North America Runs Out of IPv4 Addresses

DW100 writes: The American Registry for Internet Numbers (ARIN) has been forced to reject a request for more IPv4 addresses for the first time as its stock of remaining address reaches exhaustion. The lack of IPv4 addresses has led to renewed calls for the take-up of IPv6 addresses in order to start embracing the next era of the internet.

Comments

It's the end of the world as we know it!

[Chas]

The sky is falling!

The sky is falling!

It hit me on the head! *OW! NOT THAT ONE!*

"Runs out".

Yeah. Okay. And how many companies are sitting on vast blocks that are only partially tapped?

This isn't so much an issue of lack (though at some point it'll become that).
It's an issue created by how assignment of address blocks was and is managed.

Re:It's the end of the world as we know it!

[Daimanta]

Trying to get companies with big internet presence to return their allocated blocks to the (ARIN)-pool would take for too much time and effort and is without any form of guarantee. Furthermore, even if they would manage to return the blocks to the pool in a couple of years, it would both be too late and too little and the demand for address space far outpaces the supply that ipv4 can offer. Realistically, ipv6 is the only long-term solution for any part of the world even including Africa as the increase of internet availability on the continent will rapidly consume their own pool. Hopefully, the African states are smart enough to push for an ipv6-enabled infrastructure.

Re:It's the end of the world as we know it!

[halltk1983]

Why would they return something that they could sell?

Re:It's the end of the world as we know it!

[I4ko]

Except we don't have to. In BGP shorter prefixes override longer ones, so ARIN can just name several /17s or something at random out of the /8 blocks and have the companies deal with it. It's never going to happen obviously.

Re:It's the end of the world as we know it!

[Tim the Gecko]

Yeah. Okay. And how many companies are sitting on vast blocks that are only partially tapped?

There's some interesting economics coming up. Companies will bid up the price of IPv4 blocks, but that will also make it look like a better idea to move to IPv6. Google's stats show IPv6 users have gone up from roughly 3.5% to 7% in twelve months. If you expand the graph you'll see IPv6 is higher at weekends, when people are at home, and lower on weekdays.

So the price of IPv4 will go up, but this will push companies toward IPv6 migration, and when that happens the worth of IPv4 blocks will drop significantly.

Re:It's the end of the world as we know it!

[Anonymous Coward]

Because they can't sell it. As the current ruler of Microsoft, John Thompson, admitted, they broke the rules intentionally when they bought a block of addresses from Nortel in 2011. ICANN talked about taking action, but backed down after Gates picked a dishonest and untrustworthy moron like Thompson that has political connections to the White House. Obama said Thompson was on the short list for Commerce Secretary, and has admitted that Microsoft has unlimited access to the Oval Office. Thompson is very well connected. That is why Gates appointed him to run Microsoft despite the fact he isn't that bright and has recently shown very bad signs of Alzheimer's wrt his confused and contradictory statements on how much Microsoft plans to charge for Windows 10 subscriptions for the "free" upgrade. We still don't know how badly those of us who take the "free" upgrade are going to be screwed in the long run.

Re:It's the end of the world as we know it!

[Ultra64]

>And how many companies are sitting on vast blocks that are only partially tapped?

Good idea, let's make those companies give up their /8s.

That should give us a few more weeks worth of IP addresses.

Re:It's the end of the world as we know it!

[Sique]

What do you think would for instance GE do if suddenly some quite important addresses within the 3/8 IP space are no longer reachable from the outside, because ARIN reassigned them to someone else? Who will survive the lawsuits for damage and loss of business? What will happen if the oncall GE technician who administers some important GE serviced equipment at some hospital site can't get to it remotely after a break down, and thus the small glitch gets out of hand, and some people depending on the GE equipment on site die?

ARIN will never reassign a GE owned block without clearance beforehand from GE. Too dangerous.

Re: It's the end of the world as we know it!

[ZeroWaiteState]

Making IPv4 expensive is the only way IPv6 is ever going to happen. My local cable company bragged in the news about rolling out IPv6 to the whole country. That was two years ago. I called to find out when IPv6 was going to be offered in my area. There is no timetable nor any plan to provide it. I live in a suburban area in a city of over 150,000. The retail ISPs simply aren't interested in upgrading their equipment. They have partial monopolies in their coverage areas, and until it becomes so expensive that a third party can build infrastructure cheaper than the incumbent can upgrade, IPv4 is here to stay.

Re:It's the end of the world as we know it!

[Anonymous Coward]

Stop. Just stop.

Feeding 'reclaimed' IPv4 addresses back into the system is just pissing in the wind, and attempting to deny to problem exists, sticking your fingers in your ears going 'LALALALALA...'.

Grow the fuck up.

Re:It's the end of the world as we know it!

[Anonymous Coward]

Yeah. Okay. And how many companies are sitting on vast blocks that are only partially tapped?

Almost none, except for companies that have been grandfathered in from the beginning of the Internet. ICANN cannot legally touch those. It would cost those companies a lot of man hours to remove those IPs, potentially months, and even after those months of work, the number of IPs returned would only last a few weeks.

The only way to efficiently make use of the IP addresses is to be less wasteful, which means smaller subnets, which means more routes. We're already bumping up against the limit for the number of routes core routers can handle. The whole point of large wasteful blocks is to make management and routing more efficient.

You propose to fix a problem by making other worse problems.

Re:It's the end of the world as we know it!

[Creepy]

Now someone convince my ISP to upgrade their damn hardware already (PPPoE that only supports IPv4). My machines and domain were configured to support IPv6 for a decade-and-a-half now, but only one ISP supported it. Had to drop that line (run by COVAD) due to the expense and not needing 99.9% uptime requirements (because I stopped running a business on it - it now runs my hobby site).

Re:It's the end of the world as we know it!

[Holi]

How about Apple's then.

Re:It's the end of the world as we know it!

[rickb928]

"Almost none, except for companies that have been grandfathered in from the beginning of the Internet."

Almost one is an actual value. Better expressed as 'some'.

I'm guessing that at least some of the 20+ owners of /8 blocks could part with them entirely and manage, but who will pay that expense? A few are actually selling off space. Some have complex ownership structures now due to spinoffs and divestitures. Some will be deaf to the requests.

And some thoroughly enjoy the cachet of a /8 address space, even if no one ever really knows it.

But if you want to push this and recover some /8s, call Dick Cheney, Xerox, HP, and MI5. Let me know how that works out for ya, I'm up for a good chuckle..

Re:It's the end of the world as we know it!

[phantomfive]

Specifically, if you are interested in buying some from companies who already have them, you can go here.
Presumably they will get more and more expensive until it's cheaper to just get hardware that supports IPv6.

Re:It's the end of the world as we know it!

[greenwow]

> without any form of guarantee.

That part is not true. ICANN owns the address space, and their agreements state they can take some or all of it back if it isn't being used. The company I work for lost all of our /19 because they discovered we lied and had no intention of even using the space.

The Eli Lilly Crime Family would be an excellent target for ICANN. The family has for over a century hurt the public, and is only using a tiny fraction of their over 16 million IP addresses. That family hates us.

Plus, the USPS was prepared to give part of 56/8 back until the Bush asshole threaten to put people in prison for treason. The moron thought honoring the agreement on the use of IP addresses was treason. How stupid.

Re: It's the end of the world as we know it!

[Creepy]

I live in a moderately large city and a densely packed suburb, but have had that problem for years, but only because I refuse to do business with Comcast. The providers outside of Comcast seem disinterested in updating any hardware in the neighborhood because we lack businesses. Comcast, OTOH, has rolled out new services to my neighborhood first, exactly because we are densely packed and they care less about business services than selling TV package bundles (internet is secondary, businesses are a bonus, but not a big TV draw). CenturyLink has added service to the north, south, and west of me almost certainly because they are densely packed with businesses.

That said, Comcast's TV packages were too spendy for my tastes, and that caused me to go down the rabbit hole of not bundling with them, and then they charged me $10 a month for not doing that, and then that makes CenturyLink cheaper for internet, and so on. I honestly think it should be illegal to bundle your own products at a discount. It is anti-competitive to undercut competition only through bundling your own products, and especially when the competition doesn't offer the same range of products because you're a regulated monopoly (i.e. nobody else can run cable lines by law - they have a monopoly on this).

Re:It's the end of the world as we know it!

[foradoxium]

you pay $25/m to lease 5 static IPs...

Re:It's the end of the world as we know it!

[silas_moeckel]

You realize that those old legacy spaces do not fall under that agreement?

Re:It's the end of the world as we know it!

[Anonymous Coward]

Only a tiny fraction of people online today, were around to see the internet when it worked. Remember when every machine had a real routable IP address. NAT sucks for everything but making windows machines slightly harder to find before infesting them with malware.

Re:It's the end of the world as we know it!

[bobstreo]

you pay $25/m to lease 5 static IPs...

Comcast?

Re:It's the end of the world as we know it!

[Kjella]

Furthermore, even if they would manage to return the blocks to the pool in a couple of years, it would both be too late and too little and the demand for address space far outpaces the supply that ipv4 can offer.

This. We got 7 billion people - probably closer to 10 before it peaks, and as a minimum I should have one IP address at home, at work and for my cell phone. So 3*10 billion is 30 billion, IPv4 can offer 4 billion. And that's not counting every other odd thing I might want, like remote-controlled alarm/heating/whatever at my cabin or my car, servers of various kind and maybe IoT will become good for something.

Of course they probably could have just done it much, much simpler by making a dotted quad a dotted quint:

1.2.3.4.5

For compatibility each host under 1.2.3.4.x is granted 256 ports IPv4 ports mapped from x*256 to (x+1)*256-1 to a designated "IPv4 compatibility ports" like say the last ports from 65279 to 65535. So 1.2.3.4.1 can either be fully addressed by quint-capable equipment or 1.2.3.4:256-511 that'll be mapped to 1.2.3.4.1:65279-65535. And 1.2.3.4.2 will have 1.2.3.4:512-767 mapped to 1.2.3.4.2:65279-65535 and so on. You could use the same technique to provide a virtual IPv4 interface for legacy software, it thinks it is listening to 1.2.3.4:256 but it's really listening at 1.2.3.4.1:65279 - and any application it tells to connect to 1.2.3.4:256 would work.

That would have led to a gradual 256-times expansion of the address space without any hard switch-offs. But instead they decided to solve everything and now 19 years after the IPv6 standard we're still only barely in motion.

Re:It's the end of the world as we know it!

[AchilleTalon]

At least Thompson is not running out of addresses despite he is likely to have routing problem with these volatile routing tables due to Alzheimer.

Re:It's the end of the world as we know it!

