10 ms·

Going IPv6 Only [pdf]

174 points by okket 8y ago

phicoh 8y ago
It is weird to call this 'IPv6 Only'. Connectivity to the IPv4 internet is still provided. It is just that to talk IPv4 you have to go through a couple of complex translation steps.
- okket 8y ago
  It is IPv6 only with a fallback connection to the legacy IPv4 protocol with little to no chance of a reverse connection. Sadly, too much content is still stuck in this rapidly ageing world. Bandaid after bandaid won't help in the long term. Do we really want a one way connection world? If not, adapt IPv6. By default IPv6 CPE gear blocks incoming connections, which is good. Firewall rules can be changed, if needed. You can't change forced CG-NAT.
  - Eech0Shu 8y ago
    There's some RFC suggesting that CGNATs handle PCP requests from the CPE thus allowing incoming connections. But sadly that's not implemented everywhere.
    - pixl97 8y ago
      Yo dawg, I hear you like NAT, so I'm going to put NAT in your NAT. While IPv6 may suck, it really is time to take IPv4 out and shoot it in the head.
  - ataturk 8y ago
    I started learning about IPv6 in 1994! I mean, it was the fast-coming new thing back then. I was encouraged by one professor to deep dive into it since my career would definitely require knowledge of this new protocol. It's been 24 years now, maybe after 25 years it will take off for real.
  - repolfx 8y ago
    Well, are there any mobile ISPs that let you accept inbound connections? Carrier firewalls kill mobile p2p networks even though mobile+p2p are made for each other: it'd be amazing to be able to build decentralised services running on swarms of phones, but the lack of stable device-to-device connectivity except via massive Google and Apple datacenters is a killer problem :(
axaxs 8y ago
Credit where it's due. I'm generally against anything the big 4 touch, but TMo has been absolutely on the forefront of IPv6. The first time I saw IPv6 in the wild was while on a TMo data connection.
- deleted 8y ago
  [deleted]
- metafunctor 8y ago
  Sorry, but anything in the US hasn't really been in the forefront of IPv6 adoption.
  - Arnt 8y ago
    An ISP with ten million v6-only users is not on the forefront? Be fair please.
  - ajdlinux 8y ago
    Google's IPv6 statistics (https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption&tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...) show that the US is ahead of literally every other country in the world, so I think it's fair to say US ISPs aren't doing too badly.
    - ancarda 8y ago
      Belgium (50.02%) is ahead of the USA (37.19%) on that chart, although you may have missed that as it's quite a small country. Click "Europe" to zoom in a bit. Alternative data from Facebook -- https://www.facebook.com/ipv6/?tab=ipv6_country https://www.facebook.com/ipv6/?tab=ipv6_country -- is quite a bit different but shows Belgium (50.45%) and India (50.27%) are both slightly ahead the US (49.28%). It's very hard to measure IPv6 adoption. I would personally go with Google's measurements as I suspect the numbers are higher on Facebook because fewer people access Facebook at work, where those networks tend to have less IPv6.
Sirened 8y ago
I'm glad that someone is finally doing this. We all really need someone to force us to migrate to v6 finally, and I only did that once I realized I couldn't access my home network over cellular anymore.
- ohazi 8y ago
  What do you do if your cellular provider goes IPv6-only, but your home ISP will only give you a v4 address?
  - y0ghur7_xxx 8y ago
    > What do you do if your cellular provider goes IPv6-only, but your home ISP will only give you a v4 address? Get a tunnel from he[1] and access the home network through that. [1]https://tunnelbroker.net/ https://tunnelbroker.net/
    - icebraining 8y ago
      Or use a Tor hidden service, and get end-to-end encryption for free (see https://github.com/AnarchoTechNYC/meta/wiki/Connecting-to-an-authenticated-Onion-service https://github.com/AnarchoTechNYC/meta/wiki/Connecting-to-an...)
      - floatboth 8y ago
        I've tried to use onioncat to get from anywhere to NATed home. Performance sucked too much. Switched to an openvpn instance on a VPS :D
      - eeZah7Ux 8y ago
        ...and server authentication, and optional client authentication.
  - alex_duf 8y ago
