BT Begins Customer Tests of Carrier Grade NAT

judgecorp writes "BT Retail has started testing Carrier Grade NAT (CGNAT) with its customer. CGNAT is a controversial practice, in which IP addresses are shared between customers, limiting what customers can do on the open Internet. Although CGNAT goes against the Internet's original end-to-end principles, ISPs say they are forced to use it because IPv4 addresses are running out, and IPv6 is not widely implemented. BT's subsidiary PlusNet has already carried out CGNAT trials, and now BT is trying it on "Option 1" customers who pay for low Internet usage."

Comments

Priority Failure.

[Anonymous Coward]

If people had spent as much money on IP6 as they have on NAT, we'd be done by now.

Re:Priority Failure.

[Anonymous Coward]

Wrong. BT will charge you "extra" for a non-crippled internet line.

Re:Priority Failure.

[Anonymous Coward]

But then ISP's wouldn't have a new way to tier internet access and make you pay more for the same service or less.

Re:Priority Failure.

[Waffle Iron]

Businesses make money by charging people for scarce resources. IPV6 addresses are in no way scarce, so why would they invest any money in that?

With NAT, they can keep making money the way they always have with minimal additional investment, and they can make even more money by offering dedicated IPV4 addresses to people who pay extra for some kind of "platinum premium plus pro" plan.

Re:Priority Failure.

[Ja'Achan]

But IPV4 was never going to run out! There were so much new blocks to free up, nobody could've seen this coming!

Re:Priority Failure.

[poetmatt]

Businesses make money by charging people for scarce resources

uh, no. businesses make money by providing value which customers then pay for. that doesn't mean artificially scarce resources, which aren't truly scarce. This will however, break a ton of shit very quickly.

Re:Priority Failure.

[Anonymous Coward]

Anyone who didn't fail 3rd grade should be able to say: "4 billion IP addresses divided by 7 billion people... That's not going to work". Without using a calculator.

Re:Priority Failure.

[Noughmad]

that doesn't mean artificially scarce resources, which aren't truly scarce.

That's why those De Beers guys are so poor.

Re:Priority Failure.

[Anonymous Coward]

NAT is comparatively cheap to implement.

Re:Priority Failure.

[Anonymous Coward]

99.999 percent of people will never notice or care. They could make a free opt-out to satisfy the geeks and few would ever even ask for it.

Re:Priority Failure.

[Waffle Iron]

uh, no. businesses make money by providing value which customers then pay for

And what is of value?

Things that are scarce.

Re:Priority Failure.

[Gaygirlie]

uh, no. businesses make money by providing value which customers then pay for.

You just explained yourself the whole point with artificially-limited resources: you make the resources scarce, you end up with value, then you sell that.

Re:Priority Failure.

[Anonymous Coward]

People have been crying wolf for 20 years (I was told in grad school that we were going to run out of IP4 addresses in 2 years. That was in 1993.). Now the wolf is here, and nobody believes them.

Re:Priority Failure.

[ameen.ross]

They could make IPv6 addresses as artificially scarce as they wanted, too.

Re:Priority Failure.

[petermgreen]

Yeah, it's sad but it was also inevitable in a world of companies driven more by selfish buisness interests than a desire to improve the system as a whole.

The thing is NAT delivers it's benefits immediately. You deploy the NAT box and then you can connect more computers than you have IPv4 address for. Simple. Yes some applications will break, that is why if you are a provider selling service you deploy it on your lowest tier customers who are least likely to be using such applications and represent the smallest loss of revenue if they decide to quit over the issue. If you are a company serving internal users you work out who does and doen't need to accept incoming connections to perform their buisness role.

For most networks* IPv6 only delivers it's benefits when a substantial fraction of OTHER PEOPLE have also deployed it thereby allowing you to start deploying IPv6 only systems in roles that need external connectivity. Until then it's just an extra cost with no benefit. So the selfish but rational thing to do is to wait for other people to go through the pain of early IPv6 deployment and then learn from their mistakes.

* There is at least one provider that is so damn big that they ran out of private IPv4 addresses to address systems that did not need external connectivity but that is the exception.

Re:Priority Failure.

[show me altoids]

Wish I had some mod points. Regardless of which side of the current argument you are on, De Beers is an insane example of how a company can create artificial scarcity, and do it for over 100 years, while making boatloads of cash.

Re:Priority Failure.

[localman57]

Exactly. I am too young to remember, but my guess is there was a time when people were crying bloody murder about having a dynamic IP address, and bitching about how you had to pay extra for a static one.

Re:Priority Failure.

[Overzeetop]

No, this time never existed. Back when everyone who had an internet connection cared about their connectivity there was no NAT - or at least none at the provider level. It's only when consumers hit the internet that we got NAT on a wide scale, and all those people only consumed data for the most part. People who were early adopters and were used to being hands on, a small fraction of the growing tide, cared then and care now. As time marches on, that fraction gets smaller and smaller.

Re:Priority Failure.

[rudy_wayne]

Yeah, it's sad but it was also inevitable in a world of companies driven more by selfish buisness interests than a desire to improve the system as a whole.

Unfortunately, it's not that simply. ISPs are faced with a very serious and legitimate business problem. -- switching to IPv6 is very expensive but provides no benefit to them. For example, the millions (tens of millions?, hundreds of millions??) of modems that would have to be replaced because they can only handle IPv4. These are typically supplied by the ISP. Replacing all of them is an enormous expense, and when you're done, everything works exactly the same as it did before. From a business standpoint, there is no benefit to justify the expense.

Or, the ISPs can say to their customers:

"We've made a change to our system. It isn't any faster, it isn't any different, everything works exactly as it did before, BUT, you have to pay for a new modem or else you can no longer connect to the Internet. Oh, and by the way, you'll probably have to buy a new router too, since many home routers, even new ones sold recently, don't support IPv6. So good luck with that."

Re:Priority Failure.

[Bengie]

They shouldn't be able to call it "Internet" access if it's not a public IP address. This means they should not be classified as an ISP because they would not be offering Internet access as their primary service, just a crippled gateway to the Internet.

Re:Priority Failure.

[Sarten-X]

De Beers creates artificial exclusivity, not scarcity. It's a subtle but important distinction.

They produce a product that people value not because it's particularly rare, but because it's just uncommon enough to be a status symbol. Various substitutes can look and act similarly, so the high prices aren't justified by an actual need for the product. Rather, the need is for the brand itself, and the company creates and perpetuates the value of that brand by limiting supply. They ensure there's just enough supply to meet demand, but not enough surplus to impact the prices people are willing to pay.

Steve Jobs understood this concept well.

Re:Priority Failure.

[Anonymous Coward]

People have been crying wolf for 20 years (I was told in grad school that we were going to run out of IP4 addresses in 2 years. That was in 1993.). Now the wolf is here, and nobody believes them.

And I've been using NAT (or some equivalent) since at least 1995. We were out of IPv4 addresses that long ago. We've just been piling on hack after hack pretending that we aren't, each one making the internet harder to use as a network of peers.

Re:Priority Failure.

[Anonymous Coward]

No, this time never existed

You, sir, are either 2 years old, completely ignorant, or an ass hat.

There was (is?) more than a decade of premium charges for a static IP, whether home or business user.

Re:Priority Failure.

[Opportunist]

Because I'll switch ISPs to whomever offers me IPv6 first.

Oh, wait, that would require that I have a choice...

Re:Priority Failure.

[Anonymous Coward]

Wait, when did all 7 billion people get online?

Re:Priority Failure.

[Anonymous Coward]

By 'provides no benefit to them', do you mean continuing to provide services in the future?

Also, most modern modems have 4 LAN ports and make most home routers redundant.

Re:Priority Failure.

[Opportunist]

Yes, but only as much as a set of bricks is a replacement for tires. It props the car up, but you shouldn't try to drive.

And we're not talking about something only a handful of geeks will notice. There are plenty of consumer products that rely heavily on the ability of both ends to open and accept connections, mostly in the form of communication tools like VoIP/Skype, IMs, P2P software and so on. The moment two end users communicate without a "real" server (with an actual, real IPv4 address) in between them, this will become a problem.

Re:Priority Failure.

[Opportunist]

I know, but "AOL" was already trademarked...

Re:Priority Failure.

[grahamm]

There are already ISPs which supply IPv6. The SixXS FAQ lists 7 in the UK (which means competitors of BT) and 14 in the USA.

Re:Priority Failure.

[bWareiWare.co.uk]

If the people who had designed IP6 had just fixed the actual issue and not bolted on stuff nobody needed; we would have been done in the last millennium, and saved a LOT of money.

Re:Priority Failure.

[Anonymous Coward]

You're confusing "value" with "cost". Providing value is providing something that can be more used to generate more money for the user, generally by increasing the efficiency. For, e.g. having a telephone line allows you to talk to your client instantly instead of taking orders over snail mail.

Re:Priority Failure.

[Anonymous Coward]

modems that would have to be replaced because they can only handle IPv4.

A modem doesn't have the slighest care in the World about IPv4 versus IPv6. If just shifts ATM frames back and forth.

Re:Priority Failure.

[mark-t]

Indeed. They are doing that right now in fact, by not offering the service at all.

Re:Priority Failure.

[tlhIngan]

IPV6 addresses are in no way scarce, so why would they invest any money in that?

Providers can make them scarce quite easily.

Provide a /64, but route only ::1 to that address. If they want more, provide another /64.

And they can call it "security" or "privacy" or other thing, as well because they aren't exposing everyone's PC to the big bad internet, but firewalling them off. (Something which NAT provides just as a side effect. Not a great firewall, but better than nothing).

Re:Priority Failure.

[mark-t]

If my ISP told me I could get ipv6 just by paying for the modem, I'd do it in a heartbeat.

Re:Priority Failure.

[poetmatt]

no. scarcity is not value. scarcity can be defined by those who are in possession of something, but value is defined by the consumers.

Re:Priority Failure.

[Anonymous Coward]

They didn't. Not enough IP addresses. Weren't you paying attention? ;)

Re:Priority Failure.

[Megane]

I was told in grad school that we were going to run out of IP4 addresses in 2 years. That was in 1993.

And that was true... in 1993. That was when people realized that classful routing, for which addresses could only be divided up in chunks of 256, 65536, or 16 million, was the problem: Classless Inter-Domain Routing

Unfortunately, we still lost a few years worth of addresses from all the Class A blocks that were handed out. Because of course Ford Motor Company needs 16 million IP addresses.

Re:Priority Failure.

[andreyv]

99.999 percent of people will never notice or care.

...until one of them gets IP banned on a popular website/game, and brings down all others.

Re:Priority Failure.

[pe1rxq]

They were done in the last millennium.... and they did fix the actual issue (new address scheme and ip header).

Re:Priority Failure.

[wonkey_monkey]

Because I'll switch ISPs to whomever offers me IPv6 first.

They're only offering it to people who know when to use "whomever" at the moment. Sorry.

Re:Priority Failure.

[neokushan]

Wrong. It's a free opt-out, just ring them up and they'll give you a dynamic IP again.

Re:Priority Failure.

[gbjbaanb]

sure about that, from TFA:

BT admits that it can also affect activities such as online gaming

whoops, sure many old grannies won't notice but a lot of people are going to notice if their xbox doesn't connect anymore. Good job Microsoft never, ever wanted it online all the time :)

Also, as the people using the CGNat system are grouped together in a group of 10 (in the trial), I wonder if the RIAA will be concerned that any one of them could download whatever they liked and blame it on one of the others, who n doubt would deny all knowledge of illegal downloading.

So no online gaming with your friends, as much illegal movies and music as you like... I guess CGNat isn't such a bad idea after all!

Re:Priority Failure.

[neokushan]

There's more to it than NAT vs IPv6. The reality is we'll need both in the future. Say BT switched on IPv6 tomorrow and everyone in the UK got an IPv6 address - brilliant. But that's only half of the problem, they still need access to the IPv4 internet because all those servers the world over aren't IPv6 accessible yet.

Re:Priority Failure.

[hinchles]

My first ADSL connection back was with BT it was a 512kb service it was nearly £80 a month and came with a block of static IP address's 7 in total but lnly 5 usable as one was reserved for the router and one was your personal gateway on their network their little black router also had no NAT facilities.

And it was CONSUMER level not business level :)

Re:Priority Failure.

[hinchles]

You, sir, are either American where you've always had NAT or too young to remember the early internets

Re:Priority Failure.

[Shompol]

They produce a product ...

diamonds is not a product, it's a mineral (aka raw material, commodity)

that people value not because it's particularly rare, but because it's just uncommon

and what is the difference between "rare" and "uncommon"?

... enough to be a status symbol.

It is not a status symbol because it is rare or uncommon -- it is a status symbol because De Beers adverised it... as a brand! "Diamonds are Forever"???? Have you ever seen anybody advertising a commodity before? "Gold is Forever", anybody?

Various substitutes can look and act similarly, so the high prices aren't justified by an actual need for the product.

Excepts this product is needed practically everywhere in technology, if not for De Beers having a chock-hold on the market and inflating prices. These guys produces a flawless artificial diamond for use in technology, and got death threats over it.

Rather, the need is for the brand itself, and the company creates and perpetuates the value of that brand by limiting supply. They ensure there's just enough supply to meet demand, but not enough surplus to impact the prices people are willing to pay. Steve Jobs understood this concept well.

Yes, they turned a commodity into a brand, by monopolizing 90% of supply. The problem is -- it is a commodity, a raw material needed everywhere in technology. If the price went down it could revolutionize semiconductors industry. It can also be artificially produced from graphite, but looks like that technology is going to be squashed by De Beers, much like the electric car was destroyed by the oil industry.

Re:Priority Failure.

[compro01]

I was told in grad school that we were going to run out of IP4 addresses in 2 years. That was in 1993.

Yeah, then we came up with CIDR. Then we widely implemented NAT as a stopgap.

The wolf has actually been there. We've just been shooting at it and scaring it off. Now it's back again and we're out of ammo.

Re:Priority Failure.

[Anonymous Coward]

Or *all* of the Content Mafia, including the whole film industry, music industry, software industry (MS, Apple, Adobe, etc), games industry, book industry, etc..

Treating the work done by a service, which cannot actually even be controlled (and hence owned), like it's artificially scarce, and like another worthless copy of which you could make zillions for free like it would be worth another piece of your money for which you *actually* had to do actual work.

Some say it's because they cling to their old business models.

I say it was organized crime from the very start, and they *knew it* all along.
Which, when you actually read their "licenses" or copyright "laws", is pretty damn obvious. (And now with things like subscription models, they finally go public with the the service model... yet *still* think they can keep control over the copies... and stupid people still bitch about how they don't "own" the copy [wat?]. When in reality, the result of the work they subscribed to is free for everyone. and their whole problem of scarcity is *only in their heads* [and the crime that is current copyright law].)

Re:Priority Failure.

[Noughmad]

and what is the difference between "rare" and "uncommon"?

