UK ISP PlusNet Testing Carrier-Grade NAT Instead of IPv6

judgecorp writes "Faced with the shortage of IPv4 addresses and the failure of IPv6 to take off, British ISP PlusNet is testing carrier-grade network address translation CG-NAT, where potentially all the ISP's customers could be sharing one IP address, through a gateway. The move is controversial as it could make some Internet services fail, but PlusNet says it is inevitable, and only a test at this stage." Regarding the failure of IPv6, these graphs imply otherwise.

Comments

I recall MxStream

[MathFox]

KPN tried "carrier grade" IP4-NAT in the Netherlands a decade ago... Unfortunately the router software was too buggy and made the routers trash and crash. And how can the customers of the ISP run servers on their computers? NAT has implications for the peer-to-peer nature of the Internet.

Re:I recall MxStream

[MickyTheIdiot]

This may be a feature and not a bug to these ISPs.

The business has changed. They are probably fine with screwing up incoming services. They can charge to fix what they screwed up by using NAT.

Re:I recall MxStream

[Anonymous Coward]

Consumer grade network connections do not run servers.

A far bigger problem is that a lot of internet services these days use IP-based blocks as the final "brute force" version of "you are abusing the service, go away". It would really suck to be under an ISP that shows every customer coming from a single IP. You'd find yourself banned from all kinds of random places as soon as someone using the same ISP decides to be an idiot.

Re:I recall MxStream

[idontgno]

NAT has implications for the peer-to-peer nature of the Internet.

For a lot of organizations, that's a bonus. If you don't trust the outside network, you certainly don't want to peer arbitrarily with them, and certainly not at any outside machine's initiative. With NAT, an outside system can't initiate connectivity with any machine inside the NAT boundary without some kind of prior arrangement, so no open-ended network scanning.

If you treat the Internet as a big happy cloud of egalitarian peers collaborating at will, NAT sucks. If you treat the Internet as a bad neighborhood, which you have no way of avoiding between your house and the mall, NAT is the gated neighborhood you live in to keep the unsavory inhabitants of that bad neighborhood away from your pristine lawn and Lexus in the driveway. And people choose gated neighborhoods, and NAT, for that precise reason: separation and protection from the riff-raff, the panhandlers, the burglars and the car thieves, the Jehovah's Witnesses. Mostly the JWs, I think.

Re:I recall MxStream

[Sique]

That will be a problem of the ISP then, if their customers can't use legitimate services because the ISP can't differentiate between the culprit and the innocent customers, the ISP has a problem. The ISP then has to have either a very good customer management which allows to disconnect culprits very fast without too many false positives, or the ISP has to introduce some kind of class ips, where the customers without complains share the "good ip", and customers with some bad stains get degraded to other, partly blacklisted IPs.

Re:I recall MxStream

[Tridus]

Yes they do, pretty regularly. Ever played a multiplayer game?

Re:I recall MxStream

[Anonymous Coward]

Thats what a Firewall is for.

Re:I recall MxStream

[Anonymous Coward]

NAT has implications for the peer-to-peer nature of the Internet.

For a lot of organizations, that's a bonus. If you don't trust the outside network, you certainly don't want to peer arbitrarily with them, and certainly not at any outside machine's initiative. With NAT, an outside system can't initiate connectivity with any machine inside the NAT boundary without some kind of prior arrangement, so no open-ended network scanning.

That's what firewalls are for, not NAT. Please stop confusing the two.

Re:I recall MxStream

[JDG1980]

That will be a problem of the ISP then, if their customers can't use legitimate services because the ISP can't differentiate between the culprit and the innocent customers, the ISP has a problem. The ISP then has to have either a very good customer management which allows to disconnect culprits very fast without too many false positives, or the ISP has to introduce some kind of class ips, where the customers without complains share the "good ip", and customers with some bad stains get degraded to other, partly blacklisted IPs.

Do you really think any ISPs are going to take on these kinds of responsibilities? You're expecting them to basically be moderators for every forum on the Internet. Aside from the fact that they *shouldn't* be doing this (they should be dumb pipes), they also don't *want* to do this because it's logistically impossible and would open them up to potential legal liability.

Re:I recall MxStream

[squiggleslash]

It's also a bonus for me if my pristine Lexus doesn't have wheels because nobody's going to steal it by driving it away...

NAT is poor security. It doesn't prevent bad stuff getting in to the network, it merely prevents one type of access, and it has a habit of lulling admins into a false sense of security as a result. What's needed is proper fine grained network security on a workstation by workstation and connection by connection basis. That's something IPv6, through its mandatory support of IPSec, is very good at (at least, from the point of view of creating the essential infrastructure necessary for such security to work.

NAT breaks things. It makes things appear OK that aren't. With hindsight, we should have never used it to begin with. I suspect the foot dragging we saw with IPv6 would never have happened if the fact we had run out of IPv4 addresses had been noticed in the late nineties. (Yes, we ran out then. The NAT thing kinda hid the problem, but not without consequences.)

Re:I recall MxStream

[Alarash]

Just for the record, routers don't NAT. Firewalls do. To do NAT you have to be stateful (TCP or UDP aware), and routers aren't. If a router does NAT, that means it's got firewall features. Note that firewalls can route too (if only based on IP, if not on OSPF or even BGP) so maybe you just used too broad a term.

Re:I recall MxStream

[Sique]

If you make your users indistinguishable from the outside, you are basicly acting on behalf of your users. So yes, put to the extreme, it would mean that you are responsible for all the stuff your users do. Normal "dumb pipes" don't hide the identity of their users. They are just a means to an end, a tool the user wield to reach a goal.

Re:I recall MxStream

[172pilot]

All of what you say is true, but it ignores the reality that well over 99% of the customers are residential customers, or even small businesses who will NEVER run a server on location. Switching customers to NAT is not only easier than moving to IPv6 (read: cheaper), but also provides the carrier an opportunity to introduce a tiered "premium" service at an additional cost, where a customer could get a real IP address if they really need one. Personally, I think this is the inevitable future. 20 years from now, we'll look at IPv6 as a good protocol that never really caught on, because in the end, nobody really needed it.

Re:I recall MxStream

[Anonymous Coward]

Or even some single player games nowadays.
Ever streamed video or audio through Skype?
Ever instant messaged anyone online on most IM platforms?
Ever setup a home security system with remote access?
Ever wanted a home based cloud service or fileshare?
Ever plan on having any type of smart home?
Ever SSHed into a home computer?

Re:I recall MxStream

[Miamicanes]

> That will be a problem of the ISP then

What a wonderfully-naive view of the internet. As we all know, consumers in Britain and America have bountiful high-speed low-latency broadband choices within a healthy, competitive marketplace. We have cable OR dsl... maybe cable AND dsl if we're incredibly lucky, and... er...um...

Ok, right then. We're fucked.

Cellular data has low caps and rapidly gets expensive if you're allowed to exceed them without getting throttled to sub-dialup speeds. Satellite data has insane latency, and *insidious* caps whose throttling kicks in at thresholds that aren't necessarily transparent or obvious from the marketing literature. Fiber to the home barely exists, and with the exception of Google in Kansas City, is still the exclusive fiefdom of basically one incumbent large corporation with its own agenda that's vehemently opposed to network neutrality. And those incumbent carriers have all done their best to bribe/buy/bully state officials into passing laws making it illegal for communities (or even existing neighborhoods) to take matters into their own hands, leapfrog over those incumbent carriers, and lay their own open-access fiber *anyway*.

Re:I recall MxStream

[mellon]

No. Firewall != Router != Network Address Translater. But often all three functions sit in the same box.

Re:I recall MxStream

[fredprado]

Sorry, but what you suggest is simply impossible, and that is why it has never been done, and never will.

Re:I recall MxStream

[mellon]

Not true. The tighter you make the port set that the customer is assigned, the worse their network works. Most interesting web sites open dozens of connections at a time; each of these connections consumes a port. The fewer ports you have, the sooner you notice a problem with this. The more devices get added to the network, the quicker these problems surface. There is no fix for this other than IPv6.

The right way to approach the problem is to deploy an IPv6 network and then do lightweight port-sharing IPv4 over tunnels on the IPv6 network. Then you get IPv4 for legacy applications, and a native IPv6 network. This is cheaper than running an IPv4 network with carrier-grade NAT, because CGN devices are big, hairy and expensive—they have to maintain state for every single IP connection that your customer has.

What's going on here is that somebody high up in the hierarchy at this ISP simply doesn't want to deploy IPv6 because they think the problem is bigger than it is, and they're going to wind up determining that IPv6 deployment is cheaper after they've run this test for a while. IOW, this is really a non-problem—just part of the transition process. It's unfortunate, but completely understandable, that they don't just believe the experts and skip the CGN trial.

Re:I recall MxStream

[Alarash]

Can you name a (ancient) device which sole role was to do NAT? I'm genuinely interested.

AFAIK this NAT always been a function of firewalls, even if it's not fire-walling per say, it's an expected feature.

Re:I recall MxStream

[ub3r n3u7r4l1st]

depends which part of America.

In the U.S., around 40% have no broadband access . There was also a resurgence of dial up users because of the economy.

Re:I recall MxStream

[dpilot]

You and MickeyTheIdiot in this post http://tech.slashdot.org/comments.pl?sid=3386471&cid=42603673 are saying essentially the same thing, from two different perspectives.

But it basically boils down to this, for the most part, TPTB simply don't like the peer-to-peer nature of the internet, precisely because it is egalitarian and empowering.

By design, internet access really ought to be a utility, serviced, managed, and regulated just like electricity, POTS, natural gas, etc. For one simple reason, that's because the last mile requires monopoly infrastructure just like all of those other utilities. Some level of regulation is actually more important because internet access is far more susceptible to neutrality abuse.

At the same time current ISPs are already those regulated incumbents, and they REALLY don't want to be running yet another regulated utility - they see the big bucks and they want to grab their share. Cable TV and POTS are both regulated monopolies, but once those providers become ISPs they can sell corresponding streaming video and VOIP services, and better yet those options are unregulated.

So to the ISP the internet becomes primarily a content delivery system, and one that has already solved the content-ordering problem for them. Yet once the internet pipes exist, the ISP has no monopoly over the streaming video and VOIP services, unless they can break network neutrality.

The company sees the internet as a great communications and distribution capability. My employer had something very internet-like, minus the graphical stuff, over 10 years before the internet really hit the scene. They were also spending money developing and deploying that internal network. The internet gives it to them for "free". (Not really free, but at least at lower cost.)

In both cases, the internet is a tremendous advantage for incumbent TPTB. But in both cases there's no particular advantage to the peer-to-peer, egalitarian, empowering nature of the internet. In fact that nature is really only good for ordinary people and entrepreneurs trying to create or break into a market. For TPTB enabling entrepreneurs to break into their market is a disadvantage.

Re:I recall MxStream

[FireFury03]

With NAT, an outside system can't initiate connectivity with any machine inside the NAT boundary without some kind of prior arrangement

That's untrue. Most consumer NAT routers (at least the ones I tested about 3 years ago - doubt its really changed) don't bother to include a stateful firewall and with appropriate ISP-side routing, will happilly let connections into the private network. What you need is a stateful firewall, not NAT - that will protect you, and also doesn't completely fuck up loads of protocols at the same time.

The depressing thing (other than idiots claiming that NAT is good for security) is that Plusnet *were* trialling IPv6, but pulled the plug on the trial last year. When I asked them a month or so ago, they informed me that they had no plans to roll out IPv6 at all. Time to switch to a competent ISP if you're with Plusnet, I suspect (EntaNet and AAISP both offer v6 connections over DSL).

Re:I recall MxStream

[1u3hr]

the customers without complains share the "good ip", and customers with some bad stains get degraded to other, partly blacklisted IPs.

You fascist! I'm sending a complaint to your ISP!

Re:I recall MxStream

[Khyber]

EULA of almost every major ISP here in America for a non-business class connection.

You read it yourself. I'm not going to be bothered to hunt down the ToS/EULA for every US ISP.

Re:I recall MxStream

[jones_supa]

To be fair, a lot of those can be just put in the cloud cheaply enough these days.

Re:I recall MxStream

[Anonymous Coward]

To be fair, a lot of those can be just put in the cloud cheaply enough these days.

You sir are not qualified to be here.

Re:I recall MxStream

[tepples]

There is no single entity "the cloud"; there are only servers. Bouncing everything off a server, as you recommend, requires an IPv4 address for each operator of a server.

Re:I recall MxStream

[jones_supa]

How else can I have complete control over my site and get to tinker with my custom server software?

I believe these days you can lease a full virtual machine which allows you to do pretty much that.

Re:I recall MxStream

[tattood]

Thats what a Firewall is for.

Awesome! I didn't know firewalls can keep Jehovah's Witnesses out.

Re:I recall MxStream

[locofungus]

Normal NAT at home is like your gated neighbourhood. Someone arrives who you want to let in, you push a button and the gates open and let them in. You have to trust the other people in the neighbourhood not to let unsavoury people in but in return you get the ability to let in who you want to.

Carrier grade NAT is like the iron curtain. It didn't matter if you were prepared to pay the air fare, hotel bills etc for your friend in the soviet block, they were only allowed to visit if the people who controlled the curtain deigned to let them.

Like the iron curtain, there may be ways to smuggle things through via a third party but it's unpredictable (and potentially fatal to the packets that are being sent that might be lost without trace)

Finally, NAT potentially breaks connections that are kept open but with very little traffic. It will depend on how aggressive the ISP wants to be with pruning old connections whether applications will continue to work. Things like TCP keepalive and heartbeats can mitigate against this but TCP doesn't require any traffic at all over a connection.

Ironically, the ISPs might find that applications (such as skype) start establishing and keeping connections open all the time to hundreds, or even thousands, of peers because building the connection will be expensive but keeping it open once it's established will be cheap and the more connections you already have, the easier it is likely to be to find a way to build a new connection.

Tim.

Re:I recall MxStream

[172pilot]

Yep.. I've played a multi-player game, and it worked just fine through MY NAT device, so why wouldn't it work through the ISPs.. If you are NOT running through a NAT these days, I'd be surprised and worried. I bet if you do a survey, 999 out of 1000 home routers have no inbound ports open, which means that it makes no difference to the user, and the ISP is doing the rest of us a favor, hopefully blocking SOMETHING from being infected on those machines that would then start attacking the rest of us.. I'm all for it..

Re:I recall MxStream

[172pilot]

I hear what you're saying, but I think network speed will do away with the effect of that.. my cable modem keeps getting faster and faster, so aside from an RTP video stream or something, none of my connections are open too long. Also, that problem just limits the value of "many" in the "one to many" nat scenario, and might force the ISP to build NAT pools per neighborhood.. I'm not saying Comcast is going to NAT us all down to one IP, but certainly we dont all need our own in a consumer grade service.

Re:I recall MxStream

[hairyfeet]

Uhhh...and the ISP is gonna give a shit....why exactly? if its like most places in the USA they know they have you by the short hairs, where you gonna go? Shitty satnet? Assraping cellular? Most places have one, maybe 2 choices if you are lucky and the ISPs KNOW THIS. In my area they can assrape me with caps, CG-NAT and any other shitty thing all they want because they know its a choice of them or a 2Mbps on a good day DSL that the carrier (AT&T may they rot in hell) have made clear its a DO NOT FIX.

BTW all of those that have DSL? May want to be looking for an exit as the rumor is that AT&T is seriously looking at bailing on DSL. The reason being they are making assraping money on wireless and they don't want to spend any money upgrading the landlines when they can force everybody onto shitty data plans. Boy that "free market" really works huh? If they do pull out it will leave the cableco with a monopoly on landline Internet in many places and you think you are getting buttfucked now? Oh boy just you wait. Already mine has started playing "the cap game" which is REAL fun. Use their VoIP? No cap, Vonage? Cap. Use Windows all the updates have no cap, Linux or Mac? Cap city,use their PPV? No cap, Netflix? You get the picture.

Re:I recall MxStream

[suutar]

no, but it'll make a great basis for a lawsuit that forces them to give up the CGNAT idea. Assuming the RIAA/MPAA don't realize that everyone sharing one IP address will make tracking sharers harder and axe it themselves.

Re:I recall MxStream

[Pseudonym Authority]

Well,

Half the businesses I apply to

sounds alot like a proposal to me.

Re:I recall MxStream

[realityimpaired]

Farmers are a bad example... it's a business for them, and so something like a $4000 equipment fee would be tax deductible. Many farms, at least in Canada (which has a very similar situation with rural broadband) are actually equipped with broadband internet connections, though usually through cellular or satellite rather than cable/DSL.

However, folks who live on the outskirts of rural communities, where there may be a single DSLAM serving the whole town and where they are 6km away from it and can't get better than dialup are perhaps a better example. These folks can't get cable/DSL, because they're too far from the DSLAM and there's simply no cable infrastructure, but they can still get broadband connections either through Sat/Cellular/WiMax, or through radio broadband (if they're in an area that does radio LAN extensions), but they'd be looking at very high up front equipment costs that they can't tax deduct.

Re:I recall MxStream

[suutar]

A VPS costs, like, 5$ a month these days

Sweet! Where?

Re:I recall MxStream

[Sique]

My point exactly - this will probably end in a big lawsuit and the verdict to either stop hiding the identities of the customers behind a single NAT ip, or provide an extensive user monitoring to provide information which user was doing what at a given point in time.

Re:I recall MxStream

[realityimpaired]

Sure they do... but you have to keep recasting it every few rounds because it expires.

Re:I recall MxStream

[suutar]

It's an expected function of routers. I've never seen a firewall appliance that did nat.

Re:I recall MxStream

[Junta]

IPSec does approximately zero to change this conversation. One could, however, make the argument that most Windows and Linux deployments are far more conservative in the number and type of listening sockets they open up, and that would aid the case. On the other hand, we are innundated with wildly varying embedded devices with networking with frequently exceedingly poor networking security, which counters the argument.

What NAT established was the standard behavior of buying a network gateway for even residences. Hopefully, with that standard model of a home network firmly pressed into the minds of consumers, even if you don't need to NAT you'd still be forced to get a gateway device (e.g. delegated subnet would still mandate it, and the router companies can implement firewall rules that provide the same benefit as NAT).

Ultimately, the 'security' case for NAT is that it was mandatory security that left the common user with very little recourse and forced them to think very carefully about their network service. Without NAT, then firewalling when done correctly is better, but the possibility of incorrect firewalling is pretty high.

Re:I recall MxStream

[gbjbaanb]

Britain does have a competitive marketplace for broadband, there are hundreds of ISPs, and you can get fibre in several places (with more being rolled out all the time).

Sure you get better service if you live in a place where there are lots of other people who want broadband (as opposed to that lovely secluded farmhouse in the middle of fecking nowhere) but what else do you expect?

Prices are low too, so its only you guys in America who have a problem. But then, what else do you expect when you have such mega corporations holding you all to ransom.