    I don't think your cellular provider would stop you from accessing ipv4 addresses, it just starts the first hop on ipv6, then tunnels it for you to wherever you're trying to reach. The ultimate goal being decommissioning the tunnel once the rest of the world is ready (few decades obviously)
signa11 8y ago
geoff-huston from apnic, has this set : https://ripe76.ripe.net/presentations/9-2018-05-17-ipv6-reasons.pdf https://ripe76.ripe.net/presentations/9-2018-05-17-ipv6-reas... describing world-wide ipv6 deployment, and the conclusion there seems to be that v6 deployment is actually slowing down, and the conclusion seems to be that no one knows why...
- ec109685 8y ago
  Despite his conclusion, he likely answers it here: • The Client / Server CDN-centric Internet does not require each endpoint to have a globally unique permanent address • Addresses are increasingly being used in the role of ephemeral session tokens, not as persistent endpoint identifiers If you have to support ipv4 anyway and the benefit of ipv6 for your services is not high enough, why bother?
  - Eech0Shu 8y ago
    That only applies if you have a very myopic view on what the internet does. Sure, CDN traffic may dominate by volume but it is far from the only traffic on the internet. P2P traffic is still significant. web ⊂ internet
    - ec109685 8y ago
      P2P works through NATs as long as you are willing to signal through a central servers, e.g. discussed here: https://arxiv.org/pdf/1605.05606 https://arxiv.org/pdf/1605.05606
- gmuslera 8y ago
  The low hanging fruits are all taken, the higher ones are harder to reach. But what makes an ISP/country harder to reach is not just a couple of variables.
  - neojima 8y ago
    I'd half agree with this; for those who are actively working on this, yes, the low-hanging fruit are all done, but there's still plenty of low-hanging fruit in organizations where no one's bothered to pick them.
devereaux 8y ago
On my home network, all my device have IPv6. Unfortunately, it not native IPv6: the AT&T LTE device I use for my home internet doesn't support IPv6. (Why LTE? It's a long story- I frequently travel, and I take my connection with me. Comcast doesn't make much sense. LTE latency and bandwidth are good enough) Anyway, whenever I get a server, I make sure IPv6 is supported. No IPv6, no business from me -- even for a VPS. With IPv6, I don't have to worry about NAT: I can always ssh to any of my machines (or the VMs) from anywhere. It's just simpler. When I'm abroad and don't have IPv6, I ssh to one of my servers so I can connect to my home devices. That's a nuisance I'd like to avoid. It's nice to know TMob is going IPv6 only. When I replace my "home" LTE internet, I may switch from AT&T to TMobile if the price is competitive.
- pilif 8y ago
  > I can always ssh to any of my machines (or the VMs) from anywhere. It's just simpler. Exposing an sshd to the public internet seems very risky. IPv6 or not. Even with v6 in your LAN, you probably still want the firewall to drop all incoming connections and then use some kind of VPN or bastion host to get inside
  - jessaustin 8y ago
    GP probably has password login turned off in sshd...
  - Fnoord 8y ago
    > Exposing an sshd to the public internet seems very risky. IPv6 or not. That depends on factors. Personally, I prefer an SNT/VPN such as ZeroTier or WireGuard. SSH would suffice, so would SSH over Tor. Thing is though; you only need to expose 1 of these to public internet. The rest is redundant. Which can be useful though.
  - jacob019 8y ago
    disable password authentication, ssh keys are secure enough
    - 8y ago
StefanWallin 8y ago
> "At WWDC 2015 Apple announced the transition to IPv6-only network services in iOS 9. Starting June 1, 2016 all apps submitted to the App Store must support IPv6-only networking." In effect this is not true, as a developer without the time to fully implement IPv6-only networking I've been slapped with this rule in the app store review guidelines for non-complying apps numerous times. Just submit a new review and you'll get another reviewer who does not check this and you'll pass. The rule they cite is also that you have to be able to support IPv6 for iPad-apps, not iPhone apps... So even if it's the rule, I think that in reality it's not going to be true for all the users apps.
- okket 8y ago