Ferrari is rare. Mercedes is uncommon. Now, hand in your geek card as you obviously never played Magic: The Gathering.

Re:Priority Failure.

[Anonymous Coward]

umm he was talking about dynamic IP addresses...

Comcast STILL doesn't give you static IP addresses, at least by default.

Re:Priority Failure.

[Anonymous Coward]

Yeah like all the people expected to VPN in from home to "volunteer" time. That should work well being double and triple nat'd.

Re:Priority Failure.

[tepples]

Many ISP-provided devices include both a modem and a "home gateway appliance" built into them.

Re:Priority Failure.

[idontgno]

Yes. And to use the diamonds example, DeBeers has levers in both value and scarcity: artificial scarcity by monopolistically controlling supplies and market inventory, and value by pervasive marketing to create and sustain the mindshare diamonds as rare and singularly valuable gemstones of the the jewelry-buying public. (True, a well-cut diamond is truly beautiful, and even a mediocre diamond can be "fixed up" to be quite striking, so not all the consumer value calculus is artificial, but I'm sure that's not all of it. There are many stones that are as striking as diamonds (certain opals, for instance), but only diamonds have that peculiar cultural status in the places that the diamond marketing machine has been operating for decades.

TL;DR summary: a particularly well-placed entity can create both artificial scarcity and enhanced perceived value.

Re:Priority Failure.

[K. S. Kyosuke]

99.999 percent of people will never notice or care. They could make a free opt-out to satisfy the geeks and few would ever even ask for it.

Sounds like a case for an adaptive algorithm that decides whether you should get NATted or not. Perhaps as simple a thing as classifying DNS requests would do the trick. Are you looking up slashdot.org? Plus for "don't NAT". Are you looking for cosmopolitan.com? Probably plus for "won't notice NAT". People wouldn't have to opt out of anything most of the time since the behavior can be correlated.

Re:Priority Failure.

[Bengie]

No one will notice that Skype, xBox, or their PS3 broke. Nope, never. Before you say these things work behind NATs.. Yes, NATs with uPNP, CGNAT does not support uPNP for obvious reasons.

Re:Priority Failure.

[wagnerrp]

They did fix the issue. They designed IPv6. The trouble is that fifteen years later when the need is finally here, companies are too cheap/lazy/stubborn to adopt it.

Re:Priority Failure.

[Anonymous Coward]

99.999 percent of people will never notice or care. They could make a free opt-out to satisfy the geeks and few would ever even ask for it.

Sounds like a case for an adaptive algorithm that decides whether you should get NATted or not. Perhaps as simple a thing as classifying DNS requests would do the trick. Are you looking up slashdot.org? Plus for "don't NAT". Are you looking for cosmopolitan.com? Probably plus for "won't notice NAT". People wouldn't have to opt out of anything most of the time since the behavior can be correlated.

Yes. That's a great idea. Except for two things: 1) We don't need MORE reasons to track our usage, especially by an ISP that knows your name (no anonymous aggregation). 2) Some households may do Slashdot and Cosmo and if there are kids, Disney and Nick as well.

Re:Priority Failure.

[nitehawk214]

Wrong. BT will charge you "extra" for a non-crippled internet line.

So, they roll out IP6 and charge extra for an IP4 address.

Re:Priority Failure.

[Anonymous Coward]

And we're not talking about something only a handful of geeks will notice.

The vast majority of home internet uses are already sitting behind a NAT firewall on their own router and never have any issues.

Yes, some applications require unsolicited inbound access. The issue is not NAT, because NAT on its own does not prevent inbound connections. Rather, it's the firewall which usually goes along with NAT which blocks those. The real issue here is using port numbers in the IP header to represent applications, we really shouldn't be doing this but the behavior is so entrenched it's not likely to change. We actually already have the mechanisms which would allow you to run all your traffic over a single port number with NO issues... but nobody ever adopted it because there wasn't any need. And if we're going to put the effort into re-engineering everything, then we may as well go to ipv6 and make it a moot point. But again, the issue is not NAT itself... it's simply exposing already existing design flaws and practices.

End point to End point communications may have been the original intent of the internet, but that time has long passed. A far better view to take is a network-to-network communication. It's more robust and secure to not expose your internal network. Server clusters, Virtual Machines, load balancers, etc. all already violate the endpoint to endpoint principle anyhow.

Re:Priority Failure.

[jonbryce]

Skype and SIP work on my cellphone, and all the mobile networks in this country operate carrier grade NAT.

Re:Priority Failure.

[Anonymous Coward]

that's why they should do that and invest in NAT from IPv6->IPv4->interweb

good user base to test on as well

Re:Priority Failure.

[AmiMoJo]

Unfortunately there are only two ways to get broadband in most of the UK: BT or Virgin. BT own all the phone lines over which other providers do ADSL, so if BT can't be bothered to make your line work with ADSL (like mine) you are screwed and the only option is Virgin. Virgin don't support IPv6 at all.

I live in a densely populated city. Problem is that BT only guarantees the line for voice, not ADSL. There used to be noise on voice calls and they replaced a lot of copper before eventually finding a leak at the exchange that was causing it, but ADSL is still broken. Therefore I have absolutely no choice, it's Virgin or dial-up.

I'm hardly alone. FTTC is helping to improve the situation but it is still so bad some villages have taken to bypassing BT completely and installing their own fibre.

Re:Priority Failure.

[AmiMoJo]

Virgin, or NTL as it was back then, thought that too once. They introduced a transparent web cache and it broke a huge number of sites. It was impossible to download files from popular websites because it looked like the same IP address was trying to download 50,000 at once. Video streaming sites instantly banned the proxies after seeing a massive DOS attack from them. Any site that needed you to log in was likely to block all NTL customers due to multiple failed login attempts from the proxy's IP addresses.

People did notice and did complain, and after a while they dropped them.

Re:Priority Failure.

[Dishevel]

But there never was an outcry of people demanding a static IP address for free.
Never.
Not once.
I am old. Not ignorant of these things and, ... well to be completely truthful, I can be an asshat. I am just not being one now.

Re: Priority Failure.

[Anonymous Coward]

horseshit. 3rd party ISPs can offer independent services if you live in an area with local loop unbundling which is 85% of the population and growing. also there's sky broadband and satellite providers (though admittedly their service is pretty asymmetric). also arguably 4g in cities might offer a credible broadband service for some use cases.

Re: Priority Failure.

[Anonymous Coward]

so they do a gradual rollout. ipv6 to new customers, existing ones can stick with ipv4 or and nat or pay for a new modem if they're desperate to have ipv6.

Re:Priority Failure.

[Sarten-X]

diamonds is not a product, it's a mineral (aka raw material, commodity)

Diamond is indeed a mineral, with many industrial uses. Most of the diamonds mined, though, aren't used or marketed as an exclusive product. More on this in a minute.

and what is the difference between "rare" and "uncommon"?

Something "rare" is hard to find, even if you have the resources to acquire it. Something "uncommon" is just something that's not commonplace. It might also be rare, but in this case (as with Apple products) the price is kept just high enough that not everybody that wants one will have the resources to get one. They're readily available, but for some reason, it's still remarkable to see one.

To use the venerable car analogy, a DeLorean is rare, because there's so few of them in existence. A brand-new Mercedes Benz is uncommon, because it's unlikely for the average person to buy one.

...it is a status symbol because De Beers adverised it... as a brand!...

Less of a brand (because diamonds don't carry a big label saying "De Beers"), but more of a specific product. The symbolism of a diamond standing for love and commitment is purely a De Beers invention. Want to impress your wife? Give her a new Mercedes. Love her forever? Give her a diamond!

A car is just a chunk of metal, and a diamond is just a rock. A chunk of metal with the promise of reliable transportation and the luxury of comfort is a product. A rock with the symbolism of love and promise of durability is also a product.

Have you ever seen anybody advertising a commodity before? "Gold is Forever", anybody?

Every. Goddamned. Day.

I work in finance, so I watch a lot of finance-oriented television. Yes, there are many companies touting their gold-related investment strategies, which basically boil down to "buy gold and make the price go up so my pre-existing gold holdings are worth more". In a way, it's similar: They're shifting the public perception of a mundane item into a valuable product.

Excepts this product is needed practically everywhere in technology, if not for De Beers having a chock-hold on the market and inflating prices.

There are many other manufacturers of synthetic diamonds, perfect for industrial use. Until recently, though, the diamonds they could easily produce were all colored, which aren't as suitable for jewelry. Now Gemesis, Scio, and others can produce gem-quality colorless diamonds.

These guys produces a flawless artificial diamond for use in technology, and got death threats over it.

[citation needed]

If the price went down it could revolutionize semiconductors industry.

The price is currently a few dollars per carat, in powder form. One carat is a huge amount compared to the size of existing transistors, so it's rather ridiculous to blame the price for the lack of diamond semiconductors. Instead, it's likely the immaturity of diamond semiconductor technology that holds up back:

The combinations of the extreme properties of diamond ... suggest that diamond should out-perform nearly every other semiconducting material system for electronic applications. IN PRINCIPLE! The reality is that there are many other factors involved in developing and implementing a technology: cost, manufacturing infrastructure, investment, and knowledge base. I think it is fair to say that diamond materials need a lot more research, knowledge, and technology development before they can be considered a mature semiconducting material.

...that technology is going to be squashed by De Beers, much like the electric ca

Re:Priority Failure.

[Chris Mattern]

Because I'll switch ISPs to whomever offers me IPv6 first.

Oh, wait, that would require that I have a choice...

And, to be blunt, it would require that ISPs cared in slightest. Not one customer in a thousand would switch ISPs based on whether they offer IPv6. Hell, not one customer in a hundred knows what IPv6 *is*. You're not a big enough market to be worth worrying about.

Re:Priority Failure.

[del_diablo]

Which again is a sort of of a flamebait. If a provider is charged with maintaining and upgrading a line, the costumers are already paying for maintenance and upgrading. If the costumers then pays a extra on the top of this for something they already are paying for, somebody should be shoot. Its that simple.

Re:Priority Failure.

[mikael_j]

Oh yeah, because double NAT always works so well, especially when the end-user's precious uPnP is no longer a viable option.

There will be a lot more issues with CGNAT than with end-user-controlled NAT (just another example: services which assume "one user = one IP", works fine when your home connection is shared with one or two others, doesn't work so well when you're sharing an IPv4 address with dozens of other users).

Re:Priority Failure.

[Agent ME]

What are those obvious reasons? I don't mind NAT so much when it at least has the decency to let me request port forwards to myself such as with UPnP. (Of course, I don't think any consumer routers are smart enough to forward UPnP requests they get upstream, which is frustrating in some situations.)

Re:Priority Failure.

[Chris Mattern]

Once again, you are--almost everybody reading Slashdot is--so atypical that no ISP really cares about your business. No ISP is interested in implementing IPv6 just so they can say they support it because that's going not going to have any meaning to 99% of their customers.

Re:Priority Failure.

[Luckyo]

Not even close. Essentially everyone who plays games that feature any kind of P2P functionality WILL notice because these games will break. Anyone using skype will likely notice some issues with being unable to connect sometimes. Anyone using anything that relies on connecting directly to his device's IP will notice.

While *most* people probably won't notice, the amount of people who will notice is far from trivial.

Re:Priority Failure.

[LordLimecat]

diamonds is not a product,

Refined diamonds, the things that people sell, are a product.

Re:Priority Failure.

[X0563511]

I've never had NAT, and I've never had to avoid it either.

I think you're confusing where the NAT lives. This is NAT outside of your zone of control. That's the problem.

Re:Priority Failure.

[DarkOx]

(Something which NAT provides just as a side effect. Not a great firewall, but better than nothing).

Its 2013 can we please drop this stupid statement already. There darn near to as reverse attacks as forward ones for categories of equipment and software mostly used by retail internet customers. NAT provides you with no protection there what so ever.

Re:Priority Failure.

[Anonymous Coward]

This already happens with dynamic IPs, and the solution is to reboot the modem. When 4 or 16 customers are multiplexed on the same IP, it would happen 16 times more often; hardly something that can put an ISP out of business, as long as the price is 10$ cheaper and Facebook and Youtube work. IP banning has stopped being effective a long time ago.

Re:Priority Failure.

[Anonymous Coward]

For example, the millions (tens of millions?, hundreds of millions??) of modems that would have to be replaced because they can only handle IPv4. These are typically supplied by the ISP.

Pretty much all the cable modems capable of docsis 3 can already do ipv6, that issue pretty much sorted itself out already.
What is not nearly so easily changed are all the "back-end" applications and platforms, everything from accounting to billing and provisioning systems, it's a massive minefield of potentially crippling problems which nobody wants to be the first to step into. Then you have issues with revamping training programs for front-line support people and finding engineers who have experience with v6. Things are slowly getting better, despite there not being much in the way of visible progress looking at it from the outside.

But you are correct that many, many home routers either don't support ipv6 or will be a nightmare to get working correctly. And for a good bit of time ISP's are going to have to offer customers ipv4/6 translation services- it's just a huge mess and everybody is waiting for someone else to take the first big steps.

Re:Priority Failure.

[green1]

But what if it's 20,000 customer's on an IP? and what if every time you reboot your modem you stay on the same node behind the same NAT with the same IP?

This seems far more likely than 4 or 16 customers and the possibility of a different IP when you reboot. It would more likely be at the node level, and you'd be on the same IP pretty much all the time.

I just find it interesting that they claim they have to NAT because nobody uses IPv6, and yet the reason that nobody uses IPv6 is that they refuse to offer it!
Quit making excuses, and start offering IPv6 already. don't use your own failure to implement IPv6 as an excuse why you should implement carrier grade NAT instead.

Re:Priority Failure.

[Anonymous Coward]

They shouldn't be able to call it "Internet" access if it's not a public IP address. This means they should not be classified as an ISP because they would not be offering Internet access as their primary service, just a crippled gateway to the Internet.

They are offering you access to the internet, by means of their network, they aren't actually putting you ON the internet. If you really want to technically be fully ON the internet you'll need to get an ASN, your own IP scope, run BGP sessions, purchase your own dedicated circuit, etc.

Re:Priority Failure.

[green1]

It's one thing to have 3 computers on a home network requesting open ports. Try it with 20,000 computers. It doesn't scale well, and you quickly run out of "desirable" ports.

Re:Priority Failure.

[green1]

For now.

The question is where this leads in the future. First it will be free opt out, then it will be a discount if you take the NAT, then it will be the standard with an option to pay more for non-NAT, and then it will be only "premium" connections that even have that option. We've seen this sort of evolution on many "features". The carriers will make money off it.

I'd rather they quit using their own failure to implement IPv6 as an excuse to not implement IPv6. "nobody's using it, so we won't implement it" (how are they supposed to use it if you refuse to implement it???)

