IPv6 Challenges and Opportunities

1sockchuck writes "Opinions differ on when the Internet will run out of IPv4 addresses, prompting a wholesale transition to IPv6. In recent videos, John Curran of ARIN provides an overview of issues involved in the IPv6 transition, while Martin Levy of Hurricane Electric discusses his company's view that early-mover status on IPv6 readiness can be a competitive advantage for service providers. Levy's company has published an IPv4 DeathWatch app for the iPhone to raise awareness of the transition."

Comments

corpspeak to english dictionary

[DaveV1.0]

According to my copy of the CorpSpeak to English dictionary "challenge" and "opportunity" both say "See 'problem'."

Re:corpspeak to english dictionary

[eln]

According to my copy of the CorpSpeak to English dictionary "challenge" and "opportunity" both say "See 'problem'."

Yes, but there are subtle differences. For example, when they speak of challenges, your corporate overlords are telling you there will be massive layoffs soon. However, when they speak to you of opportunities, it means you personally will be laid off immediately.

marketing speak = teh suck

[Em Emalb]

"Challenges" means problems. "Opportunity" = cool features.

Features of IPv6:

Every known star in our universe can now have 252 ip addresses with ver6.

My frigging socks can tell me they need to be cleaned via a script. My shoes can use GPS to track where I'm going, how many miles I walked/ran that day, etc.

Problems of IPv6: Screw it, we'll just nat our existing IPv4 addresses.

Re:marketing speak = teh suck

[BobMcD]

This, this, o-this-ily-this!

Also I think proponents of IPv6 also tend to overlook the value of DNS. Human short-term memory only has so much space in it. IPv4 addresses tend to be hard to memorize, ergo DNS puts an easy handle on it.

In an IPv6 world you get this memory problem magnified in a huge way:

1) The addresses are now ridiculously long.

2) There's not supposed to be any such thing as NAT (which also means your practice of always having your inside router be x.1 now gets more complex)

3) Many things that don't REALLY need addresses are now going to get them, because we have so many, so lets just go crazy.

To recap, many minor devices will all have a very-long, unique address, and each will be difficult to fit into brain-space alone, let alone together.

This scenario only works in a fully-DHCP world, which is fine for some, but I'll keep my static IPv4 for as long as possible, thanks.

Re:marketing speak = teh suck

[Anonymous Coward]

Problems of IPv6: Screw it, we'll just nat our existing IPv4 addresses.

Between NAT and UPnP (I know it's a dirty word) there just isn't an immediate need for mountains of public 'Net addresses any time soon.
You'll probably start seeing ISPs NAT users instead of giving them a public IP. Considering 90% of their user-base has no need for a public IP (plus, it's another way to get an extra $10/month from those pesky "power users").

Re:marketing speak = teh suck

[chrylis]

Are you familiar with how IPv6 actually works? Yes, addresses are now very long--good thing that DNS works with IPv6. (The failure of most implementations to support A6 records is a shame, but AAAA does the job fairly well.) You can still have your "inside router" be :1 if you like, and hey, why not give everything an address--what's the downside?

Re:marketing speak = teh suck

[mikael_j]

I'm not sure I'm following you here, so what you're saying is that instead of Joe Q. Sysadmin always having his internal router be 10.0.0.1 and all the hosts having 10.x.x.x IPs tied to hostnames he'd have something like 2001:1001:f00f::1 as the router and all hosts would be in the same subnet? Yeah, that's really scary and confusing...

Also, NAT is an ugly hack that doesn't really need to exist, the packet filtering can be handled with a plain old packet filtering firewall just like it used to be done prior to everyone using NAT and what exactly is the point of address translation? Isn't that like going back to pre-IP days when every network seemed to use its own protocol (or in this case, everyone uses local addresses internally and a single or small number of external addresses) and inter-network communication was a PITA?

And I'd rather see devices that don't need public addresses getting them than "The amazing NAT future" where you have to pay big bucks to get a public IP address instead of being stuck in NAT hell (first they came for the residential connections, but I did not speak up because I wasn't running a home server or playing games, then they came for the small business DSL customers but I did not speak up for I was not running a small business and finally they came for the corporate customers and we ended up paying thousands of dollars per server to avoid getting thrown off the 'net)...

/Mikael

Re:marketing speak = teh suck

[Anonymous Coward]

It would really be cool if they did away with DNS after switching over to IP v6.

Re:marketing speak = teh suck

[BobMcD]

It would really be cool if they did away with DNS after switching over to IP v6.

Precisely.

Re:marketing speak = teh suck

[BobMcD]

You can still have your "inside router" be :1 if you like

You seem to be assuming a non-shared address space. Do you work for IBM?

Re:marketing speak = teh suck

[swamp boy]

Hmmm.... Every known star in the universe with it's own ip address. Now I think that the promise of cloud computing is finally starting to dawn on me!

Re:marketing speak = teh suck

[csnydermvpsoft]

Also I think proponents of IPv6 also tend to overlook the value of DNS.

1) The addresses are now ridiculously long.

I'm confused - first you say that IPv6 proponents "overlook" the value of DNS, meaning that they don't understand its significance. Perhaps you meant to say the opposite - "overstate," perhaps?

2) There's not supposed to be any such thing as NAT (which also means your practice of always having your inside router be x.1 now gets more complex)

Why would this have to be any different? Instead of getting a single or small block of IPs from your ISP, you'll get an entire subnet (or two, or 256). You can keep your router at .1 (or :1) if you'd like.

3) Many things that don't REALLY need addresses are now going to get them, because we have so many, so lets just go crazy.

While it opens up the opportunity to give more devices their own addresses, it doesn't require it. If you're like me and you don't want your fridge to have an IP address, then don't buy a network-capable fridge. However, for those that want networked fridges (or companies that want a large network of sensors in their factory without having to deal with private IP routing hell), they'll have the option.

To recap, many minor devices will all have a very-long, unique address, and each will be difficult to fit into brain-space alone, let alone together. This scenario only works in a fully-DHCP world, which is fine for some, but I'll keep my static IPv4 for as long as possible, thanks.

I'm confused - how does DHCP help us to not have to remember IP addresses? As discussed above, that's the job of DNS. If anything, DHCP makes it a bit harder, since then dynamic DNS is usually required as well.

It is true that IPv6 was not designed with old-school networking geeks in mind - I share your concern about IPv6 addresses being difficult to remember. However, it will be a huge help for actual (non-amateur) network admins, as well as home users (where autoconfiguration will make everything as seamless - if not moreso - than it is now).

Re:marketing speak = teh suck

[BobMcD]

You're separating the issues, because they're are trivial alone. That's understandable. That isn't what I'm driving at.

When you combine 'everything with an address' with 'NAT needs to die', then 'Joe Q. Sysadmin' will not be allowed to select his own IP addresses. Without an assigned and shared address space, these notions are incompatible.

Do you follow now?

Anyway, the point was, how do you go about memorizing them?

Re:marketing speak = teh suck

[chrylis]

What do you mean by "non-shared"? When you get an IPv6 connection, they don't hand you a single IP address; you get a /64 or a /48, depending on the connection type.

Re:marketing speak = teh suck

[jonbryce]

If I wanted to network my socks, I could do so at the moment with a VPN. I'm not going to want them to be publically routable anyway.

You can get things that track where you are going, and how many miles you've walked / run etc. They don't even need an internet connection, never mind a publically routable one.

Re:marketing speak = teh suck

[chrylis]

The point was, you don't go about memorizing them, you use DNS.

And why exactly (1) does 'Joe Q. Sysadmin' need to select his own IP addresses and (2) can't he with IPv6? I can't just decide to give my server the address 127.48.7.12 or 234.122.9.31 with IPv4, but that doesn't mean that I can't assign one within my address range.

Re:marketing speak = teh suck

[Anonymous Coward]

There are also security issues with IPv6. IPv6 has not seen actual testing against black hats yet. Which means you have to deal with another wave of malformed packet attacks, like land, teardrop, smurf, ping of death, and the ones which hit IPv4 stacks hard. It won't be long before someone finds a way to overrun some popular operating system's IPv6 stack and is able to execute code without even needing a service to attach to.

Not to mention that IPv6 has no security whatsoever in its design. Any form of encryption is either a bolt on, or goes on a higher layer, such as how SSL and SSH ride on top of TCP. On the IP layer, there isn't any standard form of encryption.

Of course, we all know about IPv6 and NATs. If you want to hide your internal network, you put it on IPv4. Which means on a "pure" IPv6 network an attacker can easily nmap every single box on your private network, then start running targeted attacks against every single thing, from the router with the last year's firmware to the Linux box that wasn't patched in six months. No sane sysadmin is going to allow anyone on the Internet be able to grab their network topology.

IPv6 was thought out by people who have -zero- clue about security and the scumbags that IT people battle against on a daily basis. If the Internet was the sterile, managed environment of the late 1980s, sure, IPv6 would be perfect. But most businesses have to fight hourly against intruders across the globe looking for the one weak appliance or router.

Leave IPv6 for the ivory towers. I value my business's data and going to be sticking with V4 until someone addresses the security concerns of IPv6, or just ditches the stupid thing for a protocol that has actual security in its design.

Re:marketing speak = teh suck

[chrylis]

or companies that want a large network of sensors in their factory without having to deal with private IP routing hell

Exactly the reason that a current customer of mine is rolling out IPv6 across the national enterprise. With a little help from ptrtd, troubleshooting at corporate headquarters can even talk specifically to equipment that doesn't speak IPv4.

It is true that IPv6 was not designed with old-school networking geeks in mind - I share your concern about IPv6 addresses being difficult to remember.

Please explain what you mean; I've found that IPv6 networking tends mostly to eliminate the nightmarish hassles that IPv4 had (classful addressing FTW), and remembering addresses isn't hard once you get used to the scheme. You have a 48-bit prefix that you simply know (and that always starts with 2001:), you have 16 subnet bits that you can organize in a meaningful and standardized way, and the 64 host bits... if you need to connect without DNS, assign a static short address.

Re:marketing speak = teh suck

[BobMcD]

I'm confused - first you say that IPv6 proponents "overlook" the value of DNS, meaning that they don't understand its significance. Perhaps you meant to say the opposite - "overstate," perhaps?

Dotted addresses suck, ergo DNS. Longer dotted addresses will suck even more. Good thing we still have DNS.

Clearer now?

Why would this have to be any different? Instead of getting a single or small block of IPs from your ISP, you'll get an entire subnet (or two, or 256). You can keep your router at .1 (or :1) if you'd like.

It won't shake out this way. ISP's aren't giving you that many addresses now, and many (if not all) limit and/or upcharge-for the quantity assigned. It isn't difficult to imagine scenarios where is doesn't matter, to be sure, but this kind of convenience is something that NAT has allowed us to take for granted.

While it opens up the opportunity to give more devices their own addresses, it doesn't require it. If you're like me and you don't want your fridge to have an IP address, then don't buy a network-capable fridge. However, for those that want networked fridges (or companies that want a large network of sensors in their factory without having to deal with private IP routing hell), they'll have the option.

I'm thinking about what DirectTV here. These kinds of devices get to become subscription-based. The monetizing options for networked smart devices will be very tempting. Yes, refrigerators are a strange example, but is it really that difficult to come up with a better one on your own?

I'm confused - how does DHCP help us to not have to remember IP addresses? As discussed above, that's the job of DNS. If anything, DHCP makes it a bit harder, since then dynamic DNS is usually required as well.

You're being pedantic now. Does not DHCP carry with it settings as to which your DNS server is, what the gateway is, etc? You're referring to 'non-ameteur' admins with a voice of authority, yet you cannot avoid being confused over how DHCP allows you to set these addresses once instead of many times over?

It is true that IPv6 was not designed with old-school networking geeks in mind - I share your concern about IPv6 addresses being difficult to remember. However, it will be a huge help for actual (non-amateur) network admins, as well as home users (where autoconfiguration will make everything as seamless - if not moreso - than it is now).

In my view, it creates more problems than it solves. Certain people support it because it is 'new' and 'old' automatically means 'bad'. Unfortunately, those are the only IPv6 supporters that seem to post on slashdot. That's okay, but it gets rather old, rather quickly.

Re:marketing speak = teh suck

[fava]

Yea, but the latency will kill you.

Re:marketing speak = teh suck

[maxume]

Please expand your description of the group that your last paragraph excludes, I'm curious.

Re:marketing speak = teh suck

[BobMcD]

What enforcement of subnetting recommendations are going to be in place to ensure this happens?

ISP's monetize these addresses now. Who will force them to stop?

Re:marketing speak = teh suck

[BobMcD]

I can't just decide to give my server the address 127.48.7.12 or 234.122.9.31 with IPv4, but that doesn't mean that I can't assign one within my address range.

Using NAT, you absolutely can. You're sacrificing the ability to communicate with those addresses in the wild, but that option definitely exists today.

And why exactly (1) does 'Joe Q. Sysadmin' need to select his own IP addresses and (2) can't he with IPv6?

He doesn't need to. He may want to. He has that option today.

I don't operate under the assumption that ISP's are going to hand out blocks of IPv6 addresses any more readily than they hand out IPv4's. I understand that others do. I'm not sure why they do, but since it is a futuristic sort of thing, we'll just have to wait and see. Looking at their past and present behavior, anticipating charity is dubious at best. In fact, NAT rose to popularity out of this exact same behavior. Not out of some ephemeral need to create more address space.

Re:marketing speak = teh suck

[chrylis]

It won't shake out this way. ISP's aren't giving you that many addresses now, and many (if not all) limit and/or upcharge-for the quantity assigned. It isn't difficult to imagine scenarios where is doesn't matter, to be sure, but this kind of convenience is something that NAT has allowed us to take for granted.

I believe that the registries are requiring the provision of /64s and /48s to end-user connections. Even if they weren't, the ISPs would provide at minimum /64s, since most networking equipment can't handle routing prefixes longer than /64 in hardware--i.e., routing anything longer than /64 is more expensive.

You're referring to 'non-ameteur' admins with a voice of authority, yet you cannot avoid being confused over how DHCP allows you to set these addresses once instead of many times over?

IPv6 isn't IPv4. You can use stateless autoconfiguration to find that router, no DHCP needed. The advertisement can also include information on DNS servers. If the DNS servers and default gateway aren't sufficient, you can still run DHCPv6 if you like.

Re:marketing speak = teh suck

[value_added]

The point was, you don't go about memorizing them, you use DNS.

LOL. And network admins, those who are tasked with setting up and maintaining DNS, or those just doing occasional reverse lookups, do their heads just explode?

In the real world, people use IP numbers in a number of different ways, and for just as many reasons, have committed many to memory. You don't have to be a network admin, for example, to know what is behind 192.168.1.1, or that 4.2.2.1 is open for lookups.

This doesn't mean it's impossible to do the same or something similar with IPv6, of course, just that certain complaints about the complexity/awkwardness do have merit.

Re:marketing speak = teh suck

[chrisG23]

Competition. If ISP A is only going to give you 1 IP address because they want to hoard and monetize these IPv6 Addresses, then ISP B is going to offer you oh, 16 million IPs lets say, for the same price, to get you to come to them. 16 million? Thats an insane amount you say, well the ISP can just pull it out of their bucket of gazillions of IP addresses that is their slice of the FUCKING HUGE BEYOND COMPREHENSION IPv6 address space.

Re:marketing speak = teh suck

[BobMcD]

That same competition exists under IPv4.

Re:marketing speak = teh suck

[Dog-Cow]

Where the fuck do you live where you have more than 2 viable choices for an ISP?

What universe do you live in where the "competition" would realistically compete on this feature?

Re:marketing speak = teh suck

[Anonymous Struct]

Just as soon as companies figure out how to monetize scriptable socks, we are going to see some serious IPv6 action.

Re:marketing speak = teh suck

[mikael_j]

He doesn't need to. He may want to. He has that option today.

You can assign IPv6 addresses manually to your heart's content as long as you have a block assigned to you, but for client machines there is rarely a reason to do this (just like how you normally don't go about handing out static IPs to every workstation, you set up a DHCP server (or many depending on the size of your organisation) and hand out dynamic addresses to most machines).

/Mikael

Re:marketing speak = teh suck

[Ares]

Which means on a "pure" IPv6 network with no firewall controls in place at the router an attacker can easily nmap every single box on your private network, then start running targeted attacks against every single thing

FTFY

ipv6 routers will be no different than their ipv4 counterparts now, except that the concept of nat will be eliminated. you will still have to allow specific services through to specific machines from the wan side. you'll just be able to allow more machines to have more services with ipv6, since multiple machines will be able to be presented to the outside world on port 80, port 443, or port 25.

Re:marketing speak = teh suck

[mikael_j]

No it doesn't, at best there are 4,294,967,296 available IPv4 addresses, in reality there aren't nearly as many since the entire network isn't one huge subnet. With IPv6 there are 3.4*10^38 addresses. There is no real competition in terms of "we give you your own class C" vs "We give you one address" when it comes to IPv4 because most ISPs can't actually hand out addresses like they're candy. With IPv6 an ISP would have no problem whatsoever handing out a /64 to each customer since they'll have a shitload of /64s to hand out.

/Mikael

Re:marketing speak = teh suck

[Anonymous Coward]

I wish I had mod points for you....

Re:marketing speak = teh suck

[silanea]

Not to mention that IPv6 has no security whatsoever in its design. Any form of encryption is either a bolt on, or goes on a higher layer, such as how SSL and SSH ride on top of TCP. On the IP layer, there isn't any standard form of encryption.

Not trying to troll, but what do you need encryption on such a low layer for? I prefer managing this on the protocol or application layer so I can always use the appropriate level and form of encryption.

Of course, we all know about IPv6 and NATs. If you want to hide your internal network, you put it on IPv4. Which means on a "pure" IPv6 network an attacker can easily nmap every single box on your private network [...]

There is nothing to stop you from filtering incoming connections at your router/firewall. This has nothing to do with NAT.

IPv6 was thought out by people who have -zero- clue about security and the scumbags that IT people battle against on a daily basis. [...]

I do not think that the IP layer is the appropriate place for dealing with most of these threats. How would you solve the attacks that you mentioned - POD and so on - on this layer?

The more stuff you pack into one layer the more complex and therefore more inefficient and more vulnerable it becomes.

Re:marketing speak = teh suck

[mikael_j]

First, cute little troll, I'm going to point out a few flaws lest someone takes you seriously.

Not to mention that IPv6 has no security whatsoever in its design. Any form of encryption is either a bolt on, or goes on a higher layer, such as how SSL and SSH ride on top of TCP. On the IP layer, there isn't any standard form of encryption.

IPSec was originally developed specifically for IPv6. 'nuf said.

Of course, we all know about IPv6 and NATs. If you want to hide your internal network, you put it on IPv4. Which means on a "pure" IPv6 network an attacker can easily nmap every single box on your private network, then start running targeted attacks against every single thing, from the router with the last year's firmware to the Linux box that wasn't patched in six months.

NAT != Firewall. What you want is a firewall that blocks incoming traffic to those addresses that aren't supposed to accept incoming connections. NAT means "Network Address Translation" and that's exactly what you get, it translates addresses and keeps track of connections.

The rest of your post seems to have been mostly pointless filler and hyperbole so I'll just ignore it (as should everyone else).

/Mikael

Re:marketing speak = teh suck

[Anonymous Coward]

If only there were some sort of tool that could reorganize and perform computations on sets of data -- let's say, a computer -- that could store sets of data that could act as a knowledge base -- let's say, a data base -- that those network administrators could somehow use to not only store but also consult a map between the IPv6 address and any sort of info pertaining to it. One could only dream!

Re:marketing speak = teh suck

[Anonymous Coward]

1. Yes, they are stupidly long. People who have to support others over the phone will have the hardest time (Sir, I need you to read me the digit string affixed to your cable modem. No, it's not on the label anymore, it's the 100-page volume attached with a steel cord. Yes, the whole thing please)

2. Yes there is. NAT is a very useful tool, and will continue to be used for security reasons long after ip4 dies. Or at least versions of it, we just won't call it "NAT". Using it to simply extend the life of ip4 is not the use it was ever intended for, but there are plenty of times that you have no valid reason to expose machines directly to an outside network, in which case you will need some form of address conversion.

3. Who cares. Give addresses to what you want, or don't want, it's not like we're gonna run out.

4. What's the whole beef about DNS you have? It's not going away with ipv6, in fact it will become even more important, see your own point #1.

5. DHCP- why bother? As long as you have a decent naming convention you can just assign your devices once. Hell, you might even be able to just hardcode the ipv6 permanently instead of changing it any time you change your network or switch ISP's.

In any event, even if everything goes fully ipv6 tomorrow, you can still statically assign your edge device to ipv6 and run everything internally over v4 just like always.

Re:marketing speak = teh suck

[chrylis]

I don't operate under the assumption that ISP's are going to hand out blocks of IPv6 addresses any more readily than they hand out IPv4's. I understand that others do. I'm not sure why they do, but since it is a futuristic sort of thing, we'll just have to wait and see. Looking at their past and present behavior, anticipating charity is dubious at best. In fact, NAT rose to popularity out of this exact same behavior. Not out of some ephemeral need to create more address space.

On this point, economics actually favors handing out at least /64 subnets: Not only does advertising at least a /64 permit stateless autoconfig (which significantly reduces management costs), but routing smaller subnets is more expensive because the route can't fit into a 64-bit machine word or CAM slot.

Re:marketing speak = teh suck

[EsbenMoseHansen]

I haven't counted, but I think I have *at least* 6 ISPs to choose from --- Not counting wireless, of course. North of Copenhagen, nothing special. And none of them seems to be able to deliver an unblocked port 25 (just inbound would be cool, I can relayed outgoing no problem). Sad, right?

Re:marketing speak = teh suck

[Zan Lynx]

Where I live out in the rural boonies, you might think my choices are even more limited than yours. But really, I have quite a lot of choice in ISPs.

I can get dial-up from several providers. I can get IDSL (my current setup) from a few (using Speakeasy). I can get a T1 with service from any of about 6 ISPs. I can get HughesNet satellite service.

True, some of these options cost a lot of money, like T1 service (from $300 to $1200 per month). But I do have choice.

If you live in a city I am sure that you actually have far more choices than between your local cable ISP or DSL ISP.

Re:marketing speak = teh suck

[EsbenMoseHansen]

He doesn't need to. He may want to. He has that option today.

You can assign IPv6 addresses manually to your heart's content as long as you have a block assigned to you, but for client machines there is rarely a reason to do this (just like how you normally don't go about handing out static IPs to every workstation, you set up a DHCP server (or many depending on the size of your organisation) and hand out dynamic addresses to most machines).

/Mikael

I never do. I set up DHCP with static addresses for the known computers, and dynamic for the guests. So much easier to ssh between machines with proper ip addresses and names.

Re:marketing speak = teh suck

[EsbenMoseHansen]

Not to mention that IPv6 has no security whatsoever in its design. Any form of encryption is either a bolt on, or goes on a higher layer, such as how SSL and SSH ride on top of TCP. On the IP layer, there isn't any standard form of encryption.

If that is the case, could you please fix wikipedia? It has some mention of integrated ipsec in ipv6 ;)

Re:marketing speak = teh suck

[sjames]

Zillions of account cancellations if they break autoconfig by not giving customers at least a /64.

