Slashdot Mirror
Mapping the Spectral Landscape of IPv6 Networks (duo.com)
Trailrunner7 writes: Like real estate, we're not making any more IPv4 addresses. But instead of trying to colonize Mars or build cities under the sea, the Internet's architects developed a separate address scheme with an unfathomably large pool of addresses. IPv6 has an address space of 2^128, compared to IPv4's 2^32, and as the exhaustion of the IPv4 address space began to approach, registries started allocating IPv6 addresses and there now are billions of those addresses active at any given time. But no one really knows how many or where they are or what's behind them or how they're organized.
A pair of researchers decided to tackle the problem and developed a suite of tools that can find active IPv6 addresses both in the global address space and in smaller, targeted networks. Known as ipv666, the open source tool set can scan for live IPv6 hosts using a statistical model that the researchers built. The researchers, Chris Grayson and Marc Newlin, faced a number of challenges as they went about developing the ipv666 tools, including getting a large IPv6 address list, which they accumulated from several publicly available data sets. They then began the painful process of building the statistical model to predict other IPv6 addresses based on their existing list.
That may seem weird, but IPv6 addresses are nothing at all like their older cousins and come in a bizarre format that doesn't lend itself to simple analysis or prediction. Grayson and Newlin wanted to find as many live addresses as possible and ultimately try to figure out what the security differences are between devices on IPv4 and those on IPv6.
A pair of researchers decided to tackle the problem and developed a suite of tools that can find active IPv6 addresses both in the global address space and in smaller, targeted networks. Known as ipv666, the open source tool set can scan for live IPv6 hosts using a statistical model that the researchers built. The researchers, Chris Grayson and Marc Newlin, faced a number of challenges as they went about developing the ipv666 tools, including getting a large IPv6 address list, which they accumulated from several publicly available data sets. They then began the painful process of building the statistical model to predict other IPv6 addresses based on their existing list.
That may seem weird, but IPv6 addresses are nothing at all like their older cousins and come in a bizarre format that doesn't lend itself to simple analysis or prediction. Grayson and Newlin wanted to find as many live addresses as possible and ultimately try to figure out what the security differences are between devices on IPv4 and those on IPv6.
Remember when /. used to be a tech site that knew "large, but finite" wasn't the same as "infinite"?
Pepperidge Farm remembers.
Natalie Portman would be ashamed of being referenced by a site like this!
I've been seeing some golang spider probing my websites in an odd way, so now it is blocked.
i'm safe because i'm behind a nat.
It also says "bizarre format that doesn't lend itself to simple analysis or prediction". Come on, it's just a hex number, how much simpler could it be?
The Post author is completely wrong when he says that IPv6 is in some bizarre format. IPv6 is exactly the same as IPv4, it's block of numbers. The primary difference is that IPv4 was arranged in a set of 4 blocks of 255 bit numbers. This was workable with a 32 bit address. Ipv6 on the other hand has 128 bits.
To handle a 128 bit address with the same 255 block format of ipv4 you'd need 16 blocks rather than 4. To make this easier and narrow it down to just 8 blocks of 4 digits they decided using HEX would be easier. The addressing scheme was also designed to solve many of the problems Ipv4 had, including automatic creation of a private locally addressable-only address space (the link local).
They also added an address assignment scheme that didn't required DHCP to find an assign an IPv6 address. This is called SLACC and in theory makes it trivial to setup an IPv6 network of devices without needing to build a huge DHCP server (for example in a factory where machinery needs IP addresses but have very primitive computing resources). They also designed the network so that it wouldn't be fragmented requiring huge BGP tables. Every Ipv6 network address is supposed to come with 64 bits of addresses for the user (providing the ISP complies with the RFC and provides each user a /64 as the RFC requires. What this means is that with every public IPv6 address you have 2 IPv4 networks worth of addresses to use on your own network.
There was a lot of though that went into IPv6 into solving a lot of the problems of IPv4. It does take a little getting used to because the numbers are so much bigger and it uses HEX by default to narrow down the number of digits. But other than the spin up of learning about all the new features of IPv6 and getting used to using HEX addressing it's quite a bit nicer to use IMO.
Like real estate, we're not making any more IPv4 addresses.
New IP addresses are made every time an organization rolls out a VLAN in the 10/8 range.
"I don't know, therefore Aliens" Wafflebox1
That may seem weird, but IPv6 addresses are nothing at all like their older cousins and come in a bizarre format that doesn't lend itself to simple analysis or prediction.
