Slashdot Mirror
Whatever Happened To the IPv4 Address Crisis?
alphadogg writes "In February 2011, the global Internet Assigned Numbers Authority (IANA) allocated the last blocks of IPv4 address space to the five regional Internet registries. At the time, experts warned that within months all available IPv4 addresses in the world would be distributed to ISPs. Soon after that, unless everyone upgraded to IPv6, the world would be facing a crisis that would hamper Internet connectivity for everyone. That crisis would be exacerbated by the skyrocketing demand for IP addresses due to a variety of factors: the Internet of Things (refrigerators needing their own IP address); wearables (watches and glasses demanding connectivity); BYOD (the explosion of mobile devices allowed to connect to the corporate network); and the increase in smartphone use in developing countries. So, here we are three years later and the American Registry for Internet Numbers is still doling out IPv4 addresses in the United States and Canada. Whatever happened to the IPv4 address crisis?"
While phones use Internet connectivity, they usually connect through the carrier infrastructure which may only allocate a few (or even 1) IPv4 addresses, thanks to NAT.
Slashdot, fix the reply notifications... You won't get away with it...
When that particular comment was made, the ubiquity of the home router dolling out DHCP addresses probably wasn't considered. Nowadays, you only need one IP address for your home and let the router sort it out.
There's still a problem, but people seem to prefer to adapt and come up with (very) clever workarounds rather than get some new solution shoved down their throat that renders existing equipment obsolete for no good reason.
had to say that
Just a guess, but maybe widespread adoption of Carrier Grade NAT might have given IPv4 a bit of a longer shelf life. It's either that or the kind of fun and games that I once read that Hutchison (Orange) was doing on their mobile network, with no less than seven separate instances of the 10/8 network being juggled around at once.
Still, even ARIN is now starting to tighten the screws on the size of netblocks they are assigning out, so I suspect providers are being a lot more careful about how they subnet and assign out IP addresses than they used to be. I suspect that just moving stuff like DB servers and other backend infrastructure onto private IP space instead of just dumping them in the DMZ for convenience has helped a bit too, not too mention being a better security practice.
UNIX? They're not even circumcised! Savages!
Even through all addresses have been given out, there's still so much slack to shuffle things around in the IPv4 space. We will still go another good 10 years before moving into IPv6 in a large scale.
It's only a crisis if it affects you. (sic)
That's basically what is happening, a giant stand off between the access networks and the hosting providers looking who will blink first.
From then end user perspective, you should see what happens to Skype and games when both end-users are behind a double NAT, it's hilarious. But most people seem to cope just fine.
For the hosting providers then fun really starts when you can't get a public IPv4 for your new webserver, that'll be fun. There's no NAT workaround for that, some european hosting providers are already feeling the crunch in their IPv4 blocks, you can only host so many servers. So what can you do? Jack up the prices ofcourse, isn't the free market wonderful!
If you are a business in the EMEA and you still want or need your own PI space for BGP, tough cookies, you can't get it anymore.
IPv8.1
I guess enough people finally got around to reading it.
Strange women lying in ponds distributing swords is no basis for a system of government.
and figured out they better find a better solution than ipv6. There is too much ipv4 only hardware out there to abandon it all. It would just be insane.
Let's shitcan IPV6 right now, who needs it, because clearly because some people were concerned it's a reason to ignore it all now and keep using ipv4
Your analogy fails, because IPv6 brings extra functionality, including routing advantages. It's not just an attempt at dumbing down for MBAs and the unwashed masses.
While things have slowed down here the other regional IP registars have run out. APNIC and RIPE both have no IP addresses left. Arin has only about 1.4 /8's left.
That wasn't an analogy. That was sarcasm.
As a rock-in-roll Physicist once said, No matter where you go, there you are.
"Hey Joe, what's your IP address?"
"Oh, let me see... it's fe80:0:0:0:200:f8ff:fe21:67cf"
Holy crap that's long. The second IP addresses become this difficult to exchange verbally, we're going to stop referring to them altogether.
Unsurprisingly, address exhaustion still going on. APNIC and RIPE are down to their last /8 and are now handing out addresses as slowly as they can. ARIN and LACNIC will reach their last /8 this year. AFRINIC won't run out for years, so I suspect their new infrastructure will be built on IPv6. Here's the relevant data.
There's a finite number of addresses, guys. They're not going to magically stop running out.
Visit the
Less than two months after RIPE introduced rationing of IPv4 addresses, I one day found my internet connectivity to be totally broken. Turns out the ISP had turned on NAT in my modem (without telling me about it beforehand). They did have a self service page where I could turn NAT off again and get functional internet connectivity again. However some of my devices no longer received any reply from the DHCP server.
I called their support, who said the lack of reply from their DHCP server was due to the network interface on my computer being defective (which was obviously a lie). When I pointed out that their conclusion was directly contradicting the symptoms I had already explained them about, they just hanged up.
Calling their support one more time, I was able to get to a supporter who knew what was going on, and didn't just invent a lie. It turns out they had run out of IPv4 addresses, and were now enforcing a maximum of two devices online per customer regardless of what limit had been in effect previously.
A few days later I called them again asking for native IPv6, which I considered only fair, given that they had taken away some of the IPv4 addresses, which I were using. They promised me native IPv6 before the end of the year. That was in 2012, they still haven't delivered.
Other ISPs are putting all new customers behind CGN unless they pay an extra fee for a static IP address. You'd think they'd give you native IPv6 along with that. But alas, according to the majority of ISPs, there is no shortage of IPv4 addresses in this country, so nobody needs IPv6. And since nobody is buying IPv6 connectivity, the ISPs will not offer it (completely ignoring the fact, that the reason nobody is buying IPv6 connectivity is that the ISPs themselves aren't offering it in the first place).
From what I am told, native IPv6 plus CGN for IPv4 is already fairly common in Germany, but that's not enough to make me want to move across the border. I have yet to hear about ISPs putting customers who previously had a public IPv4 address behind NAT, but I would not be surprised if it happened.
Do you care about the security of your wireless mouse?
Google's statistics of IPv6 usage show a seemingly exponential increase, which is now up to 3%. It could be 10%, 20%, or 50% in 10 years' time. Countries like mine (the UK) need to wake the fuck up and start having major ISPs offer IPv6. It really sucks that so few do.
