IPv6-only Hosting Won't Make Sense For Years

rawagajah writes "World IPv6 Day this Wednesday will shake out any bugs for websites running on IPv4 and IPv6 in parallel. However, cloud server provider ElasticHosts points out that IPv6-only websites are still a long way off — they only make sense after access is overwhelmingly IPv6 capable. In the meantime, the market in IPv4 space will presumably only grow, benefiting the IPv4 hogs..."

Comments

Slashvertisment please

[Anonymous Coward]

Some cloud unstart makes a blog, and the blog entry gets slipped in as a "story".

FUCK OFF PLZ.

SNI and other alternatives

[memyselfandeye]

This is why I generally support the big guys, Google et. all, when they go out and state they will no longer support older browsers. Not only is it good for security and designers, but it's good for server admins. With apache2 and IIS supporting SNI on all browsers, except XP SP2, it's time to move on. I really don't feel like playing the domain games of yesteryear with IP addresses.

2.5 cents

Re:SNI and other alternatives

[petermgreen]

This is why I generally support the big guys, Google et. all, when they go out and state they will no longer support older browsers.

The problem as I understand it in the case of IE is that MS considers the SSL implementation to be part of the OS not part of the browser and as such they won't implement SNI in IE on XP.

People are far more reluctant to upgrade their entire OS than to merely upgrade their browser.

Re:SNI and other alternatives

[hairyfeet]

But frankly we wouldn't be having this problem if the US and other government would step in and deal with the hogs. last time I saw the figures we are talking less than 30% of IPV4 was being utilized with the rest being taken up by squatters and hogs that got huge blocks back in the old days. If the unused addresses were to be put back into the pool it would give us most likely a good 5 to 6 years to do a nice orderly IPV6 rollout instead of the mess we are in now.

So I propose a simple answer: Each address costs you $1 a month. The hogs want to sit on them and then sell them for a fat profit like it was rare property? Enjoy the property tax. At just $1 a month it wouldn't hurt the little guy but would make those sitting on huge blocks to either "piss or get off the pot" and since we would be treating the addresses as property if they give the block back they get a one time tax credit of $1 per address as incentive.

Because if we don't do something "radical" like this the whole thing is gonna be a massive clusterfuck. I'd said a good 85%+ of the routers being sold this very minute are IPV4 only, the dead economy has caused plenty of layoffs and under-staffing in IT depts, especially in the flyover states which I predict will end up with massive outages when we do flip the switch due to staff with little training in IPV6 and simply not enough hands on deck, I've yet to hear how we are suppose to deal with the privacy concerns of having everyone tied to a unique address which is the *.A.As idea of heaven, not to mention nosy governments, and finally we still haven't seen a plan proposed that won't end up causing massive eWaste in the consumer section when the above routers and switches aren't given any IPV6 firmware upgrades thanks to the router companies looking at IPV6 as a perfect way to sell new routers to everyone.

So I say my proposal would buy us the time we need to fix the above problems and make the IPV6 transition a nice slow methodical orderly change over rather than the "Oh shit what are we gonna do?" mess that we have now. Whether it be from greed or apathy IPV4 has been allowed to be massively abused and neglected and the IPV6 gear and training simply isn't there on the consumer side nor in SMBs. Everyone laughs now about how when Y2K hit nothing happened, well I'm betting that if we don't do something the IPV6 switchover has the potential to be the total clusterfuck that Y2K was supposed to be, only worse. As someone in one of the flyover states I can tell you most places simply ain't ready, and since all of y'all on the coasts have some of your data pass through our area getting to point b from point a having the flyovers fail could cause a major outage, who knows, maybe ven a domino effect. So have the hogs pay $1 a month per address and we'll see if they want to hang onto those addresses or not.

Re:SNI and other alternatives

[Mad Merlin]

Just like old browsers, IPv4 only clients will continue to haunt us for years to come. It depends a lot on your audience, Game! for example sees something like 10-20% IE users (all versions combined), the rest using Firefox, Chrome or Opera. But if you look at the cross-section of browser usage in big companies, you'll see something closer to 80% IE usage (and primarily IE6/IE7 at that).

I predict that once XP goes off extended support, people will finally start migrating away from it and IE6 will die with it. This will be a massive step forward for the web and can't happen soon enough. Even ignoring the fact that we can stop working around IE6's remarkable retardedness, being able to use SNI willl be a major plus.

Re:SNI and other alternatives

[Ultra64]

"it would give us most likely a good 5 to 6 years to do a nice orderly IPV6 rollout instead of the mess we are in now."

We've had a decade to do a nice orderly IPv6 rollout. The problem is no one will spend the time/money to do it until it is absolutely unavoidable.

Re:SNI and other alternatives

[Anonymous Coward]

This is why I generally support the big guys, Google et. all, when they go out and state they will no longer support older browsers.

The problem as I understand it in the case of IE is that MS considers the SSL implementation to be part of the OS not part of the browser and as such they won't implement SNI in IE on XP.

People are far more reluctant to upgrade their entire OS than to merely upgrade their browser.

This is because SSL is built into the OS through the Win32 API. All applications should be using it. Real developers use available APIs instead of cluster fucking 35 different versions of shit and different libraries into their OS for fun (like Linux).

Re:SNI and other alternatives

[TheLink]

That's not a problem. One more reason for people to use Firefox or Google Chrome :).

Re:SNI and other alternatives

[Anrego]

If the unused addresses were to be put back into the pool it would give us most likely a good 5 to 6 years to do a nice orderly IPV6 rollout instead of the mess we are in now.

More time isn't what is needed. They've already had lots of time (nearly a decade).

So I say my proposal would buy us the time we need to fix the above problems and make the IPV6 transition a nice slow methodical orderly change over rather than the "Oh shit what are we gonna do?" mess that we have now.

That's the only way it's gonna happen. Like many other problems (pollution or fossil fuel) that cost a lot of money to fix just to get back to nominal, it's not gonna be dealt with until stuff starts actually breaking.

Re:SNI and other alternatives

[speculatrix]

less than 30% of IPV4.. If the unused addresses were to be put back.. give us most likely a good 5 to 6 years to do a nice orderly IPV6 rollout
you mean another 5 years on top of the nearly 13 years that ipv6 has been around?

Re:SNI and other alternatives

[compro01]

Both have the same problem, as the issue is in Windows XP's SSL implementation, which all browsers use rather than doing it internally.

Re:SNI and other alternatives

[GPLHost-Thomas]

Your $1 tax is ridiculous, because only large organization have big pools, and THEY don't care paying. If you have a /16 of IPv4, that's about 800 000 USD per year, which is nothing for a company doing billions. Now, take a small provider with a /21, the 2048 USD per month cost might kill it, while almost probably he is using it fully.

What's really bad is that everyone is using at least 256 IPs per announcement, because otherwise, many ISP just ignore the route announce, to save on the precious memory of their antediluvian routers. And I know what I'm talking about here. If you want to kill a waste, this is were to have a look into.

Re:SNI and other alternatives

[TheLink]

Chrome uses Window's crypto but AFAIK Firefox uses its own SSL stuff - Firefox's CA list is separate from the one in Windows.

Re:SNI and other alternatives

[petermgreen]

Real developers use available APIs

Real developers know it's a compromise, using the OS libraries means there is less duplication (which means less ram use and only one place to fix stuff when a problem is discovered) but it also makes it harder to be consistent across platforms and means you are at the mercy of the OS vendor regarding fixes and updates. In particular said OS vendor may use such features as an opertunity to ram a new major version down your throat.

Regardless of the merits of platform libraries VS rolling your own though I think this is a case of MS being pig headed. They could have easilly fixed something that is a major PITA for web server operators and didn't and given that the specs for it appear to have come out no later than 2003 they can't really use the excuse that it only came out after vista's release.
 

Re:SNI and other alternatives

[kimvette]

Real developers use available APIs instead of cluster fucking 35 different versions of shit and different libraries into their OS for fun (like Linux).

Do you really think there isn't a "cluster fucking 35 different versions of shit and different libraries" on your windows box?

If you really believe that, I would like to invite you to check out %windir%\WinSxS; it is part of a mechanism designed to resolve traditional Windows DLL hell but can become VERY bloated over time It's where system libraries are actually stored and then are linked to from other directories. Due to the past DLL hell, it is rare that anything ever gets deleted from WinSxS in order to prevent DLL hell by inadvertantly deleting a library that might be marked by the registry as unused, but is actually relied upon by a seldom-used app. So, what happens is as you install and upgrade your various applications, system drivers, and whatnot, a ton of files often get written to in WinSxS when installers don't check for dependencies - how many times have applications forced installs of components you know are already in place? Why does this happen? Because all too many release engineers don't understand system administration, how the OS works at the low level, so they don't know how to check for preexisting components. Why is this? Because hiring managers are all too focused on specific tool (Rational Clearcase and Clearquest, Installshield, Visual Studio, Ant, Eclipse, or a specific language, etc) and not on what really matters, i.e., system administration, coordinate development and QA, manage the build platform and a build a clean net, etc. Too much emphasis is based on knowing a specific application, rather than the process and ability to learn a tool quickly. Individual tools are relatively easy to learn very quickly; system administration and basic scripting skills are relatively difficult to pick up quickly. I never focused on learning all the tools out there; I learned the individual tools as I needed to, so my installers were always rock-solid because I knew the requirements for the underlying system, and my installers didn't force unnecessary component updates which bloat a system.

So, your Windows vs. Linux argument is kind of moot; you may not realize it, but even though you might not see libfoo.so.0.2.1, libfoo,so.0.2.1 and libfoo.so.0.4.1 (and a symlink from libfoo.so.0.4.0 to libfoo.so.0.4.1 since it's compatible and the install creator decided to save you space but not break your system in the process) in /usr/lib on Windows, but if you have installed and over time upgraded various applications you easily have 5 to 10 different copies of various libraries - often identical versions, cluttering up WinSxS.

Check these out:

http://www.ghacks.net/2010/07/24/the-winsxs-folder-explained/
http://blogs.technet.com/b/askcore/archive/2008/09/17/what-is-the-winsxs-directory-in-windows-2008-and-windows-vista-and-why-is-it-so-large.aspx

Unix-based systems are easy to clean, maintain, and if you do break /usr/lib, very easy to fix in comparison to Windows. Now tell me - after reading those articles, if you have the Unix experience you claim to have, after learning how Windows deals with various library versions, which system is better and more logical? Don't get me wrong; Microsoft has done a fantastic job making Windows a hell of a lot more stable than it used to be, but this "fix" is still a major hack which doesn't fix the root problem: shitty release engineers not developing and adequately testing installers until they're rock solid.To work around install developer incompetence, we have come to a point where WinSxS may contain gigabytes' worth of old cruft that is no longer used on a Windows box.

Re:SNI and other alternatives

[cheeseandham]

"it would give us most likely a good 5 to 6 years to do a nice orderly IPV6 rollout instead of the mess we are in now."

