At Current Rates, Only a Few More Years' Worth of IPv4 Addresses

An anonymous reader excerpts from an interesting article at Ars Technica, which begins "There are 3,706,650,624 usable IPv4 addresses. On January 1, 2000, approximately 1,615 million (44 percent) were in use and 2,092 million were still available. Today, ten years later, 2,985 million addresses (81 percent) are in use, and 722 million are still free. In that time, the number of addresses used per year increased from 79 million in 2000 to 203 million in 2009. So it's a near certainty that before Barack Obama vacates the White House, we'll be out of IPv4 address[es]. (Even if he doesn't get re-elected.)"

Comments

Don't say "NAT"

[Anonymous Coward]

Can we start the discussion by not immediately going to the "NAT will save us" argument? Just accept that while NAT deployments might put it off, IPv6 deployment is inevitably necessary.

Re:Don't say "NAT"

[sopssa]

No, not really. There's companies with whole fucking /8 that have no real purpose to own them, but they've just always had them:

003/8 General Electric Company 1994-05 LEGACY
004/8 Level 3 Communications, Inc. 1992-12 LEGACY
008/8 Level 3 Communications, Inc. 1992-12 LEGACY (two /8's ?)
009/8 IBM 1992-08 LEGACY
013/8 Xerox Corporation 1991-09 LEGACY
015/8 Hewlett-Packard Company 1994-07 LEGACY
016/8 Digital Equipment Corporation 1994-11 LEGACY
017/8 Apple Computer Inc. 1992-07 LEGACY
019/8 Ford Motor Company 1995-05 LEGACY
034/8 Halliburton Company 1993-03 LEGACY
044/8 Amateur Radio Digital Communications 1992-07 LEGACY
045/8 Interop Show Network 1995-01 LEGACY
047/8 Bell-Northern Research 1991-01 LEGACY
048/8 Prudential Securities Inc. 1995-05 LEGACY
052/8 E.I. duPont de Nemours and Co., Inc. 1991-12 LEGACY
053/8 Cap Debis CCS 1993-10 LEGACY
054/8 Merck and Co., Inc. 1992-03 LEGACY
056/8 US Postal Service 1994-06 LEGACY

Just get rid of the companies that are reserving such huge spaces without having a real reason to do so, other than that they were there to reserve them in start of 90's. Also US and UK army and defence and other ministers have several /8, but why really? Other countries do just fine without too.

Re:Don't say "NAT"

[enriquevagu]

Actually... NAT is WHAT prevented IPv4 from exhausting several years ago.

Re:Don't say "NAT"

[causality]

Can we start the discussion by not immediately going to the "NAT will save us" argument? Just accept that while NAT deployments might put it off, IPv6 deployment is inevitably necessary.

It's not unreasonable to say that the increasing scarcity of a finite resource might put more pressure on all of us to utilize that resource more efficiently. Replacing the scarce resource (IPv4 with its 2^32 addresses) with one that is overabundant (IPv6 with its 2^128 addresses) is always an option, of course. But migrating to that option and more wisely using our existing resources are not mutually exclusive. So no, I don't recognize as invalid the discussion of NAT as a technique useful for mitigating this issue.

Re:Don't say "NAT"

[growse]

So we go through a huge difficult, expensive process to save us, what? A couple of years? Why bother?

Re:Don't say "NAT"

[tehdaemon]

According to the article (which I haven't read yet BTW) all those /8's listed total what, 18 months worth of addresses? And the legal battles to get them will take how long?

T

Re:Don't say "NAT"

[swillden]

No, not really. There's companies with whole fucking /8 [iana.org] that have no real purpose to own them, but they've just always had them:

The block you listed contain a total of 301,989,888 addresses. At 2009's rate of 203 million addresses per year, returning those blocks would buy us less than 18 months. Big whoop.

Also, some of those companies actually do make significant use of the addresses they have. For example, I happen to know that IBM uses a good chunk of the 9.0.0.0 space.

Re:Don't say "NAT"

[sopssa]

Seeing the state of IPv6 and how many devices still don't support it, I think thats a pretty good idea. That being said, IPv6 support should be fully done in new devices, OS and programs already, because you need to give some time for old devices too so they can still work under IPv4.

But on another thing, I really doubt we are just a few years ago from IPv4 addresses going out of stock. There's still many /8 unallocated to anyone, most ISP's still give their users 5 ip addresses on home lines and from most hosting companies you can buy new ip's for $1-3 per piece. If we will be running out of them, we will first see hosting companies upping their prices and home ISP's limiting how many IP's they give to customers. And that will come far before we're actually out of address space.

Re:Don't say "NAT"

[fbjon]

There is no scarcity of the "resource" to begin with, only design flaws. Plus, more efficient use requires more complicated routing.

Re:Don't say "NAT"

[Anonymous Coward]

004/8 Level 3 Communications, Inc. 1992-12 LEGACY
008/8 Level 3 Communications, Inc. 1992-12 LEGACY (two /8's ?)

That's due to the acquisition of BBN who was the contractor that did a lot of initial ARPANET work. (The original defense contractor role of BBN was later spun back out and is now part of Raytheon but the network assets stayed with Genuity and then later Level 3) They also have the AS number "1", which gives them some severe old-school bragging rights.

Those assignments really aren't that bad -- they're a major ISP and would have huge chunks of IP space regardless. At least 4/8 is largely delegated to customers (I see 4.x.x.x IP addresses all the time) Not sure how much they've dipped into 8/8.

As other posters have pointed out, recycling them won't really give us much time. I'm not opposed to it personally, but it's not a fix

Re:Don't say "NAT"

[Anonymous Coward]

I happen to know that IBM uses a good chunk of the 9.0.0.0 space.

For what? Do all their PCs have public IPs?

Where I work has an entire class B and all of our PCs are public and we're talking now about NAT'ing them all, for security reasons. Once upon a time this would have been a nightmare because all of our devices have static IPs, but now we have a process to easily map in MAC addresses of authorized devices into a DHCP address so they all get their own IP.

What I'm saying is, once upon a time having to give that class B back would have been a nightmare -- right now, not really. We could probably live with a class C.

(Posted anon since someone where I work would probably take great exception to this...)

Re:Don't say "NAT"

[petermgreen]

we will first see hosting companies upping their prices and home ISP's limiting how many IP's they give to customers. And that will come far before we're actually out of address space.
That depends on what the IANA and the RIRs do. with thier policies over the next few years.

Right now IMO the sane policy for an ISP is to allocate as many IPs to customers as they can get away with, that way they can "justify" getting new IPs from the RIR. When the final squeeze comes with no new IPs availible from the RIRs the ISPs can then claw back IPs from less lucrative customers and give them to more lucrative ones.

Re:Don't say "NAT"

[swillden]

I happen to know that IBM uses a good chunk of the 9.0.0.0 space.

For what? Do all their PCs have public IPs?

At present, yes. Also their phones. But the employees' PCs are a fraction of IBM's computers. Keep in mind that IBM runs large data centers all over the world.

Yes, were IBM to go through a very large and expensive network restructuring to move many of the internal networks to NAT, they could probably give a few million addresses back. Maybe as many as 15 million. And at the 2009 rate that would buy us 26 days.

Where I work has an entire class B and all of our PCs are public and we're talking now about NAT'ing them all, for security reasons.

That's silly.

There's no security value to NAT. NAT does provide a stateful firewall that disallows inbound connections, but you can do that just as well without NAT, and with a great deal more flexibility.

Re:Don't say "NAT"

[Hatta]

It'll be easier to give everyone a block of ipv6 addresses than it will be to take away legacy ipv4 allocations.

Re:Don't say "NAT"

[gmuslera]

Inertia could make your car crash even if you started to turn when saw the danger. A few meters more could be the difference between your life or death.

Re:Don't say "NAT"

[RalphSleigh]

Google run their public DNS on 8.8.8.8 and 8.8.4.4 so they are being used, this is probably because level 3 provide google with multicast on these addresses.

Re:Don't say "NAT"

[fermion]

Another piece of useless trivia. When HP acquired Compaq which acquired DEC, HP apparently became the only firm with two consecutive "/8".

It might have been 3, but Compaq was never awarded a block. I never understood why that was. Compaq was certainly the major player in the early 90's.

In any case the IPv6 seems to implemented in all major OS(I don't know if it has fully support in Windows 7), so I suspect we will be transitioned within a couple years.It is like telephone numbers. In the US we are up to 10 digits, and we have seen no disasters as a result. We even have number portability.

Re:Don't say "NAT"

[maxume]

It also makes my car sit safely in my driveway.

Re:Don't say "NAT"

[maxume]

Why have a legal battle? Just let the current holders auction off sub-blocks.

Re:Don't say "NAT"

[Jonner]

There's no security value to NAT. NAT does provide a stateful firewall that disallows inbound connections, but you can do that just as well without NAT, and with a great deal more flexibility.

Thank you for pointing that out. So many people seem to think NAT is a security tool. I think it's because just about any router capable of NAT also has a stateful firewall (since NAT requires tracking of connections) and many people don't understand the distinction.

Re:Don't say "NAT"

[Jeremi]

There is no scarcity of the "resource" to begin with, only design flaws

The scarcity may be caused by design flaws, but that doesn't mean the scarcity doesn't exist.

Re:Don't say "NAT"

[ObsessiveMathsFreak]

Amen. NAT is the Fucking Devil. May it die a slow and horrible death.

Re:Don't say "NAT"

[turtleshadow]

IBM perhaps could still pull off a major internal transformation as they actually did once from Token Bus & Ring to Ethernet/Fibre in the late 80's and 90's. Im not sure if IBM ever phased out SNA at all their sites and customer connections.

However the Management team is gutting the company too much and overspecializing workers so that most US centers are in so much worry about Resource Actions that such major internal projects are probably walking wounded.

IBM has always been known for overkill of technology so holding 9.0.0.0 space is nothing new. Once I heard of Network Engineers having fibre and DS1 to the _desktop_ in the 80's and 90's just because they could.

Internally during the 90's boom I saw baked into contracts a really nice test lab for your customer's environment, what ever happened to that new low milage equip after the contract ended was like an internal fire sale.

IBM also still lists heli-pads near key sites just in case a critical skill or part has to be flown in/out.

Perhaps the big globalized corps will say in a few years - we've dumped IPv4 internally and skipped passed IPv6 to something we mere mortals don't hear about yet.

Re:Don't say "NAT"

[mysidia]

the ISPs can then claw back IPs from less lucrative customers and give them to more lucrative ones.

There's a term for that, it's called: Fraud. And I hope ARIN counts on that it will happen. I'm sure policies are already being considered as we speak, to provide for auditing of ISPs to validate compliance with the Registry Services agreements the ISPs signed.

It's a violation of the ARIN agreement ISPs have to sign, to give a customer more IP addresses than they have justified need for, just because you want to get a bigger PA allocation.

Allocations are provided to ISPs for re-assigning. Once re-assigned, the IPs belong to the end user, for use with services provided by the ISP.

The netblock belongs to the end user, as long as they keep services with the ISP, ARIN does not require them to return the addresses.

If the ISP retained the right to take back the IPs, then they violated the RSA by not properly recording the reassignment of the addresses, eg they never actually assigned them...

Re:Don't say "NAT"

[shentino]

IPv6 won't get around until it is profitable to do so...and that also means that v6 has to be better for the powers that be that currently are set to enjoy a monopoly grip on v4 addressing.

If I were ARIN, I would start making v4 addresses and v6 addresses cheap.

Re:Don't say "NAT"

[shentino]

It's only expensive because the holders won't give them up without a fight now that they are valuable.

Not really much different from China's recent land-grab of rare earths...just happening to sit on a pile of something that is now quite valuable, and prepared to fight to keep things that way.

Re:Don't say "NAT"

[shentino]

Disallowing inbound connections has little to do with security in that case, but everything to do with forcing your customers to pay a premium for the privilege of being a producer instead of a consumer of traffic.

Re:Don't say "NAT"

[drmerope]

Less scare oriented analysis have shown less than 50% of the IPv4 space in actual use. IPv6 is considered a to be a broken ill-designed protocol that screws up more than it fixes. Its basically unusable with mobile networks (WiMax, WiFi, etc). It significantly increases the cost of routers, switches, etc--the exceptions being those hardware that treat IPv6 in the slow-path. i.e., by trapping to the control CPU.

The IP network was designed to be a gateway network, not to connect every dippy host to every other one. Which is a broken, insecure, nonsensical practice. If you believe in it, you should review the Geek Social Fallacies.

The truth will be in the pudding. Once address space begins to be clawed back, abusive users (like IBM; IBM does NOT have millions of protocol compliant IPs: they ought to be NATed), will face a cost of reconfiguring their broken network topologies using IPv4 or switching to IPv6. Then we'll know.

Re:Don't say "NAT"

[Trolan]

Repurposing the D and E spaces won't fly. The D space is used. Think of the hell entailed if 224.0.0.5 and 224.0.0.6 get routed. Bye bye OSPF. Plus you'd have to recode every OS and firmware that understands those as multicast addresses to treat them as unicast. That's not even discussing what might be coded in for the E space in random OSes and firmwares. And after all that work, it'd buy us maybe two more years. Just go v6, it's already in the OSes, and would be in the firmwares if the end-user ISPs would just push the CPE manufacturers a little bit.

Re:Don't say "NAT"

[mysidia]

Those /8s and MANY /16s and some /24s are already allocated, they were allocated by the legacy registry under very few or no well-documented conditions. These addresses have no registry policy associated with them, they were basically granted without the recipients having to sign any agreement in many cases.

In case there was an agreement, the recipients of the legacy IP addresses (probably) either destroyed it or (conveniently) won't offer it, in any case, SELFISH BEHAVIOR is the norm.

Some of those /8 recipients themselves, and of course lots of very loud concerned single /24 recipients deem (on arin-ppml policy mailing list) ARIN to have no authority over their addresses, of course this is a self-serving position, and also results in them not having to pay any fees like everyone else (who received allocations since the late 90s) does.

But another potential consequence is, ARIN can't try to force them to renumber or take addresses back, and then re-assign them, without a 10-years protracted legal battle, with some of the largest, most influential corporations on earth, most likely.

The resulting internet instability would not be worth it the small delay in exhaustion, probably.

So in a word... the only way to get any IP addresses back is voluntary altruistic action from those companies, returning IP addresses back to the registries, that probably they could otherwise profit from.

Now tell me this... do you think Hewlett-Packard Company, Xerox, Ford, Apple, Level 3, GE, IBM, Halliburton Company, E.I. duPont , Bell-Northern , Interop, Bell-Northern, Prudential, and USPS...

Will go through the (potentially large) expense of renumbering their networks to consolidate, free up as much of their /8 as possible, and return it to IANA, as an altruistic action?

Despite the fact, that an IPv4 shortage could turn the resource they are sitting on into a very valuable asset, they could rent out piecemeal to ISPs all over the world, or to "IP Address" brokers....?

Despite the fact their Legacy IPs have special privileges that no modern-day IP address allocations have. For example, they can allocate however they want, without having to justify to anyone, they don't have to require justification from anyone and can allocate on whatever is the most profitable to them, plus they don't have to pay any fees, ever...

Whereas, if the internet ever switches to IPv6, they will lose all their legacy rights. And have to sign this gargantuan registry services agreement and pay huge annual allocation fees for their IPv6 space, just like everyone else...

Yeah, ARIN currently _waives_ fees for IPv6, by 'charging the lesser' of V4 and V6, but they can see beyond that, it won't last forever -- and the legacy registrants who currently have free IPs will start having to pay for V6, if V6 ever catches on.

It's in their best interest to keep V4 around, but not by voluntarily returning addresses, but by profiting from them, and massively increasing the fragmentation of the global routing tables in the DFZ.

Re:Don't say "NAT"

[tagno25]

If I were ARIN, I would start making v4 addresses and v6 addresses cheap.

To an ISP it is actually FREE to get IPv6 Addresses initially, ant then there is a wavier until 2012.

Fee Schedule

IPv6 Initial Allocation and IPv6 Assignment
ARIN charges a fee for the initial IPv6 allocation from ARIN to an ISP. This fee is currently waived for IPv4 subscribers. For organizations that aren't IPv4 subscribers, the fee is lowered by current fee waivers.

ARIN charges a fee for an IPv6 assignment (whether initial or additional) to an end-user. There are currently no fee waivers for IPv6 assignments.

Re:Don't say "NAT"

[swillden]

Depends on the context. I absolutely want to disallow inbound connections to the machines in my home, except on a controlled basis. The same applies for corporate networks. But ISPs shouldn't do the same. On the other hand, how many ISPs do NAT? I'm not aware of any where I live.

Re:Don't say "NAT"

[rantingkitten]

There's no security value to NAT. NAT does provide a stateful firewall that disallows inbound connections, but you can do that just as well without NAT, and with a great deal more flexibility.

You can. I can. Aunt Myrtle can't. I for one am glad that most home users are behind NAT these days. It's better than nothing. Unfortunately, it does tend to cause issues with SIP, which is my industry, but I've learned to live with that.

Re:Don't say "NAT"

[Gerald]

Level 3 owning two /8s makes sense, since networking is what they do. If I owned HP stock I'd be pissed if they simply gave back their /8s instead of leasing them. Same with GE, Xerox, Apple, IBM, or any other company in that list.

Re:Don't say "NAT"

[mcrbids]

Let's say that you get all these companies to give up ALL their addresses. You've postponed the problem by about 18 months! Whoopee!

The thing is, technology tends to grow logarithmically, which is why we have things like Benford's Law. The problem shouldn't be being solved now, while we're at the 90% level, the problem should have been solved long ago, back when we were at about the 10-20% level, because the actual halfway mark as a function of time is somewhere near 20-25% completion!

That IPV6 has been bungled so bad is a consequence of the Second System effect and perhaps a bit of design by committee.

In any event, IPV6 fails to solve a couple of fundamental problems:

1) Piss poor backwards compatibility. This was even acknowledged publicly in a recent news article. It's not only not poorly backwards compatible, it just basically ISN'T backwards compatible. Want to talk to an IPV4-only resource from your IPV6-only address? You basically have to have some fancy trickery with NAT and DNS in order to do this - it isn't straightforward, and it requires coordination with the IPV4 resource. And the reverse is even worse!

2) Un-necessary complexity in implementation. Partly as a result of #1, implementing IPV6 will be costly, and will require expensive "transition tools" in order to work smoothly. But it's not just because of lack of backwards compatibility - issues such as strange hardware requirements (what... no MAC address?) and the like make the cost of implementing high. Sure, it's not that expensive per device, but multiply that by the entire Internet, and the problem becomes a bit more clear.

3) No net positive for implementing! You don't get "more" for implementing, you get "less". Some stuff that used to work won't, and other stuff that you need to work just isn't there. Sure, Yahoo and Google support IPV6, which is great for the 50 or so people who are on it. But, if anybody cares, it's on IPV4.

4) Tragedy of the Commons: The address shortages don't affect anybody who's already on the 'net. I have an IP address or two already. I don't care if *you* run out, I only care if *I* run out. So, I really don't much care about you so long as I get mine. That's called the "tragedy of the commons" - a common resource is exploited as quickly as possible by people who are motivated to get theirs before anybody else gets it, resulting in a destroyed public resource.

IPV6 sucks. The engineers had their chance, and they blew it. Now it's too late to change it because we don't have another 5 years to committee another solution, and there is already a significant amount of inertia from those poor souls who have already implemented it! (at great cost)

This is NOT going to end well.

Re:Don't say "NAT"

[flyingfsck]

Exactly. Those companies will sell some IP addresses at a huuuuuuuuge profit. IPV6 won't become wide spread before it hasn't been made properly backwards compatible with IPV4.

Re:Don't say "NAT"

[FlyingBishop]

How is it a violation to give, say, twice the amount the company has need of? I see that as a basic optimization algorithm, so you don't have to go back and allocate a new address for every computer a company adds. But if IP addresses become more scarce, it makes sense to go back and see if their IP requirements have dropped, and possibly dial it down to 150% or even 130% of clear need. Until we run out, 200% saves a lot of paperwork.

Re:Don't say "NAT"

[Professor_UNIX]

Unless you're hosting a server on your internal network you shouldn't need to be forwarding any ports anywhere. I suggest trying a different router because yours is apparently severely broken if you need to do anything to get Team Fortress 2 to work on it. All those ports you list are outbound to the server and your firewall needs to allow stateful replies to come back in... which every consumer-grade router already should do by default.

Re:Don't say "NAT"

[Imagix]

How many home users actually use more than one of the 5 IP addresses that they've been allowed? And since they're assigned by DHCP, there's not 5 specific IPs for that user, but 5 IPs out of whatever IP space has been assigned to that network segment.

Re:Don't say "NAT"

[demonlapin]

You can. I can. Aunt Myrtle can't.

And - let's face it - neither can most of /.'s users. I remember setting up an OpenBSD firewall back in the late 90s, and I did most of my firewall rules configuration by copying someone else's rules. I tweaked them for my specific needs, but there's no way I'd have come up with them on my own. Unless you are a real network admin, you are unlikely to be able to set this up properly.

