Slashdot Mirror
If You Think You Can Ignore IPv6, Think Again
wiredmikey writes "Now that the last IPv4 address blocks have been allocated, it's expected to take several months for regional registries to consume all of their remaining regional IPv4 address pool. The IPv6 Forum, a group with the mission to educate and promote the new protocol, says that enabling IPv6 in all ICT environments is not the endgame, but is now a critical requirement for continuity in all Internet business and services. Experts believe that the move to IPv6 should be a board-level risk management concern, equivalent to the Y2K problem or Sarbanes-Oxley compliance. During the late 1990s, technology companies worldwide scoured their source code for places where critical algorithms assumed a two-digit date. This seemingly trivial software development issue was of global concern, so many companies made Y2K compliance a strategic initiative. The transition to IPv6 is of similar importance. If you think you can ignore IPv6, think again."
Until my home ISP or the ISP for the company I work for offers IPv6, I think it's going to be very easy to ignore IPv6.
"I use a Mac because I'm just better than you are."
The world, it will end
The world is how you make it
Yup. And realistically, although its not something to be proud of, there's too much money for everyone in continuing to work with IPv4 addresses for years now to force anyone over the wall to IPv6 only.
Its probably going to come down from on high - want any new routable IPs? Your ISP will force you to be fully v6 compatible. Why? Because their upstream is doing the same to them...
In the next 6-24 months though, expect a remarkable amount of horse-trading of large IPv4 blocks.
You're special forces then? That's great! I just love your olympics!
Not so fast:
http://cr.yp.to/djbdns/ipv6mess.html
http://marc.info/?l=openbsd-misc&m=128822984018595&w=2
No big deal if an equivalent amount of timely effort is put into it. In other words, It'll be what Y2K would have been had we done nothing.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
if IPv6 is "a board-level risk management concern", then I certainly can safely ignore it, and so can pretty well every Slashdot reader.
for my damn IP numbers! I am not falling victim to this left-wing liberal conspiracy to artifially inflate the price of my IP numbers, the fuel of my business! There is no such thing as a global shorting of IP numbers, the scientific evidence is completely subjective and there is no hard evidence whatsoever, no measurements, of a global shorting of IP numbers . Everyone that needs one has an IP number, and there are plenty more. I myself have 192,168,000,023 IP numbers for use just here in my company. This in nothing but a left wing media conspiracy against the working people to take away our god-given constitutional right to IP numbers in black helicopters.
Build your own energy sources from scratch. http://otherpower.com/
Do we really need to have 3 ipv6 article a week on slashdot. I believe every single slashdotter knows and understands what the problem is about. So I suggest the editors to skip all the articles about "how my god we need to move to ipv6 FAST",
VRF for an IPv4 Internet Part Two anyone??????
Service guarantees Citizenship! Questions Guarantee GITMO.... Amerika Uber Alles!
It'd barely make any difference as you need contiguous blocks and the rate at which we're using them means that even reclaiming whole /8 blocks only extends the life of IPv4 by a few months at best.
I finally found the group responsible for IPv6 at my company, and asked about our readiness. now keep in mind, we don't need to wait for an upstream provider as we are the upstream provider, with many peering agreements in place.
The answer I got back basically amounted to two things:
1) nobody else is ready, so we don't need to be either.
2) it's not legally mandated, so it's not important.
I'm so glad we pride ourselves on our ability to innovate...
Qwest has taken care of the IPv4 exhaust issue for our residential customers at the ISP level. We are implementing the capability to communicate with contacts at both IPv4 and IPv6 addresses. This transition will be transparent to Qwest residential and business customers.
I'm not sure if the transition can actually be transparent since at a minimum I'll have to do something with my TCP/IP so it knows that IP6 is there, and from the looks of it my Modem doesn't support it ether without maybe a firmware upgrade.
If you completely ignore it, isn't it likely you'll continue on with no adverse effects? I thought VP4 would continue to work with no tweaking necessary, as long as you're not using broken equipment.
But we all buy and acquire equipment. Getting a wireless router for your home, maybe you should check the specs a bit more closely now. Buying a set top DVR? You might want to do the same. Trying to decide if your old computer needs an OS update? Some will never have IPv6 support.
For end users these are concerns that could bite them down the road. For corporations, these are the kind of acquisition failures that will cost millions down the road.
I can double the number of IPv4 addressable machines.