== Jez ==
Do you miss Firefox? Try Pale Moon.
Comcast brags (http://comcast6.net) that they are the largest ISP that supports ipv6. Oh wow, cool. I have a new modem that supports it as well as a home router.
So I go to figure out how to do it and find that they are only assigning /128s (single IPs) to only certain markets.
Who has a single computer hooked up to the Internet at home and nothing else?
No wonder it's not going anywhere. Even early-adopters can't get on easily without tunneling or other hack.
Dear Mother of the First Transistor and all that's holy, would it be too much to write a summary that actually summarizes -- "Remember the IPv4 crisis? It's still a problem, and we're going to run into trouble sometime this year." It's only a matter of time before tabloid-grade link baiting pervades every area of writing -- imagine the joy of reading summaries of scientific articles that conclude with, "Is there a statistically significant likelihood that your wife secretly prefers canoodling with carpenters rather than network engineers? Click HERE to find out."
NAT means people are giving themselves IP addresses and are sharing IP address space.
This is communism in it's purest form, and it has to stop.
The IPv4 crisis was around when I got into IT back in the early 90s. So thats...over 20 years? That can't be right because, counting forward from...D'oh!
Get off my lawn!
Truth is NAT works just fine for the vast majority of cases, and makes a layered (IE not-eggs-all-in-one-basket) approach to security much simpler.
The real problem is routing table size with BGP. As we continue to divide the internet into smaller routable blocks, this is requiring an exponential amount of memory in BGP routers. Currently, the global BGP table requires around 256mb of RAM. IPv6 makes this problem 4 times worse.
IPv6 is a failure, we don't actually _need_ everything to have a publicly routable address. There were only two real problems with IPv4: wasted space on legacy headers nobody uses, and NAT traversal. IETF thumbed their noses as NAT (not-invented-here syndrome) and instead of solving real problems using a pave-the-cowpaths-approach, they opted to design something that nobody has a real use for.
Anyway, I'm hoping a set of brilliant engineers comes forward to invent IPv5, where we still use 32 bit public address to be backward compatible with today's routing equipment, but uses some brilliant hack re-using unused IPv4 headers to allow direct address through a NAT.
Flame away.
At work we wanted to set up some VPNs with a cloud provider but our ISP doesn't want to give us the IPs so we had to forgo the VPN and instead lease a line for $5000 a month + we'll end up with dev and production envirnments that don't match which will probably hit us as some downtime in the future (we're just using OpenVPN in dev which doesn't require an IPv4).
So in the case of my team of eight workers the IPv4 crisis is costing $5000/mo + countless meetings and endless paperwork. Not a showstopper, but enough that I'm not yelling "What Crisis?!" from the rooftops.
The human tendency for hyperbole happened. It was the same for Y2k, is the same for just about every winter season snow storm, and is ceaseless in our politics. We just love the drama of a crisis. Just recently John Kerry referred to man-made global warming as weapon of mass destruction. Talk about a drama queen. [br] [br] So, as it turned out, despite seemingly needing more than billions of IP addresses and IPv4 only supplying a few billion in totality, what the world really needed was just a few million IPv4 addresses that could provide "outside" initiated connectivity into the host. ie, servers. For all the rest, outbound connectivity could be supplied by some smaller proportion of addresses using NAT and clever work around services and many systems required even less than that needing only local area connectivity and allowing IPv4 to be reused over and over. [br] [br] So, the need for IPv6 RIGHT NOW OR THE END WILL CONSUME US! was driven largely by hyperbole and the reality that IPv4 can and will continue to serve our purpose is tempered by the other human traits of conservation and ingenuity. [br] Yes, the transition to IPv6 is inevitable and necessary however, the consumption of IPv4 will not be no more a sudden catastrophic event event any more than John Kerry's belief that climate change is a weapon of mass destruction. It just never happens that way.
A lot of the lower /8 ranges, that were assigned to companies and organizations(some of them that don't exist anymore) got reused to make ipv4 last a little longer. They will stil
Also don't help a lot that companies and ISPs may still be deploying hardware/software that is not ipv6 capable, replacing legacy systems is one the things that slows down adoption.
Nothing happened.
It's an ongoign disaster that will get more and more of a problem as time goes on and it gets harder and harder to get IP addresses.
Businesses that migrate to IPv6 don't drop their IPv4 addresses. They still need them to talk to legacy clients.
I've migrated to IPv6 at home but I still have an additional IPv4 addresses internally and externally for talking to IPv4 servers and devices.
The United States has enough IP addresses in our pool to carry us through to the end of say... 2018. If current growth of the Internet continues we will still have enough IP addresses in our pool, we'll just have to knock a year or two off that projection. Say, may 2017 or half way through 2016. The United States has more than enough IP addresses to keep us going for some time.
Europe and other parts of the world is a totally different story. When the Internet was created and we started handing out the IP addresses we were quite stingy when giving them to other parts of the world. The United States is one of the biggest hoarders of IP addresses in the IPv4 world while Europe and the rest of the world got relatively few IP addresses with compared to how many the US holds. There's where we are seeing the problem.
Europe has the issue, Europe has no choice in the matter; they have to move to IPv6 or their side of the Internet is pretty much crippled. So unless we all implement 6to4 to allow United States Internet users to connect to European web site (that's fugly) or finally get on the bandwagon in converting to IPv6 in the US, there will eventually be two Internets; a US and a European Internet with IPv4 and IPv6 being the limiting factor.
Somewhere out there is an atom without it's own IP address because we haven't fully rolled out IPv6! I demand no atom be left behind.
IPv6 is designed with such a large address space specifically to make BGP tables smaller. One of the factors causing IPv4 tables to grow is that, since addresses are scarce, people are getting clever with how they allocate blocks, divvying things up very finely so as not to waste. Since BGP entries are by block, this creates many blocks that need routing. The IPv6 designers went with 128 bits of address not because they think they need room for 2^128 hosts, but because there will be enough room to divide blocks hierarchically and logically, "wasting" addresses all along the way. This will allow global routing tables to more accurately reflect the structure there is between ISPs, shrinking their size.
So, routers running BGP need 1GB* of RAM to support IPv6? Considering that my phone has twice that much memory, it doesn't seem like that big a problem....
