17 ms·

Ripe NIC: 'In Five Weeks We'll Run Out of IPv4 Internet Addresses'

136 points by dyslexit 7y ago

deleted 7y ago
[deleted]
jasonvorhe 7y ago
Finally. I can't wait for the outcome of this. We'll probably waste another couple of years with more NAT and other hacky short-term solutions, but in the long run adopting IPv6 is inevitable.
- tenebrisalietum 7y ago
  NAT destroys the end-to-end principle and encourages things like CGNAT, which make side-stepping centralized services impossible. I really hope IPv6 starts becoming commonplace and that the outcome isn't that CGNAT becomes the norm for residential Internet connections.
  - cnst 7y ago
    The best part about IPv6 is that it's now possible to SSH directly into your laptop if you're using a hotspot from T-Mobile US, for example — it gives you at least a whole /64, so, your laptop gets a fully-routable IPv6 address. Which is kind of ironic, because you don't get that with most wireline connections, as they're all done through IPv4 NAT.
    - cfallin 7y ago
      This is my favorite bit about native IPv6 at home [0]. No more port forwarding to expose particular services -- I can just `ssh desktop.home.net` or `ssh other.home.net`, and they both get to run on default ports! (Of course, one probably wants a firewall -- I block inbound IPv6 by default except ssh.) [0] Comcast is surprisingly good here -- they'll give you a /60 (16 /64 networks) if you ask for it with the right DHCP option!
      - floren 7y ago
        > [0] Comcast is surprisingly good here -- they'll give you a /60 (16 /64 networks) if you ask for it with the right DHCP option! Can you go into more detail or point me to instructions? I'm on Comcast and would be interested in getting v6 at home.
        Aloha 7y ago
        I think Comcast is native dual stack across their entire footprint so long as you have new enough hardware
        cfallin 7y ago
        Sure! The keyword to look for is "DHCP-PD" (DHCP prefix delegation). I run a little OpenBSD router and my dhcpcd.conf is here [1], but I've done this before on a Linux router box too -- here are some instructions from Arch's wiki [2]. IIRC, the stock firmware on my old consumer router was also able to request a prefix and advertise it on the network. [1] https://gist.github.com/cfallin/e5865a6a93c75ace8d26d6a85287ed76 https://gist.github.com/cfallin/e5865a6a93c75ace8d26d6a85287... [2] https://wiki.archlinux.org/index.php/IPv6#Prefix_delegation_(DHCPv6-PD) https://wiki.archlinux.org/index.php/IPv6#Prefix_delegation_...
        xfalcox 7y ago
        I want to study about the technologies around this part of networking, prefix delegation, radvd, etc. Any materials you can recommend?
        sedachv 7y ago
        Hagen's _IPv6 Essentials_ covers the basics, Coffeen's _IPv6 Address Planning_ shows the amazing things you can do with IPv6.
      - virusduck 7y ago
        Do you also have an IPv4 address that you can use for NAT for those things that cant use IPv6? (Also do you have devices that aren't capable of using IPv6?)
    - dvdbloc 7y ago
      Was the former more secure? Most people don’t want their laptop exposed with a fully routable address.
      - cnst 7y ago
        That's why you have firewalls. You're already often exposed to all the other users in your coffee shop anyways. SSH is normally not enabled, either.
      - rohan1024 7y ago
        If you are on Ubuntu, you can run sudo ufw default deny incoming and your laptop is now secure.
      - msbarnett 7y ago
        NAT is not a security measure. You want a firewall regardless of whether you’re running IPv4 or IPv6
      - booi 7y ago
        What do you do for something like printers? I highly doubt Epson's "firewall" is totally secure.
        jlgaddis 7y ago
        IMO, the "right" answer is that printers go on their own subnet. Access control is managed on their default gateway.
        Jonnax 7y ago
        Your home has a gateway router. You can configure firewall rules on that. In fact, the default is almost always to disallow all inbound and allow all outbound.
    - apk17 7y ago
      Theoretically, yes. Practically, my laptop is in some Wifi network and has an IPv6 address, but that isn't accessible from the outside because the Wifi/router box blocks incoming connection. That is a wise decision overall, but unforunately replaces the "can't connect because NAT" by "glorious IPv6, bit still can't connect". And I'm not the owner of those boxes.
