Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

40% of Google users now connect via IPv6

google.com

Post reply on HN
Print view View original

311–320 of 353 posts

Re: 40% of Google users now connect via IPv6

#311

Post by Dylan16807 »

p1mrx wrote: post #309
Dylan16807 wrote: post #307

Earlier quoted context omitted.

> How could a device have a hardware-embedded IP address, if the hardware vendor doesn't know which ISP you will use? By putting the hardware part in the second half, and the ISP part in the first half. You know, like how it works by default.

Most devices randomize the second half by default, using RFC3041 and its successors.

They do, these days.

But then why were you asking "how" a device could have a permanent hardware identifier with its address? Just don't implement those optional RFCs.

And the comment you were replying to didn't say it had to be the entire address, and there's no reason for it to be.

Re: 40% of Google users now connect via IPv6

#314

Post by fulafel »

neilalexander wrote: post #84
fulafel wrote: post #78

Earlier quoted context omitted.

What besides presenting the same DUID would cause you to get the same prefix again?

The host portion of the address changes. The prefix doesn’t.

The prefix delegated to you does change in many consumer ISP setups, like the upthread poster reported and I've seen in many cases in well, I think repeating your assertion doesn't really advance your argument.

Are you thinking of a scenario where the ISP customers share a single prefix? This would be contrary to all the estabilished best practices and deployment guidance for IPv6 since it wouldn't let you easily subnet. And may get the ISP in trouble with your RIR since it's just extorting customers for access to v6 addresses.

Re: 40% of Google users now connect via IPv6

#315

Post by fomine3 »

martinald wrote: post #208
stingraycharles wrote: post #192

Earlier quoted context omitted.

To do NAT, you need to map (external) port numbers to (internal) IP addresses. This is done using connection tracking: tracking the state of the connection and the appropriate mapping. And connection tracking gets expensive at scale.

Yes, I understand how NAT works. But CPU/memory is going down in cost way faster than bandwidth demand is increasing. Regardless, its way way cheaper than buying IPv4 blocks clearly, otherwise people wouldn't be doing it. Edit: ok, the problem isn't hardware, it's comedy license fees. https://itprice.com/juniper-price-list/cgn.html $470k for a license to do CGNAT at 100gbit/sec. Surely these guys are opening themselv…

CGNAT also needs IP-port-user logging to support disclose request by law enforcement.

Re: 40% of Google users now connect via IPv6

#317

Post by Dagger2 »

Dylan16807 wrote: post #306
dsr_ wrote: post #31

Earlier quoted context omitted.

NAT doesn't. 1:many NAT does. 1:many NAT requires an affirmative choice on where to route incoming packets that aren't part of an existing stream. In adaptation to that, most attacks are malware spread by email, or attack browser vulnerabilities, or attack services running on network devices, especially remote management systems.

> NAT doesn't. > 1:many NAT does. This is technically correct but how often do you really see 1:1 NAT.

It's not even technically correct; it's just wrong.

NAT doesn't make any choices on where a packet gets delivered. For packets that aren't part of an existing steam, NAT will simply not edit the packet. Unless there's a separate firewall that chooses to drop it, the packet will get delivered to whatever IP was already in the destination field, which could be the IP of one of your LAN machines.

Re: 40% of Google users now connect via IPv6

#318

Post by Dagger2 »

ta2478367 wrote: post #270
ajross wrote: post #225

Earlier quoted context omitted.

Stuff breaks. I fought this fight a few years back just to educate myself, and the mere presence of IPv6 on the network, DHCPv6 addresses being handed out, AAAA records being returned from the local caching DNS, etc... made all sorts of software loopy. One I remember in particular was that if you hit a default openssh configuration from the local (!) network, even on a link-local address, it would try to do a RDNS lo…

Because its an over-engineered pile of shit. The only thing required was an increase in the address space, but we got IPv6 instead, which everyone sane resists to this day. Defaulting to hex addressing only a sheltered engineer would do.

It's not very over-engineered; most parts of it work the same as v4 does, just with bigger addresses.

Writing the addresses in hex is because doing so is easier. It lines up with the binary better which makes subnetting easier, and do you really want to deal with addresses that look like "32.1.13.184.133.163.0.0.0.0.138.46.3.112.115.52"?

Re: 40% of Google users now connect via IPv6

#319

Post by Dagger2 »

collsni wrote: post #126
jlouis wrote: post #46

Earlier quoted context omitted.

It rotates about once a day in most operating systems. Called ipv6 privacy extensions. This is of course defeatable, but it provides a nice black hole for a device. It moves on and you can't connect to it anymore.

yeah im not sold by this. i want all of my source traffic to show my gateway as the origin, not my unique end devices. privacy nightmare

It's not a privacy nightmare. You could just run a proxy on your gateway and your connections would legitimately end up coming from it, but it wouldn't actually do much for your privacy.

Re: 40% of Google users now connect via IPv6

#320

Post by Dagger2 »

ospray wrote: post #72
jlouis wrote: post #46

Earlier quoted context omitted.

It rotates about once a day in most operating systems. Called ipv6 privacy extensions. This is of course defeatable, but it provides a nice black hole for a device. It moves on and you can't connect to it anymore.

Rotating the IP to get similar privacy to what NAT/PAT gave you is annoying I know with v6 we need to use DNS but I hate to say it. I miss Nat I hope the just give us nat66.

It only rotates the IP used for outbound connections; you still have a non-rotating IP you can use for inbound.
Post reply on HN