Military Pressuring Vendors On IPv6

netbuzz writes "US military officials are threatening IT suppliers with the loss of military business if they don't use their own wares to start deploying IPv6 on their corporate networks and public-facing Web services immediately. 'We are pressing our vendors in any way we can,' says Ron Broersma, DREN Chief Engineer and a Network Security Manager for the Navy's Space and Naval Warfare Systems Command. 'We are competing one off against another. If they want to sell to us, we're asking them: Are you using IPv6 features in your own products on your corporate networks? Is your public Web site IPv6 enabled? We've been doing this to all of the vendors.'"

Comments

Say it!

[Anonymous Coward]

Say you love IPV6, damn you! Say it!

Re:Say it!

[c0lo]

I never thought I'll be agreeing with the idea of "army applying pressure" would bring anything good... until now.
(note to myself: seems like I'm growing old faster than I thought).

Re:Say it!

[ygtai]

They are navy.

Re:Say it!

[c0lo]

They are navy.

Ah... that explains!
Errr... hang on... what does it explain?

Re:Say it!

[Daniel Phillips]

We just want you to love us.

Re:Say it!

[c6gunner]

Easy. The rear admirals are well known for applying pressure on the poop deck. They heard that the internet is a series of tubes, and, well, there ya have it ...

Re:Say it!

[c0lo]

Easy. The rear admirals are well known for applying pressure on the poop deck...

Ah, now I see... then, methinks, the Sweden Pirate Party should start doing something about a rape case against the rear admirals...

Re:Say it!

[gtall]

Comedy aside, the Navy is the most technologically adept of all the U.S. military services. They do a lot of their own research as opposed to the Air Force which contracts out most of its which leaves the Air Force pretty much clueless. The AF are the guys who attempted to take over "cyber" work in military until Gates stepped on them. Their idea of cyber security is "standardizing on Microsoft products"....and actual edict from their most senior people.

Re:Say it!

[Anonymous Coward]

The same Navy which sold their IT Infrastructure soul to HP?

Well

[zero.kalvin]

I'll be pretty suspicious if Steve jobs tried to pitch me a mac while he is running fedora on his personal laptop. Point taken, good job I suppose.

Re:Well

[ushering05401]

Yeah, good job and more please.

Whoever writes the speeches @ 1600 Penn ought to make sure this one at least gets some lip service. While not a big deal for the general public, it is something that shows some common sense due diligence and proactive thinking from a widely vilified branch of our Federal machinery.

Re:Well

[Anonymous Coward]

Not so fast, more likely the government types think that whole NAT thing is too complicated. So the answer of course is to hit their vendors with a $2000 hammer. Ever take a look at the difference between companies that WON'T work for the government and those that CAN'T work without it?

Re:Well

[arth1]

More likely the military loves IPv6 because it's by nature a lot more traceable -- it defaults to unique addresses for each host, and even contains routing information.

Granted, you can set up a fc::/7 network, and fake-NAT outgoing traffic, but even then your internal address is likely unique. When intelligence find a HD or USB key with an internal IP 192.168.0.15 in a log, it doesn't help when there are millions of networks out there with 192.168.0.0/255 networks, but if the address is fd17:192b:3fa7:0031::000f, there's a much better chance that it can be matched against a unique destination.

Re:Well

[caerwyn]

Actually, it really depends on the company you're looking at. One of the biggest problems isn't so much the $2000 hammer, but the "not invented here" syndrome that causes it.

The government, and DoD especially, does procurement and research based on contracts. The problem is that the results of contract A are not well shared with the contractor for follow-on contract B- which means that they end up reinventing the wheel, and doing all the same work that A did, just to work on the problem that B was supposed to handle.

Hence, many of the companies that do the work are, in isolation, especially the smaller ones, reasonably efficient. But the system as a *whole* is horribly inefficient, and the *big* companies that are involved in this whole thing can rake in huge profits and support huge bureaucracies in the process, so they have a vested interested in lobbying for the status quo.

Re:Well

[adavidw]

Well, Steve Jobs spent at least a few years pitching macs while running NextStep on his personal ThinkPad (1998 to around the time of OS X release in 2001). Not quite the same, since NextStep in a way represented the future of the product. But still, there's no better to way to reinforce the perception that the current direction of the company is a dead end than for the CEO to not use the company's products.

Re:Well

[SuricouRaven]

One better, actually: Auto-allocated addresses include the host's MAC address. Get someone's IPv6 address, and you can figure out roughly what motherboard or network card they have - and if you can sieze their computer, confirm if that computer actually has that MAC. Some OEMs might even keep MAC-to-Customer-Address databases.

All this assuming that the user doesn't just fake their MAC address of course, which is trivial.

Re:Well

[Cyberax]

"Auto-allocated addresses include the host's MAC address."

Unless privacy extensions are used.

Re:Well

[gtall]

Contracting for research is more true of the other services than the Navy. The Navy does a lot of its own research and as a result, that research gets disseminated throughout DoD and even given to contractors. Privatization does have a downside, some moronic Republicans and most of the Tea Twits thinks research grows on trees and is somehow freely available. They never met a research program they could understand.

Re:Well

[Chuck_McDevitt]

You don't understand IPv6 well.. It has an option for pricacy-enhanced "temporary" IPv6 addresses to be used for outbound connections. Windows has this on by default, most linuxes seem to require you to turn it on.

When it is on, a randomly generated short-term IPv6 address is generated when you make an outbound connection. This IP address lives for a short while (until the connection is closed or a few hours, whichever comes later). Windows uses a new one for each new outbound connection (you can have thousands of IPv6 addresses at the same time.

However, if you are worried about your home internet, it doesn't help much. You need either a traceable IPv4 address, or a traceable IPv6 routing prefix, so packets can get to you. They can't tell which machine on your network generated the traffic, but they do know it was from your network.

Re:Well

[arth1]

You don't understand IPv6 well. The privacy enhancement is just a small part of the full address -- the rest is static. So there's still enough information for fingerprinting the LAN, even if which machine on the LAN used it is obscured.

(Posted from real IPv6 through a proxy gateway)

Re:Well

[MintyGreenMedia]

Granted, you can set up a fc::/7 network,

You don't understand IPv6 well. RFC4193 space is fc00::/7, not 00fc::/7.

(Sorry, saw that error and had to jump on the bandwagon.)

How long will IPv6 last?

[Anonymous Coward]

Based on current rates of growth and industry trends, how long will it be before the IPv6 space is exhausted? Given how hard this transition is, would it be better to go directly to IPv8 or some kind of variable-length scheme?

Re:How long will IPv6 last?

[TheDarAve]

640k of address space should be enough for anyone.

Re:How long will IPv6 last?

[Nethead]

You try to design a router ASIC with variable length addresses!

Re:How long will IPv6 last?

[Anonymous Coward]

Until the surface of Earth resembles Coruscant.

Re:How long will IPv6 last?

[zero.kalvin]

2^128 unique address. I don't think we'll be exhausting them any time soon. That's like each person on earth have access to roughly 10^38 unique address.

Re:How long will IPv6 last?

[Anonymous Coward]

2^128 unique address. I don't think we'll be exhausting them any time soon. That's like each person on earth have access to roughly 10^38 unique address.

Doesn't matter. I want IPv6-NAT... And anyway, IPv6 addresses are ugg-ly.

Hell, maybe the whole IPv6 thing should be thrown out and something else designed, that is more compatible with the existing IPv4 network.

Re:How long will IPv6 last?

[Nethead]

Why IPv8? Why not IPv9?

http://www.rfc-archive.org/getrfc.php?rfc=1606

Re:How long will IPv6 last?

[Byzantine]

Trantor is prettier.

Re:How long will IPv6 last?

[Anonymous Coward]

What's the population growth rate of the earth? What's the growth rate of devices per person? Sure ipv6 has big numbers, but big numbers is what exponential growth is all about

Re:How long will IPv6 last?

[Nethead]

We're down to the last 5 IPv4 /8 netblocks. A little late for that.

Re:How long will IPv6 last?

[Junta]

Though things aren't likely to exhaust any time soon, that's a fairly naive perspective on it.

2^121 addresses are knocked out by ULAs, 2^118 knocked out by link-local addressing, 2^120 are only available for multicast. In aggregate, a small chunk, but sizable.

Then, there is the inefficiency of distribution. Nothing smaller than /64 is ever supposed to be given to any single network segment. Currently, nothing smaller than a /48 is supposed to be given to an entity allowed to do routing (e.g. houses), though some have proposed allowing /56. Just like some places have 16.7 million IP addresses that don't need them, similar inefficient allocations will be made in IPv6 world.

In order to do a competent assessment, a more complex projection is required.

Re:How long will IPv6 last?

[Relic of the Future]

Think of it this way: each current IP address could have its own private entire IPv4 address space... and then each of THOSE private addresses could have its own private entire IPv4 address space... and then each of THOSE addresses could have its own private entire IPv4 address space.

It'll last a while.

Re:How long will IPv6 last?

[Bookwyrm]

Going to a variable-length scheme is one possible (if tricky) solution.

The major problem is that 'end-to-end' has become blind ideology rather than useful design methodology. As a result, people keep fighting tooth and nail against the very idea of NAT and encouraging development of applications that are tightly coupled to the underlying network.

Instead of pushing for IPv6, there should be an effort towards developing against a more abstract network model such that applications do not care if they are using IPv4 or IPv6 or IPv42, such that protocol translation between different network families can be implemented where necessary.

Or, to answer you question, if networks globally all transition to IPv6, it will last forever because it will bring innovation in the network protocol family to a grinding halt. Even if someone came up with a truly amazing and brilliant network protocol that was provably better than IPv6, it would never get implemented in a world were every toaster oven and garage door opener is built with an IPv6 stack and, due to dead-end-to-dead-end ideology, is unable to communicate with anything but IPv6. Just look at the transition from IPv4 to IPv6 and how long "IPv6 has been just around the corner", then imagine the inertia on migrating from IPv6.

Re:How long will IPv6 last?

[Gerald]

There are 2^125 *global* addresses, you resource-hogging Earthist pig.

Re:How long will IPv6 last?

[Bucky24]

I'm not entirely sure if you're being sarcastic, or if I'm completely misunderstanding your post, but isn't that how NAT already works?

Re:How long will IPv6 last?

[sjames]

Take every single network interface ever created from the very beginning. They will all fit into just 1 /64 with room to spare. Now, have every machine currently on the Internet replaced with every network interface ever created. Repeat that 4 billion more times and we'll have to start changing standards around a bit to conserve space.

We could give each human cell it's own IPv6 address and still not run out. Not even if we expand to a million other planets.

We have a few to spare...

Re:How long will IPv6 last?

[mattventura]

Not quite. The nat network would only have a (relatively) small private address space, not the whole IPv4 address space. GP is correct, since the raw IPv4 space is 2^32 and the raw IPv6 space is 2^128.

Re:How long will IPv6 last?

[Aqualung812]

Doesn't matter. I want IPv6-NAT...

You want to learn about security. There is nothing good about IPv6-NAT, and security through obscurity isn't security.

And anyway, IPv6 addresses are ugg-ly.

Learn DNS. You should only be looking at a IPv6 address if you are a network engineer.

Re:How long will IPv6 last?

[Nethead]

Er, which globe are you talking about then?

Let me know when you get that fiber drop in the Jupiter system. I'll need to add Europa to my bogon list so I don't accidentally send traffic there.

Re:How long will IPv6 last?

[Professr3]

+1

Re:How long will IPv6 last?

[sjames]

Screw it, 11 is one louder!

Re:How long will IPv6 last?

[bcmm]

Based on current rates of growth and industry trends, how long will it be before the IPv6 space is exhausted?

(Deep breath)
When we have colonised the entire observable Universe (at a (hugely over)estimated one habitable planet per star), our descendants* will be able to own about three-quarters of a million cellphones each.**

Given how hard this transition is, would it be better to go directly to IPv8

If you mean we should skip a step while we're at it, we are: we're going straight from 32-bit to 128-bit, rather than 64-bit.

* In before "this is Slashdot".
** 715,925 cellphones should be enough for anyone!

Re:How long will IPv6 last?

[Nethead]

Instead of pushing for IPv6, there should be an effort towards developing against a more abstract network model such that applications do not care if they are using IPv4 or IPv6 or IPv42, such that protocol translation between different network families can be implemented where necessary.

You mean something like the OSI model?

http://en.wikipedia.org/wiki/OSI_model

Re:How long will IPv6 last?

[icebraining]

No, parent is not saying IPv6 works that way, but that IPv6 will give you the equivalent number of addresses.

But if you use the entire address space for your local network, you won't be able to access the internet at all; you can only use reserved IPs, which aren't used on the Internet, or else you might not be able to access some services.

Re:How long will IPv6 last?

[marcosdumay]

Based on current rates of growth, it won't last until the heat death of the universe. But, for the required number of clients to come into reality, we'd have to be displaced through the biggest part of our galaxy, and IPv6 copes very badly with interestelar communication, so we'll need another protocol anyway.

Re:How long will IPv6 last?

[Anonymous Coward]

Ethernet frames are bad enough. ATM for final victory.

Re:How long will IPv6 last?

[Anonymous Coward]

"Not quite"? Try "not at all".

With NAT, you are hiding a subnet, and other groups can reuse the same subnet - you cannot address a device on a different NATed subnet. So, it's four layers deep instead of just one or two, each layer is (as you pointed out) the size of the entire ipv4 address space instead of just a chunk of it (which together mean the number of possible addresses is absurdly higher), but also - importantly! - devices on the subnet are actually addressable which cannot be the case with NAT and is a huge change in functionality.

Re:How long will IPv6 last?

[Anonymous Coward]

I'm honestly curious about this question, not looking to get into a flame-war. I've been searching for a while now for the answer: How does IPv6 handle IP address abstraction? What I mean is, I don't want to be switching my internal networks IP addressing around every time I switch ISP's. With IPv4, I have a private addressing scheme which gives everything a logical home and doesn't have to be re-done when I switch ISP's for a location. So far, no resources on IPv6 that I've found tell me how this feature of NAT has been replaced.

Re:How long will IPv6 last?

[geniusj]

ASNs+BGP for every home!!!

Re:How long will IPv6 last?

[Cwix]

*shudder*

Re:How long will IPv6 last?

[segedunum]

Oh God, please don't let sensible practicality get in the way of this. You should know by now that private addressing and NAT is completely evil and there are absolutely no reasons at all why you should be doing this.

Re:How long will IPv6 last?

[mark-t]

You presume that people might want NAT for security... when they may simply want it for its notion of compartmentalization. Many devices in your home may be able to benefit from internet connectivity, for example, but not all of them would benefit from being visible on the global Internet, and neither would it be desirable for them to be... again, not from an issue of security, but simply from an issue of what would make any sort of sense (of course, the same reasoning could apply to why some devices should not have IP addresses at all).

Re:How long will IPv6 last?

[Gerald]

Apparently you haven't heard of the Interplanetary Internet.

Re:How long will IPv6 last?

[Nethead]

I want to see you try that rant on the NANOG list.

Re:How long will IPv6 last?

[Anonymous Coward]

See that's what I'm afraid the thinking has been so far. I've got many hours in on searching for this and so far, nothing. The resources I come up with keep demonstrating networks that appear to require me to stay on one ISP forever at each of my locations.

Re:How long will IPv6 last?

[vijayiyer]

There are large corporations with whole class A blocks that expose all their internal addresses because it has nothing to do with security. So much for your "no organisation" argument.

Re:How long will IPv6 last?

[MichaelSmith]

In my intranet I want each node to have a hostname so that I can reach it to access services. For this to work I need to give each node a static IP address. So how can I do that without private addresses?

Re:How long will IPv6 last?

[simcop2387]

There is support for doing that kind of thing, and it should be doable in theory. http://en.wikipedia.org/wiki/Private_network#Private_IPv6_addresses there is a giant number of private addresses and you should be able to easily set those up in tandem with the globally routable ones.

Re:How long will IPv6 last?

[j-beda]

But, man, is it going to be a pain to switch to IPv8 at that point!

Re:How long will IPv6 last?

[asdfghjklqwertyuiop]

Nobody wants to expose all their internal addresses. Period. Which part of that can you dumb fucks not understand? No organisation is going to want to implement that.

Exposing your internal addresses should be irrelevant to security unless you're doing something else wrong. Those of us that understand that are OK with our internal addresses being exposed and want them to be. A lot of organizations already do implement that even with IPv4. Which part of that do you dumb fucks not understand?

Re:How long will IPv6 last?

[RapmasterT]

Doesn't matter. I want IPv6-NAT...

You want to learn about security. There is nothing good about IPv6-NAT, and security through obscurity isn't security.

There's a lot more to NAT than security. You might want to read up on it.

And anyway, IPv6 addresses are ugg-ly.

Learn DNS. You should only be looking at a IPv6 address if you are a network engineer.

You do know where you are right? "only if you are a network engineer" is going to be a significant part of the Slashdot population. Also, "learning DNS" without learning the underlying protocol (IPv6) is not learning anything, you're just using an app.

Re:How long will IPv6 last?

[Yvanhoe]

I remember someone actually calculating the density of nanobots you would need per cubic meter in the whole atmosphere to fill the IPv6 address space. You can do it, but that day we will have some more serious concerns...

Re:How long will IPv6 last?

[Yvanhoe]

Actually DNS appearing to be the pressure point that censors will use to switch down website, I say it is interesting to be able to memorize a few or to write them down quickly.

Re:How long will IPv6 last?

[asdfghjklqwertyuiop]

So "compartmentalize" them all you want with public addresses. It really doesn't matter if your air conditioner is at 192.168.74.91 or 206.221.38.55. You're just losing NAT and non-unique addresses and gaining more work when you renumber (which IPv6 makes easier).

Re:How long will IPv6 last?

[Anonymous Coward]

Rewriting my firewalls rules each time I switch ISP's doesn't sound very safe or fun to me. How does IPv6 allow me to set up an internal addressing scheme independent of what my ISP is allocated?

Re:How long will IPv6 last?

[Anonymous Coward]

There's a lot more to NAT than security. You might want to read up on it.

Yep.
The same security as a stateful firewall, with all the "fun" of port forwarding.

Re:How long will IPv6 last?

[asdfghjklqwertyuiop]

Do what without private addresses? Assigning static addresses or setting up A or AAAA records works about the same with public or private addresses.

Re:How long will IPv6 last?

[asdfghjklqwertyuiop]

What kind of firewall? If it is something with a textual sort of configuration you can just set your prefix once in a variable and use the variable throughout the configuration.

Re:How long will IPv6 last?

[Anonymous Coward]

You can use the fc00::/7 prefix for your internal network... called a Unique Local Address. It's defined in the RFCs. Another range may be used for that, if it hasn't been deprecated (fec0::/10).

I just took the /64 that HE assigned me and assigned internal IPv6 addresses to everything, based on their IPv4 addresses... only one machine has a tunnel set up though.

Re:How long will IPv6 last?

[Anonymous Coward]

Windows Firewall with "Advanced Features" is AWESOME!!!!111!!

Re:How long will IPv6 last?

[DarkOx]

First of all I really hope not, and second I suspect most homes will remain edge networks so the ISP can handle all the routing to and from the Internet.

Re:How long will IPv6 last?

[Rising Ape]

You can have private addresses with IPv6. You can also have multiple addresses per interface, so you could advertise/withdraw the appropriate route advertisements for public addresses as needed, in addition to the static, private one, with the public ones being used for external communications. So all your internal communications work with fixed addresses.

Whether the tools have been implemented to make the administration of that practical is another matter entirely, but is rather the key issue.

Re:How long will IPv6 last?

[Anonymous Coward]

Cisco ACL's, for example. I've not seen variables mentioned before, I'll have to go read up on them.

Re:How long will IPv6 last?

[Charliemopps]

I remember someone saying the same general thing to me when I bought my first 80Mb hard drive. You could practically install every piece of software ever written for a PC on that one drive! Why would you ever need anything bigger.

Re:How long will IPv6 last?

[Anonymous Coward]

It is. The problem is that it is not enough for everyone.

Re:How long will IPv6 last?

[Nursie]

Not having machines publicly addressable is most definitely a security advantage.

I hear this all the time, that it's insecure, but I have yet to hear an actual good reason, do you have one?

Because NAT is perfect for plug-n-play devices with questionable per-device security. Why on earth should consoles and internet-aware appliances at my folks house need a public address? They don't know much about security and getting rid of in-home NAT just exposes them to far more risk.

NAT == BAD seems to be a religious expression more than anything actually practical.

As for DNS... are we going to have a DNS server in every home now too? Every device is going to agree on the same WINS-style home-DNS registry protocol?

Re:How long will IPv6 last?

[CyprusBlue113]

You should refrain from lumping the rest of the world in to your little delusions, the rest of the internet that actually works in networking, do not in fact, share your paranoid view of "OMG PEOPLE SEE MY IPS! THEY CAN HACK ME!" and are actually quite comfortable in the significant distinction between stateful fire-walling and IP masquerading / Network Address Translation.

You may have actually had a smidgen of an argument if you had brought up PI space as opposed to using assigned space in your uninformed rant due to portability issues when switching carriers or multihoming, but unfortunately, you avoided even the one tiny hope of an argument you could have made in your favor.

As to your DNS vs IP comment, (although this applies to your previous ranting as well) To quote a favorite movie of many:
What you just said is one of the most insanely idiotic things I have ever heard. At no point in your rambling, incoherent response were you even close to anything that could be considered a rational thought. Everyone in this room is now dumber for having listened to it. I award you no points, and may God have mercy on your soul.

Thank you for warning the rest of the internet of your ignorance, I have as such, marked you as -1 in my list, and appreciate the gracious warning so that I may avoid your drivel in the future. Have a nice day =)

Re:How long will IPv6 last?

[Arancaytar]

Yeah, but if nano-scale computers are ever mass-produced...

(...it would still take longer than the age of the universe to run out of addresses.)

Re:How long will IPv6 last?

[Anonymous Coward]

Ok, but I want 2^128 - 2^32 addresses for myself. Looks like you people are SOL (again).

Re:How long will IPv6 last?

[wolrahnaes]

Nobody wants to expose all their internal addresses. Period. Which part of that can you dumb fucks not understand? No organisation is going to want to implement that.

1. Deny all default inbound rule on the firewall. Done. Same level of security as NAT.

2. There are still link-local addresses if you want to configure machines or services to be local-only.

NAT is a bad thing. It's a hack to resolve a problem (limited IPs) that IPv6 eliminates, so get rid of it.

Re:How long will IPv6 last?

[onionman]

I'm afraid that IP addresses are a very real part of working on networks today, and making them relatively easy to remember is pretty important. Mixing numbers and letters together in hexadecimal (a numbering system humans don't use) was something cobbled together by some tit who had no idea about the practicalities of maintaining a network.

The base in which you choose to represent the number is not really relevant. The computer is storing it all in binary anyway. You can write your applications to accept them in decimal if you wish, and let the computer convert them to binary. The reason that the standard is hexadecimal is because it is much quicker to convert from hex to binary in your head than from decimal to binary.

The binary representation allows you to see the network topology (and hence the routing rules) much more quickly. There's a reason that 255 shows up so often in IPv4 address, it's 0xff which is eight ones in binary, and when used as a mask it selects all the bits in the octet. Similarly, something like 248 is 0xf8 which is 11111000 in binary, which makes it much easier to see how the subnet routing is set up.

The philosophy of using hex is that hex is what networking experts would prefer to work in. So, give them hex addresses, and let the standard users just use DHCP-like services and never worry about IP addresses.

Re:How long will IPv6 last?