  A rule that is not enforced properly does not invalidate the rule. Do you want to rely for your app to get approved to get a non-enforcing reviewer forever in the future? Also think of your customers on networks like TMo.
- tzahola 8y ago
  What prevents you from supporting IPv6-only networking? HTTP libraries support it out of the box. If you use sockets, just update them to use PF_INET6 and it'll be backward-compatible with IPv4 through IPv4-embedded IPv6 addresses.
singularity2001 8y ago
Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? With IPv4 my ISP has to shuffle IPs with every reconnect. With IPv6 you could get one IP for lifetime? While ISP that hand out a static IPv4 can exist, it's much more unlikely, whereas with IPv6 it will become the norm.
- claudex 8y ago
  Some ISP provide a different IPv6 at each connection (to sell static IPv6 at higher price). Other ISP provide a /56, which means, you can shuffle on a lot of /64 on your own. Morevover, there is the privacy extension for IPv6 that change the local part of the IPv6 at regular interval to avoid tracing.
  - tjoff 8y ago
    I wouldn't be surprised if it will be trivial to look at a certain IP and query how large pool that particular ISP are allocating for each user.
- rnhmjoj 8y ago
  In the worst case the ISP will give you a /64 prefix which you can complete to form an IPv6 address via SLAAC. Operating systems will generate many different temporary addresses with a short lifetime and use those for outbound connections to reduce tracking.
- lmns 8y ago
  You should have a look at the IPv6 privacy extensions. IPv6 doesn't work as you think it does. Your devices use temporary IPs even with a static IPv6 prefix.
  - singularity2001 8y ago
    Can't trackers just map the prefix to your id, or do many users share a prefix? will look it up...
skrause 8y ago
Looking at mechanisms like 464XLAT, why are these currently favored over DS-Lite [1]? To me DS-Lite seems like a simple and elegant solution if you don't have a lot of public IPv4 addresses, 464XLAT looks much more compilcated. [1] https://en.wikipedia.org/wiki/IPv6_transition_mechanism#Dual-Stack_Lite_(DS-Lite) https://en.wikipedia.org/wiki/IPv6_transition_mechanism#Dual...
- azernik 8y ago
  464XLAT is simpler because it gets to piggyback off of other infrastructure that is already in place for forward-compatibility, namely NAT64 and DNS64. Not sure how much of this background you need, but since Wikipedia doesn't explain it well: as an ISP, you want your IPv6-only customers to be able to access the IPv4 internet. So you represent the entire IPv4 internet as an IPv6 prefix (generally ::ffff:0:0:0/96) and get IPv6 clients to send their IPv4 traffic to that subnet. So e.g. if they user wants to access an IPv4 service at 1.2.3.4, you instead send them a DNS response with the address ::ffff:0:12:34. Then you route packets to the "IPv4 subnet" to a system that both does NAT and translates packets from v4 to v6. The main point here is that you have to implement this or some other non-DS-Lite solution, because it solves a problem that DS-Lite does not address: support for IPv6-only clients on an IPv6-only ISP that still want to talk to old IPv4 servers. Where this gets interesting is that once you've implemented NAT64 + DNS64, a solution to the backward-compatibility problem falls out neatly - convert IPv4 packets to IPv6 packets using a reverse of the protocol-aware translation that NAT64 boxes do, and then feed those into the NAT64-enabled network. So the marginal complexity for solving the backward-compatibility problem through 464XLAT is lower than implementing all of DS-Lite.
  - Fnoord 8y ago
    Would 464XLAT allow you to connect to e.g. Emby over IPv4, SSH port forwarding over IPv4, and BitTorrent to work (where majority of clients use IPv4) where it doesn't with DS-Lite/CGN?
    - azernik 8y ago
      Not sure about BT (there's still a NAT involved, but maybe the more conventional NAT64 allows the usual hole punching techniques to work?) or Emby (no idea what that is). I have no idea why SSH port forwarding wouldn't work with DS- Lite or 464XLAT, since from the network infrastructure's perspective it's a pretty conventional server-client connection.
emilfihlman 8y ago
I just wish IPV6 was mostly about adding more bits to the addresses instead of the clusterfuck that they introduced.
