11 ms·
Blockers to IPv6 Adoption
- ericnyamu12345 8y agowow.check out this cool forum http://mawazo.byethost7.com/index.php http://mawazo.byethost7.com/index.php
- ericnyamu123456 8y agowow.check out this cool forum http://mawazo.byethost7.com/index.php http://mawazo.byethost7.com/index.php
- tehabe 8y agoI have an IPv6 internet connection but in my home network are still devices, like my TV, which do not support IPv6. I also use some VPN tunnels, which also still rely on IPv4.
- tty74 8y agoFor me, there is just one thing that prevents me from switching completely to IPv6: Github.
- sigjuice 8y agoReally? Each and every other thing you need already does IPv6?
- Faaak 8y agoHacker news is not even v6 ready
- okket 8y agoIn fact, it is eye-opening to disable IPv4 when you have native IPv6. So little works. It is not painful, it is totally unusable. Today, in 2018, a few months away from the 20th birthday of IPv6.
- tambre 8y agoI've messaged HN, and they said it's near the top of their list and will be fixed soon.
- cornholio 8y agoI think the author is approaching this the wrong way, it's trivial to show the advantages listed are mostly not true. The marginal benefits are more than negated by the risks and costs of IPv6. IPv6 is not the product that needs to be sold, and deploying it usually has negative cost benefit on short term, for most businesses. IPv6 needs to be deployed today because the internet literally cannot move forward without it. There are tens of millions of new internet users in Africa and Asia who get an inferior and more costly service for the simple reason their countries weren't around for the great IPv4 feast in the 90s. The data-centers of the world waste enormous energy and hardware for routing the more and more fragmented IPv4 space. The costs of all this, as well as renting IPv4 addresses, which have steadily rised, are passed down to the consumers. IPv6 should be sold as a status simbol: we deploy it because we care, we are altruist industry leaders not stingy bean-counters.
- ianai 8y agoBut you still have to sell it to the stingy bean counters. So until the benefits outweigh the costs, ipv4 4eva.
- mino 8y agoEnterprises are doing the right thing, ignoring v6. No advantage whatsoever for a long time to come, only added complexity and training. As a network engineer and enthusiast, I would do the same.
- dvfjsdhgfv 8y agoI wouldn't say it's "the right thing", but it definitely makes sense in most scenarios. Who in their right mind would voluntarily welcome a new layer of complexity into their network when it's not really necessary?
- techrich 8y agoThe IT director for a global corporation will care, once the bottom line is being effected and he will have to implement it. Profits will not be allowed to suffer.
- kojon99 8y agoPerformance? How exactly is ipv6 more performing? It even has bigger headers. Why would ipv6 be more reliable than ipv4? I’d say it’s the opposite: many times I’ve found websites with AAAA registers that pointed to a dead server. I mean, if you’re going to blame cgn for your problems, let’s steep to your level. Analytics? Forensics? So you’re telling me ipv6 destroys my privacy. How is that a pro argument?
- jjeaff 8y agoI'm by no means am expert in this space, but I was working on some routing issues lately and doing some speed testing with my router. The specs on the router claimed that the highest speeds could be reached with ipv6 support because you could then avoid the overhead of nat for your ipv4 addresses. So that may be what they are referring to. Nat does create overhead.
- kazen44 8y agoAlso, it has a simpler checksum to calculate and a far simpler header. The header is larger but has far less fields. This should make packet processing faster aswell. Also, MTU path-discovery is a pretty big deal in terms of performance, as IPV6 does not allow packet fragmentation. Which should improve performance aswell.
- AmericanChopper 8y agoBut I like NAT. I don’t want to spark a ‘NAT is not a firewall’ debate, but it solves many security and privacy issues with little overhead, and does so in an incredibly simple and elegant way. Having the private LAN as a trusted network zone makes perfect sense, and for home users is works perfectly well with 0 configuration. Remove it and you’re giving every single device a globally unique L3 identifier (no fucking thank you), and to get the same benefits that NAT provides you’ll have to replace it with an unavoidably more complex solution.
- partycoder 8y agoI noticed that enabling IPv6 in the JVM makes many operations slower. Has anyone else noticed this?
