Live data from Hacker News

The world in which IPv6 was a good design (2017)

apenwarr.ca

71–80 of 318 posts

Re: The world in which IPv6 was a good design (2017)

#71

IPv6's biggest problem remains not that it's badly designed (at least not nowadays, there were problems but they were solved ten years ago) but that millions of network engineers never bothered to look deeper into IPv6 than "I don't get it, this feels off". You can't make a backwards compatible "IPv4 with more bits" like people dream of. L2 routers and middleboxes would still need to be replaced, software would still…

I gave a couple of talks promoting IPv6 in 1999 and I'm happy that I finally have it at home as a residential customer. (I didn't until this year.)

I'm also working on a project to reclaim some IPv4 address space, which people often object to on the grounds that people should "just use IPv6". So I have to defend the legitimacy of the demand for IPv4 address space.

In connection with this issue, I recently ran some DNS lookups against lists of top 1,000,000 domains (the last Alexa one and the Cisco Umbrella one). What we see is that only dozens to hundreds of "top million sites" (depending on one's definition of "sites" and so on) are IPv6-only. That is, less than 0.1% of Internet sites currently have an AAAA record without a corresponding A record, notwithstanding things like Mythic Beasts's offering to sell this configuration to them.

The over 99.9% of sites that still have an A record have it for a very good reason, which is that somewhere around half of all of their users (of course, quite a bit more in some regions and markets, and quite a bit less in others) would be unable to reach them at all otherwise. This is probably going to be true for a long time, even if that fraction keeps creeping steadily downward, and there's not much the site operators can do about that.

On the other hand, maybe you're talking about things like the "A record but no AAAA record" case (sites that don't offer IPv6 support). This is around 45% of FQDNs that have any form of address record, according to my scans using recent Cisco Umbrella data. I don't particularly have a defense of this; in fact, I find it really unfortunate. I happen to also be involved with Let's Encrypt, and I've often seen a pattern where smaller site operators, at least, show no awareness of what IPv6 is and no desire to debug it (e.g. if their certificate request fails because their old AAAA record was broken). I think Happy Eyeballs has been kind of bad on this particular dynamic: small site operators will themselves perceive their sites as working fine with completely broken IPv6 configurations, and it can be hard to convince them otherwise!

I'd love to see some kind of tool, messaging, initiative, or whatever that would encourage the long tail of site operators to be willing to spend, like, three minutes learning that IPv6 is a thing and that it's good if they have it set up correctly rather than not having it set up correctly. I still don't know what that would look like. I've seen dozens, if not hundreds, of forum posts telling people various forms of "it looks like your AAAA record is out of date; maybe you should delete it".

Re: The world in which IPv6 was a good design (2017)

#72
post #69

Earlier quoted context omitted.

IPv6 did not fail. It's used by a sizeable chunk of hosts, network owners made investitions in hardware, software and skills. It's not going anywhere, like it or not. Just like IPv4 will not go anywhere. They will coexist. I still don't understand why IPv6 is a thing. End users can use NAT just fine. Servers can use CDNs and reverse proxies, sharing single IPv4 address among any number of hostnames. But it is a thing…

IPv4 addresses are getting increasingly expensive. And being behind an ISP’s NAT is terrible. I don’t want to share an IP with my street. It should be easy to run little network servers at home without worrying about reverse proxies or upnp or whatever nonsense we need today to make the network work. There’s plenty of numbers out there. Ipv6 lets my house have a whole subnet of them. It’s good.

I was (by default) part of a ISP based NAT. I play counterstrike online, and my ping was 80ms... calling them up and getting it disabled, dropped it to 30ms.

being behind their NAT caused all sorts of issues that i didnt realise they were causing... stuff like UPnP didnt work right, opening ports wasnt working right... everything was all over the place.

Re: The world in which IPv6 was a good design (2017)

#73
post #69

Earlier quoted context omitted.