(* I assume by "256mb" you meant 256 megabytes, not millibits.)
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
My fiber ISP provides 6rd connectivity with a /62 prefix address space, and will bump it to /54 when they implement dual-stack on all systems.
There are still legacy routers on the system apparently.
However tomato on my rt-n66u handles the 6rd just fine.
A lot of systems are on ipv6 already, and I think I have around 50/50 ipv6 and ipv4 traffic now. There is no real difference in use for a regular user. Even all the phones, tables and the chromecast use it without me having to do anything except connecting the router.
I still have a regular fixed ip for ipv4, but all my devices are behind nat.
Just an irritant, rendered negligible due to technologies like NAT, since most devices don't need to be accessible from the outside.
---- Booth was a patriot ----
Much of China is already on IPv6 (they only got a tiny ipv4 allocation for their huge population), I myself have dual-stack here in Australia, and have since 2010. It's been available since about 2007 from memory.
While the peanut gallery are pissing and moaning about it, others are actually running it, in production.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Bullshit. My ISP has been IPvt6 enabled for 5+ years now, and if you're running networking equipment more than 5-10 years, you're doing it wrong. I use IPv6 over wireless at home and at work. IPv6 is only a bogey man because of the pissing and moaning people are doing about it, rather than pulling their fucking finger out and getting on with it.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
In short, it's just too early to tell. Just because the RIRs ran out of addresses, it doesn't mean that the LIRs have yet (the ISPs).
Based on my experience as a network engineer at an ISP, the following is happening already:
Small ISPs and ISPs that have not been in the business for a long time* have either run out or are on the verge of doing so. They are doing the following:
* Purchasing legacy IPv4 addresses from enterprises with /16 networks from the old days where available.
* Deploying CGN-like solutions for their end-customers if their end-customers are residential users.
Larger ISPs and older ISPs with allocations from ye old pre-RIR days continue to hold addresses and are often able to free large quantities of addresses from old deployments. Mind you, a lot of public IPv4 space have been "wasted" on infrastructure addressing, and management of devices that were not even connected to the internet. Devices such as modems, DSLAMs, CPEs and similar.
One could easily speculate that the business of ISPs will be severely affected in the future, as customers will go to the old providers that have plenty of v4-space available at the cost of newer players who followed the RIR regulations of only applying for the address space they needed based on relative short-term predictions.
If you are a registered LIR you will see a flood of SPAM from so-called IP brokers who are trying to purchase unused IPv4 space in hope of selling this to LIRs in need. That market will probably become quite desperate in the coming years.
Oh, and by the way, I see no evidence that IPv6 deployment is taking any noticeable speed.
*) Long as in they were in the game when classfull allocations were made.
You can't get new IPv4 addresses in Europe or Asia. End users are already on DS-lite, with IPv6 for their only public address. You can not initiate a connection to millions of Europeans and Asians if you don't use IPv6. Not soon, now.
We may not need every device to have a publicly routable address, but we will need more than what ipv4+nat can provide service for
File under 'M' for 'Manic ranting'
1) DHCP 2) silent adoption of IPv6, especially in China 3) NAT
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
Actually, ipv6 adoption seems to be higher in the US than anywhere else in the world... I run a bunch of dual stack websites, and v6 accounts for about 15% of american traffic and considerably less from other countries.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Yup, although eventually/soon I suspect people will be running a 6-4 gateway and (ironically) relying on NAT64 to access the legacy IPv4 internet (I also have ipv6 at home).
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
It was never a crisis to begin with? This is why you don't listen to chicken littles.
I don't know where you live, but at a guess I would put you in a country such as the USA or in United Kingdom. If you look at how many IP addresses there are per 1,000 population you will see that the USA has about 5,000, the UK 2,000 but that India has 29. So it might not be a problem for you, but for for some it is. It is not just 1st vs 3rd world, overall the EU has 19 per 1,000.
Many people use more than one IP address (think: office, home, mobile 'phone). Yes NAT can help, but it is not the complete answer.
Your phone isn't trying to route at terabits per second.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I sat in on a router design meeting for IPv6. It took me 20 minutes to stop laughing when I heard them seriously say that it was acceptable for the system to crash if it encountered a router loop, because users will "just be careful and that won't happen". Then I took the copy of the presentation and my notes to my stock analyst and pointed out "these people ar bozos, do not invest in them or trust anyone who has invested in them". I didn't make money, but it helped keep me from *losing* a good chunk of money when their "Cisco-killer" failed miserably.
...Maybe your sites are US-centric.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
Anyway, I'm hoping a set of brilliant engineers comes forward to invent IPv5, where we still use 32 bit public address to be backward compatible with today's routing equipment, but uses some brilliant hack re-using unused IPv4 headers to allow direct address through a NAT.
We already have essentially that: it's called 6to4.
... they hype caused large blocks of IP v4 addresses to be bought with the idea of selling them at higher prices... but the demand didn't happen so they were released... making them again available.
Don't know if its true but probably is considering teh things people will do when they think they can make an easy buck.
no.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I second this. I just got IPv6 through my ISP and most of my devices just picked up an address and started using it right away.
However, the GP is correct in that ISPs need to upgrade a lot of expensive routers to add support. The good news is they have to upgrade them regularly anyways, so if they just make the decision to go the IPv6 route, it'll happen. I imagine plenty are partially supporting IPv6 already, but that one stubborn switch won't die.
How does that make sense? Do people in a given country interested in international news tend to use IPv4 while those that are interested in American news use IPv6? If you measure the proportion of each countries traffic that is v4 vs v6, how does it matter what proportion of total traffic is from each country? (As long as you are not trying to make generalizations from one or two visits from another country that doesn't visit the site often.)
Someone should invent hash tables!
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
The same that happened with the y2k bug... we're still waiting for it.
That wouldn't make a difference, it's percentages.
The reason public space is used on the inside of corporate networks is for mergers. Its a hell of a lot easier because you don't have to run any crazy dual nat type setups due to the fact that two companies both used the same private space and then were merged together.
https://www.fsf.org/associate/support_freedom
The real problem is routing table size with BGP
Number of routes that will fit in hardware associative memory.
As we continue to divide the internet into smaller routable blocks, this is requiring an exponential amount of memory in BGP routers.