- yamu1234567 8y agowow.check out this cool forum http://mawazo.byethost7.com/index.php http://mawazo.byethost7.com/index.php
- gfgffdf 8y agowow.check out this cool forum http://mawazo.byethost7.com/index.php http://mawazo.byethost7.com/index.php
- y0ghur7_xxx 8y agoI deployed a dual ipv4 + ipv6 stack on my home lan a few years ago. I got myself a /48 from hurricane electric, and did everything like it's in the book: SLAAC for subnets, fixed addresses on servers, every device had a public ipv6 and the firewall allowed or denied stuff. Everything worked as it should work. One day something stopped working on the he tunnel, and as I was about to debug what went wrong, I just asked myself "Why am I doing this? My ISP has no ipv6, every site I visit has an ipv4 address, why am I keeping all this ipv6 stuff on? I don't need it. It's just useless work". And so I reverted everything to ipv4 and I am happy since. Less work for me. I see NO reason to deploy ipv6 at the moment. I don't see it for home lans, I don't see it for my workplace, I don't see it for bigger enterprises. But you can have a gazillion IPs with ipv6!! Yeah, so what?
- mort96 8y ago"You can have a gazillion IP addresses with IPv6" isn't necessarily that interesting, but "You can have one IP address with IPv6", or "You can have on IP address per device with IPv6", or "You can get rid of NAT with IPv6", are very interesting.
- kazen44 8y agoIPv6 brings some pretty nice features in terms of network engineering. the major one is a vastly smaller BGP routing table, which is becoming more and more of an issue.[1] We need IPv6 to remove the horrible IPV4 space fragmentation. http://bgphelp.com/2017/01/01/bgpsize/ http://bgphelp.com/2017/01/01/bgpsize/
- y0ghur7_xxx 8y ago> the major one is a vastly smaller BGP routing table, which is becoming more and more of an issue. But that's not a problem for me. It's a problem for my isp. And if he does not care, why should I?
- ti_ranger 8y ago> I deployed a dual ipv4 + ipv6 stack on my home lan a few years ago. I got myself a /48 from hurricane electric, and did everything like it's in the book: SLAAC for subnets, fixed addresses on servers, every device had a public ipv6 and the firewall allowed or denied stuff. Everything worked as it should work. One day something stopped working on the he tunnel If your IPv4 address changes, you need to re-start the tunnel. I ran a setup like this, but since the closest HE tunnelbroker end-point was 180+ms away I configured radvd to only advertise to the RIPE Atlas probe I was running at the time, so only my gateway/firewall and the Atlas probe were IPv6 enabled. My ISP can't enable IPv6 because the last-mile ISP, who does layer-3 hand-over uses half-duplex MPLS VPNs for traffic hand-over (separate VPNs for each ISP), and the equipment (Cisco and Alcatel-Lucent BNGs) in use doesn't support Half-Duplex VRF for IPv6 (only IPv4). I am not aware of another last-mile fixed-line provider (there are quite a few here) that supports IPv6 at all. When I enquired with one of them, they indicated that it was on their roadmap (or backlog, they didn't have any idea of timeline ...).
- qazwsxedcrfv1 8y agocheck out this cool forum http://mawazo.byethost7.com/index.php http://mawazo.byethost7.com/index.php
- GvS 8y agoI've enabled ipv6 on my ubuntu server recently and it was 100x slower. The only solution I found is to go back to ipv4: https://askubuntu.com/questions/759524/problem-with-ipv6-sudo-apt-get-update-upgrade https://askubuntu.com/questions/759524/problem-with-ipv6-sud...
- M_Bakhtiari 8y agoWas all IPv6 traffic slower or just this one apparently misconfigured host? If the former I'd image this is a kernel bug and has nothing to do with any Ubuntu servers.
- Avamander 8y agoIt honestly doesn't matter what bug it is. It should be promptly investigated further and solved. Random blame assignment doesn't help anyone. In this case though, seeing how most mirrors still can't do HTTPS I would not be surprised if the IPv6 issue is caused by the mirrors - another thing not yet properly configured.
- GvS 8y agoAll IPv6 traffic. Checking out from bitbucket took 6 minutes instead of 10 seconds.
- Symbiote 8y agoMy Kubuntu desktop has IPv6, and I have no problems running apt. I just updated from 2001:878:346::116 / mirrors.dotsrc.org; no problems. Which mirror were you using, and did you file a report?
- GvS 8y agoI used default mirrors and I didn't file a report because I'm not sure where and which part of the system is to blame. All IPv6 traffic was slow. This question is from 2 years ago so I assumed it's a known issue.