[bbn]

Replying to the guys that said it is illegal to sell: not only is it legal, but several of the internet registries put up their own marketplace for trading IP address space.

Here is a list of RIPE approved brokers: https://www.ripe.net/manage-ip...

Re:It's the end of the world as we know it!

[Anonymous Coward]

You may have many a textually compatible IPv4 extension, but routers and firewalls do not do string manipulation. They have well defined data structures of exact sizes and anything that attempts to change those sizes breaks compatibility.

Re:It's the end of the world as we know it!

[bbn]

That has already been invented. It is called address plus port (RFC 6346 or A+P): https://tools.ietf.org/html/rf...

But it will only be used for "compatibility" - to communicate with IPv4 hosts that have not yet been upgraded to IPv6. If you think about it, there are no reason to deploy devices that can understand "quints" as that is just as big an upgrade to the IP stack as switching to IPv6.

Your home router will run the A+P function. It will share an IP address with other customers at your ISP. You will be assigned a port range with that shared IP address. The router will simply do NAT, so your devices on the home network do not need to know anything about this.

At some point you will find that it sucks not to be able to run ssh on port 22 and http on port 80. Therefore your helpful ISP has also provided you with IPv6, where no such limitations apply.

Also the trick only works with UDP and TCP, as other IP protocols do not use ports.

Re: It's the end of the world as we know it!

[buchanmilne]

Depending on the features the ISP needs, there may not be a suitable upgrade yet.

For example half-duplex vrf isn't available on Cisco ASR9K (Cisco's IPV6-and-RFC-compliance-first platform) and on Cisco ASR1K it doesn't support IPV4. As far as I know, ALU BNG also doesn't support IPV6 in HD VRF.

This is the reason for no native IPV6 over adsl in South Africa

Re: It's the end of the world as we know it!

[buchanmilne]

Depending on the features the ISP needs, there may not be a suitable upgrade yet.

For example half-duplex vrf isn't available on Cisco ASR9K (Cisco's IPV6 and RFC compliance first platform) and on Cisco ASR1K it doesn't support IPV4. As far as I know, ALU BNG also doesn't support IPV6 in HD VRF.

This is the reason for no native IPV6 over ADSL in South Africa

Re:It's the end of the world as we know it!

[Drakonblayde]

Alot of that growth is actually due to Comcast.

Cable Modem IP's were changed over to use IPv6 for their management addresses a couple years ago. Most Comcast CMTS's have very little space allocated for IPv4 management (usually a single /23) for those who are still running older modems that can't do IPv6 at all.

Likewise, DHCPv6 has been deployed for a couple years as well. So if you're using a consumer grade router that has IPv6 capability, it will pull a v6 allocation.

Since virtually every single modern OS has v6 capability, it's turned on by default, and it's preferred over v4, there are quite a few people out there who are going to popular v6 enabled websites (google, facebook, etc) without even realizing it.

I'm a network ops monkey for Comcast, so have direct experience in all this (one of my primary job functions was to get all the routing kinks worked out for a large part of the network before IPv6 day back in 2012), and while we're not on the verge of running out of v4 space, it's alot tighter than it used to be, and we're pretty careful about how we allocate them, we have a team dedicated to managing the v4 space, and they're pretty good at making sure we don't have large gobs of v4 space sitting around allocated but unused. We do alot of work to drive as much to v6 as we can without making it hard on the customer.

It wouldn't surprise me if there are other major ISP's who are doing the same. You can expect growth in this area as more and more networks realize the same thing, and as folks upgrade their old gear.

Re:It's the end of the world as we know it!

[Macrat]

How about Apple's then.

You think Apple has an unused blocks?

Especially with all the data centers and CDN edge servers they are running?

Re: It's the end of the world as we know it!

[sabri]

Depending on the features the ISP needs, there may not be a suitable upgrade yet. For example half-duplex vrf isn't available on Cisco ASR9K (Cisco's IPV6-and-RFC-compliance-first platform) and on Cisco ASR1K it doesn't support IPV4. As far as I know, ALU BNG also doesn't support IPV6 in HD VRF.

Redback Networks (acquired by Ericsson) supported IPv6 since 2010 on all their SmartEdge series BNGs...

Re:It's the end of the world as we know it!

[Cramer]

Nope. If you have what's called a "legacy allocation", then your block is old enough to not be encumbered by any of ARIN's current rules.

Re:It's the end of the world as we know it!

[petermgreen]

If the price to buy or lease IPv4 addresses rises people will reevaluate what applications really need a public IPv4 address and what applications can manage with IPv6 and/or private/shared IPv4.

Windows vista and android 3.x introduced support for server name indication which allows mulitiple https sites to be hosted behind the same IP address. With windows XP and android 2.x in decline more people will find it acceptable to host their https sites on shared IPs. Already some hosting providers are offering SNI based shared https hosting. If IPv4 addresses become too expensive I would expect hosting providers to introduce SNI reverse load balancers to allow v6 only customer servers/vms to serve v4 only clients.

The big access providers who long dragged their heels on IPv6 are looking at it seriously. Usually in conjunction with a mechanism to provide access to servers on the IPv4 internet without giving every end user a public IPv4 address such as DS-LITE, NAT64/464XLAT or traditional CGN. This will mean an increase in the proportion of users who can access IPv6 only resources and possiblly also a freeing up of IPv4 IPs.

So IPv4 addresses are likely to be a pretty volatile asset. They will probablly peak higher than their current price (lets be honest the current price of about $10/IP* is peanuts) but they may also drop off a cliff as the IPv6 transition progresses.

Also there is provision in the RIR rules for permanently transferring address blocks to another organision (a sale) subject to restrictions at some RIRs that address use must be justified (which can make selling the bigger blocks problematic, few if any organisations would be able to swing a believable justification for a /8). I'm not sure there are any similar provisions for temporary transfers (a lease) of IPs only. Of course IPs can be tempoerrally allocated to customers but that really only works if your organsiation wants to be in the ISP or hosting buisness.

* http://ipv4marketgroup.com/bro...

Re:It's the end of the world as we know it!

[thegarbz]

Yeah. Okay. And how many companies are sitting on vast blocks that are only partially tapped?

Are you suggesting splitting up large blocks and then assigning them to disperse networks further screwing up the already exponentially bloating routing tables that barely hold the internet together as it is?

I don't think you quite understand what goes into your packets making it from your computer to 216.34.181.45 so you could post that comment.

Re:It's the end of the world as we know it!

[petermgreen]

That part is not true. ICANN owns the address space, and their agreements state they can take some or all of it back if it isn't being used. The company I work for lost all of our /19 because they discovered we lied and had no intention of even using the space.

The big legacy assignments predate those agreements. It is much less clear legally whether ICANN and/or the RIRs have the right to reclaim legacy space than with more recent assignments.

There is also the question of how much legal power ICANN has over IP addresses in the first place. Is there actually any law that you should route traffic for an IP address to the organsation that ICANN says owns it? Is there any law preventing the teir 1 providers from collectively telling ICANN to go fuck themselves and setting up their own body to decide who has the right to advertise IPv4 addresses on their networks and hence the internet? I'm not aware of any.

And there isn't much point, reclaiming those blocks would have just slightly delayed the end of cheap and easy IPv4. Since the widespread adoption of IPv6 is highly dependent on the end of cheap and easy IPv4 I doubt reclaiming those blocks would have made much difference in the end.

Re:It's the end of the world as we know it!

[drinkypoo]

Of course they probably could have just done it much, much simpler by making a dotted quad a dotted quint:

But that would have resulted in a strange number of bits of addressing, and actually made everything much more complicated, so they skipped it. It really had to be a multiple of 32 bits, and obviously, they went big.

Re:It's the end of the world as we know it!

[petermgreen]

The unusual thing about comcast is they are an insanely large triple play provider with a heavy reliance on IP. Their triple play services ended up using about 8-9 IP addresses per household* . Of these only one (the customer's internet device) needed to be a public IP but comcast's system was so damn large and IP hungry that they ran out of space in net10 and had to start using public IPv4 addresses for internal management.

So while most non-botique access providers were probablly thinking "meh, when the IPv4 crises hits we can keep going almost indefinitely with CGN, lets let someone else be the early adopter of IPv6" comcast didn't have that buffer. They faced a stark choice between stopping expansion of services, federating their network**, or adopting IPv6. They chose IPv6.

That is why comcast is so ahead of the game on IPv6.

* http://meetings.ripe.net/ripe-...
** That is splitting it into multiple sections to allow IP reuse and redesigning their management systems to cope with it.

Re:It's the end of the world as we know it!

[Chas]

Question: Why does "every other odd thing" have to have a public address?

NAT!

Re:It's the end of the world as we know it!

[thogard]

The idea of using port bits was around in 1992. It migth have been where the / notion orignated as a way to say 192.168.1.1/34 would take two bits off the port bits.

The interesting thing about this is that core routers and swtiches won't care at all and anything that is doing NAT can already do the translations needed. The problem is 1) the notation and 2) which bits get used. If more programs supported DNS SRV records, then this would be completely transparent.

Re:It's the end of the world as we know it!

[KGIII]

Each of my DSL connections has a static IP address. I left one turned off for weeks (it is generally unused unless someone visits for an extended period) and when it was turned back on again it was still the same IP address even. I did not ask for them, I do not pay extra for them, and as near as I can tell this is not the norm with Fairpoint. I do not pay for business class DSL or anything though I did pay to have the CO and lines run so that I can have DSL. Additionally, I have three connections total (one in the old house that was here when I had my house built - I call it the guest house, one in the garage/shop, and one in the house) so maybe they shunted me off to business class without asking me? My online portal is very clearly residential and the bill said residential back when I paid it with dead trees.

Re:It's the end of the world as we know it!

[marka63]

Because it make security and debugging easier. NAT despite what you appear to think, actually make security and debugging worse.

Re:It's the end of the world as we know it!

[Sun]

In Israel, the one ISP supporting IPv6 is also the cheapest, but also the crammiest.

Go figure.

And they won't give you a fixed IPv6 address without paying extra (though the IPv6 address they do give you are /64, so no shortage of anything).

Shachar

Re:It's the end of the world as we know it!

[TheTurtlesMoves]

Its 2015. Everyone is a expert in networking cus they changed the password on their home router. And NAT is a firewall!

Joking aside. 99.99% of people have not idea on just how much NAT breaks things. And how it add zero security.

Re:It's the end of the world as we know it!

