IPv6 Adoption Will Grow With Smart Grid Adoption, Hopes Cisco

darthcamaro writes "A lot of people in the US have not seen a use case for the use of IPv6 yet, since we've got plenty of IPv4 addresses. But what happens when the entire electrical grid gets smart? The so-called Smart Grid will need a networking transport mechanism that will connect potentially hundreds of millions of people and devices. Networking giant Cisco sees IP (internet protocol) as the right transport and IPv6 as the logical choice for addressing. 'Pv6 is an interesting discussion and one that occupies a lot of bandwidth at Cisco,' Marie Hattar, Cisco's vice president of network systems and security solutions marketing said. 'Some people say that for smaller deployments, we could get away with IPv4, but the smart grid has a number of parts. The point is that if you're looking to build this [smart grid] out, why not build it out on the scalable protocol from the get-go?'"

Comments

I know my utility meters can be read remotely.

[vertinox]

But I'm not sure what protocol they use to check my electricity and water meters remotely.

I doubt its IPv6, but it would be a logical thing to do simply because of network addressing.

I mean even with private IPv6 addresses, it would still provide an easier way to identify the devices.

Re:I know my utility meters can be read remotely.

[oasisbob]

I doubt its IPv6, but it would be a logical thing to do simply because of network addressing.

They might be using IPv6 soon enough, check out 6lopan, an IETF group working towards getting IPv6 working on low-power networking devices like Xbee modems, etc. IEEE 802.15 transceivers are low-power, will mesh easily, and are very common in power meters.

Having global addressability saves a lot of hassle, and should not be confused with global reachability. Seems to make a lot of sense to me.

Re:I know my utility meters can be read remotely.

[FireFury03]

Also think about it. Do you realllllllllllllllllllly want your power grid to be tied to the real internet?

Well, maybe not, but there are still big advantages with using IPv6 even if it isn't on the public network. For example, you can use addresses that are guaranteed to be globally unique - this means no readdressing problems when you suddenly decide 2 completely independent networks need to talk to each other.

This is what has stunned me about the telephone industry - they are spending billions on replacing their antiquated SS7 networks with IMS networks. The IMS protocols were _designed_ to be run over IPv6 (but of course, IPv4 and IPv6 are so similar that they have actually been made to work on both), but most of the telcos are rolling out IPv4 networks. Nothing like spending vast amounts of money to replace one obsolete network with another.

IPv6 is an established and proven technology, there really aren't many good reasons not to use it in a new network.

IPV6 is a waste of time in the 'utility' market.

I'm not sure how it can be described as a "waste of time" since that would imply it would take longer to implement than an IPv4 network. If you're starting from scratch and not having to interoperate with the existing internet, an IPv6 network takes no more time to implement and is a bit of a no-brainer (getting a much more future-proofed network at almost the same cost). Unfortunately it seems that a lot of people in charge of such projects do indeed have no brains.

Re:wait - what IS a smart grid?

[Anonymous Coward]

http://en.wikipedia.org/wiki/Smart_grid

Re:oh the headache ...

[Locke2005]

when can we stop talking about IPv6? Just as soon as the IPv7 standard is released?

Translation

[Locke2005]

Companies will soon actually have a reason to throw out their old routers and buy new ones, hopes Cisco.

Re:Translation

[TheGratefulNet]

throw out routers? haven't ciscos been ipv6-capable for at least a decade now?

ipv6 is really old stuff. all routers that are 'worth anything' should be v6 capable already. those that aren't probably don't NEED to be, anyway.

not everything needs a world-wide public address. NAT 'security' is actually a Good Thing(tm).

Re:Translation

[bcmm]

Surely any decent router which miraculously doesn't support it yet could have support introduced in a firmware update? There is nothing about IPv6 that should require hardware updates.

Re:Translation

[FireFury03]

throw out routers? haven't ciscos been ipv6-capable for at least a decade now?

Pretty much (although you might have to buy a firmware upgrade... but then if you aren't running a recent firmware you're probably infested with security holes anyway).

those that aren't probably don't NEED to be, anyway.

