Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS IPv4 Estate Now Worth $4.5B

toonk.io

Post reply on HN
Print view View original

431–440 of 480 posts

Re: AWS IPv4 Estate Now Worth $4.5B

#431

Post by dataflow »

welterde wrote: post #420
dataflow wrote: post #375

Earlier quoted context omitted.

> The problem is how would C (ipv4-only) send a packet to S (ipv6-only) in the first place? It doesn't know how to deal with non-ipv4 packets, since it's ipv4-only. If S is IPv6-only, then either the address is from the IPv4 range, or it's not. If it is, then R can translate between them. If not, then they can't connect. I don't see him suggesting otherwise anywhere. Even ignoring translation possibility, his point h…

I understood djbs article differently then you. What else could he have meant with "In other words: The current IPv6 specifications don't allow public IPv6 addresses to send packets to public IPv4 addresses. They also don't allow public IPv4 addresses to send packets to public IPv6 addresses. Public IPv6 addresses can only exchange packets with each other."? But maybe I should reread the article a bit more generously…

You're picking a brief and vague 1-sentence summary he wrote, and missing everything that came after it that explained in detail what he's talking about.

> What else could he have meant with "In other words: The current IPv6 specifications don't allow public IPv6 addresses to send packets to public IPv4 addresses."

He could've meant "making IPv6 work means much more than upgrading software. Every administrator of a server on a public IPv4 address has to go to extra effort to acquire and enable a public IPv6 address."

You cannot read this and miss the fact that his frustration is with the need for administrators to acquire separate IPv6 addresses.

> maybe I should reread the article a bit more generously and less literally

No need to do either. Just read all of it, instead of 1 or 2 sentences that might sound like amateurish mistakes when you remove several pages of context and then extrapolate without them.

Re: AWS IPv4 Estate Now Worth $4.5B

#432

Post by nerdbert »

tsimionescu wrote: post #370
welterde wrote: post #197

Earlier quoted context omitted.

It is. A typical enterprise might get allocated a /32, which gives them 32-bit to nicely design their network and give 64-bit to each individual network where devices are connected. A typical ISP will get allocated a much larger allocation like a /20, which allows them to allocate a /56 for each of their customers while still having a few bits to play with. But all starting with the same prefix. With IPv4 you will ha…

Your initial claim was that a IPv6 address consists of a 64-bit network address, then a 64-bit device address that could be separated into : as an example. However, SLAAC demands that each device is given a 64-bit prefix that it then chooses many random 64-bit host addresses from, without any other rhyme or reason. So, if you want to know the IP of a host you want to connect to, you have to remember at least a 64-bit…

> you have to remember at least a 64-bit number that changes every day by design

A machine using IPv6 privacy extensions would have two addresses; one that changes, and one typically based on the MAC address that remains constant.

If you are in the local network with that machine or otherwise are supposed to be in-the-know, you'd know it's fixed address and connect to that.

Re: AWS IPv4 Estate Now Worth $4.5B

#433

Post by nerdbert »

Dobbs wrote: post #312
Tijdreiziger wrote: post #86

Earlier quoted context omitted.

Then there are a lot of ISPs to blame: https://www.google.com/intl/en/ipv6/statistics.html

That is a really nice chart, thanks for sharing. What is confusing me is the Netherlands. We only have about 13% adoption. I'm on one of the largest ISPs KPN and get 10/10 on IPv6 tests. Is this because I use a custom router? I'd expect it to be a lot higher since apparently KPN supports IPv6.

Ziggo has also rolled out IPv6 to all its customers so far as I know. They have about 40% of the market.

Re: AWS IPv4 Estate Now Worth $4.5B

#434

Post by SAI_Peregrinus »

nielsole wrote: post #102
wincy wrote: post #71

Earlier quoted context omitted.

That’s pretty cool. I’d never though about bogons and debogonizing before, it’s like chasing off all the squatters on your property and more keep coming. You need some fat pipes and beefy servers to be able to handle all the bogus traffic of machines trying to hit your server, and also be able to actually fulfill your purpose. Make sense now why Cloudflare would be one of the only companies that could handle it!