[KGIII]

What was surprising and did not match the rest of my home-use experiences was that I get the same address every time. The one that remained turned off got the same IP address back after about a six week disconnect from the power that ran the router. That is what was different than my usual experiences. I typically would return home after a weeks vacation and find the IP address had changed when I powered the router back on. That was the expected behavior from what I had been conditioned to anticipate. Having it different, a static IP address, was a nice surprise.

I used to pay attention to my IP address because I would often connect from work to retrieve data that I did not bring with me. It was important that I use an IP-to-domain service that enabled me to just use a single URL to connect to my system and access my files. I would just update that information when my IP address changed and eventually found a freeware application that enabled me to just skip the manual updating. I think the service I used was dyndns and the freeware application is behind unwilling to power on neurons.

This is where I meant to post this response. Somehow I ended up posting it in a different thread. I can only assume that stupidity was involved. My own involvement is the reason that I suspect stupidity. With this reply, though, that has been taken care of.

Re: It's the end of the world as we know it!

[catprog]

Only if they sold each item to you individually.

Re:It's the end of the world as we know it!

[mgcarley]

Yeah. Okay. And how many companies are sitting on vast blocks that are only partially tapped?

Almost every university, for starters... Several of them that I know have /16s even though they only need maybe a /19 - or, arguably, even just a /23 or /24... because does every single machine on their network need a public IP? Not likely.

Re:It's the end of the world as we know it!

[petermgreen]

I searched for microsoft nortel broke rules and found a very different picture. http://www.internetgovernance....

The summary seems to be that ARIN has basically no power over these legacy (pre RIR) blocks.

Reamining stock

[The Grim Reefer]

as its stock of reamining address reaches exhaustion.

Perhaps they should stop using the reamining stock and switch to the remaning list. If there aren't any there, they can go to the reimaging stock.

Proofread.

[alexjplant]

EMBARCE! EXTNED! EXTNIGUISH!

Re:Proofread.

[rubycodez]

My pet Dalek sounds like that when he has a stuffed proboscis

Re:Proofread.

[Anonymous Coward]

EXTREMINATE!

Cell phone uses IPv6

[jfdavis668]

My cell phone has been on IPv6 for years. Everything I have is ready for the conversion. What is holding it up?

Re:Cell phone uses IPv6

[halltk1983]

Comcast Business, which only got me dynamic ipv6 a couple months ago, and still haven't gotten around to static allocations to match my static v4 allocation. Also, a lot of people's home routers. But mostly apathy.

Re:Cell phone uses IPv6

[funwithBSD]

Meh.

Whatever.

Re:Cell phone uses IPv6

[bondsbw]

My cell phone has been on IPv6 for years. Everything I have is ready for the conversion. What is holding it up?

Suckage.

I recently disabled IPv6 on my router because too many sites were slow loading. It was particularly bad with Wikipedia, which usually just timed out after a few minutes. OTOH, IPv4 works fine for the same sites.

I don't know where the trouble is, Wikipedia or my ISP (U-Verse) or somewhere in between or some problem with my computer... but in its current state, I can't endorse switching.

Re: Cell phone uses IPv6

[WindBourne]

It is conversions and tunnels that add real overhead. Best thing is to get large isps to simply switch their residence over to ipv6.

Re:Cell phone uses IPv6

[undefinedreference]

Comcast in general is more like it. They're the 9,000,000,000 pound gorilla in the corner of the room that has a stranglehold on most internet service anywhere outside a big city in the country, exceptional internal incompetence, and positively unfathomable institutional inertia. I don't think even an act of congress would be able to fix it, short of deregulation and breaking them up like they did with AT&T.

Re:Cell phone uses IPv6

[Creepy]

The addresses are longer, so there will be a bit of a hit because of that, but I suspect the routing table for IPv6 between you and that site has fewer nodes and those nodes are overloaded. Either that or the government is weighting certain nodes to route your data to specific places like England and back so they can vacuum it all up and use it for domestic spying. That would be the paranoid option, as they definitely wouldn't do something like that. Or would they?

Re:Cell phone uses IPv6

[Ingenium13]

Same with Comcast. I tried for a years actually, but some things were too slow. Ubuntu and Debian repos in particular were painfully slow, even on my VMs on linode, digital ocean, and prgmr. I ended up having the servers force IPv4 for them when their IPv6 servers went down for days. Speed and latency on IPv6 have gotten much worse over the last couple years in my experience.

Also, it appears Android doesn't play nice with IPv6. It basically silently drops the connection eventually (I'm guessing it stops listening for the RA broadcasts), and push notifications fail. Happens on Samsung devices and my Nexus 6. So it's reliable either push notifications and low latency site loading, or use IPv6. I finally bit the bullet and disabled IPv6 on the router and all my issues went away.

Re:Cell phone uses IPv6

[Ingenium13]

Oh, I forgot to mention Netflix. Netflix streams would just drop, or would be slow, or say service was unavailable, particularly at night. Haven't had an issue since disabling IPv6.

Re:Cell phone uses IPv6

[laie_techie]

Comcast Business, which only got me dynamic ipv6 a couple months ago, and still haven't gotten around to static allocations to match my static v4 allocation. Also, a lot of people's home routers. But mostly apathy.

I'm in the same boat. I have a static IPv4 from Comcast, but don't even get a dynamic IPv6 on that connection. I don't want to give up my static IPv4 until almost all my customers have IPv6.

Re:Cell phone uses IPv6

[Drakonblayde]

My cell phone has been on IPv6 for years. Everything I have is ready for the conversion. What is holding it up?

Suckage.

I recently disabled IPv6 on my router because too many sites were slow loading. It was particularly bad with Wikipedia, which usually just timed out after a few minutes. OTOH, IPv4 works fine for the same sites.

I don't know where the trouble is, Wikipedia or my ISP (U-Verse) or somewhere in between or some problem with my computer... but in its current state, I can't endorse switching.

I actually see alot of this. Customers complaining about slow surf, and these days, that's one of two things - A. Capacity B. Bad IPv6 routing. Since v6 is preferred, if the v6 path is bad, it'll take awhile to time out before it falls back to ipv4, and looks alot like network latency.

A large part of the problem is that companies are defining AAAA DNS records without making sure that their upstream provider has actually gotten their v6 routing in shape, but even the ones that have done that doesn't help when the end user is connected to a network that isn't directly connected to their destination, and the end users provider doesn't have their v6 routing in shape.

The real holdup, however, are the end user networks. Most of them simply aren't built to be accessible over ipv6. It's possible for the ISP's to provide entirely transparent v6 connectivity to it's end users, but if the places they're trying to go isn't v6 capable, that engineering has gone to waste. It's still wise to do it, as a migration to v6 is inevitable, but it's hard to justify the money making it right.

Unfortunately, I suspect that most folks will simply try and use stopgap measures. Carrier grade NAT, transparent gateway proxying, etc.

Eventually there will come a point where someone smart will say 'you know, we're spending alot of time and effort and adding more points of failure to the network to try and keep this legacy connectivity alive. It will actually simplify operations if we just go ipv6 native'.

If you're smart, and you have the opportunity to build out a network in this time and place, you do it dual stacked, and treat ipv6 connectivity as seriously as you treat ipv4 connectivity.

Re:Cell phone uses IPv6

[Megane]

If you have a relatively recent (Motorola) router, Uverse uses a 6to4 translation. I have a /29 static, and while technically that means I have IPv6 space corresponding to all eight addresses in that range, I don't know if they would get routed properly. I'm moving in a few months and don't have time right now to dick around with routing the IPv6 into my LAN; I was happy enough that I was able to keep most of my old NAT LAN configuration without having the new router make me do tricks. But for the few machines I have on the WAN side, IPv6 does at least work okay as a client.

Re:Cell phone uses IPv6

[LessThanObvious]

Notice how the servers you access and basically all the non-mobile portions or the internet are not IPv6? You have NAT 64 or dual stack shielding you from the lack of resources available directly from IPv6. Nothing wrong with that in and of itself, but consider how much is left to convert to roll over to IPv6 as the predominate protocol. Also consider how many of the infrastructure components and devices in use today are not currently capable of decent IPv6 native support. It's great that we are starting to see some movement in the right direction, but the day when you step into a typical office or jump on public WiFi and use your IPv6 address to access resources that are also on IPv6 and just rarely have to involve IPv4 for some legacy beastie left over from the dark ages, are still far off. There should never be any reason for this to become a crisis, we only need to make steady progress in the right direction until we reach the inflection point where businesses will find it compelling to put resources behind embracing the transition. Mobile has fortunately led the way which is a very good thing considering the growth in mobile devices. The rest of the world may just need a little push to get us past some of the pain that is inevitable when IPv6 conversion isn't yet a line item on very many budgets.

Re:Cell phone uses IPv6

[Skapare]

not really ... my home comcast is still ipv4-only. i have to tunnel out to get to v6 space to test http://ipv6.linuxhomepage.com/

Re:Cell phone uses IPv6

[herbierobinson]

Somebody has to log in to a rather large number of routers and switches to enable IPv6 and possibly do a firmware upgrade, first. In case you haven't done it, yet, upgrading the firmware on a router/switch is the computer maintenance equivalent of going to the dentist. Especially when you save your configuration and the new firmware doesn't recognize the config file...

BTW, my cell phone has an IPv6 address, too.

Not sure how true this is, but I have heard that some of the large phone companies have so much internal switching equipment that they have run out of internal IPv4 addresses for the switching equipment (not to mention end user devices).

Re:Cell phone uses IPv6

[herbierobinson]

This is actually something you configure on your own computer. The FreeBSD command for doing it is ip6addrctl. I'm not sure what it's called on other systems. Also, note that the FreeBSD man pages are vague. You will also need to rfc-3484 to actually be able to use it. The man pages say it affects source and destination address selection, but they don't say how. It has two effects:

1. The command controls the sort used for DNS results. The default is to sort IPv6 addresses first. Properly converted applications actually get a list of IP addresses back from DNS and they are supposed to try them in order until the get one that works.

2. The command also controls which source address is paired with a destination address. This is less important, but something one might occasionally want to do.

For most ISPs in the US, it probably makes more sense to sort IPv4 first. At least for the next few years.

Just reuse them...

[Anonymous Coward]

Everyone I know just uses 127.0.0.1. What do we need all these new ones for?

Re:Just reuse them...

[hcs_$reboot]

Actually - except Ubuntu who uses 127.0.1.1 as well (due to some bug) - the 127.0.0.0/8 network is a waste as a whole "class A" is unused (IPv6 reserves just one address for the loopback access, ::1!).

Re:Just reuse them...

[Megane]

Also, the "Class D" (multicast) address space (224/4) is extremely under-utilized (IIRC, only 3 of the 16 /8s are even used), and IPv4 multicast is mostly a failure anyhow.