Most don't really monitize IPs anyway. The pre/IP charges just about cover the ARIN fees for an allocation. Meanwhile, the cost of an IPv6 /41 is the same as a v4 /20 but provides 2048 times the number of allocations available to customers (where allocation = 1 static v4 address or 1 v6 /64 subnet). If they charge $1/year for a /64, they'll make a HUGE profit on IP allocations.

Re:marketing speak = teh suck

[RAMMS EIN]

I don't see why IPv6 would make it more difficult to memorize IP addresses than it is with IPv4.

With IPv4, there is a certain prefix that identifies your subnet, and all your machines have an address within this subnet, which you are free to choose as far as the rest of the world is concerned.

With IPv6, there is a certain prefix that identifies your subnet, and all your machines have an address within this subnet, which you are free to choose as far as the rest of the world is concerned.

The difference? With IPv4, your addresses will look like [prefix].xxx.yyy, whereas with IPv6, they will look like [prefix]:xxyy. Is that really all that much more difficult?

Re:marketing speak = teh suck

[penix1]

You sir evidently aren't in the boonies deep enough. Come to Mingo County WV where cell service is non-existent, satellite service is spotty on the clearest days and DSL is a big dream because of rotten copper lines. It is also one of the poorest most rural counties in the state. It has one (1) broadband provider and that is the cable company.

So again I ask, where is this supposed "competition" at least in Mingo County?

Re:marketing speak = teh suck

[Tacvek]

Your inside router most certainly cannot be ::1 (except to itself) since that is localhost. (Loopback address)

Re:marketing speak = teh suck

[dbrutus]

I'm in an Indiana suburb of Chicago and I've got 3 residential options, not counting satellite. AT&T, Comcast, and Airbaud, a local point to point radio provider.

Re:marketing speak = teh suck

[dbrutus]

Aw, poor babies don't have a sufficient buffer in their wetware to manage an IPv6 address. They're going to have to write them down.

Cry me a river.

The requirement to remember IPv6 addresses is just going to make for geeks that can do more math in their heads. I don't necessarily see that as a negative.

Re:marketing speak = teh suck

[statusbar]

I use IPV6 over the internet at home right now all managed by a little "Apple Airport Express" that has ipv6 router capability in it already. Every computer on my wireless LAN gets a link local IPV6 address as well as a global IPV6 address, be it Windows, Linux, or Mac.

Here is the interesting thing; This $100.00 "Apple Airport Express" which already supports ipv6 has a little checkbox in the ipv6 settings labelled "Allow incoming IPv6 connections". With this checkbox off, it is a firewall, it does not allow incoming IPV6 Connections!

Isn't that neat! So the external hacker is unable to nmap every single box on your private network!

Anyways, I never need to remember ipv6 addresses either; all my computers are smart enough to discover each other themselves via avahi, bonjour, network browsing, etc.

It seems like most people here are scared of ipv6, yet never bothered to actually learn anything about it.

--jeffk++

Re:marketing speak = teh suck

[Anonymous Coward]

Mod this up to +5. I was going to say the same thing about NAT.

Some might consider NAT a hack, but it's a really cool hack.

Re:marketing speak = teh suck

[chrylis]

:1, not ::1! :-)

On that note, though, anybody know of an accepted convention for saying things like "the /48 prefix plus..."? (I've used '(48):abcd::1/64' myself.)

Re:marketing speak = teh suck

[sjames]

I would MUCH rather use a hosts file than end up with a NAT behind another NAT when ISPs run out of public IPs to hand out or having to train users to use port numbers in all URLs because web servers end up behind NATs as well. "Sorry your kid saw raunchy porn but that's what happens when you go to www.kidsafe.com:8132 and forget the :8132!".

Also as a network admin, I'd rather deal with v6 than try to get a /24 allocated in advance of actual need so I can avoid a huge deal killing lead time when the actual need arrives.

Re:marketing speak = teh suck

[vtcodger]

***That same competition exists under IPv4.***

Note to self. We are said have meaningful competition in digital communications that provides all sorts of benefits. Organize expedition. Try to find it/them. Surely there must be some way to profit from discovery of something that rare.

How? We can worry about how to profit once we capture one or more competes (or whatever the hell the singular of competition is) and persuade it/them to breed in captivity.

Re:marketing speak = teh suck

[bytesex]

What many people don't realize is that, initially, we won't go from 32 bits to 128 bits; we'll go from 32 bits (that we don't all use) to 32 bits (that we all can use) - at least if you consider ISP endpoints. For every soon-to-be-given-out address starts with '2001', goes on to have 32 bits of designated space, then have 16 bits for ISP routing, and end with another 64 bits of 'random' (usually made up of your device's MAC address). So the bits are there, but I don't think the IETF is intending to use them, at first.

Re:marketing speak = teh suck

[Vancorps]

While I agree with your premise for internal networking you fail to understand what the parent was referring to with 4.2.2.1 or in my case 4.2.2.2 and a bunch of other Internet addresses that are commonly used during the diagnostic process. Remembering an internal subnet is easy, nevermind the fact that I run about 20 VLANs with different subnets on each one. My whole topology changes when I switch to IPv6. Expect a lot of resistance to this change when it affects everything on your network at a fundamental level.

To most of us, the idea of subnetting internal addresses spaces makes a lot of sense as it is an easy way to control who has access to what at a layer 3 level. With IPv6 and a single subnet, you now have to rely on Intranet based gigabit firewalls to keep everything locked down. In my network, you're on your VLAN and if you change your subnet to try to gain access to a server you won't get anywhere. This is besides the fact that only the newest layer 3 switches even support IPv6 routing. Many many businesses run switching and routing gear until it dies and the vast majority of it doesn't support IPv6. On top of that, most even brand new printers don't come with IPv6 support and all my security cameras are in the same boat. Yes you can run IPv4 tunnels but that means you have to maintain both IPv6 and IPv4 infrastructures until everything catches up. There is no smooth transition to IPv6 for any company of size. Tiny shops can get by probably pretty easily as they don't have lots of bandwidth considerations. My load balancers and firewalls also don't support IPv6 and they are less than two years old. I will grant that there is a firmware version I can install for the firewall to get IPv6 but the balancer is screwed.

Bottom line, expect a lot of resistance to this change as it is the biggest change since going from token ring to Ethernet. Combined with the fact that many people were taught IPv4 in networking classes and have had no exposure at all to IPv6 you get a whole lot of experienced professionals that now feel like noobs.

Change can be good, but right now NAT works fine for the majority of us so there is no compelling reason to change to IPv6.

Re:marketing speak = teh suck

[chrylis]

There are currently 32 bits allocated for IPv6 subscriber connections. An entire datacenter only needs one of those, contrasted to a /23 or larger now.

What you go to with a /48 prefix (which is the standard ISP subscriber size) is a network with 16 subnet bits and space for an effectively infinite number of hosts in each subnet.

Re:marketing speak = teh suck

[Vancorps]

Most people do not want that option though. Allow more machines to have more services in an age when companies are fighting the P2P battle and other desktop apps trying to reduce what end users are capable of. They aren't trying to add more. If you run lots of VOIP you install a PBX on your network and use it as a proxy to the outside world. This gives you the benefit of monitoring the calls which most businesses actually like.

Now home users would be okay with this but it's the same story for them. Their router will be given an IPv6 address and then tunnel all the IPv4 traffic since a lot of old hardware and software won't support IPv6.

I can already do multiple machines. I have 32 IPv4 addresses that my firewall will forward traffic accordingly to internal servers. In short, I gain nothing by going to IPv6. Autoconfig seems like a good idea but most people hate magic protocols and are going to opt for DHCPv6 so they can control who gets what addressing on which subnet.

I'll go IPv6 in my virtual environments first until I'm happy with all the services for end-users. Until then, why go through all the effort when you don't have to?

Re:marketing speak = teh suck

[bytesex]

O, very true. And I said, or meant to say, exactly that. And it goes even beyond that - the IETF only has the first three bits (001) designated as a global address; the global IPv6 internet is 20::/3, as it were. And on top of that, they still have five 'eights' left currently to do the same thing with. Possibilities are certainly enlarged; if only from 32 to 45 bits (which is still eight thousand current internets). But to think that we'll go from 32 to 128 and use them as we do today, is not true.

Re:marketing speak = teh suck

[Vancorps]

And then there are those of us managing hundreds and thousands of devices that don't support IPv6. Windows XP is one of the most popular operating systems on the planet and you have to add IPv6 support to default installs of it which the vast majority of machines out there are. The problems aren't show-stoppers, there are just a lot of problems with migrating to IPv6 on any scale. Top it off with the fact that there aren't really any benefits for the majority of us that don't have current problems with NAT and you can't really blame people for not wanting to give up something they've known for a great many years that has proven reliable in the majority of environments.

I don't need me printer to have an Internet addressable IP. I don't even need my home workstation to. It solves a problem most people don't have. For those with NAT issues then yes, the transition makes a lot of sense. For those without current layer 3 problems it just doesn't make sense to go through all the effort involved in fundamentally modifying your infrastructure.

Re:marketing speak = teh suck

[Adm.Wiggin]

My first thought was Comcast. How depressing.

Re:marketing speak = teh suck

[lidocaineus]

I never do. I set up DHCP with static addresses for the known computers, and dynamic for the guests. So much easier to ssh between machines with proper ip addresses and names.

And... what's stopping you from doing that with ipv6?

Re:marketing speak = teh suck

[statusbar]

On windows XP the command line "ipv6 install" is all that is necessary to enable ipv6.

Perhaps you don't know that you have have ipv4 and ipv6 enabled at the same time? People can migrate to it as they need.

The benefits are real, and are all brought about because of the ipv6 Router Advertisement protocol. Having internet addressable IP addresses is NOT the point, it is only one tiny option that you have if you are using ipv6.

Take a look at UPNP and all their NAT issues with regards to "punching holes in NAT routers" to allow for bidirection DNS networking.

Take a look at all users who have 192.168.0.x home networks trying to VPN in to their office which also has 192.168.0.x.

Take a look at the hacks that allow websites to trigger links to your internal router http admin page via "http://192.168.0.1/cgi-bin/admin.cgi?user=admin&pw=password"

IPv6 also has benefits for QoS control and multicasting.

The number of bits in an IP address is irrelevant to people wanting ipv6.

I'm sorry though that you have to manage hundreds of windows XP systems. Hopefully when they upgrade to Win7 or Mac or Linux this would free up your time to do more interesting work.

--jeffk++

Re:marketing speak = teh suck

[skarphace]

You sir evidently aren't in the boonies deep enough. Come to Mingo County WV where cell service is non-existent, satellite service is spotty on the clearest days and DSL is a big dream because of rotten copper lines. It is also one of the poorest most rural counties in the state. It has one (1) broadband provider and that is the cable company.

So again I ask, where is this supposed "competition" at least in Mingo County?

That's a failing in your area. Where I work, we are 27 miles outside of the nearest town. We have a T1 and two DSL lines. So being in the 'boonies' isn't exactly a guarantee you will have no options. Being in a place where nobody gave a shit and/or corruption and corporate raping is where the problem lies.

Re:marketing speak = teh suck

[Anonymous Coward]

And for only $49.95 I will put the unique IPv6 address of any star that you want in book form in the US Library of Congress. Are you ready to sign up for IPv6 now?

Re:marketing speak = teh suck

[chrylis]

And that was exactly the hope--that by making the address space 128 bits (instead of 64), it'd be OK to "throw away" 2^64 addresses on a single host. Besides autoconfiguration, the most important aspect of the readdressing is that it dramatically streamlines the global routing table. We're not going to see it immediately, but the processing demands for core routers are going to be significantly lowered as traffic transitions to IPv6.

Re:marketing speak = teh suck

[Vancorps]

I think you missed the point entirely. It's not that XP doesn't support it, I even said so in my first post. It's that you have to install it to make it support it and even then there is no DHCPv6 client for it without yet another install. Then of course there is autoconfig which you alluded to which gets a little fuzzy when you have multiple routers all with Internet connections. DHCP isn't going anywhere.

The only legitimate problem you posed was VPN access. Otherwise, QoS and multicasting I can already do with my IPv4 network so I don't gain anything by changing my infrastructure which was the whole point of my post.

My point was simply that IPv6 is a solution in search of a problem for the vast majority of users. I'm not going to say that nobody uses UPnP especially in the business world but most don't as it's unnecessary when you have proxies doing the work for you. Instead of scripts exploiting IPv4 addressing there will be scripts to read the advertisements and take over the router which is shouting its address on the network.

There is nothing compelling about IPv6 for the majority of us. The only reason I'm even considering it now is because at some point I'm going to have to so I'd rather be ready before I have to be.

Of course all of this is on top of the fact that the majority of layer 3 switches out there don't support IPv6 without firmware updates if updates are even available without having to pay for them. Cisco, I'm looking at you. Switches take a long time to die too. You'll have to forgive those of us that have working IPv4 deployments for not wanting to introduce new infrastructure for the sake of IPv6. Most of my network printers don't support IPv6 and never will. None of my security cameras, card swipe machines, credit card machines, and a myriad of other devices. With so many devices out there not supporting it yet I'd have to maintain the same IPv4 infrastructure while adding IPv6 infrastructure. You're right that I can run most of them side by side but again, it's adding variables to a network that is already running fine.

Re:marketing speak = teh suck

[value_added]

The requirement to remember IPv6 addresses is just going to make for geeks that can do more math in their heads. I don't necessarily see that as a negative.

Being able to do math in your head is a positive. However, most computer users don't seem to have mastered binary[1], so you're concluding they'll be just as comfortable reading hexadecimal, and if not, they'll be motivated to learn about number systems and enthusiastically gear up for the challenge by repeating the rote work they they did in grade school when they learned their multiplication tables?

Try suggesting to a Windows that the netmask for a /24 is ffffff00 and see if you don't get blank stare. Or tell the webdesigner, "Skyblue? You mean 87ceeb, right?"

--------------
1. Some Slashdot users insist binary is a fiction created by OS developers to make buying hard drives more complicated.

Re:marketing speak = teh suck

[Anonymous Coward]

I don't need me printer to have an Internet addressable IP. I don't even need my home workstation to.

If you don't need your printer or workstation to talk devices on the internet, don't connect them.

It solves a problem most people don't have.

Actually, most people do want their workstations to be able to talk to other computers on the internet - as evidenced by the large number of people online.

And for the record, I would bet that you do in fact want your home computer to be able to access the internet, and that you just don't understand what's going on.

Re:marketing speak = teh suck

[Cramer]

What competition? Most people have at most 2 or three choices for residential connectivity. (some don't even have that.)

So, that'd be... DSL from your landline telco, cablemodem from your local monopoly cable provider, FiOS if you're really f'ing lucky, and HughesNet if you're really unlucky. Cellular data plans, you say... they're slow, expensive, and ALL of them have usage caps. This isn't the 90's where you had 4 dozen ISPs to service your dialup internet needs.

Re:marketing speak = teh suck

[Cramer]

... just like it used to be done prior to everyone using NAT ...

In the days before NAT, (most) people didn't bother with filtering. The net was a very different place back then; we didn't need to police every packet moving around the world. (we also didn't have SPAM back then, btw.)

A network today without the veil of NAT will be a very nasty place indeed!

Re:marketing speak = teh suck

[darkpixel2k]

IPv6 isn't IPv4. You can use stateless autoconfiguration to find that router, no DHCP needed. The advertisement can also include information on DNS servers. If the DNS servers and default gateway aren't sufficient, you can still run DHCPv6 if you like.

Under v4, my DHCP server hands out an IP, points the machine at a DNS server, and finally (not sure if it's the DHCP server or the client) registers the name in DNS.

This allows me to ssh to my server via DNS name ('server.lan' for example).

Maybe I'm totally missing the point, but under v6 w/ autoconfig, there's no DHCP server. How do your workstations find DNS automatically? You won't be able to ssh or ping 'server.lan'.

Or is that not the point of autoconfig? Is autoconfig designed to simply get a group of machines v6 connected to the rest of the world with very minimal effort with the understanding that network admins will be using DHCPv6?

Re:marketing speak = teh suck

[cenc]

Try Temuco, Southern Chile. I know lots of people getting their internet via long distance wireless Bridges, 20, 30 miles out of town. Lots of people with Sat systems in the really rural area. The government provides sat systems to schools that are 2 days horseback ride in to the mountains.

Still, knowing the rural United States, our choices and speeds of ISP's here is likly larger. Many of my family in rural parts of the United States just got off of dial up internet about a year ago.

Re:marketing speak = teh suck

[Chang]

There are a few things that you don't understand.

If you get a /48 from your ISP (standard allocation recommendation by IANA and by existing v6 practice) you can run as many /64 VLANs as you want. You aren't forced to run a single VLAN when you run IPv6. You can still subnet six ways from Sunday. Your comment talks about a single subnet but that isn't the norm for IPv6 deployment.

You don't need to convert everything all at once. Experiment first, then roll it out on a DNS server or a mail server.

You will have to maintain two sets of addresses for the foreseeable future. So does everybody else. You can stay on IPv4 but at some point you will need to connect to somebody who can only get IPv6 addresses. That might be 3 years from now or 10 years from now but this is going to happen. IPv4 will be exhausted - this is a fact that a lot of people are having trouble dealing with but it doesn't have to big bad and scary. IPv6 isn't really that different from v4. They both pretty much do the same job - yes there are differences but once you work with for a short time it's not rocket science - it's just basic networking.

The weak part of IPv6 is ISP delivery. There is a dearth of providers who are providing dual stack to all of their customers and this is right now the biggest barrier to rapid adoption, particularly in the North American market. This is going to change pretty rapidly over the next 2 years and alredy has in other regions.

I agree that IPv6 is scary but a true geek should see this as a learning opportunity rather than a departure from a comfort zone. IT people are supposed to be ahead of the curve. Yeah - maybe you don't roll out IPv6 until their is a solid business case for deployment but there is a business case now for experimentation so that it won't be a fire drill when it comes time to deploy because of an actual business requirement.

Re:marketing speak = teh suck

[ion.simon.c]

When you combine 'everything with an address' with 'NAT needs to die', then 'Joe Q. Sysadmin' will not be allowed to select his own IP addresses.

A /48 is big. Really big. You just won't believe how vastly hugely mindboggingly big it is.

You can *easily* have addresses that are configured with DHCPv6 alongside manually configured systems. (And, really... if an address has been assigned with DHCP, it can *easily* be functionally identical to a "manually assigned" address.)

So, anyway. I don't see where you're getting the notion that Joe Sysadmin will be utterly unable to manually assign addresses.

Re:marketing speak = teh suck

[Chang]

There are two mechanisms for this.

You can run DHCPv6 and have it hand out info but not addresses via a DHCPINFORM. This also works in IPv4 also but not many know about it or use it. In a nutshell you setup a subnet but don't include a range of IPs to hand out. You simply setup DNS servers and maybe a DNS domain name, ntp, and whatnot. The clients will autoconfig but also run a dhcp client to get the DNS servers defined.

The other (and better IMHO) method is that you can include RDNSS info in the router advertisements. So for autoconfig to work you have to at least advertise the subnet and prefix that clients should use to form a complete address during autoconfig. The RDNSS (recursive DNS server) advertisements are picked up and used by the client as DNS servers. This method has less adoption but I think this is ultimately going to be the preferred method once it's supported more widely. See the radvd.conf man page for more info.

The router advertising is a part of IPv6 that is poorly understood or completely unknown to many people but they put some pretty good though into it. There is actually a mechanism to renumber an entire network using primarily router advertisements which is pretty cool.

Re:marketing speak = teh suck

[ion.simon.c]

Until then, why go through all the effort when you don't have to?

'Cause most of us don't have 32 world-routeable IPv4 addresses to play with? Some of us in the East don't even have one!

Re:marketing speak = teh suck

[Vancorps]

So we agree on principle then. I wasn't saying that IPv6 wasn't worth experimenting with, I was just saying that actually deploying it is quite the headache still and you won't expect people to do it until there is a clear problem and IPv6 is a clear solution such as a scenario that you mentioned.

Vendor support for IPv6 is severely lacking even to this day however and until that changes don't expect wide scale adoption of IPv6 unless we do actually run out of addresses.

Re:marketing speak = teh suck

[Anonymous Coward]

Let's be clear...

The IPv6 internet is 2000::/3 which covers 2000:: through 2fff:ffff:ffff:ffff:ffff:ffff:ffff. Addresses are already issued throughout that range (ARIN is issuing from 26xx, for example).

IANA->RIR gets chunks of /12.
RIR->LIR goes out in chunks of /32 or larger. (LIR is mostly ISP)
RIR->End User goes out in chunks of /56, /48, or larger

ISPs may start assigning individual addresses to subscribers, but, for the most part, I think ISPs will assign prefixes of at least /64. I, for one, won't be subscribing to an ISP that won't at least delegate me a /56.

A /56 is 256 subnets, which, is probably more than enough for most households even in the foreseeable future. A /48 gives you 65,536 subnets.

We will, initially, go from 32 to 128 bits, but, we will NOT be using those bits in exactly the same way that we used to.

We'll go from 32bits total address which is divided between some (mostly) provider specific bits and a few locally assigned bits (or all provider assigned in single-host cases) -- to -- 32 provider specific bits, 16 or more customer specific bits, and 64-80 customer assigned bits.

That's enough addresses for 4 billion+ providers each serving 65,536 customers each of whom has 65,536 subnets each of which can contain 16E18 hosts, as opposed to the current environment where we can not even handle 4 billion total addresses and fewer than 40,000 providers are rapidly approaching exhaustion of the address space.

IPv6 is coming.

If you have an IPv4 network, then, the sooner you move it to dual-stack, the sooner you will be able to iron out any problems with IPv6 in your provisioning systems, automation, addressing plans, etc. before you are absolutely dependent on it to reach some fraction of the internet that can't get IPv4 addresses.

Migrating to IPv6 after that point will be significantly more difficult and perilous.

Re:marketing speak = teh suck

[mikael_j]

Lots of people were doing filtering pre-NAT, as an example I can take the university I attended, every workstation on campus had a public IP address and if you were on the campus network (or if you were on the off-campus network for students provided by a third party in cooperation with the uni) you could access any workstation directly, if you were off-campus then access to these machines was heavily restricted (no access to ports < 1024) and you had to go through one of the "big" machines that were specifically set up so that you could log in from the outside.

Yes, knowledge of firewalls used to be horribly poor among regular users and still is today, as can be seen in your comment where you seem to assume that NAT == Firewall.

The proper solution is to go back to what those who actually cared about security pre-NAT were already doing, packet filtering firewalls that block unauthorized access, something that you do no need NAT for.

/Mikael

Re:marketing speak = teh suck

[darkpixel2k]

... just like it used to be done prior to everyone using NAT ...

In the days before NAT, (most) people didn't bother with filtering. The net was a very different place back then; we didn't need to police every packet moving around the world. (we also didn't have SPAM back then, btw.)

A network today without the veil of NAT will be a very nasty place indeed!