Re:I recall MxStream

[gbjbaanb]

It would really suck to be under an ISP that shows every customer coming from a single IP

not necessarily.... I'm waiting for the RIAA to come down hard against this carrier-grade NAT concept... Maybe someone should tell them they're trying to sneak this pirates free-pass in... :-)

Re:I recall MxStream

[Pseudonym Authority]

https://www.google.com/search?q=cheap+VPS
Though it's not on the 1st page, I like 123systems, if only because they have relatively good uptime.

Re:I recall MxStream

[Pseudonym Authority]

If by $5/month you mean $30/month for anything worth spending money on, sure.

As opposed to trying to host a site with DynDNS and changing the port every month? His only triumph is that he managed to make it completely free (apparently his time is worth nothing).

It would be hard to do worse than his current set-up for any amount of money.

Re:I recall MxStream

[Patch86]

Ever wanted a home based cloud service or fileshare?

ISPs would encourage such customers to upgrade to business-or-enthusiast class Internet access.

That describes most consumer NAS. They sell NAS units to grannies at the local PC World. Some ISPs (such as BT) advertise and sell them direct to their home users. It isn't a niche or an enthusiast activity.

Re:I recall MxStream

[WaffleMonster]

All of what you say is true, but it ignores the reality that well over 99% of the customers are residential customers, or even small businesses who will NEVER run a server on location

Is a telephone a server? I call your address and it rings. You call my address and my phone rings. Few of us operate IVRs and public information services on our phones but we all still benefit from being individually addressable.

I think it is a mistake to confuse "servers" with opportunity cost of maintaining the status quot.

Switching customers to NAT is not only easier than moving to IPv6 (read: cheaper),

Easier and cheaper for whom? The last I checked packet punters cost a whole lot less than packet manglers.

but also provides the carrier an opportunity to introduce a tiered "premium" service at an additional cost, where a customer could get a real IP address if they really need one.

As a consumer that sounds swell. I've got a better idea... we just move to IPv6 and do away with the artifical scarcity bullshit.

Personally, I think this is the inevitable future. 20 years from now, we'll look at IPv6 as a good protocol that never really caught on, because in the end, nobody really needed it.

This year comcast will most likely have completed the rollout of IPv6 to all of its ~20m Internet subscribers. All other major ISPs in the US are activly working twoard the same and it is only 2013.

Re:I recall MxStream

[fatrat]

There's nothing new here. Most big corporates/Universities etc have proxy'd their traffic for years. That has the same affect. It causes the odd problem with over-zealous blocking, but nothing major.

Re:I recall MxStream

[tepples]

That describes most consumer NAS.

From the ISP's point of view, users on a home service tier are supposed to use a home NAS within the home LAN, not across the Internet link.

Re:I recall MxStream

[gsnedders]

In the UK there's only so much competition, as the vast majority of ISPs merely buy capacity off BT Wholesale. The only other major network is Virgin Media's cable network, but that covers a (geographically) tiny area (though does cover most cities), especially in comparison to BT's ADSL coverage.

Re:I recall MxStream

[Pentium100]

Easier and cheaper for whom? The last I checked packet punters cost a whole lot less than packet manglers.

What about switches that die when they have to pass ~100 IPv6 packets per second? So, replace those too, but they are not cheap. Replace pretty much all customer routers, explain to the users how to use IPv6 on Windows XP or maybe even 2000. On install a Linux-based CGN, keep all network infrastructure intact.

As a consumer that sounds swell. I've got a better idea... we just move to IPv6 and do away with the artifical scarcity bullshit.

For your protection we have blocked all incoming connections. If you want to run a server please upgrade to business class service.

Re:I recall MxStream

[ravenlord_hun]

So how do you firewall your smart TV, or any other connected appliance (that is not a PC)? No router today has any meaningful firewall functionality - all those devices with their globally unique and reachable IP6 address will be fun targets for malicious attackers. Hell, even if home grade routers had firewalls, 90% of the end users couldn't manage (or even understand) them anyway.

Re:I recall MxStream

[WaffleMonster]

What about switches that die when they have to pass ~100 IPv6 packets per second?

I'm just making the observation hardware devices which inspect only L3 header and shuffle packets using custom ASICSs between interfaces are much cheaper than mostly general purpose software stacks which must inspect higher layers, keep state and execute ALG state machines.

Switches that only forward 100PPS sound like
ethernet cables that rust when IPv6 packets move over them.

So, replace those too, but they are not cheap.

They sound cheap.

Replace pretty much all customer routers

Replace them when they die. The half life of these devices is only a few years. There is no need to rush.

explain to the users how to use IPv6 on Windows XP or maybe even 2000.

Why? Whats the point? I can benefit from IPv6 even while others have not deployed it. Who cares? If they want to upgrade they will.. Not everyone has to have IPv6 until very late in the game when people tire and begin to drop IPv4 support in which case it can be assumed number of XP users will be much lower than it currently is.

On install a Linux-based CGN, keep all network infrastructure intact.

If you look earlier you will see me agreeing with the deployment of CGN as necessary and inevitable in the short term. I only disagree with the sentiment this being an acceptable long term solution.

For your protection we have blocked all incoming connections. If you want to run a server please upgrade to business class service.

This is a different issue. NAT requires coordination to enable port forwarding where it is necessary to support an application (not necessarily running servers) ... Administrativly locking down is an example of unecessary and poor behavior on the part of the ISP. In this case it is best to upgrade ISPs.

Re:I recall MxStream

[Alarash]

Then you don't know what you're talking about, I'm sorry to say. CGNAT is done typically by a Check Point 61000, a Fortigate 5000 or similar UTMs. A Cisco router doesn't do NAT, unless you have a firewall blade inside.

Re: I recall MxStream

[jimicus]

All their users will soon get fucked off having to apply for every RBL /Hostile/spam block site on the internet.. so much so that most will move

I wonder if enough people use services like hotmail and gmail that this would be a non-issue?

Re:I recall MxStream

[Pentium100]

I'm just making the observation hardware devices which inspect only L3 header and shuffle packets using custom ASICSs between interfaces are much cheaper than mostly general purpose software stacks which must inspect higher layers, keep state and execute ALG state machines.

Switches that only forward 100PPS sound like
ethernet cables that rust when IPv6 packets move over them.

Unless the switch is a managed one and can do things like packet filtering (based on layer 2, 3or 4 information, so for example Windows SMB ports (135-139, 445) are dropped by the switch). It seems that the manufacturer really wanted to write "IPv6 support" in the specs, so they made a bad implementation of it (maybe it runs entirely in software as opposed to hardware acceleration or whatever), the switch stops working properly when ~100PPS of IPv6 is passed. The only way to make it work properly is to instruct it to drop all packets of Ethernet type 0x86DD. One small ISP found this out the hard way.

They sound cheap.

A managed 24 port gigabit switch is not cheap.

Administrativly locking down is an example of unecessary and poor behavior on the part of the ISP. In this case it is best to upgrade ISPs.

That assumes you have a choice where you live. Competition is great and where I live all wired ISPs offer external IPv4 addresses (not v6 though), do not charge for data transferred and generally provide fast and reliable connections (those who can get fiber get 40-300mbps symmetric). However, if only one wired ISP serves your area you can either choose it or a cell provider (5GB/month or whatever) or a dialup/satellite provider.

However, the ISPs will start using CGN and when most users get used to being behind NAT (or paying more for external IP), the ISP can then continue this practice even after the switch to IPv6. Maybe include the external IP with the higher speed options (so most people who want an external IP would be happy), but not give it to the 6EUR/month (15mbps) subscribers.

Re:I recall MxStream

[phorm]

Consumer grade network connections do not run servers.

Really? I know plenty of people who do. Perhaps not web-servers or mail-servers, or "big iron" servers, but game-server daemons, sure!

Re:I recall MxStream

[mellon]

Can you name an ancient device that implements DHCP relay, and nothing else? No, of course not. That doesn't mean that a DHCP Relay Agent is a router. Similarly, the mere fact that you can't think of a router that doesn't also do firewalling and NAT doesn't mean that NATs are firewalls, or that firewalls are NATs. Use your logic, man. A->B != B->A!

Re:I recall MxStream

[mellon]

Any connection you make through the NAT consumes a table entry (and a port) for a minimum of 90 seconds. This has nothing to do with network bandwidth—it's required by the protocol. A CGN that breaks this assumption will work most of the time, but will exhibit seriously flaky behavior some of the time. So just do the math—a NAT can support so many connections, and no more. You can't just continually increase the number of connections and hope for the best.

Re:I recall MxStream

[JesseMcDonald]

If you treat the Internet as a bad neighborhood, which you have no way of avoiding between your house and the mall, NAT is the gated neighborhood you live in to keep the unsavory inhabitants of that bad neighborhood away from your pristine lawn and Lexus in the driveway.

A firewall is like a gated neighborhood. NAT is like a minimum-security "gated" community where anyone can open the gate (NAT traversal) but your house address is meaningless to anyone outside, so no one can send you mail unless you first enter into a complicated forwarding arrangement with your neighborhood post office. It's an extremely inconvenient form of obscurity, not real protection from unwanted traffic.

Re:I recall MxStream

[leenks]

And many ISPs do transparent proxying of HTTP anyway (which IS the internet for most people).

Besides, mobile networks do this almost exclusively (at least here in the UK) and everything appears to work, so it would appear the workarounds are in place.

That doesn't mean IPv6 shouldn't be the norm by now - we just need a big service to start offering premium content over IPv6 (eg google/youtube) and the demand will force ISPs to start upgrading to avoid losing customers.

Re:I recall MxStream

[DarwinSurvivor]

Consumer grade network connections do not run servers.

Tell that to my home server connected to my consumer grade network connection.

Re:I recall MxStream

[leenks]

Rubbish. Most are resellers of BT products going over the core BT network before it eventually gets into your ISP. I'm on a premium package (FTTC wholesale), and my latency is still worse than I had in halls back in 1997 when I started at university (and about the same speed). Many of my friends are able to get faster (and uncapped) 3G connections than they can get land line connections.

Re:I recall MxStream

[DarwinSurvivor]

Funny, my router running dd-wrt has a great built-in firewall. The only reason consumer routers don't typically come with built-in firewalls is because consumer-grade routers don't typically come with IPv6 support so the manufacturers don't see firewalls as a requirement.

Once IPv6 is available on your everyday BestBuy router, the default firewall configuration will simply need to statefully allow outgoing connections and their coresponding responses. Allowing incoming connections to specific machines on specific ports will be enabled exactly the same way we turn on port forwarding today.

Re:I recall MxStream

[WaffleMonster]

Unless the switch is a managed one and can do things like packet filtering (based on layer 2, 3or 4 information, so for example Windows SMB ports (135-139, 445) are dropped by the switch). It seems that the manufacturer really wanted to write "IPv6 support" in the specs, so they made a bad implementation of it (maybe it runs entirely in software as opposed to hardware acceleration or whatever), the switch stops working properly when ~100PPS of IPv6 is passed. The only way to make it work properly is to instruct it to drop all packets of Ethernet type 0x86DD. One small ISP found this out the hard way.

Sure sounds like outlier, cherry picking, cheap hardware to me. A vendor who just ships shit without basic load testing is a crap vendor who can be assured to produce crap hardware.

While the general point if you expect to see wire speed forwarding performance in routers you need IPv6 aware ASICs is valid.

It is also valid to say if you want the same ARP security features in your switches you will have to buy a new one with RA guard or be prepared to cobble together hand coded filters with duct tape and bailing wire.

Both perfectly obvious and valid observations. 100 PPS on the other hand is nonsense crap scaremongering bullshit that tries to use one example of human stupidity to assert a larger reality which simply does not exist.

A managed 24 port gigabit switch is not cheap.

Apparently some of them are quite cheap in more ways than one.

Re:I recall MxStream

[jrumney]

Consumer grade network connections do not run servers.

Exactly, noone would ever expect to run servers like Skype, bittorrent, etc on their consumer grade network connection.

Re:I recall MxStream

[jrumney]

Finally, NAT potentially breaks connections that are kept open but with very little traffic. It will depend on how aggressive the ISP wants to be with pruning old connections whether applications will continue to work. Things like TCP keepalive and heartbeats can mitigate against this but TCP doesn't require any traffic at all over a connection.

For CG-NAT, they will need to be very aggressive at pruning old connections, or they will quickly run out of ports. Popular services such as google.com, facebook.com are going to become very frustrating to use if this ISP has any significant number of customers.

Re:I recall MxStream

[Pentium100]

100 PPS on the other hand is nonsense crap scaremongering bullshit that tries to use one example of human stupidity to assert a larger reality which simply does not exist.

This actually happened. I do not know, maybe that model is the only one affected and, in time, when the ISP upgrades its switches the new ones will be able to support IPv6 properly, just that the ISP is in no rush to do so, since with IPv4 the switches work fine and the ISP still has some IPs left.

Re:I recall MxStream

[Tacticus.v1]

So no one on a consumer grade network runs an xbox, ps3, wii or gaming pc? or uses skype? or voip?

Re:I recall MxStream

[ravenlord_hun]

I have a WL500gP v1. It has a "firewall" feature, but it's stateless and pretty much just NAT given a fancy name and a semi useful UI. I'd expect most routers work the same way, unless Moore did some magic on these as well...

Re:I recall MxStream

[crutchy]

re: "statefully allow outgoing connections and their coresponding responses"

isn't that what NAT does?

Re:I recall MxStream

[petermgreen]

The UK now has a lot of "local loop unbundling" going on. BT openreach still own the physical copper cables but other providers then operate their own ADSL equipment. Afaict there are three major LLU networks, O2/BE, sky/easynet and talktalk/tiscali/pipex/aol .

FTTC is complicating this though as BT operate all the equpiment for that and there has been some controversy over how they have been selling it.

Re:I recall MxStream

[petermgreen]

Even if you can actually get a workable VPS for $5 per month now (i've never seen prices that low myself) how long do you think such bottom of the barrel VPSs will continue to come with a public IPv4 address as the providers start feeling the address space squeeze?

Re:I recall MxStream

[jonadab]

> And how can the customers of the ISP run servers on their computers?

Most consumer ISPs officially don't allow that anyway. (They don't usually police it actively, unless your home server gets enough traffic to be noticeable. But the rule is on the books in most cases.) If you want to run a server, you're theoretically supposed to buy business-class service.

Honestly, I don't see a problem with ISPs levying a small surcharge (a few cents a month) for a public IPv4 address. Most people have no use for it. I personally do have a use for it (I like to be able to ssh into my home computer for work), but I'd pay a few cents extra for that, as long as the price is reasonable. Heck, up to a dollar a month would be reasonable IMO, simply because it's not that much money compared to what you're already paying for other services (chiefly, bandwidth and dubiously useful tech support).

And I *certainly* don't have a problem with ISPs only giving public IPv4 addresses to customers who actually ask for one. Take all the people who just want to get on Facebook and watch stupid videos on YouTube and put them behind NAT. They won't notice, and they won't care. If somebody tries to explain it to them and convince them that they've been wronged, their eyes will glaze over in boredom.

Actually, ICANN should cover its administrative costs by charging the regionals for IPv4 assignments in large blocks, instead of handing them out for free. A rate of one cent per allocated address would raise tens of millions of dollars each year. Then the regionals could cover *their* administrative costs by marking the price up slightly, and the large peered multinational ISPs who have the big blocks could mark them up just a little more, and by the time you filter down three more levels to the consumer we're still talking less than a dollar a year.

And that should be plenty to ensure that everyone has as many addresses as are actually needed, because they're not actually scarce. They only appear scarce because until now they've been handed out for free in unlimited quantity, and so *most* organizations are holding more public IPv4 addresses than they have any real use for; in many cases, multiple orders of magnitude more than they have any legitimate use for. I say, charge them a few cents per address and see whether they *really* need a Class A network for their three servers and two offices full of workstations.

Re:I recall MxStream

[jonadab]

That'll really only be a problem during the transitional period when only a couple of ISPs are doing NAT. I predict that within another decade virtually *all* ISPs will be doing NAT, and so websites and other services will just have to retool their thinking to take into account that most users are behind NAT.

Re:I recall MxStream

[Junta]

That's awfully optimistic. NAT made the best buy routers make *some* effort to configure the stateful rules correctly or else the customer sees 'broken internet'.

On the other hand, being too open with firewall rules will not look 'broken' to the market. Network security at that point isn't a differentiator and suddenly the manufacturers don't see the dire need to lock down devices enough. In fact, in pursuit of not risking 'breaking' the user, they'd trend toward more open by default.

There is a ray of hope. Increasingly, the ISP is the vendor of the gateway device and not person going out to best buy. ISP is going to, on average, make decisions more securely than a consumer. Hopefully this doesn't supercede consumer ability to buy advanced devices when they *do* know what they are doing...

Re:I recall MxStream

[172pilot]

OK.. Again, I dont disagree - I dont know the details of, or even that there is an RFC concerning standard timeouts in NAT, however all of this argument is just to determine how densely you can overload one IP address, not that in concept the typical home user will notice it or not. I have seen companies with 1000+ employees get NAT'd down to a nat pool of one IP address and have no discernable problem, so I dont think a neighborhood of 1000 homes that mostly wont be in use simultaneously would have a problem sharing one address.. But, even if it's only a 10:1 reduction, it's still easier/cheaper than migrating the typical consumer to IPv6 and retrain the support staff..

Re:I recall MxStream

[HappyPsycho]

Both google and youtube are available via IPv6 (2607:f8b0:4008:806::100e and 2607:f8b0:400c:c01::be respectively).

What I believe you mean is "we just need a big service to start offering premium content EXCLUSIVELY over IPv6" which will in turn force the users to switch which will in turn get more services to move to IPv6, etc...

I work for an ISP and sadly the reason I see for the stalling of IPv6 is the lack of interest from users, some of the service providers will switch of their own accord but until there is someone to serve on that side its more a token effort rather than a "we need to get this implemented".

Re:I recall MxStream

[leenks]

Yes, that's exactly what I meant - IPv6 exclusive content. If youtube was to move there would be a lot of demand very quickly (but it would be a risk for Google as users may just start using vimeo or similar instead)

Re:I recall MxStream

[WaffleMonster]

I work for an ISP and sadly the reason I see for the stalling of IPv6 is the lack of interest from users, some of the service providers will switch of their own accord but until there is someone to serve on that side its more a token effort rather than a "we need to get this implemented".

Stupid question time...

When was the last time a user called in to signup for access to the "IPv4 Internet"? What percentage of your user base do you reckon even know what IPv4 is let alone IPv6?

Re:I recall MxStream

[HappyPsycho]

Well, I think we got 4-5 who actually asked something that included IPv4 in the request but all they really wanted a block of 4 / 8, most refer to them as public ips.

I think we got 1 requests for IPv6 but it was more a "by the way, do you offer..." question more than a I am actively looking for IPv6. At the time we didn't have our IPv6 block allocated so the request had to be turned away.

As for your 2nd question, I'd hazzard a guess at 10-15%, most of the business customers (and the odd technical home user) have their own internal networks setup (even if it is just a single subnet) and manage static ips for servers, etc. but the vast majority just pull DHCP and couldn't care less. This group is where I expect most of the push-back from going towards IPv6 will come from, their networks are small enough to fit in IPv4, the few that have cared have asked what benefit is there to switch for them.