We've had a decade to do a nice orderly IPv6 rollout. The problem is no one will spend the time/money to do it until it is absolutely unavoidable.

This.It wouldn't make a difference, as it would just mean everyone would continue doing nothing, and legitimate users would just pay more.

My ISP gives me a /27 for free on my home network and I enjoy not having to use NAT and I am using the addresses (well more than 16 of them). Now why should I have to pay an extra $30 for my net connection because the rest of the Internet providers haven't performed due diligence with this issue (and since my ISP has also been IPv6 ready since 2002 they are obviously doing their job properly)

Re:SNI and other alternatives

[compro01]

It appears that you are correct. My mistake.

A handy test for SNI compatibility can be found here (https://sni.velox.ch/)

Re:SNI and other alternatives

[Anne Thwacks]

We use BT as our ISP, and we already pay £1 per IP per month to them. I asked if I could have IPv6 addresses, and they said "What is that?"

Re:SNI and other alternatives

[GameboyRMH]

I figure there's at least a 50% chance the GP is simply trolling. If not, well his statement is ignorant enough that he might get modded Funny.

Re:SNI and other alternatives

[GPLHost-Thomas]

If you didn't know, ISPs are paying a fee every year to be a member of RIPE/APNIC/ARIN. It's not because you use more IPs that you will pay more. So, BT is just monetizing on something it should not.

Re:SNI and other alternatives

[memyselfandeye]

Maybe I don't understand the problem, but in my mind it has nothing to do with available address space and everything to do with equipment cost. My ISP is a cable co-op, so what you pay is directly proportional to what you get. For my $50 I'd rather have increased bandwidth than a brand new room full of Cisco switches that isn't going to make things 'better' for me at this moment.

Our annual letter basically said that the plan was to upgrade to IPv6 when we need to upgrade the "big iron" in the next few years. So what 'profit' that could be spared went to additional bandwidth instead of new hardware. The caveat being any new bandwidth in the future will require new hardware, hence the reason to postpone IPv6 roll-out. If IPv6 were pushed back 5 years, we wouldn't upgrade until necessity forced us to. In our case, that will either be one of two things; A) our equipment has to be upgraded to handle additional traffic, or B) IPv6 roll out is required for users to use the services they require. To me, that means IPv6 it will happen when it happens, and not a day before.

I suspect this is the case with all ISPs big and small. Why pay for something now when you won't need it until later? Either way, my gut tells me there will be IPv4 squatters just like there are domain squatters. It's a bit ridiculous to pay for invisible property, but I doubt it will be too painful since unlike DNS there is a viable alternative.

Re:SNI and other alternatives

[TheLink]

Well I made a mistake too, I forgot Chrome uses Windows crypto stuff (I should have remembered that - dealt with that weeks ago - installing private certs and stuff).

Anyway in theory SSL is good. In practice it's better than nothing, but:
1) Most people just click through the warnings.
2) Governments (and naughty hackers) can get browser trusted CAs to sign their CA certs, and most browsers by default will not warn you. China's CNNIC's cert is signed by Entrust (there may be more).
3) Governments can get Microsoft to sign their certs and IE (and Chrome) by default will not warn you - you can delete a CA's cert from the CA list, and IE will add it back as long as the cert is signed by Microsoft, or by a CA that's signed by Microsoft or a CA that's signed by a CA that's signed by by Microsoft (subject to the certificate's and browser's chaining limits).
4) IE by default has http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol enabled. So an ISP could set a browser to use a proxy without the user knowing. AND I have not checked recently but years ago most browsers did not warn you if they are configured to use a proxy and receive a plain unencrypted "HTTP-302" redirect when they make a CONNECT request. The browser just goes to the redirect URL without warning. This was convenient for my purposes, and for some users but it might not be so good for the users in more security sensitive situations...

So the cynic in me feels that nowadays SSL/TLS/HTTPS is more about making the CAs money, since the browsers by default don't warn you about the crap I mentioned (whereas stuff like SSH would warn you).

The TLS SNI feature is more about not scaring the users but the users should be scared since the browsers aren't really protecting them ;).

Re:SNI and other alternatives

[Bengie]

"less than 30% of IPV4 was being utilized"

We're approaching 3 billion users and there's only 4.3bil addresses total, not including inefficiencies from smaller subnets or reserved ranges. I would say there's very few un-used addresses.

"If the unused addresses were to be put back into the pool it would give us most likely" Few months. This has been discusses many times, even by the president of ARIN.

"The hogs want to sit on them and then sell them for a fat profit" You can't sell them, you can only return them.

" I'd said a good 85%+ of the routers being sold this very minute are IPV4 only" Sadly, yes.. for residential anyway. Nearly any new commercial grade products are IPv6. It's actually hard to find IPv4 only switches/routers for anything you would use at a job/ISP/etc.

The real clusterfuck is what's happening to the IPv4 routing tables from subnet fragmentation.

Re:SNI and other alternatives

[Lennie]

IE(-based browsers) and Safari on XP (the only browsers that use the windows library) isn't the only SNI problem, Android 2.x is also a problem.

I guess by the time XP is gone the Android phones will be gone too. But it was really stupid to see these people not include SNI support.

might be good for specialized uses

[datapharmer]

IPv6 only might still be good for remote servers, for backup etc. where clients don't necessarily want everyone in the world to have access anyway.

Re:might be good for specialized uses

[TheRaven64]

It's also fine for anything that is not directly connecting to clients. There's nothing wrong with having your database server only accessible via IPv6, if your web front end is dual stack. If clients always connect via a reverse proxy, then your web server can be IPv6 only as well. If you're doing load balancing via a transparent reverse proxy, then this means that you only need one public IPv4 address for the proxy, but can have a large cluster of v6-only servers.

Re:might be good for specialized uses

[obarthelemy]

OTOH, it doesn't really matter if your non-internet-facing servers are v6 or V4, since they'll only serve local adresses ?

Re:might be good for specialized uses

[bsane]

Thats why this article is misleading...

Of course v6 only won't make sense for years. It won't make sense until 99% of the internet is dual stack or v6 only- how long that takes is an economics problem. Whats important is that servers/hosting is dual stacked during the transition. When you're looking for hosting services native dual stack will soon be a requirement. Its not right now, but it will be very soon. This really isn't very complicated- dual stack your public servers as quickly as possibly (really not that hard), and let internal infrastructure sort itself out over time. If the price for v4 addresses shoots up people using routable v4 addresses that aren't actually reachable will quickly re-ip and sell, and just a wag, but anyone on the ball enough to do that will probably re-ip to v6, not rfc1918 v4.

Re:might be good for specialized uses

[GPLHost-Thomas]

First of all, dual stack IS ALREADY a requirement for some customers, and not doing it is already hurting some hosts. While you are right, dual stack isn't very complicated, it isn't easy to find providers that wont have silly answers like "yeah, we're working on it, it's going to be available soon". Out of 12 data centers we are in, only ONE has it ready, and asking them about router announce and auto configuration was too much for their support. In all other places, we had to find IPv6 brokers and do the routing ourselves, using v6 in v4 tunnels. In some places it's ok (when brokers are close to the servers), but in other places (like Asia) it isn't satisfying at all, because it's adding latencies. But all together, IPv6 is a lot of fun, and seeing that routing is totally different is funny too. It's like having 2 versions of internet at the same time. Sometimes, going by the IPv6 is faster than IPv4 ! :)

Re:might be good for specialized uses

[TheRaven64]

Who said non-internet-facing? I said that they were not facing the clients, not that they weren't facing the Internet. Even if they're in the same data center, if they're in managed hosting then you probably want them to be Internet facing.

Re:might be good for specialized uses

[Anonymous Coward]

It might simplify things if you're connecting from outside your firewall (assuming your firewall can handle IPv6 rules)

If only you and your web servers/reverse proxy will be connected then it's no big deal to put on IPv6 only stacks on them.

The better question would be why do it if the IPv4 stack is more heavily optimized.

On the other hand ...

[Anonymous Coward]

Dual stack hosting does make sense right now, what is slashdot waiting for ?

Re:On the other hand ...

[Arlet]

Apart from adding maintenance costs, how much sense does it make ? IPv6-only clients are a small market.

Re:On the other hand ...

[Anonymous Coward]

Slashdot can't even fix simple bugs in the Javascript for their own website. What makes you think they will even think about IPv6 anytime soon?

Re:On the other hand ...

[Anonymous Coward]

Slashcode monkeys still can't even support Unicode on the site even though it was standardized back in 1991. You really think they could handle setting up the site to handle dual stack?

Re:On the other hand ...

[Yvanhoe]

Put a fast server on the IPV6 address. Give an incentive to switch.

Re:On the other hand ...

[Mathness]

For 736c:6173:6864:6f74:2e6f:7267:: or similar to become available? :)

Re:On the other hand ...

[Anonymous Coward]

Dual stack hosting does make sense right now, what is slashdot waiting for ?

Getting their IPv4 codebase to work properly...

Re:On the other hand ...

[Anonymous Coward]

If you build it they will come?

The GP was saying there's no reason to invest in ipv6 server infrastructure because there are no ipv6-only clients to serve.
Or, more specifically, why add the cost (administrative overhead) of IPv6, when the only people you can reach with it are probably also available via IPv4?

Re:On the other hand ...

[camperdave]

Javascript and HTML are application layer protocols. IPv6 is a network layer protocol. One should have nothing to do with the other. You should be able to switch to IPv6 as easily as moving a website to new hardware. If a website requires IPv4 then it is broken, and has been for a long time.

Re:On the other hand ...

[somersault]

Yeah, they should get up to date like the W3C have.. oh, wait.

Re:On the other hand ...

[mikael_j]

Because by doing it in an calm and orderly fashion now you save yourself a lot of panicking, firefighting and half-assed last-minute "fixes" in the future?

I actually suspect there will be a future market for IPv6-to-IPv4 proxy services for companies stuck with shitty ISPs that wake up late and realize they need their servers to be accessible through IPv6 yesterday. Just pay another company that has IPv6 access to proxy all IPv6 HTTP/SMTP/whatever requests to the company's IPv4 server for that service (and knowing how these things play out the "solution" will be an ugly kludge with services running on non-standard ports or through some proprietary tunnel protocol on the backend server so that they can tell which customers are using "IPv6" and which ones are connecting directly through IPv4).

Of course, I'm sure it's much more fiscally responsible to not invest a single cent in preventing this major cost down the road...</sarcasm>

Re:On the other hand ...

[gmack]

Small but growing, leaving it off until the market grows too large to ignore is going to guarantee you won't be ready when the time comes.

Re:On the other hand ...

[Yvanhoe]

If a website has one IPv4 server and one IPv6 server and one is down or slow, I will go to the other. That is just natural. If enough websites do that, IPv6 will have the reputation of being faster and there will be pressure from clients to get this.

Re:On the other hand ...

[Arlet]

Then wait until market is large enough, minus the time it takes to do add the IPv6 support. Switching to IPv6 will only get easier after you wait until everybody else has figured out all the problems, and all the hardware is supporting it.