IPv6 did not fail. It's used by a sizeable chunk of hosts, network owners made investitions in hardware, software and skills. It's not going anywhere, like it or not. Just like IPv4 will not go anywhere. They will coexist. I still don't understand why IPv6 is a thing. End users can use NAT just fine. Servers can use CDNs and reverse proxies, sharing single IPv4 address among any number of hostnames. But it is a thing…

IPv4 addresses are getting increasingly expensive. And being behind an ISP’s NAT is terrible. I don’t want to share an IP with my street. It should be easy to run little network servers at home without worrying about reverse proxies or upnp or whatever nonsense we need today to make the network work. There’s plenty of numbers out there. Ipv6 lets my house have a whole subnet of them. It’s good.

I don't believe that they're expensive when I can rent VPS for few dollars per month. They might be more expensive than 10 years ago, but this cost is shared among all people behind NAT, so in the end it must be a rounding error.

Running servers at home is a good thing to have, but I doubt that ISP cares much about users running servers at home. Users watch youtube and netflix. That's what they optimize for.

Re: The world in which IPv6 was a good design (2017)

#74

Earlier quoted context omitted.

IPv6 did not fail. It's used by a sizeable chunk of hosts, network owners made investitions in hardware, software and skills. It's not going anywhere, like it or not. Just like IPv4 will not go anywhere. They will coexist. I still don't understand why IPv6 is a thing. End users can use NAT just fine. Servers can use CDNs and reverse proxies, sharing single IPv4 address among any number of hostnames. But it is a thing…

> End users can use NAT just fine. Servers can use […] reverse proxies, sharing single IPv4 address So you want all computers to be behind at least a single layer of NAT. And you also want people to not only have to purchase a domain but also have to pay their NAT operator to add their domain to the reverse proxy

Eyeball networks are vastly different from content networks. Even among the tinkerer "homelab" and HN crowds, it is rare to host content from the same connection/address you browse from.

Re: The world in which IPv6 was a good design (2017)

#75
post #64
post #40

Earlier quoted context omitted.

Your idea sounds a lot like the 6to4 transition mechanism that was used for several years before it was phased out. It won't "just work" on many networks because they firewall off non-tcp/udp protocols but otherwise it served pretty well.

The biggest problem with 6to4 is that the anycast gateways (192.88.99.0/24 and 2002::/16) often go to a different network than the one you're paying for transit, so you can't just turn it on for production traffic and expect it to work. The anycast gateways are only used when communicating between 6to4 and native IPv6 addresses, so if 2002::/16 had been the only IPv6 address space, then it would have been more reliab…

> but then we'd be stuck with IPv4-based IPv6 addresses forever.

Yep, but would that have been so bad? Certainly with IPv6's 128-bit addresses, there would still be enough space to go around…

Though admittedly, when I see "IPv4 with more bits" hypotheticals, they often involve smaller addresses than IPv6.

Re: The world in which IPv6 was a good design (2017)

#76
post #71

IPv6's biggest problem remains not that it's badly designed (at least not nowadays, there were problems but they were solved ten years ago) but that millions of network engineers never bothered to look deeper into IPv6 than "I don't get it, this feels off". You can't make a backwards compatible "IPv4 with more bits" like people dream of. L2 routers and middleboxes would still need to be replaced, software would still…

I gave a couple of talks promoting IPv6 in 1999 and I'm happy that I finally have it at home as a residential customer. (I didn't until this year.) I'm also working on a project to reclaim some IPv4 address space, which people often object to on the grounds that people should "just use IPv6". So I have to defend the legitimacy of the demand for IPv4 address space. In connection with this issue, I recently ran some DN…

> The over 99.9% of sites that still have an A record have it for a very good reason

A records work on v4 and v6, so they'll probably stick around for a while. Perhaps they'll end up being concentrated around 4-to-6 forwarding NAT-as-a-service companies, but they're the fallback mechanism. I don't think anyone is advocating for dropping A all together unless you're really trying to pinch pennies.

> I'd love to see some kind of tool, messaging, initiative, or whatever

If Google and Microsoft decided to put even the slightest bit of preference towards IPv6 capable websites, I think SEO hacking would do the rest for us.