UDP and TCP ports 1-512 will now be one machine, and ports 513 and higher will be another machine.
A massive undertaking by programmers worldwide in order to prevent a catastrophic meltdown. Completed just in time in a way that's transparent to the rest of the world, making it seem like no big deal.
Yeah, actually it'll probably be quite a lot like Y2K in that sense.
How are sites slashdotted when nobody reads TFAs?
The nice part is, unlike Y2K, is that there's no hard drop-dead date by which all work has to be done and all of a sudden there's a bunch of folks laid off. IPv4 can be a looming threat for years to come! Huzzah!
More Twoson than Cupertino
Yes we know.
Major ISP's are just now getting the ball rolling. Client software is still being perfected. The bridges for early adopters are known to be flakey. Talk to the people working on that stuff (oh, wait, you don't need to, they're already underway).
Most readers here will move along when the infrastructure is ready. We know the address space is effectively out but there's little reason to do much at this point, and anybody trying to push people to adopt IPv6 before the tools are robust is kidding themselves.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
The former is a tad old and mostly fixed by NAT64.
On second:
they created a totally new problem by avoiding arp. the
benefit of their layer-2 discovery mechanism has been
absolutely zero; the best unit of measure for the cost of
that decision is "decades".
ICMPv6 neighbor solicitation at *worst* case 'degrades' to ARP-type behavior. In very well behaved layer 2 networks (almost none, admittedly) it greatly reduces load at large scale of system. I don't see why avoiding ARP costs 'decades'.
they created an entirely new and huge problem (destroying
SIOCGIFCONF backwards compat hurt IPV6 deployment in operating
systems on a massive scale) by not making their sockaddr be
a power of 2 in size.
I still haven't heard anyone explain why that is so catastrophically bad. It may be, but in practice, I haven't seen how this afflicts me.
Now I will complain that they changed some fundamentals around DHCP (DHCP at all being a near afterthought as they magically thought route advertisement, stateless addressing, and mDNS would be the cure for *EVERYTHING*). However, most of it is probably going to fall into place as soon as more practical deployments start (currently, most v6 trials that end in failure cause people to just walk away from now instead of trying to push fixes.
XML is like violence. If it doesn't solve the problem, use more.
Your first link dates from 2003, and therefore I cannot do anything but ignore it. Especially since you don't specify what part you're aiming at... As to what your other link is concerned, Theo de Raadt usually knows what he's talking about, but, he also likes to troll anybody he doesn't like. His post basically says that he doesn't like implementing an arp alternative. His other point simply means it may be a bit more difficult if you assumed all socket addresses would only ever be to the power of 2. That's his fault (hate to break it to you, theo also isn't perfect), he was the one who made the assumptions. Lastly, the problems he describes are about how to implement them in Operating Systems. Since all major OS's now have ipv6 support, I cannot see that being relevant. As for merely posting 2 links without any text: troll?
... the one where by far most of the people, even if you go just to the IT ones, ignores even what is IPv6. How many isps or carriers now are giving ipv6 as an option? Probably the most common policy now is "lets wait till everyone else already took the first step before moving a finger" (later it will be "let all scream and run in circles")
I really wouldn't go into board rooms and mention Y2K. The general public seems to think that there was nothing there and it was just a big hoax. I'm sure all of you have encountered this recently too. A few times recently I had to correct people who said something like "That Y2K thing was no big deal". My answer to them was "It was no big deal because people worked for 5-10 years to fix it, otherwise it would have been a big deal". But you all know that.
But if you want to be dismissed as a panic monger, bring up Y2K, otherwise, don't.
Everything has mistakes built in. But DJB's article (aside from being 9 years old) simply boils down to "but who will implement it if it's not widely implemented?" The whole point of implementing it is that it'll get more widely used. That OpenBSD mailing list message was marginally more interesting, but boiled down to "it messes up my struct!"
I don't understand all the IPv6 hatred. IPv4 is not tenable (which can't really be argued otherwise), and even somehow extending the current address space would break everything anyway, so why not just do it right?
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
is when desperate (or "innovating") ISPs decide to jack up the rates on static blocks. Companies that have a static /24 will see the rate to lease that block double overnight. Then if you're only REALLY using a few dozen of them, giving some of that back is going to look really attractive. Did I say double? how about x16? if you can live with 29 usable instead of 253 I bet that's an offer many can't refuse.