Re:Don't say "NAT"

[mysidia]

That's already been thought of. As an ISP, you don't get to just make up whatever rules you want to determine how many IPs you can assign, beyond a certain point, you have to apply RFC 2050, per the name resource policies:

Because it is.

In actuality, need is defined as the minimum number of IP addresses that will be required within a certain period of time in the future, according to Network Engineering plans that get submitted to ISPs (LIRs and RIRs) in order to apply for IPs; efficient utilization means utilizing 80% of the IPs to address internet hosts. IPs that will be required in the near future are needed and part of the justification.

Currently 25% immediate utilization is required after 6 months, 50% required after 1 year.

All existing IP allocations must be 80% utilized.

ARIN NRPM, 4.2.3.1. Efficient utilization ISPs are required to apply a utilization efficiency criterion in providing address space to their customers.

ARIN NRPM, 4.2.3.6 Reassignment to multihomed downstream customers: Under normal circumstances an ISP is required to determine the prefix size of their reassignment to a downstream customer according to the guidelines set forth in RFC 2050.
Specifically, a downstream customer justifies their reassignment by demonstrating they have an immediate requirement for 25% of the IP addresses being assigned, and that they have a plan to utilize 50% of their assignment within one year of its receipt.

4.2.3.3. Contiguous blocks: if a customer moves to another service provider or otherwise terminates a contract with an ISP, it is recommended that the customer return the network addresses to the ISP and renumber into the new provider's address space. The original ISP should allow sufficient time for the renumbering process to be completed before requiring the address space to be returned.

RFC 2050.

Re:Don't say "NAT"

[Eil]

Some Web hosts in particular like to give out IPs like candy because they're so cheap. I work for one that has thousands of vps customers and every single one gets a minimum of 4 IPs whether they use them or not.

Re:Don't say "NAT"

[demonlapin]

10-digit dialing didn't require anyone to change any equipment. You can still do rotary 10-digit dialing with a 60-year-old telephone, and it works. IPv6, not so much.

Re:Don't say "NAT"

[Yaztromo]

Why have a legal battle? Just let the current holders auction off sub-blocks.

You're assuming that the holders of these /8's have been using some sane way in which to assign the IPs within their blocks such that large, contiguous regions are still readily available that make the unused addresses readily routeable. Which, from my experience, they don't. And as the Internet would become nearly unroutable if millions of /31's and /32's suddenly appeared, the only way you could make this work is by having each and every one of those organizations effectively defragment their address use to make large, routable blocks that could be reassigned (e.g., /24s or /16s) -- and for organizations of the size that we're discussing, the cost of that is going to be way more than they'll be able to charge for those address blocks, and they aren't going to do it, fight or no fight.

You can't take an entity the size of (for example) IBM and have them compress their address use into a /12 to free up 240 new /24's without it being a very significant cost in terms of effort and downtime -- particularly when they have absolutely no incentive to do so. Nobody in their right mind would spend the necessary amount of money to make it worth their time and effort, when they can get millions of addresses in IPv6 for next to nothing.

Yaz.

Re:Don't say "NAT"

[mysidia]

NAT won't save us, but there are a lot of expensive technologies that will probably be used when IP addresses become more expensive.

For example... web hosting providers with thousands of servers for user websites.

May start looking into some expensive load-balancing and content switch technologies that support name-based virtual hosting let them use NAT on their webservers.

It means scaling name-based vhosting up even greater than it is today.

The Server end is the hardest to NAT, though. Every server application will have to adapt to these limited needs, meaning an equivalent to the HTTP host header, for every protocol. Application proxies will be king, just about everything will be HTTP, other protocols may die-off altogether or be replaced by equivalents that run over HTTP.

End users' internet connections will probably be NAT'ed by their ISPs first... this will even be seen as a revenue generator; since every TCP/UDP connection now uses ISP resources, it will become expected and normal for ISPs to have variable billing based on number of TCP/UDP connections.

Since each IP address can only have 65,530 connections, before source:destination port pairs are used up, and NAT router memory is not free.

Getting a non-NAT'ed IP is a business-level service and requires buying the 65,530 TCP/UDP connection level of service, plus an additional "IP fee".

In reality, the ISPs may force 'buying an IP' after a specified number of connection slots, since the memory usage on their router is more expensive than just assigning a certain IP at a point (if they will actually use all the full 'connection' quota they purchased)

Re:Don't say "NAT"

[PPH]

Just watch. It'll be like broadcast frequencies: "Sure, we'll give them back. For a few billion $$".

Re:Don't say "NAT"

[Yaztromo]

You can. I can. Aunt Myrtle can't.

Aunt Myrtle certainly could if her non-NAT IPv6 router came with a stateful firewall that defaulted to allowing no inbound connections, and which could be configured to allow certain ports to be opened specifically for certain machines on her network. No different from how every NAT based consumer router on the market currently works (except without the Native Address Translation part).

What is your thesis? That nobody could design a consumer home router that does this?

Yaz.

Re:Don't say "NAT"

[SatanicPuppy]

My company isn't even that big, and we have 3 /16 blocks.

That doesn't even count regular statics that come with things like T1/T3 lines, and stuff like that. No, these are blocks we bought in the 90's because the interwebs were becoming popular and we thought we might need 2^19 ip addresses.

We're migrating off of our block this year, actually. Completely abandoning it. Why? No need for it. Just the little piddly /28 blocks that come with our networking (per site) are vastly more than enough.

The ipv4-is-running-out-any-day-now argument is as pointless as its ever been.

Re:Don't say "NAT"

[hairyfeet]

But how many of those "in use" address are sitting idle, snatched up by companies like Apple, IBM, and MSFT when the net was young? I think we could go a lot longer on IPv4 if so many addresses weren't just sitting in the hands of a few major corps who aren't even using them.

And let us not forget that the switch will in all likelihood create a LOT of ewaste from all the home routers out there that don't support IPv6. So unless the ISPs give us routers that translate (not likely, as from what I've seen most give the crapola Motorola modem and that's it) then we are gonna end up with truckloads of routers heading straight to the dump.

Either way I'm betting the IPv6 change over is likely gonna be a big PITA. Hell I have to avoid my ISPs DNS for 6 months because that is how long it took them to actually get around to patching the Kaminsky flaw, I don't even wanna know how many years it will take that bunch to roll out IPv6 and actually have it work worth a damn.

Re:Don't say "NAT"

[Z00L00K]

I'm still waiting for ISP:s to offer IPv6.

As soon as the ISP:s starts to offer IPv6 it will be easier in general to use and develop for IPv6

Re:Don't say "NAT"

[ShakaUVM]

>>Allocations are provided to ISPs for re-assigning. Once re-assigned, the IPs belong to the end user, for use with services provided by the ISP.

Hmm, when I first got my cable modem it came with 5 (public) IP addresses. After a couple years, Time Warner suddenly revoked all the extra IP addresses, giving us only one instead, that we had to NAT through. I called to complain, and the manager said, essentially, that we were shit out of luck, but that we could buy additional IP addresses for a couple bucks a month each.

You think that qualifies as fraud?

Re:Don't say "NAT"

[phtpht]

You can. I can. Aunt Myrtle can't. I for one am glad that most home users are behind NAT these days. It's better than nothing.

No. Aunt Myrtle is fine at her home with the modem in BRIDGE mode and with the default settings of her vi$ta PC. (Just as she clicks on the bench icon in the network setup wizard.)

And probably she's far better than a lot of the corporate users with their own "professional" IT staff.

Re:Don't say "NAT"

[hairyfeet]

Dude, I have to be the one to break this to you, especially when you've got a good rant on and all in your journal, but if you're having that much trouble then your router is busted or just plain sucks. I got this cheap Trendnet and everything "just works" easy peasy. And hell you can get the wireless version for $2 cheaper thanks to free shipping.

So quit pulling your hair out over badly functioning equipment and just get a cheap one that actually works. I've set up plenty of these Trendnet routers for home users and they really are a breeze. No need to burst a blood vessel over gaming when there is an easier way. Oh, and I hope it doesn't give you a seizure, but UPnP actually works on these as well. So if all you are wanting to do is game these are an easy and cheap way to do it. HTH.

Re:Don't say "NAT"

[tftp]

In any case the IPv6 seems to implemented in all major OS

My Polycom IP phone is IPv4 only. What do I do now? And Polycom sold millions of those.

It's just an example, of course. There are billions of IPv4 gadgets out there, and some of them cost a lot.

Re:Don't say "NAT"

[huge]

Google run their public DNS on 8.8.8.8 and 8.8.4.4 so they are being used, this is probably because level 3 provide google with multicast on these addresses.

Anycast, not multicast.

Re:Don't say "NAT"

[mikael_j]

To be honest I'd have to say that anyone working in IT (or even developing networked applications these days) should be able to put together some decent inclusive firewall rules without too much trouble ,it's fine if you have to look up the syntax of your particular config file format but it definitely shouldn't be black magic, this isn't 1994 anymore.

/Mikael

Re:Don't say "NAT"

[huge]

Those of us that have worked in medium or large networks know how difficult life can be with NAT. It is one thing to have the NAT between your internal network and internet, but something quite different when you have overlapping RFC1918 ranges within your network.

During the past 10 years company I work for has gone through 4 huge mergers and a lot of smaller ones and in every case there have been problem with overlapping address spaces. In those cases you first and foremost goal will be renumbering the conflicting address spaces and quite obviously this wouldn't be necessary if everybody will be using public addresses. During the last merger we renumbered 100k+ workstations, servers and phones.

Re:Don't say "NAT"

[dido]

Lots of third-world ISPs, and many ISPs that provide mobile Internet do this. I remember a presentation on the evils of NAT in APRICOT 2004 where the presenter mentioned that the entire IP allocation for an African country (I forget which), was a single /24, and so they had no choice but to NAT all of their subscribers. I use an EMobile wireless dongle when I'm in Japan and that didn't give me a public IP address either. The same is true of all the other UMTS/3G/HSDPA-based Internet providers I've used (Smart and Globe in the Philippines). RFC 1918 space all the way. Some consumer DSL providers here in the Philippines do NAT as well (Globe consumer DSL and some plans provided by PLDT), although many still provide dynamically assigned public IP addresses. I imagine the number of ISPs that do NAT can only increase in the years ahead.

Re:Don't say "NAT"

[profplump]

Is there some reason your Aunt Myrtle couldn't install the non-NAT, stateful firewall/modem that her ISP provides, as opposed to the NAT-enabled version of the same product? Does the non-NAT version have more wires or something?

Whatever box she's currently using to provide NAT could just as easily provide a pre-configured firewall without NAT. Virtually every member of the helpless masses you claim to be protecting with NAT are doing nothing to modify the box provided by their ISP/picked up at Best Buy.

The default config on that box could provide the option to turn the firewall and NAT on and off separately, and could give big scary warnings if you tried to disable the firewall. It could even ship with NAT off by default, assuming the ISP supported multiple IP addresses per account, so that end-users weren't burdened with the hassles of NAT unless they actually needed it.

Heck, with a minor bit of traffic monitoring you could have the firewall/NAT box automatically detect when there were unanswered DHCP queries, stop forwarding them, enable NAT, and answer future DHCP queries internally -- then users who needed NAT would get it with zero config and users with a single machine or access to multiple addresses could get real connections.

Re:Don't say "NAT"

[dkf]

There's no security value to NAT. NAT does provide a stateful firewall that disallows inbound connections, but you can do that just as well without NAT, and with a great deal more flexibility.

The one thing of some security value to NAT that a firewall doesn't provide is that it at least partially conceals the nature of the network hidden behind it. It's not a particularly big value though as it is definitely security through obscurity; you want a firewall as well. (Using multiple layers of security is a very good plan as it makes things less brittle overall.)

Re:Don't say "NAT"

[profplump]

I guess you've never had to connect LANs from two different companies via a VPN. If you're both using the same RFC1918 address space it is incredibly difficult to route traffic around in any sensible fashion. If you want to talk about broken, non-sensical practices I'd start with that, which is squarely in the realm of what you suggest.

Even if every host doesn't need a public address (I think almost all hosts could use one, but I'm not going to argue that point here) there's still *exceptional* value in having a unified addressing plan so that you can coordinate easily with networks outside your immediate control. Just like there's value in have DIDs for every phone, as opposed to a single switchboard number and unpredictably-routed internal phone extensions, there's value in having unified addressing for every Internet host.

Re:Don't say "NAT"

[profplump]

You actually can't do rotary dialing on all lines -- I'm aware of a phone company in Iowa who actually hunted down their last pulse dialing user and gave them a new phone so they could turn off their old equipment.

And I really don't think you want the Internet to be run like the phone system -- limited to the technology we could imagine 50+ years ago for the sake of "backwards compatibility".

Re:Don't say "NAT"

[Sique]

The 10 digit dialling as it is in use in the U.S. causes major headaches for non-U.S. people who try to use telco equipment developed for the U.S.. Often it starts with some simple differences like the fact that the local phone system doesn't have an area code at all or the area code can have an arbitrary number of digits (two to six in Germany, one to four(*) in Austria...).
(*) In Austria you can get your own area code, I've customers with their own five and six digit area codes.

Re:Don't say "NAT"

[davew]

Yeah, I did some calculations on this. Took the usage numbers that are used to calculate the exhaustion date and dropped them into excel - then expanded it out further, to see how long we can last if we reclaim some /8s.

If we assume that 33 /8s are unusuable, so but claim back every other address on the internet in time for it to be reused - every single one, including yours and mine - then we run out of our second internet's worth of IPv4 addresses in September 2019.

Nine years and nine months more, if you reclaim not just the ones you listed, but everyone else's as well. What, you're using yours? Oh, ok. I'll just dial back that prediction...

Re:Don't say "NAT"

[Chris Mattern]

And I really don't think you want the Internet to be run like the phone system

Indeed. Five nines reliability, works even in the event of a total power outage...who the hell wants that?

Re:Don't say "NAT"

[Anonymous Coward]

I'm sorry, your post is off on a number of points. Let me clarify things for you.

The problem shouldn't be being solved now, while we're at the 90% level, the problem should have been solved long ago, back when we were at about the 10-20% level, because the actual halfway mark as a function of time is somewhere near 20-25% completion!

The IPv6 specs were drafted in 1994 and mostly finalized in 1998. That 95% of the world still is on IPv4 is not due to the IETF's tardiness.

1) Piss poor backwards compatibility. This was even acknowledged publicly in a recent news article.

Yes, in hindsight, more backwards compatibility would have been nice. It might have made the switchover period less painful and would have avoided the Game-theory deadlock that has withheld IPv6 adoption.

It's not only not poorly backwards compatible, it just basically ISN'T backwards compatible. Want to talk to an IPV4-only resource from your IPV6-only address? You basically have to have some fancy trickery with NAT and DNS in order to do this - it isn't straightforward, and it requires coordination with the IPV4 resource. And the reverse is even worse!

Why do you bring up IPv6-only addresses? They don't (yet) exist, and the situation you're describing is supposed to be painful: IPv6 was designed to not be backwards compatible. Such compatibility would introduce so much legacy/deprecated items in a new standard, that they opted to forego that option completely. The alternative for BC was also drafted at the same time: dual-stack operation. The only reason that your scenario may become real is because the industry's laziness. So if you have a problem with IPv6, take it up with your ISP who should have been offering IPv6 addresses for years. It's sad that the first major OS release to support the IPv6 stack was Windows Vista, even though the first working implementation dates from 1998 (KAME project). It's even sadder that up to this date, there are no end-consumer (NAT) routers that support IPv6 - well apart from the OpenWRT router I have running here.

2) Un-necessary complexity in implementation.

Where is the complexity, and which parts are unnecessary from your point of view?

Partly as a result of #1, implementing IPV6 will be costly, and will require expensive "transition tools" in order to work smoothly. But it's not just because of lack of backwards compatibility - issues such as strange hardware requirements (what... no MAC address?)

wha... what? MAC addresses are layer 2 addresses, and have nothing to do with IPv6, which is a layer 3 protocol. And besides, the MAC address is part of the autoconfigured IPv6 address...

and the like make the cost of implementing high. Sure, it's not that expensive per device, but multiply that by the entire Internet, and the problem becomes a bit more clear.

Which is why we could have had a ten-year transition period already...

3) No net positive for implementing! You don't get "more" for implementing, you get "less". Some stuff that used to work won't, and other stuff that you need to work just isn't there. Sure, Yahoo and Google support IPV6, which is great for the 50 or so people who are on it. But, if anybody cares, it's on IPV4.

Again the magic words: dual-stack operation. And about the net positives: no more fiddling with port-forwarding to get your online games to work, no more insecure UPnP implementations, automatic router discovery, automatic address discovery, full protocol support for IPSEC (instead of the tacked-on IPv4 version); no more portscan sweeps, ISPs can't limit the amount of addresses you use, to name just a few.

4) Tragedy of the Commons: The address shortages don't affect any

Re:Don't say "NAT"

[petermgreen]

What about all those users who aren't assigned permanent IPs but just use IPs from a DHCP or PPP IP pool (e.g. almost all dialup users and a large proportion of DSL and cable users)?

Right now most ISPs let those users have public IPs. What if anything is stopping the ISPs moving those users behind ISP level NAT and reusing those blocks for more lucrative buisness/hosting customers?

Re:Don't say "NAT"

[TheRaven64]

IPv6 is considered a to be a broken ill-designed protocol that screws up more than it fixes.

If this were wikipedia, that would be tagged with 'weasel words' and 'citation needed'. As it's Slashdot, can you point to someone who actually argues this rationally?

Its basically unusable with mobile networks (WiMax, WiFi, etc).

Absolute nonsense. Mobile IPv6 uses the fact that IPv6 requires IPSec support to allow the routing tables to be updated dynamically by the device (once you've been assigned an IP address, you can push routing table updates for that IP when you hop to a different network) which eliminates the triangle routing that Mobile IPv4 needs.

It significantly increases the cost of routers, switches, etc--the exceptions being those hardware that treat IPv6 in the slow-path. i.e., by trapping to the control CPU.

Again, nonsense. The sparse nature of IPv6 allocation means that it you need to inspect fewer bits in each packet to route it than with IPv4. Mobile IPv6 is an exception to this in some cases, but only if a host has moved a long way away from where it started without dropping connections (e.g. if you move from China to the UK overland keeping connections active).

Re:Don't say "NAT"

[jonbryce]

Would it be possible to assign space in the IPv6 block for all the existing IPv4 addresses and then require ISPs to do some trickery to re-route the requests?

Re:Don't say "NAT"

[amorsen]

Apple did. The Airport is the only sane IPv6 CPE for home use at this point. Other devices can be made to behave as well or better, but they need configuration.

Re:Don't say "NAT"

[mysidia]

Nope.

Unless you are allocated a block of /29 worth or more IP addresses, documenting the re-assignment is not required.

Also, the rules are different for accounting for residential ISP customers.

Instead of counting hosts, the number of ports, number of dial-up clients per city, and lists of URLs for websites are counted.

An underlying assumption behind that process is dial-up users are each assigned 1 IP address.

So 'allowing 5 IPs' to a DSL/dial-up user is a bit unusual

Re:Don't say "NAT"

[Dwonis]

Aunt Myrtle is irrelevant here. She's just going to drop a black box in between her computer and the Internet. That box will be designed by people with enough know-how to build a stateful firewall.

Seriously, NAT is effectively a huge tax on developing new Internet applications. Instead of just opening a connection to whatever node you want to talk to on the network, you have to implement complex protocols that provide no benefit other than their ability to work around NAT. The sooner we get rid of it, the better.

Re:Don't say "NAT"

[maxume]

Actually, all I was assuming was that the easiest way to get the current holders to give up any of their space was to let other people buy it from them, I have no idea if it would be a practical thing.

Re:Don't say "NAT"

[mysidia]

Probably nothing in reality, individual residential customers aren't actually assigned IPs.

IP addresses are assigned to Points of Presence in cities. Justification to ARIN is based on number of residential users dialing in to the POP.

When the ISP renumbers their dialup customers to use NAT, they will lose "dialup clients" as a justification for possessing all those IP addresses...

Technically, they're supposed to renumber at that point, and return IPs to ARIN that they can no longer justify.

The agreements (RSA) they sign state they can only use the IP addresses for the purpose they used to justify their allocation. So if the justification no longer exists, they must return them, and submit a new request, for their business customers.

In any case, after "taking all the IPs away" and NAT'ing everyone, they will no longer meet the utilization criteria required to (legally) apply for more IP addresses.

It would be to their disadvantage to do this, at least, prior to exhaustion.

Not only does it nick their ability to apply for new IPs, but it may hurt their residential ISP business, if they do this alone.

Many real-world internet applications, including games, chat apps, peer to peer, etc, rely on having public IP addresses.

Users of broadband routers at home, often find they need to forward ports, or use a UpNP-enabled router, that their software supports.

Re:Don't say "NAT"

[marcosdumay]

Yes, that is possible. We could require it after we require ISPs to support IPv6, and require that it is turned on on comercial OSs.

