Slashdot Mirror
IPv4 Address Crunch In 2 Years, IPv6 Not Ready
An anonymous reader writes "We've known for ages that IPv4 was going to run out of addresses — now, it's happening. IPv6 was going to save us — it isn't. The upcoming crisis will hit, perhaps as soon as 2010, but nobody can agree on what to do. The three options are all pretty scary. This article covers the background, and links to a presentation by Randy Bush (PDF) that shows the reality of the problem in stark detail."
It's not hard to figure out why we haven't solved this problem. It costs MORE to fix it now than it does to wait.
So just wait until it costs more to live with IPv4 than to migrate to new systems. Then EVERYONE will be working on a solution.
To hand over the bazillion address they have lock away. Problem solved for a few more years.
People will move and applications will get ported to IPv6, but only when they HAVE To move to IPv6 OR when there is some benefit that outweighs the cost.
Simple.
Why? Your money is why.
/8s and /16s de-aggregate into 100s of thousands of individual prefixes. Is there any Cisco router right now that can handle a BGP IPv4 routing table of 2 million entries? Are you willing to scrap your entire Border Router investment in 2010 when the routing table grows from 300,000 routes to 750,000 routes? Do you know what the cost of a Cisco CRS-1 is, even if you can find one used?
If you want to continue to use an IPv4 address from your upstream ISP, you currently pay about US$10 per month for that address, more if you want a nice static address to run services on.
After 2012, or if one of the hair-brained free-market schemes to buy & sell netblocks comes into effect, the price your ISP has to pay for an IP address goes from ZERO to $10 or $20 per month per address. Currently, with a freely available pool of IP addresses, there was minimal cost associated with obtaining a netblock, just some administrative overhead to ask, and some technical cost to program the routers. ISPs discovered that they could charge US$30/month to a user, of which $10/month covers bandwidth, $10/month for the connection, and the remaining $10/month is the pure profit from renting you an individually addressable IP address.
When the crunch hits, IPv4 addresses will be accounted differently, no longer will they be seen as a free resource that earns $10/month, they'll be seen as a cost center that needs to have a margin associated with it. So if the company has to start paying even $1/month per address, they'll pass that cost on to the end users as a higher monthly fee.
In the end, those who don't have an IPv6 service with a migration strategy will see their internet connectivity increase in price. Maybe only a little in 2010, more in 2012, and if there isn't a mass migration to v6, significant costs after that. You, and every consumer, better hope that ISPs and hosting centers get a migration strategy in place soon, or your costs are going to skyrocket.
That was costs from the consumer PoV.
From the techie PoV, imagine what will happen to your router FIBs if some of those nicely aggregated
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
Sure, but that's because you control the NAT and can forward ports, so you can still accept incoming connections. If your public IP address (i.e. what other torrent clients will try to connect to) is controlled by your ISP, you're going to have a hard time getting them to forward the ports you need to you. In fact, they would have a hard time providing this service in a usable and cost-effective manner, even if they wanted to.
Also, there's a good chance OpenBSD + PF is more accommodating of various protocols than an ISP's oversubscribed NAT gateway is likely to be. Even if they do their best, it can still get in the way. For example most gateways can handle FTP by watching for "PORT" or "PASV" messages and dynamically opening/forwarding the requested port (or rewriting it to use the port it wants), but this doesn't work if your FTP session is encrypted.
Finally, a lot of the ISPs seem to be actively discouraging P2P, and will simply use "no more IP addresses" as an excuse to slap in NAT gateways that restrict people to web and email. If you want "raw internet", then you'll have to pay.
With any luck there'll still be enough competition in the ISP space in 2010 to push the rollout of IPv6 onwards. A lot of the big ISPs will probably resist it, as a) it would cost a lot to upgrade and re-engineer their infrastructure to support it and b) they can make lots of money by charging a massive premium for routeable IPs. Not to mention that the media cartels will probably have convinced most people and politicians that the only reason one would want "raw internet access" is for piracy, child porn, and terrorism.
NAT is a really, really bad solution. It creates two classes of internet user: those that may run servers, and those that may not; a second-rank type of internet citizen, so to speak.
Do you really want to live in world where you can only connect to the servers of your corporate overlords? Wasn't the internet supposed to be offering equal opportunity for everyone?
I'm not saying NAT is the best solution, or even the right long term solution, just that I think it could be used (fairly successfully) in many more places while we get our collective asses in gear and go IPv6.
I foresee a - perhaps shortlived - opening for lots of filesharing.
I'm sorry if I haven't offended anyone
First, pull the plug on all those AdSense garbage and "Domain Parking" sites. That'll free up a bunch.
Most of the stuff on
The logical way to go would have been to switch to IPv6 for everything in the core of the internet, working out to the edges, so that IPv4 was routed over an IPv6 network, without requiring anyone at the end points to change... IPv4 packets would be turned into IPv6 packets in the IPv4 subset of the IPv6 address space when they left the IPv4 endpoints, and then turned back to IPv4 if the destination didn't support IPv6. To access IPv6 resources you'd need a gateway that did both DNS and NATting, so your IPv4 lookup for an A record would be handled as a lookup for an AAAA record, and then a private IPv4 address would be assigned to that IPv6 address for you, and a fake A record comes back.
For many purposes proxy gateways would work just fine, with increasingly many programs supporting HTTP proxies for connectivity.
Why didn't this happen?
That said, an alternative that is definitively possible is for ISP's to start NAT'ing everyone by default and handing out public addresses only to customers who ask. Most people would never know the difference, and frankly for many of them it'd improve security (slightly, at least).
Another alternative is for them to give out v6 addresses, hand out routers with dual stacks to their customers and do NAT style translation to public IPv4 space combined with giving v4 addresses to customers that ask.