- kazen44 8y ago
  the "clusterfuck" the introduced is mostly a nice thing in my opinion. Things like MTU path-discovery, NDP and SLAAC make a lot of sense and are definitely improvements over the solutions we have in IPv4. Broadcast makes little sense on a layer 3 perspective. The use of link-local and unique-global addresses also makes sense, and having a different address class for multicast makes implementing multicast more convenient.
  - bogomipz 8y ago
    I agree with all of your points. I didn't understand this however: >"and having a different address class for multicast makes implementing multicast more convenient." IPV4 has a different class for multicast as well - the first 4 bits are 1110. IP range 224.0.0.0 - 239.255.255.255. Or did you mean something else?
    - arbitrage 8y ago
      I doubt it, it's conceptually the same, as you say. I think this is just exemplary of just how much most people, even tech people, don't understand the underlying networking paradigm.
dstick 8y ago
I've been following the IPv6 rollout with interest for the last few years from outside the networking / RIR / LIR / ISP community and I have a question if anyone could provide some insights: ARIN is already out of IPv4, RIPE just finished their last /8 and are now going through the remaining available pile - what happens when they're all gone? Won't the world sort of be forced to migrate?
- azernik 8y ago
  This increases the motivation, but there are methods of delaying the hard requirement to migrate. A smaller patch is to reclaim unused blocks; a bigger one is carrier-grade NAT. e.g. in some countries such as Russia your ISP will allocate you a 10.0.0.0/8 address rather than a publicly-routable one, and will have a NAT between its customers in your city and the publicly-addressable internet. And yes, this is an ugly solution and comes with a lot of problems and costs.
- akvadrako 8y ago
  You can buy IPv4 addresses on a second-hand market. A few years ago they were about $8 each, with a minimum of 256. Plus you need to pay an RIR member to hold them for you, which incurs about $50/year in RIR fees for Europe. So it's not a big deal yet.
- neojima 8y ago
  - APNIC ran out in 2011, but has a new-LIR pool remaining - RIPE ran out in 2012, but has a new-LIR pool remaining (part of which is that /8 you mentioned) - LACNIC ran out in 2014, but has a new-LIR pool remaining - ARIN ran out in 2015, and does not have a new-LIR pool - AFRINIC is the only RIR with a general-use pool available As akvadrako says, there's a secondary market, except the current pricing is around 16+USD/IP, with the semi-obvious minimum of a /24 (so, 4000+USD). Given that (in ARIN region) that /24 would have cost you 250USD up-front, it's a marked increase. (Actual current numbers, FWIW: https://www.ipv4auctions.com/customer/account/previous/ https://www.ipv4auctions.com/customer/account/previous/ )
Eech0Shu 8y ago
Sadly the "happy eyeballs" algorithm obscures IPv6 problems. For example some subnets of amazon cloudfront are v4-reachable from my ISP while being v6-unreachable. But others are v6-reachable. When a DNS name points to a mix of v4 and v6 addresses nobody notices the failure because browsers are quick to fall back to v4 and thus the issue never gets reported. The other problem is that such issues are difficult to report in the first place as private customer because customer support is geared towards dealing with user errors or last mile problems.
- virtuallynathan 8y ago
  Do you have examples of these subnets? ping me @ nahtnow at amazon dot com.
  - Eech0Shu 8y ago
    Not at a location where I can check with my home ISP right now. But last time I checked a few days ago it affected some of the AAAA records that docs.rust-lang.org was pointing to. The affected ISP is deutsche telekom. I sent an email to the contact listed in the whois database but didn't get any reply.
tzakrajs 8y ago
Socat is your friend.
gyrfalcon 8y ago
Where is the video/audio presentation? Found it...but unfortunately the recorded button is broken. Why the poster didn't link to it originally is beyond me. Presentation is generally worthless without the presenter. https://pc.nanog.org/static/published/meetings//NANOG73/daily/day_2.html#talk_1645 https://pc.nanog.org/static/published/meetings//NANOG73/dail...

