Slashdot Mirror
Comcast Begins Native IPv6 Deployment To End Users
First time accepted submitter Daaelarius writes "Comcast has begun deployment of Native IPv6 access to end users. The deployment is starting out small with a single market, but is expected to expand rapidly. They have provided ... more in depth technical details."
Finally; native dual-stack IPv6 for home customers. Perhaps we can avoid a post-exhaustion future of NAT-upon-NAT and use restrictions.
until every light switch and toaster has its own /64
Nullius in verba
I'll not still use NAT for my home network for all my devices that I authorize to use the wireless router...etc?
What does the regular user have to do to use this...and what exactly is going to push him to change his whole home network along with all the devices he currently has on there (tv's, ipads, laptops, desktops, toasters...etc)?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Kudos for Comcast for finally getting the ball rolling on IPv6. A /128 address gets their foot in the door, and as their post says, they can expand it later.
When is it going to be available nationally instead of a couple of markets?
It's rare to see companies take such a long term view of their business, but Comcast sure is doing it now. I know from seeing it being done at work, huge IPv6 deployments are not trivial things!
With IPv6 addresses being so plentiful, does that mean it should never have to change? I've been running a webserver and mailserver on my Comcast account since it was an @Home account (10+ years) and my IP rarely changes, but occasionally it still does.
IPv6 deployment - Yea! Wait, it is Comcast. Ok, what's the catch?
"The ferrets, they're every where I tell you!"
Well, Dual Stack Lite is going to be their long term IPv4 availability, which removes NAT from the CPE and shifts it up into the ISP layer. So all of your transactions will be manipulated inside the ISP's AFTR element, which would be a very convenient place to mine your data stream for goodies. But that would be paranoid to think they would do that. Especially when they could do it anywhere else just as easily!
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
Extra charge for allowing you access to IPv6?
Extra charge for staying with IPv4?
Extra charge for keeping your IPv4 if you also want IPv6?
It's lock-in. Once you've gone IPV6, who's going to want to go back. You'll be a Comcast customer until FIOS, DSL or whatever other competition might actually exist catches up.
The living have better things to do than to continue hating the dead.
My solution has always been to bring the toaster into the shower with me so I do not require a notification.
Or at least that's my plan now, I'll implement that right awaZORCH
"There is more worth loving than we have strength to love." - Brian Jay Stanley
$5-$8 Per IPV6 IP just like cable boxes
The problem is that there is no benefit in using IPv6 as long as there are no IPv6-only services.
Therefore, it is unlikely that IPv6 can be rolled out successfully.
I always have mixed feelings about it. On paper, it's amazing and blows IPv4 out of the water.
However, while sure now your (everyone keep saying toaster so why not) toaster can now connect directly to the web, now also your ISP can see exactly how many devices you're attaching to the internet.
ISPs (or at least the ones in America) do anything and everything they can to squeeze more money out of the customer. I'm willing to bet it's only a matter of time before you're paying for internet per device.
And why would anyone but an idiot want a phone number or postal address that can be reached by the public at large??
Must be a relic of an operating system.
I've seen plenty of people plug their cable modems right into the back of their computer with no firewall of any kind. Thankfully, most operating systems ship with a software firewall - it's better than nothing. Most of these types of customers bought a nat box, not due to security concerns, but to get wireless connectivity.
IPv6 direct connectivity will be a problem ONLY if end users plug all of their devices into a switch and those devices lack a software firewall. I don't know of any "non-technical" home users that have such a switch. Everyone seems to have a "nat box" simply for wireless connectivity. I suspect people will not go buy a dumb switch and access point, simply because they do not know what they are.
I suspect most people will go buy an "IPv6 capable" firewall/switch with built in access-point. End users will have no idea that they no longer use nat - hell most probably don't even know they have it now.
-ted
Did you hear that Verizon? Your "next generation optical network" is now behind the clunky old cable modem guys on this issue. Where is your update? Hmmmm?
I read the internet for the articles.
They won't really be supporting IPv6 until then.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Pretty much THIS. Had to deal with the same thing myself.
