Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 traffic crosses the 50% mark

google.com

Post reply on HN
Print view View original

311–320 of 643 posts

Re: IPv6 traffic crosses the 50% mark

#311

Post by lazide »

tialaramex wrote: post #257
throw0101a wrote: post #199

Earlier quoted context omitted.

Facebook is (AIUI) 100% IPv6-only on their internal network, and has been for many years: * https://engineering.fb.com/2017/01/17/production-engineering... * https://www.internetsociety.org/blog/2014/09/facebook-launch... IPv4 is actually the "leftover" stuff they have to deal with at the front end. But they are an eye-balls heavy service, with a lot of mobile devices, which also tend to be IPv6-native.

It also just takes actual policy will. Somebody has to actually say "No" when the supplier who promised an IPv6 product says afterwards actually they meant IPv6 "ready" and they should have put an asterisk because really only the next version will be "ready", and er, so the product they've delivered doesn't actually work with IPv6 but that's fine right? "No". Not every human is psychologically prepared to do that. Th…

Just wait until someone starts remembering the other archaic terms like ‘fraud’, ‘indictment’, etc.

Re: IPv6 traffic crosses the 50% mark

#313

Post by icedchai »

menotyou wrote: post #214
icedchai wrote: post #186

Earlier quoted context omitted.

How often does your IPv4 address actually change?

Never checked. But it does change once in a while. The router has a dyndns function which updates a DNS entry, but only for the router itself. But this is sufficient for the NAT port forwarding.

Ok, so most of the time you are trackable by your public IPv4. The situation is not much better.

Re: IPv6 traffic crosses the 50% mark

#314

Post by zrail »

nlitened wrote: post #263
jl6 wrote: post #105

Everyone's saying progress is slow, but maybe this is just how long it takes to do massive decentralized global migrations affecting billions of people. What are we comparing against? Maybe the ICE-to-EV transition?

For example, compared to migration from 3G to 4G networks. As I understand, from the launch of 4G to complete shutdown of 3G it took around 12—14 years.

A reasonably fair comparison. The ISPs had a much stronger incentive to finish the migration, though, because the 3g spectrum could just get turned around and used for 4g after rollout. IPv6 doesn't really have that strong of an incentive structure now that CGNAT is a well-developed technology.

Re: IPv6 traffic crosses the 50% mark

#315

Post by lazide »

bluGill wrote: post #305
cowsandmilk wrote: post #74

Earlier quoted context omitted.

No, it can level out below that and is (as the parent was saying).

How far below is the question. It could level out at 60% - that is believable. However it can't level out at 99% - Somewhere around 95% major sites will decide IPv4 isn't worth supporting and they will just ignore that final 5% of customers, which will force them to upgrade - which in turn will give others confidence to remove their final 4% of customers - until IPv4 dies.

There are still ascii dialup bulletin boards out there. and operating model T’s. IPv4 will be around for longer than you or I.

Re: IPv6 traffic crosses the 50% mark

#316

Post by MisterTea »

sidewndr46 wrote: post #259
growse wrote: post #19

Earlier quoted context omitted.

A non-trivial minority of the time, they don't support IPv4 either!

should we try going back to IPX ?

IPX/SPX is datagram only. BUT it would be an opportunity to build a QUIC-like that runs over it :-)

Re: IPv6 traffic crosses the 50% mark

#317

Post by friendzis »

omh wrote: post #193
progbits wrote: post #161

Earlier quoted context omitted.

Anyone who relies on IP filtering for security deserves to have it broken. Change my mind.

I'll take that bait ;-) IP filtering is a valuable factor for security. I know which IPs belong to my organisation and these can be a useful factor in allowing access. I've written rules which say that access should only be allowed when the client has both password and MFA and comes from a known IP address. Why shouldn't I do that? And there are systems which only support single-factor (password) authentication so I'…

Why are you (re-)implementing client security on provider end? If a client requires that only requests from a particular network are permitted... Peer in some way.

I do understand the value of blocking unwanted networks/addresses, but that's a bit different problem space.

Re: IPv6 traffic crosses the 50% mark

#318

Post by tialaramex »

Dagger2 wrote: post #272
ButlerianJihad wrote: post #246

Earlier quoted context omitted.

One of the craziest aspects of IPv6 implementation is the reverse DNS lookups. IPv6 uses ip6.arpa and segments each little nybble into a subdomain! https://en.wikipedia.org/wiki/Reverse_DNS_lookup#IPv6_revers... This means there are always 32 octets to a reverse-IPv6 address, and there are no shortcuts or macros to overcome this! That means if you wish to assign a singular name that maps from a legitimate /64 Network…

$ dig -x 2606:7100:1:67::26 | grep PTR ;6.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.6.0.0.1.0.0.0.0.0.1.7.6.0.6.2.ip6.arpa. IN PTR Run this, then copy/paste the output into your zone file. Remove the ; and add "example.com." or whatever to the end. I agree it's a pain to read, mostly because DNS addresses are written backwards, but an "absurd non-solution"? For a set of instructions that don't even depend on the format of the…

It is a pretty nice design, partly as a result of the fact that we've got a working system to look at (IPv4) and we have a lot more eyeballs "these days" (when IPv6 was designed, so, decades ago now) than when the Internet Protocol was a new idea.

I think perhaps the person you're responding to imagines that somehow DNS mandates a very naive implementation and so this behaviour would be incredibly expensive. The sort of person who sees a flip clock and imagines it needs 1440 different faces not 84 (or in some cases 72) because they haven't realised 12:34 and 12:35 simply use the same hour face.

Re: IPv6 traffic crosses the 50% mark

#320

Post by mmbleh »

Tuna-Fish wrote: post #242
mmbleh wrote: post #232

Earlier quoted context omitted.

IPv6 is very difficult to implement and enforce reliable rate limits on anonymous traffic. This is something we've struggled a lot with - there is no consistent implementation or standard when it comes to assigning of IPv6 addresses. sometimes a machine gets a full /64, other times a whole data center uses a full /64. So then we need to try and build knowledge of what level to block based on which IP range and for so…

... But that's no different from IPv4. Sometimes you have one per user, sometimes there are ~1000 users per IP. Most of the ipv4 world is now behind CGNAT, one user per ip is simply a wrong assumption.

Anonymous rate limits for us are skewed towards preventing abusive behavior. Most users do not have a problem, even there is a CGNAT on IPv4.

For IPv6, if we block on /128 and a single machine gets /64, a malicious user has near infinite IPs. In the case of Linode and others that do /64 for a whole data center, it's easy to rate limit the whole thing.

Wrong assumption or not, it is an issue that is made worse by IPv6

Post reply on HN