Slashdot Mirror
IPv6 and the Business-Case Skeptics
Julie188 writes "Experts keep screaming that the IPv4 sky is falling. Three such experts were recently asked point-blank to state an irrefutable business case for moving to IPv6 now, and their answer was more plausible than the old refrain (the lack of addresses and a yet-to-be-seen killer IPv6 app). They said that there isn't a business case. No company that is satisfied with all of its Internet services will need to move, even in the next few years. They also pointed out that Microsoft is a unique position in the industry both causing and hindering IPv6 adoption — causing through its IPv6 support in its OSes, and hindering by not extending IPv6 support into very many of its apps."
There are plenty of business cases for IPv6, you just have to ask business experts, not technology experts...
Countries like China and India, that have lots of people that might one day want to connect, but not a lot of existing infrastructure yet, and certainly not a lot of IP4 addresses, will have a far better motivation than countries that have an abundance of unused addresses.
The killer app will come, alright - just not from the US.
"Boss, I can get an IPv6 tunnel for free so that we can start experimenting and testing. We work with the Department of Defense, and they say that this stuff is important, so with your permission I'd like to spend $0 to start playing with it."
And that's how we came to be on IPv6.
Dewey, what part of this looks like authorities should be involved?
IPv6 will happen when China demands it. China's growing need for IP address space will drive the issue. China needs at least a billion IP addresses. Especially since the Chinese government would like a system where each device has a permanent IP address.
There's no business case if you don't care about growing your network. If you do, you need to care about IPv6, becuase in a few years, it's going to become increasingly difficult to get new public IPv4 addresses.
Actually, Microsoft supports IPv6 in several of its core products. IE, Outlook 2007, Windows Mail/Live Mail and Exchange 2007 support IPv6, as do many of the services in Windows 2008 (IIS, DHCPv6, DNS, POP, CIFS, LDAP, Kerberos, Remote Desktop). Some of these also have IPv6 support on Windows XP (IE, IIS, Remote Desktop, CIFS).
Moving to IPv6 means that I can't use NAT anymore for my home network.
I don't believe that's accurate. What's supposed to happen is that your ISP gives you a /64 block and you don't need NAT, but nothing says you can't use NAT if you want to (or if your ISP doesn't play nice).
192.168.1.87 -vs- fe80::e1c0:5620:bc95:3c71%9
I see your unwieldly addressing and raise you a DNS.
Besides, if you want to talk Rube Goldberg, check out IPv4's variable-length headers and the processing required to sort them out at line speed.
Dewey, what part of this looks like authorities should be involved?
Actually, Microsoft is the last company to add IPv6 support to its OSs. By the time of arrival of WinXP, most other OSs including Linux, Solaris and BSDs had it atleast for 2 years. And WinXP offered it as an optional protocol that had to be installed manually. Vista is the first version of windows to offer IPv6 in a default install.
The largest prime factor of my UID is 263267.
Moving to IPv6 means that I can't use NAT anymore for my home network.
You technically can, but there are few sane reasons for wanting to.
That means I need a block of IP addresses assigned to me. So does my telco/cable company have this set up and will it cost me a huge amount to get a block of IPs?
Correct, yes (they will), and no (it won't). I have a free /48 allocation from Hurricane Electric, giving me a home netblock of 2^80 addresses. If your ISP tries to rake you over the coals, I could probably peel off 2^64 or so of those to lend you.
Dewey, what part of this looks like authorities should be involved?
The reason no one upgrades is that the new "standard" is not simply interoperable with the old. When color TV came out you could still watch the same programming on you B/W. It is not the case with IPv6. You need new routers, new software, new DNS and to train your people. Sure Apache 2.0 and Vista work but an Apache configured just with IPv6 can not serve people on the "internet" (yea yea build a bridge yada yada yada)
Please, the spec is bad just for this reason. The simple basic requirement for new addressing scheme is that it works with existing equipment.
Time to start over with a new spec.
You can do port forwarding without NAT.
And he's wrong, nothing's preventing you from doing NAT on IPv6, except that it's probably never been implemented since it's kinda pointless.
This is a bit like saying there is no business case for doing something about climate change. Sure, I can't tell anyone that specific bits of their infrastructure are going to get wiped out by hurricanes, or that particular segments of their markets are going to be bankrupted and / or drowned by rising sea levels, but that doesn't mean it's not a good idea.