[techno-vampire]

Mixing numbers and letters together in hexadecimal (a numbering system humans don't use) was something cobbled together by some tit who had no idea about the practicalities of maintaining a network.

As a matter of fact, the term "hexadecimal" goes back to 1954, decades before the first computer network and the use of letters (although not always, at first, A through F) goes back to at least the 1940s. Using them in IPV6 addresses is simply using the system in the standard fashion; anything else would be confusing.

Re:How long will IPv6 last?

[walshy007]

Why on earth should consoles and internet-aware appliances at my folks house need a public address?

VOIP is one application, being the game host in a multiplayer game is another. Nat essentially makes the internet one-way and to get around it involves serious hacks.

NAT == BAD seems to be a religious expression more than anything actually practical.

Suuure, because being against seriously breaking networks is a religion...

As for DNS... are we going to have a DNS server in every home now too?

router does this job, most modern ones already do. get a domain for your network and allocate subdomains from your router.

Re:How long will IPv6 last?

[owendelong]

Based on the current trends and even the most liberal theories of allocation being even proposed, in about 50 years, we MAY have allocated as much as 0.5% (yes, 1 half of one percent) of the IPv6 address space.

Variable length schemes are impractical at backbone forwarding rates. Hardware to support a variable length scheme would be incredibly expensive.

While the transition to IPv6 does involve some effort, it is not nearly as bad as many have claimed it will be. My employer operates a three-continent
dual-stack backbone. I run fully dual-stack at home (except for an amplifier, some TiVO boxes and an old terminal server which are not IPv6
capable).

Transitioning my network took a total of less than 12 man hours with an elapsed time of approximately 7 days.

Re:How long will IPv6 last?

[owendelong]

There is a difference here. IPv6 would be the equivalent of IBM saying something more like:

640 exabytes ought to be enough for anyone.

(note by exabyte I mean 1000 terabytes, not Exabyte the brand name of many 8mm digital video tape drives).

340*10^36 (the IPv6 address space) is more than 10^26 times the current demand for addresses.
Compare to 640k which was roughly 10^1 times the standard memory size for machines of the day.

In fact, today, I doubt you can identify many (any?) machines with more than a terabyte of RAM.
In fact, it's rare to find more than 128GB of RAM capacity in most machines. (64GB is roughly
100,000 times the original 640KB number, so 128GB would be 2*10^5 times 640KB).

To put the comparison in some perspectives you might be able to wrap your head around...

If you were to allocate an almond M&M for every 256 IPv4 addresses, the resulting amount
of almond M&Ms laid out in a 1-M&M thick layer would cover only 70 yards of an american
regulation football field (NFL, not FIFA). (16.7 million M&Ms, 1 for each IPv4 /24 prefix)

Contrast that with the number of IPv6 /64 prefixes (a bit more than 18 quintillion) which
would provide enough M&Ms to fill all of the great lakes.

Where each /24 can accommodate a single router and up to 253 other hosts, each
IPv6 /64 can accommodate more hosts than you could ever physically put on any
conceivable scale of network gear (18 quintillion+ hosts).

There will not be a likely shortage of IPv6 addresses in any of our lifetimes.

Re:How long will IPv6 last?

[zach_the_lizard]

Use the link-local addresses internally, if you must. (Not sure how good a suggestion that is). MDNS lets you resolve hostnames with little work, IIRC, so use that. Set it up so that your software can use the new prefix from your ISP but retain the host part of the address.

Re:How long will IPv6 last?

[smash]

You've heard of firewalls, yes?

Its not like scanning an entire /64 or /48 of an organization's IP address space for open ports is a feasible thing.

And yes, learn DNS. The "hobbled together" nature of IPv6 addressing is necessary to get the required address-space. There is zero reason to be remembering ip addresses of all your gear if you have a working DNS infrastructure.

Re:How long will IPv6 last?

[c0lo]

IPoAC?

Re:How long will IPv6 last?

[zach_the_lizard]

Hexadecimal is also more compact. If we did the standard "convert each octet to decimal and put a dot between them" strategy, there would be 16 octets to write in decimal. 255 or ff, you decide. They also gave us shortcuts: How bout ff::1 or 255.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1?

Re:How long will IPv6 last?

[mark-t]

Ultimately, using a globally visible IP address when it is not needed is wasting that IP address which might very well be usable elsewhere. 2^128 addresses may seem like an awfully big number, but that doesn't mean we should be wasteful. Remember, at one time it was thought there was an inexhaustible supply of salmon in the Atlantic.

Ultimately, the chief argument against NAT is breaks a lot of protocols, and I don't argue that point, but if it were only being used in situations where such protocols wouldn't even be desirable to have, what difference does it make? The only reason NAT gets in the way right now is because it's being used on home computers, where a globally visible IP is often genuinely desirable. But if NAT is only used for devices where that sort of visibility doesn't matter, like a lot of home appliances, for example, how does NAT break anything?

And hey, using extension headers of IPv6, you could even create a raw IP protocol that routes right through NAT's anyways. And because it's raw IP, you could even build arbitrary protocols on top of that. To route data through a NAT to an IP that it can't directly see, a sender would put the NAT's IP address into the main header, and put the IP address as seen behind the NAT unto an extension header. Whenever the NAT device sees the appropriate extension header on an incoming packet, it would route the content directly to the desired system indicated in the extension header, stripping out the extension header in the process. To send data out from a system that it is desirable for an external system to route to, the system would have to use an extension header of its own, which the NAT device would fill in on outgoing packets to identify the actual sending system as viewed from behind the NAT. If that information is not required by the recipient, it would simply be ignored as superfluous header information. Of course, this would require special software on the NAT to accomplish it, but the problem is quite manageable with the technology we have today, and should not be unduly expensive. One could theoretically even chain this quite a few times, to route through multiple layers of NAT's... with the only upper bound being dictated by how many extension headers can fit into a single raw IPv6 packet (which would easily be on the order of dozens or even hundreds).

Re:How long will IPv6 last?

[smash]

ALSO, there are only 3 NAT ranges.

Try this sort of thing for why NAT in IPv4 is completely brain damaged (and un-necessary in IPv6):

• Establish a VPN connection from a network that is NATed with the same IP range as the network you are attempting to VPN into
• Join two corporate networks (as in company merger, joint venture, etc) that are using the same internal IP address range (typically 10/8)

Hint: it doesn't fucking work. In IPv6 you get local addresses that are pretty much guaranteed to be globally unique.

Re:How long will IPv6 last?

[smash]

We can simply start using NAT... :D

Re:How long will IPv6 last?

[MrQuacker]

It goes: Mega -> Giga -> Tera -> Peta -> Exa

You skipped one.

Re:How long will IPv6 last?

[Midnight Thunder]

IPv6 addresses aren't meant to be used in their raw form (even if you can) and you should use some sort of name service, such as DNS or Zero-Config (amongst others). We could have stuck with a decimal notation for IPv6 addresses, but you would then be complaining that IPv6 addresses are too long. Believe me, the IPv6 numerical notation is not perfect, but it sure beats the alternative. Heck ::1 is a lot short than 127.0.0.1 and your IPv4 address can be represented in IPv6. For example 123.156.123.156 is simply ::7B9C:7B9C (blocks of zeros can be resumed to :: ).

IPv6 is not that much different to IPv4, though it is the address length is what breaks any levels of compatibility. No IPv4 hardware or software is designed with anything else than a 32-bit IP address in mind. So there really is no better solution that is "that is more compatible with the existing IPv4 network" and anyway even if there was it is too late for that now. No point in fighting the coming tidal wave, even if you are only seeing the receding IPv4 tide for the moment. Get with it!

Re:How long will IPv6 last?

[Anonymous Coward]

And IPv4 only had /32 address space. Each user on the internet has /32 or larger space. With new allocation, /32 is allocated to an *ISP*, not any network or simple group of networks.

Houses will do just fine with /64. /64 is a *network segment*. Another /64 is then used by ISP for PPP protocol to do actual routing to clients on one PPP segment. So,

/128 on ISP <---> /128 on your gateway <---> /64 is your network

So, how is a /48 required for your house?? /48 is a corporate network that requires multiple LANs (eg. hospitals, schools, large offices, etc..)

Re:How long will IPv6 last?

[Daniel Phillips]

Given how hard this transition is, would it be better to go directly to IPv8 or some kind of variable-length scheme?

Oh, absolutely, we just just skip IPv6 and go straight to XML addresses.

Re:How long will IPv6 last?

[binarylarry]

Exactly. /64 ought to be enough for anyone.

Re:How long will IPv6 last?

[Sometouw]

Looks like someone should learn about how site local addressing can coexist with global addressing. Oh, you do separate your internal and external DNS right?

Re:How long will IPv6 last?

[smash]

Sorry can you please post the size of the ipv6 pool in something people can relate to, such as libraries of congress?

Re:How long will IPv6 last?

[Sometouw]

Well if your talking Cisco. ACL's on a switch or router != firewall. Try using an ASA. Soon you will learn to love Network Objects and Network Object groups.

Re:How long will IPv6 last?

[Anonymous Coward]

Unique Local Addresses....ULA.

http://en.wikipedia.org/wiki/Unique_local_address

Re:How long will IPv6 last?

[mark-t]

VOIP is one application, being the game host in a multiplayer game is another.

Neither of which are needed for most home appliances. Of course, neither is an IP address at all, but under IPv6, there will be enough for every device anyways, so it's not a serious problem.

Nat essentially makes the internet one-way and to get around it involves serious hacks.

I don't think anybody argues that NAT breaks a lot of protocols, but it's hardly necessary that every electronic device absolutely must be able to utilize them all, or even a subset of the ones that break. The only problem with NAT is when it's imposed on systems that actually could productively benefit from the two-way connectivity that NAT effectively prevents in most cases, and it's simply not the case that this would be true for every conceivable device that might still benefit from a simple 1-way internet connection.

Re:How long will IPv6 last?

[smash]

Here here. Those who suggest NAT as a security measure simply do not understand stateful firewalling.

All the brain damage of NAT is avoided by

ip access list extended internet-in
permit ip any [your subnet] established
deny ip any [your subnet]

Done. Apply that to your incoming interface and you have the same level of security (or better) as NAT.

Re:How long will IPv6 last?

[smash]

Um. replace ip with TCP in the first line...

Re:How long will IPv6 last?

[owendelong]

I'll try...

I have no idea of any meaningful measurement of Library of Congress for comparison, sorry.

It takes 39 digits to define the number of addresses in IPv6. Only 10 digits to define the number of addresses in IPv4.

If you treat each address as a unit of mass and consider IPv4 to have mass equivalent of 7 liters of water, then, IPv6 would have mass equivalent roughly to Earth. (The whole earth, including all the oceans, lakes, land masses, people, buildings, etc.)

In IPv4, there are more than 1.5 people alive today for every address.

In IPv6, there are 50,041,524,547,196,832,862,260,971,681 addresses for each person alive today.

Or, perhaps consider the following:

The US public debt is 13,848,000.000,000. If IP addresses were pennies, we would need 3,462 IPv4 internets to pay it off. The IPv6 address space, converted to pennies, OTOH, would pay the public debt more than 24,572,672,365,752,344,270,896,491 times.
(If anyone wants to send me even a single IPv6 /64 network worth of pennies, please
email me for contact information.) ;-)

Hope that helps.

Re:How long will IPv6 last?

[Hecatonchires]

There is zero reason to be remembering ip addresses of all your gear if you have a working DNS infrastructure.

When setting up a firewall with external rules (allow traffic from external company to internal server on port x) using dns opens a security hole. Its a small fiddly one, but it's an audit item :(

Re:How long will IPv6 last?

[Anonymous Coward]

How does Ass To Mouth ensure final victory?

And why oh why did The Internet have to corrupt that TLA too for me?

Re:How long will IPv6 last?

[aiht]

I remember someone saying the same general thing to me when I bought my first 80Mb hard drive. You could practically install every piece of software ever written for a PC on that one drive! Why would you ever need anything bigger.

They were wrong.

Think of it like this...
The jump from IPv4 to IPv6 address space (ignoring private address ranges etc.) is a multiplication by 79,228,162,514,264,337,593,543,950,336.
So your story would go:
You have a 10MB hard drive, say, and it's starting to feel a bit undersized.
So you buy a 792,281,625,142,643,375,935-petabyte drive.

See the difference?

Re:How long will IPv6 last?

[Drishmung]

You try to design a router ASIC with variable length addresses!

You and I might struggle, but Tony Li didn't seem to have a problem with it. Really. Go and look at Google Groups for info.big-internet around 1993-1994 and see Tony provide pseudo-code that demonstrated that variable length was not a problem for ASICs, nor was it any slower.

Yes, it is obvious that fixed length must be better than variable length. Yes, that is incorrect. What everyone 'knows' may be far from the truth.

Now, continue surfing using the more efficient, cheaper ATM (fixed size cells) NIC rather than that inefficient , expensive Ethernet (variable size frames) NIC.

Re:How long will IPv6 last?

[Drishmung]

Doesn't matter. I want IPv6-NAT... And anyway, IPv6 addresses are ugg-ly.

Hell, maybe the whole IPv6 thing should be thrown out and something else designed, that is more compatible with the existing IPv4 network.

So you would agree with this then... http://www.youtube.com/watch?v=v26BAlfWBm8

Re:How long will IPv6 last?

[Aqualung812]

There's a lot more to NAT than security. You

What, exactly, is good about NAT? IPv6 is happening and has been for over 10 years. Part of the implementation is that a /64 is getting assigned to every ISP customer. You're going to have more IP addresses than you can ever hand out, just for your house. What, again, is NAT helping with?

You do know where you are right? "only if you are a network engineer" is going to be a significant part of the Slashdot population.

My assumption is that a real network engineer understands IPv6 and the issues with NAT.

Re:How long will IPv6 last?

[Aqualung812]

Ultimately, using a globally visible IP address when it is not needed is wasting that IP address which might very well be usable elsewhere. 2^128 addresses may seem like an awfully big number, but that doesn't mean we should be wasteful.

That ship has already sailed. Most ISPs are giving out a /64 to each customer. That's 2^64 IP addresses regardless if you need them or not. The spec for IPv6 has been designed, IPv4 is about out, and you have more IPs on each network than you will ever use. There is NO need for NAT.

Re:How long will IPv6 last?

[Anonymous Coward]

1. It's called the DNS

2. You get thrown off ISPs frequently? That's why you are concerned about renumbering?

3. You can of course have mutiple address prefixes from multiple ISPs simultaneouslty with IPv6.

4. Can I set fire to your strawman now? Because the warmth from the burning is the only benefit this argument will realize.

5. NAT66, if you really, really must.

6. ULAs (goes and throws up in a corner)

Re:How long will IPv6 last?

[marka63]

Ultimately, using a globally visible IP address when it is not needed is wasting that IP address which might very well be usable elsewhere. 2^128 addresses may seem like an awfully big number, but that doesn't mean we should be wasteful. Remember, at one time it was thought there was an inexhaustible supply of salmon in the Atlantic.

Think about IPv6 as 2^64 networks of 2^64 hosts. The network assignments are managed conservatively.

Ultimately, the chief argument against NAT is breaks a lot of protocols, and I don't argue that point, but if it were only being used in situations where such protocols wouldn't even be desirable to have, what difference does it make? The only reason NAT gets in the way right now is because it's being used on home computers, where a globally visible IP is often genuinely desirable. But if NAT is only used for devices where that sort of visibility doesn't matter, like a lot of home appliances, for example, how does NAT break anything?

The problem with NAT is that the presence of NAT in the network has impacts on what stuff gets developed. People then need to ask "Will this work with NAT?" and often the answer is NO.

Re:How long will IPv6 last?

[Midnight Thunder]

If your devices do not need to speak to the outside world then they can just use link local addresses ( fe80::/64 ) and be hidden from view. Heck they could even stick with with IPv4 if need be. Anything else that needs to speak with the outside world will need a routable address or deal with some sort of proxy (if outgoing only).

You can even add a firewall (and you really should) to reduce access to resources that aren't intended for use by external entities. Firewalls can be written to deal with dynamic subnet prefixes, so there isn't really an excuse to not have one.

Re:How long will IPv6 last?

[Junta]

Houses will do just fine with /64.

Maybe I'm just seeing the parts of the debates I want, but it seems the sentiment at least in NANOG is maybe down to /56 or maybe even /60, but not to /64 even for residential. The reason being that if routers for example wanted to make the wireless and wired two segments, then a /64 would be impractical. Today those are generally bridged networks, but that's only an example of the notion that even a house may have need/desire of routing. You should only do a /64 if you are managing the specific details and know that is truly an endpoint. Even in the case of a residential customer, you are not administering their internal topology, but delegating it to them/their router vendor.

I do not want allocation to be so overly stingy that I can't split my allocation into multiple segments without breaking the rules of reasonable IPv6 allocation, so I'm really against the notion than /64 for a residence is fine.

Re:How long will IPv6 last?

[Cinder6]

I'll try...

I have no idea of any meaningful measurement of Library of Congress for comparison, sorry.

Got one for you. The Library of Congress has (according to Wikipedia) 21814555 catalogued books. There are 2^128 IPv6 addresses. Thus, each book can have roughly 1.56 * 10^31 addresses assigned to it.

Re:How long will IPv6 last?

[Yaztromo]

Because NAT is perfect for plug-n-play devices with questionable per-device security. Why on earth should consoles and internet-aware appliances at my folks house need a public address? They don't know much about security and getting rid of in-home NAT just exposes them to far more risk.

No, a stateful firewall is what is protecting them, not NAT. Nobody is suggesting that homes will no longer need a "router" device for their computing devices, consoles, media players, and other net-enabled devices to sit behind, which by default block all incoming port requests. That will remain the same. Having a private internal address doesn't fix those less-secure devices -- it's the device at the gateway to your home that permits or denies access. This won't change with IPv6, but you'll be able to have public addresses that are directly routable for those devices that do need them.

(Apple's Airport Extreme has a stateful IPv6 firewall built in, and it's default i a to block everything. It has the same interface to explicitly allow certain ports to certain hosts as for IPv4 with NAT, and does the same job).

Yaz.

Re:How long will IPv6 last?

[mark-t]

Okay... so one can use the FC00::/7 prefix... but NAT could still be possibly required so that, for example, an electronic appliance with that prefix assigned to it might still routinely be able to check online to check for firmware updates, and could do so without requiring the use of a globally visible IP. And while it's true that you can have multiple IP's on a single interface, using a globally visible IP still uses an IP that simply wouldn't be required in the first place with NAT. 2^128 is certainly an awfully big number, but that doesn't mean we should be wasteful. At least with IPv6, NAT wouldn't a requirement for people, which is a good thing... but neither, I think, should its wholesale removal be enforced on devices where it isn't really needed or desired.

Re:How long will IPv6 last?

[Anonymous Coward]

You ought to work for an IPv6 marketing company. Seriously.

Re:How long will IPv6 last?

[smash]

Local addresses. If you really wanted to you could continue to run IPV4 internally, and run all services via an IPV4-IPV6 translator.

But you'd have to be pretty masochistic...

Re:How long will IPv6 last?

[smash]

This is why you have internet facing DNS, and internal DNS severs.

Re:How long will IPv6 last?

[mark-t]

The need for NAT comes from the demand for it. It's not going to magically go away.

Also... many networkable devices work perfectly fine behind a NAT, and have absolutely none of their consumer accessible functionality limited by its presence.

Ultimately, however, only thing that could really necessitate NAT under IPv6 is that it is far simpler for a consumer to use than learning how to configure a firewall to prohibit external connections to specific systems in their LAN.

Really though... what gives you any more right to insist on taking NAT away from people who want it than they have to force it on people who don't?

Re:How long will IPv6 last?

[smash]

I'm not entirely sure you understand just how big the ipv6 address space is. I'm also not entirely sure you have dealt with large scale nat related problems before.

Exhibit A: you are the admin of a 5,000 host multi-site network, with 100 computers per site. You are running an IP range of 10.1.y.z where Y is a unique site number and z is the host part. You want to join networks (company merger) with another company that is also running 10.1.z.y. You have overlapping IP ranges.

Who re-addresses their network, and where does the budget (time/money) come from to do this?

Exhibit B. You have a similar situation to the above, with peeps from company A wanting to VPN into company B (contractors, for example). Both run the same internal IP range. It doesn't work.

Re:How long will IPv6 last?

[Anonymous Coward]

Damnit, my AI device needs one IP per neuron!

Re:How long will IPv6 last?

[arth1]

Actually, there's a myria between mega and giga, but it isn't used much, because we tend to only think in terms of 1000^N or 1024^N. Oh, and because while it's part of the metric system, it's not an SI unit (but then again, neither is mega when used for 1024*1024).

But the next time you want to screw with someone's head, you could say 100 myriabytes instead of a gigabyte.

Re:How long will IPv6 last?

[Anonymous Coward]

Plus the fact that the last 48 bits are the mac address, so a /50 network will never have more than 2 addresses used. It's really 2^80 before you start subtracting stuff. Of course, 2^80 is nothing to sneeze at....

Re:How long will IPv6 last?

[Vegemeister]

Just firewall off whatever devices shouldn't be globally reachable.

Re:How long will IPv6 last?

[vlueboy]

And anyway, IPv6 addresses are ugg-ly.

Learn DNS. You should only be looking at a IPv6 address if you are a network engineer.

Saying "only," you and many others sound pretty sure that real users NEVER see ip address in the clear, though Vista and Ubuntu show you both v4 and v6 on wireless connection status and ifconfig lines --forum users asked to post theirs for troubleshooting are not all network engineers, either. Was DNS was created not for IPv4's sake, but for some not-yet-foreseen future IPv6 tech? DNS is perfect for the disaster that is writing out an IPv6 location... It isn't as dependable as some think even in our mature, saturated, well understood IPv4 world, and thus your argument falls apart. Look closer:

Remember that less than a 10 months ago in our supposedly mature year 2010 in IPv4, we all still saw IP addresses in the browser address bar for google cache pages. Of all organizations, geeks have the most respect for them, but if Google were fueled by cash from geeks alone, it would not be #2 in Netcraft's survey of most visited sites*

That alone means that a lot of people have been seeing naked IP's in their web searches. From hundreds of millions of yearly searches, even a tiny made up number like 1% is millions of individuals using a cache and finding this weird thing in their location bar called a naked IP address. In 2010. Oh, sorry, that must mean they are all certified network engineers, no? The dns domain they are using is only 2 years old, yet google caches with this "network-engineer" IP glitch in our address-bars is probably as old as google, a domain registered 12 years ago.

Now your focus will shift to "ooh, an honest 12 year mistake", or "only network engineers ever bookmark/e-mail/tweet/link address bar links with google's highlighted search keyworks," but a nobody and a never proven wrong once show dubiousness to the reliability of your thinking. Right, you said IPv6. I'm not a network engineer, but like thousands of sixx.net's tunnel users, I need to enter long, annoying sequences of IPv4 and IPv6 naked gateway and DNS server addresses into my router or tunnel. Without being an engineer, there are websites built for me and others to enter that world with sites on "free IPv6 only pr0n." Oh, so they must have meant this pr0n to network admins only... : )

Anyway, if IPv4 blunders can last for 12 years, rest assured that our fear is that IPv6 and bad *real* network admins will be lazy, like Google's were --or much, MUCH worse because IPv6 is annoying to deal with and retraining courses are few and far between. The problem will be a pest for the next decade or more. The naked IP problems of today worseing for tomorrow will bring you lots of IPv6 links when sc/pammers start targetting the IPv6-only users thanks to the relative inconvenience of hiding somewhere in IPv6 space. Proof of concept later later becomes a reality exploited by few, then more, and then all.