And the "Class E" space (240/4) is unusable because the TCP/IP stack in Windows NT and later was explicitly coded to consider those as bad addresses and not even attempt to communicate with them. Thanks a lot, anal-retentive programmer-guy.

Those two together account for 32 "Class A" equivalent addresses, or one eighth of the IPv4 address space.

Re: Just reuse them...

[Holi]

and retarded not retard.

Re: Just reuse them...

[Anonymous Coward]

I think his retort was perfectly cromulent as written.

Re:Just reuse them...

[Al Al Cool J]

Wait - so we could have a whole section of the internet that Windows computers fundamentally can't access? Sign me up!

Re:Just reuse them...

[Skapare]

i use 127.0.0.127 .... it's a longer address.

Cloud

[cdwiegand]

Wow, if only some major provider of computing resources could somehow pool them and resell access, and support IPv6 at the same time. I bet that would drive adoption. Oh well, it was a dream. Still can't use it on Amazon (excluding the worthless-to-me ELB).

Re:Cloud

[mars-nl]

Still can't use it on Amazon (excluding the worthless-to-me ELB).

Microsoft Azure does not support IPv6 at all. From Azure's FAQ:

Does Azure support IPv6?

Microsoft has played a leading role in helping customers to smoothly transition from IPv4 to IPv6 for the past several years. To date, Microsoft has built IPv6 support into many of its products and solutions like Windows 8 and Windows Server 2012 R2. Microsoft is committed to expanding the worldwide capabilities of the Internet through IPv6 and enabling a variety of valuable and exciting scenarios, including peer-to-peer and mobile applications. The foundational work to enable IPv6 in the Azure environment is well underway. However, we are unable to share a date when IPv6 support will be generally available at this time. For more information on IPv6 technologies and IPv6 support available in the Windows operating system today, see Microsoft’s IPv6 information site which includes business, technical, and developer resources: http://technet.microsoft.com/e...

So, no. Maybe some day.

Source: http://azure.microsoft.com/en-...

Goodness

[American AC in Paris]

Hey, maybe this is a Serious Thing.

It's tough to tell, though, as we've been OMG RUNNING OUT OF IPv4 ADDRESSES REAL SOON NOW for the past decade and a half, give or take.

Re:Goodness

[Anonymous Coward]

Well, "real soon now" just turned to "right fucking now". That's what this announcement is about. Those warnings you're joking about all just came true.

They cried wolf, and now there's a wolf. He's all up in your animal pen having a feast. So go hide your remaining livestock before shit gets worse.

In case that analogy didn't work for you, here's the TL;DR version: The warnings came true and we're now out of IPv4 addresses in ARIN's region. Switch to IPv6 now .

Re:Goodness

[sjames]

Perhaps all of that was an attempt to motivate at least a lukewarm response to the obviously coming problem so people wouldn't end up running around with their hair on fire later.

Re:Goodness

[American AC in Paris]

Perhaps all of that was an attempt to motivate at least a lukewarm response to the obviously coming problem so people wouldn't end up running around with their hair on fire later.

Oh I get that, I'm just saying that years of teeth-gnashing and arm-flailing has had pretty much the opposite of the desired effect.

This has been pitched as a dire and urgent danger for ages. The IPv4 address exhaustion problem Wikipedia article is nearly nine years old, for crying out loud.

This will get sorted out like pretty much every single other technical capacity issue gets sorted out: once the pain and cost of not acting becomes prohibitive, people will act, and it will cease to be an issue.

Re:Goodness

[sjames]

Unfortunately, in this case the pain spreads around. The sluggard isn't necessary the one who suffers for it.

ISPs get stuck dealing with NAT because too many servers are only reachable via v4, servers get stuck scrounging v4 addresses (possibly at great expense) because too many ISPs don't support v6, etc.

Re:Goodness

[Darinbob]

It's all about the applied application of Xeno's Paradox.

Re:Goodness

[AdamHaun]

I'm just saying that years of teeth-gnashing and arm-flailing has had pretty much the opposite of the desired effect.

Do you have any evidence for that statement? Do you believe that quietly saying "Hey, we need to spend a ton of money and 10-15 years upgrading the internet, but take your time, there's no hurry" would actually prompt businesses to act?

This has been pitched as a dire and urgent danger for ages.

We're changing the internet infrastructure of literally the entire world. Do you really think 10-15 years warning is too much? Think about all the things that have to happen. You have to create and formalize a standard for a new protocol, which takes years. You need to design, debug, and manufacture core routing hardware, which takes years. You have to upgrade all the consumer-level end equipment, which takes many years. None of this is trivial or fast. IPv4 took five years to go from final specification to total adoption, at a time when the total number of internet hosts could be measured in thousands. Today there are almost a billion hosts.

Re:Goodness

[david_thornley]

Don't worry, Captain. The water's just up to the second deck. We aren't in danger of capsizing until it hits deck three.

The addresses are there... but still...

[theendlessnow]

There are a few large companies in the USA that refused to relinquish large Class A blocks, shoot even to sell them... these companies (which I'd love to name) missed the boat when IPv4 address costs (for sale) was highest and are actually waiting for this next "crisis" in hopes that they can get billions for Class A nets (these companies date back to "the beginning" and the use their Class A addresses for non-Internet facing internal addressing (that is they are wasting the addresses) simply because they lack the skills to change). With that said, you may have to pay 100's of billions just because they lack the ability to change effectively. It's actually very sad.

Re:The addresses are there... but still...

[drinkypoo]

these companies (which I'd love to name) missed the boat when IPv4 address costs (for sale) was highest and are actually waiting for this next "crisis" in hopes that they can get billions for Class A nets (these companies date back to "the beginning" and the use their Class A addresses for non-Internet facing internal addressing (that is they are wasting the addresses) simply because they lack the skills to change).

IBM has the technical know-how to stop using routable addresses internally, but their class A is part of their culture. I imagine the same is true for other class A holders.

Re:The addresses are there... but still...

[amias]

one of those will be HP , when i worked there everything had a real ip but was firewalled and proxied which kind of defeated the point.

they could have just as easily used one of the reserved offline ranges

Re:The addresses are there... but still...

[rubycodez]

Not lack of skill, things are very nice when you can use real addresses for everything. I worked at national lab that is still that way even now

Re:The addresses are there... but still...

[xaxa]

It's correct to use assigned addresses for internal hosts. The point is they're unique — you can set up a tunnel between any two organisations, or merge two networks, and not have to renumber things because both were using 10/8.

The cost to renumber and use their assignment more efficiently would be huge, similar to the cost to move to IPv6 but with little gain.

Re:The addresses are there... but still...

[funwithBSD]

Yep.

Can't tell you how many times a day I hear or say "The 9".

Won't be the same unless... maybe we could get the range DEAD:BEEF assigned to IBM?

Re: The addresses are there... but still...

[WindBourne]

Poppycock. Best thing is for these companies, such as att, to keep holding them. We need to move off ipv4. Now, we have more and more incentives to do so.

Re:The addresses are there... but still...

[gstoddart]

Can't tell you how many times a day I hear or say "The 9".

You mean the Nazgul??

I always thought IBM was evil, but I never expected that.

Re:The addresses are there... but still...

[Dagger2]

The addresses aren't there. v4 is just plain too small. Freeing up a few /8s won't change that: there are more than 2^32 devices connected to the internet, so no matter how many blocks you reclaim, it's still not going to be big enough.

Re:The addresses are there... but still...

[Megane]

these companies (which I'd love to name)

Here, I'll name them for you... List of assigned /8 IPv4 address blocks

Well, okay, they're in that list somewhere along with everybody else. I've also heard that at least one of those networks in the UK (25/8?) isn't even connected to the routed internet, yet it is still assigned the space. And seriously, what does DISA really need four /8 blocks for?

And I find it ironic that HP ended up with two adjacent /8 blocks that can't be merged into a /7.

Re:The addresses are there... but still...

[funwithBSD]

If it is any consolation, we are usually bitching about how the 9 is slow....

Re:The addresses are there... but still...

[thrig]

They only managed token ring wraiths, though.

Re:The addresses are there... but still...

[theendlessnow]

No. Good (IBM) politically correct message though. IBM simply lacks the skills to make it happen and they use (brainwash) the masses with the word "culture" as a cheap excuse. IBM building a smarter planet... if you still live in the 60's.

Re:The addresses are there... but still...

[theendlessnow]

Lesson for IBMers and other people lacking knowledge or network skills, we've had private addressing for a while, and if IBM is going to toss every acquired network (and some are really nice) overboard and reassign anyway, why not start developing a migration plan today to private addressing? Again, the real reasons have nothing to do with cost and/or culture. Have everything to do with "it's too difficult for IBM" and "IBM is too lazy". Remember, IBM is forcing acquired companies to use "the 9" so you have to renumber anyhow. IBM already knows how to glue foreign networks in during transition. No, your arguments as to "why" are not the real reasons. And I'll tell you right now that you'll never get a truthful answer from IBM. It's not part of their culture. Also remember, while not IBM (thus unimportant low lifes to IBMers), many companies did the right thing and moved to private addressing and even returned their large land grab blocks... Sure, it meant that "culturally" those companies had to change. And IMHO, some culture change at IBM could be a really good thing.

Re:The addresses are there... but still...

[drinkypoo]

No.

Yes.

Good (IBM) politically correct message though.

I haven't worked there for years and years, and I didn't even work for IBM proper; I worked for Tivoli, which hadn't yet been fully subsumed into the IBM culture. I did, however, have access to the 9 net, and there really is a whole little world in there. It's part of how IBM keeps people on the reservation.

I've got some I can sell ya

[Snotnose]

I'm only using 8 addresses out of my 192.168.1.1/24 class C block, I could probably be talked into auctioning off the other 240+ addresses. Call me, maybe?

Re:I've got some I can sell ya

[higuita]

I have several full class C (10.*.*.0/24) to sell, cheaper than the previous post!! don't wait, call now! :)

Re:I've got some I can sell ya

[Dagger2]

Which is what... two years worth of IPs? That's not going to solve anything. No amount of reallocating or reclaiming or reshuffling is going to save v4, because v4 is just plain too small.

We might be able to buy some extra time that way, but we've had plenty of time to handle things already. More time isn't going to help at this point.

Re:I've got some I can sell ya

[Megane]

I'm only using a few out of my 127/8 class A block, the bidding for the rest starts at one milllllllion dollars. (puts pinky next to mouth)

Re: I've got some I can sell ya

[Snotnose]

Sure, what is your phone number?

It's in my IPv6 address.