They only had a 10mbit link. Apparently 50mbit/s was the amount of traffic they received. Mostly everyone could handle this, not just CloudFlare.

CloudFlare reported 10Gib/s when they first switched it on. The 10Mb/s link was deliberately limited.

Re: AWS IPv4 Estate Now Worth $4.5B

#435

Post by lxgr »

Retric wrote: post #253
robertlagrant wrote: post #240

Earlier quoted context omitted.

There's certainly a requirement for them, but it would be good to know what the justification of that requirement was before we know if there's a need. E.g. the justification could be "our SOPs say all network traffic must go through NAT", and if you dig deeper you might find that the SOP was written to save money on IPv4 addresses. That would not indicate a fundamental need.

NAT works well as an ultra simple firewall. All those ancient IoT devices don’t need to accept traffic from arbitrary addresses, but they may need to communicate with the outside world. Using a firewall is obviously an option, but why give an IP to something you don’t want accessible by the outside world?

> NAT works well as an ultra simple firewall.

There's something that works even better as an ultra simple firewall: An ultra simple firewall!

> why give an IP to something you don’t want accessible by the outside world?

- You might change your mind about it needing to be accessible by the outside world, and if it already has a global address you don't need to renumber everything.

- Addressing and routing aren't the same thing; it can be useful to have globally unique addressing even without global reachability.

Re: AWS IPv4 Estate Now Worth $4.5B

#436

Post by lxgr »

elsjaako wrote: post #302
ta1243 wrote: post #237

Earlier quoted context omitted.

The existence of NAT66 and NPTv6 are proof that there is still a need for NAT in an ipv6 environment. Maybe not in your environment, but people wouldn't make these solutions if there wasn't a need.

There's obviously a need, I didn't deny that. I'm not arguing for ipv6, I just want to learn. The uses that I found while searching weren't very convincing, I was hoping you could give an example.

Network sharing from a device that has only a single IPv6 /128 address comes to mind.

Re: AWS IPv4 Estate Now Worth $4.5B

#437

Post by butlerm »

ianburrell wrote: post #416
butlerm wrote: post #356

Earlier quoted context omitted.

The problem is that adding so many bits to IPv6 addresses, by way of intended integration of the EUI / MAC address in particular is not actually necessary and is a bit of a mistake. As a rule, no one even wants their MAC address propagated across the entire Internet, nor to be registered in DNS either. There are some technical advantages to doing things that way of course, but they are arguably rather outweighed by t…

IPv6 having 128-bit is a huge advantage for transition. NAT64 shoves the 32-bit IPv4 address into the host field. MAP-T shoves the source and destination IPv4 addresses and ports into IPv6 address. This makes IPv4-IPv6-IPv4 NAT possible. Which means it is possible to run IPv6-only network with IPv4 at on the customer network and edges.

There are certainly advantages as you point out, but just because you have 128 bit addresses does not mean it is convenient for 64 bits of that to be filled with semi-random data.

Re: AWS IPv4 Estate Now Worth $4.5B

#438

Post by WorldMaker »

snowram wrote: post #192
ncts wrote: post #170

Earlier quoted context omitted.

This is even better: game.latticeanimal.net. 3600 IN A 1.2.3.4

I don't know a single gamer who rented a domain for private use. In fact, I would argue than the hassle of setting one up is the reason why Hamachi got popular back then. You don't have to bother with knowing any technical stuff, just download a software, share a code and play.

DynDNS was big among some of my gaming friends way back in the 90s at one point, when it was a free, donation-supported tool. It was quite useful and relatively low hassle.

At the time it provided a real simple desktop tool that you would install, sign in to your account name, and it would auto-update a (very) short TTL DNS A record for you. (Generally in the form of username.dyndns.org, but as I recall donators could also bring their own top level domain.)

We've got mDNS today to fill some of that gap, but I still wonder if it would also still be nice to have a "no click" desktop tool in 2023 that could quickly update very short TTL DNS AAAA records for you on a subdomain of your choice, and sort of lament Dyn's many pivots (and eventual Oracle buy out) because that original idea still has legs even if it didn't survive the 90s. (Though maybe this time as a true non-profit internet service or operating system feature.)