Since there is a tragedy of the commons here, why didn't government(s) step on the problem? Yeah, I know the answer, ICANN and everything, it is just that such kind of task is a classical government excuse to exist.

Re:Don't say "NAT"

[TheThiefMaster]

Nothing at all, which is why it's going to happen.

Re:Don't say "NAT"

[gbjbaanb]

I thought we already had all IPv4 addresses mapped in the IPv6 space, however the second part - getting ISPs to automatically transition the packets - is the one that needs to be done. Maybe Jupiter or Cisco can add some pre-configured routing to their firmwares and then, magically the internet problem would be solved (once the edge routers were upgraded), or am I just dreaming?

Re:Don't say "NAT"

[gbjbaanb]

I doubt that does enough - if they charged a greater fee for the scarce resource, and released IPv6 for free (and allowed re-assignment to end users, though I'm not sure that matters so much for home users) then we'd start to see ISPs thinking of supporting IPv6.

Businesses follow the money, 'tax' IPv4 and you'll see reduced usage.

Re:Don't say "NAT"

[wooferhound]

The army probably wants to eventually give each individual soldier their own address.

Re:Don't say "NAT"

[u38cg]

I currently have a static IP address, for no particularly good reason. If the relevant agencies got off their backsides and created a proper market in IPv4 addresses I could sell this static address to someone that actually needs it. I'd be better off, and so would he. And I think this is, eventually, what will happen, once it realy becoems clear that no-one wants IPv6 and that a different approach to solving the problem is required.

Re:Don't say "NAT"

[jackspenn]

Not to mention schools and universities that have so many public IPs, they are giving them out to wifi quests and computer lab PCs. If we recoup those wasted IPs (with NATed addresses, I know, it's a bad word on /.), but it would easily give us many many more years.

Re:Don't say "NAT"

[eudaemon]

You hit the nail on the head: there's no reason to do it altruistically. On the other hand
if there was a tax writeoff involved I'm sure you'd see plenty of action.

Or if government decided to start reclaiming this space as abandoned property like
they are trying to do with unused calling card minutes. Either one would work. :-)

Personally I'd love to go IPV6 - my ISP doesn't support it natively. Yes I do route
and firewall (not nat) IPv6 to my internal machines that support V6 but so what?
It is tunneled and I pay a performance penalty to do so - you won't see me making
it the default any time soon.

Re:Don't say "NAT"

[asdfghjklqwertyuiop]

Then you can't set up a firewall correctly with NAT, either. The actual packet filtering conceptually works exactly the same with or without NAT.

Re:Don't say "NAT"

[sopssa]

You think normal people are going to ask if their phone supports IPv6 when they're buying it? And why should had the GP anyway, since IPv4 still works just fine?

Re:Don't say "NAT"

[Just Some Guy]

And - let's face it - neither can most of /.'s users. I remember setting up an OpenBSD firewall back in the late 90s, and I did most of my firewall rules configuration by copying someone else's rules.

If you can write a shell script, you can write a good, stateful firewall with OpenBSD. Its "pf.conf" has the cleanest, most straightforward syntax I've ever seen for such things. I struggled for weeks setting up a good firewall with FreeBSD's ipfw back in the day, but my non-network-admin coworkers have no trouble hacking around in OpenBSD's config.

Re:Don't say "NAT"

[Rich0]

Good luck with that - you'll be out of IP space before you get anybody to approve that policy, and you're likely to see the US government take over the IP space before that happens just to squash it. All that to buy 18 months, assuming space utilization doesn't continue to grow? You're going to destroy any political capital you have just to apply a band-aid.

If you want to fix the problem you don't start out by taking 10-20 large organizations (ie 50k+ employees in each of them) and getting them to completely oppose your efforts.

Re:Don't say "NAT"

[Yaztromo]

Apple did. The Airport is the only sane IPv6 CPE for home use at this point. Other devices can be made to behave as well or better, but they need configuration.

Ding! You win the prize!

It can be done exactly as easily, exactly in the same way as current consumer oriented routers do it, but without the NAT part. No net effect on security for Aunt Myrtle. Apple proves it pretty well (I run a set of Airport Extreme/Express units at home myself, with IPv6 tunnelling automatically configured for all clients that support it).

Yaz.

Re:Don't say "NAT"

[Agripa]

You do not have to wait. There are multiple ways at this point to get a full /48 or /64 IPv6 connection through tunneling over an existing IPv4 connection.

Re:Don't say "NAT"

[Z00L00K]

That was what I didn't want to do - I want the ISP to go full in with IPv6.

Re:Don't say "NAT"

[swillden]

That doesn't surprise me. However, I suspect that the ISPs who do NAT do it primarily to conserve address space, rather than so that they can force their customers to pay a premium for the privilege of being a producer, as asserted by shentino.

Re:Don't say "NAT"

[swillden]

You can. I can. Aunt Myrtle can't.

Can Aunt Myrtle install a NATing router connected to her cable modem? If so, then she can install a non-NATing router in exactly the same way that provides exactly the same firewall, just without the NAT.

Re:Don't say "NAT"

[swillden]

It doesn't obscure the network very well, though. There are a couple of papers on techniques for identifying the hosts and relationships of hosts behind NAT. Assuming the hosts make regular connections to the outside world, the information that can be gathered is pretty complete.

Also, you could get very similar effects with v6 by doing translation of the bottom 64 bits. Indeed, it's often recommended that hosts do this themselves: choose a different, random, value for the bottom 64 bits of each network request. That approach doesn't suffer from all of the limitations of NAT.

Re:Don't say "NAT"

[demonlapin]

Lots of us don't work in IT, although the point is well taken.

Re:Don't say "NAT"

[demonlapin]

And that's why I use Tomato - so that I use a base set of rules written by someone who knows what they're doing.

The actual packet filtering conceptually works exactly the same with or without NAT

Conceptually, you're entirely correct. Practically, NAT requires state awareness, and so it's a lot better than nothing.

Re:Don't say "NAT"

[asdfghjklqwertyuiop]

Practically, NAT requires state awareness, and so it's a lot better than nothing.

Actually, both conceptually and in reality, you can have a router which NATs outbound connections yet still allows any kind of inbound connections. Just using NAT's state tracking doesn't mean anything gets dropped. I think you can set up a linux machine to prove that like this (assuming everything in its default state):

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -o $EXTIF -j MASQUERADE

Re:Don't say "NAT"

[ICLKennyG]

It's all about finding the point at which moving to IPv6 makes sense. Why would anyone develop commercially for IPv6 right now. There is no reason to, virtually nothing supports it. It creates a critical mass problem in that no one wants to make things for IP6 so no one uses IP6 because no one makes... It will take a government or similar authoritative body to mandate a change over. Otherwise, prepare to have this debate again in 2020, 2030 and so on.

Also it might be worth sticking in an editorial comment in the front page mentioning the dozens of companies with /8 blocks that don't need them (or deserve them).

Re:Don't say "NAT"

[demonlapin]

True, except that most people use reserved IP blocks for their private network - so where does it forward the port? A packet addressed to a private IP range *should* have been dropped at the ISP level.

Now, having tried to devil's advocate every one of your positions, I do have to thank you for pointing out that the features we see in consumer NAT devices don't have any necessary connection to one another.

Re:Don't say "NAT"

[Agripa]

I have had IPv6 through tunneling for a couple of years now without problems. Except that the MTU size is smaller, I would never notice the difference.

Re:Don't say "NAT"

[IICV]

You know what Aunt Myrtle can do though? She can plug that nice blinky box the telephone company gave her between her computer(s) and the wall. She doesn't care if it's a DSL modem with a built-in NAT router, or a DSL modem with a built in firewall. And either one will work exactly the same, from her perspective.

Re:Don't say "NAT"

[hardwarefreak]

You can't take an entity the size of (for example) IBM and have them compress their address use into a /12 to free up 240 new /24's without it being a very significant cost in terms of effort and downtime -- particularly when they have absolutely no incentive to do so. Nobody in their right mind would spend the necessary amount of money to make it worth their time and effort, when they can get millions of addresses in IPv6 for next to nothing.

You state that transition costs are the reason for these companies to avoid reorganizing their IPv4 space and giving back what they don't need. Then you state the cost of transitioning to IPv6 as "next to nothing".

You didn't even realize you killed your own argument. Reorganizing IPv4 is peanuts compared to rolling out IPv6. The cost ratio is at least 10:1 in favor of sticking with IPv4 and reorganizing device numbering to free up space. All your devices already support IPv4. To transition to IPv6 not only incurs more labor costs (due to learning curve), it also requires substantial investment in new devices. How many network printers over 5 years old, that still have 10 years of good life in them, have an IPv6 enabled NIC inside? Very few to none. So, in IBM's case, they'd have to replace the NICs in around 20-30,000 network printers. How about ethernet security cameras? Again, none of the installed base of these devices supports IPv6. The list goes on and on.

The entities mentioned above holding the /8s will be the *VERY LAST* orgs to move to IPv6, for the exact same reason they aren't reorganizing their networks to free up IPV4 space. *Too damn many man/hours/dollars involved in any such conversion*

Re:Don't say "NAT"

[jbgeek]

IMHO, nothing significant is going to happen until some real pain starts to be experienced as IPv4 addresses near exhaustion. When the cost of IPv4 blocks starts going way up, or they simply become unavailable to businesses hosting servers, or when end users get put behind CGN devices via things like DS-Lite and NAT64/DNS64 because of lack of public IPv4s, then I think we'll really see IPv6 kick into high gear as far as deployment/adoption.

I get my IPv6 connectivity via a tunnel. My ISP doesn't offer it, and when I asked, doesn't have any plans to offer it. Even to static IP customers like myself.

Re:Don't say "NAT"

[christopher94523]

Can we start the discussion by not immediately going to the "NAT will save us" argument? Just accept that while NAT deployments might put it off, IPv6 deployment is inevitably necessary. by Anonymous Cowardon Sunday January 03, @07:07PM (#30635740) I understand that many breat questions exist, but that many basic ones are hidden. I was delted from the economy and now have no affect on the decisions that others may think they have. My pre-GUI and pre-WWW knowledge has been avoided esp when the rule of the internet is now determined (and it ain't the users!). Could you explain NAT as a resolve? I must say, that after completing my "computer science" degree in 1983, that i see less-and-less ""science" and more business, especially 'monopolization' "business as a dumbified replacement. Why do today's "resolutions" always feel like they were figured out BEFORE their 'problem requiring resolve' was? It's as if the Rothschild 'play both sides of a war' and 'create that war' is the only "science" that exists. Oh, and of course, there is the "science" of "the choiceless choice".... Idiotology is the 'brain-power' that is schooled in lieu of "science". Whenever ANY government agency now resolves, it is as FOR MONOPOLY and subjugation. In any "standards" committee decsion these daze, where the committee is tacked by commercial interests, I smell the smoke of a coming "Reichstag fire" as some protocol, standard, or enforcement body rationing-away "unapproved" communication? The loss of computer science programming languages, human languages, and rights to having other than the "politically correct" view of anything, exposes the Orwellian inversion of reality. In other words, why wouldn't the current puppet government use "the need for" some "internet upheaval", or an "attack" by its NSA operatives at Microsoft/Google/Yahoo/Cisco as an excuse for shutting it down for a tighter/less-polite State-corporate-banking-military-security consolidation? Who is going to argue? The "Open Source" pseudo-community acquiesced with CSS to Microsoft and MySQL to Oracle. Why not life in general? So well practiced.... After all, we all have proved that we really have very little talent at much other but taking our daily order of "sell your life", as in Wilhelm Reich's "The Mass Psychology of Fascism" and Theodor W. Adorno's "The Authoritarian Personality". We may dream, but we cringe at realizing dreams beyond a merely-dysfunctionalized reality. Ideologizing via idiot "left" and "right" spewages and falsified "freedom" as droned from the common master's mouth seems to be beyond our vision. We are truly "good citizens". So, in that sense, will we choose between which Tweedledee-Tweedledum "choice"? Will NAT/ipv6 just be a choice of the surveilled and blocked and filtered and censored "access" we shall have? What humanity! What marvel! What rites! Of course, I hope otherwise. I hope that calls for "plugging holes" and "expanding possibilities" are NOT just disguised complicity and compliance. best, chris

Re:Don't say "NAT"

[sjames]

If people hadn't wasted the last 10 years or so blowing off the transition by saying "we'll just use NAT to postpone the problem", then you would be right. However, at this point, the NAT option NEEDS to be considered dead and gone so we don't have those same people singing the same old song of procrastination a year and a half from now.

We're all done mitigating, it's time to FIX the problem.

Re:Don't say "NAT"

[Meski]

Get *rid* of them? Some of us work for those companies, you insensitive clod!

How many more times are we going to run out?

[toxygen01]

This is zillionth news article I read about running of ipv4 addresses, first in 2000, then 2004, 2006, 2007, 2009, 2014... what next?
some corporations are given /8 subnets, they clearly don't take use of all of it, so it's not a problem to cut piece of cake from those ip ranges.

i'm pretty sure, if we are in trouble, we can find "few" millions of unused ip's...

http://imgs.xkcd.com/comics/map_of_the_internet.jpg

Re:How many more times are we going to run out?

[Burdell]

RTFS and do the math. 203 million addresses were allocated in 2009; a /8 is 16.7 million addresses; reclaiming a /8 (which would probably take a lot of time and effort, possibly in court) would put off the IPv4 depletion by about one month. It isn't worth the effort; better to put it into IPv6.

Re:How many more times are we going to run out?

[Chang]

We are consuming a little more than a /8 every month and if every single /8 was reclaimed from a corporation that was assigned prior to 1995 how much extra time would that buy us?

How many years and millions would be spent getting them to renumber or forcing them to renumber through some sort of legal process?

How long is it going to take to transition to IPv6 - probably 10 years or more.

Where is the time and money better spent?

Re:How many more times are we going to run out?

[sopssa]

As long as they don't take away 69.69.69.69 from it's owner:

$ host 69.69.69.69
69.69.69.69.in-addr.arpa domain name pointer the-coolest-ip-on-the-net.com.

Re:How many more times are we going to run out?

[Dunbal]

Look at it this way - the year we run out of IPv4 addresses is the same year that linux will be the desktop OS of choice - because Duke Nukem Forever will only be available on linux.

Re:How many more times are we going to run out?

[Teancum]

How long is it going to take to transition to IPv6 - probably 10 years or more.

Where is the time and money better spent?

The transition to IPv6 should have been 10 years ago. It is that old of a concept. That it might take 10 more years is essentially saying it will never happen.

I agree that IPv6 is the way to go, and it astounds me that there are folks even willing to issue IPv4 address blocks. If the harsh reality comes down that no new IP addresses are going to be allocated, folks will be much more prone to a solution like IPv6.

I remember nearly two decades ago that a discussion came up at the university that I attended (which had a /16 address block... or old "Class B" for those in the know) started to go through having to justify all 65k IP addresses that they had and how they were going to be used in the future. Quite literally, every PC in every department plus ones for all of the students were allocated to "justify" keeping the full block. The situation hasn't really changed there either, and that university is quite jealous at keeping its IP block too.

What is funny, however, is folks allocating IPv6 are even more stingy at allocating IP addresses than those involved with IPv4 ever were.

Re:How many more times are we going to run out?

[peragrin]

Well the difference is now the vast majority of computer support IPV 6 with minor updates(even windows XP but that is the one that needs the updates)

what is lacking is the networking gear itself. though i am not sure how much of that is IPV 6 ready and just not switched on.

Re:How many more times are we going to run out?

[s0litaire]

it may be the coolest but 6.6.6.69 is the weird one...
6.6.6.69.in-addr.arpa. ns03.army.mil.
DOMAIN-REQUEST.AIMS7.army.mil.

Yes! The US army is 69'ing the Devil! ^_^

Re:How many more times are we going to run out?

[mysidia]

so it's not a problem to cut piece of cake from those ip ranges.

Yeah it is a problem; addresses can't be taken from them at all.

They have been allocated those ranges, and they were granted under the authority of the US DoD itself.

I don't think any of the /8 holders have said anything on the subject @ the ARIN-PPML.

But a lot of holders of one legacy /24 are extremely vocal on the subject, and claim since they were granted under authority of US DoD, by IANA at the time, without any terms, only the US DoD itself, none of the current registries can force them to obey current rules (including utilization rules) or return addresses, without violating laws.

Make no mistake, IP addresses from these allocations cannot be recovered by force.

Maybe with a 10-year legal battle. By the time the legacy holders stopped fighting, V4 would be exhausted anyways.

Re:How many more times are we going to run out?

[TheRaven64]

This is one thing that Vista did almost right. Vista machines advertise themselves as 6to4 routers. Any other v6 devices on the network will talk to the Vista machine and it will then encapsulate the v6 packets in v4 and push them to other 6to4 routers for transmission to v6 hosts. Your v4 router doesn't need to be updated at all. There are a few problems with this, however:

• Vista machines advertised themselves as 6to4 routers even when they couldn't actually send v6 packets (not sure if this was fixed in later versions).
• Encapsulation is slower than sending directly, but as it's only a temporary measure that's less of a problem.
• 6to4 has some security implications (it's relatively easy to spoof a packet from one 6to4 address if the target is also a 6to4 address).
• It bypasses all of your v4 firewall rules.

Re:How many more times are we going to run out?

[itsthebin]

of course you can - just start routing those blocks somewhere else

these american squatters can howl all they want , but the rest of the world does not have to route those blocks to them.

Re:How many more times are we going to run out?

[mysidia]

of course you can - just start routing those blocks somewhere else

Are you prepared to have an army of lawyers protecting your tail, when HP or Xerox sues you, for announcing or allocating their address space?

They will probably get a really big document called an court order against you, and probably police after you, the moment they determine you do that intentionally.

Not to mention, they have enough clout with the Tier 1s, to get your "rogue advertisements" blocked.

They can probably do this, regardless of what any current registry says. Unless there is government action on the matter, these /8 holders cannot be forced to make those IPs usable by anyone else.

No, that's propaganda

[Anonymous Coward]

We'll never run out of IPv4 addresses. "Peak-IPv4" is a myth created by those who hate America and want Asia's IPv6 to take over. 4 octets forever!

Re:No, that's propaganda

[Tablizer]

It's a liberal myth created by Nazi Corporist Jews to take over the IP world and land a fake man on the moon while shooting JFK wearing an Elvis mask from a black helicopter with "UFO" painted on the side just before crashing into the twin towers.

Re:No, that's propaganda

[Zocalo]

I know you are joking, but there is a very good reason why Asia is so keen on IPv6 adoption; they are going to feel the crunch first and they know it. IANA has in place an agreement that as soon as one of the RIRs is assigned one of the five final /8s each of the other four RIRs receives one of the remaining /8s and IANA washes their hands of the whole mess. That's without a doubt the most critical milestone along the path to IPv4 exhaustion, so let's look at that instant from the point of each of the RIRs:

• AfriNIC: Incredibly slow burn rate. They're probably still good for another decade or two at this point.
• APNIC: Includes China and India, two of the fastest developing nations on the planet with correspondingly high IPv4 assignment requests. There's no two ways about it; without wholesale IPv6 adoption, they're going to be the ones running out first.
• ARIN: Capitalists to the end, they are on record as saying IPv4 exhaustion is not their problem to solve; it's first come first served and when they are all gone that's it. Even so, there are plenty of US institutions with /8s that could mostly be handed back and reassigned if push came to shove.
• LACNIC: Not quite as low AfriNIC due to developing countries like Brazil, but are still able to sit back and let any problems with IPv6 get resolved before they make the leap.
• RIPE: Have already got the strictest IP assignment policies of the RIRs and will probably just continue to tighten the screw right up until the point of exhaustion; LIR assignment windows are typically about one quarter of what they would have been five years ago. It's a pretty fair bet that APNIC and ARIN will both beat them to the wall.

Re:No, that's propaganda

[Midnight Thunder]

At this rate until North America finally decides to gets on board IPv6, there will be the great wall of North America. That is while everyone else in the world is already using IPv6, North America will still be claiming that there is no IPv4 exhaustion issue, only to finally realise why they could no longer ping non North America servers. Its a rather cynical point of view, but based on what I am seeing we could find ourselves to some degree in that scenario.

Re:No, that's propaganda

[Nocterro]

IANA has in place an agreement

Is anyone else's brain tripping on this as badly as mine? I Am Not A "Has in place an agreement"? What the hell is a "has in place an agreement", and why would your lack of being one make you unqualified?

Stupid memes, acronyms.

Re:No, that's propaganda

[petermgreen]

Things don't seem much better on this side of the pond (personal experiance of UK and info picked up from friends in continental europe), most ISPs still don't offer ipv6 and those who do generally offer it through tunnels and don't make it obvious. Further most home routers don't support ipv6 either.

IMO things are already too late for IPV6 to be widely deployed before IPV4 addresses run-out*. When that happens I predict the next move will be for ISPs to claw back addresses from home users and bottom end hosting customers to allocate to more lucrative uses.