Re:I've got some I can sell ya

[Drakonblayde]

Never going to happen. IPv4 network stacks are hard coded to not recognize anything 224 and above as valid host addresses. In order to actually use the multicast space, you would quite literally need to update every single network and host device in existence to support that. And not just the v4 stacks, it'd also be lower level things like the dynamic routing protocols that use link local multicast for neighbor discovery.

The amount of cost and pain it would cost in order to reclaim the Multicast and experimental ranges far outstrip the costs and pain to simply migrate to ipv6, especially since the amount of space gained is paltry compared to the growth needs.

Re:I've got some I can sell ya

[Dagger2]

*twitch*

"class C"?? 10/8 is class A. It's almost as far away as you can get from the class C ranges!

Re:I've got some I can sell ya

[higuita]

re-read the comment, i'm selling many class C from a big class A
if i sell half of the class A, i would be rich!! :D

Re:I've got some I can sell ya

[Dagger2]

Well, I read it, but... the class A space and the class C space don't overlap. You can't have class Cs from 10/8, because the class C space is 192.0.0.0/3.

Re:I've got some I can sell ya

[higuita]

i'm referring to class A/class C as ip space allocation ranges (size), not as "static groups of IPs" (special ranges)

Check the https://tools.ietf.org/html/rf... , no place there they say that a class C starts in 192.0.0.0 and that Class A can only start in 10.0.0.0, they only talk in sizes

I know that some people consider that class A is only 10/8 and class C is 192.168.0.0/24, but i have no idea where they bring that, maybe they are confusing the classes with the private IPs as they are usually used as examples of one to another.

Anyway, for me, a class A network (/8) starting in any IP can have about 65025 (255*255) class C (/24) networks, right or wrong, this is the way i use it. :)

Re:I've got some I can sell ya

[Dagger2]

Look at page 2 of the RFC you linked. It explicitly says that class C networks are /24s that start with 0b110, i.e. are in 192.0.0.0/3, and class A networks are /8s that start with 0b0 ("in 0.0.0.0/1").

Hence "*twitch*". If you want to talk about /24s, just call them /24s.

Fricking finally.

[Arancaytar]

Maybe after twenty years, companies will get around to fully supporting IPv6.

(That, or they'll start abusing the shit out of NAT.)

Re:Fricking finally.

[Anonymous Coward]

Start?

Re: Fricking finally.

[WindBourne]

Nearly all networks are ready. Best to simply have 1-3 large isp , say Comcast, Google, and time-warner, switch their residence over to ipv6 ONLY. When business get calls about lack of ipv6, then they get on the ball.

Re:Fricking finally.

[myrdos2]

My guess is that IPv4 will be functionally dead within 5 to 10 years:

https://www.google.ca/intl/en/ipv6/statistics.html

Free IPv4 /8

IPv4 address daily assignment rate

Re:Fricking finally.

[hcs_$reboot]

Well, you can always NAT NAT.

Re:Fricking finally.

[hcs_$reboot]

Let's hope Google already reserved the two easy to remember 8:8::8:8 and 8:8::4:4 for their DNS servers!

Re:Fricking finally.

[Anonymous Coward]

It'll be used indefinitely because ::ffff:[address] will keep those addresses usable forever. As long as there is a router at the edge of the network that can translate to IPv4, it'll be used. There's so much legacy equipment that using IPv4 locally will probably be the norm for all but IoT devices for the foreseeable future.

Re: Fricking finally.

[Drakonblayde]

They don't call the businesses that they're trying to reach and can't though.

They call the ISP.

Since Comcast now has more Internet customers than cable subscribers, taking an ipv6 only stance would be committing suicide. The subscriber loss (and therefore, revenue loss) that would incur would piss off the shareholders, who would murder the company for failing in their fiduciary responsibility.

Instead, Comcast is fully dual-stacked. As companies transition over to ipv6, the Comcast network is ready and fully capable of supporting them.

Re: Fricking finally.

[WindBourne]

I do not think so.
I think that the big sites are ALL ready for IPv6. Netflix, Walmart, Amazon, etc are all ready.
So, if several of these large ISPs decide to go IPv6 only, they MIGHT lose a few customers, but I suspect not many. In fact, if they announce this together and give others 1 year to get their act together, we would likely see a change on all sites/ISPs.

Re: Fricking finally.

[Drakonblayde]

Ok, you can think all you want.

You're wrong. I get to handle messed up issues where folks can't reach ipv4 sites on a fairly regular basis.

Our customers do not call the company of the website they're having a problem reaching. They call us. And when we find out that the problem isn't on our end, our folks have to get in touch with their provider, who will then either fix it (if it's their fault) or talk to their customer and get them to fix it.

If the big ISP's decided to take a 'you will use ipv6 only stance', then grandma would be mad at us if she couldn't read and post on her basketweaving forum.

Now, don't get me wrong, I'd love it if we'd be ballsy enough to make such a move. But the average end user is not understanding or reasonable. They expect their stuff to just work, and when it doesn't just work, they get mad at the people they're paying money to in order to make it work.

In a market that's saturated and the only growth comes from taking your competitors customers, we'd be handing our competitors a golden opportunity to stick it to us. I can see the ad campaigns now 'Comcast won't let you get to your basketweaving website? Come to AT&T! We have full internet connectivity!'

Re: Fricking finally.

[WaffleMonster]

Instead, Comcast is fully dual-stacked. As companies transition over to ipv6, the Comcast network is ready and fully capable of supporting them.

Still waiting for my static IPv6 allocation from Comcast.

Re:Fricking finally.

[thogard]

Was also setting up 2001:4860:4860::4860 or 2001:4860:4860::2001 too hard?

Re:Fricking finally.

[TheTurtlesMoves]

You not suppose to use the numbers directly. If you want more than 10 billion devices on the internet, why would you expect to "remember" the address. Do you even bother remembering phone numbers anymore?

Re:Fricking finally.

[Dagger2]

Not really:

"What's the DNS IP?"

"It's at 53"

"Got it!"

and everybody involved in the conversation understands that the IP is 2001:db8:42::53, since the company's allocation is 2001:db8:42::/48. Heck, this is less bits to remember than 203.0.113.42 + 10.10.10.1, so if anything you're describing a problem with v4, not v6.

Re:Fricking finally.

[petermgreen]

Normal NATs use one internet ip:port combination for each active (activity may be determined by timeouts and/or by watching for connection closures) internal ip:port combination. That means you can only have ~65K active outgoing connections per internet IP.

You could build a high ratio NAT which didn't do that. Technically for basic connectivity to work the source IP/port combination only needs to be unique for a given destination server (possiblly even a given port on a given destination server) but building such a thing would totally break most nat traversal techniques and hence break things like P2P and online gaming even worse than a normal NAT would.

NAT also really doesn't help much on the server side because people expect their services to be on well-known ports. For some services you can host multiple hostnames on the same ip either by serving them from the same server or using a reverse proxy but for others that is less practical. One specific case of interest is https. Right now for https services that matter people want a dedicated IP because of older clients that don't support SNI but as windows XP and android 2.x decline that will become less of an issue.

Re:Hakuna matata

[medv4380]

A lot of that has been mitigated by not giving each cell phone it's own public IP4 address. If cell phones hadn't shifted over to IPv6 we'd be in a world of hurt right now.

Privacy?

[hcs_$reboot]

My cell phone has been on IPv6 for years. Everything I have is ready for the conversion. What is holding it up?

There is a small interesting detail about IPv6 that is almost never mentioned. An IPv6 address counts 128 bits. Typically the "top" 64 bits are provided by your ISP and will be used to route the packets through the Internet. The 64 remaining LSb have to be unique within the subnet (typically a LAN), and usually these 64 bits are made from the MAC address of the interface linked to this IPv6 address (padded if 48 bits). That means for instance that knowing your IPv6 address, someone is likely to know also your MAC address (of the device used), that is usually the maker/configurator of the NIC (eg Apple, MS ...). And if the shop where you bought the device keep track of your MAC address - like Apple for instance - they may be able to identify you precisely, based on your IPv6 address (eg when you access their web site).

Re:Privacy?

[kc9jud]

...and usually these 64 bits are made from the MAC address of the interface linked to this IPv6 address (padded if 48 bits).

I think what you're looking for is RFC 4941, Privacy Extensions for Stateless Address Autoconfiguration in IPv6:

This document describes an extension to IPv6 stateless address autoconfiguration for interfaces whose interface identifier is derived from an IEEE identifier. Use of the extension causes nodes to generate global scope addresses from interface identifiers that change over time, even in cases where the interface contains an embedded IEEE identifier. Changing the interface identifier (and the global scope addresses generated from it) over time makes it more difficult for eavesdroppers and other information collectors to identify when different addresses used in different transactions actually correspond to the same node.

Re:Privacy?

[cjb658]

A lot of people complained about this, so a "temporary" (in Windows) IPv6 address is generated that's not based on your MAC.

Re:Privacy?

[Megane]

Or you could, you know, give it a manual assignment (or a static address assignment on your DHCP server) of the low 64 bits. That way you could also make use of the short form of an address like "b1ab:1ab1:ab1a:b1ab::1".

Re:Privacy?

[rickb928]

So LAAs are nearly standard in IPv6 land?

Token-Ring rules again. Bow and be humbled.

Re:Privacy?

[Anonymous Coward]

That is no longer valid data, by a good portion of a decade.

Re:Privacy?

[Darinbob]

DHCPv6 is not for address assignment, as that's illogical for IPv6. However given the incredibly entrenched mindset in some IT shops I don't doubt that people will want to use DHCPv6 for that purpose rather than doing things the IPv6 way.

People are scared of IPV6

[amias]

A lot of people rely on NAT for simple security and get scared when faced with IPV6's global addressing.
securing IPV6 networks is not so straight forward and often requires site specific approaches that are beyond a lot of home users or small businesses.

its a good thing to run firewalls on everything but its also pain.

I can see there being some crazy security breaches and much confusion during the changeover, as a tester every network product i've tested
has had a test plan for ipv6 that gets de-prioritised to the bottom because 'nobody is using ipv6 yet' and its hard to find people who know about it.

Re: People are scared of IPV6

[WindBourne]

Look. Most residence and small businesses have modems in which the firewall is automatically enabled. That is what saves them, not NAT. For medium and large business, they can run a decent firewall.

Re:People are scared of IPV6

[Bert64]

All the routers i've seen implement statefull filtering on ipv6 and allow all outbound and no inbound (except traffic related to an outbound connection) by default, which is functionally identical to their ipv4 nat implementation.