* Bested only by facebook, with 500 million active users.

Re:How long will IPv6 last?

[Nursie]

Nat essentially makes the internet one-way and to get around it involves serious hacks.

Which is PERFECT for people like my mother.

Suuure, because being against seriously breaking networks is a religion...

Not everyone considers it broken.

router does this job, most modern ones already do. get a domain for your network and allocate subdomains from your router.

LOL.

Get a domain! We're not talking about my network here, I'm tech savvy enough to set up whatever I want to. That said it's not like most folk would know an IP address if it bit them on the arse so fair enough, those of us that need to do stuff probably can.

I'd dispute that 'most' modern routers have this function though, and of the ones that have had it it's worked for about 50% of attached devices.

Re:How long will IPv6 last?

[Nursie]

Having a private internal address doesn't fix those less-secure devices -- it's the device at the gateway to your home that permits or denies access.

True, but having them not even publicly routable gives me a better feeling about this than 'relying' on a firewall device. That's probably more of an emotional than factual response though.

It seems like the difference between a passive and active nuclear reactor damping system. An active one requires power and everything to be operational to intervene, a passive one requires power and operational status to stop the damping.

Re:How long will IPv6 last?

[SuricouRaven]

IPv6 auto-assigned addresses are derived from MAC address. They will always be static, unless the entire subnet is changed.

Re:How long will IPv6 last?

[SuricouRaven]

Firewalling an IPv6 network can be done statelessly. Nice and simple, and scaleable.

Re:How long will IPv6 last?

[Anonymous Coward]

Why on earth should consoles and internet-aware appliances at my folks house need a public address?

VOIP is one application, being the game host in a multiplayer game is another. Nat essentially makes the internet one-way and to get around it involves serious hacks.

And that is only with the current way we live.
Occationally I can't remember if I closed the refrigerator, turned off the lights or turned off the oven.
While it might seem execessive to have a unique IP-address for each of them it is probably cheaper to mass produce a chip that takes care of the IP-stack than to have them connected with a proprietary protocol to a central home server.
I would also like to have my alarm clock connected to the network and synchronize via NTP. (Does not really need a public address but if the NAT device does not have symmetrical translation times for uplink/downlink then that will introduce an offset.)

Re:How long will IPv6 last?

[walshy007]

Which is PERFECT for people like my mother.

So your mother likes it when random programs cannot connect to the network and do their job properly? (such as voip etc) something tells me she'll just shift the blame to the program instead of the broken use of nat.

the only attached devices that would need a domain or subdomain are servers and the like, so most people would not need to do this, this is mainly only needed for people that do networking stuff (and they usually would anyway).

Things like voip clients and game servers would not even need that, and the end user wouldn't be entering in the ip6 address either it would all be handled in the application as it is at present only that presently NAT breaks the functionality.

Unless you want to argue that people being able to click 'host game' and having their friends connect to it is not something a normal person would like to do among other things, people DO need two way communication.

Re:How long will IPv6 last?

[owendelong]

Nope... I deliberately chose one that was even beyond Peta because the scale is really much much larger. Peta wouldn't cut it. Exa is probably even short, but, I don't know what the term is for exa *10^11.

IPv4 = 4.2*10^9
IPv6 = 3.4*10^38 (or almost IPv4 * 10^29)
Exa = 10^18

So, IPv6 = IPv4 * Exa * 10 ^ 11.

Bottom line, the claim "640k ought to be enough" was based on 10x standard memory of the day.

IPv6 ought to be enough is based on 8.5 * 10^28 times the IPv4 address space, so an accurate memory comparison would be the claim:

85 brontobytes ought to be enough memory for everyone

Do you know any one who is likely to even be able to conceive of 85 brontobytes in the lifetime of anyone now living, let alone actually procure it or address it in a system?

Didn't think so.

Re:How long will IPv6 last?

[Anonymous Coward]

Last I checked, 10000 wasn't between mega and giga.

Re:How long will IPv6 last?

[Nursie]

"So your mother likes it when random programs cannot connect to the network and do their job properly? (such as voip etc) something tells me she'll just shift the blame to the program instead of the broken use of nat."

Programs?

My mother has just about worked out how to start "the google", by which she means Firefox. I am perfectly comfortable with her having one-way internet.

Unless you want to argue that people being able to click 'host game' and having their friends connect to it is not something a normal person would like to do among other things, people DO need two way communication.

Hate to point it out, but the fashion has been to remove LAN capabilities from games recently....

There are different grades of net user with different requirements, for some with no clue (make that a lot with no clue) having NAT is a godsend. A properly configured firewall could be just as well, but I bet we're going to see a lot of badly configured (or just hackable) IPv6 routers over the next few years that just let people address all the sweet, unprotected devices beyond.

Not to mention that an IPv6 router without NAT is still going to require manual opening of ports, unless you're also in favour of the massive security risk that is UPnP for router control.

Re:How long will IPv6 last?

[bruce_the_loon]

Exhibit A: You add new DHCP scopes to company A to move their machines out of the collision space, update your VLAN routers with the new subnets and shut/no shut all the switch ports. Then you port-scan the subnets, find the static hosts and fix them. What? You weren't running a dynamic network for 5000 machines? What a poor network admin you are then.

Exhibit B: Depends on your VPN product, but I can see the problem there.

Re:How long will IPv6 last?

[Xarius]

There will not be a likely shortage of IPv6 addresses in any of our lifetimes.

Unless we perfect nanotechnology and each little gizmo needs its own address ;D

Re:How long will IPv6 last?

[MrQuacker]

brontobytes sounds like something from the Flintstones.

Re:How long will IPv6 last?

[smash]

Unless they're like, 1 atom in size, we still have enough IPs.

Re:How long will IPv6 last?

[smash]

Um... excuse me....

How is 2 lines of firewall script (allow incoming for established connections, deny everything else incoming) more complicated than understanding nat translation and why various applications break because of it?

How is it simpler than explaining that your employees can't VPN in to work because they happen to run the same IP address range as your company?

How is it simpler than explaining that your employee can't VPN in from his phone because his telco gave him the same private-ip subnet as your corporate network?

Re:How long will IPv6 last?

[smash]

As opposed to "it just works" in both cases.

Re:How long will IPv6 last?

[smash]

uh... simpler = more complex. need to preview.

Re:How long will IPv6 last?

[smash]

Your mother can be protected by 2 lines of firewall script (allow incoming for established, deny all incoming otherwise). WITHOUT having the brain damage of NAT imposed for everything/everybody else.

Re:How long will IPv6 last?

[RAMMS EIN]

Using NAT as a security measure is like burning bridges.

Sure, it keeps the enemy from using the bridges to get into your city.

It also keeps friendly and useful visitors from doing so.

And your enemy will just enter your city by boat.

Re:How long will IPv6 last?

[Nursie]

Then I hope routers will come with this stuff enabled by default.

And I hope that if ISPs make any changes that require home users to do anything, anything at all, that they have a lot of budget and helpdesk staff for existing customers and their diverse array of IPv4 hardware.

TBH (other than address space filling up) NAT wasn't imposed anyway. In the UK there were a variety of enthusiast ISPs that were happy to give out multiple public IP addresses if you wanted them.

Re:How long will IPv6 last?

[WaffleMonster]

The major problem is that 'end-to-end' has become blind ideology rather than useful design methodology. As a result, people keep fighting tooth and nail against the very idea of NAT and encouraging development of applications that are tightly coupled to the underlying network.

End to end simplifies higher layer protocol development and removes unecessary infustructure dependancies. NAT requires a middle box understand the semantics and state charts associated with higher layer protocols before it can be effectivly translated. If I wanted to write a new protocol layered on top of IP ... I would be prevented from doing so because all of the NAT servers in the world would have to be updated to understand my new protocol in a many-to-one environment.

The argument mear existance of E2E somehow promotes crappy design/unecessary dependancies on lower layers is specious in my view.

Instead of pushing for IPv6, there should be an effort towards developing against a more abstract network model such that applications do not care if they are using IPv4 or IPv6 or IPv42, such that protocol translation between different network families can be implemented where necessary.

Most well written applications don't care. You are confusing IP layer protocol design with socket layer APIs and application design. (See getaddrinfo and getnameinfo) It is easy to write code today which would theoretically work without modification on a unknown future address family without much trouble at all.

Or, to answer you question, if networks globally all transition to IPv6, it will last forever because it will bring innovation in the network protocol family to a grinding halt. Even if someone came up with a truly amazing and brilliant network protocol that was provably better than IPv6, it would never get implemented in a world were every toaster oven and garage door opener is built with an IPv6 stack and, due to dead-end-to-dead-end ideology, is unable to communicate with anything but IPv6. Just look at the

How much can you really innovate around a globally unique identifier used for routing? The only question is really "how many bits" IP layer of IPv6 is sparatan and unintersting. Much more so than IPv4 was. At its core IPv6 is really just three things.. a source address, destination address and extensible option header. It would seem to me that any improvement here must be trivial.

The real magic happens by innovating protocols layered on top of IP (TCP,UDP,SCTP,ICMP..etc) where no wholesale infustructure changes are required -- only the two endpoints (E2E) need understand a protocol for it to be useful. IPv6 option header was designed to extend and improve IP without forklift changes.

transition from IPv4 to IPv6 and how long "IPv6 has been just around the corner", then imagine the inertia on migrating from IPv6

My guess it will never happen.

Re:How long will IPv6 last?

[Alioth]

The address space for network prefixes alone is 4 billion times more than the number of IP addresses available on the IPv4 internet (the basic network prefix size of a /64 - 64 bits). Given that the address is 128 bits long, each subnet alone is 4 billion times the size of the entire IPv4 internet. 128 bits makes for a very very large number.

Re:How long will IPv6 last?

[Sky Cry]

2^128 unique address. I don't think we'll be exhausting them any time soon. That's like each person on earth have access to roughly 10^38 unique address.

Yesterday we were assigning IP addresses to PCs. Today we're giving IP addresses to mobile phones too.

But in the future we'll be giving them to each and every device out there: PC, mobile phone, car, all the home appliances (refrigerator, microwave, oven, TV, DVD, Hi-Fi, every speaker, AC, garage doors, multiple smart remote controls in homes controlling everything mentioned), key chains, wireless hard drives, wireless mice/keyboards/other controllers, printers, scanners, cameras, iPads and Kindles, advertisement screens on the streets, bus stops, individual gas station fuel injectors, all the CCTV cameras (multiple per every gas station, shop, on streets, etc.), all the vehicle sensors for collecting tolls, etc.

Not only is this list not extensive, it's going to keep increasing both in device types and devices per person. Everything is going to be connected and have a unique IP address. So how long before we need a new system?

Re:How long will IPv6 last?

[Antity-H]

I don't know any human "who is likely to even be able to conceive of 85 brontobytes" , but I think I know quite a few who can conceive of someone who could: AI

Don't forget what we don't know yet is probably much more than what we do know.

I do agree that it's a good compromise until we reach the singularity.

Re:How long will IPv6 last?

[TheRaven64]

At a minimum, each home user is going to be assigned 2^48 IPv6 addresses. That's enough for your private network to be 2^16 times bigger than the current Internet - wasting addresses is not really a problem. Will this leave enough for routing? It means that the netmask will be 2^80 bits. To put that in perspective:

Imagine a network arranged like a tree. At the top level, you have as many routers as there are IPv4 addresses - roughly as many as there are Internet-connected devices now. Each of these routers controls a subnet the same size as the IPv4 address allocation, so you have a network the size of the Internet, where every node is a network the size of the Internet. Each of these leaf nodes is actually a network, connecting 65336 computers. The total number of computers on this network is the number of networks that IPv6 allows with this allocation scheme.

Or, to put it in human terms, there are currently around 6x10^9 people on the Earth. If every person had as many networks as there are people alive today (each one, 2^16 times bigger than the current Internet), then we would be using just over 0.002% of IPv6 addresses.

In fact, you want to waste addresses with IPv6, because it makes routing simpler. Every time you split an allocation into two subnets, just steal another bit for the subnet mask. An ISP would not allocate you a single IPv6 address, because it would make their routing tables horribly complicated.

As to NAT - you can do it, but there's really no point. If a node should not be globally reachable, tell your firewall to drop packets to and from it. You may want your IP addresses to remain constant when you switch ISPs, but I'm not sure why. Using DNS (or mDNS) to identify machines is more sensible. You seem to be trying to solve a problem that doesn't exist.

Re:How long will IPv6 last?

[higuita]

Exhibit A: DHCP do helps workstations, but how about print servers, servers and apps? yep, "static" is easy to fix, finding the apps that refer to the old static IPs is hell... yes, apps should use ALWAYS DNS, but some devs and admin are plain dump and breaking the service and finding this corner cases will take 90% of the time of the merge changes

Exhibit B: some VPN helps managing this NATs, but start having more VPNs and more network colisions and again you have hell managing all those NATs and endpoint addresses

NAT is a useful patch for ipv4, but the more you use it, the more problems you will have... many stupid apps (from big companies) like to include the real IP in their internal protocol, breaking all the NAT config. filtering and logging on the apps side in NAT environments is again pure evil, you can only use the router/NAT filter or higher level (like username/pass, but you lose the possibility to limit a user/pass to a certain IP)

IPV6 dont need NAT, people that want it dont really understand IPV6, they just want another easy patch to extend ipv4 so they dont have to learn something new

Re:How long will IPv6 last?

[TheRaven64]

According to Wolfram Alpha, there are enough IPv6 addresses to have one for every 1.5 square picometres of the Earth's surface. If we're talking about /64 subnets, then you can only have one per 27 square millimetres.

Re:How long will IPv6 last?

[Tim C]

it's part of the metric system, it's not an SI unit

None of those words are SI units; they are SI prefixes.

I knew what you meant though (obviously).

Re:How long will IPv6 last?

[higuita]

not having the computers connect to the network is also, totally and definitely a security advantage.

ohh, you need network? then connect and protect the damn thing...

you want to use private IPs in ipv6? fine, use the local-link IPs and enable the IPV6 NAT in the router... YES, you still have ipv6 NAT, but its almost useless in ipv6, but if you want it, fine, use it...

probably its easier and simpler to enable the stateful filtering in the ipv6 router to get the same, but hey, its your call

Re:How long will IPv6 last?

[Anonymous Coward]

But this is the same story as always, as the 640k should be enough, or I don't need a 500 gb hard disk because 160 is enough for me.

You can't predict the future, so you make estimations based on whatever technology you are using now. That's why 640 kb seemed a reasonable limit at the time, and that's why at some point, a hard disk with 20 gb seemed like reasonable. However, the truth is that the more resources you allocate, the more resources you use.

Think with a little bit of perspective. Imagine that in 100 years the evolution of nanotechnology has made a few big steps ahead. Imagine that you can have a few millions of nanobots inside your body, and imagine that each nanobot has a different IP address. That 715,925 doesn't look like a so-incredible-to-use number anymore. Of course, the idea is crazy, probably unreachable or just stupid, but that's not the point. You don't know which direction is going to take technology once IP addresses are "virtually infinite".

Re:How long will IPv6 last?

[higuita]

As for the DNS:

if you have DHCP, it should take care of this...
if you dont have it, zeroconf/bonjour/avahi or any other service discovery should take care of it, any modern OS have this, most of then enable by default

if you have neither, how would you do with ipv4? remember the IP? fine, you just have to remember the network address in ipv6, the rest is the MAC address you can check anytime or setup a static local part, like maybe (network address)::1

Re:How long will IPv6 last?

[Antity-H]

For just one second and because this is /. I thought you were proposing IP over Anonymous Coward , and started wondering how it would work ...

Re:How long will IPv6 last?

[smash]

TBH (other than address space filling up) NAT wasn't imposed anyway. In the UK there were a variety of enthusiast ISPs that were happy to give out multiple public IP addresses if you wanted them.

In the UK maybe. In the APNIC region, you're pretty restricted on what you can get. I'm not talking about a couple of IPs for a home user; if you are a corp with say, 2000 desktops, there's no way you're getting a /21 to have each and every machine with a real IP. NAT was forced...

And thus, we continue to deal with breakage with regards to joining network, VPNing from one network to another. Sure, if you want to block that, block it with ingress/egress filtering. But if you DON'T want to block it for a particular reason, NAT breaks shit in horrible ways.

THere is zero reason an ipv6 end user router couldn't ship with the above 2 line ruleset enabled. In fact, most ISPs these days offer/mandate egress filtering (blocking port 25, etc) in any case, even with ipv4.

Virtually all modern OSes ship with firewall enabled by default, unless the user turns it off. Securing your shit isn't what NAT is for, its just a side effect of breaking end to end connectivity that can far more effectively done by a simple 2 line firewall.

Re:How long will IPv6 last?

[AlterEager]

In my intranet I want each node to have a hostname so that I can reach it to access services.

This is reasonable.

For this to work I need to give each node a static IP address. So how can I do that without private addresses?

That does not follow.

Why do you need static addresses? Use dynamic DNS.

Re:How long will IPv6 last?

[TheThiefMaster]

In IPv6 every PC will automatically get a static Link-Local address (based on the static link-local prefix and its MAC) in addition to its (probably varying) public address (based on your ISP-assigned prefix and its MAC).

Re:How long will IPv6 last?

[msi]

I have always assumed that consumer IP6 routers would have a statefull firewall with default incoming deny rule and a default allow rule for outgoing, as consumer IP4 routers do now.

I would also assume that the web interface would identify each attached device by DNS if possible IP if not and have a drop down list of services to allow or deny incoming and outgoing access.

Why is this worse than NAT? It gives you all the advantages of NAT without any of the problems, or am I feeding the trolls because there seems to be a huge NAT love in ever time IP6 is mentioned here?

Re:How long will IPv6 last?

[Anonymous Coward]

For just one second and because this is /. I thought you were proposing IP over Anonymous Coward , and started wondering how it would work ...

Only with captha for every packet sent... bleah!

Re:How long will IPv6 last?

[Skapare]

In IPv6, there are 50,041,524,547,196,832,862,260,971,681 addresses for each person alive today.

While the vast majority of them can't even get a single real one of those addresses, much less the 18,446,744,073,709,551,616 of them each is supposed to get.

Re:How long will IPv6 last?

[Neil Boekend]

It appears you have no idea how fucking big these numbers are.

Assumptions:

• A human needs at least 1m^2 (cutting it ridiculous small) (just more than 9 square feet)
• In the future we will also cover the oceans
• The Drake equation is correct
• Earth is in the middle (size wise) of the scale of habitable planets
• Our galaxy is average

3.4028236692093846346337460743177e+38 adreses
148,940,000 square kilometer = 148,940,000,000,000 square meters.
Thus we will need about 2.28e24 earth sized planets.
A modified version of the Dake equation states the galaxy houses about R*fp*ne*(the period life can be sustained) = 7*0.5*2*1,000,000,000 = 7000000000 planets that are habitable.
Thus we need about 3.26e14 galaxies to house the people.
The observable universe currently holds about 80 billion galaxies. We would need about 4000 times as many galaxies as there are in the observable universe to hold the people.
Since space expands faster than the speed of light at these distances we will lose galaxies instead of gain them in our observable universe. So time doesn't really help.

Re:How long will IPv6 last?

[pedestrian crossing]

Your mother can be protected by 2 lines of firewall script (allow incoming for established, deny all incoming otherwise).

You keep repeating that, but that firewall script will be running on what? Her XP machine? Her $30 switch? An extra, dedicated linux/xBSD box?

Re:How long will IPv6 last?

[Anonymous Coward]

2^128 unique address. I don't think we'll be exhausting them any time soon. That's like each person on earth have access to roughly 10^38 unique address.

Just like everything before, everyone will think it's enough...then someone will say: "hey, we've got so many addresses, we can assign it to EACH product ever made and will ever be made...like a universal, online barcode"

There you have it. Every product that will ever be made will have an IP address and some sort of wifi-tag. Our shirts will alert our washing machine that it is time to get washed. My shoes will remind my car that they are dirty after walking in the mud, so put down the all-weather mats.

Then, in 100 years, after 100,000,000 boxes of Internet-enabled Kraft Dinner (how else will it cook itself, huh?), IPv6 will be exhausted.

We WILL find a way to waste all these addresses. Who knows, maybe the government will put into law something about only using one IPv6 address for a period of one-month lease, in order to historically track (in an easy-to-use central database) everything and everywhere we have been online (and where our Kraft Dinner has been too). Sounds dumb? Of course. That's what makes it plausible.

Anyway, I'm off to search for a post-it note I wrote a while back, if only it had an IP address so I could ping it to make sure it's still active.

Re:How long will IPv6 last?

[Anonymous Coward]

I hereby nominate the Almond M&M as the standard unit of measure for Internet address comparative visualization.

Re:How long will IPv6 last?

[walshy007]

Voip- only true if you are hosting the VOIP server itself (violation of a residential subscriber agreement). Any decent voip service will establish a connection to the public server when it is ready to accept inbound calls, thus you have an already open connection and it works through NAT 100% seamlessly.

Even with public servers NAT still throws a spanner in the works for sip unless the client goes through a whole heap of hacks to get around the nat. Sip nat traversal can be a pain in the ass but it is getting better (slightly).

The point of the parent was that people like you keep saying shit like this but you can't ever give any kind of reasonable example. Put up or shut up.

I just gave one.

Ya, that works great, IF you know what you're doing. Show me a router that will pay for and register a domain name for you, and whenever you switch internet providers will automatically reduce your DNS entry's TTL record and register your new scope from your new provider.

Only people who know what they are doing will need that anyway, those that don't will simply let programs handle all the connection business by having a central server tell them the ip of the person they are connecting to etc, like how sip works now and how central servers work for games like q3a.

If you have honestly never run into problems with nat, you really haven't done much at all with networking.

And finally, I'd just like to mention that all of the arguments you've presented against NAT would also apply to any kind of firewall or load-balancing mechanisms.

Firewall rules can be fixed to your needs, NAT is not so flexible.

Re:How long will IPv6 last?

[Aqualung812]

The need for NAT comes from the demand for it. It's not going to magically go away.

That is one of the dumbest things I've heard. The need for something is solely based on the demand for it? Then what is the demand based on? The need, which is based on the demand? It is turtles all the way down!

You're trying to say there is a legitimate reason for NAT, and I'm asking you to produce one good reason. Your only reason is "I want it".

Re:How long will IPv6 last?

[Aqualung812]

Really though... what gives you any more right to insist on taking NAT away from people who want it than they have to force it on people who don't?

Because I have to fix the crap that NAT breaks. If you are a network admin at one company, and I'm a network at another, I'm going to have to deal with the stupidity of your decisions when our companies have to talk to each other.

Re:How long will IPv6 last?

[marka63]

Your mother can be protected by 2 lines of firewall script (allow incoming for established, deny all incoming otherwise).

You keep repeating that, but that firewall script will be running on what? Her XP machine? Her $30 switch? An extra, dedicated linux/xBSD box?

In exactly the same place as the NAT box would have been.

Re:How long will IPv6 last?

[Anonymous Coward]

By the time we can do that we'll probably have figured out how to sustain 10x the current world population per planet. I'm not sure 72,000 addresses is enough for me.

Re:How long will IPv6 last?

[pedestrian crossing]

Reading comprehension fail! I didn't ask where, I asked what.
What is this two-line script going to be running on? An extra computer that must either always be running or booted every time mom wants to use the Internet? Or is her little $30 NAT box magically going to become scriptable?

Re:How long will IPv6 last?