174 points by okket 8y ago

It is weird to call this 'IPv6 Only'. Connectivity to the IPv4 internet is still provided. It is just that to talk IPv4 you have to go through a couple of complex translation steps.

okket 8y ago
It is IPv6 only with a fallback connection to the legacy IPv4 protocol with little to no chance of a reverse connection. Sadly, too much content is still stuck in this rapidly ageing world. Bandaid after bandaid won't help in the long term. Do we really want a one way connection world? If not, adapt IPv6. By default IPv6 CPE gear blocks incoming connections, which is good. Firewall rules can be changed, if needed. You can't change forced CG-NAT.
- Eech0Shu 8y ago
  There's some RFC suggesting that CGNATs handle PCP requests from the CPE thus allowing incoming connections. But sadly that's not implemented everywhere.
  - pixl97 8y ago
    Yo dawg, I hear you like NAT, so I'm going to put NAT in your NAT. While IPv6 may suck, it really is time to take IPv4 out and shoot it in the head.
- ataturk 8y ago
  I started learning about IPv6 in 1994! I mean, it was the fast-coming new thing back then. I was encouraged by one professor to deep dive into it since my career would definitely require knowledge of this new protocol. It's been 24 years now, maybe after 25 years it will take off for real.
- repolfx 8y ago
  Well, are there any mobile ISPs that let you accept inbound connections? Carrier firewalls kill mobile p2p networks even though mobile+p2p are made for each other: it'd be amazing to be able to build decentralised services running on swarms of phones, but the lack of stable device-to-device connectivity except via massive Google and Apple datacenters is a killer problem :(

axaxs 8y ago

Credit where it's due. I'm generally against anything the big 4 touch, but TMo has been absolutely on the forefront of IPv6. The first time I saw IPv6 in the wild was while on a TMo data connection.

deleted 8y ago
[deleted]
metafunctor 8y ago
Sorry, but anything in the US hasn't really been in the forefront of IPv6 adoption.
- Arnt 8y ago
  An ISP with ten million v6-only users is not on the forefront? Be fair please.
- ajdlinux 8y ago
  Google's IPv6 statistics (https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption&tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...) show that the US is ahead of literally every other country in the world, so I think it's fair to say US ISPs aren't doing too badly.
  - ancarda 8y ago
    Belgium (50.02%) is ahead of the USA (37.19%) on that chart, although you may have missed that as it's quite a small country. Click "Europe" to zoom in a bit. Alternative data from Facebook -- https://www.facebook.com/ipv6/?tab=ipv6_country https://www.facebook.com/ipv6/?tab=ipv6_country -- is quite a bit different but shows Belgium (50.45%) and India (50.27%) are both slightly ahead the US (49.28%). It's very hard to measure IPv6 adoption. I would personally go with Google's measurements as I suspect the numbers are higher on Facebook because fewer people access Facebook at work, where those networks tend to have less IPv6.

Sirened 8y ago

I'm glad that someone is finally doing this. We all really need someone to force us to migrate to v6 finally, and I only did that once I realized I couldn't access my home network over cellular anymore.

ohazi 8y ago
What do you do if your cellular provider goes IPv6-only, but your home ISP will only give you a v4 address?
- y0ghur7_xxx 8y ago
  > What do you do if your cellular provider goes IPv6-only, but your home ISP will only give you a v4 address? Get a tunnel from he[1] and access the home network through that. [1]https://tunnelbroker.net/ https://tunnelbroker.net/
  - icebraining 8y ago
    Or use a Tor hidden service, and get end-to-end encryption for free (see https://github.com/AnarchoTechNYC/meta/wiki/Connecting-to-an-authenticated-Onion-service https://github.com/AnarchoTechNYC/meta/wiki/Connecting-to-an...)
    - floatboth 8y ago
      I've tried to use onioncat to get from anywhere to NATed home. Performance sucked too much. Switched to an openvpn instance on a VPS :D
    - eeZah7Ux 8y ago
      ...and server authentication, and optional client authentication.
- alex_duf 8y ago
  I don't think your cellular provider would stop you from accessing ipv4 addresses, it just starts the first hop on ipv6, then tunnels it for you to wherever you're trying to reach. The ultimate goal being decommissioning the tunnel once the rest of the world is ready (few decades obviously)