Weird. I vaguely remember that time. I recall having a Windows 95 box plugged right into our core switch and I had public IP. To this day I even remember the IP. Pinging it returns nothing, but a whois for the 205.162.198/24 block returns my old employer/ISP and the craptacular 'United Telephone' allocation that used to arrive via T1. Strange that the whois record still says 'United Telephone' even through they were bought our or became 'Sprint' about 15 years ago....and then 'Sprint' through 'Embarq' sounded much cooler.

Re:marketing speak = teh suck

[darkpixel2k]

Until then, why go through all the effort when you don't have to?

There's nothing like last minute panic, eh?

Re:marketing speak = teh suck

[darkpixel2k]

I don't need me printer to have an Internet addressable IP.

I wish mine did. In order to print something out for the guys back at the office, I have to get bring my laptop in and print, or print to a .ps file, convert it to pdf, and e-mail it to the guys. No VPN access.

But maybe with IPSec and IPv6, it wouldn't be so bad--just hit 'print' from anywhere in the world and they'll get it.

Re:marketing speak = teh suck

[darkpixel2k]

if updates are even available without having to pay for them. Cisco, I'm looking at you. Switches take a long time to die too.

Free updates, and switches that don't take too long to die. Netgear. Maybe you've heard of us?

Now that we've removed two of your IPv6 hurdles, are you ready to switch? No? Good. We aren't ready either.

Re:marketing speak = teh suck

[Cramer]

What university was that? And when? I cannot recall a single univerisity that was firewalling anything when I was in college in the early 90's. Even in the mid-90's when I was working for an ISP, I saw very few places with a firewall. Most were "protected" by the limited amount of IPv4 technology in their network. The internet was much slower then with far fewer people trying to mess things up, and there wasn't that much of value to steal, vandalize, or "DoS".

No, I do not assume "NAT == Firewall". I am saying 99% of the world is protected by the veil NAT creates. Yes, it's a paper thin barrier, but it's more than enough to keep a network safe from outside attack. (no firewall can protect a network from it's own stupid users.) Taking it away is akin to taking away the front door on everyone's house... it's not much of a barrier to a theif, but it's surprisingly enough.

Re:marketing speak = teh suck

[Cramer]

If you're thinking Win95, then we aren't talking about the same "pre-NAT". By the time 95 was released (Aug 24 1995), NAT did exist. It was pretty simple and crude then, but it was "functional"... we had a next cube, my linux box (as the nat gateway), a windows 3.1.1 ("wfw") / NT 3.5(?) pc, and a win95 (msdn pre-release) working on a 10base-2 network. (june-july ish '95)

Re:marketing speak = teh suck

[darkpixel2k]

If you're thinking Win95, then we aren't talking about the same "pre-NAT". By the time 95 was released (Aug 24 1995), NAT did exist. It was pretty simple and crude then, but it was "functional"... we had a next cube, my linux box (as the nat gateway), a windows 3.1.1 ("wfw") / NT 3.5(?) pc, and a win95 (msdn pre-release) working on a 10base-2 network. (june-july ish '95)

That sounds about right. NAT just wasn't very wide-spread around the time we got our MSDN copies of Windows 95.

Re:marketing speak = teh suck

[Jeremi]

It seems like most people here are scared of ipv6, yet never bothered to actually learn anything about it.

OTOH, some of us are scared by the things we have learned about it ;^)

Re:marketing speak = teh suck

[EsbenMoseHansen]

I never do. I set up DHCP with static addresses for the known computers, and dynamic for the guests. So much easier to ssh between machines with proper ip addresses and names.

And... what's stopping you from doing that with ipv6?

Nothing. The minute the ISP's in this country supports ipv6, I'll be migrating. I am SO tired of being constrained to one freaking IP address.

Re:marketing speak = teh suck

[smutt]

Where the fuck do you live where you have more than 2 viable choices for an ISP?

Try anywhere outside of the United States. I live in The Netherlands and I've only got one choice of cable ISP. But I have about 4-5 options for DSL.

//BEGIN Advert
An article I wrote a couple weeks ago makes plain how important competition is in the ISP market. http://metafarce.com/index.php?id=24
//END Advert

Re:marketing speak = teh suck

[Anonymous Coward]

Dude. Did you just use "LOL" on slashdot?

Re:marketing speak = teh suck

[higuita]

people managing the network and dns will know its network address, just like ipv4,... its always the same and isnt different from memorizing a phone number, a address, a name... yes, its bigger than the ipv4 one, but not hard to memorize, its just different and new

then it comes to the host block, that as you should know, its by default the mac address... so if they have to create a DHCP mapping, they already need to "know" the MAC (or a easy way to know it)... the ipv6 IP is just merging the 2 parts... if you dont manage the dhcp, you still have to know some way/app to map a MAC to a machine,

dont like to memorize MAC? simples, dont use then and use small numbers for the machines, just like ipv4... but really, why memorize IPs? i know some IPs on my work network (ipv4), but not even near to 1%, and i know then because in some servers its faster to write the ip than the dns

Re:marketing speak = teh suck

[jjk3]

Same in San Francisco, only one choice for cable, but a few options for DSL. I think the Parent poster is confusing ISPs from last mile providers. While it's true no matter which DSL provider I go with it will use at&t copper, but in most metropolitan areas you have a few choices on where that copper terminates and who gives you your IP addresses.

Re:marketing speak = teh suck

[Anonymous Coward]

Well first off you better have name resolution for your lan, cause nobody can remember an ipv6 address.

Re:marketing speak = teh suck

[nametaken]

Eh, I'm in a suburb of Chicago and I have 4 or 5 options.

Re:marketing speak = teh suck

[metamatic]

I set up DHCP with static addresses for the known computers, and dynamic for the guests. So much easier to ssh between machines with proper ip addresses and names.

I just use zeroconf, and have DNS names for all machines, whether they're known computers or guests, without having to do any configuration at all.

Re:marketing speak = teh suck

[billstewart]

We didn't have firewalls when I was at university either, and for the most part 4-letter passwords were good enough for punchcard accounts :-). I started seeing university firewalls in the mid-late 90s, and the initial ones were more concerned about keeping students from attacking the outside world than keeping the outside world from attacking students, since the traditional firewall models, which assumed that all the dangerous stuff was on the *outside* simply didn't apply.

But no, 99% of the world isn't protected by NAT. 99% of the world is protected by little boxes that people bought when they got their network connection or second computer, and the firewalling functions those boxes provide happen to be implemented using NAT. And anybody who's running services at home (which due to brain-damaged ISP policies usually means gamers rather than home web servers) has to haggle with the little box to open holes in it, because NAT breaks the end-to-end model that the Internet is based on. (Why is Skype so popular? Good NAT evasion...) It's good enough for Anonymous Clients, but for IPv6 the world will be much better off if most of the firewall boxes are doing something other than NAT. (On the other hand, most people will still need little boxes to handle ISP IPv6 services, doing stuff like autoaddressing and 6to4 NATs of various flavors, though in some cases the ISP will be supporting them instead of just running dumb DSL-modem services.)

Re:marketing speak = teh suck

[Cramer]

Right. The "outside" people were protecting themselves from were the bored university students. :-)

You are spliting hairs... They are protected because the box is doing NAT -- sure it's piss-poor form of "protection" but it's clearly better than nothing. You cannot get to the hosts behind it because they don't have a public address. IPv6 was designed to do away with the address rewriting. Everything else those cheapy NAT boxes are doing, they will have to continue doing... connection tracking and protocol aware inspection -- in the Cisco world: CBAC. In the era of NAT, you can get to whatever has been explicitly granted. In the IPv6 era, you will be able to reach whatever has not been explicitly blocked. This is will be as much of a mess as the early days of IPv4 where complete idiots were setting up firewalls with a seriously flawed understanding of what they were doing. ("deny icmp any any" was the First Rule of firewalls. Anyone who did that, in my book, should be fired immediately. If you don't realize why that's stupid, you should not be a "firewall admin".)

*cough*UPnP*cough* Very few "gamers" setup anything on their NAT box these days. (yes, the computer being about to open any holes it wants is as bad and idea as it sounds... if Halo can open ports, so can a rootkit.)

People use Skype because a) it works, and b) it's free. SIP on the otherhand is a pile of braindamage. As a protocol designed in the era of NAT, they failed. It's broken by multi-homing alone. There is ZERO reason for a pair of machines to open a completely seperate connection between each other for a voice/video stream -- and there's no need to tell me your address; the connection to me gives me the address. (SIP is a security nightmare. There are loads of reasons people avoid SIP beyond their own network(s).)

Re:marketing speak = teh suck

[RichiH]

> > I can't just decide to give my server the address 127.48.7.12 or 234.122.9.31 with IPv4, but that doesn't mean that I can't assign one within my address range.
> Using NAT, you absolutely can. You're sacrificing the ability to communicate with those addresses in the wild, but that option definitely exists today.

127.0.0.0/8 is localhost. You can't use that for anything other than have processes on localhost talk to each other.

> I don't operate under the assumption that ISP's are going to hand out blocks of IPv6 addresses any more readily than they hand out IPv4's.

Do you have any idea how many IPv6 addresses there are? No? Go read http://tech.slashdot.org/comments.pl?sid=1342389&cid=29167213 :)

Re:marketing speak = teh suck

[RichiH]

You don't think anyone would accept a /64 route from you, do you? If any ISP announced their /32 in /64, they would take out their own routers and everyone else's who got (and accepted) the prefix list. We have about 280,000 IPv4 prefixes announced on the internet, today. The potential ISP above would announce 4,294,967,296 on their own. Not going to happen ;)

Re:marketing speak = teh suck

[ptudor]

1) The addresses are now ridiculously long.

The addresses are longer; what's your 32 bit solution to a 32 bit problem? We want to solve the problem once in our lifetimes, that's why 64bit was skipped.

2) There's not supposed to be any such thing as NAT (which also means your practice of always having your inside router be x.1 now gets more complex)

In IPv4, you are true. RFC1918 has ruined the Internet. But your claim of giving a router a non-eui64 address becoming more complex is FUD.

conf t
int gi1/1
ip addr 172.17.17.1/24
ipv6 addr 2001:db8:ffff::1/64

OMG! SO HARD!

3) Many things that don't REALLY need addresses are now going to get them, because we have so many, so lets just go crazy.

In 1999, my house probably didn't need a T1 with (dual) backup ISDN. And I've decided in 2009, your house doesn't really need a cable modem, so please give your spare addresses to me. Why do you seek to deny with your FUD both me and the non-US Internet globally routable addresses?

We need IP 15!

[Anonymous Coward]

A 15 digit TCP/IP address so that everyone on Earth can have their own TCP/IP address that allows for their own subnet. So, if a criminal does somethign "bad" the cops know who to go for. What can go wrong?!

Re:We need IP 15!

[Anonymous Coward]

Somebody hacked my IP! With visual basic!

Hackers will listen to the IP address your computer broadcasts, exploit your windows, overflow your stack, cause general protection faults, and change your wallpaper to goatse.

IpV6 reality check

[AbbeyRoad]

Dan Bernstein has chimed in on this before:

        http://cr.yp.to/djbdns/ipv6mess.html

He is basically dead right.

The people who came up with IPv6 seemed to be too ivory tower: they forgot about
the reality on the ground. Few ISPs are even thinking about IPv6.

-paul

Re:IpV6 reality check

[spinkham]

Since this rant, google has actually gone IPv6 for IPv6 ready ISPs.

http://www.google.com/intl/en/ipv6/

By no means is the internet IPv6 friendly, and a lot of the points Dan makes are good ones, but he fails to offer any solutions either.

Re:IpV6 reality check

[Just Some Guy]

He is basically dead right.

Umm, about what? He trots out a bunch of hypothetical problems that people have been cheerfully ignoring because they don't manifest in reality. IPv6 is here and working today, even if Dan didn't want to believe it possible.

Re:IpV6 reality check

[r7]

The people who came up with IPv6 seemed to be too ivory tower: they forgot about
the reality on the ground. Few ISPs are even thinking about IPv6.

Amen to that. But I don't see an academic angle so much as an ILEC angle i.e., IPv6 is being handicapped by large telcos, large ISPs, legacy netblock owners and their proxies in order to drive up fees for IPv4 addresses. The threads on new fee structures, in mailing lists like arin-ppml, make this obscenely clear. IPv4 netblock owners are salivating over the potential for profit from what should be a public resource.

Only thing more disappointing than ARIN's failure to either reclaim unused IPv4 netblocks (and there are plenty of those, both large and small) or speed the adoption of IPv6 is the DOC and FCC's failure to foresee the damage, both economic and to communications, which the coming address shortage will cause.

Re:IpV6 reality check

[Anonymous Coward]

You referenced a document that is 6 years old. Last update was 2003.

Re:IpV6 reality check

[Daniel_Staal]

They do manifest in reality: They are why I don't have an IPv6 address: It's to much work for too little benefit. It can be worked around, but it's just more work, and wouldn't really get me anything.

Basically all he is saying is 'accept an IPv4 address as an IPv6 address'. Which would mean that 'upgrading' would be as simple as getting software that can handle being sent IPv6 addresses. (Which basically everyone's already got at this point.)

Instead at the current situation you have to figure out how and were to get an IPv6 address, and either keep an IPv4 as well (and switch between the two as the situation demands) or work out how you are going to talk to the 90+% of the world that doesn't have an IPv6 address. Either of those require extra work, for every person trying to connect to the network.

So, in the current situation, everyone who switches to IPv6 needs to be a network engineer. Because it's a complicated setup at the user's endpoint. Guess how long it'll take Grandma to switch then.

Yes, the network works, but there is no decent upgrade plan.

Re:IpV6 reality check

[chrylis]

Sorry, but while several of the issues he mentioned are major changes, there are well-thought-out reasons for them. All the criticisms could have been leveled against the upgrade to IPv4 as well.

First off, he pretty much ignores the dual-stack transition plan, which is what I've always seen in place for business systems. Precisely because IPv6 is a separate address space, you don't have to roll over from IPv4--you can run them both. Thus both clients and service providers can upgrade and take advantage of IPv6 without breaking connectivity to the IPv4 Internet.

Additionally, application compatibility in nearly all cases is a result of the programmers' failure to use the sockets API correctly. The sockets have supported different address families for decades (zero-one-infinity), and adding AF_INET6 happens transparently to a well-behaved application. (Some protocols weren't well-behaved, but that was a bug in the protocol, not IPv6.)

Yes, the transition would have been smoother had there been a clearer standard for IPv4-to-IPv6 address mapping, but IPv6 does work fine, thank you, and the upgrade is happening largely through aging out of older systems.

Re:IpV6 reality check

[Chris Mattern]

Really? Ok, then. I have a Linux box connected to a Netgear router providing NATted connections, itself connected to a cable modem that goes out to Comcast, who provides my pipe and is my ISP. Comcast ISP, by the way, does not support IPv6. If IPv6 is here and working today, I should be able to use it. How do I do that?

If you can't tell me how, than Dan's "hypothetical problems" are very real indeed.

As far as I can tell, what people have been "cheerfully ignoring" is IPv6.

Re:IpV6 reality check

[Chris Mattern]

And you will noticed that six years later, 99%+ of the Internet *still* doesn't use IPv6. Maybe he was on to something...

Re:IpV6 reality check

[Just Some Guy]

Comcast ISP, by the way, does not support IPv6. If IPv6 is here and working today, I should be able to use it. How do I do that?

Switch to an ISP that provides IPv6 (you're surprised that Comcast is behind the times?), or spent 5 minutes enabling an IPv6 tunnel to someone like Hurricane Electric from your Linux box.

Re:IpV6 reality check

[chrylis]

So, in the current situation, everyone who switches to IPv6 needs to be a network engineer. Because it's a complicated setup at the user's endpoint. Guess how long it'll take Grandma to switch then.

Actually, it requires almost no setup. The problem isn't Grandma, it's Grandma's (US) ISP. If the IPv6 connection appears from upstream (and it's advertised by the router, no client configuration needed--not even DHCP), it's available for use.

My student ACM chapter once inadvertently leaked router advertisements for our IPv6 connection onto the building's main network and hijacked most of the Web traffic as the machines saw our connection and automatically (and transparently to the users) started routing through it.

Re:IpV6 reality check

[Just Some Guy]

Instead at the current situation you have to figure out how and were to get an IPv6 address,

If they're using an IPv6-enabled ISP, that's a non-event. It really does Just Work.

and either keep an IPv4 as well (and switch between the two as the situation demands) or work out how you are going to talk to the 90+% of the world that doesn't have an IPv6 address.

Why wouldn't you keep both, out of curiosity? Almost every machine on our corporate LAN uses both protocols. I enable it on the router and the various servers and workstations just started using it without any additional configuration.

Either of those require extra work, for every person trying to connect to the network.

Where "extra" approximates "no".

Re:IpV6 reality check

[Anonymous Coward]

Comcast is scheduled to roll out end-to-end IPv6 next year, actually.

Re:IpV6 reality check

[Chris Mattern]

And I should switch from a provider that has provided me with fast, reliable, if somewhat pricey, service because?

(Yes, I know that a lot of people have had really bad experiences with Comcast. And the few times I have had trouble, their customer service has not impressed me. But, by and large, I have indeed had very little downtime from them; that's something I count on, in my job among other things, and I am not inclined to leave it behind)

Or, if I get the IPv6 tunnel with Hurricaine Electric, I expect that will involve HE charging me. What will I be getting for my money?

Re:IpV6 reality check

[aztektum]

Grandma will upgrade to IPv6 when her ISP says your modem needs to be replaced or they have a tech swap her cable modem. The layman argument does not hold water in every situation. Most laymen will plug in their new IPv6 router and not even configure a password, let alone worry about routing tables, etc.

That's like saying grandma can't change her own brake pads, so we'll just let her grind her rotors down. Grandma will just goto a mechanic or in this case, her ISP which is staffed with NETWORK ENGINEERS. It's their fuckin' job to figure this stuff out and move to it for the benefit of their users. Your argument makes it sound like you're just a lazy network engineer who can't be bothered to work.

Re:IpV6 reality check

[XanC]

I expect that will involve HE charging me. What will I be getting for my money?

You expect wrong.

Re:IpV6 reality check

[GPLHost-Thomas]

I fully agree with that. Having to "upgrade" a software to run ipv6 is annoying already. Now, the fact that we have to have BOTH compability, and manage it, is just plain stupid. The adoption rate would have been much much bigger if it was just a mater of using ipv6, then it would have also support ipv4 and that was it.

I also always trough the DJB's URL to show how stupid the implementation was thought. Why wasn't it that simply, an IPv4 would have "contained" N amount of ipv6 addresses? That would have been so much more easy to understand.

Thomas

Re:IpV6 reality check

[Anonymous Coward]

They do manifest in reality: They are why I don't have an IPv6 address: It's to much work for too little benefit. It can be worked around, but it's just more work, and wouldn't really get me anything.

Basically all he is saying is 'accept an IPv4 address as an IPv6 address'. Which would mean that 'upgrading' would be as simple as getting software that can handle being sent IPv6 addresses. (Which basically everyone's already got at this point.)

Instead at the current situation you have to figure out how and were to get an IPv6 address, and either keep an IPv4 as well (and switch between the two as the situation demands) or work out how you are going to talk to the 90+% of the world that doesn't have an IPv6 address. Either of those require extra work, for every person trying to connect to the network.

So, in the current situation, everyone who switches to IPv6 needs to be a network engineer. Because it's a complicated setup at the user's endpoint. Guess how long it'll take Grandma to switch then.

Yes, the network works, but there is no decent upgrade plan.

dont worry about grandma shes only going to have 50/20 with 1 gig for cap any ways

why will she need ipv6 any ways

Re:IpV6 reality check

[Tony Hoyle]

Not really.. They don't index the ipv6 address space and 90% of the google pages are still ipv4 only.

The key is indexing ipv6 sites. Until google start that they haven't 'gone ipv6' at all.

Re:IpV6 reality check

[swillden]

So, in the current situation, everyone who switches to IPv6 needs to be a network engineer.

That's bull. End users don't need to know or do anything. At this point, all we really need is for ISPs to provide IPv6 and the rest will happen without users doing -- or knowing -- a thing.

Yes, the network works, but there is no decent upgrade plan.

Also crap. The upgrade plan is for IPv4 and IPv6 to coexist for a few years. Users deal with DNS names, not IP addresses, and applications and resolvers already transparently look for both AAAA and A records and use the AAAA records if available. All of the major OSes have solid IPv6 support in place -- if you don't believe me, install a radvd server on your home network and notice how *instantly* all the machines on your LAN have IPv6 addresses (heck, they all have link-local addresses now) right next to their IPv4 addresses. Of course, if your ISP set up support for IPv6, you wouldn't have to do anything.

The only reason that IPv6 won't currently work for most people even if their ISPs support it is that their current NATing router appliances don't support it properly. But if ISPs implemented v6 support, Linksys, D-Link, etc. would start rolling out devices with proper IPv6 in their firmware. With enough users on the v6 network, web site admins, etc., would add v6 support and AAAA DNS records, which the v6-enabled users would instantly (and transparently) begin using.

The transition plan is solid, and works very well in practice (as you can verify by using Hurricane Electric or another v6 tunnel provider). What's lacking is the ISP motivation, and being able to use a v4 address as a v6 address wouldn't change that at all.

Re:IpV6 reality check

[Tony Hoyle]

It's free, but don't expect reliablility... routed IPV6 is definately the way to go.

Of course actually implementing routed ipv6 is rather technical. You get an ISP that does it.. great.. now find a modem that does it.. that's either hacked linksys or a cisco, or a linux box talking PPPoE to a bridged modem like I have - these require knowledge to set up. Then setup RA, which isn't automatic (you need to pick a network from your ISP supplied /48 since RA only works on a /64).

*then* it's plug and play. Mostly. You've still got to learn about ipv6 firewalling (which isn't that different but the icmp options are all changed).

Re:IpV6 reality check

[Anonymous Coward]

My student ACM chapter once inadvertently leaked router advertisements for our IPv6 connection onto the building's main network and hijacked most of the Web traffic as the machines saw our connection and automatically (and transparently to the users) started routing through it.

And you don't see this as a problem?

Re:IpV6 reality check

[arkane1234]

Since in my area I have approximately 3 providers of high speed internet, all of which are IPV4 (thankfully...), it's nice to not even worry about something that monstrously undocumented (and readable without a goddamned math degree).
What would have been nice about IPV6 is if it was initially just an elongation of the IPV4. At least THEN it'd be number that we actually count instead of HEX. Could have used aged and proven logic with it too instead of relearning the innards of yet another layer logic.
Also, since there's no upside from the end-users perspective (aside from "omg, d00d look at my interface IP!!!!") other than being able to IP their vaseline container to Walgreens when it's empty, I honestly think this is about akin to the Bush administration in the history of the US :) A small blip we need to live through to expand out to something worth having and fixing the stagnancy that occurs during IPV6.

Re:IpV6 reality check

[swillden]

I have a Linux box connected to a Netgear router providing NATted connections, itself connected to a cable modem that goes out to Comcast, who provides my pipe and is my ISP. Comcast ISP, by the way, does not support IPv6. If IPv6 is here and working today, I should be able to use it. How do I do that?

