There Is No Plan B, the Ugly Transition To IPv6

An anonymous reader writes "The Internet is running out of IPv4 addresses — not at some point in the future, but right now. But the only solution to the problem, IPv6, is just now really starting to be deployed. That's why we're all in for some tough times ahead."

Comments

Reclaim Some?

[d0nster]

Maybe we should reclaim some of AOL's massive block of addresses. It would help a little in the short run. And they sure aren't using them.

Re:Reclaim Some?

[Darth_brooks]

kidding aside, I'd be interested to know what the actual Class A block utilization numbers look like.

Re:Reclaim Some?

[Carewolf]

kidding aside, I'd be interested to know what the actual Class A block utilization numbers look like.

True, that is obligatory. Map of the Internet

Re:Reclaim Some?

[ElectricTurtle]

Well, if it helps any, xkcd has a map of who controls various blocks (across classes).

Re:Reclaim Some?

[Joce640k]

Here you go...

And here...

Re:Reclaim Some?

[Eunuchswear]

The short run is a couple of months.

Hardly worth it.

Re:Reclaim Some?

[kaptink]

I've wondered why this hasnt been done sooner. There are some relatively small groups out there with class A blocks (16.7m) still. Make those who own these blocks justify their use. I believe back when the internet was just a wee bub, IP addresses were handed out to anyone who wanted them. And some companies just took huge chunks.

Have a look at this list for starters http://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks or http://abhishek.nagar.me/content/class-ip-address-and-owners

Some organizations, such as Stanford University, formerly using 36.0.0.0/8, have returned their allocated block to assist in the delay of the exhaustion of addresses. Perhaps some others could follow in their steps.

Re:Reclaim Some?

[jon787]

ICANN considered this option, but decided that it didn't extend the deadline out far enough to be worth the costs.

http://blog.icann.org/2008/02/recovering-ipv4-address-space/

Re:Reclaim Some?

[commodore64_love]

>>>they sure aren't using them.

AOL now has more subscribers in 2010 than they did in 2000. And I'm one of them (Netscape ISP at $7/month). Not sure where you got the idea they are using less IPs than before??? Your comment kinda reminds me of those who say "analog television frequencies aren't being used any more". And then they suggest using them for cellular phones/internet. But the reality is that those frequencies ARE being used: By digital television (channels 2-51) and Emergency Radio (52-59) and cellphones (60-69)(approximately). Every inch of space is assigned.

Just because you BELIEVE something is no longer in use, doesn't mean it's true :-)

Oh and as for the IPv4 to IPv6 transition, it probably won't be a big deal. The government got all excited and bothered over the analog-to-digital transition, and it went off just fine. There were a few problems with people for forgot to upgrade their antennas from small to large, but those were quickly ironed out.

Re:Reclaim Some?

[Anpheus]

At the rate that we're exhausting addresses, even if it were possibly to schedule and reclaim more than one Class A a month, we'd only be postponing the inevitable... by about a month.

And that assumes you can move all of their infrastructure off their class A in that time, maybe when your team gets around to dealing with , you realize it could take a year long migration.

Yeah, that'll work.

Re:Reclaim Some?

[LurkerXXX]

Your comment kinda reminds me of those who say "analog television frequencies aren't being used any more". And then they suggest using them for cellular phones/internet. But the reality is that those frequencies ARE being used: By digital television (channels 2-51) and Emergency Radio (52-59) and cellphones (60-69)(approximately). Every inch of space is assigned.

Umm, NO. Thin slices of the same spectrum are being used by digital TVs. LOTS of the space, though not contiguous, are not being used by it. That's why the FCC is going to allow others to use that unused 'white space' between the thin slices used by digital TV btoadcasts.

http://www.dailytech.com/article.aspx?newsid=14497

Not nearly every bit of the spectrum is being used, or assigned.

Re:Reclaim Some?

[commodore64_love]

>>>cellphones (60-69)(approximately).

Correction:

cellphones (60-83)

Re:Reclaim Some?

[Sir_Lewk]

AOL now has more subscribers in 2010 than they did in 2000. And I'm one of them

This explains... so much.

Re:Reclaim Some?

[GigsVT]

Nothing is inevitable.

There's an unlimited number of IPv4 addresses out there.

Every organization has an entire class A to exploit: 10.0.0.0/8

Re:Reclaim Some?

[mysidia]

It gives you a few more months to find more ways to delay the runout by a few months.

As long as you are fast enough at finding new ways at extending the runout a few months at a time, you may delay the runout for years, or indefinitely.

Re:Reclaim Some?

[Anonymous Coward]

It's probably just not worth the trouble. I looked at the rate of /8 allocations: over the past 10 years, we've allocated an average of 8 /8s per year to the RIRs. That means clawing back a Class A will buy us about 45 days. It's probably just not worth the trouble to get an extra 45 days.

Re:Reclaim Some?

[JWSmythe]

Every cybernetic soldier needs an IP. How else are they going to communicate with their command nodes? You didn't think the CNC nodes were invented by spambot authors, did you?

    Here at Sirius Cybernetics Corporation, we take great pride in the advancement of our own programs, regardless of the impact on others. Some people would consider our Aperture Science artificial intelligence program a failure, but we have proven that our EI's (Electronic Intelligence) can perform better than their fleshy counterparts.

    Our Global Cybernetic Soldier Program (estimated launch Q4 2012) will be the most significant advancement in technology ever.

    For more information you can read more about our status at scc.mil, assuming you have the appropriate clearance and implant.

Re:Reclaim Some?

[Compaqt]

IPv6 scary stories: geek horror movie pr()n

Re:Reclaim Some?

[troon]

Seriously why do 3/4ths of these companies even have /8 addresses? do every one of their workstations in the company have a publicly routable address on them?

Ford certainly use addresses in their 19.0.0.0/8 space for employee workstations, even though none of those machines is accessible from outside.

Re:Reclaim Some?

[CarpetShark]

I've wondered why this hasnt been done sooner.

Because we're only now getting hungry and desperate enough to in-fight and point fingers over the stringy remains of IPv4.

Re:Reclaim Some?

[SamSim]

There are two major reasons why this almost certainly won't happen. The first reason is that at the current rate of use this would delay IPv4 exhaustion by only a few months to a year.

The second is that for an organisation to claim such a large block of addresses, it must have done so relatively early in history. That probably means the organisation is a technology group or another organisation which has had a vested interest in the internet for a very long time. Over those decades, there's a good chance that the organisation has swelled up to make maximum use of its assigned address spaces, and rearranging its network and systems for greater efficiency would be a mammoth undertaking for relatively little gain (see above).

Re:Reclaim Some?

[Joce640k]

To be fair, I spent those four minutes looking for the second link in my post...

Re:Reclaim Some?

[Anonymous Coward]

That is a 2006 map. So it's out of date. But first, the outright errors:

Top right block? Instead of green grass it ought to be missing. There is no way to use that space for anything, because it was marked as class D experimental space and so various devices (including old Windows PCs) exist which won't believe such addresses are Unicast. No way to fix that in reasonable time.

10 is green on the map. But it's reserved. The lack of _public_ addresses in 10/8 is necessary in order for them to work as _private_ addresses, so we can never allocate these publicly.

Now onto the updates:

77-79 marked "unused"? Not any more.

The green area (172 upward) in the bottom right? A few islands are left, but the vast majority is now earmarked, and a lot is already in active use.

The grass around "North America" in the bottom part of the map is depleted, but some is still there. The 92-95 lump sticking into "Europe" is all used though, as is all the stuff toward "Asia-Pacific" from 112 and up.

Today there are 14 of those grassy square blocks left to allocate. There are 5 RIRs (ARIN, RIPE, APNIC, AfriNIC, LANIC) and they'll each get one last block no matter what, as a sort of "farewell, and good luck". So there are nine blocks left before that happens. Typically 2-3 are assigned at a time. So we may be only three more assignments away from Exhaustion. It could happen in six months, or nine, but it won't be years.

Re:Reclaim Some?

[mcornelius]

Umm, to extend your metaphor: to control the bleeding on the way to the E.R.

Re:Reclaim Some?

[Abcd1234]

I've wondered why this hasnt been done sooner. There are some relatively small groups out there with class A blocks (16.7m) still.

Because:

1) There's no process for doing clawbacks,
2) It would be horribly expensive for those networks to renumber,
3) It would put off exhaustion by, at most a year, maybe two if you're lucky, and so the effort simply isn't worth it.

Re:Reclaim Some?

[geekoid]

"which thanks to compression looks as fast as 500k DSL"

hahaha, no.

Re:Reclaim Some?

[Gerald]

4) It's Just Not Fair. Why should Ford, Apple, and HP be forced to give their /8s back when Level 3 and AT&T get to keep and resell theirs?

Re:Reclaim Some?

[commodore64_love]

>>>hahaha, no.

hahaha, yes. If a webpage takes 10 seconds to load on my home DSL, and 10 seconds to load on Compressed Dialup, that means the dialup "looks" as fast as the DSL. - The reason why it's faster is because HTML/text is compressed to 5% original size and images are compressed to 10% original size. Sure the images look like crap but so what? They're mostly junk ads anyway.

Re:Reclaim Some?

[Hylandr]

As a matter of semantics, AOL is *not* an ISP. They are a web portal your ISP gives you access to.

- Dan.

Re:Reclaim Some?

[Beorytis]

Maybe we should reclaim some of AOL's massive block of addresses.

How about instead we reclaim some of the (many more) addresses assigned to the US Department of Defense?

Re:Reclaim Some?

[Znork]

To be fair, if corporations using 'real' IP addresses without allowing connectivity to them from the internet were forced to return them (ie, everyone using non-local addresses for office networks behind firewalls), we might stretch it out a bit longer. You wouldn't even have to actually schedule any migration; if the addresses do all their accesses through proxies anyway it would be possible, if slightly nasty, to simply appropriate the address ranges and let the companies deal (via protocol gateway infrastructure or by switching to local addresses instead). The actual breakage would be limited.

Of course, it would probably be less painful for them to switch to ipv6, which would also solve integration issues during mergers and simplify things internally when ip shortage creates problems there as well.

Still, with the level of organizational head-in-sand behaviour I've noticed, I expect that's what it's going to take. A call from ARIN to corporate network departments saying 'gee, we can't ping anything in your assigned range; obviously you're not using it so next Monday someone else is getting it, kthx.' might actually kick some momentum into some places where it's sorely needed.

Re:Reclaim Some?

[bberens]

My company (another household name) had internet routable addresses for all workstations up until about a year or two ago. Dunno if they gave up their IP block when they changed that or not.

Re:Reclaim Some?

[ooshna]

"They've never screwed me over, so I never felt the need to drop them."

An AOL customer that they never screwed over some how is like a unicorn. Sure its a pretty idea but they are not real. If you have been an AOL customer that long then you went through the 90's hell of trying to connect but the lines were jammed then praying that once you actually connected you didn't get booted off. Plus that means you were probably a member of AOL Highspeed or whatever it is called. $20 a month to check your email using whatever dsl or cable connection you pay for on top of AOL.

Re:Reclaim Some?

[Beorytis]

Well, sure, but AOL's addresses would be a gauze pad and the DOD's would be a tourniquet.

Re:Reclaim Some?

[Anonymous Coward]

Why not just link to the 45 other places you've posted the list? I've seen this same conversation with you 25 times. You know what? I hope they do take away your fucking TV. I hope you turn it on one day, and nothing is there. I hope you sit there and stare at a blank screen (not even snow to look at - they took that from you too already, didn't they?). I smile as I think of your simple whimpering as you paw in futility at the TV. Your only friend...gone...gone...

Gone.

Please shut the fuck up about your god damn antenna TV. No one cares. Get bittorrent, get cable, whatever.

Re:Reclaim Some?

[zelbinion]

...and remember: DEC had a class A block. Compaq bought DEC, and then HP bought Compaq, so HP now owns TWO Class A blocks.

Re:Reclaim Some?

[Provocateur]

We can't. There is a hook in those scripts that will automatically mail you 10 more AOL CD's. For your friends.

Re:Reclaim Some?

[d0nster]

I think the definition of "subscriber" has changed since 2000. Back then, AOL was mainly an ISP. Now, they do search, ads, IM, internet radio, etc., but few still use them as an ISP. If you look at their site, they only offer dial-up service. By your (unsourced) count, there are more dial-up users on AOL now than there were in 2000. I'm calling BS. I can't see them needing an entire class A subnet anyway. The only reason they have one is that they were around during the beginning of the commercialized internet and have never given any of it back.

Re:Reclaim Some?

[mikael_j]

Actually, there are fewer available blocks than are seen in that one, they're being assigned a lot faster than it's possible to reclaim the few that are possible to reclaim.

Re:Reclaim Some?

[mikael_j]

You do realize that the very same page is also compressed when using DSL, right? Or do you mean you use some kind of proxy service which does lossy compression on all images? Well, then it's still not gonna give you the same user experience as a DSL connection which is ten times faster.

There is no way a 56k or slower modem "looks as fast as 500k DSL".

Re:Reclaim Some?

[Kadin2048]

You have no leverage to force companies to do that. The original Class A allocations were not made under the same terms that modern allocations are made under (where you're basically being loaned the addresses). They really own them, in the sense that anyone can own something that doesn't really exist.

Migrating them off of those addresses would be expensive. Who's going to pay for that? Unless they're going to be compensated for their effort I can't imagine they're going to be really interested.

Plus, as time goes on, those addresses are going to be valuable. People sitting on those old allocations might as well be sitting on gold mines. Why would they want to give them away?

Re:Reclaim Some?

[mikael_j]

Please, this is the start of a wonderfully annoying argument that pops up every time the anti-IPv6 crowd decides that it's new and scary.

NAT is not the solution to this problem, it is an ugly stopgap hack.

Re:Reclaim Some?

[Z00L00K]

Depends on where in the world you are.

Re:Reclaim Some?

[Z00L00K]

The worst problem is that the ISP:s doesn't seem to get their collective butts out of the wagon to do some work on IPv6, not even offering it as a test. (OK, a few select ISP:s do, but the great mass doesn't.)

The day that Facebook, Google or some other service offers better service if you go in via IPv6 then people will start asking their ISP:s about it.

Another issue is all those home firewalls that are IPv4 only and some of them having a hard time with that...

Re:Reclaim Some?

[commodore64_love]

I don't remember ever encountering a busy signal. Of course during that time period (mid-90s) I mostly used the college internet in my dorm, and the AOL at home sat mostly idle so I may have been lucky enough to avoid the busy signals.

My bill circa 2000 was $15 a month, which was about as cheap as you could get back then. Later-on AOL told me about their "new" Netscape ISP for $7, so I took advantage of the bargain. Then about three years ago I got DSL for $15.

Re:Reclaim Some?

[Nutria]

images are compressed to 10% original size.

The vast majority of images are already (compressed) JPG. If they could be compressed another 90% (which they can't be!) then everyone would do it and 500kbps would still seem faster than 50kbps dial-up.

Re:Reclaim Some?

[commodore64_love]

What do you call these then? They look like ISPs to me:

http://free.aol.com/thenewaol/plan_choice.adp
http://www.getnetscape.com/ (AOL owns Netscape ISP)

Re:Reclaim Some?

[Kadin2048]

Because presumably they have no interest in giving them back?

Re:Reclaim Some?

[wirez-wildhack]

I got shit canned by University of Chicago Hospitals for threatening to report their network manager, Tony Rubino to ARIN for misuse of their multiple class B address space. As the SOP, they use public address space on workstations that do not have internet access. RFC1918 address space would have been more appropriate here. Their utilization, as seen by the outside internet, is less than 1%. Last laugh will be on them when they are effectively forced to deploy IPv6 (or RFC1918 space for that matter) in the future. It's great, as a network engineer, to be able to say, "I TOLD YOU SO!" Many of these large companies, like Ford and IBM do the same thing as U of C Hospitals. I've worked for Ford and IBM as well in the past and the mindset is all ego based. One Ford engineer told me "We're too big to have ARIN take back space." Push is coming to shove and in 2011 I expect ARIN to be auditing and scrutinizing companies a lot closer on their RFC2050 compliance as outlined in the ARIN IP usage/utilization agreement. Just my two cents worth.

Re:Reclaim Some?

[commodore64_love]

>>>there are more dial-up users on AOL now than there were in 2000. I'm calling BS

It isn't BS. A lot of people bought computers during the 2000s, and lacking high speed internet (like my friend in Uniontown PA), they signed-on to AOL and other Dialup providers. So the total number of Dialup users went UP since 2000. Now there has been a downward trend the last 2-3 years, but overall there were still twice as many dialup customers in 2009 as existed in 2000.

Re:Reclaim Some?

[Drinking Bleach]

Sure, pretty everyone with IPv6 has huge swaths of address space. Take for example, a 6to4 address of 2002:1234:4567::/48. You've got 1,208,925,819,614,629,174,706,176 addresses to use for your one IPv4 connection, all machines directly accessible over IPv6. That's just for a single IPv4 link; the IPv6 address space is *huge*, shortage is not going to happen any time soon.

Re:Reclaim Some?

[TMarvelous]

AOL now has more subscribers in 2010 than they did in 2000.

No they don't! http://en.wikipedia.org/wiki/File:Aol_subscribers_Q201-Q407.png

Re:Reclaim Some?

[ElKry]

Woah, I wish they could get the wonders of compression to work with DSL and cable, too.

Re:Reclaim Some?

[TemporalBeing]

And I'm one of them (Netscape ISP at $7/month)

Wow you're actually paying them? Last I used AOL and their subsidaries (Netscape ISP, CompServ, etc.) I didn't pay at all. Signed up for the trial, then when I tried to close the account they kept extending the free period. I finally got them to close it, but not after about 4-6 months of extensions. Just keep calling back every 30 days.

Or did they fix their system so that their operators are not afraid to close accounts any more?

Re:Reclaim Some?

[TemporalBeing]

As a matter of semantics, AOL is *not* an ISP. They are a web portal your ISP gives you access to.

AOL is in fact an ISP. They still operate their dial-up modem ISP business. However, at the same time they also offer a pricey web-portal that either (i) you can pay for each month, or (ii) ISPs can contract use of so that their customers don't have to pay each month. That does not negate their dial-up modem ISP business though.

Re:Reclaim Some?

[arcsimm]

AOL now has more subscribers in 2010 than they did in 2000. And I'm one of them (Netscape ISP at $7/month).

ME TOO!!

Sorry, had to be done.

Re:Reclaim Some?

[profplump]

There are good reasons to do that.

There are good reasons to do that even ignoring all the "it is sometimes useful to have a real, end-to-end network connection" bit.

Here's one that I've actual had problems with. Company A needs a LAN-LAN VPN with company B. Company A and company B are both using the same RFC-1918 address space. Who gets to renumber their network to make this connection work? The answer is often "neither, but instead we have to setup some NAT and/or proxy service to pretend we have non-1918 addresses", which then A) actually consumes the addresses anyway, B) makes access controls about 6 times harder, and C) requires actually setting up the proxy and/or NAT system in addition to the tunnel and access controls.

Or perhaps a more common one -- company A buys company B and wants to merge their networks. If everyone was just using real addresses in the first place this would be a trivial task. If they're both using the same RFC-1918 space however, it means one end *must* renumber to accommodate the other.

Re:Reclaim Some?

[Danathar]

Because it's in the public good, it's an issue of fairness..........[sarcasm]

Re:Reclaim Some?

[Unequivocal]

Thanks - you are correct and OP is wrong about availability in terms of usage. OP is generally right that most of the spectrum is allocated tho (barring the white space you cite, which is not a large fraction).

To address this, in the National Broadband Plan the FCC recommended holding a kind of auction to sell off unused digital TV spectrum. The idea is to consolidate the used spectrum down to the bottom and clear up a nice swatch of spectrum up top for new data comms services.

The idea is to share revenue with the current spectrum license holders in the auction to incent them to give up the spectrum they aren't using..

White House announced a little while back that they support this plan so it may actually be attempted..

Re:Reclaim Some?

[Unequivocal]

No you should tether your phone to your laptop and get 700k+ service that way. Assuming you have a smart phone with an unlimited data plan which I assume you do b/c you travel a lot for business (and if you don't try sinking that $7/mo plus another $23 into a data plan and discover the joys of not looking for an rj-11 jack to get online).

Re:Reclaim Some?

[JWSmythe]

    I think he's referring to compression on the proxy, before it's sent down the line to him. I had some cell provider several years ago, whose bundled software automatically set the browsers proxy server to their server. It was awful. Most pictures came through so overcompressed that you couldn't make out what it was suppose to be. What was worse was that when I plugged the laptop back into the regular network, the proxy server changes stuck. So my pages were still ugly, and they still took forever to download. As it turns out, they over use their proxy server, so it's slow no matter what. :) I guess if he's in the same situation, it would appear to be the same experience either way.

Re:Reclaim Some?

[profplump]

For the 1000th time, it is possible to form an internet without being directly connected to the Internet, and any time you do that you need address coordination. When all your networks are internal it's plausible to do that in RFC-1918 space. But as soon as you introduce the possibility of an outside entity, it's much, much easier to use your guaranteed-to-be-globally-unique IP address than hope that every organization on your network agrees about who should have which addresses.

Or consider this situation -- *your* local network is not directly connected to the Internet, but you subscribe to a service that requires a LAN-LAN connection and *their* computer are connected to the Internet. Let's say they sell this same service to more than one customer. Does it really seem unreasonable that they want all of their LAN-LAN connections to be globally routable, or to use real IP addresses to make that happen?

Re:Reclaim Some?

[commodore64_love]

>>>lossy compression on all images?

yes

>>>Well, then it's still not gonna give you the same user experience as DSL

Now you're just being anal. All I care about is that instead of waiting 2 minutes to load via normal dialup, my compressed service loads in 10 seconds. Same apparent speed as home DSL line.

 

Re:Reclaim Some?

[vtcodger]

***and images are compressed to 10% original size.***

Hmmm! is the image compression programmable? I'm thinking in terms of 0.1% of the original size.

I know, I know, that won't work because (expletive deleted) web page designers use images where anyone with a functioning brain would use a button or text. But I can dream, can't I.

Re:Reclaim Some?

[Unequivocal]

Agreed - but the article (i read it!) makes an interesting observation about IPv6 NAT. So far standards groups don't want to touch it b/c it's "ugly" or something. It seems to me that NAT'ing IPv6 would make it much easier to plug wide stretches of IPv6 into the IPv4 world? At least providing some basic cross-over services that are missing today according to the article?

Re:Reclaim Some?

[bobv-pillars-net]

Share and enjoy!

Re:Reclaim Some?

[GigsVT]

Judging by your sig, you seem to dislike practical solutions that don't meet your aesthetic standards.

Re:Reclaim Some?

[commodore64_love]

>>>Woah, I wish they could get the wonders of compression to work with DSL and cable, too.

Try Opera Turbo
Same thing.
Although they only compress images to 50% original size (instead of 10%), so the speed increase won't be as dramatic.

Re:Reclaim Some?

[vtcodger]

I suspect the basic problem is that IPv6 looks like a huge bundle of grief to a lot of seasoned IT people. Frankly, the failure to make it interoperable with IPv4 and the lack of NAT would make me really, really nervous if I were managing a network and cared about my users.

I think plan B is to sit back and watch what happens to the early adopters. If they come back riddled with arrows, then you somehow contrive to keep your IPv4 working for a few more years while those who are young, brave, and have the strength of ten because of their pure hearts clear out most of the hostiles.

Re:Reclaim Some?

[Anpheus]

Daily assignment rates from the regional registries are approaching 600,000 to 700,000. That's 600,000 a day. 600,000 * 30 is around 18,000,000. A Class A is under 16,777,216 viable addresses. So yes, we're exhausting a class A a month. So even if we could get every business that owns a Class A to transition, and we could get them to transition over a period of six months, and we got them all to agree to it today, we'd be extending the lifetime of IPv4 by maybe a couple years. A lot of those Class As are owned by the DOD, and they aren't giving those up. Several more are owned by ISPs, and you can bet they're actually using those. MIT is actually using their Class A, although I don't know how much. I believe they actually take the proactive, anti-NATing approach with their IPs. That is, they assign public IPs to machines on their network, but rely on routers with stateful firewalls for network security.

So even if the most optimistic estimate of reclaiming class As gives us a few years, what do you propose we do by the year 2020? Start squeezing the people that own Class Bs for even smaller amounts of addresses?

Re:Reclaim Some?

[burgeralarm]

> They've never screwed me over, so I never felt the need to drop them.

You mean, you've never felt the need to drop them, so they've never screwed you over. =)

Re:Reclaim Some?

[wirez-wildhack]

In your scenario where Company A buys Company B, all you need to do is identify resources that require two-way tcp communication and NAT private-to-private IP space. This is actually what Cisco recommends on their website as one of the practical applications for NAT. Problem solved, you don't need unique IPv4 space to make this happen, all you need is NAT. In the perfect world, we would have longer address space to start, but who could have ever imagined the proliferation of IP. Like Vincent Cerf's T-shirt he sells that says "IP on everything" is really the truth these days. With that said, we should do our best to conserve IPv4 space where it is practical to do so. 95% of a business day-to-day activities don't require workstations to have public IP addresses. The few that do, legitimate exceptions can be made. If everyone followed the rules in RFC2050, we wouldn't be in this mess today. This is simply the reality. No need to flame war -- it is what it is. The question is, how are we going to react to the situation to improve it for everyone?

Re:Reclaim Some?

[compro01]

ARIN has nothing on Ford's or IBM's (or HP for that matter) blocks. Those addresses were assigned directly from IANA before the RIRs even existed and thus ARIN's policies don't mean anything.

Re:Reclaim Some?

[commodore64_love]

>>>the FCC recommended holding a kind of auction to sell off unused digital TV spectrum

Already done as part of the 1996 Telecommunications Act. The FCC sold off (actually rented) unused channels (52 through 69) for a couple million dollars to ATT, Verizon, and other major megacorps. They took possession of the space on June 13 2009. The FCC also reserved some of the space for Police/Fire/Emergency radio.

The National Broadband Plan discusses removing channels 25 and up, but that won't happen until after we have *another* transition from MPEG2 to MPEG4 converter boxes. i.e. Circa 2020.

There's always some kind of transition going on.
- Like when Macs moved from 68000 series to PowerPC.
- Or when IBM PCs moved from 16 to 32 bit.
- Or when AM Radio moved to AM Stereo (and now: AM HD).
- And from Year 99 dates to Year 2000 dates.

The changeover can be complicated but it usually works out okay. I bet IPv4 to IPv6 will barely be noticed by the average user.

Re:Reclaim Some?

[Hylandr]

Offering Internet access through a Dialup service would indeed qualify as an ISP. However, being a web portal does not. I am amazed however, that they still offer POTS service... I haven't received a floppy or CD in years.

Re:Reclaim Some?

[commodore64_love]

>>>Hmmm! is the image compression programmable? I'm thinking in terms of 0.1% of the original size.

That would be cool. And yes it is programmable, but the only "allowed" settings in AOL/netscape's software are 10%, 20%, 30%, 40%, and 50%. Oh and 100% (i.e. no image compression). At 10% most images are already shrunk to 1K, so you wouldn't gain much additional benefit anyway. What you probably need is something like Opera Browser which only loads images if you click on them.

It's always interesting visiting a porn site with the image compression turned on.
It make the girls look like "paint by number" drawings instead of photographs.

Re:Reclaim Some?

[Glendale2x]

Many of these large companies, like Ford and IBM do the same thing as U of C Hospitals. I've worked for Ford and IBM as well in the past and the mindset is all ego based. One Ford engineer told me "We're too big to have ARIN take back space." Push is coming to shove and in 2011 I expect ARIN to be auditing and scrutinizing companies a lot closer on their RFC2050 compliance as outlined in the ARIN IP usage/utilization agreement.

They are correct.

ARIN has no authority over any legacy holders (like Ford). These legacy holders also have no need to follow any utilization requirements - nor are they subject to auditing - unless they were to want to request additional space from ARIN, which they won't. They essentially have a free pass unless they voluntarily return space or sign the LRSA. It doesn't matter how big or small you are. You could have a legacy /24 and still be free from ARIN policy.

Re:Reclaim Some?

[mikael_j]

... And every home user doesn't need a public IP. And every desktop in your enterprise doesn't need a public IP. Q1 2010, Verizon reported 3.6 million FiOS Internet customers. [vzw.com] Comcast reports 14.4 million high speed (not dialup) Internet customers. The majority of those customers don't need public IP's, nor do they even know what to do with them.

The way the internet is meant to work pretty much requires their addresses to be globally routable but these days we have a bunch of hacks in various layers to deal with the lack of available globally routable addresses. And it's not going to get better five or ten years from now.

I believe the routers that they're already transiting to reach the Internet at large is also capable of NAT. Assuming full utilization of their address space, that's greater than a single /8. More than likely they are operating at 50% to 80% of their address space.

Who are "they"? The end user? The ISPs?

There are lots of ways to manage IPv4. The drive to IPv6 isn't a drive. It's a haphazard stumble towards a new standard. The problem is, it isn't a standard. Most providers haven't purchased their IPv6 blocks. Even if I, Joe Provider, bought myself a nice fat IPv6 block, my upstream providers aren't routing IPv6 yet. Common web sites are not advertising their IPv6 address, because it will cause non-IPv6 users to hang until the invalid address times out. google.com does not have an AAAA record. ipv6.l.google.com does. slashdot.org doesn't have an AAAA record, nor do they appear to have any subdomains for it. Why? Probably because their upstream provider doesn't support it yet.

Plenty of medium to large ISPs use IPv6 in their networks, they just don't offer it to residential or basic business customers, sometimes you have to pay extra, sometimes you have to sign a piece of paper stating that you understand that your SLA doesn't cover the IPv6 part of the connection...

As for google.com, that's something Google did on purpose since there are so many machines out there stuck on misconfigured networks that would otherwise try to reach the IPv6 address even though they don't actually have IPv6 access (I've worked for an ISP like this, they announced IPv6 on the network but didn't actually route traffic, completely retarded but they were happy just telling tech support to inform customers that they needed to "disable IPv6 since it's incompatible with the regular internet").

The Internet works, because all parties from Point A to Point B agree on how the network is suppose to work. They've invested countless billions of dollars in their hardware. Sure, there's been a lot of IPv6 capable hardware out there for a while, but that doesn't mean that any of them have done anything at all with it. There's been some spot testing, but nothing wide spread, like on the entire Internet.

There are actually lots of IPv6 users, but we're still the minority. The main problem is that people have been pointing out that we need to migrate to IPv6 for 15 years or so now but managers and incompetent sysadmins without foresight have stubbornly refused with arguments along the lines of "Oh, we don't need IPv6 support now, and we'll write this hardware off in three years, then we'll see what the situation is like". And five years later they're complaining about how they don't want to replace said hardware...

Re:Reclaim Some?

[commodore64_love]

Wow. An Anonymous Coward actually said something insightful. BTW V.92 is the same as the old V.90 56k standard most of us used in the late 90s, but it added some new features. Like increased speed. 56/48k instead of the old 56/33k.

Uuuugh. The ignorance, it burns.

Much of the issue with slow page loading on modems comes latency, and the problem that causes with the 100s of TCP connections and sometimes dozens of DNS lookups required to fully pull down a page.. It's a lot of setup and teardown and a lot of overhead. If you're able to do all that on the server side with nice fat pipe and then pack it in to a nice optimized compressed stream (while piling on some extra lossy compression for images too), then yes web page viewing on a modem is perfectly bearable.

Like V.92, you don't hear about it much because it didn't become available until the broadband revolution really took off

Re:Reclaim Some?

[Znork]

The original Class A allocations were not made under the same terms that modern allocations are made under

How long and in to which range? It's not merely the original allocations, there are a lot of companies using public addresses for what are effectively not public networks.

And in the case of IP addresses, I'm not sure I'd trust any such 'ownership' in a crunch; the ownership of an address is dependent on everyone elses willingness to route (or fail to route, in the case of unavailable allocated networks) those packets.

Migrating them off of those addresses would be expensive.

Who cares? Reusing their IP addresses for the real internet basically doesn't affect them if their network is blocked off anyway. Sure they wouldn't be able to access anything on the outside with those IP addresses (unless they modify their gateway infrastructure), but considering any new owner of the address would otherwise be just as unreachable to them on IPv6 space, they have little to complain about. If they eventually want to migrate, that's up to them, their problem, their cost.

Plus, as time goes on, those addresses are going to be valuable.

Mmm, about as valuable as my collection of 5 1/4 inch floppies. IPv6 ain't exactly rocket science, and there really isn't much but sheer inertia and the lack of abject necessity that's slowing adoption. Once the tipping point is reached and we get v6 only services and/or customers, then we'll get the whole 'why didn't anyone plan for this!' whines and five years of emergency implementation projects run by a whole lot of consultants with no experience at all.

Yay. It'll be even funnier than y2k..

Re:Reclaim Some?

[icebraining]

... And every home user doesn't need a public IP. And every desktop in your enterprise doesn't need a public IP. Q1 2010, Verizon reported 3.6 million FiOS Internet customers. Comcast reports 14.4 million high speed (not dialup) Internet customers. The majority of those customers don't need public IP's, nor do they even know what to do with them.

Yes, we do. NAT is a major blocking factor in the development of distributed P2P software - and I'm not only talking about uTorrent, but apps like Spotify, Joost, Skype, SwarmPlayer and dozens of others. Not to mention software important for free speech and prevention of censorship like Freenet and Tor.

Just because common users won't be installing Apache or Postfix doesn't mean they don't benefit from the possibilities that a public IP provides.

So what's the answer? Optimize utilization of the IPv4 space, and maybe we'll get another 10 years or so out of it. And this time do a serious migration towards IPv6. Or hey, we can all scream "the sky is falling, adopt IPv6 today!" and just look stupid when yet another "IPv4 is exhausted" deadline comes and goes without the entire world collapsing into a panic.