ISPs who have always had their low end customers natted and those who only do higher end stuff are likely to be SOL. Maybe they will become the ones who will drive ipv6 forward.

*That is normal allocations are no longer available from the rirs. Arin have chosen to keep some addresses back for special uses and other rirs may do the same and of course reallocations of addresses will happen either officiall or unofficially.

::1

[sakdoctor]

I've already got MY ipv6 address.

Re:::1

[negRo_slim]

Which is great if users are able to connect to said address.

Re:::1

[furball]

You can't reach loopback?

Re:::1

[OrangeTide]

I already got my IPv4 address. (a couple in fact)

The rest of the people who haven't found the interent and setup a website yet will just have to hold off on those plans until IPv6 is widely deployed (like at my ISP for one)

Re:::1

[Kjella]

If all you need to reach is loopback, there are many better options than using a network socket...

Let me be the first to say ...

[GNUALMAFUERTE]

4 octets should be enough for everyone.

I'll believe it when I see it

[haus]

It has not yet become a big enough of a problem for the large sections of unused address by universities such as MIT and Harvard to be recalled.

Re:I'll believe it when I see it

[Alrua]

It has not yet become a big enough of a problem for the large sections of unused address by universities such as MIT and Harvard to be recalled.

Well actually, from TFA:

There is an old story that Stanford University supposedly has more IPv4 addresses than the entire country of China. At the beginning of the decade, this was true: Stanford had the entire 36.0.0.0/8 class A block, more than twice the less-than 8 million addresses that were given out in China at the time. Times have changed, however. Last year, China passed Japan and took the number-two spot behind the US. This year, organizations in China obtained another 50.67 million addresses for a total of 232 million. And Stanford is one of the very few organizations that has returned a class A block.

Re:I'll believe it when I see it

[Blakey Rat]

But I love reading this story over and over again about every 2 years. It'll happen any day now!! We pinky-swear!

Re:I'll believe it when I see it

[swillden]

It has not yet become a big enough of a problem for the large sections of unused address by universities such as MIT and Harvard to be recalled.

At over 200 million new addresses needed per year, returning all of those class As wouldn't buy more than 2-3 years.

Re:I'll believe it when I see it

[fm6]

Do you think the current owners are hanging onto their address spaces out of pure spite? If they rely on the Internet to do business, this crisis hurts them more than anybody.

This mess happened because of the simplistic addressing schemes that were implemented without taking into account the explosive growth of the Internet. One result is that that some early adopters ended up with Class A networks (16 million addresses) because they needed more than the 64 thousand addresses in a Class B network. Only one Class A space belongs to a university (MIT). (There used to be two, but Stanford gave its IP space back.) Other owners include Halliburton, Apple, IBM, and Xerox PARC. HP has two, counting the one that was originally issued to DEC. DoD has eight.

Reassigning all these addresses would be a logistical nightmare, because you're changing the basic logic of network routing. Imagine all the routers that would have to be reprogrammed or replaced, and the expensive down time that would result. Much more cost effective to just go to IPv6 already. Plus there are other features of IPv6 we really, really need.

Except that nobody's doing it. I used to work at Sun, where I kept suggesting that our embedded lights-out management system (all Sun servers have them) start supporting IPv6. The answer I always got was, "customers aren't asking for it." Which means that everybody is putting off this problem until the last minute. As usual.

Re:I'll believe it when I see it

[Jonner]

The difficulty being discussed is not related to DNS, but to IP routing, a lower level function.

Re:I'll believe it when I see it

[JWSmythe]

    If I remember right, it's been less than a year since the last "the IP sky is falling" story here. Even then, we were numbered in months, not years. I know the deadline was in 2009. :) I have a lot of faith in it's failure though. It'll fall apart, and we're going to all die, or at least not be able to twitter quite as much. :)

Re:I'll believe it when I see it

[schon]

At over 200 million new addresses needed per year, returning all of those class As wouldn't buy more than 2-3 years.

That's great then - everyone knows that the world is gonna end in 2012, so it's not a problem!

Re:I'll believe it when I see it

[Anonymous Coward]

Well, where I live it's impossible to get a fixed IPv4 address for a reasonable fee. So yes I certainly believe it - for all practical purposes addresses have already run out. Arguing about recalling addresses previously handed out sort of circles around the main problem, namely that there are so few addresses that they are a scarce resource. Even if only half the addresses or so would be actually assigned, that would probably still impose a monetary value on something which could be free, were it not for the fact that we're only using four bytes and doing so for no good reason at that.

Re:I'll believe it when I see it

[fm6]

Anything can be done, if you have enough money. The question is, where does the money come from?

Re:I'll believe it when I see it

[Bigjeff5]

We will eventually run out of IPv4 addresses, that's for certain, but for heaven's sake we've still got about a fifth to a quarter of them left, and we haven't even put on the heavy squeeze to get the ones just hanging out there.

When IP addresses start selling for $4-5 each in retail land, instead of $1-2 like now, then you'll start seeing ClassA owners more willing to sell back their IP addresses at $1-2 each. When the buy-back price eventually gets into the $3-4 range, well then you'll start to see major projects to give up ClassA blocks. When a company can make $50-60 million on that sale, and cost them $5-10 million to do the conversion, they'll bite and free up more addresses.

It won't be until IPv4 addresses start actually running out (not pretend running out, like they are now, but really pushing the limits of useability) that IPv6 will start being sold on large scales. Once that starts to happen things will start to cascade, and eventually IPv6 will be everywhere.

Re:I'll believe it when I see it

[hitmark]

the explosive growth took every ceo or pundit in the tech sector with their pants down.

hell, win95 shipped originally without a web browser.

Re:I'll believe it when I see it

[JWSmythe]

    I'm really surprised that I haven't seen more ISP's NAT their networks. I think it was Nextel's original wireless network card, that always issued me a 10.0.0.0/8 IP. Home users don't generally need a static IP. I know, in this crowd we like them, but for the other 99% of the users, they'd be fine NATed. And for those who think that's nuts, yes you can have a NAT behind a NAT, without breaking anything. As an example, I ran 3 devices in a hotel room for a while. They'd only let me have 1 NAT IP, so I ran my own NAT behind it. :) I was working out of town, so I had a desktop, laptop, and my Vonage box. Everything worked fine.

    What would happen to the available pool, if every residential provider did this, and only provided a public IP upon request?

    I don't think any company I've worked for was charged for their IP's. Most got /24's with no charge. A friend got a /25 on a business FiOS line, and that did cost. We could have gotten a /24, but it wasn't necessary for that setup.

Re:I'll believe it when I see it

[mini me]

My DSL ISP does. Their DHCP server hands out a NATted address so users will get a private IP by default. If you need a public IP, you can fire up a PPPoE session.

Re:I'll believe it when I see it

[tftp]

you'll start seeing ClassA owners more willing to sell back their IP addresses at $1-2 each

A /8 block contains 16 million IPs. So at $2 per IP it will net about $30M. This is not a large sum for a major company like HP - especially considering that the IT will quote renumbering of all internal hosts at half of that. Add business risks connected with this renumbering, and note that you still need a good number of IP addresses for your hosts anyway.

All in all, it probably isn't worth it for a large corporation. The project offers tangible risk but very little reward. Specifically, IT managers will be carrying the risk, while the VPs will be getting rewards. So it's not going to happen - lower level managers (the risk bearers) will make sure of that.

Re:I'll believe it when I see it

[mikael_j]

...but for the other 99% of the users, they'd be fine NATed.

Actually, there are a lot of users who would be at least annoyed (although their annoyance may very well end up being directed at someone other than their ISP). A few examples of things which really require end-to-end connectivity to work PROPERLY (emphasis to avoid "it can work if you jump through 2^2987 hoops and sacrifice a bucket of chicken blood to Cthulhu" comments) are p2p applications (duh!) and games (which are Big Business(tm) these days). That said, I fully expect ISPs to attempt passing blame to others and trying to paint an image of "teh intarwebz" as just another cable tv network and those (companies/developers) trying to use end-to-end capabilities as evil anarcho-commie-mooslim scum out to destroy america. But hey, it's alright because new routers cost money and these switches we bought in 2002 still work, no point in messing with the quarterly profits just to make sure our products actually work, right?

/Mikael

Re:I'll believe it when I see it

[dkf]

the explosive growth took every ceo or pundit in the tech sector with their pants down.

hell, win95 shipped originally without a web browser.

Win3.1 shipped completely without networking. And boy, do I remember the nasty third-party implementations that everyone used.

Re:I'll believe it when I see it

[JWSmythe]

    I don't quite see what you're saying.

    I use P2P applications like file sharing, and multiplayer games through a NAT. Heck, most users do the same. When just about any provider puts in cable or FiOS, their "router" provides NAT, and you don't have to log into the router and provide port forwarding, nor move your machine to the DMZ.

    One of the things that won't work would be direct connections for desktop sharing. That is easily mitigated with a public reflector. I use my own, so my server (in a datacenter) handles requests from both the client being viewed, and my admin client. There are pay services that do the same thing, like GoToMyPC. They don't care if there is a NAT on either end (or both ends).

    Much like the need for passive mode FTP, it's been corrected over the years, and now just works out of the box.

Re:I'll believe it when I see it

[mikael_j]

Creating a workaround for every higher level protocol out there is not a solution, it's a bunch of ugly hacks no matter how much you keep repeating "it works for me! not a problem! NANANANANABINGOBINGOBINGOICANTHEARYOU!"...

/Mikael

Re:I'll believe it when I see it

[mikael_j]

Also, as for your "but I use $FOO through NAT" comment, that's YOUR NAT, not your ISP's, I've been stuck behind an ISP NAT (crazy policy making on a university network meant some student apartments were behind a NAT, had lots of "fun" trying to get stuff working through that).

/Mikael

Re:I'll believe it when I see it

[JWSmythe]

    For all the noise you're making, everyone knows you're happily tucked away behind a NAT at your house, and all of your applications are working fine.

Re:I'll believe it when I see it

[JWSmythe]

    That's more of an exception rather than a rule. I'd guess that your school not only NATed you, but also blocked specific ports and/or other content filtering, so you *couldn't* do what you are complaining about. This isn't unique to a NAT environment at a school. It's made enough recent news, where providers have been speed limiting or blocking bittorrent. I've seen the same happen for SMTP on some providers, both ISP and location (like hotels), or even HTTP, where they force you through their proxy that doesn't always behave properly. Proxy and redirected services based on ports are not equal to NAT.

Re:I'll believe it when I see it

[mikael_j]

All they did was set up a NAT that (obviously) disallowed all incoming connections, this was enough to cause lots and lots of problems with all sorts of apps.

/Mikael

Re:I'll believe it when I see it

[mikael_j]

Well, the reason I'm using NAT is because I'm forced to do so (I do have an IPv6 tunnel and a /48 but they're only usable internally or when I'm in the rare place that actually has IPv6 connectivity).

As for my apps working it is true that they mostly do but most of the time you have to configure the apps a bit extra due to NAT plus the actual NAT setup to make sure that end-to-end connectivity works for the most important ports.

/Mikael

Re:I'll believe it when I see it

[fm6]

And with software for MSN, which was supposed to be Microsoft's AOL killer. But the web had already rendered the "online service" concept obsolete.

Microsoft had anticipated the growth of the Internet just fine. Their mistake was believing that the web was just a passing fad.

Re:I'll believe it when I see it

[mjwalshe]

fm6 classfull routing hasnt been used for years reusing a /8 is not a major problem

Ah but...!

[Wowsers]

Ah but nobody will take away the IPv4 address I got myself, 127.0.0.1 !

Re:Ah but...!

[hedwards]

Ha ha, I'm pwning it as we spe

Re:Ah but...!

[sconeu]

Hey! That's MY IP address, you insensitive clod!

Re:Ah but...!

[t0y]

It's a /8... The address fairy will soon revoke it from you.

Re:Ah but...!

[Teancum]

I was more worried about my own private /8 block:

10.0.0.0

Of course I could still settle with simply

192.168.0.0

I've used both plenty of times.

I am curious.... how did you know the address to my web server?

Re:Ah but...!

[trapnest]

I prefer mine, 172.16.0.7

Bono should be pleased...

[fuzzyfuzzyfungus]

Anybody not paying for a business line will being going through so many layers of NAT in the near future that getting bittorrent to work will be quite difficult...

Re:Bono should be pleased...

[klapaucjusz]

BitTorrent is already running over IPv6. Anyone running Torrent on a recent enough version of Windows automatically uses IPv6 to cross NAT boxes using a technology known as Teredo.

The Free Software world is late with IPv6 adoption. In the words of one of the Torrent developers (Greg), "platforms which are not Windows [...] need to get their collective Teredo asses in gear."

Re:Bono should be pleased...

[klapaucjusz]

That should read "muTorrent", both times. The Greek letter didn't get through, for some reason.

Re:Bono should be pleased...

[aXis100]

Nah, they'll just switch to hole punching to get through the NAT, just like Skype.

Re:Bono should be pleased...

[shentino]

Great, so NAT not only gives your consumer customers shitty service and winnows out the biggies willing to pay big bucks for static IPs, but it also has the neat side effect of wrecking p2p applications that often attract the attention of the big bad MAFIAA.

What isp would not love NAT?

Re:Bono should be pleased...

[klapaucjusz]

Just because there isn't a good implementation of Teredo doesn't mean free software is late with IPv6 adoption.

There's an excellent implementation of Teredo for free Unices.

However, I don't know of a single Linux or BSD distribution that enables Teredo by default, or at least makes it easily accessible to the user, unlike Windows, where Teredo is enabled as soon as an application attempts to connect to an IPv6 address.

patches are welcome more then complaining.

Please try a web search for my name (not my Slashdot nick!) and IPv6.

Re:Bono should be pleased...

[hughperkins]

In China, I have home internet, through ADSL, and we each have *external* ip addresses! Basically, we connect to the wifi point using wifi, and then use ppp over ethernet to connect to the isp's modem, and get an external address.

Pretty nice...

Re:Bono should be pleased...

[Agripa]

However, I don't know of a single Linux or BSD distribution that enables Teredo by default, or at least makes it easily accessible to the user, unlike Windows, where Teredo is enabled as soon as an application attempts to connect to an IPv6 address.

Teredo has the advantage of working through NAT without any configuration but most people running Linux or BSD are sophisticated enough to use Protocol 41 for tunneling IPv6 directly over IPv4. It can work though NAT but the router has to be configured to forward protocol 41 to the correct machine and a lot of cheap consumer routers won't. The various BSD or Linux based router packages like pfsense or m0n0wall work great in for this and the later has full support anyway.

In other news

[Cmdr-Absurd]

Commercial fusion power will be a reality in 20 years.

We've been hearing this for a while

[badger.foo]

We've been hearing this for quite a while, and for some odd reason IPv6 isn't really entering the mainstream regardless of these warnings.

We should not forget that within IPv4 space, reallocations do happen. Some organizations are AFAIK still sitting on routeable /8s for no good reason whatsoever, and possibly, maybe, some of that space will be redistributed one way or the other. Then of course those parts of the world that have actually switched to IPv6 are not likely to switch back (but you'd have to pry their 4to6 and 6to4 gateways from their dead, cold fingers), and actuall large segments of the Western world lives quite comfortably (fsvo) behind one or more layers of NAT.

So are we actually that close to running out?

Could be. It could also be that reallocations happen in IPv4 space that make the matter a little less urgent for just long enough that IPv6 wins the hearts and minds of the resisters or their objections are in fact addressed.

Re:We've been hearing this for a while

[Tablizer]

If there is a small fee levied for each IP address block loaned out, then the unused ones may start appearing back on the market.

Re:We've been hearing this for a while

[shentino]

I agree, except that the corporation with the heaviest pockets might not necessarily be the one with the best interests of the internet community in mind.

Then again, maybe the "internet community" excludes peon customers like you and I.

Re:We've been hearing this for a while

[mlts]

In companies I worked at, there is a fear of IPv6 even though most modern devices support it. They weathered the packet storms and glitches of land, teardrop, SYN flooding, fake ICMP resets, smurf, ping of death, and so on with IPv4.

Now, the PHBs I've encountered are worried stiff about the same bugaboos once the Pandora's Box of IPV6 comes from the edge into the core fabric. Some places may end up using IPv6 edge routing with hardened routers, but then use IPV4 and NAT so they can keep their internal machines (especially the older boxes which have no IPV6 support) going. It is a kludge, because the beauty of IPv6 is being able to have such a large address space. However, it might be the best in between technology.

Re:We've been hearing this for a while

[Midnight Thunder]

We've been hearing this for quite a while, and for some odd reason IPv6 isn't really entering the mainstream regardless of these warnings.

I blame this on the "last mover" attitude, where companies won't do something until they see the competition doing something. For the average user it won't happen until the ISPs or companies get themselves in gear and for a majority of these it won't be until the backbone is IPv6 enabled - in other words they won't do it until it is convenient. It takes a company interesting in leading the pack to do something before we see everyone scrambling to make up for lost time.

I am using 6to4 on my Apple Airport Extreme and all of the time I find myself connecting to gateways in Europe, even though I am in Canada.

Re:We've been hearing this for a while

[Tablizer]

There'd be little financial incentive to just sit on them.

No real scarcity yet

[bizitch]

I just helped out a friend who lives in a remote rural section outside of Chicago. I tried for years and years to get her lit up on decent broadband service.

Finally, we got a relay from a WiMAX provider --

When I went to connect her broadband with a Cisco router - I discovered that she was assigned a FRIGGIN /27 of public numbers!! (i.e. she now personally burns 32 usefull IPV4's)

I was gonna call their support ... but why bother?

You never know if she's gonna need 30+ public ip numbers right? Just because she lives alone - she may get many friends real soon!

Re:No real scarcity yet

[Lord Byron II]

I take it she's on Clear?

How does she like it?

Bandwidth up and down? Ping times? Reliability?

I've been looking to break free from the AT&T and Comcast duopoly and Clear's Wimax sounds just about right.

Re:No real scarcity yet

[sopssa]

Yep, that just tells that all of this "we are running out of ip addresses!" is just nonsense still, especially if ISP's are able to give 32 public ip's to a single home customer.

Re:No real scarcity yet

[Jonner]

I've never gotten more than on public address from any ISP for a residential account, whether dialup, DSL or cable. Have you? I think that's a pretty rare situation.

Re:No real scarcity yet

[sopssa]

My ISP gives 5 public ip's, but I know some give even more (like in GP's case too)

Re:No real scarcity yet

[LBArrettAnderson]

And 5 usable IPs likely means that they are allocating 8 for you. 1 for a gateway, 1 for the network address, and 1 broadcast IP.

Re:No real scarcity yet

[wagnerrp]

I realize I am by far an extreme case, but in a house of four, I run one server, two mythtv frontends, one networked tuner, one networked POTS ATA, one game console, three WiFi access points, one networked printer, one networked RAID card, three desktops, four laptops, three internet capable phones, and a handful of other old machines that I occasionally bring online for various uses. That's 21 devices which could be using their own IP. Throw in half a dozen applications I'm running on the server which each have their own IP as well, and I would nearly fill that /27.

Now sure, a number of those devices shouldn't have internet access, and I can run NAT like a normal person with a consumer router, but I would love to not have to. Meanwhile, VOIP services, networked consoles, NAS boxes, networked media players, and even networking in bluray players and TVs means the number of addresses used per-person is going to skyrocket in the next few years. This is exactly what IPv6 is supposed to allow.

Re:No real scarcity yet

[Bigjeff5]

I have Clear, and for the price in my area it can't be beat. My area pretty much sucks for price and performance though.

In my area you can get upwards of 2mbps, which is obviously not much, but it has the benefit of being portable within the city - a benefit I have never found a use for.

Ping times can be ok, in the 200ms range, but often go as high as 1,000ms on bad days.

Reliability I would say as decent. It depends a lot on if there is any interferance between you and the tower. If it is pretty much a clear shot, then you'll have great reliability, but if there is stuff in the way things can get iffy.

I'd say they are a workable alternative to the duopolies out there unless you absolutely demand very high speed and low latency.

Re:No real scarcity yet

[cbhacking]

Trying out Clear here in Seattle, it works well enough but is nothing to get excited over. Latency isn't atrocious but is unjustifiably high (pinging a server located a mile from here takes ~80ms, while on cable or the old Clearwire network it took about 9ms) and they appear to be routing my packets halfway across the country for no discernible reason. It's OK for RTS games but I wouldn't recommend it to a FPS gamer. Otherwise, it's been acceptable, and the pricing is pretty good.

Reliability isn't something I've used it long enough to determine. Over the course of 3 days it once went out for half a night (and their phone support was unavailable) but from online chat via another connection I found out that it was tower maintenance. No idea how often they need to do that, though... but if I hadn't been up really late (by the standards of the average person) I doubt I'd have noticed.

Bandwidth is actually quite good. I'm on the 3Mbps/512Kbps and speedtest.net reports average speeds of about 3.4Mbps/490Kbps. Clear WiMAX is pretty new in Seattle though, so it may be just a matter of time before the network is saturated.

