4 ms·

Maybe we should bow to the inevitable and recognise that IPv6 is an unfixable problem.

by dom0 9y ago

pilif 9y ago
if it's unfixable, why is 40% of our in-office internet traffic running over IPv6? Why is 100% of our LAN traffic over IPv6? Why is 30% of the traffic to our sites running over IPv6?
- majke 9y ago
  The article suggests "Fragmentation in IPv6 is unfixable", not ipv6 itself. Try running this to see if fragments get delivered to you: http://icmpcheckv6.popcount.org http://icmpcheckv6.popcount.org http://icmpcheck.popcount.org http://icmpcheck.popcount.org (IPv4 version) via: https://blog.cloudflare.com/ip-fragmentation-is-broken/ https://blog.cloudflare.com/ip-fragmentation-is-broken/
  - heinrich5991 9y ago
    Seems to work for me (?).
  - vidarh 9y ago
    Works great for me on my laptop. I don't doubt for a second that there are problems (my phone doesn't get ipv6 at all and one of the ipv4 tests failed... but mobile networks are notorious when it comes to filtering traffic), but "unfixable"?
  - pilif 9y ago
    The comment I was responding to asserted that IPv6 as a whole is unfixable which is not true. With regards to fragmentation, I would say "fragmentation in general is unfixable", no matter the protocol. Thankfully with IPv6, the guaranteed minimal packet size is relatively reasonable (1280 bytes), so maybe it's now time to finally go there. v6 already changed the rules with fragmentation a bit in that routers won't have to fragment any more but are allowed to just drop packets smaller than the MTU and sending back an ICMPv6 packet announcing that they have done so. Unfortunately, ICMP is still dropped at many firewalls even though I would argue that it's absolutely essential for IPv6 functionality (when it was more optional in v4). As it stands now, hosts are still allowed to fragment packets themselves (which is what's happening in this article), but the solution is probably to not do that either in the future. DNSSec over UDP is a problem in that regards, but people aren't convinced that DNSSec is the way to go anyways (just ask tptacek here on this site). (edit: with regards to the fragment checking site you pointed me to: In our case, all is well because I do recognise the necessity of ICMPv6 and thus have configured the firewalls accordingly)
  - joeseeder 9y ago
    Network I am on atm, IPv6 give me both green, IPv4 MTU fails ... It means my IPv6 vpn is better than IPv4 delivered by some wannabe corpo network masters.
    - pilif 9y ago
      the firewall is probably blocking ICMP. For a long time, it was considered best-practice to blanket-block ICMP and for a long time you could mostly get away with it. But over time some really useful stuff has been added to ICMPv4 (early congestion notification for example) and IPv6 mostly won't work at all without ICMP. I would argue that it's time for firewall administrators to reconsider this decision. The time where ICMP packets could do harm are long past (remember the ping-of-death on Windows 98?) and I would argue that the time when a network could work at peak efficiency (or at all) without ICMP are also mostly past.
      - joeseeder 9y ago
        Totally agree, ICMP is needed. When it's not blocked, you can debug and have healthy network, instead of a frankensteins monster.
      - oasisbob 9y ago
        > For a long time, it was considered best-practice to blanket-block ICMP I agree with your point, but think this needs some clarification about who considered it a best practice - among enterprise firewall admins and financial-industry compliance audits, perhaps. Large scale network operators have seen the problems associated with entirely blocking ICMP for at least a decade. (v4 has blackhole problems too) A lot of the hatred for ICMP came from simple things like easy endpoint discoverability. nmap blew that argument out of the water pretty quick.
- IshKebab 9y ago
  For the reasons outlined in the article. Most DNS responses aren't fragmented, and IPv4 covers up failures where they are.
  - pilif 9y ago
    The comment I was responding to asserted that IPv6 in general is unfixable whereas the article was only talking about IPv6 fragmentation where I'd say it's totally correct. But in general, fragmentation is a bad idea and we should not have gone there in the first place. DNSSec should only ever have been specified over TCP (or not at all if you ask some people like tptacek here on this site)
deleted 9y ago
[deleted]