And companies will procrastinate^W "rationally manage resources" for another 10 years and then we'll be in the same situation as now. People have been warning about the IPv4 depletion for more than 10 years, we didn't just found out about it.

Re:Reclaim Some?

[Nutria]

Actually you can compress JPG further, and my Dialup ISP does it (converts a 50K jpeg to 5K).

If my ISP were to on-the-fly hack down the size and resolution of the images I'm requesting, then I'd crawl thru the wires and beat them mercilessly.

Just as I squeeze MPG episodes of Penn&Teller down to 10 megabyte size for emailing friends.

Now it's obvious that you're not bright enough to split big files into pieces.

It's all relative to how much quality you are willing to sacrifice.

If the web site wanted their videos to be 320x240 at 10fps then they'd have made them that way in the first place.

Re:Reclaim Some?

[cynyr]

but will happen, think mars + that new planet with life on it*

unconfirmed but 100% :P

Re:Reclaim Some?

[maxwell demon]

Well, the article says we will run out of addresses in 2012. Which means IPv4 is enough until the end of the world. What more do you want? :-)

Re:Reclaim Some?

[petermgreen]

If they could be compressed another 90% (which they can't be!)
Depends how much quality the provider is willing to throw away. According to wikipedia a JPEG Q=1 image is about 10 times smaller than a JPEG Q=50 image.

http://en.wikipedia.org/wiki/Jpeg#Sample_photographs

Re:Reclaim Some?

[maxwell demon]

Do you see any open channels?

Since you showed those which a re not open, of course not. :-)
But from your list, channel 9 seems to be open. I don't know if channel 1 is supposed to exist, but it would make sense, so that would be open as well. There's of course no way to tell from your list if there are open channels after 51.

Re:Reclaim Some?

[choongiri]

Sure they can be, with a loss of quality. Since the grandparent says the images "look like crap", I would assume there's some proxy server in there, shrinking the image dimensions and ramping the jpg compression up to the max. It's fairly simple to do.

The best application of this sort of tech is, of course, messing with neighbours stealing your wireless.

http://www.ex-parrot.com/pete/upside-down-ternet.html

Re:Reclaim Some?

[Cramer]

Based on the DMA listings, there are no markets with 48 broadcasters. Also, the FCC will not (read: actively avoids) assigning neighboring channels within the same market/region to avoid interference. Please tell us which DMA you are listing, and include the call signs of those 48 stations.

Re:Reclaim Some?

[imbaczek]

never had to make a vpn between two companies, right? things like vnc repeaters wouldn't be needed anymore.

Re:Reclaim Some?

[Nutria]

Since the grandparent says the images "look like crap"

I missed that part. So, yeah, you're probably right about the proxy.

Re:Reclaim Some?

[RedHat Rocky]

"images are compressed to 10% original size."

That's not compression, that's alteration. Big difference.

Re:Reclaim Some?

[thejynxed]

That list would be pointless, as OTA DTV transmissions ignore any arbitrary boundaries shown on maps, just like the analog transmissions did. I can pick up channels from as far away as Maryland, Delaware, eastern New York (think NYC), Canada, western Ohio, etc. depending upon time of day and weather conditions, and I live in northwestern Pennsylvania. I can actually pick up more Canadian transmissions than American ones, sadly.

Outside of southern California, the mid-Atlantic region is more densely packed than anywhere else in the Northern Hemisphere. There is overlap, etc constantly, no matter what the FCC wants.

Re:Reclaim Some?

[Darth_brooks]

I guess my point was: HP, Ford, IBM, Apple, etc have class A's. What percentage of those IP's are really being used? Have they sublet out addresses? Something tells me that even the biggest of the Fortune 50 aren't going to find a way to use all 16 million addresses.

I guess the motto of the coming IP address depression will be "Brother can you spare a masking bit?"

Re:Reclaim Some?

[treeves]

$500/year?
Verizon - unlimited data plan: $29.99/month approx= $360/year.

Re:Reclaim Some?

[Unequivocal]

FYI - here's the press release on the topic of broadband auctions by the White House recently: http://www.whitehouse.gov/the-press-office/fact-sheet-doubling-amount-commercial-spectrum-unleash-innovative-potential-wireles

You may know more than I do, but I've talked with FCC economists and they never mentioned holding off on this auction until 2020. They seem to think they can reallocate spectrum today and make it work..

Re:Reclaim Some?

[Creepy]

well the US Department of Defense USAIC has two as well, and if you count the Network Information Center Blocks as well, they have 11 altogether. Sure the Internet was built off of DARPANET, but they pig more IPs than anyone.

Re:Reclaim Some?

[Creepy]

actually, from a network standpoint it is quite easy to set up IPv6 and IPv4 if you have a router that supports it (and most modern ones do - you just plug it in at the DNS and run IPv4 and IPv6 daemons) and my web site would and did support it, but when I changed ISPs to qwest from speakeasy (for financial reasons - it is about $70/month cheaper), I got stuck with IPv4 only, so this is an ISP issue - no excuses.

I'd love to use brackets in my browser addresses again (brackets tell the browser to use IPv6)- unless I want to surf privately, that is (like NAT at a coffee shop). The problem is, qwest owns a huge block of IPv4 addresses, so they don't really have a pressing need to set up and support IPv6 and I'm sure they won't until someone else leads the way - that company is a market follower - when competitors move in and smoke them in some area, they react, but not before (which is why their internet speeds have always lagged behind Comcast and generally other DSL competitors, but the only real remaining DSL competitor in my market, Covad, is just as bad).

Re:Reclaim Some?

[commodore64_love]

9 isn't open - that was a typo. But even if it was open, TV band/whitespace devices can't use the VHF Band. Channel 1 was assigned to police radio in the 1940s. Channel 52 and up were sold off in 2008 to ATT, Verizon, and others for cellphones.

Re:Reclaim Some?

[commodore64_love]

>>>Based on the DMA listings, there are no markets with 48 broadcasters.

Well except for the market where I live - DC, Baltimore, York, and Philadelphia which were divided into 4 pieces by Nielsen, but are really the same place (I can see all four).

Re:Reclaim Some?

[commodore64_love]

>>>They seem to think they can reallocate spectrum today

They're wrong. As the press release says, "Make available 500 MHz of Federal and commercial spectrum over the next 10 years to foster investment". i.e. Not immediately. In order to sell off "unused digital TV spectrum", they FIRST have to remove the TV stations from channels 26-51 and reassign them someplace else. That process will take about ten years +/- a year or two.

Remember it took 12 years to move from analog to digital. These transitions don't happen overnight. Neither will this "squeezing" of TV from 50 downto 25 channels.

Re:Reclaim Some?

[Unequivocal]

I see what you're saying - I originally thought you were saying the auctions couldn't happen until 2020. Agree that the full transition wouldn't happen until around that time.. Apologies for confusion.

Re:Reclaim Some?

[TekPolitik]

AOL now has more subscribers in 2010 than they did in 2000. And I'm one of them

Who is the other?

Re:Reclaim Some?

[commodore64_love]

>>>include the call signs of those 48 stations.

Good grief. What a pain in the ass. Fine! Here's a quick list that I will type off in a hurry, and if I make any typos, too bad. OH AND WHY is it that you keep posting as anonymous coward instead of using your actual user ID? Protecting your karma I suppose.

37 - reserved to radioastronomy
19/20 - reserved to police/emergency radio
2-13 - unusable by TV Band/whitespace devices but the stations currently occupying this band include: wzpa, wiav, wpvi, wjla, wwjt, wgal, wbph, whtm, wbal/wbre (overlapping stations), whyy, wyou, wjz

14-51 (notice there are no open channels for using TVBDs)
wtsd/
wfdc/
wmjf/
wphl/
w18bc/
whp/
wboc/
wnjs/
wlyh/
w24cs/
wpsj/
wtve/
wgtw/
kyw/
wfpa/
wuvp/
wmpb/
wgcb/
wppx/
wpsg/
wzpa/
wcau/
wpxw/
wybe/
wttg/
wdca/
witf/
wmar/
wpha/
wlvt/
wnuv/
w40az/
wutb/
wnai/
wvia/
wtxf/
wpmt/
wmcn/
wolf/
well/
wbff/
wfmz/
wpmt/
wgal/
wnep/
wdcw/
wgal(repeater)

Re:Reclaim Some?

[Cramer]

That's not how airspace is licensed by the FCC. Yes, with the correct conditions, you can get SW signals from the other side of the planet. That's not the point. Any OTA station is licensed for a specific radiated power to reach a certain distance. 2 stations 50 miles apart will NOT be given the same channel.

Re:Reclaim Some?

[Cramer]

OH AND WHY is it that you keep posting as anonymous coward instead of using your actual user ID?

Get your eyes checked. My UID is right there. ('tho sometimes clicking links in email fails to send the login cookie.)

Re:Reclaim Some?

[fatphil]

"Mmm, about as valuable as my collection of 5 1/4 inch floppies."

Imagine how valuable *these* will be: http://fatphil.org/how_floppy.jpg

I'm going to be rich, I tell you! :-D

Re:Reclaim Some?

[bdbr]

You looked too far back! For the past few years IANA has allocated about 12 /8s per year, and that is growing (they allocated 14 /8s in the first seven months of this year). People forget that IP addresses are used for a lot of things besides desktops. Ford is used as an example below...well, most factories today use IP-based tools. Shutdown every factory in Ford for a week or so, and you're looking at about $2 billion in lost revenue (plus a ton of administrative costs), for a /8 that will delay IPv4 exhaustion by two weeks.

Re:Reclaim Some?

[theaveng]

$40 is what Cricket charges me.
In about 4 months that Verizon unlimited plan will become $30 for only 200 megabytes (if I recall correctly).
Dialup does over 12,000 per month.

Re:Reclaim Some?

[theaveng]

Actually you can compress JPG further, and my Dialup ISP does it (converts a 50K jpeg to 5K).

If my ISP were to on-the-fly hack down the size and resolution of the images I'm requesting, then I'd crawl thru the wires and beat them mercilessly.

Or... you could just turn off the compression.

Now it's obvious that you're not bright enough to split big files into pieces.

That's backwards. If his friends are anything like my friends, they would know what to do with a multi-piece RAR file. They wouldn't be able to reintegrate the 4 or 5 pieces back into one MPG file.

Re:Reclaim Some?

[theaveng]

FIXED:

"Actually you can compress JPG further, and my Dialup ISP does it (converts a 50K jpeg to 5K)."

If my ISP were to on-the-fly hack down the size and resolution of the images I'm requesting, then I'd crawl thru the wires and beat them mercilessly.

Or... you could just turn off the compression.

Now it's obvious that you're not bright enough to split big files into pieces.

That's backwards. If his friends are anything like my friends, they would NOT know what to do with a multi-piece RAR file. They wouldn't be able to reintegrate the 4 or 5 pieces back into one MPG file. That's why I too send just one file - squeezed to fit inside yousendit.com's 100MB limit.

Re:Reclaim Some?

[Nutria]

If his friends are anything like my friends, they would NOT know what to do with a multi-piece RAR file. They wouldn't be able to reintegrate the 4 or 5 pieces back into one MPG file.

They can't follow simple directions?

Re:Reclaim Some?

[Sir_Lewk]

Personally I'm just baffled that there are still hotels without free wifi. Where in the world do you find those?

Re:Reclaim Some?

[sr180]

Almost all of the more expensive hotels. Ive travelled all of Asia Pacific, and spend $200 a night on a hotel, and you'll be spending an extra $30 a night for internet. (Usually with speeds of around 500k.)

The cheaper hotels often provide free internet. Ive found this to be true in the US as well. My work doesnt stick me in the cheaper hotels.

Re:Reclaim Some?

[sr180]

Yes, we do. NAT is a major blocking factor in the development of distributed P2P software - and I'm not only talking about uTorrent, but apps like Spotify, Joost, Skype, SwarmPlayer and dozens of others.

Not true about Skype. Skype only exists because of NAT. If it wasnt for NAT it would be alot easier to simply SIP call each other directly, and Skype and its network would never be required.

Re:Reclaim Some?

[AK Marc]

Purposefully rejecting valid emails is a bad idea. Greylisting is horrible. And not for any aesthetic reasons. NAT broke all properly designed VPNs and videoconferencing at the time. Many many other standards have had to be re-written to hobble along through NAT. And then, we got NAT routers who claim "firewalls" because NAT doesn't, by default, let connections through the other way. Is it better security than no NAT? Yes. But not at all a firewall.

Oh, and are there any other old timers who still think there's a difference between NAT and PAT? It's all downhill after Cisco started calling PAT NAT overload.

Re:Reclaim Some?

[pipedwho]

The problem is that some of the machines on those Class A (and B) allocations aren't just sitting dormant on non-routable endpoints. They also happen to be spread around the internet in various sub-allocations that have been given to / shared with affiliated companies.

Any effort to forceably 'take back' those allocations would cause unpredictable routing issues around the internet - making those addresses extremely unreliable. And that is completely ignoring the enormous disruptions that would take place while said organisations attempted to transition to a new IP address range.

If the transition could be done in under a year or two, I'd be surprised. And as has been posted in many other previous comments, it would only buy an extra month or two before a full reclaimed Class A would then itself be exhausted.

At this point, large scale effort should not be wasted on dead-end strategies, when the same resources could be used to migrate towards IPv6.

Re:Reclaim Some?

[Candyban]

Speaking as a sysadmin: STOP SENDING EMAILS WITH SO FSCKING BIG ATTACHMENTS. Setup an FTP/HTTP server and send the link in the email. (Preferably public FTP and put me in CC)

Re:Reclaim Some?

[dave420]

Why do all those computers need public IP addresses? Do office printers, or every VM, need a public IP? I highly doubt it.

Re:Reclaim Some?

[Jello B.]

score: 5 obligatory

Re:Reclaim Some?

[icebraining]

Skype relies on some of the nodes being promoted to supernodes, and supernodes need to be reachable, hence no NAT. Sure, it needs less unNATed nodes than SIP, but it stills needs some.

Re:Reclaim Some?

[commodore64_love]

>>>>>I'm one of those AOL subscribers
>>
>>This explains... so much.

HAHA. Funny. ;-) But seriously: When I'm on business travel and stuck in hotels, I don't have access to my home's hghspeed internet. So instead I use my laptop to connect to AOL's Netscape Dialup. It works well and only costs $7/month. Plus it includes test/html/image compression so a webpage loads just as fast as 500k DSL (about 10 seconds).

L8r

Re:Reclaim Some?

[commodore64_love]

In my experience the only hotels that give away "free" anything, also cost over $50 a night so they aren't really providing free service - it's included in the high rate.

I typically stay at the budget hotels that are $30 or less, and they charge for the extras like internet or long distance calls or laundry. Example: Last Motel 6 I stayed wanted to charge $3/day or $90/month. Now there was one place I stayed that gave me free Cable internet ($10 extra per week), but then the manager got fired for doing that. The new manager tried to charge me retroactively but I got angry so he let me continue on the freebie plan.

In any case free internet is not usual. They provide a free hookup for 56k (the phone line) and that's it.

Re:Reclaim Some?

[AmiMoJo]

Actually there are lossless improvements that can be made to JPEG:

http://en.wikipedia.org/wiki/JPEG#Lossless_further_compression

We need to get the standard updated.

Re:Reclaim Some?

[commodore64_love]

>>>2 stations 50 miles apart will NOT be given the same channel.

Even 2 stations 100 miles apart will not be given the same channel. And that's the problem here in the Midatlantic and Northeast. Because all the cities are so close together, every channel from 2 through 51 is occupied by a station with no room for new TV programs, or TV Band/whitespace Devices. (See my list of call latters below.)

Oh it's also worth noting that this area is labeled the "Canadian border zone" by the FCC. That shorthand means the stations must cooperate with Canada, otherwise their stations could interfere with our stations, and vice-versa.

Re:Reclaim Some?

[commodore64_love]

10 megabytes is not big.

And the 100 MB yousendit.com service the other guy mentioned doesn't send the file through the actual email - it just sends a downloadable weblink.

Re:Reclaim Some?

[commodore64_love]

Mr. AC is flat wrong. The study claims Trenton NJ has 30% open channels.
But the official FCC Whitelist only has *2* channels open. i.e. A mere 4%.
So go ahead and cite flawed studies if you wish, but they don't strengthen your case.

Re:Reclaim Some?

[commodore64_love]

Ooops. Put the 4 in the wrong place:

The study claims Trenton NJ has 30% open channels. But the official FCC Whitelist only has *4* channels open. i.e. A mere 8%. So go ahead and cite flawed studies if you wish, but they won't strengthen your case. So if we adjust all your other numbers by that same "error factor" (30/8==3.75) we get:

Juneau, Alaska 20% (free channels:10)
Honolulu, Hawaii 18% (free channels:9)
Phoenix, Arizona 12% (free channels:6)
Boston, Massachusetts 10% (free channels:5)
Dallas-Ft. Worth, Texas 12% (free channels:6)
San Francisco, California 10% (free channels:5)
and so on.

Re:Reclaim Some?

[commodore64_love]

>>>You do realize that the very same page is also compressed when using DSL, right?

Wrong. My DSL does not make images look like this:
http://en.wikipedia.org/wiki/File:JPEG_example_JPG_RIP_001.jpg

Re:Reclaim Some?

[commodore64_love]

hahahahahahahaha

They barely know how to operate the DTV converter box on top of their television. Or "click on the movie file to make it play". That's the extent of their abilities. No way could they handle the 5-6 steps required to install WinRAR, gather all the RAR pieces in one spot, unRAR them, and then use the MPG file.

Re:Reclaim Some?

[Nutria]

hahahahahahahaha

Yeah, I guess I know some like that too.

That's the extent of their abilities.

Should they be allowed to have PCs? (Yes, I'm elitist.)

Re:Reclaim Some?

[commodore64_love]

>>>That's not compression, that's alteration.

By that logic when you buy a DVD or Bluray, you're not watching a movie. You're watching an "altie" or altered version of the movie.

Re:Reclaim Some?

[mikael_j]

Wow, double troll points for you.

How about you try actually reading beyond the first sentence?

Why didn't somebody tell us?

[Anonymous Coward]

What? We're running out of IPv4 addresses? Why are we only learning this NOW? This is an outrage! Why haven't tech sites told us about this problem sooner...say, several times a year?

Re:Why didn't somebody tell us?

[catmistake]

What? We're running out of IPv4 addresses? Why are we only learning this NOW? This is an outrage! Why haven't tech sites told us about this problem sooner...say, several times a year?

LOL Sarcasm aside... wouldn't it be better not to tell anyone? Just let them... how do I say this... movie metaphors might help... like letting them remain asleep inside the Matrix, or Inception style, dreaming inside their dream, or IPv6 is "oh, this is the real party" from Brain Candy. Then the NEW IPv6 Internet could be Flash-free! No more click fraud on pr0n sites! Just think of it!

Re:Why didn't somebody tell us?

[SmurfButcher Bob]

Damn those irresponsible zero-day announcements!

They should arrest those people that told everyone we're running out of these addresses. Now all the bad guys know, too!

Re:Why didn't somebody tell us?

[houghi]

Yeah, like they did about the year 2000 problem.

Re:Why didn't somebody tell us?

[Existential Wombat]

Well at least we're not running out of oil.

Article invalid

[drinkypoo]

Article invalid: Author considers NAT to be a security mechanism, and specifically cites Windows ICS as the example... I've personally had Windows machines owned by infected machines on the same segment.

Re:Article invalid

[arndawg]

blablablabla. i99% of the times, NAT is in conjunction with a stateful firewall. That's why people say NAT = FIREWALLED.

Re:Article invalid

[jra]

It *is* a security mechanism: you can't Ping Of Death a machine that doesn't have a routable address from the public Internet.

That doesn't say it's a *sufficient* security mechanism for any specific threat, but saying simply that it is *not* one is ignorant.

Re:Article invalid

[jeffmeden]

NAT is insecure only if the machine operating the NAT is insecure. A host running a NAT with sufficient hardness/dumbness will shield the interior machines from any sort of inbound attack; the fact that they are unaddressable from the outside is as secure as you can get without unplugging. An attacker on the inside is a different story but that attack vector would exist with or without an internet in the first place.

Cue the "oh but there are insecure browsers/email/cellphones/whatever" crowd in 3, 2, 1...

Re:Article invalid

[drinkypoo]

blablablabla. i99% of the times, NAT is in conjunction with a stateful firewall. That's why people say NAT = FIREWALLED.

And yet, if you RTFA (I know, I must be new here) he talks about how dropping NAT led to having to use a firewall.

Windows ICS NAT never saved anybody. The machine which would be compromised is behind another system of the same or similar OS and vulnerabilities.

Re:Article invalid

[aliquis]

Nah you just ping the address you know and the machine behind that one still get borked.

Great.

I doubt OMGYOUCAN'TPINGME is the greatest benefit.

Re:Article invalid

[aliquis]

NAT is insecure only if the machine operating the NAT is insecure.

I locked my NAT machine inside a bunker and hooked up my Macbook Pro through WIFI outside and now it's stolen.

Re:Article invalid

[jeffmeden]

Yeah but the OS was intrusion free when it got nicked, wasn't it?

Re:Article invalid

[zlogic]

That's about as stupid as locking the keys inside your car to prevent someone from stealing them from your pocket.

Re:Article invalid

[Ephemeriis]

blablablabla. i99% of the times, NAT is in conjunction with a stateful firewall. That's why people say NAT = FIREWALLED.

So if shoes are normally encountered in the presence of socks, shoes are the same as socks?

Seems a little lazy to me...

Regardless, NAT is not a security mechanism. It is not the equivalent of a firewall. And removing NAT will not prevent you from putting in a firewall.

Re:Article invalid

[MightyMartian]

That's only if you're redirecting ICMP packets. I don't know of too many people who do that on machines behind NAT firewalls, and the only time I ever did it was while working for a small ISP that had clients on a NATed proprietary wireless network who wanted a public static IP with all the fixings. I certainly wouldn't do it as a rule of thumb, leaving the dealing with such attacks to the firewall.

Re:Article invalid

[aliquis]

Yeah but the OS was intrusion free when it got nicked, wasn't it?

Yeah, lucky me! ;D

Kinda like everyone claiming OS X and Linux is so secure because you don't use them as root.

Never mind someone can wipe all your data. Atleast your OS is safe! ;D

I'd rather host a DDoS zombie than have my data ruined :)

And still I don't do backups ;D

Hurray for me!

Re:Article invalid

[Zero__Kelvin]

Following your line of reasoning, you can't shoot me if I am 3000 miles away, making it completely ignorant to claim that "air" isn't a security mechanism.

Re:Article invalid

[xaxa]

Article is invalid because half of it's bollocks.

Re:Article invalid

[julesh]

That doesn't say it's a *sufficient* security mechanism for any specific threat, but saying simply that it is *not* one is ignorant.

Well, yes, but the fact that the sufficient security mechanism that you would use to fill in the gaps in the protection it allows (i.e. a host-based firewall) will also fix any problems gained by having your internal network globally addressable renders the point kind-of-moot.

Re:Article invalid

[drinkypoo]

Well, yes, but the fact that the sufficient security mechanism that you would use to fill in the gaps in the protection it allows (i.e. a host-based firewall) will also fix any problems gained by having your internal network globally addressable renders the point kind-of-moot.

Not only the host-based firewall, but also the border firewall which simply refuses to route any packets to a host unless it's been specifically asked to do so. This security-related side benefit of NAT is a critical part of any network security plan in any case; further, no security plan which depends on NAT to provide this function is complete, because you cannot foresee future port forwarding rules which may compromise security. Stripping routing and utilizing a default drop policy is the only means to "ensure" that unwanted packets do not reach their destinations. I think we have all seen attacks against IP stacks.

Re:Article invalid

[somersault]

When I read the article I got the impression he said that NAT turned out to have the side effect of increased security for Windows machines, rather than it being done on purpose.

Re:Article invalid

[Hatta]

You can't Ping of Death a machine that's behind a stateful firewall that's dropping ICMP packets either. Every bit of security you get from NAT can be done with a firewall without fundamentally breaking the peer to peer structure of TCP/IP. Claiming that NAT is a security mechanism is ignorant. NAT adds *nothing* a properly configured firewall does not already do.

Re:Article invalid

[jthill]

He calls it "marketable" and says "applications can work around that pretty easily".

Re:Article invalid

[aliquis]

had clients on a NATed proprietary wireless network who wanted a public static IP

Say what?

That's only if you're redirecting ICMP packets.

Doesn't matter. I doubt it's processing power from accepting the packages which is the issue but rather network bandwidth.

Feel free to drop the packages either on the machine in question without using NAT or at the machine running NAT. In either case they will be sent, to somewhere, and will steal your bandwidth until they are blocked at some point. If you drop them at the NAT machine then they have already taken bandwidth to that location.
If you have say a 100 mbps connection how does dropping the packages at the NAT machine instead of whatever machine you usually have behind the NAT machine make any difference? You will still have limited traffic.

Of course you can move the block to somewhere else between you and the machines sending the ICMPs but then the NAT or no NAT doesn't matter either.

I assumed you weren't responding to them in either case. And if you where in one case but not the other then it's still not NAT solving anything. Not replying doesn't solve everything.

Re:Article invalid

[aliquis]

for a small ISP that had clients on a NATed proprietary wireless network who wanted a public static IP

Or in the name of Xzibit:
We put a NAT in your NAT so you can be public while you don't!

Re:Article invalid

[aix tom]

Actually, for a *network* an air gap was quite a good security mechanism, until they decided to build wireless in everything and the toaster.

Re:Article invalid

[vadim_t]

No, the security is exactly the same.

With a NAT, if you open any ports, it forwards the packets to the host behind it. So if you forwarded something exploitable, you get absolutely zero protection.
With a router, if you let inbound connections pass through, it passes the packets to the hosts behind it. So if you allowed something exploitable, you get zero protection.

With a NAT, you can choose not to forward any ports.
With a router, you can choose not to allow any inbound connections.

You can do exactly the same thing with a stateful firewall. Absolutely nothing stops you from making it work the same way a NAT does.

Re:Article invalid

[KingMotley]

You can be behind a firewall without NAT and achieve the same thing.

What same thing? If you are a using a "firewall" that maps internal addresses to external addresses then your firewall is a NAT. If it doesn't map internal address to external address, then no, it doesn't achieve the same thing.

NAT can be done without a firewall and a firewall can be done without NAT.

Perhaps, that depends on your NAT implementation. A good NAT implementation achieves the same effect as most entry level firewalls (No packet from "outside" and get "inside" unless an "inside" machine initiates the conversation. Some NATs can even restrict it further, disallowing internal machines to talk to some/any outside machines at all, making a NAT have all the features of a bi-directional firewall AND do network address translation.

Being behind a firewall provides much more protection then just being behind NAT.

Again, depends on your NAT. A good NAT can do everything a firewall can, but the reverse isn't true, because as soon as a firewall does network translation, it's no longer just a firewall, it's a NAT.

Re:Article invalid

[KingMotley]

Limiting physical proximity IS a basic security mechanism.

Re:Article invalid

[arndawg]

I never RTFA. But my point is i'm just annoyed by people trying to act like such network experts by pointing out NAT != FIREWALL. It's getting OLD.

Re:Article invalid

[arndawg]

So if you come up with a bad enough analogy you automatically win the argument? Socks is very often used without shoes so that doesn't count. NAT isn't used very often without a firewall.

Re:Article invalid

[profplump]

Seatbelts are rarely used without some sort of transport vehicle. Does that mean "seatbelt" and "vehicle" are synonyms?

Stop being a douche and just accept that fact that we could sell grandma (or build into her cable modem, OS, etc.) a stateful firewall that provides exactly the same protection *without* NAT.

Re:Article invalid

[anUnhandledException]

Some one mod this one up.

I mean the idea that you can't have an equal level of security without NAT is a joke.

Part of the confusion comes from the fact that most "routers" sold today are actually NAT + firewall in one box which blurs the line.

There is no reason why in an all IPv6 world you no longer have a "home router" but instead have a firewall providing an equal level of protection.

Keeping NAT because you need protection is just stupid. NAT was a hack to get around a problem of IP scarcity. It was never intended as a security system.

Re:Article invalid

[arndawg]

Can't you discuss without coming up with crappy analogies that have nothing to do with this? The argument is that NAT DOES NOT PROVIDE SECURITY. Well it does most of the time. No-one is saying that NAT is needed (if they do, they're morons). But that NAT DOES NOT PROVIDE SECURITY is a fucking lame statement because in 99,9999% of the times, it drops all incoming connections if a user haven't decided to forward a port or an IP.

Re:Article invalid

[Ares]

it might be old but its true. like the current sitting potus said, you can put lipstick on a pig but its still a pig.

while nat tends to => firewalling capacities, firewall !=> nat therefore nat != firewall

Re:Article invalid

[arndawg]

BUT WHY THE FUCK DO YOU NEED TO POINT IT OUT ALL THE TIME? Everyone knows this. And it doesn't make you look smart. It makes you look like a smug asshole.

Re:Article invalid

[Ares]

i'll bite.

have a look into the linux kernel that is used to provide nat on the vast majority of home routers. while it has certainly been a while since i had to build a kernel from scratch, the functionality you are referring to, dropping all incoming connections et seq., is provided by a completely different section of the codebase than the packet rewriting code. while creating nat rules without the use of the connection tracking (nf_conntrack, etc.) is difficult if not impossible, creating firewall rules without the use of the nat code (nf_nat, iptable_nat, etc.) is certainly possible. so while nat'ed systems inherently provide security in the form of a prerequisite stateful firewall, please don't make the incorrect assumption that the security exists because of the nat. it doesn't.

Re:Article invalid

[j h woodyatt]

You also can't PingOfDeath a machine that has an IP stack implementation written or updated in the last ten-plus years. Your point?

Re:Article invalid

[arndawg]

Constantly whining about this shit is just as lame as correcting people for saying Linux instead of GNU/Linux.

Re:Article invalid

[sjames]

Firewalled v6 is only insecure if the firewall is insecure. A firewall running v6 filters with sufficient hardness will shield the interior machines from any sort of inbound attack.

The only difference is that if someone from outside sends you notice that a machine on your network was attacking their server (perhaps due to a worm), figuring out which one from the log snippit will be easy and quick rather than difficult to impossible depending on how busy your connection was and how much your clock is skewed from theirs.

Re:Article invalid

[suutar]

So you have a NAT system that can block outgoing ssh connections based on the username as well as the address, or block individual pages of a website? Awesome! Tell me more. I've been using application proxies for this stuff.

Re:Article invalid

[thegarbz]

Everyone knows this.

Unfortunately that is exactly the problem. On slashdot itself not everyone knows this. Outside of slashdot few people know this.

Re:Article invalid

[KingMotley]

Not all NATs can do everything that every firewall ever invented can do. However, most NATs can do what most basic firewalls do with packet inspection/filtering and being a circuit-level gateway. Some firewalls go beyond that, but they aren't the "common" firewall that 99% of the users on slashdot think of when they talk about a firewall, like Windows built-in firewall, Zone Alarm, or older Cisco firewalls, and even some of the more basic business class firewall packages.

So yes, a NAT can act as a firewall (No, not the best firewall with every feature ever known), but a firewall can not act as a NAT (without becoming a NAT), if that helps.

Re:Article invalid

[darkpixel2k]

blablablabla. i99% of the times, NAT is in conjunction with a stateful firewall. That's why people say NAT = FIREWALLED.

So if shoes are normally encountered in the presence of socks, shoes are the same as socks?

Seems a little lazy to me...

Regardless, NAT is not a security mechanism. It is not the equivalent of a firewall. And removing NAT will not prevent you from putting in a firewall.

If shoes and socks were sold as a bundle, pre-sewn together to the end user like most home firewalls, then yes--users would call them shoes.

Sorta like what you call a hand. It's really a wrist, palm, fingers, fingernails, etc...

Re:Article invalid

[PseudonymousBraveguy]

Only that the important part for security is the "firewall" part, not the "NAT" part. If you use a NAT in conjunction with a firewall, you can drop the NAT without losing security. If you are using NAT without a firewall, there is no security so you don't lose any if you drop NAT. Bottom line: NAT is not a security mechanism. Wait, that's what GP already said...

Next bubble?

[Average_Joe_Sixpack]

1980s Real Estate
1990s Tech Stocks
2000s Commodities
2010s IPv4 addresses

Re:Next bubble?

[aliquis]

Gold?

Maybe one could say the dollar is bursting right now? Euro to follow? =P

Anyhow I think real estate and stocks in general burst more often than that =P, at least nowadays :)

Over here in Sweden we haven't had our housing burst yet. People have already taken loans of 8.8% more than the same month last year, probably since rates are very low thanks to the global economical situation and "real estate always increase in value!". Loans are up to 2600 billion SEK atm. They are even complaining that you can only get a house loan of 85% of the value of the house (since they lack the first 15%, but sure they can pay more than 100% later!!) and not more as you used to. But that doesn't matter because they just take a blanco loan instead. They also sort their short-term economic situations by taking SMS loans with thousands of percents of rate.

Some US (?, I have the video in a tab but I'm too lazy to check it up) guy claimed Dow Jones would fall to 1000, it's at around 10800 now. Some article speculated in that it would raise to 14000 since there was a presidential election and it usually raised by 50% during those. So between those 1000 and 14000 I guess we could say: We don't know. But oh well, analysis like that doesn't make you a lot of money :D

Re:Next bubble?

[aliquis]

(But everyone claim gold is secure in any situation you can think of. Afraid of inflation? Buy gold! Afraid of deflation? Buy gold! Want to instead in raw materials? Buy gold! Think the stock market will crash but still want to invest in something? Buy gold!)

