331–340 of 511 posts
Earlier quoted context omitted.
If you would like to write IPv6 addresses in the same style as IPv4, they would look something like 208.255.238.250.0.16.239.109.89.54.222.189.74.21.22.9
No, it should usually look like v4, except in cases where you're using more address space and need to add more dots. NAT is here to stay, and a LAN doesn't need 128 bits of address space.
Earlier quoted context omitted.
I disagree, because as of now the vast majority of top sites are IPv4-only (see e.g. http://www.delong.com/ipv6_alexa500.html for semi-fresh stats) so if someone gets bad experience on my IPv4 site, they will not assume that the problem is with my site, as that will match their overall experience with most sites on the web. Perhaps you will diagnose the issue as caused both by the combination of your ISP flaws and my…
That site's data-collection method must be misconfigured somehow. Google, Facebook, and Instagram are certainly all reachable via IPv6.
Earlier quoted context omitted.
My ISP does not allow BYOM (bring your own modem) and assigns me a /64 net, so I have a hard time running an (ipv6) router behind it that would do the firewalling.. I guess I'm stuck with ipv4 for the time being...
Doesn't it let you put it in bridge mode (i.e. modem only)?
My experience with IPv6. I have option to enable full dual stack with my ISP. After doing this I noticed that YT/FB/Google were significantly faster, however my kids started to complaing that some games began to have connectivity issues. Minecraft have problems to start. On a number of sites load time was noticebly longer. Switching off IPv6 as a experiment on one of kids PC solved all issues. My conslusion is that i…
First thing I do setting up any network is disable ipv6. It's caused issues at least once, and that's one time too many for something that doesn't benefit me in any other way.
Don't really understand networks yet, but I guess it was because my isp doesn't support ipv6, but linux kept defaulting to ipv6 before trying ipv4.
Earlier quoted context omitted.
Firstly, normally nodes base their automatic IPv6 address on their MAC address, so there will be no conflict between these, since MAC addresses are supposed to be unique to the hardware. Otherwise, it’s a random 64-bit number (actually a few less bits, but not many). It’s very unlikely a collision will happen. And even if it does, there is a protocol (Duplicate Address Detection) to detect it, and avoid it.
The current state has those two items flipped: Randomly-generated IPs is normal, and MAC-based IPs is the exception. https://www.internetsociety.org/resources/deploy360/2014/pri...
Personally, I don’t feel the need for privacy at this level of the protocol stack, and if I did, I would not consider IPv6 Privacy Extensions to be adequate. Also, I might like to keep TCP connections alive for more than a day. Therefore, I personally prefer regular MAC-based SLAAC, or even hard-coded addresses, over randomized and rotating addresses.
Yup. I work at a large, complicated infrastructure organization. Our firewall guy has a lot on his plate. Having him manage the security concerns for IPv4 and IPv6 is a bad idea when considering the tasks we have and the labor available. Similarly, having the networking team implement IPv6 on top of their already significant projects results in less time available to do other things.
I look forward to the day when IPv6 is easy and universal, but I can completely understand why many admins aren't bothering.
Earlier quoted context omitted.
> NAT and a Firewall are two different concepts. They are, but in practice they are muddled together and I suspect people are going to create subnets with IPv6 in the name of security. In IPv4 NAT is used to make sure your laptop isn't exposed to random script kiddies trying to scan for vulnerable services behind your router. A fun exercise is to plug a RaspberryPi up directly to a public facing IP address and log ev…
>In IPv4 NAT is used to make sure your laptop isn't exposed to random script kiddies trying to scan for vulnerable services behind your router. A fun exercise is to plug a RaspberryPi up directly to a public facing IP address and log every packet it receives. Then give those scripts a few services to detect (HTTP server, SSH server, etc.) and look at how the traffic shifts from scanning for ports to scanning for vuln…
[0]: https://isc.sans.edu/diary/Targeted+IPv6+Scans+Using+pool.nt...
Earlier quoted context omitted.
And what computer is making what requests. Now that i think about it, this cloud be the reason why youtube started making recommendations based on stuff i just watched in private browser tabs...
I have multiple computers in the house, mostly not logged in to Google. YouTube recommendations spill between devices all the time - like, if I watch a video on one device, I’ll see the same video recommended on another. Or if my partner watches something, YouTube will recommend it to me. They’re obviously doing recommendations based on IP address. (And this is purely over ipv4).
eBay uses IPs showing content, too. I see 'items you've viewed recently' show items I've never looked at, since when on a mobile connection my IP changes fairly frequently and eBay carries over the recently viewed state from whoever else was previously using that IP.
It had puzzled me until I came across this[1] eBay topic where others had experienced this, from shared offices to spouses, etc.
[1] https://community.ebay.com/t5/Share-eBay-Technical-Issues/Re...
Earlier quoted context omitted.
This isn't about an attack scenario from this vector, it's about preventing reconnaissance that might yield helpful results to an adversary that can exploit it via any other vector.
> […] that can exploit it via any other vector. And what are those vector(s)? Besides compromising a machine that is already inside per the above (which can then do scanning / lateral moves), or perhaps physically getting inside the premises (in which case a scanner can be physically installed to examine the network), what attack are you protecting against ? Can you give me a link about an attack that knowing the top…
Earlier quoted context omitted.
IPv4 is now stretched to the point that you often end up requiring multiple layers of NAT, such as carrier-grade NAT plus endpoint NAT. That reduces the reliability of pretty much all protocols and makes any protocol doing peer to peer communication really hard or even impossible to run. The latter includes tons of games, video chat, peer to peer VPNs, decentralized social networks, and so on. These problems will onl…
I get that there are people in the world with severe lack of IPv4 addresses and this is a valid reason for them to switch to IPv6. However, assuming that I and my organization have enough IPv4 addresses (without requiring any of the tricks of multiple layers of NAT), is there a sufficient reason for us to justify the effort/expense of changing what works?
No, unless you're running servers for users who might have those issues on their side (e.g. anyone accessing your servers from mobile). May as well wait until you can save money by giving up your IPv4 addresses.