Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1/3 of all access to Google is now over IPv6

google.com

Post reply on HN
Print view View original

131–140 of 237 posts

Re: More than 1/3 of all access to Google is now over IPv6

#131

Post by Dagger2 »

buro9 wrote: post #41
theduality wrote: post #11

Earlier quoted context omitted.

My ISP in the Netherlands (Ziggo) provides me with native IPv6 if I use their supplied router, but forces me onto IPv4 when I use theirs in bridge mode in conjunction with my own router. Still not sure why they do that.

These ISPs are using DS-Lite, Dual-Stack Lite. https://www.juniper.net/documentation/en_US/junos/topics/top... (this isn't a purely Juniper thing, but they have nice diagrams on their documentation) It's a kind of carrier grade NAT with 4over6 baked in. Depending on the version of this they are relying on your modem to perform encap/decap of 4to6, hence when you switch to modem mode or your own router you fall back t…

DS-lite gives you a v6-only internet connection. v4 is provisioned as a service over the top of that, using a tunnel between your router and a server inside the ISP. The underlying network is v6, so a router without DS-lite support will only get v6 (which will generate support calls because "your router must support DS-lite" is too complicated for many people to understand).

My guess is that turning on bridge mode also migrates you from the ISP's newer DS-lite service to their older v4-only one. This is unfortunately common in DS-lite deployments; ideally the old service would also have v6 so that you aren't forced to choose between v6 and non-CGNATed v4.

Re: More than 1/3 of all access to Google is now over IPv6

#132

Post by mehrdadn »

dijit wrote: post #129
mehrdadn wrote: post #128

Earlier quoted context omitted.

Thanks for sharing. While I have a hard time grasping your usage (why in the world are 3 devices opening 1.6 connections every second?), it's not really relevant as your own data shows state tables don't get exhausted, right? Your table only has 152 entries, which is quite a far cry from exhausting its 403,000 slots.

My point is that even when I don't quite run out, something is dropping states. the Hard limit is just one imposed by the OS, it doesn't seem to matter that I have absurd amounts of free memory, or that the kernel is quite content with loading up hundreds of thousands of states: they still get dropped. And like I said, my hardware and software platform is many dozens of times more advanced than what most people are u…

You're talking about the state-mismatch rate being nonzero, right? I take it as a given that that represents the router dropping states? And you're assuming that must be due to NAT slot exhaustion? If that's what you're saying, it clearly doesn't square with the 152 slots being in use currently (nor does it make sense to me otherwise, given everything I explained above). So either the states are being dropped due to a different reason than you're claiming (I see no link to table exhaustion? it seems like a conjecture), or I'm completely missing a giant piece of the puzzle. Heck, if I take the name at face value, "state mismatch" just sounds like it could be due to a bug in the connection endpoints (or random package spamming from the internet...), rather than anything related to the router at all.

Re: More than 1/3 of all access to Google is now over IPv6

#133

Post by dijit »

mehrdadn wrote: post #132
dijit wrote: post #129

Earlier quoted context omitted.

My point is that even when I don't quite run out, something is dropping states. the Hard limit is just one imposed by the OS, it doesn't seem to matter that I have absurd amounts of free memory, or that the kernel is quite content with loading up hundreds of thousands of states: they still get dropped. And like I said, my hardware and software platform is many dozens of times more advanced than what most people are u…

You're talking about the state-mismatch rate being nonzero, right? I take it as a given that that represents the router dropping states? And you're assuming that must be due to NAT slot exhaustion? If that's what you're saying, it clearly doesn't square with the 152 slots being in use currently (nor does it make sense to me otherwise, given everything I explained above). So either the states are being dropped due to…

Routers, especially cheap ones, are often equipped with weak CPUs because they aren’t designed to handle heavy processing loads. It’s not like you’re calculating physics or processing 3D animation directly on your router, right?

But network address translation _can_ be a processing-heavy task.

Every single packet that leaves the private network needs to be translated, and every single packet that comes in from the public network needs to be translated. Each individual translation may be simple enough, but with heavy internet use, it all adds up.

Here’s my network activity while browsing the web: https://i.imgur.com/oP8PrX4.png, with one 720p YouTube video open in a tab and a dozen other tabs for various websites, all in the Edge browser.

The top nine processes are using an average of 1,182,149 bytes per second. Every network interface has a maximum transmission unit (MTU), which is the largest size that a data packet can be. Ethernet and Wi-Fi have an MTU of 1,500 bytes.

My computer, doing nothing more than watching a YouTube video, is putting a minimum load on my router of 788 packets per second. That’s assuming the bytes are all divided into 1,500-byte packets, which isn’t the case in real world usage. Somewhere between 1,000 to 3,000 packets per second is more realistic.

The load is worse during bandwidth-intensive activities, such as multiplayer gaming and torrenting. In fact, torrenting is so intensive that it’s the primary cause of NAT issues for home users today. (Open connections to dozens/hundreds of peers, with each connection involving high-speed downloads and uploads.)

And it’s not just one computer on a private network. It is commont to have a smartphone or two, maybe a tablet, smart TV, plus a handful of other devices for the rest of the people sharing the living space. They all need network address translations too!

At the end of the day, we’re talking thousands and thousands of data packets per second, all translated by a weak CPU that can’t keep up. It’s one reason why cheap routers are prone to slowing down.

Notably: while doing that (and opening youtube) my state table grew to just under 400 states. So, youtube needs a lot of connections it seems.