I've got a block of 8 myself (5 usable naturally) so I think I'm safe from the vultures for awhile. But they're also probably going to want to start pooling people inside their /24's. As it is right now I have my own network with my own router. That's 3 of 8 addresses being somewhat wasted, and I bet they don't overlook that. If the entire /24 I'm in is carved into 32 chunks of /29's, that's 93 (32*3-3) more IPs in that block alone they could resell by consolidating gw/br/net. (/29 is admittedly quite a waste of IP space) Maybe I DO need to start worrying?
I work for the Department of Redundancy Department.
Nothing helps drive a wedge between people and their money than a fear incessantly pounded into their brain like a rusty nail.
IPv6 caper should help pay off the mortgage. Then 2038 should set me up quite comfortably for retirement.
You have a link local address AND a different global address. It's the global address that will be routed.
Link local addresses are useful locally. There's even a link local system for IPV4 but hardly anyone seems to know about it. From Wikipedia and various RFCs - "In IPv4, the block 169.254/16 is reserved for this purpose, with the exception of the first and the last /24 subnet in the range. "
At least before home users can care, is a good 4 to 6 translation system. What I mean is let's say your ISP goes IPv6 and your cable modem gets just an IPv6 address. If you have a newer computer (Vista or newer, newer OS-X releases, etc) it'll just work. It can have its own public IPv6 address and everything is great.
However, what do you do about older stuff? I'm not just talking older computers, which possibly could be upgraded, but I'm talking older devices, which can't. My AV receiver is a networked device, but it only supports IPv4. I don't think that can be changed, I think that's all its DSP can handle. Even if it can, it probably won't be since it is an older model. So I still need to use that.
Well, the thing to do is have the cable modem handle it. Have an IPv4 DHCP server, IPv4 gateway, and internal IPv4 DNS server and all that in private space. Then when an IPv4 computer requests something, the DNS server gets the AAAA record and the real IPv6 IP. It translates that to a fake IPv4 IP and hands that to the computer, and handles the translation. More or less a system similar to NAT (or a stateful firewall of some types).
That way IPv4 devices can continue to work, there is no problem with going 6.
So far I've seen nothing along these lines. Everything keeps being "Add IPv6 to an existing IPv4 network!" Ya, ya ok that works in some cases but if the issue is running out of IPv4 addresses, that isn't the long term answer. The answer is to make routers that'll let IPv4 devices talk IPv6 without them knowing. Likewise you have a 6-to-4 tunnel at the ISP if you need to communicate to old 4-only networks.
The IPv6 move is not like Y2K. With Y2K there was a firm deadline when everything had to be re-coded, tested and ready, or else. With IPv6 it's more like the introduction of fax machines. You only need a fax machine if you want to communicate with someone else who also has a fax machine. Since around 98% of the Internet is still using IPv4 no one is going to want to be the first to stick their neck out and embrace IPv6. If everyone you want to talk to is on IPv4 there is no reason to migrate yet.
How are we supposed to roll out IPv6 without NAT? Can someone explain, and without RANTING about how NAT is unnecessary?
Think about it. Let's say I set up my company with link local addresses. IPv6 forbids NAT on routers and firewalls. So how are my hosts going to talk to the Internet? Specifically, if I have a link local address of fe80::/10. That's not going to be routable from the Internet. TCP is two-way traffic, so the servers need a return route to me. How is this accomplished with NAT?
NAT is necessary so the ISP can send traffic back to my summarized address. I don't understand how this works when they forbid NAT. Someone please kindly explain how that works.
Sorry to rant at you and not answer your question.
Have we stopped learning/teaching about routing, forwarding and firewalls because the magic NAT box does all of that for us? This is a sad state for the world of networking that such a question must be asked.. repeatedly... by people who should know better.
The idea that NAT will go away just because a network is IPv6 is a pipe dream. No sane security admin would ever allow that. The idea that the firewall is the only thing between you and the outside world is, and should be, a non starter.
IT security is all about multiple layers, and one of them is the fact that you have a DMZ between you and the internet, and that the internet can't route outside of it. That is not going anywhere.
Look, I don't want to be disrespectful to you as a person, but your understanding of network security is... limited. What the fuck does having a DMZ have to do with NAT? It's true that NAT is how the most common way to configure a segregated v4 network, but if you think that NAT is the only (or even the best) way to handle this, you're sorely mistaken.