      - cnst 7y ago
        It depends.™ I've had a static IPv4 subnet allocation from AT&T on AT&T U-verse, and tried using it on a couple of consumer routers for the local network. Well, guess what — all these devices from major brands that are called "routers" don't actually route between the interfaces, after all — all they did was NAT between my public IPv4 allocation and the main IPv4 address assigned by DHCP. And disabling the NAT simply disconnected the networks — instead of rounting one interface to the other. I actually opened up a support ticket with ZyXEL, which got escalated to their engineering managers, and they did confirm my finding that their routers had a bug in sysctl settings that stops them from routing the interfaces (e.g., sysctl net.ipv4.ip_forward not set to 1). Anyhow, back to T-Mobile US IPv6 on a hotspot — when I originally tried ssh'ing back to my own box via the public IPv6, things didn't work, either; but I then found out that it was some sort of a local policy on the local machine, because another laptop without a firewall was able to receive connections on IPv6 from the internet without any issues.
        anticensor 7y ago
        Were they all just selling NAT-ing bridges instead of routers? This is a serious fraud.
  - apk17 7y ago
    From my vantage point, it is already. The only parties that don't have IPv6 are my employer (which I maybe need to nag about since we're an ISP and have our own AS), and the customer I'm dealing with.
  - JohnFen 7y ago
    > NAT destroys the end-to-end principle Yes, and that precisely why I use it in my home network, and will continue to use is with IPv6. I explicitly don't want any IP addresses in my green zone to be directly accessibly from my red zone.
    - Dagger2 7y ago
      Then you're doing something very wrong. You can't rely on NAT to stop connections, because that's not a thing NAT does. You need to be using a firewall. NAT is just an extra, useless, complicated and unnecessary thing to be adding to the top of that; one that makes it hard to understand how your network is even working, and which makes it harder rather than easier to secure.
      - umanwizard 7y ago
        Can you explain how an outside person (other than my ISP) can make an outside connection to my laptop despite being behind a NAT? Assuming for concreteness that my laptop's internal (NATted) address is 192.168.1.123 and my router's public address is 123.45.67.89. What sequence of commands would you type to open a TCP connection to my laptop?
        takeda 7y ago
        NAT is implemented on a firewall, the blocking of incoming connections is a side effect and isn't even intentional (that's why UPnP exists). Since you already have a firewall you can just add a single rule that block incoming connections and that's all you actually need.
        ATsch 7y ago
        You are right that it would be hard to open a TCP connection with you on a specific target port on a 1:N NAT without UPnP. If you could, IPv4 exhaustion would not be an issue. However, NAT is just a mapping from an internal IP to an external Port number. With pure NAT, once you have created a connection to the outside, anyone can send packets to that external port, and have them delivered to your device. Of course, this mapping is inherently lossy. You are mapping the port space of one device onto N devices. This does mean external IPs can only send your devices packets on ports they have previously used as source ports, but you are still not safe. You might own devices that, for example, have vulnerabilities in their networking stack. Not that rare. You also might not want to disclose the number of devices active in a network, allow them to be fingerprinted by their response, or similar. Some UDP client applications might also not check the IP addresses of incoming packets. UDP server applications also commonly use the same socket for connections to other hosts as it listens on. So, to elaborate on that last example, you might run, say, a video surveillance server. It might listen for RTP on UDP port 12345. It then uses that same socket to send a UDP packet to licensecheck.example.com. That packet will have a source port of 12345. NAT will then map internal_ip:12345 to external_ip:xyz. Anyone can now view your cameras on external_ip:xyz. So either way, you'll want a stateful firewall. Deny incoming, allow outgoing. That's what firewalls are there for, and that's what gives you your security, NAT or no NAT.
- pas 7y ago
  So does RIPE automatically hand out a v6 block for every v4 one, and do the LIRs also, and is there a policy to also hand out zero added cost v6 blocks? No? Oh, okay then.
RijilV 7y ago
AFRINIC has a number of available IPv4 free, across multiple /8s: https://www.afrinic.net/stats/ipv4-pool https://www.afrinic.net/stats/ipv4-pool APNIC has "0.32" of a /8 left: https://www.apnic.net/community/ipv4-exhaustion/graphical-information/ https://www.apnic.net/community/ipv4-exhaustion/graphical-in... ARIN reached zero on Sept 24, 2015: https://www.arin.net/resources/guide/ipv4/ https://www.arin.net/resources/guide/ipv4/
- 1996 7y ago
  Can you easily get a free /24 from AFRINIC? What kind of presence do you need? I will soon have to do a small CDN with a POP in ZA. I might as well get the IPv4 from AFRINIC if they have plenty.