I wonder how it will work in the case of starvation =P

So, anyone want to buy tulips?!

Re:Next bubble?

[Jaysyn]

Some people buy gold, some people buy gas, munitions & non-perishable food.

Re:Next bubble?

[jimmydigital]

Some people buy gold, some people buy gas, munitions & non-perishable food.

Unfortunately gasoline does not keep well. I like to dollar cost average my ammo though.

Does anyone know....

[Anonymous Coward]

...how many patents related to IPv6 were filed until now?

The IPv6 nightmare begins with it's design...

[AbbeyRoad]

http://cr.yp.to/djbdns/ipv6mess.html

-paul

Re:The IPv6 nightmare begins with it's design...

[jra]

Wow. DJB misunderstands something?

Say it ain't so, Joe!

(His piece, written in his usual "I am not at all nuts" style, assumes that IPv6 is *solely* a new "address space", and not an entire replacement protocol.

(While that might have been a better design, smarter people than me decided it wasn't practical to approach it that way, so listing the ways in which that wasn't well implemented is useless, since *that wasn't what they were TRYING to implement*; the entire page is a strawman.)

Re:The IPv6 nightmare begins with it's design...

[TheRaven64]

While that might have been a better design, smarter people than me decided it wasn't practical to approach it that way

The problem with the approach is that it's very difficult to do in a way that doesn't break backwards compatibility, and if you're going to break compatibility then you may as well fix other things at the same time.

One option, for example, might have been to get rid of the port field as a fixed length and make network, machine, and port number all combined in the same way that network and machine addresses are now. This would let you have, for example, 256 ports per machine while getting 256 times as many IP addresses, or doubling the available addresses at the cost of only having 32K ports per machine. Only the routers at the very last hope would need any modification for this to work. Since you only need a unique port for each app that connects to the Internet (you can reuse ports, as long as the remote end is different), 2^16 is a lot more than most machines need, and losing 3-4 bits from the port field would be a lot more convenient than NAT for a lot of home users.

Of course, that would still not be a good long-term solution. After a little while, you'd end up with the port field being shortened so much that people would complain. You'd also have the problem that you actually use the variable-length port field, every machine on your local segment would need an upgraded network stack, and protocols that expected to be able to use high port numbers would have serious problems.

The effort in deploying such a solution would only be slightly lower than the effort of deploying IPv6 and it would be a significantly inferior long-term fix.

Re:The IPv6 nightmare begins with it's design...

[hedwards]

Precisely, there's all sorts of things you can do if you're not concerned with backwards compatibility. One of the main reasons why Apple has been resurgent in the OS market is that they broke backwards compatibility and made some really significant changes to the way their platform worked. OSX is significantly more reliable and more stable than their previous releases were. Mainly because they completely redid things with experience from known stable OSes.

MS has had a lot of trouble due to trying to maintain too much compatibility for too long. It's a competitive advantage that they can run old code, giving that up would make it much easier for people to switch platforms.

Re:The IPv6 nightmare begins with it's design...

[ewanm89]

Host operating systems tend to already have support, Linux was early in 1996 with experimental support. By 2005 all the major desktop systems had support (well, winxp needed download from Microsoft). We've known this year is coming for quite some time. Also IPv6 is actually more effecient, removing a lot of the left over ARPA cruft that is nolonger neccersary, for an address size at 4 times the size of IPv4, the IP packet header is only twice the size. The problem is the router manufacturers and network engineers don't like it cause it's quite different from IPv4 with that cruft removed, and they can't seem to read the RFCs. FInally I had a friend who stated that IPv6 needs all routers to support it, as if 6to4 tunneling didn't exist. As long as it'll pass on protocol 41 packets like any other it works fine (with the necesity of manually forwarding through a NAT for the standard reasons.

Re:The IPv6 nightmare begins with it's design...

[hedwards]

The problem is outside the home. There's no reason why people at home need to switch from IPv4 to IPv6, you can just replace or upgrade the modem to convert between the two without a whole lot of trouble. You can include NAT which does the translation nicely.

The bigger problem is that the ISPs haven't made it available yet in any universal way. I just checked the other day and Qwest still hasn't, as far as I can tell, made it available, definitely not on my modem anyways.

Re:The IPv6 nightmare begins with it's design...

[julesh]

http://cr.yp.to/djbdns/ipv6mess.html

Much as I respect DJB (ROTFL), he's talking utter bullshit, and has clearly never used a modern implementation of IPv6.

Suppose someone sells you a public IPv6 address. You put your computer on that address. You find that you can't reach the CNN servers or the Google servers or your company's web servers. How will you react?

This is an example of what's called an interoperability failure. Right now, many---in fact, most---Internet servers can't talk to clients on public IPv6 addresses.

I did some experiments a few weeks ago with IPv6. You know what? Most things just work. There's this thing called ipv4-over-ipv6 tunnelling: if you attempt to connect to an address of the form ::ffff:[an ipv4 address] your local router should be able to handle tunnelling the packets as far as a router that has a public IPv4 address, at which point you get an NAT'd connection outgoing and everything works pretty much transparently. The only thing that *fails* is when connections back are needed. Pretty much no P2P software works. Active-mode FTP fails. The situation is pretty similar to using an NAT router that doesn't have any protocol mangling stuff like we generally expect these days.

The specifications could have defined a functionally equivalent public IPv6 address for each public IPv4 address, embedding the IPv4 address space into the IPv6 address space; but they didn't.

You can't route IPv6 packets directly to IPv4 addresses. The idea is absurd: how can a machine that only talks IPv4 reply to such a packet? Clearly the packet must be rewritten at some point, and that has to be done by a machine that has a public IPv4 address, which basically means either your router or some upstream router that your router should be aware of. Tunneling the packets is the only possibility, which is where the 4-in-6 tunnel comes in.

(RFC 2893 does some of this, but the IPv6 proponents say that RFC 2893 is a local option, not part of the IPv6 architecture. In particular, they say that an IPv6 client is not supposed to send a packet to an IPv4 address by using the RFC 2893 address.)

RFC2893 is an outdated RFC that has been superceded by RFC4213. Bernstein's rant is undated, but it's either at least 5 years out of date, or else he's attacking a strawman version of IPv6 that ignores recent advances.

As of 2002.11, Google hasn't published IPv6 addresses for www.google.com

OK, so the rant is probably nearly 8 years out of date. FTR, google.com is accessible through IPv6, as I believe are all the other specific examples of sites DJB quotes that were not IPv6 enabled at the time of writing.

Most of his concerns seem to be addressed by the easy methods available for automatically tunneling IPv4 connections over IPv6. The *only* outstanding issue is the one he glosses over briefly: that an IPv4-only client can't talk to an IPv4-only server. This is unfortunate, but it's hard to see how anything can be done about it, other than perhaps reserving the last few IPv4 addresses for server applications and only allocating IPv6 addresses to nodes that will be clients (which would be an administrative nightmare, but should be feasible).

Re:The IPv6 nightmare begins with it's design...

[julesh]

winxp needed download from Microsoft

I haven't tried this, but sources I've seen suggest it isn't the case: you just need to run "netsh ipv6 install" (or something similar; the precise command seems to vary according to which service pack you're on). The support is already there, it just isn't enabled by default because it was considered experimental.

Unfortunately, the support is missing several important features, including IIRC support for DHCP.

Re:The IPv6 nightmare begins with it's design...

[AbbeyRoad]

> The only thing that *fails* is when [...]

thats quite a lot of things failing.

> similar to using an NAT router

no, there are 100 million people connected to the internet using ADSL and all *their* stuff works fine

why, because NAT is a solved problem with lot's of workarounds

ergo: IPv6 is just NAT all over again

we might as well solve the IPv4 address-space problem with huge /8 NAT'd networks.

good luck to the 0.0000001% of the Internet that has "successfully" switch to IPv6 after 20 years of IPv6 promotion.

-paul

Re:The IPv6 nightmare begins with it's design...

[Tacvek]

I have not yet read all of DJB's post, but I agree that the design is the key issue.

There are a number of large flaws, but the key among them is ipv4/ipv6 dual networks, and lack of a proper transisition plan.

Here is how IPv6 should have gone:

First they design a new protocol, with new address space, etc. They did that correctly.

It is highly stressed that inside a single network only IPv4 or IPv6 be used. Never both, except on gateways between an IPv4 and IPv6 network. They failed here miserably. Having regular machines speak both protocols is asking for trouble.

Now, design a method of tunneling IPv4 packets across an IPv6 network, in such a way that that it appears to the IPv4 machines as merely one high latency IPv4 hop. Thus all IPv4 networks can talk to each other completely unaware of the existence of IPv6.

Now also design a way to tunnel IPv6 packets between two IPv6 networks separated by an IPv4 network. Basically that requires the IPv6/IPv4 boarder gateways to know about each other and each's IPv4 network.

At that point we would have the ability of IPv4 and IPv6 machines to talk with other machines of the same protocol, despite possibly needing to tunnel over the other protocol.

Now we need the ability for IPv6 only clients to be able to connect to IPv4 only servers. There exists only one way to do that. You specify some way to encode IPv4 addresses in IPv6 space. The IPv4/IPv6 border gateways advertise routes for such packets. When the packets reach them, they perform a form of network address translation, not unlike what home routers perform, except that the interior addresses (and protocol) are IPv6 not IPv4.

I believe that all of those tunneling/translation systems have been defined for the real world IPv6, but as far as I can tell, they were not all ready when IPv6 was first announced.

Re:The IPv6 nightmare begins with it's design...

[AbbeyRoad]

or you could just added an extra 32-bits as a TCP or IP header-option

if you interleave the bits, you can keep all the routing configuration

-paul

Re:The IPv6 nightmare begins with it's design...

[riegel]

His piece, written in his usual "I am not at all nuts" style

Why the attack on DJB? Why is parent modded infomative? Sounds like parent has issues with DJB that calls into question the rest of what he writes.

Re:The IPv6 nightmare begins with it's design...

[Cyberax]

So why do we need entire replacement protocol?

Let's see, IPv6 autoconfiguration is nice, but DHCP is working fairly well by now. So no need for a new protocol here. No checksums for mutable header IP fields? Nice, but does it require a whole new protocol?

What else? Multihoming? Nope, IPv6 doesn't help here. Mobile IPv6? That's just a result of a large address space, so nothing new here.

So, why do we need a replacement protocol if not because of a larger address space?

Re:The IPv6 nightmare begins with it's design...

[Tacvek]

You are correct, but the problem was that when IPv6 was first announced, the NAT based tunnel mechanism was not ready yet, AFAICT.

At the time, I believe they had specified how to transparently tunnel an IPv4-to-IPv4 message across an IPv6 network, and the reverse, such that except from the perspective of the edge gateways, both IPv4 and IPv6 looked like contiguous networks, even when they were not.

There has also not been nearly nearly enough emphasis on avoiding IPv4/IPv6 mixed networks. In the theoretical design of IPv6, only the gateways between IPv4 and IPv6 networks spoke both protocols, and even then, not on the same physical interface. Regular machines simply spoke only one or the other. In practice, I've yet to see a network where the clients have IPv4 disabled. If the machines speak IPv6, they also speak IPv4, which is not optimal.

But having networks speak both internally is just asking for trouble.

Re:The IPv6 nightmare begins with it's design...

[TheLink]

Maybe you should take the trouble to read completely and understand what he wrote before replying piecemeal.

Because it's funny how you say he's talking "utter bullshit" when you say:

I did some experiments a few weeks ago with IPv6. You know what? Most things just work.

And you then also say:

You can't route IPv6 packets directly to IPv4 addresses. The idea is absurd: how can a machine that only talks IPv4 reply to such a packet?

Because that's EXACTLY the problem DJB was talking about: "Right now, many---in fact, most---Internet servers can't talk to clients on public IPv6 addresses."

Then you follow up with:

DJB: "As of 2002.11, Google hasn't published IPv6 addresses for www.google.com"
OK, so the rant is probably nearly 8 years out of date. FTR, google.com is accessible through IPv6, as I believe are all the other specific examples of sites DJB quotes that were not IPv6 enabled at the time of writing.

His rant wasn't 8 years out of date, because only in 2008 did Google's search engine start to support IPv6: http://www.google.com/intl/en/ipv6/
Furthermore they only added support for the other stuff later.

So 3 years ago, if you only had an IPv6 address and no IPv4 addresses, you couldn't use Google. Not being able to use Google (or the other search engines for that matter) would have been a major problem to many people. If it took Google that long to add IPv6 support, guess how long it'll take for the rest of the servers to add IPv6 addresses?

If the "only have IPv6 address" scenario does not apply to you and you have an IPv4 address, then naturally you don't have the problem. But is "everyone sharing IPv4 addresses to talk to servers" considered an official migration path to IPv6?

Too many IPv6 proponents don't appear to be living in the real world. So it's no surprise when many people ignore them and their "ivory tower plans".

My prediction on what will actually happen is ISPs will put more and more users behind IPv4 NATs. Because going from IPv6 only to IPv4 only will require some form of proxying/NATing anyway, so if the ISPs are going to do that, they might as well stick with IPv4 proxying/NATing technologies which are more tested and proven.

This won't affect the WoW users, or the grandmas who use web, or those playing farmville on Facebook. But it would certainly affect those using P2P, and those running their own servers. So the users who want a public IPv4 address will have to pay more $$$.

The ISPs and Big Media (who own or are linked to many ISPs) are likely to consider this a feature and not a bug. After all many big corps tend to prefer a world where only a few can talk and the rest have to listen. So their motivation to move to IPv6 might not be so high.

Re:The IPv6 nightmare begins with it's design...

[julesh]

You are correct, but the problem was that when IPv6 was first announced, the NAT based tunnel mechanism was not ready yet, AFAICT.

Oh, sure, and I'm happy to accept that it wasn't ready when DJB wrote that rant. But it is now, so perhaps people should stop referring to it.

Re:The IPv6 nightmare begins with it's design...

[Daniel Phillips]

The problem with the approach is that it's very difficult to do in a way that doesn't break backwards compatibility, and if you're going to break compatibility then you may as well fix other things at the same time.

...and that was all the justification the committee needed to succumb fully to second system syndrome.

IPv6 is the Duke Nukem Forever of the internet.

Re:The IPv6 nightmare begins with it's design...

[mrjohnson]

Yeah, but people aren't locked into the Mac. They buy Macs (generally) because they like them. Microsoft, on the other hand, desperately needs to maintain lock-in.

Re:The IPv6 nightmare begins with it's design...

[Daniel Phillips]

Of course, that would still not be a good long-term solution. After a little while, you'd end up with the port field being shortened so much that people would complain. You'd also have the problem that you actually use the variable-length port field, every machine on your local segment would need an upgraded network stack, and protocols that expected to be able to use high port numbers would have serious problems.

So instead of stealing address bits from the port field grab the checksum field, it isn't doing anything useful that the ethernet checksum doesn't already do.

Re:The IPv6 nightmare begins with it's design...

[AbbeyRoad]

Basically, this is what is going to happen:

Some ISP somewhere with a /20 is going to project that in 6 months time they will be out of IPs,
and it's going to be too expensive to buy another /20.

So they are going to buy some Cisco-hardware-NAT-appliance and say to their customers: "look here,
you are all on NAT from now on, if you want a real IP you pay extra."

This NAT box will NAT a /20 to a /24 of temp addresses+ports. It will be plug-n-play and
easier than setting up IPv6.

99.9% of customers won't read the announcement and won't notice. They are all NATing through
their DSL modems anyway, and this Cisco equipment will have hacks for all those special
apps that need it to work behind double NATing.

And no one will ever think of switching to IPv6

-paul

Re:The IPv6 nightmare begins with it's design...

[the_humeister]

I disagree. Look what IBM can do with their mainframes. These things can run code written 40+ years ago on modern hardware without breaking anything (usually).

Re:The IPv6 nightmare begins with it's design...

[r7]

The problem with the approach is that it's very difficult to do in a way that doesn't break backwards compatibility, and if you're going to break compatibility then you may as well fix other things at the same time.

Didn't have to be that way. We could have had an IPv5 with all the addresses and none of the backwards compatibility issues if not for special interests in the IETF:

    http://bill.herrin.us/network/ipxl.html

Gets my vote for IPv7...

Re:The IPv6 nightmare begins with it's design...

[geekoid]

Have you ever tried to hook up 5 machines that all want to play network games through a home nat? It's a real big pain in the ass. Go online and look atn the non network interested person try to figure it out. It's a night mear. You need to open ports, and specific port forwarding wules, still ahve a lot conflict issues that arise.

Getting rid of that is exactly why IPv6 will arrive. The consumer needs an easier way, and IPv6 is the solution it IPv4s problems.

BTW in 2008 the adoption of IPv6 went from 2.4% to 4%. and it's still rising. A lot of new home users are getting IPv6 be default, the most use OS is finally starting to use it in a proper way.

So it's use is about 10Million times what you claimed it to be.

So stop pulling numbers and opinion out of your ass and take at least a few moments to get soome of the most rusimentary facts correct? You are not stupid, stop acting like it.

Re:The IPv6 nightmare begins with it's design...

[Abcd1234]

It is highly stressed that inside a single network only IPv4 or IPv6 be used.

Bullshit. Dual-stack has *always* been part of the transition plan.

Now, design a method of tunneling IPv4 packets across an IPv6 network

Why would you ever need that? The core network can be dual-stack. Edges slowly migrate to v6-only. v4 machines work as they always have.

Now also design a way to tunnel IPv6 packets between two IPv6 networks separated by an IPv4 network.

There are *myriad* solutions for this. Hell, 6to4 was first described nearly ten years ago!

Now we need the ability for IPv6 only clients to be able to connect to IPv4 only servers.

NAT64 and DNS64.

but as far as I can tell, they were not all ready when IPv6 was first announced.

That's only true for your last example... unfortunately, the IETF failed hard, there, underestimating the cost and complexity of transition. Fortunately, companies like Comcast, dealing with the real-world issues of transition, convinced them than NAT64/DNS64 are necessary technologies to make the transition possible.

Re:The IPv6 nightmare begins with it's design...

[KingMotley]

You do realize that you just described NAT in a round about way?

Re:The IPv6 nightmare begins with it's design...

[PitaBred]

Their stuff does NOT work fine. VoIP, VNC/RDP, media sharing services, all of those are broken with more than a single level of NAT. NAT is a well understood hack, it is NOT a solved problem.

NAT is only the solution when the users are simply consumers. If you want to do anything other than use the Internet as a replacement for cable TV, you need more than NAT. Multiple levels of NAT kill any kind of participation in the Internet and make everyone behind them a second-class Internet citizen.

Re:The IPv6 nightmare begins with it's design...

[DavidTC]

Hey, did you actually read the fucking article?

What djb says is exactly what's wrong with IPv6.

No, IPv6 clients cannot, under any circumstances, talk to IPv4 ones. They also have to run IPv4. There is no conversion at all, and the IPv4 address space 'inside' IPv6 will never, under any circumstances, be turned into IPv4 when it hits the 'edge' of IPv6, nor will it be turned into IPv6 going the other way.

And, no, routers cannot 'convert' between protocols, as there is no way to convert back and forth. There are ways to tunnel, but no way to convert. The IPv4 address space in IPv6 is just a goofy allocation scheme, saying 'If you have some addresses in another protocol, you get these addresses free also.' They are utterly different addresses in any sense of the word, you can have them on different computers or even different networks.

Christ, you read an article about how IPv6 is broken because the way that people expect the upgrade to work is broken, and you walk away going 'What an idiot. The way people thinks it works is great, and I've decided to ignore the place where points out that way is not, in fact, how it actually works.'

How you think it works, how everyone including djb thinks it should have worked but doesn't, was not chosen, for no apparent reason. Instead, we've got a damn stupid 'dual stack' approach.

Incidentally, I'm no djb fanboy, he's a total idiot in my book. He has no idea of the proper way to actually follow standards and write software, instead choosing to invent entirely different control systems, and that's just the start of the problem.

But that doesn't mean anything written by him is wrong. He's exactly right about how IPv6 fucked up, and if it had been a superset of IPv4 we might actually have an internet that's 90% IPv6 and 10% IPV4, and we'd be talking about the sysadmin's hard choice to keep paying for IPv4-compat IPs or use IPv6-only IPs.

Instead, IPv6 is still almost completely unused, and we've run out of fucking time.

Re:The IPv6 nightmare begins with it's design...

[DavidTC]

Uh, no.

There is no modem that can 'convert'. There is no way to convert from IPv4 to IPv6, or vis versa.

You can pass traffic for one over the other, to some other endpoint that will reverse the process, but that's tunneling, not converting.

You cannot convert, because IPv4 and IPv6 do not share the same address space, at all. (Some IPv6 addresses are given out free to people with IPv4 addresses, but you could use those addresses on entirely different computers if you want.)

It is a common misconception that IPv6 is a superset of IPv4. It's not. There's no IPs that can 'convert' back and forth.

Re:The IPv6 nightmare begins with it's design...

[mikael_j]

As others have stated, that's an ancient article by DJB who has a tendency to be very vocal about things he probably should read up on again before expressing his misconceptions.

There's a whole bunch of things wrong with that article, I'm sure it's been refuted in a thousand /. comments on articles about IPv6 before though, so I suggest you use Google...

Re:The IPv6 nightmare begins with it's design...

[DavidTC]

The idea that IPv6 addresses are a superset of IPv4 addresses, and routers can just 'convert' them back and forth as long as they're in the IPv4 address space, is the most common utterly incorrect misconception about IPv6, and really should be shot down by some giant notice required on all slashdot stories about IPv6.

The 'IPv4-MAPPED IPv6' convention just made things even stupider. Those are not actual routeable IPv6 addresses, people! That's just a way to hold an IPv4 address in an IPv6-sized field, and your computer contacts it as IPv4.

Anyone actually publishing such addresses should be shot. It's just a helpful way to store IPv4 and IPv6 addresses in the same place, and even treat them the same, and have the OS figure out which protocol to use.

IPv4-Compatible IPv6 Addresses, OTOH, are actual IPv6 addresses you get free with IPv4 addresses...but are, indeed, entirely separate addresses. You can put them on entirely different computers, and no one can convert or even assume it's the same device.

Re:The IPv6 nightmare begins with it's design...

[cynyr]

and doing ipv4 to ipv6 to ipv4 seems like a dumb idea. Now my WII and PS3 both do not support ipv6. I'm not sure if mediatomb(upnp server) does or not.

If my router could get an ipv6 block from my ISP (qwest) and my router(linksys wrt54g v8 with ddwrt micro) supported ipv6 and my router could do the ipv4 to ipv6 "NAT"ing I'd move to ipv6.

All of the real computers in the house all support ipv6, so bring it on.

Re:The IPv6 nightmare begins with it's design...

[DavidTC]

You hit the nail on the head about the actual problem and the actual solution, but your last line is wrong.

The translation has not be defined, as they decided that IPv6 is not suppose to work that way. The problem isn't lack of hardware supporting such standards, it's that the actual standard defined it the way people are doing it, with dual stacks and no edge translation. (And, strictly speaking, IPv4 address don't even exist in the IPv6 address space. Sure, you get some free IPv6 addresses if you have IPv4 ones, but they aren't actually 'the same' address....feel free to put them on entirely different computers.)

Re:The IPv6 nightmare begins with it's design...

[TheThiefMaster]

Everything has to be changed to support even the slightest increase in address space, so they figured they'd fix all the little annoying niggles while they were at it.

Re:The IPv6 nightmare begins with it's design...

[JesseMcDonald]

Actually, the IP checksum isn't as redundant as you think. It provides end-to-end protection for the IP packet; the ethernet checksum is link-level, and changes every time the packet it forwarded (due to different MAC addresses, if nothing else). You need both to deal with the possibility of malfunctioning routers.

Re:The IPv6 nightmare begins with it's design...

[Cyberax]

And they have not gone far enough. For example, PMTU is a big ugly mess. Ports are still limited to 16 bits. Etc.

In any case, the biggest reason for IPv6 is not a protocol switch for the sake of better protocol. The main reason is much larger address space.

Re:The IPv6 nightmare begins with it's design...

[j h woodyatt]

portforward.com

Re:The IPv6 nightmare begins with it's design...

[sjames]

If only he knew what he was talking about. If you actually look at the spec for IPv6, you'll see that the header basically IS v4 with expanded address fields and no checksum.

That doesn't matter, the old Wnn95 box won't understand it. It never will unless you do an update. If you do an update, you might as well just add a v6 stack.

The one thing that would make sense would be a translator function. A box on an ISP's net that acts as the v6 default route for all v4 only IPs. Just define a v6 prefix that routes to the entire v4 space. Of course, that is NAT, and since everyone who can speak v4 can also speak v4, we'll call the kludgy NAT solution a distributed bv4 gateway and be done with it.

The other side of the equation, v4 machines reaching v6 can't happen. v4 just isn't big enough to deal with that. There is no case where making a v4 machine understand a larger address space is any easier than just adding a v6 stack.

The one thing that might have helped would have been adding a port lookup to DNS so multiple v6 servers could map their listening ports to a single v4 address.

As for the rest, dual stacks are recommended rather than required because none of the relevant groups have the regulatory force necessary to REQUIRE it. They can only recommend strongly or 'urge' the needed actions. They can't arrest you if you don't comply.

Re:The IPv6 nightmare begins with it's design...

[sjames]

You can't really split the port/address fields any differently. IP only understands addresses. The Core routers only route based on addresses. Ports are part of the UDP and TCP headers encapsulated in the IP packet. They only understand ports, not addresses. You'd still have to update everything on the net, only it wouldn't last as long before you had to update again and routing would become a lot less efficient since all routers would have to inspect the tcp and UDP headers as well as the IP header.

Re:The IPv6 nightmare begins with it's design...

[sjames]

Because the only way to get the larger address space is with a new protocol?

Call it IPv4 if you must, but it would be like the old axe joke: This is my great grandfather's axe. The head has been replaced 15 times and the handle has been replaced 20 times.

Re:The IPv6 nightmare begins with it's design...

[sjames]

And good lick to YOU convincing the layers of bureaucracy in the clueless ISPS to grant you an inbound port to either log in to your home machine or use a VOIP service other then the one they offer to sell you. I predict that you'll still be alternately on hold, being transferred, or yet again explaining to some clue resistant flunkie what you want, why you would want it, and why they should let you have it when the last machine on the net (other than yours) upgrades to v6 only.

Hang in there, we're all pulling for you!

Re:The IPv6 nightmare begins with it's design...

[petermgreen]

That is where I disagree with you.

IPV4 has support for optional header fields. You could introduce a system where "long ips" were stored in an extended header and their use was indicated by setting the original source and destination fields to a special value. Routers that didn't understand long IPs would just pass packets destined for them on to their default gateway.

End system software, nats and some routers would still need to be updated but there would be no need to administer a second independent set of addresses nor would there be any need to perform organisation wide forklift upgrades to allow interoperability with long IP users.

Re:The IPv6 nightmare begins with it's design...

[Cyberax]

Sure.

But it was possible to design it to be _backwards_ _compatible_ with IPv4, like we did it with MX records for SMTP. It would have allowed us a smooth transition, without requiring a flag day for the whole Internet.

That's the point that DJB makes.

Re:The IPv6 nightmare begins with it's design...

[TheThiefMaster]

All user software would need to understand long IPs, otherwise no server could ever have a long IP, because some software wouldn't know how to connect to it.

All core routers would need updating, because they work through peering and defined routes, not by having a "default gateway".

All user hardware that deals with IPs directly (routers, NATs, firewalls, even perhaps modems) would need replacing too, else they wouldn't understand their own IP and give bad source addresses in their data.

Some hardware/software that could normally get away with routing to the default gateway would need replacing due to mangling extension headers it didn't understand.

So what's left that wouldn't need replacing?

Re:The IPv6 nightmare begins with it's design...

[sjames]

But how is it going to be backwards compatible? One side or the other in any connection will not be able to reach the other within the size of it's addressing.

Re:The IPv6 nightmare begins with it's design...

[Cyberax]

Fairly easy. First, layer of IP datagrams won't be changed much from existing IPv6/4 dual stacks. Most changes would go into TCP (and UDP).

1) You're an IPv6/4 host connecting to IPv6 address. Easy, just proceed with IPv6.

2) You're IPv6/4 host connecting to IPv4 address which may be IPv6-compatible. In this case you just set a 'want IPv6' flag in the header and if your peer sends back 'ok to use IPv6' you proceed with IPv6 (using IPv4 addresses transparently transformed into IPv6 for endpoints).

3) You're IPv6 host connecting to IPv4 address. In this case you just send IPv6 packets to wrapped IPv4 address. If your peer supports IPv6 then it will talk to you using your IPv6 address. And if your peer doesn't support IPv6 then you won't get answer and connection will fail.

Re:The IPv6 nightmare begins with it's design...

[Cyberax]

You don't get it.

Backwards compatibility would have allowed smooth transition between two states: 'nobody supports IPv6' and 'all support IPv6'. As it is, this is impossible.

Yes, you'd still need to upgrade everything. But you could have done do this in stages.

See: http://slashdot.org/comments.pl?sid=1804354&cid=33753930 for details.

Re:The IPv6 nightmare begins with it's design...

[TheThiefMaster]

I don't see anything innovative there. You still have the situation where you can't give someone *only* a new kind of address, because people without support for them won't be able to talk to them at all. You'd still end up running out of IPv4 addresses because everyone would still need one.

Re:The IPv6 nightmare begins with it's design...

[Daniel Phillips]

Actually, the IP checksum isn't as redundant as you think. It provides end-to-end protection for the IP packet; the ethernet checksum is link-level, and changes every time the packet it forwarded (due to different MAC addresses, if nothing else). You need both to deal with the possibility of malfunctioning routers.

...which is why the IPv6 designers felt it necessary to include header checksums in IPv6. Oh wait, they didn't.

Re:The IPv6 nightmare begins with it's design...

[JesseMcDonald]

True, there is no checksum in the IPv6 header. However, IPv6 mandates changes to the upper-layer TCP and UDP protocols in exchange. The UDP checksum, optional in IPv4, was made mandatory, and both protocols are required to include the full IPv6 source and destination addresses within their checksums.

Improved link-level data integrity did play a part in justifying the lack of IPv6 checksums, but was clearly not deemed sufficient by itself. Ergo, the checksum is not redundant in IPv4, at least not without further changes.

Re:The IPv6 nightmare begins with it's design...

[Tacvek]

Why would you want to be able to tunnel IPv4 over an IPV6 connection? Obviously two IPv4 networks seperated by an IPv6 only network.

In the long run we do not want to be running both, or we will be tempted to allways assign both an IPv4 and IPv6 address to every machine. Eventually we want basically nothing left running IPv4, just like we got rid of IPv1, IPv2, and IPv3 when each successor came out.

Also the "*myriad* solutions" is a problem. There sould have been exactly one, not more than one.

Re:The IPv6 nightmare begins with it's design...

[Tacvek]

Having pretty much every computer running both IPv4 and IPv6 will be a nightmare. Things like managing subnets for IPv4 will still need to happen, but yet the IPv6 system does not cleanly line up with that.

If you don't have some (many) IPv6 only machines, then you have not in any way avoided the IPv4 address exhaustion problem.

The only sane future is one where we gradually transition to having almost no devices still running IPv4.

Re:The IPv6 nightmare begins with it's design...

[sjames]

Why not just use v4 if you're a 6/4 host connecting to a v4 address, and v6 if the other side can do that. No need for a special flag, if the host can do v6, it will have an AAAA record.

If you're 6 only, why not just have an IPv6 prefix for the legacy v4 internet and translating proxies (kind of like the 6to4 tunnels)?

That results in the same connectivity and allows for a couple changes of the if we knew then what we know now sort.

Re:The IPv6 nightmare begins with it's design...

[paul248]

You can deploy an IPv6-only network where the clients can still connect to IPv4-only servers.

It's called NAT64:
http://tools.ietf.org/html/draft-ietf-behave-v6v4-xlate-stateful

Re:The IPv6 nightmare begins with it's design...

[EsbenMoseHansen]

DHCP is probably not going to be used by most people using IPv6.

Re:The IPv6 nightmare begins with it's design...

[EsbenMoseHansen]

Misquoting is no way to have an argument. You parent said

similar to using an NAT router that doesn't have any protocol mangling stuff like we generally expect these days

Not just the unemphasized part.

Re:The IPv6 nightmare begins with it's design...

[dwinks616]

Or you download some file from M$ that does the same thing as that command. Do you honestly believe M$ would EVER tell a user to run something on a command line?

Re:The IPv6 nightmare begins with it's design...

[DavidTC]

You can deploy any sort of network that can talk to any other sort of network if you put a damn NAT in the middle. There are ways to talk to IPv4 addresses over IPX.

This is just a NAT that does some clever A rewriting to general AAAA records, which it then understands when the IPV6 side tries to connect to those records and maps them back to the real site.

You'll notice that it has to make up these IPv6 addresses, because despite there being two entire sets of IPv6 addresses that 'correspond' to IPv4, neither of them actually, you know, are defined to be the same thing.

There's actually no IPv6 address that is the IPv4 address '1.2.3.4' (plus a prefix). And hence you need a NAT instead of a bridge.

You'll notice that even if you assign the IPv6 side of this addresses in 'the IPv4 range', no computer on the IPv4 side can actually connect to them.

Ironically, they'd didn't place the damn IPv4 address space in IPv6 because it would be 'complicated' or some such nonsense, but it would sure as hell be easier than NAT64. (Which, I must point out, is not an RFC yet.) If all IPv4 addresses actually corresponded to IPv6 addresses, it, at least, would only have to do a remapping on outward packets.