This may strike you as heresy, but you can construct your network with public-facing addresses, a DMZ and a network of addresses inaccessible from the outside world (except under prescribed circumstances)... all using public IPv6 addresses. The secret is... wait for it... don't fucking route to them, except when you decide it's okay.
The simplest way to do this would be simply to refuse connections originating from outside your network for a designated subnet. Hey presto! All the benefits of NAT without the insanity of NAT!
My employer, a university with campuses in 12 countries, does this already with a public IPv4 block. Last I checked, it was working just fine, thank you very much.
P.S. Yes, we're IPv6-ready.
Crumb's Corollary: Never bring a knife to a bun fight.
The big mistake was not making mobile IP devices IPv6 from the beginning. Even if they had to go through a NAT at the telco. Most of the growth is in mobile devices.
Fortunately, most mobile devices respond to updates pushed from the carrier. So mobile carriers need to be encouraged to implement that transition. Carriers are in a good position for this, since they control both ends of the air link. Some of this must be happening already.
I had to google Sarbanes-Oxley compliance. Never heard of it before. Apparently it's some sort of irrelevant foreign legislation regarding accounting. How they managed to equate that to the hard technical limits like Y2K and IPv6 is beyond me.
When our name is on the back of your car, we're behind you all the way!
How are we supposed to roll out IPv6 without NAT? Can someone explain, and without RANTING about how NAT is unnecessary?
Ok, not a word about NAT.
Think about it.
I am thinking.
Let's say I set up my company with link local addresses.
You will not. Link local address is something every IPv6 interface has. You can use to communicate with other hosts on the same ethernet segment. You can not use it for communicating with the internet at large.
IPv6 forbids NAT on routers and firewalls.
It does no such thing. However nobody has bothered implementing NAT (sorry I said the word) on IPv6. I am sure someday somebody will but few will use it.
So how are my hosts going to talk to the Internet?
The minimum subnet size an ISP can assign to a customer is a /64 giving you 2^64 unique IP addresses you can distribute among your computers. In fact, your computers will pick up the prefix (the first 64 bit) from the router and then select the last 64 bit automatically. You will not have to do anything, it will just work.
Specifically, if I have a link local address of fe80::/10. That's not going to be routable from the Internet. TCP is two-way traffic, so the servers need a return route to me. How is this accomplished with NAT?
I assume you are asking how it is accomplished _without_ NAT. You are confused about link local addresses. Those are not generally something you will be using. Your computers will get the first half of the IP address from the router and it will make up the last half by using your MAC or by random. All your computers will have unique public IP addresses. Since your computer already has a public IP address there is no need to translate it to something different by NAT.
NAT is necessary so the ISP can send traffic back to my summarized address. I don't understand how this works when they forbid NAT. Someone please kindly explain how that works.
You are assuming you only have one address. In fact you will have a minimum of 2^64 addresses. The ISP only needs the first 64 bit of the address to route it back to you. The last 64 bit is handled internally on your network. If you insist, you could say the first 64 bit is your "summarized address".
There are some ISPs that are starting off with just a single /64 (e.g. Comcast's trial), because they've got some equipment or management software that's not bright enough to handle more complex routing than that, but the general consensus is that businesses should get /48 and residences should get at least /56. That not only allows for a couple of subnets (e.g. wired, wireless, uplink, DMZ), but it also lets you use relatively dumb routers that handle subnets by cutting their address space in 2-4 pieces, and you can stack a couple of those.
I have heard of one ISP that's only allocating a /60 for residences, but IPv6 has enough address space that most people think it's worthwhile wasting some of it to get addresses aligned on byte boundaries and not mess with nibble-aligned, much less single-bit-aligned.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Facebook, 4chan, digg, slashdot, reddit, and redtube make their sites accessible by ipv6 only (and not through v4 to v6 tunnels.) :)
They take a hit in traffic for a little while, two weeks later, every ISP is giving out ipv6 addresses and every ancient router and pc is upgraded.
Even if you switch to a pubic IPv6 address, all your internal stuff will still be IPv4. My home print server and IP telephony adapter are all IPv4. The problem with IPv6 is that you can't entirely switch to it and just shut down IPv4. You have to run dualstack for the foreseeable future. That's why every IT consultant and IT manager and CIO I've spoken to says they don't give a crap about IPv6 because every adopter of IPv6 will have to be backward compatible with IPv4 so why bother running dual stack. Even after all the addresses are assigned, not a single IPv4 device or network will stop working.
