Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So Long Last /8 and Thanks For All the Allocations

labs.ripe.net

Post reply on HN
Print view View original

151–160 of 201 posts

Re: So Long Last /8 and Thanks For All the Allocations

#151

Post by mabbo »

teddyh wrote: post #137
EE84M3i wrote: post #38

IPv4 address utilization is incredibly low. For example, consider 44.0.0.0/8 - it's sitting around almost entirely unallocated. UCSD Caida uses it for their network telescope (pretending to use it for amateur radio) and won't give it back. Just look at how dark it is: https://benjojo.co.uk/internet-2018.png (from https://blog.benjojo.co.uk/post/scan-ping-the-internet-hilbe... ) Discussion on r/amateurradio - https://…

As far as I understand the situation, it would be pointless to chase “unused” address ranges and try to claw them back because: 1. It would be technically very difficult, and old equipment is frequently hardcoded. 2. With the rate the allocations are going, you’d get maybe an additional few months or a couple of years out of this enormous effort. After that, all the addresses really would be allocated, and now what d…

> old equipment is frequently hardcoded.

> it is easier to just adopt IPv6

Old hardware won't work with IPv6 either. I'm not saying your wrong, just that while easier IPv6 still isn't what I'd call an easy option.

Re: So Long Last /8 and Thanks For All the Allocations

#152

Post by pas »

jlgaddis wrote: post #124
ancarda wrote: post #114

Earlier quoted context omitted.

Why do they do that? They already have an /8 to themselves -- 10.0.0.0/8. Did they need an additional 16M IP addresses?

Well, see, compared to what most of us are used to nowadays, IP networking looked a little bit different back then. In 1981, RFC791 [0] came about, describing a way of doing IP addressing on the ARPANET (based upon "classful networks" [1]). In accordance with this scheme, you would get either a /8 ("Class A"), a /16 ("Class B"), or a /24 ("Class C") -- depending on how many hosts you had (or thought you might reasona…

How come IPv6 wasn't standardized before 2017? I suspect there's some kind of story there. Do you happen to know the details? Any links/pointers? Thanks!

Re: So Long Last /8 and Thanks For All the Allocations

#153

Post by outworlder »

toopsss wrote: post #73
Beltiras wrote: post #50

Earlier quoted context omitted.

Apple has an /8 but Microsoft does not? How did that happen?

Microsoft pretty much had an anti internet strategic policy until 1995, that’s why. Back in the day a tcpip stack was a third party add on.

Trumpet Winsock?

Re: So Long Last /8 and Thanks For All the Allocations

#154

Post by reaperducer »

Beltiras wrote: post #50
EE84M3i wrote: post #38

IPv4 address utilization is incredibly low. For example, consider 44.0.0.0/8 - it's sitting around almost entirely unallocated. UCSD Caida uses it for their network telescope (pretending to use it for amateur radio) and won't give it back. Just look at how dark it is: https://benjojo.co.uk/internet-2018.png (from https://blog.benjojo.co.uk/post/scan-ping-the-internet-hilbe... ) Discussion on r/amateurradio - https://…

Apple has an /8 but Microsoft does not? How did that happen?

Remember that Microsoft believed that the future was subscriptions to CDROMs like Encarta that would be delivered by mail.

It was late to the party on the internet, but was a pioneer in seeing the value of subscription computing, predating pretty much every SaaS company out there today.

Re: So Long Last /8 and Thanks For All the Allocations

#155

Post by apeace »

tormeh wrote: post #111

It's hard for an ISP to justify switching. It costs money now, so your competition who do not switch can use the money saved to outcompete you. Switching costs are also likely to fall the longer you wait. Customers don't demand it. If I was CEO of an ISP, I would have ordered a plan, but not put it into action just yet.

I work at a small ISP and I consider this a misconception.

Any network equipment your ISP bought or gave you in the last 10-15 years supports IPv6. Equipment only has a certain lifespan anyways, so there really has been no "cost" to upgrade. Maybe a bit of software needed updating.

In my experience, the problem is customers don't care that much about IPv6.

When your customer is an IT professional who has been configuring networks the same old way for years, they expect to be sent the IPv4 subnet information. It would be a negative customer experience if we gave them an IPv6 subnet by default. Since they don't see the need and aren't used to it, it's bound to cause frustration for them.

We do support IPv6 for any customer that wants it.

I think IPv6 will happen when web sites can no longer get IPv4 addresses. Then people will start saying, "my favorite site is v6 only!", so the IT people hear about it and start to care.

I think it'll be several more years.

Re: So Long Last /8 and Thanks For All the Allocations

#156

Post by ozim »

zAy0LfpBZLC8mAC wrote: post #93
ozim wrote: post #59

Earlier quoted context omitted.