Your main obstacle is Comcast, who has announced that they are going to begin providing v6 support.

If you want to, you *can* work around them, by using a v6 tunnel provider (like Hurricane Electric). The configuration is not hard, but isn't something Grandma could do (not my Grandma, anyway).

When Comcast begins providing IPv6 addresses, if you connect your Linux box directly to the cable modem, you'll instantly have access to the v6 network, without losing access to the v4 network. They coexist seamlessly. Your Netgear router has an IPv6-capable IP stack and if you connect that to IPv6-enabled Comcast cable modem, it will also pick up an IPv6 address and use it. It probably is *not* configured correctly to pass v6 address announcements to your LAN, though, so your machines probably won't get v6 addresses. And you probably can't change that without installing new firmware, which Netgear probably doesn't provide even if you were willing to install new firmware.

Those are the two big problems with v6 right now: ISPs that don't provide v6 addresses and home routers that aren't properly configured for v6 support. If ISPs start providing v6, though, router manufacturers will eventually pull their heads out and new routers will do the job correctly (and the manufacturers will probably also provide new firmware for those courageous enough to go that route).

However, because v4 and v6 can coexist peacefully, no "big bang" transition is required. If Comcast turned on v6 support, all of their subscribers who don't use a brain-dead router would instantly start using v6 for any web site (for example) that provides an AAAA DNS record. As the rest of them got new routers with proper v6 support, they'd also start using v6.

If you can't tell me how, than Dan's "hypothetical problems" are very real indeed.

If you'd like more detail on how, I can point you in the right direction.

Re:IpV6 reality check

[John Hasler]

> ...now find a modem that does it.

If it knows about IP numbers it isn't a modem.

Re:IpV6 reality check

[John Hasler]

> It's free...

Thank you for that. I had heard of the service but never checked into it because I assumed there was a charge (after all, they call themselves a "broker").

Re:IpV6 reality check

[CarpetShark]

Grandma will upgrade to IPv6 when her ISP says your modem needs to be replaced or they have a tech swap her cable modem.

Which, as far as most ISPs are concerned, is ideally never.

Re:IpV6 reality check

[chrylis]

Of course it was a problem in this circumstance; we had a cable plugged into the wrong socket! However, my point is that IPv6 deployment doesn't require hand-editing config files buried deep inside your system; if a router shows up and starts advertising, IPv6-enabled systems can start using it without the machine's users' even having to be aware that it's there.

Re:IpV6 reality check

[TheLink]

> Why wouldn't you keep both, out of curiosity?

People keep saying we're running out of IPv4 addresses. If we can go around keeping IPv4 addresses it would mean we aren't really running out of IPv4 addresses ;).

Re:IpV6 reality check

[chrylis]

Why wasn't it that simply, an IPv4 would have "contained" N amount of ipv6 addresses? That would have been so much more easy to understand.

That's actually an option that you can turn on if you like; it's called 6to4, and it maps each IPv4 address to a /48 block of IPv6 addresses.

Re:IpV6 reality check

[adiposity]

Yes, the transition would have been smoother had there been a clearer standard for IPv4-to-IPv6 address mapping, but IPv6 does work fine, thank you, and the upgrade is happening largely through aging out of older systems.

XP doesn't really support ipv6 nicely. It does work but it's certainly not easy. Windows Me, 98, and 95 are still a big part of internet hosts. When you say, "the upgrade is happening," do you mean that in 10 years, none of these hosts will exist? Considering that XP is still included on many new computers (dell and lenovo still offer XP on all business class computers, for example), and pretty much all netbooks, I'm not so sure about that.

IPv6 works fine, sure. So does token ring.

-Dan

Re:IpV6 reality check

[Ant P.]

If IPv6 is here and working today, I should be able to use it. How do I do that?

1) Install linux on router (openwrt will do fine)
2) Install radvd on router (opkg install radvd)
3) Read instructions to set it up (radvd doesn't have a sugar-coated web CGI like most of owrt's packages)
4) Poke the initscript or reboot it
5) There is no step 5.

If you're lazy Apple's Airport routers supposedly do step 1-4 already.

Re:IpV6 reality check

[chrylis]

To be fair, the XP issue is one of the reasons I want to play surprise paintball in MS headquarters. That said, it's not too difficult to enable: "netsh interface ipv6 install". Stick that on the "ISP install CD" and you're done.

Clients running software older than 2k I consider expendable. ;-)

Re:IpV6 reality check

[adiposity]

The point is not so much new hosts as existing hosts. Since the ISPs haven't done what you say, not only are there a huge number of XP hosts out there without ipv6, it's still growing.

If they did what you say, and ISPs offered ipv6, then XP would still not be ideal. Since XP does not support DHCPv6, this could cause problems for ISPs trying to assign ipv6 addresses.

The bottom line is that ipv4 is working, and ipv6 is working, but they don't work together. My ISP is Hurricane, so I have as much ipv6 connectivity as anyone. It sure would be nice if ipv4 hosts could talk to the ipv6 internet, though. Otherwise we just have to wait until enough ipv6 hosts are not just capable but correctly configured that it makes sense to get an ipv6 address if you don't already have one. But since the ipv4 network will have a superset of the ipv6 network's hosts for a long time, just the opposite occurs. You still need an ipv4 address, so your ipv6 address seems pointless. One day, when you can't get an ipv4 address, you will be stuck talking to only the ipv6 net. And then, and only then, will website owners finally feel the need to offer ipv6 services--because if they don't, some clients can't reach them...

-Dan

Re:IpV6 reality check

[WaywardGeek]

I agree, Dan was basically right, seven years ago. The situation hasn't improved much. My prediction:

- As we start running out of IPv4 addresses, ISPs will start selling them to each other. Suddenly, we'll start using IP addresses wisely.
- There are only 111 million active domain names. Most of those point to shared IPs on virtual hosts and domain name squatters.
- With so few actual required IP addresses, the IPv6 transition will never happen.

We geeks like to think that the world will naturally adopt new, better technologies, simply because it would be the right thing. Reality is far different:

- Consider UTF-16 and UTF-32. They basically delayed multi-language support world-wide until UTF-8 made it painless for developers, allowing them to continue using 'char' data types in C for strings.
- NAT may have been invented by geeks for various cool reasons. However, it dominates the web because our ISPs like to charge extra money for multiple IP addresses, and we consumers like to dick them out of it.
- ISPs dynamically switch our IP addresses to protect us. A dynamically changing network is far harder to attack, especially when consumers know virtually nothing about security. On a drive through South Carolina recently, I found about 80% of all WiFi points were wide open!
- ISPs would love to force customers onto another level of NAT. They could kill a ton of P2P traffic, with a great excuse for the FCC: "I ran out of addresses!"
- The SIP protocol was designed by committee, like IPv6. It basically doesn't work across NATs worth a damn, and it's slowed VoIP adoption by years.

TCP and UDP increase our addressable space to 48 bits, which should last the rest of our lifetimes. IPv6 should have seen the success of these protocols and created an extension to IPv4 that would work with old equipment and software.

Re:IpV6 reality check

[Tacvek]

Actually, why would you not just use the utility provided for that very purpose, rather than using netsh? Just run "ipv6 install".

Re:IpV6 reality check

[Eil]

Few ISPs are even thinking about IPv6.

I work at a web host and know people from other hosting companies and ISPs around town. Not a single Internet-related business that I know if around here has any interest in IPv6 because few of their engineers know anything about it, none of their equipment supports it, IPv4 addresses are still remarkably cheap, and (most importantly) not a single customer is asking for it.

No business will invest in IPv6 until there is either a clear cost benefit to supporting it or until customers start demanding it. History has proven again and again that technical merit alone does not propel technology into the mainstream.

Re:IpV6 reality check

[dbrutus]

Yes, but practically it means on average once every x years as the darned things just die off. X is a known statistic for every ISP. It's how they budget equipment replacement costs. Over the span of a decade, it happens to just about everyone.

Re:IpV6 reality check

[chrylis]

They run the exact same routines, but the "ipv6 install" syntax was deprecated in SP2 in favor of the netsh call... if you want to know why, ask Microsoft...

Re:IpV6 reality check

[slack_justyb]

99%+ of the Internet *still* doesn't use IPv6.

Really? Could you cite where you get your numbers? May I point you to here to get better numbers? I can personally speak for five or six Beowulf clusters at different universities all sending data to researchers and customers via IPv6 links.
Seriously, just because no one on your block uses IPv6, does not mean that businesses, universities, government agencies, and telecos are not using IPv6 in large deployments. I am really confused at Slashdot's current trend that IPv6 deployments just aren't happening, when in fact I see companies switching to IPv6 deployments on a quarterly basis (disclaimer: yeah I know, it's not on some huge scale like daily basis, but some of the comments on Slashdot make it sound like the rate is 0.000%)
Finally, the biggest thing that I have seen slow deployments of IPv6 is simply lack of knowledge of the protocol. Most admins that I run into off-site usually have no working knowledge of IPv6, or have limited experience in IPv6 deployment and working in a dual-protocol environment.

Re:IpV6 reality check

[chrylis]

If they did what you say, and ISPs offered ipv6, then XP would still not be ideal. Since XP does not support DHCPv6, this could cause problems for ISPs trying to assign ipv6 addresses.

Get an account with SixXS or HE and play around with IPv6 some. One of the things you'll discover is that with IPv6, you don't need to assign addresses. You don't even need DHCPv6 to advertise DNS servers or default routes.

It sure would be nice if ipv4 hosts could talk to the ipv6 internet, though. Otherwise we just have to wait until enough ipv6 hosts are not just capable but correctly configured that it makes sense to get an ipv6 address if you don't already have one.

Unfortunately, the problem is a simple mathematical one. IPv4 hosts can't talk to the IPv6 Internet because they can't address them. That's not a surprising drawback, it's the reason IPv6 was developed.

You still need an ipv4 address, so your ipv6 address seems pointless.

If you already have public IP addresses for all of your devices, sure. However, I don't get public v4 IPs from my ISP for each of my systems (even before counting the virtualized servers). Since I have an IPv6 tunnel set up with a globally routable /48 prefix, however, I can directly address each system from anywhere in the world without having to use a VPN or other translation.

Re:IpV6 reality check

[slack_justyb]

If you can't tell me how

I believe that someone has already written a HOWTO. Besides, Comcast is looking into IPv6 deployments for consumers (to save you on that tunneling) around 2010 -2012.

But the reality is this. You can connect to the Internet via IPv6 if you choose to want to. That's a big thing in the whole IPv6 debate. It is a question of if you want to or not, as opposed to if you can or not. Most people at the current moment do not want to, but they can if they truly want to. It would be a whole different debate if you totally lacked the ability to connect via IPv6. Soon enough, most people will want to switch to IPv6, companies that are not ready for this transition will find themselves at a competitive disadvantage. (see TFA)

Re:IpV6 reality check

[MikeBabcock]

If they didn't manifest in reality, we'd all have switched by now.

As it is, even with an IPv6 compatible OS and compatible devices, I use all IPv4 because its simpler and works better in practise and is easier to debug as a result.

IPv6 has been around long enough to call it an abysmal failure as far as I'm concerned. Next, please.

Re:IpV6 reality check

[MikeBabcock]

My student ACM chapter once inadvertently leaked router advertisements for our IPv6 connection onto the building's main network and hijacked most of the Web traffic as the machines saw our connection and automatically (and transparently to the users) started routing through it.

That sounds like a huge security hole to be plugged before people condone IPv6 deployments, or don't you see it that way?

Re:IpV6 reality check

[chrylis]

Not particularly. The only security risk would be possible eavesdropping, and (at the risk of starting another flamewar) that's what IPsec is for; it's not like IPv4 packets aren't sniffed at points all over the Internet.

Additionally, the scenario is almost identical to that of my sticking a rogue IPv4 DHCP server on the network. The communications range is limited to link-local, and access switches should be configured not to forward RAs if this is a concern.

Re:IpV6 reality check

[Yaztromo]

If you want to, you *can* work around them, by using a v6 tunnel provider (like Hurricane Electric). The configuration is not hard, but isn't something Grandma could do (not my Grandma, anyway)....

Those are the two big problems with v6 right now: ISPs that don't provide v6 addresses and home routers that aren't properly configured for v6 support. If ISPs start providing v6, though, router manufacturers will eventually pull their heads out and new routers will do the job correctly (and the manufacturers will probably also provide new firmware for those courageous enough to go that route).

Apple's Airport Extreme base stations have built-in IPv6 with auto configuration for clients. They even have built-in tunnelling. On their IPv6 configuration page, you just have to turn it on and specify whether you want it to be tunnelled or not, and you're all set. As an added bonus, all of their wired ports are gigabit, and the latest revision has independent 802.11b/g and 802.11n radios (so 802.11g clients don't slow down the network for 802.11n clients, and so that 802.11n clients can run in the 5Ghz range).

If you're into IPv6 at home, it's the best off the shelf solution available. I installed one last fall, and have been able to convert my entire network to using IPv6 internally, and many of the wired clients to gigabit speeds.

Yaz.

Re:IpV6 reality check

[bconway]

Far from it. Comcast, the nation's largest (or second largest, depending on who's counting) ISP is rolling out IPv6 later this year, with a complete roll-out in 2010.
Comcast Plans Residential IPv6 In 2010

Re:IpV6 reality check

[Anonymous Coward]

Every time my system boots there is an extra 10 second delay while it times out trying to get an IPv6 address, then gives up and falls back to IPv4. They've made it harder to find and turn off in every new software release.

Yes. IPv6 is working today - just as they designed it.

Re:IpV6 reality check

[adiposity]

I have an HE account, they are my ISP...

Yes, DHCPv6 is not a requirement of IPv6. Does it offer additional functionality? Yes. I have used IPv6 for several years, and am aware of its abilities. Technically, DHCPv6 is not a dealbreaker, but it might be for some ISPs.

Unfortunately, the problem is a simple mathematical one. IPv4 hosts can't talk to the IPv6 Internet because they can't address them. That's not a surprising drawback, it's the reason IPv6 was developed.

You are wrong about this. There are several solutions being worked on to do exactly this. Of course it's not pretty, for obvious reasons (ipv6 hosts pretending to only be as numerous as ipv4 hosts, etc.) Check out IVI and Dual Stack Lite. Something like this had better exist, or we will probably never get ipv6 going.

If you already have public IP addresses for all of your devices, sure. However, I don't get public v4 IPs from my ISP for each of my systems (even before counting the virtualized servers). Since I have an IPv6 tunnel set up with a globally routable /48 prefix, however, I can directly address each system from anywhere in the world without having to use a VPN or other translation.

You basically are using ipv6 as a VPN. Yes, I know that's an overly broad classification of IPv6, but what's your point? You set up tunnels, configure ipv6 interfaces and addresses, and memorize ipv6 addresses, all so you can access a few remote hosts? I can do this with a VPN, and it's a hell of a lot easier to configure. It also has the added benefit of security--only those with access to my VPN can actually talk directly to these hosts.

Globally routeable addresses are cool, of course...but it does nothing to solve the problems with IPv6 transition.

-Dan

Re:IpV6 reality check

[chrylis]

You are wrong about this. There are several solutions being worked on to do exactly this. Of course it's not pretty, for obvious reasons (ipv6 hosts pretending to only be as numerous as ipv4 hosts, etc.)

I wasn't as precise as I should have been; I meant that in the sense that IPv4 hosts can't talk to the whole IPv6 Internet. And amen on the "not pretty"; I've done projects with ptrtd that would probably make the original author cringe.

You basically are using ipv6 as a VPN. Yes, I know that's an overly broad classification of IPv6, but what's your point? You set up tunnels, configure ipv6 interfaces and addresses, and memorize ipv6 addresses, all so you can access a few remote hosts? I can do this with a VPN, and it's a hell of a lot easier to configure. It also has the added benefit of security--only those with access to my VPN can actually talk directly to these hosts.

It's kind of like a VPN when I'm using AICCU on my laptop from a hotel or such as my uplink to the IPv6 Internet. But even then, I also have access to any other IPv6-connected hosts, not just the ones at my office, and when I'm at a customer site with an IPv6 connection, no tunneling or the like is required.

In contrast, not only does a VPN always require connecting straight back to the office, IPv4 VPNs can screw up my laptop's routing table horribly (I frequently use three physical interfaces on separate networks, not to mention any virtual ones), and they don't provide a single, configure-once path to anywhere I want to go.

And while I could probably remember the IPv6 addresses if I cared to, that's what DNS is for...

Re:IpV6 reality check

[Cramer]

End users don't need to know or do anything. At this point, all we really need is for ISPs to provide IPv6 and the rest will happen without users doing -- or knowing -- a thing.

100% WRONG . That little thing you have between your cable/dsl modem and your computers -- called "a router" (and that's being generous) -- will have to be upgraded at best, and replaced at worst. If you're plugging your windows box into the internet "naked", then you're a g** d***ed idiot and should be taken out and shot.

The cheapy netgear, dlink, linksys, et. al. routers/gateways/etc. for the most part don't have the memory or processing power to support IPv6. Even if they did, users would still have to upgrade them, and very few ever do. In the corp. world, there's a great deal of work to be done to integrate IPv6. Not the least of which is none of the firewalls (fully) supporting IPv6... if you have a pix firewall, throw it away -- "Upgrade to an ASA today!"; even 'tho it's working fine (and has for decades), it'll never support IPv6.

All of the major OSes have solid IPv6 support in place...

No they don't. IPv6 support in Windows XP is "experimental" and lacks just about everything found in modern (i.e. windows 7) implementations.

The transition plan is solid, and works very well in practice...

"Stop using IPv4 and start using IPv6." (not necessarily in that order) Is not a "plan". I was around back in the early days... people had appletalk and IPX networks and wanted to "get on the internet". None of them were happy with the requirement to add a completely new network layer (IPv4) to their network and thus new software on every machine. IPv6 is the same mess. IPv4 and IPv6 share only the first two letters. At the core, they are completely, utterly, fundamentally different. People will be running "dual stack" for many years to come due to this incompatibilty and simple fact that a great number of devices/systems will NEVER support IPv6. (for example, I still have IPX only print servers.)

Re:IpV6 reality check

[Cramer]

99% of his rant is on the complete lack of interoperability and the non-existance of any migration path. Not that there can be any migration since the two protocols are completely alien to the other. Your only choice is to start using the new and eventually stop using the old. People are resistant to the first part, and the last part isn't going to happen for decades.

Re:IpV6 reality check

[Cramer]

I can directly address each system from anywhere in the world without having to use a VPN or other translation

And so can everyone else. Having watched a Windows 2000 Server be compromised during installation, and a redhat server compromised on it's first boot (before patches could be applied)... no machine should ever be connected to the internet "naked".

As much as NAT "isn't security", it keeps the internet out. You cannot mug me if you don't know where I am.

Re:IpV6 reality check

[Cramer]

You don't even need DHCPv6 to advertise DNS servers or default routes.

Because you are still running an IPv4 stack. IPv6 autoconfig will give you a prefix and a router(s). That's it. DHCPv6, in it's current brain damage, won't provide domain names, a hostname, ntp servers, or pretty much most of the data that can be provided from DHCPv4. PXE netbooting... I don't think anyone has even realized that won't work. :-)

Turn off the IPv4 stack and see how much static information you have to enter.

Re:IpV6 reality check

[r7]

Grandma will upgrade to IPv6 when her ISP says your modem needs to be replaced

Now this is the stuff of Ivory Towers. In reality Grandma will find a new ISP when her grandkids warn her that IPv6 addresses will only be able to connect to 10% of the Internet.

Your argument makes it sound like you're just a lazy network engineer

Not lazy, just smart. Smart enough to understand that the transition to IPv6 will not happen as long as people are too "lazy" to think things through. You don't have to be a network engineer to see that partial net access is a non-starter. Think instead of the consumer backlash when they discover A) they won't have 100% network accessibility, B) all of their internal addresses will be owed by their ISP (thanks to ILECs blocking IPv6 NAT), and C) all of their IP addresses, internal and external, will be trackable by Google and DHS. In reality the ILECs don't care, they don't have to as long as the lack of government regulation allows them to profit from this wholly artificial shortage (very much like Enron did from energy deregulation, with helpless consumers sucking up the same exponential price increases).

Bottom line is that IPv6 is and will remain a non-starter until network engineers and, wanna-be engineers like aztektum, understand that every node will have to communicate with every other node regardless of IP version. That means servers will need both IPv6 and IPv4 addresses, and clients will need either the same 1 to 1 mapping or NAT, for the duration of the transition.

Re:IpV6 reality check

[Anonymous Coward]

Why should he make solutions? He is not the ipv6 working group. I personally am eagerly awaiting the ipv6 transition. I am an hourly billed network engineer. As long as I do not seem to actually attempt to start or lead an ipv6 transition, I will be able to make a killing swooping in and fixing the years of monstrous horrible network outages caused by the terrible mistake of making a replacement for ipv4, and not an extension of it. If it seems like I planned or lead such a transition however, I will be fired.

Re:IpV6 reality check

[kwerle]

That's bull. End users don't need to know or do anything. At this point, all we really need is for ISPs to provide IPv6 and the rest will happen without users doing -- or knowing -- a thing.

Hi. I'm an end user. I don't have an IPv6 address because it is too much work and I have to know too much.

Dan is right; if IPv4 were just a subset of IPv6, we'd all have IPv6 [compatible] addresses already. All IPv4 software would continue to work. All IPv4 routing would continue to work. The whole transition would be easier.

Re:IpV6 reality check

[Lanboy]

I am a very greedy network engineer and I look forward to the horrendous problems caused by ipv6 service transitions. I get paid by the hour after all.

Grandma will get another ISP.

Questions:

What percentage of customer downtime is considered a success for ipv6 transition for a service provider? Lost revenue due customer desertion?

Are those people on the phone you talk to at Verizon or Comcast "Network Engineers"?

What percentage of the television set top boxes provided by ISP triple play providers have an ipV6 stack? What percentage of the VOD backend? How much loss of revanue of lost video on demand is acceptable?

How much have you worked with DOCSIS compliant cable gear under ipv6 or ipv4/6 hybrid mode? HOOO Daddy!

Is Comcast going to buy grandma a new router? Ship it to grandma for free? Different Comcast?

Re:IpV6 reality check

[Lanboy]

Hey we are all looking into it...

Re:IpV6 reality check

[ion.simon.c]

I'd like to use jumbo frames on my wired LAN. It's my understanding that all interfaces on a VLAN *must* use the same MTU, unless one wants to run into problems.
a) Is my understanding correct?
b) Can you configure each wired port into its own VLAN, so that one can connect 100mbit devices and jumbo-frame GigE devices into the same router?

(Sorry, too lazy to use Google atm.) :(

Re:IpV6 reality check

[isdnip]

Right. The transition must fail because at every stage, everyone needs v4 addresses, and thus there will be more v4-reachable destinations, and thus no need to move to v6.

But then v6 is so frabjulously flawed, so stupid in so many ways, that it will fail on its own. It is just a way for Cisco to force costly new hardware on people.

Re:IpV6 reality check

[chrylis]

Because you are still running an IPv4 stack. IPv6 autoconfig will give you a prefix and a router(s). That's it.

