Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blockers to IPv6 Adoption

labs.ripe.net

Post reply on HN
Print view View original

141–150 of 154 posts

Re: Blockers to IPv6 Adoption

#141

Post by zAy0LfpBZLC8mAC »

noinsight wrote: post #140
zAy0LfpBZLC8mAC wrote: post #132

Earlier quoted context omitted.

> ARP was replaced by neighbor discovery protocol. Would you be happy if we renamed NDP to ARPv6? Or is your suggestion that we continue to use ARP and put a more-than-four-byte-address into a fixed-size four byte field? > Broadcast was replaced by multicast. So, in IPv6 you can only send packets to a small subset of recipients, whereas in IPv4 you could address a packet to "every IPv4 device on the planet"? Or are y…

I don't have a problem with IPv6, I was just stating changes between it and v4.

Well, but I didn't ask for "changes between v6 and v4", I was asking for changes other than the change in address size that hinder adoption--with the point being that most of the stuff that people complain about is actually an unavoidable consequence of the change in address size, such as the replacement of ARP with a new protocol that can actually transport longer addresses than 32 bits (and that otherwise isn't all that different from ARP).

Re: Blockers to IPv6 Adoption

#142

Post by lwhalen »

voidwtf wrote: post #133
4ad wrote: post #76

Earlier quoted context omitted.

> Their default is to give a /60, which seems appropriately overkill. A /60 is pathetically small, with SLAAC you have 16 (!!) subnets for your whole network. With people having multiple computers and multiple phones, this is not enough even for a normal household of 3 people. If you are a IT person, with multiple computers and VMs, forget it. The recommended size of block that every ISP should give is /48 (RFC 6177)…

Comcast business users can get a /56 by requesting it in their dhcpv6 settings.

I have Business. I request a /56. It gives me a /60. I try to partition that out into subnets, but prefix-delegation (PD) fails at that point.

Re: Blockers to IPv6 Adoption

#143

Post by grandinj »

joquarky wrote: post #137
grandinj wrote: post #20

What we should take away from the IPv6 debacle is a fine lesson in hubris. I was hanging out in the IPv6 mailing lists at the time the various solutions were being debated. The prevailing attitude was "the Internet is about to die from routing overload without IPv6, so we can stick whatever complexity we want inside it, and they will have no choice but to accept it." Except that new router hardware and new incrementa…

I've had this question for some time, and you mentioned that you were present during the debate phase. I wonder if I could ask if there was any mention of a solution to expand IP address space in a manner similar to how UTF-8 expands as needed? I'm not a SME on low-level protocols, but it seems the jump from 32 to 128 bits was an ambitious leap to future-proof and maybe a small part of the reason adoption is slowed.

I don't remember any variable-length encodings being proposed, but it was a long time ago.

I don't think the 128-bit length was ever an issue, that is just a field length, one parameter amongst many. It's all the other details that make a protocol (and it's surrounding infrastructure) more or less difficult to implement.

One of the contending proposals literally modified an existing TCP/IP stack with a constant in all the relevant places, and was then compiled twice. It had

#ifdef IPV6 #define ADDR_LENGTH 4 #else #define ADDR_LENGTH 16 #endif

and then you could compile the same source twice, once for each protocol, just passing a -DIP6 on the command line for the IPV6 version.

Re: Blockers to IPv6 Adoption

#144

Post by vetinari »

ddalex wrote: post #134
vetinari wrote: post #102

Earlier quoted context omitted.

> That is completely untrue. The vast majority of home routers (I would venture 99% of them) run Linux, and use the built in NAT, which does check source IP, for both TCP and UDP connections Of course it is true. The true thing you wrote is, that Linux is one of the few implementations that do check the source IPs. However, even if many home routers do run Linux, it does not mean that they use Linux's NAT. Many do no…

I really don't know a lot about the hole-punching thing, can you please point me to some docs / demos / code / etc. available that would demonstrate this ? Is there any exploit / known technique / program that allows you to explore a network behind a NAT without cooperation from inside ?