I understand that IPv4 addresses are getting scarce, but I think they'd be better off to start this same way, but with IPv6 and a NAT like gateway to IPv4, it ends up with a similar short term situation for the customers (with much traffic heading over the IPv4 tunnel), but it also helps the IPv6 upgrade along a little bit, and doesn't hurt these customers in the long term once more becomes available over IPv6

Re:Priority Failure.

[neokushan]

CGNAT will be necessary for as long as there's still people out there only on IPv4. I don't disagree with what you're saying - as IP(v4)'s become scarce, they'll be worth more and ISPs will probably try to charge for them until people get the idea and move to IPv6.

Re:Priority Failure.

[Anonymous Coward]

Businesses make money by charging people for scarce resources. IPV6 addresses are in no way scarce, so why would they invest any money in that?

A number of companies that boast IPv6 addresses for their vServers and the like, actually only sell individual /128 addresses! Yes, madness!

For example, you get 2 IPv4 addresses and whopping 2 or 3 IPv6 addresses! And not /64, but /128.... You want extra? $1+/per IPv6 address/month! I use this to weed out companies that don't have a clue what they are doing with their network.

I will not name and shame them here, but cursory search for virtual servers and IPv6 will bring them up.

Re:Priority Failure.

[green1]

But right now it's the ISPs themselves forcing IPv4 use, while at the same time telling us that IPv4 use is the problem.
If they do this by issuing real IPv6 addresses, with CGNAT to IPv4, I actually don't have a problem with it. but using it in full IPv4 mode just makes the existing situation worse.

Re:Priority Failure.

[neokushan]

If they do this by issuing real IPv6 addresses, with CGNAT to IPv4, I actually don't have a problem with it. but using it in full IPv4 mode just makes the existing situation worse.

I don't disagree with that at all. I wish I knew what BT's plans were in this instance, but at some point CGNAT will need to be rolled out. I guess you could argue that IPv6 is less of a priority because if IPv4 addresses run out, people are screwed and ISP's need to have a solution in place - right now, IPv6 is not that solution because it only gets you on to the (rather small and limited) IPv6 internet.

Re:Priority Failure.

[Anonymous Coward]

Free? hahahahahahahahahaha

Re:Priority Failure.

[green1]

And that is the one and only acceptable way to run CGNAT, as an IPv6 to IPv4 compatibility workaround.

I don't deny that CGNAT is necessary, but I believe it should only be used to allow native IPv6 clients to connect to the current IPv4 internet. Anything else just makes the problem worse.

Re:Priority Failure.

[DarkOx]

I don't how exactly you are going to pull that one off. Its not like policy routing, where the client has no need to know or care what the next hops are. The client has to know its address. Once you have assigned a host an address there really is no non-disruptive way to change it.

I guess you could data mine your logs before going NAT to decide which customers to give NAT'd addresses to and which ones likely to have problems with it. That does not help you with new customers though; you won't have data. I guess you could ask them and the ones who can't form a coherent answer go in the NAT group....

Re:Priority Failure.

[DarkOx]

The only option is dual stack. There is just no way anyone isn't at least a avid slashdot reader in terms of techniess is going to be able to be on an ipv6 only endpoint; with or without NAT64.

Yes your ipv6 aware applications can use the v6 prefix you have stuff the ipv4 internet into. You could have a DNS server that generates synthetic AAAA records from the ipv4 A records and predefined prefix that routes to the NAT. This will probably work ipv6 aware applications using simple protocols like browsers.

Its going to make inspects and higher level protocol address rewrites pretty complex for the gateway. Think something like h.323 with the host address. You can't just swap out 6 bytes worth of src/port you going to have to completely re-craft that packet's content. That is just software that can do ipv6! Any older software that is expecting to open a ipv4 socket is going to have to have a local proxy of some kind on the client and point at a loop back ipv4 address. That client is going to have to have some sort of mapping of 127.0.0.0/8 addresses to predefined ipv6 address I guess. That is going to be a klugey mess no matter how you look at. I am sure YOU could make it work, but Aunt Tilly is going to be SOL.

Re:Priority Failure.

[mars-nl]

Can you back that up?

Re:Priority Failure.

[mars-nl]

Why is switching to IPv6 very expensive compared to implementing CGNAT (and having to move to IPv6 sooner or later anyway)?

Re:Priority Failure.

[LordLimecat]

Internet refers to internetworking. If it connects to a collection of networks, its internet.

Re:Priority Failure.

[dissy]

But what if it's 20,000 customer's on an IP?

You're a lot closer than you realize.

IANA has recently reserved the IP block 100.64.0.0/10 for use with carrier grade NAT.
An entire /10! 100.64.0.0 to 100.127.255.255 - just over 4 million IPs.

This block exists purely to interconnect two RFC1918 IP blocks which have a chance of conflicting.
If the ISP decided to use 10.0.0.0/8 internally, then they wouldn't be able to connect any customers who's NAT router also used the 10.0.0.0 IP space. Similar problems arise with the 256 blocks of 253 IPs within 192.168.0.0/16

There is a new class of network middleware gear designed to sit between the real Internet and the customers which links them all together using that 100.64.0.0 block.
Each cable modem / DSL modem's WAN IP is within this private block, as is the new router gear designed for massive state tables. It also does some interesting tricks to keep DNS working.

The routers are designed to take a single /24 block of routable Internet addresses to share with all those natted WAN ports, which of course will turn right around and NAT your single private 100.64 IP with all your own devices on traditional RFC1918 IPs.

255 public Internet IP addresses shared with 4,194,302 private IP addresses, or 16,448 private IPs per single Internet IP.

For a guess of 20k, you are amazingly close! Far closer than 4-16

Re:Priority Failure.

[Cramer]

Yes, yes there was. But it wasn't in a very loud voice, because there weren't that many people on the internet in those days. And it was mostly due to people now having to figure out ways to get their SLIP software to detect their IP address; if they used PPP (which wasn't all that common then), it was a minor change.

Re:Priority Failure.

[Anonymous Coward]

Have you ever seen anybody advertising a commodity before? "Gold is Forever", anybody?

Yes, all the time. Does "Milk does a body good" and "Pork, the other white meat" ring any bells? Gold is probably the most heavily advertised commodity of all time.

Re:Priority Failure.

[sc0rpi0n]

I suppose that most customers will get a /24 in the 100.64.0.0/10 to use for all the devices in their home network. This way there will still only be one layer of NAT, and the maximum number of customers on one IP would be 64, not 16000. IPs are not so scarce that they need to squeeze more than 64 customers onto one IP (yet): one /8 of real addresses can theoretically accomodate up to 1 billion customers at 64 customers per IP. With only one layer of NAT (and uPNP support), almost nobody will notice a difference.

The few geeks that want remote access will be willing to pay a few extra dollars to get a real IP, or just connect IPv6 instead. By having people pay a little bit for a scarce resource, you can distribute them more effectively amongst those that really need them.

Re:Priority Failure.

[mark-t]

For the people who can't use ipv6, CGN might make a lot of sense from the ISP's perspective.

Funny thing is, however, if they even just provided ipv6 to the customers that could actually use it, they'd probably get a new pool of IPv4 addresses they could use for v4-only customers anyways.

Re:Priority Failure.

[knorthern knight]

> But what if it's 20,000 customer's on an IP? and what if every time you reboot
> your modem you stay on the same node behind the same NAT with the same IP?

That would destroy the internet as we know it. Several hundred max. Problem is that many websites have a ton of 3rd-party ads displaying. That will eat up a bunch of ports. There are 64K ports, with the bottom 1K being reserved. After that, a NAT machine has to start terminating connections with prejudice. I don't like much of the crap in IPV6, but it's come down to the point where having IPV6 is a lesser evil than not having IPV6.

Re:Priority Failure.

[Anonymous Coward]

and all those people only consumed data for the most part

All those using Bit Torrent, IP phones, Skype and Google voice beg to differ.

Re:Priority Failure.

[complete loony]

If browsers tried both IPv4 & IPv6 connections at the same time, there would be almost no risk to turning on IPv6. But right now, there can be a delay of up to 21 *seconds* before falling back to an IPv4 connection, that's if it does fail over at all.

Which ISP & web host would turn on IPv6 support by default with that kind of end user delay?

Re:Priority Failure.

[green1]

I highly doubt it. They have their own special IP range specifically so that they can still have the other routers behind it and double NAT, if they planned to just give every customer a ton of IPs they could have used one of the existing private ranges.

No, they'll continue to give each customer 1-2 IPs as they do now, and double-NAT will be the norm. There's no reason to expect they'd have anything less than an entire node on an IP.

Re:Priority Failure.

[green1]

NAT already "destroyed the internet as we knew it" (but we got used to the "destroyed" internet), CGNAT destroys the internet as we know it even further (we'll get used to that too). If the ISP cared at all about not destroying the internet as we know it, they'd implement IPv6 instead of this disaster.

Re:Priority Failure.

[green1]

I don't see how that's a problem. If a site is advertising IPv6 availability, and you have a real IPv6 connection, you won't "fail over" at all. If they don't advertise IPv6 availability, then you don't even try them on IPv6.

Your issue should only occur for a site that claims to be available on IPv6 and isn't. And I don't see how that's any different than a site having a bad DNS entry on IPv4 either. (except that in the IPv6 vs IPv4 thing there is actually a failover possibility instead of outright failure, so it's actually less of a problem)

There is zero risk to turning on IPv6 now. Assuming proper ISP level CGNAT back to IPv4 for those sites that haven't migrated yet.

Re:Priority Failure.

[complete loony]

I'd say there's a non-zero risk of an IPv6 connection failing. When something breaks in IPv4, everyone notices and fixes it. But for IPv6, since hardly anyone is using it and applications should fail over, there's a good chance that a failure will go unnoticed.

This recent(ish) talk (video) has some interesting statistics on IPv4 exhaustion and IPv6 take up.

Re:Priority Failure.

[Hognoxious]

Bread is a thing of value. And yet there's probably half a ton of it within a few hundred yards of where I'm sitting.

Re:Priority Failure.

[Shompol]

The symbolism of a diamond standing for love and commitment is purely a De Beers invention. Want to impress your wife? Give her a new Mercedes. Love her forever? Give her a diamond!

My point exactly

Have you ever seen anybody advertising a commodity before? "Gold is Forever", anybody?

Every. Goddamned. Day. I work in finance...

It is a commodity, and is advertized as such on financial markets. It is not advertized to the general population on MTV.

These guys produces a flawless artificial diamond for use in technology, and got death threats over it.

[citation needed]

Although you can Google it, we don't know who the threats came from, so it is irrelevant. I would assume De Beers don't need death threats to destroy a startup, they can just acquire it, and it is possible that they did, but death threats can be extremely helpful when the owner refuses to sell.

If the price went down it could revolutionize semiconductors industry.

The price is currently a few dollars per carat, in powder form.

The stated reason why Apollo Diamond was trying to grow large artificial diamonds was not to undercut De Beers, but to be able to manufacture a CPU on a 1x1 inch diamond wafer. [citation] Clearly a diamond powder does not cut it.

Re:Priority Failure.

[Shompol]

Refined gold is still a commodity, and it actually goes through a purification (refining) process. There is no such thing as refined natural diamonds; unless that is how you call being cut and polished, but even that is not done by De Beers.

Re:Priority Failure.

[Sarten-X]

You're still confusing a "product" vs. a "brand". A product is a salable good of a particular kind, such as milk. A brand is a product from a specific manufacturer, such as Borden milk. When an entity is competing against other producers, it's worth the effort to promote a brand. On the other hand, when an entity stands to gain more from promoting the whole industry, it's cheaper and easier to just advertise the product in general, saving the hassle of fighting with other brands. As is common in the food-supply industry, multiple suppliers of a single product can band together in associations like the "California Milk Processor Board" to jointly purchase advertising.

This is somewhat orthogonal to the distinction of a "commodity". A commodity is a good that has no product differentiation. One manufacturer's car is wildly different from another manufacturer's, but one mine's gold is not different from another's. Diamond is somewhat odd in this regard, as the minor or even intangible differences in diamonds from different mines are magnified in the price and legality. Being lab-grown or natural also is a major difference in demand.

De Beers is not really marketing a brand to the public at large. They're advertising a rock, promoting its image to create a market. That turns the industrial good into something far more salable - and that makes a product. Since they control most of the world's diamond production, it's easier for them to advertise diamonds in general, even if it helps their competitors. By increasing the public demand for diamonds, they increase the demand from distributors. They'll then advertise their brand to those distributors, who have to keep up their own supply.

It is a commodity, and is advertized as such on financial markets. It is not advertized to the general population on MTV.

It's also advertised in magazines, newspapers, and everywhere else there are people looking for investments. Since the gold fanatics profit most from driving up gold prices, they're promoting gold as a whole, rather than any particular brand of gold-investment strategy.

Although you can Google it, we don't know who the threats came from, so it is irrelevant.

Yes, it is irrelevant and unfounded, but you brought it up. It's a conspiracy theory that doesn't hold water.

The stated reason why Apollo Diamond was trying to grow large artificial diamonds was not to undercut De Beers, but to be able to manufacture a CPU on a 1x1 inch diamond wafer.

Such wafers already exist from other manufacturers for other purposes. Apollo just made improvements to the technology, but still failed at the business. Perhaps it's because, as mentioned in my last post, we still can't make reliable diamond transistors because our technology is immature, but they were focusing on making wafers for full CPUs. Perhaps in 50 years, they'll have a market.

Clearly a diamond powder does not cut it.

Quite the contrary... Diamond powder is one of the very few things that can cut a diamond wafer!

Re: Priority Failure.

[Anonymous Coward]

BT are actually the only one of the top 5 ISPs in the UK to offer an uncrippled line and the only one that was publicly open about how they used traffic shaping in the first place. That combined with the fact the majority of other ISPs lease their service from BT and still opt for heavy traffic shaping and Mr Branson's horrifically crippled offering still failing to bring anything to the wider table of British networking but a horrendous last mile service. People need to lay off BT and stop crying bloody murder because their line took a month to queue for an installation from the only provider to offer the service.

Re:Priority Failure.

[Waffle Iron]

Just because people have stockpiled an item near you doesn't mean it's not scarce.

Go out in the wilderness and see if you can spot any loaves of bread.

Re:Priority Failure.

[RockDoctor]

That would destroy the internet as we know it. [...] Problem is that many websites have a ton of 3rd-party ads displaying.

Do you see a problem with a lot of internet advertising disappearing? I don't. Except for a relatively small proportion of people who attempt to make money from their sites by having adverts rather than content. Call it a slaughter of the innocents, or call it whatever you want to, but I don't have any problem with destroying advertising. Why do you think I've been a vigorous user of AdBlock for years? And JunkBuster before that, going back to when I was on dial-up.

Re:Priority Failure.

[RockDoctor]

Essentially everyone who plays games that feature any kind of P2P functionality WILL notice because these games will break.

Will they? Does that mean that I can't play Solitaire, or X-com, or Elite in my DOSBox emulator then? Have any interesting games been written that use this functionality?

