4 ms·

There are a couple of reasons: - There are limits to how many devices you can put behind a single IPv4 address. There is the case of Belgium where law enforcem

by phicoh 8y ago

There are a couple of reasons: - There are limits to how many devices you can put behind a single IPv4 address. There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Obviously for law enforcement, if an address is shared between multiple customers it makes investigations harder. - A second problem it that you may lose geographical resolution if customers for a wide area share a pool of addresses. For some ad placement you really want to know where addresses are. - But the bigger problem is that network speeds keep growing. Compared to an IPv6 router, boxes that can do NAT at a large scale and high speed are quite expensive. So an ISP has an incentive to move traffic volume to IPv6. Relatively low volume oddball sites can go over the NAT box.

geofft 8y ago
Do these arguments not apply to IPv6 customers speaking to legacy IPv4 sites? They also have to go through IPv4 NAT, it's just that the NAT is converting it to a public IPv6 address instead of a CGNAT IPv4 one. Wouldn't law enforcement and ad targeting be equally unhappy by piles of IPv6 users being converted to the same IPv4 address? If enough of the Internet is running IPv6 that you save significantly on performance by bypassing NAT for IPv6 sites only, that seems worthwhile, sure. But also I'd intuitively find that surprising, at least at present - maybe my intuitions are just wrong about how much IPv6 there is.
- phicoh 8y ago
  For ad networks, the sensible thing to do is to support IPv6. Then any ISP with CGNAT only has to enable IPv6 to make it work. I have no clue what law enforcement plans to do. Video services use most of the bandwidth. So with youtube and netflix on IPv6, you can easily have most the traffic go over IPv6.
- Dagger2 8y ago
  The most recent figures I've heard were that something like 40-60% of traffic (by bytes) on a dual-stacked client ISP will go over v6. I heard that stat about 4-5 years ago, so it seems reasonable to expect it to be even higher nowadays. Another advantage is that v6 is easy to hand off early, but if you're CGNATing v4 then your v4 traffic has to go via your CGNAT routers. For cost reasons you probably want as few of those as possible, which means v4 traffic may need to go further to reach them. T-Mobile in the US is like this; v6 traffic is passed off as soon as possible and gets a relatively direct network path, but v4 traffic has to go all the way to one of their datacenters to get NATed. That can add a lot of latency.
- devdas 8y ago
  But you would have far fewer connections behind the IPv6 - IPv4 NAT. Then the performance problems are limited to sites without IPv6.
logifail 8y ago
>> There are limits to how many devices you can put behind a single IPv4 address. Do you mean ~65k devices behind a single public IPv4 address? [0] >> There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Well if law enforcement in Belgium asked, of course we all need to immediately work to redesign the global IPv4 internet to comply. </sarc> [0] https://learningnetwork.cisco.com/thread/81720 https://learningnetwork.cisco.com/thread/81720
- richardwhiuk 8y ago
  > Do you mean ~65k devices behind a single public IPv4 address? [0] That's an absolute limit of 2^16 (65k) - the practical limit is much lower. If you only allow one connection per client, then yes, you can get to 65k with TCP/UDP. If you want more than one connection per client (e.g. because the user wants to download content from Facebook while also downloading a YouTube advert), you need to allocate multiple ports on the NAT device. I'd imagine that most clients need at least 2^4, and possibly up to 2^8 simultaneous connections to ensure that you don't introduce problems. At the level, you have a limit of 2^8 - 2^12 clients (i.e 256 - 4096).
  - buzer 8y ago
    You can actually get more than 65k connections per address depending on NAT technology. Traffic coming from 1.1.1.1:80 to 9.9.9.9:12121 can be mapped to 192.168.1.1:3333 while traffic coming from 2.2.2.2:80 to 9.9.9.9:12121 can be mapped to 192.168.1.100:9999. GCNAT devices usually support that.
  - zzzcpan 8y ago
    The 65k limit only applies to concurrent connections to the same remote ip and port. Meaning that you can only make 65k connections from a single IP to the same port of another IP. Which is unlimited for all practical purposes. However, popular services that could potentially see a lot of connections - ban IP addresses, do rate limiting, don't allow that many connections from a single IP. This in turn drives policies of small number of clients per IP, sometimes even rotating IPs, all to minimize effect of bans on users sharing the same IP.

