Slashdot Mirror
World IPv6 Launch Day Underway
A number of readers have written in with stories related to today's permanent rollout of IPv6 by several major organizations. From the looks of it, for the 1% or so of end users with IPv6 support, everything is going smoothly. For those not so lucky to have IPv6 already, an anonymous reader writes with (mostly) good news: 60% of ISPs intend to enable IPv6 by the end of 2012. For business users, darthcamaro provides some words of caution: "...the Chief Security Officer of VeriSign doesn't think IPv6 should be turned on by a whole lot of people. The problem is network security devices in many cases don't scan IPv6. So if you turn IPv6 on, you're screwed.
'If you don't have that visibility into IPv6, you should probably consider explicitly disabling IPv6 on your systems until you can take a very concerted approach to enabling IPv6 in a secure manner,' McPherson said."
This is Verisign the operator of the .com and .net registry, not the other Verisign the certificate racket. The CA business was sold to Symantec in August of 2010. So don't mix this up with the recent news about the $99 fee to get your signed with the UEFI key that will be preloaded on every Windows 8-certified PC motherboard; that's all VeriNorton.
So when is slashdot going to leave the dark ages?
Secure messaging: http://quickmsg.vreeken.net/
With IPv6 support
AccountKiller
Google for this thing called 'DNS' it has been around for a while....
Secure messaging: http://quickmsg.vreeken.net/
Humans have different needs than computers. It's almost like we need a table of easy to remember names that can be used to look up IP addresses automatically by a computer. Then that table needs to be distributed automatically to all the ISPs in the world. That'll never happen. Sounds impossible.
DNS, or even a hosts file if you must
Also, the hex makes it easier to make words in statically-assigned addresses.
other than having every single device have a unique public IP that is a wet dream for google and other marketers?
Did folks ever get IPv6 multi-homed routing straightened out?
It always felt like conflicting goals at work -- on one hand, people wanted to simplify and shrink the size of the backbone routing tables, but on the other, a purely hierarchical routing space removes redundancy. That is, a tree graph has the property that there is only *one* path between any two nodes, which means a purely hierarchical routing arrangement would mean that the idea of 'routing around censorship' would go into the waste bin because there are no alternative routes possible. (Note that I am differentiating this from redundant *physical* links -- this is a matter of administrative links. If there is no multi-homing and the upstream provider is blocking/filtering/limiting traffic, there is no network route around it, physical redundancy not withstanding.)
So any current best practices for IPv6 multihoming for small ISPs/businesses?
"The problem is network security devices in many cases don't scan IPv6. So if you turn IPv6 on, you're screwed."
Funny, The ones here do. In fact the last firebox update said it covered ipV6.
What out of date garbage are people running out there that will not scan ipV6?
Do not look at laser with remaining good eye.
a great article about why wee need IPv6 : http://www.forbes.com/sites/firewall/2012/06/05/why-we-need-ipv6-now-and-what-it-means-for-network-security/
The issue isn't just addresses. IPv4 was never meant to be a global business network. It is an experiment that was never turned off.
I don't know why everyone is freaking out about remembering addresses... really really easy
12-16 hex digits, That is it... assign static address after that.
Mine: 2001:470:8xxx /48 /64 networks, I use my VLAN ID
that is my
then for my
2001:470:8xxx:vlan::1 == router
2001:470:8xxx:vlan100::1 == router
etc...
easy
For example, when I look at Comcast's site, I see "When Comcast decided to participate in World IPv6 Launch, we committed to enabling at least 1% of our customers with IPv6 by June 6, 2012." So, how does that figure into the 60%? If there are 50 ISPs in the world, but Comcast has 5% of the subscriber base, is that 2% out of the 60%? Or is it 5% Or is it .002%? I'm curious how this 60% number was calculated.
For your security, this post has been encrypted with ROT-13, twice.
"Google" won't help him. He needs to go to 74.125.226.64.
...that are going to enable IPv6 for all customers by the end of 2012? Does it include CenturyTel?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
I will not use it at my home. I have an IPv4 address, and always will.
I'm still hanging on to NCP you insensitive clod!
Thanks smartass, but some of us who run large scale networks and use computers for more than porn and Facebook need to access things by IP, need to be able to look at a routing table and have it mean something, need to look at traffic capture and know what we're looking at, and about a million other ways in which I use IPs on a daily basis. Doing a reverse lookup for every goddamn IP I ever see would be completely impractical. I do recognize the need for it, and realize it's going to happen eventually, but for a lot of us, the non humanreadability of IPv6 is a massive massive headache. Hopefully I'll be out of this shit industry before it becomes prevalent.