Plus an RDNSS (recursive DNS server) entry. That gives you an IP address, a default gateway, and DNS servers. That's all of the information that most IPv4 DHCP replies contain.

Re:IpV6 reality check

[chrylis]

I've never said you shouldn't still use a firewall. Defense in depth is still the best policy.

Additionally, those machines were compromised only because the IPv4 address space is small enough to scan. If you're not assigning addresses like :1 to machines, scanning even a /64 is infeasible.

Re:IpV6 reality check

[Cramer]

True. But for 99% of the internet connected, NAT comprises 100% of their security. And that's all they need. IPv6 is a lot more complicated. ...scanning even a /64 is infeasible. That's the IPv6 equiv to sticking your fingers in your ears and screaming LA LA LA LA LA. For starters, that's wrong -- one need not scan the entire /64. Plus, that's a completely wrong thought process for any security context. That's like claiming I cannot break into your house because I don't know where it is. An IPv6 host will eventually talk to some other machine(s) -- otherwise it has no need for a network at all, and then it's not hidden any more. Ah, but what about the "privacy extensions", you're thinking... most machines will still have that eui-64 address. See, the nuts that designed this crap didn't spend even 1 second thinking about how this stuff will get used; they spent even less time looking at how people currently used networks.

Re:IpV6 reality check

[Jeremi]

If they didn't manifest in reality, we'd all have switched by now

Why would we? For those of us that already have IPv4 addresses, there's not a whole lot that IPv6 can do that IPv4 won't... so why bother?

It's the people who don't yet have IPv4 addresses and find it difficult to get them who will find IPv6 attractive.

IPv6 has been around long enough to call it an abysmal failure as far as I'm concerned. Next, please.

What alternatives are there? The world can stick with IPv4 until it's not practical anymore... and then what, IPv8? Not bloody likely... it will be IPv6, sooner or later. Probably later.

Re:IpV6 reality check

[Jeremi]

no machine should ever be connected to the internet "naked".

Of course, the NAT routers that you hide your Windows PCs behind are also computers... and you are attaching them to the internet "naked". What will protect them? :^)

Re:IpV6 reality check

[Cramer]

(ok, smartass)

They aren't a "computer" in the common sense. And they aren't "naked"... they protect themselves by not running any services on the WAN (internet) side, and not having much to compromise in the first place.

Re:IpV6 reality check

[AbbeyRoad]

> The transition plan is solid, and works very well in practice ... What's lacking is the ISP motivation,

Moron, the very definition of a "solid plan" is that ISPs would have "motivation".

Yes, this is what "geeks" (in the most derogatory propeller-head sense of the word) always say:

    1. It is technically sound.
    2. There are no bugs.
    3. My users do not seem to like it.
    4. Ergo - there is something wrong with my users.

With people-like-YOU it is always someone-ELSE that has the problem.

Let me slap you in face and point out a flaw in your logic: If everything is as perfect as you say,
WHY don't people want to migrate?

    5. Ergo - the thing that is wrong with my users is that a religious outside force is sabotaging my perfect plan.
    6. Ergo - it is not my fault.
    7. Ergo - I can take full credit for a perfectly conceived plan even though I have failed to produce anything useful.

-paul

Re:IpV6 reality check

[AbbeyRoad]

> Seriously, just because no one on your block uses IPv6, does not mean that businesses,
> universities, government agencies, and telecos are not using IPv6 in large deployments

bullshit.

NO ONE is the slightest bit interested in IPv6 at the moment, except for extremely rare niche
deployments LIKE universities.

YOU need to go speak to a real owner of a real ISP and ask them why they are not
interested in IPv6. You won't get an answer - you'll just get a laugh.

-paul

Re:IpV6 reality check

[higuita]

>- As we start running out of IPv4 addresses, ISPs will start selling them to each other. Suddenly, we'll start using IP addresses wisely.

problem: routing... isnt that easy to "move" IPv4 blocks

>- There are only 111 million active domain names. Most of those point to shared IPs on virtual hosts and domain name squatters.

problem: yes, only servers need IP...NOT! clients also need IPs, nat can work for a few apps, but if the use of nat increase you turn the internet as a "one way" communication channel... if all people used NAT, even local address would start to became full on the ISP side

>- With so few actual required IP addresses, the IPv6 transition will never happen.

problem: we all need one IP... again, NAT fake that you have one IP, in reality you are sharing it with many others... enforce NAT and you will need to solve the communication between peers... do that and you will saturate the NAT with millions of p2p connections... it might even work, but the ipv6 is the clean solution and sooner or later will happend... remember that ARPNET was disconnect only a few years ago, it took time also to deploy ipv4

>- Consider UTF-16 and UTF-32. They basically delayed multi-language support world-wide until UTF-8 made it painless for developers, allowing them to continue using 'char' data types in C for strings.

UTF-8 is already the better thing... there are still many people using local codepages (windows fault mostly), but UTF-8 is here and each day more apps use it. UTF-16 and UTF-32 fail because are alot more heavier, just to support a few more people (5 languages? 8? not the hundred supported by UTF8 )

>- NAT may have been invented by geeks for various cool reasons. However, it dominates the web because our ISPs like to charge extra money for multiple IP addresses, and we consumers like to dick them out of it.

NAT is a hack that mostly works... ISP like it also... but ISP also would like to better manage routing... the main reason they dont deploy IPV6 is the older hardware support (or lack of) and lack of request... if windows didnt support it, no one would request it... now that MS start to support IPV6, we will see a increase of the IPv6 deploy... more people start to use ipv6, the faster it will grow

>- ISPs dynamically switch our IP addresses to protect us. A dynamically changing network is far harder to attack, especially when consumers know virtually nothing about security. On a drive through South Carolina recently, I found about 80% of all WiFi points were wide open!

bull sh*t... when dynamic IPs increase security? it you have a open, insecure port, find it , exploit it and install the rootkit... if IP changes, it will still call home... it can only increase the security if the IP change during the attack (little probability) and increase a little the time to scan ( retry offline in static IP vs retry all in dynamic IP), but zombies network dont care about that... with IPv6 is even harder to scan for holes, as the IP space is HUGE

but if you (or the ISP) want, change your IP in ipv6 whenever you want, if that makes you happy...

>- ISPs would love to force customers onto another level of NAT. They could kill a ton of P2P traffic, with a great excuse for the FCC: "I ran out of addresses!"

most ISP dont really care about P2P, other than eating their bandwidth... also, with static IP of ipv6

>- The SIP protocol was designed by committee, like IPv6. It basically doesn't work across NATs worth a damn, and it's slowed VoIP adoption by years.

all 2 way communication have problems with NAT... some work better than others, most need external servers to "proxy" or coordinate the NAT transversal, but that require servers for all protocols and limit the traffic to UDP

yes, ipv6 is not perfect, its taking ages to deploy, but in the end will win, just like ipv4 won over all other protocols

Re:IpV6 reality check

[sglines]

Dan Bernstein has mostly been off in left field over the years but I have to agree with him 100% this time. IPV6 is fundamentally flawed because of its all or nothing approach. I would recommend scrapping the current IPV6 entirely and replacing it with something more like this:

8 bytes - reserved for expansion
4 bytes - current BGP Autonomous System number
4 bytes - current IPv4 address

This way IP(V8) could be built up from the core outwards. Once the core of the Internet is talking IPV8 the interior can expand as needed and as noted in the Bernstein article. This scheme provides an almost transparent transition to the new and improved Internet.

SG
-- Life is simple, why complicate it?

Re:IpV6 reality check

[swillden]

Hi. I'm an end user. I don't have an IPv6 address because it is too much work and I have to know too much.

No, you don't have an IPv6 address because your ISP hasn't given you one. There's no need for you to know anything or do anything.

if IPv4 were just a subset of IPv6, we'd all have IPv6 [compatible] addresses already.

That would perhaps have smoothed the transition a little, at non-trivial expense to IPv6. These are engineering tradeoffs, and I'm not sufficiently knowledgeable of the issues (and neither is Dan) to judge which approach is better. Regardless, unless we want to go out and create IPv7, the fact is that what Dan wishes for is not how IPv6 works, and IPv6 does in fact work just fine. All that's really required is for the ISPs to begin supporting it. Earthlink has for several years, and Comcast has announced their plans to support it, so things are moving, if not as fast as we'd like.

Re:IpV6 reality check

[swillden]

End users don't need to know or do anything. At this point, all we really need is for ISPs to provide IPv6 and the rest will happen without users doing -- or knowing -- a thing.

100% WRONG . That little thing you have between your cable/dsl modem and your computers -- called "a router" (and that's being generous) -- will have to be upgraded at best, and replaced at worst.

Yes, I addressed that issue in my comment, if you read it.

The cheapy netgear, dlink, linksys, et. al. routers/gateways/etc. for the most part don't have the memory or processing power to support IPv6.

That's nonsense. IPv6 is easier and cheaper to route/manage than IPv4. For example, with v6 and it's stateless autoconfiguration, there's no need to keep track of DHCP leases. All the router has to do is periodically broadcast a router advertisement. And all of those cheapy routers and gateways ALREADY HAVE IPv6 stacks, because they're all running Linux (most of them), QNX or other embedded OSes that support IPv6. What's lacking is just attention to the upper layers to properly use v6 -- stuff like actually broadcasting those advertisements.

Finally, most of those cheapy routers can be updated with user-provided firmware RIGHT NOW to give them full v6 support. I've upgraded the two Linksys routers in my house. I'm not suggesting that the average user will do this, they won't. They'll buy a new router. But my point is that the hardware is perfectly capable.

No they don't. IPv6 support in Windows XP is "experimental" and lacks just about everything found in modern (i.e. windows 7) implementations.

Works fine for me.

"Stop using IPv4 and start using IPv6." (not necessarily in that order) Is not a "plan".

The "not necessarily in that order" is a crucial part of the plan. The plan is "Start using IPv6 in addition to IPv4 and eventually transition most traffic to the new protocol".

I was around back in the early days... people had appletalk and IPX networks and wanted to "get on the internet". None of them were happy with the requirement to add a completely new network layer (IPv4) to their network and thus new software on every machine.

So was I, but I don't recall any heartburn over the issue. We were mostly all running thinnet or Token Ring at the time, and it carried the multiple protocols just fine. It was a bit of a pain to install Trumpet (or whatever) IP stacks on the machines, but they coexisted nicely with the other software, and didn't consume much of the (then very precious) RAM, but not a huge issue.

IPv6 is the same mess. IPv4 and IPv6 share only the first two letters. At the core, they are completely, utterly, fundamentally different. People will be running "dual stack" for many years to come due to this incompatibilty and simple fact that a great number of devices/systems will NEVER support IPv6. (for example, I still have IPX only print servers.)

And those print servers still work just fine, don't they? I don't think people will be running dual IPv4/IPv6 stacks for "years", I think the dual stacks will be there essentially forever, long after, for example, Linux no longer supports IPX. And, actually, the IPv4/IPv6 issue is much less intrusive because AppleTalk and IPX are different at every layer. IPv6 only replaces the datagram transport layer. TCP, UDP, etc. don't have to be modified, nor do any other protocols that don't deal with addresses.

Also, IPv4 and IPv6 *are* very similar. Go look at the Linux or *BSD implementations and you'll notice that 90% of the IP-level code is shared. It turns out that adding v6 support to a well-designed v4 stack adds only a very small amount of code -- and removing v4 support removes only a very small amount of code. Might as well keep them both.

I find your comm

Re:IpV6 reality check

[swillden]

> The transition plan is solid, and works very well in practice ... What's lacking is the ISP motivation,

The very definition of a "solid plan" is that ISPs would have "motivation".

They will have motivation, as the IPv4 address space limitations begin to constrain their operations. Thanks to much effort and cleverness, this has taken longer than expected, but it's coming.

I think what is likely to happen if the US and European ISPs delay the shift too long is that other parts of the world which are even more constrained with respect to v4 address space will make the move first. In particular, I wouldn't be surprised if China were to be the first to move to a primarily IPv6 network, with plenty of Chinese-only services (web sites, etc.) which are v6-only.

Eventually, though, even North American and European ISPs will be forced to transition. We may for a while see two pricing tiers, where you pay a base fee for a connection, which includes v6 only, but can pay a surcharge to get the use of a v4 address. That's some time away, though.

Note that using the v4-in-v6 subset of the v6 address space, as Dan Bernstein recommended, would not significantly change this dynamic. It would still be the case that if services want to be accessible to everyone, they have to have a v4 address and if users want access to everything, they have to have a v4 address.

Re:IpV6 reality check

[nametaken]

As far as I can tell, what people have been "cheerfully ignoring" is IPv6.

It's worse than that. IPv6 is dead dick. It has been for years.

Re:IpV6 reality check

[Yaztromo]

I'd like to use jumbo frames on my wired LAN. It's my understanding that all interfaces on a VLAN *must* use the same MTU, unless one wants to run into problems. a) Is my understanding correct? b) Can you configure each wired port into its own VLAN, so that one can connect 100mbit devices and jumbo-frame GigE devices into the same router?

(Sorry, too lazy to use Google atm.) :(

Unfortunately, I haven't tried experimenting with this yet. My wired network is still primarily 100Mb/s clients -- I only have one dedicated gigabit client on the wired network (my MacBook is also a gigabit client, but I generally connect at about 300Mb/s via 802.11n, and only wire myself into the network when I need to do some sort of bulk transfer to my dedicated gigabit file server).

So unless someone else knows, you might have to resort to Google after all.

Yaz.

Re:IpV6 reality check

[Anonymous Coward]

Wow, so much pent up anger over a simple statement. But that's okay because you are so out of the loop on IPv6 it may very well cost you your reputation. I don't know about the parent to your reply but I've talked to ISPs in my area and all of them offer IPv6 to customers who request it. Most ISP understand the government requirement for IPv6 and take it very seriously, unlike what you have said, "a laugh."

Maybe you should ask a serious ISP about IPv6, your comment is stupidity playing out in a comment area.

IPv6 is the protocol of the future

[Chris Mattern]

...and always will be!

thank the US government

[Lord Ender]

US government contracts are starting to require IPv6 support. This is the main reason I'm seeing for IPv6 adoption. If it weren't for the government, we would all be keeping our heads in the sand until the internet starts slowly failing and Goldman Sachs starts selling remaining IPv4 netblocks to speculators.

Re:thank the US government

[Chris Mattern]

US government contracts are starting to require IPv6 support.

And that's what they're getting: IPv6 support. You're getting set ups that *could* run IPv6. They don't, but they could.

Re:thank the US government

[Anonymous Coward]

I wonder if the long term end result of IPv6 will it being an edge protocol, while businesses will continue to use IPv4 in house, and when they need to route outside their company, it will use IPv6. This is clumsy, but this probably what may end up happening.

Re:thank the US government

[KevinKnSC]

But isn't a large supply of systems capable of running IPv6 a prerequisite for actually running IPv6?

Re:thank the US government

[Anonymous Coward]

It's because IPv6 is a joke. Everyone knows it is not the next step of the internet, or it would have been adopted sometime in the past 10 years it has existed. Everyone realizes how fail it is except the Government, which seems to explain their incompetence in wanting change Healthcare too. Face it, the Government is incompetent running anything besides HIGH LEVEL oversight of states and the military. Anything else our government touches(with the exception of NASA decades ago) is hogwash.

Just say no to government run internet (IPv6 crap), Healthcare, state laws, etcetera; let the people with real vested interest in these modern invention run them. For instance, the tech world has laughed at IPv6 for the past 10 years, and the American congress has laughed at government healthcare the past 60 years. 'Nuff said.

Re:thank the US government

[Lord Ender]

I can't tell whether this post is a joke or not.

Re:thank the US government

[knorthern knight]

> US government contracts are starting to require IPv6 support.

But do they REALLY want to face the outcry that'll happen when people applying for disaster relief funds can only do so via IPV6-enabled computers? http://politics.slashdot.org/article.pl?sid=05/09/08/1212237

Current deadline, in case anyone's interested

[tygerstripes]

Stolen from wikipedia:
"As of April 2008, predictions of exhaustion date of the unallocated IANA pool seem to converge to between February 2010 and May 2011"

Re:Current deadline, in case anyone's interested

[Em Emalb]

Does that take into account universities and large companies giving back all the class A ip addresses they have that were initially given out back in the day?

(I'm genuinely asking, I don't know)

Re:Current deadline, in case anyone's interested

[csnydermvpsoft]

The Wikipedia page on IP address exhaustion discusses this at some length. The Cliff-notes version:

1. There are blocks of under/non-utilized addresses that could be reclaimed, as well as reserved addresses that could be re-purposed.
2. Accomplishing the above would require a lot of investigation (into current usage) and/or reprogramming routers (which were designed with the current addressing system in place).
3. At best, the exhaustion date would simply be postponed.

It seems to me like more trouble than it's worth - especially since it just postpones the problem. If we're reprogramming routers anyways, why not deploy IPv6?

Re:Current deadline, in case anyone's interested

[tygerstripes]

Here's a link to the latest projection (wikipedia's out of date) which is updated daily. It explains how the estimate is made, so have a read if you're interested (I confess, I'm not)

Anyway, current guess is July 2011.

Re:Current deadline, in case anyone's interested

[Gerald]

Does that take into account universities and large companies giving back all the class A ip addresses they have that were initially given out back in the day?

Why the heck would HP, Apple, and every other publicly-traded company with /8s give back address space when they could lease it? (I'm also genuinely asking)

Re:Current deadline, in case anyone's interested

[Tony Hoyle]

Problem with that prediction is it's bollocks.

The potaroo exhaustion counter that these dates come from hasn't changed significantly in the last year that I've been following it. It dips somethimes to 650 days or so, then climbs over 1000 days sometimes.. but the average stays around the 700 mark.

If the prediction had been remotely accurate when it said 700 last year it should be at around 350 this year, and it just isn't.

Re:Current deadline, in case anyone's interested

[Anonymous Coward]

Why the heck would HP, Apple, and every other publicly-traded company with /8s give back address space when they could lease it?

As I believe leasing IP space in that manner violates IANA rules.

Re:Current deadline, in case anyone's interested

[Kt.foss.zealot]

Why the heck would HP, Apple, and every other publicly-traded company with /8s give back address space when they could lease it?

As I believe leasing IP space in that manner violates IANA rules.

This may very well be right, I don't know, but all it means is that these companies with /8s will have a huge incentive to buy/get bought by a major ISP. If you can't lease the address, lease the company :)

Re:Current deadline, in case anyone's interested

[Gerald]

The /8s I'm talking about were allocated before IANA even existed. If G.E. decided to start leasing out chunks of 4/8, there isn't much IANA could do about it.

Re:Current deadline, in case anyone's interested

[Cramer]

It may violate current rules, but it does not violate any law. And that's all that matters.

And, for the record, the reason ARIN/IANA aren't chasing down any of these /8's is because a) it won't help, and b) it will take a costly, time consuming legal battle to get them back.

Re:Current deadline, in case anyone's interested

[isdnip]

If GE has part of 4/8, then it's not pre-IANA. Net 4 was one of three Class A's belonging to BBN in the old days. 4 went to Genuity; two, used for government work, were returned. Genuity tanked and its assets went to Level 3, which kept 1/4 of the block.

Readiness test checklist

[wowbagger]

OK, here's a handy checklist to see if IPv6 is ready for prime time:

Use case: access a common web site (e.g. Slashdot) entirely by IPv6 packets:
1) Look up host's IP via IPv6 packets:
1a) Access a root DNS node via IPv6 packets (look up .org DNS server): CHECK
1b) Access .org DNS node via IPv6 packets (lookup slashdot.org address): ???
2) Access slashdot.org via IPv6 packets:
2a) Route IPv6 packets from my computer to "the Internet": FAIL
2b) Route IPv6 packets from "the Internet" to Co-Lo facility: ???
2c) Route IPv6 packets within the Co-Lo to Slashdot's servers: ???

When you (a presumably technically skilled user) can do that, then IPv6 is ready for the masses.

Re:Readiness test checklist

[Above]

1B)

% dig any org @a.root-servers.net

; > DiG 9.7.0a2 > any org @a.root-servers.net ;; global options: +cmd ;; Got answer: ;; ->>HEADER- opcode: QUERY, status: NOERROR, id: 4577 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 12 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;org. IN ANY ;; AUTHORITY SECTION:
org. 172800 IN NS B2.ORG.AFILIAS-NST.org.
org. 172800 IN NS C0.ORG.AFILIAS-NST.INFO.
org. 172800 IN NS D0.ORG.AFILIAS-NST.org.
org. 172800 IN NS A0.ORG.AFILIAS-NST.INFO.
org. 172800 IN NS A2.ORG.AFILIAS-NST.INFO.
org. 172800 IN NS B0.ORG.AFILIAS-NST.org. ;; ADDITIONAL SECTION:
A0.ORG.AFILIAS-NST.INFO. 172800 IN A 199.19.56.1
A0.ORG.AFILIAS-NST.INFO. 172800 IN AAAA 2001:500:e::1
A2.ORG.AFILIAS-NST.INFO. 172800 IN A 199.249.112.1
A2.ORG.AFILIAS-NST.INFO. 172800 IN AAAA 2001:500:40::1
B0.ORG.AFILIAS-NST.org. 172800 IN A 199.19.54.1
B0.ORG.AFILIAS-NST.org. 172800 IN AAAA 2001:500:c::1
B2.ORG.AFILIAS-NST.org. 172800 IN A 199.249.120.1
B2.ORG.AFILIAS-NST.org. 172800 IN AAAA 2001:500:48::1
C0.ORG.AFILIAS-NST.INFO. 172800 IN A 199.19.53.1
C0.ORG.AFILIAS-NST.INFO. 172800 IN AAAA 2001:500:b::1
D0.ORG.AFILIAS-NST.org. 172800 IN A 199.19.57.1
D0.ORG.AFILIAS-NST.org. 172800 IN AAAA 2001:500:f::1 ;; Query time: 15 msec ;; SERVER: 2001:503:ba3e::2:30#53(2001:503:ba3e::2:30) ;; WHEN: Thu Aug 20 15:18:36 2009 ;; MSG SIZE rcvd: 423

Check.

2a is also a check for me.

Re:Readiness test checklist

[Anonymous Coward]

1b) Check, AAAA records for root .org DNS servers, but they just get you the following glue NS records.
slashdot.org. 3600 IN NS ns-1.ch3.sourceforge.com.
slashdot.org. 3600 IN NS ns-1.sourceforge.com.
slashdot.org. 3600 IN NS ns-2.ch3.sourceforge.com.
1c) Access any of the slashdot.org authoritative DNS servers purely by ipv6... that's pretty much fail.

2a) You should be successful with that. There are several options for ipv6 tunneled over ipv4 available. They have worked with off the shelf consumer routers, although I admit to not testing with 2wire's network equipment.

It isn't that it's hard to deploy ipv6. It's harder to have an upstream provider
1) Provide ipv6
2) Provide key infrastructure services (such as DNS) on ipv6
3) Not screw up visibility to a common ipv6 tunnel provider.

After perusing through
http://www.commandinformation.com/ipv6/pdf/IPv6-Prefix-BigISPs_StatusTwo_v002.pdf
I see that sourceforge's upstream provider (savvis) doesn't have their prefix visible to hurricane electric yet.