Exhaustion is certainly not helping.
IPv6 makes this problem 4 times worse.
The minimum routable IPv4 prefix is 24 bits. On the IPv6 network it is 48 bits. So absolute worse case 2x. You can do much better in the real world.
While there will be some (small?) savings from increase in route aggregation it is also true it uses more memory than IPv4 ... for now until IPv4 route disaggregation from scarcity becomes dominant.
IPv6 is a failure, we don't actually _need_ everything to have a publicly routable address
A failure currently growing faster than the IPv4 network.
There were only two real problems with IPv4: wasted space on legacy headers nobody uses
The content of the IP layer header is not a real problem. The real problem is there are >2^32 humans on this planet. The problem is entirely ADDRESSING not formats of headers. Any solution to make the address bigger is functionally the same solution as IPv6 where it matters.
and NAT traversal. IETF thumbed their noses as NAT (not-invented-here syndrome) and instead of solving real problems using a pave-the-cowpaths-approach, they opted to design something that nobody has a real use for
In a world of youtube, netflix, facebook, and twitter it does not much matter what the network looks like...NAT it to hell and back it will all work just the same and nobody cares...well except for ISPs who have to shell out cash for CGNs and Media companies who have to put up with ISP CGN suckage.
In a world where humans see value of communicating with each other as peers over an IP network where everyone can talk to everyone else without having to obtain prior permission then it matters big time. Even if everyone is stuck behind IPv6 SPI they have the capability to allow communication or use a common service to prime NAT/SPI state machines for direct peer to peer communication. If both communicating partners are stuck behind a CGN using many to many or port range MAPping then even building a direct connection between peers becomes impossible and the carriers rather than users become gatekeepers on allowing incoming connections.
Anyway, I'm hoping a set of brilliant engineers comes forward to invent IPv5, where we still use 32 bit public address to be backward compatible with today's routing equipment, but uses some brilliant hack re-using unused IPv4 headers to allow direct address through a NAT.
The only solution to pigeonhole problem is effective increase of address size (e.g. Area codes) if you do this you've already taken most of the hit in changing addressing scheme... only you've elected to do it using duct tape and bailing wire.
If you think hardware associative memory is a scarce expensive resource imagine how much more it must cost to manage NAT state at scale. Even partial deployment of IPv6 would reduce operational costs in a NAT dominated world.
The wining of many of the people on this list make me laugh. I heard the same thing from the Novell, SNA and AOL users about IPv4 and the Internet. As for the business case, here are five reasons to move: 1. PERFORMANCE - Performance browsing to an IPv6 enabled server is 10-20% faster, making anyone's web properties look better to their customers! 2. LOWER COST - The maintenance of IPv6 networks cost 17% less, then IPv4 only or dual stack. 3. BETTER SECURITY - IPv6 end-to-end communications along with DNSSec with DANE, perfect forward security, BPKI, and others. Reduces the chance of man-in-the-middle attacks, SPAM, and identifying source of DOS's. 4. MAINTAIN COMMUNICATIONS - If your mail servers, web server and browsing is on IPv4 only, there are website today you will not be able to access. 5. GROWING MARKET - No matter what your business, the network effect (Metcalfe's law n^2) allow you to connect to more people, and systems. To the innovators, please visit my blog at http://www.scientifichooligan.... to learn more about IPv6 features and security. TO THE IDIOTS & TROLLS - please, return to AOL where you belong.
Apple has been "dying" for years and we're been on the verge of an IPv4 crisis for years too. And then there's the little fact that devices have a "MAC address"... Conspiracy? I don't think so!
What does it mean? No idea. I just put stupidly insane conspiracies online, I let the crazy people fill in the details.
Get free satoshi (Bitcoin) and Dogecoins
After the technological meltdowns consistently failed to appear, IPv4 was finally replaced when IPv7 was adopted globally in the year 2017 as a result of a world trade agreement.
The incongruous IPv7 clause was widely seen as the result of an unlikely alliance between the RIAA, MPAA and various repressive regimes such as China, Zimbabwe and the United Kingdom.
Frustrated by the inability to trace internet usage to a single user via IPv4, these organisations lobbied for IPv7 to be adopted so that individual phones and computers could be mapped permanently to a single device and user. Unlike IPv6, IPv7 includes a direct mapping to the mac address of a device and the user's global internet ID, so that (in theory at least), all downloads can be linked to a specific person.
Although the EFF and various other organisations campaigned vigorously against IPv7, the arguments around catching terrorists and preventing pedophilia prevailed.
VLC Remote for iPhone and Android
Yeah, many ISPs have begun to NAT, for the regular user while still keeping the option of a regular adress for those that want/need it. Most will never know they're NATed and won't care nor need anything else for their everyday surfing.
Yep. You're so smart. So smart that you ran right over "hardware doesn't support ipv6", "virtually all wireless network hardware sold today" and "cost the ISPs time and money and aggravation to support" and went straight to "bullshit."
Have a cookie. Clearly you've got intelligent discourse down pat.
...Steve
There is not reason you can't have a ipv6 gateways/routers that filter incoming traffic. It would defeat a significant benefit of IPv6 but you can do it.
People who don't understand networking think that all machines should be on a single flat address space, that is, every machine can directly address every other machine. IP4 has a lovely thing called private address spaces, which increase the number of devices significantly. You also don't need a public IP to be a server. A single IP on a web server can handle any number of web site names. There has never been an IP4 address crisis, ISPs just have to use them more efficiently. In the simplest network, all you need are two addresses. I will let you figure it that out.
The only thing worse than a Democrat is a Republican.
So, routers running BGP need 1GB* of RAM to support IPv6? Considering that my phone has twice that much memory, it doesn't seem like that big a problem....
In routers it is special (associative) memory. Normally you look up values stored in your phones ram by asking the question "what data is located at 0x00001337" in routers you are asking a much higher level question "what interface should I send data packets going toward 1.3.3.7"
The routers have a kind of hardware key value store requiring a lot more money and power to operate vs. ram found in normal computers and phones.
Yeah, some "experts". Apparently, the term "expert" is thrown around with hardly any regard for its definition. Two things happened to the IPv4 crisis; 1) NAT, and 2) common sense.