Anyone using skype will likely notice some issues with being unable to connect sometimes.

And this will differ from today's situation just how?

Re:Priority Failure.

[Luckyo]

Of the current titles, Warframe comes to mind as I'm playing it right now. Had to punch a hole in my router for proper connectivity.

Essentially all non-server games will be hurt by this.

In relation to skype, people who did not have this problems before (all ports fully open to internet, they could function as a node) will start experiencing the problems of a user who's not a node.

Re:Priority Failure.

[Bengie]

UPNP is a Hack to make NAT work and has no authentication, meant for small networks where you trust all of the clients. Anyone can request ports open for anyone else. It would be a security nightmare and be easily abused.

Re:Priority Failure.

[Bengie]

Several case studies have shown that CGNAT is almost as expensive as IPv6 up-front, and the operational costs of CGNAT is much much higher because of management, engineering, and customer support issues.

Those case studies assumed that most ISPs have modern ADSL2, DOCSIS2/3, or FiOS. Any ISP still using antiquated technology would not have the benefit of their equipment supporting IPv6, just not being configured.

Re:Priority Failure.

[Bengie]

The Internet is a mix of networks, including the one you are on. Why do you think they're called "Internet Service Providers"? They provide the Internet, or at least claim to.

Re:Priority Failure.

[Agent ME]

Anyone on the network could just request a port open to themself and forward connections from it to unforwarded ports within the LAN, so the ability to request ports to be open for others doesn't really get an attacker much further.

Re:Priority Failure.

[kasperd]

IANA has recently reserved the IP block 100.64.0.0/10 for use with carrier grade NAT.

That's interesting. I didn't know about that block. I'll keep that in mind as I might get involved with deployments, where this is applicable. I looked up the relevant RFC, which is RFC 6598. I find it interesting that this was taken out of ARIN address space. With ARIN being next in line to run out, this block must have accelerated depletion for ARIN.

That there is a /10 allocated for the purpose doesn't necessarily mean there will be millions of users behind a single CGN. A medium sized ISP could use this /10 to assign one address to each customer without having duplicated addresses within their own network, even if they plan to deploy multiple CGN devices to service their customers. That way customers of that ISP can communicate with each other as well as the ISPs own servers without going through CGN. It can also make management easier.

I am curious what this means for usage of 2002:6440::/26 address space. Things could get interested. This is briefly covered in section 5.2.6 of the RFC.

Re:Priority Failure.

[kasperd]

Your issue should only occur for a site that claims to be available on IPv6 and isn't.

There are plenty of those sites around. But what you see even more are sites, which are available on IPv6, but are quite unreliable on IPv6. A couple of high profile examples include YouTube and facebook, which are much more reliable if you are on an IPv4 only connection, than if you have dual stack.

One of the blocking factors that kept websites from deploying IPv6 in the first place was a problem on the client side with clients which thought they had IPv6 support, but in reality did not. This is similar to the problem you describe, but is different. An ISP should of course not deploy IPv6 to their customers if they aren't going to have real connectivity to the IPv6 backbone. But as RFC 6598 addresses start seeing more use, there will be routes thinking they can use 2002:6440::/26 6to4 address space. Those clients will then think they have IPv6 connectivity, but won't be able to reach dual stack sites.

An ISP can actually avoid that particular problem by deploying native IPv6 to their customers. Once there is native IPv6, the routers won't bring up 6to4. That way you can avoid 6to4, which has been broken by RFC 6598.

Re:Priority Failure.

[kasperd]

There is just no way anyone isn't at least a avid slashdot reader in terms of techniess is going to be able to be on an ipv6 only endpoint

You won't see many IPv6 only users on slashdot either. I'm wondering if I should change my signature to read "slashdot is part of the problem" until they eventually set up AAAA records for slashdot.

You could have a DNS server that generates synthetic AAAA records from the ipv4 A records and predefined prefix that routes to the NAT.

64:ff9b::/96 is allocated for exactly that purpose. And BIND has support for synthesising the AAAA records. But I don't see much benefit from such a deployment compared to dual stack plus CGN.

Its going to make inspects and higher level protocol address rewrites pretty complex for the gateway. Think something like h.323 with the host address. You can't just swap out 6 bytes worth of src/port you going to have to completely re-craft that packet's content.

Exactly, that is a real challenge. And for that reason I think CGN + dual stack is more viable in some situations. Deploying CGN without dual stack is just screwing over the customers.

Re:Priority Failure.

[kasperd]

Yeah, then we came up with CIDR. Then we widely implemented NAT as a stopgap.

CIDR was a great stopgap. NAT was not.

Without CIDR the addresses would have run out faster than any solution could have been implemented. CIDR was not that big a change, so it didn't break lots of stuff. And it slowed down the consumption of addresses a lot. If a decent effort had been put into upgrading to IPv6, it could have been completed before addresses ran out, even if CIDR had been the only stopgap measure, and NAT had never been invented.

But NAT got widely deployed. Not because real scarcity of IPv4 addresses, but rather because of an artificial scarcity. ISPs were charging for IP addresses, so with NAT already available, private users used that to avoid paying extra. It did slow down IPv4 consumption so much, that ISPs decided not to work on deploying IPv6. But a major reason for the deployment not happening faster actually was that there was no competitive advantage.

The ISP which deploys IPv6 has some expenses in doing so. If they decide to save that money, they are causing a problem. But the problem they cause affects the entire industry, so it was not a competitive disadvantage. Moreover the lack of IPv6 deployment is now causing more problems for newcomers than it is for those established companies, who were responsible for the problem in the first place. And this is the real reason we have such a mess today.

Rationing of IPv4 addresses was a great idea. It just happened way too late. Rationing once you have consumed 98% of a resource is not solving the main problem. The 1024 IPv4 addresses an ISP can get if they start deploying IPv6 is not that great an incentive.

At the time CIDR was introduced a rationing policy should have been agreed upon. As soon as IPv6 implementations were reasonably mature, but not widely deployed, rationing should have been applied to keep the base of IPv4 only systems constant. At that point ISPs should only have been able to get new IPv4 addresses for use in dual-stack deployments. If they used the newly allocated IPv4 addresses for IPv4 only deployments, they should have received no more IPv4 addresses until they had converted enough IPv4 only systems to dual stack.

A proper rationing policy would have ensured by the time IPv4 addresses ran out, there would be at least as many dual stack deployments as IPv4 only deployments. That would make IPv6 only look much more viable, and it wouldn't take a lot of IPv6 only systems to make dual stack look preferable to IPv4 only, if dual stack was proven to work in practice.

It is too late to implement such a policy now. So we will have to find another way out of this mess. It was clear already a decade ago, that there simply didn't exist the right economic incentives for ISPs to deploy IPv6. And nobody in place to implement the needed policy, had the balls to do it. That IPv4 addresses ran out without IPv6 having reached a significant deployment should not have come as a surprise to anybody. That ISPs still believe IPv4 only is the best strategy even now, is however a bit surprising, and quite scary.

NAT was part of the reason it took such a long time to reach the point we are at now. And what good has it done us? It delayed the inevitable. But that extra time was not used to make us more prepared for it, as such we didn't get any benefit from NAT, which we can use to ease the deployment of IPv6. Also the delay has meant the network is now larger, which means more work and more expensive to upgrade, than it would have been, had it happened earlier. NAT also made the network more complicated, and many of the blockers in deploying IPv6 are due to problems caused by NAT. Moreover many people have gotten so used to NAT, they don't know how the Internet was supposed to work. And now they don't want IPv6 because it doesn't look like what they are used to. Lots of effort has been put into developing workarounds for the problems introduced by NAT. And none of them work great. All of that wasted effort would have been much better spent on getting IPv6 deployed in the first place.

How about....

[skyraker]

helping get IPv6 implemented rather than crying about it not being implemented?

Re:How about....

[hinchles]

I'd love them to put me on ipv6 if I ever need to get to the v4 range I can always vpn to one of the work servers and use that as a bridge as they're both v4 and v6 enabled.

Re:How about....

[jones_supa]

Exactly!

Although CGNAT goes against the Internet's original end-to-end principles, ISPs say they are forced to use it because IPv4 addresses are running out, and IPv6 is not widely implemented.

Well, implement it then, for crikessakes! It's your job!

"Although getting seriously overweight goes against principles of healthy life, I am forced to buy bigger clothes because the old ones cannot fit, and all I do is eat junk food."

Re:How about....

[Anonymous Coward]

Well, implement it then, for crikessakes! It's your job!

You aren't understanding this. They don't have enough v4 addresses. If they put you on a pure v6 connection, 99% of the internet will not be usable because almost nobody else has implemented v6 yet. They will have to offer users v4 addresses for quite some time even after they start offering v6 in order to make the transition seamless. When shit stops working end users don't care whose fault it really is... it's always the ISP's fault because that's who they are paying.

Re:How about....

[cas2000]

so the solution is for ISPs to offer IPv6 service PLUS a v4-to-v6 gateway or CGNAT for access to "legacy" IPv4 sites.

in a few years, the transition will be complete with little pain

Killing IPv4

[eksith]

Is the only solution. This is a stopgap measure like carpooling and congestion charges that don't actually fix the original problem of a diminishing resource.

Re:Killing IPv4

[hedwards]

Umm, carpooling and congestion charges both work. Ultimately, unless you force people to not leave their home, people still need to go to work, and there aren't very many options available for dealing with that.

Re:Killing IPv4

[MightyYar]

It takes an interesting mind to watch thousands of 5-passenger cars go by with a single occupant and not think that carpooling is a solution. Just one additional passenger will double the capacity of the road.

Re:Killing IPv4

[Anonymous Coward]

Simplistic much?

Re:Killing IPv4

[operagost]

Not to argue, but it won't "double the capacity" unless your road has no buses or trucks.

Re:Killing IPv4

[Anonymous Coward]

Simplistic much?

Accurate more.

Re:Killing IPv4

[Anonymous Coward]

Not really. For example, some of those carpooling may be doing so as an alternative to buses or other public transport, in which case there is no impact on the number of passengers carried by the road. To name just one way in which the statement is simplistic.

Re:Killing IPv4

[DarkVader]

So will doubling the speed of the cars.

Or adding lanes.

But carpooling isn't a solution unless two people are coming from the same place and going to the same place.

Re:Killing IPv4

[jbburks]

It takes an interesting mind to watch thousands of 5-passenger cars go by with a single occupant and not think that carpooling is a solution. Just one additional passenger will double the capacity of the road.

And there are millions of packets going by on the Internet. Just think, if every other packet were concatenated on the previous one, there would be half as many packets, and that would double the capacity of the routers.

Re:Killing IPv4

[Opportunist]

That would be a little bit like the way UPS delivers, right?

Re:Killing IPv4

[Anonymous Coward]

Bad analogy. There are millions of 1KB packets with .5KB of real data. Somehow merging them would double the capacity of the internet. But it adds processing cost.

Re:Killing IPv4

[jbburks]

Actually, a bus or public transit would be more like UPS. Both involve a central collection point and aggregation into a scheduled service. Car transit is more like a peer-to-peer service: on demand and point-to-point. Much faster than going UPS (or bus).

Re:Killing IPv4

[MightyYar]

I hope that is obvious enough for me not to mention! :)

Re:Killing IPv4

[MightyYar]

But carpooling isn't a solution unless

Doubling the speed of cars isn't a solution UNLESS cars can go that fast, slow drivers speed up, highways are redesigned for the speed, safety features are improved, etc.

Adding lanes isn't a solution UNLESS you have the land available, money available, have a place to put the extra cars exiting onto secondary roads, etc.

All solutions have caveats, that doesn't make the solutions all invalid.

Re:Killing IPv4

[MightyYar]

It is indeed simplistic to view empty cars as underutilized. That was kind of my point?

Re:Killing IPv4

[hedwards]

This is stupid.

The point of congestion pricing is that it encourages either carpooling or delaying the trip until off peak times. Adding additional capacity to the roads, just ensures that more people will use the roads.

Ultimately, you need to take vehicles off the road, and this kind of bullshit doesn't help that.

Re:Killing IPv4

[hedwards]

Not the same place, but close enough. There's a ton of places within a half mile of each other in urban areas. If one can't walk a quarter mile, then one needs to get some more exercise and deal with their pathetic body. I know that some folks with disabilities aren't so lucky, but ignoring them you can still make a huge difference.

Re:Killing IPv4

[MightyYar]

Did you reply to the wrong person? It seems we agree.

Re:Killing IPv4

[kasperd]

And there are millions of packets going by on the Internet. Just think, if every other packet were concatenated on the previous one, there would be half as many packets, and that would double the capacity of the routers.

This only helps as long as the processing power on the router is the bottleneck. As soon as packets are large enough, the actually link bandwidth will be the bottleneck. At that point fewer larger packets will not give you more throughput.

As links become faster the optimal packet size will also increase. There is a huge difference between dialup and 100Gbit/s fiber. You wouldn't want the same size of packets on both kinds of link. A 1500 byte packet would block a dialup link for long enough to cause a measurable latency increase for any small packet you might want to send through at higher priority. You don't want packets that large on dialup. But on 100Gbit/s fiber such a packet size would mean millions of packets per second. You'd want larger packets, such that you don't need to handle millions of packets per second.

But what about those packets, which go over links of different types? With IPv4 they could be large as they were sent and be split into smaller fragments on their way to the destination, and then be reassembled at their final destination. But having this work done by routers on the path adds to the processing cost for that router, and that processing cost is what we want to reduce in the first place. For that reason this was changed in IPv6. Routers no longer fragment packets in transit. A packet is the same size all the way from the source to the destination.

Assembling multiple fragments into one packet is even more work and was never done by intermediate routers. (Some firewalls might do it before deciding whether to forward or drop the packet, but that was never intended by the standard.) Grouping unrelated packets would be even more difficult. And as long as it is only done end-to-end, it can only be done if they have the same source and destination anyway. There is no standard for doing this.

But for traffic that would get segmented by TCP or fragmented by IP, we really do want to have the packets on the wire get larger as link speeds increase. In fact the maximum size was increased between IPv4 and IPv6. It used to be 64KB but has been increased to 4GB. Hardware that would allow us to benefit from that increase is still difficult to come by (if it even exists), but IPv6 is designed to be usable in many years, so it makes sense to support larger packets.

Ah, the bad old days...

[fuzzyfuzzyfungus]

Fantastic! This will be just as wonderful as AOL was, back when they were still unsure about this whole 'ISP' fad, and offered ghastly semi-access to the internet proper. I think I just threw up in my mouth from all the nostalgia!

Re:Ah, the bad old days...

[Anonymous Coward]

Fantastic! This will be just as wonderful as AOL was, back when they were still unsure about this whole 'ISP' fad, and offered ghastly semi-access to the internet proper. I think I just threw up in my mouth from all the nostalgia!

Me too!

Re:Ah, the bad old days...

[Anonymous Coward]

Me too!