I've been using IPv6 via he.net tunnels on pfSense 2.1 for over a year now, and it's working great.
Really happy to see my Netflix streaming going over IPv6 this morning, too.
ixnay on the ostshay ilefay talk!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
you don't even need large scale networks - I need to remote desktop to VMs on a LabManager server - currently every single one of those is an IPv4 IP and I don't think we'll switch to IPv6 anytime soon, but I dread the day we do, since currently all I really need to do is remember the last number and have the first three memorized (the IPv6 auto generation by MAC address will likely make me have to memorize more or all of the IP). All of these are accessed by IP and all of these require hand editing files and injecting the IP into them (so they correctly serve client machines outside of the VM, and these have to be outside the VM because they need hardware graphics acceleration on the head).
You are welcome to leave at any time. We won't be sad to see you go. I heard McDonalds is hiring burger flippers. You may be qualified for that.
Wait.... you are running a 'large scale network' and looking at packet captures... yet are unable have your tooling do the reverse lookup automaticly?
Secure messaging: http://quickmsg.vreeken.net/
For such things, it would only be a 64-bit address you'd be looking at, since half the address falls within subnets. So if one wants to check up routing tables, then only the top half of it is what would matter.
You have many options, DHCP6, you don't have to use autoconfigure you can still assign all nice consecutive address to each machine if you like. Setup DNS that actually works and use the host names. Best yet and actually probably the easiest to do and still be secure both (dhcp6 server can do the DNS updates so the hosts don't need to).
This is not that difficult, and if you think it is you are in the wrong industry.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
You could define your subnets to be 120 bits so you only have to remember the 8 bit number at the end (like now) or you could use the IPv4 in IPv6 notation (x:x:x:x:x:x:d.d.d.d) which is not so different really from using 120 bits as your subnet prefix.
Run OpenWRT on your router, then.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
$> dig facebook.com aaaa
You're doing it wrong if you're flipping burgers at McDonalds. They switched to timed hot presses a while ago.
This is IPv6 Launch day. He needs to go to 2a00:1450:4016:801::1000
605413? Yes, it's a prime.
There's an app for that.
Google Fu KICK!!! Ha haaa
Life is not for the lazy.
..or other hostnames with AAAA records:
Add -4 to ping_check command, restart nagios and carry on.
Dan
To the dozens of new hosts worldwide.
I'm glad to see you mention that. While under the FreeBSDs, Monowall has supported BSDs for a while, the same hadn't been true about pFSense. I wanted to know whether pFSense 2.1 supports IPv6 or not. Checking out their site, it stated
Today is World IPv6 Launch day, when many major websites have permanently added AAAA records to make their sites accessible via IPv6. All our sites have been IPv6-enabled (on native connectivity thanks to bluegrass.net) since last year, running behind pfSense 2.1. Many others are using the current snapshots in production networks.
We’d hoped to have 2.1 released in time for today, but getting to the point we consider full IPv6 support has taken far more work than anticipated. As has become the norm for us over the last several years, we do much more than put a GUI on things, having to implement and/or fix things in the underlying software to meet the needs of our users. There was far more to implement and fix in the underlying software than we anticipated. We have the last major piece addressed this week with CARP IPv6 support now functional. We’re just validating things at this point and fixing some last issues, with the official release coming roughly in the next 1-2 months.
IPv6 isn’t yet a critical need for most every network, but it will be getting to that point quickly. I know many IT professionals have been ignoring it, but it’s time to get up to speed for those who haven’t yet. I encourage everyone to at least start experimenting with it at home if you haven’t yet. For the bulk of us who don’t have an option for native IPv6 at home, our Using IPv6 on 2.1 with a Tunnel Broker document will get you going.
Incidentally, which version of FreeBSD does pFSense 2.1 correspond to?
That thing is broken. Even the default values is transformed wrong. It transforms 127.0.0.1 to 0::7f00:1 but the correct answer is ::1. Then it transforms ::1 to 0.0.0.1. And 0.0.0.1 becomes 2002::1 (WTF?).
What good is it if does not know about the special cases?
You do realize that inside of a subnet, just like with ipv4, only the very last part of the number actually changes, so if you're able to make sense of the numbers for one, the other isn't that big of a difference?
Seriously, all it takes is a bit of practice, and a willingness to try, rather than "I fear change, and I shall keep my bush."
You really know how to do this - you're an ex-employee of the month at McDonad's?
