Is there hope for IPv6? • Hacker News Board

Re: Is there hope for IPv6?

#231

Post by Dagger2 » Sat, Jan 05, 2019, 9:43 PM UTC

ben0x539 wrote: post #217

Dagger2 wrote: post #138

Earlier quoted context omitted.

64 bits probably wouldn't be enough to let people avoid going into address conservation mode though. Heck, there are way too many ISPs allocating a single /64 in v6 land today , and there's far more space available in v6 today than there would be after 100+ years of your 64-bit space. Having an unnecessarily large amount of addresses is a good thing, because the alternative is to have too few addresses. You don't wan…

Is your complaint that the /64 allocation from ISPs is too big or too small? And are you primarily thinking of residential/"end-user" ISPs?

It's too small. /56 should be the minimum unless there are hard technical reasons why you can't do that. My point was that a lot of ISPs seem to think that even /63 is too big, and that's in a 128-bit address space. Surely they would be even more miserly than they currently are if you removed 99.9999..% of the address space?

I was primarily thinking of residential ISPs; business ISPs tend to be a little bit better. That said, datacenters (or rather server/VPS providers) are absolutely terrible. Most of them give you no v6 allocation of your own at all. If you're lucky they let you use as many addresses as you like on your WAN segment, but good luck if you wanted to do a VPN or routed VM subnet.

Re: Is there hope for IPv6?

#232

Post by lowercased » Sat, Jan 05, 2019, 9:47 PM UTC

4bpp wrote: post #198

phicoh wrote: post #116

Earlier quoted context omitted.

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

More issues with IPv6 that are relevant for me as a techie: - Memorising an IPv4 address is about as easy as memorising a phone number, which is to say, fairly easy. I remember the iPv4 addresses of both my rental servers, every device on my home LAN, a bunch of public DNS servers if things go wrong, ...; there's no way I'm going to be able to do that for IPv6. - At least last time I tested it (more than 10 years ago…

Your point (and reply) about memorization was good. Yes, I'm not constantly remembering "210.40.138.43" but enough tech people need to remember some of these things - for debugging, support, etc - that IPv6 is painful. Asking someone to verify an IPv4 in a dialog setting is doable - an IPv6 is not.

I've maintained for 2 decades that simply adding another 2 slots for 0-255 would have opened up a greatly usable amount. Every current v4 - 210.40.134.34 - would also be 0.0.210.40.134.34, but we'd have another 65000 groupings of 4 billion addresses to allocate as needed, and a transition would have been far easier (smaller space, less processing, easier to think about, etc).

Re: Is there hope for IPv6?

#233

Post by phicoh » Sat, Jan 05, 2019, 9:51 PM UTC

vbezhenar wrote: post #223

phicoh wrote: post #116

Earlier quoted context omitted.

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

I never truly delved into low level networking, but I generally got a grasp for IPv4, I can setup simple networks and I think that I understand what's going on on every level. Now despite the fact that I tried to understand IPv6 multiple times, I failed miserably all the time. I tried to setup IPv6-over-IPv4 OpenVPN, it did not work despite all efforts. IPv6 is just too complex. At this point I wish that IPv6 would b…

By and large IPv6 is very similar to IPv4, but of course without NAT.

For example, at my home I get a /48 prefix from my ISP over DHCPv6 (over PPPoE). Then I assign /64 prefixes to my subnets. After that, hosts pick up addresses using SLAAC.

Obviously, VPNs are more complex, but that's not the fault of IPv6.

Re: Is there hope for IPv6?

#234

Post by richardwhiuk » Sat, Jan 05, 2019, 9:56 PM UTC

zzzcpan wrote: post #216

richardwhiuk wrote: post #197

Earlier quoted context omitted.