by phicoh 8y ago

geofft 8y ago

Do these arguments not apply to IPv6 customers speaking to legacy IPv4 sites? They also have to go through IPv4 NAT, it's just that the NAT is converting it to a public IPv6 address instead of a CGNAT IPv4 one. Wouldn't law enforcement and ad targeting be equally unhappy by piles of IPv6 users being converted to the same IPv4 address? If enough of the Internet is running IPv6 that you save significantly on performance by bypassing NAT for IPv6 sites only, that seems worthwhile, sure. But also I'd intuitively find that surprising, at least at present - maybe my intuitions are just wrong about how much IPv6 there is.

phicoh 8y ago
For ad networks, the sensible thing to do is to support IPv6. Then any ISP with CGNAT only has to enable IPv6 to make it work. I have no clue what law enforcement plans to do. Video services use most of the bandwidth. So with youtube and netflix on IPv6, you can easily have most the traffic go over IPv6.
Dagger2 8y ago
The most recent figures I've heard were that something like 40-60% of traffic (by bytes) on a dual-stacked client ISP will go over v6. I heard that stat about 4-5 years ago, so it seems reasonable to expect it to be even higher nowadays. Another advantage is that v6 is easy to hand off early, but if you're CGNATing v4 then your v4 traffic has to go via your CGNAT routers. For cost reasons you probably want as few of those as possible, which means v4 traffic may need to go further to reach them. T-Mobile in the US is like this; v6 traffic is passed off as soon as possible and gets a relatively direct network path, but v4 traffic has to go all the way to one of their datacenters to get NATed. That can add a lot of latency.
devdas 8y ago
But you would have far fewer connections behind the IPv6 - IPv4 NAT. Then the performance problems are limited to sites without IPv6.

logifail 8y ago

>> There are limits to how many devices you can put behind a single IPv4 address. Do you mean ~65k devices behind a single public IPv4 address? [0] >> There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Well if law enforcement in Belgium asked, of course we all need to immediately work to redesign the global IPv4 internet to comply. </sarc> [0] https://learningnetwork.cisco.com/thread/81720 https://learningnetwork.cisco.com/thread/81720

richardwhiuk 8y ago
> Do you mean ~65k devices behind a single public IPv4 address? [0] That's an absolute limit of 2^16 (65k) - the practical limit is much lower. If you only allow one connection per client, then yes, you can get to 65k with TCP/UDP. If you want more than one connection per client (e.g. because the user wants to download content from Facebook while also downloading a YouTube advert), you need to allocate multiple ports on the NAT device. I'd imagine that most clients need at least 2^4, and possibly up to 2^8 simultaneous connections to ensure that you don't introduce problems. At the level, you have a limit of 2^8 - 2^12 clients (i.e 256 - 4096).
- buzer 8y ago
  You can actually get more than 65k connections per address depending on NAT technology. Traffic coming from 1.1.1.1:80 to 9.9.9.9:12121 can be mapped to 192.168.1.1:3333 while traffic coming from 2.2.2.2:80 to 9.9.9.9:12121 can be mapped to 192.168.1.100:9999. GCNAT devices usually support that.
- zzzcpan 8y ago
  The 65k limit only applies to concurrent connections to the same remote ip and port. Meaning that you can only make 65k connections from a single IP to the same port of another IP. Which is unlimited for all practical purposes. However, popular services that could potentially see a lot of connections - ban IP addresses, do rate limiting, don't allow that many connections from a single IP. This in turn drives policies of small number of clients per IP, sometimes even rotating IPs, all to minimize effect of bans on users sharing the same IP.