I think the simple answer is if you need to address a machine by IP you shouldn't be using stateless autoconfiguration for it. IMO stateless autoconfiguration should be used only for client machines where it doesn't matter much that the addres is hard to remember or that the address changes when the network card is replaced.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Why isn't /. participating ?
What you meant to say is that "there are workarounds for the difficulties". Any way you slice it, it is still a PITA...either to deal with it directly or implement the workarounds. I wish they could have come up with a more sane implementation.
Or you are free to actually configure ipv6 addresses manually, so people would only need o memorise a prefix and the last 2-4 characters Prefix : 2001:0DB8:D:1::/64 VM1 2001:0DB8:D:1::100 VM2 2001:0DB8:D:1::101 etc ok a bit more to remember but the users you refereed to only have to learn the prefix and the part after the last : Will your users grumble a bit? yes, people don't realy like change Will the cope? My guess is yes, a few will have problems the first week or so but after that .....
Those long IPv6 addresses are a pain in the ass to remember. So, I'm not looking forward to this.
Use the for..err dns... or manually select your 64-bits of id and things aint soo bad.
It's auto-configured SLAAC addresses which are impossible to remember but it need not be that way if you don't want it to.
Use manual configuration or DHCPv6 to assign reasonable addresses.
Some lucky stiffs have IPv6 addresses shorter than anything possible with IPv4.
Sprint for instance...
http://2600/
Ok, which home router support IPv6 ? does it support IPv6 WIFI ?
I go to Frys, and mention which router support IPv6 for both internet and Wifi - all I get is a
blank stare.
Some lucky stiffs have IPv6 addresses shorter than anything possible with IPv4.
Sprint for instance...
http://2600/
Ok you know what if slashdot insists on living in the past and sitting on its thumb when it comes to IPv6 deployment so be it...but for godsake munging valid IPv6 URLs into invalid IPv4 addresses is crossing the line.
I entered 2600:: and slashdot posted 0.0.10.40...
He needs to go to 2a00:1450:4016:801::1000
That's not a correct URL. You need to enclose it in brackets for any uses that don't expect a bare IP address. Oh, and Slashcode destroys IPv6 literals in <a>.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Except that thanks to IPv6 you will have one IP per server to memorize (and this means you can put it in DNS). It's only in IPvCrap that you need to manually configure layers upon layers of VPNs just to connect to something in a remote network.
IPv6 is the final solution to the NAT question.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
All of my Datacenter admin friends told me how wonderful IPv6 is to setup and manage. They told me that they wish IPv4 would just die already. Large network admins love IPv6, other than the learning curve and setup, because routing is clean again.
Tracking ability is going to be driven more by browser request headers than by IP address, anyway.
I expect ISPs will get beyond /64s within a year or two. Being stuck with only a single /64 is BS; I have my home wired and wireless networks on different subnets for pretty simple (but entirely valid) reasons:
This I agree w/, and I think that ISPs could probably have a 3 tiered choice to offer customers:
On this issue, I've argued that the IPv6 address space has been less than optimally allocated. They allocated the first 48 bits for global prefix, next 16 for subnet, and remaining 64 for the interface ID. In the meantime, for features like multihoming, /32 or lesser addresses are needed. That puts a squeeze on the upper half of the address space, host density ratio arguments notwithstanding. Instead, had the first 64 bits been totally dedicated to the global prefix, the next 16 or 32 bits to the subnet and the last 48 or 32 bits to the interface ID, it would have been far more optimal. The first word would have still been fixed, the next 2 words could have been used for things like PI addresses and so on, while the last word would have been given to the ISPs.
That way, ISPs could give their customers anything from 16 to 65536 addresses w/o feeling the pinch. If 32 bits were assigned to the interface ID, it would be plenty, since no network is likely to ever have that many nodes. It would allow for hierarchical subnetting. OTOH, if the entire 48 bits were desired for ethernet autoconfiguration, the subnet could have been just 16 buts, and still been plenty.
IPv6 is the final solution to the NAT question.
Now we just need a cure to the people who have been beating their heads against a wall long enough that they think that NAT is/was a good thing.
upon the advice of my lawyer, i have no sig at this time
Doing a reverse lookup for every goddamn IP I ever see would be completely impractical.
Hyperbole much? Recognizing IPv6 addresses is not that different from recognizing IPv4 ones, especially if you assign local parts manually, which you should do for the servers instead of relying on autoconfiguration, for reasons which should be obvious. So, 2001:db8:0:1001::4 is...?
With a bit of practice, parsing the IPv6 addresses you deal with frequently will become second nature. If it doesn't, then maybe you're not such a hot network admin.
