Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Hacker News now supports IPv6

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 396 posts

Re: Tell HN: Hacker News now supports IPv6

#191

Post by jasode »

mike_d wrote: post #140
greyface- wrote: post #40

Earlier quoted context omitted.

That sure sounds like a lot. But "billions" is less than a /64. Try "sextillions" (/56) or "septillions" (/48). Of course, when the denominator is "undecillions", it becomes clear that this is actually a non-issue.

ARIN recently handed out a /16 allocation to Capital One. That is one 65,025th of all of IPv6. A reasonable sized /32 allocation would have allowed for giving every ATM they operate worldwide its own globally routable /48.

>ARIN recently handed out a /16 allocation to Capital One. That is one 65,025th of all of IPv6. A reasonable sized /32 allocation [...]

The more one digs, the more egregious it seems. If the NETIFY webpage is accurate, it shows that Capital One already had "/32" and "/36" blocks, and yet they also got "/16" : https://www.netify.ai/resources/networks/capital-one

And if I'm reading the ARIN fees correctly, it only costs $4000 annually for a "/16" allocation: https://www.arin.net/resources/fees/fee_schedule/

There doesn't seem to be any public transparency of the approval process to explain how a non-ISP company could justify a "/16" block so it just leaves everybody guessing.

John Sweeting from ARIN only confirmed that the "/16" was allocated to Capital One according to policy but he didn't elaborate on the rationale: https://www.mail-archive.com/arin-tech-discuss@arin.net/msg0...

Example reddit discussion : https://old.reddit.com/r/ipv6/comments/17yuqvp/til_capital_o...

Re: Tell HN: Hacker News now supports IPv6

#192

Post by SSLy »

lxgr wrote: post #17
teaearlgraycold wrote: post #6

Earlier quoted context omitted.

Why would things be faster over v6?

On networks using NAT64 (and maybe also for DS-Lite, although I'm not so sure there), the IPv6 path is more direct than the IPv4 one since it doesn't need to go through a CG-NAT, which might be at capacity (tracking every TCP connection requires memory) or located farther away than the nearest IPv6 egress router, making routing more indirect. I believe all three large US mobile carriers use NAT64 at this point exclus…

I am stuck in DS-Lite, and indeed IPv6 is direct while v4 is served via shitty CGNAT

Re: Tell HN: Hacker News now supports IPv6

#193

Post by jeroenhd »

kccqzy wrote: post #67
lolinder wrote: post #56

Earlier quoted context omitted.

Can you explain this more? I realize that one IP address per device poses a major problem for privacy, but I thought we somewhat mitigated that by dynamically reassigning IPs. What exactly is the problem with the privacy fixes that were put into IPv6? Why don't they work?

I'm guessing that the GP is talking about the fact that if there were two persons in a household using the Internet at the same time, with IPv4 they would connect from the same IP address (though of course with different port numbers), but with IPv6 they would likely connect from distinct IP addresses, and usually only sharing a /64 prefix. You are correct that this isn't a big issue. SLAAC addresses are generally ch…

IPv6 privacy extensions are only switched around once a day or so in most default configurations.

You can change that, of course, and switch addresses every minute if you want to, but I do find the default a little high.

Re: Tell HN: Hacker News now supports IPv6

#194

Post by mort96 »

dijit wrote: post #183
mort96 wrote: post #177

Earlier quoted context omitted.

I don't understand why getting rid of DHCP is desirable. DHCP provides a nice central place where you can map MAC addresses to IP addresses instead of configuring it ad-hoc on every device which needs a static IP address (if you're lucky and the device even supports static IP!). Checking "Does my interface have an IP address?" is also a really really useful and quick analogue for "is the gear related to the LAN prett…

FWIW; SLAAC works by setting the local part to the mac address. So, if you have knowledge of your mac address (which is what you say you are using for DHCP) then you will know the fe80:: IPv6 IP too, which, while not globally routable is probably what you want based on this comment.

Wait SLAACs aren't globally routable? I thought the whole idea behind IPv6 was to not use NAT?

Re: Tell HN: Hacker News now supports IPv6

#195

Post by jeroenhd »

geraldhh wrote: post #189
tsimionescu wrote: post #112

Earlier quoted context omitted.

I don't understand what you mean by complicating firewall rules,except maybe that you now need to use IPv6 addresses instead of IPv4 addresses in some of the rules. It's not like NAT without a firewall gave any security in 2024.

there is no nat w/o a "firewall" and yes, it will be more secure

Actually, unless you disable all application layer gateways in your NAT, your IPv4 firewall can be bypassed quite easily. I don't know of any IPv4 NAT implementations where the ALG don't override the firewall (because that's the point of them).

If you configure NAT+firewall you're going to be somewhat resistant to configuration mistakes, but you can do the same thing on IPv6 if you really want to. However, for most consumer devices, all you get is "NAT instead if a firewall WITH NAT bypass methods so you can still use SIP and FTP".