The concepts are described here:

Ford, Bryan; Srisuresh, Pyda; Kegel, Dan (2005), Peer-to-Peer Communication Across Network Address Translators (http://www.brynosaurus.com/pub/net/p2pnat/)

Abstract:

Network Address Translation (NAT) causes well-known difficulties for peer-to-peer (P2P) communication, since the peers involved may not be reachable at any globally valid IP address. Several NAT traversal techniques are known, but their documentation is slim, and data about their robustness or relative merits is slimmer. This paper documents and analyzes one of the simplest but most robust and practical NAT traversal techniques, commonly known as “hole punching.” Hole punching is moderately well-understood for UDP communication, but we show how it can be reliably used to set up peer-to-peer TCP streams as well. After gathering data on the reliability of this technique on a wide variety of deployed NATs, we find that about 82% of the NATs tested support hole punching for UDP, and about 64% support hole punching for TCP streams. As NAT vendors become increasingly conscious of the needs of important P2P applications such as Voice over IP and online gaming protocols, support for hole punching is likely to increase in the future.

> Is there any exploit / known technique / program that allows you to explore a network behind a NAT without cooperation from inside

If you wanted to exploit this, you would have to guess the port, and it would be forwarded to a machine behind the NAT, which "owns" the open port.

Re: Blockers to IPv6 Adoption

#145

Post by vetinari »

beagle3 wrote: post #108
vetinari wrote: post #102

Earlier quoted context omitted.

> That is completely untrue. The vast majority of home routers (I would venture 99% of them) run Linux, and use the built in NAT, which does check source IP, for both TCP and UDP connections Of course it is true. The true thing you wrote is, that Linux is one of the few implementations that do check the source IPs. However, even if many home routers do run Linux, it does not mean that they use Linux's NAT. Many do no…

Hole punching refers to cooperative nat traversal, that is, with help from the inside - in every discussion I have ever seen. Care to point to 3 examples of common home routers that do not check source IP? I’ve verified many TP-Links, Linksys (when they were owned by Cisco) and Netgears, and all used the kernel to NAT (and yes, they couldn’t do the 1Gb while NATting - usually 300-700 or so. And much lower if you use…

> Hole punching refers to cooperative nat traversal, that is, with help from the inside - in every discussion I have ever seen.

If by cooperative you mean that there is outcoming connection on the port, then yes, that's cooperative. If by cooperative you mean some sort of port mapping, whether manual or UPnP, then no, you don't need that.

For details, see the paper linked in sibling response.

Re: Blockers to IPv6 Adoption

#146

Post by ac29 »

lwhalen wrote: post #142
voidwtf wrote: post #133

Earlier quoted context omitted.

Comcast business users can get a /56 by requesting it in their dhcpv6 settings.

I have Business. I request a /56. It gives me a /60. I try to partition that out into subnets, but prefix-delegation (PD) fails at that point.

Sounds like a router configuration issue. I have no issue getting a /56 and handing out /64's on a Comcast Business line.

Re: Blockers to IPv6 Adoption

#147

Post by lwhalen »

ac29 wrote: post #146
lwhalen wrote: post #142

Earlier quoted context omitted.

I have Business. I request a /56. It gives me a /60. I try to partition that out into subnets, but prefix-delegation (PD) fails at that point.

Sounds like a router configuration issue. I have no issue getting a /56 and handing out /64's on a Comcast Business line.

Do you have a static v4 block as well?

Re: Blockers to IPv6 Adoption

#149

Post by singularity2001 »

neojima wrote: post #127
singularity2001 wrote: post #123

Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)?

In 2005 or so, sure. Now...not so much? What privacy erosion/easier tracking are you talking about that wasn't remedied by the very wide deployment of RFC4941 (IPv6 Privacy Extensions) in operating systems?

with IPv4 my ISP has to shuffle IPs with every reconnect. with IPv6 you could get one IP for lifetime?

Re: Blockers to IPv6 Adoption

#150

Post by detaro »

singularity2001 wrote: post #149
neojima wrote: post #127

Earlier quoted context omitted.

In 2005 or so, sure. Now...not so much? What privacy erosion/easier tracking are you talking about that wasn't remedied by the very wide deployment of RFC4941 (IPv6 Privacy Extensions) in operating systems?

with IPv4 my ISP has to shuffle IPs with every reconnect. with IPv6 you could get one IP for lifetime?

That's orthogonal to IPv4 and IPv6. There's ISPs that give you always the same IPv4 adress, there's ISPs that give you a different IPv6 prefix each time.
Post reply on HN