> like, three minutes learning that IPv6 is a thing and that it's good if they have it set up correctly rather than not having it set up correctly

Learning to set up IPv6 properly will take more than three minutes. As much as I think IPv6 is a better designed protocol now that the necessary RFCs have come out, there's still a huge difference with legacy IP stuff. The concept of link-local addresses needs to be conveyed or people will put fe80:: addresses in their DNS records, and concepts like /48 or /64 subnets representing customers needs to be explained to prevent bots and spammers from taking over. Unlearning NAT and realizing NAT≠firwall is also something that can take surprisingly long. Enabling IPv6 may take five minutes, but the required background knowledge can take a day or more of learning and experimenting.

Internet forum posts about deleting AAAA records are a great helpfulness thermometer for a forum. I treat them the same as the "just disable SELinux" posts; if that's a popular opinion, the forum probably doesn't know what it's talking about so all advice that gets upvoted there needs to be taken with a grain of salt. They're a problem, but also a warning beacon.

Re: The world in which IPv6 was a good design (2017)

#77
About a year ago I started the IPv6 migration for my home network (2 Remote sites, connected via IPSEC, with 10 VLANs (subnets) and about 70 devices, 10 people).

- I started on one side of the IPSEC, where I have an OPNsense

- there were like 5 updates of OPNsense in the last year where different IPv6 issues were fixed (and others have been introduced).

- my ISP only hands out /64-Prefixes, and these are also dynamic, which makes configuration more difficult

- a number of times I had to turn off IPv6 because different parts were suddenly not working anymore, mostly based on software issues in my stack

All of that over 20 years after IPv6 was introduced makes me wonder if it is the correct technology, if it is so difficult to implement.

Re: The world in which IPv6 was a good design (2017)

#78
post #65
post #20

IPv6 failed because they tried to boil the ocean. It was design by committee, where everyone got their pet feature thrown in to appease and gain consensus. Alternatively IPv4 is a mountain of small hacks, which is its biggest strength. We could have done a lot of good by adopting proposals to extend v4 like 0/8 and class D, but instead the decision was made to collectively drown the babies in the bathwater and insist…

It's looking more like a slow victory than a failure: https://www.google.com/intl/en/ipv6/statistics.html People like to complain a lot about the new features in v6, but they don't make it any worse as a v4 replacement.

IPv6 adoption is just the traffic shift from desktop to mobile. IPv6 kinda makes sense in mobile because it solves a problem of needing multiple addresses per person (phone, tablet, gaming device, etc) and the whole stack is maintained by two entities (the phone OS manufacturer and the carrier). It probably would have worked even better if it was far less complex and only solved the problem that was needed.

https://web.archive.org/web/20210122043401/https://blogs.aka...

Re: The world in which IPv6 was a good design (2017)

#79
post #70

Earlier quoted context omitted.

"Ipv4 with more bits" could have a very simple cut-over. You internally update your stack and networks. Up until the cut-over date, the addresses are truncated into IPv4. After the cut-over, they're routable. This could have been given a time table of say 5 years.

No, it didn't work. Other than already mentioned issues of hardware, you also had for years the issue of lots of applications requiring substantial rewrite to support another protocol due to use of BSD Sockets which leaked protocol internals up to application layer. It was a very big and vocal issue about porting to v6 even in early 2000s despite BSD Sockets finally getting a new API (lifted from the Streams-based XT…

> you also had for years the issue of lots of applications requiring substantial rewrite to support another protocol due to use of BSD Sockets

Past tense? I still regularly see code that uses BSD sockets and doesn't support IPv6. Actually, I feel like among C and C++ codebases that make direct TCP or UDP connections, the majority are IPv4-only, even in 2023. Though, direct TCP and UDP connections themselves are less popular than they used to be, and so are C and C++...

Re: The world in which IPv6 was a good design (2017)

#80
post #74

Earlier quoted context omitted.

> End users can use NAT just fine. Servers can use […] reverse proxies, sharing single IPv4 address So you want all computers to be behind at least a single layer of NAT. And you also want people to not only have to purchase a domain but also have to pay their NAT operator to add their domain to the reverse proxy

Eyeball networks are vastly different from content networks. Even among the tinkerer "homelab" and HN crowds, it is rare to host content from the same connection/address you browse from.

You're confusing cause and effect.

They're very different precisely because of hacky nonsense like NAT.

Post reply on HN