- JdeBP 8y ago
- lwhalen 8y agoComcast is my biggest blocker to IPv6 adoption. I maintain a static v4 block with them, they tell me I have to give that up if I want a v6 block. Until I give up v4, v6 works on my network right up to the Comcast modem, and is promptly dropped on the floor. Regrettably, that is 'no bueno' for a multitude of reasons. :-(
- 4ad 8y agoHere in Vienna, the "local Comcast" started deploying IPv6. However, they stopped providing real IPv4 for IPv6 customers, and instead do CGN. Well thanks, but no thanks.
- vetinari 8y agoThat's the problem with most consumer-grade ISPs that "embrace" IPv6. They will give it to you, but you have to give up your public IPv4 adress and be stuck within private address range. Of course, given the state of IPv6 in the world, that's not usable for anyone who uses IPv4 today, so instead of using both simultaneously and using IPv6 when possible, you are stuck with IPv4 only, and be counted in the IPv4 stats.
- sliken 8y agoVery weird, the Comcast consumer lines support IPv6 quite well. Their default is to give a /60, which seems appropriately overkill. Generally it "just works", and my roku, android phones, and similar average over 50% of the packets on IPv6. Comcast seems like one of the largest deployments of IPv6 for normal consumers outside of the cell companies.
- 4ad 8y ago> Their default is to give a /60, which seems appropriately overkill. A /60 is pathetically small, with SLAAC you have 16 (!!) subnets for your whole network. With people having multiple computers and multiple phones, this is not enough even for a normal household of 3 people. If you are a IT person, with multiple computers and VMs, forget it. The recommended size of block that every ISP should give is /48 (RFC 6177). Good ISPs will give you a /48, some lesser ISPs will give you a /56. Comcast and crappy ISPs will give you a /60.
- merb 8y agowell K8s can't be run in Dual Stack, which is a major Pita. Also most Clouds (especially Gcloud) mostly work on the IPv4 level.
- grandinj 8y agoWhat we should take away from the IPv6 debacle is a fine lesson in hubris. I was hanging out in the IPv6 mailing lists at the time the various solutions were being debated. The prevailing attitude was "the Internet is about to die from routing overload without IPv6, so we can stick whatever complexity we want inside it, and they will have no choice but to accept it." Except that new router hardware and new incremental software improvements came out, and the enormous complexity of the "boil the ocean" redesign inherent in IPv6 was rightly regarded as completely unnecessary. If the IETF had simply made IPV6 "ipv4 with longer addresses", (and there was a proposal to do just that), implementations and deployment would have been dramatically simpler and would have stood a real chance of succeeding. Instead we have this baroque construction, which I _still_ have to explicitly disable in my work environment because various bits of supposedly IPV6 software don't play nice together.
- MR4D 8y agoWell said! I was in the camp hoping for two octects at the beginning of the address (so they could be zeroes). Actually, a single i text would have taken us to a trillion IPs and given us enough time to think about the topic a bit more. Large changes rarely succeed. Perl 6, Mozilla (back in the 1990’s) and others come to mind. This is hard stuff, and we were made to swallow the kitchen sink.
- magicalhippo 8y agoI guess one could say, to paraphrase, extraordinary change requires extraordinary motivation. For me as a home user, IPv6 seems like what you'd get when you ask a group of 6-year olds to design a concept car.
- zAy0LfpBZLC8mAC 8y agoSo, what are the changes in IPv6 other than change in address size that hinder adoption?
- noinsight 8y agoARP was replaced by neighbor discovery protocol. Broadcast was replaced by multicast.
- m0dest 8y agoDecades from now, the story of IPv6 will be a cautionary tale about the danger of ignoring incentives when enhancing open standards. So much of the spec seems to have been designed in an idealist vacuum that the promoters are blind to its own failures. The addresses are ugly and impossible to memorize but that shouldn't matter because... There are no performance advantages but that was out of scope because... There are few security advantages because that wasn't a core goal because... I'm not saying that we should give up on IPv6. But we should acknowledge that its slow adoption is entirely due to a standard that was poorly designed for the real needs of critical stakeholders and poorly marketed to everyone else.
- rjsw 8y agoThere is one performance advantage, IPv6 requires one fewer checksum calculation on each packet.
- kelnage 8y agoIsn't the same true of HTTPS (first developed in 1994, but has only seen wide usage recently, outside of specific use-cases), or even programming languages like Python 3? At the end of the day, it seems to me that incumbent internet technologies that are widely used will always see slow incremental change to a new incompatible version, regardless of how small the changes or how many improvements there are, without significant and clear external incentives. Such incentives are very hard to manufacture - so foresight of upcoming issues (such as IPv4 address space depletion) will always seem premature until they actually occur. But it certainly doesn't make forward planning a bad idea.