I'm currently in the middle of a network hosting deployment where ipv6 will be an option, but it's a bigger PITA than it needs to be due to a lack of ipv6 availability from time warner.

There is also a lack of out of the box support for ipv6 on consumer network hardware. I can deploy ipv6 at my home (And actually do for some local traffic), but I end up either needing non-standard firmware for the devices, or configure one of the PCs as the ipv6 router.

Re:Readiness test checklist

[Anonymous Coward]

I can access ipv6 hosts easily enough, but only because I've got some nastily complicated hack on my connection that encapsulates my ipv6 packets inside ipv4 and anycasts them out to the nearest gateway. It's a mess, but it gets me access to a very useful ipv6 server or two.

I set it up to look for the legendary ipv6 dump servers - the massive collections of pirate material said to reside on academic networks in ipv6 space, so that the ipv4-only anti-piracy operatives wouldn't find them and only those who can prove their technical skill by attaining ipv6 access may earn access. Turns out... oh, they do exist! But you have to know someone who'll tell you where to find one, and so I was only able to locate a single dump server. Kept me in anime and hi-def movies for months though.

Re:Readiness test checklist

[Tony Hoyle]

If slashdot went ipv6 then presumably so would their DNS service.. so 1 and 2 are somewhat linked. .org is already on ipv6.

2a works for me.
2b works provided the Co-Lo is ipv6 aware, and that implies 2c.

It's up to slashdot to pull their finger out and implement the damned thing.. it's not the fault of ipv6 they haven't. This is geek site.. if they don't do it why expect anyone else to?

Re:Readiness test checklist

[swillden]

I can do everything in your list just fine -- if you pick a web site that actually supports v6. There is no AAAA record for slashdot.org. Were Slashdot to configure their servers for IPv6 and add appropriate AAAA records, then it would be reachable. Of course, most sites don't bother with v6 support, because few users have v6 addresses, which is because most ISPs don't support v6.

When the ISPs move, everything else will follow.

Re:Readiness test checklist

[Anonymous Coward]

Because IPv6 is failure. Why would a tech savy person do anything besides laugh at IPv6? Sometimes NO OPTION is better than the ONLY OPTION.

Although the post I linked mentions it, government healthcare is another example of "no option" being better than what's proposed, much like IPv6.

Re:Readiness test checklist

[wowbagger]

"I can do everything in your list just fine -- if you pick a web site that actually supports v6. "

That's rather my point: until common, popular web sites support IPv6, there is no reason for the average person to have it.

If a tech-savvy site like /. cannot support IPv6, then what hope is there for more ordinary sites?

And why doesn't /. support IPv6? According to previous articles on this, because their co-lo doesn't.

And that is the whole point of my checklist.

Re:Readiness test checklist

[adiposity]

"I can do everything in your list just fine -- if you pick a web site that actually supports v6. "

That's rather my point: until common, popular web sites support IPv6, there is no reason for the average person to have it.

Correction:

until common, popular web sites support IPv6 and only ipv6 there is no reason for the average person to have it.

-Dan

Re:Readiness test checklist

[radish]

until common, popular web sites support IPv6 and only ipv6 there is no reason for the average person to have it

And I'm going to go out on a limb and predict that will never happen.

Re:Readiness test checklist

[swillden]

until common, popular web sites support IPv6 and only ipv6 there is no reason for the average person to have it

And I'm going to go out on a limb and predict that will never happen.

What do you predict will happen?

Re:Readiness test checklist

[swillden]

If a tech-savvy site like /. cannot support IPv6, then what hope is there for more ordinary sites?

Slashdot would seem to be a good example of a tech-savvy site, but it's really not. Look at how long it took Slashdot to use CSS, for example. It really tends to lag well behind the curve, rather than leading, in spite of the topics discussed.

However, your point that few sites support IPv6 is valid. The reason they don't is because there's no value in it. As ISPs deploy IPv6 support, this will change, a little. It won't become really critical for sites to support IPv6 until there are users who don't have IPv4 connectivity -- and that won't happen until nearly all sites support IPv6, so there is a chicken-and-egg problem there.

All I care about

[Anonymous Coward]

Under IPv6 will I still be able to block posting access to my Japanese discussion site from African/Russian 419 scammers? I have a nice list of IP addresses that are automatically sent an empty http response when they try to become members. I used to give them a chance but every single one turned out to be a scammer so now I just block whole regions outside of Japan. (And luckily most aren't smart enough to bother with a proxy.) Will I still be able to do this under IPv6?

Re:All I care about

[FreeUser]

Under IPv6 will I still be able to block posting access to my Japanese discussion site from African/Russian 419 scammers? I have a nice list of IP addresses that are automatically sent an empty http response when they try to become members. I used to give them a chance but every single one turned out to be a scammer so now I just block whole regions outside of Japan. (And luckily most aren't smart enough to bother with a proxy.) Will I still be able to do this under IPv6?

Yes, you'll just need to know their IPv6 addresses/adress-ranges and block those.

Re:All I care about

[Anonymous Coward]

No. IPv6 is a joke, and the fact the Government is REQUIRING it further proves the Governments incompetence...and you want them to take over Healthcare! What a joke.

Re:All I care about

[Fizzl]

That is a stupid question and you are stupid for asking it. Also, the "+1 Interesting"-mod is stupid.

That's ok, the world ends in 2012 anyway!

[billlava]

According to the Mayans (I think they are a sect of Ron Paul followers) the world will end in 2012 anyway. I saw a youtube video about it, so it must be true.

What, again?

[Nobo]

2002 called. They want their impending-IPv6-transition stories back.

Re:What, again?

[maxume]

You need to be more patient. The IPv6 transition is going to be impending right up until the point that it happens.

I'm sorry but

[Pop69]

until consumer routers support IPv6 it's a dead protocol

Re:I'm sorry but

[Anonymous Coward]

My Airport handles IPv6 just fine. Which is a good thing, I cisco's vpn client borks up everything and i need ipv6 to access my lan.

So, like usual, Apple is ahead of the game.

Re:I'm sorry but

[shentino]

Is milking v4 for all it's worth more profitable than going to v6?

Re:I'm sorry but

[Just Some Guy]

until consumer routers support IPv6 it's a dead protocol

Then it must be doing pretty well, since Apple's Airport Extreme router has it enabled by default and even configures a working tunnel for you. Cue grumbling about "but other routers don't!" in 3... 2... 1...

Re:I'm sorry but

[jonbryce]

Apple's market share for routers is tiny compared to Netgear and Linksys. I'm one of the 8% or so of people who uses a Mac, but it talks to a Netgear router.

Re:I'm sorry but

[Anonymous Coward]

I'm not sure that a $180 fucking wifi router should count as a "consumer router."

Apple may have grossly overpriced it, but that's still out of the price range that most consumers will spend on their home network. You can get sneeringly superior about how great Apple is when they cost $50.

Re:I'm sorry but

[Just Some Guy]

I have a hacked WRT-54G. You presume much.

Re:I'm sorry but

[Anonymous Coward]

My dlink DIR-825 (rev B1) supports it out of the box.

Re:I'm sorry but

[SBrach]

I started this post intending to post a lot of links to IPv6 enabled routers. I own a Linksys/cisco RVS4000 that supports IPv4, IPv6, and dualstack. I know other routers besides the Apple and 1 D-Link I could find must suppport it but apparently they don't feel the need to advertise that fact. 15 minutes of googling turned up nothing.

Re:I'm sorry but

[RAMMS EIN]

Which brings us to the question: why don't all modern routers support IPv6? Every serious OS under the sun supports it nowadays! So why not the routers, even though they have more and more features that only serve to make them less reliable? It almost feels like they are leaving out IPv6 support on purpose.

IPv6 is necessary.

[Anonymous Coward]

People don't want to make the transition because it's a hassle.

Sure you lose your easily remember IP addresses for some huge 128 bit string, but it's not a total loss.

IPv6 has a great deal of benefits such as increased browser speed (due to more efficient packet headers), higher privacy (due to increased address space), and increased server efficiency (due to the fact that the server is not performing all the computations - that load is now on your computer).

Ultimately, yes it will make your old computer suck more, but it will make your new computer shine.

Cool But...

[Anonymous Coward]

Interesting discussion, and not likely to be solved here.

But let's look at cost. The cost for an IPv4 allocation is basically zero. This obviously conflicts with the scarcity argument.

Once IPv4 starts costing more, either directly on via a secondary market, then we may see some corner IPv6 implementations.

The other side of this is usability. Currently for public connections which is where the address space crunch is, IPv4, not IPv6 has usability. Despite the fact that anyone can get one, IPv6 addresses are not globally usable, but IPv4 is.

So, count me skeptical on this transition.

Re:Cool But...

[Anonymous Coward]

But let's look at cost. The cost for an IPv4 allocation is basically zero. This obviously conflicts with the scarcity argument.

Once IPv4 starts costing more, either directly on via a secondary market, then we may see some corner IPv6 implementations.

As soon as somebody tries to sell an IP address, he is clearly not using it according to the rules and has to return it to its Regional Internet Registry.

Re:IpV6 vs D20

[medv4380]

The reality is that IPv4 has a limited use. NAT, and DHCP can only prolong it's life for so long. Eventually too many people are on the internet at the same time and then you have a problem. You then have to start dynamically reallocating IP addresses across countries and not just around a city or state. This is impractical and would mean the death of IPv4. Yes, IPv6 has been poorly thought out and poorly implemented. Then again the Internet2 which uses IPv6 is used primarily by universities and academia which is where the internet started. It's going though the same life cycle that the original did and will take the existing sport of the Internet when we finally figure out how to break it and have no way to fix it. When that happens is very debatable and will happen, unless society collapses and the internet dies with us.

I just rolled a 1 on vs Society Collapsing... was that good or bad?

We need IPV7

[flyingfsck]

We need IPV7 that will merge IPV4 and IPV6 in a usable way. Keeping them separate and incompatible is a big mistake. There needs to be a seamless upgrade path from the one to the other, else it will never happen.

Re:We need IPV7

[Anonymous Coward]

How? It seems to me as simple as creating a seamless upgrade path from RS-232 to USB.

Re:We need IPV7

[painandgreed]

We need IPV7 that will merge IPV4 and IPV6 in a usable way. Keeping them separate and incompatible is a big mistake. There needs to be a seamless upgrade path from the one to the other, else it will never happen.

And IPv8 will see one of the designers write in his personality into the code in an attempt to become immortal and a god. It might have worked too if the net itself hadn't have become sentient and put an end to it.

for crying out loud ...

[neonprimetime]

... does anybody realize how long have we been talking about ipv6?

august 2009, december 2008, august 2007, jan 2006, july 2005, jan 2004, feb 2003, feb 2002, may 2001, july 2000, july 1999, may 1998

The thing that gets me...

[DavidTC]

...is that even new devices don't support IPv6, even when they're in entirely controlled address spaces.

For example, why the hell don't, for example, cell phones internet capabilities have IPv6? I mean the IPv6 routing would seem exactly designed for cell phones, devices external to the network don't need to reach them, and it's a frickin closed system with device upgrades fairly quickly. If we can't even use IPv6 in closed systems like that, it has failed.

The reason, of course, is because IPv6 is, in fact, an EPIC FAIL in actually working, because no one apparently bothered to figure out any sort of actual transition for it.

It's like, if instead of self-driving cars, they invented self-driving micro-monorails and expected us to buy them. But, don't worry, they have a handy monorail carrying rack we can install on top of our car that not that hard to set up so we can carry our monorail to the monorail tracks fifty miles away.

D. J. Bernstein is an ass, but he's right about this.

IPv6 should have been built by changing the damn format of the packets, but using the exact same IPv4 addresses with a specific prefix, routed exactly the same place. Any router that talked to devices that didn't understand IPv6 could just 'dumb it down' to IPv4, and, they should eventually do the same in reverse!

We could actually include a bit in the packet that upconverted IPv6 packets get, so we could keep statistics on how many packets were IPv6 their entire distance, and how many got converted down and back up at some point. So we could see what networks are actually switching out their equipment, and see what misconfigured gear thinks it's talking to IPv4 devices when it's talking to IPv6, so it needlessly converting. (IEEE 802.2 specifics a way to autonegotiate IPv4 or IPv6 using the EtherType, but it might not always work, and it's only for Ethernet anyway.)

At some point, as routers and OSes got replaced, large amounts of traffic on the internet would end up being IPv6 their entire distance, and at that point we can start assigning the IPv6 addresses that don't have a equivalent IPv4 one.

And, incidentally, we should keep the IPv4 network operational forever. 95% of the people can give their IPv4 addresses back, and as people stop connecting IPv4 devices, routers and whatnot will lose the ability to speak to them but there will still be some devices that cannot be upgraded, some embedded device that speaks only IPv4 or whatever. The company should be able to keep an IPv4 address, and require people to install one of the routers that can still upconvert in front of the device, and it gets routed over the internet and back just like anything else, because, for almost all the trip, it's IPv6. There would be no reason to ever turn off the subset of IPv6 that is IPv4.

Instead we invented a new fucking network that doesn't interact with IPv4 at all. Yes, yes, you can get IPv6 versions of IPv4 addresses, but routers and OSes do not automatically translate them. And it's actually against the rules for someone to try to contact a IPv4 server 'over' IPv6. They have to use their IPv4 address, like there should be a difference.

Re:The thing that gets me...

[chrylis]

IPv6 should have been built by changing the damn format of the packets, but using the exact same IPv4 addresses with a specific prefix, routed exactly the same place. Any router that talked to devices that didn't understand IPv6 could just 'dumb it down' to IPv4, and, they should eventually do the same in reverse!

Technically speaking, this is still possible using mapped addresses. The problem is that IPv4 addresses don't map onto IPv6 addresses; only a small subrange of IPv6 addresses can be handled this way.

Re:The thing that gets me...

[DavidTC]

It would be possible if any router behaved in the manner I stated, instead of idiotic IPv6 'tunnels' over IPv4.

And that's not 'the problem' at all. The problem is that what I said is not how the changeover works. It instead works in a rather idiotic way.

The 'problem' that only a subset of IPv6 devices could be accessed by IPv4 devices wouldn't actually matter. At this point in my hypothetical transition, we probably wouldn't have even assigned any actual IPv6 addresses yet, because we'd be waiting for almost all IPv4-converted traffic to be carried its entire length by IPv6 before we start creating anywhere that can be only accessed by IPv6-only traffic.

Re:The thing that gets me...

[Kt.foss.zealot]

...is that even new devices don't support IPv6, even when they're in entirely controlled address spaces.

For example, why the hell don't, for example, cell phones internet capabilities have IPv6? I mean the IPv6 routing would seem exactly designed for cell phones, devices external to the network don't need to reach them, and it's a frickin closed system with device upgrades fairly quickly. If we can't even use IPv6 in closed systems like that, it has failed.

1. 95% of the cellphones in existence don't last much longer than a couple of years 2. Most people get new cellphones when they renew yearly or bi-yearly 3. Just because the cellphone industry does not implement something does not mean it is "epic fail", by that logic this world is full of fail.

The reason, of course, is because IPv6 is, in fact, an EPIC FAIL in actually working, because no one apparently bothered to figure out any sort of actual transition for it.

Again, you've got a funny definition of failure considering IPv6 is already working on many internet backbones and in other instances, some ISPs are using IPv6 for their internal modem addresses now even.

It's like, if instead of self-driving cars, they invented self-driving micro-monorails and expected us to buy them. But, don't worry, they have a handy monorail carrying rack we can install on top of our car that not that hard to set up so we can carry our monorail to the monorail tracks fifty miles away.

This analogy is somewhat amusing and cute in a stupid way..., but it's also is completely inaccurate, the modern internet today is based on layer upon layer of encapsulation, Vlans within QnQ tunnels, MPLS/Tag Switching encapsulations and what-not, not to mention data within TCP headers within packets within frames. So realisticly we have been carrying monorails on top of other monorails on the roofrack of our car tied to the roof of our other car all this time, encapsulation is not a bad thing, or a rediculous thing, it's how the internet works.

D. J. Bernstein is an ass, but he's right about this.

IPv6 should have been built by changing the damn format of the packets, but using the exact same IPv4 addresses with a specific prefix, routed exactly the same place. Any router that talked to devices that didn't understand IPv6 could just 'dumb it down' to IPv4, and, they should eventually do the same in reverse!

So instead of updating the TCP/IP protocol properly we should encumber it with even more hacks? How is this any different than what can already be done with the tunneling mechanisms already in place? Besides, you can already embed your ipv4 addresses in your ipv6 address, let's say you did not want to convert your internal network to ipv6, that's cool, you get your 64 bit ipv6 prefix from your ISP, let's say FECE:5:CAFE::, and combine it with your internal addresses, e.g. FECE:5:CAFE::192.168.1.2, although this is not really embedding ipv4 packets in ipv6 packets it will help save your memory.

At some point, as routers and OSes got replaced, large amounts of traffic on the internet would end up being IPv6 their entire distance, and at that point we can start assigning the IPv6 addresses that don't have a equivalent IPv4 one.

Just so you know, ALL ipv4 addresses have something like a 64-bit ipv6 RANGE dedicated to them, but I forget the details exactly. Also, all the modern major routers(Cisco) and OSes already support IPv6, even windows!

And, incidentally, we should keep the IPv4 network operational forever. 95% of the people can give their IPv4 addresses back, and as people stop connecting IPv4 devices, routers and whatnot will lose the ability to speak to them but there will still be some devices that cannot be upgraded, some embedded device that speaks only IPv4 or whatever.

I bet you a billion trillion dollars that IPv4 will

Re:The thing that gets me...

[DavidTC]

How is this any different than what can already be done with the tunneling mechanisms already in place?

It's not tunneling, you loon. It's conversion. Tunneling requires endpoints that know what the hell is going on.

With what I said, you could put a IPv6 knowledgeable computer on an IPv4 network, and it would function. You could upgrade the router it's plugged into, and the local network would now be IPv6, and the ISP still IPv4. You could upgrade the ISP, and it would just change to IPv4 when it hit the backbone. You could even upgrade the ISP without upgrading the router.

Devices would talk to their neighbor with IPv6 if they both understood that, and IPv4 if at least one of them didn't.

It's not a shitty 'tunnel' that you have to actually set up endpoints for and route 'IPv6 traffic' into. There's not even any such damn thing as 'IPv6 traffic' being carried. It's 'traffic that goes to IPv4 addresses that could be carried via IPv6 or IPv4 at any particular point'.

IPv6 addresses wouldn't even be assigned until we'd mostly switched over to using IPv6 as a transport.

Again, you've got a funny definition of failure considering IPv6 is already working on many internet backbones and in other instances, some ISPs are using IPv6 for their internal modem addresses now even.

WOW! And it's only been ten years to get a use 1% penetration! We should be fully done as early as the year 3000!

Also, all the modern major routers(Cisco) and OSes already support IPv6, even windows!

Oh. My. God. You do not realize how funny this is. For a while, the inability of hardware to support IPv6 was, in fact, an excuse to not use it. Fair enough.

And now, considering that something like 80% of computers do support it, and another 10% could with free upgrades, there must, therefore, be some other reason it's not used. Like the sucky transition that was laid out instead an incremental backwards-compatible one.

The fact that it is supported, is cheaper to get addresses for, and isn't used wold suggest something wrong with how this is supposed to happen. Um, duh.

Just so you know, ALL ipv4 addresses have something like a 64-bit ipv6 RANGE dedicated to them, but I forget the details exactly.

I love when people object to what I say without actually reading it. IPv6 does not work the way I have described it. It's easily demonstrated. I will assume your computer is hooked into a IPv4 router:

First, enable the IPv6 stack on your computer. Second, attempt to access your IPv4 router's web page by typing in a IPv6 format address. Whatever it's supposed to be for the router's IPv4 address.

Go ahead. I'll wait.

Oh, you can't. That's because for some idiotic reason, IPv4 and IPv6 operate entirely separate. It doesn't matter that there is, indeed, a subset of IPv6 addresses that were given to IPv4 address holders. (Except not really. You can't take an IPv4 address and state an IPv6 address for it.) They are not, in any manner, treated as the same damn IP address.

They're two entirely separate stacks, you can run services on a certain port of the IPv4 address but not the IPv6 version of it, OSes with IPv6 stacks do not actually attempt to contact the IPv4 version of an IPv6 mapped address if they're on an IPv4 network, etc.

Re:The thing that gets me...

[Anonymous Coward]

My Nokia N97 supports IPv6. The cell phone providers don't support IPv6 (unfortunately), but over WiFi in my home network it works just fine!

Re:The thing that gets me...

[AbbeyRoad]

exactly right

Re:The thing that gets me...

[DavidTC]

Well, yeah, that's sorta even worse, when you think about.

Like I pointed out above, the fact that all sorts of devices and OSes actually support IPv6, but almost no one actually uses it is, is much more damning of the transition plan than if no one had bothered to built devices that supported it.

I mean, the excuse for the plan's delay before was 'We need to reach critical mass, and then IPv6 will magically appear'. At this point, frankly, almost every internet connected device except personal DSL routers can do IPv6, and those tend to get replaces every few years so people could upgrade rather easily. If this isn't 'critical mass' I don't know what is.

And, yet, no IPv6. In fact, almost all conversions have either been driven by law, or by countries running out of IPv4 addresses.

why are these all videos

[Anonymous Coward]

grrrrrr

try it tonight

[digitalsushi]

Ok kids. Go home tonight and turn ipv6 on. I know you're all running homebrew linux nat routers.

Here's all you gotta do.

Install radvd. It's a Router Advertisement server. Router Advertisements are how your LAN clients learn what the hell their IPv6 "prefix" is. You're going to use something clever called 6to4, which basically converts your public ipv4 address into the first half of your ipv6 address. You plug that information into your radvd configuration, and voila, all your LAN clients can learn their unique global ipv6 address. Then you just run a little script, which turns up the 6to4 tunnel on your linux nat, and all of a sudden, all your LAN clients have globally routable ipv6 addresses! And once the v6 stack fires up, your computers will try resolving AAAA records, so you might even get to visit some v6 websites!

You're not strictly running native ipv6, since 6to4 is a tunnel to an anycast server (dont worry, there's plenty of them sharing the same address). It emulates pretty damned close though. Enough for you to try it out!

Here's the thing that keeps blowing my mind. Remember back before NAT? The Internet was actually symmetrical back then. Any host could contact any host. Well, it's restored. I keep forgetting I can literally contact ANY lan host from remotely, using its v6 address. Security nightmare? You betcha. Restored services? Makes up for it! Maybe I can figure out what a firewall is, after all!

Sure, there's tunnel brokers out there too... don't waste your time with all that. 6to4 is quick and easy, and it works fairly faithfully. By the time a tunnel broker OKs your info, you could be pinging already with 6to4.

Oh yeah. That malarkey about "ooh my address is so long, it's just not worth it" -- My address is 2002:xxxx:xxxx::1 through ::5. Also, a few weeks ago they released an interesting workaround to memorizing ip addresses, called "The DNS". As ominous as that sounds, it's actually pretty clever and I've been enjoying it for a while.