There are millions of devices with IPv4 baked in that will never get another firmware update. These devices cannot run tunnel software. They talk ipv4 and thats it. It is unreasonable to expect people to ditch their hardware to support new protocol that missed its window of opportunity for adoption.
but everyone needs an IPv4 address to keep their bluray player working, then how does having IPv6 on their cable modem help? We will still be running out of IPv4 addresses.
1) There was never a crisis, and
2) Carrier-grade NAT
IP is a protocol. It is software, not hardware.
In order to make a device that is IPv4 only able to run IPv6 is software changes. Carrier grade hardware will have firmware updates that add this functionality.
The big routing toys all have specialized hardware (ASICs) tied to IPv4 packet structures and addressing which needs to be physically replaced to support new structures of IPv6. Assumptions about structure is literally burnt into the hardware.
However most of this gear will still pass IPv6 on the slow path allowing some deployment of IPv6 until the gear can be replaced/upgraded over time.
In 2014 I have little sympathy for the ISP who is just now realizing "OMG we need to buy all new shit" simply because they failed to be proactive and didn't plan ahead...they should have been sourcing hardware with IPv6 support for years already.
For anybody paying any attention over the past few years, this shouldn't come as a surprise.
The IANA ran out of IPv4 address space available for doling out to the Regional Internet Registries (of which there are six) three years ago. APNIC (Asia Pacific) and RIPE NCC (Europe) went below a single /8 three and two years ago respectively. The IPv4 address exhaustion has already begun.
ARIN (North America), however, has 82 /8s. If you consider that there are only 221 /8s in total (the IANA keeps 35 for reserved use), this means that ARIN has 37% of all usable Internet addresses assigned to it, for roughly 8% of the worlds population. More than a third of all possible addresses for less than a tenth of the worlds population.
Even still, ARIN now only has about 1.3 /8s free. Projections have them running out next year. They've always been estimated to be one of the last RIRs to run out (with AfriNIC being last, as they still have just over 3 of their nearly 13 /8s free) due in part to the huge number of /8s already in use in North America (way out of proportion to the population of the continent).
I feel really ashamed every time this topic comes up on /. at the complete and rampant ignorance of the issues surrounding IPv4 and IPv6. We will run out of IPv4 address space, but address space is hardly the only problem with IPv4. The bigger problem is ROUTABILITY -- the IPv4 routing tables have become seriously unweildly, they are getting progressively worse (in part due to InterRIR transfers of address blocks now that Europe and Asia have run out of addresses), and they continue to need more and more compute power thrown at the problem just to keep up. The number of BGP forwarding entries has doubled from roughly 250k to nearly 500k in just the last six years. The algorithms used for determining routes in IPv4 are complex. The computability is difficult, and it's slowing down the Internet today.
IPv6 solves a lot of the routing problems inherent in IPv4, making routability a lot easier to compute. IPv6 packets have a simpler header, routers don't need to provide fragmentation services, and there is no header checksum. IPv6 also avoids the routing anomalies present in IPv4 due to things such as the switch to CIDR. We know a heck of a lot more about packet routing now than we did in the 60s when IPv4 was first defined, and these improvements are available in IPv6.
This is why I cringe whenever I see a post in an IPv6 address exhaustion related /. story complaining about a lack of backwards compatibility in IPv6, or anytime anyone says that NAT is good enough for everybody. As the address space fragments even further, and historic /8s and /16s are broken up into ever smaller units which are then distributed to diverse geographies, the routing table in IPv4 is going to continue to blow up, becoming ever uglier -- it simply wasn't designed to scale in the manner in which we're using it. IPv6 brings sanity to global routing again, in a way that no backward-compatible solution could achieve.
The IANA is out of addresses. RIPE and APNIC are virtually out of addresses (with only enough reserved to aid in IPv4 - IPv6 tunnelling and translation services). ARIN is down to less than 1.5 /8s, and survives purely on the fact that it has a disproportionate number of /8s compared to the population it serves. And worst of all, IPv4 routing is an absolute mess that requires a ton of processing power and compute time to maintain. Remember these things before you post something silly about being pro-NAT, pro-some-untested-IPv4-address-extension-proposal, complaining about backward compatibility, or how people have been predicting IPv4 exhaustion for the last 25 years (just because you see the train coming towards you way off in the distance does
To embellish smash's response, no there is no privacy benefit to using NAT. If you want some sort of a privacy benefit, you still need to add a firewall to your connection that can monitor your traffic for the very same things it would have to monitor for if you use global addressing. The only thing that NAT provides is an address translation interface, too allow you to have a larger pool of addresses to use than your provider can grant. If there is a port forward for a service set up either statically or dynamically (upnp) any flaws in the service that is being forwarded can be exploited in the same way it would be if there were no NAT involved.
You never know...
I often wonder this. I've been on AT&T since 2010 and they've always handed me an IP behind a NAT. I know prior to 2010, Sprint handed out real IPs but I bet they've stopped by now.
You can supposedly pay an extra $15 a month to AT&T for an "Enterprise" data connection that gives you a real routable IP. I've had absolutely zero use for it, but I bet it comes in handy for folks using USB cellular modems.
Either way, this is how cellular providers are staving off IP depletion. Frankly I don't care; the lack of a real routable IP has never kept me from doing anything I need to do with my phone.
I recommend that the next time you brag about insider trading you at least post AC.
Not so much. Same flaws apply as addresses are still allocated through dhcp, and someone who has a given address now, very probably won't have that address the next time they go to a website.
You never know...
If every cell phone had a public IPv4 address, we'd be screwed...
In 2G & 3G networks, phones got NAT'd 10.x.x.x IP addresses. The downside being no listening services accessible to the internet, even if you wanted to run a web server, or SSHd on your phone.
In all 4G/LTE networks, though, carriers are going native IPv6, with no IPv4 to be seen.
You may not know that you've switched to IPv6, but if you're an LTE user, you HAVE.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
It wasn't "insider trading", It was a "free to attend" presentation of a student's work that was being presented to potential investors. No NDA was signed, and the paper was publicly available.
... is not always straight forward. This is especially so if you are running in a NAT environment and want to deploy IPv6 and do host resolution correctly. Internally, you want to resolve a host as:
test1.example.com 192.168.0.10
test1.example.com 2001:DB8::a
Since this node makes connections to the world, we need to resolve it's address for some services to work:
test1.example.com 2001:DB8::a
Before IPv6 was enabled on this network, this node would be resolved via a generic NAT IP address.
