Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

341–350 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#341

Post by xnyanta »

dheera wrote: post #220
xnyanta wrote: post #212

Earlier quoted context omitted.

> With IPv6 hell knows what their hex-colon monstrosities would be. You would know exactly, because every IPv6-enabled interface has a link-local predictable IPv6 address derived from its MAC address.

And so now I have to stick stickers on every light bulb with a huge address on it and then get up on a chair several times per bulb while I transfer chunks of its address from the sticker to my terminal? The reality is with IPv4 I can memorize all of the IPv4 addresses of every light bulb, every robot, every thermostat, every plant watering device in my residence, and I can hammer out CURL commands to control everyth…

Why do you need stickers? You can just log into your router/switch and inspect the arp/nd table. You could just just use DNS records the first time you set a widget up and never have to remember an address again. Your router likely already does this automatically for you in IPv4 land via the DHCP server's database. The reality is that remembering IP addresses to access things has always been a band-aid fix. When's the last time you typed the IP address of hacker news into your browser's url bar? Using link-local addresses is usually a last-resort kind of scenario where you're glad it exists to save you some headache.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#342

Post by kmbfjr »

Spivak wrote: post #261
justeleblanc wrote: post #152

Earlier quoted context omitted.

What kind of observer is 1. able to listen to the entirety of your network's outside communications, 2. interested at all in it, 3. harm you only on the condition that they "map out" your internal infrastructure? This isn't a novel, the goal is not to solve intricate security non-problems.

Your ISP, "mapping your network" means being able to take data that was previously an amalgam of a household and reliably split it into the individual members and devices for better targeting.

Take a moment and learn about Nokia’s Deepfield or Kintec.

The ISPs have the ability to see what is on your network by IPv4 egress. They have been able to do this for a decade.

Worrying that an IPv6 address divulges the network forgets that IPv4 devices betray their existence through DNS, their destinations and other network behavior.

The ISPs know.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#343

Post by xnyanta »

Gigachad wrote: post #252
mritun wrote: post #128

Earlier quoted context omitted.

If we’re talking anecdotally, I am running dual stack IPv6 and have had zero issues with Minecraft or any other game on my network on Xbox, Switch, iOS and PC.

Minecraft does not support v6 but I wonder what caused the issues. Maybe the presence of v6 support caused DNS to give a v6 address and this caused problems? Seems unusual.

Minecraft absolutely supports IPv6. The server doesn't bind to v6 by default but will happily do so and work if you tell it to.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#344

Post by btgeekboy »

gxt wrote: post #313
throw0101c wrote: post #307

Earlier quoted context omitted.

> How does that protect privacy of the private network? I don't want to divulge any information about internal topology. I'm curious to know: what (attack) do you hope to protect against? I would think that most attacks come in two fashions: the first being that you run a service of some kind and that there's some JSP/PHP/whatever exploit for a public facing service, and someone does a 'magic' PUT/GET that has the ap…

This isn't about an attack scenario from this vector, it's about preventing reconnaissance that might yield helpful results to an adversary that can exploit it via any other vector.

Correct. If I talk to service A and I see an address that’s in the same /64 as service B, it’s unlikely there’s a firewall between the two. Two different /56 or /48? Probably a different site.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#345

Post by jacob019 »

dmm wrote: post #218
bityard wrote: post #78

Question from a (relative) IPv6 newbie that wasn't addressed in TFA: Let's say I have a very small home lab. I have a handful of hosts that get their IP addresses via DHCP from my router. In the router, DHCP and DNS are tightly coupled such that the router essentially always knows the MAC address, IP address and hostname of each device. Now I want to run IPv6 on this network as a first-class citizen. Since DHCPv6 is…

It's important to distinguish between stateful and stateless DHCPv6. stateless DHCPv6 is fine. It's just a way for nodes to get dns/ntp/etc. Nodes still select their addresses with SLAAC. Stateful DHCPv6 is the bad one. It assigns hosts specific addresses. > the router essentially always knows the MAC address, IP address and hostname of each device. You can still have this with ipv6 addresses. They easiest way is to…

SLAAC can advertise the DNS server. Why would you call stateful DHCP bad?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#346

Post by emmelaich »

dheera wrote: post #191
Symbiote wrote: post #188

Earlier quoted context omitted.

If you would like to write IPv6 addresses in the same style as IPv4, they would look something like 208.255.238.250.0.16.239.109.89.54.222.189.74.21.22.9

And that's the problem! Who can memorize all that? I mean look, a few days ago Comcast had an outage and I plugged my phone into my USB port to tether it for internet access. It hijacked my DNS entirely, and I couldn't turn on my damn lights or change my thermostat which were on my LAN. Thankfully I know their LAN IPv4 addresses from memory, 10.10.10.x and 10.10.10.y, and I was able to issue CURL commands directly to…

ipv6: don't worry about the long addresses, you won't need them because DNS

dns: maniacal laughter

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#347

Post by dheera »

xnyanta wrote: post #341
dheera wrote: post #220

Earlier quoted context omitted.

And so now I have to stick stickers on every light bulb with a huge address on it and then get up on a chair several times per bulb while I transfer chunks of its address from the sticker to my terminal? The reality is with IPv4 I can memorize all of the IPv4 addresses of every light bulb, every robot, every thermostat, every plant watering device in my residence, and I can hammer out CURL commands to control everyth…

Why do you need stickers? You can just log into your router/switch and inspect the arp/nd table. You could just just use DNS records the first time you set a widget up and never have to remember an address again. Your router likely already does this automatically for you in IPv4 land via the DHCP server's database. The reality is that remembering IP addresses to access things has always been a band-aid fix. When's th…

> router likely already does this automatically

Yes but my phone hijacked all the LAN DNS when I plugged it into a USB port for tethering when Comcrap went down for a few hours

Also separately, when Comcrap is working, my phone on Wi-Fi refuses to ever use the router DNS, http://xyz.local addresses are only available on desktops/laptops and not phones, therefore IPv4 addresses it is when trying to visit a LAN site on a phone.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#348

Post by waych »

kazen44 wrote: post #197
waych wrote: post #151

Earlier quoted context omitted.

This looks like NAT pushed down to the endpoint itself. You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME. What are valid values in the scenario you are proposing? The defaults are 1 week / 1 day, so 7X. If you chose to rotate each second, and say allowed addresses to only be valid for say 20 minutes, this still appears to be…

> You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME. They have not? The global routing table size for ipv6 at max is a /32 (if i remember correctly) every customer gets a /56 prefix to use in their network, so the routing table entry would still be the same, no matter how many addresses you use to cycle through in your /64. A…

I don't understand what you mean. Neighbor Discovery Caches certainly are a thing.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#349

Post by topranks »

thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

NATs at very least complicate things.

Even if you never allow anything in from outside that wasn’t established from the inside first, it still removes an added layer of complexity from things.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#350

Post by waych »

justeleblanc wrote: post #208
waych wrote: post #184

Earlier quoted context omitted.

"The network is secure" is a common fallacy.

"Those who don't know what to say quote adages" is a common saying.

??

There is a whole industry built around network traffic analysis.

What makes you think it doesn't happen on the internet?

Post reply on HN