I depend on having a public IP, but if my ISP put something like either of those two alternatives in place I'd be perfectly happy with it. Even if they'd charge me a nominal amount.
And that might be a good idea for IP space in general: Charge a small fee per usable IPv4 address allocated from the RIR's. If you pay say $1 per IP address it doesn't matter much for a small business, but it will make a difference to the people holding on to huge chunks of IPv4 space where most of it either is unused or could be switched to local NAT'd addresses. Allocate the funds raised to IPv6 transition projects that anyone can apply for if they give up a certain percentage of their IPv4 space.
> ... it'll be IPv6 or nothing.
The problem is that this is simply not true. Most people can continue with IPv4 under NAT until the first IPv6 big site arrives. But, nobody's going to be that first guy.
No one wants to run a publicly available site on an IPv6 address, as that would create problems, but the client side is easy to convert, as long is there is incentive. Few customers of major consumer ISPs need real IPv4 addresses, so most ISPs can run their networks on IPv6 and require their customers to have IPv6 enabled (XP, Vista, OS X and Linux can all do this). This would free a lot of IP addresses.
Clearly the market is not embracing this solution, partly because they don't want to force their customers into a transition, but also partly because the market is based upon the cost of procurement, rather than on future availability. Procurement has been cheap up until now. It's the same reason that gas is only about $3.00 a gallon (yes, I said only), despite the anticipated future scarcity. So there are three options:
It would also be nice to see some financially independent and influential non-profit organizations make the switch, like major Ivy League universities. They're the ones who should really be leading this because they don't have the profit motive that makes businesses shy away from what appears to be a set of risky changes.
Anybody can use Linux for routing, or if they need something better, they use Cisco.
Both support IPv6.
When IPv4 runs critically short of addresses, give people a NAT'd IPv4 address and a real IPv6 address.
They can switch to IPv6 if they want/need to, and they won't have a leg to stand on if they don't like it.
Just because it CAN be done, doesn't mean it should!
There are plenty of IPv4 addresses to go around. It's just that they're literally priceless. With no price for an IP address or the routing that goes with it, there's no market. So surprise surprise, there's a shortage!
Why don't people listen to us economists when we tell you how to solve your problems? There's plenty of evidence for what happens when you DON'T listen to us.
Don't piss off The Angry Economist
This already exists, I have to pay $20 extra for my 2 statics. And looking at my firewall logs, NAT for your average user is not a bad idea. Don't worry, P2P will find a way to deal with it. But does offer the ISP ways of cutting down abuse from careless PC Internet users.
But do also agree with the flip side, I am sure ISPs will find a way to screw customers.
"At least NAT forces organizations to manage their internal address space and keeps some of the routing burden off our backbone. It also provides some extra security by keeping all those soft targets (client workstations) off the big bad Internet, even when people make a mess of their firewall."
NAT is a causes more headaches than it solves. For corporate clients that you don't want on the internet, firewalls which are no less complicated to configure than any NAT setup, can be used. It would takes less configuration and less processing power to do plain SPI with public addresses than do NAT + SPI.
Now think about that fact that IPV6 bumps up the address space 2^96 times. Imagine the burden that will place on routing tables.
Current routing hardware can handle it just fine.
Without very careful consideration IPV6 could knock the Internet back a decade
You speak as if that would be a bad thing. A decade ago, the internet was made up of peers. Today it's come to the point where a select few actually participate and the rest are only allowed to consume. Everyone being able to participate in the internet again would indeed set the internet back a decade.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
NAT is *the* *wrong* solution.
... your NAT! And the NAT is not tracked 99% of the time. So, the compromised box on your site cannot be easily discovered without packet sniffing.
Public IP addresses make it simple to have *proper* routing tables.
There is also the ability to track users easily. Imagine you have one of your computers compromised. The computer is then used to control another box that controls another one that drives some botnet. If you have a NAT, the 3rd party that discovered their box compromised will trace it back to
Or an employee is involved in something illegal. The 3rd party produces their logs that list your NAT as the source of the problem. Which computer was used in that activity? You are stuck with tracing the stuff though screen loggers and other invasive BS just because NAT has to exist.
NAT is the wrong solution because of liability. NAT is wrong solution from routing point of view. NAT is wrong solution from technical point of view. IPv4 would have been replaced years ago if it wasn't or stupid NAT gateways everyone has now. Yeah, these will be obsolete with IPv6.
When I left school I thought NAT was the greatest thing in the world aside from sliced bread. Then real world experience forces you to realize that maybe the university usage of public IP on its internal network wasn't such a stupid thing after all. Public IP should be assigned to ALL devices, and then you can use a statefull firewall to protect these assets. Private IP networks should NEVER be connected to public IP networks - let's hope that dies with IPv4. The sooner the better.
First of all, break up the "LEGACY" Class-A allocations. http://www.iana.org/assignments/ipv4-address-space. That'll free up a bunch.
All of the following companies have a full 16.7 Million addresses assigned to them. Level 3 might use theirs, (they actually have 2 blocks), but Halliburton? DEC? Amateur Radio Digital Communications? Do they all really need more than 16 million IP addresses?
This short list accounts for 654 million IP addresses -- over 15% of the address space.
"With sufficient thrust, pigs fly just fine. However, this is not necessarily a good idea...."
RFC 1925
Who modded this "Insightful"? You CAN forward ports to multiple servers, easily. There's plenty of equipment to do that.
Any half-decent load-balancer is minimally L7-aware, to the point of being able to send specific hostnames in HTTP requests to specific servers (or server groups). The ones I primarily use go to the point of allowing me to distribute traffic based on arbitrary headers, cookies, URIs, you name it. Plenty of sites and distinct server farms behind a single public IP address.