To that point, if I could figure out how to get one of these 6to4 gateways working (completely transparently, and without needing allot of IPv4 space to deal with the temporary mappings) I'd hazzard a guess that if I changed the setup for a few of our customers to IPv6 they would not notice.

Re:I recall MxStream

[WaffleMonster]

This group is where I expect most of the push-back from going towards IPv6 will come from, their networks are small enough to fit in IPv4, the few that have cared have asked what benefit is there to switch for them.

The way it should work most customers also get an IPv6 address and don't know they have it any more than they knew they had an IPv4 address.

The ones who have routers are not being deprived of anything by adding IPv6. They can choose to add IPv6 or ignore it if they elect.

To that point, if I could figure out how to get one of these 6to4 gateways working (completely transparently, and without needing allot of IPv4 space to deal with the temporary mappings)

In my not so humble opinion the time for IPv6 tinkers ameature hour has come and gone. Either deploy IPv6 native or don't do it at all. The best way to piss off customers is to give them a crappy experience. Thankfully the way host policy works on most systems 6to4 is likely to never to get used anyway.

Re:I recall MxStream

[DarwinSurvivor]

Sort of, but it can be easily done without NAT.

Re:I recall MxStream

[HappyPsycho]

Oh how I wish it was that simple, there are always issues / considerations when deploying. One of the biggest problems is firewalls which if configured correctly will not simply ignore what they don't understand but start raising alarms (this is a big sticking point for business customers). Debugging any issue for users who are used to and understand 192.168.1.1 is going to be quite difficult when faced with IPv6's format (this is the major sticking point for regular home users, they are fine once everything is working but once something doesn't work as expected expect hell).

To your second point, I shudder to think of the consequences. While allot of services remain on IPv4 (bbc.com, cnn.com, amazon.com, twitter.com and ebay.com all lack AAAA records), such a stance requires full dual stack to the customer. At some point you will only have IPv6 to give customers, what then? I've now double checked and what I meant was http://en.wikipedia.org/wiki/NAT64 which would allow customers who are only given an IPv6 address to be able to communicate with the IPv4 internet.

As more services move to IPv6 the load on the NAT64 devices will decrease until they can eventually be removed (I am assuming at this point the pressure for IPv4 addresses will be removed therefore those requiring legacy access should be easy to facilitate via a dual-stack setup, majority of the customer base would be running IPv6 only happily).

Re:I recall MxStream

[crutchy]

i agree... iptables is pretty awesome

Re:I recall MxStream

[WaffleMonster]

Oh how I wish it was that simple, there are always issues / considerations when deploying. One of the biggest problems is firewalls which if configured correctly will not simply ignore what they don't understand but start raising alarms (this is a big sticking point for business customers).

I can come up with clever reasons not to do stuff too. Nevermind all the attack hits constantly blanketing the entire global IPv4 address space...red alert defcon 1 when an L3 firewall sees a L2 protocol message it does not expect.

Debugging any issue for users who are used to and understand 192.168.1.1 is going to be quite difficult when faced with IPv6's format

Is 192.168.1.1 a CPE? If so why would it still not be accessible via this address?

Comcast has already deployed IPv6 to half their customer base of 10m+ people and the sky did not fall.

To your second point, I shudder to think of the consequences.

While allot of services remain on IPv4 (bbc.com, cnn.com, amazon.com, twitter.com and ebay.com all lack AAAA records), such a stance requires full dual stack to the customer. At some point you will only have IPv6 to give customers, what then?

You deploy NAT to stretch whatever IPv4 resources you have left.

I've now double checked and what I meant was http://en.wikipedia.org/wiki/NAT64 which would allow customers who are only given an IPv6 address to be able to communicate with the IPv4 internet.

Native dualstack is the safest most compatible deployment method available.

NAT64 causes unecessary breakage. IPv4 only applications can't use it.

If you find yourself with no more IPv4 addresses to hand out then dualstack with an IPv4 NAT (AKA CGN) is the next best option.

As more services move to IPv6 the load on the NAT64 devices will decrease until they can eventually be removed

Yep.

Not "instead of", but "in addition to"

[Anonymous Coward]

Dual-stack deployment with NAT'd IPv4 alongside with IPv6 is the only viable short-term option for consumer ISPs. You can't just cut off people from the IPv4 internet, you'd leave them with a pretty much useless internet connection.

Re:Not "instead of", but "in addition to"

[vlm]

You can also cut them off on ipv4 with cg nat (did you know the marketing name changed from c-nat to cgnat not because there's anything wrong with "carrier nat" as a name, but everyone was calling it "crappy nat" instead?)

Then the end users can all connect to ipv6 providers. Free tunnels from he.net, or maybe their game company. I think it would be interesting if every windows machine connected to steam lit up a ipv6 tunnel for game server purposes.

In the long run I agree it would be nice to provide ipv6 direct support in parallel.

Re:Not "instead of", but "in addition to"

[FridayBob]

... You can't just cut off people from the IPv4 internet, you'd leave them with a pretty much useless internet connection.

Luckily, IPv6-only connections are becoming less useless every day.

Re:Not "instead of", but "in addition to"

[petermgreen]

Dual-stack deployment with NAT'd IPv4 alongside with IPv6 is the only viable short-term option for consumer ISPs.

NAT'd IPv4 alone is also a "viable" option :(.

From a quick search it seems plusnet have run an IPv6 trial in the past but are not currently offering any IPv6 service :/ Hopefully they fix that before they start rolling out ISP level NAT for real.

Re:Not "instead of", but "in addition to"

[bobbied]

You are right.

I never really understood why we didn't just map all the IPv4 addresses to a IPv6 subset and provide a very simple rule to translate, say by adding all zeros or some other number to the IPv4 address to get its IPv6 one. Then start forcing the adoption of IPv6 by not accepting v4 traffic from the top down though the domain registration authorities and hosting providers. Get legal agreements from them to not route IPv4 traffic in exchange for IPv6 address assignments and allowing new domain registrations, force top level domain authorities to only support IPv6 going forward.

You want to keep your website available? You want your customers to see new domains? You need a IPv6 assignment because we won't route v4 traffic and DNS is going to give you an IPv6 address. ISP's would then be free to provide IPv4 connections, but only if they did the translation to IPv6 internally themselves, which would end up costing IPv4 customers more money and limiting what they can see.

Eventually, there would be enough pressure for the ISP's to push IPv6 down the food chain to the end user who will either pay more for IPv4 service, or upgrade to IPv6. Eventually there will be a tipping point and IPv6 will see universal acceptance.

The problem here is that nobody really has the necessary power to force IPv6 on the world.... So we will keep bumping along trying more and more incremental patches to IPv4. Eventually, you could be behind 20 NATs wondering why your SIPP/VOIP device won't make any calls...

Hey, how about we just put all of the adult content on IPv6 only addresses.... You know THAT would set a fire under things....

Re:Not "instead of", but "in addition to"

[jittles]

(did you know the marketing name changed from c-nat to cgnat not because there's anything wrong with "carrier nat" as a name, but everyone was calling it "crappy nat" instead?)

Crappy gnat sounds even better than crappy nat to me!

Re:Not "instead of", but "in addition to"

[Githaron]

I doubt the ISPs will have a whole lot of luck getting their customers to all upgrade their home routers.

Considering that many areas only have one ISP, if people were told they have 1 year to buy an IPv6 enabled router or they will lose access to the internet, they will buy a new router. It might be the only good thing that comes out of ISP monopolies. Besides, don't a lot of non-techie people just rent a router from the ISP? Most techies will be full willing to replace their routers with IPv6 enabled ones even without coercion.

Re:Not "instead of", but "in addition to"

[mellon]

Most provider sites can make the transition to IPv6 really easily. Chances are their colo facility already offers IPv6; all they have to do is turn it up. It's not trivial—you have to get the DNS right, and get the routing right—but it's pretty easy. Sites that have a harder transition are, by and large, already done with that transition. Google, Yahoo, Netflix, Akamai, all already have working IPv6 networks. If all you have is a web site with a shopping cart or a user forum, switching to IPv6 will take you a week or a month of planning, depending on where you are on the learning curve, followed by about an hour of configuring for the transition from IPv4 to dual-stack.

Re:Not "instead of", but "in addition to"

[mellon]

A lot of ISPs that are serious about IPv6 are just counting on attrition to solve this problem. As new customers are added, they get an IPv6 router. Old customers get a new router when they get tired of the problems with the old one. There's no rush.

Re:Not "instead of", but "in addition to"

[petermgreen]

Depends on what proportion of customers actually use those applications, whether those are customers the ISP actually wants to keep and whether the customers have any other decent options.

Also remember ISPs don't have to put every user onto ISP level NAT, just a sufficiant propotion of them to allow for expansion.

Re:Not "instead of", but "in addition to"

[Miamicanes]

The main problem is that in America, high-speed internet basically means "AT&T", "Comcast", "TWC", "Verizon", etc. Huge corporations are allergic to "risk", and *hate* to do *anything* in an experimental, adhoc manner. They want to Roll Out IPv6 in one huge, monolithic program that involves spending as little capital expenditure as possible. The problem is, especially when it comes to networks, that nothing EVER works "in the wild" the way it works under controlled "lab" conditions. End users have an amazing way of breaking assumptions and invalidating models. And what the end users don't break or invalidate, hackers WILL.

What NEEDS to happen is for companies like Comcast and AT&T to make IPv6 *available* to customers who ask for it NOW, without screwing with IPv4 at the same time and trying to deploy CGN or something like it at the same time. Let us have IPv6 to screw around and experiment with, use with open routers capable of running things like OpenWRT, and just leave everyone alone for a year or two. Or three, or five. At some point, the early adopters will buy new hardware, and increasingly decide that IPv6 is more convenient than NAT & port forwarding, creating a larger and larger market for things like IP cameras and stuff that will actually WORK with IPv6 (as opposed to "theoretically be compatible with" it).

In the US (and to a large extent, Europe), we're lucky. We don't *HAVE* to drop everything and wantonly break things to deploy IPv6 as the one and only networking protocol tomorrow. We just need to have it *available* without resorting to latency-adding kludges like tunneling. Make it available, and the people who'll ultimately be creating the devices and apps that run under IPv6 will slowly start to drift towards it. The problem is that right now, our ISPs see it as an either/or false dichotomy -- IPv6 + CGN, or IPv4 only. Let us have an IPv6 /48 prefix of our own AND a public DHCP-assigned IPv4 address of our own like we've had for the last 15 years, and give IPv6 a chance to emerge on its own in the same organic fashion IPv4 largely did.

Yes, I said that IPv4 evolved organically. The harsh truth is that the idea that the internet we have today was "defined" by IETF is a delusional fantasy. IETF didn't define shit. It documented the status quo, and occasionally reconciled conflicting guerrilla standards already out in the wild, so that later generations of hardware could interoperate with it. The problem is, the people behind IPv6 have been bought into the fantasy of IETF-omnipotence hook, line, and sinker, and convinced ISPs like AT&T and Comcast that it's the truth, while companies like Cisco metaphorically roll their eyes, cringe, and humor them because it means they'll be selling lots of new hardware to replace slightly less new hardware.

Re:Not "instead of", but "in addition to"

[petermgreen]

Free tunnels from he.net

Note that the tunnel technology HE uses does not get on well with NAT. It can SOMETIMES be made to work with consumer NAT boxes but good f*cking luck making it work with ISP based NAT.

So if you are stuck behind IPv4 nat and want an IPv6 tunnel you have to look elsewhere, for example sixxs or freenet6.

Re:Not "instead of", but "in addition to"

[Alomex]

I never really understood why we didn't just map all the IPv4 addresses to a IPv6 subset and provide a very simple rule to translate, say by adding all zeros or some other number to the IPv4 address to get its IPv6 one.

Because IPv6 was incorrectly designed from a flag day perspective. As late as 1999 people were still talking about a possible flag day when the net went down and woke up speaking IPv6 only.

Hey, how about we just put all of the adult content on IPv6 only addresses.... You know THAT would set a fire under things....

It's been tried. It was called the Great IPv6 Experiment and it was a failure.

Re:Not "instead of", but "in addition to"

[172pilot]

The problem here is that nobody really has the necessary power to force IPv6 on the world

That's where you are wrong.. The CONSUMER has the power to force it to happen. The reason it isn't happening, is because it isn't necessary. Unless and until someone comes up with the "killer app" that there is no way to run over IPv4, the path of least cost is always going to be to extend the IPv4 network. If someone big like Facebook were to say today that starting tomorrow, if you weren't on IPv6, you wouldn't have access, everyone would be outraged until next Monday, when "facebookclone.com" opened up and took all their old customers.. there's just no reason to even go there..

Re:Not "instead of", but "in addition to"

[Noughmad]

I doubt the ISPs will have a whole lot of luck getting their customers to all upgrade their home routers.

I find this interesting, is it common for people in America to own their own routers? Here in Slovenia, the standard practice is that the ISP leases you a router for the duration of your contract. I think this is a good system because most people don't know anything about routers, and having a single model makes tech support much easier. As an added bonus, it is very simple to replace the hardware, which they sometimes do.

Re:Not "instead of", but "in addition to"

[Chirs]

I never really understood why we didn't just map all the IPv4 addresses to a IPv6 subset and provide a very simple rule to translate, say by adding all zeros or some other number to the IPv4 address to get its IPv6 one.

Um....they did?

http://en.wikipedia.org/wiki/IPv6#IPv4-mapped_IPv6_addresses

Re:Not "instead of", but "in addition to"

[istartedi]

Eventually, there would be enough pressure for the ISP's to push IPv6 down the food chain to the end user who will either pay more for IPv4 service, or upgrade to IPv6

End users are ahead of this. Windows XP uses IPv6 if it's available. It works so well I only know about it because I'm geeky enough to look. I assume Windows 8 and any planned future versions work the same way. All Unix-like variants have had it for years, probably longer than Windows, and I'm sure they can be configured to use IPv6 when it's available also. I assume that Apple products also "just work" in this regard; but if that assumption is invalid I'm sure someone will point it out.

Re:Not "instead of", but "in addition to"

[MajroMax]

I never really understood why we didn't just map all the IPv4 addresses to a IPv6 subset and provide a very simple rule to translate, say by adding all zeros or some other number to the IPv4 address to get its IPv6 one.

We can do that; for legacy reasons IPv4 addresses can be embedded perfectly in the IPv6 space. However, there's no way to do so and ensure compatibility, because an IPv4-only application will simply be unable to handle IPv6 addresses. For IPv4-only applications (on either endpoint) to work on an IPv6 connection, some device in between has to translate the network addresses, or some anagram thereof.

From the perspective of the IPv6-end of things, this is a solvable problem. NAT64 effectively allows a router to proxy the entire IPv4-space, allowing a 6-only host to more-or-less transparently deal with IPv4-only hosts. DNS64 also proxies the DNS records to construct suitable (NAT64-based) addresses for hosts with only A (IPv4) DNS records.

The problem of IPv6 adoption is a classic chicken-and-egg. The differing address lengths mean that compatibility for IPv4-hosts must be broken; the pigenhole principle means that there literally cannot be a stateless mapping between IPv4 addresses and IPv6 addresses, even ignoring the traditional NAT problems of addresses-in-protocols. Some kind of translation intermediate will be necessary until we can finally turn off the IPv4 lights.

Re:Not "instead of", but "in addition to"

[gbjbaanb]

I would hope that NAT64 is enabled by default on all home routers, so I can still stream from my IPv6 PC to my TV and whatever other old device still uses IPv4.

However, I wouldn't want, or care, if my legacy devices could see the real internet - if they could, that's a bonus, and I certainly do not want them addressable from outside my router. Considering these are the devices least likely to be upgrades, it would seem that NAT64 in my home would be the best option. The second best is just to run a dual stack on my PC.

Now, if only I can get a home dsl router and an ISP that supports IPv6 :)

Re:Not "instead of", but "in addition to"

[jez9999]

Luckily, IPv6-only connections are becoming less useless every day.

Yep. I love browsing Slashdot at home with my IPv6 conn... oh wait.

Re:Not "instead of", but "in addition to"

[clarkn0va]

the marketing name changed from c-nat to cgnat

thereby making the term even more deceptive, since there is nothing at all inherently different about the NAT utilized by carriers and the NAT employed by a $30 desktop router. There's nothing "carrier grade" about it. They might as well call it closet grade NAT.

Re:Not "instead of", but "in addition to"

[Bert64]

Most users use whatever hardware the ISP supplies to them (most of which is complete crap), so the ISP need only supply them a v6 capable router.
Those few users who use their own router tend to be geeks who would actively seek out a v6 capable router themselves.

Re:Not "instead of", but "in addition to"

[Bert64]

AT&T already provide IPv6 to their DSL customers, and the routers they provide to their customers include support for it out of the box. If you sign up a new AT&T DSL right now and use the supplied kit then you will get a /64 of IPv6 configured and working by default - i know several people who are using it right now.

Comcast have already rolled out IPv6 to a big portion (over 50%) of their network, and if you have a DOCSIS 3 router you too can do V6 there. I would assume that the latest hardware Comcast are supplying will enable v6 by default too.

The UK is way behind the US when it comes to V6 adoption...

Re:Not "instead of", but "in addition to"

[Bert64]

Only traditional IPv6 tunnels don't work from behind NAT...

Re:Not "instead of", but "in addition to"

[marka63]

You run dual stack within the home. You most probably already are running dual stack within the home without knowing it.

As for home DSL routers that support IPv6 they exist as do ISPs that support IPv6. Just shop around.

Re:Not "instead of", but "in addition to"

[Elvii]

I wish comcast made ipv6 available if you ask, or at least give you a timeline of when it might be. I have a ipv6 capable router (I think, I haven't tried a 4to6 tunnel or anything to test it). But my modem isn't ipv6 capable, and the last time I tried to get past that they only gave me a faster modem - with a built in horrible router and AP. both of which got disabled in minutes.
I'm not sure if it's their equipment supplier(s) or comcast themselves to blame for my lack of ipv6, but from this customer point of view it's comcast's fault either way.

Re:Not "instead of", but "in addition to"

[bbn]

Luckily, IPv6-only connections are becoming less useless every day.

Yep. I love browsing Slashdot at home with my IPv6 conn... oh wait.

Yes you can. Check this:

baldur@neaira:~$ telnet 2001:778:0:ffff:64::216.34.181.45 80
Trying 2001:778:0:ffff:64:0:d822:b52d...
Connected to 2001:778:0:ffff:64::216.34.181.45.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.1 301 Moved Permanently
Server: Apache/2.2.3 (CentOS)
Location: http://slashdot.org/

Although due to that redirect you will have to put the IPv6 address for slashdot.org into your /etc/hosts file. Or you could use 2001:778::37 as your DNS server:

baldur@neaira:~$ host slashdot.org 2001:778::37
Using domain server:
Name: 2001:778::37
Address: 2001:778::37#53
Aliases:

slashdot.org has address 216.34.181.45
slashdot.org has IPv6 address 2001:778:0:ffff:64:0:d822:b52d
slashdot.org mail is handled by 10 mx.sourceforge.net.