signa11 8y ago

geoff-huston from apnic, has this set : https://ripe76.ripe.net/presentations/9-2018-05-17-ipv6-reasons.pdf https://ripe76.ripe.net/presentations/9-2018-05-17-ipv6-reas... describing world-wide ipv6 deployment, and the conclusion there seems to be that v6 deployment is actually slowing down, and the conclusion seems to be that no one knows why...

ec109685 8y ago
Despite his conclusion, he likely answers it here: • The Client / Server CDN-centric Internet does not require each endpoint to have a globally unique permanent address • Addresses are increasingly being used in the role of ephemeral session tokens, not as persistent endpoint identifiers If you have to support ipv4 anyway and the benefit of ipv6 for your services is not high enough, why bother?
- Eech0Shu 8y ago
  That only applies if you have a very myopic view on what the internet does. Sure, CDN traffic may dominate by volume but it is far from the only traffic on the internet. P2P traffic is still significant. web ⊂ internet
  - ec109685 8y ago
    P2P works through NATs as long as you are willing to signal through a central servers, e.g. discussed here: https://arxiv.org/pdf/1605.05606 https://arxiv.org/pdf/1605.05606
gmuslera 8y ago
The low hanging fruits are all taken, the higher ones are harder to reach. But what makes an ISP/country harder to reach is not just a couple of variables.
- neojima 8y ago
  I'd half agree with this; for those who are actively working on this, yes, the low-hanging fruit are all done, but there's still plenty of low-hanging fruit in organizations where no one's bothered to pick them.

devereaux 8y ago

On my home network, all my device have IPv6. Unfortunately, it not native IPv6: the AT&T LTE device I use for my home internet doesn't support IPv6. (Why LTE? It's a long story- I frequently travel, and I take my connection with me. Comcast doesn't make much sense. LTE latency and bandwidth are good enough) Anyway, whenever I get a server, I make sure IPv6 is supported. No IPv6, no business from me -- even for a VPS. With IPv6, I don't have to worry about NAT: I can always ssh to any of my machines (or the VMs) from anywhere. It's just simpler. When I'm abroad and don't have IPv6, I ssh to one of my servers so I can connect to my home devices. That's a nuisance I'd like to avoid. It's nice to know TMob is going IPv6 only. When I replace my "home" LTE internet, I may switch from AT&T to TMobile if the price is competitive.

pilif 8y ago
> I can always ssh to any of my machines (or the VMs) from anywhere. It's just simpler. Exposing an sshd to the public internet seems very risky. IPv6 or not. Even with v6 in your LAN, you probably still want the firewall to drop all incoming connections and then use some kind of VPN or bastion host to get inside
- jessaustin 8y ago
  GP probably has password login turned off in sshd...
- Fnoord 8y ago
  > Exposing an sshd to the public internet seems very risky. IPv6 or not. That depends on factors. Personally, I prefer an SNT/VPN such as ZeroTier or WireGuard. SSH would suffice, so would SSH over Tor. Thing is though; you only need to expose 1 of these to public internet. The rest is redundant. Which can be useful though.
- jacob019 8y ago
  disable password authentication, ssh keys are secure enough
  - 8y ago

StefanWallin 8y ago

> "At WWDC 2015 Apple announced the transition to IPv6-only network services in iOS 9. Starting June 1, 2016 all apps submitted to the App Store must support IPv6-only networking." In effect this is not true, as a developer without the time to fully implement IPv6-only networking I've been slapped with this rule in the app store review guidelines for non-complying apps numerous times. Just submit a new review and you'll get another reviewer who does not check this and you'll pass. The rule they cite is also that you have to be able to support IPv6 for iPad-apps, not iPhone apps... So even if it's the rule, I think that in reality it's not going to be true for all the users apps.