Just wait until IPv8 comes out.
It must have been something you assimilated. . . .
There is this odd blindness by ipv6 proponents about just how annoying and overly complicated they literally made everything, while also blocking normal approaches.
ipv4 addressing was in practice either static or dhcp. Simple to understand. And in a business, this works, DHCP hands out all sorts of information to the device, the IP address, if its a phone where it should register, DNS servers etc.
ipv6 we get the following:
static addressing with absolutely huge address space
static addressing done using DHCP - a weird stateless dhcp
thankfully now they have dynamic addressing via DHCP
SLAAC
and SLAAC with DHCP.
Why so many choices? Because it turns out SLAAC is not that useful because you need DHCP in most cases to get all the other information anyways.
The whole dynamic DNS integration story similarly messy.
The ICMP story - now ICMP can mess with your network, so you need to filter it. BUT filtering too much breaks ipv6.
Ipv6 is this brand new and complex tech nobody has heard of before.
Everything is just a number. A Matroska movie is just a big number. But parts of the IPv6 address have meanings, some of them complex, albiet not really "inscrutable". :-)
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
This is essentially the same as building up. Need more real estate? Build up. Instead of a single level home, you build a high rise and you've increased your real estate 30 fold.
Uh, no it wasn't. Indeed, IPv6 was intended to prevent any monitoring at all.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I think the author of the article is having trouble with the concept of "sparsely populated" and therefore calling it "bizarre".
With IPv4, someone can easily scan all 2^32 possible addresses in a reasonable amount of time (actually fewer than 2^32 given the various "non routable" reserved addresses. But for IPv6, they really can't perform an exhaustive scan of all possible 2^128 possible addresses. In fact, to do a reasonable scan, they have to determine all the ISPs out there which are given /29 through /32 addresses ranges to manage. And then the ISPs with their own addresses ranges then have free reign as to how they then manage the remaining 96 to 99 bits of addressing.
So yes, doing an exhaustive scan of world wide allocated IPv6 addresses is definitely not a trivial problem.
OMFG man! What a nonsense conspiracy theory!
* feeding the trolls since *put a very early internet year here*
Haven't we heard about the "impending" exhaustion of IP addresses now for what, at least a decade?
-Styopa
may it be jokers like this who create problems in the ipv6 networking because of their scanning shit.
anyway, screw ipv6, it's not secure at all and is a very large attack vector for all the nasties out there.
While IPv6 is a technological failure -- came way too early, full of design problems, partially already obsolete before good and well deployed -- the IPv4 address space exhaustion is real. You don't hear that much about it yet since the anglophone space still has lots of grandfathered unused space that can be squeezed a bit in a pinch. But CGNAT is the scaled-up version of the idiot and fairly desperate NAT thing, and it shows up in ever more places. Again, often in places that don't necessarily speak English so you don't hear about it that often. But it's happening.
IPv6 was implemented because we were running out of IPv4.
That's conservation, not conservatism.
It little behooves the best of us to comment on the rest of us.
Wait a minute. I though the NSA and CIA were run by the Conservative agenda, to block free speech of left of center ideas, making sure the people who are in power keep it there without disruptive influences from these "Others"
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
we already have "build cities under the sea" using NAT!
I'm seeing more and more help requests from gamers who aren't able to play a networked game because they sit behind a NATed IPv4 firewall they don't control, which blocks the ports their game needs and doesn't have UPnP enabled (for automatic port forwarding). Usually they're apartment dwellers, but a small number of them are people whose ISPs are putting them behind a NAT (i.e. the ISP has more customers than IPv4 addresses).
The fact that the mac address is part of the number adds some unpredictability if there are a lot of different devices on the network. If it's a monoculture of devices it improves predictability.
That is why the mac address is part of the number? How does this prevent monitoring? I don't believe its a partisan conspiracy, but it could serve an authoritarian purpose.
I see that /. revised the headline: when I posted that comment, the headline was "Mapping the Infinitely Large Address Space of IPv6 Networks". Now it's been revised to remove the "infinitely large" phrase: "Mapping the Spectral Landscape of IPv6 Networks."
So, if it seems like the comment doesn't make sense-- that's why.
It's why the original specification mandated encryption. Not at endpoints, but at tunnels. So neither your MAC address nor your data was ever visible.
Since you could set your MAC address, it wouldn't have mattered much anyway. You didn't own an IP address, you owned access to a router, or as many routers as you liked. Your IP was generated from the path and what you advertised.