This is called NAT64 and is admittedly not much better than carrier grade NAT. But it allows you to run pure IPv6 and still have access to the IPv4 internet.

Re:Not "instead of", but "in addition to"

[Miamicanes]

I don't know about AT&T DSL, but I can definitely say that if my AT&T U-verse 3801 residential gateway has a real IPv6 address in addition to its IPv4 address, they've done an incredibly good job of making it non-obvious and hiding it from me. My RG (U-verse parlance for "VDSL2 modem + router") is ~3 months old, and AFAIK, it's the newest model they have and use in FTTN neighborhoods that are 1500 feet from the VRAD).

For shits & giggles, I had my friend's Netgear 3700 (rev.3) router autodetect IPv6 on his Comcast cable modem. It found IPv6 and displayed what appeared to be a legit IPv6 address, but identified it as a tunnel broker. Apparently, Comcast isn't rolling out "real" IPv6... they're just making it easier to kludge by offering their own tunnel-brokering service to customers. The big innovation is that routers can autodetect it, instead of having to set it up by hand. Yawn. It's not real IPv6 until the modem can route both natively all the way back to the NOC without having to wrap one in the other first.

Re:Not "instead of", but "in addition to"

[Alomex]

Um....they did?

Um... they did not.

From the same wikipedia article:

1) Host software can be IPv4-only, IPv6-only, dual-stack, or hybrid dual-stack.

2) Hybrid dual-stack IPv6/IPv4 implementations recognize a special class of addresses, the IPv4-mapped IPv6 addresses.

3) Some common IPv6 stacks do not implement the IPv4-mapped address feature.

So let me sum it up for you of the three types of IPv6 software hosts only one of them supports IPv4 mapped address, and even among this limited set some do not implement it (or has to be activated, like in Linux).

Re:Not "instead of", but "in addition to"

[Agripa]

The native IPv6 over IPv4 tunneling (protocol 41) is neither TCP nor UDP so most NAT implementations just ignore it which drops it. Some routers can permanently forward protocol 41 to a single private address (maybe through a DMZ setting) but that is only a solution if you already have a routable IPv4 address. In theory a NAT implementation could forward multiple protocol 41 connections automatically by tracking the source and destination IP4 addresses but I know of none that do and an end user would hardly need this.

Some ISPs (at least AT&T U-Verse does this to me but Earthlink provisioned through Covad did not) drop protocol 41 unless it is going to a 6to4 relay (I assume their local 6to4 relay) so you can not use third party hosts for 6in4. This blocks SIXXS unless you tunnel using UDP instead of protocol 41.

Re:Not "instead of", but "in addition to"

[bobbied]

Hey, how about we just put all of the adult content on IPv6 only addresses.... You know THAT would set a fire under things....

It's been tried. It was called the Great IPv6 Experiment and it was a failure.

Not really, they only put a small amount of adult content out there. I'm sarcastically suggesting they actively move all obviously adult websites to IPv6. Heck, just start charging more for IPv4 DNS records, a LOT more...

Actually, this problem will not be fixed anytime soon. Nobody has the power to force IPv6 adoption.

Re:Not "instead of", but "in addition to"

[bobbied]

The problem here is that nobody really has the necessary power to force IPv6 on the world

That's where you are wrong.. The CONSUMER has the power to force it to happen.

This is not really a consumer issue. The consumer browsing the internet really doesn't know or care what version of IP is being used. This is really about what it costs...

Re:Not "instead of", but "in addition to"

[172pilot]

Exactly my point.. The consumer doesn't care, and the TYPICAL consumer is price driven, so why upgrade them to an IPv6 network, and retrain all of your support staff, when your typical customer is happy if they can get to Facebook and google? NAT on an IPv4 network is fine for most people.. Those who care, will be willing to spend some extra per month to get a real IP address.. EVENTUALLY, there might be some functionality that the consumer demands, which can ONLY be provided on IPv6, at which time, there would be a reason for the typical consumer to care, and at that point, there will be a financial driver to force the upgrade. Until then, I'm betting no. I've been hearing the same IPv6 is coming mantra for 15 years or more, and it's still the same story..

Re:Not "instead of", but "in addition to"

[petermgreen]

The native IPv6 over IPv4 tunneling (protocol 41) is neither TCP nor UDP so most NAT implementations just ignore it which drops it. Some routers can permanently forward protocol 41 to a single private address (maybe through a DMZ setting) but that is only a solution if you already have a routable IPv4 address.

Indeed, this is the technical explanation for why "protocol 41 tunnels" are NAT unfriendly.

HE only offer "protocol 41" tunnels while the other providers I mentioned also offer NAT friendly UDP based tunnels (AIUI using two different tunneling protocols :/).

Re:Not "instead of", but "in addition to"

[WaffleMonster]

Have to be careful it is very easy to get IPv4 mapped IPv6 address confused with IPv4 compatible IPv6 addresses. While they sound and look the same they are two separate concepts which solve two distinct problems.

IPv4 mapped IPv6 addresses in the fame of ::ffff: is used to facilitiate dualstack sockets. When you listen on a dualstack socket and an IPv4 connection is established the address is conveyed at the socket layer as ::ffff:x.x.x.x however this address explicitly has no meaning whatsoever outside of this internal use. It is not for example valid to address an IPv4 system by typing ::ffff:x.x.x.x into a browser. It is explicitly not allowed.

The IPv4 compatible IPv6 address in the form of ::x.x.x.x was intended to allow IPv6 to acess IPv4 thru a nat gateway or whatever. It has been dead for a very long time.

Even those new fangled proxy systems which leverage NAT and DNS to allow IPv6 only hosts access to IPv4 use a different prefix to map IPv4 universe into IPv6 subnets.

With regards to dualstack sockets they are only useful for listeners/server applications. Windows XP does not support them nor do insanely old versions of linux (pre 2.6 era)

The only problem lack of support for IPv4 mapped IPv6 addresses means is that instead of getting away with just one socket to listen for IPv4 and IPv6 requests you need to listen on two separate sockets one for each address family.

Re:Not "instead of", but "in addition to"

[WaffleMonster]

Not really, they only put a small amount of adult content out there. I'm sarcastically suggesting they actively move all obviously adult websites to IPv6. Heck, just start charging more for IPv4 DNS records, a LOT more...

Actually, this problem will not be fixed anytime soon. Nobody has the power to force IPv6 adoption.

I betcha google could get basically everyone to switch to IPv6 overnight simply by saying their ranking algorithm will preference those sites accessible via both IPv4 and IPv6.

Re:Not "instead of", but "in addition to"

[jbgeek]

Yes. Or IPv6 NAT64/DNS64 ... there are already mobile telcos doing this with their customers. End users get IPv6 but can still talk to the IPv4 internet through NAT64/DNS64.

inevitable?

[Nossie]

why in the world is it inevitable? Inevitable because they want to keep holding off on newer technology? If I was with Plusnet I'd use this as a good reason to start looking elsewhere.

Re:inevitable?

[rogueippacket]

This is largely inevitable due to the cost of replacing customer modems/routers with those which truly support IPv6. Any decent core routing equipment can do both IPv6 and CG-NAT - the difference being CG-NAT does not require you to mail out a couple hundred/hundred-thousand/million IPv6-cable boxes to your customers.
I suspect we will see virtually all ISP's converting to CG-NAT in the coming years, with an upgrade to an IPv6-capable circuit becoming an option shortly thereafter. Any customers who simply use their Internet service for requesting data will be fine with CG-NAT - it will really only be those who run servers or programs which fail behind a double-NAT (admittedly, most do) who would request IPv6.

Re:inevitable?

[vlm]

I can't speak to the customer owned routers, but for the modems, given how often my cablemodem dies on the RF side from lightning or "whatever" and how very long its been illegal to install anything but docsis 3.0 ipv6 compatible modems, I'm unimpressed. That was a pretty good argument in '03 but its '13 now.

I also can't speak for the DSL users. Maybe they're stuck in the stone age, maybe they've also all been ipv6 compatible since the 00s.

Re:inevitable?

[Nossie]

right, so give customers the option to upgrade to something else - I never use a service that bundles a modem anyway. I'm currently using IPv4 as it's one of the 10 IPs my ISP assigned when I joined them.. I'm in no hurry to go the IPv6 route but it would not be a big issue to reassign another set of IPs and I would just migrate over. The netgear I bought in 2002 supported IPv6 (which I subsequently bricked with custom firmware *cough*) and yes it was a premium router at the time but if they are selling IPv4 only consumer routers then THAT is the problem.

Give us the option to migrate and when someone signs up by default put them on IPv6 and slowly phase out IPv4. Slowly do the same for customers renewing their contract and send tickles to the remainder with the benefits/reasoning of IPv6.

Not rocket science really - build out your fucking IPv6 network before start butchering the current one! I realise I'm in the minority because I'm fully aware/care about the issue however that does not mean they have to relegate their current system first.

Re:inevitable?

[petermgreen]

Because everyone sat on their hands for too long.

Afaict the plan was that everyone would get dual stack, then once IPv4 only hosts/services became negligable v6 only hosts and services could be introduced. Unfortunately it didn't work out that way. There was little immediate value in having IPv6 and as such most companies did not work on deploying it. As a result IPv4 addresses have pretty much run out while many services (including the website we are discussing this on) are still V4 only.

Therefore any growing ISP will have no choice but to deploy a mechanism to allow access to services on the IPv4 internet while using less than one IPv4 address per customer. That mechanism may be conventional IPv4 NAT, NAT64, DS-LITE, port based IP sharing or some other mechanism but whatever it is it will be needed and it will have implications on what users can do with their internet service. They may or may not choose to also provide access to the IPv6 internet.

Re:inevitable?

[bbelt16ag]

why the hell would they have to mail them out? just have the customer go exchange them?? or upgrade the god damn bios on the router.. oh bull crap

Re:inevitable?

[Nossie]

there is nothing stopping them keeping the current users on ipv4 and just adding an IPv6 layer... customer wouldn't need to exchange them

However, I had to laugh when you said upgrade the firmware on the router ... router manufacturers are kinda like cell phone providers when it comes to software updates.

They would much rather you bought a new product than fix/upgrade an older one

Re:inevitable?

[WaffleMonster]

why in the world is it inevitable? Inevitable because they want to keep holding off on newer technology? If I was with Plusnet I'd use this as a good reason to start looking elsewhere.

My guess cause their running out of IPv4 addresses right now and IPv6 won't be widely deployed enough to stand on its own for a number of years.

I don't think anyone had any illusions CGN would not be deployed. The benefit to the ISP by deploying IPv6 early is they need a whole lot less of it as long tail of network traffic becomes IPv6 accessible. In the US the majority of the traffic is generated from just a handfull of suspects.. google, youtube, netflix, facebook...all native IPv6. By deploying IPv6 less traffic needs to be routed thru CGN.

What I don't see in TFA is anyone from PlusNet saying they will never deploy IPv6...rather it seems they are just testing a technology everyone already knew would be necessary anyway.

The only news seems to be the artistic license used to whore attention to a non-issue.

Re:inevitable?

[Nossie]

they should be spending money investing in IPv6 and not IPv4 - period.

http://community.plus.net/forum/index.php/topic,106125.0.html

Not their customers fault they didn't start this quick enough.

Re:inevitable?

[SeaFox]

I can't speak to the customer owned routers, but for the modems, given how often my cablemodem dies on the RF side from lightning or "whatever" and how very long its been illegal to install anything but docsis 3.0 ipv6 compatible modems, I'm unimpressed.

"Illegal"? Citation for that, please.

Last time I was in a retail store there were still DOCSIS 2.0 modems for sale.
More likely a ISP business decision that new installs must be DOCSIS 3 modems.

Re:inevitable?

[SignOfZeta]

I know Charter Communications is selling only DOCSIS 3.0 modems now, but that seems to be solely for the speed benefits. However, relevant to the article, there was an extension to the old standard called "DOCSIS 2.0 + IPv6" which does exactly what you think it does. I'm not sure how popular that was, but it does exist.

Am I reading that graph wrong?

[mwvdlee]

Am I reading that graph wrong?

What I see is less than 11% of the thousand most popular sites has adopted IPv6

Either that or we seem to be using different definitions for the word "failure".

Re:Am I reading that graph wrong?

[Albanach]

What I see is less than 11% of the thousand most popular sites has adopted IPv6

I'd imagine the hundred most popular sites account for the vast majority of internet traffic. So it really depends where in the list of 1,000 sites that 11% is. I wonder if folk would feel differently if the ISP in question were to offer an unrestricted ipv6 connection or NAT based ipv4 at the customer's choice?

If a country the size of the UK were to set a switchover date and move to ipv6, the vast majority of English language sites would be running ipv6 by the switchover date for fear of losing that audience. It might take regulation though, as no ISP wants to be first for fear of losing customers.

Re:Am I reading that graph wrong?

[Guspaz]

Google reports about 1% of their traffic is IPv6. That's probably a better estimate of IPv6 deployment.

Re:Am I reading that graph wrong?

[vlm]

Just recently an IPv6 proponent sent me a chart showing IPv6 traffic growing from 0.25% to 1% of the Internet in a year as proof of its "impending success" and "rapid adoption".

In the unlikely even that 400% annual growth continues, get back to us in four years when ipv6 is 256% of the internet.

Re:Am I reading that graph wrong?

[mwvdlee]

Just recently an IPv6 proponent sent me a chart showing IPv6 traffic growing from 0.25% to 1% of the Internet in a year as proof of its "impending success" and "rapid adoption".

Let's invent IPv8 and setup a single server and client; the rate of adoption will be 1.#INF within it's first year!

Re:Am I reading that graph wrong?

[mellon]

What matters is not that every site adopt IPv6, but that enough sites adopt it that having an IPv6 connection gets you useful value. We are already at that point—you can do all your google stuff over IPv6. You can do all your yahoo stuff over IPv6. You can do all your netflix stuff over IPv6. Facebook is fine over IPv6. If you had a v6-only connection, yes, you'd have trouble getting to the long tail. But most of your packets would go over IPv6.

Re:Am I reading that graph wrong?

[nine-times]

The technological version of "it moved, I swear, I saw it move, don't unplug the machines just yet!"

I don't think that's it. I think it's more like, "God dammit, you assholes, get moving or you're going to fuck us all over!" Or what, really, do you suppose our other option is? We're running out of addresses. NAT isn't an alternative.

Re:Am I reading that graph wrong?

[Alomex]

9000% adoption in less than a year from world IPv6 launch day

You really do not believe that IPv6 first went live on "world IPv6 launch day" do you?

The protocol has been a standard since 1998, and "IPv6 launch day" was just another effort to get the ball rolling (there have been several before that). So any way you cut it 1% adoption fifteen years after first launched is a dismal failure.

I agree with you that it might be too late to roll back. We are just kind of stuck halfway between IPv4 and IPv6 with IPv6 being more of a roadblock at this time ("well, there is already a solution out there, if a bad one") than help, since it is not being adopted fast enough.

Re:Am I reading that graph wrong?

[petermgreen]

Googles numbers basically tell you the proportion of clients that "preffer" IPv6 which while interesting isn't really a very useful number for making descisions.

The important numbers are

1: what proportion of clients can access v6 only servers.
2: what proportion of popular servers can be accessed by v6 only clients.

Re:Am I reading that graph wrong?

[Alomex]

Or what, really, do you suppose our other option is?... NAT isn't an alternative.

First, I do not accept your premise that NAT is not an alternative. It has worked fine for the last 20 years and it will continue to work fine for at least another 10.

Second, our other option is to dump IPv6 and propose a new alternative using existing hardware. At present state it consists of: IPv4-only gear, IPv4/IPv6 gear (dual stack), NAT boxes, Merchant Silicon, and programmable router boxes.

Re:Am I reading that graph wrong?

[Miamicanes]

> If a country the size of the UK were to set a switchover date and move to ipv6, the vast majority of
> English language sites would be running ipv6 by the switchover date for fear of losing that audience.

Yes... that worked REALLY WELL with RoHS, didn't it? (hint: it didn't). For components that were basically in "legacy old-stock mode" (new ones hadn't been made in years, but new old stock was widely available), new RoHS-compliant parts DIDN'T appear. The components just became officially unavailable in Europe, with no compatible alternatives to replace them with.

If British ISPs switched over to exclusively IPv6, British customers would be screwed. And lots of British sysadmins would be unemployed or forced to consider emigration, because British companies would move their web hosting to the US to avoid losing ~400 milllion English-speaking customers with only IPv4.

Re:Am I reading that graph wrong?

[Dagger2]

There are other useful stats, depending on what decisions you're making. For instance, if you want to know how much CGNAT capacity you need to provide, then the relevant stat is "how much of our traffic will go over v6 (and thus avoid the CGNAT)?"

I've seen the figure from a large university network that provides internet access to its dorms: it was 50%.by volume.

(Though perhaps the better stat would be the fraction of packets rather than of bandwidth.)

Re:Am I reading that graph wrong?

[Nossie]

I'm not sure it has been a failure as such, I currently have 10 allocated IPv4 IPs. I don't go down the IPv6 route because there is currently no benefit for me to change. That is not to say my hardware does not support it or that I don't see it as being inevitable. If you give me a IPv6 service - then I'll use it and be on my way.

What does REALLY suck - is companies like plusnet trialing IPv6 and then giving up - much easier to retard current infrastructure than build for the future apparently.

Re:Am I reading that graph wrong?

[jones_supa]

All the Linux users? ;)

Re:Am I reading that graph wrong?

[jones_supa]

I'm glad that my home computer, file server, roommate's computer, roommate's tablet, and my tablet now have unique public IPv6 addresses.

Why? Do you at least get consecutive addresses from the same netblock?

If I'm worried that I've somehow accidentallyed xinetd on to any of those computers, I'm more than capable of setting up a firewall. Except none of these computers have any services that have been accidentallyed on to them.

I would lose sleep over that. With a silly IPv4/NAT setup I can at least be sure that all connections are blocked by default (unless I specify some port forwardings).

I don't know. I'm not a networking pro after all. I don't exactly have anything against IPv6 adoption, but some of the arguments that recommend it seem to just want "academically correct" public IP address for every device.

Re:Am I reading that graph wrong?

[klapaucjusz]

What matters is not that every site adopt IPv6, but that enough sites adopt it that having an IPv6 connection gets you useful value.

It's natural that people should be focusing on the web, but the web is really a non-issue -- we know how to proxy HTTP efficiently, so HTTP sites staying on IPv4 is at worst a minor inconvenience.

What urgently needs to move are protocols that are difficult to proxy, either because they have a complex structure (BitTorrent, SIP) or because the added latency hit is problematic (SIP, Skype, most online games). You really want enough of your BitTorrent peers to implement IPv6 support, so you can get your Linux distributions fast.

Re:Am I reading that graph wrong?

[Roogna]

I've got running IPv6 working just fine here, but I almost never go to ipv6.google.com. So unless Google has it set to check and auto-redirect I'd think I usually end up hitting the IPv4 servers, as would most people I'd imagine.

