Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1/3 of all access to Google is now over IPv6

google.com

Post reply on HN
Print view View original

121–130 of 237 posts

Re: More than 1/3 of all access to Google is now over IPv6

#121

Post by dijit »

mehrdadn wrote: post #112
c0nsumer wrote: post #106

Earlier quoted context omitted.

The most common symptom of this is someone mentioning that their home 'router' regularly needs reboots to keep working well. Excluding memory leaks, it's frequently the state table running out of space and connections going sideways as a result. This is hard for individuals to see, but put a fair bit of load on a home consumer 'router' and, presuming you can get enough access to it to watch resources, you'll see it r…

Makes sense if this happens, but does this actually happen to you? I've heard vague and rather dubious third-hand stories along these lines, but I've never actually encountered a router that needs rebooting to keep working well. This actually seems bizarre to me now that I think more about it. The routers I've seen allow something like a few hundred thousand established connections over like a ~week. Say 300,000 over…

Exhausted NAT state tables is excessively common, evictions happen silently and the assertion that a reboot is required is for other reasons which I think are likely unrelated.

Professionally I run one (two, actually) of those annoying 'always online video games' and state drops in low quality routers is the most common cause of VOIP drop.

It seems like most router firmware has some kind of intelligent sensing software to see if there's a lot of traffic going over a state and then attempting to avoid evicting it. But for VOIP which can sometimes be silent.. or for a person not moving around in a game (and thus sending/recieving very few and very tiny updates) it can be seen.

Now; you want concrete evidence, and unfortunately the kinds of routers most people have (Say, a Virgin Hub 3.0 which is based on the Touchstone TG2492[0]) does not lend itself to being monitored well.

We're in some luck though, as I happen to run something immeasurably more powerful: a PfSense branded NetGate APU2[1]

PfSense absolutely /loves/ letting you know how it feels; and if we assume that I'm a "normal" user, (I have 1 laptop, 1 phone and an apple watch as the only devices on my network right now and I'm just browsing like normal) then we have some measure of how much memory a state table really consumes.

My state table currently contains a mere 170 states (according to iftop), but it's not really hurting my memory:

> 6% of 4030 MiB

Yet, I can see that some states have been forcefully closed, despite having lots of ram available to store too (these statistics were reset yesterday):

   state-mismatch                       748            0.0/s
In general the state table is very busy:

  State Table                          Total             Rate
    current entries                      152               
    searches                        90040931          338.1/s
    inserts                           437333            1.6/s
    removals                          437181            1.6/s
it's worth noting that this device is forcefully configuring itself to hit a max of 403000 states total:

  states        hard limit   403000
So it's not "memory" like you suggest, but since doing nat translation on every single packet is CPU intensive, states can be dropped if the table can't keep up.

[0]: 256MB of ram reserved for the state table it seems: https://deviwiki.com/wiki/Virgin_Media_Super_Hub_3

[1]: 4G of general purpose ram: https://www.firewallhardware.it/en/apu2-3nic/

Re: More than 1/3 of all access to Google is now over IPv6

#122

Post by jiggawatts »

anonymfus wrote: post #101
jiggawatts wrote: post #72

Earlier quoted context omitted.

Imagine someone saying, in 2001 that they're adding IPv4 support. Laughable, right? IPv6 was available in Windows 2000. Just saying.

Was not that the time of massive migration from IPX/SPX?

I began my IT career in 1999 and I saw exactly one network that still had significant amounts of IPX usage, but it was already primarily IPv4.

If any vendor had tried to sell a network product in 2001 that didn't do IPv4, they would have been laughed out of the room.

Nobody is laughing in the faces of vendors in 2020 for selling products that can't do IPv6 properly... or at all.

Nobody will be laughing in 2021. Or 2022... or...

I suspect we'll be having this conversation in 2030 as well, and the same people complaining about the side-effects of carrier grade NAT four levels deep will trot out things like "IPv6 doesn't have security because it's not behind a NAT!"

Re: More than 1/3 of all access to Google is now over IPv6

#123

Post by mehrdadn »

viraptor wrote: post #119
mehrdadn wrote: post #86

Earlier quoted context omitted.

> What complexity? 1. What the hell is DHCP-PD and is it better on or off? 2. What are 6to4, 6in4, 6rd, etc. and should the user care? 3. When should autoconf be stateless vs. stateful? I thought the point of IPv6 was to allow things to be stateless? 4. When should DHCPv6 be enabled vs. disabled? Why the hell is this even a question on some routers if devices are supposed to be "autoconfigurable without DHCP"? 5. Wha…

These are valid questions regarding complexity, but I also think you're ignoring the complexity of v4. Here are v4 questions for home modems/routers you're just used to: What's bridged mode? What's upnp? What's dmz? What are static IP assignments, wasn't dhcp supposed to manage IP addresses? What's port forwarding? Should I enable "telephony support" and "legacy game support"? What's SIP-ALG? In both cases for reside…

I'm not ignoring the complexity of v4. I'm responding to "What complexity?"

But even if I was, "it only doubles the complexity" is not exactly a compelling response to "why should I switch to IPv6?"

Re: More than 1/3 of all access to Google is now over IPv6

#124

Post by viraptor »

mehrdadn wrote: post #123
viraptor wrote: post #119

Earlier quoted context omitted.