If you used DHCPv6 to hand out addresses and your machine just magiclly pulled IPv6 instead of IPv4 them and your connection "Just worked" why would you care which protocol was being used? This will cover 90% of home installs and is still quite simple, fc00::1 doesn't seem that much more complicated than 192.168.0.1, gives you allot more breathing room too (http://en.wikipedia.org/wiki/Private_network#Private_IPv6_addresses)
Also I highly doubt your ISP will give you a full publicly routable subnet (not initially anyway), that would cut into the business segment of sales. You run whatever you want internally and IPv6 runs on the CPE to talk to the internet. It will make sense to switch your internal network to IPv6 once the list of services only available over IPv6 starts to grow, not like you are losing access to anything, IPv4 is accessible via IPv6 but not vice-versa.
The problem is the services can't move first otherwise they lose customers (and also have to run dual stack for a while), so the stalemate will continue until the consumers are unable to get v4 addresses. The good news is this will hit consumers before it hits web site operators because ISPs require wayy more address space than hosting services use (simple one server to many clients dynamic). Hosting providers have more options to deal with the issue as well because they know what traffic is using their ips (reverse proxys, etc.), no carrier wants to run large scale NAT if it can be avoided (the stateless nature of routing is what allows it to scale).
I have to wonder, how useful is a network of large scales really? Unless your verifying the weights of trucks in convoys.
There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
the hex makes it easier to make words in statically-assigned addresses.
This message brought to you by the DEAD BEEF CAFE
There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
can't you just use ipv4 internally and save ipv6 for external? or you could assign them both an ipv4 and ipv6 addresses? i mean i realize that ipv4 has a limited number of available addresses but for internal use i doubt that you would run out well ever inn the conceivable future.
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
What you meant to say is that "there are workarounds for the difficulties". Any way you slice it, it is still a PITA...either to deal with it directly or implement the workarounds. I wish they could have come up with a more sane implementation.
If you see DNS as a workaround ... then, yes.
Well, others have already mentioned some, but let's try to get a list of possible solutions to this problem listed:
* DNS, access machines by name
* For frequently accessed machines, assign "short numbers", e.g.
1234:5678::25 (where 1234:5678 is your IPv6 prefix). For a little bit of added convenience, assign your network prefix to an environment variable, and you can, e.g.
$ ping ${IP6_Prefix}::25
* Run IPv4 *internally* as well as IPv6, then you can access machines on the local network using the EXACT SAME IPv4 private network addresses you've been using for the last 20 years. IPv6 is most useful for accessing hosts on OTHER networks on the global internet, no reason you can't use IPv4 for internal networking.
* If you use IPv6 auto-config based on Mac addresses, and you have a database of mac addresses on your network, I bet vendors will be releasing tools which allow you to automatically parse out the mac address from an IPv6 and show you which machine the address belongs to. That's good enough for machines you don't need to frequently lookup (like individual workstations of employees). For servers, printers, etc, assign "short numbers" as described above, in blocks (e.g. routers and switches might be ::1 through ::100, printers ::200-::300 , servers ::500-::600, etc, then you just have to remember what the short numbers of frequently used devices are.
The DNS is workaround for our memory-leak-ridden brain software. :P
I read TFA and all I got was this lousy cookie
A criticism from VerySlime is reason to adopt it, because it must mean it hampers at least some of their privacy violation schemes.
Indeed it is broken. I also found IPv6 is broken at BIT.LY, too :-(
now we need to go OSS in diesel cars
Yeah, maybe things have improved, but I played with IP6 tunneling for a short time. It was kind of cool, but on IPv4, my typical ping times are 20-80ms to reach most hosts. On IPv6 with tunneling, the latencies were typically >100-300ms. Which, is mostly fine for web browsing, but sucks for other applications.
No, all of those examples are correct. There are no special cases.
(Well, the last one might be odd if you didn't ask for a 6to4 conversion.)
You could, but I'd rather just get the pain over with earlier rather than later in switching over to 6. But I am a guy who likes to front-load his work, so... meh?
Vote monkeys into Congress. They are cheaper and more trustworthy.
You sir needs to read up a little on the subject: http://en.wikipedia.org/wiki/IPv6_address
Let me simply quote a few things for you on that page.
"::1/128 — The loopback address is a unicast localhost address. If an application in a host sends packets to this address, the IPv6 stack will loop these packets back on the same virtual interface (corresponding to 127.0.0.0/8 in IPv4)."
So 127.0.0.1 should become ::1.