The choice is between IPv4 single-stack or IPv4/IPv6 dual-stack. Given those as the only choices, people are choosing the former instead of the latter. There is no possibility of running IPv6 single-stack. IPv6 will essentially become the new "private IP addresses" that have to translate to "public" IPv4 addresses used by 99% of the IP devices in the world. The only difference is that IPv6 devices will be able to talk to each other without a NAT across organizations.
Look, you're getting a subnet that's big enough for just about anything you can imagine doing at home, not just the things you can actually figure out how to do. If you're like to split your /56 into 256 different subnets and do different things on them, go ahead. You can do that without breaking the end-to-end principle.
NAT breaks stuff right and left today, for two main reasons
- lots of protocols, including FTP and newer protocols, put the IP address inside the data packets, not just in the packet headers, and doing NAT properly requires ripping the packets apart, changing the addresses, and fixing up any checksums that got damaged in the process. It's even worse if you've got protocols that use crypto, either for information hiding or just simply for authentication. It's very hard to get them right, especially if people design protocols the firewall doesn't know about.
- stateful NAT makes it hard to establish connections through the firewall. Sometimes this is intentional, blocking unwanted connections for security reasons, but if two people behind NAT want to communicate, neither one can talk until the other one has talked to them first. There are products like Skype that are popular because they go to a lot of trouble to work around the different broken NAT implementations out there.
Putting a firewall box in front of your computers isn't a bad thing - you just need one that's IPv6-aware instead of IPv4-only. You're not getting the security from NAT, you're getting security from having a stateful packet inspection box in front of your computer, and that's not going to change. If you want to offload packet inspection from your 2GHz CPU down to your 200 MHz SOC-based firewall, go ahead; about a quarter century ago, Van Jacobson figured out how to tune the BSD TCP/IP stack so you could do wire-speed file transfer on 10 Mbps Ethernets using a Sun 3/60, so you should have plenty of spare CPU horsepower left to inspect your packets.
There's no particularly good reason for your computer to look like a single computer to anybody outside your network, and simple address-munging isn't enough to solve the problem. My laptop has different addresses depending on where it's plugged in, home, work, coffeeshop, etc., and the address isn't enough to tell them anything definite. When I'm at work, I occasionally have trouble reaching sites because many other users behind my corporate firewall are accessing them at the same time, so they want me to do a CAPTCHA to verify I'm not a bot abusing their system. However, if anybody does want to track your address, with IPv 6 they'll probably do it by tracking your /56 or /48. Also, there's the IPv6 address privacy mode, which lets your computer use a different host-part address on every connection, so it's not using the same MAC address every time.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I've been running IPv6 on my home network and have had IPv6 tunneling running through HE.net for the past year.
My Apple Time Capsule allows IPv6 tunneling and allocates addresses to my machines on the network for me. I even set up a AAAA record in my DNS service to allow people to see my personal web site over an IPv6 address.
I can hold up my hand and say that I'm ready to go as soon as my ISP gets off it's butt. It will be nice to be able to shut-off all that annoying NAT crap some day!
There are other ways to find the machines on your subnet besides scanning, though it is nice that scanning will become harder. If you've got a known brand of ethernet card, there are only 24 bits worth of possible MAC addresses, and what's 16 million scanning packets between friends? Multicast works by default, though your firewall might block it, and they can still do phishing to get you to go to their web page so they can get your address. (IPv6 address privacy mode is a Good Thing, though corporate networks might block it internally so they can track which machines are doing what for auditing and debugging purposes.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
If your biggest problem is a trivial matter of notation you must be pretty happy with it.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
"The secret is... wait for it... don't fucking route to them, except when you decide it's okay."
Which is all very well and good, but that requires that everyday people learn how to configure routers to do that. Guess what? That ain't gonna happen. People want a plug-and-play solution, not one where they have to learn crap they don't care about when all they want to do is read email or browse the web.
Which, believe it or not, is all that a *VAST* majority of people do.
When people want more, they can either use another globally visible IP, situating the device on the global side of their NAT, or else they punch holes in their NAT if they can't get another IP address. With IPv6, there will simply be no need for the latter. That doesn't mean that NAT wouldn't be useful.
File under 'M' for 'Manic ranting'