These are valid questions regarding complexity, but I also think you're ignoring the complexity of v4. Here are v4 questions for home modems/routers you're just used to: What's bridged mode? What's upnp? What's dmz? What are static IP assignments, wasn't dhcp supposed to manage IP addresses? What's port forwarding? Should I enable "telephony support" and "legacy game support"? What's SIP-ALG? In both cases for reside…

I'm not ignoring the complexity of v4. I'm responding to "What complexity?" But even if I was, "it only doubles the complexity" is not exactly a compelling response to "why should I switch to IPv6?"

It doesn't double the complexity. Most of the questions above don't exist in ipv4. My point is that it's different complexity, not more complexity.

And for basic usage people can ignore that the same way they ignore it now.

Re: More than 1/3 of all access to Google is now over IPv6

#125

Post by q3k »

bzb3 wrote: post #103
q3k wrote: post #73

Earlier quoted context omitted.

> I've been to several isps with cgnat and none of them suffered from congestion. And I've been on several residential ISPs where IPv4 was unusable during peak netflix hours, likely because people were blindly disabling IPv6 on their devices.

That's not necessarily a problem with nat; anybody with basic networking knowledge can tell you that packets that move through v4 and V6 do not have to follow the same routes. Since there are more users using v4 than V6 it's common for v4 routes to be congested while V6 routes are not.

I know.

Re: More than 1/3 of all access to Google is now over IPv6

#126

Post by mehrdadn »

viraptor wrote: post #124
mehrdadn wrote: post #123

Earlier quoted context omitted.

I'm not ignoring the complexity of v4. I'm responding to "What complexity?" But even if I was, "it only doubles the complexity" is not exactly a compelling response to "why should I switch to IPv6?"

It doesn't double the complexity. Most of the questions above don't exist in ipv4. My point is that it's different complexity, not more complexity. And for basic usage people can ignore that the same way they ignore it now.

I meant "doubling" the complexity as in IPv6 + IPv4 vs. just IPv4.

If your argument is users can ignore IPv6 complexities as they already do with IPv4, then you've just established the IPv4 complexities can be disregarded by the user... which means you just destroyed your own argument...

I'm not interested in endless debates here though; I feel like I've made my point sufficiently well. If this is an attempt to change my view on the matter I think you're misunderstanding the purpose of the discussion.

Re: More than 1/3 of all access to Google is now over IPv6

#128

Post by mehrdadn »

dijit wrote: post #121
mehrdadn wrote: post #112

Earlier quoted context omitted.

Makes sense if this happens, but does this actually happen to you? I've heard vague and rather dubious third-hand stories along these lines, but I've never actually encountered a router that needs rebooting to keep working well. This actually seems bizarre to me now that I think more about it. The routers I've seen allow something like a few hundred thousand established connections over like a ~week. Say 300,000 over…

Exhausted NAT state tables is excessively common, evictions happen silently and the assertion that a reboot is required is for other reasons which I think are likely unrelated. Professionally I run one (two, actually) of those annoying 'always online video games' and state drops in low quality routers is the most common cause of VOIP drop. It seems like most router firmware has some kind of intelligent sensing softwa…

Thanks for sharing. While I have a hard time grasping your usage (why in the world are 3 devices opening 1.6 connections every second?), it's not really relevant as your own data shows state tables don't get exhausted, right? Your table only has 152 entries, which is quite a far cry from exhausting its 403,000 slots.

Re: More than 1/3 of all access to Google is now over IPv6

#129

Post by dijit »

mehrdadn wrote: post #128
dijit wrote: post #121

Earlier quoted context omitted.

Exhausted NAT state tables is excessively common, evictions happen silently and the assertion that a reboot is required is for other reasons which I think are likely unrelated. Professionally I run one (two, actually) of those annoying 'always online video games' and state drops in low quality routers is the most common cause of VOIP drop. It seems like most router firmware has some kind of intelligent sensing softwa…

Thanks for sharing. While I have a hard time grasping your usage (why in the world are 3 devices opening 1.6 connections every second?), it's not really relevant as your own data shows state tables don't get exhausted, right? Your table only has 152 entries, which is quite a far cry from exhausting its 403,000 slots.

My point is that even when I don't quite run out, something is dropping states.

the Hard limit is just one imposed by the OS, it doesn't seem to matter that I have absurd amounts of free memory, or that the kernel is quite content with loading up hundreds of thousands of states: they still get dropped.

And like I said, my hardware and software platform is many dozens of times more advanced than what most people are using at home.

As for the usage; easily explained by: every single website I open, all of the things that website asks my browser to pull in, every DNS request, every NTP update and every 'ping' to see if the device is online-- counts as a new state.

Re: More than 1/3 of all access to Google is now over IPv6

#130

Post by dijit »

jiggawatts wrote: post #120
johannes1234321 wrote: post #102

Earlier quoted context omitted.

Looking at the number of unprotected databases (see i.e. https://news.ycombinator.com/item?id=23957510 ) I think it's good that cloud providers push for gateways etc. in order to restrict access on network level. (They still could do IPv6 proper - no argument there)

Nobody said there wouldn't be ACLs or firewalls in an IPv6 network. IPv4 NAT provides security as a side effect . You don't need NAT for security. PS: This is the #1 most common argument trotted out against IPv6, and it is blatantly false.

NAT doesn't do much if anything for security at all, as soon as there's an outbound connection the internet has a port mapping back to your host.

https://www.f5.com/services/resources/white-papers/the-myth-....

Post reply on HN