Re: AWS IPv4 Estate Now Worth $4.5B

#439

Post by WorldMaker »

nikanj wrote: post #116
nash wrote: post #103

Earlier quoted context omitted.

Only network engineers should see or care about IP addresses. The fact IPv6 addresses use colons is why people don't use IPv6 is the worst take I've ever heard.

But only network engineers pick the protocols used. You’re making life harder for the very people who should be your primary audience. PS: As a developer, I often read logs and go ”oh yeah, that’s just our satellite office IP”. 192.168.1.110 is the network printer, etc. There’s no hope of recognizing IPv6 addresses at a glance the same way.

There's more hope than you think as a developer to recognize those types of IPv6 addresses at a glance. The :: shortcut alone also acts a shortcut for pattern matching. You may have network designs where things like {prefix}::110 is the network printer and {prefix}::beef is the cafeteria's new meat printer. Whether or not you bother to remember what exactly {prefix} is or if in worst case it changes regularly and you can mostly ignore it (after briefly pattern matching that it looks close enough to other IPs in your network).

There's different "rules" from IPv4, but as a developer those mostly don't matter and if your network engineer wants you pattern matching your network's machines, then you can just as easily pattern match your network's machines as with IPv4. (That said, there's privacy reasons your network engineers might not want that, security through obscurity and all that. That can be just as true in IPv4, but fewer companies have enough IPv4 address space to truly obfuscate the network patterns. Life is harder for network engineers in IPv6 not entirely because it "has to be" but because "privacy and security is 'easier' if we use a more complicated approach to IPv6 than we did with IPv4 where we would just sequentially number machines within our allotted space".)

Re: AWS IPv4 Estate Now Worth $4.5B

#440

Post by cornholio »

azernik wrote: post #282
cornholio wrote: post #255

Earlier quoted context omitted.

There was a third option: make the existing IPv4 space a hierarchically routed island of the new IPv4.1 space, with backwards compatible packet format, then upgrade just the endpoints in the first phase. So every owner of a ipv4 would get, say, an entire 32 bit space that routes over existing IPv4 infrastructure . So, if the endpoints are upgraded, you have guaranteed end-to-end deliverability without silly hacks suc…

This is exactly how NAT64 works, and still doesn't solve the problem of IPv4 clients trying to connect to servers with only IPv6 addresses. The backwards incompatibility is irreducible, inherent to the special place of Layer 3 in the networking stack.

> This is exactly how NAT64 works

No. The NAT64 hack involves intercepting the DNS requests and rewriting the IPv6 packets in flight so that the IPv6 only clients see outside IPv4 hosts as IPv6. Among many issues, it breaks any end-to-end encrypted protocol that includes IP literals, such as FTP and SIP.

Also, NAT64 presents no immediate benefit to a client upgrading in a IPv4 only environment, since it still doesn't allow two clients behind NAT64 gateways to connect to each other if there isn't an IPv6 connection between them. So the same old IPv6 self-fulfilling tragedy, everybody must upgrade before anybody can see any benefit, therefore nobody upgrades (or uses NAT64).

The main benefit of a backwards compatible packet format is that IPv4.1 islands see each other from day one in the legacy IPv4 internet and get the full benefits of the new protocol, without any configuration or tunnels. The "encapsulation" seen by legacy hops is in fact the canonical, definitive packet structure, there is no temporary transition technology that can break or needs to be configured.

> the problem of IPv4 clients trying to connect to servers with only IPv6 addresses

This is not a problem that can or should be solved, and it's not the problem significantly preventing IPv6 adoption. A non-upgraded client will just see an IPv4 internet, just like an USB 1.0 won't be able to use USB 2.0 speeds.

The difference is that, while a software&hardware upgrade to IPv6 won't bring you any new connectivity without extra configuration from your upstream provider, an IPv4.1 upgrade will instantly allow you to see (and connect end-to-end) to all existing IPv4.1 islands and hosts, using only your legacy, IPv4 connection. The hierarchical extended address space (IPv4 subdivisions) is immediately available, incentivizing adoption without risking connection issues, while the upward extended space becomes available when you have a native IPv4.1 connections, just like with IPv6.

Post reply on HN