okket 8y ago
A rule that is not enforced properly does not invalidate the rule. Do you want to rely for your app to get approved to get a non-enforcing reviewer forever in the future? Also think of your customers on networks like TMo.
tzahola 8y ago
What prevents you from supporting IPv6-only networking? HTTP libraries support it out of the box. If you use sockets, just update them to use PF_INET6 and it'll be backward-compatible with IPv4 through IPv4-embedded IPv6 addresses.

singularity2001 8y ago

Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? With IPv4 my ISP has to shuffle IPs with every reconnect. With IPv6 you could get one IP for lifetime? While ISP that hand out a static IPv4 can exist, it's much more unlikely, whereas with IPv6 it will become the norm.

claudex 8y ago
Some ISP provide a different IPv6 at each connection (to sell static IPv6 at higher price). Other ISP provide a /56, which means, you can shuffle on a lot of /64 on your own. Morevover, there is the privacy extension for IPv6 that change the local part of the IPv6 at regular interval to avoid tracing.
- tjoff 8y ago
  I wouldn't be surprised if it will be trivial to look at a certain IP and query how large pool that particular ISP are allocating for each user.
rnhmjoj 8y ago
In the worst case the ISP will give you a /64 prefix which you can complete to form an IPv6 address via SLAAC. Operating systems will generate many different temporary addresses with a short lifetime and use those for outbound connections to reduce tracking.
lmns 8y ago
You should have a look at the IPv6 privacy extensions. IPv6 doesn't work as you think it does. Your devices use temporary IPs even with a static IPv6 prefix.
- singularity2001 8y ago
  Can't trackers just map the prefix to your id, or do many users share a prefix? will look it up...

skrause 8y ago

Looking at mechanisms like 464XLAT, why are these currently favored over DS-Lite [1]? To me DS-Lite seems like a simple and elegant solution if you don't have a lot of public IPv4 addresses, 464XLAT looks much more compilcated. [1] https://en.wikipedia.org/wiki/IPv6_transition_mechanism#Dual-Stack_Lite_(DS-Lite) https://en.wikipedia.org/wiki/IPv6_transition_mechanism#Dual...

azernik 8y ago
464XLAT is simpler because it gets to piggyback off of other infrastructure that is already in place for forward-compatibility, namely NAT64 and DNS64. Not sure how much of this background you need, but since Wikipedia doesn't explain it well: as an ISP, you want your IPv6-only customers to be able to access the IPv4 internet. So you represent the entire IPv4 internet as an IPv6 prefix (generally ::ffff:0:0:0/96) and get IPv6 clients to send their IPv4 traffic to that subnet. So e.g. if they user wants to access an IPv4 service at 1.2.3.4, you instead send them a DNS response with the address ::ffff:0:12:34. Then you route packets to the "IPv4 subnet" to a system that both does NAT and translates packets from v4 to v6. The main point here is that you have to implement this or some other non-DS-Lite solution, because it solves a problem that DS-Lite does not address: support for IPv6-only clients on an IPv6-only ISP that still want to talk to old IPv4 servers. Where this gets interesting is that once you've implemented NAT64 + DNS64, a solution to the backward-compatibility problem falls out neatly - convert IPv4 packets to IPv6 packets using a reverse of the protocol-aware translation that NAT64 boxes do, and then feed those into the NAT64-enabled network. So the marginal complexity for solving the backward-compatibility problem through 464XLAT is lower than implementing all of DS-Lite.
- Fnoord 8y ago
  Would 464XLAT allow you to connect to e.g. Emby over IPv4, SSH port forwarding over IPv4, and BitTorrent to work (where majority of clients use IPv4) where it doesn't with DS-Lite/CGN?
  - azernik 8y ago
    Not sure about BT (there's still a NAT involved, but maybe the more conventional NAT64 allows the usual hole punching techniques to work?) or Emby (no idea what that is). I have no idea why SSH port forwarding wouldn't work with DS- Lite or 464XLAT, since from the network infrastructure's perspective it's a pretty conventional server-client connection.