Re:No real scarcity yet

[Jonner]

So, which on is it? I want in on the action.

Re:No real scarcity yet

[satoshi1]

In that list in the second paragraph, the only real "need" (it's still a want, but it would benefit the most, probably; maybe) for a public IP would be the game console, as they're likely the least hackable thing (potentially the blu-ray or TV, too, but that just seems excessive to give those public IPs). And even then not really. Everything in that list can be NAT'd, and in fact most of it SHOULD be. I can understand wanting a media server or NAS publically available while you're not at home, but keeping it behind your router would be loads safer while still allowing you to get at it while away from home.

Re:No real scarcity yet

[mlts]

Clear sounds like something I'd like on a netbook or a laptop. However, 200ms latency if playing an online game really makes it killer.

LTE has yet to be rolled out, but I read somewhere they are promising sub 40 ms for most destinations on their network, and an average of 75 ms to an average server. I'd love to see this, but historically, radio has always had a lot more latency than wired connections like DSL that require less processing per bit over the wire.

I'm looking forward to LTE because it would standardize three providers -- Verizon, T-Mobile, and AT&T. Then if they use the same frequency, swapping a sim to use in an unlocked device shouldn't be as painful as it is now, as even on GSM networks, phones need quad-band capability to use T-Mobile's G3 and AT&T's G3 bands.

Re:No real scarcity yet

[nabsltd]

Now sure, a number of those devices shouldn't have internet access, and I can run NAT like a normal person with a consumer router, but I would love to not have to.

You'd still have to configure an IPv6 firewall in pretty much exactly the same way as you would your NAT device (if you want to let connections through to these devices).

For well-known, inbound-only ports (HTTP, FTP, SSH, etc.), IPv6 offers essentially nothing over NAT as long as you have enough public IPs for each duplicated port (i.e., if you want eight different physical servers to be contacted on port 80, you need 8 public IPs). Since every IPv6 address is public, this isn't an issue.

IPv6 will help for things like P2P that can dynamically allocate a server port, but these sorts of protocols need some sort of "control server" that is listening on a well-known port (like torrent trackers). But, you can usually just configure the software for a fixed port (not "well-known") and then add a rule to the NAT device. UPnP can help with this in most current cases where you just can't pre-allocate the port number.

I do have some older software that stupidly sent the local IP address as part of its connection setup, and there was no way to configure it to not automatically discover the IP, so it sent the private address. IPv6 would also solve this, but most modern software understands that both ends may be behind a NAT device.

One real problem with NAT is that for very large private networks, the NAT device may run out of ports for outbound connections (depending on the implementation). Although it's possible to use the same outgoing port for connections to two different IP addresses, this does have some security issues.

Re:No real scarcity yet

[jrumney]

This seems to be a common theme in comments from posters in the US. 5 IP addresses, 32 IP addresses... Meanwhile in the rest of the world, you get one, and you're lucky if it is not NAT'ed. It seems the US treats IP addresses the same way they treat oil.

Re:No real scarcity yet

[ockegheim]

Meh, there's a limit to how much carbon we can put into the atmosphere, and plenty of people are buying Hummers.

In this case, and with global warming, I think the stick of IP scarcity/ weather or sea-level disasters will be much more effective than any early adoption by nerds/ environmentally conscious people.

Re:No real scarcity yet

[XanC]

Everything in that list can be NAT'd, and in fact most of it SHOULD be.

Nothing ever "should" be NAT'd. NAT is a necessary evil in the scarce world of IPv4. A world which should be abandoned in favor of IPv6.

Re:No real scarcity yet

[wagnerrp]

NAT is not a security tool, has never been a security tool, and was never intended to ever be used as a security tool. It does no more good than a basic 'block all inbound' firewall, and only serves to limit and complicate every application you wish to use.

If I want to run multiple computers accessible over SSH or VNC, I have to run them on separate ports. If I want to run multiple web servers, I again have to run on different ports, or otherwise proxy them all through a single external server. SIP and other protocols that embed the address in the protocol are outright broken by NAT. Like XanC said, it is a necessary evil that should be dumped with extreme prejudice.

Re:No real scarcity yet

[raynet]

That seems somewhat silly. My ISP gives me 5 public IPs and they are given via DHCP from /22 network block, less waste that way.

Re:No real scarcity yet

[eth1]

IAAFWA (I am a FW admin)...

If I want to run multiple computers accessible over SSH or VNC, I have to run them on separate ports. If I want to run multiple web servers, I again have to run on different ports, or otherwise proxy them all through a single external server. SIP and other protocols that embed the address in the protocol are outright broken by NAT. Like XanC said, it is a necessary evil that should be dumped with extreme prejudice.

It sounds like you're talking about PAT (many-to-one), not NAT (one-to-one). PAT is almost never used for servers, just stuff like user VLANs that have no inbound connectivity (unless your public space is so limited you have to double up with static PAT). On the other hand, almost every single server (thousands) that go through our firewalls, is NATed onto the public network. Even some whose true IPs are routable still have public NATs. That's because NAT *is* a security tool; it just shouldn't be the *only* security tool. It's like security through obscurity: obscurity in itself isn't bad, because it increases the work that attackers have to do to profile your internal network, but it had better not be the only thing standing between them and your boxen.

Great... now do I switch?

[Anonymous Coward]

I live in one of the most tech-focused parts of the country (downtown San Francisco) and as far as I can tell there's no way for a normal consumer to order native (i.e. not tunneled) IPv6 here.

When I moved to my current apartment in 2004 I specifically went with Speakeasy because they were talking about rolling out IPv6 to customers. Over 5 years later, those plans are still stalled as far as I can tell. None of the other providers seem to be even making a peep about it. If I'm wrong, someone please correct me - I'd love to switch to an IPv6-capable provider.

I've pretty much concluded that IPv6 just isn't going to happen -- instead providers will just force all of us normal people into shared IP addresses. From a technical perspective this isn't hard to do: just move the software that's currently running in your home NAT router onto the DSLAM and only provide a NATed view. For the ISPs there's no downside to this since not only can they avoid rolling out IPv6, it means they have complete control of your network connection.

I bet in 10 years we still won't have IPv6 in our homes, and the idea of having your own IP address (even a dynamically allocated one) will just be a memory. It's a shame.

Re:Great... now do I switch?

[swillden]

None of the other providers seem to be even making a peep about it.

Comcast is planning to start deploying residential IPv6 this year. They haven't said how long it will take for a full rollout to all of their customers, but if they do get there, that will be a significant chunk of the US residential market that has native IPv6.

Re:Great... now do I switch?

[pwthoma]

Actually, there are several issues with that.

1) The CPEs (DSL/Cable Modems) that most service providers don't support IPv6. No major ISP will force the firmware upgrade of millions of CPE just to enable IPv6. Even then who knows what all the folks home network uses (wireless, OS versions, etc). Imagine the calls to the helpdesk.

2) Most of the DSLAMs in the DSL market aren't IP aware. Those cost more than the ones doing simple ATM VP/VC mapping or ATM>Ethernet (dot1q / QinQ) conversion. That offering will need to roll up to the BRAS which probably won't be able to support that many NAT translations as the big boys terminate 100k+ sessions. I can't speak for CMTS stuff.

3) The big boys customer is no longer the subscriber but it's actually wall street. That's who they care about making happy. So imagine the opportunity they have once they figure out a way to NAT all their non premium subscribers. That's another $5 a month for anyone that needs a public *dynamic* ip address. Then another $10 on top of that for a public static IP.

Re:Great... now do I switch?

[koehn]

I'd be happy if they started hosting the 6to4 anycast address (192.88.99.1) internally. I use 6to4 and am looking at 133ms just to hit the 6to4 gateway. Native IPv6 would be phenomenal.

Here's what's going to happen...

[WebManWalking]

... We'll run out. People won't be able to get new IP addresses. Entrepreneurs will see a market to sell IPv6 addresses. We'll have IPv6 addresses.

Some entrepreneurs will start earlier than others, and they'll have an edge.

Re:Here's what's going to happen...

[John Hasler]

+5 funny.

On the other hand...

[192939495969798999]

... we won't run out, because more and more of the addresses in use will also become available, and as ipv6 uptake accelerates, ipv4 uptake will dramatically decelerate, and it will stop just shy of actually running out.

Re:On the other hand...

[blai]

as ipv6 uptake accelerates

ipv4 uptake will dramatically decelerate

Which one happens first?

Re:On the other hand...

[neokushan]

For that to be the case, there has to be an actual uptake of IPv6. I live in the UK and I don't know of a single residential provider that's offering IPv6 to anyone and nobody seems to have plans to, either.

Pre-emptive strike

[fbjon]

"IPv6 addresses are too long and complicated to type"

...is like saying solar panels are too hard to build when you run out of slave labor in hamster wheels.

"We don't need IPv6 since there is NAT"

...is like saying we don't need new energy solutions because beeswax candles are a tried and trusted technology.

"The Internet will be overrun by zombies when NATs no longer protect us."

...is like saying avoiding antibacterial soap will cause untold misery and disease.

"Just re-allocate some of the wasted space in Class A nets."

...is like saying overcrowding of the planet can be mitigated by decreasing the size of houses.

Re:Pre-emptive strike

[Athanasius]

"...is like saying avoiding antibacterial soap will cause untold misery and disease."

Well, actually, it has some potential to be a problem, if not used correctly:

http://news.bbc.co.uk/1/hi/health/8427399.stm

Re:Pre-emptive strike

[fbjon]

Precisely, NAT is part of the problem.

Re:Pre-emptive strike

[shentino]

Hoarding of scarce v4's undeniably aggravates the shortage almost by definition.

Re:Pre-emptive strike

[Midnight Thunder]

Hoarding of scarce v4's undeniably aggravates the shortage almost by definition.

And asking said entities to return unused blocks is like asking the government to return unused tax money. In other words: good luck with that.

Re:Pre-emptive strike

[DrXym]

...is like saying solar panels are too hard to build when you run out of slave labor in hamster wheels.

No it isn't. It's a legitimate issue with IPv6 addresses. I totally understand the need for IPv6 but there is no denying what a pain in the ass the format is to type in. About the only useful notation is ::1. Having to type out potentially 8 colon separated hex values is an exercise in pain and suffering.

Re:Pre-emptive strike

[Rich0]

I dunno. This sounds kind of like arguing that MAC addresses should be only 16 bits instead of the typical 48. After all, they only need to be unique within a single physical network segment, and who even has 255 ethernet devices on one of those? It would save us a LOT of mac address typing since you'd only need four digits of hex to identify a device.

Of course, every device would need dynamically-assigned MACs, and nobody actually types MAC addresses anyway.

I actually struggle to remember the last time I had to type an IP address. Unless you're doing network work where you actually are troubleshooting IP problems or are assigning address space, you generally don't need to deal with it. That's what DNS is for. Maybe what we need is to have network devices and DNS servers work together more easily so that home network users don't ever see AN IP unless they're going something unusual? Their new network printer could provide its hostname in the DHCP request, and the $20 linksys router would automatically register it in the DNS database (and provide resolution services). Other than some standardization there is no reason this couldn't work.

I think the key is to make IP space cheap and then not worry so much about who is allowed to use it. Unfortunately, we're stuck with IPv6 which makes the transition a big pain. What we really need is an IPv4.1 that has more backwards-compatibility.

Refrigerator ....

[Mansing]

... can't get a DHCP address .... Film at 11.

Re:Refrigerator ....

[Jeremi]

... can't get a DHCP address .... Film at 11

The Film at 11 has been cancelled, because the television's NAT gateway wasn't configured properly.

Only a Few More Years' Worth of IPv4 Addresses...

[jimpop]

Only a Few More Years' Worth of IPv4 Addresses

They (vested interest groups) have been saying that for a decade now.... guess what, we haven't run out yet.

2012?

[michaelmalak]

The Mayans were right about 2012!

Re:2012?

[Dayofswords]

dang...... your right, could be by then

Re:2012?

[MobileTatsu-NJG]

The Mayans were right about 2012!

According to Autodesk Maya 2012 only really cares about the MAC address.

ipv6

[Dayofswords]

lets just switch to ipv6 and just end it already, you hear me ISPs, get you butts in motion!

I read the org post in 1998

[haus]

So there is no need to read the repost.

I will guess by your user id that you where in junior high then, or are old and senile and forgot the password to your old account. Either way the story goes that everyone needs many address they do not exist so we will all change over to IPV6 by Thursday. Hint the research is done by people who have a vested interest in selling gear or by grad students who have never worked anywhere.

When you have read the next three such articles and the country is suffering through the nightmare of a Palin presidency you will become cynical as well...

Re:I read the org post in 1998

[Alrua]

Aha. Well, in that case I will get off your lawn immediately... ;)

A possible solution

[RoccamOccam]

Two words: offshore drilling.

For stupid reasons

[Junta]

I also know first hand IBM uses a lot of 9.0.0.0/8 today and that the world would have to do something drastic to make them change their usage as it isn't cost-effective from their standpoint unless they can save/get a large chunk of change.

Now, you'd think that means these devices are publically accessible, but noooo. If 99% of their '9.x.x.x' equipment that does have internet access attempts a connection, it gets NATed outbound to a different address entirely! So they sit on a mountain of globally addressable IP addresses, and then only use them internally for nearly all of them.

Just give me a sane IPv6 environment (give me richer DHCPv6 capability than I have today and a few other things that are just flat-out missing in the IP6 generation) and a /48 (or /56) for my house and I'll be on my way.

Re:For stupid reasons

[metamatic]

Now, you'd think that means these devices are publically accessible, but noooo. If 99% of their '9.x.x.x' equipment that does have internet access attempts a connection, it gets NATed outbound to a different address entirely!

Depends on the IBM site. Some use NAT and/or a proxy, but the sites I've worked at in the US don't. In fact, the NATted sites are a source of technical issues internally, exactly as you'd expect.

[Opinions mine, not IBM's.]

Re:For stupid reasons

[Stile 65]

GE's use of their 3.0.0.0/8 is exactly the same way. All their devices have public IP addresses, and they're all NATed at the firewall anyway - even for some internal communication. The NAT doesn't cause too many problems at most of the sites I've worked with (except one, getting that firewall migrated was a bitch and a half) but it's a huge waste of IP space.

Same goes for many of the customers of my former employer with full /16 blocks, too. Absolutely no reason for most companies to have that much if you're trying to conserve IPv4 address space.

That said, NAT is heinous and horrible for the end user. Peer-to-peer technologies suck when more than one device on the user's network attempts to use them at the same time (and I'm not just talking about BitTorrent, I'm talking about mixnets like Tor and I2P). I look forward to the day when I can have at least my own /64 if not my own /48 without having to tunnel it. Or several /64s - at least one for home and one for my phone and portable devices tethered thereto.

Re:For stupid reasons

[swillden]

Now, you'd think that means these devices are publically accessible, but noooo. If 99% of their '9.x.x.x' equipment that does have internet access attempts a connection, it gets NATed outbound to a different address entirely!

That's not my experience. HTTP connections often pass through a proxy, which means the target site sees a different IP, but that's not NAT. If you use a non-proxyable connection (e.g. SSH), the target host sees the real IP.

That's the way it seems to work from multiple US sites, anyway. I did see some actual NATing from sites in Asia.

Re:For stupid reasons

[Junta]

If I ssh out, my source ip is different than what it appears to be locally.

Re:For stupid reasons

[Junta]

I base my experience on 'who' output on a system I ssh to, which puts me on a different IP.

Re:For stupid reasons

[Junta]

Oh, and I meant to say a sanely routed /48 ;)

Take back his Nobel Prize!!

[lucm]

> So it's a near certainty that before Barack Obama vacates the White House, we'll be out of IPv4 address

When Bush left, there was still plenty of IPv4! Shame to you, Obama.

Fool!

[ravenspear]

IANA has in place an agreement that as soon as one of the RIRs is assigned one of the five final /8s

You DO NOT talk about the final five. That is against your programming.

Workaround

[SEWilco]

So it's a near certainty that before Barack Obama vacates the White House, we'll be out of IPv4 address[es]. (Even if he doesn't get re-elected.)

So if we change the Constitution to extend the President's term of office to eternity, we'll be OK? No election, no problem.

Re:Workaround

[shentino]

Thank God (literally) that man is still mortal.

Re:Workaround

[SEWilco]

Thank God (literally) that man is still mortal.

Not relevant. Put his crypt there and he still won't have "left" the White House.

Now if IPv6 could get fixed...

[Junta]

There are so many ways IPv6 remains broken and too many of the people with influence can tend to say 'working as designed'.

I know that's controversial, so I'll enumerate my pain points:
-DHCPv6 DUID is a pain to 'pre-provision'. When any operating system or firmware instance dhcpv6 for the first time, it sends out something that you'll never know what it would be ahead of time. In 99% of cases, the DUID is a generated value at 'OS Install time' that is used only for that specific OS, and a reinstall or livecd boot will change it out completely. stateless boot, multi-boot systems and multi-stage booting (i.e. pxe -> os) cannot hold together a coherent identity because DHCPv6 is explicitly designed not to do that. Binding by MAC is considered 'evil', but it has been the strategy used for ages. I wouldn't mind so much if DUID was commonly implemented as a value retrieved from motherboard firmware tables, but no one is stepping up to drive that behavior in a spec visible to all parties.

No PXE/bootp boot. I believe they are trying to reinvent, from scratch the boot design from IPv4, and are nearing completion. I fear the extent to which the baby has been tossed out with the bathwater (i.e. 'root-path' was dropped and no one has pulled it into dhcpv6).

Some standards are missing the capability to operate in IPv6. I.e. IPMI hase some IPv4 specific portions of the standard without IPv6 capable equivalents.

Re:Now if IPv6 could get fixed...

[swillden]

Why use DHCPv6? I much prefer stateless autoconfiguration. I was amazed at how well it works. The first time I fired up the radvd daemon on my home gateway (which is using a tunnel broker service to get v6), I was amazed at how every device on the LAN instantly had v6 access, with no action whatsoever on my part.

I don't have any comment on PXE/bootp. Haven't looked into that in the v6 world. It seems like v6 should make that trivial, though. Just pick a standard reserved local suffix to hold the boot service. The booting device should wait for a router advertisement to find out what network it's on, append the standard suffix and open a connection to get boot code. Done. That's just off the top of my head, of course.

Re:Now if IPv6 could get fixed...

[flux]

..did it configure the DNS for you as well? No? How did you configure that then?

I'm guessing you had already IPv4 configured (manually or via DHCP) and used its DNS settings. I suppose that's a decent solution for the time being, as most hosts already are configured to IPv4. But I suppose at the same time they could have their IPv6 address assigned over DHCP too, even if via a DHCP extension..

(Although I run radvd also, and it's great, until you have accidentally ran it on a host that used to do teredo, and you're no longer running it: happy times removing the IP from all hosts.)

Re:Now if IPv6 could get fixed...

[Ant P.]

Do you really NEED IPv6-capable PXE? What's wrong with keeping IPv4 on your LAN, the same as Windows 7 still does with NetBIOS?

Re:Now if IPv6 could get fixed...

[Junta]

I recognize this as a possibility, but I'd kinda like to not manage multiple networks when it comes down to it.

Re:Now if IPv6 could get fixed...

[Junta]

On the DHCPv6 front, one thing is that IPv6 has two distinct scenarios in my mind:
stateless autoconfig with service discovery via route advertisement and mdns. Great for networks with self-managed participants. This was the orginal vision intended to encompass the whole usage.

On the other end, centrally managed scenarios are recognised as unavoidable, and that's where DHCPv6 has to come into play. It just so happens if you are centrally managing things, a lot of value is lost when the managed entities are moderately dynamic in nature. This is great in some 'enterprise' contexts or other cases where the number of entities to manage far outnumbers the people to manage them.

Re:Now if IPv6 could get fixed...

[Junta]

Some could say that IPv6 went wrong by not being more interoperable with IPv4 or throwing out too much accumulated knowledge with IPv4. On the former point I'm undecided, as one goal was a sane routing scheme and that may well be impossible if preserving IPv4 semantics, but I'll defer to others on that. I tend to agree with the latter, where IPv6 architects for a non-trivial part threw out the entire IPv4 set of best-practices assuming they were all crap and requiring every last bit to debate for re-acceptance (i.e. DHCP was not originally going to exist, bunches of useful DHCP option codes when it would exist are dropped until someone argues them back in, etc).

Re:Now if IPv6 could get fixed...

[swillden]

mDNS.

Re:Every two years? Hah. More like twice a year

[dgatwood]

I'm not positive, but I'm pretty sure we'll run out of IP addresses on December 21, 2012. :-)

Re:recover unused/abandoned IP blocks

[Jonner]

You clearly don't understand the way the Internet is supposed to work, which is as a bunch of peers, all able to communicate with each other. NATs only work to the extent that they can preserve the illusion of a peer to peer network. A shortage of addresses resulting in more NATs gives the man more ways to control us, not the opposite.