1. The only IPv6 "routing and discovery" packets that should be flying around are local-network only. The fact that you didn't know that, and the fact that you are confused by the whole thing, suggests that the problem is with you, not IPv6.
2. More than likely, you screwed up configuring your public web server when setting it up for IPv6 (it is hard to tell, because the only information we have is you blame IPv6 for it). That suggests the problem is with you, not IPv6.
3. You need to sit down and figure out how things work, security-wise, on IPv6. That's nice... join the club? There isn't some grand conspiracy to confuse and frustrate you.
4. There was a time when people complained about remembering phone numbers that were an incredible *7* digits long. My advice to you is adapt or go get a job at McDonalds. I hear there is some sort of distributed naming system that lets you assign names to IP addresses, maybe that will help.
Wrong also. The security gain comes from having to rewrite adresses to be connectable. No rewrite == not connectable. This is also the weakness of being behind NAT, as you can only map adresses on a per port basis. So you can run exactly one webserver (on port 80, that is).
An IP6 firewall (regardless of statefulness) would enable you to run many servers behind it.
The current situation provides some level of security for the end-user ... even if the end-user does not understand the concepts.
The get 1 IP address from their ISP and they buy a magic box that provides them lots of sockets to plug stuff into and wireless access. They don't know if they're running NAT or PAT or what the difference is between stateless and stateful.
But will that same behaviour have different results once they receive globally routable IP addresses for each device? I think it will.
And I also think that there will be IPv6 compatible magic boxes that do NOT have firewall capability up for sale very soon. It's just cheaper to NOT have certain functionality and that means saving $5 or so on the device. In essence, they will be just a cheap switch/wireless-bridge that plugs into the Comcast cable modem.
And those devices will, initially, appear to have MORE functionality as the end-users won't have to go through additional steps configuring the firewall to connect to other gamers / torrents / whatever.
And that's not considering the end-users who will turn off the firewall functionality of the firewall/wireless-bridge/router devices because it "makes everything work".
Of course, once everyone's on IPv6, the copyright police will be better able to tell exactly who is doing all the illegal downloading and trading. WINNING!
I can see where that would be a nice consolation prize... FIOS pretty much sucks, with all the filtering and restrictions of servers, but Comcast is even worse.
Yes, I've had both. At the same time, briefly... I'm on FIOS now because the effective bandwidth is better. Comcast's useable bandwidth went down every time they raised my absolute bandwith, because their worm farm was able to slam my firewall harder. Pretty much every box on my segment was totally owned and was hammering away at the rest of Comcast's customers 24/7. Comcast offering antivirus to people who were already completely rooted didn't help much, either.
Like 10x a standard consumer connection.
If the ISP is doing carrier-grade NAT across their whole address pool, does it matter anymore that you might technically share an IP address with others? Heck, you could be using different public v4 addresses for different connections and most people would never know.
NAT is not the Devil coming to Eat your Children.
NAT can be used to source many machines from the same address, and it can also be used to source one machine from many address.
You can do all kinds of cool stuff with NAT, because NAT is a firewall concept.
But most of you dipshits see "NAT" and instantly assume it's some Draconian method of forcing you to only have a single public IP address. Yeah, sometimes it's used for that, but that's only one example and only a few ISP's actually do that in the first place. Most will give you anywhere up to a dozen, which is limited by the capabilities of the hardware they put in your house, not some nefarious plot to "keep you down, maaaan."
The problem with getting around NAT isn't NAT, it's the fact your piece of SHIT $140 "bad-ass gaming router" you bought from Fuck-Mart can only support one IP address on the public interface, and can only do LAN-side routing.
No, I don't. And you probably mean PAT, not NAT.
No it does not. The same as IPv4 does not require a firewall.
But, many end-users purchase an EXTERNAL firewall in order to get the PAT functionality so that they can run multiple devices (and wireless) on the single IP address that their ISP provides them.
So, in order for them to overcome the limitations of IPv4 (fewer IP addresses) they, inadvertently, purchase a firewall that improves their security.