That's rather untrue though. If you're going to deploy IPv6-only systems then *all* the routers on the network need to do IPv6. Yes, this even includes the home DSL routers, most of which currently on the market *still* have absolutely no IPv6 support, even though we only have about 2 years until IANA runs out of IPv4 addresses. Anything else is going to involve kludging things to work through IPv4 to IPv6 gateways, or tunnelling IPv6 over IPv4 to bypass the non-compliant devices.

The whole IPv4 address exhaustion problem is a really good example of people sticking their heads in the sane and hoping the problem goes away - most ISPs seem to not be interested in preparing their networks for IPv6 at all (PlusNet told me that they had no plans to roll out *any* IPv6 support over the next few years and EntaNet seem to have halted their IPv6 trials). Some time towards the end of 2011 there will be a "sky falling" moment similar to what we saw at Y2K when ISPs realise they are basically screwed and are going to have to do an expensive rush-job of deploying IPv6 over their networks in just a few short months.

not everything needs a world-wide public address. NAT 'security' is actually a Good Thing(tm).

Argh! Please will people stop spreading this crap. There is practically *no* security provided by a NAT. You get security from stateful packet inspection. NAT requires stateful packet inspection to work, but there is no significant security advantage (and many really serious operational disadvantages) provided by running NAT instead of just a stateful firewall. Also, most home NAT routers provide no stateful firewalling, only the limited stateful tracking required to make NAT work, and can therefore easily be bypassed by anyone on the upstream segment (which may be a few hundred random members of the public in the case of some cable setups).

Security is better served by doing proper stateful firewalling, and this is probably best achieved by removing NAT from the equation so that people don't have a false sense of security. Removing NAT also solves a lot of operational problems, as there are an increasing number of protocols that can't be made to work well through NAT (and whilst many people regard this as a flawed protocol design, there are sound reasons for designing these protocols in this way).

Re:Translation

[drinkypoo]

That's rather untrue though. If you're going to deploy IPv6-only systems then *all* the routers on the network need to do IPv6. Yes, this even includes the home DSL routers, most of which currently on the market *still* have absolutely no IPv6 support

Yeah, when ISPs actually do go IPv6 it will be a beautiful day for DD-WRT and OpenWRT. There will be whole businesses around reflashing those routers and reselling them, while most manufacturers will not release an update including IPv6.

There is practically *no* security provided by a NAT.

Unless your ISP is compromised, the combination of using non-routed addresses and dropping source routed frames (as everyone and their mom does by default) means that a NAT does provide some significant security. Attacks generally rely on packets reaching their destination.

Security is better served by doing proper stateful firewalling,

This part is true.

Removing NAT also solves a lot of operational problems, as there are an increasing number of protocols that can't be made to work well through NAT (and whilst many people regard this as a flawed protocol design, there are sound reasons for designing these protocols in this way).

In some cases yes, in some cases no. FTP is just stupid no matter how you slice it, sorry. Most newer protocols have some facility for NAT traversal, or at least work with a SOCKS proxy.

Re:Translation

[FireFury03]

There is practically *no* security provided by a NAT.

Unless your ISP is compromised

Your ISP doesn't have to be compromised. Many cable systems are set up so that the cable segment is basically a bus and the cable modems are bridges. Anyone on that segment can adjust their routing appropriately.

Also, even if you're not on such a network I don't think it's a particularly good idea to trust that another party's network is secure.

the combination of using non-routed addresses and dropping source routed frames (as everyone and their mom does by default) means that a NAT does provide some significant security. Attacks generally rely on packets reaching their destination.

No... No it doesn't. The ability to track the state of all the connections and drop packets that don't belong to any that were established by a local machine gets you the security. It just so happens that NAT requires that you implement this underlying framework, but keep this framework and remove the NAT and you still have about as much security. The only thing NAT gets you over and above this is to hide your internal network topography, which is of questionable value and turns out to be very harmful to a lot of legitimate stuff many people want to do.

In some cases yes, in some cases no. FTP is just stupid no matter how you slice it, sorry.

No, FTP isn't stupid - it was invented before firewalls were thought of and did the job it was designed to do very well. However, most people don't use the full functionality of the protocol and can therefore get away with something more simplistic that plays better with these newfangled firewall things.

Most newer protocols have some facility for NAT traversal, or at least work with a SOCKS proxy.