Re:On the other hand ...

[bsane]

Small, but growing. There will soon be economic pressure for v4 addresses, and it won't take too many people moving to v6 make it worthwhile to maintain dual stack servers.

First hand experience on this one- if you're already using best practices for web hosting, adding v6 addresses is stupid easy, and requires no re-work to your backend. Why _wouldn't_ you add v6, even to capture (or keep from losing) 1% of your traffic?

Right now the reason is: horribly misconfigured dual stack clients will fail when accessing dual stacked servers. Thats what v6 day is for, with most of the large web sites going dual stack for 24 hours, hopefully most of those issues will be brought to the surface. Once people like google see that lost misconfigured dual stack traffic is equal to incoming v6 traffic, they'll switch to dual stack permanently, and the transition will officially begin.

Re:On the other hand ...

[Arlet]

Because a lot of people don't care about 1%. When Firefox had a market share of 5%, there were still plenty of sites that didn't support it.

Also, people moving to IPv6 doesn't mean they can't reach IPv4 sites anymore. As long as they can reach them through some NAT service, the IPv4 web hosts will be fine.

Re:On the other hand ...

[Anonymous Coward]

So, pay the early-adopter price now, or the late adopter price later...
But there's a nice middle ground, where you start implementing when enough of your audience is available for it to make sense.

It's the same argument for practically every new technology.
Of course, people just aren't very good at finding the crossover point. You've got the IT guy who started screaming for IPv6 in 2000 (to pad his resume), you've got the Manager who thinks it's cool (thanks to some "IPv4 sky is falling" Gartner report), and the CIO who has to justify the cost.

Of course, I'm sure it's much more fiscally responsible to not invest a single cent in preventing this major cost down the road...

You say that like IPv6 is old hat. There's still quite a few bugs to be ironed out.
Those who wait until it's "too late" will inherit the tutorials/guides/fixes provided by the blood/sweat/tears of the early adopters.
It'll cost a lot more to implement now than it will in a few years.

Re:On the other hand ...

[Lunix Nutcase]

Because the W3C is the one who standardized IPv6... oh, wait they have fuck all to do with the Internet Protocol standards. On the other hand, the real people behind the IPv6 standard, the IETF, does have a website that is IPv6 ready.

Re:On the other hand ...

[Anonymous Coward]

Your post reeks of trolling and cynicism.

The global IPv4 pool has run out, that's a pretty good sign we're past the early adopter stage so telling people to hold off on getting dual-stack up and running is just dumb (or greedy if you think you can make off of those people later).

There are also plenty of people who have been pushing IPv6 for a long time because they believe it is the right solution, a necessary one at that, and not because they're greedy or looking to further their careers. But you knew that, didn't you?

And what "bugs" are there in IPv6 that desperately need to be fixed? I've been running dual-stack at home for years without any problems (at least not any that could be traced back to flaws with IPv6 itself) and my employer has been running dual-stack on servers for almost a year and recently transitioned all desktops to dual-stack. Sure there were some implementation issues but those always pop up when moving a large number of systems to new technologies no matter how stable and well-engineered the new tech is.

Re:On the other hand ...

[somersault]

Wow, the people who developed the standard use it, that's life changing knowledge!

Instead, let's look at some of the W3C's "Mission" statements:

Web for All - The social value of the Web is that it enables human communication, commerce, and opportunities to share knowledge. One of W3C's primary goals is to make these benefits available to all people, whatever their hardware, software, network infrastructure, native language, culture, geographical location, or physical or mental ability

Web on Everything - The number of different kinds of devices that can access the Web has grown immensely. Mobile phones, smart phones, personal digital assistants, interactive television systems, voice response systems, kiosks and even certain domestic appliances can all access the Web

This is just one of the groups that I'd have expected to have IPv6 addresses by now. Facebook and Amazon don't either..

Re:On the other hand ...

[Anonymous Coward]

If they're big enough, and make money via page views, they'll care about 1%. Which admittedly may be a small number of sites, but it'll be the largest sites. Once they're dual stacked others will follow (maybe not banks... they're obnoxiously behind the times).

Re:On the other hand ...

[kirillian]

So what you're saying is, you think the early adopter stage is gone...whereas GP thinks the early adopter stage is currently going on...sounds like you're trolling him...his main point was not that we're in the early adopter stage, but that it's difficult to tell where exactly that middle ground is. While I agree with you that we're probably fast approaching that middle ground or there potentially, I think it's arrogant to argue that you can see that we're there already. Leave that for history to decide when we look back in 5-10 years with a slightly more clear picture. Regarding the IPv6 "bugs"...Unless he's referring to the general issue of lack of anonymity built into IPv6 (due to unique IP addresses), I myself would like to know what bugs he is referring to... Regardless, the general tone of your post I felt was extremely out of line and uncalled for, no matter my own personal standing on the matter. Maybe you felt affronted by the charges that he made of the IT guy trying to pad his resume or the Manager spiel, but I didn't really see those as intentional slaps - just exaggerations based off of his personal experiences intended to narrate (remember that high school English class where you learned about hyperbole?).

Re:On the other hand ...

[Cimexus]

Facebook does, actually, at http://www.v6.facebook.com./

> ping www.v6.facebook.com

Pinging www.v6.facebook.com [2620:0:1cfe:face:b00c::3] with 32 bytes of data:
Reply from 2620:0:1cfe:face:b00c::3: time=170ms
Reply from 2620:0:1cfe:face:b00c::3: time=169ms
Reply from 2620:0:1cfe:face:b00c::3: time=170ms
Reply from 2620:0:1cfe:face:b00c::3: time=170ms

Ping statistics for 2620:0:1cfe:face:b00c::3:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
        Minimum = 169ms, Maximum = 170ms, Average = 169ms

On 'World IPv6 Day', they'll be making their main site (i.e. www.facebook.com) IPv6-enabled. That's really what the point of this day is ... not to test IPv6 itself, but to iron out bugs that might occur when major sites go to dual-stack on their main sites (both on their end, and the users' end).

Re:On the other hand ...

[Anonymous Coward]

Also, what is Elastic Hosts waiting for? Even a pro, IPv6-aware hosting company doesn't have dual-stack? Even after they wrote this article saying it's sad that a market for IPv4 addresses will arise?

Easy for me to be critical, but isn't this exactly the sort of behaviour that causes the situation they lament, that IPv6-only hosts are severely disadvantaged? We need people who run services on the net (hosting companies) to run IPv6-enabled sites, so we don't have to pay the IPv4 hogs--the old, established internet players, who don't innovate on the internet.

Slashdot is looking extremely lame now. This is worse than no unicode support, which was just lame, this is actually holding back the internet, and ensuring the brain-damage called NAT stays with us.

Re:On the other hand ...

[Anonymous Coward]

And what "bugs" are there in IPv6 that desperately need to be fixed?

None, it's the vendors (and administrators) that screw it up.

I'm NOT saying IPv6 is useless.
It's required, but convincing the financial guys to spend money so you can address something which won't help their bottom line THIS QUARTER is... difficult. Let alone something like IPv6 which still has (many?) years left for the ROI to make sense.

Honest question: Inside the firewall, what benefit is IPv6?
The geek in me wants to switch, but the lazy bastard in me doesn't see any use for it (and I know it'll screw with things like VPN and online games).

Re:On the other hand ...

[Anonymous Coward]

You want to take a fast server and put the slashdot code on it? That is cruelty to hardware!

Re:On the other hand ...

[Junta]

I suspect NAT64 will be around for a long long time to keep IPv6 people talking to IPv4 only hosts.

Re:On the other hand ...

[Anonymous Coward]

Facebook does, actually, at http://www.v6.facebook.com./

That's a lie, my browser says "The requested URL could not be retrieved"!!!!!!!!!!!

Re:On the other hand ...

[Lunix Nutcase]

Wow, the people who developed the standard use it, that's life changing knowledge!

Which was the point. Why do you point out the W3C? And why do they need an IPv6 record to accomplish their goals? I'm pretty sure you can have web for all and web on everything at this point without an IPv6 record.

This is just one of the groups that I'd have expected to have IPv6 addresses by now.

Good for you?

Facebook and Amazon don't either..

Facebook does. But why either one need them when less than 1% of their users will be using the IPv6 version, is the better question.

Re:On the other hand ...

[petermgreen]

There is a catch 22 with IPv6 deployment. There is little point in deploying v6 on your servers unless you belive there will be a significant number of V6 only clients in the next few years (or whatever your "major upgrade" cycle is) and noone will want to deploy clients that cannot access v4 servers while there a significant number of v4 only servers.

Now the question is will the global v4 pool running out break this catch-22? I suspect the answer is no since clients without public v4 address are likely to still be able to access v4 only servers through some mechanism (e.g. NAT444, ds-lite, NAT64 or proxies).

Right now if I was a proper server admin (I do run a hosted server but it's mostly for personal use so it doesn't really count) i'd be making sure all newly introduced software supported IPv6 and if the cost was close enough to zero and my ISP offered proper v6 rather than some crappy tunnel I might consider actually using it..

Re:On the other hand ...

[EsbenMoseHansen]

Regarding the IPv6 "bugs"...Unless he's referring to the general issue of lack of anonymity built into IPv6 (due to unique IP addresses),

That would be wrong. Any IPv6 client I know of can generate addresses either from something static (the MAC-address of the network card, a fixed configuration or whatever) or an automatically and randomly generated string, giving you the same anonymity if you so desire. I believe win* defaults to the latter and linux to the former, but switching is easy.

Anyway, even with a statically configured computer you can always claim that someone else must have used that IP address/someone else used the computer.

Re:On the other hand ...

[EsbenMoseHansen]

Honest question: Inside the firewall, what benefit is IPv6?

There are a number of benefits, mostly related to having a globally routeable IP address. E.g, if your company merges with another, there will be no need to reassign hosts or create bridges in the new, joined network. You also save the administration of internal IP addresses, the DHCP server, perhaps a print server.

For me, it means that when I work from home I can directly ssh to my work computer (started with wake-on-lan) if I need something from it. That makes it much easier to git pull/push changes, but I admit that is a bit of a cornercase).

I'd say that if your company runs openwrt or the like, switching to dualstack using a tunnel if necessary makes a lot of sense. Even if you set up the firewall to block non-related traffic (like NAT would do), but even more so if you don't.

Re:On the other hand ...

[Lennie]

To bad the IPv6 experiment (porn) never got completely of the ground.

Re:On the other hand ...

[somersault]

One of W3C's primary goals is to make these benefits available to all people, whatever their hardware, software, network infrastructure

If they haven't bothered yet, why should Slashdot?

Re:On the other hand ...

[jrumney]

Facebook has had an IPv6 server running for some time. And Amazon support IPv6 for AWS, so I'd be surprised if they do not have at least an unpublicised test server running for their main site.

sell it

[Anonymous Coward]

make ipv6 prioritised traffic, brand it as faster than IP4

Re:sell it

[Anrego]

Right now most residential ISPs don't offer IPv6 period.