Maybe we should bow to the inevitable and recognise that IPv6 is an unfixable problem.

by dom0 9y ago

Maybe we should bow to the inevitable and recognise that IPv6 is an unfixable problem.

if it's unfixable, why is 40% of our in-office internet traffic running over IPv6? Why is 100% of our LAN traffic over IPv6? Why is 30% of the traffic to our sites running over IPv6?

majke 9y ago
The article suggests "Fragmentation in IPv6 is unfixable", not ipv6 itself. Try running this to see if fragments get delivered to you: http://icmpcheckv6.popcount.org http://icmpcheckv6.popcount.org http://icmpcheck.popcount.org http://icmpcheck.popcount.org (IPv4 version) via: https://blog.cloudflare.com/ip-fragmentation-is-broken/ https://blog.cloudflare.com/ip-fragmentation-is-broken/
- heinrich5991 9y ago
  Seems to work for me (?).
- vidarh 9y ago
  Works great for me on my laptop. I don't doubt for a second that there are problems (my phone doesn't get ipv6 at all and one of the ipv4 tests failed... but mobile networks are notorious when it comes to filtering traffic), but "unfixable"?
- pilif 9y ago
  The comment I was responding to asserted that IPv6 as a whole is unfixable which is not true. With regards to fragmentation, I would say "fragmentation in general is unfixable", no matter the protocol. Thankfully with IPv6, the guaranteed minimal packet size is relatively reasonable (1280 bytes), so maybe it's now time to finally go there. v6 already changed the rules with fragmentation a bit in that routers won't have to fragment any more but are allowed to just drop packets smaller than the MTU and sending back an ICMPv6 packet announcing that they have done so. Unfortunately, ICMP is still dropped at many firewalls even though I would argue that it's absolutely essential for IPv6 functionality (when it was more optional in v4). As it stands now, hosts are still allowed to fragment packets themselves (which is what's happening in this article), but the solution is probably to not do that either in the future. DNSSec over UDP is a problem in that regards, but people aren't convinced that DNSSec is the way to go anyways (just ask tptacek here on this site). (edit: with regards to the fragment checking site you pointed me to: In our case, all is well because I do recognise the necessity of ICMPv6 and thus have configured the firewalls accordingly)
- joeseeder 9y ago
  Network I am on atm, IPv6 give me both green, IPv4 MTU fails ... It means my IPv6 vpn is better than IPv4 delivered by some wannabe corpo network masters.
  - pilif 9y ago
    the firewall is probably blocking ICMP. For a long time, it was considered best-practice to blanket-block ICMP and for a long time you could mostly get away with it. But over time some really useful stuff has been added to ICMPv4 (early congestion notification for example) and IPv6 mostly won't work at all without ICMP. I would argue that it's time for firewall administrators to reconsider this decision. The time where ICMP packets could do harm are long past (remember the ping-of-death on Windows 98?) and I would argue that the time when a network could work at peak efficiency (or at all) without ICMP are also mostly past.
    - joeseeder 9y ago
      Totally agree, ICMP is needed. When it's not blocked, you can debug and have healthy network, instead of a frankensteins monster.
    - oasisbob 9y ago
      > For a long time, it was considered best-practice to blanket-block ICMP I agree with your point, but think this needs some clarification about who considered it a best practice - among enterprise firewall admins and financial-industry compliance audits, perhaps. Large scale network operators have seen the problems associated with entirely blocking ICMP for at least a decade. (v4 has blackhole problems too) A lot of the hatred for ICMP came from simple things like easy endpoint discoverability. nmap blew that argument out of the water pretty quick.
IshKebab 9y ago
For the reasons outlined in the article. Most DNS responses aren't fragmented, and IPv4 covers up failures where they are.
- pilif 9y ago
  The comment I was responding to asserted that IPv6 in general is unfixable whereas the article was only talking about IPv6 fragmentation where I'd say it's totally correct. But in general, fragmentation is a bad idea and we should not have gone there in the first place. DNSSec should only ever have been specified over TCP (or not at all if you ask some people like tptacek here on this site)

deleted 9y ago

[deleted]