Similarly, I can't forecast what the oil price is going to do, whether it will be higher or lower in 12 months time than it is now. I don't know when we will hit peak oil, or if we've hit it already, and I don't know the exact consequences of that. But that certainly doesn't mean that looking at ways of reducing energy requirements, and alternative sources for them, isn't a good idea.
I can't say what will happen as IPv4 address scarcity hits. Will people be denied allocations outright? I doubt it. Will small blocks of addresses in random parts of the address space be auctioned to the highest bidders? Seems more likely. Will dealing with the huge routing tables caused by all those disconnected little blocks put stress on routers, causing reliability issues and more money to be spent on upgrades? Quite possibly. Will we see people rolling out multiple layers of NAT, and all sorts of ugly application-helpers? Probably. Will it be reliable? I doubt it.
Times are hard economically now, and as a result people pull their horns in and look for hard, specific reasons to justify effort and expenditure, particularly immediate, short-term reasons. But short-termism got us into the current (economic) mess in the first place. Step back, look at the big picture. Yes, it's fuzzy. That doesn't mean there aren't obvious trends, obvious problems -- and also some reasonably obvious, big-picture solutions.
long ip addresses? /48 block, which is 12 digits long (2001:4200:24AB::/48), similar in length to an ipv4 address. You could then number your devices sequentially
Your isp should give you a
2001:4200:24AB::1/64
2001:4200:24AB::2/64
2001:4200:24AB::3/64
What's so hard to remember about that?
Correction: they're a tech on a tiny network where they're used to memorizing the DNS zones. At this very moment, I'm not sure I can tell you the IP of the webserver I work on most often - not because I never access it, but because I've been accessing it via DNS for the last five years and have never once in that time needed to connect via IP.
So you've never needed to troubleshoot a network problem. Good for you.
Your assumption that anyone who needs to know an IP address must be working with a tiny, memorizable DNS zone is completely false. Like I said, DNS is something that can break. For example, where I work, our dynamic DNS is broken, and the server team refuses to work on the problem (or delete bad entries...). So, when I want to work on one of my user's machines remotely, I sometimes need to find out from the user what their IP address is. Now, I don't know about you, but I'd much rather deal with repeating "192.168.1.87" over the phone than "fe80::e1c0:5620:bc95:3c71%9" (to use the previous example).
And what if you suspect the name servers are down, but want to be sure that they are, indeed, the problem? Boy, it would sure be nice to have a nice, easy IPv4 address memorized for testing, than a long, unwieldy IPv6 address.
Your lack of ability to imagine situations where knowing IP addresses is useful does not mean that they don't exist.
"16MB (fuck off, MiB fascists)" - The Mighty Buzzard
Network architects and admins with clue are currently at the "Depression" stage (4th stage).
Why Slashdot feels that putting up a commentary authored by someone who's still in the first stage ("Denial") is useful to anyone is beyond me.
IPv4 exhaustion is coming. CIDR got us from the mid-90s until now. But it's coming now. Please stop denying, being angry, trying to bargain it away. Hopefully we'll all move past depression into acceptance (as vendors and infrastructure gets ready) before it hits. But I know a lot of smart people who would prefer to retire in the next 2 years instead of be there when it hits.
They probably won't, but would like to...
Even if you said "Here, have a /8 completely free, use whatever you like," they'd still want to do NAT. Why? Privacy and security. NAT automatically gives a good measure of security. You have an inbound firewall by default, simply because of how it works. You have to explicitly set up any inbound ports to be forwarded. Also this means that to get to any system that doesn't have a forwarded port, you'll have to get access to a system that does. With public IPs, there is always the possibility that the firewall fails or is shut off and you can get at a system. With NAT, you have to get inside to be able to get at anything.
Privacy you also get just by the way NAT works. Since you have many people using a few (or one) IP addresses, it is much harder to track what any given computer is doing. Web browsing can be tracked with things like cookies (if the client accepts them) but over all you really can't tell what is going on for a given system inside the network.
So NAT is something companies may well want to keep doing, even if they don't have to.
IPv11!
A horse can't be sick, you know, even if he wants to.
This is a bit like saying there is no business case for doing something about climate change. ...
Oh, no! Now we have a Global Warming take on IPv6 adoption!
I think it's time for a new version of Godwin's law with Global Warming / Climate Change substituted for NAZIs:
As a scientific, technological, or political discussion or grant proposal grows longer, the probability of an assertion of a tie-in to climate change approaches one.