[segedunum]

You should refrain from lumping the rest of the world in to your little delusions, the rest of the internet that actually works in networking, do not in fact, share your paranoid view of "OMG PEOPLE SEE MY IPS! THEY CAN HACK ME!" and are actually quite comfortable in the significant distinction between stateful fire-walling and IP masquerading / Network Address Translation.

No, they're not and the fact that you think you can create a nice little safe scenario where the majority will feel comfortable just shows how deluded the "Move everything to IPv6" brigade is.

Re:How long will IPv6 last?

[Builder]

There are only 3 ranges of IP addresses reserved for private use. That doesn't stop MANY companies just picking address ranges outside of that and using them. There are very few places that they won't be able to connect to as a result, but it's important to note that you can NAT any range you want.

Re:How long will IPv6 last?

[segedunum]

1. Deny all default inbound rule on the firewall. Done. Same level of security as NAT.

This has got nothing to do with the security of firewalls. You're misunderstanding this, perhaps deliberately, if you think that it is.

Re:How long will IPv6 last?

[Bookwyrm]

End to end simplifies higher layer protocol development and removes unecessary infustructure dependancies.

That is a mind-boggling statement. If that was truly the case, then there would not be any problem with moving from IPv4 to IPv6 because the higher level protocols (i.e. applications) would not have to be rewritten to handle them.

NAT requires a middle box understand the semantics and state charts associated with higher layer protocols before it can be effectivly translated.

That is *precisely* the problem. If there was actual separation between the network layer and the higher level protocols as you claimed E2E provides, then the NAT middle box would not have to care about higher level protocols.

If I wanted to write a new protocol layered on top of IP ... I would be prevented from doing so because all of the NAT servers in the world would have to be updated to understand my new protocol in a many-to-one environment.

...? I think you miss the point. You should not have to care about layering 'on IP'. If E2E really removed 'unnecessary infrastructure dependencies', you wouldn't care that it had to be on IP.

The argument mear existance of E2E somehow promotes crappy design/unecessary dependancies on lower layers is specious in my view.

It's not the 'mere' existence, it's the fact it's become ideology. It's like people have chosen to populate their toolboxes with only a hammer, so that now everything looks like a nail.

Most well written applications don't care. You are confusing IP layer protocol design with socket layer APIs and application design. (See getaddrinfo and getnameinfo) It is easy to write code today which would theoretically work without modification on a unknown future address family without much trouble at all.

No, lazy programmers are writing applications dependent on IP layer protocol because the E2E mindset lets them get away with making bad design assumptions and not actually writing programs in a protocol independent way. Also, for server-side sockets, right now I believe software that used to only open one socket to listen for IPv4 connections must now open two -- one for IPv4, and one for IPv6. This is not a scalable protocol independent API.

How much can you really innovate around a globally unique identifier used for routing? The only question is really "how many bits" IP layer of IPv6 is sparatan and unintersting. Much more so than IPv4 was. At its core IPv6 is really just three things.. a source address, destination address and extensible option header. It would seem to me that any improvement here must be trivial.

And no one will ever need more than 640K of RAM.

The real magic happens by innovating protocols layered on top of IP (TCP,UDP,SCTP,ICMP..etc) where no wholesale infustructure changes are required -- only the two endpoints (E2E) need understand a protocol for it to be useful. IPv6 option header was designed to extend and improve IP without forklift changes.

*laughs*

So, IPv6 is *perfect*? It will never ever need to be replaced? In a hundred years, it will still be good? Two hundred? Five hundred? A thousand?

Wow. After a bare handful of decades of the Internet, and people have already reached perfection in network protocol design! The holy IPv6 has be given unto us to last forever and ever, amen.

Sorry, I don't buy it.

My guess it will never happen.

Sad, isn't it?

Re:How long will IPv6 last?

[Conspiracy_Of_Doves]

IPv6 has enough address space to give a unique IP address to every particle in the universe.

Re:How long will IPv6 last?

[Anonymous Coward]

Lets hope the ISPs follow the advice of assigning a /48 to each customer not a /64.

Re:How long will IPv6 last?

[eth1]

Contrast that with the number of IPv6 /64 prefixes (a bit more than 18 quintillion) which
would provide enough M&Ms to fill all of the great lakes.

Actually, with IPv6, you're only three orders of magnitude short of being able to give each water molecule in the great lakes it's own IPv6 address. (10^38 vs 10^41). IPv4 is 32 orders of magnitude short. The amount of water addressable by IPv4 would be invisibly small.

Re:How long will IPv6 last?

[owendelong]

I disagree. I was easily able to obtain 1,208,925,819,614,629,174,706,176 of them and so can anyone else from various internet tunnelbrokers* or from several other sources.

*Full disclosure: I work for the company that provides the largest tunnel broker, but since it is a free service and I have not named the particular tunnelbroker, hopefully this is not regarded as a promotional message. It is intended as informative only.

Re:How long will IPv6 last?

[Abcd1234]

So, how is a /48 required for your house?

How is it not? Last I checked, subnets were a good thing. Hell, I have two subnets on my v6 network at home right now, one for my guest wireless pool and one for my internal LAN. This would be impossible if I only got a /64 (fortunately Hurricane gives out /48's).

Re:How long will IPv6 last?

[Anonymous Coward]

Maybe he wants to run an Oracle setup or any (call it legacy if you want) server app that requires a static IP.

Re:How long will IPv6 last?

[Anonymous Coward]

If you want subnets in subnets like IPv4 without NAT, I'm not sure that's possible; it makes sense to me to be able to split the /64 into /68 that only the internal routers understand but the spec probably doesn't allow it. In this case, you'd probably just do what we do now — pay your ISP extra to get your /64 upgraded to /60 or /56.

Re:How long will IPv6 last?

[mark-t]

Configuring a firewall, even though it's very simple to do, requires more technical skill than just plugging an appliance into the wall.

Now granted, a UI could well be designed into IPv6 routers that hides all of that from the user... so the only thing they need to worry about when connecting is whether or not the device is supposed to be globally visible, and the home router adds the firewall rules appropriately. But designing that software with that UI still requires somebody to write it. NAT is a solution that works today.

The only real argument against using NAT is that it breaks some protocols... and I don't refute that point, but those exact same protocols would be broken by a firewall that rejects incoming packets for a particular computer anyways, so what's the difference?

Re:How long will IPv6 last?

[mark-t]

And how is it that firewalling devices as you describe does not break anything more than NAT would? Because you can pick and choose which devices to firewall? Could you not equally easily simply pick which devices should be NAT'ted?

Re:How long will IPv6 last?

[Anonymous Coward]

Funny you should mention that. I'm in the process of swapping out my aging PIX hardware for the new hotness ASA's. It's going to be a bit yet before I'm through the book for them. I'll keep my eyes open! Thank you for the tip.

Re:How long will IPv6 last?

[jthill]

For comparison, the mass of the earth is 5.9e24 kg. So that's about one IPv6 address for every five nanograms of mass on the entire planet.

Re:How long will IPv6 last?

[TheTrueScotsman]

Why can't your visitors also enter by boat?

Re:How long will IPv6 last?

[TheTrueScotsman]

Why can't you write 255::1? The argument (by the OP) about hex being easier to convert to binary than decimal is lame. It may be harder for his 11-year old sister...

Re:How long will IPv6 last?

[im_thatoneguy]

Another way to think about it is that there is one Library of Congress. In order to have one IPv6 address for each Library of Congress you would need (2^48-1) more Library of Congresses.

Re:How long will IPv6 last?

[mark-t]

You only have to fix the crap that NAT breaks when it is used on devices that use the protocols that NAT breaks. Not all devices require the use of such protocols. Also, the existence of NAT is not a sufficient condition such that it will always going to be used on devices where NAT would break a protocol. NAT is not the problem, using it where it breaks things is. And believe it or not, there are far more things that NAT doesn't break than things that it does... it just so happens that the stuff that NAT does break is really really useful, and is what makes NAT undesirable on any general purpose computing platform.

Re:How long will IPv6 last?

[syzler]

I am confused. Your point seems to be that variable length addresses do not incur a performance hit. You say that Tony provided pseudo-code which demonstrated "variable length" was not a problem. However you ask us to look it up ourselves while linking to an article which describes Tony's work history (which does not reference variable length addresses).

The grandparent was commenting on address length and the last lines of your comment purportedly to support your view provides an example based on frame size. Do you realize that address length and frame size are not the same and they really cannot be compared when talking about routing performance? Maybe if you said the size of the address parameter in the header and the size of the frame_size parameter in the header it would be more comparable, but then it would be obvious that it does not provide a meaningful example since both the address parameter and frame_size parameter are fixed length variables.

So are you talking about variable length addresses or variable frame sizes?

If the first, can you provide an example? If the second, how is it related to the GP's post?

Re:How long will IPv6 last?

[Chuck_McDevitt]

A single IPv6 subnet has room for every network interface ever built, or will be built in the next decade. And that's only ONE /64 subnet.

Re:How long will IPv6 last?

[WaffleMonster]

That is a mind-boggling statement. If that was truly the case, then there would not be any problem with moving from IPv4 to IPv6 because the higher level protocols (i.e. applications) would not have to be rewritten to handle them

What does making a statement about end-2-end being a good idea have to do with the effort involved in switching address families? Most issues are related to storage and manipulation of address family specific data (sometimes in ASICs) rather than logical layering issues related to bits contained within an actual wire format. At some point you need to enter an IP to connect somewhere.. protocol agility at the application layer was not something people spent much time thinking about.

That is *precisely* the problem. If there was actual separation between the network layer and the higher level protocols as you claimed E2E provides, then the NAT middle box would not have to care about higher level protocols.

??? Suppose I'm a one-sided UDP packet and I want to be delivered to a certain user at a certain address how do you propose that I get there if there is a many-one NAT in my way and the NAT knows nothing about me, my purpose or even what my final destination should be? Should I embed next hop routing data in the IP header? (Please say no) How do you resolve this without end to end?

If I can't send a single sided message to a destination...the issue isn't IP it is whatever is standing in the way. This has nothing to do with higher layer protocols. Support of NAT actually creates more layering inversions than there otherwise would be.

No, lazy programmers are writing applications dependent on IP layer protocol because the E2E mindset lets them get away with making bad design assumptions and not actually writing programs in a protocol independent way. Also, for server-side sockets, right now I believe software that used to only open one socket to listen for IPv4 connections must now open two -- one for IPv4, and one for IPv6. This is not a scalable protocol independent API

This is just a restatement of your previous argument. I wrote several applications which were IPv4 only. At the time IPv4 was the only game in town. Now all of my applications work with both protocols and you know what there is now LESS total socket code, lower complexity and everyone is better for it. WRT two separate sockets it's called a dualstack socket. You do NOT need to listen separatly.

And no one will ever need more than 640K of RAM

It is easy to take this argument to absurdity showing others before you were wrong so by extension all statements about practical limits must be wrong regardless of the merits of the specific situation. IPv4 was at no point intended to provide network services to billions of people. I didn't even specify a number of bits. All I said was that the header does virtually nothing and is therefore uninteresting. There are only ~2^32 /32's you can hand out.

Given current announced allocation policy when there are roughly 4 billion ISPs connected to the global Internet there will be an address shortage. Unlike IPv4 if we ever get close to seeing this day there are options to address it without renumbering. These are the facts - feel free to interpret them as you wish.

*laughs*

So, IPv6 is *perfect*? It will never ever need to be replaced? In a hundred years, it will still be good? Two hundred? Five hundred? A thousand?

Wow. After a bare handful of decades of the Internet, and people have already reached perfection in network protocol design! The holy IPv6 has be given unto us to last forever and ever, amen.

Sorry, I don't buy it

**NO** you did not read what I said. I ONLY made the point IPv6 header does nothing more than a postal envelope. It is both uninteresting and extensible and therefore wholesale replacement is unlikely to ever be nece

Re:How long will IPv6 last?

[Bookwyrm]

What does making a statement about end-2-end being a good idea have to do with the effort involved in switching address families? Most issues are related to storage and manipulation of address family specific data (sometimes in ASICs) rather than logical layering issues related to bits contained within an actual wire format. At some point you need to enter an IP to connect somewhere.. protocol agility at the application layer was not something people spent much time thinking about.

Argh. Why do you keep coming back to "you need to enter an IP"? You're not getting the point. The point is you should never *NEED* to enter an *IP Address*.

??? Suppose I'm a one-sided UDP packet and I want to be delivered to a certain user at a certain address how do you propose that I get there if there is a many-one NAT in my way and the NAT knows nothing about me, my purpose or even what my final destination should be? Should I embed next hop routing data in the IP header? (Please say no) How do you resolve this without end to end?

If I can't send a single sided message to a destination...the issue isn't IP it is whatever is standing in the way. This has nothing to do with higher layer protocols. Support of NAT actually creates more layering inversions than there otherwise would be.

You're still stuck in IP-land. You're stuck in UDP packets and IP addresses. Just imagine, maybe, a network which did not use UDP and IP packets.

It's like talking to someone who only ever uses Microsoft products, and expects everyone else to use Microsoft products end-to-end -- they only think in .doc extensions.

It is easy to take this argument to absurdity showing others before you were wrong so by extension all statements about practical limits must be wrong regardless of the merits of the specific situation. IPv4 was at no point intended to provide network services to billions of people. I didn't even specify a number of bits. All I said was that the header does virtually nothing and is therefore uninteresting. There are only ~2^32 /32's you can hand out.

Given current announced allocation policy when there are roughly 4 billion ISPs connected to the global Internet there will be an address shortage. Unlike IPv4 if we ever get close to seeing this day there are options to address it without renumbering. These are the facts - feel free to interpret them as you wish.

Sigh. You're still stuck in IP-only land. It's NOT about address exhaustion. It's about, maybe, someone, someday, invents something *better* than IPv6, but is not compatible with IPv6.

I guarantee nothing. I do not assert IPv6 will be the last Internet protocol the world will ever see.

And this is why I laugh.

If there is the potential for something *better* than IPv6, then we should be working on making sure that it is easy to transition to that. We should not be painting ourselves into a dead-end-to-dead-end corner.

This is why the E2E mindset fails. If the possibility for something beyond IPv6 exists, then how exactly do we transition to the future without a wholesale replacement of IPv6 software/hardware if we insist on E2E? Otherwise, if one wants to claim the use of protocol translation devices to ease the transition, that violates E2E.

Re:How long will IPv6 last?

[SleazyRidr]

Exactly. I can imagine in maybe 10-20 years time people looking back on discussions like this and thinking how naive we were that we thought we had enough addresses.

Re:How long will IPv6 last?

[Drishmung]

I am confused. Your point seems to be that variable length addresses do not incur a performance hit. You say that Tony provided pseudo-code which demonstrated "variable length" was not a problem. However you ask us to look it up ourselves while linking to an article which describes Tony's work history (which does not reference variable length addresses).

That's right. There is a lot of stuff there. The 'info.big-internet' reference shows both sides of a long debate about what eventually became IPv6.

The grandparent was commenting on address length and the last lines of your comment purportedly to support your view provides an example based on frame size. Do you realize that address length and frame size are not the same and they really cannot be compared when talking about routing performance? Maybe if you said the size of the address parameter in the header and the size of the frame_size parameter in the header it would be more comparable, but then it would be obvious that it does not provide a meaningful example since both the address parameter and frame_size parameter are fixed length variables.

So are you talking about variable length addresses or variable frame sizes?

Yes. Both. In the general sense that fixed length (addresses/frame sizes) 'must' be more efficient. It was 'obvious' at the time that fixed length ATM cells must be easier and more efficient to implement in hardware. In fact (and I am well aware of all the other reasons that led to ATM's fall and Ethernet's ascent) ATM was not significantly easier to do in hardware. I offered ATM vs Ethernet since that's something most people are at least superficially aware of.

In fact, Tony Li's (and others') proposal for variable length addressing was ultimately ignored, and we ended up with the current 128 bit format.

One of the places where Tony demonstrated the sort of code that router manufacturers actually write was in this posting. It's part of a long and technical thread. If you are interested you'll have to read to get context.

Re:How long will IPv6 last?

[operagost]

I don't think you realize how big a number 10^38 really is. You could allocate one address for every MOLECULE of every item a person owns and not exhaust them.

Re:How long will IPv6 last?

[Abcd1234]

Configuring a firewall, even though it's very simple to do, requires more technical skill than just plugging an appliance into the wall.

Umm... firewalls *are* appliances.

NAT > Firewall

If you can plug in a NAT, you can plug in a firewall just the same.

The only real argument against using NAT is that it breaks some protocols... and I don't refute that point, but those exact same protocols would be broken by a firewall that rejects incoming packets for a particular computer anyways, so what's the difference?

The difference is, if you have transparent, end-to-end connectivity, it's a *hell* of a lot easier to build a nice, user-friendly firewalling product that doesn't require machinations to get peer-to-peer protocols to work properly. You simply turn on/off ports/protocols, and you'd done. No UPnP bullshit. No port forward crap. It Just Works.

Couple that with a nice user-interface that presents you with things like "Enable Bittorrent" or "Enable SIP", and you have a device anyone can use, without needing to understand the details of how NAT might break things.

Re:How long will IPv6 last?

[TheRaven64]

Nonsense. An IPv6 firewall could be configured to, out of the box, allow all outbound and block all inbound connections. This would be exactly the same, in the default case, as NAT, only slightly more secure (some rebinding attacks that work on NAT would not work). You'd need to explicitly open ports, but you need to do that with NAT anyway and there are already simple interfaces in all consumer routers for doing it (and it would be easier with a simple firewall, because you'd just be opening ports, not forwarding them). NAT gives you nothing of value.

Re:How long will IPv6 last?

[marka63]

Well if she has IPv6 then she will have replaced the $30 NAT with a box which supports IPv6 and includes a firewall. Or if she is lucky the manufacture will provide a IPv6 capable image which can be flashed on to it assuming there is enough flash space.

Her existing NAT effectively has a firewall that munges address, ports and packet contents so manufactures can build a firewall at this price point. The main price constraint is the amount of flash and ram in the box as the extra capabilities do take more of these.

We should have had a box which does the traditional IPv4 + NAT44 + DHCPv4 and also does IPv6 + IPv6 firewall with equivalent functionality + DHCPv6 including prefix discover + 6to4 at this price point years ago. The only reason I can see why we don't is ISPs not offering IPv6 until very recently so there hasn't been the volumes of sales available to get it down to this price point. That will change soon. Newer CPE boxes should include things like B4 (see DS-lite) and 6rd.

Re:How long will IPv6 last?

[mark-t]

NAT gives you nothing of value.

Other than IP's that might have been usable on a device which actually could utilize a globally visible IP. And considering the fact that we are going to run out of IPv6 addresses by about 2200 if we continue to allocate them as wastefully as what has been proposed so far, and are going to be forced to try to reclaim significant amounts of unused ranges in roughly a hundred years or so, I'd say that those IP's do have some value. There may be plenty of them today... but probably not so many at the next turn of the century, simply owing to exponential population growth and growing use and dependence upon the technology.

Re:How long will IPv6 last?

[mark-t]

The difference is, if you have transparent, end-to-end connectivity, it's a *hell* of a lot easier to build a nice, user-friendly firewalling product that doesn't require machinations to get peer-to-peer protocols to work properly.

Or... you just don't worry about it. I'm not suggesting that you support them... I'm just suggesting that you don't exclude them from being able to use the Internet at all when there are plenty of applications that can still benefit from a 1-way connection. People behind who would put general purpose PC's behind NAT's simply wouldn't be able to use such protocols, and they will suffer for that choice if they make it. Meanwhile, appliances that don't need 2-way connectivity could be NAT'ted... and all of them would never be seen as anything just a single IP to the outside world. In the end, the one thing that NAT gives you which firewalls don't is that NAT's free up IP's.... which, given how wasteful IPv6 addresses are being proposed to be allocated, I anticipate is going to be an even bigger issue than the migration to IPv6 itself is right now sometime before the next turn of the century.

Re:How long will IPv6 last?

[greylion3]

At a minimum, each home user is going to be assigned 2^48 IPv6 addresses.

Where do you see that? I thought the smallest possible allocation was a /64 (and the largest a /48)?

Re:How long will IPv6 last?

[skudenfaugen]

Doesn't matter. I want IPv6-NAT... And anyway, IPv6 addresses are ugg-ly.

Hell, maybe the whole IPv6 thing should be thrown out and something else designed, that is more compatible with the existing IPv4 network.

It can't be any worse than deailing with and subsiquentally memorizing different activation key codes. I'm not proud that I can spit out the keys for my Win2000, WinXP, Office2k3, and Win7 volume licenses; but I know that I wont have any problem with IPv6 addresses because I can do this.

Re:How long will IPv6 last?

[Bengie]

"[...]Run out of IPv6 addresses by about 2200[...]"

IPv6 has enough IPs for 30,000 per square inch of the earth surface. How, pray tell, do you think the human race will accomplish this feat? Managing 30,000 computers on every square inch over the entire surface of the earth would make for quite the data center.

Re:How long will IPv6 last?

[Bengie]

Several of my FPS/RTS games require incoming ports to work. Luckily uPNP works with these games as I can't forward the same port to several computers, so each computer has to negotiate a new uPNP port to forward in order to get connections if I want more than one person playing at my home. I'm talking about major game releases to.

NAT is full of fail and holding on to NAT is about as stubborn and idiotic as when people were complaining about moving to 32bit OSes. Like, OMG.. 32bit flat memory is so much harder than 16bit real mode because I'm not used to it. QQ

Re:How long will IPv6 last?

[Junta]

A great number of local scope standards are explicitly designed for /64 and could break if violating the less than /64 rule.

Most blatant/basic example is the concatenation of advertised routing prefixes and EUI-64 for stateless addressing.

Re:How long will IPv6 last?

[Nzimmer911]

Working at Best Buy does not qualify you as a "network technician". If you do not fall into CyprusBlue's categorization of people that feel comfortable while sitting behind a stateful firewall product then you should pursue a new line of work. I bet that it's is relatively "safe" selling microwaves over in the appliance section. Oh wait...they have ip addresses you can be scared of exposing too! Oh Noes! The Big Bad Internets Are Going to Haxor My Microwaves!! /puts on tin hat

Re:How long will IPv6 last?

[Junta]

Well, not always the mac address, stateless addressing without privacy will generally do that, but you can still arbitrarily manage your host portion as you wish like you do with ipv4 today.

Re:How long will IPv6 last?

[mark-t]

IPv6 has enough IPs for 30,000 per square inch of the earth surface

If they were allocated on a basis where there was actual need, yes... but that's not what's happening... the allocation is sloppy and wasteful, just like IPv4 was in the beginning, only several orders of magnitude worse.

As I said... there was once a time when they thought that the Atlantic salmon supply was inexhaustible as well... and that's a population that replenishes itself! IP addresses are finite resource from the start.... owing to an exponential population rise and rate of technology adoption, I don't see 128 bits lasting longer than maybe 3 or 4 times what IPv4 has, unless we are actually somewhat prudent in how we allocate them. As time goes on and the supply starts to deplete, people will get smaller and smaller blocks, and NAT will start becoming increasingly practical.

Re:How long will IPv6 last?

[smash]

You fail at understanding concepts. The script was an example from cisco IOS. Any home user DSL router can handle simple firewalling these days if you turn nat OFF. I posted a few lines because it is straightforward and it illustrates the concept. You would rather i post screenshots for each and every shitty little home user router's GUI?

Re:How long will IPv6 last?

[smash]

Because they do not mangle packets. If your packet is allowed - it passes through unmolested and in-tact.