- olavk 8y agoIPv6 was designed in the early 90'ies where the internet looked very different - this was even before the web. Large scale changes were much easier to coordinate and roll out. I dont think the players at that time needed incentives beyond knowing that the upgrade solved the address space problem. The problems of adoption can be compared to the Python 3 debacle. When Python 3 was first planned, Python were mostly used by enthusiasts which would be quick to adopt a new version - even if it had a few minor incompatible changes. But when the release finally rolled out, Python had become much more popular and entrenched and widely used by business and scientists which were more reluctant to adopt breaking changes.
- rwmj 8y agoI wonder if anyone has tried making their home network IPv6 only? How did that work out for you? The reason I ask is (as described in the article) I've nearly run out of RFC1918 space because of dozens of machines, gadgets and many more virtual machines. (For complicated reasons to do with the VPN routing, I cannot use 10.x).
- letsgetphysITal 8y agoCan't use 172.16.0.0/12 either? That's over 1m hosts. You don't have 1m hosts unless your homelab is actually a large domestic ISP.
- rwmj 8y agoEither way I'd have to renumber everything. If I'm going to do that why wouldn't I just go straight to IPv6? I already have IPv6 on my home network (but everything has an IPv4 primary address and name resolution always resolves to IPv4); and an IPv6-supporting ISP. The question is if it's a good idea to go IPv6 only for some or all machines, and how to deal with the IPv4<->IPv6 issues.
- beagle3 8y agoIf it's your home network, you could use 172.16.0.0/20, as well as the CGNAT /16. > If I'm going to do that why wouldn't I just go straight to IPv6? Because it is a lot more than just renumbering. Whether or not it's a good idea depends on what you expect to get from it (anything?), how good your ISP's IPV6 support is, and how good the support of hosts you connect to is. If whatever hosts you contact are all on IPV4 only, then you'll have to occasionally debug the 6to4/4to6/Teredo/whatever kludges that add latency and provide nothing of value compared to using an IPv4 directly.
- virtuallynathan 8y agoQuite a few folks have done it using DNS64/NAT64, I might set it up. Most of my traffic is IPv6 at home.
- guidedlight 8y agoI see IPv6 as a privacy issue. It will enable clients to be individually identified without needing to rely on cookies and fingerprinting anymore. NAT is great in that it obscures individual machines without too much lose of functionality.
- andrewaylett 8y agohttps://tools.ietf.org/html/rfc4941 https://tools.ietf.org/html/rfc4941 defines IPv6 privacy extensions, which mitigate that issue. One of the few benefits of an extended roll-out of IPv6 is that there's been time for people to identify issues like this and get fixes rolled out widely before systems started relying on the old behaviour.
- mehrdadn 8y agoWhat percentage of IPv6-supporting routers have implemented and activated those privacy extensions?
- detaro 8y agoIt's a feature of the client device, not the router, and is implemented in all major operating systems. They are not perfect though, since at least the original design was purely timer-based, which left some tracking potential.
- mehrdadn 8y agoThanks for the correction, and yeah, there you go.
- gigatexal 8y agocouldn't you get around this by wrapping all tcp/udp connections in an encrypted manner say a tunnel and using dns+tls to encrypt dns queries? Sure it's not as easy as just using NAT but not having to translate via NAT to get to the internet sounds good to me. Access points wouldn't need to route anymore would they?
- azwsxedcrfv12 8y agohttps://www.bit.ly/2M0hqJa https://www.bit.ly/2M0hqJa
- zwsxedcrfv123 8y agohttps://www.bit.ly/2M0hqJa https://www.bit.ly/2M0hqJa
- atemerev 8y agoOf course it is the NAT. It always was the NAT. NAT is the easy thing, nearly effortless, that dramatically improves network security — there is a "bastion host" (router) and private network computers, almost impossible to be accessed from the outside without breaking the bastion host first. This is good security, and with NAT, everybody was getting it for free. With IPv6, it doesn't work this way, everybody needs to know how to set up proper packet filtering, ACLs, and whatsnot. It is really easy to misconfigure the network, especially in the unfamiliar environment which is IPv6. Huge loss for security. Of course IPv6 adoption suffers.
- okket 8y agoActually, I don't know one CPE IPv6 router that ships _without_ blocking the home network from the outside by default.