And not even that if people inside the network used IPv4-compatible IPv6 addresses, which would let it do a straight bridging. Or even put a IPv4 NAT in front of said bridge, which sounds silly, but most existing DSL routers can do that NATing, so that's free. And then you could put a single bridge after the router to talk to your IPv6 network, which has real IPv6 addresses you map to 10.* addresses (So your existing router can talk to them.), but also does a IPv6 tunnel out for IPv6-only stuff. So your computers talk IPv6, your connection talks IPv4, and IPv6 is tunneled. And you can put all the IPv4-only devices on the other side of the bridge. And at some point your ISP upgrades, and gives you a new IPv6 router. You know, an actual upgrade path for home users.

But it's got to do the mapping both ways, thanks to idiots. Including rewriting DNS, which I have to admit is a neat trick, but one it shouldn't have to do at all.

In fact, if IPv4 was a subset of IPv6, DNS servers could do that A->AAAA record rewrite themselves. If you ask for an AAAA, and there isn't one, it could make a correct one out of the A. And if it couldn't, the IPv6 stack in the end user's computer could. Or, hell, just make AAAA requests implicitly mean 'Or give me the A record if you don't have an AAAA.'.

Instead, because it makes up the mapping and needs to keep track of it, the NAT64 device must do it, cleverly managed to map in two directions at once.

Re:The IPv6 nightmare begins with it's design...

[Daniel Phillips]

It's redundant enough to make the concept I described perfectly feasible.

Re:The IPv6 nightmare begins with it's design...

[JesseMcDonald]

Redundant or not, you can't put anything other than a valid checksum in the IP checksum field without breaking every device which has to examine (and thus validate) the IP header. That includes every single router. If you're going to drop backward-compatibility anyway, why not fix the other problems with IPv4 at the same time?

IPv6 certainly isn't perfect. However, implementing any of the alternatives proposed in this thread would cost nearly as much, without addressing the long-term issue: non-hierarchical address allocation and the resulting exponential growth of routing tables. IPv6 provides enough address bits that a small number of known prefixes should always be enough to identify the next step in the route; high-level IPv4 routing, by contrast, requires knowledge of over 150,000 disorganized subnets[1].

[1] The number of "prefixes after maximum aggregation" from "BGP Routing Table Analysis" at the APNIC router <http://thyme.apnic.net/current/data-summary>.

Re:The IPv6 nightmare begins with it's design...

[JesseMcDonald]

The one thing that might have helped would have been adding a port lookup to DNS so multiple v6 servers could map their listening ports to a single v4 address.

I believe this is what DNS SRV records are for. Unfortunately, most applications ignore them. They are actively supported for a few protocols, however.

Re:The IPv6 nightmare begins with it's design...

[sjames]

Yes, you are correct. If we could only make actually looking them up a MUST and make the current default ports a fallback.

That might be a good answer. It's functional enough to not bring everything to a crashing halt, but painful enough to make v6 transition an obviously good choice.

Re:The IPv6 nightmare begins with it's design...

[julesh]

Or you download some file from M$ that does the same thing as that command. Do you honestly believe M$ would EVER tell a user to run something on a command line?

Maybe not, but it's not like the command line is the only way:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_ip_v6_pro_inst.mspx?mfr=true

Re:The IPv6 nightmare begins with it's design...

[Daniel Phillips]

Redundant or not, you can't put anything other than a valid checksum in the IP checksum field without breaking every device which has to examine (and thus validate) the IP header. That includes every single router. If you're going to drop backward-compatibility anyway, why not fix the other problems with IPv4 at the same time?

The expected behavior is that a router that doesn't understand the extended address will drop the packet. Check.

Your argument in favor of throwing out all of IPv4 is flawed, it is a false dichotomy. In fact, there exist degrees of breakage. A responsible engineer tries to minimize breakage when breakage is necessary. The degree to which the IPv6 wallowed in breaking the existing network stack is, in a word, unconscionable. My thesis is that, in order to 'save the internet' by extending the range of routable addresses we must begin by admitting IPv6 has failed, which ought to be clear to all but the most tenacious IPv6 diehards by now.

IPv6 certainly isn't perfect. However, implementing any of the alternatives proposed in this thread would cost nearly as much, without addressing the long-term issue: non-hierarchical address allocation and the resulting exponential growth of routing tables.

The great saving of the proposal in this thread is that interoperability with the existing internet is never lost. Clients could migrate to this hypothetical extended IPv4 addressing scheme at their convenience, as routes open up due to routers being upgraded. It may be that it is not convenient at any point in the near future for a .com server to migrate to an extended address, however there are certainly enough non-extended IPv4 addresses available to handle all .coms for now and a long, long time.

The long term problem of heirarchical routing... IPv6 fails to make the problem go away with its stupidly long addresses due to multihomed hosts and other issues. CIDR does a perfectly good job, and where it suffers strain the issue should be solved by extending router-router protocols, not client-client.

Re:The IPv6 nightmare begins with it's design...

[JesseMcDonald]

My thesis is that, in order to 'save the internet' by extending the range of routable addresses we must begin by admitting IPv6 has failed, which ought to be clear to all but the most tenacious IPv6 diehards by now.

One small problem: IPv6 hasn't failed. It works right now. Even without support from your ISP, or even the core routers, you can set up a 6to4 tunnel on your client or Internet gateway and migrate to IPv6 at your convenience. All you need is a single routeable IPv4 address. Alternatively, your ISP could provide an IPv6 gateway alongside private (NAT'd) IPv4 addresses.

The great saving of the proposal in this thread is that interoperability with the existing internet is never lost. Clients could migrate to this hypothetical extended IPv4 addressing scheme at their convenience, as routes open up due to routers being upgraded.

The great savings of (dual-stack) IPv6 is that interoperability with the existing Internet is never lost. Clients can migrate to IPv6 at their convenience, and with 6to4 tunneling they don't even need to wait for routers to be upgraded.

Seriously, what is your real problem with IPv6? Any variation on extended IP addresses will require just as much support from applications as IPv6. Programs which expect to receive a dotted quad, and often as not store it as a 32-bit integer, will not be able to handle five- or six-byte addresses without modification. Clients with extended addresses will not be able to receive replies from stock servers, and vice-versa. DNS and DHCP, among numerous other protocols embedding IP addresses, will have to be updated. In short, most of the things which would be broken by IPv6 would be broken by any change to the IP address format, your proposal included.

Re:The IPv6 nightmare begins with it's design...

[Daniel Phillips]

Any variation on extended IP addresses will require just as much support from applications as IPv6.

This is your mistake. You see this question in black and white, whereas the real world works in shades of gray. It does matter _how much_ the new protocol breaks the stack. Exceeding the size of a traditional socket addr was a monumentally bad idea, it greatly increased the scope of what had to be rewritten, and even today many programs do not work because they have not been converted to use interfaces that support larger socket addrs. It does matter whether the user is required to manage two network stacks or one. It does matter that the new address format is unfamiliar and in no way an extension of the familiar format.

But these issues, huge to actual users, are just considered minor theoretical details by IPv6 cheerleaders. And these are just a few that came to mind. They do matter, I see that first hand.

IPv6 has failed, the adoption curve is a flat as a pancake. IPv6 is just as dead as Itanic. And for the same reason: the designers were not mindful of backward compatibility.

Re:The IPv6 nightmare begins with it's design...

[petermgreen]

Thinking about it a better way would be to make packets to/from long IPs look like UDP packets to legacy infrastructure. Done right this would mean that not just existing routers but also existing nats could be used by clients accessing long IP based infrastructure.

That way the only things that would need upgrading in existing deployments would have been end systems ,core routers* and possiblly firewalls. Even with core routers long IP support could be phased in gradually by setting legacy routers to route all long IP traffic to one long IP capable router.

* defined as routers that import the internet routing table to decide which ISP to send traffic to.

Re:The IPv6 nightmare begins with it's design...

[JesseMcDonald]

Exceeding the size of a traditional socket addr was a monumentally bad idea, it greatly increased the scope of what had to be rewritten, and even today many programs do not work because they have not been converted to use interfaces that support larger socket addrs.

As I said, this problem is common to any extended address format. Adding more addresses means programs need to be updated to handle a new address format. You can't fit any more addresses into 32 bits than already exist.

It does matter whether the user is required to manage two network stacks or one.

I'll grant you this, but there is nothing about IPv6 that mandates managing two network stacks separately; that is simply how the UIs have been designed. One could create tools for unified IPv4 and IPv6 management. Assuming you bump the protocol version for your modified packets (as opposed to leaving routers and peers guessing whether a given packet is invalid IPv4 or valid IPv4.1) you could easily end up with separate tools for IPv4 and IPv5 anyway. Moreover, dual stacks are only required during the transition—in the long term there will only be one stack, IPv6.

There is nothing to prevent anyone from designing an IPv6 stack that also handles IPv4, either, by translating IPv4 packets to/from IPv6 format (with ::a.b.c.d compatibility addresses). It simply wasn't considered to be worth the effort compared to separate stacks.

It does matter that the new address format is unfamiliar and in no way an extension of the familiar format.

Now you're really grasping at straws. Who exactly does it matter to? How many people do you think deal directly in IP addresses, particularly now that we have mDNS? For those who do, what difference does it make whether the address is a dotted-quad (or "dotted-quint"(?)) or hexadecimal numbers separated by colons? Obviously people prefer what they're familiar with, but IPv6 addresses will become familiar soon enough for anyone who has to work with them.

Re:The IPv6 nightmare begins with it's design...

[TheThiefMaster]

You'd still need to upgrade all clients to understand long ips before you gave even one server a long ip, or some clients wouldn't be able to connect.

You'd also need to upgrade all servers to understand long ips before you gave even one client a long ip, or the server wouldn't be able to reply to them.

So basically... you couldn't give out any long ips. Assuming you didn't give machines both a long and short ip, which is how the IPv6 transition is planned to happen anyway.

Regardless, what you're proposing for the long ips is fairly similar to 6to4, i.e. it's an IPv4 packet with some extra data for an extended address, which is routed as IPv4 by legacy equipment but provides an IPv6 connection. It's one of the many transition mechanisms.

Re:The IPv6 nightmare begins with it's design...

[petermgreen]

You'd still need to upgrade all clients to understand long ips before you gave even one server a long ip, or some clients wouldn't be able to connect.
True but I belive it would have been much easier to get client OSes and core internet infrastructure upgraded on a gradual basis than to try and run two complete parallel networks with separate administration, addressing etc.

Of course it's too late for any new protocol now and probablly too late for smooth deployment of IPv6. Pervasive ISP level nat seems like the only medium term solution much as many /.ers will hate it's affects.

Regardless, what you're proposing for the long ips is fairly similar to 6to4, i.e. it's an IPv4 packet with some extra data for an extended address, which is routed as IPv4 by legacy equipment but provides an IPv6 connection. It's one of the many transition mechanisms.
It's not so different but the key difference is that 6to4 was both an afterthought and not amenable to running behind nat with the result it didn't take off.

Re:The IPv6 nightmare begins with it's design...

[TheThiefMaster]

6to4 works perfectly fine with a NAT if it's the NAT itself doing the 6to4.

I'm not sure what you mean about two complete parallel networks either. IPv6 is being deployed on the existing internet. It's also being admin'd by the same group (both IPv4 and IPv6 addresses are allocated by IANA). As for addressing, that's the whole point of the change...

Re:The IPv6 nightmare begins with it's design...

[Daniel Phillips]

Exceeding the size of a traditional socket addr was a monumentally bad idea, it greatly increased the scope of what had to be rewritten, and even today many programs do not work because they have not been converted to use interfaces that support larger socket addrs.

As I said, this problem is common to any extended address format. Adding more addresses means programs need to be updated to handle a new address format. You can't fit any more addresses into 32 bits than already exist.

Nonsense. sockaddr_in is 16 bytes, plenty of room to fit a uint64_t address for IPv4.5 (hypothetical name). Not enough for a 128 byte address. See, the IPv6 committee was completely and utterly stupid in this regard.

It does matter whether the user is required to manage two network stacks or one.

I'll grant you this, but there is nothing about IPv6 that mandates managing two network stacks separately; that is simply how the UIs have been designed. One could create tools for unified IPv4 and IPv6 management.

That would have been almost sensible, but no such sensible things were done, again due to the directions set out by the IPv6 committee.

The question of bumping the protocol number or not is a very good one. I think most probably "not" is the right design point but I haven't actually tried this.

It does matter that the new address format is unfamiliar and in no way an extension of the familiar format.

Now you're really grasping at straws.

That's a straw? Ask any administrator who has been force-fed the new regimen whether they think this detail is a nothing more than a little straw.

Who exactly does it matter to? How many people do you think deal directly in IP addresses, particularly now that we have mDNS?

Everybody who runs the internet and all the IT departments, that's a pretty big who.

...but IPv6 addresses will become familiar soon enough for anyone who has to work with them.

In somebody's dreams maybe. The fact is, nobody needs to work with IPv6 today because nobody (relatively speaking) is using it, and nobody (relatively speaking) will be using it in the foreseeable future. It's dead, Jim.

Re:The IPv6 nightmare begins with it's design...

[JesseMcDonald]

Nonsense. sockaddr_in is 16 bytes, plenty of room to fit a uint64_t address for IPv4.5...

My apologies; I thought you meant "socket address" in the generic sense, not the sockaddr_in structure specifically. This does mean applications have to allocate a larger structure to support IPv6, which could be considered a (very minor) drawback. It's a trivial change, and any obsolete proprietary applications which can't be changed can connect through a proxy (e.g. SOCKS). This would be necessary anyway for applications which were statically linked, since extending struct in_addr requires (incompatible and potentially unsafe) changes to the C library (e.g. inet_pton()).

That's a straw?

Yes, a irrational fetish for dotted decimal bytes is a "straw" when presented as a justification for opposing the ongoing adoption of the only IPv4 successor protocol to actually be implemented in the real world. "2002:4ba7:d1f5::1/64" is not any harder to work with than "75.167.209.245/32". Certainly not enough so as to block adoption of IPv6.

Everybody who runs the internet and all the IT departments, that's a pretty big who.

If either group's work depends on memorizing IP addresses then they're doing it wrong. That's a job for computers, not humans, regardless of whether we're talking about IPv4 or IPv6.

IPv6 is the future of the Internet. You lost this debate ages ago. IPv6 works, and is already being adopted by major servers and ISPs for general use alongside IPv4. No one is going to ditch imperfect-but-functional IPv6 in favor of your nonexistent IPv4.5. Deal with it.

Procrastination

[dmgxmichael]

Why is it that problems never seem to get corrected until they are well and truly disastrous in scope.

Re:Procrastination

[CoolVC]

I'm not sure if I'd call needing to use NAT with private IPs for a little while during the transition "disastrous"

Re:Procrastination

[tsj5j]

The whole idea in a democracy is to have visionary leader(s) elected to lead the short-sighted (generalization) masses.

Unfortunately, our leaders today are mostly controlled by short term financial interests, which brings us back to square one.

Re:Procrastination

[dmgxmichael]

Agreed - but people in groups procrastinate in the face of danger. Repairing the levees in New Orleans for example. The procrastination is even worse when the consequences are not disastrous. I predict IPv4 will be here 10 years from now enabled by nightmarish workarounds.

People will not fix anything with low impact or low frequency. This is why auto accidents aren't addressed more seriously by society as a whole - the loss of a few lives, or even 40,000 / year in a population of 300 million, is "low impact."

Re:Procrastination

[Enderwiggin13]

Only if you consider the possibility of getting a letter from the RIAA/MPAA's lawyers trying to blackmail you for several thousand dollars because some teenager sharing your IP via NAT decided to torrent the latest Uwe Boll movie "disastrous".

Although, I guess if sharing IPs will make it more difficult for the RIAA/MPAA to "legally blackmail" people it can't be all bad.

Re:Procrastination

[oldspewey]

Because by being insanely focused on quarterly results, our society rewards short-term thinking, and often actively punishes long-term thinking. In most (not all, but most) companies, if a system architect told his CTO
"we need to undertake a $X million project to transition our systems to IPv6. This is going to become a big deal in about 10 years time and we want to be on top of it,"
the CTO might or might not take the idea seriously. But even if the CTO did decide to bring the idea to the board for approval, he'd be shot down in seconds.
"You want to reduce shareholder profits by $X million to fix something that might become a problem in 10 years? Let's move on to the next item on the agenda shall we? And don't bring stupid ideas like this one to the table again in the future Bob. We need you focused on shareholder value."
.

Re:Procrastination

[oldspewey]

Meanwhile, back in realityland, the ISPs all maintain records of which subscriber was assigned which NAT IP during various periods of time.

Re:Procrastination

[cgenman]

I'm glad someone finally said it. NAT is the (slightly slower) Plan B.

We don't need every computer on the network to have an address. We need every SERVER and external-facing router on the network to have an address. A company of 10,000 desktops may really only have 100 servers and a few external access routers, meaning they could work fine with 100 IP addresses instead of 10,000. Heck, most of those servers are internal anyway. You could require users to VPN in first (which you should be doing anyway), and then those servers could live entirely on the local NAT.

And yes, that will break a few applications, which will have to find ways around it. NAT issues have been worked around in consumer software since the mid 90's. It's not a deal breaker. I haven't had a real IP at home in about 10 years.

And then you start having DNS-style auctions with IP addresses. Eventually, those start going for too much money, and everyone gets off their butts and enables IPv6.

Re:Procrastination

[hedwards]

This is the natural consequences of the small government platform. If you cut taxes and government size you must necessarily cut services or run up mountains of debt, then cut services and raise taxes.

Unfortunately, corporations seem to like to run themselves that way as well with a significant amount of the profits going to the executives running them.

Re:Procrastination

[Enderwiggin13]

Yes it was hyperbole, but we already hear about users getting unfairly sued or threatened with being sued because their IP was supposedly torrenting copyrighted material. I can only imagine that NATing IPs would increase the probability of this happening.

If the **AAs crack team of network security pros can't correctly determine which user is using a static IP, how much trouble will they have with NAT IPs?

Re:Procrastination

[hedwards]

That's why some of us advocate increasing the short term tax rate to something much higher than what we currently have and tailing off to what we've got now for long term capital gains. And pushing the holding period to 2 years or so. And cut the tax rate on dividends to the rate that people pay for capital gains.

The effect of that is to increase the holding period of an investment and discourage reckless speculation. People tend to forget that Enron produced far more winners than losers. The people who ended up holding the bag were a small fraction of the total number of people who invested in it.

It also has the upside of discouraging charlatans that practice technical analysis from screwing up the markets with their charts. Any practice which ignores what a business does to make money should be discouraged.

Re:Procrastination

[Anonymous Coward]

Say what you want, but disasters are just *so* much more motivating than distant problems

Re:Procrastination

[Eivind]

But car-accidents *ARE* adressed seriously -- very much so. The improvements have been DRAMATIC, even over short timescales.

Back when I got my drivers licence, 15 years ago, we learned, as a rule of thumb, that one person died in traffic every day, aproximately 400/year here in Norway. By now, we're down to half that. And that is despite the fact that there's a lot more cars, and the average car is driven more.

Measured in a mile-by-mile way, traffic-risk is reduced by more than 2/3rds in 15 years. That is, frankly, spectacular.

And it's the result of concerted effort on a multitude of areas: better roads. better crossings. better cars. better driver-education. better signs. better light. better snow-removal and so on and on and on.

If this is an example of things NOT being fixed, I can live with it.

Re:Procrastination

[cgenman]

To be fair, right now there is unprecedented unemployment, two wars, a midterm election, an overhaul of the health care system, and the largest oil spill this country has ever seen. The planet will soon be destroyed by global warming, global cooling, rogue nukes, biological terrorism, Al Qaeda in the UK, peak oil, Iran, North Korea, Christian fundamentalism, and the last Harry Potter movie. Running low on global routing numbers, like we have been since 1990, has understandably been backburnered.

Re:Procrastination

[shentino]

For those people that are sitting on piles of class A's they don't need, there isn't a problem at all.

It's rather like sitting on an oil well when people start running out of coal.

Re:Procrastination

[shentino]

As long as people keep caving into settling instead of fighting back, how much are they even going to care?

Re:Procrastination

[maxume]

Your example is stupid:

http://en.wikipedia.org/wiki/List_of_motor_vehicle_deaths_in_U.S._by_year

(especially if you bother to consider things in relation to total population and miles driven)

Re:Procrastination

[shentino]

Sadly, it is for long term value.

In this dog eat dog world, if you make a pit stop to give your engine a tune up, you'll have already lost the race.

Re:Procrastination

[hjf]

Yes, all sounds good, until your ISP starts providing you with 1 private IP address for your home, with no way around it. Here in my city 1 of the ISPs does this, you get an address from the 10.0.0.0/8 range. If you need to poke a hole in the firewall for things like IM file transfer or webcam, any kind of P2P, SIP, SSH/remote desktop/vnc into your home machine, etc... guess what? you're out of luck. Change ISPs? Sure, until the other ISPs are forced to do the same. What are we going to do then?

And that's what we're going to get. I simply don't see the point of mentioning NAT as a near-term temporary solution: it ALREADY is doing that. Guess what? Companies don't give their desktops public IPv4 addresses anymore, they haven't done that in several years now, so I don't see what your point is. You're just in denial and being too optimistic.

I wonder why no one mentions v4 addresses are "lost in routing". Take for example an ISP here, they used to give you a full /24 (legacy CLASS C, and let me stop here for a bit: NOT EVERY ASSIGNMENT IN THE NET IS A, B or C. Only script kiddies dreaming of "T3" "pipes" talk about "class C" and "ping of death", get over it! It's 2010 already. OK, back to my point). So they used to give you a /24. For every 256 addresses on a /24, the .0 and .255 are usually not usable, and the .1 is usually the CPE router. But now they don't give out a /24 anymore, unless you specifically state why you need such a large space. So they give out a /30. 8 addresses, again the first and last are unusable, and the first available is the CPE router. 3 out of 8 or 27% of the addresses are lost in routing.

Let me recap: NAT is not the solution, it's already there holding the internet like duct tape.

Re:Procrastination

[ebuck]

The whole idea in a democracy is to have visionary leader(s) elected to lead the short-sighted (generalization) masses.

Unfortunately, our leaders today are mostly controlled by short term financial interests, which brings us back to square one.

How are short-sighted masses supposed to have enough long-term vision to elect a visionary leader?

Re:Procrastination

[Hatta]

I haven't had a real IP at home in about 10 years.

Any service plan that does not include a real IP address should not be called Internet access. The internet is built on TCP/IP which is a peer to peer protocol. If you are not a peer, you are not really part of the intertnet.

Eventually, those start going for too much money, and everyone gets off their butts and enables IPv6.

Why would ISPs enable IPv6 when selling IPv4 addresses is so lucrative?

Re:Procrastination

[mlts]

What I see is that city planners actually build roads to maximize traffic congestion. Cars stopped on a highway are not wrecking, so it makes the municipality's death stats look better.

It gets me wondering if the car death statistics are not as much due to safer cars, but the fact that there are far more cars on the road, that the speeds where deaths happen just can't be reached on a day to day basis.

Re:Procrastination

[wvmarle]

If it ain't broke, don't fix it.

IPv4 is not broken yet. No, it's not, believe me. I'm still connecting to the Internet just fine. So it's not broken. That's enough reason not to fix it.

Re:Procrastination

[somersault]

People will not fix anything with low impact or low frequency. This is why auto accidents aren't addressed more seriously by society as a whole - the loss of a few lives, or even 40,000 / year in a population of 300 million, is "low impact"

That does sound pretty low impact to me.

I just looked up some odds and (if the figures are accurate) the average person has more chance of dying from slipping when having a bath/shower than you do from dying in a car accident. Why isn't society as a whole outraged at all these idiots who are risking life and limb by having a wash, possibly while DRUNK, or HIGH?

Or are you more bothered about people risking others' lives than their own?

I'm thinking the majority of car accidents are caused by assholes who drive drunk, or outside of their ability and not taking account of conditions. This is not a problem of society as a whole - this is a problem of some humans being assholes.

Re:Procrastination

[mlts]

What we might start seeing are servers using multiple ports for one IP and incoming NAT, perhaps with a hack to DNS (perhaps another record) to support ports as well as IPs.

This would mean that if someone wanted to go to www.foo.com, DNS would hand them not just 9.0.0.1, but the port number, so www.foo.com would resolve to 9.0.0.1:80, and www.bar.com would resolve to 9.0.0.1:8000

Re:Procrastination

[ObsessiveMathsFreak]

And yes, that will break a few applications, which will have to find ways around it. NAT issues have been worked around in consumer software since the mid 90's. It's not a deal breaker. I haven't had a real IP at home in about 10 years.

That great; great that that's workin' out for ya'. Some of us though, think that NAT is the fucking devil, and would prefer an alternative solution. Preferably one that doesn't involve custom exceptions for every second application on our networks.

Re:Procrastination

[Abcd1234]

I'm glad someone finally said it. NAT is the (slightly slower) Plan B.

Ah, if only.

Go ask Comcast how that's going. They've exhausted private IP space in their network. So now you, what, want them to double-NAT their networks next?

Anyone proposing NAT as a serious solution to the IP shortage issue is either a) sticking their head in the sand, or b) simply doesn't understand the scope of the problem.

Re:Procrastination

[Artifakt]

I'd support setting the whole long term holding period as high as 5 years, with a sliding scale between the full long term rate for the first year and a bit better each quarter after that the investor stays invested in the same thing. Add in requirements that the company have some particular percentage of US employees and bank in the US, or the scale goes back towards the short term rate by various proportions. Even setting the employee percentage at a simple 50% would probably be enough to induce investors to avoid stocks where the issuer was moving to more and more outsourcing. (that's by costs, not by headcount, allowing any US based company to still put up to half its employee compensation into places where they think they can get cheap help, yet be able to rely on the US legal system and defense). We would end up with Kramer or somebody similar listing those risky stocks that were approaching 55%, 53% and so on, to where most of them would keep a bit of additional margin.

Re:Procrastination

[cgenman]

NAT is not a solution, and it is duct-tape.

On the other hand, the way the article frames the discussion is that the moment IPv4 allocation spaces run out in X years, the internet ceases to function. That's just not true. There is a lot of duct-tape left, and the kinds of problems duct-tape can solve. It is problematic, but it is the kind of slow burn problem that we tend to learn to live with. We still have the dead crappy unvalidated, spam-prone e-mail system kicking around.

Moving to IPv6 is the right and proper solution. But I suspect we still have about 15 years left of dealing with IPv4 problems before we get there.

Re:Procrastination

[scottzak]

Because it's not a crisis until it's a crisis. Once it's a crisis, THEN it's a crisis.

It's really that simple.

Re:Procrastination

[MorpheousMarty]

2 reasons:

Problems don't get solved until they have to . People are short sighted and lazy. Plus, if you fix something before it's really a problem and anything goes wrong, it's your fault.

You only notice problems that are big, small problems get solved too quickly for them to seem like anything.

Re:Procrastination

[ugen]

Mod this up +100. As a developer of IP-related applications for the last 20 years or so, I always thought that NAT is a proper way to handle it.

The parallel to "real world" (something CS people need to visit from time to time) is quite clear. We don't have every person or entity (or, worse yet, every item that person or entity owns) assigned it's own global unique "street" address or phone number. There is a country, a city, a street, a house number and may be (gasp) an apartment number too. Why the hell do CS people (who are, otherwise, presumably not into global domination ideas) so inclined to uniquely number every single thing with one flat no-namespace number is something that eludes my understanding.

Only "outward facing" systems need a public IP. My dozen laptops, wireless routers, phones, printers and (promised for the last 20 years) a toaster and a refrigerator not only don't need a public facing IP - they are strictly prohibited from having one. I don't need or want anyone to be able to directly contact these devices (or even simply enumerate them or know they exist) without my explicit consent. The same applies to individual devices and workstations within any single business or other entity.

  Assigning individual unique IP addresses to all these entities serves no purpose other than violating user privacy (and, of course helping improve job security of all those "consultants" who will be implementing IPv6 for years to come - and then selling users "add-on" privacy solutions)

Personally, I refuse to promote IPv6 and will continue to do everything in my (small, though they may be) power to prevent its onset, even if by a little bit.

Re:Procrastination

[somersault]

This is a worldwide problem, I wouldn't say it has much to do with democracy. It's just a result of poorly controlled organic growth of a small project into a much larger one. It happens all the time in computing..

Re:Procrastination

[Nethead]

A /30 is 4 addresses. One broadcast, one network, two hosts, often each end of a point-to-point link. Anyway everyone is using /31 now for PtP links (it's 2010 now.) Network routing is really a very small part of the IPv4 space. And try renumbering THAT part! Most network us RFC1918 address for internal routing anyway. Most large networks have issues of running out of that too!

Re:Procrastination

[PitaBred]

The problem is that once it's taken, it's hard as hell to get it back. Taxes almost never go lower. They always trend higher. Same thing with the executive powers granted by the PATRIOT act, and so on. Hell, Bush's tax cuts are being removed because they were only temporary.

Re:Procrastination

[blueZ3]

People procrastinate (both individually and in groups) because in a lot of cases, waiting to decide is the rational thing to do. Making a snap decision can be helpful in some cases (and thus the fight/flight reaction) but a lot of times it's better to collect more information before deciding what to do. You see smoke over the next hill--run away willy-nilly and chance running into the fire's path, or wait to determine wind direction and if you're actually in danger?

Re:Procrastination

[oldspewey]

Taxes almost never go lower. They always trend higher.

They do?

Re:Procrastination

[mandelbr0t]

Because the short-sighted people who made the decision to risk the disaster all but assumed that it couldn't happen.

Re:Procrastination

[blueZ3]

The natural consequence of smaller government is less government coercion of private behavior.

Right now all we have are two wings of the fascists--the "liberals" who want the State to tell people how to live: recycle or be fined, eat what we say or pay higher taxes, don't commit the "hate crime" of creating a "hostile environment" (essentially the criminalization of thought); and the "conservatives" who want the State to tell people how to live: don't view pornography, wear a flag pin, don't view Web sites about "terrorist" topics (essentially the criminalization of thought).

I wish that there were more liberals (in the classic sense) who could see their common ground with Libertarians. I think it could be a powerful counter-force to the Tea Party movement, which I thought might actually be a force for good until it was high jacked by the "conservative" wing of the two-sided coin that's our current party system.

Re:Procrastination

[Anonymous Coward]

So they give out a /30. 8 addresses, again the first and last are unusable, and the first available is the CPE router. 3 out of 8 or 27% of the addresses are lost in routing.

This is not the case with an intelligent ISP.

I have 8 addresses allocated to me, all are usable, and the configured gateway for all of these is x.x.x.1 with a subnet mask of 255.255.255.0.

So, the ISP only loses 3 addresses for every 256, just like before, and can serve many small customers more efficiently.

Re:Procrastination

[growse]

People who are scared to give endpoints public IPs (because it's "too dangerous" or some sort of "privacy violation" are usually just hiding the fact they don't know to configure a firewall. Or a web proxy. Or, you know, the right tool for the job.

Re:Procrastination

[PitaBred]

Sorry. I was speaking as an end payer of taxes, not as a corporate "citizen" with massive access to our politicians to buy laws.

Re:Procrastination

[Aceticon]

Think back to any large company you worked for:

- How many times have you seen the kind of guy/gal that proactivelly checks the systems/processes/code for problems, solves them and thus prevents problems in the future, get celebrated as a Hero/Heroine and promoted?

- How many times have you seen the kind of guy/gal that does not proactivelly seek and fixe potential issues but instead fixes things when they brake, somehow managing to "Save the day" when everybody is in "oh shit!" mode, get celebrated as a Hero/Heroine and promoted?

I bet that the vast majority of places celebrate and promote the ones that solve problems that put the team in the spotlight when they occur, not the ones that prevent the problems from ever appearing.

Do this for 10 or 20 years and the result is a company which is filled with short-term, reactive management from top to bottom.

Re:Procrastination

[xlsior]

Why is it that problems never seem to get corrected until they are well and truly disastrous in scope.

Because there is next to no benefit in being the first on your block to make the switch when it comes to the IPv4 -> IPv6 migration. It's a big hassle to overhaul existing infrastructure to make it compatible, especially when using older equipment that may not talk IPv6 yet. There is a good chance that your upstream providers don't talk IPv6 yet either, so there often is no discernible immediate gain.

Sure, in the long run having everyone on IPv6 is a good thing...
But it's hard to write a good case for why you need to do it NOW instead of next year. Or the year after that.

Hence we wait. And so does everyone else.

Re:Procrastination

[Rising Ape]

We don't have every person or entity (or, worse yet, every item that person or entity owns) assigned it's own global unique "street" address or phone number.

I don't know about you, but mail addressed to me comes to (my name, house number and road, town, post code). NAT is more like only being able to send to the house - or, for ISP scale NAT, the town - and then having to play guessing games with who the post is actually for by inspecting the contents. Anyone who wanted to implement a postal system that way would be rightfully considered insane.

Re:Procrastination

[bersl2]

I can't tell if this is a great troll or just someone misinformed. The CE "routers" don't need to do NAT in order to deny everything incoming except for established traffic and specific punched holes in the firewall.

Re:Procrastination

[fafaforza]

You're overthinking it, and adding too much of your own bias and anger into it. It is no different than waiting til the night before to write your essay or study for the test. And in some instances, that pressure to finish something then and there helps many to perform. Transitioning to ipv6 in many cases involves investment in equipment and effort from network and systems people. naturally, it will be delayed until the last possible moment, especially in this economy.

Re:Procrastination

[oldspewey]

It's called tax dodging.

Well, yes and no. It's a way to shift the tax burden to the company paying the dividends, but here's the catch: unless the company is making large profits you can't just go on drawing huge dividends out of it year after year.

