Is there hope for IPv6? • Hacker News Board

Re: Is there hope for IPv6?

#191

Post by SamuelAdams » Sat, Jan 05, 2019, 8:35 PM UTC

apple4ever wrote: post #73

geofft wrote: post #31

Earlier quoted context omitted.

Loose coupling and no second system effect. IPv6 should have been extended address space and extended address space only, in a manner backwards-compatible with IPv4. You think ARP is broken? Great, implement a fixed version of ARP for both IPv4 and IPv6, meanwhile we'll spec IPv6 to use ARP. Don't design IPv6 to use your new thing called NDP that layers completely differently. You think everyone using NAT is wrong? G…

You hit on the problem with IPv6 designers- they took a solution (bigger address space) to a problem (not enough addresses) and they added a bunch of other changes (No NAT, No DHCP, ARP vs NDP, weird address scheme, etc) that arguably made things worse. Then they wonder why people aren’t adopting it. (Its the same complaint I have against Let’s Encrypt. They shoved down a policy which is antithetical to helping their…

I think this is what will cause USB-C to fail. It’s taking a simple problem (allow reversible, higher-bandwidth connections) and making it complex.

The latest spec requires encryption. In a cable. Which might be ok for some applications, but certainly not necessary for all items. Now you have so many versions, which may or may not implement a laundry list of features. And people just want simple, no fuss cables.

Re: Is there hope for IPv6?

#192

Post by Dagger2 » Sat, Jan 05, 2019, 8:37 PM UTC

geofft wrote: post #162

Dagger2 wrote: post #142

Earlier quoted context omitted.

It doesn't actually do that though. If you give a machine an IP of X, and then you turn on NAT on the upstream router so that its outbound connections appear to come from Y instead, the machine is still called X . NAT won't prevent someone from sending a packet to X, and it won't cause the router to somehow drop the packet when it sees it either. That stuff is handled by firewalls, not by NAT.

On Linux at least, NAT isn't handled by routing, it's handled by a separate layer (the firewall layer, in fact). I think that's the obvious way of implementing NAT: you're not routing at all. On the public side you're not accepting any packets not addressed to you. On the private side you're converting all packets, so you're not doing normal packet forwarding. When packets arrive on the public side, you have to trans…

It's handled by a separate layer, yes, but that doesn't mean that the routing layer magically disappears. It's still there, and in fact it's still required to forward every single packet that goes through the router. NAT is just simply an extra layer on top that sometimes changes the addresses in the src or dst fields of some packets.

Dropping packets not sent to a valid target is called firewalling. NAT doesn't decide what's valid and what isn't; all it does is detect packets which correlate to known connections and rewrite some of the headers on those packets.

Home routers, like all routers, do a lot of routing. They sit between two networks and they forward packets between them, which is pretty much the definition of a router. Having some header rewriting going on doesn't change that.

Re: Is there hope for IPv6?

#193

Post by phicoh » Sat, Jan 05, 2019, 8:37 PM UTC

geofft wrote: post #181

phicoh wrote: post #179

Earlier quoted context omitted.

There are a couple of reasons: - There are limits to how many devices you can put behind a single IPv4 address. There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Obviously for law enforcement, if an address is shared between multiple customers it makes investigations harder. - A second problem it that you may lose geographical resolution if customers for a…

Do these arguments not apply to IPv6 customers speaking to legacy IPv4 sites? They also have to go through IPv4 NAT, it's just that the NAT is converting it to a public IPv6 address instead of a CGNAT IPv4 one. Wouldn't law enforcement and ad targeting be equally unhappy by piles of IPv6 users being converted to the same IPv4 address? If enough of the Internet is running IPv6 that you save significantly on performanc…

For ad networks, the sensible thing to do is to support IPv6. Then any ISP with CGNAT only has to enable IPv6 to make it work.

I have no clue what law enforcement plans to do.

Video services use most of the bandwidth. So with youtube and netflix on IPv6, you can easily have most the traffic go over IPv6.

Re: Is there hope for IPv6?

#194

Post by Macha » Sat, Jan 05, 2019, 8:38 PM UTC

dtech wrote: post #167

votepaunchy wrote: post #157

Earlier quoted context omitted.

> consider how relatively smoothly various parts of WiFi stack was upgraded Has WiFi been upgraded? I believe new devices still have support back to 802.11b.

Usually, devices have an "802.11n+" options nowadays, dropping support for 11b and 11g has some benefits. It's often enabled by default on new devices, especially since most 11b/11g devices don't support WPA2-PSK so couldn't connect anyway

11b maybe, but most 11g devices should support WPA2, 11g lasted a long while before 11n was widespread.

Re: Is there hope for IPv6?

#195

Post by quicklyfrozen » Sat, Jan 05, 2019, 8:39 PM UTC

Dagger2 wrote: post #176

zamadatix wrote: post #148

Earlier quoted context omitted.

"If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor" Yes it is, it's the same scenario as if there was no route to the destination just at a higher abstraction layer. Think about it this way: a packet just hit the NAT IP from the internet, the packet has hit it's destination. There was no NAT table match for the packet so it was not rewritten. Where would the packet be f…

It's not the same scenario at all. If there's no route to the destination then the packet will necessarily be dropped, but with no matching NAT state table entry for a packet all that happens is that the dst header field is left alone. There will still be an IP in the dst header field! The router will still deliver the packet to that IP, subject to all the usual constraints (e.g. it needs a valid route etc). NAT won'…

The destination IP will be for the router itself, so the router can either re-deliver the packet to itself or drop it.

I don't see how NAT isn't an effective inbound firewall by itself in the normal case where it's in front of local non-internet-routable IP addresses.