You may want to read up on what NAT actually does to your IP packets (essentially mangling them by rewriting the IP addresses embedded into the packet). NAT breaks UDP without horrible hacks to maybe get ONE machine working behind your NAT box for anything that speaks UDP.

A firewall for real IP addresses (be it IPv6 or IPv4) does not mangle the packets. The source and destination IP is left in tact. Thus, if you want to (for example) allow UDP in through your firewall, the destination machine specified in the packet matches where the packet should actually end up.

NAT also breaks IPSEC without buggering around with NAT traversal (Nat mangles the packet, thus invalidating it when it is checked for integrity at the remote end). The work around (NAT-T) is less secure than proper IPSEC. Yes, NAT, which some tout as being good for security, WEAKENS IPSEC. It also weakens the security/breaks SIP.

As to picking what devices should be NATed - if you have real IPs, the entire need for NAT goes away. If you have real IPs, don't use NAT, simply block all incoming connections and you're done. You've got the same security without the packet mangling that makes apps harder to write and less secure.

NAT is evil. Yes, that is the extent of what some people write - but there are real, valid reasons for it. The "advantages" of NAT aren't really there, but there are plenty of drawbacks.

Re:How long will IPv6 last?

[Skapare]

I intentionally used the word "real" to exclude tunnel brokers. Unless they can use that IPv6 address outside the context of a tunnel, then it isn't real.

Re:How long will IPv6 last?

[owendelong]

I did not get my addresses from a tunnel broker. I got mine from ARIN. I can use them outside of a tunnel, just as my IPv4 addresses. However, there is not a cost-effective non-tunnel way to get BGP based IP transit services into a house, so, my IPv4 and IPv6 BGP sessions are handled over GRE tunnels.

If you sign up for IPv6 service with an ISP you should be able to get at least a /48 from the ISP. If you are multihomed, you should easily be able to get at least a /48 from your local Regional Internet Registry.

There are many options for obtaining IPv6 addresses today. There will be more in the near future.

Re:How long will IPv6 last?

[Nursie]

"Luckily uPNP works with these games as I can't forward the same port to several computers, so each computer has to negotiate a new uPNP port to forward in order to get connections"

NAT is full of fail

NAT is full of fail, but you allow software on potentially compromised machines (you run windows, right?) to decide what ports to open on your router?

Methinks it is you that is full of fail.....

Re:How long will IPv6 last?

[Nursie]

"Securing your shit isn't what NAT is for, its just a side effect of breaking end to end connectivity that can far more effectively done by a simple 2 line firewall."

Except that the firewall breaks it just as badly, you still don't get two clients talking directly to each other because for most normal human beings the router is a black box not to be messed with, so they'll still have everything denied. And if you try to open ports for them you have a security risk, and if you have UPnP you have another security risk.

IPv6 and the removal of NAT does absolutely nothing for these users, with the potential to actually make things a lot worse.

Re:How long will IPv6 last?

[Nursie]

Just out of interest, how is having a default-deny inbound firewall (with no exceptions configured) different from a NAT situation for SIP?

Opening listening ports on machines on folks' home networks is still going to be problematic. You have a few options -

1. People open ports manually (bad, relies on end users to input a bunch of numbers)
2. Software opens ports automatically via UPnP (security risk)
3. Routers pre-configured to let through some common ports (security risk)
4. Routers ship 'open' (security risk)

Re:How long will IPv6 last?

[ptudor]

yes! NAT is evil.

Re:How long will IPv6 last?

[Abcd1234]

Or... you just don't worry about it. I'm not suggesting that you support them... I'm just suggesting that you don't exclude them from being able to use the Internet at all when there are plenty of applications that can still benefit from a 1-way connection.

So then bury them behind a one-way firewall.

Why the hell do you believe NAT is required to make that possible?

which, given how wasteful IPv6 addresses are being proposed to be allocated, I anticipate is going to be an even bigger issue than the migration to IPv6 itself is right now sometime before the next turn of the century.

You really have absolutely no fucking idea how *huge* the IPv6 address space is, do you? Here, let's try to put this in perspective:

1. An IPv6 subnet is 80 bits (a /48). This is 1,208,925,819,614,629,174,706,176 addresses. In *one* subnet.
2. That means there are 48 bits worth of subnets. That's 281,474,976,710,656 individual subnets.
3. There are, say, 8 billion, or 2^33 people on the planet.
4. That means everyone on the planet can have *a whole subnet*, and there would still be 281,466,386,776,064 subnets left over.

Of course, this isn't the whole story... yeah, there's some addresses that, like in v4, are reserved, etc. But even with that, the available space for assignment to devices is beyond imagining.

In short, if you *really* think IPv6 is gonna experience address shortages before our species wipes itself out, frankly, you're completely delusional.

Re:How long will IPv6 last?

[walshy007]

Just out of interest, how is having a default-deny inbound firewall (with no exceptions configured) different from a NAT situation for SIP?

You can icmp echo request them to see if they are up? but but the main advantage is that you CAN allow certain ports through, and unlike NAT every host can use it instead of just one single host being port forwarded.

If I am hosting a quake server on default ports, I can only have one server on the port with nat, with a unique publically addressable IP each of my servers can run default ports with ipv6.

1. People open ports manually (bad, relies on end users to input a bunch of numbers)

Depends on the context, if you have a network admin this is fine, for home use it is not recommended, one situation does not fit all.

That said port forwarding is stupid, if the network admin is opening ports it would be on the firewall, not port forwarding.

2. Software opens ports automatically via UPnP (security risk)

Port forwarding to get around the braindeath that is NAT is pointless, and so is this option.

3. Routers pre-configured to let through some common ports (security risk)

Doing this is silly, unless you are very aware of the users needs you will never accurately predict what they want.,/p>

4. Routers ship 'open' (security risk)

Better to ship open and rely on the os' stateful firewall than to by default kill functionality for everyone on the network.

The software itself can reject connections from IP addresses outside of the local subnet if it wishes to not be present on the internet (most software of this nature does already).

Unless you are running some very horribly insecure software it is the best option according to many.

Essentially your choices are,

1. get someone who knows what they are doing and your needs to set up a firewall.

2. Break the two-way internet for everyone and only allow outgoing connections for everything (stupid).

3. Leave the network open even for noobs. All their software will function and they will only be at risk if they run software that both accepts connections outside the local subnet and it has sufficient security flaws.

Of course having a proper admins is ideal, but failing that, leaving it open really isn't so bad compared to breaking the internet for anyone who doesn't merely want to be a consumer (and even some consumer uses)

Re:How long will IPv6 last?

[pedestrian crossing]

Yes, there's the rub. Transition to IPv6 will require ISPs to deploy new boxes (or new images) to all customers. Also, the typical customer (think mom) is going to use whatever defaults the ISP provides, which may or may not be a good FW setup. This scale of roll-out a pretty big (read: costly) problem in the real world. The inertia is going to be difficult to overcome. What we "should have had" is far from what we do have.

Re:How long will IPv6 last?

[ptudor]

NAT is a historical artifact. That a PIX could NAT anything before RFC1918 existed matters in the same classroom where people learn about Classful routing before CIDR. It is more important to note we should already have native IPv6 from carriers. And Slashdot.

I mean, people, hire me and smash and the other under-modded smart people, we'll teach a class Friday, configure your routers on Saturday, check out the hosts on Sunday, and take the phone calls on Monday. This isn't rocket science (except for HSRPv2, so let's all use GLBP instead). Mainly you'll notice... IPv4 still works like it did on Friday. But all your google traffic, software downloads, and dns... IPv6 in the logs now.

conf t
ipv6 unicast-routing
int vlan 666
ipv6 addr 2001:db8:db8:666::1/64
ipv6 router ospf 65066
network 2001:db8:db8::/48

Some devices need:
sdm prefer dual def
wr me
reload

Sooooo haaarrrrrrrdddd omgosh.

Re:How long will IPv6 last?

[Nursie]

"That said port forwarding is stupid, if the network admin is opening ports it would be on the firewall, not port forwarding.

I don't really see the difference except in the situation where multiple machines on the network wish to run the same service on the same port. Otherwise, from my perspective as a user, it's identical.

Port forwarding to get around the braindeath that is NAT is pointless, and so is this option.[UPnP]

Right, so manual port opening is out because it's bad for home users, and so is auto port opening using UPnP because it's pointless... ?
I wouldn't call it pointless, just insecure in that it allows and compromised machine inside the network to bypass security.

"Of course having a proper admins is ideal, but failing that, leaving it open really isn't so bad compared to breaking the internet for anyone who doesn't merely want to be a consumer (and even some consumer uses)"

Leaving it open and machines, televisions, mobile phones, consoles, NAS boxes and a million and one other things that are marketed to consumers, open on the public internet by default, is a horrible, horrible option. Having NAT (or a default deny-all firewall) is extremely useful to protect the average consumer from direct hacking attacks via OS and device vulnerabilities (which will continue to exist) or malware that runs a server program on their home computer.

Leaving it open is the worst possible case.

Hell, my new laptop has a remote admin mode that runs below the OS that I only found out was present and on by default by poking around the BIOS. Even with that disabled I now can't trust it to be on the net without an intermediary.

And N00bs already have functioning software and do only care about consuming, you're talking about putting people with no training (and no idea where they are) on the front lines of a war.

The only sensible option I can see is to keep them in the present situation, walled off. Preferably un-routable, but certainly behind outgoing-only firewalls. The likes of us who want to run server software already can, and anyone who wants to write services for the masses will continue having to run a server to co-ordinate and forward traffic.

Is this not obvious? As far as I can see your argument comes down to "let them take the risk, my stuff will work better"

Re:How long will IPv6 last?

[Nursie]

"ohh, you need network? then connect and protect the damn thing..."

I don't disagree with the rest of your post, but that attitude is not helpful for the billions of non-tech savvy folks out there, who want something to work without them having to screw around with strange magic numbers and router configuration.

Why is NAT useless if you want non-routable addresses able to get client access to the net?

Re:How long will IPv6 last?

[walshy007]

I don't really see the difference except in the situation where multiple machines on the network wish to run the same service on the same port. Otherwise, from my perspective as a user, it's identical.

Multiple people even within a household wanting to use the same thing on their pc is really so rare to you?

and so is auto port opening using UPnP because it's pointless... ?

It is pointless because it is designed for poking holes through NAT. And even a blocks all incoming firewall is better than nat because at least you can fix it if you know what you want.

And N00bs already have functioning software and do only care about consuming, you're talking about putting people with no training (and no idea where they are) on the front lines of a war.

The point is even while consuming they can still be serving, the point of the internet is communications, things such as p2p protocols and voip and gaming all provide communication between parties, all of which work much better when people can directly contact eachother (i.e. routable)

Any restrictions you place on the connection inhibit the ability to freely communicate. The only thing that effectively stops the need to know some details on how it works is stopping that ability to communicate, I mean hell to stop browser vulnerabilities all you have to do is block all http/ftp etc traffic. Easy solution hey?

Defeats the point of being able to communicate. It is better to allow people to communicate and run the risk of running stupid software that can allow their machine to get owned (which they already tend to do by trojans off the net anyway) than to block off the main purpose of the internet, communication.

Who are you to judge what everyones needs may be. Sure if you can analyze their needs you can make a nice firewall that will suit them perfectly if they cannot themselves. But why gimp the populations internet access in the name of if they cannot connect they cannot get owned.

Would be far better to secure the individual nodes and allow free communication except where the person knows enough that they don't need a specific type etc.

Re:How long will IPv6 last?

[Nursie]

"Multiple people even within a household wanting to use the same thing on their pc is really so rare to you?"

Outside of bittorrent, yes.

It is pointless because it is designed for poking holes through NAT. And even a blocks all incoming firewall is better than nat because at least you can fix it if you know what you want.

UPnP is not just designed to poke holes in a NAT, it is designed for automated admin of routers.

Defeats the point of being able to communicate.

No it doesn't. My mother can browse the web and use skype now. That's as much communication as she needs or wants. She sure as hell doesn't need her machine, which may or may not be compromised, up to date on security patches or whatever, having the ability to offer server capabilities to the entire internet.

It is better to allow people to communicate and run the risk of running stupid software that can allow their machine to get owned (which they already tend to do by trojans off the net anyway) than to block off the main purpose of the internet, communication.

Those who do not have the capacity to understand how to configure a network should be walled off. It is FAR better that they not be able to run a SIP program in a serverless way, than 90% of the world's machines get owned in a single day because a windows vulnerability was found.

Would be far better to secure the individual nodes and allow free communication except where the person knows enough that they don't need a specific type etc.

Oh sure, how about you come back to me when you've trained the entire world population on responsible network admin, computer security and frequent log scans.

It would be far better if we all had cars that ran on farts and gave out nothing but pure, clean drinking water as exhaust too.

In summary - you're crazy. NAT (not because of address translation, but it's firewall side-effect) is the only thing keeping botnets as small as they are right now, and keeping black hats out of a hell of a lot of computers.

I don't think you have any idea of security.

Re:How long will IPv6 last?

[walshy007]

Outside of bittorrent, yes.

Guess you've never seen a complete household with several voip phones before, or a household full of twenty-something males that play computer games.

I don't think you have any idea of security.

Actually I'd argue that you don't. Security is a constant trade-off between having things work and making life difficult.

Who are you to decide that everything should be blocked off? Arguably this choice is for the network admin (even if it is a clueless person) to decide.

Of course personally i'd go with the view of having things work as default instead of killing functionality. Since if the functionality is dead from the start how can they utilize it if they don't know about it?

What you are proposing is trying to protect people from themselves. All you wind up doing is putting people in a padded room, not surprisingly most people don't like it when they realize they've been limited by these things (NAT, which is not fixable and not globally routable, as opposed to ipv6 globally routable addresses).

Your argument is still pro-nat. Mine is that Nat is a nasty horrible hack, whereas globally routable addresses with an outgoing only firewall is slightly better, still useless for many but at least those who know what they are doing can fix it. But why should people have to deal with broken connectivity from the get go.

You will never have security with users that don't know anything about what they are doing combined with a lack of oversight by anyone competent. To think otherwise is pointless.

What you are proposing as a blanket solution provides many drawbacks, ones that even common users encounter without any real security benefit (stupid users will still get owned) considering the workarounds needed.

Your view of security seems to be, fuck the users needs, lets make this secure! and taking that to it's extreme you're better off just removing net access entirely.

Re:How long will IPv6 last?

[smash]

Yes. I've just spent all day dealing with network brain damage due to having to try and route back to our 10.3.1.0/24 subnet from a company running 10.3.1.0/24 internally on their own network. Fucking joy.

Re:How long will IPv6 last?

[badkarmadayaccount]

Have the OS use inverse NAT mapping, assisted with SRV records. Applications won't know a thing.

Re:How long will IPv6 last?

[TheRaven64]

Some African ISPs have been proposing allocating /80s to customers. I don't know if they are actually going to, but that's the smallest proposal I've seen. Most ISPs seem to be converging on /64s. Not sure who would need a /48.

Re:How long will IPv6 last?

[Abcd1234]

Some African ISPs have been proposing allocating /80s to customers. I don't know if they are actually going to, but that's the smallest proposal I've seen. Most ISPs seem to be converging on /64s. Not sure who would need a /48.

Anyone who wants subnets. Which could be anyone at all.

And a /80 is absurd, as that wouldn't allow for autoconfiguration. /64 is the bare minimum that makes any sense at all.

Re:How long will IPv6 last?

[Abcd1234]

Actually, I take that back... with a /80, you can embed the full device MAC in the host bits and autoconfigure that way (as opposed to "upconverting" the MAC, as is the standard practice today). 'course, I have no idea if any operating systems actually support doing that.

Re:How long will IPv6 last?

[mark-t]

Assuming that population growth and technology evolution grow at a linear rate, you'd be right.

However, that's not the case... the population and number of connected devices will grow exponentially... plus, there's the fact that corporations are going to be expect multiple subnets, resulting in absolutely *ENORMOUS* numbers of IPv6 addresses being unused. As time goes on, we will be facing an issue where we have to reclaim those unused IP's from where they were originally allocated, or else start reducing the number of IP's we allocate to people. This will complicate routing far more than it would have been if we had been more conservative in the first place, and eventually NAT is likely to be seen as better solution, as people start getting allocated much smaller blocks than they used to.

Anyways, assuming the exponential growth goes unabated, some relatively straightforward math shows that it will only take *roughly* 4 times as long for IPv6 space to run out as it has for IPv4 space to be facing depletion, since the address space is 4 times as wide (even though it is 2^96 times as large). Exhaustion by that time is only avoidable if the exponential growth rate stops as well. NAT may be seen as superfluous for IPv6 now, but I again refer you to a time when people thought that the Atlantic salmon supply was inexhaustible as well.

And hey... under IPv6, it's wholly theoretically possible to route right through a NAT-like device anyways... so protocols don't even have to break, as I described in an earlier message... effectively making an IP address 256 bits wide (or even larger) instead of 128, using an extension header to hold the remaining bits. The main header would have the 128 bits of the NAT-like device through which the packet must pass to reach the actual destination, and an extension header would hold the remaining bits of the address to forward the packet to. Essentially, it would amount largely to the IP packet containing small amounts of explicit routing information, and the intermediate systems specified would still have to do some address translation in the packet header so that the underlying protocol is manageable by IPv6 routers that do not know about the extension headers this concept utilizes, but all of the original information could be preserved in an extension header if necessary, and this would not have to break a single protocol.

Re:How long will IPv6 last?

[mark-t]

Yes, NAT mangles packets... but then that doesn't matter for a lot of protocols.

And for the protocols it does matter for, NAT devices under IPv6 could be set up to preserve the original data in an extension header, so outside machines could potentially route data directly to them, even without having an existing connection, as long as the NAT-like device is configured appropriately.

Re:How long will IPv6 last?

[mark-t]

The reason for NAT's continued existence is not because I want it specifically, but rather because wishing it would go away is not, realistically, ever going to make it happen. Instead of getting a hate-on over people who might want to utilize NAT, why not just ignore them? Particularly since, as I was saying, the devices that are most likely to utilize NAT under IPv6 are devices that aren't going to be needing any of the protocols that NAT breaks in the first place.

Re:How long will IPv6 last?

[Abcd1234]

However, that's not the case... the population and number of connected devices will grow exponentially

Yeah, we're gonna hit the earth's physical capacity to store humans and devices before we hit the IPv6 address limit.

Seriously, just think for a moment or two (you can do it!). The surface area of the earth is 5.10072 × 10^20 square millimeters. A *single* /48 contains 2^80 addresses. A little basic math shows you can have 2,370 *unique* IPv6 addresses for *every square millimeter on the planet*. In just *one subnet*. And there's *hundreds of trillions of subnets*.

I think we'll be fine for a while.

plus, there's the fact that corporations are going to be expect multiple subnets

And they'll get one. One of those trillions and trillions of /48s. They can then break that down into 65535 /64's. And if they *really* need more than 65k subnets? Just give 'em another /48, it's not as if there aren't hundreds of trillions more.

Anyways, assuming the exponential growth goes unabated, some relatively straightforward math shows that it will only take *roughly* 4 times as long for IPv6 space to run out as it has for IPv4 space to be facing depletion, since the address space is 4 times as wide (even though it is 2^96 times as large).

Wow... epic math fail.

"4 times wider" != "4 times longer before exhaustion again". 2^96 is such a mindbogglingly huge number it's inconceivable. Certainly inconceivable for you, it seems.

Re:How long will IPv6 last?

[Aqualung812]

Instead of getting a hate-on over people who might want to utilize NAT, why not just ignore them?

Because there are far bigger issues to work out with vendor support for IPv6 (as TFA mentioned) that I don't want any of the vendors distracted with a feature that isn't needed.
If I have to deal with another bug because Cisco was spending time trying to make NATv6 work, then my time is being wasted by someone else's stupidity.

Let's assume that people were bitching about a lack of Solitaire in Windows 8. I would expect desktop guys to be just as frustrated as me in the demand that Microsoft spend its time working on something that serves no purpose instead of focusing on writing good software.

Re:How long will IPv6 last?

[mark-t]

I don't see any reason to go to any trouble to make protocols interoperative with NATv6... if people require the advantages of a global IP, there's no reason not to use one. If they don't require one, there's no reason to use one.

Re:How long will IPv6 last?

[Aqualung812]

You're missing my point. Running NATv6 on a gateway requires some sort daemon running on the gateway. Someone has to write that daemon, debug memory leaks, etc.
Plus, some devices are going to have that daemon running the whole time without the option to disable, just in case the user wants to use it.

If they don't require one, there's no reason to use one.

Yes, there still is a reason to use one, as running NAT requires more resources.

This is basic design, you shouldn't make anything more complicated than it needs to be. Since there is no need for NATv6, it shouldn't be added. KIS,S!

Re:How long will IPv6 last?

[mark-t]

"4 times wider" != "4 times longer before exhaustion again"

Actually... it is, assuming exponential growth continues. Do the math. Given that the number of systems on the Internet seems to be doubling roughly every two years or so (slowing down only now, possibly owing to IPv4 space depletion), in about than 4 years there could be 4 times as many as there is now, in 8 years 16 times as many, in 16 years 256 times as many, in 32 years there would be 65 thousand times as many, in 64 years, 4 billion times as many, in 128 years, 18 quintillion times as many, and in roughly 256 years we are facing total IPv6 exhaustion.

The *ONLY* way that can be avoided is to assume that the exponential growth stops, but once IPv6 address space opens up, I don't see that happening before the address space starts becoming more scarce again, as IPv4 space is now.

Re:How long will IPv6 last?

[mark-t]

Yes, there still is a reason to use one, as running NAT requires more resources.

So does running a firewall... arguably, running a firewall requires more resources than a NAT because a firewall is so much more flexible.

NAT breaks protocols, I don't deny that... but there are far more uses of the internet that NAT doesn't break than those that it does. So I really don't see the problem... systems behind NAT's simply wouldn't work the same as systems that aren't... but under IPv6 there will be no reason not to use a global IP if one is needed or desired, so there won't be any demand to make stuff have to work with NAT that wouldn't otherwise.

Re:How long will IPv6 last?

[Aqualung812]

So does running a firewall... arguably, running a firewall requires more resources than a NAT because a firewall is so much more flexible.

I thought running a firewall was a forgone conclusion, or are you suggesting someone run NAT and no firewall? To me, it is SPI+NAT or just SPI.

I'm curious why you care so much about keeping NAT. If you understand that there is no advantage to it, why would you or anyone else want to use it?

Even if there was no performance gain, why choose the more complicated solution?

Re:How long will IPv6 last?

[Coren22]

I wish you hadn't posted AC so you might actually see this reply as you seem to genuinely want the answer.

http://news.slashdot.org/comments.pl?sid=1918484&cid=34625248

There are private addresses, but most likely you would not NAT as that is a horrid hack. Security is done through "local" and "world" type zones, not through NAT.

Re:How long will IPv6 last?

[mark-t]

Remember, that IP address space is a resource too... and NAT uses fewer addresses than having globally visible IP's. Inexhaustible as that range might seem, it's still finite, and poor allocation will result in its depletion long before what the actual size of the number should seem to suggest.

But what I imagine in the future are homes where literally every single electronic device, no matter what it is, has some level of Internet connectivity, many of them (or maybe even all of them) wireless. There would be many thousands, or even tens or hundreds of thousands of these devices in just a single person's apartment. In larger homes, and especially for office buildings or corporations, it could and likely would be orders of magnitude larger. It's simply not true that all possible devices would need a globally visible IP (arguably some of them may not need an IP at all), but it could still be the case that many of them might be able to benefit from at least a 1-way global internet connection, such as what is typically available through NAT right now. Devices that could benefit from a 2-way connection would simply not utilize NAT... they would use a globally visible IP instead, while devices that would not require a globally visible IP would use a private network range IP address, and the NAT device would translate the address of such devices as needed.

