Slashdot Mirror
China To Run Out of IPv4 Addresses In 830 Days
JagsLive writes "China is running out of IP addresses unless it makes the switch to IPv6. According to the China Internet Network Information Center, under the current allocation speed, China's IPv4 address resources can only meet the demand of 830 more days and if no proper measures are taken by then, new Chinese netizens will not be able to gain normal access to the Internet. Li Kai, director in charge of the IP business for CNNIC's international department, says that if a netizen wants to get access to the Internet, an IP address will be necessary to analyze the domain name and view the pages. At present, most of the networks in China use IPv4 addresses. As a basic resource for the Internet, the IPv4 addresses are limited and 80% of the final allocation IP addresses have been used."
When your WHOLE COUNTRY is behind a firewall? NAT the hell out of that! Flatten it to a /8 network in 10.0.0.0 and put it all behind one public IP. Problem solved!
Netizen is really stupid word, we really don't need more buzzwords.
I predict that we'll see China begin to use IPv6 addresses before most other people. Why?
Granted, I'm no fan of China's human rights policies. But it definitely has an advantage in terms of adopting IPv6. Hopefully, when China switches protocols, it'll catalyze the rest of the world to do so as well.
If 25 companies (are there even that many with /8s?) gave back their entire allocation, that would still only add 10% to the pool. That might buy a little time (a year, if we're at 80% and have two years left), but it's hardly going to solve the problem.
Chernobyl 'not a wildlife haven' - BBC News
NAT is not a solution. It's a huge, gigantic clusterfuck of a problem. Some people only started their careers after NAT was widespread, so they can't imagine how wonderful the world is without it. The internet is much simpler when you can assume that all nodes can directly address all other nodes.
Look: this is what we've done.
In the beginning, each endpoint of a TCP (or UDP) connection looked like this:
[octet][octet][octet][octet][16-bit port]
[(------- host-------------)(--service--)
Each octet was routed hierarchically, and the port acted as an additional level of routing within a single node.
With CIDR, the model moved to this:
[32-bit opaque address][16-bit port]
(-------host----------)(--service--)
This change didn't hurt anything, aside from an increase in router complexity. Allowed the 32-bit address space to be used much more efficiently.
Now with the IP address shortage, the situation looks like this:
[48-bit address]
(----?---------)
Note how we've lost the distinction between host and service and smushed them all together into one huge opaque number. We've caused ourself lots of problems with this:
These days, instead of saying "connect to mydomain.foo.cx", for example, you have to say "connect to mydomain.foo.cx at port 12345". That's out of band address information, and should never be needed. Imagine if DNS only gave you the first three octets an IP address, and every application requires you type in the last one in manually. That's what the world is like today!
Not a week goes by where someone doesn't trot out a new statistic on how P2P uses the vast majority of bandwidth on the internet. And you suggest NAT will be the solution to limited IP addresses.
*sigh*
stop saying "netizens".
It must have been something you assimilated. . . .
Why is everyone in the comments talking about various steps (reallocating large blocks, more widespread NAT, etc.) that would allow us to push back IPv6?
It seems that we very close to the point where every device supports IPv6 (Vista adoption is helping this) but just isn't using it. Let's start turning it on. What better way to help the adoption than by having users who are IPv6 only complaining?
-bugg
Why can't some of the owners of /8 address spaces return them back to be re-allocated?
For example, HP owns 15.0.0.0 through 16.0.0.0 (~33m ip addresses) can't they get by on just ONE class A network?
Apple owns 17/8
MIT own 18/8
US Postal Service 56/8.
http://www.iana.org/assignments/ipv4-address-space/
Do all these companies need to have ALL of their devices on publicly routable IP addresses? From a security standpoint, I would hope not. Odd since IBM, a company much larger than MIT and Apple can get by on just one /8, and I'm having trouble believing that HP requires 2 /8 networks.
We talk about making our datacenters "green" by consuming less power, there's got to be an equivalent for consuming fewer public IP addresses.
I've just finished re-IPing our datacenter (~5000 servers), not to 'release IP addresses back, but to undo the damage done by years of seemingly randomly assigning IP addresses to servers in our datacenter. Yes it's a pain, but so is any form of cleaning up your datacenter (cabling for example).
A year is a lot of time. Think how much cheaper computers/routers get in a year. That's a lot of expense saved if they can delay switching over for a year.
in a world where everything including your fridge is connected to teh interweb 24h a day, 7 days a week, we will quickly run into a situation where no more IPv4 address can be assigned to a new machine
And tell me again why my fridge will be on a public IP, rather than the 192.168.1.xxx address my Best Buy $49.99 Linksys router will give it?
Even better, explain to me why I, as Joe Sixpack will *need* my fridge on a public IP where every flaw and exploit will be passed directly to it, rather than dropped at the NAT box?