  - mike_d 7y ago
    You need to have a business presence in Africa, not just a network presence. Cloudflare abused this long ago by creating a subsidiary on paper in Seychelles just to get as many IPs as possible, while doing no business there.
- anticensor 7y ago
  Public service: LACNIC has 0.09 of a /8 left: https://www.lacnic.net/1039/2/lacnic/ipv4-depletion-phases#tabs-1 https://www.lacnic.net/1039/2/lacnic/ipv4-depletion-phases#t...
peterwwillis 7y ago
We need a Wiki that documents all the problems of migrating from IPv4 to IPv6. Currently it's a scary, unknown process of bumbling into corner cases, which I think is the reason the vast majority of people haven't adopted it into their products. Why do something slow and complicated when you don't need to (yet)? By documenting it fully, it will seem easier, and more people will at least try to adopt IPv6. One of the many things that would speed up adoption is "IPv6 by default". Often it's just a matter of turning on the "IPv6 thing" at the same time as the "IPv4 thing". We need IPv6 name servers added to DHCP leases. We need load balancers to expose IPv6 addresses. We need to provide an AAAA record at the same time as an A record. We need firewall rules for IPv6 at the same time we add one for IPv4. We need SLAAC or DHCPv6 enabled. And we need applications to natively support an "ip address" field that accepts both IPv4 and IPv6 format addresses.
- clarry 7y ago
  > One of the many things that would speed up adoption is "IPv6 by default". This is precisely why I end up searching for the knob to turn off IPv6 in kernel after installing a new system. That is, if I remember to do so. And then I curse because the system's (or application's) name resolver still keeps performing AAAA queries and breaking because IPv6 doesn't actually work. Recent example: https://bugzilla.mozilla.org/show_bug.cgi?id=1582686 https://bugzilla.mozilla.org/show_bug.cgi?id=1582686 Please don't enable anything by default unless it's actually working.
  - IcePic 7y ago
    > Please don't enable anything by default unless it's actually working Then again, we know news of v4 running out and v6 being the only usable replacement has been running for .. 20 years? If people start _now_ and test what v6 means, then we get what we deserve. Not pointing only to you, but equally the server ends mentioned in this thread also. IANA released its last allocations 8 years ago, how much more forewarning do people need in order to actually move their butts? If you get v6 issues today, it is only because people put their heads in the sand and decided "hey, I have this one machine with a v4 on which I can serve data, I don't need to worry about this issue ever". Having to fiddle with do-or-do-not-resolve-v6 to make stuff work is something we should have spent time on in 2003 or so.
shaki-dora 7y ago
I recently decided on a whim to try an IPv6-only VPS which was something like 70% off at my provider. It being for internal stuff only, I thought it shouldn't be too much of a problem. As it turns out, not even the Ubuntu repositories are reachable over IPv6. I believe this was the PPA server, which held some package I needed for some workaround for all the other connectivity problems. So let's hope a few important people/companies/institutions start to be slightly inconvenienced. I bet as soon as this rises to the concern of, say, some peoples' Netflix stream stuttering it's a matter of weeks to solve it.
- Liquix 7y ago
  Forgive my naiveté - how does running out of IPV4 addresses result in Netflix stuttering? I'm viewing it a binary problem (you either have an IP and have internet, or you're fighting to get an IP and have no internet) but that seems incorrect.
  - orev 7y ago
    I could imagine if your ISP has some big NAT plant that’s overloaded, it would cause connection problems with traffic getting congested at the NAT devices.
    - Liquix 7y ago
      Makes sense, thanks :)
    - toast0 7y ago
      Not just raw bandwidth, but also NAT relies on session tracking, and the NAT device has a limited amount of memory and therefore sessions available. It's often a lot easier to augment bandwidth than to augment available sessions.