We arn't even at the "getting customers to buy into it" phase yet, we are at the "getting it available" point. Which is (and I know this dead horse has been sufficiently beaten already) quite sad considering how much the ipv4 problem has been known about and a solution available.

IPv6-only hosting in my pants

[slashpot]

I have IPv6-only hosting in my pants.

Re:IPv6-only hosting in my pants

[Anonymous Coward]

The internet won't be complete until my penis has an IP address.

Re:IPv6-only hosting in my pants

[Anonymous Coward]

the IP address for your tiny penis is BAT.HRO.OOM

Right...

[Anonymous Coward]

It's going to make sense when we run out of fucking addresses.

It's asshats like this....

Re:Right...

[Anrego]

Even then it probably won't.

Until IPv6 is available to most residential users, it's gonna make more sense to buy ipv4 addresses at high prices than to switch to ipv6 where the huge majority of the internet can't actually get to your site.

The problem here isn't the web hosts, it's the residential ISPs who are _still_ dragging their feet on this.

Re:Right...

[Anonymous Coward]

why are developers always so shortsited?

640kb is enough for anyone...

oh my code will never be around in 2038 so lets use a 32 bit integer to store number of seconds since 1970...

ipv4 ought to have enough addresses...

Re:Right...

[petermgreen]

It's going to make sense when we run out of fucking addresses.

Of course there is the definition of "RUN out" to consider. IP addresses aren't like oil, we don't use them up. When demand exceeds supply then (provided the RIRs don't mess things up too much) they will simply become more expensive causing the least profitable uses to be sacrificed.

I'm betting the first thing to be sacrificed will be public IPs for people on normal home broadband plans (mobile broadband seems to be using private IPs already)

Re:Right...

[Macrat]

Comcast is rolling out IPv6 right now in the US. http://www.comcast6.net/

They have had a beta rollout for the past year to work out the issues.

Customers in Denver, CO are currently getting IPv6 to their homes right now.

Hopefully they'll start rolling it out in the San Francisco bay area soon.

Re:Right...

[L4t3r4lu5]

ISPs won't upgrade because there isn't any IPv6 content. No content is being migrated to IPv6 because there's no ISPs supporting it.

No, this does not surprise me.

Re:Right...

[drinkypoo]

My WISP (I am a fixed installation) doesn't have real addresses for me, so I'm there already. It does prevent me from playing some games and such, but the latency isn't that great anyway.

Re:Right...

[Cimexus]

No thanks. While that suits many average users, I would change ISPs if they did that to me. (NB. both my home ISP and my mobile phone have proper public IPs at this stage, and in fact my home connection is full native IPv6/v4 dual stack already, though I do understand that's a rarity for a residential ISP)

You're completely right though, of course. I foresee an awful period of horrible double-NATtedness for most home connections in the not too distant future.

Re:Right...

[Kjella]

And the cynic in me tells me it's not going to be our home broadband plans. There are after all 4 billion IPv4 addresses. Even if we say half of those go to servers and shit, the top 2 billion residential users would have no problem paying their way to an IPv4 address. It's going to be third world countries or countries with massive growth like India or China who'll get stuck on IPv6-only Internet.

Re:Right...

[WaffleMonster]

ISPs won't upgrade because there isn't any IPv6 content. No content is being migrated to IPv6 because there's no ISPs supporting it.

Those who think there is no market incentive for IPv6 should be asking themselves why so many major content providers and ISPs are taking it seriously.

ISPs will upgrade because they have no other viable cost-effective choice. Running huge NATs at ISPs is expensive, pisses off customers needing a real address for their gear to work right and adds insane CALEA requirements.

Content providers will upgrade because they want the fast-path to the customer bypassing ISP NAT. They also benefit by having access to the individual customers network address.

Re:Right...

[GPLHost-Thomas]

Even if there was no content, having IPv6 routed to your home is simply cool, because you don't have to deal with silly port forwarding on your router anymore. It just routes to your device.

Re:Right...

[Cimexus]

Ah nice - I was wondering if any of the US ISPs were doing this yet.

My (ordinary, residential) ISP is also fully native IPv6 to the home (and has been for about a year I think, though I only just got a native-IPv6-capable router in the last few months). I live in the Asia-Pacific RIR (APNIC) area though (Australia) so I think IPv6 deployment here is probably somewhat ahead of in North America, simply because we are due to run out of IPv4 addresses quicker than all the other regions. Several major national ISPs here have already got native IPv6 trials running.

Hehe ... comcast6.net even mentions to me that I'm connecting via IPv6. How nice of it.

Re:Right...

[petermgreen]

There are after all 4 billion IPv4 addresses

It would intially seem that way. However when we look at the 256 /8 blocks we see that many of them are not normal IPv4 addreses.

1 block is assigned to local identification
1 block is assigned to private use (there are also private use blocks elsewhere but only one is a full /8)
1 block is reserved for local loopback
16 blocks are allocated to multicast
16 blocks are practically unusable because they were never defined as either unicast or multicast and IIRC windows won't accept them as addresses

So there are only arround 3.7 billion "regular" addresses rather than the approximately 4.3 billion that one would nievely expect. Further conventional subnetting wastes quite a few addresses too, you waste one for network, one for broadcast, one for gateway and however many are needed to make the number of addresses up to a power of two. So i'd imagine the number of usable addresses is more like 3 billion.

And the cynic in me tells me it's not going to be our home broadband plans

What I expect will happen in the west is that public addresses will gradually (it will vary a lot by the particular ISP's growth rate and address situation at the time of exhaustion) become an extra cost option. If an ISP charges a couple of bucks extra a month for one then they are likely to free up a lot of addresses without pissing off the geeks too much.

One thing that is not clear at this point is whether it will be possible for ISPs to sell addresses across RIR boundries or if sales will be restricted to one RIR's area.

Re:Right...

[DarwinSurvivor]

Which is the only thing I'm leary about with IPv6 (other than not being able to roll your /64 over). Most people are told that a good hardware router will be enough to keep incoming attacks (ignoring browser drivebys) at bay. With IPv6, everyone is going to need a DECENT firewall on every machine in their home. Many people simply don't.

Re:Right...

[GPLHost-Thomas]

Not on every machines. On the router, this is enough. I just bought a D-Link DIR-825, and re-flashed it with OpenWRT. Using a 2GB key as root filesystem, it's working very well, and it has all the facilities needed (eg: ip6tables) to block any bad incoming connection. It also has all the software you need to get yourself connected to the ipv6 network, even if your ISP doesn't provide it: you can connect to an ipv6 capable host using OpenVPN, or setup an ipv6 in ipv4 tunnel if you like (for example, from SixxS, or others). I know it may sound like top-advanced, but frankly, it's not that hard to setup. Sure, many people wont do it. But for us, IT people reading slashdot, it's really possible and easy.

As for the firewall, people are badly mistaking NAT with a firewall. Don't do that, it's dangerous. Soon, you'll get your laptop connected to the net directly (maybe using 3G?), and you'll regret your wrong thinking! The fact that masquerading acts as a firewall is pure luck.

Re:Right...

[DarwinSurvivor]

Yeah, I've got DD-Wrt on my router (no open-wrt support for the N), but when companies finally start releases *consumer* routers with IPv6 enabled by default, I'm not so sure they will have the same protection as a NAT (which dose prevent outsiders from exploiting numerous ports left open by Windows).

Furthermore

[Metabolife]

The company also revealed research implying that fish could not swim in a sea of pudding.

It's not up to the end users anyway

[torgis]

Meh. Who cares? In all honesty, most people (myself included) don't know or care which protocol our devices are using when communicating with teh interwebs. It's not as if any of us have a say in the matter, in most cases the technicalities are handled upstream by our ISPs. When the ISPs have decided they are done battling over the little remaining IPv4 space and start switching en masse to IPv6, then the users downstream will, of course, be switched over. In most cases, this will probably be done without end users having any clue that some magical, mythical transition has occurred. They'll just power on their computer, phone, television, or toaster, and it will have internet.

The few internet-facing IP addresses I have are for my phone, iPad, and my home router. I'm guessing that AT&T will handle the switchover for my phone and iPad with a simple software update. The remaining device - my home router (Linksys WRT54G) will either be able to handle the new addresses (problem solved) or not (time for an upgrade). Such is the cost of progress. I have no plans ever to switch my home network to IPv6 unless someone can make a compelling case as to why that would make any sense at all.

Re:It's not up to the end users anyway

[Anrego]

I have no plans ever to switch my home network to IPv6 unless someone can make a compelling case as to why that would make any sense at all.

Yup. Unless you are a business and have to figure something out more complicated than "the addresses of my machines have all changed", there isn't much reason in playing around with ipv6 until your ISP actually starts cooperating. I mucked around a little just to get some familiarity (and truth is, I actually don't like how ipv6 works), but once I got stuff communicating it got kinda dull.

Re:It's not up to the end users anyway

[gr8_phk]

I'd agree that as a home user you have little control over the implementation of such things. But there are reasons you should at least want it. The primary reason being that those devices you mention don't have fixed IP addresses (unless you pay extra for that). There is a whole world of possibilities that open up when every home can get a block of fixed IP addresses. At the highest level, it means you don't need 3rd party "services" to connect to other people, or even to connect to your own machines when you're away. The implications of that are game changing.

Re:It's not up to the end users anyway

[obarthelemy]

uTorrent is reporting a few peers with v6 addresses, so I'm guessing I have v6 access. Didn't do anything at all for this, though.

Re:It's not up to the end users anyway

[crossconnects]

It will make sense to the home user for gaming situations, and when ISP's no longer support IPv4, though that's a long way off.

Re:It's not up to the end users anyway

[somersault]

At the highest level, it means you don't need 3rd party "services" to connect to other people, or even to connect to your own machines when you're away. The implications of that are game changing.

You know you can do all of that already if you actually want to, right?

You're still going to want 3rd party services to communicate your IPv6 address to friends (or even to your other devices probably). Unless you want to drive to their house and read it out manually. I hope I never have to read out or scribe an IPv6 address manually :/

Re:It's not up to the end users anyway

[Artemis3]

Either your ISP is supporting IPv6, or your OS is using a tunnel. Windows Vista and 7 by default do by try 6to4 and teredo tunnels if the ISP doesn't assign an ipv6.

Linux users can just install miredo to have a teredo tunnel. It is nice to use ipv6 capable DNS, such as OpenNIC; do these and you'll get 10/10 score at http://test-ipv6.com/

More ISPs should be supporting dual stacks by now, that means an ipv6 capable DNS and assign both ipv6 and ipv4 to clients. That will ensure a transparent switchover and ease ipv6 only services, which will start slowly, but will growth with time; especially with regions like Asia running out of ipv4 addys.

It makes sense even if the ISP itself is using a tunnel for all its customers, while their upstream providers get a clue. Of course that also can be done in any LAN, which is why doing it in your home to get the starting knowledge is a good idea...