Re:Ah, the bad old days...

[Squash]

I wonder what percentage of Slashdot users will even get that joke...

Re:Ah, the bad old days...

[NJRoadfan]

What day are we up to in September again?

Re:Ah, the bad old days...

[compro01]

Today is September 7189th.

Re:Ah, the bad old days...

[nitehawk214]

Today is September 7259th

Not a fan!

[andy16666]

I'm not fond of this in the least. I wonder how long before major ISPs finally jump to v6.

Re:Not a fan!

[green1]

If they can keep up this game? never.

So far they are using their own failure to implement IPv6 as an excuse not to do so. "we won't let anyone use it because nobody is using it"

Also why implement IPv6 where every device in the world can easily have an IP, when they currently charge so much for extra IPs? and with CGNAT they can even get to the point where you don't get ANY IP without paying extra.

What incentive is there to ever go to IPv6 in this situation?

Just use IPV6

[Anonymous Coward]

Just use IPV6 and do it properly... why on earth BT is not capable of doing this is beyond me...

Re:Just use IPV6

[Slackus]

The main reason in my opinion most ISPs are not fully migrated to IPv6 is because there are MANY inhouse and 3rd party apps that ISPs use for monitoring, operations, business etc that do not support IPv6 yet. It not just a matter of upgrading the routing infrastructure to support IPv6, they have to uplift most if not all of their operational tools as well, which all adds up to millions.

Re:Just use IPV6

[Khyber]

It's BT. No explanation for the sheer incompetence is required.

Re:Just use IPV6

[Hillgiant]

Yes, but:

How many of those 3rd party apps are there because of the limitations of IPv4?

Re:Just use IPV6

[bill_mcgonigle]

why on earth BT is not capable of doing this is beyond me.

yes, apparently it is. I'm almost positive it's not beyond BT's Internet engineers why BT isn't capable of 'just using' IPv6 (without also implementing 'CGN' to make it work to the IPv4 Internet).

Re:Just use IPV6

[skywire]

Never attribute to incompetence what can more parsimoniously be explained by greed or malice.

It's time

[lesincompetent]

I hereby declare a Jihad against BT for their infidelity about IPv6.

Governments and corporations love this

[Anonymous Coward]

They have "fixed" the internet so it looks more like television. You are back to be a content consumer, and any attempt to communicate directly with another content consumer will be regulated.

Re:Governments and corporations love this

[Pi1grim]

STUN disagrees.

Re:Governments and corporations love this

[jones_supa]

P2P file sharing will also take a hit, as there will be less users that your client can connect to.

Re:Governments and corporations love this

[Anonymous Coward]

No. The majority of P2P clients already have better UDP-based holepunching than almost everything else.

Re:Governments and corporations love this

[erik.martino]

But it is harder to uniquely identify you by IP address

Re:Governments and corporations love this

[Anonymous Coward]

But it does make p2p usage more anonymous.

Re:Governments and corporations love this

[green1]

Yes, because I'm sure the ISP will never keep logs which would allow such identification, and in any case they would never provide them to other corporations or the government upon request...

Re:Governments and corporations love this

[Bengie]

UDP hole-punching only works with certain NAT setups, not all of them. NAT is not a standard, so each company is free to implement it however they want.

bye bye port forwarding

[Anonymous Coward]

lol

Re:bye bye port forwarding

[Stormthirst]

For the vast majority of users, port forwarding isn't a priority. BT are selling this to lower tier internet users like my Granma who knows nothing about port forward and doesn't care. So long as she can send and receive emails, use a web browser and make the odd Skype call, she has no other need.

You and I on the other hand need to have the port forwarding capabilities, but then you and I probably need higher bandwidth etc that a higher tier package gives us.

I'm not saying it's right, I think they should skip this and go to IPv6. But port forwarding isn't a feature that the vast majority of internet users need or use.

Re:bye bye port forwarding

[Anonymous Coward]

Skype works a _lot_ better with a port forward.

Re:bye bye port forwarding

[Opportunist]

I'm not sure, can she still make the "odd Skype call"? Or would that require that one computer can actually open a connection to the other one?

Re:bye bye port forwarding

[Anonymous Coward]

Skype can work around NAT.
This is one of the more clever aspects of the protocol.

Re:bye bye port forwarding

[compro01]

I believe Skype utilizes STUN to deal with NAT, so it'll work, but fully peer-to-peer stuff will break.

Re:bye bye port forwarding

[petermgreen]

AIUI skype first tries direct connection using nat traversal techniques if needed. If that fails it routes the call via a node with a public IP address (they used to (ab)use customers on open internet connections to provide this service but nowadays I belive they provide it from their own servers).

Re:bye bye port forwarding

[wagnerrp]

To be fair, we would be saying the same thing were we migrating to IPv6....

Re:bye bye port forwarding

[kasperd]

they used to (ab)use customers on open internet connections to provide this service but nowadays I belive they provide it from their own servers

Not sure what they are doing these days. Their old scheme was a major contributing factor in a huge Skype outage a few years back. As far as I recall, they needed a bunch of servers at Amazon in order to get Skype back online. That outage might never have happened, if IPv6 had been deployed when it should have been.

Oh, the old internet...

[Anonymous Coward]

Presumably they'll give you a block of static ipv6 at least

"Not widely inplemented"

[Anonymous Coward]

The easiest solution would be to implement it then.

Have some balls, and just do it. I'm sure there will be tons of calls from people using computers and routers from the late 90's. Send them a free router/network card/dongle.

Re:"Not widely inplemented"

[Pi1grim]

Who's gonna pay for the "free" dongle? And how on earth can you make IPv6 a premium option if you don't make IPv4 unbearably broken and inconvenient for users? And once they start crying you offer a "new and improved internet".
Sad jokes aside - why aren't they implementing NAT64 ? It's solves the problem in the same way as NAT, except more and more resources will have incentive to move to IPv6 and once the momentum is gained and all of the resources are there you can just drop NAT64 altogether without anyone noticing.

Re:"Not widely inplemented"

[xorsyst]

BT already gives all customers a home hub (router) as part of the deal, this is pretty standard in the uk. They upgrade them every couple of years for you, so going to an IPv6-enabled one is not difficult.

Re:"Not widely inplemented"

[Anonymous Coward]

Who's gonna pay for the "free" dongle?

The customer. I'm guessing you're American (so am I) When something is free, but you must purchase something (Internet service), then the "free" thing is built into the cost of what you are purchasing.

Anyway, a router capable of this costs maybe 15 bucks if it is cheaply made. A dongle might be anywhere from 2 to 6 dollars depending on if it is wifi or Ethernet. Buy in bulk, get special deals from china, and the price goes down.

1) give away "free" router/ dongle
2) but only after customer signs a contract for say, 6 months to two years service.
3) enjoy marketing push of being the first ipv6 ISP.
4) profit!!!

Re:"Not widely inplemented"

[gsnedders]

Uh, what? My father has never got anything beyond the first ADSL modem he got from BT almost a decade ago.

Re:"Not widely inplemented"

[green1]

This is hardly an impossible problem.
Start with the new customers, and any equipment swaps, service plan upgrades, etc. You'll get most of your customer base within about 5 years, then you can go after any that remain.

I do installation and repair for an ISP, The ADSL modems we stopped using 10 years ago are pretty much all gone (I haven't seen one in about a year, and it was probably almost a year before that that I saw the previous one) the ones we stopped using 5 years ago are rare (I might see one every month or two). At this point I'd say I mainly see a mix of the ones we stopped using 2-3 years ago, and the current ones with only exceedingly rare exceptions.

Re:"Not widely inplemented"

[yet another SanTiago]

> Sad jokes aside - why aren't they implementing NAT64

NAT64 is generally more restrictive for IPv4 than common NAT, while does not have much advantages (if compared to IPv4NAT together with IPv6).

But there are other options like MAP-E, which solves both IPv4 exhaustion and IPv6 deployments with advantages (compared to CGNAT) for both users (better control over NAT) and ISPs (just stateless and easily scalable gateways).

Re:"Not widely inplemented"

[vlueboy]

BT already gives all customers a home hub (router) as part of the deal, this is pretty standard in the uk. They upgrade them every couple of years for you, so going to an IPv6-enabled one is not difficult.

A few cents or dollars per NEW module kills timely standard adoption. We're talking about ISPs, so let's use a well-known evolutionary example with WIFI routers available to users even outside the ISP chain:

First, no wifi at all,
then default / empty passwords all neighbors could steal,
then WEP only because WPA wasn't supported,
then no WPA2...
then (or mixed in with the above):
no support for G,
then no support for N
finally, "support" for N on just 130mbps, but not multiples of it. The unwritten word is also SINGLE band (2.4Ghz)

That is what I remember from a ton of different routers I either got from ISPs, owned, gave away or just troubleshooted. The great fragmentation tells you that it won't be an easy problem to solve. I mean, just check your Wifi now and see how many of the ancient no-nos you can still see from neighbors around you who PAID for their routers --I don't even want to know what they have to settle for at the Modem level.

Providing an upgraded router may not be the same as just "going" up to an IPv6-enabled router. Supply chains take forever (5 years) to provide today's optional features.

If you need more proof that a 2 year cycle for upgrades means nothing, just look at how few top of the line smartphones *refreshed yearly* support 5Ghz bands. Even if you paid through the nose to correct that, you still must leave the 2.4 Ghz band open because your pricy game console [refreshed every 5 years] isn't that lucky or your visitors' gadgets are behind. It's not a pretty picture. Give it 10 or 15 more years

On the other hand....

[mark-t]

With CGN, they can't *POSSIBLY* argue that an IP address somehow is linked with a particular subscriber anymore.

This is going to create a hell of a problem when people inside the CGN start doing stuff they aren't supposed to outside of it, and those people outside can't do anything useful with the IP that they have.

Re:On the other hand....

[fuzzyfuzzyfungus]

Given that the usual move when you have an IP and want to identify John Doe is to ask the ISP, I assume that the same principle will still work just fine. After all, if the ISP isn't keeping track of which traffic to a given IP needs to go to which subscriber, the system will break, so they will still know what the story is....

Re:On the other hand....

[Anonymous Coward]

Yep, thinking of moving to BT option 1 so I can bittorrent with impunity.

Re:On the other hand....

[Anonymous Coward]

That is assuming that the Telcom companies are not already keeping a long term log file on the who is accessing what with a time stamp.

Re:On the other hand....

[poetmatt]

doesn't really matter, all that piracy shakedown stuff is coming to a close a prenda is being brought front and center for those specific activities. There are very, very wide implications for what is going on that will probably stop a large amount of the "piracy settlement" firms.

Re:On the other hand....

[mark-t]

Nope.... not remotely. Which is the whole problem.

Because if BT implements CGN, then the IP that somebody outside ot BT would have for somebody inside of it would actually map to a whole bunch of BT subscribers. BT has no possible way to tell which subscriber utilized the IP because all of them did... possibly even all at exactly the same time, unless BT maps every subscriber to a unique global IP anyways, at which point BT doesn't gain anything by using CGN at all.

Re:On the other hand....

[Anonymous Coward]

Copyright trolls never made much out of having solid evidence, chances are they'll just try to sue everyone that used that IP.

Re:On the other hand....

[hinchles]

Wonder if it'd open up the potential for exploiting since you and other subscribers are potentially on the same vlan kinda perhaps you could packet sniff it or find out the internal ip's of the others in your nat session. Perhaps you could simply just get yourself ddos'd taking out your entire nat block for connectivity and simply reconnect your own router to get a new nat block.

I suspect this won't end well.

Re:On the other hand....

[mark-t]

That'd be kinda like prosecuting everybody who had walked into a store in a particular morning for shoplifting when only one item went missing.

Re:On the other hand....

[Gerafin]

Depending on how they set it up, BitTorrent might not work at all.

Re:On the other hand....

[mark-t]

There's far more than just piracy as an issue here.

Re:On the other hand....

[Anonymous Coward]

CGN in service provider networks typically keeps track of port numbers that are used by subscribers behind the BNG. For example, customer 1 might be assigned ports 5000-5199, customer 2 5200-5399, etc. Those records will certainly be kept.

All a lawsuit pirate has to do is provide the time, IP, and port(s).

Re:On the other hand....

[Imagix]

Not true... the CGN unit can do a bunch of interesting things to sort this out. Assigning or hashing port numbers to source IPs, to maintaining a massive set of logs of which subscriber used which IP and port at what time. Not saying that this is a _good_ thing, but is theoretically possible.

Re:On the other hand....

[fuzzyfuzzyfungus]

My point is that, for NAT to work, the NAT system has to track activity between internal hosts sharing an external IP and the outside world in order to handle the address translation process. If it didn't, it wouldn't be able to rewrite a packet coming from the outside and send it on to the appropriate internal host.

So, if an outside entity knows that shared IP w.x.y.z did something, BT's NAT has to know which subscriber behind the NAT was responsible, because it would otherwise be incapable of correctly sending responses from the outside to that subscriber's internal IP.

Whether they retain this information as long as they do customIP information is unknown; but the address translation table must, for NAT to work, contain all the information needed to pin down a given activity to a given internal IP.

Re:On the other hand....

[Anonymous Coward]

That's why you have data retention laws.

username1, with internal ip 10.1.1.2 from udp port 12345 accessed via external ip 1.2.3.4 udp port 12345 destination ip 8.8.8.8 port 53

...for every connection, from anywhere to anywhere.

Re:On the other hand....

[Anonymous Coward]

Nope.... not remotely. Which is the whole problem.

Because if BT implements CGN, then the IP that somebody outside ot BT would have for somebody inside of it would actually map to a whole bunch of BT subscribers. BT has no possible way to tell which subscriber utilized the IP because all of them did... possibly even all at exactly the same time, unless BT maps every subscriber to a unique global IP anyways, at which point BT doesn't gain anything by using CGN at all.

Are you saying that CGN doesn't allow for an internal time stamped log of NAT assignments?

Re:On the other hand....

[petermgreen]

To track abuse reliablly from behind a NAT two things are required

1: the service being abused logs port number information as well as IP and time information
2: the NAT keeps sufficient logs to map that IP/port/time combination back to a user.

If the NAT keeps sufficient logs then in some cases item 1 may not be required, for example if the abused service can also provide the IP the abuse was received on then that is likely to narrow things down significantly.

Re:On the other hand....

[mark-t]

Except the time isn't known... Unless you can guarantee that the ISP and the destination clocks are synchronized to the second.

Re:On the other hand....

[bsdaemonaut]

The company requesting information would need to know the public facing source port and correlating time otherwise there would be no way to look up the correct state/mapping. The company requesting this information wouldn't be able to know this information unless the user was connecting directly to their servers or they themselves were playing man-in-the-middle. The former option is plausible with some activity, i.e. if a peer were directly connecting to them in a torrent, but the latter option would be illegal in most any situation I can think of. So while it still may be /possible/, it is definitely much more difficult nor am I convinced ISPs would be held to such exacting standards -- I run some relatively small routers by comparison, and at any point in time there can be thousands of (relatively short-lived) states, we're taking about some pretty massive amounts of data compared to what is required now.