Re:Procrastination

[oldspewey]

My IPv6 example was hypothetical. In my real world experience, I've watched in awe as companies did things that cannibalized the future in order to add a few dollars to the current quarter results - things that did substantial harm when the piper came calling 6 weeks later.

Re:Procrastination

[Kadin2048]

No, NAT is not a good way to handle it.

NAT works -- it's not good, but I will at least agree with you that it functions in some minimal way -- for small networks. But it doesn't work for large ISPs. Comcast has already realized this and gotten on the IPv6 bus, although it's going to cost them. If NAT were feasible, I'm sure they'd do it. But they can't without segmenting their network, which is as much a PITA for them from a management perspective as it would be for their customers.

Eventually the wireless telcos and other ISPs are going to run into the same issues, although their networks are designed differently so they might have a while left. But it's not like networks are in general going to get smaller. People want more and more devices online, and they want those devices to be able to talk to each other.

When you start layering NAT, what you end up with is still a network of sorts, but it's not the Internet. Lots of traditional Internet applications don't work, and worse than that, a great many applications that might be designed in the future won't be, because the architecture of the network will be so limiting. We could quite possibly nerf what has been the greatest wealth generator and communications tool since the printing press, if we build client/server assumptions in so deeply that it's impossible to ever move on from them. Just because the Internet today is principally client/server doesn't mean that it must or should always be.

I'm not a big fan of IPv6. It looks like a bloated piece of shit, frankly, and I've always been disappointed that they didn't go for a more elegant backwards-compatible extension of the address space rather than a forklift upgrade. If the people designing color TV had taken the same route, we'd all still be watching in black and white. But it's here now, and the alternatives are worse.

Re:Procrastination

[sjames]

Management rewards heroic pissing on fires, not calm forward thinking initiatives that make people not look crazy busy. At the higher level, as you state, the next quarterly is everything, any stability after that will be strictly a matter of inertia and heroic effort.

Re:Procrastination

[anUnhandledException]

By your logic there would be no global starvation problem even if the entire world resorted to cannibalism (aka "The Road"). A problem wouldn't exist (and thus no reason to start implementing a solution) until the very last cannibal kills the second to last cannibal left alive on the planet.

Hell there is no food problem right, the last surviving human has enough to eat for next couple days. Right?

Re:Procrastination

[Attila]

Sorry, my fault. Been working on the global warming thing.

Re:Procrastination

[sjames]

It is a bit silly to be bidding $100,000 on a glass of water when you have a filter and are standing next to a fresh water lake though.

Really, we SHOULD have added port lookup to DNS a couple years ago so we could make v6 the first class citizen now and let a single v4 address cover several servers if you couldn't use the direct v6 address. I would say it's far too late for that now.

Yet another great thing being ruined by head-in-ass disease.

Re:Procrastination

[nine-times]

But you also have to adjust bonuses for short-term performance measurements and other kinds of compensation (e.g. "golden parachutes") that enable/encourage people to have a destructive long-term strategy while making out like a bandit.

And even then, that only deals with personal profit motives. Contrary to what some people believe, people are not solely motivated by a rational understanding of what will achieve the greatest personal financial profit.

Re:Procrastination

[nine-times]

And that's what we're going to get. I simply don't see the point of mentioning NAT as a near-term temporary solution: it ALREADY is doing that.

Yeah, NAT is not an upcoming short-term solution for when we run out of IP addresses. NAT was the last short-term solution. NAT is why we didn't run out of IP addresses a really really long time ago. The fact that we're running out of IP addresses now indicates that the ability of NAT to solve the problem is running out.

I guess I'm not adding much to what you already said, though.

Re:Procrastination

[eth1]

Why is it that problems never seem to get corrected until they are well and truly disastrous in scope.

Because it takes that long for not doing something to become more expensive than doing something, and money is all that matters to the entities that have to make most of the changes.

Re:Procrastination

[maxwell demon]

So the best strategy is to find the problems, work out the solutions, but not to apply them until the problems appear, at which time one can apparently promptly solve them?

Re:Procrastination

[2obvious4u]

You mean like Y2K? As I recall it become a non-issue because people fixed it, and the places it didn't get fixed in time didn't cause as many problems as people thought it would. The IPv6 transition isn't any different. Once it gets in the way of business it will become priority number one and then teams will be assigned to fix it. Also anyone who has an IPv4 address isn't even affected by the transition, it only affects new people trying to register. It won't be an issue until after all addresses are used and then it won't be an issue until there is enough new and usable content on IPv6 domains. Only then will it be enough of a priority for businesses and consumers to switch to IPv6.

Re:Procrastination

[mikael_j]

No, the idea of democracy is to have society's rules and administration according to the will of the people, there is no need for a leader in order for it to be democracy.

Re:Procrastination

[petermgreen]

Go ask Comcast how that's going.
Yeah IIRC the combination of their sheer size with a big push for triple play has lead to them using up all of net 10 and having to use public IPs for control plane functions. Sucks to be them but I doubt it's a widespread problem.

Of course even if they migrate the control plane to IPV6 they may well still have to NAT end users to continue providing them with V4 connectivity (though ironically the fact they have had to use public V4 ips on the control plane may help them here as those IPs can probablly be repurposed as customer IPs after new allocations dry up).

But all of that is really rather irrelevant. This is about the internet, not what some big companies do on their admin networks. Post exhaustion a growing ISP has essentially the following choices.

1: offer IPV6 only.
2: offer IPV6 with natted V4 as standard and IPV6 with public V4 as a premium option.
3: offer natted IPV4 only as standard and public IPV4 as a premium option.

I don't see 1 happening for a long time due to the fact V6 only clients can't reach V4 only severs. The question is will most ISPs bother with option 2 when option 3 would be enough to satisfy the lusers? I bet the better ISPs will and the shitty ones won't.

Re:Procrastination

[hjf]

Yes, if it uses cablemodem-style allocation. But REAL ISPs (the ones that can route to your own subnet bought from ARIN/LACNIC/RIPE/ETC) have to route it that way.

Re:Procrastination

[hjf]

/31 for the PtP is ok (ISP-side of the CPE), but you still need a /29 for the client side. And yes, /30 was a confusion, I meant a /29.

Re:Procrastination

[hjf]

I haven't move to said ISP because of that issue. I talked to the admin there, and he said: yes, we NAT the residential connections, and we do block P2P in those too.

Besides there is another problem. try downloading a file from some hoster like Megaupload, Rapidshare, etc: you just can't. Because someone else has already used the free daily limit.

And the price is the same as the other local ISP, only this one sells crap and the other works relatively good.

Re:Procrastination

[hjf]

Maybe this explains it. HP has a 16 million addresses for themselves:

http://whois.arin.net/rest/net/NET-15-0-0-0-1

And if that wasn't enough, they also have:

http://whois.arin.net/rest/org/HP/nets

Re:Procrastination

[hjf]

GM has addresses to spare... http://whois.arin.net/rest/org/GMC-20/nets

Re:Procrastination

[jurbanek]

So they give out a /30. 8 addresses, again the first and last are unusable, and the first available is the CPE router. 3 out of 8 or 27% of the addresses are lost in routing.

A /30 in fact provides "4 addresses" and is the standard point-to-point IP subnetwork as it allows for two real hosts (plus network address and network broadcast address, both traditionally unusable). Magic number method is a quick way to not get tripped up on this sort of math.

A subnet's address size is inversely proportional (but without constant ratio) to the percentage of "lost" addresses.

/30 - 4 Addresses - 2 Usable - 50% Lost
/29 - 8 Addresses - 6 Usable - 25% Lost
/28 - 16 Addresses - 14 Usable - 12.5% Lost

-Weaver

Re:Procrastination

[dwinks616]

No, the problem is, if I slip and die in my tub, that's my own fault.
There is NO SUCH THING as an "accident". If I'm driving down the road, and someone runs into my car, they were doing something wrong. Going too fast, not paying attention, running a red light, whatever. It's no different than if you "accidentally" shot someone.
EVERY SINGLE "accident" needs to be investigated, and the at fault needs to be charged with murder, assault with a deadly weapon, attempted murder, etc depending on whether someone died, was gravely injured or just a bit injured. I GUARANTEE "accident" rates will go down considerably if people realize that hitting another human with a 4,000+ LB object moving at 60+ MPH will land them in jail for 10 years or more. People should be scared shitless about hitting another car every time they get behind the wheel and should thoroughly evaluate whether driving where they are driving is really necessary.

Re:Procrastination

[somersault]

Um. Okay. That's pretty much exactly what I said in my 3rd and 4th paragraphs.

Assholes already know that running someone over is likely to kill them, yet they still drive drunk or in unsafe vehicles because they think it won't happen to them.

You shouldn't be "scared shitless" of hitting another car, you should just learn how to drive "defensively", ie be observant and aware of potential hazards. And if someone is going to run into me in their car, I'd rather I was in my own car than walking down the street or on my bike.

Some accidents are not caused by drivers btw, though short of "acts of god" you're right that there is always some blame somewhere in any "accident".

Re:Procrastination

[KillAllNazis]

In general: If a problem has no profitable solution then it will not be solved. If a problem has a profitable patch-like solution (for example, selling bottled water from clean water sources to places where there are none) then a reinforcement is set up to preserve the problem. In either case, the profitability and establishment of existing institutions tends to suppress new ideas for progress.

Re:Procrastination

[hjf]

OK, I meant a /29. Still a lot of addresses lost.

BTW, point-to-point usually uses PPP (no IPs lost) or cablemodem tricks (make the CPE control link speed and "firewall" the shared media making it look like a point to point, while it's still just ethernet).

Re:Procrastination

[L33tGreg]

What he doesn't realize is that if he uses NAT only, then right now, any of his neighbors using the same ISP just need to add a route to for 10.0.0.* (or whatever block he uses) to route through his public IP. Firewalls protect networks.....not NAT.... NAT is security through obscurity.....

The solution!

[airfoobar]

We should just censor half the internet and reclaim those IP addresses! That should solve the problem and give us plenty of time to move to IPv6!

Hey, it looks our "tech-aware" government is already trying that -- never mind!

NAT

[TheCount22]

Finally we will no longer have to use this IPv4 NAT garbage with all it's limitations!

Re:NAT

[alen]

what limitations? my iphone is on NAT. what will IPV6 allow me to do on it that i can't do now

Re:NAT

[betterunixthanunix]

One issue with NAT is the difficulty in running a server. I like being able to ssh to my home computer when I am at work; but behind NAT, that becomes more difficult (not impossible, just more difficult).

Re:NAT

[TheCount22]

Exactly! Plus you can only forward to a single machine for a given port number.

Oh, also NAT needs to keep a translation table meaning you can't establish large amounts of connections (think torrents).

Re:NAT

[alen]

this has been solved by apps like logmein or something similar. i even have the iphone version in case my mom calls me with a computer problem and she's 2000 miles away

i was a beta tester for MS live mesh a few years ago and used the RDP feature along with the file transfer when on vacation to transfer pictures from a digital camera back home to clear up space on my ssd card

Re:NAT

[hedwards]

Yeah, any application which requires a one to one mapping of IP addresses across the entire network is not going to work with NAT as it's typically used. And definitely not if we run out of unique IPs. As it stands now, it's likely that there are several layers of NAT in between you, me and slashdot.

The biggest limitations aren't really recognized because nobody has been able to release anything that is being limited. At least not on a major scale. We won't know what those things are until the excessive NATing is gone.

Re:NAT

[Ephemeriis]

what limitations? my iphone is on NAT. what will IPV6 allow me to do on it that i can't do now

The original idea of the Internet was a network of peers. Every address was globally routable, and any machine could host content.

There are obvious security issues with this... Which is why we've got firewalls... But there wasn't really anything standing in the way of you hosting a game server, or website, or whatever on your home machine.

NAT now stands in the way of you doing this. NAT has destroyed the whole "network of peers" thing.

NAT is fine for simply consuming content. For your iPhone, for example, I doubt if it's an issue. And if you're just loading up random web pages at home, or connecting to WoW, or whatever - you'll be fine.

But if you want to host a web page at home you're going to have to not just open the ports in your firewall, but forward the traffic from your outside IP to the inside IP. And if you want a second box to serve up a web page too? Too bad. You only get one port 80 per IP address, and you've only got one globally routable IP address.

Again, if all you're doing is consuming, this isn't all that much of a problem. But then you aren't a peer, either.

Where this starts to be more of an issue is with various devices that we now want to be able to communicate with remotely. It's becoming more and more common for people to want to remote into home computers. Or maybe program a DVR remotely. Or maybe some utility company wants to be able to check your electric/water meter remotely.

Being able to host your own content is becoming more important, not less. And shoving everything behind NAT is becoming more of a problem, not less.

Re:NAT

[Eunuchswear]

Nothing. You have an iPhone.

Re:NAT

[jimicus]

Not a great deal in practical terms, but it's a little more complicated than that.

There are quite a lot of things it's actually quite difficult to do with a layer of NAT in the way. Things that you may well want to do on your iPhone.

IPSec is a PITA, as is SIP. Both of these have workarounds that are commonly implemented which deal with NAT, but these workarounds can introduce all sorts of interoperability issues which don't otherwise exist. Anyone who's supported large numbers of road warriors using an IPSec based VPN knows what I mean - sooner or later you can more-or-less guarantee that someone's going to stay somewhere where the hotel's wireless configuration unintentionally breaks IPSec, and Murphy's law dictates the person affected will be your CEO at a conference discussing the benefits of outsourcing your IT support to India.

(Variation for IT Support People who Live in India: It'll be your CEO at a conference discussing outsourcing your IT to the US, which has become much cheaper now there are so many IT specialists and so few IT jobs).

The fact of the matter is that those workarounds shouldn't really need to exist in the first place.

Re:NAT

[multi io]

I wouldn't go as far as to say writing a port forwarding rule is difficult. A minor one time annoyance at best.

..as long as you're the one running the NAT. When your ISP runs the NAT for you (as is the case with mobiles, and will be the case with cable/DSL connections in the future as public IPv4 address availability drops even more), good luck talking your ISP (even via NAT-PMP or whatnot) into forwarding ports for you.

Re:NAT

[drachenfyre]

You have 65,000 inbound ports. You can't possibly be peering with more then 1000 or 2000 other torrents anyway without completely destroying your bandwidth. Further, there is nothing that says SSH has to run on port 22. You just like it to because it's easy. There's no reason you can't NAT to 100 servers for SSH, run 50 webservers (with both SSL and non-SSL ports), torrent to 5000 of your best friends and still have 59,000 ports left to play with. And a translation table with 5000 entries isn't beyond the capabilities of anyone that might actually have the much infrastructure running behind the device.

Re:NAT

[trapnest]

Oh, also NAT needs to keep a translation table meaning you can't establish large amounts of connections (think torrents).

Only if your router is rubbish.

Re:NAT

[r7]

NAT is only a problem if you are a Google, a Government, or some other entity who is effectively prevented from
monitoring someone because they do not have a unique IP address. NAT is the most effective privacy tool on the
Internet. The only people calling it evil are ILECs, doubleclicks, and spies.

Of course NAT is also good when you want to switch Internet providers, or have more than one ISP. Without it you
would have to renumber all your internal hosts to change or fail-over. ILECs have so far blocked NAT in IPv6
because it will provide such good vendor lock-in.

NAT is also incredibly effective in firewalling outside hosts from getting a free pass to internal networks. Of
course spies, "aggregators", and spyware vendors don't like this.

The sad part is that few will adopt IPv6 until it has a standardized NAT. ILECs don't really care if this never
happens because they will make a bundle reselling addresses in the resulting IPv4 bubble. Not just ILECs of course,
but companies like Cisco, HP, and even Allstate Insurance who registered millions of IP addresses decades ago,
before the advent of CIDR.

I guess all this is not really so sad when you consider that what's really sad is our (US) government, who can't
even see what's coming down the pike.

Re:NAT

[wvmarle]

I don't agree with you. Multi don't.

First of all I'm happy that not all my boxes are directly reachable from the outside world. Only those that I choose (DMZ or specific port forwarding). A simple quite effective security measure against many worms, for example. What's not addressable can't be infected that way.

Secondly if you're really trying to run web pages from home, and want your other computer to serve one too, why not putting that one on say port 8080? You won't be running any serious commercial web site from such a set-up anyway (assuming you're somewhat sane). And it's reachable from the outside again.

Same for your VCR and your water meter: assign them their own port numbers. No unique IP needed.

And yes of course it's convenient if everything is addressable from anywhere. The Stuxnet writers would have had an easier job if they could reach those PLCs directly instead of first having to infect another computer.

Re:NAT

[MikeBabcock]

Tunnels eliminate this problem.

Side note: I don't think NAT is the solution.

That said, doing an IPSec tunnel to your machine would use exactly one port on your router, and give you full access to all services on the internal machine you connect to by tunnelling the TCP/IP data in other IP packets.

Re:NAT

[ugen]

This is such a strange argument. I hear it all the time and I just don't get it.

So dealing with NAT-related design issues of a couple (literally about 3) protocols is "hard" and "should not be done"
But dealing with completely new design issues of essentially every single protocol, device and system for IPv6 support *should* be done?

I know IT people need to get paid and grab at any chance of a big project to improve job security, but this one is just out there.

Re:NAT

[Ephemeriis]

First of all I'm happy that not all my boxes are directly reachable from the outside world. Only those that I choose (DMZ or specific port forwarding). A simple quite effective security measure against many worms, for example. What's not addressable can't be infected that way.

That's what firewalls are for.

Secondly if you're really trying to run web pages from home, and want your other computer to serve one too, why not putting that one on say port 8080? You won't be running any serious commercial web site from such a set-up anyway (assuming you're somewhat sane). And it's reachable from the outside again.

The problem with putting that one on port 8080 is that your average user has no idea what a port is or how to specify one. If I tell my parents to go to www.example.com they can manage it. If I try telling them to go to www.example.com:8080 they'll wind up with all sorts of strange interpretations of that.

Just because I'm not going to be running any "serious commercial web site" from my house doesn't mean I don't want people to be able to find it. I could run a small photo album, or my own blog, or a forum, or a mail server... Any number of things. If I only open it up to my friends and family there's absolutely no reason why my bandwidth couldn't handle it.

But, if you really think that's unreasonable, replace "home" with "small business that's only been given/sold a single public IP address by their ISP". The relative scarcity of IP addresses has turned them into commodities. You have to actually purchase additional IP addresses. If you're running even a few servers that need to be publicly accessible it quickly becomes very inconvenient to have to pass everything through NAT. And you only need two of the same thing to find yourself needing another IP address.

Same for your VCR and your water meter: assign them their own port numbers. No unique IP needed.

Granted, we're unlikely to have 65,000+ devices requiring their own connectivity to the Internet... But your answer is tantamount to suggesting that every mail server should have its own, unique port number. There's a reason we've standardized port numbers. Imagine trying to set up a mail server if every single machine you tried to talk to had its own, unique port. Imagine trying to manage traffic without being able to match against port numbers.

And yes of course it's convenient if everything is addressable from anywhere. The Stuxnet writers would have had an easier job if they could reach those PLCs directly instead of first having to infect another computer.

Again, you're somehow forgetting the fact that firewalls exist.

If you don't want a machine to be accessible from the outside world, you don't allow it. Only allow outgoing connections. It isn't that hard.

Re:NAT

[yakovlev]

What I don't understand from all this NAT stuff is that NAT (for the home user) is mainly about 1 thing: COST. I can spend $50 on a router and save $20 for a switch and $5 per month to get a second IP. The router pays for itself in 6 months, and that's just to connect 2 computers. I have 4 connected to my router right now.

I have no reason to believe that the numbers would be significantly different on IPv6. My ISP would probably still charge to get additional IPs on my network, which makes NAT a major cost savings.

I realize from an architecture perspective that NAT is ugly. However, it represents a real cost savings on real networks. The security discussion is just a red herring for cost, which is the real reason for home NAT deployments, which are probably the most common.

Re:NAT

[wvmarle]

Running your photo album on your home computer fine; I don't see why you would need to spread that over two computers. Http redirects should be able to help you out with that even.

Small businesses that need two separate computers as e-mail servers? Doesn't sound like a small business to me. Then your business has at least like 100 email users, and using a load balancer you can run it on a single IP address still. Anyway more reliable than hoping your incoming connections spread themselves over multiple IP addresses. And I can't think of any other servers they may possibly need two of. Even big sites like slashdot.org or google.com resolve to a single IP, yet they are run by a complete network of servers.

Re:NAT

[Pentium100]

NAT is great, it decouples my internal addresses from external ones.

My internal network is 192.168.0.0/24. My external ip is a.b.c.d. If I change my ISP and get a different IP, let's say e.f.g.h, the only thing that needs to be updated is the configuration of the router. The internal network can be the same, no matter the ISP. Any disruption in my internet connection will only disrupt data transfer to/from the internet, my internal network stays the same.

Now, if I got 10 IP addresses from my ISP and decided to assign them to my internal network, I would have to change those addresses if I change my ISP or use a different connection (let's say a backup connection when my main one goes down). Now a disruption in my internet connection would require me to change the IPs of my local machines, which would cause disruptions in the data transfer between them.

Plus you can only forward to a single machine for a given port number.

With 65535 port numbers, you can forward a lot of ports to a lot of machines and higher level protocols should work independently of the port number.

Oh, also NAT needs to keep a translation table meaning you can't establish large amounts of connections (think torrents).

That depends on the router. Linux routers by default keep connection information for 5 days (who thought of that?), which does use up a lot of memory, reducing the timeout to a few hours can allow me to establish thousands of connections with a router that has 64MB or RAM. I know, 64MB is expensive and all, but if you need a lot of connections, you'd better have at least this much memory. A 100MHz x86 CPU cannot route 200mbps traffic either.

Re:NAT

[Pentium100]

I use L2TP over IPSec VPN that is provided by Windows and so far I could connect from any connection (NAT or not) to my VPN server that is behind NAT.

Re:NAT

[Dan Dankleton]

In IPv6, renumbering becomes trivial.

The host portions of your addresses are 64 bits and automatically generated from the MAC address, so these will stay consistent before and after the renumbering.
Hosts are not statically configured with their global address; they get them from the router (via ra-autoconfiguration) or the DHCP server.

This means that you renumber the router interface and it automatically gives the right addresses to hosts. The only thing left to do are DNS and firewall rules, which can be fixed with a simple regexp.

Re:NAT

[anUnhandledException]

When you control the NAT it is an annoyance but not a problem.

What happens when your ISP implements NAT (and maybe double NAT) and the ISP upstream provider is implementing NAT. Suddenly unless you have the ability to configure all those NAT layers (and dream on thinking ISP will let you configure their network) nothing will get to your NAT layer.

Re:NAT

[j h woodyatt]

More accurately, you and your 1000 neighbors will be splitting 64Ki between you at the carrier-grade NAT, and you can forget about port leasing, because they aren't implementing it.

Re:NAT

[Ares]

There's no reason you can't NAT to 100 servers for SSH, run 50 webservers (with both SSL and non-SSL ports)

Sure there's no reason you can't run 50 web servers on different ports on the same IP. except for customers who will never learn that you have to type in http://www.google.com:8080/ instead of google.com. browsers have been designed to assume that any url without a protocol type is for http port 80. why? because port 80 is the standard designated protocol for http.

the inability for customers or potential customers to access your business's web site is a sufficient motivator to not stray from the standard.

Re:NAT

[mikael_j]

Uh, it's not dealing with "a couple" of NAT-related issues, the more widespread NAT becomes the more issues pop up. Sure, you can generalize it to "a few design issues" but these design issues affect every program that wants to be able to receive inbound connections.

Also, for most modern applications IPv6 shouldn't be a major issue as long as they don't have thousands of places where IP addresses are defined as being four bytes in size. The main issue is support further down in the stack and on the endpoints that's pretty much done (with the exception of the nutjobs still running some old G3 iMac with Mac OS 9 and IE 5.x or the guy who swears there has been no better operating system than Windows 95 and that no one could ever need a faster computer than a 166 MHz Pentium with 32 MiB of RAM. And yes, I've encountered both examples in real life, they're generally luddites or cranks).

I'd gladly have the IPv4 address exhaustion thing not be an issue, it means lots of extra work and issues, especially with legacy systems. But it is an issue and it needs to be dealt with properly, you can't keep putting bandaid after bandaid on something that's bleeding to cover up the blood...

Re:NAT

[s7uar7]

The solution for that is to modify DNS to include the protocol and port. Instead of assuming port 80 for http and looking up the IP address via DNS, the query becomes, "what's the IP address and port for google.com http?"

Re:NAT

[DrBoumBoum]

An OpenVPN tunnel would be even neater (100% user space, very reliable, dead easy to configure).

Re:NAT

[the_other_chewey]

Sure there's no reason you can't run 50 web servers on different ports on the same IP. except for customers who will never learn that you have to type in http://www.google.com:8080/ [google.com] instead of google.com.

It's actally no problem at all to run many webservers for different domains
on the same machine, using the same IP and all listening on port 80.

See e.g. Apache's "VirtualHost" functionality, which is used for millions of hosts without a problem.

Re:NAT

[Ares]

the problem with that line of thought is that if you change one protocol that the internet relies on so heavily to function (DNS) instead of another (IP), nothing has been accomplished. yes this is an oversimplification of the problem at hand, but standard port numbers are standard port numbers for a reason. what's worse, if you allow the two to coexist, if a couple of https web sites mapped to the same ip address but with different ports, older clients that didn't have the support for the new DNS extension would still have the problem of not being able to get to one of them.

i won't get into the matter of alternate name resolution systems (NIS, /etc/hosts, etc.), because i home they're not sufficiently common for internet purposes to be an issue.

Re:NAT

[Ares]

ever try running multiple https virtual hosts on the same ip address/port 443 combination like that? becuase of the nature of ssl, it doesn't work.

Re:NAT

[L33tGreg]

Several come to mind: 1) Servers (ssh to your phone) 2) True IPSEC (IPSEC uses signed headers and therefore cannot be translated since the router would need the private key to do so) 3) Not bog down routers doing translation. Translation is substantially slower than routing. There are more these are just right off the top of my head.

Re:NAT

[badkarmadayaccount]

DNS can redirect ports, you know (google.com -< google.com:8080)

Re:NAT

[MikeBabcock]

OpenVPN is easier but not cleaner. Its TCP based and there can be nasty repercussions when doing TCP over TCP due to exponential back-off and other problems.

On nice clean normal connections, it seems to work fine, but IPSec is a more rugged way to handle the problem.

Re:NAT

[DrBoumBoum]

Where did you get that information from? OpenVPN is UDP based and has always been as far as I can tell. It supports tunnelling over TCP but advises against it. From the documentation:

OpenVPN is designed to operate optimally over UDP, but TCP capability is provided for situations where UDP cannot be used. In comparison with UDP, TCP will usually be somewhat less efficient and less robust when used over unreliable or congested networks.

Routers

[hackwrench]

Have routers use IPv6 and regular computers use IPv4 and reclaim the IPv4 addresses used by the routers. Use IPv4 tunnelling. I think I've got that right.

Re:Routers

[jd]

The original plan was that the Internet backbone would use IPv6 first, tunneling all IPv4 traffic. After which, ISPs would migrate. Since appliances can be dual-stacked, end-users would be the last, using a hybrid of IPv4 and IPv6 transparently (since end-users use names and names will "just work"). This transition would allow people to migrate over to IPv6 with no real "drop-dead" date.

It never happened.

Multicast has been native on the Internet backbone for over a decade, but most ISPs refuse flat-out to enable it. Resistance to IPv6 is even tougher, with mainstream name registration only happening recently.

There will now be an IPv6 drop-dead date, because of the laziness and ineptitude of ISPs. There is no time for the planned transition and the dual stack plan has been largely foiled by IPv6 being disabled by default. (Grandma can't just have her computer "just work" during a transition because Microsoft chose to not let her computer "just work" during a transition. Mind you, most Linux distros don't auto-detect it either, so it's not just a Microsoft fault. However, as they have the bulk of users, they have the bulk of the impact.)

There can't be a sudden switch-over without disabling practically the entire user-base. Having said that, it might mean work will get done, so maybe the backbone providers should enforce this anyway. It would be good for America.

Re:Routers

[maxwell demon]

Multicast has been native on the Internet backbone for over a decade, but most ISPs refuse flat-out to enable it. Resistance to IPv6 is even tougher, with mainstream name registration only happening recently.

Why didn't they just charge more for backbone access from ISPs which don't provide it? I mean, money has always been the best argument to do something.

Nobody cares.

[ledow]

Nobody cares, nor needs to, except the ISP's and hosting outfits. If they provide a nice 6-4 proxy (or whichever way around it is), 99.999% of users can continue doing everything they normally do. I've done it on several of my machines in the past, been in the IPv6 net and browsed IPv6 websites to confirm it, and I never once had to touch my IPv4 config or do anything too fancy - certainly nothing that an ISP couldn't do transparently from their side of the net.

It's an issue if you're hosting websites, because then your site needs to be accessible from the IPv6 addresses, but that's an issue for the hosters, most of the biggest of which are managed hosting outfits that can switch that on overnight if they haven't already - if they are allocating static IPv4 addresses, it's just a matter of translating and passing on IPv6 requests for a recognised IPv4 equivalent address to an internal IPv4 network. The root DNS servers are running IPv6 already, etc. There's absolutely nothing to stop this just working on most people's machines today and, no, not every machine needs to upgrade to IPv6 addressing in order to do that. In fact, if anything, suggesting that internal business networks suddenly become IPv6 addressable is the most stupid suggestion in the history of the world - most places just want an "4-6 convertor" in layman's terms and they'll tick along quite nicely on their internal 10, 176, and 192's without caring. Most places would run absolutely fine, the only place it matters is the extreme borders of the Internet.

People don't run IPv6 not because of any of those reasons in the article but because a) they haven't heard of it, b) ISP's don't support it or won't do it for them automatically and c) a lot of OS's never come preconfigured to use IPv6 if it's available. Oh, and of course, d) nobody will care until their IP address allocation requests start getting turned down.

It's not a big deal, it's not going to kill NAT's and 30 years from now there will STILL be local networks, internal VoIP systems, print-servers and whatever else using IPv4 addressing because it's a damn sight easier to leave a working config alone than to upgrade/replace every bit of hardware that touches IP. I can use IPv6 today. There's absolutely no need to until every link in the chain supports it and that's still YEARS away even with US government backing. And even then, IPv4 isn't going anywhere - it's just being superceded. It's like saying that all SSH servers have to switch to SSH2, or all wireless LAN's to 802.11n - it'll happen, and a little nudge won't hurt, but overall people just don't care enough for the majority of cases and their old stuff will still work on IPv4 in 20-30 years time if it's still operational.

Tell me when even 5% of the websites that I use regularly are available over IPv6 and I'll look at setting up my VPS to do the same.

Re:Nobody cares.

[am 2k]

Tell me when even 5% of the websites that I use regularly are available over IPv6 and I'll look at setting up my VPS to do the same.

Hard to say, since you don't list what sites you are using regularly. However, google search is available via http://ipv6.google.com, which is a rather big part of common web usage.

Re:Nobody cares.

[ledow]

Useless is less than 5% of the sites returned support IPv6 (or could even tell you what it was).

Slashdot, for instance, doesn't.

Re:Nobody cares.

[Eivind]

Yeah. The entire internal network in my house uses 10.*.*.* adresses as it is, and aslong as all webservers are on ipv4, none of them need to change that. Wake me up when there's a significant mass of internet-services only available over ipv6.

Re:Nobody cares.

[TheCycoONE]

Hmm... at work I can't access that page. \o/

Re:Nobody cares.

[Lord Ender]

In my experience, it is so easy to put AAAA DNS records along side your A records, and to tell your servers to bind the v6 addresses in addition to the v4 addresses, that there is no need for translation devices. Dual-stacking is simple, easy, and JUST WORKS. On the server side, every piece of software worth a damn and every OS worth a damn can handle v6 natively. Right now.

Re:Nobody cares.

[AmericanInKiev]

If you're an ISP, and people are paying a premium for each and every IPv4 address; why in bloo&y he!! would you bother to support or push IPv6 addresses on anyone?
(so I've been told)

Re:Nobody cares.

[caluml]

You're the kind of person who doesn't want a phone with a camera, internet access etc, aren't you? "I can't see why people need to do more than make phone calls".

Re:Nobody cares.

[mplex]

Nobody cares and there's no reason to care. ISPs should implement Carrier NAT at the ISP, and charge extra for public IPs. Once ARIN gets a market going for IP addresses, there will be incentives to clean up and resell address space.

Name a mainstream application that doesn't work behind NAT these days...they don't exist. As a carrot, ISPs can hand out global IPv6 addresses to promote P2P v6 clients etc to keep that ball rolling, but there's really no rush.

Re:Nobody cares.

[suutar]

bittorrent. Okay, it works behind nat that you control and can open incoming ports on, but you just handed your nat over to your ISP, so no inbound port for you. Everything you download is going to have to be on http, and the server holding the linux image you want is going to be _slammed_...

Re:Nobody cares.

[Eivind]

No. I'm the kind of person who's realistic.

Realistically, most people aren't consciously aware of having a "home network" at all, and a majority of them, if they have one, simply use the wlan on the nat-router they use to connect to the internet in the first place. Worrying about what kind of adressing is used on their home-network is FAR off the radar.

I -do- have a wired home-network, part fibre-optical and part copper-based, aswell as 2 wireless routers, and around a dozen devices that connect either wirelessly or wired, 3 of which I can access from outside my home-network. But I'm not so far into the nerd-woods that I'm unaware how untypical this is.