Alternatively, if you do not want to actually use it for anything, it could be converted into the prefix:
"::ffff:0:0/96 — This prefix designated an IPv4-mapped IPv6 address. "
Instead it was translated into this:
"The 96-bit zero-value prefix ::/96, originally known as IPv4-compatible addresses, was mentioned in 1995[38] but first described in 1998.[44] This class of addresses was used to represent IPv4 addresses within an IPv6 transition technology. Such an IPv6 address has its first (most significant) 96 bits set to zero, while its last 32 bits are the IPv4 address that is represented. In February 2006, the Internet Engineering Task Force (IETF) has deprecated the use of IPv4-compatible addresses."
I did not ask for a 6to4 conversion but even if I did, it would be wrong: http://en.wikipedia.org/wiki/6to4
"For example the global IPv4 address 192.0.2.4 has the corresponding 6to4 prefix 2002:c000:0204::/48."
So 0.0.0.1 would be 6to4 translated into 2002:0:1:: but instead they made it 2002::1.
So in fact, everything that happens on that page is simply broken.
I did this analysis back in March, here is a quick summary of sites found with AAAA records:
* 1% of total sites
* ~5% of sites in Germany and Russia
* 0.38% of sites in the USA
* 90% of sites are running Apache or Nginx
* 4% of sites are running IIS
In July, I am planning on a follow-up to see if there is any major change in the numbers.
http://hackertarget.com/ipv6-in-top-sites-infographic/
or even a hosts file if you must
Are you TRYING to resurrect APK?
you don't even need large scale networks - I need to remote desktop to VMs on a LabManager server - currently every single one of those is an IPv4 IP and I don't think we'll switch to IPv6 anytime soon, but I dread the day we do, since currently all I really need to do is remember the last number and have the first three memorized (the IPv6 auto generation by MAC address will likely make me have to memorize more or all of the IP). All of these are accessed by IP and all of these require hand editing files and injecting the IP into them (so they correctly serve client machines outside of the VM, and these have to be outside the VM because they need hardware graphics acceleration on the head).
For this particular case, IPv6 is even better than IPv4. With IPv4, if you are already getting a NATed service, then there is no way you can assign new addresses to those VMs w/o another level of NATing. In IPv6, that's not even an issue - you can either configure DHCP6 to assign a certain set of addresses to the VMs that you create, or you could manually assign them yourself, but from the same network. So each VM would have its own direct link to the internet, whereas in IPv4, they are likely to be behind multiple NAT levels.
Isn't IPv4 mapped address all but deprecated as well? It's support varies according to the platform. Incidentally, why were IPv4 compatible addresses deprecated? Seems like they could have been allowed as a shortcut way to assign addresses, particularly to those who wanted NAT. I also never understood the need to have both IPv4 compatible and IPv4 mapped addresses.
Right now, both are being supported in all operating systems, but at some point in the future, OSs are likely to want to not support such older protocols and may simply drop support for IPv4 altogether. At that point, one would have to use IPv6 for internal networks. Not to mention that Windows 7 uses IPv6 as its default internal IP protocol.
Actually, it should have been [2600::1] or whatever. Incidentally, 2600 belongs to ARIN, so if Sprint bought an entire /32 from them, that might explain it. Incidentally, I ran the above address in a whois on ARIN, and response came up blank. So it's questionable whether the entire 2600 has been assigned to Sprint.
1- You don't have to us the IP autogeneration with the MAC address.
2- All you have to do is have your clients tell the DNS server their name when they ask for an IP address.
3- If you are putting ip addresses in by hand, you won't be rolling out ipv6 any time soon.
4- There are things that ipv6 will confound, but naming shouldn't be one of them. Using bare IP addresses these days is as silly as using bare mac addresses.
I was at a restaurant that tested one of the new types of those clamshell grills. It was a huge pain in the ass to those of us who were really good at the old way. But the kids liked it and they give much more consistent results. A bitch to clean though.
I think because of the routing problem.
Now, if only I had a list of all 4 or fewer letter words that only used A-F ;-)
to their customers, for example Comcast is already doing that. Otherwise, there is not much point in IPv6.
Boy, I miss the good old days when I could just tell the operator a 4 digit phone number and they would connect me. Now we have area codes that overlap and my neighbor could have a completely different area code and exchange than I do! Now I have to remember 10 digits and type them in myself!
Humans have different needs than computers. It's almost like we need a table of easy to remember names that can be used to look up IP addresses automatically by a computer. Then that table needs to be distributed automatically to all the ISPs in the world. That'll never happen. Sounds impossible.
Ow how smart you are. How about connecting to PC on local network. Or like to many local servers on which you have to deploy stuff. ...
Even now it is rare for them to have a dns assigned to them