= = =
I realize you may have had a serious point. But (like NAZI analogies) the global warming tie-in has been used so often, and so inappropriately, that it's painful to read past it to search for any real meat in such a posting.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
So until then they won't be pushing IPv6 although it is available and even supported for the curious and brave.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Repeat it until it sinks in. In some cases it is possible to tunnel through NAT routers. And there are several attacks that do not depend on the victim having a public IP address. If you want security, use a firewall, anti-virus and anti-spyware technology.
The cost of having (probably) Cisco write custom firmware for all their equipment, and the cost of maintaining that custom firmware. It's possible to get the routers to handle a /128 assignment, but you're fighting the equipment the whole way. And it fails to work with Windows, whose IPv6 stack assumes that IPv6 stateless autoconfig works properly and doesn't play well with routers that refuse to accept the stack's use of it's own MAC-address-based value in the lower 64 bits. Again this can be worked around, but it takes a lot of heavy messing-about in low-level configuration to make it all work right. And how many ISPs are going to tell their customers that the ISP doesn't support Windows?
Lucky you. There's not a system on my home network that can be reliably accessed through anything but the IP address. I've experienced the same reliability on every network I've ever touched.
Now internet-wide DNS is pretty damn solid, but that tends to happen when there are about seven levels of fall-back. LANs tend not to be nearly that robust.
Having said that, IPv6 addresses are stupidly over-complicated. Adding two groups onto IPv4 would probably have been more than enough for quite a number of years to come (281,474,976,710,656 IPs should be plenty for a while), even if it's not quite as futureproof as IPv6 which is something like 1 IP for every four atoms in the universe.
How are sites slashdotted when nobody reads TFAs?
...In _one_ customer deployment We're deploying 1.7 million devices over 1200 mobile subnetworks in under 18 months. Each device needs to be capable of self addressing and migrating from subnetwork to subnetwork subject to the local RF conditions.
These devices need to be uniquely addressable from existing Unix hosts, as well as capable of being monitored from current Enterprise Network Element Managers.
We've further hypothesized that by 2012 as many as fifty of these networks will be in existence, each of which may need to have all their nodes addressable by multiple vendors.
There is your business case for IPV6.
Ironically, internally, in our company, and on all of our servers - we are 100% split stack. No desire whatsoever to run IPV6 pure environments. NAT does everything we need. Don't even run IPV6 on our IPSEC Remote Access VPN or 802.11 environment.
- Any Day above Ground is a good Day (Michael Rich, 1997)
In the v4 Internet, multicast exists but is usually disabled (except U-Verse).
In the v6 Internet, multicast will exist but be disabled (except maybe U-Verse).
So what do I do if I've only got a /64 from my ISP but I want to segregate unsecured wireless, secured wireless, and wired? I think it would be in Cisco's (and Microsoft's) best interest to have a solution for that use case, which would naturally translate into a solution for the ISPs. What's more, if some big ISP like AT&T or Verizon is pushing for it, I have little doubt that Cisco would comply.
With public IPs, there is always the possibility that the firewall fails or is shut off and you can get at a system. With NAT, you have to get inside to be able to get at anything.
In that sense, it's also always possible that the NAT gets shut off -- thus implying that a handful of computers on your network have live Internet IP addresses, and the rest are denied DHCP access -- or it's possible that it fails, as is the case with things like NAT hole punching.
Privacy you also get just by the way NAT works. Since you have many people using a few (or one) IP addresses, it is much harder to track what any given computer is doing.
An anonymizer may make sense for an individual behind the NAT, but I doubt it helps the corporation at all. In fact, if I get a ton of spam, and I send mail to your domain saying "It's from <IP>", wouldn't you rather know exactly which computer that IP corresponds to, so you can shut it down?
Since the corporation has no real reason to provide that privacy, why should it be their obligation?
Don't thank God, thank a doctor!
I agree with the person who said elsewhere that NAT solves this problem much more neatly than IPv6. How many routable addresses do you really need, even at the biggest companies? It surely can't be that many (1000, tops?), and for the rest, you can use the 10.0.0.0 block, and use NAT. I can't imagine that having 16 million addresses for your internal network wouldn't be sufficient.
That's what I feel is the important take away from this. the big Telcom guys might need it, but little ole me on this desktop in my house can care less. My ISP might need my router to be IPv6 compatible so they can interface with many more clients. Maybe my Cel Phone will need it in the future? But from behind a router, I'm always going to run IPV4 inside my networks because they're easier to understand and IPv6 doesn't give me any additional benefit when my 10.6 network is "all that I'll ever need." Right?