Re:On the other hand....

[bsdaemonaut]

Sure, it's possible, but the company requesting NAT assignments would need to know the public facing source port which would only be possible if the user was connecting directly to the company requesting information. That is comparatively hard compared to requesting lists of ip addresses from a torrent tracker per say.

Re:On the other hand....

[mark-t]

So they are going to log every single udp packet or tcp session? It's one thing to maintain a list of states for any active connections... It's quite another to try to keep a log of every single one, because as each session ends, the port is recycled, and available for another connection. Take a wild guess how much storage an entire ISP would need to keep track of thir subscriber activities or just one week?

Re:On the other hand....

[grahamm]

All it means is that as well as quoting the IP address they will also have to quote the port number and an accurate time in order for the subscriber to be identified. It would also need the ISP to log the 4-tuple (Subscriber 'private' IP, External IP, External Port, TCP/UDP) for each connection as well as which private IP is allocated to each subscriber.

Re:On the other hand....

[BuGless]

NTP is your friend. man ntpd.

Re:On the other hand....

[BuGless]

NTP is your friend. man ntpd.

Re:On the other hand....

[Opportunist]

You say that like they cared.

The very definition of a copyright troll is that he doesn't care about petty things like "evidence". It runs along the lines of "Hey. You. Yes, you there with the face. Give us X money or we'll drag you to court. Yes, we know you didn't do anything wrong, but X money is still less than Y money, what it would cost you to be represented by a lawyer and so on. Well? Peace of mind for a few bucks or wasting time in a court room as the defendant, and EVERYONE will know. Now, which is it?"

Re:On the other hand....

[poetmatt]

noted and agreed, but then again it seems that they simply want to move forward with an obviously bad decision.

Re:On the other hand....

[DarkOx]

Yes this will log it. No its not a storage problem. Your typical F500 has probably as many users / devices as lot of ISPs have connected and trust me they log ever session.

Really
8 byte time stamp start,
8 byte time stamp end
4 byte origin src,
4 byte dst,
2 byte dst port
2 byte orign src port
2 byte src port,
4 byte src ( assumes pool could be a sing byte if its just an index into the pool)
1 byte for flags (tcp / udp, whatever else)

So 35 bytes per connection give or take depending on how you want to implement things. So you can store ~30 records per 1Kb. You don't store on a per udp packet basis. You make UDP have sessions. Basically you introduce a hold time. You only long the session when the hold time expires and you tear down the sessions.

Even if you have pretty chatty customers we are talking not more than a couple of gigs per hour. You keep a months worth on line or so and the rest goes off to cheap tape.

Re:On the other hand....

[AmiMoJo]

Sounds like BT wants people to perma-ban their entire customer base from large numbers of web sites. Multiple failed login attempts, abusive behaviour etc. It only takes one person to get the entire ISP blocked.

Re:On the other hand....

[Anonymous Coward]

This is exactly what will happen. Writing as AC on purpose. But I HAVE been subpoenaed by the FBI before to find out who was behind a specific IP address. Because we already NAT the vast majority of our customers behind an IP block, we have NO idea who "x.x.x.x using port y on date z/a/b" is. I couldn't tell you because there's hundreds of people it might be.

Every time I've had to respond to something like that and told them "Well, that IP is actually part of a pool that all of our customers share" the FBI has pretty much just gone "Welp, okay." and left us alone.

Re:On the other hand....

[Anonymous Coward]

Many Large Corporations may find that an acceptable tradeoff for:
1) P2P not working so well any more
2) People not being able to run their own servers so easily.

Where some see bug they see feature.

Re:On the other hand....

[mark-t]

Your notion of making UDP have sessions would make UDP even more unreliable than it currently is, as the remote device might see things coming from the same port as a previous recent UDP packet from the same sender, but the actual sender might have used two different (random) outgoing ports for each, so the NAT won't know which of the ports a UDP response needs to be sent to if it doesn't get the first reply before a second UDP packet is sent out. For protocols where how you process an incoming response to an outgoing packet does not affect what data you send in subsequent packets, it's almost a certainty that trying to attach sessions to UDP will lower its reliability by a factor of two.

Re:On the other hand....

[DarkOx]

I am fully aware of that actually, but in practice so are many applications these days. There are lots of NAT devices out there that do exactly this. Its why UDP hole punching techniques like STUN work in the first place.

I am not saying its a good thing. NAT breaks all kinds of protocols in all kinds of ways. Do think CGNAT implementation is going to do inspect to make traditional FTP work? My guess is no. I am sure customers trying to connect to remote servers that can't / won't do PASV will just be SOL. CGNAT will suck for end users in lots of ways but that suckiness is not going to take back seat to the accountability big ISPs need. "Sorry we can't tell you which of our customers was DOSing because they used udp"? Not going to fly because what is the remote site operator going to do? Null route the ISP that's what, and that screw over their other customers.

Its going to be ugly no matter what but I hardly think imposing sessions on udp is even half so invasive as all the other inspect type crap its going take to make popular apps work. Stuff is going be broken in subtle ways all over the place and it will be hell to figure out why.

Re:On the other hand....

[Anonymous Coward]

If I were on a jury, I wouldn't convict someone on this kind of convoluted trash. Would you?

Re:On the other hand....

[XXeR]

NTP is your friend. man ntpd.

Most people here know what NTP is (no need to point to man..), and it's safe to assume BT's network devices all use it. The problem is, MANY destinations don't run it, or run it improperly (I can't count the amount of times I've seen 'ntpdate' in a cronjob instead of running ntpd). And unless they're in perfect sync with BT, then cross referencing will still be difficult (assuming the destination is getting a sizable amount of diverse traffic from BT customers behind the same NAT'd address).

Re:On the other hand....

[kasperd]

and those people outside can't do anything useful with the IP that they have.

Might this mean we'd soon see an identd variant designed for helping with this issue?

BT Statement:

[Anonymous Coward]

"Yeah, so, like we cba to implement this IPv6 thingamajiggy. Thought you might like some NATs instead though? It sounds like "cats" Cats are good. So we're all good now?"

Re:BT Statement:

[Anonymous Coward]

Who says cats are good?

Fine for most casual types

[Anonymous Coward]

For most casual users of the web, it is fine.
But for people that actually use the internet beyond the web, it is a god damn nightmare.

Pretty soon you can expect to see internet-facing IPs carry a huge premium. It is going to suck.
Do what you can, implement IPv6 encrypted mesh networking for your town and get people off the general internet. Most people just talk to their friends on facebook.
Kill the facebook, make your own mesh social network, save the internet.
There are many DIY mesh networking implementations. The only problem will be ISPs differ in how they allow you to use their connections. (most ban you from making servers but people do it anyway)
Some ISPs will disallow you to re-broadcast your connection on a large scale, even if it is free and a large package you bought.
You'd likely need to pay them a premium on your end. So don't do it if you are clueless about this.

Also, I hope they put more mobiles behind these. Mobile users should already be on IPv6 as it is and be put through an IPv4 tunnel if they need v4 resources.
All games on them are casual multiplayer anyway, unless it is local play. And that is about the only thing of worth to these people that will be impacted.

CG NAT is not new!

[Anonymous Coward]

Odds are you've already been subjected to CG NAT -- especially if you have a wireless contract or are using some cheap DSL reseller. Check you're "public" IP address - if you're in the RFC 1918 or RFC 6598 IP ranges (10/8, 172.16/12, 192.168/16 or 100.64/10) you're being NAT'ed.

Re:CG NAT is not new!

[Anonymous Coward]

Are you fucking stupid? We're talking about NAT at the ISP, not your fucking local firewall.

Re:CG NAT is not new!

[compro01]

Your cell carrier doesn't count as an ISP for your smartphone? You don't get a publicly routable address on any cell network I've used.

Re:CG NAT is not new!

[petermgreen]

Mobile providers have been doing it for ages but at least here in the UK fixed line providers generally haven't.

Re:CG NAT is not new!

[znark]

Your cell carrier doesn't count as an ISP for your smartphone? You don't get a publicly routable address on any cell network I've used.

At least Saunalahti in Finland offers publicly routable IPv4 addresses to their mobile customers. You have to activate the feature in the self-service portal and use the correct APN so generally only those who know what they're doing would do it, but it is all documented on their website. The feature is free of charge.

Re:CG NAT is not new!

[Anonymous Coward]

He's not but you are.

When my father-in-law had Verizon DSL, the IP address VERIZON GAVE HIM was a 192.168 number

No choice

[markus_baertschi]

The carrier has probably no choice. He can no longer get IPv4 addresses for new customers, so either he refuses customers or uses NAT to map multiple customers on the same IP.

On the other hand, the average Joe customer will not see the difference. He can surf as before and all his apps will work as before. Some apps (mostly p2p stuff) will suffer, but most internet user don't use those.

If you as customer do need a 'real' IP, then there always is the option to get a more expensive option.

Re:No choice

[Anonymous Coward]

A whole lot of internet users do use p2p. Programs like skype have a good bit of p2p, torrents are pretty popular, for lots of things, wow patches with p2p and many other things. Honestly, the only right way of doing things in having the whole internet move to ipv6

Re:No choice

[Anonymous Coward]

The carrier has probably no choice. He can no longer get IPv4 addresses for new customers, so either he refuses customers or implements IPv6 with 6to4 proxying for all new customers.

On the other hand, the average Joe customer will not see the difference. He can surf as before and all his apps will work as before. Some apps (mostly p2p stuff) will be easier to configure than before, but most internet user don't use those.

If you as customer do need a version 4 IP, then there always is the option to get a more expensive option.

FTFY

Re:No choice

[bill_mcgonigle]

If you as customer do need a 'real' IP, then there always is the option to get a more expensive option.

There's no real need to upcharge either - customers who are negatively affected could simply be placed on a 1:1 list, and everybody else would continue to share the pool.

But maybe they can trade the retirement system free phone service in exchange for their /8 instead.

Re:No choice

[AmiMoJo]

Oh they can get more IPv4 addresses if they want. They are simply not willing to pay the asking price for them.

It's greed all the way. Save a few quid by screwing your customers and hoping somehow they either won't notice or you can blame all the problems on "badly coded web sites".

Re:No choice

[Hatta]

The carrier has probably no choice. He can no longer get IPv4 addresses for new customers, so either he refuses customers or uses NAT to map multiple customers on the same IP.

The carrier has the choice to implement ipv6. Run ipv6 natively, and tunnel ipv4 traffic.

Re:No choice

[Anonymous Coward]

All European and US carriers have been very busy finding justifiable uses for huge amounts of IPv4 address space. It is indeed a matter of maximizing profit. Sitting on a resource when it becomes scarce is the best that can happen to any businessman. Consider this: If you can upgrade for a price, then obviously there is address space which can be allocated to you, so your assessment, that the ISP has no choice, must be wrong. The only way to break this exploitative business model is to make IPv4 worthless by moving to IPv6.

Re:No choice

[MrL0G1C]

Not just file-sharing.

Try posting a message on a forum, you won't be able to because your IP address will be banned, because one person in thousands said something someone didn't like.

A good VPN nicely bypasses all this kind of crap.

Re:No choice

[Anonymous Coward]

Just pointing out that BT stands for British Telecom; i.e. the original monopoly holder on comms in the UK, and one of, if not the biggest ISP. So it's not some 2nd rate Mom and Pop ISP (well, depends who you speak to!)

Re:No choice

[markus_baertschi]

>Oh they can get more IPv4 addresses if they want. They are simply not willing to pay the asking price for them.

No. He will have to pass the additional cost of the IP addresses to its customers. And those customers are not ready to pay the price. They prefer a cheaper, but crappier service, otherwise the'll upgrade or switch to another more expensive carrier with real IP addresses.

Re:No choice

[markus_baertschi]

>The carrier has the choice to implement ipv6. Run ipv6 natively, and tunnel ipv4 traffic.

I don't think this will solve the problem. In the end, even if tunneling, some applications expect to see an IP per end-user. So the carrier still has to expose a dedicated IPv4 address per customer to the internet.

Ahh yes.....

[Anonymous Coward]

A step back for the Internet. Perhaps if ISP's actually took some of their huge profits and started implementing IPV6 instead of bending over for their shareholders, the world would be a better place.

and a 1000 nerds cry out

[Anonymous Coward]

Why not at least implement ip6 and make the cgnat 6to4? O.o

Re:and a 1000 nerds cry out

[chromaexcursion]

The story actually implies that this is on their roadmap.

A considerable part of the problem is that many new devices are not IPv6 compatible, some sort of NAT is required.
New devices aside, the world is full of older IPv4 only devices.

Need some explanation here...

[Pollux]

Over the last eight years and my previous three ISPs, my router has never once received anything other than a 192.168.x.x or a 10.x.x.x IP address from my local ISP. Not once have I received a live & legit IPv4 address. I have to pay a lot more for those. What's the difference between this and CGNAT?

Re:Need some explanation here...

[Imagix]

Odd.. every ISP that I've had gives out public IPs. Now, they're only willing to give you 2 usually, but they're proper public IPs. I'm not counting visiting hotels and such.

Re:Need some explanation here...

[GrandCow]

Over the last eight years and my previous three ISPs, my router has never once received anything other than a 192.168.x.x or a 10.x.x.x IP address from my local ISP. Not once have I received a live & legit IPv4 address. I have to pay a lot more for those. What's the difference between this and CGNAT?

You are thinking of your routers internal address, the one you use to access it from inside your home network to configure and troubleshoot. They are talking about the routers external address, the one the rest of the internet sees.

Re:Need some explanation here...

[Anonymous Coward]

It's a much larger scale. Private citizens don't tend to use all of their bandwidth constantly, meaning the total load can be averaged out. Businesses, on the other hand, have heavier loads and fear they could lose customers if, due to this setup, they were isolated from said customers.

In otherwords - current NAT only risks a small area each time, CGNAT could risk entire countries internet accessibility.

Re:Need some explanation here...

[Anonymous Coward]

Google "what is my ip".

Re:Need some explanation here...

[L4t3r4lu5]

CGNAT is NAT for your external IP address. Your router will assign private network IP addresses so your devices on your internal network, but the external interface on your router will have a publically addressable IP address assigned by the pool allocated to your ISP. Depending on their size, they may have a pool of tens of thousands or millions of addresses to assign, but you definitely got one even if you didn't know it.

Head on over to http://whatismyipaddress.com/ to find out.

Re:Need some explanation here...

[department_g33k]

You're probably plugging into the inside of your ISP's CPE (Customer Premise Equipment) Modem/Firewall/Router combo. If you log into THAT device and put it into "Bridge Mode" you should get a public IP. But basically, you're double NAT'ed otherwise. Only difference between this and CGNAT is that the IP your ISP gave your modem isn't shared by dozens of other people.