That's why I see NAT under IPv6 being useful. Nothing beyond that... and I don't see any reason to have to try to fudge protocols to work through NAT for devices that aren't ever going to be using those protocols in the first place.

Re:How long will IPv6 last?

[Abcd1234]

Actually... it is, assuming exponential growth continues.

Interesting, do you normally just ignore arguments that invalidate your ideas? Because it's a piss poor debating technique.

And in case you missed it: this is a *stupid assumption*. Even *if* exponential growth continued, the IPv6 address space is so insanely large that the *physically limitations of the planet earth* would prevent you from running out of addresses.

Re:How long will IPv6 last?

[Aqualung812]

Remember, that IP address space is a resource too... and NAT uses fewer addresses than having globally visible IP's.

This is where the disconnect is...you are not saving IP addresses with NAT on IPv6. The smallest public subnet will be a /64.

So, NAT or not, you're going to burn 2^64 addresses on every firewall in every home. If you want to debate IF they should be handing out a /64, then that is a great debate back in 1990, and I might have been on your side then.
However, that decision has been made. You are going to have those address, and NAT WILL NOT SAVE A SINGLE ADDRESS IN IPv6.

Re:How long will IPv6 last?

[mark-t]

This is where the disconnect is...you are not saving IP addresses with NAT on IPv6. The smallest public subnet will be a /64.

So far... That is liable to change as IPv6 address space starts to get used up.

Re:How long will IPv6 last?

[mark-t]

It's also worth pointing out that that 30,000 per square inch is flat. The world is 3 dimensional...

So when whole internet-capable devices with individual IP address can be smaller than a cubic millimeter in size, it's actually quite achievable just considering the land space we have on this planet that is actually inhabited by people (roughly 1% of the surface area).

Re:How long will IPv6 last?

[Aqualung812]

So far... That is liable to change as IPv6 address space starts to get used up.

I think we'd sooner go to a new protocol completely. So many things have been built with the assumption that hosts will be on a /64, that it would be the same as trying to go after class D or class E IPv4 space, and you'll notice that we have not attempted that. Another thing would be to reclaim every address in the 127.0.0.0/8 other than .1, but again, there were assumptions made and we have to live with them. IPv6 is farther along than you might imagine, and we're already at the point that there is no time to undo those assumptions with IPv4 so close to exhaustion.

IP has its limits, and something tells me we'll be on to something better before IPv6 is exhausted 200 years from now, assuming the same exponential growth (which I don't think can be assumed). It wasn't that long ago that IPX was a viable layer 3 protocol, and I just can't imagine we can't come up with something to completely replace IP (not IPv7 or whatever) in a few hundred years.

Re:How long will IPv6 last?

[mark-t]

I think we'd sooner go to a new protocol completely

Are you sure? Especially considering how long NAT is keeping IPv4 alive when it has been facing depletion for several years now?

Re:How long will IPv6 last?

[Aqualung812]

I don't mean due to exhaustion, I mean because we figure out a better way of connecting computers.

For example, IP sucks when it comes to high-speed, high-latency connections (like something a deep-space ship would use). NASA is working on a new protocol to deal with ping times of hours instead of milliseconds. I'm sure there are other proposals that are just now being played with, and others that will come.

Don't forget, 100 years ago, we were just beginning to drive cars, and we've only had computers around for 60-70 years. With another 100 years, I would be shocked if nothing had replaced IP with better functionality.

Re:How long will IPv6 last?

[Nursie]

Guess you've never seen a complete household with several voip phones before, or a household full of twenty-something males that play computer games.

They tend to know how to configure a router and therefore will have no problem changing the default-deny firewall setup they got from their ISP or vendor to something that suits them.

Of course personally i'd go with the view of having things work as default instead of killing functionality. Since if the functionality is dead from the start how can they utilize it if they don't know about it?

They don't know or care about it anyway. It's more important for Joe underachiever to be able to use the web in relative safety than it is that he be able to find some cool new software and start using it, turning his machine into a server, without any idea what it does.

What you are proposing is trying to protect people from themselves.

Absolutely. Most people are idiots. Even more so when you bring computers into the equation.

All you wind up doing is putting people in a padded room, not surprisingly most people don't like it when they realize they've been limited by these things

Most of them will never know or care.

whereas globally routable addresses with an outgoing only firewall is slightly better, still useless for many but at least those who know what they are doing can fix it. But why should people have to deal with broken connectivity from the get go.

Because it's not broken for >90% of their use cases and it protects their badly configured, unpatched machine from being port scanned and pwned.

You will never have security with users that don't know anything about what they are doing combined with a lack of oversight by anyone competent. To think otherwise is pointless.

But we can help them, can't we?
We can remind them to install anti-virus, we can block people from remotely probing their machine, we can stop them exposing services to the entire world unless they know what they're doing. Or is all of this pointless in your mind?

Your view of security seems to be, fuck the users needs, lets make this secure!

And your view of security seems to be "fuck the users needs, if they can't configure a firewall they a shouldn't be on the net and deserve to get pwned".

and taking that to it's extreme you're better off just removing net access entirely.

You're an idiot.

You're a complete moron if you think that most consumer (not to mention business) machines should have anything like complete exposure to the internet.

In your head is it only NAT that's to "blame" for keeping machines from being directly and completely exposed to the net?

Have you ever considered what happens in companies that have a class A address space? Do you think even 1% of the machines IBM owns are publicly accessible? Hell no they aren't. They may have a 'real' address but there's no way for any access to occur that's not exactly the same as if it was through a NAT.

Hell, a well set up corporate network will have segments that can't even address each other due to security-related partitioning.

You are free to make your mobile phone, television, NAS and other devices first-class internet citizens. You're going to get pwned. Meanwhile my mother's Win XP machine is safely behind a NAT, and she can go about her business without risk of some shithead using this week's remote access exploit to re-purpose her machine into a Tor node, a porn hub or a spam proxy.

Re:How long will IPv6 last?

[walshy007]

They tend to know how to configure a router and therefore will have no problem changing the default-deny firewall setup they got from their ISP or vendor to something that suits them.

But if they only have one IP address and NAT, how can they fix it with multiple people wanting the same services really? Thats still an argument AGAINST nat.

Your main argument is pro NAT, as I've said before ipv6 with firewall is far better but still not suited to everyone. The real solution of course is if you care about security, get someone who knows what they are doing. NOTHING will fix this but that. Even with NAT devices will still get owned by noobs.

You're a complete moron if you think that most consumer (not to mention business) machines should have anything like complete exposure to the internet.

It would still be limited, but at the device not the network router/firewall. Nothing is stopping devices from rejecting any packet that has not come from the local subnet if the owner wishes. Which makes perfect sense for such devices.

You are free to make your mobile phone, television, NAS and other devices first-class internet citizens. You're going to get pwned.

Most of them have their own publicly routable IP address, with no firewall rules at the entire network level, they each have their own firewall rules on their own machines suitable to their purpose. Anything that I don't want to be accessible just drops the packets if they aren't from the local subnet.

You mistake me for saying every service should be open to everyone, it is still security just at a different stage of the game.

You want to lock down the network for everyone, I think it would be wiser to just lock down what you attach to the network in small network situations, and of course in large ones to have a network admin worth their salt.

Every modern device either has a stateful firewall built into the IP stack anyway, or just ignores any packets it isn't expecting anyway.

Re:How long will IPv6 last?

[walshy007]

Have you ever considered what happens in companies that have a class A address space? Do you think even 1% of the machines IBM owns are publicly accessible? Hell no they aren't. They may have a 'real' address but there's no way for any access to occur that's not exactly the same as if it was through a NAT.

And they have a network admin and clear needs to which any other consideration can be left behind. We were talking about home situations. I completely agree that businesses and large networks should have a network admin that can do whatever he likes to the firewall.

And it still isn't the same as with nat, he can add (and likely does) exceptions to it to allow certain hosts to have two way access to the net, with the exception of port forwarding which only works for one host for that port, you cannot do the same with nat.

Re:How long will IPv6 last?

[Nursie]

They have a default deny policy. And why do you think they have it? Because MOST hosts do not need to use server ports visible to the whole internet, which is true wherever you are.

NAT or no NAT, the idea of letting home computers and other devices on the net without a firewall that stops anything and everything incoming unless the user sets it up differently, is just common sense and good practice.

Re:How long will IPv6 last?

[Nursie]

But if they only have one IP address and NAT, how can they fix it with multiple people wanting the same services really? Thats still an argument AGAINST nat.

Very few people, as a percentage, care about running one service, let alone multiple copies in a single house. If you do you are likely an enthusiast and enthusiast ISPs have been handing out multiple IPs for ages in a lot of places.

Your main argument is pro NAT, as I've said before ipv6 with firewall is far better but still not suited to everyone.

No, you said the default deny was barely better and argued against home hardware coming with that preconfigured.

The real solution of course is if you care about security, get someone who knows what they are doing. NOTHING will fix this but that. Even with NAT devices will still get owned by noobs.

And yet 99% of the public don't know a thing about security and their router has kept them safe from remote exploits anyway. Strange.

"It would still be limited, but at the device not the network router/firewall. Nothing is stopping devices from rejecting any packet that has not come from the local subnet if the owner wishes. Which makes perfect sense for such devices."

I'll say it again - good luck with that. Devices are not well configured and their software stacks bulletproof by default. Multiplying the points of failure in a given house is a surefire recipe for failure. Hell, only the other day we had an article on here about the potential for network attached TVs to get pwned as they run a small networking OS.

"Anything that I don't want to be accessible just drops the packets if they aren't from the local subnet.

I haven't found that config item on my tv yet.

You want to lock down the network for everyone,

I think it would be wiser to just lock down what you attach to the network in small network situations,

And you'd be wrong, because these devices ship with a million and one vulnerabilities built in that a firewall can prevent, and the lack of a firewall presents ZERO compelling use cases to the average home user.

Every modern device either has a stateful firewall built into the IP stack anyway, or just ignores any packets it isn't expecting anyway.

Which is not the same as saying that it doesn't open ports for all sorts of reasons that expose vulnerabilities to the world.

You seem to envisage a world in which device security is perfect, and large network admins have mysterious reasons for locking things down and only allowing services they know about, and that for some reason doesn't apply elsewhere.

Let me sum it up - many devices are riddled with security holes. This is not going to change. Putting these devices directly on the net just so you can ping them is never going to be a good idea.

Re:How long will IPv6 last?

[smash]

Direct routing works just fine with IPv6 as is. Mangling your packets still breaks IPsec.

Re:How long will IPv6 last?

[walshy007]

Which is not the same as saying that it doesn't open ports for all sorts of reasons that expose vulnerabilities to the world.

Misconfigured software will still get you owned even with a nat or firewall. You've sacrificed a lot of connectivity for the sake of only taking care of one vector, when all the others are still open. Congratulations.

And yet 99% of the public don't know a thing about security and their router has kept them safe from remote exploits anyway. Strange.

So you're trying to say that not more than 1% of people who do not know about networking have ever been victim to any kind of exploit. I call bullshit.

I don't see the point in sacrificing functionality when what it aims to stop won't be stopped anyway because of all the other methods a user that has no idea leaves open to them.

When you have someone to administer the system properly that knows what they are doing it is a different story. They know what they do not need and can safely toss that functionality out.

Basically only having nat in regards to security is like trying to plug a leak in a dam with your finger, not effective to the point of why bother and in doing so you've sacrificed other things.

Re:How long will IPv6 last?

[Nursie]

You still don't get it do you?

Firstly, with access to machines a remote vulnerability in the OS becomes a major concern. Now there has to some sort malware, trojan or social attack. Millions more machines can get pwned without an intermediary firewall.

Secondly, nobody is sacrificing anything. Anything at all. There is no server that my mother wants to run. Gamers are a minority on the net and amongst them those that even know what a dedicated server is are a much smaller minority. VOIP with SIP is an even more niche case.

Default deny is the only sensible option when the internet is like the wild west. You would throw out an important security measure that can be given to the less savvy, for no gain for them at all.

Re:How long will IPv6 last?

[mark-t]

Well... Not every internet connected device reasonably requires IPsec.

NAT works too.... and doesn't chew up more global IP's than are actually required by what is actually needed.

2^128 addresses is a mind-bogglingly huge number, but it's quite approachable in a human scale of time when two things are happening, and both of them are: a) exponential growth, and b) massively wasteful allocation.

As a result, we are going to have to do 2 things at some point in the not too horribly distant future: 1) start giving out smaller ranges of IP's, and 2) reclaim unused IP ranges from organizations and people that don't need them.

Or.... we will have to move to a new protocol completely, and have to do this shit all over again.

Using NAT on devices that don't actually require it seems preferable to the latter option. It doesn't break anything because nothing NAT breaks gets used on those devices. Ultimately, there are far more uses of the Internet that NAT does not break than those that NAT does... the only issue with NAT is when it is used on devices that could practically benefit from using any of the protocols that NAT breaks, which is probably most significant on general purpose computing devices like PC's.

Re:How long will IPv6 last?

[mark-t]

Inertia is not a quality limited to physical matter... there is an inertia that applies to everything that people do, and the longer people do it that way, the harder it is to get people to change, even if it is for their own good.

Re:How long will IPv6 last?

[walshy007]

Secondly, nobody is sacrificing anything. Anything at all.

If nothing was being sacrificed, we wouldn't be having this discussion would we, nat would be fine for all purposes.

There is no server that my mother wants to run. Gamers are a minority on the net and amongst them those that even know what a dedicated server is are a much smaller minority. VOIP with SIP is an even more niche case.

The point is users don't have to know about dedicated servers etc, they don't have to map ports, they could just click 'host game' and their friends could click 'join my friends game' on the master server list. Much as q3a and other such games already do, but removing the port forwarding and allowing multiple people on a network to host.

The non-tech savvy wouldn't even know they are running a server, it would be that simple. To them they are just making a phone call or playing a game

As it stands application developers have to work around being non-routable and doing a bunch of hacks to get things to work, far from optimal and sometimes it still doesn't work.

To say you've sacrificed nothing with nat is ridiculous.

Dren?

[Anonymous Coward]

DREN Chief Engineer? I don't think that means what you think it does.

No they aren't.

[Anonymous Coward]

I work for a military contractor. I can confirm that we a.) have no orders from on high to move to ipv6, and b.) have no plans to move to ipv6. This is most likely just one tiny section of the military - it's by no means across the board.

Re:No they aren't.

[Anonymous Coward]

Well.. I'd say that the DREN are. This appears to be a DoD usa-wide engineering research network. By their own admission, DREN is the "official DoD long-haul network for computational scientific research, engineering, and testing" -- doesn't sound like they're the military operations type people though.

So... yeah. Given that DREN explictly say they support ipv4 and ipv6, they're almost certainly insisting on ipv6 support on equipment they buy and want a show of good faith from vendors that their ipv6 solutions are good enough that the people selling them actually use them themselves. Makes sense - everyone knows that ipv6 is coming; and a research network can afford to be an early adopter. They're probably big enough to have some clout.

Broade, for example, met the demands by putting some of their own gear in front if its website

Brocade put a pair of its ADX load balancers in front of its Web site to allow incoming IPv6 users to access its IPv4-based content. This pair of load balancers – which would cost around $26,000 -- allowed Brocade to IPv6-enable its Web site, DNS services and mail server.

For them, not a huge cost to land what is probably a fairly decent contract.

However, this does appear a way off from being a US DoD-wide mandate.

Re:No they aren't.

[Cwix]

What kind of military contractor? If you sell sights for guns, I doubt they care what version IP you use. If you sell software or computer hardware, then apparently they are interested. Either that of your just not important enough to know what the military says to your boss.

I'm okay with this

[Byzantine]

As long as they're applying this across the board and not playing favorites (at least not without a damn good in-writing reason), I'm okay with this. I fact, I don't really see IPv6 being adopted soonish absent measures like this.

Re:I'm okay with this

[dasdrewid]

It is kind of funny. I rail and rail against the power and might of the military-industrial complex. Then things like this happen and I am thankful for the DoD for advancing the state-of-the-art in ways that the general market is incapable/unwilling too. It's...frustrating. Why do they have to make things so complex!

Re:I'm okay with this

[VTI9600]

As long as they're applying this across the board and not playing favorites (at least not without a damn good in-writing reason), I'm okay with this.

Not quite. The rule only applies to network hardware vendors who sell to the military, of which there are a very small number. Also, they're not doing this in the interest of public welfare. They are doing it because they're being sold hardware that hasn't been adequately tested and thus tends to break down on them. This is a very sad excuse for quality assurance, and begs the question of whether the military should switch vendors regardless of whether these companies roll out IPv6 on their private networks or not.

Re:I'm okay with this

[tlhIngan]

As long as they're applying this across the board and not playing favorites (at least not without a damn good in-writing reason), I'm okay with this. I fact, I don't really see IPv6 being adopted soonish absent measures like this.

Not really. It'll probably lead to NAT (v4/v6) being created as a stopgap, simply because transitioning is HARD. These companies want a simple box then can use to replace their current NATv4 router to give them both v4 and v6 compatibility with zero effort. (After all, why does every PC on my network need to know what my blasted IPv6 prefix is to get on the 'net? And unless I use DHCPv6, each PC on my network will have 3 IPs? link-local, local network (because I'm not typing out individual device IPs when FC00::/64 is available for private networking), and internet-routable). Why can't we have a box that replaces my current D-Link or Linksys? I have better things to do with my time than learn the intricacies of IPv6 (and I know IPv6 simply because I had to learn it, and I'm not looking forward to the migration))

It's doable, too, to give v4 only clients v6 access through protocol translation and a bit of DNS hackery to map v6 addresses to a v4 host temporarily like how NAT works).

We're down to 4 or 5 blocks. Let's make it happen people - a simple way to transition, and keep v4 networks internally while both supporting v4 and v6 externally. I don't care about external connectivity - I can port forward like I normally do.

Re:I'm okay with this

[Anonymous Coward]

Yea, let's all praise the military for pushing a technology that will further destroy anonymity and provide non-changing, traceable IDs to every computer. The military only has our best interests in mind ...

Re:I'm okay with this

[Pi1grim]

Ahem, you mean like IPs and MAC-addresses? Hate to break it to you kid, but they have been around since the beginning of APRAnet. Thinking that NAT provides anymity is like hoping that shutting your eyes will hide you from everyone's sight.
PS You can still spoof your mac if

Re:I'm okay with this

[gtall]

It isn't DoD, its the Navy. Wish it were DoD, then it would change much sooner.

To the bozo below talking about destroying anonymity, you may have heard of TOR, developed at the U.S. Naval Research Laboratory and given to the world.

Re:I'm okay with this

[Drishmung]

Not really. It'll probably lead to NAT (v4/v6) being created as a stopgap, [...]

It's doable, too, to give v4 only clients v6 access through protocol translation and a bit of DNS hackery to map v6 addresses to a v4 host temporarily like how NAT works).

Alas, not so. NAT46 (RFC 2766) doesn't work. It's now an ex-Parrot (RFC 4966) and no-one is showing any signs of applying high voltage to the cage.

That particular "simple way to transition" won't work.

Until nanotech networks need addresses.

[Ungrounded Lightning]

2^128 unique address. I don't think we'll be exhausting them any time soon. That's like each person on earth have access to roughly 10^38 unique address.

Huh?

That's not enough to address the cells of one human body.

(Of course putting your medical nanobots on the internet would be a pretty dumb move. DoS attacks would sink to a new level - about six feet under, while BSoD would become quite literal.)

Re:Until nanotech networks need addresses.

[Anonymous Coward]

double huh...? there are on the order of 10^27 *atoms* in an "average" human body, and the number cells is far fewer still. that's just a wee bit smaller than 10^38...

Hmmm???

[Anonymous Coward]

Maybe we should just go all the way to IPv11! That's what I'm talkin' 'bout! All Your Base Are Belong to US!

Re:Hmmm???

[Anonymous Coward]

"this internet protocal goes to eleven, its one more than 10!"

Adding IPv6 is not difficult

[The_Dougster]

I upgraded my systems to ipv6 even though I just have IPv4 by signing up for a free tunnel broker service. I recommend SixXS if you are serious, or one of the others if you just want to flirt around with IPv6. Basically, you open a tunnel on one of the machines, it starts radvd which activates ipv6 on every machine on your LAN automagically, and thats all you do. Perhaps edit a config file here or there to turn on ipv6 if its lacking for some reason. The radvd machine broadcasts on your net and provides something like DHCP for all your ipv6 enabled machines which usually just pick it up on the fly with no reboot or anything required.

Re:Adding IPv6 is not difficult

[VTI9600]

Perfect! Just hold on a sec while I forward your post to the Joint Chiefs....there! Done and done.

Re:Adding IPv6 is not difficult

[Anonymous Coward]

Playing with IPv6 is ok, but please for the sake of spreading good experiences about IPv6, please don't recommend SixXS. They have many problems with their service, mostly with admins who care more about their own ego than the users. There are other tunnel providers available, I've heard good especially about Hurricane Electric, but anything else than SixXS works fine.

Re:Adding IPv6 is not difficult

[Abcd1234]

Hurricane is far better than SiXXs, IMHO. They seem to have better peering arrangements (the additional latency for me over v6 is negligable), and you don't have to go justify to HE why you want a tunnel. You ask for one, you get it. Plus, then you don't have to deal with SiXXs killing your tunnel without warning.

What's the big deal?

[DeathSquid]

Anyone with IPv4 addresses can use 6to4 right now to provide IPv6 connectivity. Software support for IPv6 is common, e.g. apache, postfix, etc. Operating system support is widespread, e.g. linux, *bsd, etc.

There are no real barriers to having IPv6 public facing services for vendors except rank incompetence.

Re:What's the big deal?

[Bucky24]

Most of the backbone providers haven't fully upgraded their networks to ipv6 because the massive routers and switches that they use are quite expensive.

Re:What's the big deal?

[DeathSquid]

You missed the bit where anyone with v4 connectivity can use 6to4 right now. No need for massive router upgrades or ISP cooperation, etc. Just turn it on. If you plan for a 10 minute upgrade, you'll have time to make a coffee as well. Assuming basic sysadmin competence.

I'm mystified as to why you think switches (which are layer 2) would need upgrading to support IPv6,

Of course, in the longer run, native v6 support from your ISP is highly desirable for optimal routing. But end users don't need to wait for this.

Re:What's the big deal?

[Bucky24]

I'm mystified as to why you think switches (which are layer 2) would need upgrading to support IPv6

You're right, for a switch it wouldn't matter.

If you plan for a 10 minute upgrade, you'll have time to make a coffee as well. Assuming basic sysadmin competence.

I imagine most people with basic sysadmin competence have already upgraded. It's the people who a) don't really understand how IPv6 is better, and b) wouldn't know how to upgrade even if they did know that haven't switched over.

Re:What's the big deal?

[Nethead]

You're right, for a switch it wouldn't matter.

Management stack.

Also, most "switches" these days also do layer three. Hell, the Juniper EX-4200 does BGP and it's sold as an enterprise top-of-rack switch.

Re:What's the big deal?

[segedunum]

You missed the bit where anyone with v4 connectivity can use 6to4 right now. No need for massive router upgrades or ISP cooperation, etc. Just turn it on. If you plan for a 10 minute upgrade, you'll have time to make a coffee as well. Assuming basic sysadmin competence.