  - oarsinsync 7y ago
    Peering policies between networks are protocol dependent. You have ipv4 peering and you have ipv6 peering. When your ipv4 peering sessions have problems, as that accounts for >90% of your traffic, you notice and you notice fast. If you don’t, your customers will notice for you. When your ipv6 peering sessions have problems, you may not notice for days, weeks or even months. Source: it took 3 months before the first customer complaint came in about the entire v6 network being down on a network otherwise passing over 1Tbps at peak daily.
purerandomness 7y ago
In the meantime, we still can't have a web server running on a GCP instance that uses an IPv6 address and does TLS termination with your own certificate at the same time.
ergothus 7y ago
Stupid question: Everytime I'm given the option to work with v4 or v6 (which, granted, is not often) I do v4 for one silly, stupid reason: I can remember a v4 address for, like the 10 minutes while configuring that I might at any moment have to record/enter it somewhere. (So: Not just once, but being able to have it as needed in a small time window) What do people do with v6? Have better memories than me? cut-and-paste repeatedly as needed? While I do less-and-less sysadmin work over time, even on my home network, there are opportunities to get more comfortable with v6 that I've skipped because of this, yet I never see anyone talking about it.
- briffle 7y ago
  We use DNS... Its been around about as long as IPv4
  - azinman2 7y ago
    DNS doesn’t help when you’re having to manually enter an IP into a config, which is what the OP implied.
    - oarsinsync 7y ago
      If an application supports IPv6, it should support DNS. If it doesn’t support DNS, that feels like a bug. The only configuration item that should require manual entry of an IPv6 address is a NIC. Even that has other mechanisms. Everything else should support DNS. Edit: doh, the second place is the dns zone file
      - Paperweight 7y ago
        So you gotta log into your registrar and copy paste your IPv6 address and wait god knows how long for it to propagate...
        oarsinsync 7y ago
        Or you can host your own dns. Or you can get a decent dns host. It doesn’t need to be your domain registrar, much like you don’t need your website or email hosted with your domain registrar.
xfalcox 7y ago
If every engineer took the extra 10 minutes to enable IPv6 for their AWS services we would have a much better availability. I believe it's less than 50 lines of Terraform code to enable it for the standard Application Load Balancer use case.
- regecks 7y ago
  I have the opposite experience when it comes to availability. I sell some software that runs on servers, and we used to get so many tickets that came down to the server's IPv6 transit being busted in sometimes obvious, sometimes subtle ways. And then we have to fight with their NOC to convince them something is broken. IPv6 is an afterthought in many networks. There is less peering, less monitoring, less users overall to uncover issues. It got so tedious to deal with that support burn that I just changed our software to not dual-stack any of its outgoing connections. Not heard a peep since.
  - xfalcox 7y ago
    Does the software runs well under heavy CGNAT? Because that is where we are going if everyone follows you.
    - seppel 7y ago
      The whole problem with ipv6 is that earlier adaptors have not much advantages (while still having to support ipv4 anyway) whereas late adaptors will have it much easier (better ecosystems, much less bugs anywhere else, problems are documented and well understood, infrastructure is tested, etc.). The incentives from the business side are just plain wrong. They can change when CGNAT causes problems. But they don't as long as other stuff is more important.
    - saurik 7y ago
      What is the concrete problem you envision from "heavy CGNAT"?
- paulddraper 7y ago
  Lots of networks and software is broken on ipv6. The more you use ipv4, the more reliable things are. Someday that will hopefully change.
eat_veggies 7y ago
I believe even Hacker News is inaccessible via ipv6. https://news.ycombinator.com/item?id=19833362 https://news.ycombinator.com/item?id=19833362 I noticed this at my parents' house, where their new wifi setup was toggled to "ipv6 only" mode, and HN didn't work.
- pera 7y ago
  $ ping -6 news.ycombinator.com ping: news.ycombinator.com: Name or service not known There is no AAAA record :/
- icebraining 7y ago
  Accessing an IPv4-only website from IPv6 is not a major problem. A NAT64 gateway to access such legacy services works fine. IPv4-only clients is another issue.
  - p1mrx 7y ago
    Running an IPv4-only website becomes a problem as ISPs migrate their IPv4 traffic to NAT44/NAT64, and you can no longer tell users apart for abuse detection purposes.
    - icebraining 7y ago
      If you run a dual-stack site, the attackers can just use your IPv4 (if their ISP gives them a private one) or the equivalent NATed IPv6 (forcing the use of NAT64) instead of your real IPv6.
      - p1mrx 7y ago
        Sure, but you can block the attacking IPv4 addresses without affecting normal IPv6 users. This is why it's a good idea for ISPs to deploy IPv6 alongside NAT, and for browsers to prefer IPv6 by default.