Re:It's not up to the end users anyway

[Anonymous Coward]

Wow you have no clue how it works. Here's what's really going to happen. Broadband ISPs are going to start adding IPv6 to the subset of cable and DSL modems that can handle dual stack. Unless you're running a router that is dual-stack capable (and most people aren't and most new routers aren't either), that's where it will end. There are very few COTS routers out there that will gracefully handle dual stack, such as the Apple Airport Extreme. You can also run a custom firmware on many older routers that is dual-stack capable like DD-WRT and OpenWRT.

Trust me. It is not all pixie dust and fairies like your post.

CAPTCHA: "borrowed". As in "borrowed time".

Re:It's not up to the end users anyway

[TheTurtlesMoves]

My router that my ISP sent me 4 years ago, is dual stack and it is enabled by default. My ISP does not support IPv6 however. But in my experience most hardware does have dual stack support.

Re:It's not up to the end users anyway

[Cimexus]

It's most likely a tunnel ... easy to find out: just find out what your IPv6 address appears to be and do some Googling. Teredo and 6to4 have distinct prefixes that are reserved for those uses, I believe.

Re:It's not up to the end users anyway

[speculatrix]

My ISP (web tapestry in the UK) has provided IPv6 for a while, but I had to get my ADSL-connected firewall to handle the router advertisements, and install/configure a router advertisement daemon for my lan.

I think what will happen is that ISPs will have IPv6 working, and if the CPE can't do anything useful, they will set up web cache/proxies for their customers so that they can access IPv6-only web sites.

Re:It's not up to the end users anyway

[GPLHost-Thomas]

The backbone of ChinaNet and China Unicom are already IPv6 ready, but they aren't rolling it out to customer because ... the great firewall doesn't understand v6 yet!!! At least, that's what I've been told (it may be a silly rumor).

Re:It's not up to the end users anyway

[metamatic]

I have no plans ever to switch my home network to IPv6 unless someone can make a compelling case as to why that would make any sense at all.

I'm guessing that it will be a hell of a lot easier to turn on IPv6, than to set up a 4to6 encapsulating NAT so you can reach IPv6 hosts even though you only have IPv4.

With 6to4 and RFC 3068 it ought to be a checkbox or two to turn on IPv6 on your router, if your router doesn't suck.

Re:It's not up to the end users anyway

[Bengie]

Pretty sure it's 2002.

Re:It's not up to the end users anyway

[EsbenMoseHansen]

I use IPv6 (alas via a tunnel here). IPv6 gets rid of DHCP, which is nice, but also lets me ssh directly to any of my machines here. So I can ssh to my wife's machine to fix her machine (often that the old box has too much flash running), and git pull those changes I forgot to push from my home computer. Very convenient.

Re:It's not up to the end users anyway

[tengwar]

DHCPv6 still exists, and is useful for some purposes. It can do more than hand out IP addresses.

Re:It's not up to the end users anyway

[EsbenMoseHansen]

Sure, but it is now a corner case, for a few configurations, not the neigh-obligatory server it used to be.

What is really sad is...

[ganjadude]

when i was taking my cisco classes back in 2001 in high school they made a big deal about how we were running out and IP6 was going to be ready in a few years ...this was 10 years ago!

What is really, really sad is...

[gman003]

What's really sad is that I'm in networking classes right now (not in the Cisco ones yet, that's in a few semesters). And the only mention of IPv6 has been when I asked about it, or asked "how would ___ be done under IPv6?". They aren't even preparing new networking people to work with IPv6. I'm probably going to have to teach myself everything.

Re:What is really, really sad is...

[Raenex]

What's not so sad is that there's no need for classes anymore. It's all online now. Yes, you should be teaching yourself. Most of what you need to know you'll end up learning outside the classroom, anyways.

Makes sense for several years already....

[fuzzel]

It makes sense for several years already, as a lot of "firewalls" (eg, that nice Great Chinese Firewall) and various other such country-wide blockades to the Internet, do not have a single bit of understanding of IPv6, and as long as they remain that way, IPv6 will work like a charm......

Next to the other thing for home users: everything becomes accessible, instead of having to get IPv4 addresses from your home ISP (which generally they won't do, but indeed there are cases where they do), or getting a private server outside in a network, which is not home. For years already: set up an IPv6 tunnel, get a prefix, use it from anywhere.

There's at least one use for IPv6 hosting

[mysidia]

For hosting an IPv6 version of your site in parallel with your IPv4 only hosting.

Also useful for testing purposes.

This is useful if the price is right, and your existing hosting provider does not support IPv6. Nothing requires you to turn off your IPv4 site, in order to host an IPv6-only version of it somewhere else :-)

Making sense

[Anonymous Coward]

No more IPv4 addresses means there WILL be IPv6 only networks, regardless of how good or bad it is.

Re:Making sense

[petermgreen]

Bullshit, there is this little thing called NAT which allows hosts to reach v4 servers even if they don't have their own public v4 IP.

Beside the point

[FridayBob]

For a website owner working together with a hosting provider that still has plenty of IPv4 addresses, why would you even want to move to IPv6-only? Especially when so many in the world aren't even running dual-stack? The only good reason that I've heard so far to set up an IPv6-only website is for testing purposes (You can't see this site unless you have IPv6!).

On the other hand, soon there will be plenty of people and organizations in the world, starting in Asia, that will be IPv6-only. Not because it's better, but because they won't have any choice! For those people, whether it will be useful or not to run IPv6-only will be entirely beside the point.

As for us here in the West, where our pools of free IPv4 addresses are not yet being rationed, that doesn't make it important for us to start running IPv6-only... it makes it important for us to start running dual-stack! Not just for the sake of the Asia-Pacific folks, but for ours too. The chances are good that one day you'll want to access something over there that happens only to have an IPv6 address.

One question that anyone in the world could ask is whether it is useful to run dual-stack -- even if you don't have to. In my experience, most definitely. True, it does require a bit of extra work that must be done properly, but afterwards the main advantage for me has been that, with no NATs that must be traversed, remote management is much easier than before.

Re:Beside the point

[TheLink]

soon there will be plenty of people and organizations in the world, starting in Asia, that will be IPv6-only

They might go massive IPv4 NATs first. Especially since:
1) it makes control of the population easier.
2) it makes P2P harder
3) it makes it harder for users to set up their own servers

What tech people see as problems, would be considered benefits by some governments and organizations.

Re:Beside the point

[j h woodyatt]

All of those things can be accomplished at lower cost and with higher scalability and manageability with IPv6. There are some reasonable arguments for deploying NAT444 instead of IPv6 DS or DS-lite, but none of them have anything to do with tightening your grip on what your user community is doing with your network.

Re:Beside the point

[TheLink]

I find it hard to believe your claim that the IPv6 stuff will be cheaper and more scalable. Where's your evidence? Benchmarks? The IPv4 stuff has been around for decades. ISPs are already using it. Plenty of existing stuff for IPv4 acceleration.

And it certainly won't be more reliable. There are still lots more bugs to be found. For example: how many years did it take for the ISC to reduce the number of security holes and bugs in their IPv4 DHCP server? So you really think the dhcpv6 servers will be much better?

Adding a carrier grade NAT is pretty much proven tech. You know what it breaks and what it does. And what it breaks and does will make the MPAA, RIAA and the Chinese Gov quite happy.

Re:Beside the point

[EsbenMoseHansen]

IPv6 won't have DHCP servers for most people. DHCP6 is a for odd cornercases.

Re:Beside the point

[j h woodyatt]

Most of the IPv4 stuff that ISPs are already using today was either never designed for the NAT444 subscriber model, or if it was, then it's badly broken and not as well engineered as the comparatively older and better designed IPv6 stuff. This is especially apparent when you're looking at service providers with more than 16 million subscribers, who need to number subscribers in multiple separate address realms. This is the main problem cited to me by operators who have rejected NAT444 in favor of IPv6 DS/DS-lite.

For evidence, I don't have much to point out except the fact that every major ISP in the United States and Europe, and many in Asia as well, having looked at the operational considerations associated with the NAT444 and IPv6 DS/DS-lite alternatives, now seems to have concluded that the latter is superior to the former. Admittedly, I have nothing but anecdotes to relay if you want help explaining their observed behavior.

As for making GoldenShield workalikes, yes Virginia— that's a piece of cake with IPv6. Easier, actually, because you have only a single address realm to manage.

Re:Beside the point

[TheLink]

Fine, so please tell me how would a home Linux/Windows 7/OS X machine get its DNS settings from the ISP? Or are you claiming that getting stuff like DNS configured is an "odd corner case" that only a few users would ever need?

OK you might say use router advertisements instead of dhcpv6, but those would be even newer and thus support my point about bugs even more (they're probably still writing the RFCs - some are dated Nov 2010 e.g. http://tools.ietf.org/html/rfc6106 ). You going to bet that the implementations won't be full of bugs?

And are there even Windows/OSX/Linux clients that handle those router advertisements? Are they stable and secure? Are there already carrier grade routers that would support them? Nov 2010 isn't that long ago.

So how is IPv6 cheaper and more scalable than IPv4 as the OP claimed?

Currently with IPv4, "good case scenario" - home user plugs laptop to device from the ISP (or selects the device's SSID), and stuff works - DNS, gateways, netmasks, addresses all get set up automatically. Ask yourself what happens with an IPv6-only "good case" scenario? Is all the tech there already?

If it isn't, then all the talk about "the world had 10 years to move" is bullshit.

That's like saying you had 10 years to move in to a house when they were still discussing part of the foundation's design in Nov 2010. Just because they successfully tested the mock up rooms and doors at their own test sites doesn't mean much.

Getting people to move from nothing to a shack is easy. But when they have a house that mostly works and is just a bit short of space, it is stupid to expect them to move to a building with lots of space but not ready.

Re:Beside the point

[EsbenMoseHansen]

Calm yourself.Router advertisements will be used for those purposes. They have worked fine for several years (that I know of), but of course they haven't been hammered the way DHCP servers would. They are, on the other hand, by design somewhat more robust. Anecdotally, our new printer in the office picked up the router advertisement from our router without any problems, as have all our computers except for the one where the user explicitly disabled IPv6. I have no knowledge about carrier grade (heh) equipment, but I'm guessing they are a few years ahead of printers in the routing department.

Currently with IPv4, "good case scenario" - home user plugs laptop to device from the ISP (or selects the device's SSID), and stuff works - DNS, gateways, netmasks, addresses all get set up automatically. Ask yourself what happens with an IPv6-only "good case" scenario?

That would be the same. User plugs in equipment, and all machines get a globally routeable IP address, routing and DNS. And above IPv4, there will be no need for setting up port forwarding.

Is all the tech there already?

For several years, yes, except the stuff that can only be shaken out in actual large-scale deployment.

If it isn't, then all the talk about "the world had 10 years to move" is bullshit.

Heh. As I said, calm yourself, this stuff has been ready for years and years.