And yes, ::1 is easily guessable and that makes it hackable. So please, no nmapping the 2002:xxxx/32 subnet tonight. (At the rate of 2^96 pings per second, it should be done by next century)

Re:try it tonight

[digitalsushi]

here's one way of setting a 6to4 tunnel up. i squished some semicolons in cause it's pasting funny.

#!/bin/bash

# Create a 6to4 tunnel in linux.

if [ $# -eq 0 ]
then
    echo "Usage: $0 [delete]";
    exit;
fi;

ipv4=$(ifconfig $1|grep "inet addr:"|awk '{print $2}'|awk -F: '{print $2}');
ipv6=$(printf "2002:%02x%02x:%02x%02x::1" `echo $ipv4 | tr "." " "`);
echo "ipv4 address: ${ipv4}";
echo "ipv6 address: $ipv6";

if [ "$2" = "delete" ]
then /sbin/ip link set dev tun6to4 down /sbin/ip -6 route flush dev tun6to4 /sbin/ip tunnel del tun6to4
    echo "IPv6 tunnel has been deleted."
    exit
fi; /sbin/ip tunnel add tun6to4 mode sit ttl 255 remote any local ${ipv4}; /sbin/ip link set dev tun6to4 up; /sbin/ip -6 addr add ${ipv6}/16 dev tun6to4; /sbin/ip -6 route add 2000::/3 via ::192.88.99.1 dev tun6to4 metric 1;

if ping6 -c 1 he.net 2>&1 1>/dev/null
then
    echo "Verified IPv6 connectivity.";
else
    echo "Can't ping IPv6 network.";
fi;

Re:try it tonight

[xaxa]

For those without a Linux router:
sudo aptitude install miredo
sudo invoke-rc.d miredo start
ping6 -nc 1 ipv6.google.com
PING ipv6.google.com(2001:4860:a005::68) 56 data bytes
64 bytes from 2001:4860:a005::68: icmp_seq=1 ttl=58 time=29.9 ms
lynx --dump http://ipv6.whatismyv6.com/ | head -n 5
This page shows your IPv6 and/or IPv4 address
You are connecting with an IPv6 Address of:
2001:0:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx

Re:try it tonight

[digitalsushi]

Teredo isn't 6to4.

It works through NAT, which actually makes it even easier to use than 6to4. Thanks for pointing it out! 6to4 is more of a site tool, and Teredo is a client tool.

Re:try it tonight

[Anonymous Coward]

Here's the thing that keeps blowing my mind. Remember back before NAT? The Internet was actually symmetrical back then. Any host could contact any host. Well, it's restored. I keep forgetting I can literally contact ANY lan host from remotely, using its v6 address.

The LAST thing I want, is for my users to be able to directly address each physical, or virtual, machine in my server cluster. My cluster has one public facing IP, and it will remain that way regardless if it's v4 or v6.

I don't particularly like NAT, the above problem can be solved through much more elegant means. But NAT on home routers, as a direct result of the ip4 "shortage", has done more for home network security than anything else.

Being able to directly access LAN devices is not a secure model, especially when home users have neither the time, no-how, or inclination to purchase and admin their own custom firewall. I know this doesn't apply to slashdot readers (much), but most people online today are well served by NAT'ing their home network.

Re:try it tonight

[Anonymous Coward]

But since my tunnel broker is 1 extra hop away, and adds .2ms to my latency, I'll use it... I've found that there are some IPv6 sites that have native (or tunneled) connectivity, that *can't* reach 2002::/16... unfortunately...

Re:try it tonight

[ion.simon.c]

..specially when home users have neither the time, no-how, or inclination to purchase and admin their own custom firewall

Obvious troll is obvious.

Re:try it tonight

[ion.simon.c]

By the time a tunnel broker OKs your info, you could be pinging already with 6to4.

Your post is informative, but I take issue with this statement. Account creation and tunnel allocation with Hurricane Electric took all of a couple of minutes. While it *IS* slower than relying on an anycasted 6to4 connecion, it's not like you're going to be waiting for hours before you're good to go. :)

Re:try it tonight

[AbbeyRoad]

> Well, it's restored. I keep forgetting I can literally contact ANY lan host from remotely, using its v6 address

that's a bug not a feature.

-paul

Re:try it tonight

[AbbeyRoad]

> You're not strictly running native ipv6,

this is ridiculous.

why couldn't the standards have defined that every IPv4 address *is* an IPv6 address?

Then I can keep my addresses and switch to IPv6 without having to encapsulate or proxy anything.

at the border between IPv4 and IPv6, if the address space of IPv4 is within IPv6, then
all the router needs to do is translate the IPv4 packet into IPv6 and back again, because
translation is 1:1.

This way everyone has a migration path to IPv6.

-paul

Re:try it tonight

[hab136]

Restored services? Makes up for it! Maybe I can figure out what a firewall is, after all!

If you can figure out a firewall, you can figure out port forwarding.

I actually did set up IPv6 on my local network, using HE's tunnel broker. I got everything working, including an IPv6 web, DNS, and mail server. I set up Linux, OS X, and WinXP dual-stack clients. I even then had some fun and set up an IPv6-only Windows 7 machine. I left it all up for about three weeks, then realized it was basically useless right now and turned it off.

IPv6 is a neat technology that will probably eventually arrive for the masses, *despite* the terrible transition plan.

Re:try it tonight

[digitalsushi]

Ok, I will grant you that HE is awesome. The other tunnel broker, sixxs, took about 2 days. (And I am probably getting my tunnel disconnected by reviewing them on slashdot. They're... draconian. Cruise their forums and decide for yourself.)

Re:try it tonight

[digitalsushi]

That's a serious issue I have -- since port forwarding is a subfunction of NAT, and since there's no NAT module for ipv6 in linux, there's no way to port forward for ipv6 in linux.

Re:try it tonight

[Anonymous Coward]

That's awesome! Now how do I do this with my windows laptop and the linksys router that 99.999% of home users have?

Not a problem for some

[TheLink]

> Problems of IPv6: Screw it, we'll just nat our existing IPv4 addresses.

Big Media might like that a lot. That's not a bug to them but a feature.

ISPs resorting to shoving most people behind NATs is a feature for Big Media, because it breaks P2P.

I know it would break WoW updates and other stuff too, but I'm sure Big Media would consider that an acceptable sacrifice.

It may help produce an Internet that's more like TV or a broadcast medium. The billions of users only being able to get content from a few million servers controlled by those who can afford public IPv4 addresses (which would go up in price).

Big Media might be very friendly with some Big ISPs in the USA right?

So while the IPv6 rollout is likely to eventually happen, it may take quite a long while. Way after the popular "run out of IPv4 addresses" deadlines.

Users would be shoved behind NATs and most of them wouldn't even notice- Fox News, CNN etc would still work for them.

Re:Not a problem for some

[dbrutus]

It's not going to happen. The US military is going to cut off any ISP that doesn't support IPv6 by, at latest 2011. Military paid for contracts to AT&T, Comcast et al are going to ensure that their off base officers are going to get IPv6. Once you've rolled that out engineering-wise, there's no way that people will stand for it being a military only facility. It just won't fly.

Wouldn't be surprised to see an ipv4 kludge

[Anonymous Coward]

With so many legacy apps out there I would not be surprised to see some sort of kludge to increase the ip4 space...

something along the lines of using a couple of the unused bits in the ip header to differentiate
between ip4 space 1,2,3 etc....

A pack of Luddites, honestly!

[Just Some Guy]

Every time something on IPv6 comes out, there's a thundering herd of people who've never used it but are certain that it's awful and won't ever work. What's wrong with you people? Do you feel threatened because you're used to being the networking expert among your clique and don't want to lose that reputation? If not that, then what is it that's making you sneer at a cool new technology without even trying it first?

I'm not addressing people who tried to make IPv6 work but had problems along the way, or who otherwise had bad experiences with it. That's totally understandable and I'm not going to tell such a person that they're wrong. I am talking directly to the people who've read old articles talking about why it won't work, or who are trotting out the same tired, invalid reasons to dislike it.

Here's what you need to know about IPv6:

1. It's here and working today, and a lot of people are starting to adopt it.
2. You can run IPv4 and IPv6 on the same network and machines. I don't know of any IPv6 implementation that can't run alongside IPv4.
3. DNS works perfectly fine for IPv6. I have a long address on my machines at home and work, but ever have to manually type them anywhere after adding them to DNS.
4. If you enable IPv6 alongside IPv4 and try to connect to another host, and that host has an IPv6 DNS record, then your machine will try to connect to that address and then fall back to IPv4 if that fails. If it doesn't have an IPv6 DNS record, then you'll connect via IPv4. There's no penalty for enabling it.
5. NAT sucks. It might seem like a reasonable idea until you're reminded how nice it is not to have to mess with it, then you'll come to loathe it.
6. There are plenty of good, free, reliable IPv6 tunnels available. I use Hurricane Electric, but there are lots of others to choose from.
7. All modern OSes support IPv6 out of the box.
8. Many/most consumer routers do not support IPv6 natively (although you can still tunnel through those routers from your Linux or Windows or Mac server or desktop). Some do, though, and an Airport Extreme is still a consumer product even if it's more expensive than some of the others.

I think that about covers it. There's no reason to be afraid of IPv6. If you haven't tried it, give it a shot before bragging about how smart you are for recognizing that it can't work. Again, if you've tried it and had problems, I can understand why you're leery of the idea. If you haven't at least used a free tunnel to see what IPv6 is like, though, then you don't have a lot of room to comment on the subject.

Re:A pack of Luddites, honestly!

[adiposity]

IPv6 is not a big deal. What is a big deal is there is no way it will ever take over given the current transition plans. Yes, it's useable. But it doesn't solve the problems it's supposed to solve, because we can't get people to start using it under the current conditions. And those conditions are unlikely to change as long as we can still find ways to make IPv4 work.

Until there is a way to transition, the new addresses are not really helping alleviate the shortage. I don't really think the issue is "ipv6 sucks, why would you use it?" but "sure would be nice if we could switch to ipv6, but we can't, because some bad decisions were made."

-Dan

Re:A pack of Luddites, honestly!

[radish]

I haven't ever tried setting it up, but I'll agree it doesn't look like too big of a deal. I have a sneaky feeling it's not quite as easy as you make out (because nothing ever is!) but I'm sure that I could get some IPv6 action going fairly quickly if I wanted to. Problem is, I don't. It just doesn't solve any problem I (as a fairly tech savvy user) care about. I've never been denied a v4 address when I've needed one, I don't have any problem with NAT and I've never found a server I wanted to contact which was only available via v6. Therefore, while I could do it, there's very little motivation for me to bother.

Re:A pack of Luddites, honestly!

[FlyingGuy]

Well I am not ah-skeered of IPV6 but...

I gotta say the group that came up with this abortion for and address specification are a collective group of ASSHATS

Ohhh you mean you want to go to a specific port? Well don't forget to put your address in [] brakets!

Ohh if there are consecutive zero's [0] you can just put two colons next to each other, BUT you can only do that ONCE, because otherwise it might be ambiguous.

And oh BY the way, remember UNC paths? Guess what you cant put colons in those! But hey, we have a fix for that uhmmm yeah just go to ipv6-literal.net

Need link local?? Ok, I guess we gotta throw some percent (%) signs in there too!

The bottom line is the asshats who created this spec might be smart, but damn they are clueless.

Re:A pack of Luddites, honestly!

[Just Some Guy]

It just doesn't solve any problem I (as a fairly tech savvy user) care about.

You are fascinatingly incurious.

Re:A pack of Luddites, honestly!

[Abcd1234]

What? People who don't set up ipv6 just for kicks are "incurious"? Please.

Sorry, until I can access my v6 network wherever I am, be it at work or at a friends place or the library or wherever else I may be, v6 will have precisely *zero* utility for me. I mean, it's entire advantage is that I can get my own IP block. Great! Except I can't actually *access* that IP block from anywhere, as no one else has v6 connectivity. So how useful is that? Right. Not. At. All. So why the hell would I waste my time when it can be better spent doing more interesting things?

Re:A pack of Luddites, honestly!

[ion.simon.c]

*bites*

Ohhh you mean you want to go to a specific port? Well don't forget to put your address in [] brakets!

How would you represent it?

Ohh if there are consecutive zero's [0] you can just put two colons next to each other, BUT you can only do that ONCE, because otherwise it might be ambiguous.

Is 2002::1::2
a) 2002:0:0:0:0:1:0:2
b) 2002:0:1:0:0:0:0:2
c) 2002:0:0:1:0:0:0:2
... ?

And oh BY the way, remember UNC paths? Guess what you cant put colons in those! But hey, we have a fix for that uhmmm yeah just go to ipv6-literal.net

This is an issue with CIFS. Take it up with MSFT.
Alternatively, you could enter your systems into DNS and never worry about their IP addresses again. IIRC, if you're a member of a domain, then your machine's hostname is automatically entered into DNS.

Need link local?? Ok, I guess we gotta throw some percent (%) signs in there too!

All link-local addresses on my Linux system get a route that's associated with the loopback interface, and no others. Should the system have associated a link-local address with the interface that it's been generated for? I think so. But, I haven't read the documentation that dictates how routes for link-local addresses are to be created.

Re:A pack of Luddites, honestly!

[Lanboy]

I eagerly await the ipv6 transition. I am an hourly billed network engineer and I will make BANK. The users will be fucked however.

Re:A pack of Luddites, honestly!

[FlyingGuy]

How would you represent it?

How about using WORDS instead of bytes? lets see, uhmm FFFF.FFFF.FFFF.FFFF is about 1.8^19 or 180,000,000,000,000,000,000 hosts so I think 450.450.450.440:80 would work just fine since I don't think my toaster or my refrigerator or my car needs an IP address.

Is 2002::1::2
a) 2002:0:0:0:0:1:0:2
b) 2002:0:1:0:0:0:0:2
c) 2002:0:0:1:0:0:0:2
... ?

See above

This is an issue with CIFS. Take it up with MSFT.
Alternatively, you could enter your systems into DNS and never worry about their IP addresses again. IIRC, if you're a member of a domain, then your machine's hostname is automatically entered into DNS.

Well I dislike MicroSoft for many ,many reasons, but considering about 80% to 90% of the wolds desktops run WINDOWS well hell FUCK those People they were stupid mutha fuckahs for buying a computer with windows on it to begin with and as we all know UNC paths are just bad bad bad! As to having my machine automatically entered into some DNS server that may or may not get tooled... uhm thanks but no thanks and besides hey, we can raise the load on the DNS system exponentially, no problem right?

All link-local addresses on my Linux system get a route that's associated with the loopback interface, and no others. Should the system have associated a link-local address with the interface that it's been generated for? I think so. But, I haven't read the documentation that dictates how routes for link-local addresses are to be created.

All because some pencil necks could not figure out that a word holds more information then a byte. Uhm, yeah that's the ticket!

Re:A pack of Luddites, honestly!

[chappel]

I haven't actually fired up ipv6 (yet), but I did a lot of preliminary legwork, and found that:

- An end user cannot find a Verizon tech who knows what IPv6 is, let alone sign up for it

- The local indy ISP doesn't want to mess with it

- while my linux and mac workstations, and OpenWRT router will support ipv6, my networked HP printer/scanner/fax gee-whiz box, my asterisk appliance, none of my various VoIP phones, my chumby or my Nabistag have any idea what ipv6 is - and they out number my PCs

- the proliferation of the ethernet enabled 'gadgets' is really driving our ipv4 depletion - and they are the very devices least likely to support ipv6

Re:A pack of Luddites, honestly!

[radish]

Oh I'm very curious, but also time limited. Right now I'm learning Lua, testing some rather sweet new (unannounced) gadgets and hacking together a script to process the (disgustingly formatted) iTunes XML file. Can't really afford to spend a day getting to the point where I can ping somewhat longer IP addresses :)

Re:A pack of Luddites, honestly!

[Just Some Guy]

With real (IPv6) routing, I now have to install firewalls on all of my systems and maintain them individually.

That's not true at all. Conceptually, NAT is similar to a default-deny firewall. Why not just enabled one of those at the same place your NAT would have been running? Make a firewall ruleset like:

allow all from $internal_if to $external_if;
allow tcp to $web_server port http, https;
allow tcp to $mail_server port smtp;
allow tcp,udp to $dns_server port domain;
...
deny from all;

...and so on. The above is almost exactly what a NAT setup would look like except that it lacks the actual redirects.

NAT offers no additional security beyond that of a stateful firewall. In either case, an incoming address:port combo corresponds to a specific port on an internal machine.

Previous address expansions

[Animats]

IPv6 should have been built by changing the damn format of the packets, but using the exact same IPv4 addresses with a specific prefix, routed exactly the same place.

Yes, that's what was done the last two times the address space was upgraded.

When ARPANET IMP addresses went from one byte to two bytes, to allow the number of nodes to increase beyond 256, the old addresses retained their 8-bit value, with a new prefix.

When the ARPANET was extended to the Internet, the two byte IMP address was the low two octets of the IP address, and the first two octets were 10 and 0, so IMP addresses converted to IP addresses as [10.0.xxx.xxx]. And that's where "network 10" came from. When the ARPANET went down, it freed up that address space for other uses.

But we have DNS now.

Re:Previous address expansions

[DavidTC]

Good point about how it was done before. I knew about ARPANET, but hadn't realized that it was done before that, too.

DNS doesn't really matter in all this. If we could just magically upgrade servers, that would be one thing, but servers end up behind routers that don't speak IPv6, and the routers are on a connection that doesn't speak it, and the connect hooks to a backbone that might speak it, sometimes, and that's hooked to an ISP that doesn't speak it, etc.

The only way to do a transition is to have parts of it able to upconvert IPv4 to IPv6, and then downconvert whenever needed, until everyone has the entire thing running IPv6 the whole length.

Like I said, IEEE 802.2 will actually let you determine what the device at the other end speaks. Routers could have started having a 'We will talk to our other endpoint, and figure out if we can upconvert on the way out, or need to upconvert on the way in.' feature, along with a 'the local network speaks IPv6' feature.

At first, there would be a lot of conversion up and down, but eventually, all devices would be IPv6 functional. (And if not, if some router rotting in an closet somewhere can't be replaced but is routing all traffic for Kuwait, that's when you set up IPv6 tunnels.)

At which point we start giving out new IPv6 addresses a lot cheaper than IPv4 ones, and let everyone switch over. And start building devices that can't handle IPv4 and can't convert either way.

ipv6experiment.com

[Anonymous Coward]

Could somebody please tell me whatever happened to the ipv6experiment.com ?

Re:ipv6experiment.com

[arkane1234]

it failed ;)

Re:ipv6experiment.com

[Midnight Thunder]

Could somebody please tell me whatever happened to the ipv6experiment.com ?

No idea, but there are a number of early IPv6 related web sites that no longer exist, simply because they don't need to any more. Some of these sites were set up as experiments, but as IPv6 is slowly creeping in the mainstream they achieved what they set out to do and passed on. For a starting point on IPv6 related sites (not complete), then start here:

http://www.sixxs.net/wiki/Category:IPv6-specific_content

Re:ipv6experiment.com

[Anonymous Coward]

The mailing list is still around, but hasn't seen any traffic since February, nor does it feature an explanation for the sites disappearance:

http://mail.your.org/mailman/listinfo/v6test

Re:IpV6 in Finland

[Ux64]

We got only one ISP providing IpV6 addresses to normal end users. So there is not too much hope to get IPv6 trough quickly. I asked my ISP if they even can provide IPv6 addresses or if they need test users. They thought it a while, and told that they don't have any IPv6 plans yet.

So... That's it.

My home Linux systems, ADSL modem / router & firewaall are 100% IPv6 compatible and ready. ISP's arent.

I am excited.

[changa]

I can't wait for the day I get home from work in my  flying electric car  to play Duke Nukem Forever against my friends over my new IPV6 connection.

Please fix IPv6

[Anonymous Coward]

Dear inventors of IPv6 please fix your protocol. I'm not asking for wholesale changes such as use of reasonable address lengths or a politically sane and realisitic transition scenario.. All I'm asking for is that some minor details be fixed OR ELSE!!!!

Not following law of demeter on ISO layer separation is a sin punishable by rotting in hell for eternity.
Using interface names to disambiguate IPv6 addresses..really? All %eth0 nonsense needs to be outlawed immediatly and forever. I don't know or care how many bis RFCs need to be created to make that happen but it must be done.

All hosts must be able to talk to themselves. If my servers IP address is AAA:BBBB:CCCC::BADD that address must work from the server itself without interface name decorations applied.

These above two demands are non-negotiable. The rest are nits I really don't expect anyone to take seriously:

The socket options to prevent use of IPv4 mapped addresses don't need to exist if dualstack is the accepted global transition strategy which it looks like will definately be the case. Make the IPv4 mapped space reserved like you know -- your precious massive Class E IPv4 block you just pissed away while the Internet is hurting for Internet addresses.

People should be assigned network prefixes that can remember using :: compression to its highest effect. The flawed notion that address will ever denote structure in any meaningful way needs to be dispensed with.

Re:Please fix IPv6

[grumbel]

Isn't the %eth0 nonsense only needed for link-local addresses (fe80::) and disappears when you start using a globally scoped address?

Re:Please fix IPv6

[ion.simon.c]

Your two demands are only an issue if you're using a link-local address. Try using a globally routable address and see the difference.

Linux and IPv6

[Anonymous Coward]

When the year of the Linux desktop comes they will implement IPv6.

Short term problem

[Midnight Thunder]

Instead at the current situation you have to figure out how and were to get an IPv6 address, and either keep an IPv4 as well (and switch between the two as the situation demands) or work out how you are going to talk to the 90+% of the world that doesn't have an IPv6 address. Either of those require extra work, for every person trying to connect to the network.

The issue of where to get an IPv6 address is false one, unless you have an ISP who is dragging their feet. It is a short-term problem and once the infrastructure is in place the apparent issues will go away. Sure it is not IPv4, but no one said it was. There are plenty of solutions to give your computers names, so there should be fewer and fewer cases where you will need to access you machines using numbers.

For example of an ISP who is not dragging their feet, in France there is an ISP called free.fr that provides IPv6 to their customers at no extra cost. Once enabled the router (users are given modem-router hybrids) advertises the IPv6 subnet prefix to all the computers in the subnet. If the computers are IPv6 aware then they will self configure the address ( subnet prefix + MAC address ) and start routing all IPv6 addresses through the announced router.

If you have an ISP who is dragging their feet and you are behind a NAT, then you need to establish a tunnel to an IPv6 Tunnel broker. There are a number of places to do this, including but not limited to: Sixxs.net, Freenet6 and Hurricane Electric.

The only thing I would like to see now are more home router manufacturers providing IPv6 gateway/routers. Apple's Airport and the Fritz!Box are two of the few that do.

If you have your doubts about IPv6, then at least give yourself two months with it and then come back and tell me whether you are still of the same opinion.

Perl ...

[Midnight Thunder]

Ask the people developing Slashcode what the IPv6 issues are and you get pointed to Perl libraries that aren't IPv6 ready. You ask the people at CPAN when they will fix the IPv6 issues and you find yourself hitting a wall. The experience I have had with CPAN makes me feel that Perl should be long dead, IMHO. The library at fault is libwww-perl. I see someone proposed a patch, but it appears to be slowly collecting dust.