    - blotter_paper 7y ago
      > you can no longer tell users apart for abuse detection purposes s/abuse detection/tracking As a user, this sounds like a feature -- but really, there are a ton of other metrics to track most users by (assuming we're talking about abuse done via the actual website interface rather than just flooding ports with packets from a specific IP).
ulkesh 7y ago
I have been hearing this end-of-the-IPv4 world chatter for 10+ years now. While I understand it is a real problem, I wonder if we’ll still be talking about it in the present tense 10 years from now.
- fortran77 7y ago
  It's like "peak oil." They keep saying we'll run out, but if we keep drilling or fracking, we keep finding more.
  - kstrauser 7y ago
    That's a great analogy. Like peak oil, we've passed the point of exhausting the cheap, plentiful reserves. Now we're scrounging for harder-to-get, scarcer deposits which means that the prices of both will go up, inevitably. No, we're not out of oil or IPv4 addresses. It's just getting a lot harder to come by either one, and the writing's on the wall that the invisible hand is able to slap us silly if we don't seriously start migrating to the replacements ASAP.
  - p1mrx 7y ago
    IPv4 addresses are more like land than oil. We're never going to find any more, but they aren't consumed, and existing ones can be traded. IPv6 lets us build in the sky, where space is no longer a constraint.
    - mysterydip 7y ago
      There are no more, but there are a lot wasted. In the early days when it was assumed everything would be publicly accessible, large organizations were given class A's or more.
      - p1mrx 7y ago
        There's a lot of wasted land too (e.g. single-story buildings in the Bay Area.) In any case, many of those "wasted" /8s have been resold for $100M+ in the last decade. Grep this page for "formerly" https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...
magicalhippo 7y ago
I'm currently running a pfSense router at home, which has limited IPv6 support. Does anyone have any suggestions for something with more extensive IPv6 support? Specifically what I need is something which can handle my ISP only handing me a /64, and can smoothly handle prefix changes (update firewall rules etc). Ideally also being able to register/update LAN clients on dyndns service so I don't need to install an update client locally on every device.
- bn7t 7y ago
  I think OPNSense has proper IPV6 support
mingabunga 7y ago
Some ISPs are resorting to CGNAT eg. https://help.2degreesmobile.co.nz/app/answers/detail/a_id/402/~/changes-to-ip-addresses-%28cgnat%29 https://help.2degreesmobile.co.nz/app/answers/detail/a_id/40...
- pkulak 7y ago
  Man, that would suck to be behind one of those.
  - ripdog 7y ago
    I use 2degrees. They gave me a static public IP for free when I asked and justified it. Most people who just browse Facebook and Instagram, watch YouTube and Netflix won't notice a thing.
  - lucb1e 7y ago
    Tell me about it. Rented a place in Amsterdam that came with a Ziggo connection. Wanted to play a game online with someone and I couldn't. No way to host a game. Called support, they said I had a shared ipv4 address. They'd be happy to switch it to a real one but then I'd lose my v6 connection. I didn't know what to tell them. These connections need to come with warning symbols, this isn't what I expect of an Internet connection (I think they deployed "dual-stack lite" but it isn't mentioned in the contract, and even if it is, it should be called "Internet lite"). Still happy with my XS4ALL connection on fiber. Proper /48 subnet and static legacy IPv4 address since ~2011.
    - saurik 7y ago
      Why can't you host a game behind CGNAT? You should be able to use PCP or STUN to establish an incoming port, no?
      - MayeulC 7y ago
        But wouldn't the game itself would have to support something like STUN? AFAIK, it's a handshake between the two ends, made trough a third party server. Both parties need to contact the third party server, then they get an IP:port combination. So you would have to do that, then quickly enter that information in the game client and server, while making sure that the TTL doesn't expire. You might also have to fight your OS a bit. Moreover, STUN doesn't work on symmetrical NAT, where the router uses the incoming address of a packet to route it trough the host. I don't know PCP; I'll look into that. IMO, the solution to the GP's issue is a VPN. Hamachi used to be a popular solution among gamers, I think.
Havoc 7y ago
Now if only my ISP would get onboard. I applaud the 1gbps fibre, but IPV6 has been "in progress" for like 3 years now...
- umanwizard 7y ago
  Verizon FiOS?
