Slashdot Mirror
At Current Rates, Only a Few More Years' Worth of IPv4 Addresses
An anonymous reader excerpts from an interesting article at Ars Technica, which begins "There are 3,706,650,624 usable IPv4 addresses. On January 1, 2000, approximately 1,615 million (44 percent) were in use and 2,092 million were still available. Today, ten years later, 2,985 million addresses (81 percent) are in use, and 722 million are still free. In that time, the number of addresses used per year increased from 79 million in 2000 to 203 million in 2009. So it's a near certainty that before Barack Obama vacates the White House, we'll be out of IPv4 address[es]. (Even if he doesn't get re-elected.)"
Can we start the discussion by not immediately going to the "NAT will save us" argument? Just accept that while NAT deployments might put it off, IPv6 deployment is inevitably necessary.
RTFS and do the math. 203 million addresses were allocated in 2009; a /8 is 16.7 million addresses; reclaiming a /8 (which would probably take a lot of time and effort, possibly in court) would put off the IPv4 depletion by about one month. It isn't worth the effort; better to put it into IPv6.
UNIX? They're not even circumcised! Savages!
"IPv6 addresses are too long and complicated to type"
...is like saying solar panels are too hard to build when you run out of slave labor in hamster wheels.
"We don't need IPv6 since there is NAT"
...is like saying we don't need new energy solutions because beeswax candles are a tried and trusted technology.
"The Internet will be overrun by zombies when NATs no longer protect us."
...is like saying avoiding antibacterial soap will cause untold misery and disease.
"Just re-allocate some of the wasted space in Class A nets."
...is like saying overcrowding of the planet can be mitigated by decreasing the size of houses.
True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
Only a Few More Years' Worth of IPv4 Addresses
They (vested interest groups) have been saying that for a decade now.... guess what, we haven't run out yet.
We all know that IPv4 addresses will be bought and sold like any other commodity once new ones run out.
Of course there is - it allows all manner of insecure and misconfigured gear to avoid being probed from the other side of the planet?
That's not an advantage of NAT. That's an advantage of a stateful firewall that disallows inbound connections. NAT is not required to get the same benefit.
All of the machines in my home have public IPv6 addresses, but I have a firewall that blocks inbound connections to all of them. Same security result. No address translation.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
An improperly configured NAT gateway may also allow outsiders access to the internal, private network.
I can't think of any that are this way by default.
Improperly configured network devices are always a security risk. NAT does not help here.
Sure it does, they're not reachable from the Internet. How is that not helpful?
Your JetDirect card would presumably be behind a firewall, so even with a public IP, it would not be accessible to those on the general internet.
Yes, mine would be, but most people don't properly secure their networks. NAT buys them some security despite their misconfiguration.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
That's great - your network is properly configured. Most aren't.
NAT isn't required, it just makes up for poor administration.
Bah. You just gotta love that attitude. Actually the most plain view of the NAT security is not the inbound firewall but the persumably unroutable private block that's behind it. "We can't do our work properly so we stick our gear where they can't attack it. After all, our network has private addresses so the evil asian guys can't get to it. Right? RIGHT?" Wrong.
Wrong in oh so many ways.
First off, private addresses are NOT unroutable, they just happen to be dropped on their way through your ISP (if they do their job properly). Just try a traceroute to a private address and see how far the trace gets. (And try it from a public traceroute server ;) Try putting a server on the other side of your beloved NAT and you might just discover that you can ping into your private network.
Second, even if this works as advertised it does not pose any great advantage over a stateful firewall. To the contrary, NAT not only tends to fuck up many L4 protocols, but also introduces a complexity in address rewriting and therefore might introduce a whole bunch of security issues on its own.
The third problem is the NAT admin's typical mentality. People tend to satisfy themselves with such a global protection shield (tm) and neglect going into the detail of securing their private network properly. "LAN hosts" are often left with their own firewall off, with simple or even default admin passwords, a lot of non-pc appliances (printers, phones) left to their own fate etc. That just makes a perfect base for the all-or-nothing principle, which goes so against any security reasoning. Such an admin will then be horrified by the mere thought of having IPv6, since that would put all of his naked boxes right on the evil Internet without the condom of NAT, OMG!
Finally AND MOST IMPORTANTLY please ask yourself how much of the total security is provided by blocking inbound traffic. Most client boxes run absolutely no services (maybe ssh), even windows can have a great deal of its server capability disabled. Further, service exploits were the music of the early 2000's, by now almost all of the services can withstand direct exposure to the Internet (with the exception of silly newcomers). The real security threat comes from outbound connections, people going to nasty sites, or people going to legit sites (banks) with silly passwords, flipped staff, and so on and so on. The vast majority of compromised zombie machines is on broadband, which means a router with NAT or "stateful firewall".
Helping solve the problem is much harder.
Are you part of the problem, or part of the solution? If all you're willing to do is criticise, then I think you're part of the problem.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf