Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unique IPv6 prefix per host [pdf]

ripe76.ripe.net

Post reply on HN
Print view View original

11–20 of 22 posts

Re: Unique IPv6 prefix per host [pdf]

#11

Post by snuxoll »

nimbius wrote: post #4
ra1n85 wrote: post #3

When I see things like this, I suspect people aren't thinking through all of the NDP edge cases. Do you really want the potential to have 2^64 NDP entries on your gateway? What about NUD - do you really want that many potential hosts performing unreachability detection? NDP is the abominable child of ARP and an IGP and doesn't scale well. Using huge address spaces everywhere is a good way to let it crush your network…

perhaps its just my lack of coffee, but I fail to see the scalability issue. Router Redirection can prune quite a few ndp discovery table entries but Learned link-layer addresses are kept in a neighbor discovery table. 2^64 link layer connections are probably not present in a competently designed IPv6 network. im also confused as to what this paper is talking about in terms of new features.../64 and per host is alrea…

> if anything home ISP's need a slap on the wrist for their stingy DHCPv6 delegations of what basically amount to a SINGLE ipv6 address or some weird less-than /64. splitting a 56 is a better idea here.

This is the single most infuriating issue with IPv6 rollout in the US. CenturyLink is starting to roll out native IPv6 support (instead of 6rd which they've been using for years), the only issue is you get a single /64. I mean, I have no use for giving every single host a /64, but I've got five or six VLAN's and without at least a /56 I've got no way of actually deploying IPv6 on my network. By the way, this is a business DSL connection too - so it's not like they shouldn't expect something more than your typical flat home network where everything sits on a single broadcast domain.

Re: Unique IPv6 prefix per host [pdf]

#12

Post by ra1n85 »

nimbius wrote: post #4
ra1n85 wrote: post #3

When I see things like this, I suspect people aren't thinking through all of the NDP edge cases. Do you really want the potential to have 2^64 NDP entries on your gateway? What about NUD - do you really want that many potential hosts performing unreachability detection? NDP is the abominable child of ARP and an IGP and doesn't scale well. Using huge address spaces everywhere is a good way to let it crush your network…

perhaps its just my lack of coffee, but I fail to see the scalability issue. Router Redirection can prune quite a few ndp discovery table entries but Learned link-layer addresses are kept in a neighbor discovery table. 2^64 link layer connections are probably not present in a competently designed IPv6 network. im also confused as to what this paper is talking about in terms of new features.../64 and per host is alrea…

>2^64 link layer connections are probably not present in a competently designed IPv6 network.

From the article: "Provides a very simple mechanism for a single host or interface to be able to run 2^64 virtual machines"

That equates to AT LEAST 2^64 NDP entries. And when the L3 domain is scoped to that of a single hypervisor, router redirects are not relevant.

Re: Unique IPv6 prefix per host [pdf]

#13

Post by majidazimi »

ps0ps wrote: post #7
ra1n85 wrote: post #3

When I see things like this, I suspect people aren't thinking through all of the NDP edge cases. Do you really want the potential to have 2^64 NDP entries on your gateway? What about NUD - do you really want that many potential hosts performing unreachability detection? NDP is the abominable child of ARP and an IGP and doesn't scale well. Using huge address spaces everywhere is a good way to let it crush your network…

One of the benefits of /64 per host is there is no NDP since the only neighbor is your router.

Additionally you can install the routing software on server itself and let it form neighbor-ship with ToR router(s) and use ECMP directly from server in multi NIC scenarios. ECMP failover/recovery is faster and simpler (vendor agnostic) than link aggregation protocols. Basically each rack becomes its own OSPF totally stubby area. Data center core runs as area 0.

Re: Unique IPv6 prefix per host [pdf]

#14

Post by ra1n85 »

snuxoll wrote: post #11
nimbius wrote: post #4

Earlier quoted context omitted.

perhaps its just my lack of coffee, but I fail to see the scalability issue. Router Redirection can prune quite a few ndp discovery table entries but Learned link-layer addresses are kept in a neighbor discovery table. 2^64 link layer connections are probably not present in a competently designed IPv6 network. im also confused as to what this paper is talking about in terms of new features.../64 and per host is alrea…

> if anything home ISP's need a slap on the wrist for their stingy DHCPv6 delegations of what basically amount to a SINGLE ipv6 address or some weird less-than /64. splitting a 56 is a better idea here. This is the single most infuriating issue with IPv6 rollout in the US. CenturyLink is starting to roll out native IPv6 support (instead of 6rd which they've been using for years), the only issue is you get a single /6…

>I mean, I have no use for giving every single host a /64, but I've got five or six VLAN's and without at least a /56 I've got no way of actually deploying IPv6 on my network.

Why can't you subnet the /64? CenturyLink isn't doing dot1q tagging to you, so you must have a router with tagged interfaces on your network.

Edit: Imagine this is because you want to use SLAAC.

Re: Unique IPv6 prefix per host [pdf]

#15

Post by ddtaylor »

For anyone interested in playing with IPv6 I recommend Vultr their routing seems to work instantly, where other providers seem to have some churn. On Linode for example once I start actually using more than ~100 IPv6 endpoints it starts forgetting the previous ones for a few minute at a time. Vultr does proper prefix routing it seems.

Re: Unique IPv6 prefix per host [pdf]

#16

Post by y0ghur7_xxx »

ra1n85 wrote: post #14
snuxoll wrote: post #11

Earlier quoted context omitted.

> if anything home ISP's need a slap on the wrist for their stingy DHCPv6 delegations of what basically amount to a SINGLE ipv6 address or some weird less-than /64. splitting a 56 is a better idea here. This is the single most infuriating issue with IPv6 rollout in the US. CenturyLink is starting to roll out native IPv6 support (instead of 6rd which they've been using for years), the only issue is you get a single /6…

>I mean, I have no use for giving every single host a /64, but I've got five or six VLAN's and without at least a /56 I've got no way of actually deploying IPv6 on my network. Why can't you subnet the /64? CenturyLink isn't doing dot1q tagging to you, so you must have a router with tagged interfaces on your network. Edit: Imagine this is because you want to use SLAAC.

because if you want slaac to work without nat, the smalles ipv6 subnet you can have is a /64. so if your provider gives you just a single static /64, all you can allocate is a single subnet.

Re: Unique IPv6 prefix per host [pdf]

#17

Post by snuxoll »

ra1n85 wrote: post #14
snuxoll wrote: post #11

Earlier quoted context omitted.

> if anything home ISP's need a slap on the wrist for their stingy DHCPv6 delegations of what basically amount to a SINGLE ipv6 address or some weird less-than /64. splitting a 56 is a better idea here. This is the single most infuriating issue with IPv6 rollout in the US. CenturyLink is starting to roll out native IPv6 support (instead of 6rd which they've been using for years), the only issue is you get a single /6…

>I mean, I have no use for giving every single host a /64, but I've got five or six VLAN's and without at least a /56 I've got no way of actually deploying IPv6 on my network. Why can't you subnet the /64? CenturyLink isn't doing dot1q tagging to you, so you must have a router with tagged interfaces on your network. Edit: Imagine this is because you want to use SLAAC.

> Edit: Imagine this is because you want to use SLAAC.

Not just because of SLAAC, prefixes smaller than /64 are likely to mess with all sorts of assumptions built into networking gear. It may not be "correct" since there are valid reasons for subnets as small as a /127 (though they are used infrequently enough at least), but a lot of networking gear cheats with IPv6 routes to keep the amount of TCAM memory needed down. Why spend 128-bits per route and quadruple the memory required when you can double it and go 64-bits per route and dump the longer ones to slower DRAM (I mean, you only use /127's for point-to-point links that don't need link-rate switching anyway)?

Regardless of anyone's philosophy of address assignment strategies, prefixes smaller than /64's in IPv6 are un-wise unless you want to degrade into worst-case routing paths on your network gear.