NAT traversal is flakey at best - even the STUN RFC admits that it is not, nor can it be, reliable. STUN (and other forms of NAT traversal) are a best effort way to make the best of a bad job and they work most of the time, but by no means should they be considered a good solution.

As for SOCKS, I've not seen anything using especially recent protocols provide any kind of support for SOCKS proxies. Certainly when it comes to applications that need to use UDP, whilst SOCKS 5 does support UDP I've never actually seen anything try.

Re:Translation

[TheGratefulNet]

There is practically *no* security provided by a NAT.

untrue.

try to ping my home address. its 10.a.b.c (you know what I mean).

go ahead.

now ssh to me.

now try to port scan me.

want to finally admit that there IS *some* security to nat? its not as secure as a smart firewall but its WAY better than being 'directly on the net'. way way better (for most of us).

Re:Translation

[Arlet]

Go ahead and post your public IP address, then.

Re:oh the headache ...

[TheRaven64]

When everyone's deployed it and it's boring.

Re:oh the headache ...

[Pulse_Instance]

When IPv7 standard is release we will talk about how no one will fill up all the address in IPv6 and there is no reason to switch to IPv7. When the IPv8 standard is released then we will talk about how easy it actually was to switch to IPv6 in the first place so there is no reason to stick around on IPv7. Maybe after IPv9 we will hear the end of IPv6 but it is highly unlikely.

Wishful thinking

[Locke2005]

NAT/IP Masquerade has worked well for scaling IPv4 in every conceivable application to date... what makes them think it won't work for the "smart grid"? Or to put it differently, do you really want every appliance in your house directly addressable from anywhere in the world? After all, what could possibly go wrong?

Re:Wishful thinking

[solevita]

NAT/IP Masquerade has worked well for scaling IPv4 in every conceivable application to date

Except, of course, that isn't really true. I've had to try and run a VPN endpoint on a NAT'd host because our ISP wasn't giving us what they'd advertised. That wasn't fun and if more people are going to want to run VPNs in the future, we're going to need more IP addresses.

Re:Wishful thinking

[hardburn]

NAT/IP Masquerade has worked well for scaling IPv4 in every conceivable application to date

Much the same way that up to Aug 28, 2005, the New Orleans leeves were successful in holding back every conceivable rise in water level.

NAT works as long as you have simple networking needs--nothing much more than web and email. As soon as you need to use VPN, or VoIP, or try to get two or more people to play the same game behind the same firewall, it becomes readily apparent what a pain NAT is. In some cases, the application is doing all sorts of trickery to try to keep the user from noticing the issue. In others, the user is left on their own to deal with it. That doesn't even count a bunch of potential applications where the developers realized that they wouldn't be able to get around NAT, and thus never built it at all or simply toiled in obscurity.

Or to put it differently, do you really want every appliance in your house directly addressable from anywhere in the world?

NAT != Firewall. The only thing NAT provides you with over a packet filter is hiding your network topology. There is some use in that, but it comes at the expense of everything mentioned above. On balance, NAT comes out wanting. If you still really want to hide your topology, you can still use NAT on IPv6, but this should be the exception, not the rule.

Re:Wishful thinking

[techno-vampire]

NAT != Firewall. The only thing NAT provides you with over a packet filter is hiding your network topology.

Personally, I'd say that it does a little more. As long as your router drops incoming requests on the floor instead of forwarding them, it protects your LAN from port scanners. That, of course, doesn't make it a firewall, but it is a step in the right direction. There's nothing NAT can do to protect you if you click on the wrong link because whatever comes back is a response, not a request, but still, for the average office, it's better than nothing.

Re:Wishful thinking

[FireFury03]

NAT/IP Masquerade has worked well for scaling IPv4 in every conceivable application to date...

Except it hasn't, NAT is a kludge that happens to work with simplistic client/server protocols in common use (such as HTTP). It doesn't even work well with some old standard protocols, such as FTP, without protocol-specific packet mangling.

NAT breaks pretty much all peer-to-peer protocols, which are rapidly becoming more common. Want to do VoIP, or start a direct file transfer between 2 IM clients? If you have NATs in the way then that gets unreliable. STUN makes things work a lot of the time, but even the STUN RFC admits that it is not, and cannot be, reliable. Systems like Skype try to hide these problems by abusing unfirewalled clients to route traffic between NATted clients (often without the unfirewalled user's knowledge), but the problems still exist and such "solutions" start to fall to pieces as the proportion of unfirewalled hosts dwindles.

what makes them think it won't work for the "smart grid"?