> Do you mean ~65k devices behind a single public IPv4 address? [0] That's an absolute limit of 2^16 (65k) - the practical limit is much lower. If you only allow one connection per client, then yes, you can get to 65k with TCP/UDP. If you want more than one connection per client (e.g. because the user wants to download content from Facebook while also downloading a YouTube advert), you need to allocate multiple ports…

The 65k limit only applies to concurrent connections to the same remote ip and port. Meaning that you can only make 65k connections from a single IP to the same port of another IP. Which is unlimited for all practical purposes. However, popular services that could potentially see a lot of connections - ban IP addresses, do rate limiting, don't allow that many connections from a single IP. This in turn drives policies…

It's not as unlimited as you might hope.

For a typical provider, a large proportion of their traffic is going to go to a limited number of properties (e.g. facebook, google, youtube).

Each of those properties is only going to return a limited number of IP addresses, and all of the traffic is going to be to a very small number of ports (i.e. 443/80). I can well believe that clients connects via a single ISP to a single remote port a large multiple of times.

Re: Is there hope for IPv6?

#235

Post by Dagger2 » Sat, Jan 05, 2019, 10:00 PM UTC

4bpp wrote: post #224

Dagger2 wrote: post #218

Earlier quoted context omitted.

It would be a random address from a given subnet, yes. Basically the privacy, tracking and banning implications of this are more or less the same as they are with v4+NAT, with the v4 public IP mapping to the v6 subnet. Note that there's still no way to map a subnet to a person, just like there's no way to map a public v4 address to a person.

Huh, are you implying that with IPv6, the ISP can place multiple unrelated people in the same subnet but not coordinate with them regarding what address from the subnet they use? How does this work from a routing perspective? What if two people pick the same address? On the other hand, if the ISP ultimately does hand out the address in the subnet (and the end user can merely ask it for a new one), the ISP can retain…

Normally what happens is: you request a prefix from the ISP (call it a /56, which is 256 subnets of /64 size each), then you pick one /64 from the prefix and use it for your network. Your computers then assign themselves randomly-selected addresses from the /64.

The prefix might be 2001:db8:1:2300::/56, the first network 2001:db8:1:2301::/64, and the machines on that network 2001:db8:1:2301:random:numbers:go:here.

The ISP knows who has which prefix, because they handed them out, but the allocation of IPs inside that prefix is handled entirely by the end-user network. The ISP isn't involved in it, so they have no idea which IP is which computer.

With NAT the LAN-side IPs are hidden from the ISP. In v6 the ISP can see the LAN part of the address, but without any way to identify which machine is using which IP that doesn't give them any extra information. All they get is the prefix and a random number. Computers typically change the random number on a regular basis too so you can't even do any long-term analysis on it.

Re: Is there hope for IPv6?

#236

Post by phicoh » Sat, Jan 05, 2019, 10:01 PM UTC

nothrabannosir wrote: post #200

phicoh wrote: post #172

Earlier quoted context omitted.

I disagree. You have to consider network effects. Even if IPv6 was completely perfect, switching on your own doesn't do any good. You need to get most of the network to switch to get the benefits. Given that there is always a cost to switching, people will consider switching when continuing on the old path will become more costly than switching.

>> ... the utter failure of v6. > Even if IPv6 was completely perfect... More specifically: "completely technologically perfect". Which is the point being made in this thread: the technical aspect is of only partial relevance. If IPv6 fails because of political problems, or "contextual ones" (like “we could make it technologically inferior but more readily backwards compatible; it would make it less awesome but easie…

It is easy enough to criticize the IETF and the wider IPv6 community for the mistakes they made.

But as far as I know, nobody came up with a credible protocol that is fully backward compatible with IPv4.

So, you can ask the IETF to come up with a magically protocol that has longer addresses and is still backward compatible with IPv4. But they are only human. So that kind of magic is not going to happen.

Re: Is there hope for IPv6?

#237

Post by bartwe » Sat, Jan 05, 2019, 10:08 PM UTC

As a gamedeveloper it hasn't been particularly easy or clear how to make connections between users over v6, it is enough of a mess with v4 tbh

Re: Is there hope for IPv6?

#238

Post by Dagger2 » Sat, Jan 05, 2019, 10:11 PM UTC

iagovar wrote: post #145

zamadatix wrote: post #119

Earlier quoted context omitted.