Now you have an asymmetry in how access to/from test1.example.com occurs which means it can work for some people (internal hosts, IPv6 enabled remote hosts) but not for others (IPv4-only sites.) In general, asymmetry in your security with two different paths to the same host means you are less secure. Unfortunately, IPv6 is more than IPv4:IPv4:IPv4:IPv4 and requires some thought and expertise that many shops just don't have.
Another part of the answer...take back the class A allotments that were given to companies/organizations early on. If you're not in the business of using the addresses to help your customers connect (Level-3, AT&T and such), you should be using NAT like the rest of us. I'm looking at GE (3.0.0.0/8), IBM (9.0.0.0/8), Xerox (13.0.0.0/8), HP (15.0.0.0/8, 16.0.0.0/8), Apple (17.0.0.0/8), MIT (18.0.0.0/8), Ford (19.0.0.0/8), CSC (20.0.0.0/8), Halliburton (34.0.0.0/8), Merit (35.0.0.0/8), Eli Lilly (40.0.0.0/8), Amateur Radio (44.0.0.0/8), Prudential (48.0.0.0/8), duPont (52.0.0.0/8), Daimler (53.0.0.0/8), Merck (54.0.0.0/8) and USPS (56.0.0.0/8).
Between them, these organizations have almost 7% of the IPv4 address space and all of them have similar counterparts that manage to get by without a block of ~16m addresses. Address space isn't property and should be allocated by the internet community based on the common good. These organizations should be given sufficient notice to ensure that they have enough time to prepare, but they shouldn't be allowed to hold these addresses indefinitely.
The Freshnews.org link to this article on /. links not to /. at all but instead directly to the Network World article. Which, as we all know, nobody needs to RTFA.
Sig for hire.
News to me... our division in China just got a /28 allocation of IPv4 address last month.
Life has many choices. Eternity has two. What's yours?
So you are trying to say that routers have a hardware implementation of a map data structure instead of system memory, and that map is somehow mysteriously backed by non-standard computer memory.... Further, you suppose that this hardware based map uses more power than a software based approach, which directly contradicts one of the main benefits of using ASICs in the first place. So, are you a troll?
My idea is to allow full interoperability between ipv6 and ipv4 parts of the internet. The solution here is to use DNS. When a peer on an ipv4 network accesses a DNS address for an ipv6 peer, the DNS server works with the router, the DNS server realises the IPV4 client is asking for the address of an IPV6 site. The DNS server returns a private ipv4 NATed address to client and any further packets to the NATed address from the client are translated into Ipv6 addresses at the router to be sent up to an ipv6 network. Returning packets are NATed from the ipv6 address back into the Ipv4 NATed address. Or, the router could have a tunnel over ipv4 to another ipv6 network. Furthermore, create a new TLD, ipv6, and ipv4 peers could use an something like ...a2e2.da2f.ipv6 or something like that to access a particular ipv6 address. The Router-DNS complex would do the NAT translation as above to make that work
APNIC does give them out reasonably freely. I just got a /24 last month.
Mind you a /28 wouldn't be coming from APNIC, that would be from your host which can still be difficult but not nearly as much as from APNIC. /28 is also a relatively small amount.
NAT as a firewall is like venturing out into a hurricane in a friggin windbreaker, and believing the hurricane can't hurt you because it can't see you. The only reason the world hasn't gone v6 is because the ISPs have to do it first. If Cumcast is serious, 2014 is the year of v6.
I am Audience.
NAT is not a firewall. Lets repeat NAT is not a firewall.
User controlled functions such as UPNP make is even less of one.
NAT does prevent first time outside access, but nothing beyond that.
Look at this scenario.
You visit http://hack.ed/. It launches a flash exploit that gets admin privileges. As admin it launches a UPNP function to allow port 40,000 to your internal IP. The rest of the world now has access to your computer as if it were directly connected.
Now if your NAT also has UPNP turned off and/or also contains a firewall that prevents NEW connections to any computer behind it, yes it a NAT enabled firewall.
Another part of the answer...take back the class A allotments that were given to companies/organizations early on.
Why does this myth persist? Modded Interesting, even. This proves that education is the major barrier to IPv6 adoption.
We can't "take back" the class A allotments because there is no "back" to take it to. Those were given by Jon Postel before IANA existed, and IANA does not claim any more legal authority to those addresses than anybody else. It's an unwise investment of limited resources to challenge those companies' legal departments.
Also, with the rate that IPv4 addresses were being allocated, and the acceleration of the rate before 2011, those addresses would have postponed IPv4 exhaustion by months at best. It's surely not worth the expense to force all those companies to release their class A networks just so we could collectively fail to do our jobs, that is, switch to IPv6.
Have a nice time.
This is a censor's wet dream - turning the Internet into an unidirectional distribution channel, just like TV. IPv4 address space exhaustion only helps them do that sooner. MPAA/RIAA also have a vested interest in this.
No, he's right. The US has some big hitter ISPs doing IPv6 at home, and some of the world's biggest companies that do IPv6 for services are in the US. Google for example offer most services over IPv6.
Contrast say the UK where the big home ISPs aren't doing any IPv6 at all. British Telecom? Nope. TalkTalk? Nope. Zen? Nope. You have to go to a smaller outfit to get IPv6 and the average person doesn't even know those exist.
The actual reason might be surprising to non-network people. IPv4 sucks for the engineers at a REALLY big ISP. If you've got a million customers like a big UK ISP, you don't run into any trouble. IPv4 gives you enough address space to label everything and space to stretch out. But suppose you've got more like 20 million customers like a big US ISP. Now you run into problems labelling all this gear. You'd like to just give everything an address (note, this isn't stuff like refrigerators that some jackass wired to the Internet, it's stuff in your network, that you are supposed to manage, like customer routers, or DSLAMs) and you get headaches trying to find addresses you can use to do that which don't conflict with the public network or your customer's networks. Your best bet is 10/8 but that's still pretty cramped. If you mess up and use an address that conflicts, you get even more problems, and all the problems land on you, the network engineer. Aaargh.