"Private" IP addresses have little to do with human privacy. If you don't want a fridge giving out private information, don't buy fridge capable of doing that or don't connect it to a network. If you think NATs keep your network secure or keep your data private, you're in for a big surprise, especially if there are devices in your network actively trying to leak private information. What can be helpful in keeping a network secure is a stateful firewall (though that wouldn't necessarily prevent a malicious device such as the hypothetical fridge from leaking private information), and since most routers that do NAT also have stateful firewalls, many people seem to confuse the two.

There's an incredible amount of waste in IPs

[mschuyler]

I know of one organization, for example, that was originally awarded 11 Class C's. These are permanently assigned. One Class C was used to knit together nine routers (That's all.) Another was assigned to a branch office that had five PCs, one hub, and one router. Later they added an IP-addressable copy machine and printer, so that's nine IPs hard coded out of one Class C. When their main office got a little crowded they did manage to subnet this Class C into two and swipe half of it away, but overall I think they had 2700+ IPs and were using about 300 of them. There are so many other ways they could have handled it, but in the early years they gave them away. Who knew?

Re:Only a Few More Years' Worth of IPv4 Addresses.

[compro01]

We managed to slow it down via massive use of NAT and the RIRs tightening the requirements to get blocks of address space.

Always the same

[omb]

You got a market-droid answer, once that happens in a font line computer company, you have 5 years to sell your stock and fix your 401K, the retire or start a new life. Why do you think C* negotiate a golden parachute, so they can participate in the stock pump & dump before the implosion.

DEC, Compaq, Sun are just the biggest and once, the best, to go down this road.

Re:Always the same

[fm6]

Sigh. Your anti-corporate rant (which, believe it on not, I pretty much agree with) is beside the point. The fact remains that IPv6 is a solution, anything else is just a kludgy expensive workaround.

Re:Every two years? Hah. More like twice a year

[Bigjeff5]

No no, after December 21, 2012 all the addresses will be available!!

one address per two world citizens

[wwwillem]

Agreed, look at it another way: 2**32 is four billion address, which is one address per two world citizens. OK, I could share that IP with my wife, but given the number of devices in between us, that won't really work. Now I know, that places like Africa currently don't follow the pattern of "personal" computers, but how long will that last.

More realistically, given that my phone, web-server, car, camera, email, GPS unit, home security system, etc. all should have their own IP address, we need at least 20x what a 32 bit address space can provide. And then you've to add the 'wasted space' so that we can allocate blocks of addresses in a logical fashion.

So yes, IPv6 is the only way to go, if you like it or not. Couple of /8 blocks or NAT won't help us.

Re:one address per two world citizens

[VGPowerlord]

More realistically, given that my phone, web-server, car, camera, email, GPS unit, home security system, etc. all should have their own IP address, we need at least 20x what a 32 bit address space can provide. And then you've to add the 'wasted space' so that we can allocate blocks of addresses in a logical fashion.

This is a straw-man, as not all devices need publicly addressable IPs, which is the current issue with the IPv4 space.

Re:one address per two world citizens

[Karrots]

wwwillem is correct even with private IP's we can't necessarily address everything. Just ask Comcast who ran through the full 10.x.x.x/8 on their network and had to get space from ARIN for cable modem management. See the presentation below.

http://www.ripe.net/ripe/meetings/ripe-54/presentations/IPv6_management.pdf

Re:one address per two world citizens

[Daniel Phillips]

IPv6 is the only way to go, if you like it or not.

Oh, I don't know. There is always the chance that IPv6 may die a well deserved death to be replaced by a viable solution based on extending the IPv4 stack.

Re:one address per two world citizens

[mysidia]

To have proper end-to-end connectivity of these hosts, public addressable IPs are an absolute requirement.

NAPT was a kludge due to the limitation of IPs, that compromises the end-to-end principal, it compromises the fundamental design principals of the internet, and hosts with RFC1918 IPs and the like are not truly internet connected.

Non publicly addressable IPs don't have proper connectivity.

If your Car, Camera, etc, don't have publicly addressable IPs, then you can't connect to them from off-net, which defeats the point of having them internet connected in the first place.

Re:one address per two world citizens

[Firehed]

Not all devices need publicly addressable IPs, but providing them could enable a lot of cool new stuff, or at least vastly simplify its implementation. I'd quite like to be able to ping my refrigerator from my cell phone when out getting groceries to find out where I need to pick up milk. Right now, that would be completely impractical (from a networking perspective) without NAT, plus probably also UPNP (we are talking consumer devices here, who the hell wants to screw with their router's firewall for a fridge?!) and remembering a non-standard port number.

Or a more practical task: maybe you've tried to enable remote desktop (or some other service that has a standard port) on two machines in the same private network. At least on my consumer-grade router, I have to set up all sorts of port mapping (tedious) and then remember which port corresponds to which machine (horribly annoying).

Quite a first-world problem, but giving each device its own unique public IP eliminates a lot of ugly hacks that we currently have to employ.

Re:one address per two world citizens

[dkf]

There is always the chance that IPv6 may die a well deserved death to be replaced by a viable solution based on extending the IPv4 stack.

That extension is IPv6. The roll-out of support to core OS platforms is now about done. There's still quite a bit of work to do to make it work with applications (there are some very messy details when you get to the specifics) and there are many devices that need conversion too, but moaning about it won't help.

For reference, at my organization we're really constrained for IP addresses. It's got to the point where we need to write business cases to get a public IP because those we have are needed for systems that need to be routable (as they host services). We already NAT most desktops and all wireless devices. We can't expand our allocation with IPv4 (I think we already have several /16s). In short, v6 looks good to us even though we know it's going to be horribly painful to get there from here.

Re:one address per two world citizens

[chromas]

Even more important: if I see some LEO activity on my home security cam, I should be able to send a Flush command from anywhere in the world.

Re:one address per two world citizens

[Daniel Phillips]

There is always the chance that IPv6 may die a well deserved death to be replaced by a viable solution based on extending the IPv4 stack.

That extension is IPv6.

If only it were. But alas, IPv6 was conceived as an incompatible replacement for IPv4, not an extension.

So, how many applications break?

[tjstork]

I guess the question is, how many applications break on the switch to ipv6? Seems to me that if it were so easy to port to ipv6, we would have done it already.

Re:So, how many applications break?

[mark-t]

Applications that make the assumption that any ip address will fit into a space that is 4 bytes or lager.

The number of applications that make this assumption is not small, but it is not unmanageable.

Re:So, how many applications break?

[tftp]

The number of applications that make this assumption is not small, but it is not unmanageable.

I would say that IPv4-only apps are majority:

#include <netinet/in.h>

struct sockaddr_in {
short sin_family; // e.g. AF_INET
unsigned short sin_port; // e.g. htons(3490)
struct in_addr sin_addr; // see struct in_addr, below
char sin_zero[8]; // zero this if you want to
};

struct in_addr {
unsigned long s_addr; // load with inet_aton()
};

You need to hack the source to use in6_addr and sockaddr_in6 wherever appropriate, and change the code that processes them (such as inputs addresses, compares them, works with netmasks, etc.) I'm sure most coders never even thought of adding IPv6 support to their specialized, made to order applications. They weren't paid to add features that nobody asked for, and they never even had an IPv6 network to test the code on. In my career I had only one (1) customer specifically asking to support IPv6 - and he paid for it, and he got it. Everyone else got IPv4 only - as a business we had to be lean.

This is a lot of work, both coding and testing, and you will never see it done to a legacy software as a free patch. Software is sometimes very expensive - tens of thousands of dollars per seat. There is zero chance that this investment will be just scrapped, and you'd have to do that if your PADS Layout or SolidWorks or, $deity forbid, CST can't talk to its license server. The latest releases may, of course, fix all that, but they are never free. And the worst news is that some of *your* production software, like your beloved OrCad 10.3, is not supported any more, and you can't upgrade to the latest OrCad, jumping over six revisions, because it will break millions of things in your business process (or your bank.)

Re:So, how many applications break?

[Bigjeff5]

A lot, as the IPv6 spec is not equivalent to the IPv4 spec, it just has a lot more addresses.

Pretty much

[Sycraft-fu]

While I'm sure eventually IP address scarcity will become a real problem, it just doesn't seem to be at this point, and doesn't really seem to be near it. Part of the reason is that there is a fair bit of unassigned IP space still, and a fair bit that is very underused. Organizations that got Class As way back in the day but have no need for all that. Then of course there's NAT, which has made the space go much further. There are lots of situations where NAT can be used, and even is desirable.

There's no question that a move to IPv6 will eventually be necessary, and it is a good idea over all. However I'm more than a little tired of hearing these "sky is falling" stories on IP space. Maybe this really is the time this time, but I'm doubtful because, as you said, people keep crying wolf about it. I've been hearing about the death of IP for at least a decade now.

Re:recover unused/abandoned IP blocks

[JWSmythe]

    I honestly wouldn't be surprised if home appliances were subsidized pretty soon. I know it's a joke for now, but I'm sure a few executives have been drooling over the idea of pushing targeted ads into the homes, and being able to "remind" customers to restock particular items. From what I've seen, most grocery store items are not RFID tagged quite yet, but I'm sure they will be soon enough.

Are desktops ready?

[tjstork]

I guess the question is, can a modern desktop operating system, out of the box, wire itself to an ipv6 network the same way one does with ipv4? Like, if Verizon decreed that FIOS shall use IPV6 addresses for everything, does that break the following operating systems:

a) Linux
b) Mac
c) Windows

Re:Are desktops ready?

[klapaucjusz]

I guess the question is, can a modern desktop operating system, out of the box, wire itself to an ipv6 network the same way one does with ipv4?

Yes.

Like, if Verizon decreed that FIOS shall use IPV6 addresses for everything, does that break the following operating systems:

a) Linux

No. (If using 2.4.12 or later.)

b) Mac

No. (If using 10.3 or later.)

c) Windows

No. (If using Vista or later, limited support since XPSP2.)

Re:Are desktops ready?

[Captian Spazzz]

Linux is ready and in fact Ubuntu tries to use IPv6 by default which is a major pain in the ass because if your network/isp isn't IPv6 compatible it's not yet all that smart about figuring it out and it causes a very noticeable time lag between the time it tries IPv6, Times out, then tries IPv4 resulting in a successful connection.

It used to be easy to switch IPv6 off until they started building it into the kernel and then for a while you could not switch it off.

I think though they realized it and the newest kernel has a flag you can set at boot time to disable IPv6 and just use straight IPv4

Re:Are desktops ready?

[gbjbaanb]

Doesn't really matter whether your desktop supports it if your home router doesn't.

Re:Only a Few More Years' Worth of IPv4 Addresses.

[jimpop]

What "vested interest groups"?

Hardware vendors, software (non-desktop) vendors, registrars, etc.

So how will the transition look like?

[lostinmadnez]

Could anyone enlighten me why I dont notice anything about a shift from IPv4 to IPv6? What will the switch actually look like? 2 years isnt that far away...

Re:So how will the transition look like?

[JSBiff]

I think the rational goes that ISPs don't want to begin migrating to IPv6, because they are afraid it will cause problems for customers, incur lots of expense, generate no new revenues, and currently there is no customer demand for IPv6 (or negligible demand). Basically, everyone will migrate when it become too much of a pain in the ass to keep using IPv4, and no sooner. It'll probably be more expensive to migrate at that point, but oh well.

Re:So how will the transition look like?

[tftp]

It'll probably be more expensive to migrate at that point, but oh well.

Why more expensive? The Moore's law keeps ticking, and the hardware becomes cheaper - per unit of performance or per box. Also money not spent on IPv6 today will be invested into something else, hopefully bringing dividends. You always want to delay spending money on nonessential projects. When the project doesn't even offer any immediate increase in revenue the choice becomes very obvious.

Re:So how will the transition look like?

[TheRaven64]

Well, the easiest way of getting back some new IPs is to reclaim some used for residential ISPs. At that point, a typical home user will have a double-NAT'd IPv4 address and a public IPv6 subnet. As long as their client software supports it (all recent operating systems do, and a lot of home routers do) then they will just use the v4 address for connecting to servers that haven't migrated. Things like VoIP and other P2P systems become easier because both endpoints are publicly routable, they just need the user to open the correct ports (some already use IPv6 via terendo tunnelling).

Re:So how will the transition look like?

[JSBiff]

"Why more expensive?"

Well, at least the following occurs to me why it will be more expensive: any switch to IPv6 necessarily involves a transition period where IPv4 and IPv6 must run side-by-side. When we hit the point where all IPv4 addresses are 'owned', it might be very expensive to get the necessary IPv4 addresses to enable a smooth transition to IPv6 (artificial scarcity will drive up the price of IPv4 addresses, I would presume based upon usual market economic forces - I wouldn't be surprised if in a couple years' time, IPv4 addresses are 10x or 100x more expensive than they historically have been).

Re:So how will the transition look like?

[delinear]

At the very least if you assume a support cost, this will increase as more users sign up. The hardware costs involved for the average user are pretty stable now and unlikely to fall much further in the next few years.

I wish they would just do it already

[Captian Spazzz]

I've been hearing for years about how by this time in X years we'll have no IPv4 addresses left. I wish people would knock off the doomsday predictions or just freaking adopt already. While I don't see a lack of being able to connect because of lack of an IPv4 address yet but I do see some device makers trying to force users to use IPv6 by default and making it a pain in the ass to switch back to IPv4 easily. Which frankly pisses me off because most ISP's don't support it yet. (Hey Canonical, I'm looking at YOUUUUUUUUU Ubuntu Devs!)

That being said I would like to see some routers and devices being made that can sign an IPv6 address out on the LAN side and accept either IPv4 or IPv6 addresses on the WAN side that way users can start transitioning over and will be ready when the ISP's finally start upgrading their infrastructure.

This again?

[Anonymous Coward]

We all know that IPv4 addresses will be bought and sold like any other commodity once new ones run out.

Re:This again?

[JSBiff]

I would say a 'commodity' is the wrong analogy here. More like real estate in Manhattan or London or some other very expensive place where all available land is already owned. The thing about commodities, like food or toothbrushes, is that you can always make more. Not so with real estate, or IPv4 addresses. Once we hit the IP crunch, IP addresses will get *very* expensive, I think. I wonder how many people are just sitting on blocks of IP addresses waiting for 'the day', so they can sell them off at 1000x what they paid for them?

So, what can I do?

[philmck]

I currently use two IP4 static addresses - one at the webhosting company I use in the US, essential for the SSL certificate (shared between several domains, yech!) and one at my home address in the UK, not essential but losing it and using dyndns wouldn't really free up another address. Last year I asked both suppliers what plans they had for IPv6 adoption, and both replied "none". It seems to me they're leaving it a bit late, especially at the hosting end. If I think of all the places where I currently have an opportunity to input an IPv4 port number (even though it's usually just left at the default) it comes to quite a large number.

Re:So, what can I do?

[gbjbaanb]

It looks like they're finally getting their act together in supporting TLS extensions (ie SNI, Server Name Indication) in Apache, so running multiple ssl domains on a single IP/port will work perfectly. You'll need to use Apache 2.2.13 (IIRC) and a browser that supports TLS (all but IE6, so no problem there)(there's a lovely test page for your browser, which includes the server config)

I'm not sure this version of Apache is in all distros yet, I think Fedora has it and Karmic Koala, but it'll be here soon enough in all of them.

On Which Planet?

[bill_mcgonigle]

There's no security value to NAT

Of course there is - it allows all manner of insecure and misconfigured gear to avoid being probed from the other side of the planet?

What you say can be true, but only where everybody's gear is perfectly configured and they're all running updated OpenBSD. I'm not likely to give a 10-year-old JetDirect card a public IP any time soon...

Re:On Which Planet?

[mini me]

An improperly configured NAT gateway may also allow outsiders access to the internal, private network. Improperly configured network devices are always a security risk. NAT does not help here.

Your JetDirect card would presumably be behind a firewall, so even with a public IP, it would not be accessible to those on the general internet.

Re:On Which Planet?

[swillden]

Of course there is - it allows all manner of insecure and misconfigured gear to avoid being probed from the other side of the planet?

That's not an advantage of NAT. That's an advantage of a stateful firewall that disallows inbound connections. NAT is not required to get the same benefit.

All of the machines in my home have public IPv6 addresses, but I have a firewall that blocks inbound connections to all of them. Same security result. No address translation.

Re:On Which Planet?

[sopssa]

But the truth is, NAT usually accomplish the same (even if unintentionally)

Re:On Which Planet?

[asdfghjklqwertyuiop]

The truth is, nobody actually ever uses NAT without a firewall. You'd have to go out of your way these days to do that and if you did you'd find that NAT alone does not in fact drop any packets. Access to your network is left up to your attacker's ability to get packets with certain destination addresses up to the outside of your router.

Re:On Which Planet?

[bill_mcgonigle]

That's not an advantage of NAT. That's an advantage of a stateful firewall that disallows inbound connections. NAT is not required to get the same benefit.

All of the machines in my home have public IPv6 addresses, but I have a firewall that blocks inbound connections to all of them. Same security result. No address translation.

That's great - your network is properly configured. Most aren't.

At the risk of being repetitive: NAT isn't required, it just makes up for poor administration.

Re:On Which Planet?

[bill_mcgonigle]

An improperly configured NAT gateway may also allow outsiders access to the internal, private network.

I can't think of any that are this way by default.

Improperly configured network devices are always a security risk. NAT does not help here.

Sure it does, they're not reachable from the Internet. How is that not helpful?

Your JetDirect card would presumably be behind a firewall, so even with a public IP, it would not be accessible to those on the general internet.

Yes, mine would be, but most people don't properly secure their networks. NAT buys them some security despite their misconfiguration.

Re:On Which Planet?

[mysidia]

Of course there is - it allows all manner of insecure and misconfigured gear to avoid being probed from the other side of the planet?

It is much better to use a real stateful firewall for this, with a complete stateful firewall table, rather than rely on mickey-mouse techniques such as NAT. If the 'misconfigured' gear makes any outside connections whatsoever, NAT gear can be tricked to allow an outbound probe to it.

The key is NAT works by creating a (LOCAL):(lport) => (GLOBAL):(glport) entry, when a host on the LAN sends a packet to WAN.

For example, if the print server having IP 192.168.1.1 sends a packet sourced from port 139 to outside IP 192.0.32.10 on some port (destination port is irrelevent)

The NAT device will generate some random local port and make a NAT table entry
local-ip lport glport
192.168.1.1 139 1234

If someone on the internet happens to probe "port 1234". What will they be connected to? 192.168.1.1 port 139, of course!

This can result in a lot of unusual security implications for you. But the most significant one, is thinking you're more secure than you are... which may be okay, to an extent.

But not only can you be as secure without NAT (using a true stateful firewall), but you can be more secure than simple NAT allows you to be.

Re:On Which Planet?

[phtpht]

That's great - your network is properly configured. Most aren't.

NAT isn't required, it just makes up for poor administration.

Bah. You just gotta love that attitude. Actually the most plain view of the NAT security is not the inbound firewall but the persumably unroutable private block that's behind it. "We can't do our work properly so we stick our gear where they can't attack it. After all, our network has private addresses so the evil asian guys can't get to it. Right? RIGHT?" Wrong.

Wrong in oh so many ways.

First off, private addresses are NOT unroutable, they just happen to be dropped on their way through your ISP (if they do their job properly). Just try a traceroute to a private address and see how far the trace gets. (And try it from a public traceroute server ;) Try putting a server on the other side of your beloved NAT and you might just discover that you can ping into your private network.

Second, even if this works as advertised it does not pose any great advantage over a stateful firewall. To the contrary, NAT not only tends to fuck up many L4 protocols, but also introduces a complexity in address rewriting and therefore might introduce a whole bunch of security issues on its own.

The third problem is the NAT admin's typical mentality. People tend to satisfy themselves with such a global protection shield (tm) and neglect going into the detail of securing their private network properly. "LAN hosts" are often left with their own firewall off, with simple or even default admin passwords, a lot of non-pc appliances (printers, phones) left to their own fate etc. That just makes a perfect base for the all-or-nothing principle, which goes so against any security reasoning. Such an admin will then be horrified by the mere thought of having IPv6, since that would put all of his naked boxes right on the evil Internet without the condom of NAT, OMG!

Finally AND MOST IMPORTANTLY please ask yourself how much of the total security is provided by blocking inbound traffic. Most client boxes run absolutely no services (maybe ssh), even windows can have a great deal of its server capability disabled. Further, service exploits were the music of the early 2000's, by now almost all of the services can withstand direct exposure to the Internet (with the exception of silly newcomers). The real security threat comes from outbound connections, people going to nasty sites, or people going to legit sites (banks) with silly passwords, flipped staff, and so on and so on. The vast majority of compromised zombie machines is on broadband, which means a router with NAT or "stateful firewall".

Re:On Which Planet?

[dbIII]

Time for an analogy. Say your firewall/router is a blue colour. The people that say NAT is providing the security may as well say it's the blue that is doing it. They are mistaking one feature of the device for another.

Re:On Which Planet?

