More than 1/3 of all access to Google is now over IPv6 • Hacker News Board

Re: More than 1/3 of all access to Google is now over IPv6

#161

Post by ghshephard » Wed, Aug 05, 2020, 8:42 PM UTC

talideon wrote: post #98

jl6 wrote: post #66

Earlier quoted context omitted.

Does IPv6 on an internal network offer any benefit to enterprises (not talking about ISPs here), who may view NAT as a form of defence in depth?

Yes, tonnes of benefits. If you've ever been through a merger, you'll know the pain of dealing with getting the everything working when merging networks. That issue doesn't exist with IPv6 to anywhere near the degree because you don't have overlapping RFC1918 space to deal with. IPAM with IPv4 is a massive pain in the backside once you get up to a certain scale, even if you're allocating from 10/8. If you have multip…

Well - you may have overlapping RFC 4193, but if your network engineers have done their job well, you are randomly choosing from a big honking FD/8 address space, and the odds of a collision are statistically very unlikely.

Re: More than 1/3 of all access to Google is now over IPv6

#162

Post by enkid » Wed, Aug 05, 2020, 8:51 PM UTC

amluto wrote: post #154

yyyk wrote: post #150

Earlier quoted context omitted.

Every sane large internal network is segmented. I doubt all the "more than 16 million devices" need to talk to every other device. The IPv4 limit is an annoyance, but not a big one for the typical internal networks.

When my internal network connects, via any non-NATed means, to a vendor’s internal network, there is a chance that my addresses conflict with theirs. If the vendors have even a few tens of clients, this risk is quite high.

This is especially true because people tend to use the same private addresses over and over. How many devices are 192.168.1.1 vs. 192.168.52.123 ?

Re: More than 1/3 of all access to Google is now over IPv6

#163

Post by danceparty » Wed, Aug 05, 2020, 9:01 PM UTC

barbegal wrote: post #8

The graph is interesting when you zoom in, much more IPv6 use over the holiday period and also recently during the period of lockdown measures. I would guess the majority of IPv6 traffic comes from devices on 4G networks. More devices are on 4G when visiting family and friends over the Christmas period and when working remotely.

I work on a very large internet property and can confirm that the majority of v6 internet traffic we see is mobile (easily discerned by ASN)

Re: More than 1/3 of all access to Google is now over IPv6

#164

Post by gerdesj » Wed, Aug 05, 2020, 9:06 PM UTC

Dagger2 wrote: post #137

oarsinsync wrote: post #107

Earlier quoted context omitted.

> IPv6 completely sidesteps this by not even needing a state table because no NAT. You may have forgotten that a stateful firewall that tracks inbound and outbound connections still needs memory to store a state table still applies in IPv6. Now it also needs 8x more memory per entry, as the addresses have gone from 2x 32bit to 2x 128bit.

There's almost certainly more data in each entry than just the IP addresses, so it won't be 8x. NAT also requires a second set of entries to track the NAT session, which further equalizes it.

Absolutely. A state is protocol, ports, addresses, timers, counters and more. QoS/DSCP, firewall marks and other things add to the fun.

Re: More than 1/3 of all access to Google is now over IPv6

#165

Post by richardwhiuk » Wed, Aug 05, 2020, 9:09 PM UTC

ghshephard wrote: post #161

talideon wrote: post #98

Earlier quoted context omitted.

Yes, tonnes of benefits. If you've ever been through a merger, you'll know the pain of dealing with getting the everything working when merging networks. That issue doesn't exist with IPv6 to anywhere near the degree because you don't have overlapping RFC1918 space to deal with. IPAM with IPv4 is a massive pain in the backside once you get up to a certain scale, even if you're allocating from 10/8. If you have multip…

Well - you may have overlapping RFC 4193, but if your network engineers have done their job well, you are randomly choosing from a big honking FD/8 address space, and the odds of a collision are statistically very unlikely.

FD/8 space? You mean 10.0.0.0/8? No the odds of a collision on 10.0.0.0/8 are high because:

- Both corporations probably started allocating from the top

- Both corporations probably allocated huge subnets.

Re: More than 1/3 of all access to Google is now over IPv6

#166

Post by Animats » Wed, Aug 05, 2020, 9:14 PM UTC

It took decades to reach 5% in 2015, but now we're moving. 50% looks to be 2 years away.

It's surprising that China doesn't show as dark green on the world map. China was into IPv6 early; the address space was needed.

Re: More than 1/3 of all access to Google is now over IPv6

#167

Post by gerdesj » Wed, Aug 05, 2020, 9:17 PM UTC

jasonvorhe wrote: post #38

efxz wrote: post #6

Earlier quoted context omitted.

IPv6 still has NAT. There's public and private IPv6 addresses, same as IPv4. Google building their infrastructure around IPv6 does not have anything with tracking IPv6 users

IPv6 doesn't have NAT, it has different addresses for global and local scopes, but your OS never translates between these addresses and it doesn't need to keep a table of translations & connections, as you'd have with IPv4 and NAT.

Network Prefix Translation or NPT is the equivalent of NAT in IPv6. Let's say you have six WANs (I do in the office) and each has its own IPv6 allocation and BGP and a personal allocation is not available.

Your client machines don't know what is going on at the border, so they can't "choose" a route out unless you turn the lot into routers and use OSPF or something internally.

So NPT. Your router sends flows out over links and rewrites the prefix accordingly for that link. Its a bit horrible and I've decided not to bother yet.

Re: More than 1/3 of all access to Google is now over IPv6

#168

Post by pkaye » Wed, Aug 05, 2020, 9:17 PM UTC

Why so low an adoption in China? Is it because Google in not widely used there so it not captured by Google data?

Re: More than 1/3 of all access to Google is now over IPv6

#169

Post by wmf » Wed, Aug 05, 2020, 9:24 PM UTC

jiggawatts wrote: post #93

fulafel wrote: post #87

Earlier quoted context omitted.

It's natural because AWS/GCP/etc are against internet style system architectures (=natural IP addressing of your components), they are all about RFC1918 subnets, NAT gateways and L7 proxying. AWS even tells you it's bad architecture (or at least not "Well Architected") to build internet-style systems.

They've internalised their constraints. RFC1918 was forced upon the cloud providers only because there weren't enough IPv4 addresses to go around. If Amazon had started in 1980, they would have simply allocated a /8 for each region and be done with it. No NAT, no gateways, no address translation of any sort. Everything routing to everything else natively.

EC2 originally allocated a public and private address to each VM, so clearly they do have enough addresses to go around.

Re: More than 1/3 of all access to Google is now over IPv6

#170

Post by willhk » Wed, Aug 05, 2020, 9:25 PM UTC

pkaye wrote: post #168

Why so low an adoption in China? Is it because Google in not widely used there so it not captured by Google data?

Pure conjecture as I don't know how they're collecting the location data, but I imagine all Google traffic from China is going through a VPN. So maybe the vast majority of VPNs used by Chinese users are IPv4 only?