If anything, I see a opposite trend: NAT is becoming less and LESS of a hassle, because more and more devices and protocols come with enhancements to deal with it, precisely BECAUSE that is the de-facto standard. (a home-network with NAT was a major hassle before STUN became common, for example)

This is really sad

[Omnifarious]

And at every job I've worked in the past 5 years, management has completely had their head in the sand about it. :-( And none of the developers understood enough about IPv6 to push in an even faintly credible way. :-(

I've been running IPv6 on my home network since about 2002. It's just not that hard. In fact, it's a lot easier than running IPv4. My IPv4 home network has a seriously contorted configuration because of the constrained addressing. When I wasn't even given a block of IPs but instead given X number of individual IP addresses it was even worse. My IPv6 network, OTOH, is configured quite simply and obviously.

OTOH, even though I've had an IPv6 DNS server for ages, my stupid registrar STILL does not support IPv6 glue records. It's ridiculous. The standard has been stable enough to do something like that for at least 3-4 years now. I just want to strangle them.

Last I checked, we only have about 200 days before ARIN stops being able to hand out new IPv4 addresses. It's around 7 months. After that, hosts start appearing on the Internet that only have IPv6 addresses. The connectivity breakage will be slow, subtle and inexorable. I bet it takes the tech industry at least another 5 or 6 years before they have to fix the problem or not have customers, and I bet it won't be fixed before then. So very very stupid.

Re:This is really sad

[Inda]

I keep seeing IPv6 addresses on my home network; on the XBOX360, on the router, P2P, the laptop.

I've done exactly zilch in setting up IPv6. What gives?

Re:This is really sad

[lidocaineus]

360 does not support ipv6, so you can't be seeing it on there. For the others, those are probably link local addresses or link locals AND actual routable IPv6 addresses, if you have an ipv6 device advertising routes (could be happening, some devices already do this automatically). You need to read up on how ipv6 works.

Re:This is really sad

[growse]

I use gkg.net - they seem to support ipv6 glue.

Re:This is really sad

[compro01]

"Huge" is relative. We're currently assigning about one /8 block (~16 million addresses) per month. Those 100 million addresses, even if they could be clawed back in a reasonable expedient manner, would only buy about 6 months.

Going though the list of companies given class A blocks, recovering all of them that aren't assigned to people who are likely to be using them (AT&T, IBM, etc.), it would buy us about 18 months, two years at the outside.

Re:This is really sad

[RAMMS EIN]

``And at every job I've worked in the past 5 years, management has completely had their head in the sand about it. :-( And none of the developers understood enough about IPv6 to push in an even faintly credible way. :-(''

I think that's testimony to how well IPv4 has worked, and I think that deserves some recognition. Three cheers for IPv4 and those who made it happen!

Re:This is really sad

[Omnifarious]

Ahh, a denier. I've seen you people too. The estimates that you claim to hear periodically keep on changing as the estimates change. I think you are mistaking early warnings for estimates that IPv4 will run out of addresses in a short period of time.

For the past 3 years, the date has remained relatively consistent. I have a nice phone app that shows exactly how many blocks are left. The number's been going down right on schedule.

Re:This is really sad

[Omnifarious]

As someone pointed out, every device that's IPv6 capable gets a link local address without any configuration on anybody's part. And while all the one's I've seen start with fe80, the range for link local addresses start with fe80::/10 (i.e. only the first 10 bits are constant).

Devices send packets out for a number of reasons, though if you've never configured IPv6 of any kind, the most likely packets you're seeing are router solicitation packets asking any routers on the network to please respond. IPv6 doesn't really need DHCP, though DHCPv6 does exist in the IPv6 spec. Mostly IPv6 devices find a router and ask it what prefix they should configure themselves with. Often routers will simply announce themselves and say what prefix hosts should be using.

Additionally, newer versions of Windows have a number of features designed for tunneling IPv6 packets over the IPv4 network. This enables them to speak IPv6 and talk to other IPv6 machines even though the intervening network is not aware that IPv6 exists.

Re:This is really sad

[Omnifarious]

Thanks for the tip. I've been considering switching registrars over this, even though most of my domains have a year or two left on them.

Re:This is really sad

[Omnifarious]

I think that's testimony to how well IPv4 has worked, and I think that deserves some recognition. Three cheers for IPv4 and those who made it happen!

1. Hip, hip hooray!
2. Hip, hip hooray!
3. Hip, hip hooray!

*grin* I agree with you, though it's still frustrating.

Gonna be a hard switchover

[Linsaran]

As an employee for a major electronics retailer, I can see that this whole situation is going to be brutal on the general internet going public, but more importantly it's going to be brutal on me when I have to try and explain to grandma Jones why her internet doesn't work right anymore on her 10 year old computer and how she's going to have to buy a new router/modem/network card/computer. People don't want to deal with ugly inconvienent stuff like the switch to ipv6 (no matter how needed it might be) they just want their stuff to work. I really hope this transition goes a lot smoother than it looks like it's going to, but I don't have a lot of faith that it will.

Re:Gonna be a hard switchover

[Panaflex]

Nah, it's an opportunity to sell new gadgets!

Someone will come up with an inline ethernet 6to4 proxy for $30. Router manufacturers will finally build it in... it will be as simple as serving ip4 to older DNS requests, and ip6 to newer machines. As long as the DNS requests are managed correctly it won't be a problem.

The real hard work will be at the ISP and enterprise level... The service software guys (RH, IBM, CA, Oracle etc) will be banking.

Re:Gonna be a hard switchover

[am 2k]

On the plus side, you'll have a lot more stuff to sell.

Re:Gonna be a hard switchover

[hedwards]

And those people shouldn't have to know. The ISP should be sending out a new modem or update that handles it in the modem. The end user shouldn't need to know about it unless he or she wants to.

Re:Gonna be a hard switchover

[Linsaran]

Certainly true, unfortunately things rarely work that way in the real world, I mean look at how much the switch over to ATSC digital TV broadcast from the old analog NTSC system got screwed up. Even with the whole government inititive to get people the converter boxes, the switch wasn't exactly smooth or easy, even though there was plenty of advance notice.
From personal experience, I can say there were a LOT of very upset people who used to pick up analog broadcasts just fine but had insufficient signal strength for the digital feeds. Granted that probably had more to do with networks abandoning VHF frequencies for UHF ones, but I'm sure there were plenty of cases of 'fuzzy' analog stations that were still watchable falling off the digital cliff.

The solution is simple

[Anonymous Coward]

Just force all porn sites on the internet to be accessible from IPv6 addresses only.

Re:The solution is simple

[Archangel Michael]

This is actually insightful, and would force the issue. People would do anything to get their porn.

However the problem with 6 vs 4 is that 4 works. It works well enough with NAT for most things. People aren't going to change until they absolutely have to. And right now, almost nobody "has to", so it isn't going to happen.

It is going to take someone like Google to force us to switch.

Re:The solution is simple

[sjames]

It's modded funny, but it would actually get the job done. There would be a few holdout ISPs claiming they don't support v6 "for the children", but most would be falling all over themselves to make sure they had v6 up and running by the day porn goes dark on v4.

When is /. going to get an IPv6 address?

[avij]

Serious question. I already have an IPv6 address, why doesn't Slashdot have one?

Re:When is /. going to get an IPv6 address?

[grumbel]

Running IPv6 on a webserver means cutting of a chunk of your users with broken IPv6 setups. That is why you see a lot of http:://ipv6.google.com style sites, but hardly anybody having a AAAA record on their main domain.

Re:When is /. going to get an IPv6 address?

[avij]

Yes, that's unfortunately true.. At this point I'd be happy if Slashdot had an IPv6-only subdomain, such as ipv6.slashdot.org. At this moment that address does resolve (like any subdomain of slashdot.org), but unfortunately only to an IPv4 address :-/

Re:When is /. going to get an IPv6 address?

[gmueckl]

heise.de, a major German tech news site ran a test for precicely that reason about two weeks ago: they added an AAAA to heise.de in addition the normal AA record. Out of the thousands of visitors they have each day less than 10 were unable to reach that site in that configuration and wrote in about their problems and only one turned out to be unfixable because of a router misconfiguration somewhere else in the network. Since they advertised their test weeks ahead and asked users to report any problems they might experience during the test, the number of complaints they received is pretty low. So the argument of mixed AA/AAAA records not working properly of users is luckily losing its credibility, it seems.

Re:When is /. going to get an IPv6 address?

[grumbel]

So the argument of mixed AA/AAAA records not working properly of users is luckily losing its credibility, it seems.

Depends, on standard configuration it doesn't seem to be a big issue, as by far most users will just fallback to IPv4 and ignore IPv6. On the other side each time I tried to setup a 6to4 IPv6 tunnel I ended up with half the IPv6 sites not being reachable. So while things should be fine for most part for IPv4/IPv6 dual stack, I am wondering how the situation will change if IPv6 is actually provided by your ISP and devices no longer just fallback to IPv4.

Re:When is /. going to get an IPv6 address?

[Abcd1234]

heise.de, a major German tech news site ran a test for precicely that reason about two weeks ago: they added an AAAA to heise.de in addition the normal AA record. Out of the thousands of visitors they have each day less than 10 were unable to reach that site in that configuration and wrote in about their problems and only one turned out to be unfixable because of a router misconfiguration somewhere else in the network.

Counter-anecdote. I've been running v6 at home for about a year now with absolutely no problems (Hurricane Electric, seriously, you guys kick ass). But I decided I wanted to add a new private 802.11n router to my network, so I went and picked up a DIR-625, which is a lower-end, 2.4Ghz-only 802.11n-capable D-Link WAP.

Now, I have a *slightly* unusual setup, in that I have a dedicated firewall (m0n0wall, you guys also kick ass), and I wanted this private, WPA2-secured AP to sit on my internal network and basically bridge the wireless pool directly to my network (no, in an enterprise scenario, I wouldn't advise this, but at home, with a properly secured WAP, I think it's safe). Furthermore, the firewall sends out v6 router advertisements, and I use simple v6 auto-configuration, so that any device connected to my LAN or existing 802.11g WAP automatically gets v6 connectivity (the latter is open and sits in its own DMZ). All of this works perfectly.

So I plug in the WAP so that the LAN-side of the device is connected to my network (this bridging the networks), and then connect to it with my laptop... and my v6 connectivity is shot. Attempts to connect to any v6 hosts time out. Odd. So I check my routes, and lo and behold, inexplicably, I have a default v6 gateway route that corresponds to a *loopback* address. A little digging, and I discover this POS AP is sending out router advertisements, and advertising it's *loopback address* as the gateway address. Buh??

So naturally I log into the AP and make sure v6 is disabled. Except it is. And it's *still sending out radv messages for it's loopback address*. The solution? I had to reflash the blasted thing and replace D-Link's firmware with dd-wrt.

Now, this is an incredibly common piece of consumer-grade hardware. And their IPv6 implementation is, apparently, horribly broken. If I were a regular user, and, say, Google, advertised AAAA records for www.google.com, I would've been unable to hit their website. So can you really blame service providers for choosing to either a) not advertise AAAA records for their services, or b) only do so to whitelisted ISPs?

Re:When is /. going to get an IPv6 address?

[Anonymous Coward]

Chicken and egg kind of problem. As long as few hosters advertise A and AAAA records for the same domains, users are going to suspect that the web site is at fault even though it's really due to a problem with the users' local IPv6 configuration. Heise ran a test to find how many users could be getting that misconception and the test result was much better than they had expected. "Thousands of visitors" is a bit of an understatement, btw: Heise.de has an Alexa traffic rank of 587 (29 in Germany). On a typical day, 0.2% of all internet users visit heise.de. If a web site of that size can switch on IPv6 and get only a negligible number of problem reports, then it makes other sites hesitation look like procrastination, not caution.

The only way to work out the kinks of IPv6 is to use IPv6, and it looks like that is possible without breaking much. This experiment (and now live configuration) should encourage more sites to just go for it.

Re:When is /. going to get an IPv6 address?

[RAMMS EIN]

Minor correction: I think you mean A record rather than AA. AA is something else ...

Re:When is /. going to get an IPv6 address?

[sjames]

So where is ipv6.slashdot.org? Surely they must be aware of the need to get v6 going ASAP, don't they read /.?

That and unlike cnn.com (for example) it can assume that many of it's users will know what's going on and have a fair chance of fixing it.

Re:When is /. going to get an IPv6 address?

[sjames]

Yes, if you do network administration long enough, you might need AA.

Re:When is /. going to get an IPv6 address?

[knorthern knight]

> Google is in the same position, they should just do it, because
> then in 1 day, the problem just won't exist.

And the reason it won't exist after 1 day is because every user that runs into
problems will switch that same day to Bing or Yahoo or Altavista (Remember them?).
The only "benefit" to Google is that MS will no longer be able to claim that
Google is a monopoly ;) And people who have shorted Google shares will be happy.

Re:Wolf Wolf Wolf

[disi]

I see it a little like domains. If a domain is already taken, you contact the owner and pay for it. If an IP is already taken...

crisis? opportunity!

[F�an�ro]

So, what are the best ways to profit from this crisis?

Hoarding IP addresses is an obvious way, but that market seems pretty crowded already.

Re:crisis? opportunity!

[Goffee71]

IP Bounty Hunters - the more villainous and scummy the better

Re:crisis? opportunity!

[sharkey]

Yes: crisitunity!!

Re:crisis? opportunity!

[caller9]

Selling IPv6 gear and migration services to federal orgs who get funded to do it regardless of need.

Re:crisis? opportunity!

[kieran]

Ready a company that offers IPv6 migration consultancy, and gather a bunch of contractors who are qualified to roll it out across large corporate or ISP networks, handle the DNS fixes, patch custom code, and/or upgrade ancient servers to an IPv6-ready OS.

IPv6 is not in demand, and will not BE in demand until there are new sites out there that don't have an IPv4 address because they can't get one, and thus are ONLY reachable from IPv6-enabled networks. When that does happen, demand will rise suddenly and rollouts will suddenly be worth the money. But most of the work will happen in a pretty short span of time - think Y2K panic - and that will be when you can cash in.

As a network engineer, I am waiting eagerly for this to happen. And anything that helps save IPv4 space from running out quite as quick is just delaying the inevitable. Give it all away! Announce there is no more coming! And finally you will bring on the long-awaited change.

Maybe we'll sort out multicast while we're at it :)

Re:crisis? opportunity!

[EpsCylonB]

no, ordinary residential routers will not be upgraded to support ipv6 in a short timespan

the bulk of the migration to ipv6 might take as little as 5 years, but i predict there will still be multiple users natted behind a single ip address for 20 years

Re:crisis? opportunity!

[CBravo]

Become an ISP yourself and get a free C block. It worked for us..

Re:crisis? opportunity!

[petermgreen]

IPv6 is not in demand, and will not BE in demand until there are new sites out there that don't have an IPv4 address because they can't get one
I would expect it will be quite a long time after allocations run out at the RIRs (if ever) that buisness sites can't get IPV4 IPs. Prices will go up of course as people are competing over a limited pool of IPs but that doesn't mean they won't be able to get them.

Re:Right now?

[2.7182]

Actually you might say we've been running out of them since the moment the first one was assigned...

Re:/: No AAAAnswer

[ledow]

Maybe if you spelled slashdot correctly?

Re:/: No AAAAnswer

[chill]

Yeah? WTF is slahsdot.org?

Re:Right now?

[Anonymous Coward]

Exactly. Haven't we been running out of them for at least the last 10 years?

Awesome that no-one ever cared.

It will be like this as well for oil and clean water and air. Populations need to learn to dis-trust their businesses and governments more, that would be a good start and a help. It would also help a lot if people learned to look themselves in the eye.

There is truth in what you say -

[anti-NAT]

attackers don't only come from the Internet. The "hard shell, gooey centre" security model is doomed now that people are buying laptops, ipads, iphones etc. Mobile devices need to protect themselves, and since everybody is buying mobile devices, upstream network located firewalls are losing their effectiveness.

Re:There is truth in what you say -

[drinkypoo]

The notion that a border firewall was a sufficient security mechanism ended when the portable computer was invented, which is to say, it was never a valid concept. Indeed you could make the case that indeed telecommunications itself basically invalidates the idea. Get someone to hook up a modem to some internal system and you've got an attack surface.

It's truly distressing how many effective security mechanisms go unused for lack of a user interface. SElinux has the potential to make system intrusion all but a thing of the past, but it is tragically underutilized because it is difficult to create a useful profile. NX/DEP goes unused in many cases because it causes compatibility problems. All POSIX.2 systems have ACLs but virtually none of them use them because there's no GUI tools. Firewalling did not become popular for user desktops until the various add-on firewalls for Windows with autoconfiguration interfaces appeared (e.g. ZoneAlarm.) I'm sure some other people can imagine some other even more excellent examples... well, actually, it's hard to imagine a better example than SElinux. But I really want ACLs, and I'm kind of annoyed that GNOME or KDE hasn't taken a stab at them yet.

Re:There is truth in what you say -

[david_thornley]

The first commercially successful portable computer (the Osborne 1) was released in 1981. It was fairly quickly followed by similar computers. At that point, I'd suspect almost nobody had border firewalls.

In other words, the hard shell over gooey center security model was never valid.

Re:There is truth in what you say -

[Fulcrum of Evil]

At that point, hardly anyone had networks.

Re:Right now?

[Anonymous Coward]

we're running out of ipv6 addresses!

buy your *now*

Milking the IP4 squeeze

[martyw]

Is it not entirelly impossible that IP vendors, network providers, ISPs and hosting companies have already accumulated or say squattered enough 4byte IPs to take advantage of the upcoming IP shortage situation and are not rushing the much needed IPv6 hardware deployment as they should?

A Douchebag

[L4t3r4lu5]

What are you for posting the answer to your question in the title of your post, but then posting the question in the body of the comment below it, and then failing to properly end your question with a question mark?

The leading cause of smug is no longer hybrids.

[pak9rabid]

It's the unnecessary use of IPv6 on private networks.

Re:The leading cause of smug is no longer hybrids.

[sdguero]

Muuuaaaaaaaaaaahh...2001:0db8:85a3:0000:0000:8a2e:0370:7334.

Where is my wine glass?

Re:Wolf Wolf Wolf

[julesh]

I participated in a RIPE training 4 years ago and according to their statistics, we were supposed to deplete the IPv4 address space during 2009. Well guess what..

The low estimates for running out of addresses are the ones that usually get quoted, but both low and high bounds on the estimate have been available for a while and while they tighten taking a midpoint has been quite stable for some time now. 4 years ago the estimates were 2009-2013. IIRC the bounds are now something like June 2011 - December 2012.

Re:Right now?

[mcvos]

15 years ago I first heard about IPv6. IP4 was running out of address space, and IP6 would save the day. A bright new future with enough addresses for every single object on earth. For years I've lived in continuing surprise that it still hasn't bee implemented yet, and now it's too hard to implement because of weird crap that's been added to IP4 in last 15 years?

May are reporting doom scenarios

[PARENA]

I'm thinking this will be just as huge a problem as the y2k bug was. Hold on to everything you can and... only some minor issues pop up.

Re:May are reporting doom scenarios

[jd]

Y2K was only a minor issue BECAUSE every programmer and their cousin was busy fixing the bugs for several years. A few million man-hours and workarounds from hell later, you'd expect things to function fine. There were vendors that ignored the issue and it is those vendors that reported problems in 2000. It is THOSE examples you should look at, because THAT is what your world would have been had the rest of us not fixed things for you. Be grateful, wretch, that we bothered. Because next time we might not. And there is NOTHING you can do or say to change that.

Re:May are reporting doom scenarios

[dbIII]

There were vendors that ignored the issue and it is those vendors that reported problems in 2000

Macro-fucking-vision: Y2K bug in 2008 in flexlm that extinguished permanant licences marking them as expired on 1 January 2000.

Re:Right now?

[aliquis]

It will be like this as well for oil and clean water and air.

Off-topic:
I discussed politics/what party and old man at the gym had voted for last time I saw him.

Useless information:
He voted for Moderaterna and talk about how we couldn't do without nuclear power, needed it and how good it was nowadays. Which was rather ok (I don't know much about modern technologies but as far as my own reasoning goes running the power plant and storing the waste is kinda ok, but I think we need to accept mining our own raw material if we are ok with nuclear power instead of having someone else do it, and do we want to? Haven't read up on Thorium and don't know much about newer reactor designs but it doesn't matter much atm.)

Point:
But then he started talking about global warming and how obviously they where so wrong because the last winter was so cold! ...

I don't know, ask the deniers

[SmallFurryCreature]

You got plenty of people here who are permanant residents of the state of denial. So why not ask them?

Ask the idiots who year after year come up with "reclaim a handful, that will delay the inevitable for a couple more weeks, so nothing needs to be done" or "NAT, I heard that solves everything! Yeah, I nat my windows XP machine and everything is windows XP so that is the solution!"

People HATE change and HATE having to learn new stuff.

And the longer they put it off, the more they got to keep denying it, else they look silly.

what stuns me...

[Skal Tura]

is why didn't we just go for an extension?

Normal IPv4 is 4 sections, for IPv6 we could have added 2 sections, making IPs such as:
150.150.150.150.150.150

Simple to understand, minimal hardware & software changes. Of course, some new features will be lacking but in any case...

Putting the remaining 2 sections on separate portion of the packet, keeping the first 4 sections normal, would allow legacy hardware to route these, yet trivial to make new hardware to understand.

We could have even gone for extensible protocol, address minimum if 4 sections, but at will the endpoint can allow for extension of N length.
Thus we'd need only a *single* IPv4 address per ISP for example, and they are free to give out as many as they want from that.

All the midpoints would route these trivially, and the endpoint is the only one needing to translate the last sections, making no tunneling necessary as you could visualize tunnels created automaticly, without any problems.
This would have made minimal to no impact whatsoever for backbone networks at this moment, all it would have needed are:

  - Some new edge routers for those who wish to extend
  - Software update to operating systems of trivial level
  - Instead of Class Cs given for new applicants, you give just a Class D (what is now single IP address)

The transition would have been smooth and easy, and if started when IPv6 came around, it would be supported by now widely by all operating systems, switches etc. only a marginal group of legacy systems do not understand.

Legacy system support:
  - They are made to believe they have IPv4 address "Class D"
  - Something like NAT is used to translate this based upon MAC address of the NIC.
  - No downsides of NAT
  - All benefits of NAT
  - Basicly the same method "extensions" are being done, this time just in reverse.
  - Lightweight
  - Downside: Still needs packet manipulation at the switch (edge switch in case of ISPs)

This would have been *über* easy to accomplish, and can be easy to accomplish EVEN TODAY.

New software for some DSLAMS or Edge switches: Do reverse extension address translation. Done deal, no OS updates required for typical home user. Of course, that is very limited support.

OSs need to be updated for full feature set, such as extensible addresses used in typical lower level network tools (ping, traceroute as an example, which typical users DO NOT use).
On Phase 1 it would act 100% just like NAT. No support for servers as of yet tho.

Getting servers of extended IP address to work for OSs not supporting extended IPs is the tricky portion, but as of today is not required (enough IPs to go around for servers at the moment), and could follow up in several years. Those left behind, are left behind, nothing around that.

There are multiple solution routes for that aswell if legacy system are needed to make connection to extensible IP addresses, translations done on the switch. All of these needs to be researched what their impact is.

One solution is to dynamically map reserved areas of IPv4 space, or 1 class A set aside for this. The switch assings for extended IP address an regular IPv4 address from this space, allocated for this MAC address at request time. We manipulate DNS results according to this data from regular response.

- System requests dns for slashdot.org
- Switch detects this and waits for response
- Response is arriving, switch looks into the results: (changed to extended)
slashdot.org. 3583 IN A 216.34.181.45.100.100

Changes response IP to:
224.216.100.100

  - connects to 224.216.100.100 (224.x.x.x is reserved/unusable space)
  - switch translates that to 216.34.181.45.100.100 and does NAT for the connection

How this is *NOT* done for modern system: Modern systems in the initial request (origin IP) had the extended IP. NAT disabled for this system.

Acquiring IPs:
  I'm not familiar with DHCP protocol enough to envision a proper scenario, but my guess is we can extend the protocol trivially.

Please proof me wrong this wouldn't work so i can rest easy.

Re:what stuns me...

[DarkXale]

You can still do that.

An IPv6 address that has a bunch of collected 0s after each other can be shortened down by using ::

E.g. 0:0:0:0:0:0:0:0:0:0:224:16:100:100, can be written as ::224:16:100:100.

Or you can write 100:0:0:0:0:0:0:0:0:0:0:1 as 100::1

The device/software will interpret the :: as 'fill in the missing sections here with 0s'

And it'll be written in Hex rather than decimals

Re:what stuns me...

[hakey]

is why didn't we just go for an extension?

Normal IPv4 is 4 sections, for IPv6 we could have added 2 sections, making IPs such as: 150.150.150.150.150.150

It's Internet Protocol Version 6. It actually has 16 bytes.

Re:what stuns me...

[Daniel Phillips]

is why didn't we just go for an extension?

That would have made too much sense and the IPv6 committee wanted to build a monument.

Re:what stuns me...

[Daniel Phillips]

Putting the remaining 2 sections on separate portion of the packet, keeping the first 4 sections normal, would allow legacy hardware to route these, yet trivial to make new hardware to understand

They will fit nicely in the checksum field, which is redundant. Less one bit, used to make the checksum invalid so that routers will not attempt to route the packet if they do not understand the extension scheme. The two extension bytes properly belong on the low order end of the address so that the existing CIDR continues to work properly.

Re:what stuns me...

[CAIMLAS]

That's kind of part of the problem, though. An IPv6 address is much more difficult to read.

Not only did they (needlessly) do away with the . separator, making it intrinsically incompatible (and more difficult to read), they made decimal representation of an address difficult. Nevermind netmasks and broadcast. Quick: which subnet is 3ffe:0501:9999:ffff:: in?

In essence, they did a complete redesign, from the ground up, with only slight consideration for backward compatibility. Why? "So we don't have to change this again," or something like it, I'm sure. How many times have we heard that (and then hit them on the head some time down the road)?

Re:what stuns me...

[CAIMLAS]

I have to say, I like this idea; it's basically what I came up with as a preferred method, but I'd not conceived the "NATe" intricacies. I'm not much of a network engineer, though, so I'm sure there's something I'm forgetting. None the less, it makes much more sense within the scope of things I understand - and, unlike IPv6, it isn't a one-way compatibility with the current getup. (Usually, new systems have to support communication with the old both ways, not just one, as is the case with IPv6.)

It could even be extended repeatedly, using the same mechanisms. At the fabric layer, the overhead would seemingly be somewhat negligible.

I really wish that this would be the route we take forward. It's much more organic as an extension, and allows for further extension down the line without a 'reboot'.

Re:what stuns me...

[Sancho]

Putting the remaining 2 sections on separate portion of the packet, keeping the first 4 sections normal, would allow legacy hardware to route these, yet trivial to make new hardware to understand.

This would have made minimal to no impact whatsoever for backbone networks at this moment, all it would have needed are:

    - Some new edge routers for those who wish to extend
    - Software update to operating systems of trivial level
    - Instead of Class Cs given for new applicants, you give just a Class D (what is now single IP address)

So they go into the payload? Thus decreasing the amount of real, useful data that you can actually put into the packet and increasing the total number of packets flowing through the backbone, as well as the total amount of data that's being pushed through. This quite obviously impacts the backbone.

You seemingly haven't considered low-mtu links, either. The extra data you have to put into the packet will really start to add up there.

- Software update to operating systems of trivial level

Networking stacks are hard--not because the protocol itself is hard, but because interoperability is absolutely essential. We can't get IPv4-only network stacks right. To suggest that this would be a trivial modification blows my mind.

- System requests dns for slashdot.org
- Switch detects this and waits for response
- Response is arriving, switch looks into the results: (changed to extended)
slashdot.org. 3583 IN A 216.34.181.45.100.100

Changes response IP to:
224.216.100.100

And this adds a huge amount of complexity by breaking the networking stack model wide open. Switches modifying content? No. Just...no.

Re:what stuns me...

[Pentium100]

So they go into the payload? Thus decreasing the amount of real, useful data that you can actually put into the packet and increasing the total number of packets flowing through the backbone, as well as the total amount of data that's being pushed through.

And in IPv6 they go to hyperspace, making the header take no more space than an IPv4 header, to that the amount of useful data in each packet is the same between IPv4 and IPv6.

Re:what stuns me...

[Sancho]

With IPv6, we're redesigning everything anyway, but we're trying to do it right rather than hacking something onto IPv4.

Re:what stuns me...

[Pentium100]

Of course, after all, a good system on paper is worth much more than a system that works and is actually used in practice.

The internet now is too big for reboots.

Re:what stuns me...

[Gnitset]

  - connects to 224.216.100.100 (224.x.x.x is reserved/unusable space)

224.0.0.0/4 is used for multicast, so you can't use that range

Re:what stuns me...

[Skal Tura]

I deal almost solely on "higher level" as well, not with the lowest of detail.

Yes, the NATe would give 2 way support, and infact get the hardest to upgrade points, home users, on it as the first thing.

Servers etc. are easier upgrade as they are 98% of the time maintained by professionals, and it's not exactly that hard thing to do:

- Server kernels updated
- Switch firmware updated
- Last switch: Enable subnet extension
- Update server DNS entries and IPs.

The overhead of extension is minimal at worst, and in fact it would build the routing tables on the switch doing the extension, distributing routing load across more switches and further down the pipe.

Of course, best method is to actually change BGP routing and support from starting edge switches, and other switches can remain "dumb" in this regard.

Re:what stuns me...

[Skal Tura]

Yeah, they must like doing things "let's build it bigger & fatter" :D

Some famous genius in history said (Einstein, Newton?) something along the lines that "anyone can build things bigger and more complex, but it takes a true genius to make things smaller and more efficient"

Re:what stuns me...

[Skal Tura]

Thank you for clarifying it on a bit more lower level :)

Re:what stuns me...

[Skal Tura]

Switches such as your local ADSL "router". They can be called switches or routers, whatever.

Switches do already NAT (atleast ProCurves i've checked lately, as did Ciscos), what's so much different?

or VLAN as well afaik does change content physically getting sent over the wire ...

Nothing new there

If the programming bit is hard for switches: They should consider upgrading their programming methodology and make a full stop for a moment to think what they are doing, is it the simplest way they can do it ...

(I've coded some quite damn complex systems myself, so i'm familiar with the programming bit)

Re:what stuns me...

[Skal Tura]

exactly and so correct :)

IPv6 might be on paper good (someone forgot tho some practicalities), but on practice ... Not so supported

Re:what stuns me...

[Skal Tura]

Illustrative purposes, did not check for what it is being used.

Re:what stuns me...

[Sancho]

First, some definitions. Words matter, so use the right ones.

Switch: Device usually operating at the data link layer that chooses which link to send a packet to.

Router: Device usually operating at the network layer that routes between different networks.

Very nearly all consumer-grade "routers" have a built-in switch, leading to a certain amount of confusion by people with just a little knowledge of the subject. Many enterprise-grade routers have the capability of doing switching, often by installing a particular blade in the chassis.

All that out of the way, NAT and VLANs are handled at the network layer, with just enough logic built into the switches to allow them to function in the environment. VLANs are handled by encapsulation--the entire packet sent by one end of the connection is incorporated into a new packet which is routed (and switched) accordingly. The data is unaffected.

It's the same with NAT, which really has nothing to do with switches. Rather than encapsulation, though, the router modifies the headers of the packet (again, not the data.) Of course, it has to keep track of the connections in order to correctly correlate connections to NAT IP addresses, except in the odd case of one-to-one NAT (when it isn't strictly necessary to do so, but most NAT devices will anyway.)

One of the important things to realize is that we really want to operate only on the headers if at all possible. This is because they are fixed length, making it very easy to optimize. When you start getting into variable-length calculations, it becomes much slower. You have to worry about whether or not there's really a header stored in the data portion of the packet, and if so, whether it's valid. There's a very good reason that data and routing information are separate in IP. We could probably use options to indicate the presence of this data, but we're still talking about considerable additional load on the router. This will lower the packets per second that the router can handle, and since you'll have additional fragmentation (due to needing to insert into the data field on already maximum-sized packets), you're drastically lowering performance.

In essence, to get any of this to work, you'll probably need to add or replace infrastructure anyway. So if you have to do that, why not just do it right?

Re:what stuns me...

[JesseMcDonald]

An IPv6 address is much more difficult to read.... Not only did they (needlessly) do away with the . separator, making it intrinsically incompatible (and more difficult to read), they made decimal representation of an address difficult.

Seriously? IPv6 addresses are no more "intrinsically incompatible" with IPv4 address than any address with more than 32 bits must be. Strings of hex digits separated by colons are no more difficult to read than strings of decimal digits separated by periods. There is absolutely no need to represent addresses in decimal, which is harder to work with for bit-oriented protocols anyway.

Nevermind netmasks and broadcast.

Netmasks in IPv6 are identical to netmasks in IPv4: "192.168.0.0/16" vs. "aaaa:bbbb:cccc::/48". There are more bits involved, but the format is the same. There are no subnet-specific IPv6 broadcast addresses; a reserved multicast address is used instead (ff02::1, similar to 224.0.0.1 in IPv4).

Quick: which subnet is 3ffe:0501:9999:ffff:: in?

The subnet is 3ffe:0501:9999:ffff::/64, of course. IPv6 subnets are always 64 bits, with the remaining 64 bits reserved for autoconfiguration.

Quick: which subnet is 10.133.180.131 in? 10.0.0.0/8? 10.133.180.0/21? 10.133.180.128/30?

Plan B

[Spazmania]

For your information, plan B is ISP NAT and a zero-sum game address transfer market. That would allow us to reallocate upwards of 80% of IPv4's addresses, extending the life of IPv4 some 10 to 20 years. It's not a fun prospect, but it's eminently workable -- perhaps even more so than IPv6.

So, anyone who says there's no plan B doesn't know what they're talking about.