On that note, to help their traffic reports, anyone have a good way to force the browser search bars and such to redirect to the ipv6 versions of Google's servers?

Re:Am I reading that graph wrong?

[Guspaz]

ipv6.google.com isn't required. If you do a regular nslookup for google.com, they return an AAAA record, which includes the IP 2607:f8b0:4006:800::100e

Re:Am I reading that graph wrong?

[Darinbob]

My computer can definitely support ipv6, but it can't do it because of the ISP's router which doesn't support it (and the router is less then a year old).

Re:Am I reading that graph wrong?

[mellon]

BitTorrent was one of the earliest protocols to start using IPv6, because it literally doesn't care. If there's a way to get IPv6 packets to a seeder, it does it. SIP works just fine with IPv6; the problem is that SIP providers typically don't yet support it. But it would be trivial for them to do so; the reason they haven't is that there's not enough market pressure on them yet. If there was a decent SIPPOTS provider that did IPv6, I'd drop my current provider in a hot second. Skype will probably never work with IPv6—the protocol has inherent dependencies on IPv4. In order to get IPv6 support to work on it, Microsoft would have to get everyone to upgrade, and that's not likely.

But none of this matters. The person who cares about how many service providers have IPv6 support is the person trying to justify deploying IPv6 at an ISP. That person cares most about how much traffic his or her employer can offload to IPv6 if they turn it up on their network. The amount of actual traffic that would be offloaded today is already enough to make that case. Yes, it would be great if everything supported it, but that's not necessary to make the transition worthwhile.

Put simply, IPv6 support reduces the pressure on the ISP's NAT solution. That saves them money. End of story.

(Note that most U.S. ISPs do not currently have an IPv4 address shortage, so this analysis doesn't apply to them yet. Comcast did the transition anyway, because, as I understand it, it made good business sense for them other reasons.)

Re:Am I reading that graph wrong?

[klapaucjusz]

Comcast did the transition anyway, because, as I understand it, it made good business sense for them other reasons.

Could you please explain?

Re:Am I reading that graph wrong?

[raxx7]

Like most cable providers, Comcast uses the 10.0.0.0/8 private address range internally to, among other users, manage their clients' modems.
That is, in addition to the client's public IP address, each modem gets a private 10.0.0.0/8 address for management purposes.
Their problem is that they have so many clients.. they ran out of private addresses.
So, they want to deploy IPv6 earlier than most.

Re:Am I reading that graph wrong?

[Albanach]

Businesses moving, you are kidding, right? You really think a business would move to a different country with a different regulatory environment rather than buy ipv4 addresses elsewhere and proxy/vpn etc if they really had the need for ipv4 addresses. If you think they'd move overseas, leaving most their workforce behind, leaving their funding sources and customer base, I think you're living on another planet.

Re:Am I reading that graph wrong?

[mellon]

Wanted. They've already done it. And having done it, rolling out IPv6 to the end user was a relatively small incremental cost with a really big upside. They did really good work pioneering native IPv6 to the home—a lot of CPE device bugs got ironed out as a result of their efforts.

Re:Am I reading that graph wrong?

[Miamicanes]

No, they wouldn't move the whole company, they'd outsource their web hosting to an American (or Canadian, or French, or German, or some other country) company that supported both IPv4 and IPv6, and continue as always.

The companies that a law mandating immediate and exclusive use of IPv6 would put out of business are British web hosting companies, because their services would become commercially worthless compared to web hosting services in countries where both IPv4 and IPv6 were legal. VPN'ing isn't commercially viable, because it adds latency and expense for no good reason. A Linux/Windows box on the Internet in a country with English-speaking staff and cheap fiber backbone connectivity is pretty much a commodity. A customer in London can SSH into a colocated server in Virgina, New York, or California as easily as he can SSH into a colocated server in London, Cambridge, Edinburgh, or Manchester. If hosting companies in Britain weren't allowed to offer IPv4-routed hosting services, they'd cease to be competitive with hosting companies in other countries who could offer both IPv4 AND IPv6 routing.

Re:Am I reading that graph wrong?

[jrumney]

If you pick some random addresses in your assigned subnet (which tend to be several orders of magnitude larger than the entire IPv4 address space) it's just not worth it for an attacker to scan your entire subnet.

Even better if you have a honeypot that responds on all the unassigned addresses.

Really instead of ?

[pumpkin2146]

I highly doubt it makes sense for plusnet to do this "instead" of IPv6, but it does make sense to do this "as well" as IPv6.

I see the transition involving something like these 5 steps.

1.) Everyone needs IPv4, IPv6 is useless (no content).
2.) Everyone needs IPv4, IPv6 reduces the amount of IPv4 traffic you use.
3.) Most people still need IPv4, but IPv6 is most of the traffic.
4.) IPv4 is a niche requirement. Most normal users won't notice if they don't have it.
5.) IPv4 is Cobol and I come back and get a fat paycheque because I still remember how it works.

I think we are at (2) right now. I think CGN *IS* inevitable (even if it sucks) as part of a transition strategy. If we had started transitioning seriously a few years ago, we might have avoided this, but we didn't.

Re:Really instead of ?

[characterZer0]

If we had started transitioning seriously a few years ago

Some of us did. All the computers and network equipment at my house has been ready for IPv6 for years. I am just waiting for my ISP to get with the program.

ISPs are the problem here. But with government-granted monopolies without regulation, they have no incentive to support IPv6.

Re:Really instead of ?

[mwvdlee]

5.) IPv4 is Cobol and I come back and get a fat paycheque because I still remember how it works.

Step 5 is that IPv4 is one of the most common IP versions in business environments and plenty of people will still be trained to use it?

Re:Really instead of ?

[Alomex]

ISPs are the problem here.

Actually Windows 7 is also part of the problem and a step backwards. You see it has a buggy Teredo implementation leading to a ton of Teredo Ethernet adapters hanging on to their entries in the ipconfig tables. Some people report up to thousands of adapters. This has lead to various organizations disabling the IPv6 stack in their Windows network configuration.

Re:Really instead of ?

[vlm]

All the computers and network equipment at my house has been ready for IPv6 for years. I am just waiting for my ISP to get with the program.

Get a free ipv6 tunnel, like I did... more than a decade ago.

Once it works, its actually pretty boring. It has gotten easier over the past decade or two.

Re:Really instead of ?

[vlm]

5.) IPv4 is Cobol and I come back and get a fat paycheque because I still remember how it works.

Step 5 is that IPv4 is one of the most common IP versions in business environments and plenty of people will still be trained to use it?

Yeah like SNA/SDLC. My VTAM skills are not exactly in demand and are pretty rusty anyway. Or DECTALK. How bout Novell IPX/SPX? Classic Appletalk? Or my first home LAN tech, that being ye olde Arcnet? Although you could run ip over arcnet and that was my plan using early linux. I would imagine recent linux kernels no longer support the arcnet card (there was only like one implementation for arcnet as I recall) A pity I threw out all the weird arcnet coax a decade or so ago, I believe it was something weird like 93 ohm impedance.

Re:Really instead of ?

[characterZer0]

ISPs could support IPv6 and let users disable it at the modem.

Re:Really instead of ?

[petermgreen]

Some of us did.

But many more did not and it wasn't just ISPs. There is plenty of blame to go arround.

MS added IPv6 support in windows XP but didn't enable it by default until windows vista (which was a flop for other reasons) so there are still lots of machines arround that even if placed on a dual stack network will not get IPv6 access by default.

Home router vendors didn't add IPv6 support until pretty recently and even when they did it was often only half baked.

Vendors of serious routers often made products with half baked IPv6 support (such as doing IPv6 forwarding in software while doing IPv4 forwarding in hardware)

ISPs didn't bother to deploy native IPv6 or ISP managed IPv6 tunnels to their customers until way too late and didn't take generic transition mechanisms like teredo and 6to4 seriously either*.

*Traffic destined to 2001:0::/32, 2002::/16 and 192.88.99.0/24 should not have to leave the ISP to reach a suitable relay server, sadly it usually does even if the ISPs backbone is dual stack.

Re:Really instead of ?

[_xeno_]

ISPs are the problem here. But with government-granted monopolies without regulation, they have no incentive to support IPv6.

Yep. I'm on Comcast. You know, the US ISP that made a big deal about supporting IPv6, including making dumb posters about it? I've got an IPv6 capable device serving as a router/IPv4 NAT. I upgraded my cable modem so that it's be able to do IPv6. Let's see what IPv6 addresses were assigned to me by Comcast...

That'd be none. Still. Because IPv6 hasn't rolled out in my area yet. Or maybe it hasn't rolled out for the particular cable modem I have, I'm not sure. Who knows, because Comcast sure isn't making it clear what areas and what devices do and don't get IPv6 support from them.

Re:Really instead of ?

[172pilot]

I like your listed steps, but I dont think anyone outside of the academic and/or government world will ever see "step 2" unless there's a killer-app that forces the consumer market to demand it.

Re:Really instead of ?

[wings]

If we had started transitioning seriously a few years ago

Some of us did. All the computers and network equipment at my house has been ready for IPv6 for years. I am just waiting for my ISP to get with the program.

I'm still waiting for my ISP too, but I'm working around that limitation by getting IPv6 from a tunnel broker. I've had dual stack IPv4 and IPV6 access for my home network for about 2 years now and I'm not experiencing any real problems. My IPv6 access is fully routed and suitably firewalled and IPv4 is through NAT.
With applications that support both IPv6 and IPv4 it isn't always apparent which protocol was used for a connection. Everything just seems to work.

Re:Really instead of ?

[jez9999]

Good job I'm still using Windows XP!

Re:Really instead of ?

[Ingenium13]

Isn't your bandwidth restricted by them though? I assume you're using he.net?

Re:Really instead of ?

[Ingenium13]

What modem do you have? I've had dual stack on Comcast for about a year and a half in the Bay Area (since I signed up for service with them). My modem wasn't IPv6 capable when I lived in Pittsburgh so I don't know if/when it was rolled out there. Both my residential and business accounts use Ubee modems that I made sure supported IPv6. I have noticed more of a variance in IPv6 latency though (sometimes pings to google are up to 100ms vs consistent 20ms on IPv4), but that could just be my router since other people with Comcast in the area haven't reported the same issue.

Re:Really instead of ?

[SignOfZeta]

I don't know where you live, but I spoke with a surprisingly-knowledgeable Comcast representative some time ago about the future of IPv6 on their network. They are rolling it out market by market, but unfortunately for me, the northeast and mid-Atlantic states will be one of the last regions to have it activated. Something something legacy equipment up there. She couldn't provide a time frame, though it will definitely be addresses. (Whenever that may be.)

If you do have it enabled, though, your router will get a single IPv6 address. If it's capable of DHCPv6-PD and you left that enabled, you'll wake up one morning to see that IPv6 has magically come to your house.

Re:Really instead of ?

[bbn]

Isn't your bandwidth restricted by them though? I assume you're using he.net?

he.net are good. But if you are a Linux user it is easier to run this single command:

sudo apt-get install gogoc

Thats it. You got IPv6 through an automatic gogo tunnel.

But yes it actually makes your internet slower. Or at least it does for me. I am on a 40/40 fiber but the tunnel can not deliver anything near that.

Re:Really instead of ?

[toddestan]

One thing I don't understand is how Microsoft managed to screw up the networking in Windows 7. It's one of the few things that got actually got worse when compared to Vista.

Re:Really instead of ?

[petermgreen]

So users are supposed to divert their internet traffic from taking the most "direct" route to it's destination to routing via a third party who is not committed to providing them with any particular quality of service and who could drop the service at any time?

Sure *I* did that on one of my machines because I want to test that my software works with IPv6 but it's not something i'm going to advise users in general to do.

Fastweb Italian Provider

[paulatz]

The Italian provider Fastweb (pioneer of optical fiber connections in Italy) has been doing it for ages, technically since the very beginning of its business.

The main drawback for it's customers has been with P2P programs, as direct peer-to-peer connections do not work well with NAT. As the Fastweb customers are not NATed with respect to each other, some of them even developed a special version of aMule (the most common P2P network at that time) called "adunanza" that would work inside the ISP-level network. Bittorrent is somehow less sensitive to the NAT problem, hence an "adunanza" torrent client was never developed.

I suspect this may actually be a strong motive behind such a silly ISP choice: reduce the exposition of P2Ping customers to the outside world. If the aim is to reduce P2P or just to hide it from the mayor's private police, it's hard to tell.

Re:Fastweb Italian Provider

[pmontra]

Fastweb is opening up its network. Residential customers with new routers have a public IPv4 address and can open ports on the router (but not port 5000).

Too bad the new routers are not very good. Other customers and I are experiencing weak WiFi signal and lot of lag over WiFi between devices inside the home network (wire is fast). That's ok for browsing with a phone but I'm also experiencing problems handling concurrent connections: even a 2 Mb/s data stream (video streaming, a backup, etc) seems to affect significantly the responsiveness of the other connections (it's a 10 Mb/s symmetric fiber optic line). The old router was much better, but had no WiFi: the now discontinued Fasteweb's TV set top box could get a 4 Mb/s MPEG2 stream and the other computers in my home could access the internet at 6 Mb/s without any problem. I wonder if they messed up the home router or their network.

This is just the beginning

[alphaminus]

Rather than doing this correctly, it will go like this. All "home" users will get CG-NAT. "Business" users will be allowed public IPs at a steep premium, and only when that possibility is completely exhausted, will IPv6 truly begin to be implemented. Hell, people might just use duct tape code and NAT subterfuge to drag this out another decade or two.

Re:This is just the beginning

[mellon]

Comcast is delivering IPv6 to end users now. Lots of ISPs in Europe are too. IPv6 deployment is growing in Asia. CGN is expensive and delivers really crappy service—tiling fails on Google maps, sites with lots of AJAX fail in mysterious ways, etc. CGN is the worst of all worlds, and ISPs that put all their eggs in that basket will shrink over time, even if they manage to avoid dying off completely.

My Rant....

[ZiakII]

How the hell does slashdot.org not support IPV6, I thought this was a tech website?

Re:My Rant....

[Alomex]

You must be new here. It doesn't even support "edit" which is breakthrough technology from the 1980s.

It's like a flashback to Unix ca. 1980 when you couldn't edit the command line if you made a mistake while typing a command.

Re:My Rant....

[Mr_Silver]

How the hell does slashdot.org not support IPV6, I thought this was a tech website?

Forget IPV6 ... it doesn't have valid HTML, valid CSS and looks terrible on mobile devices.

Re:My Rant....

[Princeofcups]

How the hell does slashdot.org not support IPV6, I thought this was a tech website?

IPV6 is great in theory, but it's solving a problem that does not exist. When the internet was started, the idea was that every workstation would be on the internet. Once security became a concern, all those workstations ended up behind firewalls. With firewalls, there is no reason to not NAT. Since only the firewalls need be internet facing, the number of IPs drops drastically. Multiple web servers and web sites can share a single IP. There are people that think that they still need an internet facing IP on every workstation, but the reasons are more personal than practical.

Re:My Rant....

[JDG1980]

Doesn't properly support Unicode either. That's why you will regularly see garbage if you copy and paste content that contains characters like a British pound symbol.

Re:My Rant....

[Anonymous Coward]

You must be new here. It doesn't even support "edit" which is breakthrough technology from the 1980s.

That's a feature, not a bug.

GP has a valid point. Why am I using Facebook over IPv6, but not Slashdot? My piddly little Linode instance has had native IPv6 for years now.

Re:My Rant....

[jittles]

You must be new here. It doesn't even support "edit" which is breakthrough technology from the 1980s.

It's like a flashback to Unix ca. 1980 when you couldn't edit the command line if you made a mistake while typing a command.

I think the lack of an edit feature is due to the way that moderation works. They don't want someone to get modded up, then edit their post to something a bit more trollish. While it would be nice to be able to fix typos, that is a handy feature. Though they could of course allow you to view the revision history.

Re:My Rant....

[Alomex]

Though they could of course allow you to view the revision history.... and severely punish your userid and IP if you ever replaced a +5 Insightful with spam.

Re:My Rant....

[Anonymous Coward]

I think the lack of an edit feature is due to the way that moderation works. They don't want someone to get modded up, then edit their post to something a bit more trollish.

There are loads of ways to avoid that, many other sites allow a 5-10 minute window for editing out mistakes or fixing broken links. Hell, let the author of a post edit it right up to the point where it gets its first moderation points and then lock it. There are plenty of ways to allow editing without letting people go back to replace content with troll nonsense, taking back fluffed arguments, etc.

Re:My Rant....

[Ksevio]

There's now http://mbeta.slashdot.org/ which looks pretty spiffy on mobile devices and even validates (except for some code strangely there to handle IE)

Re:My Rant....

[the eric conspiracy]

Mod parent down. The IP address shortage is real, and using NAT doesn't solve all the issues.

As this ISP will soon find out.

Re:My Rant....

[the eric conspiracy]

Edit should be supported until moderation or a reply occurs.

Re:My Rant....

[compro01]

SSL requires unique IP addresses on webservers. More sites use SSL.

Actually, Server Name Indication allows multiple SSL servers behind a single IP, though support for it is slightly lacking, e.g. No version of IE on XP supports it, nor does the Blackberry browser or Android's stock browser prior to Honeycomb.

Re:My Rant....

[FridayBob]

How the hell does slashdot.org not support IPV6, ...

In a way, it does seem hypocritical: Slashdotters regularly complaining about IPv6 not being adopted quickly enough, while the Slashdot site itself is still not available via IPv6 despite carrying such reports for over a decade.

However, the problem may have at least as much to do with their hosting provider, Savvis, which AFAIK still does not offer their customers native IPv6 support. Of course, Slashdot could decide to set up an IPv6-over-IPv4 tunnel instead, but the traffic involved would probably be substantial and lead to complications and expenses that they and their corporate masters would rather avoid.

I suspect that Savvis and other US providers will only start to improve their support for IPv6 after ARIN's pool of IPv4 addresses has been depleted, an event that currently looks set to take place in the first half of 2014.

Re:My Rant....

[fredprado]

Just take all the positive moderation points and keep the negative on editing. Problem solved...

Re:My Rant....

[mellon]

The more services run on the same IP addresses, the fewer ports are available for each service. Address sharing is great for small sites that have few hits per day, but is useless for large sites, where a single domain will actually have more outstanding connections than can even be supported by a single network node.

Re:My Rant....

[tlhIngan]

IPV6 is great in theory, but it's solving a problem that does not exist. When the internet was started, the idea was that every workstation would be on the internet. Once security became a concern, all those workstations ended up behind firewalls. With firewalls, there is no reason to not NAT. Since only the firewalls need be internet facing, the number of IPs drops drastically. Multiple web servers and web sites can share a single IP. There are people that think that they still need an internet facing IP on every workstation, but the reasons are more personal than practical.

While mostly true, there are needs for individual IP addresses still. However, I suppose a big problem is everyone thinks IPv6 means complete end-to-end connectivity and the end of NAT.