  - tambre 7y ago
    IIRC, they plan to deploy IPv6 in 2020 spring. Unfortunately I can't remember the source. And they've had it in few select residential areas as a trial since 2018 autumn [1]. [1]: https://www.dslreports.com/forum/r32136440-Networking-IPv6-working https://www.dslreports.com/forum/r32136440-Networking-IPv6-w...
  - Havoc 7y ago
    Small local player. But they posted on twitter in 2016 that their network is technically ready. Apparently finding the ON switch takes years
nikanj 7y ago
Again?
- Dagger2 7y ago
  Nope, not again. This is the first time that RIPE has ever had more applications for v4 space than v4 ranges to satisfy those applications with (even with the strict limits on how much people can request).
xvilka 7y ago
At the same time, GitHub Pages do not work[1] with IPv6 yet... [1] https://github.community/t5/GitHub-Pages/Cannot-reach-any-github-io-page-via-IPv6/td-p/4021 https://github.community/t5/GitHub-Pages/Cannot-reach-any-gi...
- 1f60c 7y ago
  Not if you don’t use Cloudflare ;-)
- tambre 7y ago
  They used to support IPv6. When they added HTTPS support they removed it because of it [1]. Which is a complete nonsense reason. Using the old IPv6 range works for *.github.io domains even now. But IIRC, you can fetch GitHub Pages custom domains over IPv6 with HTTPS too, but you don't get the correct certificates, because they simply don't have an IPv6 range pointing to the newer HTTPS-supporting infra. [1]: https://github.com/isaacs/github/issues/354#issuecomment-385746014 https://github.com/isaacs/github/issues/354#issuecomment-385...
jakeogh 7y ago
IPv4's inability to label all the things may be a feature. NAT's are like borders in some ways, and prevent fine grained censorship without larger consequences.
nodesocket 7y ago
Is there a graph of the average price of a /24 block of ipv4 addresses? Is the price going to keep appreciating as supply falls until there is no more supply? I.E. is there potential to treat ipv4 addresses like a commodity? I don't see ipv6 being widly adopted (major cloud providers only offering ipv6 for new servers) in the near future.
- Dagger2 7y ago
  https://auctions.ipv4.global/prior-sales https://auctions.ipv4.global/prior-sales https://www.vultr.com/products/cloud-compute/#pricing https://www.vultr.com/products/cloud-compute/#pricing
proverbialbunny 7y ago
When a dns request is sent the dns software most of the worlds ISPs uses pulls both the A and the AAAA record, but the AAAA (ipv6) record takes on average 4x longer than the A record to pull. The dns software short circuits this so what you get back is almost always an ipv4 address. If you're accessing a website, you're almost always going to end up getting its ipv4 address. This is significant, because still the entire internet doesn't support ipv6. (I'm looking at you Sonic.) If website providers can't get a dedicated ipv4 address, they could use some sort of 6to4 like tunnel to support ipv4. But because of the way the current dns software works, by default all of their traffic will run through that ipv4 tunnel. This leaves ipv6 almost exclusively used for p2p or other types of home connections. The future of the internet is shaping up in such a way where websites run over ip4v and end users to have a sort of firewalled ipv4 access, then use ipv6 for everything else. A law that requires ISPs fully support ipv6 may be beneficial.
- 300bps 7y ago
  Is there a reason why certain companies get to retain their originally allocated Class-A netblocks with their 16 million addresses? http://www.aturtschi.com/whois/neta1.html http://www.aturtschi.com/whois/neta1.html Even companies that were given Class-B netblocks with about 65,000 addresses seems a bit wasteful. I remember when I started an ISP in 1996 it was like pulling teeth to get a Class-C with 255 addresses but there Ford sits with 16 million of their own.
  - Dagger2 7y ago
    Yes: those netblocks belong to them and you can't take their stuff just because you like the look of it. There aren't enough addresses in v4. Reclaiming one or two /8s here or there won't fix that. Before IANA runout in 2011, we were going through over one /8 per month, and demand has only gone up since then. Those class Bs you're so worried about would last the internet maybe 2 hours each. You can push as many allocations around as you like, but there just plain and simply isn't enough v4.
- Dagger2 7y ago
  My experience doesn't match that. ISP DNS servers just return the A or AAAA record that they're asked for, and the return time is more or less identical for the two, not 4x longer. All of the client resolvers I've ever used wait for both records to come back, and your DNS resolution returns both sets of addresses. I think OSX does some sort of racing here, but it still gives v6 some amount of head start (~150ms?). Also, Google's published v6 stats say that 29% of their users reach them over v6. That doesn't seem to match with "you're almost always going to end up getting its ipv4 address".
commandersaki 7y ago
Meanwhile ipv6 which had literally one job* remains fairly useless. * that is to avert impending address exhaustion, but it happened, and ipv6 sat idle and did nothing.