99% of users couldn't tell you what an IP address or port is let alone manually configure MACs and IPs into their router so I don't think that has anything to do with adoption of v6. To the vast majority of users they type a name in the URL bar and that's their full interaction with what they'd think of as "internet addresses". Those administering the systems users connect to have always handled DNS just fine so I do…

v6 adresses are hard to memorize tho

Not really? I don't think you can reasonably argue that:

2001:db8:4242:1::2

is much harder to remember than:

203.0.113.42+192.168.1.2

In fact it's substantially fewer characters.

Okay, obviously you can pick v6 addresses such that they're long and hard to memorize, but I'd argue that if you do that and also refuse to use DNS for them then you've lost your right to complain about how long and hard to memorize they are.

Re: Is there hope for IPv6?

#239

Post by gerdesj » Sat, Jan 05, 2019, 10:11 PM UTC

4bpp wrote: post #230

gerdesj wrote: post #225

Earlier quoted context omitted.

I'm a techie too but I think: - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. - In general…

> - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. Most of the things I do with memorised a…

Most of the things I do with memorised addresses have nothing to do with the browser or HTTP. (Mind you, though, the moment a browser won't let me access a bare IP, I'm switching away from that browser.)

Me too. Wireshark, nmap and co are in regular use in my job. All browsers are playing nanny, more and more apart from the likes of Links (which I also use quite often). A lack of https is already flagged and I suspect that things will get worse in this regard. Links2 has saved my bacon many times in the past so you may enjoy it 8)

You are worried about the likes of Google and Facebook profiling you

No mate. I'm CREST accredited: I'm not worried about G and F profiling me - I know they do. However I also know that my choice of addressing scheme does not affect my privacy whatsoever. A carrier can use metadata to derive loads of facts about your usage even if you are connecting to the oher end over say https. NAT will save you from some silly firewall screw ups but not much else. A VPN can help but is no silver bullet either. If I really put my mind to it I could probably make myself near enough anonymous with enough use of proxies, VPNs and TOR but I'm not too sure about that!

I too am from the UK and have seen silly overreactions such as your [1] link. However, this is the world we have nowadays and in our case we have a horrific level of CCTV pointed at us as well as some pretty impressive levels of IP traffic mining. We also have the rather unpleasant RIP Act and a few others to belie our supposed liberal way of life in the UK. You do have to be careful what you say nowadays, within reason.

Re: Is there hope for IPv6?

#240

Post by 4bpp » Sat, Jan 05, 2019, 10:13 PM UTC

Dagger2 wrote: post #235

4bpp wrote: post #224

Earlier quoted context omitted.

Huh, are you implying that with IPv6, the ISP can place multiple unrelated people in the same subnet but not coordinate with them regarding what address from the subnet they use? How does this work from a routing perspective? What if two people pick the same address? On the other hand, if the ISP ultimately does hand out the address in the subnet (and the end user can merely ask it for a new one), the ISP can retain…

Normally what happens is: you request a prefix from the ISP (call it a /56, which is 256 subnets of /64 size each), then you pick one /64 from the prefix and use it for your network. Your computers then assign themselves randomly-selected addresses from the /64. The prefix might be 2001:db8:1:2300::/56, the first network 2001:db8:1:2301::/64, and the machines on that network 2001:db8:1:2301:random:numbers:go:here. Th…

Oh, I see where the misunderstanding is. In cases like the one addressed in Belgium, the ISP actually assigns the same outward-facing IP address to multiple unrelated customers, and NAT is performed on the ISP side. Somebody who has merely recorded the IP address that made a request therefore has no legal way of determining that it came from you or someone close to you, rather than a number of complete strangers who were assigned the same address, unless the ISP maintains a record of what connections were mapped. As far as I know, in the US this is mostly common for mobile providers. If we are just talking about a NAT in your home LAN, this won't help you for privacy/security: law enforcement and whoever else still know that the IP address is yours.