Which is completely wrong - NAT is STILL useful even in an all-IPv6 solution, Because as you said, we've got firewalls and things will be even worse in an IPv6 world because things will assume end-to-end connectivity and fail in new and mysterious ways because of some firewall along the line. (And most of these things probably would work just fine in a NAT'ed IPv4 environment - it's just devs got lazy with IPv6).

And even worse, there's no way for either end to tell - unlike IPv4 where if your local IP is in the reserved range, you can pretty much assume NAT, with IPv6, you can get a route check and get a valid IP for the 'net (the machine will also have a link-local and maybe a reserved address as well, hence doing a route-check and figuring out which IP you will be using), and not realize that you still can't communicate.

And NAT is still useful because it isolates the internal network from the external - basically the only Internet-visible machine is the firewall/gateway, to which the ISP is free to redo their prefixing however they want. And I'm sure ISPs will be changing prefixes once they get full on IPv6 and start figuring out ways to properly segment their network and splitting nodes and such. Of course, not everything may pick up the new prefix so you'll end up with being able to ping stuff fine (because it uses link-local or private addresses) but can't access the internet due to the incorrect prefix.

Knowing home users, it's going to be a fun time on the phone helping parents fix problems like that - if only we could have NATv6 where the internal network could have their own private addresses, isolated from their ISP given prefix (which they don't care about - for 90% of home users, NAT is perfectly adequate).

Hell, NAT even has NAT-PT that allows IPv4-only hosts to communicate on IPv6 networks and vice-versa ("protocol translation"). It's available in RFC and in BSD I believe. And in a way, in Windows as well (which abuses DNS to allow an IPv4 host ot actually specify an IPv6 address transparently).

Of course, the **AAs love IPv6, since it gets rid of the "an IP address does not identify an individual" defense since an IPv6 can be traced to a specific PC, and it's possible to forensically analyze said PC to figure out which individuals are most likely to have done the crime. (Not so with NATv6 - because all traffic is routed through one IPv6 address).

Re:My Rant....

[beelsebob]

You mean all of plusnet's user's IP, not mine :P

Re:My Rant....

[Zadaz]

Also no Unicode support.
It's a tech site from the 1980's.

Re:My Rant....

[mypalmike]

I agree with the gist of your rant, but:

"SSL requires unique IP addresses on webservers."

This is not true of modern webservers or browsers. See http://en.wikipedia.org/wiki/Server_Name_Indication

Re:My Rant....

[Dagger2]

Of course, the **AAs love IPv6, since it gets rid of the "an IP address does not identify an individual" defense since an IPv6 can be traced to a specific PC, and it's possible to forensically analyze said PC to figure out which individuals are most likely to have done the crime. (Not so with NATv6 - because all traffic is routed through one IPv6 address).

Do people seriously still not know about privacy extensions?

Re:My Rant....

[jones_supa]

Sometimes it drives me nuts when I see just an edited message "*** never mind, got it working***" with no idea what the problem or the solution was. It could have been helpful to others...

Re:My Rant....

[jones_supa]

IPV6 is great in theory, but it's solving a problem that does not exist. When the internet was started, the idea was that every workstation would be on the internet. Once security became a concern, all those workstations ended up behind firewalls. With firewalls, there is no reason to not NAT. Since only the firewalls need be internet facing, the number of IPs drops drastically. Multiple web servers and web sites can share a single IP. There are people that think that they still need an internet facing IP on every workstation, but the reasons are more personal than practical.

Thank you for saying this. :)

Re:My Rant....

[jmkrtyuio]

Since the most significant bits wont be changing all that frequently, this does not help much.

Re:My Rant....

[WaffleMonster]

IPV6 is great in theory, but it's solving a problem that does not exist. When the internet was started, the idea was that every workstation would be on the internet. Once security became a concern, all those workstations ended up behind firewalls. With firewalls, there is no reason to not NAT.

Doing away with ALGs makes the system more secure than restricted cone NAT.

Since only the firewalls need be internet facing, the number of IPs drops drastically.

It is still much less than the number of people on this planet. I believe each and everyone one of them with network access should have the opportunity to be individually addressed if thats what they want.

Multiple web servers and web sites can share a single IP.

Or we can bite the bullet and dispense with all of these shitty hacks that suck, dramatically increase complexity, incur security and accountability problems, don't scale and require permission/coordination from the ISP. Native IPv6 deployment has the same complexity as native IPv4 deployment.

There are people that think that they still need an internet facing IP on every workstation, but the reasons are more personal than practical.

Or maybe they just want to be able to access their computer from somewhere else on the network?

Re:My Rant....

[WaffleMonster]

Actually, Server Name Indication allows multiple SSL servers behind a single IP, though support for it is slightly lacking, e.g. No version of IE on XP supports it, nor does the Blackberry browser or Android's stock browser prior to Honeycomb.

So in other words SSL requires unique IP addresses on webservers.

Re:My Rant....

[Threni]

No, it's shit. Produces pages you can't scroll on the S3, using chrome,a quad core phone.

Re:My Rant....

[Dagger2]

NAT won't help much either then, since it only hides the least significant bits.

Re:My Rant....

[Patch86]

When the internet was started, the idea was that every machine would have its own IP address. When the addresses started to run out, we used NAT so that now every household or network subdivision would have on IP address shared by dozens or hundreds of machines.

We're now at the point where NAT-enabled one-IP-per-household is starting to fail; now we're talking about one IP address for tens of thousands of households, each with dozens of devices. What's next? One IP address for each million customers? One for each 10 million? One IP address per country- with subnets within subnets, in a sort of multiply nested NAT hell?

Can't we just fix the god damn problem instead?

Re:My Rant....

[MajroMax]

And even worse, there's no way for either end to tell - unlike IPv4 where if your local IP is in the reserved range, you can pretty much assume NAT, with IPv6, you can get a route check and get a valid IP for the 'net (the machine will also have a link-local and maybe a reserved address as well, hence doing a route-check and figuring out which IP you will be using), and not realize that you still can't communicate.

If, if business or network requirements mandate the use of NAT66 for reasons that can't be worked-around with other, more sensible approaches, then local hosts should exclusively use addresses from the Unique Local Address space. It's like private IPv4 addresses, only with near-zero chance of collision if different domains interact (like VPNs, organization mergers, or leaking of private addresses onto public spaces). A host with (seeming) internet connectivity that has an address in a ULA range must obviously be behind address translation.

Besides, what really breaks devices isn't NAT so much as many-to-one NAT. If (again, for some bizarre reason) an organization chooses to implement NAT66, then they should be using many-to-many NAT, where each internal host still maps to a unique -- but not predictable -- public address. If the public address is rotated every few minutes/hours for new connections (like already happens with stateless autoconfiguration + privacy extensions), then it will be impossible for an attacker to track hosts over the long-term.

Re:My Rant....

[flayzernax]

I agree this is the result of shear laziness and incompetence, ipv6 works just fine.

Re:My Rant....

[fredprado]

That is hardly a problem.

Re:My Rant....

[bpier]

How the hell does slashdot.org not support IPV6, I thought this was a tech website?

I agree and have asked about it several times!

Re:My Rant....

[Pentium100]

Webservers require a publicly accessible IP. Tablets and phones are not webservers, in fact, they are not servers at all, they can make do with NAT.

NAT is not security, that's what firewalls are for.

But if you drop all incoming connection in the firewall, you might as well NAT and save an IP (or thousand).

Yes, the ideal is that every device would have a unique address that is publicly accessible. Still, most of those devices would end up behind firewalls that block all incoming connections, those devices might as well be behind NAT.

And that ideal makes local networks more complex. Since there still isn't a IPv6 NAT implementation, all my PCs would have to have at least two IPs - one from the ISP (that can change if I change the ISP or just because the ISP decides so) and one local (that would not change), then I would have to be careful to only use the local IPs internally otherwise there might be problems if the ISP decides to change the public IPs.

Though IIRC iptables will have v6 NAT option a few years later, then IPv6 might be worth using.

Re:My Rant....

[Raenex]

Edit should be supported until moderation or a reply occurs.

No, because reading counts too. No editing. If you really insist on an edit feature, then make it an option that your post doesn't appear for 15 minutes or something, which lets you edit in the meantime.

Re:My Rant....

[petermgreen]

SSL requires unique IP addresses on webservers. More sites use SSL.

Right now this is mostly true, however IPv6 is not the only "soloution". The other "soloution" is "SNI" where the browser indicates to the server which site it is requesting so the correct certificate can be served.

Most browser/OS combinations currently support SNI. The main exceptions being internet explorer on windows XP, the stock browser on andriod 2.x and the stock browser on blackberry. I expect all of these to decline significantly over the next few years.

Windows XP has an IPv6 stack but it's disabled by default which means it may as well not exist. Windows 7 has an IPv6 stack with teredo and 6to4 support included but 6to4 only works on pretty open networks and teredo is automatically disabled if the computer thinks it's on a "managed network" (supposedly this is triggered by seeing a domain controller but i'm pretty sure i've seen it triggered by seeing a samba server that was not acting as a domain controller). So there will be a substatial number of win7 boxes out there that can't access IPv6 resources for the forseeable future.

In short while neither IPv6 or SNI is a usable option for public SSL websites right now I belive the evidence points to SNI becoming a usable option before IPv6 does. Of course one could do both, IPv4+SNI and IPv6 but I belive that would only marginally increase the number of users who could connect without a certificate warning over using IPv4+SNI alone.

ipv6

[geekoid]

failure if IPV6 = We don't want to spend money helping our customer.

Re:ipv6

[mellon]

More likely it means "we don't believe the people who told us this wouldn't work, because we've been doing IPv4 since 1998, so we're going to trial CGN and then once we've been spanked by our pissed-off trial users, we'll deploy IPv6."

Re:ipv6

[cardpuncher]

Actually, no.

IPv6 failed the moment that the IETF decided that Not Invented Here was more important than fixing the problem. Had the original IAB recommendation been adopted, we'd be on to IPv8 by now. The window of opportunity to manage a transition before there really was a "consumer" internet was lost.

It's not just a problem with ISP's penny-pinching - most of the consumer routing kit supplied to date doesn't do IPv6 and to the extent that consumers have any technical knowledge at all, it's a recognition of the pattern "192.168.x.y".

The logisitics of doing this the official way are so horrendous, it's hardly surprising that ISPs are looking at any alternative, however unattractive.

Good Plan

[Anonymous Coward]

This way when one customer violates an AUP the entire ISP can be null routed in a single line.

As fastweb in italy

[gabrygenoa]

Fastweb in Italy is using this method since a decade. And it works quite well. They offer fiber or ADSL depending from the user location. Almost every internet service I used (IP blacklist, megaupload-like services...) know that behind a single fastweb IP there may be a million of users.

Re:As fastweb in italy

[bytesex]

A million is probably a bit of an exageration, as there are only 64K source ports to distribute. Minus a few, even.

So they're lazy to convert to IPv6

[nhat11]

*Smash head against desk*

wtf

[spottedkangaroo]

seems like a colossal waste of money -- they'll eventually come around to ipv6 and just throw this out... right?

Re:wtf

[mellon]

ISPs have to cycle through equipment over time anyway, so this just means they aren't doing IPv6 in this cycle. But again, it's a trial, so really what they're doing is hoping that they can get away with not doing IPv6, but not committing to not doing IPv6. Which is actually pretty smart.

IP Theft from IP...

[KitFox]

So what happens when the "copyright enforcement agencies" decide that somebody on that NAT IP has downloaded a movie and three strikes or something similar gets kicked in for the IP? (I know it's perfectly possible given port, IP, and Time to back-track a connection through a properly-logged NAT.Just an amusing side effect if somebody is dumb, and dumb happens a lot these days.)

Re:IP Theft from IP...

[mellon]

Depends on the regulatory regime. In general, the answer is that there is a log. But this is one motivating factor for MAP-E and lightweight 4over6: entire port sets are allocated to clients, rather than just randomly allocating ports, so you just have to log who had what address and port set were allocated to who when, rather than logging every single translation.

Worst rant ever

[saveferrousoxide]

There's no words in all caps, no fantastical assertions, not a single typo, and it's 15 words long!! I'll give you some charity style points for using 100% improper punctuation, but really: 2/10. Hell, this rant about your rant was nearly 3x longer!! You should be ashamed.

X-Forwarded-For:

[tepples]

A far bigger problem is that a lot of internet services these days use IP-based blocks as the final "brute force" version of "you are abusing the service, go away". It would really suck to be under an ISP that shows every customer coming from a single IP.

That's what X-Forwarded-For: and agreements with ISPs are for. See, for example, Wikimedia's implementation of X-Forwarded-For:.

Re:X-Forwarded-For:

[Anonymous Coward]

That's an http header. What about the rest of the Internet- email, chat, gaming etc...

Re:X-Forwarded-For:

[tepples]

Email already uses a separate infrastructure for banning, namely that all mail servers with dynamic IP addresses are automatically banned. Gaming, as I understand it, uses e-mail addresses (on GFW Live, Xbox Live, and Steam) or friend codes (on Nintendo platforms) to control access.

Re:X-Forwarded-For:

[beezly]

X-Forwarded-For won't help with CG-NAT. Any XFF: address would be a fairly meaningless RFC6598 address, and that's assuming that the ISP is running a proxy as well as CG-NAT.

Re:X-Forwarded-For:

[WaffleMonster]

That's what X-Forwarded-For: and agreements with ISPs are for.

This does not scale and is not compatible with SSL.

Re:X-Forwarded-For:

[tepples]

SSL sites can ban users' accounts instead of banning IP addresses.

Re:X-Forwarded-For:

[Aqualung812]

Who said SSL = user accounts?

I can use https on Google and Wikipedia without logging on.

I hope, for their sake, that they are a small ISP

[mark-t]

Because otherwise, they will just end up running out of ports when they have a larger number of people simultaneously using their services.

Quite quickly too.

This plan is so colossally doomed to fail that I have no words for it.

Where can I buy the popcorn? This is gonna be funny as hell to watch.

failure?

[slashmydots]

Failure to properly plan and fund and implement IPv6 for your own company is not what I would call a failure of IPv6.

And again our weekly: IPv6 is great article

[someones]

Ang again the same arguments are brought, why ipv6 is *not* the solution to a problem that does *not* exist.

To invite someone who's not quite unsavory

[tepples]

NAT is the gated neighborhood you live in to keep the unsavory inhabitants of that bad neighborhood away from your pristine lawn and Lexus in the driveway.

So how should a resident invite someone who's not quite unsavory? For example, to use your example of Jehovah's Witnesses, I study the Bible weekly with one of them. If my neighborhood were to adopt a firewall with a "JWs keep out" policy, I'd be pretty disappointed.

Re:To invite someone who's not quite unsavory

[DarwinSurvivor]

The same can be done without the NAT just like your firewall does when connected to a public wifi hotspot. You do use a firewall when connected to a public wifi hotspot don't you?

Three birds with one stone

[tepples]

That's what firewalls are for, not NAT. Please stop confusing the two.

But they're not entirely orthogonal, as NAT imposes a firewall by default. It takes down three birds with one stone, namely delaying the effects of IPv4 depletion until an IPv6 rollout can be afforded, firewalling out those assumed to be unsavory, and upselling business class connections to home-based businesses. How would NAT be implemented without a firewall?

Re:Three birds with one stone

[drinkypoo]

How would NAT be implemented without a firewall?

We should probably stop using the term "firewall" for anything that is not a filtering appliance. It means less and less all the time. We know what IP filters are, let's call them that. Anything with ACLs is a firewall, most firewalls are also lots of other things these days, minimally including VPN appliances...

NAT thus requires a router, with NAT capabilities. You don't have to actually do any deliberate filtering. And yet, as you say, you do gain some of the benefits of firewalls for those clients on the NAT segment.

Re:Three birds with one stone

[mellon]

This is actually not true. Most NATs can be penetrated from the outside; they have to be able to be penetrated, or things like Skype don't work. Pretty much any UDP-based protocol requires that the NAT open holes. So the notion that NAT == Firewall is utterly incorrect, and in fact the feeling of security that you apparently have based on this misconception is likely to cause you harm in the future.

Re:Three birds with one stone

[mark-t]

How do you propose to arrange to penetrate a NAT that you don't administrate? Do you think that an ISP I implementing CGN will just let you punch yur own holes in it for your own applications?

Re:Three birds with one stone

[mellon]

If it doesn't, the customer will be pretty pissed off, because a lot of services they're accustomed to using (e.g., Skype) will start failing.

Re:Three birds with one stone

[multi io]

But they're not entirely orthogonal, as NAT imposes a firewall by default

No it doesn't. NAT-PT just tracks TCP connections initiated from the "inside" network, rewrites the local IP and maps them to ports on the NAT machine. The outside network can still send packets to ping or open connections to any inside machine, unless you consciously throw away any packets coming from the "outside" network and not belonging to an existing connections, using e.g. some equivalent of iptables -P FORWARD REJECT. Otherwise, the only thing thay may protect you is the fact that your ISP may not route packets with destination addresses in 10.0.0.0/8 / 196.168.0.0/16 to you.

Re:Three birds with one stone

[mark-t]

That's the inherent problem with NAT... and CGN in particular. Unless you punch holes in a NAT, the Internet breaks for any end-to-end communication. You can only punch holes in a NAT when you administrate the NAT.

But this is Carrier-Grade NAT.... ie, the NAT is not at the consumer level, but at the ISP level. Can you imagine the nightmarish logistics of having all of the ISP's customers be able to individually punch holes in it for their own applications on a NAT that they don't even actually own?

Re:Three birds with one stone

[gbjbaanb]

How would NAT be implemented without a firewall?

when you enable the "DMZ" option in the NAT configuration. Turn that on, and still think NAT = firewalled? Of course not. Well, you and I don't think that, but everyone who doesn't know the difference between a firewall and NAT will. And they're the ones we need to look out for.

Now if routers came "with a free, advanced firewall enabled by default", people would think twice before "turning the firewall off" when they'll switch DMZ on without hesitation.

Re:Three birds with one stone

[TheRaven64]

The search term you are looking for is 'port rebinding attack'. This is a vulnerability that only NAT'd networks are vulnerable to. A firewall without NAT doesn't introduce this problem.

Re:Three birds with one stone

[tragedy]

You know what else imposes a firewall by default: not having an Internet connection in the first place. Or, how about not hooking up any computers to the network connection. And hey, if you have any screws to loosen or tighten: butterknife! Nails to pound in? How about a nice shoe heel?

Re:Three birds with one stone

[mellon]

No, again what you just said represents a fundamental misunderstanding of how NAT traversal works. Generally speaking, NATs _automatically_ open holes for incoming packets based on the behavior of the host inside the NAT. There's no reason to think a CGN couldn't do this. Any NAT-traversal mechanism that requires administrator action is essentially not going to happen, for the majority of internet users.

Of course, if you happen to be one of those savvy Internet users who actually sets up holes in your NAT on your CPE device, you're going to hate CGN, but you're very much in the minority.

Re:Three birds with one stone

[pacman on prozac]

But Skype is running on the internal network, of course it can punch holes in the NAT device. The concern is for unsolicited access from the outside which will not make it through NAT.