Re:Plan B

[cheekyjohnson]

Drop IPv4, switch to IPv6. Stop artificially extending outdated technology if it doesn't need to happen (it doesn't). It'll suck for a time, yes, but it will eventually pay off.

Re:Plan B

[PitaBred]

Assuming you don't want to use VNC, VoIP, IM file transfers, bittorrent, access your home DVR remotely... sure, it's workable! It's as workable as a backup to the Internet as candles are a backup to electricity.

Re:Plan B

[anUnhandledException]

How the hell did this get modded interesting?

How exactly is ISP level NAT going to work with port forwarding?

Me & Spazmania are behind the same public IP address (37.37.37.37)

A bittorrent (or VOIP, or whole host of other applications) packet comes in on port 23829 to 37.37.37.37. Is it suppose to go to me or Spazmania. The ISP has no way to determine. Packet dropped.

Re:Plan B

[radtea]

Stop artificially extending outdated technology if it doesn't need to happen (it doesn't).

And yet the odds are you typed that on a machine that's using the wretched x86 instruction set...

Better technology never wins. More convenience does. ISP-level NAT is starting to look awfully convenient...

Note that I'm not saying this is a good thing. I was an early adopter of RISC technology and stunned that x86 has lasted so long, even though it's mostly RISC under the hood for the past decade or more. I'm just pointing out that this is the way things have tended to go.

Re:Plan B

[ceoyoyo]

Actually, it sounds like it would suit most of the powers that be just fine.

Re:Plan B

[sjames]

As long as you just want to be a consumer of web and mail, it works to a degree (it will require some big honking firewalls to do the NAT), but if you actually want to serve content, ssh to your home machine, or do anything even slightly off of the norm, you might as well just cut the cable because it's not going to happen.

Just forget it is NOT plan B, it's just giving up.

That's a real shame when v6 is actually quite easy to set up and even the ancient XP machines can handle it.

Re:Plan B

[Spazmania]

How the hell did this get modded interesting?

It isn't. The somewhere south of 1% of you who have the slightest idea what port forwarding is will pay the extra $5 for a hobbyist/gamer/home office Internet connection that has a publicly routable IP address. The other 99% who do email, web and the occasional VPN to work won't notice or care about the difference. If anything, the reduced hits from scanning bots will improve the network security those 99% experience with their computers.

Or did you imagine you'd be forcibly stripped of the IP address you actually use with no recourse? Seriously, such a straw man.

Re:Plan B

[Spazmania]

it will require some big honking firewalls to do the NAT

What makes you think that? A generic linux appliance on old hardware can handle 1000 general purpose NAT users easily. Add that to the 1% of users who actually use the Internet in a way that they need a dedicated IP address and you're still looking at a better than 50:1 compression of client-side IP addresses consumed.

Or was there some technical reason that ISP NAT needs to folks hundreds of thousands of users into the same single box?

Re:Plan B

[Spazmania]

My Vonage (VoIP) works just fine behind a NAT and my DVR calls out to a remote service from which I control it. I don't need VNC or bittorrent. Neither do 99% of the folks who buy residential Internet service. If you're one of the 1% that does, you buy the static IP address option for an extra five bucks. No muss, no fuss.

Re:Plan B

[Spazmania]

Nothing is "better" in a vacuum. You always have to consider the holistic picture.

At every step along the way the computer with the x86 chip provided the user experience that didn't require me to immediately find and purchase all new software, much of which wasn't as good as what I already had. From a practical, user perspective the computer in which the x86 chip was part of the package was consistently the better technology.

That's the challenge IPv6 faces. What good is it if I can't use it to play farmville?

Re:Plan B

[petermgreen]

Most IM file transfers have a fallback to server based transfer.

As for the other things many of them are things that ISPs would like to see the back of or at least charge you for a buisness account for.

As the GP says it's not a fun prospect but from the ISPs POV it will provide a way to keep providing the lusers with their facebook/im/email/youtube/etc while also providing another way to get more money out of the geeks. Win/win for the ISPs.

Re:Plan B

[sjames]

Considering that we're talking about NATing entire ISPs, that's going to be many millions of users. I imagine the ISP will want to at least centralize the admin on that making it effectively a big honking clustered firewall.

Re:Plan B

[Spazmania]

Certainly. They centralize admin of all the subscriber cable modems now. Why would they do anything else with the NAT boxen?

Re:Plan B

[PitaBred]

You don't have multiple levels of NAT. You tunnel a single port through. Say that again when your ISP starts doing NAT before it gets to you.

Getting things done.

[Civil_Disobedient]

Corollary:

If it weren't for the last minute, nothing would ever get done.

Dual stacking is the wrong approach

[Nicolas MONNET]

Until recently (and probably today still) there was no mechanism to allow a IPv4 host to talk to a IPv6 machine, even if there is address space reserved for the former in IPv6. NAT64 was not being seriously worked on until recently, yet it's obviously absolutely needed; without it, IPv6 hosts need to be dual stacked, ergo have an IPv4 address. What happens when you have both? If IPv4 gets broken for some reason, nothing useful works, so it gets fixed. If IPv6 gets borked, you probably won't even notice because everything is still using IPv4. So in the end many theoretically dual stacked machines are actually single stacked.

Re:Right now?

[idontgno]

How long did we know that the year 2000 would pose a problem for legacy and other craptacular computer systems? How long before that date did the industry actually begin to address them?

It's always a problem for "next quarter". Unless it damages (profits|revenues|share price) right now, fixing it is just a cost center.

IPv4 is warmer and I'll never switch

[SteeldrivingJon]

I'll never switch to IPv6 with its cold, digital precision rendering of data. The lower resolution of IPv4 just provides a better rendition of old favorites like slashdot, to my eyes anyway. Sure, there's some noise, some clicks and pops, but nothing matches wikipedia seen through a nice tube monitor.

Re:IPv4 is warmer and I'll never switch

[j h woodyatt]

For the win.

Re:Right now?

[GigsVT]

It's all thanks to IPv6 being designed to poorly that no one wants to deal with it.

If IPv6 were a reasonable upgrade, people would have already done it. No one wants to memorize or type 128 bit addresses.

Re:Wolf Wolf Wolf

[electron sponge]

December 2012.

man those Mayans sure were smart

You're all just getting this?

[rickb928]

Really?

Well, ok, a little recap:

IPV6 has been resisted by virtually all major players, with few exceptions.

IPV6 is poorly tested in the real world. We will see massive problems getting it working.

IPV6 WILL WORK. It will take some time.

IPV6 will coexist with IPV4 poorly, and we will see a dramatic changeover as the critical mass of IPV6 nodes comes online, and IPV4 is more trouble than it's worth to keep around for a little while longer. My estimate, 3 years.

Asia will lag behind in IPV6 adoption.

Some interesting points:

The U.S. Department of Defense holds 11 Class A blocks. If they could reduce their usage to just 3, we could give IPV6 another 3 years of grace. But:

- If we give IPV6 3 more years, it will still take 3 years from then to substantially implement it. And the industry will take those 3 years to avoid the pain.

- The DOD will need at least 5 years to reorganize and give back those Class A blocks. The Navy alone will need 2 years to negotiate with EDS/HP to make the changes. Read up on NMCI and you will recognize a genuine military-grade CF. NMCI is a failure. IPV6 would merely give EDS/HP another opportunity to gouge the service. They rarely miss these opportunities.

- There are several Class A block owners that look like better candidates for either conversion or elimination. None seem ready to do what the DOD would have to do, i.e. spend massive amounts of time and money to make a change for the community, without any real benefit to them.

Just some personal IPV6 observations:

I had two different Fedora distros fail for me at home because IPV6 was turned on and both my router (Linksys WRT54G stock F/W) and my ISPs (Cox and Qwest) fritzed their IPV6 implementations. No, wait, both ISPs had no working IPV6 in the Phoenix area in 2005-2008, despite claims to the opposite. The Linksys I will probably have to reload with something more useful, but it's the early one that can take a lot of new firmware.

Oh, and turning off IPV6 in each Fedora release required different and arcane methods. A hint to the Linux community - common and stable configuration methods would be a blessing. And not just a GUI. I know, security, security, security. I can assure you, my broken Fedora builds were secure, even from me. A stopped clock is right twice a day.

I think my Ubuntu distro left IPV4 on and IPV6 off, but I haven't looked. It works, and has for 3 years.

Despite the clamoring for IPV6, it just has no traction. Why bother yet? Like a lot of things, crisis will have to escalate to failure before this gets fixed.

If Jon Postel were still with us, he would have already made this happen. I miss him so. We need individuals that drive Internet management and administration, not groups. Internet by committee is failing. Can we not find anyone trustworthy to lead Internet functionality at this level?

No, Stallman is not the answer. And nobody at Sun/Oracle either.

Re:You're all just getting this?

[CAIMLAS]

Asia will lag behind in IPV6 adoption.

Doubtful. I'd wager they're ahead of the curve, to be honest.

Unlike the West, they haven't got 30+ years of institutional IT build-up and backward compatibility to worry about. They haven't got mainframes which have outlasted a hundred employees and are not compatible. They're able to implement from the ground up due to not having the glut of legacy stuff.

Re:You're all just getting this?

[rickb928]

Unfortunately, they will be dominated by China, which has no reason play nice with anyone right now.

But I think you give Asia more credit than due. APNIC is not as nimble as you seem to be implying.

Re:You're all just getting this?

[compro01]

If they could reduce their usage to just 3, we could give IPV6 another 3 years of grace.

What? We're assigning roughly 17 million addresses per month. That would not buy us 3 years, more like 7 months.

Asia will lag behind in IPV6 adoption.

I doubt this. Current projections are showing that APNIC will be the first RIR to run out of new IPv4 addresses to assign.

Re:You're all just getting this?

[rickb928]

Then it's already over. In that scenario, I expect IPV4 assignments to end before 2011. God help us.

Of course, if DOD could go to 3 Class A blocks, that would give us 8 to work with. Ignoring all the classful problems, which should NOT be an issue, does that last us at least through most of 2011?

Not that it matters, DOD can't do that.

Re:You're all just getting this?

[anUnhandledException]

Even 8 class A blocks would provide only months not years.

The IANA has been depleting/assigning roughly 1 class 8 block per month. This trend has held true for last couple years.

1 block reclaimed = 1 month.

It simply isn't worth it.

Re:You're all just getting this?

[rickb928]

True.

Blaming mobile doesn't work. My G1 from TMO gets a 10. block address, and most carriers have to do that. It even routes through a 172.16.x before getting back into 10. privates.

It must be China. If everyone in China had an address, we would be in some trouble.

Re:You're all just getting this?

[compro01]

At current rate, the fourteen /8 blocks IANA has in their pool will be assigned to the RIRs by June of 2011 (Once IANA is down to the last five /8 blocks, the next time a RIR requests addresses, they will give one block to each of the five RIRs) and wash their hands of IPv4, dealing only with IPv6 addresses from then onward.), but the RIRs will still have their pools. Of those, APNIC will be the first to run out, probably in October, followed ARIN maybe a month later. RIPE NCC is an unknown, as they've been tightening their requirements to receive blocks of addresses, though I'd say they'll either be out or rejecting practically all requests by January of 2012. LACNIC and AFRINIC will be the last to run out, probably lasting through 2012, as they don't assign many addresses, so that final block will last them awhile.

Re:You're all just getting this?

[compro01]

We're fine for this year, but things will start hitting in 2011.

IANA will give out the last 5 blocks (one to each RIR) in their pool in either May or June of 2011 and wash their hands of IPv4, dealing only in IPv6 addresses from then onward.

APNIC will be the first RIR to deplete their pool, probably in August or September. ARIN will likely be right behind them. RIPE NCC will last longer, as they've been progressively tightening their requirements to receive address space, but I would expect they'll either be out or rejecting practically all requests by January.

LACNIC and AFRINIC will continue on as normal probably through at least part of 2012, as they don't give out many addresses, so their blocks from the final five will last them for some time.

Ford

[CarpetShark]

Non-IT Companies like Ford doesn't need to be on a list like this at all. Apart from a a few WAN IPs, a webserver, and a mailserver, they could probably put their whole network behind NAT, and no one would notice.

Re:Ford

[MikeBabcock]

NAT didn't exist in its present form when these addresses were handed out. The assumption was that every machine on the Internet was a routable entity unto itself.

IPv6 brings back that concept, with all its benefits and security issues.

Re:Ford

[Beorytis]

Maybe having a class A address block is what allowed Ford to fare better than the other two of the big three in recent years.

Re:Ford

[LWATCDR]

Ford was at one time a huge military contractor. They even had a division called Ford Aerospace. Also people forget that in the 60s and 70s the big three where using a pretty large percentage of the computers and tech in business. Also back then NAT wasn't around yet.

Re:Ford

[sjames]

The security issues only exist if the network people shouldn't be doing security anyway. NAT just happened to provide a decent level of protection for machines behind the firewall. A simple set of v6 rules can provide exactly the same protections.

Block inbound connections, inbound SYN,ACK packets that don't match an outbound SYN, and UDP unless there was a matchong outbound UDP first.

Meanwhile, by not re-writing every packet passing through, the firewall can handle a lot more traffic for the same resources.

Re:Ford

[petermgreen]

Afiact the real reason early allocations were so wasteful was the concept of "classes". Your network was either assigned a class A, a class B or a class C, not anything in between. So if you needed more than 2^8 addresses you got 2^16 addresses and if you needed more than 2^16 addresses you got 2^24 addresses.

Re:Ford

[Creepy]

I agree - you could still route traffic through a gateway and put some rules on that gateway server that prevent certain traffic through. NAT also provides anonymity, which IPv6 vehemently does not want, but end users may - I really don't want advertisers to know every place I go, for instance, and IPv6 allows that. On the plus side, it has built in security (IPsec), so only the target site will know your IP.

Well, I guess you could just change your MAC address and regen the IP if you wanted anonymity (the IP formula for IPv6 uses the MAC address to generate the unique address) and then switch it back afterward, but that seems like a pain.

Re:Ford

[sjames]

Nat doesn't do very much for privacy in most cases. The advertiser doesn't much care which computer in your household accessed what, just that one of them did.

You could in theory choose a different IP for each connection, but the prefix will still give you away.

Re:Ford

[Nursie]

"The security issues only exist if the network people shouldn't be doing security anyway. "

Right, like my mom. The internet is not just for geeks these days, and the idea of having publicly routable (and thus more easily root-able) systems in the hands of my less-than-computer-savvy family members is scary.

Re:Ford

[sjames]

In her case, the security is being done by whoever sets up the factory defaults on her router. I presume she didn't configure the current one for NAT herself?

Re:Ford

[Nursie]

Well, that much is true, if a good default config can be sent with routers then that will mitigate a lot of problems.

That said I still like the idea of private machines not even being route-able from the outside world.

Re:Right now?

[GarryFre]

That's funny!! LoL. This is what happens when you treat a limited resource as an unlimited resource.

The alternative to transition ...

[haapi]

... is increased network isolation.

There are services possible with IPv6 that are not possible, or certainly more expensive to implement, with IPv4 and its partitioning and NATs and all that. Think multi-cast, for instance. Or, ubiquitous IPSEC. Or, working QOS that is what ATT, Verizon, and Google ought to be talking about instead of trying to defeat net neutrality. Those are new building blocks.

There is money to be made in new services, if we get off our butts and transition.

Re:The alternative to transition ...

[suutar]

Hmmm. You have a point. Therefore I expect the DOJ to get an executive order freezing the implementation of IPv6 until they figure out how to break IPSEC, backed by the RIAA/MPAA who want to go with the ISP-level NAT solution to help kill P2P.

Re:Right now?

[Anonymous Coward]

Good health is merely the slowest possible rate at which you can die.

We are not running out, we are being stupid

[gbrandt]

A friend of mine just colocated his server. The colo he used gave him 4 or 5 IP addresses for his single computer. Even though he is running VM's, he does not need 4 IP's.

This kind of thing is happening everywhere. Cleaning up that kind of junk will give us time to convert to IPv6

Re:We are not running out, we are being stupid

[Abcd1234]

This kind of thing is happening everywhere. Cleaning up that kind of junk will give us time to convert to IPv6

Ahh, the naivete.

Delaying the inevitable will just give the ostriches a little more time to pretend all is well.

Re:We are not running out, we are being stupid

[lidocaineus]

Why shouldn't he have 4 or 5 addresses? Most colo providers will either allocate a /30 or /29 to your machine, and there are very good reasons for this.

Playing the "conserver ipv4 IPs!" game is ridiculous when there's a standard right there that will completely remove these type of concerns. It's time to move on.

Re:We are not running out, we are being stupid

[grumbel]

There are less IPv4 addresses than people on the planet, so even if you have 100% perfect allocation everywhere you *WILL* run out of IPv4 addresses in the not so distant future. That aside you also often want multiple addresses, as that is the only way to properly run multiple services from a single machine without vhosts hacks, non-standard ports and other hackery.

Also what we need for IPv6 is not time, we already had plenty of that, but simply people doing it (mainly looking at ISPs here who don't give you an IPv6). The problems that IPv6 might cause aren't going away when we continue to twiddle our thumbs for the coming few years, the only way to make them go away is doing the switch and then fixing what pops up.

Public IPs to the desktop here

[Namlak]

My large employer has public IPs to the desktop. According to ARIN, my desktop is in a block of over 500,000 addresses owned by the company.

I'll have you know we're using *over 20* addresses on my local /24!

What shortage?

Re:Public IPs to the desktop here

[JSBiff]

Yes, there are some 'wasted' IP addresses which could be reclaimed and re-allocated. However, given the scope of the problem, there's still not enough IP addresses for future growth. Reclaiming might buy us a few months or years, something like that, but in a world moving towards a population of 7 Billion people very soon, and probably 10 Billion within a few decades, reclaiming 500,000 addresses here and there doesn't really solve the problem.

Now, granted, a significant chunk of the world pop are too poor to have much in the way of computers or electronics - although I think cell phones are starting to get into the hands of populations previously considered 'too poor' to use them. Most of those, currently, might be 'dumbphones' that only do calls and texts, no Internet, but my point is, given the history of technology, it doesn't seem unreasonable to expect that smartphones will start becoming affordable for even very poor people within the next decade or two.

In the developed world, the expectation will be that someone might have at least one personal or work computer (and for a lot of people, both), plus a cell phone, and possibly even a netbook/tablet/pda/iPod.

So far, NAT has helped us limp along much longer than we otherwise would have, but it would really be better if everyone had public addresses with a proper firewall (which, most OSes have installed and activated by default these days, anyhow, and any DSL/CABLE/FIBER router *should* have built-in too) for security (for those worried that going from NAT to a Public address exposes you to greater risk of getting hacked/infected, a firewall should protect you the same amount as a NAT does).

Re:Public IPs to the desktop here

[bhcompy]

Software firewalls are not the solution, and neither are public addresses for all. The ability to segment out your network, separate traffic, limiting broadcast domains, etc are GOOD things. Sure, there is more configuration involved, but logical separation of networks provides way more benefits than just saying "my crappy software firewall will fix it". I also wonder what public IPs to the whole network will do to things like Active Directory and ISA Server

Re:Public IPs to the desktop here

[JSBiff]

As I said, on most networks (corporate or home), there will be another layer of firewall built into the gateway between the network and the ISP (the exception here might be 'public' WiFi networks such as hotels, coffee shops, restaraunts, bookstores, airports, etc, which is why I'd still want a 'crappy software firewall' on my machine - and that is no different between IPv4 and IPv6 - you want your own firewall on a computer that connects to 'untrusted' networks, or just don't connect to them, but for some people, that's not always an option).

Also, how does IPv6 prevent you from segmenting your network, separating traffic, limiting broadcast domains, etc? All those things are quite possible whether you use public addresses or private addresses, as long as you have routers/switches that support those things? I never said software firewalls were the answer for those problems, and while you may be able to use NAT to accomplish those things, you can accomplish all those things without NAT, and still have the benefits of public addresses, which you lose with NAT.

I don't know enough about Active Directory or ISA Server to be able to answer, but I'd be very surprised if they don't handle public IP addresses just fine. Any properly designed networking software shouldn't *care* what the IP addresses it serves are, you should just be able to configure it with the proper network config info, and it should just work. I'm pretty sure that at least *some* large organizations using Microsoft Server technologies (things like government agencies, the military, fortune 500 companies, etc) must be using 'public' network addresses (ok, wrt to the military, 'public' has a bit different definition in some cases, because they have an entire 'high-security Internet' of their own which is completely isolated from the public Internet, but still).

Um, scuse me but Mac Os X does have IPv6

[GarryFre]

A simple google of "ipv6 for os x" reveals countless sites discussing how to enable it and test it? So this article says that only Windows Vista and Windows 7 has it but that OS X and other OS's don't? Whats up with that? What exactly are they talking about here?

Re:Um, scuse me but Mac Os X does have IPv6

[JSBiff]

What exactly are you talking about? Did we read the same article? Because the article I read didn't say that only Windows 7/Vista support IPv6. There was one specific feature, I think, DHCPv6 or something, which maybe Win Vista/7 support and others don't.

Re:Um, scuse me but Mac Os X does have IPv6

[GarryFre]

Page 2, last paragraph under the heading "You mean to say that IPv6 is actually different from IPv4???" states in part.... " all IPv6 systems support stateless autoconfig; Windows Vista and 7 support DHCPv6, but Windows XP and Mac OS X don't;". Therefore if all IPv6 systems support stateless autoconfig, and since the quote just above and the re-quoted paragraph below says that Ma OS X does not have it, and that other OSes do not, than the article is stating that only Vista and 7 support this *integral* and necessary feature of IPv6. So now that you had yourself directed right to what part of the article I read, perhaps next time you will re-read the article instead of assuming just because you didn't see it the first time, then it was not there. Complete paragraph from the article reads ... "The end result is a bit of a mess: all IPv6 systems support stateless autoconfig; Windows Vista and 7 support DHCPv6, but Windows XP and Mac OS X don't; on open source OSes a, DHCPv6 client can usually be installed if one doesn't come with the distribution; and Vista and 7 also use the temporary, random number-derived addresses by default, whereas other OSes don't." Url to the page .... http://arstechnica.com/business/news/2010/09/there-is-no-plan-b-why-the-ipv4-to-ipv6-transition-will-be-ugly.ars/2

Re:Um, scuse me but Mac Os X does have IPv6

[JSBiff]

There's a difference between, "Mac OS X does not have IPv6" and "Mac OS X does not support the new DHCPv6". The article implies that. BTW, it's not at all clear that DHCPv6 is an *integral* and necessary feature of IPv6. If Apple viewed it as a highly demanded feature from their customer base, it'd be in there tomorrow. They obviously don't think there's a rush to add DHCPv6 support.

As the article states, IPv6 was designed to mostly not need DHCP - the addition of it is, I believe, to satisfy the needs of some system administrators, and I'm sure that for those administrators, it's an integral and necessary feature, but for most users, perhaps it's not so much.

monster cable has a special ipv4 cable for you

[circletimessquare]

it is gold plated, and we all know what that means: leprechauns and unicorns make your browsing sessions happier

Re:monster cable has a special ipv4 cable for you

[EmagGeek]

But, but, is it LOW OXYGEN gold?????

Re:monster cable has a special ipv4 cable for you

[circletimessquare]

if you stop hysterically hyperventilating about the quality of your ipv4 session, the oxygen content of the room you are in goes up, which leaches into the hyperconjugated gold-oxygen tcp/ip matrix, which ruins your ipv4 connection quality. so what you have to do is constantly hyperventilate, thereby ensuring your ipv4 connection is not ruined by oxygen

Re:monster cable has a special ipv4 cable for you

[EmagGeek]

Right, but what about the effects of non-correlated subatomic cross-field tensors between the strands in the cable? How are those effectively mitigated!?!? They can affect the way the bits travel on the wire, making my IPv4 connection less pure!!! You can even have a zero-oxygen environment and these tensors will actually simulate the effects of having oxygen in the wire by mimicking oxygen's electron field pattern... very few IPv4 cables are equipped with reverse-trunion hydrocoptic marzel vanes. how can they not think of this?!

Re:monster cable has a special ipv4 cable for you

[circletimessquare]

monster cable is very interested in pure bits. we have invested heavily in spanish inquisition technology, where each bit is put through an ecclesiastical trial of moral purity. if the bit is found wanting of wholesomeness, modesty and humility, it is tortured mercilessly until it rectifies the purity you demand of it

Re:/: No AAAAnswer

[Artifakt]

"Hosting report about Slahsdot.org. Slahsdot.org is currently hosted at Oversee.net visit site. The IP 208.73.210.28 links to a server in Los Angeles, United States. The company behind this all is Oversee.net."

Assumptions, and difficulty

[CAIMLAS]

Let's just assume we can put IPv4 address exhaustion off for a couple years.

What then? It's a chicken/egg scenario. Let's say I'm a good admin and I move all my outside-facing servers to IPv6.

This assumes All the software we've got (internally and externally developed stuff) is going to work with IPv6 addressing. What are the chances of that happening?

This also assumes that not only is all equipment new enough to do IPv6 properly, but the newer stuff all properly supports it. That's also not much of a concern if I can't even get IPv6 addresses from my upstream provider.

FOr the most part, I think IPv6 is a problem looking for a solution. The huge mental jump for administrators and the added burden it adds to day-to-day crap (mail admin would be so much fun with IPv6 addresses in logs, don't you think?) alone makes it something that many people want to put off. It doesn't matter if I can do the hex/arabic transition in my mind; remembering that much more between looking @ one log to the next is going to be a headache. And yeah, I really want to start typing lengthy hex strings into network configurations (whether it's BIND or a Cisco or something else).

The 'shortage' of IPv4? Somehow, it doesn't seem like the bigger shops are much concerned. Likewise, there always seems to be an abundance of allocation: if indeed it were a limited resource, someone, somewhere - aside from a regulatory board or a sensationalist author looking for his pay day - would be taking notice.

Even though these netblocks are allocated does not mean they are used. Clearly, there is surplus as of now - there is more supply than demand, because they still exist.

I'd think there'd be

Here's another idea: why didn't they just expand the address space by x256 by prefixing it another couple bits? Would that not have been enough? They could have then put their added security extensions on that "IPv6" stack as an optional extension instead of a prerequisite, and humans would still be able to read the "quads" (which would now be a quint).

Re:Assumptions, and difficulty

[XanC]

There's nothing unreadable or difficult about IPv6 addresses. The "huge mental jump" is you worrying that the water in the pool you're about to jump into is too cold. It's fine, jump in!

And I really don't understand people who say how "easy" it would have been to simply add another byte to IPv4. You'd still have the compatibility problems we have now, except that you wouldn't have nearly as many addresses in the new scheme. All so that you don't have to read hex? What's the big deal about that anyway? Talk about shortsighted.

Re:Assumptions, and difficulty

[anUnhandledException]

"Here's another idea: why didn't they just expand the address space by x256 by prefixing it another couple bits?"

Of course they COULD have. Then again if the original IP address had been 64bit (each octal being 0-65535 instead of 0-255) we wouldn't have a problem for a century or more.

I guess the thinking is change from 32->128 is going to suck so they made the address space so large that it would only have to be done once.

Re:Assumptions, and difficulty

[John Hasler]

Adding a few bits would be no easier than adding 96.

Re:Right now?

[XanC]

If you can think of a way to expand the address space without expanding the number of bits in the address, I think there's a Nobel prize in it for you.

But to answer your concern, you should look into this cool new technology: http://en.wikipedia.org/wiki/Domain_Name_System

Re:Right now?

[Firethorn]

No one wants to memorize or type 128 bit addresses

How often do you actually need to do this though, DHCP works, DNS works, etc...

Personally, I think the problem is one of 'who's first?', in that it's not a straightforward process for an IPv6 address to send a packet to an IPv4 address and vice versa.

So you end up with the problem that you'd need EVERYBODY to switch at the same time, because once all your users have IPv4 addresses(possibly behind a NAT) so they can reach IPv4 servers, and all the servers have IPv4 addresses so they can communicate with clients that haven't upgraded yet, you might as well send packets via IPv4, as it's actually a little more efficient.

Sorta like how a 32bit system is a little more efficient as long as you're not busting the address limits compared to a 64bit system.

Forgot one point. . .

[JSBiff]

One point slipped my mind, and I realized right after hitting submit that I had forgotten to include it:

The reason I say it would be "better" if everyone had a public IP address is that it would make it much simpler for user-to-user direct communications (voice/video chat, remote backup to a friend or relative, games, file transfer, remote administration/tech support [e.g. I use VNC to assist my parents with computer problems, but had to setup port forwarding for that to work - but they have two computers, which complicates things since you can only port forward to one device, unless you use different port for each device], etc).

Re:Right now?

[r0n0c]

Actually you might say we've been running out of them since the moment the first one was assigned...

We are running out of IPv6 addresses.

Re:Right now?

[interkin3tic]

Then screw IPv6, I'll wait for IPvINFINITY.

ISPs arn't going to let IPv6 happen

[Bo'Bob'O]

There are two points here that make me think that it's never going to happen.

1) Scarcity drives up value. If it starts to become hard to get IPv4 addresses, then this is just the excuse that an ISP would want to start -charging- for public addresses. Want a real IP address? Oh, that will require a business account and an extra $100 a month please.

2) It's in their interest to make your internet the least useful possible. That private IP address making it imposable to do anything other the email and web browsing? Great! Just more bandwidth they can oversell.

3) Because of 1&2 companies that have become little more then hallow husks (AIM?) or bought out by holdings firms that no longer have any use for those swaths of IPv4 addresses that they have been assigned suddenly have a new 'profit center'. Selling off chunks to other companies for a profit.

IPv6 is never going to happen.

Re:ISPs arn't going to let IPv6 happen

[EpsCylonB]

$100 a month for an ipv4 address?, try this on residential customers and they will just start to hate their isp and the internet

try it on businesses and they will shop around for price that is close the market value of an ipv4 address, at the same time they may consider implementing ipv6

ipv4 trading will happen and you will have to pay for it but i doubt prices will ever get that high

ha ha... you said D-Link

[dbc]

That's the start of your problem right there. Their products are a waste of otherwise perfectly good sand.

Re:ha ha... you said D-Link

[Abcd1234]

Congratulations, you've managed to expertly demonstrate the phrase "missing the forest for the trees".

Re:ha ha... you said D-Link

[dbc]

What? I'm supposed to take someone seriously when that person buys products from a company notorious for getting things wrong? Yes, there is a lot of that crap out there. If IPv6 plays a role in killing the crap off, outstanding!

Re:ha ha... you said D-Link

[Abcd1234]

What? I'm supposed to take someone seriously when that person buys products from a company notorious for getting things wrong?

Yup, once again, missing the forest for the trees... *sigh*

Apparently I need to point this out, as your arrogant self-importance is getting in the way of your ability to comprehend: Cheap, consumer-grade router hardware sporting broken v6 stacks are extremely common. To support that, I cited a specific example of a common, mainstream device with a fundamentally broken v6 stack, thus contradicting the OP, who claimed this issue isn't that widespread. And if such devices have broken IPv6 implementations, and thus users of them cannot reach popular sites which advertise AAAA records, this will impact site viewership. And so sites will use that as an excuse to not to deploy IPv6 or advertise AAAA records for their primary domains.

Yes, there is a lot of that crap out there. If IPv6 plays a role in killing the crap off, outstanding!

Huh, yeah, you *really* didn't get the point. v6 won't kill off bad devices. The bad devices will kill off (or, at least substantially hamper the adoption of) v6.

Does that make sense to you? Or are you going to continue your pointless, entirely beside-the-point bitching about D-Link?

Mark Rasche

[Art3x]

"The bad news is, nobody will do anything about critical infrastructure protection until there's a global catastrophic failure. The good news is, there will be a global catastrophic failure." --- Mark Rasche, former head of the United States Department of Justice computer crime unit.

OT: OS X / Classic Backwards compatibility

[Kadin2048]

Didn't they only break backwards compatibility when they gave up on PowerPC and switched to Intel chips with Tiger?

Kinda-sorta.

OS X on PPC would run Classic (pre-OSX) apps, but did so by actually running OS 9. It was similar to VMWare Fusion works on Intel Macs today. OS 9 was actually running, but the desktop was hidden and OS 9 apps were each given their own window so that they seemed to play alongside OS X native apps. If you wanted to, you could display the OS 9 desktop or even reboot directly into OS 9 (if you needed to run a game or something else that couldn't tolerate the overhead of OS X).

It was pretty ugly and a lot of people swore off using it as soon as they could; having the Classic environment running soaked up a lot of resources on typical hardware at the time. It was certainly not a seamless attempt at backwards compatibility in the way that Windows has typically at least tried to maintain (at the expense of being uglier in other ways, granted).

Problems with NAT

[nuckfuts]

NAT is not problematic because 65K ports is insufficient. It's problematic because some protocols are inherently incompatible with NAT. FTP in active mode, for example, runs into problems with NAT traversal because it uses randomly selected ports, and that's when only the client is behind NAT. If both the FTP server and client are behind NAT, the protocol is broken completely and some sort of proxy or ALG will be required.

There are other examples of widely-used protocols that have trouble with NAT traversal. Anything involving randomly selected inbound ports is potentially problematic.

Slashdot and IPv6

[Danathar]

And yet Slashdot is STILL not routable over IPv6, but Netflix (ipv6.netflix.com)

It's a problem with infrastructure.

[CherniyVolk]

I own blocks of IPv4 addresses, yes a query to ARIN produces my name. I own many Domain Names (my DNS bills are substantial). I also own several IPv4 blocks because I purchase a business account for my home internet connection; these ones aren't ownership, but part of product agreement from the ISP I go through. I have co-los directly connected into Yahoo's backbone in the NBC building downtown San Diego. I have considerable network resources, for personal use and as nerdy as it is... I'm proud.