I'm guessing that the electricity supplier is going to want to be able to talk directly to your electricity meter, etc. Having a NAT in the way makes this less reliable since they won't be able to talk to it unless the meter has already initiated the connection through the NAT.

Or to put it differently, do you really want every appliance in your house directly addressable from anywhere in the world?

Do not confuse global addressability with global reachability. Assigning every device a globally unique address is valuable, even if it is on an isolated network. It makes it easier to connect 2 isolated networks together when you realise that you actually need them to not be so isolated from each other.

That said, I can think of a number of appliances that I wouldn't mind being globally reachable: My MythTV system is already globally reachable - if someone mentions a TV programme that sounds interesting, I can use the web browser on my phone to tell it to record that programme. I wouldn't mind my oven to be internet addressable, so I could remotely ask it to turn on and cook my dinner in time for me getting home. Being able to turn my heating on when I'm at the airport after coming back from holiday would be useful. Taking things a bit further, if I could ask my fridge what I'm running out of when I'm in the supermarket, I could save some hassle.

After all, what could possibly go wrong?

There are obviously security concerns to be addressed. But at the same time, designing a network so it *can't* be extended in the future seems somewhat short sighted.

Re:Wishful thinking

[techno-vampire]

Router's don't drop requests, at least not by default. Firewalls do. Best Buy has never sold a single router, no matter what it says on the box.

I have a home LAN, with a router. In order to get bittorrent working correctly, I had to set up this machine with a static IP on the LAN, and tell my router to forward all rquests on the appropriate ports to that IP. I have my own domain, and I've used dynamic DNS to let me use SSH to connect to my home machine when I'm away from home. Again, I had to tell the router where to send incoming requests on Port 22. Now, you may prefer to call that a "residential gateway" as Wikipedia does, but most people would look at you funny if you called it anything other than a router.

Re:Wishful thinking

[techno-vampire]

*Shrug!* At this point, you're just playing word games with the nomenclature. The common name for the device in question is "router," and wanking about the definition isn't going to change that.

NEGATIVE! Seperate it from public!

[Anonymous Coward]

No, the smart grid should be a completely seperate network, only backed by the Internet/public network as a fallback to primary grid network failure. And even then severe security measures should be met for such a bridge. My point still stands, the grid should be implemented on a seperate network (not completely publicly accessible), and in that case using IPv4 on both will be just fine.

Get a Clue!

[refactored]

I waded through the replies with a fist full of mod points hoping to mod the cluefull up... but there weren't any!

The internet and especially all the Linux nodes on the internet are designed from the ground up to have a static IP addresses and IP names and be their own DNS and own Mail smarthost and web server and ....

Between the control freaks, the clueless, and the bean counters in Microsoft and the ISP's we have an internet with...

• an artificial scarcity of ip numbers and ip names that the ISP's can rort a fortune out of their users for a service that costs them less to provide than the cost of billing their customers for it.
• the vast majority of machines being dumb emasculated drones begging for content from the big media industries.
• an a tightly controlled web where peer to peer traffic is being squeezed out.

IPv6 will _never_ be allowed into the current mix.

Re:Get a Clue!

[sexconker]

Protip: We were networking long before IP. If you were talking about MAC addresses, you'd have a point.

Yes, ISPs suck.
No, believe it or not, IPv6's ridiculously slow uptake is MS's fault.

Yes, IPv6 will be here one day.

Re:Get a Clue!

[tsotha]

• an artificial scarcity of ip numbers and ip names that the ISP's can rort a fortune out of their users for a service that costs them less to provide than the cost of billing their customers for it.
• the vast majority of machines being dumb emasculated drones begging for content from the big media industries.
• an a tightly controlled web where peer to peer traffic is being squeezed out.

Only your first point has anything to do with IPv6. Switching to a new protocol isn't going to make your machine any less "emasculated", and P2P is being suppressed over bandwidth costs (though I'm not even sure how much that's true - I use bittorrent all the time). People who aren't running some kind of web service aren't going to see any benefit from IPv6.