Or better still, explain why a small business with 60 users should have every last user on a public IP?
Or why a college or university needs to put every last workstation, printer, AP, and toaster on a public IP address?
NAT exists because NAT works. No, it is not the be all end all for any perceived IPv4 woes, but there is a metric assload of stuff out there with a public IP that either should be, or desperately NEEDS to be on a 10.xxx.xxx.xxx network.
There are some people that if they don't know, you can't tell 'em.
So you can connect to your fridge and see if your milk has gone off from outside your home? NAT does not give security. A firewall gives security, and most NAT devices also do firewalling. If you don't want your fridge to be accessible from anywhere outside your network, or only from a set of VPN locations, then you can easily configure your firewall to block inbound connections to it (which is likely the default anyway).
Does your small business with 60 employees want to use IP telephony? In this case, each PC (or each telephone) needs a public IP. You can get away with routing this at the application layer, but why bother when it doesn't actually gain you anything?
I am TheRaven on Soylent News
Why will white goods need to be on the internet at all?
I mean a *good* reason , not just the usual re-hashed fridge-can-reorder-beer-for-you Jetsons style drivel that is laughably spoken about as some vital function by techno evangelists.
Even better, explain to me why I, as Joe Sixpack will *need* my fridge on a public IP where every flaw and exploit will be passed directly to it, rather than dropped at the NAT box?
What you want is a firewall not a NAT. A firewall will protect you just the same and allow people to initiate communication as YOU desire.
Or better still, explain why a small business with 60 users should have every last user on a public IP?
There are quite a few examples why this is important but here's one. Why can't all students / businesses have a public IP with an exposed port for VoIP? Why do VoIP products have to have complicated NAT traversal software that doesn't always work and at the very least just adds useless overhead.
It's called a firewall. Set one up and stop spreading FUD.
I imagine they could have more than one outward-facing IP. Two would mean they have two 16-bit port numbers to choose from. That would actually be enough, given that it's doubtful they're using more than a /8 network.
Of course, I'm assuming GP wasn't joking. I don't know -- never heard of China NAT-ing.
Don't thank God, thank a doctor!
Had every router shipped since 3 or so years ago been required to have a) IPv6 support w/ stateful firewall on by default for internal hosts and b) a "turn on 6to4" button, we would have been near done already. That simple. You can do it with current routers with firmware mods and a lot of work.
"Strangers have the best candy" -Me
You have absolutely no conception just how big a number 2^128 is, do you? Every human who has ever lived could have a billion devices, each with a billion sub-components with their own public IP address. Doing that would use less than one billionth of the address space.
Chernobyl 'not a wildlife haven' - BBC News
A year is a lot of time. Think how much cheaper computers/routers get in a year. That's a lot of expense saved if they can delay switching over for a year.
Its simpler if people just started accepting that IPv6 is going to happen and adjust accordingly. For me its like having to accept Y2K was going to happen and acting accordingly. Believe me its much simpler to code the applications than go through the politics, and possibly technical issues, of getting someone to give back a block they don't appear to be using.
Get your ISP and your router manufacturer to provide you an IPv6 solution. That too is probably not easy, but if we all start making noise then they will start doing something - hopefully.
Jumpstart the tartan drive.
Sure, in the same sense that crushing an airliner into a cube makes it useless for terrorists. NAT breaks the internet, and when you break something, it's useless because it's broken.
You can filter packets with a firewall without doing any NAT at all. In fact, your life would be a lot easier without NAT. There would be no need for configuring ports. There would be no need for mapping and configuring and making and unmaking.
You'd plug things in, and they'd just work. Globally. You can allow connections to your fridge from work, or from anywhere. A firewall could do that. The fridge itself could do it. But you'd still be connecting to your fridge, and not some random port on some arbitrary gateway machine somewhere.
Going with your fridge analogy, why should it be a bad thing for a grocery store to connect to all the fridges it knows about in order to tell them about new products? Why this artificial distinction between "inbound" and "outbound" traffic?
There has been research, lots of it, and conferences and RFCs and discussion and development and testing and everything else and it led to IPv6. You seem to suggest that someone is going to come up with a magic 'new' network protocol from out of their arse, which seems unlikely. Nobody wants IPv6 because for the most part IPv4 works for them. When that stops happening there will be a shift towards IPv6 (hopefully, I can imagine there will be some horrible bodged setups that sort of work, but not on tuesdays if it's raining before then). The other issue is that people are afraid of having to remember longer numbers.
Seems to me like nobody wants IPv6.
They will - in about 831 days. It's like the idea behind Peak Oil, where instead of an instant failure one day, there will be a shift toward exponentially increasing prices. I don't know if Peak Oil will happen, but in about two years Peak IPs certainly will.