emilfihlman 8y ago

I just wish IPV6 was mostly about adding more bits to the addresses instead of the clusterfuck that they introduced.

kazen44 8y ago
the "clusterfuck" the introduced is mostly a nice thing in my opinion. Things like MTU path-discovery, NDP and SLAAC make a lot of sense and are definitely improvements over the solutions we have in IPv4. Broadcast makes little sense on a layer 3 perspective. The use of link-local and unique-global addresses also makes sense, and having a different address class for multicast makes implementing multicast more convenient.
- bogomipz 8y ago
  I agree with all of your points. I didn't understand this however: >"and having a different address class for multicast makes implementing multicast more convenient." IPV4 has a different class for multicast as well - the first 4 bits are 1110. IP range 224.0.0.0 - 239.255.255.255. Or did you mean something else?
  - arbitrage 8y ago
    I doubt it, it's conceptually the same, as you say. I think this is just exemplary of just how much most people, even tech people, don't understand the underlying networking paradigm.

dstick 8y ago

I've been following the IPv6 rollout with interest for the last few years from outside the networking / RIR / LIR / ISP community and I have a question if anyone could provide some insights: ARIN is already out of IPv4, RIPE just finished their last /8 and are now going through the remaining available pile - what happens when they're all gone? Won't the world sort of be forced to migrate?

azernik 8y ago
This increases the motivation, but there are methods of delaying the hard requirement to migrate. A smaller patch is to reclaim unused blocks; a bigger one is carrier-grade NAT. e.g. in some countries such as Russia your ISP will allocate you a 10.0.0.0/8 address rather than a publicly-routable one, and will have a NAT between its customers in your city and the publicly-addressable internet. And yes, this is an ugly solution and comes with a lot of problems and costs.
akvadrako 8y ago
You can buy IPv4 addresses on a second-hand market. A few years ago they were about $8 each, with a minimum of 256. Plus you need to pay an RIR member to hold them for you, which incurs about $50/year in RIR fees for Europe. So it's not a big deal yet.
neojima 8y ago
- APNIC ran out in 2011, but has a new-LIR pool remaining - RIPE ran out in 2012, but has a new-LIR pool remaining (part of which is that /8 you mentioned) - LACNIC ran out in 2014, but has a new-LIR pool remaining - ARIN ran out in 2015, and does not have a new-LIR pool - AFRINIC is the only RIR with a general-use pool available As akvadrako says, there's a secondary market, except the current pricing is around 16+USD/IP, with the semi-obvious minimum of a /24 (so, 4000+USD). Given that (in ARIN region) that /24 would have cost you 250USD up-front, it's a marked increase. (Actual current numbers, FWIW: https://www.ipv4auctions.com/customer/account/previous/ https://www.ipv4auctions.com/customer/account/previous/ )

Eech0Shu 8y ago

Sadly the "happy eyeballs" algorithm obscures IPv6 problems. For example some subnets of amazon cloudfront are v4-reachable from my ISP while being v6-unreachable. But others are v6-reachable. When a DNS name points to a mix of v4 and v6 addresses nobody notices the failure because browsers are quick to fall back to v4 and thus the issue never gets reported. The other problem is that such issues are difficult to report in the first place as private customer because customer support is geared towards dealing with user errors or last mile problems.

virtuallynathan 8y ago
Do you have examples of these subnets? ping me @ nahtnow at amazon dot com.
- Eech0Shu 8y ago
  Not at a location where I can check with my home ISP right now. But last time I checked a few days ago it affected some of the AAAA records that docs.rust-lang.org was pointing to. The affected ISP is deutsche telekom. I sent an email to the contact listed in the whois database but didn't get any reply.

tzakrajs 8y ago

Socat is your friend.

gyrfalcon 8y ago

Where is the video/audio presentation? Found it...but unfortunately the recorded button is broken. Why the poster didn't link to it originally is beyond me. Presentation is generally worthless without the presenter. https://pc.nanog.org/static/published/meetings//NANOG73/daily/day_2.html#talk_1645 https://pc.nanog.org/static/published/meetings//NANOG73/dail...