Re:People are scared of IPV6

[FictionPimp]

My router/stateful firewall will still act as the gateway to my internal network even with ipv6. All traffic flows though there and I can setup firewall rules as to what I'll allow in/out of the wan/lan ports. Nothing on the 'inside' of that router really needs to run a firewall. They can't get out without going though the router even with a 'public' address.

Re:People are scared of IPV6

[sjames]

A simple firewall rule will provide all of the security NAT would provide and with a lower load on the firewall.

Just enable connection tracking, accept incoming related packets and drop the rest.

Re: People are scared of IPV6

[buchanmilne]

Did you actually bother reading up about IPv6 (like you probably had to to switch from IPX to TCP/IP)?

You can't just treat IPv6 as IPv4 with longer addresses, some concepts (such as broadcast address) simply don't exist in IPV4.

There are some very good free training materials available, such as from afrinic.

http://learn.afrinic.net/en/co...

Re:People are scared of IPV6

[thegarbz]

A lot of people rely on NAT for simple security

You mean a stateful firewall with a router bolted on?

There's nothing NAT gives you security wise that any stateful firewall can't. You have NAT? You have a stateful firewall setup. Was it a pain to setup at your router, or was it just a tickbox?

Re:Hakuna matata

[jones_supa]

IPv4 CG-NAT seems to be heavily used in cell phone networks as well.

Damn kids.

[AnotherBlackHat]

Get off my internet!

Re: Wasn't this originally predicted

[Anonymous Coward]

Also, I hear Voyager has just left the solar system.

Re:Wasn't this originally predicted

[sjames]

No, it wasn't. It was predicted that IANA would soon run out of blocks to hand out to the regional registries unless allocation policies were tightened up. They were tightened, but in spite of that, it ran out in 2011. IANA was last predicted to ruin out on July 5th this year. They almost made it.

For that reason, only Africa has addresses to hand out now, but that will be exhausted in just a couple years.

About time.

[WindBourne]

Seriously, the only way that we are going to move to ipv6 is when being denied ipv4. The good news is that most are ready. Ideally, a large isp will decide to drop the ipv4 section and see how it goes.

Re:About time.

[bondsbw]

I doubt that will be the catalyst. I think websites will start the charge. Probably the easiest way forward is to begin reducing the number of nodes that respond to IPv4 (effectively slowing down that traffic). IPv6 should become more stable and used more frequently, and that will allow the sites to reduce even more nodes. Repeat until all clients use IPv6, then shut down IPv4 (both on sites and ISPs).

Re:About time.

[WindBourne]

Yeah, but if Comcast and/or TW were to announce that they were going to drop their IPv4 in say 1 year, then it would put everybody on notice that they must be up to snuff or lose customers, etc.

Re:About time.

[bondsbw]

True, but what incentive do they have? There would potentially be a huge backlash from customers whose favorite sites suddenly started sucking (even if for only a few months until things got settled). And many ISPs such as cable also have to compete with DSL or fiber, so customers would flock away.

Plus something I haven't thought of before now... consider net neutrality, and the fact that customers may start filing complaints that their favorite service is being throttled by their ISP. That service is working fine for other ISPs (which are still using IPv4). This appears like a classic net neutrality violation, but in reality the ISP is not throttling anyone, it's the site or backbone provider that has something screwed up.

Even if the FCC sides with the ISP, plenty of damage to reputation will be done.

Re: Security and IPv6

[WindBourne]

Why bother? The reason the first post was AC is that he is a moron and knows it.

Re:Hakuna matata

[rubycodez]

not true, firewalls can do wondrous things nowadays to isolate

Re:Security and IPv6

[Bert64]

Good luck trying to scan an ipv6 range...
The smallest subnet is a /64, even scanning every host there for a single port would take a LONG time.

IPv6 works fine with VPN software, even ipsec was originally a part of ipv6 and cruftily backported to ipv4... Infact, you can use ipsec properly (ie end to end without kludges like l2tp) with ipv6. The problems published recently were due to short sighted vpn providers who completely ignore the existence of ipv6. If they provided dual stack connectivity over their vpn then there wouldn't have been a problem.

Bugs could still be found in ipv4 stacks too (and are still being found), on the other hand ipv6 is much newer and addresses some of the weaknesses of ipv4.

US runs out of ....

[hcs_$reboot]

As usual, US can get unused resources [ IPs ] from where there's a lot available. E.g. from Iraq.

Re:US runs out of ....

[hcs_$reboot]

So you mean that, soon, Microsoft will have purchased a lot of useless IPv4 addresses while everybody will have moved to IPv6...

Re:Security and IPv6

[Ultra64]

>First, an attacker can easily find your network topology (i.e. which segment is what) with IPv6.

So you've never heard of firewalls? A few rules creates a stateful firewall that performs the same "security" function as NAT.

You can use some of mine

[davidwr]

I've got plenty of unused numbers in my 10.x.x.x range.

Re:You can use some of mine

[freeze128]

Gentlemen... Gentlemen.... We can all share!

Re:Security and IPv6

[FictionPimp]

Are you saying that IPv6 address can not be placed behind a firewall? Just because it's a publicly addressable block doesn't mean it can't be firewalled off. There are entire companies running on 'real' ipv4 addresses right now that can't just be nmaped because they are secured with a firewall. NAT is not required to create that curtain, proper network security (firewall, acls, gateways, routing, etc) is.

The rest of it, well i'm not expert so I can't comment.

But why can't we just get major ISPs to start handing out ipv6 addresses for external communication and just use ipv6 to ipv4 nat technology internally?

My pet conspiracy theory...

[Dr.Dubious DDQ]

(Adjusts Aluminum Foil Deflector Beanie to block out the Bilderberg mind-control rays)

THEY don't want IPv6 implemented, because IPv6 easily ensures that everyone and their evil twin can have a fully-accessible IP address, allowing them to directly communicate with each other without paying extra rent to the ISP for a "server" or "special" (routable) IPv4 address.

If users' systems can directly communicate with each other, there's far less need for centralized sites for everything where it can be controlled (for example, YouTube for video). Deep packet inspection is an option to spy on people looking for copyright trespassers or subversives, but with encryption becoming more readily available, that gets harder, too.

When anybody who wants to can set up (or even buy "canned") a media appliance running something like "MediaGoblin" to share audio, video, text, photos, etc., or VoIP servers like Mumble or various WebRTC-based systems for conferences and "phone calls" and other audio, servers for federated instant-messaging systems or "social media" platforms, etc. etc., and just assign those systems one of the overflowing bucket of publically-routable IPv6 addresses that everyone can have, it'll remove a huge amount of control that big media and telecommunications corporations (and governments) currently have. They don't want that.

Don't try to tell me it's not true, I can hear 'em talking about it on the radios the CIA implanted in my teeth.

But, seriously, my lazy, cheap, asshat phone company can't/won't give me more than one publically-accessible static IP address, probably really because of the ancient crappy DSL modem/router they force us to use and not being willing to have their executives skip lunch for one or two days to pay for the infrastructure upgrades.

Note that this doesn't necessarily mean it's not a secret conspiracy on a global scale overall, though...

Re:My pet conspiracy theory...

[Carewolf]

I partly agree, though I suspect it is more the difficultly of differentiating business and consumer internet products with IPv6. Currently the business solutions gets to have IP adresses and servers, and consumers does not.

Re:My pet conspiracy theory...

[dave420]

So I take it you don't know much about IPv6. Thanks for letting us know. Everyone can now safely ignore your nonsense, safe in the knowledge that nothing of value was lost.

Re: Privacy? So what

[WindBourne]

change your Mac address every so often.

It won't work that way

[davidwr]

The way it MIGHT work is that ARIN would take the 3 block and in a controlled manner that won't break anything convert it into a bunch of /9 through /16 or even smaller blocks based on what GE is currently using. It would give GE a short period of time - maybe 30-90 days - to justify why it should be able to keep the blocks it is not currently using. If they give a good reason, they keep them. If they give no reason ("we have plans to use them in the next year, we'll show them to you if you sign an NDA" would be a good reason), they lose them. If they give a lame reason then it goes to some dispute resolution, effectively allowing GE to keep them for the duration of the dispute process.

Frankly, I'm surprised that ARIN didn't foresee this ages ago and ORDER anyone with a block bigger than, say, /12, to attempt to split up their address range, consolidate if practical, and return any unused blocks that were /16 or bigger. If this had been done, say, 10 years ago the process could have been be repeated 5 years ago but with the order applying to anyone with a range bigger than /16 to split, consolidate, and return any /25 or larger unused block. A year ago the same order could go out to everyone with a block bigger than /24 with an order for them to return all unused /24 blocks. I don't know if it's feasible for blocks smaller than a /24 to be handled by ARIN, but if it is, then they should start requesting those ultra-small blocks as well.

Oh well.

Re:It won't work that way

[Anonymous Coward]

Frankly, I'm surprised that ARIN didn't foresee this ages ago

They did, we've been hearing the sky is falling for almost 10 years now.

Re:It won't work that way

[Hadlock]

Just 30-90 days to determine if an IP address is used in a legacy system the size of GE stretching back 35 years? You're mad, MAD.

Re:It won't work that way

[silas_moeckel]

Because ARIN/ICANN has about 0 authority over these old blocks, they were assigned well before all this you do not own they we can take them back to companies with enough lawyers to litigate them into oblivion (well into having to up the ICANN fee's so much people will look for an alternative like hey GE want to leave me a block).

Re:It won't work that way

[swb]

The only real authority over any IP block is in BGP announcements and who believes them.

Re: It won't work that way

[Anonymous Coward]

I work for IBM... who has a /8 (9.0.0.0/8) that in my own opinion is totally squandered.

You know what IBM does with its /8? Use it for internal addresses. Every computer on the IBM internal network has a 9. address even though none of them are internet facing and they could just as easily use 10. addresses.

Re: It won't work that way

[tnk1]

So every address at IBM is in a routable block? That's not only extravagant, it's blindingly insecure.

Yes, I'm sure that there are firewalls and routing tables that ignore attempts to address the internal 9.x.x.x addresses from the outside, but still, it would be so easy to screw that up. At least with private addressing, you have an entire extra layer of difficulty for people who want to get at your internal networks remotely and more importantly, it defaults to not being routable, even if accidentally exposed somehow.

Oh well. I'm sure IBM has it all under control. (Sells all IBM stock immediately). :)

Re: It won't work that way

[Anonymous Coward]

If you think "routable" and "insecure" are synonyms, you're going to have a hell of a time with IPv6

Re: It won't work that way

[tnk1]

Not synonyms, but private addressing is a good way to help enforce access around internal networks that don't need outside to inside access. You can certainly set up routing that does the same thing, but you want defense in depth whenever you can.