Re: Is there hope for IPv6?

#196

Post by logifail » Sat, Jan 05, 2019, 8:41 PM UTC

apple4ever wrote: post #77

AnIdiotOnTheNet wrote: post #74

Earlier quoted context omitted.

> because I get assigned a new prefix every 24 hours Which kinda defeats the purpose of having a globally reachable unique address in a lot of respects. How am I supposed to allow connections to this device in my firewall if the address is always changing?

Exactly. There is more than enough address space to give a person a static IPv6 network. Comcast is guilty of this. Verizon doesn’t even offer IPv6 on FIOS. For both, I just set up an IPv6 tunnel to Hurricane Electric using pfSense.

>> There is more than enough address space to give a person a static IPv6 network. >> Comcast is guilty of this. Verizon doesn’t even offer IPv6 on FIOS.

Why would ISPs not deliberately(!) change address(es) for cheap/residential plans, to provide a reason for those customers to care about this to pay more for a pro/business plan with a static IP allocation?

Re: Is there hope for IPv6?

#197

Post by richardwhiuk » Sat, Jan 05, 2019, 8:41 PM UTC

logifail wrote: post #182

phicoh wrote: post #179

Earlier quoted context omitted.

There are a couple of reasons: - There are limits to how many devices you can put behind a single IPv4 address. There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Obviously for law enforcement, if an address is shared between multiple customers it makes investigations harder. - A second problem it that you may lose geographical resolution if customers for a…

>> There are limits to how many devices you can put behind a single IPv4 address. Do you mean ~65k devices behind a single public IPv4 address? [0] >> There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Well if law enforcement in Belgium asked, of course we all need to immediately work to redesign the global IPv4 internet to comply. [0] https://learningnetwor…

> Do you mean ~65k devices behind a single public IPv4 address? [0]

That's an absolute limit of 2^16 (65k) - the practical limit is much lower.

If you only allow one connection per client, then yes, you can get to 65k with TCP/UDP.

If you want more than one connection per client (e.g. because the user wants to download content from Facebook while also downloading a YouTube advert), you need to allocate multiple ports on the NAT device.

I'd imagine that most clients need at least 2^4, and possibly up to 2^8 simultaneous connections to ensure that you don't introduce problems. At the level, you have a limit of 2^8 - 2^12 clients (i.e 256 - 4096).

Re: Is there hope for IPv6?

#198

Post by 4bpp » Sat, Jan 05, 2019, 8:42 PM UTC

phicoh wrote: post #116

hn_throwaway_99 wrote: post #15

I hope (but am skeptical) that folks look at the overall failure of ipv6 from a deployment perspective to understand the root causes of why it failed (some may think "failure" is too strong a word, but I remember v6 being "just around the corner" in 2000, yet in 2019 I'm still connecting to a GCP database with v4). Coming up with a solution that looks like a huge technological advancement, with no real respect for th…

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

More issues with IPv6 that are relevant for me as a techie:

- Memorising an IPv4 address is about as easy as memorising a phone number, which is to say, fairly easy. I remember the iPv4 addresses of both my rental servers, every device on my home LAN, a bunch of public DNS servers if things go wrong, ...; there's no way I'm going to be able to do that for IPv6.

- At least last time I tested it (more than 10 years ago now), the greater length of IPv6 headers had a quite measurable adverse impact on transmission latency of small packets (online gaming, remote shell...)

- Why do people keep treating "you get your own unique IP address when browsing" as if it were an advantage? The way I see it, NAT and IP address reuse (especially together with some European countries' laws stipulating the address->identity mapping must be deleted within some time period) are the currently most widely rolled out privacy technology. Somewhere downthread, they talk about how Belgian police is trying to prevent ISPs from putting more than 16 customers behind the same internet address. Since I can hardly say everything I do on the internet is perfectly legal, what's bad for Belgian police is probably good for me.

Re: Is there hope for IPv6?

#199

Post by BenjiWiebe » Sat, Jan 05, 2019, 8:44 PM UTC

geofft wrote: post #165

sliken wrote: post #118

39% of Google's traffic is IPv6, clearly there's no hope.

Only if the end state is that the public internet will be dual-stack IPv4/IPv6 forever and everyone will need some form of IPv4 connectivity, either a real IPv4 address or NAT to one (from either private IPv4 or private IPv6). Is that the world we want? Have we solved the address space exhaustion problem if that's the route we take?

If 95% was dual stack, we could start getting rid of ipv4.

Re: Is there hope for IPv6?

#200

Post by nothrabannosir » Sat, Jan 05, 2019, 8:45 PM UTC

phicoh wrote: post #172

hn_throwaway_99 wrote: post #129

Earlier quoted context omitted.

> For the last couple of years we now have a mature market for IPv4 addresses. Which highlights the utter failure of v6 - people are willing to pay for access to technology that v6 was supposed to make obsolete over a decade ago.

I disagree. You have to consider network effects. Even if IPv6 was completely perfect, switching on your own doesn't do any good. You need to get most of the network to switch to get the benefits. Given that there is always a cost to switching, people will consider switching when continuing on the old path will become more costly than switching.

>> ... the utter failure of v6.

> Even if IPv6 was completely perfect...

More specifically: "completely technologically perfect". Which is the point being made in this thread: the technical aspect is of only partial relevance. If IPv6 fails because of political problems, or "contextual ones" (like “we could make it technologically inferior but more readily backwards compatible; it would make it less awesome but easier for people to migrate”), then that is still "failure of IPv6".

If IPv6 had been perfect, it would be fully backwards compatible, and there would be no market for IPv4 right now.

Just because that isn't possible doesn't mean there isn't a middle ground.