You know, I despair at people who say utterly brainless shit like this because they obviously have not a clue about how large some organisations are and how long it's taken to get their existing network infrastructure sorted and working. You cannot do this in ten fucking minutes.

I'm mystified as to why you think switches (which are layer 2) would need upgrading to support IPv6,

A lot of switching equipment can be protocol aware.

Re:What's the big deal?

[Bengie]

you missed that most backbones have been supporting IPv6 for years. It's ISPs that are dragging their feet.

Re:What's the big deal?

[Cwix]

Go to google and type in layer three switch.

I found this though if it helps you. Emphasis mine.

"Some MLS's are also able to route between VLANs and/or ports like a common router. The routing is normally as quick as switching (at wirespeed). According to Cisco, Level 3 switches are basically routers that switch based on Layer 3 information , the basic difference being processing speed and/or the way they do the switching; Level 3 switches use ASICs/hardware instead of the CPU/software that a router would."

https://secure.wikimedia.org/wikipedia/en/wiki/Multilayer_switch

Re:What's the big deal?

[beanpoppa]

Not to mention, even my lowly access switches have multicast snooping functionality, which would require IP6 capability to continue function. And non-access distribution and core switches tend to be layer 3 'switches'.

Re:What's the big deal?

[DeathSquid]

As you quote "Level 3 switches are basically routers". Actually, by definition, using level 3 information *is* routing. Calling them level 3 switches because it is a hardware rather than software implementation ignores basic computer science. But that's no surprise from a marketing department.

Re:What's the big deal?

[Nethead]

That must have been why I had OSPF questions on my Juniper "Enterprise Switching" cert test.

Re:What's the big deal?

[Sometouw]

Most of the backbone providers haven't fully upgraded their networks to ipv6 because the massive routers and switches that they use are quite expensive.

And I can fart gold plated nano bits that form IPv6 address. Hurm, apparently I too can just make shit up. Gold plated IPv6 nano bit shit at that.

Re:What's the big deal?

[marka63]

You missed the bit where anyone with v4 connectivity can use 6to4 right now. No need for massive router upgrades or ISP cooperation, etc. Just turn it on. If you plan for a 10 minute upgrade, you'll have time to make a coffee as well. Assuming basic sysadmin competence.

You know, I despair at people who say utterly brainless shit like this because they obviously have not a clue about how large some organisations are and how long it's taken to get their existing network infrastructure sorted and working. You cannot do this in ten fucking minutes.

Which is why people have been saying for the last several years that you needed to start moving to IPv6. But human nature being what it is, people just wait to the last minute.

I'm mystified as to why you think switches (which are layer 2) would need upgrading to support IPv6,

A lot of switching equipment can be protocol aware.

But it should still work with IPv6 packets, just not as efficiently.

Re:What's the big deal?

[Cwix]

Routers connect two different networks, a layer three switch doesnt.

Re:What's the big deal?

[Alioth]

The only trouble is 6to4 sucks, you tend to get lots of connectivity problems with the real IPv6 internet. A tunnel broker tends to be much more reliable than 6to4 (and usually the tunnel broker's end point is the same place as the 6to4 traffic goes to).

Re:What's the big deal?

[segedunum]

Which is why people have been saying for the last several years that you needed to start moving to IPv6. But human nature being what it is, people just wait to the last minute.

You missed the point. No organisation is going to move to another network infrastructure that will make things appear to work the same, at best. No one.

Re:What's the big deal?

[Abcd1234]

Except, alas, for the surprising number of home routers and WAPs which have the nasty tendency of sending out router advertisements even though they don't actually have a public IPv6 address. Result? Connection timeouts as clients resolve the AAAA record, attempt a v6 connection, and fail (I had a WAP from *this year* do exactly this to me... had to use tcpdump to figure out wtf was going on, and had to reflash the gd firmware on the device to fix it).

Re:What's the big deal?

[Dan Ost]

This is a situation where it's hard to define what the "last minute" is. It's not like IPv4 is going to stop working when the address space is completely consumed.

Re:What's the big deal?

[marka63]

Except people are moving. There is a steady increase in the percentage of IPv6 traffic on the net compared to IPv4. Remember this isn't another network infrastructure. The packets flow over the same wires and through the same boxes. This is in most case just turning on capabilities that already exist in the equipment you already have. Sure there are some boxes where the manufactures have been so short sighted as to not include IPv6 support but apart from my access point all my equipment at home including network printers already supports IPv6.

IPv4 + IPv6 is standard from some ISPs already and from most others its just a question of asking for it as it doesn't cost more. The place where it is hard to get is in the home but one can use a tunnel broker for that in the mean time.

Re:What's the big deal?

[marka63]

This is a situation where it's hard to define what the "last minute" is. It's not like IPv4 is going to stop working when the address space is completely consumed.

But the ability to get new IPv4 addresses will stop forcing you to make more efficient use of the existing addresses or requiring you purchase/lease more from someone who has addresses to spare.

The hard part in turning on IPv6 is not at the network layer. It is making sure all the applications you use will work with IPv6. This takes time and maybe some development work. The world has basically a year or two to do this and it hasn't had the press coverage that Y2K had because there isn't a hard date as to when you will need to be able to support IPv6. You just know that it is coming.

Re:What's the big deal?

[Bengie]

then we need a definition of "network". You can also get Layer 4 managed switches

Oops. Off by a few orders of magnitude. B-(

[Ungrounded Lightning]

Oops. Need to check my math BEFORE posting. B-(

About 47 bits to address the cells of one body (if you only have one device with one port each and nothing for other stuff). Another 33 for the current population. That's only about 2/3 of the bits.

Still, IMHO that's starting to get a little tight. You'll probably want more than one bot per cell, one port per bot, and that's not even counting things like the intestinal bacteria (which out-count the body cells by enough to reduce the body cells to a footnone.) More significantly, there are a LOT of things besides people's guts that could use such molecular-machine attention.

So IMHO ipv6's address space is only adequate for macro machines on one planet.

Re:Oops. Off by a few orders of magnitude. B-(

[Anonymous Coward]

Well, if you want to access each and every bacteria in your body from the Internet, you may as well write a higher level protocol just for this purpose. Your body can get a IPv6 address, and then you layer a Body Protocol on top of it. You can store a Body Address in the IP payload just fine. An since your application will be speaking this protocol, while everyone else won't give a shit, it should be perfect.

Only half the fight

[bwindle2]

IPv6-enabled content is the first half... now to get a big ISP to enable it across all their systems (someone like Comcast, but more competent)

Re:Only half the fight

[gnapster]

Actually, Comcast is currently conducting trials of IPv6 with their subscribers. I am not participating right now because I had to cancel my service, but I was very close to participating six months ago.

Re:Only half the fight

[Alioth]

Facebook is on IPv6. So is Google.

Actually, it's kind of embarrassing that Facebook is on the IPv6 internet before Slashdot.

Re:IPv6 is a Failure

[PsykoDemun]

Following your argument: I live in Northern Virginia. They are constantly doing road construction here. Why? Why didn't they just plan out for today's traffic needs thirty years ago? That is the argument you are using. A technology that was designed in the 70's was supposed to miraculously anticipate the explosion of the internet and net enabled/connected devices that we are seeing today. That is a logical fallacy. That's like saying the roads that they built in the early 1900s should have been ready to rock when automobiles hit the big times in the late 40's to early 50's. Humans have consistently failed to accurately predict even thirty years in the future since the industrial revolution. It will only get worse as progress continues to accelerate.

I'll move to IPv6

[AVryhof]

....as soon as Consumer/SOHO routers that support it are in the right price range.

Right now, the lowest priced item on Newegg that comes up for IPv6 is a cable modem, which I don't need, and that's $77.

Then there is the Cisco router starting at ~$133 on sale.

OpenWRT does it, and it looks nice, but I don't have the time to fiddle with flashing a router right now.

When are we going to see a company hack something together with inexpensive chips, and flash that is dedicated to just running OpenWRT, then sell it?

Re:I'll move to IPv6

[blueg3]

...but I don't have the time to fiddle with flashing a router right now

Ten minutes of your time is that expensive?

Re:I'll move to IPv6

[Drakino]

Newegg doesn't sell them, but the Apple Airport Express (and any 802.11n based Apple router) supports IPv6. $99 and up. Buffalo had one out in 2007, before their WiFi lawsuit, and has a few more out now. DLink does too.

http://www.sixxs.net/wiki/Routers has a good list.

It will be interesting to see what router manufacturers decide to be nice and offer IPv6 formware upgrades, and which ones push people towards new equipment.

Re:I'll move to IPv6

[radish]

OK, seriously...I'm using dd-wrt on my router and while I like it very much it is NOT a 10 minute job to install (particularly for the uninitiated). I'm not going to list my credentials here but suffice it to say I generally know what I'm doing - but it took me the best part of a day to set up, including figuring out which version I should be installing, where to get it, and how to install it. Just reading the giant FAQ threads on the forums (which I was told I had to do as the wiki pages were out of date) took much longer than 10 minutes. The actual install took a while too with all the hold this button, wait 5 minutes, press this, wait for this light to flash, etc etc. Then it was config, test, figure out why the wlan speed kept fluctuating, try another build, config, test, etc etc for the rest of the afternoon until I finally found a combo which was reasonably stable.

Now the OP mentioned OpenWRT, and maybe that's much, much better (it'd have to be!) but last time I checked that didn't support my hardware.

Re:I'll move to IPv6

[Anonymous Coward]

...but I don't have the time to fiddle with flashing a router right now

Ten minutes of your time is that expensive?

Look asshole, the problem is NOT lazy Network Engineers posting on slashdot, it's the 99.9% of the rest of the planet's population. YOU go right ahead and try to talk Grandpa Jones through flashing the firmware on his router. Keep in mind he thinks "double click" means "press the button twice as hard", and when his monitor won't turn on that it means the internet is "down".

Good Luck With That.

Re:I'll move to IPv6

[WaffleMonster]

Look asshole, the problem is NOT lazy Network Engineers posting on slashdot, it's the 99.9% of the rest of the planet's population. YOU go right ahead and try to talk Grandpa Jones through flashing the firmware on his router. Keep in mind he thinks "double click" means "press the button twice as hard", and when his monitor won't turn on that it means the internet is "down"

The number of $50 router vendors offering IPv6 firmware updates for routers that did not already come with IPv6 out of the box is likely to be very close to zero.

Re:I'll move to IPv6

[Chuck_McDevitt]

DD-WRT or OpenWRT firmware supports IPv6, so you can often convert your older router to one that supports IPv6.

Re:I'll move to IPv6

[goldarg]

Try one of these: http://www.roc-noc.com/product.php?productid=201&cat=4&page=1 or if you need GigE: http://www.roc-noc.com/product.php?productid=342&cat=4&page=1 .

It's not OpenWRT based, and it's not on NewEgg but they are very cool routers. I've used native IPv6 on them and used a HE.net tunnel with them without any issue.

Re:IPv6 is a Failure

[Xugumad]

IPv6 has been around since 1998 ( http://tools.ietf.org/html/rfc2460 ). That's Windows '98/NT territory. If Windows Server can't handle it, it's not because it hasn't had long enough to be tested in that configuration.

To address your ideas in turn:

1. Auditing by who? The first crisis with IPv4 allocation is the inability to allocate new chunks. Organisations with enough IPv4 addresses already aren't going to be bothered by this for a long time.

2. So... you're avoiding the cost of configuring networks to be dual protocol, by re-configuring servers... why is that necessarily cheaper?

3. Reclaiming IP addresses is akin to solving a lack of phone numbers for the NY area by claiming back some from a less populated state. It would rapidly lead to routing tables that are infeasibly complicated.

4. Again, you're suggesting an alternative way of investing time to solve a problem instead of solving it properly, and I'm not sure why this is inherently faster.

5. Possibly some variation on the SRV records, but... again, why is replacing every OS world-wide (absolutely nothing supports that, so everything will need upgrading) cheaper than enabling IPv6 on systems that are already out there?

Sticking with IPv4 means constructing an ever more elaborate set of workarounds on top of each other. For a while it will work, but I can't see the result remaining workable, or being cheaper in the long term.

Too little, too late...

[bertok]

There might be some pressure in the States to push IPv6 adoption, but there's none here in Australia.

Every consulting project I've been on in the last two years, I've asked this standard question: "Do you have a business requirement or mandate to deploy IPv6 now or in the future?"

Inevitably, the answer is "No."

Here in Australia, at both private enterprise and government, nobody has even begun to think about IPv6 at any level. Nobody requires IPv6 capability when purchasing software or equipment, and even when the capability is available, nobody turns it on. The more "IPv6 aware" clients turn it off to avoid compatibility issues. Even when I offer to implement IPv6 for some new system ("no extra cost, I'll just turn it on"), nobody wants it.

Pure IPv6 networking will be particularly hard to implement. I've tried experimental setups with products from various vendors. The usual result is that with IPv6 only most things work, but some things break. Stop and think about this for a moment: imagine if that sentence was: "the usual result is that with IPv4 addresses most things work, but some things break." That would be totally unacceptable for any enterprise software, yet it's "perfectly acceptable" for every major vendor to ship software where that's the situation with IPv6, because... nobody cares. The failures are often quite pathetic too, like dialog boxes that require an IPv4 address to be entered, even if it's never used or needed, or only accept IPv4 address for things like DNS servers. Clearly vendors have never tested their products in pure IPv6 environments, or did test them and decided it's too much effort to fix for something nobody cares about.

Let me whip out my crystal ball and predict that when IPv4 addresses run out and organisations scramble to implement IPv6, it's going to be a rush job, and we'll start hearing horror stories of incompetent admins that inadvertently bypass or break firewall rules by enabling IPv6 and cause major issues. These reports in turn are going to scare off management, who'll assume "IPv6 is bad", because they "read about some horror story of how Incompetent-r-Us Pty Ltd was hacked when they turned IPv6 on, hence, IPv6 must be insecure". Combined with stories of broken software and issues like IPv6-connected browsers waiting 30-60 seconds for IPv6 requests to time out, I'm certain that nobody is going to start using it until absolutely forced to.

It's a bad, bad sign that all the major websites like Google and Facebook have "ipv6.normalurl.com". That's because practical IPv6 implementations are often broken, and if enabled it on the main website, it breaks it for a huge fraction of users. If Google and their like can't implement IPv6 transparently without issues, and are forced to create "experimental" websites, then what hope does the typical admin have?

Re:Too little, too late...

[dakameleon]

Let me whip out my crystal ball and predict...

Come back in 6 months and you'll be able to start testing your predictions. We're down to 4 or 5 free blocks to allocate to the RIRs, and then they'll allocate onwards. Not that IPv6 is on any publically visible agenda, at least until this article came along.

That said, the internet we have today is largely a set of conventions based on patch jobs that were later formalised in the RFC process - IPv6 at least has been around for a while. Someone's going to make a lot of money out of this stuff - if you're halfway through a uni course in technology, make sure you pay extra attention in the networking classes (and if they're still talking IPv4, tell them it's the equivalent of discussing COBOL as a cutting edge language!).

Re:Too little, too late...

[FranckMartin]

check your facts: http://www.google.com/ipv6 it is native on Google...

And there is a quite active IPv6 forum in Australia, and AARNET is IPv6 for a long time...

Re:Too little, too late...

[NoExQQ]

The funny part is that if the top level peers said on date X we will only route IPv6 packets and the top level DNS root servers said on date X we will only respond to IPv6 queries, the net result would be an increase in job opportunities for small to mid level tech service companies. Sure, many ISP's would have to work to handle the change as well but in general I see it as an win / win. Perhaps if the government was serious about all this they would even throw monies to the states to cover the increased associated IT costs to get state services compliant. There are many positives that would come out of an IPv6 mandate.

Re:Too little, too late...

[Anonymous Coward]

Maybe Australia has that problem, but I know for certain that Verizon is switching their cell network to IPv6 to deal with the number of smartphones on the network. They're a client and have insisted that we have everything ready for IPv6 to connect with them by early next year. They'll do 6to4 on the edges and IPv6 internally. It's that or stop selling smartphones, since they're already NATing and have found that that solution doesn't scale well enough to handle the volume they need.

Re:Too little, too late...

[bkk_diesel]

The more "IPv6 aware" clients turn it off to avoid compatibility issues.

Interestingly, a google search for "how to turn on ipv6" has the first three results instructing me how to turn OFF IPv6, which seems to bolster your argument.

Re:Too little, too late...

[bertok]

check your facts: http://www.google.com/ipv6 it is native on Google...

Did you read all the way to the end? Where it says: "If your network meets these requirements and you'd like to receive Google over IPv6, please see our FAQ for how to request access."

In other words, it would be broken if enabled, and it's not enabled for everyone, unless access is explicitly requested by an ISP network administrator. I even tested this, take a look:

nslookup
> set type=AAAA
> www.google.com
Server: ####.#####.###
Address: 151.178.210.155

Non-authoritative answer:
Name: www.google.com

> ipv6.google.com
Server: ####.#####.###
Address: 151.178.210.155

Non-authoritative answer:
Name: ipv6.l.google.com
Address: 2404:6800:8004::68
Aliases: ipv6.google.com

In other words, the organisation that is likely the world's most competent "Internet host" in terms of pure technical skill had to develop a procedure to enable ISPs to dip their toe in the water and enable IPv6 access only if they're very very certain it won't break anything.

If that's the state of IPv6 adoption in 2010, mere months from IPv4 address space exhaustion, we're in big trouble.

And there is a quite active IPv6 forum in Australia, and AARNET is IPv6 for a long time...

Talk is cheap. There's no action, particularly in management.

Imagine if in late 1999, there would have been "active forums" for some techos to talking about "testing" the possibility of rolling out 4-digit dates just as soon as management approves it. Not too quickly though, because it might "break things". Meanwhile, the world's biggest banks have "experimental" 4-digit date support, if you open a new "test" account.

Re:Too little, too late...

[bertok]

The 6to4 system is effectively carrier-grade NAT. You can't say that they found that "NAT didn't scale", because the two technologies solve the same problem in practically identical ways.

Re:Too little, too late...

[Anonymous Coward]

In other words, the organisation that is likely the world's most competent "Internet host" in terms of pure technical skill had to develop a procedure to enable ISPs to dip their toe in the water and enable IPv6 access only if they're very very certain it won't break anything.

If that's the state of IPv6 adoption in 2010, mere months from IPv4 address space exhaustion, we're in big trouble.

In my view this is the single biggest problem facing IPv6 adoption.

My understanding the lions share of broken IPv6 issues were the result of MAC OSX behavior. There was recently a patch to preference IPv4 over automatic 2002:: tunnel (6to4 et al) addresses.

It does not universally solve the problem but does put a significant dent in the number of broken clients.

Re:Too little, too late...

[VTI9600]

If Google and their like can't implement IPv6 transparently without issues, and are forced to create "experimental" websites, then what hope does the typical admin have?

Forget about Google; What hope do admins have when Cisco and Juniper can't implement IPv6 transparently? I'm not sure if it was specifically their hardware that the military had problems with, but they're mentioned in the article so that would be the implication.

Re:Too little, too late...

[Anonymous Coward]

We also have Verizon as a customer (we're a HA data storage vendor). They've informed us that IPv6 support in our client apps and APIs within the next year or so is a requirement if we want to continue getting their business..

Re:Too little, too late...

[DeathSquid]

NAT is stateful, 6to4 is stateless. Nat multiplexes using port numbers, 6to4 tunnels but doesn't multiplex. Nat munges headers, 6to4 doesn't. Nat undermines global addressability, 6to4 adheres to this principle.

Yeah, they are practically identical.

Re:Too little, too late...

[smash]

Not sure where you've been looking but Telstra have a public "Transition to IPV6" document available after a simple google search. The Aussie government has a time frame of 2008-2009 for preparation, 2010-2011 for transition and 2013-2015 for "implementation" whatever that means.

Plans are most certainly afoot, I'm currently awaiting a response from my account rep, but he's just left for the christmas break.

Re:Too little, too late...

[smash]

Google results for unwashed masses dealing with technology problems != the list of valid solutions to technology problems.

Re:Too little, too late...

[bertok]

NAT is stateful, 6to4 is stateless. Nat multiplexes using port numbers, 6to4 tunnels but doesn't multiplex. Nat munges headers, 6to4 doesn't. Nat undermines global addressability, 6to4 adheres to this principle.

Yeah, they are practically identical.

My mistake, I was thinking of something else.

It's possible that you've confused your acronyms too, 6to4 is an IPv6 to IPv6 protocol that enables the packets to tunnel over IPv4, but it does not allow IPv4 to IPv6 communicatio. It requires a unique IPv4 address for each IPv6 endpoint, so it doesn't solve IPv4 address exhaustion. NAT and/or proxying is still required in some form, which will be carrier grade NAT in practice, with all of its inherent horrors. Most home users will be have a double-NAT, because of ADSL or Cable routers. I'd love to see the gymnastics required to establish a P2P connection across 4 layers of NAT.

Re:Too little, too late...

[anti-NAT]

Here in Australia, at both private enterprise and government, nobody has even begun to think about IPv6 at any level.

Are you sure about that? I suggest you check the dates in the PDF linked to at the following URL - http://www.finance.gov.au/e-government/infrastructure/internet-protocol-version-6.html

Re:Too little, too late...

[bertok]

Google results for unwashed masses dealing with technology problems != the list of valid solutions to technology problems.

But it's indicative of a real issue.

To enable a smooth transition of a huge number of people to a new technology, the transition has to be easy. It has to "just work". How many end-users had issues with the Y2K cutover? I bet not many had to "turn off 4 digit dates" to make their "computer work properly".

The problem with IPv6 adoption is that it has zero immediate tangible benefit, so convincing management at a corporation to cut over would be hard enough, but if enabling it causes problems, any problems, not matter how slight, it's impossible. Why would any mid-level suit-wearing paper-pusher risk breaking the entire production network to resolve a problem that doesn't yet impact the organization? It's instant career suicide!

There is not a single IPv6-only service anywhere that a corporation in the English-speaking world desperately wants. I hear there's free porn somewhere on IPv6 that someone uploaded as a "carrot", but there's free porn on IPv4 too, so I don't even see that as a serious motivation for anyone else either, even the horny technophiles at home.

Re:Too little, too late...

[DeathSquid]

I run 6to4 in my infrastructure so I speak from direct experience. You are correct in that it provides IPv6 connectivity over v4 transport. Furthermore it does nothing to fix v4 exhaustion. However I believe you are mistaken on two points:

1. You can have millions of v6 hosts sharing a single v4 endpoint. There is no one to one correspondence as you suggest.

2. None of these hosts (or the v4 endpoint) need run NAT of any description).

What 6to4 provides is an easy way for anyone with at least one v4 address to deploy entire v6 networks. No need for NATs or tunnel brokers or any cooperation from your ISP.

In the long run 6to4 will go away. When most ISPs support native v6 it will have served it's purpose. Right now, it is a key element to solving the chicken and egg problem of bootstrapping v6 in the real world.

6to4 is not "carrier grade NAT". It is a doorway into the v6 world where NAT of any sort is simply not required.

Re:Too little, too late...

[TheRaven64]

It wasn't just OS X. Vista, at release time, was advertising itself as a 6to4 gateway, even when it didn't have a public IP. This meant that any machine on the same NAT'd network as a Vista machine thought it had working v6 support, but actually didn't. Sit down in Starbucks with a Vista laptop, and everyone with a dual-stack network config would suddenly find that they have to wait for the v6 request to time out before they try the v4 connection (a minute for every page load? Wonderful!). This was later fixed (Vista now makes sure IPv6 actually works before advertising itself as a 6to4 router).