- peterwwillis 7y ago
  If that were its only job, the only change would have been 128 bits instead of 32 for the address. There's like a bazillion other changes, unfortunately :(
  - Dagger2 7y ago
    Not as many as you think. It's mostly very similar to v4, and the majority of the changes are to handle the extra address width.
illys 7y ago
Well, to me, the issue of IPv6 adoption is that it is not a natural extension to IPv4, but two different protocols. It requires two settings efforts and additional efforts for interoperability with third parties still limited to IPv4. I am sure there must be some tools to smooth the efforts, but it is not native in the protocols.
neckardt 7y ago
Would it be ethical/useful to overwhelm NATs with addr:port combinations to overflow the NAT's translation table? If NATs start breaking down, it might force upstream to start adopting IPv6. I could see a system of doing this as setting a different port for each outgoing connection. Thoughts?
- rb12345 7y ago
  I doubt it would be either ethical or useful to deliberately overload translation tables. That said, I would imagine that the migration to QUIC and HTTP/3 would increase pressure on NATs. QUIC's use of UDP means that it's harder to safely reuse source ports for connections to different destinations compared to TCP, so the density of connections per external IP address should be lower.

136 points by dyslexit 7y ago

deleted 7y ago

[deleted]

Finally. I can't wait for the outcome of this. We'll probably waste another couple of years with more NAT and other hacky short-term solutions, but in the long run adopting IPv6 is inevitable.

tenebrisalietum 7y ago
NAT destroys the end-to-end principle and encourages things like CGNAT, which make side-stepping centralized services impossible. I really hope IPv6 starts becoming commonplace and that the outcome isn't that CGNAT becomes the norm for residential Internet connections.
- cnst 7y ago
  The best part about IPv6 is that it's now possible to SSH directly into your laptop if you're using a hotspot from T-Mobile US, for example — it gives you at least a whole /64, so, your laptop gets a fully-routable IPv6 address. Which is kind of ironic, because you don't get that with most wireline connections, as they're all done through IPv4 NAT.
  - cfallin 7y ago
    This is my favorite bit about native IPv6 at home [0]. No more port forwarding to expose particular services -- I can just `ssh desktop.home.net` or `ssh other.home.net`, and they both get to run on default ports! (Of course, one probably wants a firewall -- I block inbound IPv6 by default except ssh.) [0] Comcast is surprisingly good here -- they'll give you a /60 (16 /64 networks) if you ask for it with the right DHCP option!
    - floren 7y ago
      > [0] Comcast is surprisingly good here -- they'll give you a /60 (16 /64 networks) if you ask for it with the right DHCP option! Can you go into more detail or point me to instructions? I'm on Comcast and would be interested in getting v6 at home.
      - Aloha 7y ago
        I think Comcast is native dual stack across their entire footprint so long as you have new enough hardware
      - cfallin 7y ago
        Sure! The keyword to look for is "DHCP-PD" (DHCP prefix delegation). I run a little OpenBSD router and my dhcpcd.conf is here [1], but I've done this before on a Linux router box too -- here are some instructions from Arch's wiki [2]. IIRC, the stock firmware on my old consumer router was also able to request a prefix and advertise it on the network. [1] https://gist.github.com/cfallin/e5865a6a93c75ace8d26d6a85287ed76 https://gist.github.com/cfallin/e5865a6a93c75ace8d26d6a85287... [2] https://wiki.archlinux.org/index.php/IPv6#Prefix_delegation_(DHCPv6-PD) https://wiki.archlinux.org/index.php/IPv6#Prefix_delegation_...
        xfalcox 7y ago
        I want to study about the technologies around this part of networking, prefix delegation, radvd, etc. Any materials you can recommend?
        sedachv 7y ago
        Hagen's _IPv6 Essentials_ covers the basics, Coffeen's _IPv6 Address Planning_ shows the amazing things you can do with IPv6.
    - virusduck 7y ago
      Do you also have an IPv4 address that you can use for NAT for those things that cant use IPv6? (Also do you have devices that aren't capable of using IPv6?)