Re:Get a Clue!

[TheRaven64]

I'm not sure how you can blame it on Microsoft. You've been able to download IPv6 support for XP from Microsoft for several years (one of my housemates was running v6 on his machine via a tunnel back around 2002/3) and Vista supports 6to4 out of the box.

I don't know about you all...but as for me...

[Em Emalb]

I'm waiting for IP version Kevin Bacon.

It's the only way to ensure your packet is going to positively absolutely get from point A to point B in a timely, efficient, and stylish manner.

Keep your stupid IP ver 6. Pffft. It's about as elegant as Lemur poop. IPvKB, on the other hand...now THAT'S a protocol.

The last thing we need is for the power grid

[antifoidulus]

to become self-aware AND connected to the internet. It will spend the whole day looking at ionic porn instead of providing power.

"ooh baby, I can see your net positive charge, come put it in my net negative charge..ooh, you like like bonding....yeah baby...ooh, you want to get kinky and go 3 atom covalent?"

Re:The last thing we need is for the power grid

[Cheesetrap]

Wouldn't you be putting your net negative charge in the net positive charge?

Hey don't push your politics on me, man!

Can't Wait

[sexconker]

I can't wait to DDoS your fridge, then call you up (over VoIP) and ask you if your fridge is running.

Re:oh the headache ...

[iamapizza]

Does this mean we'll have to modify the quote to "There's no place like ::1"?

the Linux desktop will drive ipv6

[Trepidity]

IPv6 adoption, I predict, will increase markedly in The Year of the Linux Desktop.

Re:NEGATIVE! Seperate it from public!

[FooAtWFU]

Don't worry! You see, by using IPv6 you can guarantee that no normal host on the Internet is ever going to be capable of reaching it! :)

If it's so interesting...

[Gerald]

"IPv6 is an interesting discussion and one that occupies a lot of bandwidth at Cisco."

So why can't I get to www.cisco.com via IPv6?

Re:If it's so interesting...

[chrylis]

Especially ironic since just this afternoon I was looking at a Cisco Press book that gave a lookup for www.cisco.com as an example of IPv6 DNS.

The smart grid doesn't need public IPs

[Desert Tripper]

Most grid control systems are on private (192.168 style) networks not connected to the general Internet for obvious reasons, and "smart-grid" meter-reading systems that are currently implemented or planned use other methods of addressing (packet-radio protocols, etc.) So, the "smart grid" argument in the article is misguided at best.

Re:when the entire electrical grid gets smart?

[sexconker]

IPv6 only allows about 3.4 * 10^38 addresses.
Not nearly enough!

Re:oh the headache ...

[0100010001010011]

In perspective, IPv6 is 5Ã--10^28 addresses for every man womand and child alive. 70kg human has around 7*10^27 atoms in their body. Or about 7 IP addresses per atom.

Each 1.020144 * 10^-14 sq meter of Earth could have an IP address.

It's 252 addresses for every known sun in the observable sky.

Not making any 640k statements, but damn that's a lot of addresses.

Patricksomerdmnum

[Anonymous Coward]

You know the most hilarious part of all this? We're currently running a protocol that the designers had NO intent of scaling. So then some of the SAME designers have turned around and come up with a scalable address scheme and protocol and NO ONE wants to use it - except for the Chinese. You know they have over a billion people over there? All of em - even the dirt farmers - seem to have a freakin computer that wants to hack my bank account!

Re:oh the headache ...

[JesseMcDonald]

Sure, IPv6 allows for far more individual addresses than we'll probably ever use. The idea is that, unlike with IPv4, we won't be forced to use every single one of those addresses. Instead we'll have the freedom to group them in ways which make sense--like purely hierarchical assignments, which greatly simplify routing, and unique, locally auto-generated host addresses. It's sort of like the way the name "John Smith" (which is hardly unique) consists of around 47.5 bits, assuming 4.75 bits per letter (26 letters + space). That leaves far more addressing possibilities than we need (about 10^14, vs. less than 10^10 humans), but the extra bits are useful in that they lets us skip inconvenient identifiers like Efmq Duisx.

Re:oh the headache ...

[TheLink]

Sounds like a problem waiting to happen.

What are the odds that some popular software/code turns out to be not so good at picking completely random numbers.