Re:It won't work that way

[Dagger2]

None of this will fix anything, because the v4 space just plain isn't big enough. It doesn't matter how you slice and dice it: there ain't enough of it.

You might be able to buy some extra time this way, but we've had more than enough time already. "More time" isn't what we need at this point.

Re:It won't work that way

[davidwr]

You might be able to buy some extra time this way, but we've had more than enough time already. "More time" isn't what we need at this point.

The fact that there are still network service providers working on IPv6 roll-outs means "more time" is exactly what we need at this point.

More time and some incentives to the ISPs to hurry along and finish the job. Given that this should have been completed years ago, methinks it's time to take away the carrot and use the stick: Regulatory agencies should consider limiting ISPs' abilities to take on new customers until such time as they are providing IPv6 to an ever-increasing percentage of their customer base until all of their customers have IPv6 connectivity and have an easy, no-cost-to-them (other than perhaps replacing their non-IPv6-compliant equipment) method of getting all of their machines up on public-facing IPv6 addresses if they so choose.

Re: It won't work that way

[Agripa]

private addressing is a good way to help enforce access around internal networks that don't need outside to inside access.

Just like a stateful firewall with a default reject or drop rule.

Interestingly enough, AT&T's current U-Verse modems enforce a drop all incoming rule on IPv6 which is not even user configurable.

Re:It won't work that way

[Dagger2]

The fact that there are still providers that haven't finished (or even started) their deployments is exactly why extra time wouldn't be helpful. They've had years and years to deploy v6; the only reason for not being done by now is that they've been procrastinating.

We've already bought these people an extra 10-20 years with pervasive NAT and over-aggressive address conservation. Buying them an extra 2 years would just lead to another 2 years of procrastination. Enough is enough. It's time they got a move on, and if they have to suffer through some (more) pain to get there then they only have themselves to blame.

I'd've loved to see ARIN put a "you can only get v4 space if you show us that you're doing a serious v6 deployment too" policy on their last /8. Bit late for that now though.

Re:It won't work that way

[petermgreen]

I'd've loved to see ARIN put a "you can only get v4 space if you show us that you're doing a serious v6 deployment too" policy on their last /8.

I think they should have done that long before the last /8 and they should have carefully defined what was meant by "serious v6 deployment". Something along the lines of

1: all IPv4 customers of the requester must be offered IPv6.
2: For new customers any provider supplied equipment must support IPv6 in it's default configuration and all instructions must cover IPv6.
3: all existing IPv4 customers of the requester must be explicitly contacted and instructed on the steps needed to get IPv6.
4: All public services operated by the requester must be offered on IPv6.
5: The company must operate local relays for 6to4 and teredo and direct all internal customer traffic for 2001::/32 2002::/16 and .

But they didn't. ICANN and the rirs knew or should have known that continuing as they were would lead to v4 exhaustion before serious IPv6 deployment but they did it anyway.

Re:It won't work that way

[Dagger2]

I would've initially accepted steps towards a v6 deployment, e.g. if you've just got your v6 allocation and you're turning up BGP next week? Fine, but when you come back for more v4 in 3 months then you'd best have made some more progress or you aren't getting any.

Instead we got... a discount on your v6 allocations if you already have v4 allocations. Which has since been phased out. Woo.

Re:Wasn't this originally predicted

[ShaunC]

Your bank's grammar verification code clearly hadn't been fixed.

Federal Trade Commission anyone?

[davidwr]

If the FTC made a ruling that advertising "Internet access" was deceptive advertising if full IPv6 support was not part of the package, it would probably push change in the right direction.

I've tried turning IPV4 off..

[jcr]

Every couple of weeks or so, I turn off V4 to see what happens. /. is one of the sites that I can't reach when I do.

-jcr

Re:I've tried turning IPV4 off..

[OrangeTide]

I fail to see the problem.

Re:I've tried turning IPV4 off..

[fluffernutter]

Dude, you need a hobby.

Re:I've tried turning IPV4 off..

[Your.Master]

He has one: monitoring IPv6 compatibility.

Re:Wasn't this originally predicted

[Anonymous Coward]

It wasn't crying wolf, at that time the growth was amazing and the policies for handing out IPs were much looser. They also didn't factor in for the facts that the policies would be changed and people would NAT NAT as Xzibit hadn't yet taught us about doing things while we're doing things. If NAT hadn't become so common we would have run out of IP addresses a very long time ago.

If they hadn't "cried wolf" then, I can only imagine how long ago we would have hit this point as we wouldn't have made adjustments to practices to push it into the future.

It's amazing how many morons will see that the rate at which a massive problem is coming is slower than anticipated and conclude that it's not a real problem. It's usually better to err on the side of caution and expedience as you rarely do things to quickly with regards to large problems.

Re:Fricking Finally

[OrangeTide]

What should my IPv6 address be when I'm using a satellite link from my RV ?

Re:Hakuna matata

[sjames]

That was IANA running out of blocks to hand out to the RIRs such as ARIN.

Now, since it can't get any more, ARIN has also run out. The remainder are held by corporations and individuals and they have no obligation to hand them over.

Cloud providers are part of the problem

[laffer1]

Look at the massive amount of IPs that Amazon and Microsoft use for their cloud solutions. If AWS actually supported IPv6 properly, people could start migrating. Last I checked, Amazon didn't even offer IPv6 as an option for their DNS services.

ISPs are starting to move on IPv6, and now we need the big hosting companies to step up. Today, that's mostly cloud providers.

FreeSWITCH Supports IPv6

[briankwest]

We seen this coming long ago, we did a lot of work to make sure we were IPv6 Ready, Check it out on http://www.freeswitch.org/

Re:Security and IPv6

[undefinedreference]

Couldn't we also just use private addresses within our private networks and a NAT gateway to the internet? You know, like basically every household in the world with more than one computer does today? Hell, the internal addresses could be IPv4 or IPv6 and nobody would know or care.

Re:Security and IPv6

[silas_moeckel]

No that broke the internet 20 years ago, lets not go back. Major firewalls have no ability to NAT ipv6.

Re:Hakuna matata

[Dagger2]

The real picture is that IP addresses are allocated hierarchically and there are multiple entities at all levels except the root, all of which run out separately.

IANA (the root of the tree, the people who allocate addresses to the regional registries) ran out of /8s in Feb 2011. The regional registries (there are five of them; these are the people that allocate addresses to ISP) have their allocated pools of /8s which ran out at different times: APNIC ran out in Apr 2011 (that's the story you linked), RIPE in 2012, LACNIC in 2014 and ARIN just now. (AFRINIC still has a few years to go, although they won't if everybody tries to get their addresses from there.)

Then there are the ISPs, who allocate addresses to their customers. ISPs will tell you that "we have plenty of addresses left" -- except the ones who don't -- but at some point all ISPs (or perhaps more importantly, your ISP) are going to move into the "don't" category.

And finally, ISP customers (i.e. you) allocate addresses to networks. Except you've probably never experienced this, because we've been short on v4 addresses for long enough that many ISPs don't (can't) give you enough IPs for your networks, and haven't for years and years. You probably grew up with this and consider it normal; it's not.

I don't know when you're going to go from "we seem to be trucking on just fine" to realizing that we have a problem -- I'd say we already do, since lots of people waste lots of time and money due to NAT, but perhaps for you it'll take your ISP giving you an RFC 1918 address on your upstream before you realize. Or maybe you have infinite time and money and don't mind the headaches caused by many layers of NAT and all the workarounds needed to deal with them, and you don't mind paying programmers to write workarounds into software, and you don't care about all the things we could've had if the internet had been up to providing them. But hopefully I've shed some light on the highly-complicated reality of "guy A allocates to guy B who allocates to guy C".

Re:Hakuna matata

[Dagger2]

APNIC ran out in Apr 2011 (that's the story you linked),

Sorry, my bad. You linked the IANA runout, APNIC is here. (For completeness, RIPE is here and LACNIC is here.)

Re:Unlikely

[codealot]

They can still hide behind a proxy if they want.

Re:Security and IPv6

[lokedhs]

That security is provided by RFC 4941 (Privacy Extensions for Stateless Address Autoconfiguration in IPv6).

It's even better than IPv4 with NAT since it will actually rotate in new random IP addresses every so often (every hour or so). That means that your source IP will change over time which makes tracking harder.

Wikipedia names them

[davidwr]

A list of companies still holding an entire /8 block, culled from the Wikipedia article List of assigned /8 IPv4 address blocks and verified against https://www.arin.net/ and https://apps.db.ripe.net/searc... on 7/2/2015:

3 - General Electric
4 - Level 3*
8 - Level 3*
9 - IBM (partially *)
12 - AT&T Services*
15 - Hewlett-Packard
16 - Hewlett-Packard (inherited from Digital Equipment Corporation via Compaq)
17 - Apple
18 - MIT**
19 - Ford
20 - Computer Sciences Corporation
32 - AT&T*
34 - Halliburton
38 - PSINet*
44 - Amateur Radio Digital Communications***
48 - Prudential Securities
53 - Daimler AG (via RIPE)

This list does not include military, postal, or other government entities.

* Network service provider

** Educational institution

** Special-use, mostly unreachable, see Wikipedia's article on AMPRNet for details

The real end of the world...

[Anonymous Coward]

Now that would be the real end of the world, if ICANN gets yanked from the US's control and is put under some global authority like the UN. I wouldn't be surprised to see entire IP blocks pulled from established companies without warning, just out of spite.

I also wouldn't be surprised to see sites that are not popular or are not politically correct have their IP blocks reassigned as well, be it Charlie Hebdo, Falun Gong, Kurdish sites, anything that isn't approved by some cleric or government official.

People bash the US, but this is one area where the US is doing a decent job -- keeping the Net's core structure going.

How big was the block?

[davidleelambert]

I can't see that detail in the article or the ARIN announcement. It's a bigger deal if no one can get a /22, but then again if the request was for a /9 that might be a much bigger group of people about to go behind Carrier-Grade NAT.

Re:How big was the block?

[Dagger2]

Everything larger than a /23 is getting denied now. Once they allocate the 55 remaining /23s (probably in a week or two), everything larger than a /24 will be denied. When they allocate the last 430 of those (in... 1-2 months?) then they'll be denying everything.

Re:Unlikely

[Dagger2]

For reasons which are wrong or don't make sense.

I'm not a network engineer...

[Anonymous Coward]

but it feels like we have "run out of ip addresses" and "rejected requests", "for the first time", at least 10 times already in the past year. and yet here we sit, still on on our v4 backbone. plus, are we really out of them? can't we just steal the like 4mil IBM (or whoever) has that they don't even need?