That's like saying you had 10 years to move in to a house when they were still discussing part of the foundation's design in Nov 2010. Just because they successfully tested the mock up rooms and doors at their own test sites doesn't mean much.

Getting people to move from nothing to a shack is easy. But when they have a house that mostly works and is just a bit short of space, it is stupid to expect them to move to a building with lots of space but not ready.

Yes, fear of change is always a problem in such migrations. It is, however, a necessary thing to do, and the net will be a better place for it.

Re:Beside the point

[Bengie]

IPv6 will be more scalable because the routing tables are more efficient. Current IPv6 routing practice makes use of the huge address space and uses that to better organize the tables to be smaller. IPv4 routing tables have mushroomed over the past few years because of subnet fragmentation caused by lack of address space.

"Carrier grade NAT" HA. All professions see this as a no-go. As it is right now, your ISP logs who gets what IP address. On average, an IP for a given broadband device probably changes once per week. I've had the same one for the past few months now because I haven't reset my modem. Here comes the fun part. Your ISP logs this info not only for maintenance, but legal reasons. If they rolled out "Carrier grade NAT", they would have to log EVERY connection in real time.

Can you imagine going from 1 log entry per user per week to possibly hundreds per second per user, and sometimes thousands? Gigabyte log files where kilobytes use to work. Professional talks about CGN for broadband essentially stated it's prohibitively expensive and massively complicated from both a technical and legal view. It already takes ISPs hours to days to respond to police about IP addresses.

Sorry, your Skype/xBox/PS3/PC-game doesn't work anymore. Class action lawsuit waiting to happen. Before you say "all that stuff already works through NAT".. NO IT DOESN'T. They use uPNP to forward ports. CGN would not allow that. Several big name anti-cheat and DRM software makes use of uPNP, and if uPNP doesn't work, you have to manually setup port-fowarding. Many games make use of P2P for a slew of reasons, but hide the port-fowarding setup via uPNP.

Many places still block traffic based on IP address. An entire city could easily get blocked from nearly any service.

IPv6 is a disaster

[Anonymous Coward]

There was zero improvement over v4 and no reason for anybody to switch. IPv6 is a designed by comittee standard that has seen little real world traction. It's dick-waving proponents endlessly present it as the only solution to the exhaustion of ipv4 address space. What utter crap!

If it aint broke, don't fix it. The "problem" with ipv4 was address exhaustion, nothing else. Nothing that requires a huge kernel module adding protocol features that nobody ever asked for.

So here we are, out of address space because "the answer is ipv6"... the answer to what exactly? It's about time someone did the obvious and proposed a simple extended ipv4. The reserved header bit could double the address space, someone smart could make that doubling expotential. IPv6 is a failure.

Re:IPv6 is a disaster

[Anonymous Coward]

I have been waiting for someone to propose IPv4 2.0 -- ip4+ip4=IPv8. Yes, it's a big fat address space. But, it would encapsulate IPv4 quickly and easily; and provide a direct and compatible "upgrade" path. The knowlege base would stay mostly the same -- get rid of the damn hexadecimal IP addresses.

Re:IPv6 is a disaster

[TheTurtlesMoves]

and how big are your routing tables?

Re:IPv6 is a disaster

[Dan Dankleton]

And there's the same problem with nobody buying the IPv4 2.0 kit because nobody uses IPv4 2.0
And it doesn't have the built in cool stuff which nobody has worked out that they want yet (Mobile IPv6 + ubiquitous IPSec means no more half-arsed VPN software - hooray!)

And who wants the knowledge base to stay the same? If there's a better way to do things, lets do it!

Re:IPv6 is a disaster

[m50d]

There is no way to extend IPv4 compatibly, because old routers won't know about the extensions, meaning people on the new addresses would get voodoo failures as their packets went to different places depending on network conditions. Not fun.

Re:IPv6 is a disaster

[Pentium100]

There is a way to do it. Assign the extended IPs to the internal networks, while keeping the original IP as the public one. That way, the old routers would still be able to route it correctly.

A longer version:

Extend the IP address by 4 more bytes, up to 1.2.3.4.5.6.7.8 (for example), place the additional bytes somewhere in the packet header where the old routers do not really look (options for example). So, old routers will see 1.2.3.4 and deliver it correctly to the ISP/company that has it and has the new routers, which can then deliver the packet inside their network to the correct destination. Yes, you won't be able to assign 1.2.3.4.5.6/48 to one ISP and 1.2.3.4.5.7/48 to another, but IPv6 is also set to assign huge subnets to one ISP.

This way old devices can still somewhat communicate by using the old half of the address and each company/ISP will be able to decide what to do with them, provide a static page saying you need to upgrade, use NAT to provide some of the services etc.

1% is a whole lot

[xiando]

All my websites have been IPv6 ready for many years now and I have never noticed any problems with having them available over both IPv4 and IPv6, but that does not mean there are none. I have read than less than one percent of the users will have IPv6 configured without actually having IPv6 connectivity and I probably loose that traffic. This is what the IPv6 testing day is all about: to see just how much traffic you loose because of badly configured clients. Less than one percent traffic loss may be acceptable to me, but it's not acceptable when you're a huge profitable website. It's pretty obvious that nobody in their right minds will make their high-traffic website available over IPv6 only before 99.5% or so of all users have a IPv6 connection.

Re:1% is a whole lot

[tokul]

I have never noticed any problems with having them available over both IPv4 and IPv6

You own both IPv4 and IPv6 addresses. Problems start happening when you don't own one. IPv4 scarcity will ensure that some won't have it.

If you run public site, you want to be reachable by both IPvs and dual stack setup is the only solution. Dual stack does not increase number of IP addresses available to web hosts.

Re:1% is a whole lot

[Anonymous Coward]

Ahh, yet another blowhard on Slashdot who doesn't actually understand the problem World IPV6 Day is testing for, even though the OP expressly pointed it out for him/her...

You own both IPv4 and IPv6 addresses. Problems start happening when you don't own one.

No, the entire fucking point is that problems start happening when you start dual-stacking a website. Why? Because there is a small percentage of people out there with broken IPv6 connectivity, often thanks to broken routers advertising routes that don't actually work (like my WAP, which broadcasts it's fucking link-local address... POS). So when you enable IPv6, suddenly those people see sites unavailable or very slow as their boxes attempt IPv6 connections first, fail, then retry on IPv4.

*That's* what this whole fucking thing is about.

So, when the OP said "I have never noticed any problems with having them available over both IPv4 and IPv6", he meant he hasn't noticed any large volume of users being turned away.

Anyone even remotely familiar with v6 is aware of this issue. Since you're clearly not, why are you trying to instruct the OP on this topic, given he's actually deployed and used it while you so clearly haven't?

I disagree

[Erik Hensema]

At some point, connection quality on IPv4 will be worse than connection quality on IPv6 for a significant amount of people. Their CGNAT may be overloaded. They may run applications which don't work correctly behind CGNAT.

When this point is reached, dual stacked hosting will be an advantage over IPv4-only hosting. Search engines may start to weigh in IPv6-reachablilty of sites. When this happens, you'll want to be with a hoster which supports IPv6 already.

Thanks...

[Anonymous Coward]

Thank you, Captain Obvious!

This is where government should mandate compliance

[Anonymous Coward]

One of the instances where it makes sense! Require major internet companies to be IPv6 compliant.

Meh

[Nammut]

Granted:
IPv4 address space is 'close' to being depleted.
IPv6 is 'far' from being common.

Still:
Yes, you should consider the fact that IPv6 will give you decent end to end connectivity again(finally), or at least it can. (some seems to have a problem letting go of NAT)
No, you should not buy any soft or hardware anymore that doesn't support IPv6.

Yes, chances are your ISP is slow with implementing IPv6 and making it available natively on their network for you, most are. It's an investment they without an obvious profit or ROI for that matter.
Yes, chances are your hosting provider is slow with ... (see above, same thing applies)

No, your home network does not need IPv6 in itself, it's puny and has very few devices. Yes you should still aim for IPv6 on your home network if you're gonna change the network (equipment/configuration) anyway, it'll save you from having to fix it later on when you need that one IPv6 only program to run or that one IPv6 only service you wanted from the web. (or worse when you want to play that one awesome game that won't work behind a NAT)

No, IPv4 is not evil, it's just outdated.
Yes, IPv6 is good, the next step and the future etc. ...

So basically if you're a decent nerd, next time you mess up your network you might as well get the IPv6 configuration sorted and done. Then, when your ISP catches up you may only need to change the prefix and have connectivity.

Unless of course, you enjoy being limited in your internet access and connectivity (Might I suggest getting a hold of some coax and ARCnet NIC's in that case)

Re:Meh

[Anonymous Coward]

No, IPv4 is not evil, it's just outdated.
Yes, IPv6 is good, the next step and the future etc. ...

What the hell are you talking about? With the fragment bit and MSS rewriting commonly performed during NAT, when was the last time you saw an IPv4 PMTUD black hole? When was the last time you used IPSEC? How does IPv6 solve the loc/ID split? I can go on and on and on....

So basically if you're a decent nerd, next time you mess up your network you might as well get the IPv6 configuration sorted and done. Then, when your ISP catches up you may only need to change the prefix and have connectivity.

Unless of course, you enjoy being limited in your internet access and connectivity (Might I suggest getting a hold of some coax and ARCnet NIC's in that case)

There you go again, offering advice on something you appear not to understand. The single pressing problem with v4 is address exhaustion. Had IPv6 limited itself to that problem, we'd all be using it right now!

Re:Meh

[Dan Dankleton]

Nope - there are two pressing problems with IPv4: Address exhaustion and routing table explosion. IPv6 fixes one of them and helps with the other (if there was a solution to multihoming that was neater than SHIM6 and didn't require BGP then it would have completely fixed the routing table growth, but you can't have everything.)

Re:Meh

[Anonymous Coward]

Nope - there are two pressing problems with IPv4: Address exhaustion and routing table explosion. IPv6 fixes one of them and helps with the other

Nope. If IPv6 is a good answer to address space limitations, why are we not already using it?

if there was a solution to multihoming that was neater than SHIM6 and didn't require BGP then it would have completely fixed the routing table growth, but you can't have everything.

I did mention location and host id splitting -- you may not agree but do keep up ;)

Re:Meh

[Rising Ape]

Nope. If IPv6 is a good answer to address space limitations, why are we not already using it?

Because we haven't needed it yet, as IPv4 addresses were still available. And still are, apart from in the APNIC region.

Re:Meh

[Pentium100]

I'm waiting for my ISP to offer IPv6. No, I do not want to use a tunnel because of two reasons:
1. Since there are no exit points inside my country, the connection will be slower
2. When the ISP actually starts offering IPv6, the tunnel configuration will not work for it (so I can't prepare for it now) and I might actually have new computers with newer OSs by that time, so configuring the old ones might be pointless.

Also, maybe by the time the ISP offers IPv6 some OS will support NAT for it (NAT has more uses than just making more than one PC appear as one to conserve addresses).