Also I do not need to have directly accesible stuff on my home network. I can use dropbox or buy cheap VPS if I want to keep my data in sync. One is security, NAT is nice for that a lot smaller attack surface. Second keeping your stuff always running at home is unreliable and annoying. Would be nice if I would not have to pay for VPS but $5 a month cheapest linode is more than enough for my hobby projects.

> Also I do not need to have directly accesible stuff on my home network. I can use dropbox or buy cheap VPS if I want to keep my data in sync. You also can walk everywhere instead of using machines to move around ... but why would you? > One is security, NAT is nice for that a lot smaller attack surface. No, it doesn't. It's a common myth, but NAT does not provide any security, it only hides insecurity. > Second kee…

Do you have redundant power supply at home, redundant internet connection? Keeping your own server up and running at home is unreliable and annoying. Having animals, kids, makes it even more difficult. If I would have to rely on it beeing up while I am abroad, I would rather pay for VPS.

Hiding insecurity is perfectly valid. It is making attack surface smaller. I do not get pings of death, constant scanning, login attempts all the time on my local machine which is always behind NAT. Every server that has public IP gets scanned or tried out with vulnerabilities. I can connect totally new PC to router with NAT and not be owned in matters of minutes by some botnet. My router might be exposed but it is something I know. All machines behind router are perfectly fine for remote vulnerabilities.

Re: So Long Last /8 and Thanks For All the Allocations

#157

Post by oasisbob »

pas wrote: post #150
dfox wrote: post #134

Earlier quoted context omitted.

Particularly notable example of this is that the three ip6tables rules needed to get NAT-like everything out nothing out behavior are exactly the same three rules that you need in v4 iptables for the NAT to have any security effect at all.

Care to share them? And how is NAT not added security by default? By default it drops everything incoming, no? (I mean, theoretically NAT doesn't, but [almost] every practical implementation situations means that there's no possible automatic internal-external address correspondence, otherwise you wouldn't need the NAT.)

I think the most productive way to look at it that for NAT/NAPT/cone NAT to work, a necessary prerequisite is a default-deny inbound firewall policy and stateful connection tracking.

Once you have that, layering on NAT is possible. But the security implications were already addressed before you get to that point.

Re: So Long Last /8 and Thanks For All the Allocations

#158

Post by oasisbob »

smsm42 wrote: post #140
throwaway2048 wrote: post #130

Earlier quoted context omitted.

NAT does nothing meaningful securitywise that a firewall cannot achive, and causes a lot of stupid problems.

NAT of course is not the best solution ever, but vast majority of currently used network nodes do not need publicly routed IPs in a limited global space. If anything, many of them are much better without one. Yes, I know, firewalls. But why not just avoid the issue by not having publicly accessible address for non-public systems in the first place?

Because NAT is an abominable hack with significant technical and administrative overhead.

My home is not intended to be a public space. But, it has a unique address, just like any other bar or restaurant in the area. Being able to locate it with a unique identifier is valuable, even if I don't intend for my living room to be publicly accessible.

Re: So Long Last /8 and Thanks For All the Allocations

#159

Post by craftyguy »

leeter wrote: post #128
jlgaddis wrote: post #101

Earlier quoted context omitted.

They don't have to give it back, of course. If anything, the first organization to have netblocks yanked out from under them should be the US DoD. As I mentioned a few days ago [0]: > There are also large portions of the 13 /8s (218 million IPs!) assigned to the US Department of Defense [5] that you wouldn't need to scan since there are no routes to them at all: the 11.0.0.0/8, 22.0.0.0/8, 26.0.0.0/8, 28.0.0.0/8, 29.…

Technically that depends on the agreements with IANA. If IANA could say "HEY YOU if you're not using 80% of your space actively, by January after next then we'll charge you a an exponentially increasing fee" I suspect they'd get a lot more movement. I suspect that the price of IP space on the market will also change that attitude as people go "Well crap that's worth a lot of money"

What if they didn't pay it? It's the US military, IANA would have a hard time enforcing any punishment they bestowed on the DoD.

Re: So Long Last /8 and Thanks For All the Allocations

#160

Post by smsm42 »

oasisbob wrote: post #158
smsm42 wrote: post #140

Earlier quoted context omitted.

NAT of course is not the best solution ever, but vast majority of currently used network nodes do not need publicly routed IPs in a limited global space. If anything, many of them are much better without one. Yes, I know, firewalls. But why not just avoid the issue by not having publicly accessible address for non-public systems in the first place?

Because NAT is an abominable hack with significant technical and administrative overhead. My home is not intended to be a public space. But, it has a unique address, just like any other bar or restaurant in the area. Being able to locate it with a unique identifier is valuable, even if I don't intend for my living room to be publicly accessible.

> Because NAT is an abominable hack with significant technical and administrative overhead.

Agreed. But you can use private networks without NAT. In fact, 99% of traffic in the private network doesn't need NAT. Only outside traffic does, and only that which can't use proxies etc. - which is pretty small amount of overall traffic, I think.

Post reply on HN