Unique IPv6 prefix per host [pdf]
ripe76.ripe.net
Unique IPv6 prefix per host [pdf]
1–10 of 22 posts
Re: Unique IPv6 prefix per host [pdf]
#2Video of the talk: https://ripe76.ripe.net/archives/video/131/
Re: Unique IPv6 prefix per host [pdf]
#3When I see things like this, I suspect people aren't thinking through all of the NDP edge cases. Do you really want the potential to have 2^64 NDP entries on your gateway? What about NUD - do you really want that many potential hosts performing unreachability detection?
NDP is the abominable child of ARP and an IGP and doesn't scale well. Using huge address spaces everywhere is a good way to let it crush your network.
Re: Unique IPv6 prefix per host [pdf]
#4When I see things like this, I suspect people aren't thinking through all of the NDP edge cases. Do you really want the potential to have 2^64 NDP entries on your gateway? What about NUD - do you really want that many potential hosts performing unreachability detection? NDP is the abominable child of ARP and an IGP and doesn't scale well. Using huge address spaces everywhere is a good way to let it crush your network…
perhaps its just my lack of coffee, but I fail to see the scalability issue. Router Redirection can prune quite a few ndp discovery table entries but Learned link-layer addresses are kept in a neighbor discovery table. 2^64 link layer connections are probably not present in a competently designed IPv6 network.
im also confused as to what this paper is talking about in terms of new features.../64 and per host is already a thing in linux. RADVD for example allows you to delegate upstream prefixes to additional interfaces in linux routing. these /64 delegations are handled by the linux host that delegated them and are only known one step above that router as a singly delegated prefix from the "gateway." prefix delegation was designed explicitly for the /64.
if anything home ISP's need a slap on the wrist for their stingy DHCPv6 delegations of what basically amount to a SINGLE ipv6 address or some weird less-than /64. splitting a 56 is a better idea here.
Re: Unique IPv6 prefix per host [pdf]
#5When I see things like this, I suspect people aren't thinking through all of the NDP edge cases. Do you really want the potential to have 2^64 NDP entries on your gateway? What about NUD - do you really want that many potential hosts performing unreachability detection? NDP is the abominable child of ARP and an IGP and doesn't scale well. Using huge address spaces everywhere is a good way to let it crush your network…
This seems off-topic. 64-bit networks for whole companies vs 64-bit networks per host, it makes no difference for the attacks you are thinking about.
Re: Unique IPv6 prefix per host [pdf]
#6When I see things like this, I suspect people aren't thinking through all of the NDP edge cases. Do you really want the potential to have 2^64 NDP entries on your gateway? What about NUD - do you really want that many potential hosts performing unreachability detection? NDP is the abominable child of ARP and an IGP and doesn't scale well. Using huge address spaces everywhere is a good way to let it crush your network…
Isn't the presentation talking about each host acting as a router? So any gateway only needs to know about the prefixes that are the next hop downstream, not every single host.
Maybe I have this wrong, but I think the idea here is talking more on layer 3, whereas you are imagining everything sharing the same layer 2 network?
Re: Unique IPv6 prefix per host [pdf]
#7When I see things like this, I suspect people aren't thinking through all of the NDP edge cases. Do you really want the potential to have 2^64 NDP entries on your gateway? What about NUD - do you really want that many potential hosts performing unreachability detection? NDP is the abominable child of ARP and an IGP and doesn't scale well. Using huge address spaces everywhere is a good way to let it crush your network…
One of the benefits of /64 per host is there is no NDP since the only neighbor is your router.
Re: Unique IPv6 prefix per host [pdf]
#8When I see things like this, I suspect people aren't thinking through all of the NDP edge cases. Do you really want the potential to have 2^64 NDP entries on your gateway? What about NUD - do you really want that many potential hosts performing unreachability detection? NDP is the abominable child of ARP and an IGP and doesn't scale well. Using huge address spaces everywhere is a good way to let it crush your network…
One of the benefits of /64 per host is there is no NDP since the only neighbor is your router.
I'm speaking from the perspective of the router (or physical host) which must maintain NDP entries.
Re: Unique IPv6 prefix per host [pdf]
#9> Provides a very simple mechanism for a single host or interface, to be able to run 2^64 virtual machines, with their own global IPv6 address
It's not uncommon to have multiple layers of virtualization (e.g. lxc/docker running inside qemu/kvm). You'd need top-level hypervisor to passthrough (bridge?) nested VMs requests back to the router, but then you don't have same level of isolation.
Configurable prefix length when nesting (/64 at first level, /80 at 2nd, /96 at 3rd if needed) and automated NDP proxying could solve it, though.
Re: Unique IPv6 prefix per host [pdf]
#10When I see things like this, I suspect people aren't thinking through all of the NDP edge cases. Do you really want the potential to have 2^64 NDP entries on your gateway? What about NUD - do you really want that many potential hosts performing unreachability detection? NDP is the abominable child of ARP and an IGP and doesn't scale well. Using huge address spaces everywhere is a good way to let it crush your network…
perhaps its just my lack of coffee, but I fail to see the scalability issue. Router Redirection can prune quite a few ndp discovery table entries but Learned link-layer addresses are kept in a neighbor discovery table. 2^64 link layer connections are probably not present in a competently designed IPv6 network. im also confused as to what this paper is talking about in terms of new features.../64 and per host is alrea…
As much as I dislike the rest of their business, I have to give credit to Comcast for assigning up to a /60 if the router requests it. Of course a /56 would be better, but 16 networks should be good enough for any home network, right?