Total anonymity and total privacy.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
The only history that matters is IPng and IPv6 draft, prior to RFC status and then when IPSec is ratified.
But, then, you don't want history. You much prefer your pram.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Isp controlling your local address range is bad for corp networking.
That could claim infinite end points is TUBA, one of the other IPng contenders.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Stop listening to lamestreme media. Only people with agenda are liberals who want to impose there insane ideas on free Americans.
The fact that the mac address is part of the number
That's not a given. It may or may not be. For many auto-assigned IPv6 schemes, it is, but that's not the only way IPv6 addresses are assigned.
IPv4 is optimized for low bandwidth. IPv6 is optimized for high bandwidth. That is the biggest difference apart from the memory address space.
IPv4 came out of a world of dialup. Data arrived slowly and the receiver could easily read byte by byte. This means optimization aims at minimizing the number of bytes in the header and this is done by adding conditional bytes. If a certain variable isn't needed for the header in question, don't add it.
IPv6 is optimized for a world with optic fiber. The header file now includes all data and unused variables are included with default values. While this wastes some bytes in each header, it makes it faster to decode a header, particularly if you just need a certain variable. This is ideal for high throughput routers, particularly in the internet backbone. It can read just the variables it needs to determine the routing for the package. In fact if you want, you can make custom hardware, which can read all the variables at the same time because it can be hardwired to assume the variables at certain bytes in the header buffer. This allows processing more headers each second, which in turn allows more packages, hence more data throughput. The content of the packages aren't processed other than counting as it matches the length variable from the header.
The difference between IPv4 and IPv6 essentially comes down to this and the extra address space. There are some other details that differs, but it's just that: details. IPv6 is not bizarre. If anything, IPv4 is the bizarre one with all the conditional lengths/offsets in the header layout.
To put it into programming perspective, IPv6 is a class with well defined get functions. IPv4 is a class with a bunch of get functions called getA, getB, getC etc and you end up with if getA() > 8, then a = getC() else a = getB(). Sure you can argue that you can use abstraction and make easy to use get functions, which does more than just reading an offset, but that's precisely the point. IPv6 reads one variable and returns it, IPv4 reads multiple variables and does some calculations to figure out which one to return.
"...or build cities under the sea, the Internet's architects developed a separate address scheme with an unfathomably large pool of addresses."
And then ARPA started handing out IPv6 space like candy. We would still have plenty of IPv4 space today if ARPA hadn't handed out IP space so liberally in the beginning of IPv4. "Oh, you want a Class A? Here you go, have fun." There's a ton of unused IPv4 out there but it's assigned to a bunch of people and organizations that are just sitting on it not wanting to give it up. The lesson was clearly not learned the first time around and so the whole process is repeating itself with IPv6. Someone needs to smack some sense into the folks at ARPA before they really screw up the Internet worse than it is. Also, NAT'ing IPv6 is not really possible whereas it works well enough for IPv4 (hey, it's not without its issues but it works).
What should have happened is leave IPv4 alone and instead make a "minor" adjustment to TCP/IP to use 3 bytes for a port number instead of 2 bytes. 16 million port numbers per host is hopefully enough for everyone but the largest organizations without requiring massive hardware lookup tables (whereas 4 bytes would be too many ports). 2 byte ports is really restrictive and makes routing harder.
Typical libtard always resorts to insults when there actual argument fails.
These "researchers" are completely clueless as to the state of IPv6. The worked and worked and found 86,000 IPv6 addresses? There are plenty of references out there that could have clued them in as to just how sad their "research" results are. https://www.google.com/intl/en/ipv6/statistics.html https://activednsproject.org/statistics.html and that last dataset is freely available to researchers. All they had to do was download this dataset and count for themselves the millions of distinct IPs in this dataset.
I wouldn't be buying anything from Duo with tripe like this on their website
ipv6 was invented by the NSA and CIA to implement deep state paket inspection of conservative websites in order to infiltrate them and undermine the movment. If you use ipv6, even if not on purpose, you are enabling liberalism and all its evils. that means things like abortion, the climate change hoax, Trump-hate, etc.
The thing I don't understand is why patriots don't pick up their guns and do something about this. Screw the optics Slasdotters, just go in!
I was told to stop listening to the Rightwing media, Only people with agenda are conservatives who want to impose their ancient ideas on free Americans who want to grow.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.