Along comes IPv6. Need twenty million addresses? Sure, here's a billion we've got spare just for this kind of situation. Well that sounds pretty nice. What do I have to do to get that? I just buy the IPv6-enabled gear? Yes I definitely will tell my boss we want that. And it means the customer can have IPv6 too? Well I'm sure the boss will eat that up, but frankly I, the network engineer, am just happy I can label all my gear uniquely without headaches.
Google agrees. They're probably a bit less US-centric.
As bad as the ISPs in the US are, we're actually a world leader in v6 traffic. Comcast, Time Warner (the ones I have personal experience with) and apparently Verizon are all doing v6 natively and properly. That accounts for a huge percentage of customers - as they get around to replacing their gateways, it should "just work".
-- reply ends, general comments begin --
Just so everybody's clear what I mean by "just work" - when I moved into my new apartment, I rented a modem/router from the cableco (I of course bought my own a few weeks later like a good nerd). Out of the box, it requested a /64 prefix and delegated it to the internal network, including the v6 DNS servers. All OSes made in the last 10 years know how to do v6 properly, so everything from my desktop to my phone to my smart TV can access v6 resources just fine.
v6 is here. It works great, and you get real IPs! Like, you can actually paste an IP to a friend so he can download a file from your box just like the old days, without doing any NAT port mapping bullshit. Want to play a game, or video chat, or VNC or something? Just open a damn socket, no STUN or UPnP or any other crap.
I don't get why so many Slashdotters are bitching/FUDding about v6. There's no money in it - all the ISPs are doing it happily - so it's not astroturfing. And the comments don't fit the typical troll model. What gives?
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
So you are trying to say that routers have a hardware implementation of a map data structure instead of system memory, and that map is somehow mysteriously backed by non-standard computer memory..
Internet routing is not a simple map operation, it's a prefix match operation against a very large prefix table and it has to be performed at very high speed (potentially tens of millions of packets per second). For a large router at an ISP it's also likely to have poor locality so caches won't help as much as you would hope.
Further, you suppose that this hardware based map uses more power than a software based approach
More power than the same ammount of regular ram sure but regular ram isn't going to keep up.
Having said that the large size of the v6 address space means that addresses can be allocated in a way that brings us much closer to the ideal of one prefix per AS. There is also much less historical cruft, so I suspect that the IPv6 routing table will not be anwhere near as bad as the GP asserts.
I would also point out that the place you have the really big routing tables is on the core networks and yet most ISPs seem to have upgraded their core networks to IPv6 already, it's the access networks that are lagging.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
IP is a protocol.
True
It is software, not hardware.
Protocols can be implemented in either software or hardware, which is chosen depends on various tradeoffs including cost, performance and flexibility.
In order to make a device that is IPv4 only able to run IPv6 is software changes. Carrier grade hardware will have firmware updates that add this functionality.
Able to run and able to run with decent performance and reliability are unfortunately not the same thing.
A high end router has a CPU that does various housekeeping tasks (updating routes, administrative access etc)and a forwarding engine that does the real work of matching packets to routes and pushing them out of the correct interface. If the forwarding engine is not designed for IPv6 then it is unlikely to be able to support it with a mere firmware upgrade.
AIUI some such routers "support" ipv6 but handle it with the CPU instead of the routing engine, so they work ok if IPv6 is a small proportion of total traffic but as the number of IPv6 packets in the mix grows they fall over.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
I expected better from a 4 digit UID.
"hardware doesn't support ipv6" - Sure, and it's all being steadily replaced. As everybody replaces their stuff on the normal cycle, the new stuff supports v6. 5 years later, everything supports it - starting at the backbone, moving to the ISP core, then the individual gateways. Case in point - Comcast, Time Warner, Verizon, ATT, etc. Not sure what you mean by "expensive hardware that ISPs have in their data centers" because the big ISPs don't seem to have any trouble with it. Perhaps you mean some shitty ISP nobody's heard of (got any names?) that went out of their way to *not* buy all the v6-compatible gear? Or perhaps they're running 8 year old equipment, even though bandwidth requirements have gone through the roof since then. Well, either way, yeah occasionally upgrading your shit is part of being an ISP.
"virtually all wireless network hardware sold today" - You mean like Aruba and Cisco? Fun fact - my university uses Aruba gear for WLAN and they flipped on native v6 quite successfully. In 2010. Or perhaps you mean consumer gear, like my shitty Arris gateway from the cable company that requested a v6 prefix when I plugged it in and has been happily advertising it to all my machines? And "machines" includes my cellphone, Smart TV, and fucking Blu-Ray player!
"cost the ISPs time and money and aggravation to support" - You'll have to do better than that. IPv6 brokenness is a non-issue, and most of the negligible fraction of people who have a problem are having a problem due to ISP misconfiguration - a support non-issue if the ISP is configured properly. In fact, when the support guys realized that widespread v6 support would essentially eliminate all their "how do I forward a port" support calls, I bet they had to change their pants. If by "support" you mean "configure this shit they bought over the last 5 years"... well, that's known as a "job".
Normally I'd expect a bullshit post full of ad-homenims to be some sort of astroturf but all the ISPs are already fucking doing this so they have no reason to troll forums. So I don't know what your deal is. Maybe you get a jolly from shitting on v6. That's fine, go nuts. We'll all be over here using it happily, spinning up v6-only services in a few years, and leaving you in the dust.
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
Interestingly enough, both Germany and Romania have a higher adoption rate.
I'm from Romania and gave IPv6 a try. I have a router that allows both IPv4 and IPv6 connections at the same time, so I enabled both and worked like that for a while. For some unexplained reason, the IPv6 connection took a huge amount of time to get its IP (literally minutes) and after both connections were enabled, many things wouldn't work right. I experienced repeated loss of connectivity in pretty much all online games, Yahoo Messenger would randomly disconnect, Skype would randomly disconnect, Steam would go offline for 30 minutes in a row, Dropbox would lose connectivity, etc.
Maybe IPv6-based PPPoE has issues, I don't know, but I was literally forced to disable it for my computers to work properly.
Anyway, I would definitely not consider 6-7% as being a "successful" deployment. It's a start, but still a LONG way to go.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
FUCK PAT. It breaks too many protocols and gives ISPs and governments easy ways to damage the P2P aspect of the internet. The internet should not be cable TV 2.0.