IPv6 is the working technology that we have available. There aren't any viable alternatives in the pipeline that I'm aware of, and certainly none far enough along that they'll be well-tested and ready for use in that short of a time period.
Dewey, what part of this looks like authorities should be involved?
That's a consequence of the way things have evolved, not a characteristic of the essential nature of things.
The only reason we have these NAT boxes is because ISPs didn't give each customer a whole bunch of IPs. If they had, then we'd have the same boxes, but call them firewalls.
You are trying to justify something based on its existence. That's what we call a circular argument.
From such statements does infamy arise.
How do you possibly know whether or not it might be useful to have independent addressability for orders of magnitude more devices than have it now? Have you already invented all the things that this might bring about, and pronounced them useless? What a remarkably shortsighted view.
"Patriotism is your conviction that this country is superior to all other countries because you were born in it." -- GBS
NAT is not ugly. It is actually an elegant solution. Take into the effect that most Computers are not servers, and don't need a Real IP Address. Many servers can host multiple domains with one Outside IP Address. The world population is about 6 Billion with 4 billion address available. With a proper network we can have clean Natted network for years to come on one Outside IP address for 6 people taking 1/4 of the of the addresses leaving an average of 3 servers per person which can also be natted down at a higher level of and average of 20 servers per IP Address. So we can bandaid the problem for a long time with no ill effects. Getting people to switch to IPv6 is tougher. If we were to do that we should have done it back in 1994.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
> If we all switch to ipv6 now, then everyone on the existing internet has incurred a cost,
Erm, no? Okay, so there's a cost for the sys-admin time at backbones, DNS servers, and a few other places that need to be adapted. Customers out at the edges don't need to worry about this, IPv4 will continue to work well until they're ready to upgrade.
Why does everyone see these as mutually exclusive options?
Okay, I'm a little sick of seeing this argument.
Network/port address translation is /not/ a security system. It is /not/.
A NAT box is two things: an address translation system, and a /router/. The router is just the same as any other router - if you send it a packet with a destination address that it knows how to route, it will forward it along to that destination, regardless of any NAT rules you might have in place. If you send it a packet addressed to 192.168.1.23 from the public side, and that address is routable as far as the NAT box is concerned, /it will forward it on/. I could sit on the public side of that NAT box and spam it with connection requests on common ports (443? 22? 13[789]?) - ~65000 packets could map out the contents of the NATed network without ever hitting the NAT rules. NAT would have supplied /zero/ security, even through obscurity.
In order to provide security the NAT box has to refuse to forward those packets, unless they meet one of the NAT rules. Oh, look - it's suddenly become a /firewall/.
Now change that scenario to an IPv6 router: you could indeed set it up such that anyone outside could send anything they wanted into the site network, but that would be the same as the NAT box. Alternatively, you could set it up to block incoming traffic unless it matches certain rules - a firewall, and in fact /exactly the same/ firewall as existed on the NAT box. The only difference is that the machines behind the IPv6 firewall are publically addressable, meaning that they can be used for /anything/ a public Internet host can, assuming they're granted permission by the firewall. No futzing around with DNAT and non-standard ports, just simple, reliable operation, exactly the way the Internet was originally designed.
/Now/ do you see why people keep saying that NAT has nothing to do with security? Any security you get from sitting behind a NAT box is entirely due to the firewall that is almost always implemented alongside the NAT. And /that/ can be replicated on the non-NATed network, without replicating the management headaches that NAT introduces.
</rant>
Now that I've got that off my chest, I'll concede that it's rather more difficult to get an rfc1918 address across the public Internet to your NAT box than it is to get a publically routable IPv6 address there (modulo the limited IPv6 availability, of course). That said, with the increasing prevalence of wireless networking it's becoming easier and easier, and even without that it's possible that rfc1918 addresses won't be dropped by intervening routers (ironically, increasing use of NAT will likely make that more of an issue, as companies demand the ability to route their NATed traffic across semi-public WANs). So, although there /are/ some valid arguments that NAT combined with rfc1918 addressing provides significant security benefits, they're not as great as people generally like to think, and they're a lot less reliable than a firewall which doesn't make /any/ assumptions about address routability.
himi
My very own DeCSS mirror.
It's dead easy to control, track, trace, and monitor IPv4, and even to do automatic man-in-the-middles. It is in fact so cheap that some ISP's do it just to insert advertising. IPv6 won't change anything about that.
Finally! A year of moderation! Ready for 2019?
You're likely seeing NAT'ted addresses. If there are a thousand hosts behind a NAT, it's likely that at least one of them will be infected.
These are many, many unique public IPs. From a wide variety of subnets all owned by chinanet. Yes some might be NATing more hosts behind them, but then the owner of the public IP still should be required to police the hosts on his/her network.