Re: Tell HN: Hacker News now supports IPv6

#196

Post by zekica »

bmacho wrote: post #119
Plasmoid wrote: post #107

Earlier quoted context omitted.

Another person who does not understand IPv4. IPv4 isn't a text based protocol where IP addresses are parsed like DNS. It's a binary protocol where addresses are recorded in binary and adding more address space WOULD BE A BREAKING CHANGE.

That's not what GP said. Of course IPv4 devices wouldn't be able to use IPv6 addresses, that would be impossible. But it is possible to "keep" IPv4 addresses, just make a.b.c.d to correspond 0.0.a.b.c.d.

64:ff9b::/96 is allocated for NAT64 - and most US mobile carriers use this as most Android and iOS phones use IPv6 only APNs with DNS64 and 464XLAT.

Re: Tell HN: Hacker News now supports IPv6

#197

Post by mort96 »

OJFord wrote: post #179
mort96 wrote: post #175

Earlier quoted context omitted.

I appreciate the honesty, and the reality is that most add-on developers have a price; a lot of people would probably sell their add-on for $10M. But these things auto update. If a government (or even just a moderately big org) really wants to spy on someone, and they determine that said someone uses IPvFoo, $10M isn't a very large price to pay to just get complete access to the target's web browser. This isn't speci…

If your threat model includes a government...

Which it kinda should? It's not as if governments universally have proven themselves to not do messed up shit and not violate people's privacy

Re: Tell HN: Hacker News now supports IPv6

#198

Post by ta1243 »

JustFinishedBSG wrote: post #187
ta1243 wrote: post #154

Earlier quoted context omitted.

I find the insistence of using /64s everywhere for networks frustrating. Any network larger than a /112 seems crazy, that's already 65k IPs per subnet. A /104 for every normal end user (256 subnets per user), or a /80 for massive companies like Capital One (4 billion subnets) should be more than enough.

Except you need at least a /64 for v6 to properly work.

You only need it because that's how the protocol was designed.

Re: Tell HN: Hacker News now supports IPv6

#199

Post by DrNefario »

IcePic wrote: post #125
tsimionescu wrote: post #102

Earlier quoted context omitted.

That's a very interesting case, as UDP is very reliant on MTU. If the IPv6 headers take out more space from the ethernet frame, that leaves less space for the UDP payload. Which means that a UDP payload which was at the limit for IPv4 on the typical MTU needs to be fragmented into two IPv6 packets, which will likely increase latency quite significantly. However, this will depend on each specific game, if they are usi…

If you try "ping" and "ping6" towards a multi-protocol host, you see both send 64 bytes each, so while v6 source and destination addresses take up lots of extra space, the v6 IP packets have less of the "this part could be useful for tcp" which means icmp pings can be of the same size, even though the two addresses eat up lots more bytes. Not sure if the same goes for game UDP packets, but the optional header stuff i…

This is straight up wrong. An IPv4 ICMP echo request over ethernet uses a minimum of 42 bytes, the same request with IPv6 uses 62. The ethernet frame is 14 bytes and the ICMP echo is 8 bytes for both packets, the difference is that the IPv4 header uses 20 bytes where IPv6 uses 40.

Anecdotally, my ping to HN is consistently 166ms with either protocol. I doubt an extra 20 bytes is going to make any meaningful difference to latency, but I'll leave that for the game devs to find out.

Re: Tell HN: Hacker News now supports IPv6

#200

Post by ta1243 »

tuetuopay wrote: post #169
ta1243 wrote: post #154

Earlier quoted context omitted.

I find the insistence of using /64s everywhere for networks frustrating. Any network larger than a /112 seems crazy, that's already 65k IPs per subnet. A /104 for every normal end user (256 subnets per user), or a /80 for massive companies like Capital One (4 billion subnets) should be more than enough.

There is a really practical reason behind this, and it is called "routers". Due to longest prefix match, you'll end up wasting resources on the networking hardware. And you waste both precious and expensive TCAM and LPM latency for matching the prefixes. So routers do optimize for anything shorter than /64, and have special lookup memory for /64 and /128. But nothing in-between.

That's fair enough, in which case ipv6 is really only a /76 (having more than 1000 hosts on a subnet isn't a great thing, even with no broadcast and arp and other traffic, and /76 allows 4000 on a /64)

Those fanboys going "we'll never run out of 2^128 IPs" are being disingenuous when about 2^59 of them have been burnt straight away (I'd guess most subnets have less than 30 devices)

2^64 subnets is a reasonable number, but when they are handed out like candy that number dwindles quickly. ARIN is allocating the equivalent of a /15 every year. That's fine if it's a constant allocation, there's 100,000 years worth, but if that rate grows, the space will be eaten in a matter of a few decades.

Post reply on HN