As a gamer, I find typing in four 8-bit numbers painful enough. And you want me to type in eight 16-bit numbers?
A general switch to unrouteable IP addresses for intranets is, I think, mostly what happened. We could see the shift starting even a little before the chicken littles started screaming about addresses running out. Some of us could see that either the internet would shift to a usage pattern where they didn't run out at all, or they'd run out much more slowly than projected.
Mind you, infrastructure should probably still switch to IPV6 (and is, slowly) but there are few reasons why addresses used within intranets have to be real routeable IP addresses.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
1. Not every device needs a publicly routable address.
2. See 1.
"GET / HTTP/1.0" 200 51230 "-" "Mozilla/4.0 (compatible; Setec Astronomy)"
You're right, and it would only cost IBM billions of dollars to re-ip their entire internal network so that you could squeak by with ipv4 for a few more months.
Anything on a wireless network should be done with the assumption that dropouts are are going to have to be dealt with. Open connections are a very obvious failure in doing that.
Of course it costs more in traffic. That's a price of dealing with a connection that is almost certain to drop out or switch to another route.
My current connection, as well as most "NGN" lines in Germany already doesn't have IPv4. All you get is some sort of NAT and of course IPv6. In practical terms it means nothing IPv4 related works anymore and many people set up their own VPNs to get useful IPv4 connectivity, if they still need IPv4.
Of course IPv6 works like a charm with roughly zero problems.
Why doesn't ARIN just charge more per IPv4 address? They could have easily setup rents to try and even out the price being paid by early adopters. Those who really cannot upgrade can continue to do so but those that can will do so more quickly. Give them something they can put into an Excel spreadsheet vs existential benifits to adopting IPv6 at a high financial cost ... seems like an obvious solution to me.
Is there anything better than clicking through Microsoft ads on Slashdot?
Again, not paying attention: in the wireless industry THERE IS NONE WITH IPv6.
Wireless equipment (not Linksys, ffs) is almost universally IPv4 only - right now.
...Steve
And you got better. You're clearly uninformed, and I can't change fanboyism.
-
"hardware doesn't support ipv6" - Sure, and it's all being steadily replaced
-
It's *not available* in some cases, certainly fixed wireless equipment. I made that point twice, FFS.
-
big ISPs don't seem to have any trouble with it
-
Actually, they do. Many large ISPs don't support IPv6 or are in the stages of moving over parts of their network right now. They're having huge issues. They're just not sharing them with YOU. For an example, Bell Canada still has no IPv6 support on their network, even at the business-classed fiber/ethernet level.
-
You mean like Aruba [arubanetworks.com] and Cisco [cisco.com]?
-
Those are not ISP-level equipment. Those are WiFi. Again, you fail at comprehension.
-
when the support guys realized that widespread v6 support would essentially eliminate all their "how do I forward a port" support calls, I bet they had to change their pants
-
Wrong. Now they have people calling them up asking how they get static IPs on their Samsung TV. And why their home security system doesn't seem to be working when it supports only IPv4. They want more outbound bandwidth for their fleet of home cameras and an IP for each of them, and they want it for free, including technical support when something goes wrong. IPv6 means you go from people trying to force you to support their shitty, poorly configured wireless network at home to trying to force you to support 50 devices that they want available on the Internet at all times with their own IP addresses. You clearly don't think outside your little consumer box AT ALL.
-
Maybe you get a jolly from shitting on v6. That's fine, go nuts. We'll all be over here using it happily, spinning up v6-only services in a few years, and leaving you in the dust.
-
Could you be any more fanboy butthurt?
...Steve
We ran out of them 20 years ago when we started using NATs and devices no longer get issued their own addresses. The reason why we don't recognize that we did is that the IP address is just a means and doesn't define the relationships in a post-mainframe world. Unfortunately we don't have standard alternatives soinstead of have lots of ad-hoc communities that use the Internet as a transport but don't play well with each other. More about this in http://rmf.vc/CILight.
Funnily enough I _have_ a IPv6 router which filters incoming traffic. AVM Fritz!box
You may think it defeats the purpose but leaving machines fully exposed isn't a good idea.. The thing does open ports on demand.
The machines wouldn't be fully exposed. They should have their own firewalls. There just wouldn't be a need for port forwarding and NAT traversals.
Yahoo Messenger would randomly disconnect, Skype would randomly disconnect, Steam would go offline for 30 minutes in a row, Dropbox would lose connectivity, etc
Don't worry. That was just the NSA testing their systems
Coder's Stone: The programming language quick ref for iPad
This will allow global routing tables to more accurately reflect the structure there is between ISPs, shrinking their size.
That was what the ivory tower guys thought, they came up with grand plans for heirachical routing that were never really adopted because they didn't respect the realities of the internet. They also came up with crazy ideas that network admins would find it acceptable to run multiple prefixes on their networks at once and that end hosts would somehow be able to determine which was the best to use for a given destination.
In reality no ISP or large company wants to tie their addresses to their current choice of upstream providers or manage multiple prefixes in paralell, so each ISP/large company is still going to end up with a route in the global routing table.
The table should still have less entries than the v4 one because most ISPs and large companies should have one block each rather than building up multiple blocks over time but it's not going to be as small as some people hoped.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Using PPPoE to log in to SBC residential ADSL got me a new IPv4 address every time. Address lease times were 24 hrs and I always got a new IPv4 address.
...And ONLY their IPv6 systems, I guess.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
Yes, why didn't they just call it "2001:192:168:x::1" ?
Followed them providing a quote from me doing exactly that!
Then a strawman suggestion of what they pretend I'm suggesting - which of course is stupid, but I'm not the one suggesting it am I?
Keep on arguing with yourself if you like "kasperd". I've made my point about it being a bad idea of assuming 100% reliable connections on such networks and if you don't want to discuss it then fine but I really do not like people building me up as a strawman just so they can have someone to pretend to argue against on other points, let alone using it as a way to "inform" with the obvious while pretending that 90% of the site doesn't already know it.
This is supposed to be a discussion site and not an insult site isn't it?
Of course they should have their own firewalls. They need protection from the local network for starters.
When it comes to network protection: Belt, braces, safety pin, bit of twine. No single item should ever be your sole point of failure.