How exactly do you think Skype will work through a stateful firewall? It'll result in exactly the same techniques being used, the client will send an outbound "dummy" packet to allow the relevant incoming UDP traffic when the router things it's part of the same connection. Sure there will be 1/10000 customers who can go onto their firewall and open the incoming port, most people will not so these hacks will be around for a long time to come.

Re:Three birds with one stone

[mark-t]

The NAT can't open a hole for an incoming packet to a device unless that device has actually sent OUT a packet first, so that the NAT knows about it. Otherwise, the NAT wouldn't have any idea which device to forward any incoming packet to, and would probably simply drop it. Opening a socket on a machine to listen for incoming connections does not actually send anything to anyone, so the NAT wouldn't even have any way to know about it, and everyone else wouldn't know which port to try to use to talk to the computer even if it did

So.... how would a remote system know which port it is supposed to try to connect to through a NAT? What if just two people behind the same NAT are trying to run the same sort of program, and are both trying to accept a connection from outside?

NAT breaks the peer-to-peer communication paradigm that the Internet was built on, and at carrier grade level, this will spell no end of problems for anyone who does anything more sophisticated with their internet connection than using http, or collecting email.

Re:Three birds with one stone

[tepples]

when you enable the "DMZ" option in the NAT configuration. Turn that on, and still think NAT = firewalled? Of course not.

You're assuming that a household has only one device that connects to the Internet. To all machines other than the one machine selected to be the DMZ machine, it is a firewall.

Re:Three birds with one stone

[mellon]

Attackers using botnets can afford to just spam every port and see what comes back. They don't have to wait for some host to open a hole in the NAT, because hosts are always opening holes in NATs, so if you do port scanning, you find holes. It doesn't mean that every time you open a hole in your NAT, the internet will jump through the hole. It just means that if you are in the habit of opening holes in your NAT (and you are), you will get attacked, and hence the claim that the NAT is a firewall is incorrect.

You're preaching to the converted on the end-to-end bit. I think CGN is a terrible idea, and the fact that it breaks end-to-end is one reason. But by no means the primary reason.

Re:Three birds with one stone

[makomk]

NAT holepunching only works on NATs that map all UDP traffic coming from the same IP and port within the NAT to have the same source IP and port outside of the NAT, no matter what their destination (so-called full cone or restricted cone NAT). Without this property there's no way for the other system to know what port incoming packets will be coming from, and therefore no way for it to punch the appropriate hole in its own NAT to let them in. NAT on home routers almost always has this property but carrier-grade NAT generally doesn't because there just aren't enough ports available to make it work. So NAT holepunching solutions don't actually work on carrier-grade NAT.

Re:Three birds with one stone

[mark-t]

I never claimed NAT was a firewall... I just said that if you can't administer your NAT, then it's perfectly useless for running programs which might have to listen for incoming connections. The only remotely justifiable reason that even exists to use NAT at all is if you are allocated fewer globally visible IP's than you have systems that need to connect to the outside world. The only reason you would punch a hole in a NAT is if you needed a machine or service running inside the NAT to be somehow visible outside of it.

Re:Three birds with one stone

[mellon]

Again, you are not understanding how NATs operate. Every time you enable skype on a computer inside your NAT, you are punching holes in the NAT. Every time you establish a TCP connection through a NAT, you punch a hole in the NAT. Every time you send a UDP packet out through the NAT, you've punched a hole in the NAT.

If this were not so, you literally could not access the Internet from inside a NAT.

Re:Three birds with one stone

[jrumney]

Generally speaking, NATs _automatically_ open holes for incoming packets based on the behavior of the host inside the NAT.

Generally speaking, the protocols used to _automatically_ open holes in the NAT assume that the router doing the NAT is the local router. There is no protocol in widespread use that can request a port to be opened for forwarding incoming UDP packets from a router two or more hops away.

Re:Three birds with one stone

[gbjbaanb]

I'm not, I assume that once the DMZ is opened up and the internet is allowed access to that 1 device with no firewall protection, all the other devices will quickly be in as corrupted as that 1 device.

Re:Three birds with one stone

[mark-t]

Note, however, that to automatically punch any hole through a NAT always requires that you *SEND* a packet from your computer first. Listening for incoming connections does not, by itself, actually send anything. To anyone. Although some communication protocols are set up such that you must broadcast your intent to listen for an incoming connection before actually listening, such protocols are invariably application specific, and have very little to do with the way the Internet really works.

For TCP, you "punch a hole" in the NAT whenever you initiate an outgoing TCP connection (TCP sessions are bidirectional, so data can come in on the same connection after it's been intiated), but only the system with which the connection was initiated can send data through that hole, and as soon as you close that session, the hole is closed with it.

Skype uses a process called UDP hole punching to accept connections from outside a NAT, and this only works because both the caller and receiver have each established a connection with the Skype server first so that the caller can get the necessary information about the intended receiver. You cannot use TCP to accept incoming connections with Skype if you are behind a NAT.

In fact, there is no way at all to initiate a TCP session with a computer that is behind a NAT from outside of it without either a) manually punching a permanent hole in the NAT first, through which to accept incoming connections (you cannot use automatic hole punching for this), or b) hijacking another TCP connection to that machine through IP spoofing.

Re:Three birds with one stone

[mellon]

Again, this is true but does not mean that there is no way to get in through the nat. A port scanner will find the ports Skype opened for you.

Re:Three birds with one stone

[mark-t]

Okay, but UDP hole punching on a single NAT by more than a few people at a time would quickly saturate theNAT to the point that nobody using it would be able to establish conections with anybody. It's not a problem for a home user because the number of computer systems behind the home NAT is so small..

The core problem with NAT is that it cannot possibly ever scale to anything beyond a very tiny LAN, and why CGN is doomed to catastrophic failure.

Carrier Grade NAT....

[Lumpy]

Its that like Military grade NAT and Combat ready NAT?

The NAT I use is the SAME NAT that they use. There is no such thing as "Carrier Grade" NAT.

Re:Carrier Grade NAT....

[Lumpy]

No it doesnt. My NAT comes from a out of date Cisco Router I got off ebay. but my NAT is no different than a Linksys NET or a linux NAT NAT is NAT there is nothing special about any NAT as NAT is the same from a home router to NAT done by the newest IBM supercomputer.

Re:Carrier Grade NAT....

[klapaucjusz]

Its that like Military grade NAT and Combat ready NAT?

Yes, it should have been called ISP-side NAT (as opposed to the more usual customer-side NAT), but the marketing people thought otherwise.

--jch

Re:Carrier Grade NAT....

[MajroMax]

Carrier Grade NAT refers to an implementation of NAT444. What distinguishes this implementation is that the customer is given an IP address (or several) from within a private or shared range managed by the ISP, which is itself address-translated to a small pool of public addresses.

Hence, a customer's home network (IPv4) is translated to a provider's private network (IPv4) and again to the public Internet at large (on IPv4): NAT444.

Algorithmically it's the same network address translation you do at home, but if you were to stack two NAT-routers on top of each other to build a double-NAT at home you'd be a damn fool. When the provider does it, it gets a fancy name.

Re:Carrier Grade NAT....

[marka63]

The difference is that you control the configuration of the NAT in the home. You DO NOT control the configuration of the NAT that the ISP runs. If you have never changed the defaults and do not have applications that depend on UPnP then you are unlikely to see issues with CGN.

If on the other hand you configure port forwarding or or have applications that depend on UPnP then it is likely you will see reduced functionality with a CGN in the path.

Re:Same-screen or LAN multiplayer

[Anonymous Coward]

You're missing the point. Internet multiplayer games are quite popular these days.

Re:I hope, for their sake, that they are a small I

[the eric conspiracy]

I can think of some words.

Should be noted

[Pop69]

PlusNet is a subsidiary of BT, the ex state telecom monopoly. BT also operate the vast majority of ADSL infrastructure in the UK. BT Openworld, their other broadband brand name claim to be the largest UK ISP by number of subscribers.

Where BT test on PlusNet then likely everything else BT will follow

This will screw up VPNs - probably

[flappinbooger]

In my area the 4G Verizon WWAN devices are doing this. It screws with VPNs big time. It connects you to verizon on an internal IP and then verizon NATs you the web content through their system.

The WWAN dongles can connect to the 3G service and then you're fine, that still works the "old fashioned" way.

This is fine for Bubba lookin at boats on craigslist or grandma getting emailed pics of little Johnny, but if you are in that 1% of non-typical use, whoops.

Connections per public IP address

[tepples]

Pretty much any UDP-based protocol requires that the NAT open holes.

So does any TCP-based protocol, but as far as I can tell unless a port is forwarded, the router doesn't know where to forward incoming connections. So a NAT acts as a firewall against TCP-based protocols. UDP-based protocols, as I understand it, begin with a TCP connection to a trusted introducer, followed by having each side of the connection send a datagram on an ephemeral port to the other end so that the NAT knows how to route that particular port. This is limited to a few thousand connections per public IP address because there are only 16,000 or so ephemeral ports.

Re:Connections per public IP address

[mellon]

There's no such thing as an ephemeral port. Do you mean a "reserved port"?

It's true that penetration of the NAT requires cooperation of the host on the other side, but getting that cooperation is not hard. A bit of javascript will do it, as will a virus or trojan horse. You can also just scan ports on the assumption that some client is running something that's already punched a hole; chances are you will get through.

The bottom line is that depending on your CPE NAT for security is a really bad idea.

Re:Connections per public IP address

[mellon]

The lack of any cited RFCs in the Wikipedia article, and the profusion of cited Microsoft Technet articles, should tell you what you need to know about the prevalence of this bit of terminology.

Re:Connections per public IP address

[tepples]

The lack of any cited RFCs in the Wikipedia article

It cites an IANA document. Aren't those at least as authoritative as the IETF's RFCs?

Re:Connections per public IP address

[mellon]

No. However, in fact the IANA document references RFC6335, which talks about Private Ports, and mentions that they are also sometimes known as Ephemeral ports. And RFC6056 uses the term "ephemeral" preferentially. So you win this one, tepples. :)

But don't get too smug before you read section 3.2 of RFC6056. It was my understanding of current practice as codified by RFC6056 that led me to claim that there was no such thing as ephemeral ports.

However, I do apologize for not doing my reading before contradicting you—my response was incorrect.

Re:IP v6 was not well thought out.

[mellon]

snrk Have you seen how many transition technologies have been proposed at IETF? We originally assumed everyone would deploy dual stack and wait for IPv4 traffic to tail off, but that assumed deployment ten years ago, which didn't happen. Then we started looking at CGN about five or so years ago; the problem is that CGN depends on there being lots of IP addresses, and since then we've come up with better solutions that do a smarter job of distributing the state required to do nat. This is what MAP-E and lightweight 4over6 are. MAP-E and lightweight 4over6 are getting serious consideration by ISPs.

I don't disagree that there were a lot of egos involved in early IPv6 development, but we actually do have a solid transition suite, and people are deploying it. CGN is five-year-old technology that never saw widespread deployment, and probably never will.

Re:IP v6 was not well thought out.

[Viol8]

Seconded.

"A simple extension to v4 to expand the address space should have been adopted"

Indeed. All they needed was another 2 bytes to be used as address space in the IP4 packet - perhaps in the options or padding section - since 65K times the current address space is more than enough (and don't anyone quote me Bill gates 640K remark as a lame repost) and to update the IP version number in the packet. Sorted.

Graham's hierarchy

[tepples]

Even more stupid on Graham's hierarchy is name-calling, which calls one's arguments "downright stupid" while giving no evidence of why they're "downright stupid".

Re:Graham's hierarchy

[realityimpaired]

That list is incomplete. We need to know what is lower than namecalling so that we know how to reply to this post. ;)

Re:Graham's hierarchy

[wagnerrp]

Someone tell realityimpaired that he is an ass hat, as he is so wrong, I refuse to speak to him.

A combination would be ok

[spectrokid]

If they delivered full IPV6 with a CNAT as fallback, I might understand. All the big boys are on IPV6 nowadays anyway. But only CNAT? That, my friend, is connectivity they can shove where the sun don't shine...

Re:IP Geolocation

[mellon]

It's unlikely that they will deploy CGN, because the trial will probably fail. But if they do, they will still almost certainly do routing aggregation, so the IP address you get will likely be associated with the BRAS or concentrator closest to you. They won't be able to get pinpoint accuracy, but they will probably know what city you are in, if you are in a city.

Re:IPV6 is a classic engineering failure

[mellon]

If anything there are too many transition technologies, not too few.

Re:IP v6 was not well thought out.

[Dagger2]

3. Back to point one again, it seems like someone's ego prevented any kind of transition plan or backward compatibility. The all-or-nothing attitude has prevented rollout that should have happened a decade ago

It's called dual stack. v6 deployment is not all-or-nothing. For instance, OS upgrades have been rolled out over the past decade, and content provider and ISP upgrades are being rolled out now. Take a look at Comcast, who are doing v6 despite less than 100% of their traffic being done over v6.

Re:The failure of IPv6 was predicted years ago

[Dagger2]

I'm an early adopter of IPv6. I don't believe your claim that it offers me nothing, because it's been making my life easier for years now.

Re:Same-screen or LAN multiplayer

[tepples]

Internet multiplayer games are quite popular these days.

MMO and social games are server-based and, as far as I'm aware, work fine through NAT. People living in an IPv4-starved market who want to play FPS and RTS that don't use a dedicated server would probably be encouraged to upgrade to business-or-enthusiast class Internet access.

How does one forward 3074 TCP for Black Ops2

[wabbadot]

Anyone with a 100.64.0.0/10 WAN address is being CGNATted by their ISP. http://whois.domaintools.com/100.64.0.0 How does one do port forwarding when CGNATted? e.g. Black Ops 2 needs TCP 3074 opened. Can anyone who is CGNATted confirm if they can port forward to one of their internal devices? I believe HugesNet uses CGNAT too.

Maybe a good way..?

[ACluk90]

I think this might be a intermediate step to change to IPv6. Nobody takes action until they suffer. Sharing one IPv4 address will make them suffer.
Give them the option for an IPv6 address and a shared IPv4 address to maintain backward compatibility.

not quite true

[Chirs]

Theoretically a "carrier grade NAT" could (due to the large scale) have the resources (both computational and developer time) to be capable of packet inspection to figure out what ports need to be dynamically mapped for more types of traffic than are supported in a cheaper implementation.

Re:not quite true

[Lumpy]

NAT does not do packet inspection of any type. If your "NAT" is doing that then it is not NAT but instead Dynamic routing based on packet content. NAT has never ever had any packet inspection in it's specification.

Re:not quite true

[klapaucjusz]

NAT has never ever had any packet inspection in it's specification.

The closest thing to a NAT specification is RFC 2663, an informational RFC that was published a good four years after NAT got deployed. It explicitly speaks about deep packet inspection:

One of the most popular internet applications "FTP" would not work with the definition of NAT as described. The following sub-section is devoted to describing how FTP is supported on NAT devices. FTP ALG is an integral part of most NAT implementations. Some vendors may choose to include additional ALGs to custom support other applications on the NAT device.

(ALG means "Application Layer Gateway".)

Re:hope it doesn't become standard practice

[jones_supa]

Heh. I was also thinking that carrier-grade NAT would cut out a big chunk of piracy traffic. BitTorrent performs poorly if you can't accept incoming connections, and not at all if the other peer can't either. Serving a homebound FTP warez site would also be out of question.

Coming to USA too

[Anonymous Coward]

Posting as AC for obvious reasons. I'm working for an ISP and we testing Juniper MX routers for CGNAT. It will be deployed for "legacy" DSL customers. These routers can handle a lot of traffic, and we found that the wast majority of applications have no issues with another layer of NAT. There is a plan to offer a web interface to allow a customer to punch a hole when necessary.

You control your NAT device's port forwarding

[tepples]

I've played a multi-player game, and it worked just fine through MY NAT device, so why wouldn't it work through the ISPs

Because you control the port forwarding on your own NAT device, not your ISP's. Or because your machine is never selected to be the server, limiting the selection of opponents. Or because your game is in a genre that traditionally uses a dedicated server operated by the game's publisher as opposed to using the publisher's servers only for matchmaking, such as MMO or a browser-based game.

Concatenate public+6598 address

[tepples]

Any XFF: address would be a fairly meaningless RFC6598 address

Say the connection comes from 123.45.67.89, and the proxy specifies "XFF: 100.64.123.45", and the operator of the proxy has an agreement with the operator of the web site. Then instead of blocking the whole proxy, the web site would block "123.45.67.89.100.64.123.45". Yes, HTTPS would make this harder, as HTTPS proxies tend to get people up in arms because of the level of trust the user is required to have in the proxy.

Re:Concatenate public+6598 address

[beezly]

That's still proxying and not NAT. I would be stunned if ISPs started routinely proxying all HTTP traffic (and they don't stand a chance with HTTPS). The amount of processing resource required would be unfeasibly large.

Big Dumb Pipe

[ThatsNotPudding]

There should be a Kickstarter campaign to create an ISP that is actually named Big Dumb Pipe with promises not to up sell, or offer 'cloud storage', or offer security suites to protect your snowflakes, or pretend to be a content creator, but merely provide access and up time, for they are only a Big Dumb Pipe (tm). Oh; and no caps or throttling.

Re:IP v6 was not well thought out.

[WaffleMonster]

1.During it's design, way too much effort was put in to solving problems that were not important. Many design decisions seem to satisfy only academic concerns and the egos of those who hold said concerns.

Care to be specific what are your talking about?

When I look at the IPv6 header and compare it to the IPv4 header I see address fields are a lot bigger and garbage from the IPv4 header is now gone. Thats it. TCP and UDP protocols below are exactly the same.

The next header scheme is the same one deployed in dumb layer 2 networks for vlan tagging... I don't see anyone complaining about that either.. Some L2 people have even gone nuts chaining with QinQ et al.

There are new things that did not have to change but these are management not wire issues. Their mostly ethernet/multicast nobody except the very few who write network stacks for operating systems and security schemes for L2 switches have to pay much attention to.

The efforts I see going on around me are centered in dealing with the reality of a larger address space and numbering networks.

Furthermore, due to the simple march of progress (Faster, cheaper computers. More bandwith. Better hardware), many of the above concerns are now moot. Many of IPv6's built in mechanisms will not be implemented today but replaced by "six-afied" versions of their ipv4 counterparts.

What are you talking about? Many of what?

Back to point one again, it seems like someone's ego prevented any kind of transition plan or backward compatibility. The all-or-nothing attitude has prevented rollout that should have happened a decade ago. Even inevitable address space exhaustion has not proven incentive enough

Suggest something better than native dualstack without breaking anyones shit.

Sorry to say, but v6 should have been scrapped a long time ago. A simple extension to v4 to expand the address space should have been adopted (Perhaps with some extensions/modifications to help alleviate some of the other issues. Goodness knows TCP could use some tweaks)

Thats exactly what IPv6 is on the wire:
http://en.wikipedia.org/wiki/IPv6_packet

Compare that to IPv4 on the wire:
http://en.wikipedia.org/wiki/IPv4_packet

I'm surprised it has not happened already. Usually someone pragmatic comes up with a brilliant, but hackish compromise that everyone informally adopts by sheer necessity.. Then becomes formalized after the fact when standards bodies realize everyone's using it anyway.