The problem is that there are many people who recognise the IPv4 issue, like people recognised the Y2K issue, but it will only be on the eve of IPv4 exhaustion, and people running around like headless chickens, that we will see the remaining developers realising they have work to do.

Different link than mine?

[Lanboy]

"Comcast plans to enter into broadband IPv6 technical trials later this year and into 2010," TBarry Tishgart, VP of Internet Services for Comcast tells Internet News. "Planning for general deployment is underway."

They will have possibly completed a trial in 2010 and ar "Planning for General Deployment" I personally am planning for lottery winning, but there is no indication of when I might have completed my lottery winning deployment.

Anybody remember GOSIP?

[isdnip]

By 1986, every government computer was supposed to support OSI. So OSI backers thought that it would be commonplace.

Uncle's IPv6 mandate is just GOSIP II. But IPv6 makes OSI look like Shakespeare next to its own Ed Wood.

Not in router fast path

[isdnip]

While many routers "support" IPv6, it is software support, not the hardware support for the "fast path" that IPv4 uses for standard packets. IPv6 packets are the slow exceptions. The total packet capacity is low. This isn't noticed yet much because v6 carries roughly 1/100 of 1% (i.e., 1/10,000) of the total traffic of v4, and a lot of that is just IETF dorkwads throwing around experimental packets to show that it can be done.

Good reason for consumers

[Anonymous Coward]

The transition will happen at latest when the end-users have a good reason for that. NAT works for them at the moment, but luckily there are some applications where IPv6 is forced.

One of the reasons to use IPv6 is IEEE 802.15.4 wireless sensor networks with 6LoWPAN protocol, which is basically a very low-energy, very low-bandwidth, wireless mesh network protocol that is IPv6 compatible. There is no IPv4 in this world, it would be a disaster as the sensors should be very cheap and numerous in the future.

The idea of having every light switch of your house connected to internet is ridiculous itself. Still, IPv6 would be a very good way to ensure connectibility and interoperability between devices by different manufacturers. Currently the home/building automation connections are a mess with dozens of incompatible standards. IP networks are proven and work.

Re:ion.simon.c reality check

[Anonymous Coward]

"(Sorry, too lazy to use Google atm.) :(

ion.simon.c's knowledge in computers is really shallow. Without google he is helpless. He's too lazy to earn an actual college diploma oriented towards computer science.

Obvious google junkie is obvious

[Anonymous Coward]

"Obvious troll is obvious."

Coming from the biggest troll at slashdot, ion.simon.c, that's almost funny. All ion.simon.c can do is read manuals and spit back what he reads in them. His knowledge is really shallow so don't expect much out of him other than what he googles.

we're already out

[Jessta]

...we've already run out of IPv4 addresses.
I have so many devices that don't have a public IP address because my ISP only provides me with one.
We've been out of IPv4 addresses for a long time now.

Don't waste time with this dimwit ion.simon.c

[Anonymous Coward]

Don't even try to have a conversation on any topics technical in computing with ion.simon.c because he is an unintelligent moron that tries to play smart and all he does is google up topics and then spit back what he finds there, in his posts here. That's the kind of people that are produced from his area of the nation (maine).

slashdot.org _DOES_ have AAAA records

[Nivag064]

$ dig slashdot.org

; <<>> DiG 9.5.1-P3-RedHat-9.5.1-3.P3.fc10 <<>> slashdot.org
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18292
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 13

;; QUESTION SECTION:
;slashdot.org. IN A

;; ANSWER SECTION:
slashdot.org. 2607 IN A 216.34.181.45

;; AUTHORITY SECTION:
. 79212 IN NS M.ROOT-SERVERS.NET.
. 79212 IN NS F.ROOT-SERVERS.NET.
. 79212 IN NS L.ROOT-SERVERS.NET.
. 79212 IN NS B.ROOT-SERVERS.NET.
. 79212 IN NS H.ROOT-SERVERS.NET.
. 79212 IN NS I.ROOT-SERVERS.NET.
. 79212 IN NS E.ROOT-SERVERS.NET.
. 79212 IN NS A.ROOT-SERVERS.NET.
. 79212 IN NS C.ROOT-SERVERS.NET.
. 79212 IN NS G.ROOT-SERVERS.NET.
. 79212 IN NS K.ROOT-SERVERS.NET.
. 79212 IN NS D.ROOT-SERVERS.NET.
. 79212 IN NS J.ROOT-SERVERS.NET.

;; ADDITIONAL SECTION:
A.ROOT-SERVERS.NET. 134745 IN A 198.41.0.4
A.ROOT-SERVERS.NET. 262772 IN AAAA 2001:503:ba3e::2:30
B.ROOT-SERVERS.NET. 209708 IN A 192.228.79.201
C.ROOT-SERVERS.NET. 134745 IN A 192.33.4.12
D.ROOT-SERVERS.NET. 466134 IN A 128.8.10.90
E.ROOT-SERVERS.NET. 134745 IN A 192.203.230.10
F.ROOT-SERVERS.NET. 469625 IN A 192.5.5.241
F.ROOT-SERVERS.NET. 93705 IN AAAA 2001:500:2f::f
G.ROOT-SERVERS.NET. 134745 IN A 192.112.36.4
H.ROOT-SERVERS.NET. 300717 IN A 128.63.2.53
H.ROOT-SERVERS.NET. 139387 IN AAAA 2001:500:1::803f:235
I.ROOT-SERVERS.NET. 134745 IN A 192.36.148.17
J.ROOT-SERVERS.NET. 300716 IN A 192.58.128.30

;; Query time: 73 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Aug 22 18:06:31 2009
;; MSG SIZE rcvd: 501

$

Re:slashdot.org _DOES_ have AAAA records

[Nivag064]

I should write out 1000 times "I should spend more time reading carefully", rather making sure the formatting is correct... :-(

Re:slashdot.org _DOES_ have AAAA records

[swillden]

I should write out 1000 times "I should spend more time reading carefully", rather making sure the formatting is correct... :-(

:-)

I see you did realize that slashdot has no AAAA record, and that those AAAA records in the dig response were for a couple of the root servers.

Operational needs = no hoarding IPv6 addresses

[billstewart]

Because the 128-bit IPv6 address space is so excessively large, there's really no value in hoarding the stuff - an ISP who has a /32 isn't going to try charging you even $1 for each single IPv6 address because they know the market isn't going to fork over $2**96 for it. If you go read the what the network operators are saying when they talk to each other, the original designs ~15 years ago assumed 64 bits for the operator to play with and 64 for the end user, which gave the end user 16 bits for subnets and 48 bits for MAC-address-based auto-addressing, letting you run your network like Netware, but when that got replaced with EUI-64 64-bit-MAC auto-addressing (which is uglier but should never need changing), operators moved to giving users larger blocks.

The general view is that corporate customers get /48s, and home users probably get /56 but some ISPs lean toward /48, though a few ISPs seem to like /64 as a default for home users and /56 or /48 as an extra-price upgrade. ( /64 means that either you only get one subnet at home or that you do something fancy with the addressing behind your home firewall, but realistically, as home wireless is becoming near-universal, almost everybody ends up with multiple subnets so working with /64 is a pain.) Operationally, for an ISP, it's a lot simpler and cheaper if you can treat all your users the same way, so you can put one set of instructions on the web site and have one set of scripts for the help desk folks to work from and have troubleshooting processes that work. There are a few people advocating /60 for home networks, but the value of aligning addresses on byte boundaries vs. the added complexity and minimal savings means that they get shouted down rapidly.

Anywhere in US with DSL has 2 ISPs

[billstewart]

Just about anywhere in the US that has DSL has far more than two choices of ISP from a price/policy standpoint. Unlike cable modems, where the right technical choice is to do routing all the way down, and where the main technical approach to sharing with multiple ISPs is PPPoE or even uglier things, DSL is fundamentally a Layer 2 protocol that makes it easy to share between different sets of router operators, so issues like address space, bandwidth caps, and port 25 blocking are per-ISP, and there are lots of national ISPs like Speakeasy that can sell you service on top of the telco DSL wire. That doesn't get you competition from a highest-available-speed perspective; you're still limited by the DSLAM hardware and your distance from the central office, but at least you're not stuck with your telco's idea of forward-thinking Internet service policy.

In bigger cities in the US there's also Layer 1 competition, with Covad and occasional other CLEC DSLAM providers who use the telco copper wire, so they may have higher or lower speeds than what the telco offers. And for both cable and DSL, it's possible to have shared services at Layer 8, i.e. wholesale billing arrangements so you're getting your service from Example.Net instead of the telco/cableco, so you may not have the same price caps or policies about sharing or limits on static addresses, but any routing and port-25 blocking gets done by the infrastructure provider. (For Layer 9 reasons, cable companies usually don't offer this, but some telcos are ok with it.)

And of course if you live too far from your telco office, so DSL doesn't reach you, then you're stuck with either cable modem, satellite, or wireless. You don't even need to be near big cities - a friend of mine runs wireless ISP service in rural Wyoming, putting antennas on top of silos and such, though he *really* doesn't want any P2P running on his network because of bandwidth costs and performance impacts.

DSL gets you even more choices

[billstewart]

And if you've got AT&T, you've probably also got a bunch of national DSL providers like Speakeasy who can provide you different policies and services on top of the AT&T DSLAMs. It tends to cost a bit more, but you get more choices about static addresses, email/web/etc. service, bandwidth caps, etc. I'm currently using sonic.net on top of AT&T DSL, and get my static addresses and a shell account which I mainly use to run procmail and webmail, and even N years ago when the telco's policies were very restrictive (no web or mail servers at home, no sharing wireless with neighbors, no more than N computers on your line, etc.), sonic's policies were "You're buying service from us because you want a Real Internet Connection - do whatever you want (except spam, of course)." The telco's relaxed a lot since then, but I've still been happy with value-added service.

It is slower than Comcast, but more than fast enough for me, and I'd prefer almost *any* ISP's policies to living with the typical cable modem company's policies.

Streamlining Routing Tables isn't happening

[billstewart]

One of the pipe dreams of early-years IPv6 planning was that by handling IPv6 address allocations cleanly and hierarchically, without the leftover IPv4 swamp space, routers could all have a nice clean shiny view of the rest of the world, with far fewer routes and less routing table churn than IPv4. But it ain't happening, folks, because the user requirements that led to much of the IPv4 routing complexity are still there.

• Businesses that want their own provider-independent IPv4 space so they don't have to renumber their network or public face when they change ISPs have no incentive to accept provider-allocated space in IPv6, and no expectation that they'll want to do that even after the IPv6 market matures.
• Dual-Homing for Reliability is a much more serious technical objection - if you're a business with one ISP, even if you've got physically diverse feeds to protect you from backhoes, if that ISP has routing problems you're toast. It's less common than it used to be in the early 90s, but individual ISPs do still flake occasionally, especially if they do something like install a new router software version without testing it thoroughly enough, something that's going to happen very frequently in the next five years as ISPs deploy IPv6 for real and find all the subtle problems that Cisco and Juniper haven't discovered yet (especially the problems in older hardware...) And dual-homing means multiple routing table entries, so the routing tables keep growing as inbound IP becomes more and more critical for businesses..
• The main alternative solution to multiple homing that I've seen is "shim6" - it's a hopeless ugly mess, trying to insert a protocol layer in between IP and TCP/UDP to maintain sessions across multiple IP addresses. It only works well if everybody you're trying to talk to supports it, which will be a long time even if Microsoft, Apple, and Linus all adopt it.
• And Hierarchical Routing really only makes sense if the network topology is hierarchical, which it isn't. Not only do ISPs overlap in multiple cities, but large and medium business customers also have locations in multiple cities and often multiple continents, and the routing tables have to cope with that. Joe's Bar can do fine with provider-assigned or geographically-assigned address space, because it's all in one city, but Joe's Multinational can't easily do that - if it gets an address block from its San Francisco ISP, it needs to also have routes so that traffic to its New York office doesn't get shipped to San Francisco first, and especially so routes to its London, Mumbai, and Tokyo offices don't go to SF first. So you still end up with messy routing tables. Some of that complexity has limits to its growth and some doesn't - most of it belongs to maybe the US Fortune 10,000 and the equivalents in Europe, Japan, Southeast Asia, and India - but some of it's likely to keep growing as the world economy expands.

How You Get IPv6 Addresses

[billstewart]

Having an ISP go to all the work of accounting for every device you need an IPv6 address for, all for free, would be charity; ISPs can't afford to do that. They're going to hand you a block of addresses and make you deal with address assignment inside them. One reason IPv6 address space is so big is so that we never have to expand it again (which is what killed the 64-bit addressing proposals), but another reason is so that we can afford a clean separation between the bits that the ISP assigns and the bits that the customer manages, because managing things costs money. The reason many ISPs only give you one IPv4 address today is because IPv4 addresses are scarce and expensive, and you use NAT to put multiple machines behind it (if you want multiple machines) because you can do that without dealing with the ISP, which costs you both money. IPv6 addresses are designed so they'll never be scarce - your ISP gives you one block of addresses and you do whatever you want inside that block. It does mean that your ISP-connection-box needs to be a router, since it's handling a whole block of addresses on your side and not just one, but these days that's cheap.

In early IPv6 planning, the block size was /64 - it was a nice clean round number, and was big enough for a Netware-style autoaddressing which gave the user 16 bits of subnet numbers if they wanted them and 48 bits of MAC hardware address, though it was later decided that autoaddressing should use EUI-64 hardware addresses instead of 48-bit MACs, which means that the boundary needed to shift, since /64 is now only one subnet.
The consensus among ISP operations folks these days is that the boundary will probably be to assign /48s to businesses and either /56s or maybe /48s to homes. There may be some ISPs that only want to give you a /64, but there's a high enough fraction of the market that needs multiple subnets because of wireless and other applications that it's an unpopular position. And there are some ISPs that are talking about /56 for smaller businesses and /48 for larger ones, since at that point the differences between what consumers need and what businesses need are more about reliability, billing options, and value-added services such as television or managed PBX services.

You referred to Joe Sysadmin wanting to assign addresses, so you're apparently thinking about a business context - a few devices like routers may need manually assigned addresses, but humans are going to deal with DNS addresses, and the IPv6 applications folks have been working on different tools for managing that for the last decade and a half. The worldview has changed a bit, from the original MAC-based autoaddressing to a more DHCP-centric view, but either way widespread manual addressing is non-scalable and usually silly in the IPv4 world and worse in the IPv6 world. (Doesn't mean that it doesn't happen; I'm currently working on a customer firewall project where we're doing lots of it, but if I were the architect we'd have done it differently...)

And as far as whether you've got a global address space or can assign your own IP addresses that overlap with the outside world, it's global, get used to it, and if you try assigning local addresses that overlap with the rest of the world's addresses, you're going to get spanked. Back in the mid-90s, when IP applications weren't universal (e.g. businesses still ran SNA and NetBEUI and Novell Netware IPX and didn't always have Internet connections on their internal networks), and RFC1918 hadn't been invented, I did have computer-consulting customers who had done internal projects using addresses they'd Just Made Up. "We're a Bank - This'll never connect to the Outside World! Who cares if our address space overlaps with University of Toronto." That was before DHCP, so it really *hurt* when they had to renumber their network :-)

You want name resolution anyway

[billstewart]

Anonymous Clients don't need names. But if anything, the fact that IPv6 addresses are often hard to remember is a *feature*, because it forces people to deploy name resolution for anything that does need names.

Nmap fails, multiple home IPv4 addresses

[billstewart]

Nmap fails entertainingly when the average target subnet has 2**64 addresses instead of 1 or 256. There are ways to cheat on that, e.g. exploiting the MAC-based autoaddressing structure (guess that the target has a Dell or HP PC first), but it's still basically difficult. On the other hand, the average user is still going to have a firewall at home, and they don't really care how the little box they had to buy protects them; the real question is whether they had to buy their own or had it built in to their ISP's DSL/cable-modem.

If you're running a small business, 32 externally-visible IPv4 addresses is probably enough, but for a home network, by about 2012 it's going to start costing a good bit more money to have multiple IPv4 addresses, since the world will have run out of them, and ISPs are likely to move toward another layer of NAT for their dynamic-address customers if they're not using IPv6.

For your business environment, I agree with you about DHCPv6 vs. autoconfig and testing a lot of stuff in a virtual environment before running much of it for the real network. And yeah, older equipment is probably going to stay IPv4 for a while. I'm looking forward to seeing how my Corporate Desktop Support Overlords deploy IPv6 for us...

*BSD runs IPv6 :-)

[billstewart]

Oh, wait, wrong meme...

IPv6 has a lot of problems, but the IPv4 address space is going to fall off the edge of the world by 2012 or earlier, so you're either stuck with IPv6 or multiple-NAT, which is at least as ugly.

Why ISPs are Dragging their Feet

[billstewart]

Umm, no, thanks for playing.

Disclaimer: This is my own personal commentary, not the opinion of my employer, other companies they own, or my other corporate overlords. But it's still correct.

All major ISPs are thinking about IPv6, most minor ISPs are thinking about it, and any that aren't thinking about it are going to be in serious trouble by 2012 or before. A few years ago, what they were thinking was mostly [Expletive deleted!], but most of them are a bit more focused by now and the rest won't outlive the Mayan calendar rollover. Sure, some of us own large netblocks that will it may be possible to monetize, but just about everybody who does also owns large Cisco routers that will need to be replaced, which costs a lot more money, and in many cases it's the whole collection of operation support software that needs to be updated, which is even harder than just upgrading all your capital equipment. This is basically about as big a problem for a typical ISP as Y2K was - there are 32-bit address fields embedded in all sorts of things, so it's not as simple as just putting new values into existing tables.

Sometimes you can get around it by shoving your dynamically-addressed users behind another layer of NAT, and adding some IPv6 tunnel devices, but if your DSL or cable modem users require a hardware upgrade to support IPv6, it's potentially going to cost more in support to handle the transition than you'd gain by charging them extra to remain on IPv4, even if you make them buy the box. And if you're a business ISP, and your customer with a T1 line has been running fine on a Cisco 2500-series router for the last decade, well, time's up on that hardware. Most newer CPE routers can handle IPv6 fine, though if you've got a user with a T3 or E3 line (45 or 34 Mbps), you may find that it can't go full wire speed with IPv6.

There are a very few universities that still have big netblocks they haven't given back, but there's been enough market for them for the last decade that anybody who didn't need theirs has had plenty of incentive to sell them already. A much larger impact is the number of businesses who have a /24 address block when NAT and firewalls mean that they could get by just fine with a /28 or /29 to handle an inbound web server and VPN or two. In many cases, they can't do that, because they need their own address block that's large enough to be routable, since they're connected to multiple ISPs for reliability and business reasons. But even if we salvaged all of that, it would only gain us a year or two - there's so much growth in Asia that it'd get used up anyway.

I give Microsoft a lot of credit here - they started relatively early working on how to support IPv6 in their operating systems, and while it's not a vanilla feature on XP, you can install it, and they've done enough work on eating their own dogfood that it's as usable as anything they do, especially on Vista, which they'd hoped would be widely deployed by now.

Cost-benefit of Avoiding Impending Doom!

[billstewart]

Don't know what town you live in, but any ISP that doesn't have a really solid IPv6 plan by now is going to be toast by 2012 if not before. Either they won't be able to get enough IP addresses, or they're going to have to set up big tunnel servers and learn how to use them in a hurry, or start carrier-NATing their customers which starts to break applications. If IPv6 were something you could simply enable overnight it'd be different, but it's not - you're going to have a significant learning curve as you retrain all your people and rebuild all your management tools and replace any equipment that's not fast enough to run IPv6.

I'd expect that it would get even more exciting for people in the hosting business - not only do you have to keep getting more IP addresses as people virtualize their hosts, but as there start to be IPv6-only end users who want to reach websites, your hosting customers are going to want to have IPv6 support, and if you can't at least give them dual-stack, they're going to become somebody else's web hosting customer instead. You don't happen to have any Layer 3 switching gear in your hosting centers or manage load-balancers for customers do you? Good luck!

It's not like POSIX and GOSIP this time, really!

[billstewart]

I went through this in the 1980s with the government trying to push their users to OSI and POSIX - every RFP had a check box saying whether you supported it, and sometimes you had to write reams of explanation about how you were going to do it, but for the most part the end users got waivers and ran MS-DOS on their underpowered desktops and deployed TCP/IP in any networks that weren't running SNA.

But it's different this time, really, trust us! Ok, 5 years ago it wasn't, but by now IPv4 space is close enough to running out, even for agencies that can live behind firewalls like the military does, that they're starting to get serious about using this stuff, and by requiring it they're forcing development of the tools it takes to use IPv6 in the real world and not just on paper. And they helped get Microsoft to build IPv6 support in Windows to sell to them as well as to the real market.

Re:Anybody remember GOSIP? Very well :-)

[billstewart]

Yeah, I dealt with that market back in the 1980s, as well as the POSIX efforts, and worked with people who'd dealt with the US Auto Industry's attempts at standardizing on OSI as well. Five years ago, that was pretty much what government support for IPv6 looked like also, but it's different now, because the world really will run out of IPv4 addresses by about 2010-2012, so they really do need to do more than just hide behind NAT. And over the last few years their efforts to get testbeds run and actual operational experience have meant that ISPs and developers have some experience dealing with IPv6 now, and are starting to get ready to have to convert.

Most of the big chunks have been returned

[billstewart]

There are a few big chunks that are still being hoarded, but not much; universities have mostly returned their early allocations, and some of them now belong to big ISPs which have legitimate use for them. (For instance, Bell Labs used to have a Class A to support their Cray in Murray Hill, but it's now used for AT&T's ISP customers.)

There's a lot more space out there for small-medium businesses that have Class C /24s that could probably get away with /28s or /29s now, but many of them need to have publicly-routable address blocks since they're connected to multiple ISPs, so they can't use anything smaller. (In the IPv6 world, they could use a /48 just fine.)

But no, it wouldn't save us much time - Asia's using multiple /8s per year for growth.

That's already happened with IPv8 :-)

[billstewart]

Ok, sorry, I shouldn't be snarky about it, but if you go look up IPv8 you'll know what I'm making fun of...

Just to give you an idea of scale...

[RichiH]

> Where the fuck do you live where you have more than 2 viable choices for an ISP?

I live in a tiny German town with approximately 2000 people in it and I would say there are about a dozen ISPs I can get DSL from.

> What universe do you live in where the "competition" would realistically compete on this feature?

Unless an ISP is forced not to give you more than n IPv6 addresses, they will give you a /64 for home connections, /48 for colocation, etc. Every LIR gets one /32, no matter how large they are. This means that there can be as many _large_ ISPs as you have IPv4 addresses _in total_ before you run out of IPv6 space. Every DSL customer has the current IPv4 address space timed the current IPv4 address space at their disposal. Colo customers have 2^16 times that.
Every backwater ISP can have as many DSL customers as there are IPv4 addresses _in total_ before they run out.

Long story short: There are just so many IPv6 addresses, it literally does not fit into anyone's head. Humans are not geared to think in those dimensions.