IP Address

[fluffernutter]

Can I sell mine on eBay?

Re: Privacy? So what

[ColdWetDog]

Apple's got you covered. According to their Plan For World Domination you are supposed to replace your Apple hardware every time a they come up with a new product or model.

Security through consumerism. Then you have to buy new connectors and cases and a new desk or outfit to go with your new shiny. Thus, it helps with the local and global economy and even generates more traffic on the Internet (all of those rantings on various support boards and all of those lovely adverts). Given Apple's push towards recyclable packaging products, it helps those companies as well.

What's not to like?

Re:Unlikely

[Darinbob]

They can disconnect from the internet also!

Re:Security and IPv6

[Drakonblayde]

Good luck trying to scan an ipv6 range...
The smallest subnet is a /64, even scanning every host there for a single port would take a LONG time.

That's not even close to true. You need big subnets if you're going to use autoconfigs based off of MAC Address sure, but with DHCPv6, there's no 64-bit boundary, you can break your subnets into whatever chunks you want and allocate IP's out of that.

Now, the subnets are still going to be big. I mean, if you break your allocations down into /96 blocks, for example, and hand those to the end users, you'd still be needing to port scan the equivalent of the entire ipv4 address space.

Re:Security and IPv6

[Drakonblayde]

Are you saying that IPv6 address can not be placed behind a firewall? Just because it's a publicly addressable block doesn't mean it can't be firewalled off. There are entire companies running on 'real' ipv4 addresses right now that can't just be nmaped because they are secured with a firewall. NAT is not required to create that curtain, proper network security (firewall, acls, gateways, routing, etc) is.

The rest of it, well i'm not expert so I can't comment.

But why can't we just get major ISPs to start handing out ipv6 addresses for external communication and just use ipv6 to ipv4 nat technology internally?

I suspect that is where a large part of it is going to go. I think alot of ISP's are going to start employing v6 to v4 gateways.

The problem with that, however, is going to be DNS.

Let's say my host is native v6 only, no ipv4 address. And I'm trying to reach a site that has ipv4 connectivity only, no v6 DNS records.

About the only way that's going to work is if the DNS server I'm using returns a result that points me to a v6 to v4 gateway for sites that don't have AAAA DNS records. I seem to remember folks getting up in arms when someone tried that for non-existent ipv4 domains.

Fortunately, that problem has already been solved. NAT64/DNS64 are viable migration alternatives, and one I'll be implementing on the home network as soon as my ISP decides they want to actually roll out native IPv6 connectivity (though I am a Comcast employee, I do not live in a Comcast area. Sometimes, there is a downside to being a telecommuter)

Re: Privacy? So what

[WindBourne]

LOL.
Yeah, oddly, they are not the only ones with that same plan.

Utilization

[bl968]

I would suggest that a better first step would be to require that organizations prove that their allocations are in reasonable use. That the use is justifiable in light of the availability technologies like NAT and named based virtual hosting.

Re:Utilization

[corychristison]

Yeah, unfortunately the web hosting companies that are handing out dedicated IPv4 addresses are still considered small fry to companies like General Electric, Hewlett Packard, Ford Motor Company... see https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks

Re:Unlikely

[mars-nl]

Dude. I'm privacy conscious and I want/use IPv6.

As already mentioned many times, all modern computers support IPv6 privacy extensions giving you a regularly changing random IPv6 address.

Furthermore, does your IP-address really matter when you are logged in to you Google and Facebook account all the time on all your devices and dozens of cookies/trackers follow you on every website you visit? Your IP-address is quite irrelevant these days.

Easy solution: $1 per IP per year

[Great_Geek]

This a non-problem. Just charge a dollar per IP per year. Watch the IP blocks be returned quickly.

With so many addresses in use, the money should accumulate quickly. Pretty soon, there will be enough money to design a new IPV6NG that can actually work (as opposed to IPV6 does cannot be deployed).

For people who think IPV6 is the solution - it is an empirically observed fact that IPV6 has not been successfully deployed in any scale in several generations technology.

Think of the degrees man!`

[stolidobserver]

So many people will lose their jobs because they don't have degrees with this experience....

using quints

[Black Copter Control]

The reason why the dotted quad format was used is that it translated into 32 bits -- which fit quite nicely into normal (long) INTs back in the '80s.

The IETF knew that this was to small for the longer term, but the efficiency argument won out. (this was back at a time when a 1Mz mainfraim with 16Megabytes of ram could be timeshared to over 100 users). They figured that by the time the 32 bit address space was saturated, that the replacement protocol with a REAL address space (IP6) would be easier on the computers of the day and there would be lots of time to get it up and running (turns out to have been over 30 years).

What they didn't plan for was that the 'Net would be effectively in the control of business majors and bean counters and that IP6 adoption would be at the whim of financial considerations and a 'you first' attitude. Now IP6 adoption is waiting for a 'killer app' that is on an IP6-only server ... or for Google to announce that they'll give preferential listing to sites that are IP6 capable.

Re:Fricking Finally

[OrangeTide]

So the consensus so far is that my IPv6 address shouldn't be my GPS coordinates?

Thanks for proving my point, in a round about way.

RFC1812 has become unreadable as well

[Trax3001BBS]

This is the RFC that handled three reserved IP4 address blocks 10.X.X.X which Goggle uses or any large organization is able to use; one for semi large companies can use; as well as the 192.168.x.x a small group of users are to use, and most of us are familiar with. https://tools.ietf.org/html/rf... I've read it many times in the past for those reserved blocks. Now can't make sense of it, it's grown by many many pages.

At least the HOSTS file is safe (I think) "0.0.0.0 is an obsolete form of the limited broadcast address".

A Router setup, I'll wait and see:
  "A router MUST allow a metric to be assigned to a static route for
  each routing domain that it supports. Each such metric MUST be
explicitly assigned to a specific routing domain. For example:
route 10.0.0.0/8 via 192.0.2.3 rip metric 3
  route 10.21.0.0/16 via 192.0.2.4 ospf inter-area metric 27
route 10.22.0.0/16 via 192.0.2.5 egp 123 metric 99"

And against all advice: "A router MUST support ICMP".

Re:RFC1812 has become unreadable as well

[Trax3001BBS]

To add: MUST
          This word means that the item is an absolute requirement of the
          specification. Violation of such a requirement is a fundamental
          error; there is no case where it is justified.

we'll know ipv6 is in real use when ...

[Skapare]

... spammers start using it.

Re:we'll know ipv6 is in real use when ...

[Dagger2]

Spammers are already using it.

I only had to look at 3 emails in my spam folder before I found one that was delivered over v6.

Re:Unlikely

[Black Copter Control]

You can NAT ip6, if you want to, and use private IP6 addresses internally. The advantage with IP6 is that you have a MUCH larger pool of non-routable addresses to choose from which means that It'll be that much harder for an attacker to guess at your internal network layout and machine addresses.

The original reason for IP4 NAT was necessity, not security. It was (and is) quite common for a house or business to get a single IP4 address for however-many machines. IP6, on the other hand, defaults to giving a normal end-user an address pool bigger than what IP4 provides to the whole planet. This means that it's WAY harder for an external hacker to guess at the address of a random machine. I got a /64 prefix for my home network. That means that I have trillions of potential address for dozens of machines. Even with thousands of machines, if I pick a set of random addresses for my machines (which is what auto-config does), it should take a well-provisioned attacker a couple of centuries to get his first hit.

If you add NAT on top of all that, then you've got a pretty good security regime.

However -- all of that being said, the main excuse given for NAT being 'secure' is that people can't get to a NATed machine from the outside world. However, between machines getting 48bit (or more) randomized addresses that change from day to day, and a simple stateful firewall, you would have the same security and then some if you moved to ipv6. -- before you even throw NAT into the configuration.,

No, using private addressing...

[davidwr]

Using private addressing is like living in a building with only one entrance and hoping the bad guys won't get through that entrance.

Having a firewalled public address is like living in a building with only one (or more - all under your control) entrance and hoping nobody accidentally creates a second entrance that you are unaware of/don't control.

The comment about "security in depth" is well-taken.

A hybrid method - which might actually be in IPv6 (I haven't read all of the relevant standards documents) would be to specifically declare certain IPv6 addresses or ranges as "private," and routers not specifically configured to handle those addresses would be required to drop those packets. In other words, if IPv9 had such a standard (it does not) and I owned 9.0.0.0/8 and I declared all addresses other than those ending in .1 to be private, and I didn't configure any non-9.0.0.0/8 routers to specifically handle 9.0.0.0/8 traffic, any traffic not routed through a 9.0.0.0/8 firewall ending in .1 (and having its "public" IP masqueraded into an address ending in .1 in the process) would be dropped by the first standards-compliant non-9.0.0.0 router that it encountered. This way, if an employee intentionally or accidentally connected a machine to both a 9.0.0.0/8 network and another network at the same time and the machine started routing traffic (which shouldn't happen if my internal network isn't broken in some other fashion), the first upstream router of the external network would say "woah boy, I can't handle that traffic, *DROP*. Defense in depth.

Granted, this would not stop a rogue employee who knew what he was doing from setting up a firewall that did its own address translation. This scheme provides some security, it is not intended to protect against all adversaries. It also has most of the other weaknesses of NAT, including client-based vulnerabilities where an internal machine is p0wned and has relatively-free run of the network (well, as free as if the network were entirely publicly-addressable/publicly-accessible).

What are you saying?

[davidwr]

Are you saying that you use addresses that are assigned by ARIN or a similar authority to NCR, but as far as the Internet is concerned, the address are in a range that not in use ("no route to host")?

You are one mis-configured BGP announcement away from that statement becoming false. I hope you are practicing "defense in depth."

What's the big deal?

[Mister Null]

Just do it and stop talking about it.

Time to take addresses back

[vilanye]

I know a university that has an entire class B block and they claim that they need them because they pass them out to anyone connecting to wifi on campus. In reality they could get by with maybe 20 addresses, at most.

Yup, connect your laptop on campus and you have an internet routable address.

There is lots of address waste.

Like MMGW

[brunnegd]

Similar to global warming, deniers have had their heads in the sand too, too long, and they are now getting kicked in the butt.

APNIC is exhausted?

[shalomsky]

Hurricane Electric says that as of today, APNIC has ~ 11 Million IP addresses. Am I missing something?

Re:Hakuna matata

[SignOfZeta]

Accurate, though most implementations of LSNAT will probably use the now-reserved address space of 100.64/10 rather than one of the well-known private ranges.

(Yes, in the face of IPv4 exhaustion, The Powers That Be burned an entire /10. There must be some IPv6 engineers on that committee.)