The format or feature set of IPv6 have never been much of an issue.

The real problem that lots and lots of us must do make our toys IPv6 compatible is to make provisions for a larger address space.

For example my game does not work with IPv6 not because of the format of a packet...the game does not generate packets it uses the OS network layer to do that for it. It does not care about the format of an IP packet except for trivialities such as MSS.

The reason my game is not IPv6 compatible is because it is not capable of addressing a larger address space without the source code being modified. Aint none of this got shit to do with a packet format on the wire.

The inevitable part...

[tlambert]

why in the world is it inevitable? Inevitable because they want to keep holding off on newer technology? If I was with Plusnet I'd use this as a good reason to start looking elsewhere.

PlusNet meant that it was inevitable that "it could make some Internet services fail".

But you knew that already, since you were using PlusNet.

Re:The inevitable part...

[Nossie]

nope, you are wrong I said '*if* I was a plusnet customer ...'

However, it does appear that you are right in that either the quote was taken out of context or I misinterpreted it....

Actually, no tlambert, .I take that back

"The move is controversial as it could make some Internet services fail, but PlusNet says it is inevitable, and only a test at this stage."

Where does plusnet say it's inevitable some services would fail during the test? They don't!

FTA:
"ISPs will have to operate a “dual stack” approach, supporting both protocols, but this is made difficult by the shortage of IPv4 addresses, so some sort of sharing is inevitable, PlusNet argued."

Re:The inevitable part...

[tlambert]

"The move is controversial as it could make some Internet services fail, but PlusNet says it is inevitable, and only a test at this stage."

Where does plusnet say it's inevitable some services would fail during the test? They don't!

They were unclear as to whether "it is inevitable" referred to the direct or indirect subject, and so it was ambiguous as to whether they were referring to "the move is inevitable" or "[use of PlusNet] could make some Internet services fail".

However, my statement works without the ambiguity being interpreted unfavorably...

Given that the consequence of the inevitability applied to the first automatically makes it apply to the second, it looks like they are saying that they will be inevitably making the services fail, whether or not it's a consequence of the move, it is therefore a consequence of the [meta] "use of PlusNet".

Ergo, if you use PlusNet, your services could fail.

So: Thanks for the warning, PlusNet!

Re:The inevitable part...

[Nossie]

I believe this line from the article pretty much spells it out "so some sort of sharing is inevitable" So they themselves specify that NAT on the network is inevitable. Personally I think it's just an excuse to take another standard service and re-brand it to a premium service.

Either way - bad news!

Speaking of IPv6 and firewalls, how infested is it

[Marrow]

Whats the worm traffic (ssh and other) on the IPv6 internet? The weird IPv6 people want us to just hop on IPv6 by tunneling under our old IPv4 firewall/routers. So how much parasitism and hacking is on the new network? And can we expect a wave of new attacks/exploits to happen to people who turn on IPv6 and blindly bypass the only protection they have?

 

Opportunity for Microsoft to be the good guy?

[tlambert]

IPv6 goes global with the first Microsoft OS release where IPv4 requires installing an extra package which OEMs are not permitted to install by default.

This is a great chance for them to play the white hat, but it'd be a significant departure from historical behavior for them (e.g. they fought TCP/IP tooth and nail, thinking that NetBIOS and NetBEUI had a chance in hell of winning), and it took them a very long time to support IPv6 at all in the first place.

Only buying time.

[Midnight Thunder]

If ISPs are turning to carrier grade NAT, then they are in a desperate situation. The current approach will only buy time for an ISP who has run out or will soon run out of IPv4 addresses, but they should still have a parallel IPv6 strategy in place. Without support for IPv6, customers won't be able to access new services which are only IPv6 accessible, and as hosting services can't get acces to new IPv4 blocks this will be the case.

As IT professionals we should all be asking our ISPs, and even our employers, when they plan to be IPv6 ready. This is similar to the Y2K issue, except the cut off date is a little bit more fuzzy. If the work is done, then your average user shouldn't notice anything. If it isn't then they are going to be complaining of connectivity problems.

Why not, Comcast's been doing this for years

[Vrtigo1]

Ok, it's not CG-NAT, but if you get commercial service from Comcast, they give you a POS cable router that has NAT turned on. That's OK, but the problem is that the ONLY way to turn NAT off is to purchase a static IP. You can't put it in bridge mode and use your own router unless you have a static IP (for an extra charge, of course).

As far as I'm concerned, their policy of forcing NAT upon me means they are not delivering the full Internet experience, as many applications either do not work or do not work as well through NAT. I argued with them for about 10 minutes, but arguing with some phone monkey who has no idea how the Internet works (or is supposed to work) is futile, and I wasn't about to give them any more money, so I just lived with it.

Re:Why not, Comcast's been doing this for years

[Ingenium13]

You can call them and say you have your own router and that you want a regular pass through modem like the kind given to residential service. Say you have your own router that you NEED to use and that the integrated modem/router they gave you is messing it up since you can't disable NAT. They will come back and replace it with a normal modem, and they didn't charge me for the site visit. If the phone rep doesn't understand why, just say that you need to swap out the router/modem for a consumer model (they gave me an Ubee that supports IPv6) because they one they gave you doesn't work with the new networking hardware you just bought. I had to do this when I first got Comcast business service, and just explain you want a residental modem that isn't a router and they'll give you it.

Re:Why not, Comcast's been doing this for years

[EmagGeek]

I've had commercial service from Comcast for years and I've never been NATed.

Re:Why not, Comcast's been doing this for years

[Vrtigo1]

Actually, you're right. I think the issue was that the tech installing it was a business tech so he didn't have any residential modems on his truck and they would charge to do another truck roll to replace it. The only way to get it for free was to go pick it up at the local comcast office. Unfortunately I was in town from another area just for that day to install computers and stuff at an office we were setting up so it wasn't feasible for me to do that. So, it's more appropriate to say that Comcast will let you turn off NAT as long as you're okay wasting some of your time to go pick up another modem.

Re:Why not, Comcast's been doing this for years

[Vrtigo1]

I've had commercial service from Comcast for years

Maybe that's why. We just got this service installed about a year ago. Do you have a static IP?

So how do you secure a home IPv6 network...

[ravenlord_hun]

...without a firewall on your router? Seriously, unless you invest deeply, 90% of the consumer grade devices can't do that - my router supports IPv6 in theory (no carrier support yet to test it) but only has a 400mhz CPU. Trying to implement any stateful firewall on that will just make the system unstable if you make some more intensive use of the connection (streaming HD TV, torrent, etc). No "smart" device I have in my home supports firewalls apart from my PC, so they can not be trusted to just cope on their own.

I'm probably missing something I guess, but it just doesn't seem like a genious prospect to me.

Re:So how do you secure a home IPv6 network...

[WaffleMonster]

without a firewall on your router? Seriously, unless you invest deeply, 90% of the consumer grade devices can't do that - my router supports IPv6 in theory

Poking around a few of the standard vendors web sites a few weeks ago they all have SPI/policy settings in their IPv6 enabled CPE/router offerings.

Re:So how do you secure a home IPv6 network...

[raxx7]

Your router already implements stateful IPv4 NAT. Implementing a comparable (or better) IPv6 stateful firewall will put a similar or even smaller load on it's CPU.

Also, you might not need a stateful IPv6 firewall.
The premise is that the minimum IPv6 network your ISPs should assign you is a /64, which has 2^64 possible addresses, which is too large to be scanned.
By using an appropriate address assignment scheme (stateless autoconfig or random DHCPv6), it would be impossible for a potential external attacker to find your devices' addresses via a network scan.
So, unless your device exposes it's address on the Internet in some way it's safe and this should be enough for things like printers, TVs, etc.
Devices like your PC, tablet or smartphone are more likely to expose their IP address (ie, via participating in a BitTorrent swarm) but those need to be able to cope with being on a hostile network anyway. Ie, consider when you use your tablet in a hotel's WiFi.

Then again, this may be just wishful thinking and we'll need IPv6 stateful firewalls!

Re:So how do you secure a home IPv6 network...

[bbn]

NAT is harder than firewalling. Both requires the same connection tracking. But only NAT requires rewritting the packets. If your router is handling NAT it will do IPv6 firewalling as well.

Re:So how do you secure a home IPv6 network...

[bbn]

I should also mention there is a RFC that requires customer routers to support IPv6 firewalling and to have it enabled by default: http://tools.ietf.org/html/rfc6204

Re:So how do you secure a home IPv6 network...

[ravenlord_hun]

It's not doing stateful NAT, it's completely stateless - it's a static port forwarding to preset LAN IPs or outright dropping the packet, UPNP is disabled. AFAIK this is anything but stateful. When I try enabling the stateful features in iptables (--state SOMETHING), it quickly slows down the box and makes it unresponsive during heavy use. Maybe there's a bug in the kernel I use, but I'd bet it's closer related to 16MB RAM and 400Mhz CPU. :)

I don't see how a larger address space helps. First of all, devices generate IPv6 by using the MAC - if someone is looking for an exploit for a specific device (like, knowing there's a bug in the LExxW650 brand of samsung TVs, let's say) they can narrow down the possible IPs by knowing what brand of cards the device uses. Also, as IPv6 (supposedly) never changes, anyone can take their sweet time to scan piece by piece (subset by subset), as that data will never lose relevance...

I'd say having a stateful firewall will be a must. It's not good to rely in security through obscurity. Or maybe I'm just paranoid. :)

Re:So how do you secure a home IPv6 network...

[ravenlord_hun]

NAT is harder than firewalling? How so? A stateless NAT should be lot easier on the machine than a firewall (which I could compare to stateful NAT, dropping packets based on some criteria and being able to track established connections), or do I get it completely wrong?

And thanks for the link, interesting doc. My router is a WL500g Premium v1, a pretty old model that's working quite admirably so far, but it can't do firewalling. Seems I'll have to just throw it out.

Re:So how do you secure a home IPv6 network...

[bbn]

A stateless NAT should be lot easier on the machine than a firewall

Assuming that by NAT we mean the port address translation variety implemented by home gateways, there is no such thing as stateless NAT. For each inbound packet received from the ISP, the NAT device needs to know which of your internal machines is the intended recipient. It does so by looking up a relation in a table (external host IP, external host port, gateway port) -> (internal host IP, internal host port). This table is updated on outbound packets. If a relation is missing on inbound packets the gateway has no way of knowing where to send the packet and so has to drop it. It is from that property that a NAT device can act as a primitive stateful firewall.

Now some (=most home gateways) NAT devices cheat a little on that mapping (full cone NAT). Instead of recording the full relation as above, they record a reduced set of information. This makes them less secure, because a third party might be able to pass packets. Many NAT traversal techniques depends on the NAT device to "cheat" like this.

Notice that even the cheating devices are not stateless. Also note that a firewall could do the same tricks. It would become less secure in exact the same way as the NAT.

I am not sure why they bother cheating though. It does not really save any CPU power. The algorithm is only slightly less complex. They do save a little bit of memory as the tables will be smaller.

The real way to open a port is to use the UPnP Internet Gateway Device Protocol http://en.wikipedia.org/wiki/Internet_Gateway_Device_Protocol that allows software to request that a port be opened up. Most peer to peer software supports this.

Re:So how do you secure a home IPv6 network...

[ravenlord_hun]

Ahh, I see. Thank you for elaborating on that a little, wasn't really aware of this. Makes me wonder why my box cannot handle the --state option with iptables then...

About UPNP: I utterly dislike it and keep it disabled. I prefer knowing if an app wants a port open and then I make a static iptable entry for it myself; otherwise, if some fancy malware asks nicely, my router would happily give them any port they ask for.

Re:So how do you secure a home IPv6 network...

[raxx7]

You've got some weird setup there. It has to be doing some state tracking to do NAT or else your outgoing connections won't work. Unless you've set a specific high/low port range in each computer..

Anyway.. whatever rules you have there for IPv4, you can set them for IPv6 as well and it will be less work for your CPU.

Regarding the address space: yes, there are probably many possible avenues.
Never quite stopped to think much about them, I just firewall my IPv6 networks.

Re:IP v6 was not well thought out.

[MajroMax]

... in what fantasy world would this have worked? Upgrading the IP version number by itself is an incompatible change, and any address-space extension means that a stateless, 1:1 address mapping is impossible. Once a stateless mapping is impossible, we're right back to the current mess of transition, since new-IP hosts would not be able to talk to old-IP hosts without an intermediary.

Re:Speaking of IPv6 and firewalls, how infested is

[klapaucjusz]

Whats the worm traffic (ssh and other) on the IPv6 internet?

According to the network administrators I've spoken to (admittedly a biased sample), almost all the malware traffic they're seeing is over IPv4. They say they'll deal with IPv6 malware when it appears.

Three different levels of blocking

[tepples]

Who said SSL = user accounts?

Nobody, necessarily. It's just that the CPU and latency hit of SSL is more justifiable when information private to a particular user is being transmitted. And sometimes a web site operator finds the insight that an XFF proxy gives into which customer is actually causing a problem worthy of a block valuable. Perhaps either or both of these reasons is part of why Slashdot, for example, redirects all HTTPS accesses to HTTP except for logged-in paying subscribers.

I can use https on Google and Wikipedia without logging on.

There are bans, and then there are bans. Both sites you mention (Google Search and Wikipedia) are useful for reading even if a particular user or anonymous users behind a particular IP are blocked from editing. An IP address found to be the source of vandalism can be blocked first from editing anonymously, then from editing with any user account (if the problem is believed to arise from sock or meat puppetry), and finally (unlikely) from reading. If you're on HTTPS, and you're not logged in, and you're behind a Big Honkin' NAT, and the NAT's IP address shares an owner with a recognized XFF proxy, and the IP is blocked, then you might end up redirected to HTTP so that the site can read the XFF header sent by the proxy.

Re:Three different levels of blocking

[Aqualung812]

CPU & latency have not been an issue for years now.

Everything else you explained either compromises functionality or makes everything far more complex.

Simply deploying IPv6 solves all the issues. Instead, some would rather make an even bigger house of cards.

JW vs. APK

[tepples]

I didn't know firewalls can keep Jehovah's Witnesses out.

I don't know why you'd want to keep Jehovah's Witnesses out, but if you insist, you can use APK's old standby: a hosts file.

0.0.0.0 jw.org
0.0.0.0 www.jw.org
0.0.0.0 wol.jw.org

Re:Speaking of IPv6 and firewalls, how infested is

[bbn]

Whats the worm traffic (ssh and other) on the IPv6 internet? The weird IPv6 people want us to just hop on IPv6 by tunneling under our old IPv4 firewall/routers. So how much parasitism and hacking is on the new network? And can we expect a wave of new attacks/exploits to happen to people who turn on IPv6 and blindly bypass the only protection they have?

Unlike IPv4, it is not practical to probe the IPv6 network blindly. You need to know the IP address of your target exactly. There is no guessing it.

A worm on IPv4 can send a packet to a random IPv4 address and have a high chance of that packet actually reaching someone. There are only about 4 billion IPv4 addresses. Even a single computer can send to every single IPv4 address in a span of only a few hours. If there are thousands of infected computers sending random packets, they got the IPv4 network covered in mere moments.

Fast forward to the IPv6 world. The IPv6 has an address space of 128 bits. This is the same size as strong encryption keys. Sending to a random address has zero chances of actually reaching anyone.

IPv6 addresses can be split into the first 64 bits called the prefix and the other half of 64 bits called the host identifier. Lets say you somehow learned the prefix of some user. But even if you only have to guess 64 bits of host identifier, the chances that you are going to hit his computer is so extremely low that we can call it zero.

What if you already know his full address? You wont for long. Most operative systems today have privacy extensions enabled. This is a system that makes your computer change the host identifier part of your address on a regularly basis (at least once per day).

People will still have routers and those will provide firewall services on IPv6. You would not get past that, but even if you did, you would not be able to simply guess an address. You can only send packets to people that recently sent packets to you first. Or which otherwise advertised the address through DNS or through a peer to peer network such as Bittorrent.

Bottom line: Classic worms and cold scanning is history on IPv6.

How to go out of business

[vanyel]

When the entire ISP gets blacklisted for this or that reason, causing users to leave in droves, they'll see the error of their ways...

Re:I hope, for their sake, that they are a small I

[petermgreen]

Because otherwise, they will just end up running out of ports when they have a larger number of people simultaneously using their services.

You do know that NATs can have more than one IP on the WAN side right?

Yes there is a limit to the customer to IP ratio that can be achived but unless an ISP is growing very quickly ISP level NAT should give them enough breathing room for the forseeable future.

Re:I'd leave for a better provider

[petermgreen]

Note: for now this is only an opt-in trial.

Yes it's sad. RIPE have run out of IPv4 addreses while many internet resources are only availble on IPv4. So growing ISPs have no real choice but to deploy mechanisms that allow users to access those resources while using less than one IPv4 address per user. The only real question is which such mechasmism to deploy (each has it's pros and cons).

Redirect to HTTP to come in through the proxy

[tepples]

I would be stunned if ISPs started routinely proxying all HTTP traffic

AOL did.

(and they don't stand a chance with HTTPS)

Anonymous visitors coming from an ISP whose NAT IP is blocked but whose proxy is known to add reliable XFF headers would get redirected from HTTPS to HTTP so that they can view the site through the proxy.

Commodore 64, Nintendo 64, what else 64?

[tepples]

CPU & latency have not been an issue for years now.

HTTPS involves more round-trips than HTTP. True, SSL latency has been solved for wired Internet links (fiber, cable, DSL), but latency is still a problem with cell and sat links.

Everything else you explained either compromises functionality or makes everything far more complex.

Complexity is a stopgap until the Rest Of The World completes the IPv6 upgrade.

Simply deploying IPv6 solves all the issues.

The issues are exactly the same for an ISP that has installed carrier-grade NAT64 so that IPv6-only users can view web sites that don't yet have an AAAA.

Re:Commodore 64, Nintendo 64, what else 64?

[Aqualung812]

The issues are exactly the same for an ISP that has installed carrier-grade NAT64 so that IPv6-only users can view web sites that don't yet have an AAAA.

No, this is why you deploy dual-stack. Don't make a bunch of workarounds for IPv4 or IPv6.

My point is that instead of calling CG NAT a solution, they should deploy NAT alongside IPv6.

If the user has issues, inform them that if XYZ.com would simply upgrade to IPv6, their problems would go away.

If the DMZ device is a video game console

[tepples]

If the DMZ device is a video game console, as I've seen it to be in several household deployments, it would probably make the news if someone managed to exploit it for remote execution of homebrew.

Good to know! That makes me feel better

[Marrow]

Thanks!

Re:I hope, for their sake, that they are a small I

[mark-t]

You realize that each customer is often going to be using up multiple ports at one time, right? And owing to the inherent statefulness of each connection and resources that the NAT system will have to dedicate to maintaining that state, it imposes a rather severe upper limit on how many ports a single NAT device can actually utilize at once.