The IPv6 problem largely persists because there is 0 infrastructure support. When I say infrastructure, I mean everything from the AT&T copper telecommunications level all the way to the consumer level Service Providers like Cox Cable or Road Runner services. Almost all "IPv6" solutions a consumer can find is nothing more than a IPv6 WAN configuration scheme between you and your ISPs first router and their router does IPv6 to IPv4 translation for all requests. Some companies might have their own IPv6-to-IPv4 translators on the routers facing their upstream providers... again this isn't connected to a IPv6 "internet". The IPv6 support found in software primarily seems to most revolve around one requirement "translation to IPv4".

I know this might hurt a lot of feelings. Bind Ping, a lot of FOSS software has "native" IPv6 support and I'm not debating this. What I'm pointing out is none of it is anything more than experimental code as there is no real means of testing any of it on a real life network. I have faith in it, yes but I have a hard time thinking it could have been extensively tested on a real network.

I realized all of this after trying to get my co-los on a hardcore, pure, real-life IPv6 network with network addresses and all services go. Even up to the point where IPv4 wouldn't work at all. It logically can't be done at this point in time; there are no big time upstream providers in Southern California that can provide a real IPv6 link, even to businesses such as mid-sized ISPs let alone to consumers. This is the problem, without infrastructure support... all we are doing is translation and pseudo-WANs running on top of IPv4.

All the telecommunication companies need to jump on board. All the major universities need to abandon IPv4 for communicating with each other (effectively converting the major backbone of the internet to IPv6). We need the translators to be in primarily reverse, IPv4-to-IPv6 instead of IPv6-to-IPv4. We need all the major ISPs to start offering IPv6 to the consumer. This is the easy part I think, consumer doesn't care or know the difference.

Re:Right now?

[GigsVT]

48 bits is 281 trillion. It would have been more than enough.

Re:Right now?

[TemporalBeing]

How often do you actually need to do this though, DHCP works, DNS works, etc...

DHCP does not necessarily work with IPv6. Microsoft's IPv6 (Teredo) platform doesn't support for example, at least Win2k+IPv6, XP+IPv6, Vista, and W2k3 (I don't know about Win2k8 or Win7, but they probably are using the same IPv6 stack).

That said, DHCP for IPv6 is in a sorry state for pretty much all platforms as most are ignoring it entirely. ISC DHCP Server 4.1 and later supports it; but few distros if any support it. Even Gentoo and Ubuntu only provide 3.x releases as 'stable' releases.

And for those that think DHCP is not necessary - it has many benefits. From configuring the network (yeah, yeah, Neighbor Discovery provides that) to some network security - can't operate on the network without a valid address. Personally, I don't want anyone on my network that I have not authorized to be on it, and when they do get on I want to track them accordingly. DHCP provides a great benefit in that - since I know their MAC address and their network address; and if I expect they'll be on more often, then they'll get assigned their own static and DNS as well.

Until those kinds of things can be supported IPv6 won't go much of anywhere no matter how much IPv6 acolytes want to switch the world over.

Re:Right now?

[GigsVT]

How often do you actually need to do this though, DHCP works, DNS works, etc...

Except when it doesn't. I've typed an IP address at least 10 times in the last week.

The shorthand notation of IPv6 helps a little, but the stupid plan to hand out trillions of them with each allocation ensures that we have to remember a good number of digits for each address.

Re:Wolf Wolf Wolf

[anUnhandledException]

Yeah and watch the internet routing tables explode by a couple orders of magnitude.

When will the ISP have IPv6 and give out free mode

[Joe The Dragon]

When will the ISP have IPv6 and give out free modems for people with old ones that can't do IPV6?

comcast is still testing IPv6 full roll time line?

ATT roll out?

smaller cable co's? some are still on D2

small town DSL systems?

small town ISP's?

Re:Wolf Wolf Wolf

[shentino]

Officially, it's against the rules to do that, but when resources are scarce you are going to get a black market whether you like it or not.

Organizations that are sitting on piles of addresses they didn't need when they got them are going to milk their supply for all it's worth when push comes to shove, and they aren't going to give them up without a fight.

Re:Max OSX broke backwards compatibility

[bobv-pillars-net]

Funny thing about that theory is that nearly everyone I know who owns a Mac runs Windows on it (via Parallels or some such virtualization layer) so they can keep their backwards-compatibility.

Re:Right now?

[vtcodger]

***Why wouldn't they have set-aside a block of 4.2 billion addresses that mapped 1:1 with IPv4 addresses? ... Also, eliminating NAT seems short-sighted***

Both excellent observations. Possibly that's why a lot of folks aren't anxious be first in line to implement a shiny new technology designed by people who didn't address those things.

Re:Secondary market?

[JSBiff]

I keep seeing people bring up this argument, but the problem is that 'lots and lots' JUST ISN'T. You might free up what, on the order-of-magnitude of 100 Million or so addresses? That still is NOT ENOUGH IP addresses to solve the problem. It might buy us a bit more time (perhaps a few years before address exhaustion really happens). We need Billions more addresses to really solve the problem, which you can't get through re-allocation of unused blocks.

As for companies selling off blocks, until the transition occurs, I'm sure you're right. Well, partly. It isn't gonna be $200/yr for a lease. Maybe $5,000 - 10,000/yr for a lease. Most likely, the price will be determined at auction, and I could see prices even going above $10,000yr per block. I fully expect the world to drag its collective feet in transitioning to IPv6, and IPv4 addresses becoming INSANELY EXPENSIVE as a result.

The silver lining here is that insanely expensive IP addresses gives a big incentive for the transition to IPv6 to begin - whereas right now (pre-exhaustion) most organizations see little benefit to an upgrade, as addresses become very expensive, there's suddenly a financial incentive to migrate.

Re:Odds of slipping in the shower

[bobv-pillars-net]

Please God those statistics never get read in congress, else the government safety inspectors will be wanting to install a shower cam in every bathroom.

Re:When will the ISP have IPv6 and give out free m

[EpsCylonB]

much easier to nat them and make them pay the cost (+ margin) for an ipv4 address if they want one

Re:Right now?

[Firethorn]

DHCP does not necessarily work with IPv6. Microsoft's IPv6 (Teredo) platform doesn't support for example, at least Win2k+IPv6, XP+IPv6, Vista, and W2k3 (I don't know about Win2k8 or Win7, but they probably are using the same IPv6 stack).

What the frack? And they expect this to roll mainstream?

Re:the EASY fix

[JSBiff]

Maybe because we'd rather not antagonize a nuclear power who can also muster a 300-400 Million man army/navy/airforce if they need to, and, oh yeah, to whom we've outsourced 90% of our manufacturing (which they could, I'm sure, quickly turn to military production, just as the U.S. who, at the time, was a rising manufacturing power, turned our then-significant manufacturing capabilities towards becoming the "Arsenal of Democracy" during WWII)?

We hide behind our nukes, which is why we are in no position to really get rid of them, despite the dreams of Obama & Co., because if China decided to gear up for war, they can out-manufacture and out-muster us on about a 6-to-1 basis (or maybe more). Nukes, however, end up being sort of the great equalizer, in a way. Just as on an individual level, guns can make big strong men and smaller weaker men more-or-less equal, so do Nuclear Weapons between countries (so long as you have enough weapons to ensure MAD). Still, even if you've got a gun, there's no reason to bait a bear over something sort-of (relatively speaking) trivial.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Right now?

[jbolden]

Yep. But 15 years ago we were just trying to get the vast bulk of the US on the internet at all. There were other focuses.

Re:Right now?

[jbolden]

NAT doesn't provide security it pretends to.
Also it isn't a very good protocol it breaks lots of assumptions about IP and all sorts of apps have workarounds.

Ditching NAT is not a bad thing.

Re:Right now?

[maxwell demon]

Why wouldn't they have set-aside a block of 4.2 billion addresses that mapped 1:1 with IPv4 addresses?

They have.

My thoughts on how to ease some of the problems

[JSBiff]

I don't know that this would necessarily deal with ALL transition problems, but I had an idea a couple years ago about how you might come up with a collection of transition technologies that work together to make the transition a bit easier, which I posted in my Journal:

http://slashdot.org/journal/215899/A-NAT-DHCP-amp-DNS-Based-approach-to-IPv6-transition

In a nutshell, it seems to me that since the IPv6 address space is so large, you can have many, many hosts where the last 4 bytes of the address are all the same, as long as some part of the rest of the address is different. Seems like you could exploit this fact to give the same 'public' IPv4 addresses to different hosts on different networks (every network could have it's own /16, /8 or even it's own private complete IPv4 address space, internally). Between the Internal network and the IPv6 'public' Internet, you have a gateway which transparently hides the IPv6 details from IPv4 applications/devices. Some of the 'internal' IPv4 addresses would be used for local hosts on the networks, and some of them would be used to establish mappings to the 'real' IPv6 addresses. IPv4 applications could access IPv6 hosts either by making a dns request for the host by domain name (which would trigger the gateway to automatically setup a temporary mapping as discussed above), or if the host you want to contact does not have a 'real' domain name, a special dns entry which encodes the IPv6 address in the domain name, then is parsed by the dns server, which again triggers an automatic mapping between the IPv6 address and a local IPv4 address.

For connections the other direction (e.g. from an IPv6 host to IPv4), it really ridiculously easy - since the entire IPv4 address-space can fit in a subnet of an IPv6 network address, you can just form public IPv6 addresses of the form network-prefix:IPv4address (e.g. if your network prefix is 1234::5678, the IPv6 address of a machine whose 'internal' IPv4 address is 12.34.56.78, becomes 1234::5678:0C22:384E - 0C22:3844 is the hex equivalent of 12.34.56.78 - but users will generally not need to worry about that, as they'll usually be looking up hosts through either DNS, or by making connections through a service like an instant messenger client, bittorrent tracker, game server browser/matching system, etc, where they never even see the address, like the way things usually work nowadays with IPv4).

I've not really heard anyone else describe such a system, but I don't see why it's not possible?

Re:My thoughts on how to ease some of the problems

[butlerm]

v4v6 NAT devices will have to do DNS interception and rewriting of the sort you are talking about. That handles the problem of private IPv4 hosts speaking to public IPv6 hosts for most protocols. There isn't a serious technical problem with private IPv4 hosts speaking to public IPv4 hosts through some sort of v4v4 NAT and v4-in-v6 tunneling scheme either. The real problem is the same as with any other NAT - the interior devices are not directly addressable, and so lots of things will break until all the necessary NAT hacks, protocol workarounds, and remapping services are adopted.

The most important question for an interior host on a NATed network is what is my real, external (public) address, is it unique to me, what is the port mapping, etc. There is no standard way to answer those questions with v4v6 NAT now, especially when there is more than one layer of NAT, which will be common for years to come, especially the v4v4 (home) + v4v6 (ISP) configuration.

Re:My thoughts on how to ease some of the problems

[JSBiff]

As I mentioned (I think) in my Journal article, the great thing about IPv6 is that any IPv4 address could be represented inside of an IPv6 'subnet'. So, different ISP's, or maybe even end-users can have their own entire 'IPv4-Internet-in-a-box', so to speak. Let's say your ISP gives you a /48 v6 network block (I believe that is actually the suggested standard from the spec - every user their own /48): you can have your own full IPv4 address space. So, you give your 'internal' network addresses 'public' addresses.

Ok, but those addresses aren't really public, right, because they are just inside your network? Well, it's easy to map from prefix::IPv4 address (as an IPv6 address), to the corresponding internal IPv4 address. So, let's say you allocate the for yourself the 1.1.1.0/24 network (and let's say your IPv6 network prefix is 0102:0304::). Well, it would be easy enough to have your IPv6 'gateway' router forward any incoming request with a destination address like 0102:0304::0101:0101 to the local 1.1.1.1 IPv4 address.

So in the scheme I'm proposing, either the end-users home network, or possibly the ISP's regional network, provides a complete set of public IPv6 addresses for all 'legacy' IPv4 hosts/applications by assigning the 'internal' hosts any of the approximately 4 Billion 'public' (in as much as those addresses are routable under IPv4 rules - something with an IPv4 private network address should probably never be routed, even if it technically could be by the router) IPv4 addresses.

This means every ISP has enough routable IPv4 addresses there's no longer any reason to 'hoard' them, or charge people $10/mo for a static IP (although, ISPs being who they are, I'm not holding my breath that Verizon, AT&T, & co. - the same people who want to kill net neutrality - won't try to screw the customer just because they can). Well, at least if they give me full IPv6 with a /48, I could potentially provision IPv4 static addresses for myself.

Re:Right now?

[petermgreen]

While obviously some address extension was inevitable I think of many things that have hampered IPV6 rollout that were at least somewhat avoidable.

1: IPV6 was designed as a replacement not an extension. What that means is that as well as having to upgrade all the equipment/software you also have to allocate every bloody device a second set of addresses and maintain two separate sets of routing tables. There were some hacks to get arround this and allow hosts on the V4 internet to talk to V6 hosts but home router vendors never seemed to adopt 6to4 and teredo is a pretty fragile design.
2: Rather than just making the address long enough to solve any shortage problems for the forseeable future they also introduced this idea of stateless autoconfiguration which while nice in theory in practice just makes addresses too long and unstructured for people to remember. With IPV4 the address is four octets and there is a good chance that at least a couple of those will be the same across much of the company. With V6 and stateless autoconfiguration there are a lot more and most of them will be different on every machine.
3: Afaict windows XP only supports the aforementioned stateless autoconfiguration or manual command line configuration not manual GUI based config and not DHCPv6. So it's rather hard for netadmins to avoid stateless autoconfig even if they think it's a bad idea.
4: Linux has outright refused to implement V6 nat on ideological grounds. While global address shortages are one reason for nat they aren't the only one (other obvious ones are hiding your network structure from outsiders or adding a private subnet that needs to connect outbound only to the internet without having to go through some hugely beuracratic process to get a subnet assigned and routed).

IMO any ISP that doesn't have plans for deploying ISP level NAT at this point is suicidal (note: it's probablly not in an ISPs interests to advertise or implement such plans until they are forced to, the rational thing for an ISP to do at the moment is to get as many V4 addresses as they can so they can be reallocated to more lucrative customers later). The better ones will offer IPV6 as well and public IPV4 for an extra charge but the ISP level NAT will be what keeps the lusers connected to facebook/youtube/email/etc.

Re:Right now?

[dwinks616]

DNS? You can't have 128 bits worth of address space without 128 bit addresses. Either deal with 128 bit addresses or NAT everything to hell and back.

Re:Right now?

[EsbenMoseHansen]

DHCP is unlikely to get much used in IPv6. It works otherwise...

As for remembering or typing them... just don't. Learn copy and paste. It's not something you should have to do often anyway, unless you are a poor network administrator.

Really no way?

[RichiH]

Paint stripes on it.

Re:Right now?

[budgenator]

Damn, I told them we should have held out for IPv8, but nnnooobody listened to me. Now we're stuck with a half an internet of Internets when we could have had a whole internet of Internets!

Threaten to switch to bang-paths

[SteeldrivingJon]

That ought to scare people into compliance.

Re:Right now?

[Firethorn]

DHCP is unlikely to get much used in IPv6. It works otherwise...

Then how does the new-out of the box computer bought by my grandparents get it's IPv6 address? What about the fridge/toaster they keep proposing to network?

I'll fully admit that I haven't thouroughly studied the issue.

Learn copy and paste.

Which I tend to do now, except for the tendency to use four fields to store the address so I can't just paste it in.

Easier Solution

[TekPolitik]

There is an easier solution. If even one very key service provider (Google, for instance) announced that:

1. It was implementing IPv6 on all its customer facing web servers immediately;
2. It was removing IPv4 from all its customer facing web servers in 6 months;
3. In 3 months all its IPv4 web servers would include a prominent warning to visitors in big bold red letters at the top of the page that they need to switch to an ISP that supports IPv6 within 3 months; and
4. In that later 3 months, the services would all be https only so the ISPs cannot strip the warning*

just watch how quickly the ISPs would implement at least some mechanism for IPv6 to work. Depending on how aggressive the provider was prepared to be (think signed plugins that verify a workable, routed IPv6 address), it could even force a proper IPv6 implementation, with the ISPs educating their users to ensure a quick, smooth transition.

* Sure, some users will just click-through if the ISP provides a filtered version with a bad certificate, but not all, and the ISP does not want to just throw away business.

Re:Right now?

[sootman]

No, it's only been for a few years now. Maybe a decade or so. Like the old joke: how far can you run into a forest? Halfway--after that you're running out.

Re:Right now?

[darkpixel2k]

Exactly. Haven't we been running out of them for at least the last 10 years?

Awesome that no-one ever cared.

I can't see why anyone would now either.

Is it all thanks to Microsoft? Other network equipment? Embedded systems?

There is no greater motivation than last minute panic.

Re:Reclaim Some? What about email marketers?

[Linuxmagic]

What about all the email marketers? They only need one IPv4, not a /17 (Yes, they are out there).. Start reclaiming some of those.. 174.123.61.34: mail.rentpink.co.cc 5 174.123.61.35: mail.vonpink.co.cc 2 174.123.61.36: mail.alneedthings.co.cc 3 174.123.61.37: mail.bineedthings.co.cc 2 174.123.61.40: mail.caneedthings.co.cc 2 174.123.61.41: mail.chneedthings.co.cc 6 174.123.61.43: mail.deneedthings.co.cc 4 174.123.61.44: mail.epneedthings.co.cc 6 174.123.61.46: mail.fineedthings.co.cc 4 2.103.90.212.in-addr.arpa domain name pointer natan.vendaagil.com. 3.103.90.212.in-addr.arpa domain name pointer felina.comprecomestilo.com. 4.103.90.212.in-addr.arpa domain name pointer dartaian.rapidasofertas.com. 5.103.90.212.in-addr.arpa domain name pointer natan1.vendaagil.com. 6.103.90.212.in-addr.arpa domain name pointer felina1.comprecomestilo.com. 7.103.90.212.in-addr.arpa domain name pointer dartaian1.rapidasofertas.com. 8.103.90.212.in-addr.arpa domain name pointer natan2.vendaagil.com. 9.103.90.212.in-addr.arpa domain name pointer felina2.comprecomestilo.com. 10.103.90.212.in-addr.arpa domain name pointer dartaian2.rapidasofertas.com. 11.103.90.212.in-addr.arpa domain name pointer natan3.vendaagil.com. 12.103.90.212.in-addr.arpa domain name pointer felina3.comprecomestilo.com. 13.103.90.212.in-addr.arpa domain name pointer dartaian3.rapidasofertas.com. 14.103.90.212.in-addr.arpa domain name pointer natan4.vendaagil.com. 15.103.90.212.in-addr.arpa domain name pointer felina4.comprecomestilo.com. 16.103.90.212.in-addr.arpa domain name pointer dartaian4.rapidasofertas.com. 17.103.90.212.in-addr.arpa domain name pointer natan5.vendaagil.com. 18.103.90.212.in-addr.arpa domain name pointer felina5.comprecomestilo.com. 19.103.90.212.in-addr.arpa domain name pointer dartaian5.rapidasofertas.com. 20.103.90.212.in-addr.arpa domain name pointer natan6.vendaagil.com. 21.103.90.212.in-addr.arpa domain name pointer felina6.comprecomestilo.com. 22.103.90.212.in-addr.arpa domain name pointer dartaian6.rapidasofertas.com. 23.103.90.212.in-addr.arpa domain name pointer natan7.vendaagil.com. 24.103.90.212.in-addr.arpa domain name pointer felina7.comprecomestilo.com. 25.103.90.212.in-addr.arpa domain name pointer dartaian7.rapidasofertas.com. 26.103.90.212.in-addr.arpa domain name pointer natan8.vendaagil.com. 27.103.90.212.in-addr.arpa domain name pointer felina8.comprecomestilo.com. 28.103.90.212.in-addr.arpa domain name pointer dartaian8.rapidasofertas.com. 29.103.90.212.in-addr.arpa domain name pointer natan9.vendaagil.com. 30.103.90.212.in-addr.arpa domain name pointer felina9.comprecomestilo.com. Broken up into /27's but the whole /20 seems to be the same.. Block and forget?

Re:Right now?

[EsbenMoseHansen]

DHCP is unlikely to get much used in IPv6. It works otherwise...

Then how does the new-out of the box computer bought by my grandparents get it's IPv6 address? What about the fridge/toaster they keep proposing to network?

I'll fully admit that I haven't thouroughly studied the issue.

I'm not *totally* straight on this either, but I have IPv6 (tunnel) set up here. It works by the router advertising over ICMP (I think it's called) what *prefix* devices on this network should use. The devices then decide on some suitable postfix (the MAC address is a popular choice; an random one is also). The device the asks something (possibly the router) if this assembled address is a-ok. If it is, this is the address it gets. So no more setting up DHCP and manually assigning IP numbers. Any experts are more than welcome to fix any glaring error; I am not an expert on this.

Learn copy and paste.

Which I tend to do now, except for the tendency to use four fields to store the address so I can't just paste it in.

Yeah, that IS fucked up, isn't it? Whoever came up with that idea should be tickled. Severely. I'm talking goose feathers here.

Re:Right now?

[dbIII]

NAT provides no security at all. The security you get is due to the router with just happens to also have NAT on it. The router is still there with IPv6.

Stupid idea - here's why

[dbIII]

They portscan anyway so will find it, plus shifting the destination port stuffs you up at the other end when the firewall won't let you out. There may be a nice little hole to let ssh out on 22, but port 2525 or whatever, nobody uses that so you'll hit the firewall rules to stop malware from spreading. The days of firewalls letting all internal traffic get out should be long gone. You can only change the port when you control both ends and can be sure that nobody in the middle is going to stop you. So that means pure point to point and you can forget about getting in via a hotel connection or somebodies WiFi.

One more bit of NAT pain

[dbIII]

Even if you put another server on port 8080 people may not be able to get to it. As a nasty transitional hack I had a webmail system for travelling employees that was on there, and some of them just could not get to it due to hotel networks blocking that port so I had to move them back to the old web server. While it's supposed to be a standard port not everyone who sets up firewalls cares.

Re:Right now?

[mcvos]

Why wouldn't they have set-aside a block of 4.2 billion addresses that mapped 1:1 with IPv4 addresses?

They did exactly that. The incompatibility problems are in other areas, and many of those are relatively recent additions to IPv4. Workarounds for the limitations of IPv4. Limitations that IPv6 doesn't have.

At least, that's as far as I understand it.

Re:Right now?

[mcvos]

Perhaps it would have been better if we'd switched to IPv6 before we got the entire world (and not just the US) on the internet. The enormous growth of the past 15 years seriously aggravates the problem.

In the '80s, they needed only a year to transition from one technology to a completely incompatible one. Switching from IPv4 to IPv6 should be easier, but the huge scale makes it a lot harder.

Re:Right now?

[jbolden]

Maybe, maybe not. I'm not so sure it is harder now. We are just far more cowardly than we were in the mid 1990s and far less staffed up for change. Heck we got the country moved from DOS to Windows which meant replacing essentially all the hardware. We got the whole world hooked up on local lans, which involved physically touching every computer in the USA.

We scoped it, we did it.
What's changed is that:

1) People are much more dependent on the internet.
2) We've lost the manpower we used to have

I'd love to see IPV6 help fix (2).

The internet was undergoing explosive growth in 1995 people were distracted and focused on change that was happening monthly. There really is nothing complex about doing the shift to IPV6 by 1990s standards. You go in you, you tell people how to switch to the new system, you replace the old equipment with the new; configure away any bugs.

Further, the internet is big enough now that the FCC for example could just declare various days that things happen.

Feb 1, 2011 all ISP must provide IPV6 technology or lose their right to use of telecommunications / cable company interconnects for data.

April 1, 2011 All corporations operating in the United with over 50 employees must have a list of all routers and switches not IPV6 capable or lose their right to business class connectivity.

etc.... It really isn't that hard to do as a series of dictates. The US government used to lead on technology shifts. They refused to so under the GW Bush administration but that doesn't mean they couldn't go back to leading like they did under Clinton and HW Bush.

So in 1995 it would have been much easier when getting on the internet was supposed to be hard, and people expected it to be tricky and thus followed instructions. Also far fewer protocols you had to get working all at once. On the other hand you don't have a unified infrastructure. In 1994 I still would have believed that gopher was more important protocol than HTTP as far as information sharing.

Moreover I'm not even sure people would have wanted it. I would have wanted a much more hierarchical internet like we had but were losing. That sort of internet allowed for community, a low security environment. Things like spam, heck advertising didn't exist. I wouldn't have seen enabling commercial activity the way it exists today as a good thing. I probably would have been against the massive proliferation which is the whole point of IPV6. Widespread internet ubiquity destroyed accountability. We still had an open internet in 1995. If I could have looked 5 years in the future I'd see how cool the commercial internet would become and absolutely I'd say that's worth losing the open internet. But in 1995?

Remember the commercial people were online service providers that offered internet as a gimmick on top of their core offerings.

So no, I don't think its harder now. Its more work absolutely but that not the same thing.

Re:Where is Marshall Rose

[Douglas Goodall]

Thirty years ago Marshall Rose saw the roadmap to IPV6 and spoke of peaceful co-existence and transition. Every few years I hear the rumbles about running out of IPV4 numbers and I wonder why the people that earn big bucks, and the companies with big bucks haven't figured this out. The original Internet happened because people wanted it to work, and it wasn't about making money. It was about having the catanet we wanted.

Virtually all the growth on the Internet since has been about various companies posturing to make money at all levels. Governments, and Businesses, and Individuals have all been feeding at the Internet trough now since about 1991 when appropriate use was withdrawn. Most of the posturing is done now and the bid providers have us about where they want us. No matter what we pay, our circuits degrade as fast as the providers can oversell them Unlimited circuits aren't unlimited. The lack of Committed Rate in consumer circuits leads to wide swings in throughput for consumers. I have Comcast Business Internet, but I am on the same coax as my home service neighbors. When they all jump on (torrenting their hearts out no doubt), my business circuit goes to about 10% of what I am supposed to be getting. That is a joke, providing alleged business class services inside a consumer network.

Anyway what I was getting at is that this issue of transition to 6 is almost as old as most of the Internet users. Thirty years ago, adaptation to the IP6 stack was slow because the stack supporting it took almost 1MB of ram. That is certainly not a credible concern today where home machines have gigs of ram. I can only think that we haven't made the transition because someone has a vested interest in delaying the transition. OF course what is unfortunate about that is the the disruption to our society will be extreme if this is not dome smoothy Between the money the government has paid to the big providers, and the massive dollars collected each month from consumers, the money has to exist to make the changes we need to transition. IF not I want to know where that money went?

Re:Right now?

[Firethorn]

Okay, that sounds workable, as long as you have massive amounts of empty addresses in the subnet. Which IPv6 provides.

Still, if we go with 8 octets for prefix and 8 for suffix, we're still talking about 'So many more addresses' I don't want to think about it.

Re:Right now?

[JesseMcDonald]

And for those that think DHCP is not necessary - it has many benefits. ... some network security - can't operate on the network without a valid address.

DHCP does nothing for your network security. It's a voluntary protocol. Anyone who wishes to join the network can simply choose any available address and configure their interface to use it statically. They will then be invisible to your DHCP-based "tracking" system.

It is possible to control access to a network securely (or by MAC address, if that's what you really want), but not through DHCP. One of those secure mechanisms is IPsec, which is mandated in IPv6.

Re:Right now?

[TemporalBeing]

IPsec

IPsec is only useful for securing communications between two specific nodes for a specific communication channel. It does nothing for securing a network. It works for VPN as VPNs around all data between the diverse networks over a single communication channel (or multiple channels bonded into a essentially single channel). That is not the security I am talking about here.

DHCP does nothing for your network security. It's a voluntary protocol. Anyone who wishes to join the network can simply choose any available address and configure their interface to use it statically. They will then be invisible to your DHCP-based "tracking" system.

Only works for valid addresses on the network; and then you must get every little detail right for that specific network. That's WHY we have have DHCP - to assign valid addresses and inform of the network configuration. Now granted, they designed that into IPv6 as (i) the auto address assignment (MAC+LocalLink) which provides administrators no method of controlling the address ranges, and (ii) Neighorhood Discovery which tells everyone about everything automatically - again, administrators have little to no control other than to try to track down the offending user and physically remove them. On the other hand, with DHCP you can control the configuration. Granted, some may stealth their way in and figure out the configuration but the majority will not. With DHCP you can also setup methods to track the MAC and then alert for unauthorized nodes - e.g. DHCP registers a MAC+address, and separate software then monitors the network for MACs and addresses not on the official list, alerting appropriately. Take away the ability to control a network via DHCP and such tools go away. Also truly secure networks only use static addressing and monitor for any unauthorized addresses, etc. on the network. This doesn't work for IPv6 since IPv6 by default assigns an address even without a DHCP server - something that is not desirable in all situations. (Great idea, but doesn't really work for certain situations.)

Anyone who wishes to join the network can simply choose any available address and configure their interface to use it statically. They will then be invisible to your DHCP-based "tracking" system.

They will also be denied access to the services if the network is configured correctly. Some hotels do this to force you into a registration system before you can go elsewhere on the network.

Re:Right now?

[JesseMcDonald]

IPsec is only useful for securing communications between two specific nodes for a specific communication channel. It does nothing for securing a network.

On the contrary, IPsec defines a protocol for securing connections between a security gateway and a host (network-to-host mode), in addition to the host-to-host and network-to-network modes. Using this protocol on a router you could securely authenticate client devices and limit routing to authenticated incoming packets.

Only works for valid addresses on the network; and then you must get every little detail right for that specific network.

Which is not any kind of realistic obstacle. Even on a switched network you have all kinds of broadcast packets being sent, any one of which will give you the address of the sender. From there it's trivial to determine enough to the other parameters to communicate with that host, clone it, or scan for others.

... separate software then monitors the network for MACs and addresses not on the official list, alerting appropriately.

Exactly—separate software, not DHCP. It's not much of a security feature if your DHCP server just accepts requests from any device which happens to ask, and if you have a way of actually authenticating clients you might as well use that by itself and skip the DHCP.

Also truly secure networks only use static addressing and monitor for any unauthorized addresses, etc. on the network. This doesn't work for IPv6 since IPv6 by default assigns an address even without a DHCP server - something that is not desirable in all situations.

IPv4 will also assign addresses without a DHCP server, in the link-local 169.254.0.0/16 block. IPv6 only assigns global addresses automatically if you enable router advertisement; they can also be assigned statically, directly on the client or with DHCPv6 (which is supported natively for Windows Vista, Windows 7, and Windows Server 2008 clients, not to mention Linux; free third-party software is also available for clients, servers, and relays).

Re:Right now?

[TemporalBeing]

IPsec is only useful for securing communications between two specific nodes for a specific communication channel. It does nothing for securing a network.

On the contrary, IPsec defines a protocol for securing connections between a security gateway and a host (network-to-host mode), in addition to the host-to-host and network-to-network modes. Using this protocol on a router you could securely authenticate client devices and limit routing to authenticated incoming packets.

But first you have to know about and be about to get a route to the router. That requires a valid IP address on the network and information about the network.

... separate software then monitors the network for MACs and addresses not on the official list, alerting appropriately.

Exactly—separate software, not DHCP. It's not much of a security feature if your DHCP server just accepts requests from any device which happens to ask, and if you have a way of actually authenticating clients you might as well use that by itself and skip the DHCP.

Except you can configure DHCP to only provide addresses to a known set of MAC addresses. It doesn't have to give one out to anything on the network; it could even require authentication via Radius or other mechanisms first as well.

Also truly secure networks only use static addressing and monitor for any unauthorized addresses, etc. on the network. This doesn't work for IPv6 since IPv6 by default assigns an address even without a DHCP server - something that is not desirable in all situations.

IPv4 will also assign addresses without a DHCP server, in the link-local 169.254.0.0/16 block.

No, that's just Microsoft. No other sane IPv4 stack that I know of (and I'm not calling Microsoft's IPv4 stack sane) assigns in that range. Also, even when Microsoft's does - you cannot go anywhere on most networks.

Unix/Linux/Mac/etc if no DHCP server is available just fail and do not enable the interface at all. No IP address is assigned.

IPv6 only assigns global addresses automatically if you enable router advertisement; they can also be assigned statically, directly on the client or with DHCPv6 (which is supported natively for Windows Vista, Windows 7, and Windows Server 2008 clients, not to mention Linux; free third-party software is also available for clients, servers, and relays).

Linux supports yes; but find a working DHCPv6 implementation please - and one that is available on most distributions.

Windows - I can believe Win7/Win2k8; but not Vista - unless they changed it in an "update". I have managed an IPv6 Windows network before; and no DHCP is not even possible. Windows does not even offer the possibility in the configuration; nor is static IPv6 assignment.

And as I said - please point out these clients/servers/relays. I have looked. DHCPv6 was shutdown because ISC's DHCP 4.1 and later has DHCP IPv6 support - but it's not available in most distributions yet; even Ubuntu and Gentoo are stuck on ISC DHCP 3.x.

Re:Reclaim Some? What about email marketers?

[CBravo]

I'll tell you why we need so many IP's... Many email servers are restricted in the amount of emails per hour they allow from 1 IP. One of our customers has 300.000 subscribers (their own customers!) and about 100.000 are from hotmail. They would like to deliver their email within the hour.

Hotmail will not allow more than X connections and Y emails per session per IP to one of their Z email servers. So I have this special software from port25.com which will allow me to create A virtual mailservers. I just have to feed that software some IP's.

The maximum rate is dependant on the 'reputation' of the IP (see e.g. senderscore.org). A fresh IP is 'cold' and has to be 'warmed up' (it takes a couple of months). A warm IP is therefore an asset to our company.