Re:Need some explanation here...

[Anonymous Coward]

if true that is beyond absurd. those addresses can not be routed on the public net (as per rfc1918).

i guess an ISP could give that address if they were modifying the packets on their end with NAT before it leaves their internal network destined for the public net, but i find it really hard to believe any ISP does that. it would be the internet equivalent of a penny in the fuse box.

Re:Need some explanation here...

[wagnerrp]

It's still technically NAT, because your modem is having it's external address translated to an internet addressable address on the ISP's side. The difference is that what you are seeing is a one-to-one translation with direct passthrough of all traffic. CGNAT typically refers to a one-to-many translation, where multiple subscribers are tied to a single address, and there is no inbound traffic.

Re:Need some explanation here...

[Anonymous Coward]

No, those are not the addresses that your ISP gave your router. Those are local network addresses which have nothing to do with your IP - your router invents them and hands them out to nodes on your network.

To see your public IP address visit http://www.whatsmyip.org/

Re:Need some explanation here...

[yet another SanTiago]

It is probably the same. Small wireless ISPs use Linux/PC-based ISP-wide 1:N NATs for years, they just don't call that CGNAT.

Main difference between NAT and CGNAT is that you buy CGNAT from Cisco ;-) .

Shouldn't be doing anything on the open net anyway

[Greyfox]

It's pretty easy to set up a node on Tor. We could just declare the "open internet" lost to commercial interests and do all the "interesting" stuff on an encrypted network. Sure, it's slower than an open connection, but with increasingly common cable and optical connections it's still faster than even reasonably fast DSL from a couple years back.

I've had to deal with this.

[Gerafin]

Having to share an IP address with tons of people is absolutely, 100% a crippling experience. There are plenty of sites (newspapers, the site I get textures from, RapidShare, etc.) who limit their services by IP address. There's nothing quite like seeing messages about how your IP has exceeded the download limit on a website you've never visited before. Also: having to deal with bans when playing online games, as many are IP-based. The impossibility of hosting your own servers for games or other purposes. BitTorrent is nigh unusable. I would not pay a dime for this kind of a service, ever again.

Re:I've had to deal with this.

[VortexCortex]

Having to share an IP address with tons of people is absolutely, 100% a crippling experience. There are plenty of sites (newspapers, the site I get textures from, RapidShare, etc.) who limit their services by IP address. There's nothing quite like seeing messages about how your IP has exceeded the download limit on a website you've never visited before. Also: having to deal with bans when playing online games, as many are IP-based. The impossibility of hosting your own servers for games or other purposes. BitTorrent is nigh unusable. I would not pay a dime for this kind of a service, ever again.

And I shouldn't have to try and figure out some way to make my client and server software work around the crappy service either. I'm fully capable of using other types of fingerprinting (though they're spoofable to a large degree) in order to make quotas and bans stick (and secure your connection). However, I'm not EVER going to go out of my way to make IP level NAT more easy to digest -- (port based NAT in home routers is a whole different ballgame). If that means you get shitty issues when you use the shitty service, then those issues are incentive to "upgrade"; It is good for you, and me, and everyone that crap actually stinks.

I apologize to folks who have no other available options, but I don't make decisions based on the outliers in a graph, that way lies pain. My fear is that by placating the users of these "Option 1" "Carrier Grade" NAT I'll forever pave the way to ruin for everyone else; Essentially diverting my money into BTs pockets in the form of funneling traffic through servers needlessly (TURN instead of P2P), and development time to make the kludge ridden workaround code. I already did this shit once with "firewall" port punching because of the home routers (ISPs not giving you an IP for each device), and Look how that shit turned out: We're stuck with the damn things and to this day have to waste cycles and bandwidth negotiating with a 3rd party server just to do VOIP / online games, sync a backup of all the family's files in a private cloud store, etc. I am NOT doing it again. Complain incessantly to the ISP if they heap this crap on you, do not settle for less features for more money. They take your money, IPv6 adoption is the cost of doing business they're been trying to put off on everyone else, ever since they found out it was coming many YEARS ago, and the cost to serve traffic has gone down while their prices have gone the other direction... If the rate hike vs cost is NOT getting you upgraded service, then I can't be fucked to care.

Re:I've had to deal with this.

[uncqual]

There are plenty of sites (newspapers, the site I get textures from, RapidShare, etc.) who limit their services by IP address. There's nothing quite like seeing messages about how your IP has exceeded the download limit on a website you've never visited before.

My cable ISP (one of the big names) doesn't give static IP addresses with their standard consumer packages and, AFAIK, never has. You can buy higher end packages which do include static IP address(es), but most people don't select these. My IP address doesn't change often, but it does from time-to-time without advance notice. So, some of the things you describe are already a reality by your definition for a lot of consumers in the United States.

Mostly, implementation of CGN might force sloppy providers who do things like prevent downloads based on load by IP address or check licensing based on IP address to get their act together as, in most cases, this hasn't worked well for years for so many reasons in the consumer market. So, adoption of CGN by a major carrier, as long as you don't use that carrier, may have an upside to the community as a whole.

Previously, did BT provide life-long static IP addresses for the tier of customers they are converting to CGN? I doubt it.

Re:I've had to deal with this.

[Anonymous Coward]

Once people switch to IPv6, you'll have just as many problems with systems based upon IP address. With IPv6 for now, you can always get another address.

Re:I've had to deal with this.

[Anonymous Coward]

I see where you're coming from, but I think you missed his point. It's not that the dynamic IP is changing frequently (here we pay extra for statics), rather it's that because the IP is shared, the servers consider it as one person instead of the reality of it being multiple.

Imagine a nice feast laid out in a big room for you and your family. Your sister goes in, everyone else gets stopped since, hey, you all (originally) go by the same surname and it must be fine since there can't be any sharing of the food.

Re:I've had to deal with this.

[Anonymous Coward]

DDOS bot clients will be both your neighbors and your problem.

Re:I've had to deal with this.

[wagnerrp]

That's not the point. He's referring to false positives, and users being unable to access resources because their neighbor used it all up, or got their shared address banned.

Re:I've had to deal with this.

[uncqual]

But, esp. w/the case where the server limits by IP address (based, I assume, on some sort of subscription), dynamic IP addresses have the same problems, just that we don't notice them as often as we would with CGN. For the "excessive load from host" case, if the person assigned to your new dynamic IP address this morning was banned from site X, you are suddenly banned when you get that IP address - with CGN the window is smaller and overlapping, but that just points out the flaw in such strategies.

What do you mean IPv6 isn't implemented

[Anonymous Coward]

Every freaking network stack in existence is updated to IPv6, it's just the carriers that refuse to turn it on!

Re:What do you mean IPv6 isn't implemented

[wagnerrp]

Tons of people still use WinXP that has no functional IPv6 stack. Tons of people use old consumer modems and routers that have no IPv6 stack. Even many new modems and routers don't come with IPv6 capability. Was this poor planning on the part of ISPs, and entirely their fault? Abso-fucking-lutely!

Re:What do you mean IPv6 isn't implemented

[Anonymous Coward]

Are you saying that turning on IPv6 turns off IPv4?

Re:What do you mean IPv6 isn't implemented

[wagnerrp]

No. I'm saying plenty of consumers are running software and/or hardware that can't even use IPv6. While enabling IPv6, so those that can use it can do so and relinquish their IPv4 address, will go a long way towards relieving the pressure on ISPs, that's considerably different from saying everyone has already updated.

At least they're being honest...

[rodrigoandrade]

And letting us know from the get go.

How many unscrupulous ISPs could be doing this behind closed doors right now without anyone noticing??

Re:At least they're being honest...

[green1]

Almost none. That's the point. Carrier grade NAT is not one of those things you can possibly implement without anyone noticing. Sure you'll find that many people don't notice, but some people always will. Anyone who uses any P2P technology will notice. Anyone with any tech knowledge will notice.

Which would be more evil?

[chromaexcursion]

If BT required all devices on it's network to be IPv6 compliant, many existing in use devices would cease to function.
If BT said you MUST replace your working, but not IPv6 compliant device there would be an even louder cry of EVIL!

The situation is not very good, but there aren't any alternatives.
This is like politics. It's not about choosing the better choice, but the less evil one.

Re:Which would be more evil?

[wagnerrp]

Those that could convert to IPv6 would do so, freeing up IPv4 space for those that could not.

Re:Which would be more evil?

[tepples]

Those who convert to IPv6 would still need to communicate with IPv4-only hosts.

Re:Which would be more evil?

[wagnerrp]

A significant portion of the web has already transitioned over to IPv6, and the remainder could be accessed through NAT. At that point, any difficulty due to IP collisions is not the ISPs fault, and it shifts the onus to those straggling websites and servers to upgrade.

Re:Which would be more evil?

[clarkn0va]

If BT said you MUST replace your working, but not IPv6 compliant device there would be an even louder cry of EVIL!

I quite doubt that. The average consumer is used to being told that he has to upgrade. There might be the odd muttering of "money grubbing" and the like, but at the worst, it would go over like every other forced upgrade.

In reality, however, Joe average will take this information to his maven friends (like the folks who talk about this kind of thing on /.), who will assure Joe that IPv6 migration is in fact a good thing that is long overdue, that most consumer routers support it by now, and he should be grateful to have an excuse to upgrade his $50 home router to something that will allow him to use the internet to its intended potential. Joe will be happy with this advice and go spend the money on the new router and not think of it again.

Re:Which would be more evil?

[jimicus]

Those that could convert to IPv6 would do so, freeing up IPv4 space for those that could not.

BT provide routers to their customers; I imagine the great majority are still on the BT-provided router.

AFAIK, BT have yet to provide an IPv6-capable router.

Verizon isn't much better

[zerofoo]

Verizon started field testing IPv6 on their FIOS network in 2010. I figured it's 2013 - they should be done testing by now.

I called our business services rep about a month ago and asked about IPv6 service for our FIOS connections at our offices.

The rep's response:

"IPv6, what's that?" "Hold on. Let me ask my support engineer."

Support engineer's response:

"IPv6 - What's that?"

I may retire from the IT business before Verizon deploys IPv6.

-ted

Re:Verizon isn't much better

[NJRoadfan]

A shame because Fios itself is a "new" network. They could have implemented IPv6 from the start of Fios deployment back in 2005.

Re:Verizon isn't much better

[Anonymous Coward]

My brain just melted a bit.

What's the BFD with not doing v6

[Anonymous Coward]

I know people fear change and all, but at this point, what's the BFD here? Why can't we just start rolling out v6, it seems like a reasonable solution? This is not a rhetorical question. Does anyone know what is taking so damn long? At this point, if we let the legacy crap keep holding up the change we're never going to get there.

At some point you just have to rip the bandaid off and go.

Re:What's the BFD with not doing v6

[Chris Mattern]

I can answer that question with another one: How is the ISP going to make more money with IPv6? If it's supposed to get them customers, they need to explain clearly why they're better with IPv6 to the 99% of the customer base that doesn't even know what an IP address is. It's a chicken-and-egg problem--IPv6 won't be clearly superior to the end user until most of the Internet is on it, and most of the Internet won't be on IPv6 until it's clearly superior to the end user. Nobody wants to go first and lay the groundwork for no good advantage. Let somebody else do it first; when a lot of other people are on IPv6, then we'll have a reason to move. When ISPs look at IPv6, they see a large investment of time, money and expertise that doesn't really have any convincing prospect of making them money back.

Re:What's the BFD with not doing v6

[JDG1980]

Well, part of the problem is that there are still routers being sold today that don't support IPv6.

You'll need a regulatory push to get to IPv6. The digital TV transition in the US didn't happen because people gradually migrated off of analog, it happened because the government said 'after this date, analog TV goes dark'.

Re:What's the BFD with not doing v6

[Anonymous Coward]

Pretty much every modem / router we've sold in the last 6 months has some level of ipv6 support. The first ones from d-link only supported ipv6 over ppp but now even the cheapest tp-link ones on our shelves support it via ppp and 6rd. Shame there's only one ISP in Australia that officially offers ipv6 on their residential packages.

Carrier grade nat may suck but combine it with a working routed ipv6 address and the BitTorrent users will drive adoption fairly quickly. A lot of them don't understand the technology but will happily buy a new modem if it means they can download movies.

Re:What's the BFD with not doing v6

[DigiShaman]

You wont need a regulatory push to IPv6. While yes, it would help considerably in terms of providing a unified industry focus, it may not be required at all in fact. So now you're waiting for the other shoe to drop, yes? Mobile phones. It will be the cellular industry that will push IPv6 as they're already using GGNAT anyways (which is why PPTP works half the time for air-cards due to GRE getting borked). Mobile phones already rely on cloud based applications and e-mail anyways. So it's trivial for the likes of Google, Microsoft, and Apple to implement IPv6 on their end anyways. I can only imagine China Telecom having a serious interest in getting deployed ASAP with an ever increasing mobile phone usage rate (thanks to their growing economy). Most major ISPs are already in an IPv6 deployment phase anyways, and consume WiFi routers are now being sold to support IPv6 too. So with the moment getting started, the adoption rate will explode with exponential growth.

No ipv6 for you

[sl4shd0rk]

"Limiting what customers can do..." seems to be the new norm... along with with "shut up. give up rights. sign EULA"

Re:No ipv6 for you

[Anonymous Coward]

Thatcherites wouldn't have it any other way.

CGNAT has nothing to do with End-to-end

[bgt421]

The end-to-end principle has to do with where network logic is placed, not which devices are reachable, routeable, or have an IP address. As simply as possible, the end-to-end principle means that we should have smart end hosts and a dumb network. This is why routers don't guarantee packet delivery -- its up to the hosts (with TCP, et al.) to ensure this. This is in contrast to telephony networks, where the network is responsible for almost everything.

There are good reasons to oppose CGNAT, but the "end to end principle" is not one of them.

http://en.wikipedia.org/wiki/End-to-end_principle
or, if you're inclined to primary sources:
http://groups.csail.mit.edu/ana/Publications/PubPDFs/End-to-End%20Arguments%20in%20System%20Design.pdf

Re:CGNAT has nothing to do with End-to-end

[Anonymous Coward]

The end-to-end principle has to do with where network logic is placed, not which devices are reachable, routeable, or have an IP address. As simply as possible, the end-to-end principle means that we should have smart end hosts and a dumb network.

CGNAT is a (pseudo) smart network so it is a violation of end-to-end.

Re:CGNAT has nothing to do with End-to-end

[Anonymous Coward]

Um, try that again. How is the horribly complicated CGNAT router, sat in the middle of the network, not breaking the end-to-end principle?

Packets arrive, and instead of just going "Yup, that's for 1.2.3.4, I should send that over toward 1.2.3.4" the CGNAT device goes "Oh, 1.2.3.4? Let's see, this looks like UDP traffic, with the port set to 7458, in my table there was last a packet sent from 1.2.3.4 with that port 18 seconds ago, and it was NAT'd from 5.6.7.8 port 11960, so I guess I'll rewrite this incoming packet to adjust those fields and then forward it to 5.6.7.8, then I'll update the last used timer to now.."