I have no idea what you're thinking of.
Again, because with IPv6 there is no need for the ISP to limit the end-user to a single IP address. So the end-user can purchase different devices (such as a switch with a wireless bridge) that would allow the same PERCEIVED functionality with IPv6 as they get with IPv4 and a firewall/PAT device today.
And the point being that the end-user does NOT understand that TODAY. And cannot be expected to understand it when Comcast rolls out IPv6.
Having globally routable addresses means that if the end-user's home network is mis-configured from a security stand-point, their devices could still "work" from the perspective of the end-user. They would still be able to access the Internet.
Right now, with IPv4, that is less likely for the end-user.
They will probably still charge a fee for every additional IP address, so we'll still be stuck with NAT all over the place
Well, Dual Stack Lite is going to be their long term IPv4 availability, which removes NAT from the CPE and shifts it up into the ISP layer. So all of your transactions will be manipulated inside the ISP's AFTR element, which would be a very convenient place to mine your data stream for goodies. But that would be paranoid to think they would do that. Especially when they could do it anywhere else just as easily!
I'm just thinking ahead - perhaps the next box delivered to me for DSL could very well have some memory they could upload instructions to, to sniff on the spot and report back what it spots, rather than requiring the provider to sniff at their end.
With net neutrality going in and out of legislation (or directions to/from FCC) I'm not taking things for remaining status quo.
A feeling of having made the same mistake before: Deja Foobar
Wake me when these idiots offer a plan that doesn't include a 250 GB monthly data cap.
The government has a defect: it's potentially democratic. Corporations have no defect: they're pure tyrannies. -Chomsky
It looks like the initial deployments will only support recent Windows and recent OS X releases. Let me know when they take the blinders off their tech support people so that Linux folks can set their OpenWRT gateways and Linux servers up with IPv6.
SCREW THE ADS! http://adblock.mozdev.org/ Proud user of teh Fox of Fire - Registered Linux User #289618
Perhaps we can avoid a post-exhaustion future of NAT-upon-NAT and use restrictions.
Sorry, the post exhaustion NAT future already happened, and entirely because of the IPv6 design cock-up. If IPv6 had been designed for maximum compatibility with IPv4 we would have completed the transition decades ago.
I'm afraid it's going to get worse from here, too. The big question is, what use is IPv6 when there are next to no web sites serving it?
Have you got your LWN subscription yet?
IPv6 is a hackers paradise, thats why there are whole toolkits made for hacking it by reputable parties such as the Hackers Choice.. Backdoor deployment Enable IPv6 6to4 tunneling Run Backdoor on IPv6 address Not detected by port scanning Harder to analyze traffic IPv6 protocol exploits tools can be coded in just 5-10 lines Sounds like hacker heaven! Nat-upon-NAT!?!? I guess the phrase Double NAT escaped your notice.
1. The only IPv6 "routing and discovery" packets that should be flying around are local-network only. So that means anyone who bypasses your wireless WEP or WPA keys and has access to your local network. 2. More than likely, you screwed up configuring your public web server when setting it up for IPv6. Maybe, perhaps, I wouldn't know as I use IPSec & TCPCRYPT for my tunneling not IPv6. 3. You need to sit down and figure out how things work, security-wise, on IPv6. Oh I have and whats more I have all the tools to hack into it. 4. I hear there is some sort of distributed naming system that lets you assign names to IP addresses, maybe that will help. Bind9 and no not really that just set's you up for DNS Cache spoofing!
How does one enable it? Under Windows 7, if you click on Properties under Network, you have Client for Microsoft Networks, File & Printer sharing for Microsoft Networks, QoS Packet Scheduler, and Internet Protocol (TCP/IP). In Vista and 7, that line item is Internet Protocol version 4 (TCP/IP), and then there is one more item Internet Protocol version 6 (TCP/IP). That's how you get IPv6 in Vista and 7. But how does one get it in XP?
"Implicitly" should have been "explicitly", of course. When will Slashdot implement proper editing of comments? :-)