Re:Meh

[Nammut]

I agree tunneling now isn't as useful and certainly is not worth losing connection speed over.

There still seems to be rather a lot of discussion on NAT for IPv6 tho, mainly if there should be a standard drafted to prevent the plethora of IPv4 NAT types and implementations.

There's doubt about how wise it would be to define a standard for IPv6 NAT since it's likely to promote the use of NAT(partially due to familiarity with it), and thus maintaining connectivity issues existent in IPv4 today. (As well as application development challenges that come with the use of NAT)

What may have been a very good idea at the time to avoid the IPv4 depletion problem, might in the end stand in the way of proper connectivity as it was envisioned (and is possible with IPv6).

Some find NAT to be a security measure, or even worse(in my opinion at least) a best practice concerning internet connectivity for clients.

I myself for one appreciate the benefits IPv4 NAT offers today but despise the limitations it causes for connectivity and applications/developers. I'd much rather not use NAT at home, instead have only a decent firewall configuration to provide security and limit only the connectivity I choose to limit.

Re:Meh

[Pentium100]

There's doubt about how wise it would be to define a standard for IPv6 NAT since it's likely to promote the use of NAT(partially due to familiarity with it), and thus maintaining connectivity issues existent in IPv4 today. (As well as application development challenges that come with the use of NAT)

Well, "connectivity issues" will remain because people will be using firewalls that block by default. Adding an exception is the same difficulty as forwarding a port on a NAT router. And your applications should use the IP addresses in the packet headers anyway.

Some find NAT to be a security measure, or even worse(in my opinion at least) a best practice concerning internet connectivity for clients.

NAT for clients is essentially the same as a firewall that blocks by default. Would you advise not to use one?

I'd much rather not use NAT at home, instead have only a decent firewall configuration to provide security and limit only the connectivity I choose to limit.

That's your choice, but I'd rather block by default and allow what I choose to allow. That way, there is less chance that I miss a port and get hacked (if I miss a port on a block by default configuration, the connection does not work and I find out quite fast, if I miss a port on an allow by default configuration I might not know about it until I get hacked).

I once used NAT to load balance two internet connections with zero cooperation from the ISPs. The application I used also did not know about this and even BitTorrent worked over such configration.

Re:Meh

[Anonymous Coward]

Well, "connectivity issues" will remain because people will be using firewalls that block by default. Adding an exception is the same difficulty as forwarding a port on a NAT router. And your applications should use the IP addresses in the packet headers anyway.

I think however that using a firewall instead of a NAT implementation (especially since there's so many different types) makes more sense(considering the purpose) and is 'easier' to maintain and troubleshoot. Additionally a firewall can be run transparent lowering the attack surface of your security measure on the ('evil') outside, the principle of NAT makes this impossible for NAT implementations as far as I know.
However if you want to drop everything/connections you don't want it remains true that, while it's not the purpose of NAT, it is the added result. One simple rule in a firewall does the same on the other hand.

NAT for clients is essentially the same as a firewall that blocks by default. Would you advise not to use one?

I'd suggest using a firewall over a NAT as I mentioned, but that's really personal preference with IPv4. In IPv6 there's not a real standard for NAT'ing yet thus the choice would be made for you, people are used to having NAT tho and hence the discussion about making a standard for it.
Unlike with IPv4 NAT that's missing a standard the suggestion would be to try and resolve as much issues as NAT brings to the table in a NAT standard for IPv6, this is something of a challenge tho and if anything it will be time consuming to complete. Danger lies in vendors doing the same as they did with IPv4 and 'inventing' a "standard" themselves driven by market demand posing the same 'problem(s)' as IPv4 NAT still has today.

I suspect IPv6 NAT will be there sooner or later so I sincerely hope an actual standard surfaces soon enough to fit the need of the market, even though I will keep advising against using it unless there's an undeniable need that can't be filled by a router and/or firewall set up.

That's your choice, but I'd rather block by default and allow what I choose to allow. That way, there is less chance that I miss a port and get hacked (if I miss a port on a block by default configuration, the connection does not work and I find out quite fast, if I miss a port on an allow by default configuration I might not know about it until I get hacked).

I once used NAT to load balance two internet connections with zero cooperation from the ISPs. The application I used also did not know about this and even BitTorrent worked over such configration.

Agreed, better to be safe then sorry when it comes to security. And I think your NAT load balancing situation might be one of the best arguments to need NAT as far as I've seen in the discussion about IPv6 NAT.

In the end there's simply a technocrat standpoint(avoid NAT) and a security standpoint(use NAT) to IPv6 NAT and I trust the discussion will go on for a very long time yet.

Re:Meh

[Nammut]

/offtopic
One should definitely log in before posting :S , must be sleep deprivation that resulted in me being the anonymous coward(#36359892) above.

Re:Meh

[Pentium100]

Additionally a firewall can be run transparent lowering the attack surface of your security measure on the ('evil') outside, the principle of NAT makes this impossible for NAT implementations as far as I know.

OK, now I'm a bit confused. I assume that by transparent firewall you mean that the internal IPs are exposed (the firewall behaves like it is not there, well, other than filtering some packets). In that case I do not see why the attack surface would be lowered. I mean a NAT router also has a firewall (on Linux for example, iptables can be used as a router and firewall). If there is a bug in the firewall code then the device can be hacked and that does not depend on the mode. Same with NAT, if there is a bug in the code then it can be hacked.

Also, a transparent firewall would allow the bad guys to count how many machines you have. While this is not really serious, it would help them, especially since with NAT they cannot be sure whether port 12345 and 12346 go to the same machine or not.

However if you want to drop everything/connections you don't want it remains true that, while it's not the purpose of NAT, it is the added result. One simple rule in a firewall does the same on the other hand.

Yes, and both methods work well. What I meant was, you said about connectivity issues that are present with NAT. Yes, I need to forward a port for you to be able to connect to me. But the same would be true if I used a firewall - I still would have to add a rule to allow your packets. If I used Linux and iptables, the rules would look very similar.

Also, the point is that with IPv6, nobody would force you to use NAT, like it is with IPv4. If you do not like it or use protocols that do not support it, just do not use NAT, while I could continue to use it (if it becomes available of course).

Re:Meh

[Nammut]

OK, now I'm a bit confused. I assume that by transparent firewall you mean that the internal IPs are exposed (the firewall behaves like it is not there, well, other than filtering some packets). In that case I do not see why the attack surface would be lowered. I mean a NAT router also has a firewall (on Linux for example, iptables can be used as a router and firewall). If there is a bug in the firewall code then the device can be hacked and that does not depend on the mode. Same with NAT, if there is a bug in the code then it can be hacked.

Also, a transparent firewall would allow the bad guys to count how many machines you have. While this is not really serious, it would help them, especially since with NAT they cannot be sure whether port 12345 and 12346 go to the same machine or not.

Yes, I do indeed mean the setup where your internal(internet routable) IP addresses get exposed. I meant to point out that it lowers the attack surface of the security measure, in this case the firewall. NAT by itself (as a security measure) does not provide this, granted that one would not be especially smart to not run a firewall in front of a firewall which is one of the reasons I prefer to not run NAT and a firewall but just a firewall instead, to me that limits administration to the one function.
As for counting the amount of machines, this is possible behind a NAT as well, granted it takes more effort, more time and increases the amount of guess work. (2 random sources : http://www.antionline.com/archive/index.php/t-238181.html http://www.techspot.com/vb/topic5154.html [2003] ).

While usually a bug in the code indeed exposes the security measure to possible abuse, if you run transparent however, lacking a public IP address makes the chance those particular bugs get abused drop dramatically. After all you're not aiming communications directly at the firewall machine. One would first need to identify the fact that there's a transparent firewall by profiling, then either try the attack or run extensive profiling to try and identify the brand/version/implementation of the firewall and pick an attack based on that. Much like a NAT prevents direct contact to clients behind it on private ranges, a transparent firewall prevents direct contact to the firewall itself. It's nothing more then a packet filtering bridge like device after all. Intelligently crafted packets can still hurt it of course, but then I don't believe it can be 100% secure unless you unplug the cable.
I just trust transparent firewalls more then I trust NAT to keep my network safe based on the above, I don't find it a threat if someone is able to determine how many hosts are on my network, firewall, NAT or even both can't really prevent that anyway.
And let's not forget one can still control the exposure of hosts by other means like proxies for web/ftp/etc.

Yes, and both methods work well. What I meant was, you said about connectivity issues that are present with NAT. Yes, I need to forward a port for you to be able to connect to me. But the same would be true if I used a firewall - I still would have to add a rule to allow your packets. If I used Linux and iptables, the rules would look very similar.

Also, the point is that with IPv6, nobody would force you to use NAT, like it is with IPv4. If you do not like it or use protocols that do not support it, just do not use NAT, while I could continue to use it (if it becomes available of course).

True, I agree the two effectively pose similar challenges to connectivity yet under the premise that NAT on it's own should always be fortified by a firewall I'd rather leave the NAT out if I had the choice. Save me the trouble of administrating both a firewall and port forwarding or public/private IP mapping on a NAT solution. IPv6, as you point out, makes NAT a choice rather then a given, I am sure that if the IPv6 NAT standard doesn't get drafted the 'big' vendors will step in to fill the void albeit with their own, not necessarily good/friendly/open, 'standard'.

Re:Meh

[Pentium100]

While usually a bug in the code indeed exposes the security measure to possible abuse, if you run transparent however, lacking a public IP address makes the chance those particular bugs get abused drop dramatically

Oh, OK.
Since I do not have a lot of money, I want to use the physical machine not only as a router, but give it other functions as well, for example VPN server (so I can connect securely with my laptop, I won't start using unencrypted connections just because the internal IPs of my network are public accessible). In this case the device will have to have its own public IP.

I'll also read about the method of counting machines behind NAT, it looks interesting.

Anyway, I use a NAT router without an additional (hardware) firewall, just the software one that is provided with the OS (both Windows and Linux) of the router I use. It drops packets that are not set up to go anywhere (the alternative would be for the router to interpret those packets as directed to it, which is less secure).

NAT can be used for other things than just saving addresses, I do hope that it will be available for IPv6 by the time my ISP starts using v6 and/or it becomes really needed.

Chicken-and-egg continues

[dkleinsc]

Web hosts will still not support ipv6 because there aren't enough customers for it to be worth it. ISPs will not support ipv6 because there aren't enough web hosts to be worth it. Everyone sits around waiting for somebody else to move first, in a classic deadlock pattern.

Re:Chicken-and-egg continues

[GPLHost-Thomas]

You might want to reconsider the host part. Many times, we had customers that wanted IPv6. After loosing 2 or 3 bids, we implemented it!

IPv6 Article Mandate

[Anonymous Coward]

Is there some kind of mandate at /. for putting up an IPv6 article every week which leads to the same comments ad nauseum?

Re:IPv6 Article Mandate

[j h woodyatt]

I play comment Bingo with them.