[TheRaven64]

The NAT device that my mother was using defaulted to automatically forwarding all inbound connections to the first machine to appear on the network. It's a fairly nice idea, in theory, because it lets one machine pretend that it's not NAT'd, while all of the others are. It had a configuration option for statically assigning this machine or for turning off that feature (I turned it off and explicitly opened a few ports).

A stateful firewall almost invariably has a default deny policy on the hostile side. Nothing outside can initiate a connection to anything inside unless you explicitly open the port. NAT has nothing to do with this. NAT is just address and port mapping. It's a mechanism. The policy is orthogonal.

Or, in summary: routable does not mean reachable.

Re:On Which Planet?

[fireylord]

The key is NAT works by creating a (LOCAL):(lport) => (GLOBAL):(glport) entry, when a host on the LAN sends a packet to WAN.

For example, if the print server having IP 192.168.1.1 sends a packet sourced from port 139 to outside IP 192.0.32.10 on some port (destination port is irrelevent)

The NAT device will generate some random local port and make a NAT table entry local-ip lport glport 192.168.1.1 139 1234

If someone on the internet happens to probe "port 1234". What will they be connected to? 192.168.1.1 port 139, of course!

but hang on a minute, my understanding of nat is that it also records the outbound ip address, and only allows any connection back the other way from that ip, everything else just gets filed in the bitbucket, or sends a rst packet?

Re:On Which Planet?

[mysidia]

Many-to-one NAT doesn't need to record the outbound IP address, and many simple NAT devices don't, it would require more memory to record the extra information, and more complicated software.

Most NAT devices will simply forward the packet, as long as a mapping exists for the port number the packet is sent to.

A stateful firewall does record the remote IP as part of the NAT table entry. A stateful firewall also records the state of the connection, deletes the entry from the table when the connection is closed, and doesn't allow packets that don't match a proper TCP connection.

And a stateful firewall can also block outbound traffic that doesn't match a valid TCP sequence. For example, malware trying to communicate through a back channel that uses stray TCP "ACK" packets

Re:On Which Planet?

[Shatrat]

Set up your windows machine's IP as the DMZ and there goes your firewall.

Re:On Which Planet?

[asdfghjklqwertyuiop]

What the hell are you talking about? Some linksys garbage? There's a firewall there. It is specifically configured to forward everything to that system in that particular case.

Re:On Which Planet?

[CrazedSanity]

... it allows all manner of insecure and misconfigured gear to avoid being probed from the other side of the planet...

Bravo! NAT absolutely does provide security features in exactly the way the parent described. To say that NAT does not provide security is like saying SSL does not provide security. Neither is the be-all-end-all of security to sure: NAT insulates broken network devices from the rest of the Internet, and SSL encrypts data to keep sensitive data from being readily used by malicious Internet users and devices.

Re:On Which Planet?

[CrazedSanity]

Don't be an idiot. You're talking about something that you apparently either have inadequate or no knowledge about.

Using NAT means devices cannot be directly connected to from the Internet unless rules are specifically put in place to allow it. Using a public IP address means the world has access to it by default. There is a HUGE difference. Make the presumption that something is behind a firewall doesn't make it so.

Re:On Which Planet?

[Bigjeff5]

Sure it does, they're not reachable from the Internet. How is that not helpful?

Actually, NAT is what makes it possible for a private address to interface with a public address and vice versa. They certainly are reachable from the Internet with NAT, that's the whole point of NAT.

You're confusing NAT with the built-in firewall that almost all NAT routers have, which hides the private addresses from the public. It is included because it is cheap to do a simple firewall, and the NAT device is a sensible place to put it as it is a single point of entry.

If you want to test this out, throw your privately-addressed computer on your router's DMZ (which is not under the protection of the internal firewall), and then record how many random hits from the internet you get. If what you say about NAT is true, you'll get none. I guarantee you will get a boatload.

Re:On Which Planet?

[Bigjeff5]

That's the firewall doing all the security in a NAT device. NAT itself facilitates connections between private and public addresses, by definition it makes the private addresses more accessible to the public. That's kinda the opposite of improving security, is it not? But we do it because it makes expansion cheaper, and actualy does provide a single gateway from which we can protect the private addresses.

That should not be confused with NAT providing security, it doesn't do anything of the kind.

Re:On Which Planet?

[CrazedSanity]

I think we're arguing semantics here. By placing a machine (or machines, or devices) behind a NAT firewall means they are implicitely NOT directly accessible to the Internet unless they are explicitely granted access. So if BrokenMachineX has port 22345 open and is expoitable, placing it behind a NAT-enabled router means things on the Internet won't be able to talk to them: the router will receive the request, but can't route it anywhere because it doesn't have any forwarding rules for that IP.

It is true that improperly setup NAT-enabled routers might put a device into the DMZ by default: if this happens to be BrokenMachineX, then port 22345 will be directly accessible to the Internet. Placing another machine/device on the network with the same problem will not be accessible, however, due to the nature of NAT. If BrokenMachineX *initiates* connections to something on the Internet, that machine can communicate with it.

By your own words you denote the ability to protect private addresses through the gateway. If you think I'm still wrong, explain yourself.

Re:On Which Planet?

[bill_mcgonigle]

Time for an example.

Port 1234 on device 192.168.4.99 has a remotely exploitable security hole. It's behind a shared-IP NAT (PAT in Cisco parlance). How does a cracker in N. Korea casually exploit it?

Re:On Which Planet?

[bill_mcgonigle]

The NAT device that my mother was using defaulted to automatically forwarding all inbound connections to the first machine to appear on the network.

What kind of device was it? I've worked with dozens and have never seen this setup, unless you configure a 'DMZ' port. Was it a DSL modem, perhaps? Some of them are just scary-awful.

A stateful firewall almost invariably has a default deny policy on the hostile side. Nothing outside can initiate a connection to anything inside unless you explicitly open the port. NAT has nothing to do with this. NAT is just address and port mapping. It's a mechanism. The policy is orthogonal.

Normal NAT setups are 1-to-many IP sharing and are configured as such even with one device behind it. A random inbound connection has no forward rule in place because an outbound connection was never made.

Re:On Which Planet?

[bill_mcgonigle]

Bah. You just gotta love that attitude.

It's terrible, yet it's pervasive.

First off, private addresses are NOT unroutable, they just happen to be dropped on their way through your ISP (if they do their job properly)

I drop them at my firewall too.

Just try a traceroute to a private address and see how far the trace gets. (And try it from a public traceroute server ;)

If a public traceroute server is tracing to a private block, it won't be my private block, but some other use of the same range.

Try putting a server on the other side of your beloved NAT and you might just discover that you can ping into your private network.

Most devices that do NAT would have to be specifically configured to allow this, by default they have an inbound deny rule. Even if they do, you've lowered your attack surface to things local to your ISP's router.

Second, even if this works as advertised it does not pose any great advantage over a stateful firewall.

Say I have 200 PC's behind a NAT box. Six of them have remote vulnerabilities. How can somebody in North Korea exploit those?

To the contrary, NAT not only tends to fuck up many L4 protocols

Quite true. That's not contrary to security, though, it's a separate problem.

but also introduces a complexity in address rewriting and therefore might introduce a whole bunch of security issues on its own.

That's plausible. Do you happen to know of any examples?

The third problem is the NAT admin's typical mentality ... which goes so against any security reasoning.

Quite so. But that doesn't mean NAT doesn't add to the total security.

Such an admin will then be horrified by the mere thought of having IPv6, since that would put all of his naked boxes right on the evil Internet without the condom of NAT, OMG!

And IPv6 has an abysmal adoption rate...

Most client boxes run absolutely no services (maybe ssh), even windows can have a great deal of its server capability disabled.

When you say 'most', Windows is usually what exists as 'most'.

Further, service exploits were the music of the early 2000's, by now almost all of the services can withstand direct exposure to the Internet (with the exception of silly newcomers)

That's not so. Nearly every month, on Patch Tuesday, Microsoft puts out a bulletin about new exploits available to remote unauthenticated users. Go check out the US CERT archive to see for yourself.

The real security threat comes from outbound connections, people going to nasty sites, or people going to legit sites (banks) with silly passwords, flipped staff, and so on and so on.

"A very large security threat". Absolutely. That doesn't mean remote exploits are no longer a problem. Check our your Snort logs - people don't just do that because they feel like wasting bandwidth.

Re:On Which Planet?

[swillden]

And port 1234 on the device at XXX:XX:XX::1 (a publicly-routable IPv6 address) has a remotely exploitable security hole. It's behind a cheap commercial Linksys router with a default-configured firewall which rejects inbound connections. How does a cracker in N. Korea casually exploit it?

Well, if the router config still has the default password, he logs into the router and modifies the firewall to allow access to what he wants.

Which is exactly the same situation if the Linksys is doing NAT.

Re:On Which Planet?

[bill_mcgonigle]

Well, if the router config still has the default password, he logs into the router and modifies the firewall to allow access to what he wants.

No, you can't log into a consumer-grade NAT/firewall via the public interface, you have to be on a local interface.

That's what milw0rm 9209 was about, an XSS exploit to avoid this most basic of protections.

Re:On Which Planet?

[phtpht]

I drop them at my firewall too.

If a public traceroute server is tracing to a private block, it won't be my private block, but some other use of the same range.

The point of that exercise is to see that not all of the routers are so vigilant. Plus there's things like source routing, ipip tunnels, and what not, all of those just begging you to abuse them. On some broadband/cable ISPs you can target your neighbor victim directly if you are lucky. Some time ago there was a presentation about hijacking cisco vpns (i can't remember more about it) ... point being that there are lots of unforseen ways to sneak into 'private address space'. A pure NAT router (without fw or source route checks) will just route packets to 10.0.0.0 like any other ones.

Most devices that do NAT would have to be specifically configured to allow this, by default they have an inbound deny rule. Even if they do, you've lowered your attack surface to things local to your ISP's router.

I don't know what is the status quo of today but about a year ago I was still seeing ISP's giving out routers will very sick defaults. Wifi-able ones with even criminally sick defaults. Want free 'net? Go to some apartment building and ride someone's well-NATed connection.

Say I have 200 PC's behind a NAT box. Six of them have remote vulnerabilities. How can somebody in North Korea exploit those?

Well he can try one of the hacks above, maybe he gets lucky. If not, then the packet was dropped, which is a work of a firewall, not a NAT. He will then proceed to zombifying one of your secretarys' boxes (or worse, one of your executives' laptops) and then pwn the target from there, because the internal network will be insecure and open. What you should do is to put all devices that can't defend on their own onto a separate network segment and place at least a very restrictive firewall between that network and the rest of the world, including your corporate internal network. If you've already done that, then good work! You don't need NAT anymore, except if your ISP is not willing to give you enough IP.

but also introduces a complexity in address rewriting and therefore might introduce a whole bunch of security issues on its own.

That's plausible. Do you happen to know of any examples?

Just google for 'nat vulnerability linux' for some. No piece of code is perfect and I would be very surprised if address rewriting ever worked flawlessly. In fact, Linux might be on the better side due to FLOSS, many commercial boxes might be even more emental-ish.

And of course the N:1 property alone of the NAT opens its own field of problems.

Quite so. But that doesn't mean NAT doesn't add to the total security.

It hardly does in the light of the hassle, the inherent issues, and potential can of worms effect.

Such an admin will then be horrified by the mere thought of having IPv6, since that would put all of his naked boxes right on the evil Internet without the condom of NAT, OMG!

And IPv6 has an abysmal adoption rate...

Well this is going to be a "me" comment; I have adoped as early as circa 2000 (I still got the ip6.int file from those days ;), and it hardly can be any problem today for a determined person. If your ISP sucks at IPv6, pick anoter one or dig a tunnel. Besides the original statement was not concerning IPv6 as such, but the fact that its implementation will expose the network to the 'net and thus drop any hopes for NAT being a security measure. North Korea can suddenly connect to your microwave, scary eh?

Actually there is one more common mentality problem here: "my OS supports ipv6, but i dont have ipv6 connectivity, so i need not bother with securing ipv6. right?" ... wrong. ;)

Most client

Re:On Which Planet?

[swillden]

Well, if the router config still has the default password, he logs into the router and modifies the firewall to allow access to what he wants.

No, you can't log into a consumer-grade NAT/firewall via the public interface, you have to be on a local interface.

That's not actually true. I have a Linksys router which does allow HTTPS connections from the outside to the configuration interface. Hopefully not by default; I don't recall.

In any case, how is this any different from a device of the same class that provides a stateless firewall without NAT?

It's the firewall that provides the security, not the NAT.

Re:On Which Planet?

[swillden]

So when my grandmother wants to add a network printer to her home network, instead of just plugging the thing in and printing, you want her to:

- Hope that her ISP is giving her a large enough block of addresses so she doesn't have to mess around with multiple subnets

- Find out what the ip for the device is

- Build firewall table rules to prevent outside access/add all the IP's of the other home devices to a whitelist

- Build routing tables so the traffic doesn't try to leave the network and traverse to the ISP

Don't be ridiculous.

Your grandma would just plug the thing in and it would work.

As far as the large-enough block of IPs, the smallest IPv6 block used for a subnet (even a "subnet" containing a single host) is a /64, meaning it contains 2^64 addresses. No worries about not having enough.

As for the rest, it would work exactly as NAT does now. Your NATed devices are not prevented from leaving the local network and reaching out to the Internet at large. What's not allowed is for something out in the world to initiate a connection to your device. Stateful inbound-blocking firewalls work exactly the same way. Connections from outside-in are rejected. Connections from inside-out are allowed. The only difference is that the router doesn't have to edit the source address and port.

But I guess if you really want your asshole ISP to control how users access each one of your internal devices, then so be it.

What would the ISP have to do with it?

We will see v6 (or 7, etc.) deployment eventually, but we will also see NAT stick around as well.

No, we won't. NAT offers absolutely no value for IPv6. It will die, and good riddance to bad rubbish.

Re:On Which Planet?

[sjames]

NO, NO, NO!!!!!

People who don't understand that honestly are not qualified to configure NAT or a firewall at all and should not have the authority to do so. Yes, that would be an awfully large percentage of the people who do those things.

Blocking inbound connections protects the those devices. For TCP it can even be done statelessly by disallowing inbound SYN packets (but allowing SYN ACK packets). NAT is just a dirty hack that just happens to also disable inbound connections.

But why?

[dn15]

It's just an academic question at this point, but why are all these new addresses neeeded?

Yes, I know NAT isn't a real solution for a shortage of addresses. But really, the vast majority of Internet-connected devices don't need a public address.

Home Internet connections, cell phones, etc. have no need for public addresses. Which begs the question, are these companies just being selfish in requesting so many more? I don't see any real legitimate need. And if this is the case, why are they still actually being given more?

Re:But why?

[tftp]

I'm so glad there are such great gurus who can tell us all which of our devices "need" to be able to talk to the outside world!

Actually, all your devices are, and will be, able to talk to the outside world. The debate is about the other direction - which of consumer devices need to be addressable by the outside world.

Also, there is nothing wrong in professionals debating general needs. It's not any more wrong than cooks discussing nutritional needs of a batallion of soldiers.

Re:But why?

[XanC]

NAT barely qualifies as being connected to the outside world.

Re:But why?

[tftp]

NAT barely qualifies as being connected to the outside world.

Fine, so *you* need a static IP (or several.) It's a free world, if you need something you can usually get it. Probably most people on /. need something like that because they know how to use those addresses. But most people don't, they wouldn't even notice if one day their DSL box issues them a 10.x.x.x address. Why would they worry - everything still works as it did before - their Interweb and their Skype, what else is there, after all?

Re:But why?

[TheRaven64]

cell phones, etc. have no need for public addresses

Don't they? They already have a public address; it's called the phone number. When we start using all-IP networks (which LTE requires) they will need a public address for SIP to work (not necessarily a public IP address, but that makes life a lot easier). And that's just for making calls. What about other push services? Why can't my laptop connect to my mobile phone whenever I edit my address book and sync the changes? Why can't my phone run an SMTP daemon and have emails pushed to it? My phone is currently NAT'd on the 10/8 subnet so none of these things work without ugly and unreliable hacks.

Re:But why?

[dn15]

That was exactly my thought with the original post. Unless you're a hardcore gamer (really most of the general population isn't) or your'e running a server (which probably violates your terms of service for your home DSL/cable connection anyway) you'd never even know the difference.

sonic.net

[YesIAmAScript]

They offer IPv6. It's tunneled as far as I can tell, but it's tunneled within their own network so it works well.

sonic.net is the best, you just can't get fast service from them in most places. Lucky for you one of the places you can get it is downtown San Francisco.

http://sonic.net/features/ipv6/

It'd be better if they supported native IPv6, but then again my home router doesn't support native IPv6 either (but it does support tunneling).

SSL burns up quite a bit of IP space as well

[DarthBart]

It used to be one IP per HTTP Vhost until named-based virtual hosting came along. You can't do that with SSL, though. When I worked at a major hosting provider, it was not uncommon for a single server to have 25-30 IPs on it to run a bunch of SSL vhosts.

Re:SSL burns up quite a bit of IP space as well

[VGPowerlord]

It used to be one IP per HTTP Vhost until named-based virtual hosting came along. You can't do that with SSL, though. When I worked at a major hosting provider, it was not uncommon for a single server to have 25-30 IPs on it to run a bunch of SSL vhosts.

The TLS protocol has support for name-based TLS virtual hosts. However, there's at least one major web server, whose name is the same as a Native American tribe, that doesn't properly support this out of the box.

Re:SSL burns up quite a bit of IP space as well

[gbjbaanb]

Apache is catching up - SNI support was committed to 2.2 in May. I just guess it'll take a while for this to filter out to all distros and then to server operators.

There's a good update on this blog

What overcrowding?

[hwyhobo]

...is like saying overcrowding of the planet can be mitigated by decreasing the size of houses.

There is no overcrowding of the planet. This is yet another specious argument created in hope that no one challenges it with facts. Have you seen the interiors of China, Africa, USA, Russia? They are EMPTY.

The only places that are overcrowded are coastal port areas, where people who make that argument tend to live.

It's the same with v4. Use it better, use it as port areas, and the interiors can be populated with non-routable addresses. I have heard the v6 song for the past 20 years. It's been Standards Track protocol for the past ten. It will be another ten before the first signs of wide spread public deployment are seen. The only things that might possibly accelerate it is mobile devices with public IPs, and even then it is not really a make-it-or-break-it issue, as it can be handled with dynamic private addresses from provider's pools.

idea: switch to alphanumeric

[Ralph Spoilsport]

So, an address might look like:

1h2.tyj.56j.0as

I think that would solve the problem permanently.

Re:idea: switch to alphanumeric

[mini me]

What would the benefit of that be over IPv6? You need 96 bits to store that address, compared to only 32 with IPv4. IPv6 uses 128 bit addresses, FWIW.

Re:idea: switch to alphanumeric

[ocip]

What a waste of bytes that would be.

Re:idea: switch to alphanumeric

[iphayd]

Yeah, you don't understand what the octets are, do you?

11000000.10101000.00000000.00000001. Now convert these into four base10 numbers. What do you end up with?

192.168.0.1

Now, if you convert to "alphanumeric" (I think you mean ascii) _every_ letter and number gets eight bits.
0011000101101000 0011001001110100 0111100101101010 0011010100110110 0110101000110000
  0110000101110011

Or, padding this with another two octet pairs of zeroes...

3274:796A:3536:6A30:6173::

And then you don't have to worry about those unwritable ascii codes either.

A subnet is a glass half empty

[Niobe]

As everyone known "in use" is a dubious term. The only subnets that I've ever seen fully occupied were /30's. Even my university has 2 class B's, where we could live with half of one - if we tried. Naturally this space is jealously guarded. Meanwhile, in India, entire campuses are being NAT'd to /28's Inefficient allocation are of course totally necessary when dealing with the prospects of future growth and variably-used DHCP pools, but I would be willing to wager at least 50% of the IPv4 space could be recovered if there was a serious effort at rationalisation - and that's ignoring the ridiculous situation of class A's.

Re:A subnet is a glass half empty

[TheRaven64]

And how much would that serious effort cost? At present, it's likely that the cost of upgrading all of the big routers to handle the much larger routing tables caused by vastly more /24s and the admin time compressing all of the existing allocations (including rewriting routing rules for all of the sites that use a /24 for each office) would be a lot more than the cost of making IPv6 available.

Re:Only a Few More Years' Worth of IPv4 Addresses.

[matlhDam]

Hardware vendors, software (non-desktop) vendors, registrars, etc.

Which hardware vendors are you thinking of? One of the ongoing problems with native IPv6 deployment is that effectively no consumer-level CPE supports it -- Cisco don't exactly make stuff for Joe Sixpack, after all. As an example, Internode have been the first ISP here in Australia to offer native IPv6 (on a trial basis for now), but have basically had to tell interested people not using newer Cisco routers to use bridge mode, which is decidedly sub-optimal.

