Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 traffic crosses the 50% mark

google.com

Post reply on HN
Print view View original

451–460 of 643 posts

Re: IPv6 traffic crosses the 50% mark

#451

Post by jcgl »

QuercusMax wrote: post #442
jeroenhd wrote: post #227

Earlier quoted context omitted.

One of the big challenges with IPv6 remains that many of the knows-just-enough-about-networking people, like support staff, often never received any IPv6 training (or, for that matter, even enough IPv4 training that they don't need to Google things that come up in real life). Another is that the weird, awful, everyone-hostile corporate "solutions" often break IPv6 in stupid ways (like load balancers and logging tools…

Here's an example of a potential security hole caused by lack of ipv6 knowledge: I've been setting up Snapcast (open-source multi-room audio), and needed to move the server to a different machine. While I was setting up the new system, I told it to only bind to localhost. Somehow this only affects the ipv4 networking stack, as some of my clients started automatically connecting to the new server even before I had fin…

I don't see how this generalizes into a security hole caused be lack of IPv6 knowledge. It just sounds like a random bug in Snapcast (great program!). If a user configures a program to only bind to loopback, but the program binds to other interfaces as well, that's a bug in the program.

Re: IPv6 traffic crosses the 50% mark

#452

Post by jollyllama »

marginalx wrote: post #373

Is most of that due to mobile? The real migration challenges are in the server side/consumer home internet space which I'm not sure if there are clear stats around the adoption there. I think IPV6 is a great example of over engineering, trying to do too much in one iteration. In an ideal scenario this could work, but in the context of large scale change with no single responsible party, it usually doesn't work well.

I was wondering how much is "last mile" between end-user devices and the next hop vs. within cloud networks, but the bit about mobile is a good point.

Re: IPv6 traffic crosses the 50% mark

#453

Post by hkt »

nickserv wrote: post #443
tyingq wrote: post #434

Earlier quoted context omitted.

May explain the ipv6 resistance. Hard to do effective per-ip rate-limiting with v6.

I don't understand, wouldn't it make it easier?

No, IPv6 as it is supposed to be implemented gives (say) a single server a /64, which is for all intents and purposes an inexhaustible supply of IPs. You could in principle have an IP per site you visit and have plenty left to spare.

Random Google result with a bit more:

https://www.captaindns.com/en/blog/ipv6-subnet-sizes-48-vs-5...

So if I wanted to annoy GitHub, I could connect to them without ever using the same IP twice. Their response would have to be banning my /64, or possibly /56.

Re: IPv6 traffic crosses the 50% mark

#454

Post by stackghost »

lxgr wrote: post #450
stackghost wrote: post #426

Earlier quoted context omitted.

>Why would you not just use a regular firewall? No idea, but people do it. Every time this comes up on HN there are dozens of comments about how they like hiding their devices behind a NAT, for security

Just because people regularly bring up a non sequitur doesn't mean there actually is a problem. "I have a device acting as both a NAT and a stateful firewall, why are you making me switch to IPv6 and in the process drop both the NAT and the stateful firewall?" is a non sequitur.

I think we're talking about two different things, or maybe I just don't understand your reply.

What I'm saying is this: There exist people in the hobbyist space who believe that when their devices only have private IPv4 addresses such as 192.168.0.0/16 that this meaningfully increases their network security, and that if their raspberry pi has a globally-routable v6 address that this weakens their network security, even though this is bogus because NAT is orthogonal to network security considerations, and that this belief contributes to IPv6 hesitancy.

Re: IPv6 traffic crosses the 50% mark

#455

Post by QuercusMax »

jcgl wrote: post #451
QuercusMax wrote: post #442

Earlier quoted context omitted.

Here's an example of a potential security hole caused by lack of ipv6 knowledge: I've been setting up Snapcast (open-source multi-room audio), and needed to move the server to a different machine. While I was setting up the new system, I told it to only bind to localhost. Somehow this only affects the ipv4 networking stack, as some of my clients started automatically connecting to the new server even before I had fin…

I don't see how this generalizes into a security hole caused be lack of IPv6 knowledge. It just sounds like a random bug in Snapcast (great program!). If a user configures a program to only bind to loopback, but the program binds to other interfaces as well, that's a bug in the program.