Re: Unique IPv6 prefix per host [pdf]

#18

Post by ra1n85 »

snuxoll wrote: post #17
ra1n85 wrote: post #14

Earlier quoted context omitted.

>I mean, I have no use for giving every single host a /64, but I've got five or six VLAN's and without at least a /56 I've got no way of actually deploying IPv6 on my network. Why can't you subnet the /64? CenturyLink isn't doing dot1q tagging to you, so you must have a router with tagged interfaces on your network. Edit: Imagine this is because you want to use SLAAC.

> Edit: Imagine this is because you want to use SLAAC. Not just because of SLAAC, prefixes smaller than /64 are likely to mess with all sorts of assumptions built into networking gear. It may not be "correct" since there are valid reasons for subnets as small as a /127 (though they are used infrequently enough at least), but a lot of networking gear cheats with IPv6 routes to keep the amount of TCAM memory needed dow…

Somewhat of a good point, but I don't think it applies here - some implementations, particularly inexpensive devices like SOC's, do exact search on common prefix lengths like /64 and /48. I can't imagine this would be a huge problem within a home network, though. Even then, DRAM, which is essentially software switching, is rarely used. Further, you said you had 6 VLANs - this is well within the route scale of the vast majority of network devices regardless of how they implement their lookup data structures.

Good example: The SRX300, a desktop router/firewall implemented on a MIPS based Cavium Octeon (both control and data plane) can handle up to 256K IPv6 routes: https://www.juniper.net/assets/us/en/local/pdf/datasheets/10...

The Trident series SOC's can do 8K by default, and 64K with ALPM enabled: https://www.juniper.net/us/en/local/pdf/datasheets/1000480-e...

>(I mean, you only use /127's for point-to-point links that don't need link-rate switching anyway)?

/126's and /127's are often used for PTP's for peering/transit. Line rate is table stakes. Bear in mind that the gear used in these situations has plentiful lookup memory (SRAM, RLDRAM, HMC, or HBM).

Re: Unique IPv6 prefix per host [pdf]

#19

Post by gerdesj »

snuxoll wrote: post #11
nimbius wrote: post #4

Earlier quoted context omitted.

perhaps its just my lack of coffee, but I fail to see the scalability issue. Router Redirection can prune quite a few ndp discovery table entries but Learned link-layer addresses are kept in a neighbor discovery table. 2^64 link layer connections are probably not present in a competently designed IPv6 network. im also confused as to what this paper is talking about in terms of new features.../64 and per host is alrea…

> if anything home ISP's need a slap on the wrist for their stingy DHCPv6 delegations of what basically amount to a SINGLE ipv6 address or some weird less-than /64. splitting a 56 is a better idea here. This is the single most infuriating issue with IPv6 rollout in the US. CenturyLink is starting to roll out native IPv6 support (instead of 6rd which they've been using for years), the only issue is you get a single /6…

RFC4193 "Unique Local Addresses" may be your only hope when you need multiple VLANs and only a /64 allocation. You then use NPT. Basically, its a bit like RFC1918 + NAT. The horror ...

Re: Unique IPv6 prefix per host [pdf]

#20

Post by X-Istence »

majidazimi wrote: post #13
ps0ps wrote: post #7

Earlier quoted context omitted.

One of the benefits of /64 per host is there is no NDP since the only neighbor is your router.

Additionally you can install the routing software on server itself and let it form neighbor-ship with ToR router(s) and use ECMP directly from server in multi NIC scenarios. ECMP failover/recovery is faster and simpler (vendor agnostic) than link aggregation protocols. Basically each rack becomes its own OSPF totally stubby area. Data center core runs as area 0.

BIRD or other BGP on the host running VMs/containers is what Calico does. We had it peer with our ToR "switches" over BGP.

We could do zero downtime, 1 or 2 packets lost live migration of workloads from one hypervisor host to another and had full ECMP capabilities.

We did this with both IPv4 and IPv6. There is nothing special about IPv6, but it does make it easier to aggregate routes.

Post reply on HN