Fundamentally, we are going to run out of IPv4 addresses, and as other posts in this thread have said, it's going to be pretty soon in some regions, such as the Asia-Pacific. We need to be planning for this now, not when it actually happens, and if it takes "vested interest groups" to make it happen, so be it.

The real answer...

[John Hasler]

...is to go back to UUCP bang addresses. Pathalias can handle routing.
--
ihnp4!stolaf!bungia!foundln!john

Re:The real answer...

[troll8901]

I don't know any of this. I'm surrendering my geek certificate (asymmetric) now.

You can access it by obtaining access through my 3 layers of NAT routing (Class /8, /16 and /24 private ranges on OpenWRT, Tomato and dd-wrt) to my DOS based BBS, then ride on the serial connection (E-7-1.5) to the PGP door... Peace of cake to all the Slashdotters out there!

base16 to base36 or whatever....

[AmigaHeretic]

I think he was refering to devices that only accept xxx.xxx.xxx.xxx as well has how it is sort of harder to remember/use/write down on a piece of paper an IPv6 compared to IPv4.

An IPv6 looks like:
3ffe:1900:4545:3:200:f8ff:fe21:67cf

What wants to write that down or try to "use" it.

xxx.xxx.xxx.xxx could posibly still be utilized of you didn't use base16.

Allowing 0123456789abcdefghijklmnop..... then you could still use the format xxx.xxx.xxx.xxx

I don't want to do the math, but what base would you need to be in to fit 2^128 into the space xxx.xxx.xxx.xxx ??

Re:base16 to base36 or whatever....

[tftp]

I don't want to do the math, but what base would you need to be in to fit 2^128 into the space xxx.xxx.xxx.xxx ??

I'm afraid it will be base 1626 if you must fit the 2^128 address into just 12 symbols. Chinese might be OK with that, though :-)

2^128 = 16^32 = 1626^12
128*log(2) = 32*log(16) = 12*log(1626)
base := 10^(128*log(2)/12)

Re:base16 to base36 or whatever....

[AmigaHeretic]

Your math looks good.

But yeah, there are over 80,000 chinese characters so they should be good to go.

http://chineseculture.about.com/library/symbol/blccbasics.htm

So in base 80,000 they should just need xxxx.xxxx

;-)

Re:Only a Few More Years' Worth of IPv4 Addresses.

[jimpop]

;-) I'm not opposed to IPv6, I just think it's important to point out that people have been crying the "we are going to run out" message for over a decade now. That's longer than people have been crying about SARS, H1N1, and Mad Cow disease combined. Yes there is a need for IPv6, but the over-hype has killed a lot of the interest. If CNN/FOX were to report on the exhaustion of IPv4 today, it would get 5 seconds in the 3am timeslot. People are tired of the IPv6 talk... get on with the technology already.

Re:Demand IPv6 and it will come

[JSBiff]

Or you could get a router which supports IPv6 *today* and use 6to4 to use a single public v4 address to address multiple IPv6 hosts on your network, and to talk to other IPv6 capable hosts. If you want a router that's ready out of the box, my understanding is that Apple's Airport routers support IPv6. If you don't mind a little bit of tinkering, you can get a router which is compatible with a third-party firmware replacement (such as OpenWRT, load OpenWRT on it, and use IPv6 (I just got a Linksys WRT54GL for $70 at Microcenter - it's a bit more expensive than some of the other 802.11g routers, but still not too bad - and I'm going to flash it sometime in the next week or two, as I get time).

Re:Only a Few More Years' Worth of IPv4 Addresses.

[Eil]

A decade ago, common houseplants weren't sending twitter updates to the Internet at large.

Router Advertisements

[Midnight Thunder]

In a good number of cases you don't even need DHCPv6. Router advertisements will do the reset. Basically the router announces the prefix it is using to the LAN and then the computers there will pair it with their own MAC address to create a unique IPv6 address. If you wish to control which computers on the subnet have access to the outside world, then just configure your firewall as necessary.

My Windows 2000 PC supported this 5 years ago and was able to connect to an IPv6 network this way.

I am not saying that router advertisements will solve all the problems, its will simply be good enough for most people.

Note there is a more recent specification for also announcing the DNS server via router advertisements too, though in most case it would probably a safe hack to assume "subnet prefix" + "::1" is the router which is also acting as DNS proxy.

It'll happen

[msimm]

It'll happen but not a second sooner then it absolutely has to. Think about it, if there's no driving force to roll out a new technology, as a company why would you? What's the return on a philosophic investment for a service provider? Customers don't want it, eventually they'll simply need it. Not to mention it's really a chicken/egg thing where early adopters (like the parent) will be tunneling anyway.

convergence

[el_tedward]

While it may not happen quite as quickly as people trying to get you to read their article or sell you new hardware want you to think, I don't see how we'll be able to put this off forever. Eventually, everything will get swallowed up by the internet. Your phone, your tv, your radio, you dog, and you house will ALL have their own IP addresses eventually.

Think of the adorable puppies!! How will the people of the future have adorable puppies if we don't migrate to IPv6?!!!?

Criticising is easy.

[anti-NAT]

Helping solve the problem is much harder.

Are you part of the problem, or part of the solution? If all you're willing to do is criticise, then I think you're part of the problem.

Re:Criticising is easy.

[amorsen]

It would have been fairly easy to repurpose the existing source routing IPv4 header as an IP address extension. That gives you 32 extra bits and you can do it more than once. If the end point you talk to doesn't send back the header, you fall back to traditional NAT.

It doesn't give you all the other benefits of IPv6, but those only really apply when you're IPv6-only, not dual stacked. And IPv6-only is a distant dream. Right now it just means you have to learn everything twice with subtle differences.

Public IP's for household appliances??

[freaker_TuC]

Name me one reason why household appliances, or even a phone, or your dog .. requires a direct IP address?

Why can't we put our second priority devices on a NAT network and save a bit of ip-space?

Now, It's dwelling with the faucet open without any good result at all...

Re:Public IP's for household appliances??

[el_tedward]

Well, it'd be a lot more fun giving my doggy it's own ip address than just putting it behind a NAT..

Re:Public IP's for household appliances??

[Hydroksyde]

Because the IP is only data in the packet header, and it's scarity is artificial, purely as a result of a design decision made in the late 1970s? And NAT breaks things.

Re:Public IP's for household appliances??

[freaker_TuC]

Will your doggy perform better under a public IP ? Strange canine ! :D

Re:recover unused/abandoned IP blocks

[tftp]

You clearly don't understand the way the Internet is supposed to work, which is as a bunch of peers, all able to communicate with each other.

That's how some people thought it should be. And Henry Ford thought that all cars must be painted black. And many people thought that Earth is the center of the Universe.

Guess what, they were wrong, for one reason or another. Internet indeed may have been envisioned as a fully connected graph, but today it is fairly clear that in most cases this is not required, and often the exact opposite is wanted. People are poor commons builders, but they are great at wall construction.

So it looks like endlessly repeating the "bunch of peers, all able to communicate with each other" mantra is nothing but appeal to authority. If you look deeper you will see that today there is very little substance in that claim. Internet technologies changed; we don't run an SMTP server on each host, we don't use 'talk' or 'finger', we don't FTP into each other's computers... we do it very differently, and in this new world full connectivity is required not any more than a dedicated FedEx airplane from every city to every other city.

Divided by technology?

[freaker_TuC]

OK, I could share that IP with my wife, but given the number of devices in between us, that won't really work.

Divided by technology?
Or what kind of devices are you referring to exactly ? *nudge nudge wink wink*

alphanumeric means errors

[freaker_TuC]

Why recreate the wheel if they already got ipv6 for that?

By using that approach of alphanumeric [a-z] you'll also get a lot more errors in spelling, O & 0, I & 1, ..
HEX solves that entirely by only allowing [0-F].

Re:alphanumeric means errors

[AmigaHeretic]

Well, if it was possible I don't think there would be any more mistakes than trying to enter 3ffe:1900:4545:3abc:2defa:f8ff:fe21:67cf ;-)

A few statistics

[jamyskis]

The population of the earth is 6.8 billion. There are just under 4 billion IPv4 addresses available. That means that, theoretically speaking, the Internet is doomed to failure because there aren't enough IPv4 addresses to go around.

BUT

About 80 % of the world's population live in poverty. They can't afford a bite to eat, let alone a PC with internet access. That leaves us with 850 million people.

Of those 850 million, around 25% are children with no internet access of their own. With 20% of the population being elderly (60+), let's assume that half are in care. So, minus 35%, that leaves us with roughly 550 million people. I'm not going to include technophobes or those incapable of using a PC for physical or mental reasons, nor am I going to go into the complexities of dynamic IP allocation, which applies for the vast majority of the lay population. A library or school, for example, despite having perhaps 100 computers, will only have one global fixed IP address. The local 192.168.*.* addresses obviously don't count as being usable. Let's also assume that the 180 million websites out there each have their own IP (I know this is not the case - many webspace providers simply allocate one fixed IP to several sites on their server)

That means theoretically that there would be enough IPs for everyone to have at least six of their own. So the question is: WHO THE FUCK HAS BEEN HOGGING ALL MY IP ADDRESSES?

Re:A few statistics

[TheRaven64]

Every subnet needs a broadcast address and a router address. That means that you lose two automatically. If you're allocating /8s then it's not many at all, but the scarcity means that you haven't been able to get anything bigger than a /24 for a while. This gives you 254 usable addresses but uses up 256 of the total allocation, so around 1% are used for infrastructure. Most of the time you can't exactly use a subnet. If you have three computers then you need 8 addresses; one for the router, one for the broadcast and three for the machines. One bit fewer and you only have 4 addresses, which is less than you need. This means that you are using 8 addresses for three usable ones.

Anything smaller than a /24 is going to impose huge strains on the backbones, so you won't see assignments smaller than that given to a site. That will then be subdivided if it's a data centre, so you're lucky if 50% of the assigned IPs actually corresponds to a machine.

Re:A few statistics

[gbjbaanb]

So the question is: WHO THE FUCK HAS BEEN HOGGING ALL MY IP ADDRESSES?

China and the Department of Defence.

I wonder how true this prediction really is ...

[freaker_TuC]

Is it like one of those "the web has to change" predictions which will be groundbreaking in 2009 ?

http://1997.webhistory.org/www.lists/www-talk.1994q2/0007.html if you want a reference ;)

Content providers need to get on IPv6

[adaviel]

A comment from an IPv6 workshop I attended last year, from (I think) Tata.com : content providers need to get on IPv6 else they will be left behind. As customers start to move to v6 (perhaps starting in Asia, but it doesn't really matter), any org that puts hurdles in the way of customers connecting at full speed is going to lose out.

Address scarcity predictions

[oojah]

I'm sure many of you have seen the IPv4 Address Report, which attempts to predict when the IANA and RIRs will exhaust the unallocated pool of IPv4 addresses.
I've been tracking the results of those daily predictions for a while now and since this time last year, they've moved further away by about 6 months. There are graphs online at http://atchoo.org/ipv4/
We're still roughly at the same place we were back when this was discussed in April (ARIN Letter Says Two More Years of IPv4).

Cheers,
Roger

Re:Address scarcity predictions

[TheSync]

It sounds more and more like "Peak Oil".

Sure, things might get dicey, but we could still be on IPv4 addresses for a very long time.

Re:Address scarcity predictions

[oojah]

Yes agreed, although it's a bit of a different situation of course given that we know exactly the limit on IPv4 addresses.

Based on a very quick hand drawn trend line fit to the last years predictions, they seem to be reducing at such a rate that they'll be predicting zero days until IANA exhaustion at around the middle of 2014.

Cheers,

Roger

Re:The first and foremost issue:

[JBird]

$ host -t AAAA google.com
google.com has IPv6 address 2001:4860:c004::68

Re:Only a Few More Years' Worth of IPv4 Addresses.

[KlaymenDK]

Only a Few More Years' Worth of IPv4 Addresses

They (vested interest groups) have been saying that for a decade now.... guess what, we haven't run out yet.

No, but still-untapped address pools are becoming harder and harder to access, needing ever longer pipes to reach them. Eventually, the return on investment is just going to be too small to be worth it.</bad analogy>

Re:Only a Few More Years' Worth of IPv4 Addresses.

[BriGal]

Exactly. I call Y2K on this.

but...

[Ginger Unicorn]

ONCE AND FOR ALL!!!

The problem is in the last 6 inches.

[pedestrian crossing]

Having read this thread this morning, I was walking down the aisle in the store and came across a shiny new "Cisco/LinkSys" wireless router.

I read every bit of text on the box, and while there was plenty of info about what OSs it is "compatible" with, there was not a single mention of whether or not it is IPv6 compatible. No hype == no adoption.

This is a big barrier, the little consumer-level device at the end of the wire.

Most people with DSL have the "modem/router" that their service provider provided with the connection. If that huge base of installed equipment isn't upgraded to IPv6 (and who is going to pay for it?), then IPv6 is a FAIL.

Native IPv6 connectivity, widely available

[xororand]

Some users insist that there's no way for consumers to get affordable native IPv6 at home. Consider this: http://www.sixxs.net/faq/connectivity/?faq=native
You can get native IPv6 DSL almost anywhere in Germany. I'm going to switch soon as well. Also more and more data centers provide native IPv6 at no additional cost as well because they're actually running out of IPv4 addresses already.

Embed OS

[DrYak]

There are billions of IPv4 gadgets out there, and some of them cost a lot.

All of them run some specific firmware to function. A huge proportion of modern IP-gizmos run some embed variation of the Linux kernel (very often the case in modems, routers, multimedia -harddisk enclosure / -players, and cheap SAN/NAS for Soho). This kernel DOES support IPv6. So for a lot of IP-enabled gizmos, the IPv6 support is only a firmware-flash away. Whether the constructor *will* actually release an upgrade is another question.
The open-source nature of most tools involved in such embed device also enables the end-users to attempt such upgrade (think OpenWRT and other user-made firmwares), although the proprietary user interfaces might not be able to configure it. (i.e.: you can reflash your home router to support IPv6, but when logging on http://192.168.1.1/ the original interface handles IPv4 configuration. The IPv6 has to be done on the console using SSH or Dropbear.

... except in the USA

[Skapare]

My home and work internet access providers, a major cable TV provider, and a major incumbent telco provider, both do not have native IPv6 available. This is in the USA, where we need some leadership to take action and mandate universal IPv6 access everywhere, with a timetable for government sites to be increasingly available ONLY via IPv6. Unfortunately, this country has lacked leadership for many presidential terms, and continues to have this issue.

Burn Baby Burn

[kieran]

IPv6 will not take off until there is stuff out there that people want to access that hasn't been able to get an IPv4 address.

Believe me, once that moment hits, IPv6 will become a differentiator and ISPs will race for it. Until then, they'll largely ignore it, because they can't justify the cost of setting it all up if no-one cares about it.

(I am an ISP Network Engineer)

IPv4.2

[binkzz]

Why not switch to IPv4.2?

i.e.: 9999.9999.9999.9999 instead of 9999.9999.9999.9999.9999.9999 or 255.255.255.255.

We'd have 9996000599960001 addresses, or 2327375 times as many as we do now, and the current addresses would still be valid and usable.

Re:IPv4.2

[Hydroksyde]

No. The address is stored in the header in binary 00010001 00110110 11110011 10101010 nnn.nnn.nnn.nnn is just a representation of this. An IPv6 Address it just a lot more binary 00010001 00110110 11110011 10101010 00010001 00110110 11110011 10101010 00010001 00110110 11110011 10101010 00010001 00110110 11110011 10101010

Re:No need to panic.

[geekmux]

Ah, nothing like a hot cup of sarcasm with a touch of irony to keep warm...

Nothing like repeating the same old "stupid liberal" cliches for the millionth time.

Er, much like the Nobel Prize selection process, my post was meant to be a joke.

Sometimes you just gotta laugh it off, especially when trying to cope with what Congress is doing to this Country.

Re:Demand IPv6 and it will come

[Agripa]

Do you know of any other routers that have IPv6 support from the vendor? I'm not really an apple guy, but if they're the only choice they're getting my support.

There are a couple of embedded x86 routers with BSD based m0n0wall installed and it has full IPv6 support. They tend to be just under $200 or higher though so I do not really consider them in the same class as the cheap consumer routers. Consumer routers hacked to run one of the Linux based WRT variants are probably the cheapest but I do not know of anybody selling them in that configuration.

Re:No need to panic.

[fm6]

I know it was a joke. A very tired, ill-informed joke.

But that's the thing..

[Junta]

In some scenarios, a pre-provisioning capable scheme is required for certain circumstances and that is ostensibly where DHCP should be able to fill the gap, but it is restricted here.

stateless autoconfig w/ mDNS for all service discovery was the original vision of all IPv6 (which still makes sense in many contexts).

dhcp was brought to ipv6 with the recognition that some circumstances for more central management exist.

Re:recover unused/abandoned IP blocks

[Hydroksyde]

in this new world full connectivity is required not any more than a dedicated FedEx airplane from every city to every other city.

No.

You still need to be as "fully connected" as you'd ever be, with IPv6, or IPv4 with NAT. The connections STILL PHYSICALLY EXIST. The only difference is what kind of data is sent over those ports... there's no real reason for any scarcity, save for an arbitrary technical decision made in the early days of the TCP/IP Protocol

A better analogy would be, because humanity hypothetically ran out of unique postal addresses, everyone in the city shares the same address (name, address, everything), and the postman decides where to deliver the letter based on a the number of small cuts in the side. Wouldn't it make more sense to add more fields to the address, say, a ZIP code?

This is, in effect what IPv6 is doing. Adding more data to the address.

Re:recover unused/abandoned IP blocks

[tftp]

there's no real reason for any scarcity, save for an arbitrary technical decision made in the early days of the TCP/IP Protocol

True; but that decision is so entrenched that it will take billions of dollars to switch to IPv6. And, as I believe, *most* customers will not see any benefit from doing so. Quite opposite will happen - the ISPs may start charging per host, since each host needs an IP and they are in control of the firewall (that will be in the DSL IPv6 router.) Today you can have a NAT and run whole house full of computers on one external IP.

So while I understand that, as you say, the physical links are already in place and do not need to be changed, the IPv6 transition will require massive, costly upgrades and will result in no new features for majority of home users. I leave "power users" alone - if you need a host to be on Internet, it's your decision. If you have several H.323 or SIP devices, you probably don't want a NAT. But an average home user, of which the USA has hundreds of millions, can't care less about things that you are so passionate about, and therefore will be reluctant to pay for something that only you need.

A better analogy would be, because humanity hypothetically ran out of unique postal addresses, everyone in the city shares the same address

Did you notice that in apartment buildings mailman does not deliver to each apartment? He instead dumps all packets at the router (mailboxes) on the ground floor, and subsequent delivery is done by the apartment dwellers themselves. That mailbox stand is a NAT. The mailman does not know who lives in the building, or where. He only knows his gateway by its street address. The little note "apt. #123" is for the final routing, just like a small cut on the side of the envelope, or like a TCP port number for a NAT. If you forget to write the apt. number the letter will be still delivered (and left on top of the mailbox;) but if you forget the street number the letter will be returned.

You've just cited my favorite address!

[freaker_TuC]

How can you read my mind that fast ? It has latency! :)

So where is your RFC?

[anti-NAT]

The IETF will happily accept individual Internet-Draft submissions for review. They'll publish them as RFCs if they have merit.

And this is the problem. These articles on Slashdot bring out all the people with "wonderful" ideas about how IPv6 is wrong, and how they'd have fixed it or done "better" instead. But as they say, "the proof is in the pudding", and these people never seem to be bothered even going into the kitchen, let alone trying to actually cook anything.

IPv6 is specified, has been implemented in most OSes and works. It may not be perfect, and may not be as widely deployed as it should be by now, but it's better than IPv4, and solves one of the fundamental problems IPv4 has (i.e. lack of address space), as well as incorporating a number of better ideas that were shown to be useful from the experience of IPX, Appletalk and IPv4.

IOW, I'm basically saying, you should have "put up or shut up", and as you and other "punters" here on Slashdot haven't put up ... well...

Re:So where is your RFC?

[amorsen]

It's way too late for that, and I only had the idea a few years ago -- once it became clear that IPv6 wasn't going to succeed in time.

Certainly it's a case of 20/20 hindsight; I'm not claiming that I could have foreseen this 10 or 20 years ago. I'm just rather sad that Carrier Grade NAT won.

ah the first ipv6 post of the year

[mjwalshe]

IPv4 has suposedly been running out soon for the last fracking decade or so - and WTF does President Obama have to do with this

Re:... 'leadership' in the USA

[bstender]

correction, the USA does not lack leadership, it is a surfeit of leadership that is causing the problem you mention. we just need a good ol' fascist govt. to get the trains to run on time.

The Future of Deja Vu

[hicksw]

1. Linux on the desktop
2. Exhaustion of ipv4 address space
3. Duke Nukem Forever

Warning: date order may differ in your universe
--
Let's make another big bang so we can test it.

Future may be somewhat difficult to predict

[hicksw]

Why is the word "asymptotic" absent from these recurring screamfests?