There are sure to be dozens or hundreds of vulnerabilities like this, that's what I'm saying. I'm not even sure it's a bug in snapcast - very possible I configured it wrong without realizing.

Re: IPv6 traffic crosses the 50% mark

#456

Post by Hikikomori »

hkt wrote: post #453
nickserv wrote: post #443

Earlier quoted context omitted.

I don't understand, wouldn't it make it easier?

No, IPv6 as it is supposed to be implemented gives (say) a single server a /64, which is for all intents and purposes an inexhaustible supply of IPs. You could in principle have an IP per site you visit and have plenty left to spare. Random Google result with a bit more: https://www.captaindns.com/en/blog/ipv6-subnet-sizes-48-vs-5... So if I wanted to annoy GitHub, I could connect to them without ever using the same…

Its not harder to rate limit a /64 though.

Re: IPv6 traffic crosses the 50% mark

#457

Post by anilakar »

badgersnake wrote: post #181
torcete wrote: post #110

They have released the draft for IPv8 two days ago: https://www.ietf.org/archive/id/draft-thain-ipv8-00.html Does it mean we better put our chips on IPv8?

Guess you didn’t read it.

15 years ago I would have dismissed this immediately as an elaborate troll but nowadays you cannot be sure anymore.

I'm suggesting moving on to IPvNN which requires device and ISP forced guarantees that the originator is not under the effect nor the lack of any medication or other substance, not being coerced and not using non-human assistants in content creation.

Re: IPv6 traffic crosses the 50% mark

#458

Post by 10000truths »

sedatk wrote: post #415
ff317 wrote: post #402

Random related data point: for HTTP requests to Wikipedia (and related) for the past 7d, the IP protocol split is roughly 35% IPv6 / 65% IPv4. (this is counting by-request, so heavy usage from a small number of IPv4s can skew it).

> heavy usage from a small number of IPv4s Basically, all crawlers.

If be curious to see what the IPv4/IPv6 breakdown looks like when looking at HTTP/2 and HTTP/3 connections only, which should exclude the vast majority of crawlers.

Re: IPv6 traffic crosses the 50% mark

#459

Post by cyberax »

teddyh wrote: post #284
cyberax wrote: post #127

Earlier quoted context omitted.

IPv6 is a recursive WTF. It might _look_ like a conservative expansion of IPv4, but it's really not. A lot of operational experience and practices from IPv4 don't apply to IPv6. For example, in IPv4 each host has one local net address, and the gateway uses NAT to let it speak with the Internet. Simple and clean. In IPv6 each host has multiple global addresses. But if your global connection goes down, these addresses…

> For example, in IPv4 each host has one local net address, and the gateway uses NAT to let it speak with the Internet. Simple and clean. No, that’s not the IPv4 design. That’s an incredibly ugly hack to cope with IPv4 address shortage. It was never meant to work this way. IPv6 fixes this to again work like the original, simpler design, without ”local” addresses or NAT. > In IPv6 each host has multiple global address…

Hyrum's law. That's how IPv4 is being used in practice.

> You can quite easily give each host one, and only one, static IPv6 address, just like with old-style IPv4.

You literally CAN NOT. On Android there's no way to put in a static IPv6 or even use stateful DHCPv6.

Re: IPv6 traffic crosses the 50% mark

#460

Post by cyberax »

philipallstar wrote: post #167
cyberax wrote: post #127

Earlier quoted context omitted.

IPv6 is a recursive WTF. It might _look_ like a conservative expansion of IPv4, but it's really not. A lot of operational experience and practices from IPv4 don't apply to IPv6. For example, in IPv4 each host has one local net address, and the gateway uses NAT to let it speak with the Internet. Simple and clean. In IPv6 each host has multiple global addresses. But if your global connection goes down, these addresses…

How do the working IPv6 deployments cope with these issues?

The simple answer is: they just don't deploy IPv6.

These days you can use ULA and third-party monitoring tools instead of DHCP.

Post reply on HN