Sticking IPv6 the Bizness.

[Anonymous Coward]

...Is what it's all about.

The number of high-end, hugely expensive firewalls and load balancers that do not support IPv6 is legion. Blowing five digits or more plus labor to update, versus paying a few cents more per IP... Well, let me tell you what any sane business is going to do. ...And before the trolls come, yeah, no, IPtables and HAproxy are not the answer. We're talking enterprise, not website about your cat.

IPv6 is overwrought

[Anonymous Coward]

It's not widely deployed because it's way too overwrought, and it's pretty easy to screw up and turn into a security and usability boondoggle.

How about this? This is my proposal for IPv5. Whack another two octets onto the front of your addresses, so that the entire 0.0.0.0.0.0/48 block is reserved for IPv4 use - if the first two octets are zeroes, it's IPv4 over IPv5. I suppose we could also reserve 10.0.0.0.0.0/48 for local networks, and we could reserve 127.0.0.0.0.0/8 for the loopback address, which would be 127.0.0.0.0.1. Of course, 0.0.127.0.0.1 would still work as well, but why not have a "native" loopback.

While I'm at it, jumbo frames can be up to 1MB. Network gear claiming to be IPv5 compliant MUST support this. Boom, less overhead.

Everything else remains the same. Ports still exist in the same manner, you don't have silly assignments (My cell phone claims a /13 when using IPv6. Wryyyyyyyy?), and if 65536 present day internets are not enough someday, rinse, repeat, and go to IPv6 with 64-bit addresses. You could easily distribute real IPs to every connected device, but since NAT still works, you wouldn't need to. Gram's toaster oven and laptop doesn't need to be world-accessible, and SHOULD probably be NATted away behind her $40 Best Buy router.

Anyone know how to set up a RFC?

Re:IPv6 is overwrought

[SmilingBoy]

And what is the advantage over IPv6? In fact, what is different of your "IPv5" except the location and the number of of the additional bits?

Re:IPv6 is overwrought

[magamiako1]

You are speaking in IPv4 terms, in what "already happens" and not "what could be".

Re:IPv6 is overwrought

[Bengie]

Take a look at the IPv4 packet structure. Where do you plan to add these octets? Don't tell me you're going to change the format because that will break backwards compatibility and would be no different than just using IPv6, minus the confusion of having a similar format.

While a 1MB frame would be nice for reduced routing overhead and increased throughput, the added jitter would be horrible. Great on a LAN, bad on the i-net backbone.

Re:IPv6 is overwrought

[baerm]

How about this? This is my proposal for IPv5. Whack another two octets onto the front of your addresses, so that the entire 0.0.0.0.0.0/48 block is reserved for IPv4 use - if the first two octets are zeroes, it's IPv4 over IPv5.

...

Anyone know how to set up a RFC?

Yes, got to www.ietf.org. Become active in that organization and try to start a work group (or find one where this RFC would be applicable), write and submit your RFC. Of course, the main problems: no one is implementing it at ISPs, no one is implementing in hardware, compatibility issues, ISPs won't implemented until they have too (i.e. they believe they lose money without it or believe they will make more money with it), everyone one and Dilbert's mother will have an idea of what to add / change in your proposal before anyone accepts it and actually does any of the above. If you're extremely successful, you end up with a bastardized IPv4 that will take longer for anyone to use than IPv6 (i.e. which is already defined and available in modern devices), does less, and has a much smaller address space than IPv6. I'm not thinking it would be a big win.

Re:IPv6 is overwrought

[Pentium100]

While I'm at it, jumbo frames can be up to 1MB. Network gear claiming to be IPv5 compliant MUST support this. Boom, less overhead.

That would be really fun on 100mbps LAN and Wi-Fi. Oh, look, somebody is sending a 1MB frame, OK, my VoIP/game packet can wait those >100ms...

Re:IPv6 is overwrought

[Anonymous Coward]

Version number 5 was taken already, so you cannot use that. Apart from that, everything you suggest is something that IPv6 was already designed to do. For the compatibility there are ipv4 compatible ipv6 addresses, ipv4 mapped ipv6 addresses, and 6to4. But none of that made IPv6 happen as fast as it should have.

The main difference in your suggestion from the actual IPv6 protocol is that you suggested smaller addresses than IPv6, so your suggested 48 bit addresses would be running out. If you like short addresses you should take a look at IPv4.1. But you shouldn't expect to effectively use more than 80% of the bits in the address. In other words you need to find out how many bits you need for the number of devices you expect and then add at least 25% more bits to compensate for bits lost due to administrative overhead.

The current IPv6 address allocation strategy does look like a waste, but so what, it is most likely going to last anyway. Besides initially the address space was split into 8 equal sized parts of which two can be used for RFCs and one was given to IANA to hand out from. That means if the allocation strategy turns out to be broken also for IPv6, there will be another 5 chances to get it right. My guess is, if it another attempt turns out to be needed, the local portion of the address will be reduced from 64 to 56 or 52 bits, and the network portion of the address is increased from 61 to 69 or 73 bits.

As far as packet sizes goes, IPv6 did increase the sizes that must be supported significantly compared to IPv4. In IPv4 the packet size implementations were required to support was 576, and the MTU must not be less than 68 bytes on any link. In IPv6 the numbers were increased to 1500 and 1280 respectively.

To put it bluntly

[olterman]

Not much will happen when most end users still use IPv4. Truth is that IPv6 offer zero to "some" benefits to the end user and "switch" will happen only after IPv4 is eradicated and not possible to use.

Re:To put it bluntly

[Skapare]

There are benefits to IPv6-only. Among them, no RIAA or MPAA snoops (at least for a few years).

Money is a powerful motivator

[Fred Ferrigno]

The deadlock will be solved by the market for IPv4 addresses that everyone seems to think is so horrible. The unused IPv4 addresses will get sold off first. As prices go up, even currently used IPv4 addresses start looking like a juicy money-making opportunity. Hosts that can migrate without much pain will get paid to do so. ISPs and vendors who want their business have an incentive to make the process even less painful. Gradually, the cost of IPv4 will go up, the cost of IPv6 will go down, and people will migrate naturally of their own accord.

Re:Money is a powerful motivator

[marcosdumay]

Or gradualy the routing tables will get out of the reach of the routers at some places, and IPv4 will completely stop working.

There are many problems with auctioning IP addresses.

Force the issue

[sjames]

One thing we really DON'T need on the net is an IP version of the real-estate bubble. The best way to make the transition happen is to set a hard cut-off day. On X day at midnight, all IPv4 allocations are rescinded.

Of course, what sort of traffic you run on your own LAN is your own business, but if you want to traverse the public internet, you'll need to use v6.

Not to mention client-side IPv6-only

[ranmachan]

I set up a xen dom0 with IPv6-only yesterday and a local bind instance for DNS.
I found that I can't even reach a lot of IPv6-enabled sites because their nameservers only have IPv4-addresses, so they don't resolve...

Actually, I can see IPv6-only for NEW systems

[WindBourne]

Seriously, assume that a new device comes out and the company is a bit like Google in wanting to make real changes. They could turn around and require that access to the site be via IPv6 only. They might have to use a tunnel, but the idea is that the website itself would be IPv6 to push that as being the only solution. And that would mean that for any other system to access it, they must use IPv6.

Re:This is where government should mandate complia

[WindBourne]

NO!. Requiring that is a waste.
However, there IS a simple solution.
Simply require that the feds use IPv6 and IPv4 everywhere with IPv4 support dropping 1 year out. That will get a number of ISPs to re-think this through REAL QUICK. In particular, all of the big players will have IPv6 done very quickly. And all of the smaller companies will make fast switches as well.

There is a simple way to make this happen FAST

[WindBourne]

Have the feds require that all of their dept do IPv6 by end of year. Then require that they drop IPv4 by year end 2012. That will solve these issues QUICKLY. The reason is that many businesses will start shopping for ISPs that support IPv6. And they will tell their current ISP that they are leaving unless they have it PDQ. By end of 2013, IPv4 will be gone.

Re:This is where government should mandate complia

[DarwinSurvivor]

Yeah, let's just give a big middle finger to all the financially suffering families out there that can't afford a new computer and are still using old Win98 (or worse) that has NO support fox IPv6. And before anyone goes on a tangent about using 13 year old software, 99% of people have no apparent (to them) reason to pay for a new computer just for the "shinny" factor.

IPV6 static == end of privacy

[knorthern knight]

> no RIAA or MPAA snoops
Wrong; if anything, it'll be easier. Dynamic IP addresses (at least for ADSL) are an address-conservation measure. It's based on the assumption that not every customer is online at the same time. By using dynamic IP addresses, you can get away with fewer of them. This is important in the current environment.

Without the address scarcity to force dynamic IP address usage, an ISP can assign you a fixed /64 under IPV6. It doesn't matter how much you shuffle your address inside that block, every packet you send out will have your prefix. In addition to using using cookies, Google and Adclick/etc can simply aggregate data from every web user. Eventually, somewhere in your web-surfing, you *WILL* give out your realword contact info, and all that web-surfing will be traceable to you. Nothing short of wifi hotspots will provide privacy.

Re:This is where government should mandate complia

[WindBourne]

It is amazing how easy it is for an ISP to provide a 4to6 for these.

Re:This is where government should mandate complia

[DarwinSurvivor]

And if they do that, there really isn't any reason for them to turn on IPv6 now is there?

Private Cloud

[ircharlie]

I don't want to use some company's cloud service. I want to store my data on my own NAS. I do want the convenience of accessing that information from anywhere though which is what cloud services offer. The reason I can't do this myself is that there is no eco-system for private clouds. What would a private cloud eco-system look like? Well it would consist of some opensource protocols for syncing from any device and a fixed IP with some storage attached to sync to. But fixed IPs are expensive because IP4 addresses are minimal. So the killer app for IPv6, it seems, is the private cloud. IPv6 => lots of private fixed address => private cloud to sync data to.

Redefine v4 classes in the interim

[Anonymous Coward]

Currently, you have (excluding the private addresses 10.x.x.x, 172.16-31.x.x and 192.168.x.x

1.x - 126.x - Class A w/ /24 subnets
128.x-191.x - Class B w/ 16 subnets
192.x-223.x - Class C w/ 8 subnets

In other words, you have 126 subnets that are concentrated in 126 owners, 63 subnets distributed among ~ 16k owners, and 31 subnets distributed among 2 million owners. That's all you have.

I suggest reversing this, so that

Class A addresses will have /8 subnets instead of /24
Class B addresses stay unchanged
Class C addresses will have /24 addresses instead of /8.

Then you'll have 8 million potential owners for Class A, 16k owners for Class B, and close to 8k for Class C. In other words, 4 times as many public IPv4 addresses. Issue updates to DHCPv4, DNS, etc to take care of this, until that happens.

Buys more time to convert all to v6, and this time, accompany it w/ a warning that all IPv4 will be shut OFF by a certain date...