- atemerev 8y agoIt is easy enough with home routers (packet filtering is hidden from the user, and no need to configure it). It is much harder for corporate networks where you need to configure everything yourself and maintain ACLs. No more easy default option.
- kazen44 8y agowhat? this makes no sense? For a corporate network, their requirements usually result in them having to manage their own ACL's anyways. It does not matter if that is IPV4 or IPV6. There is no "easy default" for corporate networks because they don't have easy requirements. On a enterprise grade firewall/router, the end rule of an ACL is a DEFAULT DENY ANY ANY, on both ipv4 and ipv6. (this assumes you actually enable ACL's. But that depends on your platform).
- atemerev 8y agoYou a talking about large corporations. I am talking about small and medium business where networks are abused and misconfigured in every way, and the only thing holding them relatively undamaged is the NAT. There are millions of them.
- 4564565475 8y agothis is a very nice forum,check it out https://www.bit.ly/2M0hqJa https://www.bit.ly/2M0hqJa
- Jack5500 8y agoI still think that while the hardware may be ready by now, the software certainly isn't. Not only does an IPv6 break a lot of old software,that's not designed for the stack. Even today, not all network librarys do support IPv6. It's nothing that can't be worked out, but we are just not there yet and will never be there until a forced adaption comes into play.
- gigatexal 8y agoCouldn’t you get rid of nat altogether with ipv6?
- mehrdadn 8y agoNot if you want to keep its benefits. See discussion below.
- 543543543543 8y agobit.ly/2K1FL3T
- 543543543543 8y agowww.bit.ly/2K1FL3T
- mehrdadn 8y agoI'm surprised security and privacy weren't mentioned. In the current state of affairs (no, I'm not talking about some ideal utopia with IPv6 perfection where fifty quintillion additional RFCs have been finally deployed and battle-tested world-wide; I'm talking about IPv6 as available to the ordinary user /today/) I simply do not trust using IPv6 to provide as much security or privacy as IPv4. More than happy to change my mind when (...if?) the technology moves forward 10 years from now, but I just can't see it working right now. Sorry.
- ge0rg 8y agoIt is really sad to see that essentially all security issues of IPv4 were inherited, at least on the LAN level. However, besides of the "firewall protection" provided by NAT, which is largely mirrored as "outgoing connections only" in ipv6 deployments, I fail to see how it actually makes security worse. Do you have examples for what you had in mind?
- mehrdadn 8y agoThe one you excluded (why?) is a pretty darn big one. It means for example that a random hacker would have a hell of a hard time spontaneously reaching my phone via the cellular data connection... or the WiFi connection for that matter, since that's NAT'ed too. Which reduces the attack surface immensely. I don't see why even this by itself would be insufficient reason...
- 765765708008 8y agonice forum https://bit.ly/2JQeKgF https://bit.ly/2JQeKgF
- alex_duf 8y agoYet adoption is still growing exponentially https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html It's not as fast as past me would have hoped for and I think the criticism is perfectly valid but I'm quite happy to look at this graph no and again
- tylll 8y agonice blog nice post https://bit.ly/2HVeGKU https://bit.ly/2HVeGKU
- mino 8y agoNot really, see slide 4 of Geoff Huston's talk at RIPE76: https://ripe76.ripe.net/wp-content/uploads/presentations/9-2018-05-17-ipv6-reasons.pdf https://ripe76.ripe.net/wp-content/uploads/presentations/9-2... It is actually growing slower and slower and looking as a logistic curve, which is perhaps unsurprising. Also note the increasing gap between weekdays and weekends, which is a sign that enterprises don't care about v6.
- singularity2001 8y agoIs it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)?
- neojima 8y agoIn 2005 or so, sure. Now...not so much? What privacy erosion/easier tracking are you talking about that wasn't remedied by the very wide deployment of RFC4941 (IPv6 Privacy Extensions) in operating systems?
- singularity2001 8y agowith IPv4 my ISP has to shuffle IPs with every reconnect. with IPv6 you could get one IP for lifetime?
- detaro 8y agoThat's orthogonal to IPv4 and IPv6. There's ISPs that give you always the same IPv4 adress, there's ISPs that give you a different IPv6 prefix each time.
- rektide 8y agoGoogle offering no ipv6 networking options in their cloud is one giant dick of a blocker. Screw this. Immoral awful cataclysmic prevention of us getting better at #ipv6. Wtf Google. https://issuetracker.google.com/issues/35904387 https://issuetracker.google.com/issues/35904387