Re: More than 1/3 of all access to Google is now over IPv6

#134

Post by MayeulC »

growse wrote: post #116
MayeulC wrote: post #114

I host some services at home, mainly targeted at friends and family. Some are IPv6-only, because it's much easier to manage from my side. I whish I could add an A record for these that pointed to a reserved IP address that would inform clients the service is IPv6-only. For now, I just don't put any, and browsers just display a generic error. Since some DNS don't answer with IPv6 addresses, the browser couldn't even p…

Isn't the presence of an AAAA record but the lack of an A record already a sufficient indicator that the service is IPv6 only?

It should, but:

* I don't know any browser or app that display a special, informative message in that specific case.

* You need a DNS server that answers AAAA record to detect this. Some ISPs do not provide IPv6 connectivity, nor do their DNS servers provide AAAA records. In most places I know, especially when talking about individuals, people use their ISP-provided DNS servers.

Re: More than 1/3 of all access to Google is now over IPv6

#135

Post by theandrewbailey »

zenexer wrote: post #99
LUmBULtERA wrote: post #77

Meanwhile, Verizon FIOS here still doesn't offer IPv6.

Coming soon! https://www.verizon.com/support/residential/internet/getting... How long have they been saying that now? Five years? Ten years? Probably about ten years.

They've been saying that since I signed up for FIOS, around 2011. I've heard that some FIOS deployments/cities have IPv6, but I don't know which, and it's not mine (Pittsburgh).

Re: More than 1/3 of all access to Google is now over IPv6

#136

Post by [deleted] »

jl6 wrote: post #66
wtallis wrote: post #13

Earlier quoted context omitted.

It's not just 4G. It's consumer networking in general, which isn't held back by legacy enterprise networking equipment. When your residential ISP turns on IPv6 for their network, they also tend to turn on IPv6 for the modem+router combo devices they lease to run your LAN. Or if you're the kind of power user that buys your own router, it's almost certainly new enough to support IPv6.

Does IPv6 on an internal network offer any benefit to enterprises (not talking about ISPs here), who may view NAT as a form of defence in depth?

[deleted]

Re: More than 1/3 of all access to Google is now over IPv6

#137

Post by Dagger2 »

oarsinsync wrote: post #107
c0nsumer wrote: post #106

Earlier quoted context omitted.

The most common symptom of this is someone mentioning that their home 'router' regularly needs reboots to keep working well. Excluding memory leaks, it's frequently the state table running out of space and connections going sideways as a result. This is hard for individuals to see, but put a fair bit of load on a home consumer 'router' and, presuming you can get enough access to it to watch resources, you'll see it r…

> IPv6 completely sidesteps this by not even needing a state table because no NAT. You may have forgotten that a stateful firewall that tracks inbound and outbound connections still needs memory to store a state table still applies in IPv6. Now it also needs 8x more memory per entry, as the addresses have gone from 2x 32bit to 2x 128bit.

There's almost certainly more data in each entry than just the IP addresses, so it won't be 8x. NAT also requires a second set of entries to track the NAT session, which further equalizes it.

Re: More than 1/3 of all access to Google is now over IPv6

#138

Post by fulafel »

jiggawatts wrote: post #75
dijit wrote: post #40

And yet, when I beg my google cloud rep for IPv6 addresses on instances (or on anything that isn’t the load balancer) I get told that it is not on the immediate roadmap. The cloud providers have pushed back ipv6 adoption so hard imo. At least native ipv6 access. I know they’ve thrown in some token support and you /can/ make something work; but compared to VPS providers which consistently deliver machines with IPv6 ad…

Azure's IPv6 "support" saddens me. It's just painful how minimal their support is. For one, they NAT all IPv6 traffic. Let that sink in. Let it percolate. Mull over the fact that the entire purpose of IPv6 is to eliminate NAT, and that it's practically impossible to get an IPv6 NAT-ing network device. Microsoft must have had to write their own, custom network load balancers to NAT IPv6. It's madness . Oh, if that's n…

Wow. That's terrible.

Re: More than 1/3 of all access to Google is now over IPv6

#139

Post by Dagger2 »

johannes1234321 wrote: post #102
jiggawatts wrote: post #84

Earlier quoted context omitted.

There's little demand for half-baked support. There would be a lot of demand if IPv6 wasn't an "also ran", a "tack on", some checkbox to tick. Think about how much network complexity would simply vanish if everything used only public routable IPv6 ranges. No more split DNS. No more NAT gateways. No need for a separate "public IP" and "private IP". No need to carefully "carve up" the 10.x.x.x range to carefully avoid…

Looking at the number of unprotected databases (see i.e. https://news.ycombinator.com/item?id=23957510 ) I think it's good that cloud providers push for gateways etc. in order to restrict access on network level. (They still could do IPv6 proper - no argument there)

As a side benefit of v6, it makes it harder to find unprotected machines due to the vastly increased address space.

Obviously that doesn't make those machines secure, but an insecure machine that hasn't been exploited is better than an insecure machine that has.

Re: More than 1/3 of all access to Google is now over IPv6

#140

Post by icedchai »

jasonvorhe wrote: post #38
efxz wrote: post #6

Earlier quoted context omitted.

IPv6 still has NAT. There's public and private IPv6 addresses, same as IPv4. Google building their infrastructure around IPv6 does not have anything with tracking IPv6 users

IPv6 doesn't have NAT, it has different addresses for global and local scopes, but your OS never translates between these addresses and it doesn't need to keep a table of translations & connections, as you'd have with IPv4 and NAT.

Technically you can do NAT with IPv6, just almost nobody ever does it for the reasons you specify. It's pointless to do NAT when there is no address shortage.

In the early to mid 90's, nobody did NAT with IPv4 either.

Post reply on HN