Yeah, that looks exactly like the dumb network of end-to-end networking, NOT

Re:CGNAT has nothing to do with End-to-end

[Anonymous Coward]

There are good reasons to oppose CGNAT, but the "end to end principle" is not one of them.

I beg to differ. If I want to talk to one end of the end to end, and I send a packet the machine's address (i.e. IP address:port) in order to communicate with it and it then fails because that IP address is shared among multiple machines and I end up talking to a completely different machine, then yes the end to end principle was just horribly violated (much like what my endless sentence just did to the English language).

Thank you CGNAT.

If people had put more thought into the transition

[Marrow]

we would be done by now. They should have written an extension, not a replacement.

His router would not be flopping around

[Marrow]

between 192.168 and 10.0.

Re:His router would not be flopping around

[GrandCow]

between 192.168 and 10.0.

He said he'd gone through 3 different ISP's over eight years.

Re:His router would not be flopping around

[Anonymous Coward]

Exactly! and since he'd use the same router with all the ISPs, his internal network would remain unchanged -- the router's internal IP would still be (let's say) 192.168.35.1, and only the external one would change. Ergo, your assertion that he's talking about his internal address is rubbish, which was GP (Marrow)'s point.

He's probably using small-time 802.11 WISPs and such, many of them do NAT all their customers (at least by default, at cheap prices). Ditto for cellular internet.

21CN

[TinheadNed]

Apropos of nothing, here's what BT did invest in for their "21st Century Network".

It's all IPv4.

Cant they just assign a port number range

[Marrow]

Your src port will always be from x-y on this outgoing IP address. Instead of spreading the users out horizontally by IP address, they could stack them vertically by port number.

BT Don't change...

[Anonymous Coward]

Well, I see they still love just fobbing people off..... Can't give me a straight answer...

This is after I was told to call Broadband Customer Secutiyu....

BT: well at this point of time there is no team who can actually give you this information as this information has not yet rolled out within BT desk
BT: and we do not have any updates about this

COME ON BT: We aren't all idiots

I pay $5/month for a fixed external IP.

[Anonymous Coward]

That's from our local wireless internet provider. That's in a major US east-coast city.

Re:Shouldn't be doing anything on the open net any

[wagnerrp]

Or you know, just use one of the many IPv6 tunneling mechanisms. The issue is that many of those mechanisms use IP protocol 41, and many ISPs, modems, and routers filter out non-standard protocol traffic.

BT and its customer

[multi io]

BT Retail has started testing Carrier Grade NAT (CGNAT) with its customer.

Has the customer been informed already? How does he or she take it?

Re:BT and its customer

[Anonymous Coward]

Not explicitly. Up the ass.

What's next?

[justthinkit]

Sharing an IP address? What's next, sharing a desk?

This kills TOR, right?

[BenEnglishAtHome]

If so, it's a total non-starter with me.

Re:This kills TOR, right?

[wagnerrp]

No. It merely means people sitting on CGNAT cannot function as nodes, and that only applies to TOR in its current form. TOR could be re-implemented in UDP, using a third party to synchronize two nodes. In such a setup, only that third party would need to be globally accessible, of course it would also limit the security of the system as the routing data would be more readily available to someone hosting one of these nodes.

Re:If people had put more thought into the transit

[pe1rxq]

And how would you 'extend' ipv4 without ending up with essentially all the same problems?

Goldline

[tepples]

It is not a status symbol because it is rare or uncommon -- it is a status symbol because De Beers adverised it... as a brand! "Diamonds are Forever"???? Have you ever seen anybody advertising a commodity before? "Gold is Forever", anybody?

Glenn Beck's darling Goldline and a lot of other gold retailers promote a commodity to people who are afraid of a coming crash of a major currency.

www.sixxs.net appears to be under attack

[tepples]

There are already ISPs which supply IPv6. The SixXS FAQ lists [...] 14 in the USA.

The two major ISPs in Fort Wayne, Indiana, are Comcast and Frontier. I tried to read the SixXS FAQ to see if either of these was among these 14, but all I got was this:

This Connection is Untrusted

You have asked Firefox to connect securely to www.sixxs.net, but we can't confirm that your connection is secure.

Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

What Should I Do?

If you usually connect to this site without problems, this error could mean that someone is trying to impersonate the site, and you shouldn't continue.

Technical Details

www.sixxs.net uses an invalid security certificate.

The certificate is not trusted because no issuer chain was provided.

(Error code: sec_error_unknown_issuer)

Re:www.sixxs.net appears to be under attack

[sl3xd]

Have you, by any chance, imported the CAcert.org root certificate(s)?

I don't recall if CAcert.org is included in by default... I'm thinking not.

If you had trouble figuring out the certificate was signed by CAcert.org, nor do you know who CAcert.org is or the X.509 CA racket in general, I'd suggest you just wait for your ISP to do everything for you.

Comcast is currently deploying IPv6. A few news items down, they state: IPv6 has been launched on all Arris DOCSIS 3.0 C4 CMTSes, covering over 50% our network. We are targeting completion of the rest of the network by mid-2013.

Users behind CGNAT will switch to apps that work

[tepples]

Then users behind CGNAT will switch from applications that don't work (those that use a peer-to-peer topology) to applications that do work (those that use a server to forward everything).

OK, I need explanation here.

[Anonymous Coward]

"ISPs say they are forced to use it because IPv4 addresses are running out, and IPv6 is not widely implemented."

Aren't ISP's supposed to be the ones implementing IPv6? My ISP doesn't and I therefore cannot use IPv6 to connect to it.

Re:If people had put more thought into the transit

[petermgreen]

Actually I think all we really needed was a transition mechanism that went with the flow of NAT e.g.

1: for each IPv4 address and UDP port combination an IPv6 address would be allocated.
2: IPv6 packets passing over legacy infrastructure would be encapsulated in a UDP packet. An anycast address would be created to represent IPv6 addresses with no IPv4 equivilent.
3: if a NAT changed the IPv4 address or UDP port of a packet containing an encapsulated IPv6 packet then the IPv6 addresses of the packet inside would be updated to match

With this system the end systems and internet core would need to be updated, but the rest of the existing infrastructure could be left in place.

But i'm just a nobody. Those with power over the stamdards process were on a crusade against NAT so such a system would be unthinkable to them and the transition mechanisms we got either ignored NAT (6to4) or fought it (teredo). Worse still ISPs didn't take either of those transition mechanisms seriously meaning that connectivity between users of transition mechanisms and users of native IPv6 has been poor.

Tailgating law caps each lane at 30 cars/min

[tepples]

So will doubling the speed of the cars.

Doubling the speed of the cars doesn't double the capacity in cars per hour. Traffic laws that ban following too closely or "tailgating" appear to define the crime based on a two-second minimum time between vehicles. This leaves 30 vehicle slots per minute.

Or adding lanes.

Which makes it more difficult to get from the lane where you turn on into the lane where you turn off. Each vehicle changing lanes occupies two lanes, and if the driver has to slow down to find a gap in the other lane, it occupies more of the 30 vehicle slots per minute.

But carpooling isn't a solution unless two people are coming from the same place and going to the same place.

That's why city bus systems have transfer stations downtown. People coming from places along one route take the bus downtown and transfer to another bus that goes by the destination.

The Internet is not a truck.

[tepples]

Just think, if every other packet were concatenated on the previous one, there would be half as many packets, and that would double the capacity of the routers.

Waiting until enough packets arrive to fill a "truck" to get to the next hop would add a boatload of latency. That's why the Internet isn't a truck; it's a series of tubes. Packet goes in one end of a tube; packet comes out the other end.

in case you're not familiar, the consequences are:

[slashmydots]

Everyone using it just got banned from everything everywhere. Everyone is behind one giant router that assigns sub-IPs privately but to the open internet, you're all on the same IP address. So one of those thousands people starts ranting on a forum, you're all IP-banned from it since you're all on the same IP. If you've ever used a common proxy or TOR exit node, you'll notice you're basically banned from everything everywhere. That's exactly what will happen here.

Days since August 31, 1993

[tepples]

Bookmark this link or this link to find the current day of September 1993.

Wireless doesn't always mean WLAN

[tepples]

Odds are you've already been subjected to CG NAT -- especially if you have a wireless contract

Are you fucking stupid? We're talking about NAT at the ISP, not your fucking local firewall.

"Wireless" doesn't necessarily mean wireless local area network technologies such as the 802.11 family. It can also mean technologies associated with cellular carriers, such as CDMA2000, UMTS, WiMAX, or LTE. These have been known to provide only a Private Internets (RFC 1918) address to each customer and use NAT to connect the internal network to the global Internet.

And could you please tone down your F-words?

Re:Shouldn't be doing anything on the open net any

[fisted]

Hows this even remotely related to the actual issues which come with NAT?

CAcert audit

[tepples]

Have you, by any chance, imported the CAcert.org root certificate(s)?

I happen to have not. Where should I check for information on the progress of the audit of CAcert?

Re:CAcert audit

[X0563511]

Maybe you should go learn what CAcert is, before holding your breath for an audit that would be meaningless.

Re:CAcert audit

[tepples]

So what's the point of using CAcert for a public web site if it'd never pass the accountability standards of one of the most widely used web browsers?

Re:CAcert audit

[X0563511]

You can't audit a web of trust like you would audit a centralized authority.

CAcert is a bandaid on a broken system. It works, but it doesn't "fit."

Re:CAcert audit

[sl3xd]

Just a thought:

The prominent voices in defining the requirements of a "CA Audit" are the CA's, and they have something to sell...

It's in their interest to eliminate competition.

It has nothing to do with trust, and everything to do with money.

BT no longer an ISP

[Anonymous Coward]

With this move, BT will cease to be an ISP, and its customers will not actually be paying for internet service.

No, logging is built-in and fairly easy.

[Moskit]

They easily can, translations are logged as is required by law in many countries.

CGN implementations provide for this in many forms, ranging from syslog (poor scalability) to netflow (pretty much industry standard for getting traffic info and logging it).

No, the wrong choice...

[Burz]

Choosing between static IP or NAT is 1993 thinking: The former enhances surveillance and the latter degrades connectivity options (esp. for anything that isn't strictly a client).

The debate should really be about whether IP+DNS is an outdated form of addressing. IMO, they cannot be made consistently loyal to their users' interests (they are subject to tampering and exploits) so they should be -- if not retired -- then demoted in such a way that they matter only on a minute-by-minute basis.

Tor and I2P have such a scheme. They are an extra layer between the network hardware and the application that implement cryptographically-based addressing that also form the basis for identity as well. The identity is the address, and its independant of hardware- and provider-based addressing. Having one's IP address shift from week to week poses no challenge for these anonymous networks. They both offer a better example of the marketing and politics at work in IP and DNS.

Re:Shouldn't be doing anything on the open net any

[Burz]

Hows this even remotely related to the actual issues which come with NAT?

With anonymous networks like Tor and I2P, you get a crypto-based identity that doubles as your network address. No one else can change it, and you can take it with you.

Load Balancers beware!

[JRHelgeson]

Many hosting providers have traffic load balancers that distribute traffic based upon source IP address (there is a better way to do this, but I'll get to that later). When traffic arrives it routes that traffic to a specific server. When you have a carrier that has thousands of customers all coming from 1 IP, the load balancer routes it to 1 server which quickly gets overwhelmed and either crashes or is just DoS'ed. Then it points it to the next server, then the next. Back in the early days of the internets - AOL pulled this stunt where entire regions would get nat'ed behind a firewall. It was very efficient in taking out online services.

Most load balancers will now look at the session cookie and load-balance off of that, as long as they are configured to work that way. As the practice of CGNAT (as they call it now) went away, I'm sure a number of hosting companies have gone to using source IP as a sufficient load balancing method. If so, we are sure to see these events happen again.

CGNat, double-NAT, "IPocalypse 20 months later"

[cas2000]

One of the most interesting talks at linux.conf.au this year was by Geoff Huston of APNIC (and with a long history of involvement in the internet in Australia), talking about IPv4 address exhaustion and IPv6 and Carrier Grade NAT (and why CGNAT sucks).

tl;d[wr] version: two of the main reasons why it sucks are a) it results in double-NAT when users have their own LANs and NAT devices behind a CGNAT connection and b) it's effectively a ways for a handful of major telcos around the world to gain control of the internet on their terms, just like in their Good Old Day (which is why they have little or no interest in IPv6).

CGNAT means getting the same kind of crappy barely-functional internet service on your landline (or wifi or satellite etc) broadband service as you get on a mobile phone.

Video here:

http://mirror.linux.org.au/linux.conf.au/2013/ogv/The_IPocalypse_20_months_later.ogv

LWN article about Geoff's talk here:

http://lwn.net/Articles/424696/

Re:If people had put more thought into the transit

[LordLimecat]

Add extra bits to the reserved fields, and have routers interpret them as tacked onto the first octet. Want to reach a new IP? Upgrade ur crap.

In all fairness to BT

[Anonymous Coward]

they do let you opt out.

Yet Mozilla Corp listens to these CAs

[tepples]

Yet Mozilla Corp listens to these CAs when the CAs set audit standards, and end users listen to Mozilla Corp. With which party should the solution start?

Re:Shouldn't be doing anything on the open net any

[fisted]

In a world where everyone and their mother actually uses TOR and I2P, that might be a viable solution.
In the real world, it solves none of the problems with ISP-level NAT, it rather creates an additional one on the TX path.

Re:Shouldn't be doing anything on the open net any

[Burz]

Hmmm...no.

Tor and I2P are each capable of sharing an IP address with multiples of themselves. I2P can also traverse a firewall-like NAT pretty easily (I'm not sure about Tor). You also cite a chicken-and-egg conundrum for Tor and I2P, but that's more of an IPv6 problem because end users have no say in whether they can use IPv6 with their ISPs.

The point is that overcoming ISP-level NAT is possible with some adjustment, using a layer that provides identity-style addressing. Like any big innovation, early adopters will have to flesh it out a bit first.

Re:in case you're not familiar, the consequences a

[Hognoxious]

This is because a large number of idiot sysadmins don't understand that 1 IP != 1 user (even without CGNAT).

Re:If people had put more thought into the transit

[Bengie]

Yes, lets put more load on the core for the sake of letting people be lazy and not upgrade. NAT isn't even a standard, it's a "implement how ever you want and hope your customer's don't complain".

IPv6 doesn't not pass over legacy, it gets routed to legacy. The core of the Internet has been IPv6 for the past 5+ years and a large portion of the Internet was IPv6 for the past decade.

ISPs are the ones who have been slow to upgrade, not the core, and ISPs are the ones that would have to upgrade to your new idea. See the problem? The people who are not adopting the upgrades are the ones you are targeting to upgrade.