Re:Too little, too late...

[smash]

The benefits are coming.

As more and more people (read: suits) depend on constant access to email, the corporate network, etc when visiting other clients and plugging into their network, things like DirectAccess will lend support to the issue.

DirectAccess + an ipv6 enabled network internally means that your boss getting access to his email/files/ERP system are as simple as plugging into any old network and his group policy settings enable him to tunnel back into the corportate LAN. Seamlessly.

Thats the driver for IPV6 in the core, on your edge, as soon as potential clients are simply unable to access your services, it will happen.

Will it be next year? 2012? Who knows. But it is coming, and soon.

Re:Too little, too late...

[MrMarkie]

What's 2012 then?
Lunch break?

Re:Too little, too late...

[Neil Boekend]

The end of the world. You gotta take time for that :D

Re:Too little, too late...

[Abcd1234]

It wasn't just OS X. Vista, at release time, was advertising itself as a 6to4 gateway, even when it didn't have a public IP.

Hell, my 802.11n WAP that I bought just a couple *months* ago did this! POS... I had to flash it with dd-wrt to fix the problem.

Re:Too little, too late...

[Anonymous Coward]

You may not know it, but Victoria, Australia has a large IPv6 rollout which will climb to over 1M nodes (each power meter): SmartMeters. There is some IPv6 deployment, you just may not know where it is.

Re:Too little, too late...

[Anonymous Coward]

If you look at the average Google user, they're not technical enough to deal with it, and Google doesn't want to lose a single eyeball.

On the flip-side you can just turn it on and deal with it. The Fedora Project has enabled IPv6 and just post the Known Problems and tell users to how fix it for themselves.

We'll never get there if we never deal with turning it on. Google has done it the safe and cautious way. Fedora has done it the deploy and fix after way. The point is to just start getting it turned on.

Re:Too little, too late...

[smash]

This IS a series of government departments we are dealing with.

Re:IPv6 is a Failure

[Anonymous Coward]

Of course IPv4 isn't going away. The IPv6 address space is a superset of IPv4.

Re:IPv6 is a Failure

[Bengie]

Nearly all infrastructure has supported IPv6 for A LONG TIME. All major OS's have supported IPv6 transparently for the past 1-2 years. The only thing left is ISPs to set aside some of their huge cash flow and upgrade. If a company hasn't been preparing for IPv6 over the past 6 years, that's their own fault. Seems to me that any competent network admin thinks IPv6 is cake. It's all the people who are scared of learning something new that spread FUD.

IPv6 is almost the same as IPv4, except with IPv6, you don't have to worry about IPs, you can logically group IPs together and waste ranges to make things more logical.

Vendor sales answer

[FranckMartin]

"That's funny, this is the first time someone ask." wash, rince, and reuse

Re:IPv6 is a Failure

[Ultra64]

NAT is a desperate kludge that breaks end to end network connectivity thus preventing things like Skype, et. al from working without a centralized server.

NAT is bad and you are Hitler for suggesting it.

Re:Now if only the government would do that elsewh

[techno-vampire]

HTML was supposed to be a standard.

Standards are so wonderful, aren't they? After all, there are so many of them to choose from.

They ask in the RFP/RFI time, but don't install it

[(H)elix1]

In practice when I've worked with these guys (as a vendor) and been game on, lets install this in your IPv6 environment - things get quiet real fast. This is only about them trying to squeeze more from their budget dollars. They *have* software today that works in that environment. Guess what? They won't install it in anything but IPv4 networks.

That $400 hammer looks like a bargain when you deal with these folks. Sure, the engineering for the actual hammer costs $40, but all the other crap they 'want' the vendor to do does get added to the cost of the product.

Full of dumb...

Re:Oops. Off by a few orders of magnitude. B-(

[Anonymous Coward]

So there IS a purpose for NAT in the future...

Military is the trendsetter

[Spy Handler]

back in 1946 the military got rid of racial segregation, and opened up any post to anyone of any color. It took the rest of the government 20+ years to catch up.

How about the entire federal gov't follow the army's lead and REQUIRE ALL COMPUTERS, ROUTERS AND NICS BE PRECONFIGURED FOR IPV6 OUT OF THE BOX from all vendors by end of 2012, or they don't get a gov't contract. How about it, Nancy Harry and Barry?

Re:Now if only the government would do that elsewh

[erroneus]

Yeah, old saying is old.

It's not applicable to HTML, however. It is a communications/media interchange format. When one expects to read and interpret data of a particular format, it needs to work as it is claimed to be. It might be okay if the HTML headers came out to say "Microsoft HTML 1.0 specification" or something like that. Instead it all comes out claiming to be some other standard.

Re:IPv6 is a Failure

[markass530]

psssshhaw windows 7 supports it already.. slackers!

Re:IPv6 is a Failure

[c0lo]

IPv4 is here and is not going away.

Wanna bet on it?
(hmmm... who do I know in ..IAA? Maybe suggeting them to assign an IPv6 addr to each person - like the SSN - addresses to be tracked to individual persons? I bet they'll lobby it in no time, no matter it does makes no technical sense... since when making sense is necessary for business?... Fuck everything, We're doing 5 blades).

Re:IPv6 is a Failure

[FranTaylor]

Just take a look at the hair-pulling in mixed IPv4 and 6 networks with things like Windows Server.

I've set up IPv6 on Windows Server and it is quite simple.

Windows Server is actually the simplest operating system for IPv6. Really it just works. With RHEL and SUSE and Solaris you have to enable it and tweak some text files, but Windows Server is ready to go right out of the box. With DHCPv6 you can be up and running in literally seconds.

Re:They ask in the RFP/RFI time, but don't install

[MrQuacker]

Sure, the hammer costs $400. They pay the $40 it really cots to buy, and funnel the other $360 to a "Black Budget".

Stargates ain't cheap to run yo.

Let the military work ALL the bugs out or trash it

[Anonymous Coward]

I will wait until my ISP sends me the 'Or Else' letter

From wikipedia

IPv6 is largely incompatible with IPv4 at the packet level, and translation services have practical issues that make them controversial.[2]

IPv6 and IPv4 are therefore treated as almost entirely separate networks with devices having two separate protocol stacks if they need to access BOTH NETWORKS.

Sorry, I am not going to rush out and embrace this obvious clusterfuck.

Sounds like IPV6 is the Windows ME/ Vista/Edsel of network protocols.

Is the world waiting for some dumb schmuck to point out "The Emperor has no clothes" on IPV6?

OK, I'll Bite, THE EMPEROR HAS NO CLOTHES.

How come this is such a sacred cow? What is wrong with telling the packet geeks, NO! 'Back to the drawing board'. Enough already.

This article comes up every 6 months and nobody does nothing. It is obviously a dead issue. Are we going to see Bono and Melissa Ethridge for IPV6 next?

If windows 7 adoption is so slow because of legacy concerns, how is touching / replacing every box in the whole company going to fly?

It is not.

Re:IPv6 is a Failure

[Daniel Phillips]

Argument by analogy is a logical fallacy. That said, going to IPv6 is not like replacing a road with a bigger one, it is more like replacing all the roads in the country with railways.

Re:IPv6 is a Failure

[smash]

You're replacing the work of rolling out IPv6 alongside existing IPv4 with brainless NAT on NAT hackery to try and make things work.

And eventually we run out of NAT because the translation tables get too big/run out of ports and then we're fucked.

IPv4 needs to be phased out, this bullshit with NAT is only going to delay the inevitable and make a BIGGER problem for us to untangle in the future.

IPv6 gives us a nice clean, flat network that will work as the internet was originally intended. Further NAT bastardization won't.

Poor analogy - IP assignment not physical...

[l2b]

... and the 'poor planning' simile fits forced IP6 adoption far better than IP4 addy assignment audit/revision across the board.

The OP is right. Many organizations have large IP4 blocks that are not justified or properly utilized. I recently encountered a city hospital (!!) in northern NJ which has a PUBLIC IP4 ip for every floor. Pretty silly and exactly what the OP is talking about. Never mind the old A, B, C type allocations that have been left alone since old post ARPA days. If an organization wants a public IP4 addy, it should get only one and manage it properly. Yes that will take some work, but far easier than IP6 implementation.

The real IP6 motivation appears to be that Big Brother wants to be able to trace all traffic directly to a specific source host, which full IP6 adoption would make possible. IP6 adoption should be resisted by the free world on that principle alone.

Furthermore, you do realize that most IP4 and IP6 stacks are usually implemented separately, right? Considering that the US gov't is evidently still having trouble securing its IP4 based hosts, imagine how it is going to do with the challenge of securing them in an IP6 environment.

Can you say - come in - we are open, wide open, i.e. "Welcome, Chinese hackers..."

Re:Poor analogy - IP assignment not physical...

[Pi1grim]

Goddammit, Cartman
How is IPv4 in any way more secure than IPv6? NAT does NOT provide anonymity or security. It is crippled by design. The Big Brother you're so worried about will need to contact the ISP to get the info regarding the IP. He has to do exactly the same thing now, if you are hiding behind your ISP's NAT. Want to be anonymous? Use the anonimising proxies, TOR, i2p, hell, there is a whole bunch of solutions and NAT is NOT one of them.

Godwin

[Anonymous Coward]

There might be some pressure in the States to push IPv6 adoption, but there's none here in Australia.

You've just mentioned Australia in a context relating to internet access.
Consider the thread ended.

Those who do not learn from history...

[gavron]

GOSIP was supposed to require all US Federal agencies to support ISO's OSI stack, not TCP/IP.

Obviously that didn't work.

Twenty years later, and ONE branch of the US military thinks it can make a difference?
Sorry, US Navy.

Like everything else about the Internet, innovation will come from private enterprise. We don't mind accepting Federal money, but your contract lawyers and funky colored skittles won't change the Net. Oooh... piece of candy.

E
IP - written by Bolt Beranek and Newman (now part of Raytheon)
BGP - written by Cisco and IBM
ROUTERS - produced by Cisco, Juniper, Redback, and others
(in other words, while DARPA provided $$$, the real innovation wasn't done by the military or US govt.)

appliance support?

[chappel]

I'm a networking guy excited to play with some new tech, but I've been putting off converting my 'basement' network to IPv6 because sure, all the PCs (mac and linux) and routers (cisco and openWRT) will be easy, but what about all my legacy appliances? I check HPs website every 6 months or so to see if they've released a firmware update for my multi-function printer/scanner, but nothing. So far Polycom hasn't mentioned any support for their SIP phones, and Asterisk is still just dabbling with it - so far only SNOM and Yealink (and yealink only as of November) support IPv6 SIP phones (that I've been able to find), and SIP is supposed to be one of the IPv6 'killer apps', since all the hassle of transitioning NAT goes away. I won't even go into my mvix media player, chumby alarm clock, or nabastag wifi talking rabbit. Is it safe to assume the Wii doesn't do IPv6, either? I have yet to find an ISP that is even considering IPv6. I was impressed apparently the iPhone supports IPv6 since iOS v4, and that my folks Brother LaserJet (wifi/ethernet) supports IPv6, but I don't want to upgrade my printer just to not have to mess with dual stacks - I guess we'll get there eventually.

I'll start playing with dual stacks one of these days, but at the moment it doesn't appear to get me anything beyond novelty and geek cred.

Re:IPv6 is a Failure

[Junta]

IPv6 is completely incompatible with IPv4

With NAT64, an IPv6 only host can reasonably initiate connections to IPv4 servers. While guaranteeing a server may be reached by everyone still requires IPv4, mostly-client-only hosts can be IPv6 and enjoy the benefit of being on a true peer-to-peer capable network with respect to other entities doing IPv6.

Just take a look at the hair-pulling in mixed IPv4 and 6 networks with things like Windows Server

I have that set up, there really isn't anything special to it, my hair is intact.

weenies decided that we should be 'saved' from all of the mistakes of IPv4.

I kind of have to agree with you in part, they really really seemed reluctant to discuss NAT64 which should have been part of the conversation from the beginning. Also, they have mucked with a lot of other related technologies setting things back a long way, particularly DHCP. Standards are just now getting close to parity for most use cases in theory, though many established best practices still won't work as-is.

Your points 1 and 2 may continue to apply for servers seeking for universal exposure in the interim.

Point 3 would be a given *if* IPv6 can't happen (I finally think it can happen for most participants.

For point 4, carrier grade NAT I will only find acceptable if it is NAT64. If you advocate a world where a house has no public IPv4 address anyway, why not give the house IPv6 addresses and use NAT64 to get to the rest of the world? The ISP doesn't have to spare a rare IPv4 and the house still gets a 'real' address that allows similar residences to direct connect (for things like swarm downloading and gaming).

For ppoint 5, just... no. We are closer to having IPv6 as a usable solution than some awful hack like having the browser using SRV records for fully identifying a server location.

IT and computing people need to voice their workflows that still don't work and get through it so we have a sane IPv6 internet instead of a horribly broken IPv4 network.

Re:Let the military work ALL the bugs out or trash

[marka63]

I will wait until my ISP sends me the 'Or Else' letter

From wikipedia

IPv6 is largely incompatible with IPv4 at the packet level, and translation services have practical issues that make them controversial.[2]

IPv6 and IPv4 are therefore treated as almost entirely separate networks with devices having two separate protocol stacks if they need to access BOTH NETWORKS.

Sorry, I am not going to rush out and embrace this obvious clusterfuck.

You really should be asking your ISP why they failed to deliver IPv6 to you for the last 10 years. It's not like this is new technology. I've been supporting IPv6 in the products we ship for over a decade. I've been using IPv6 at home for 7+ years.

Sounds like IPV6 is the Windows ME/ Vista/Edsel of network protocols.

Is the world waiting for some dumb schmuck to point out "The Emperor has no clothes" on IPV6?

OK, I'll Bite, THE EMPEROR HAS NO CLOTHES.

How come this is such a sacred cow? What is wrong with telling the packet geeks, NO! 'Back to the drawing board'. Enough already.

This article comes up every 6 months and nobody does nothing. It is obviously a dead issue. Are we going to see Bono and Melissa Ethridge for IPV6 next?

If windows 7 adoption is so slow because of legacy concerns, how is touching / replacing every box in the whole company going to fly?

It is not.

Just turn it on in the router and most of the rest of the boxes on the network will auto configure themselves. Go on. I dare you to turn on IPv6.

Maybe there is another way

[fotoguzzi]

Maybe the military could just specify IPV6 and not act like douchebags to the salesmen that have to stop by.

Re:Let the military work ALL the bugs out or trash

[Alioth]

What a load of BS. Dual stacks is not at all hard, it's easy, and transparent and just works.

I turned on IPv6 on at home and on the development network at work. Everything which does IPv6 autoconfigured itself, Windows PCs, Linux PCs, Macintoshes, even my damned iPhone autoconfigured an IPv6 address, and it all *works*. IPv4 only services work, and IPv6 services work. It's easy. Both "legacy" IPv4 is supported and works, and the new IPv6 works.

Re:IPv6 is a Failure

[TheRaven64]

When I was a student, one of my housemates was using IPv6 with Windows XP and a tunnel broker. This was with Windows XP in 2002/3 (back then it required you to download an add-on from Microsoft, I believe it was later incorporated into a service pack). If a network admin can't configure IPv6 under Windows now, I'm sure there are lots of recent graduates who can and would be happy to take his job...

Re:IPv6 is a Failure

[Pi1grim]

Convince Facebook, Twitter and Google to provide services in IPv6 only and it will be a matter of days, before all the ISPs switch over.

Re:IPv6 is a Failure

[Neil Boekend]

Damn, why did you have to do that? Now the pro-IPv6 side has lost!

Re:IPv6 is a Failure

[docwatson223]

X, as a Network Architect, I agree with your assessment but the fact remains that we've been down this road how many times now - four or six? - and no matter how much someone 'pushes' IPv6 it's a nonstarter without a 'killer app'. Now if they could do P2P sharing...

I have discovered the reason for _car_ analogies!

[jonaskoelker]

Your post makes me salivate. That makes me scared :(

You want rice?

[jonaskoelker]

(If anyone wants to send me even a single IPv6 /64 network worth of pennies, please email me for contact information.)

Not exactly, but I have this chessboard, you see...

But... I thought that was a good thing

[jonaskoelker]

Sticking with IPv4 means constructing an ever more elaborate set of workarounds on top of each other.

Think of it this way: IPv4 creates jobs!

Re:But... I thought that was a good thing

[FoolishOwl]

Fallacy of the Broken Window FTL!

A pro-teach-them-IPv4 argument

[jonaskoelker]

make sure you pay extra attention in the networking classes

I recently TA'ed a $Something and Networking class. We did IPv4, TCP/UDP, a bit of ARP. I gave pointers to out-of-scope practical stuff to my students (DNS, DHCP, RFCs @ IETF, ...).

I think we were quite justified in teaching this, because this is the technology the students will most likely be faced with---and because it teaches networking principles reasonably well.

(YMMV, FWIW, BLAH)

Re:IPv6 is a Failure

[segedunum]

IPv6 has been around since 1998 ( http://tools.ietf.org/html/rfc2460 ). That's Windows '98/NT territory. If Windows Server can't handle it, it's not because it hasn't had long enough to be tested in that configuration.

You missed the point and you kind of answered it with that. People don't rip out network infrastructures that will merely make everything work as it did before, at best. It simply doesn't happen. That's why nothing has been done with IPv6 and it should have been a clue to those pushing for its usage that it wasn't going to work.

Auditing by who? The first crisis with IPv4 allocation is the inability to allocate new chunks. Organisations with enough IPv4 addresses already aren't going to be bothered by this for a long time.

Yep, and if you can't demonstrate that you're using them then you'll get them taken off you. I fail to see why organisations that have been efficient with their use of IP addresses should be penalised.

2. So... you're avoiding the cost of configuring networks to be dual protocol, by re-configuring servers... why is that necessarily cheaper?

Application support for IPv6 is as thin on the ground as it is, and for IPv6 it will be a hard prerequisite. That's a lot of rewriting no one is going to do.

3. Reclaiming IP addresses is akin to solving a lack of phone numbers for the NY area by claiming back some from a less populated state.

Hmmm, no. That's silly. It's reclaiming phone numbers from people who already have several and don't use many of them.

4. Again, you're suggesting an alternative way of investing time to solve a problem instead of solving it properly, and I'm not sure why this is inherently faster.

Solving something 'properly' in computing means starting all over again. I repeat, this is not going to happen.

5. Possibly some variation on the SRV records, but... again, why is replacing every OS world-wide (absolutely nothing supports that, so everything will need upgrading) cheaper than enabling IPv6 on systems that are already out there?

Supporting IPv6 is about more than an OS being able to accept a IPv6 address. Application support is required regardless. I know people like to tell us that IPv6 support is widespread, but it really isn't.

Re:IPv6 is a Failure

[segedunum]

They don't. Why? Because it's a lot of huge effort for nothing.

Re:IPv6 is a Failure

[segedunum]

Whether I or you like NAT is neither here nor there. When you have a vast amount of infrastructure you keep the thing running in the form that it is in, and the perfect solutions you didn't think of are neither here nor there.

Re:IPv6 is a Failure

[segedunum]

I repeat, you do what is necessary to keep hard infrastructure working. You don't expect people to replace it, and so far that hasn't happened at all. I wonder why.

Computing people have this vision that you can start again with something nice and 'clean' and pink ponies will run free through meadows. In the real world this doesn't happen with infrastructure that you rely on. People pay once for it and expect it to work for at least decades before anything major is done.

Re:IPv6 is a Failure

[segedunum]

I have that set up, there really isn't anything special to it, my hair is intact.

I thought I'd made this clear? Do this on a network with hundreds or even thousands of servers, routers and network equipment and then try and maintain a certain amount of forwards and backwards compatibility - with applications that can't afford to be down for any length of time, no less.

People are just not understanding what's required here.

Are ISPs going to implement proxy servers?

[Marrow]

Has there been any chatter that indicates that the ISPs will be implementing ipv6 over ipv4 servers at their borders?

Modded funny already, but

[sean.peters]

... in the unlikely event this wasn't meant to be a joke: IPv6 would provide sufficient addresses to provide each of the 7 billion people on earth 5 x 10^28 addresses. I've also heard it said that IPv6 would provide enough addresses to assign one to every atom in the observable universe (can't confirm that one, though).

So, to answer your first question: IPv6 addresses will be sufficient for pretty much forever.

Re:IPv6 is a Failure

[Chuck_McDevitt]

All modern versions of Windows (desktop or server) fully support IPv6. I have it, I use it, and it works. Of course, it works for my Linux and Mac boxes too.

Mod Parent Up

[Abcd1234]

This is a solved problem.

Why are people bitching about an issue that's been long addressed? I mean, there are a lot of reasons to complain about the way IPv6 was spec'd and implemented (why the hell did it take the IETF so fucking long to realize NAT64 was necessary??), but this certainly isn't one of them.

Re:Mod Parent Up

[arth1]

No, it's not a solved problem. Only parts of the IPv6 address gets changed with privacy extensions. I.e. it's good enough to hide which host on a LAN it is, but not good enough to prevent fingerprinting.

Re:IPv6 is a Failure

[Bengie]

they don't *only* support IPv4.. but they all do support IPv6. I can completely disable IPv4 and still P2P/Google and a few minor other things. Now we just need more web sites to support IPv6 so I can leave IPv4 disabled.

Re:IPv6 is a Failure

[Bengie]

I can plug any fresh install of Win7\Win2k8R2 into my cable modem and get IPv6. ab-so-lute-ly nothing to setup/configure. I can even disable ipv4 and still get google and a few other sites.

Re:IPv6 is a Failure

[Agripa]

Application support for IPv6 is as thin on the ground as it is, and for IPv6 it will be a hard prerequisite. That's a lot of rewriting no one is going to do.

The three applications I regularly use with native IPv6 support are Firefox, x-chat (IRC), and uTorrent. I use a IPv4 to IPv6 port proxy so my IPv4 usenet client can access a couple of IPv6 NNTP servers.

As usual, piracy and porn are leading the way.

Re:IPv6 is a Failure

[badkarmadayaccount]

You do realize that you need inbound client connectivity on the network - SRV isn't going anywhere.

D-Link DIR-615: $24 (USD)

[FoolishOwl]

The D-Link DIR-615 has IPv6 support. I've been using it for IPv4 and IPv6 for almost a year. The current price on Amazon for the D-Link DIR-615 is $23.99.

I bought one at Office Depot for $50. It was the cheapest router they had.

FFS, just deploy IPv6 already!

[FoolishOwl]

A common shtick in third-rate science fiction is that when the crisis hits, the civilian government is busy pretending there's no problem, when the military heroes save the day. Like a lot of other people posting here, I'm not used to endorsing the military strong-arming anyone, but in this case, I'm relieved to see someone with some authority actually taking the problem seriously.

We've got about 58 days left before we run out of assignable IPv4 addresses. IPv6 has been ready-to-go for years, except for the ISPs, which are dragging their feet. Yes, I know about Comcast's beta testing -- I signed up to beta test dual-stacking over a year ago. They should have been rolling this out years ago, not running a tiny beta test at a glacial pace at the last moment.

I'm not sure how serious a problem suddenly running out of assignable IPv4 blocks will be for the global economy. It's certainly going to be a serious problem for IT. Continued expansion of the Internet, and services based upon it, depends upon IP addresses being available. A lot of us remember the comic overreaction to the Y2K problem -- in this case, there seems to be a comic underreaction.

Re:IPv6 is a Failure

[FoolishOwl]

It's a small effort for staying in business for more than one more year.