  - dvdbloc 7y ago
    Was the former more secure? Most people don’t want their laptop exposed with a fully routable address.
    - cnst 7y ago
      That's why you have firewalls. You're already often exposed to all the other users in your coffee shop anyways. SSH is normally not enabled, either.
    - rohan1024 7y ago
      If you are on Ubuntu, you can run sudo ufw default deny incoming and your laptop is now secure.
    - msbarnett 7y ago
      NAT is not a security measure. You want a firewall regardless of whether you’re running IPv4 or IPv6
    - booi 7y ago
      What do you do for something like printers? I highly doubt Epson's "firewall" is totally secure.
      - jlgaddis 7y ago
        IMO, the "right" answer is that printers go on their own subnet. Access control is managed on their default gateway.
      - Jonnax 7y ago
        Your home has a gateway router. You can configure firewall rules on that. In fact, the default is almost always to disallow all inbound and allow all outbound.
  - apk17 7y ago
    Theoretically, yes. Practically, my laptop is in some Wifi network and has an IPv6 address, but that isn't accessible from the outside because the Wifi/router box blocks incoming connection. That is a wise decision overall, but unforunately replaces the "can't connect because NAT" by "glorious IPv6, bit still can't connect". And I'm not the owner of those boxes.
    - cnst 7y ago
      It depends.™ I've had a static IPv4 subnet allocation from AT&T on AT&T U-verse, and tried using it on a couple of consumer routers for the local network. Well, guess what — all these devices from major brands that are called "routers" don't actually route between the interfaces, after all — all they did was NAT between my public IPv4 allocation and the main IPv4 address assigned by DHCP. And disabling the NAT simply disconnected the networks — instead of rounting one interface to the other. I actually opened up a support ticket with ZyXEL, which got escalated to their engineering managers, and they did confirm my finding that their routers had a bug in sysctl settings that stops them from routing the interfaces (e.g., sysctl net.ipv4.ip_forward not set to 1). Anyhow, back to T-Mobile US IPv6 on a hotspot — when I originally tried ssh'ing back to my own box via the public IPv6, things didn't work, either; but I then found out that it was some sort of a local policy on the local machine, because another laptop without a firewall was able to receive connections on IPv6 from the internet without any issues.
      - anticensor 7y ago
        Were they all just selling NAT-ing bridges instead of routers? This is a serious fraud.
- apk17 7y ago
  From my vantage point, it is already. The only parties that don't have IPv6 are my employer (which I maybe need to nag about since we're an ISP and have our own AS), and the customer I'm dealing with.
- JohnFen 7y ago
  > NAT destroys the end-to-end principle Yes, and that precisely why I use it in my home network, and will continue to use is with IPv6. I explicitly don't want any IP addresses in my green zone to be directly accessibly from my red zone.
  - Dagger2 7y ago
    Then you're doing something very wrong. You can't rely on NAT to stop connections, because that's not a thing NAT does. You need to be using a firewall. NAT is just an extra, useless, complicated and unnecessary thing to be adding to the top of that; one that makes it hard to understand how your network is even working, and which makes it harder rather than easier to secure.
    - umanwizard 7y ago
      Can you explain how an outside person (other than my ISP) can make an outside connection to my laptop despite being behind a NAT? Assuming for concreteness that my laptop's internal (NATted) address is 192.168.1.123 and my router's public address is 123.45.67.89. What sequence of commands would you type to open a TCP connection to my laptop?
      - takeda 7y ago
        NAT is implemented on a firewall, the blocking of incoming connections is a side effect and isn't even intentional (that's why UPnP exists). Since you already have a firewall you can just add a single rule that block incoming connections and that's all you actually need.
      - ATsch 7y ago
        You are right that it would be hard to open a TCP connection with you on a specific target port on a 1:N NAT without UPnP. If you could, IPv4 exhaustion would not be an issue. However, NAT is just a mapping from an internal IP to an external Port number. With pure NAT, once you have created a connection to the outside, anyone can send packets to that external port, and have them delivered to your device. Of course, this mapping is inherently lossy. You are mapping the port space of one device onto N devices. This does mean external IPs can only send your devices packets on ports they have previously used as source ports, but you are still not safe. You might own devices that, for example, have vulnerabilities in their networking stack. Not that rare. You also might not want to disclose the number of devices active in a network, allow them to be fingerprinted by their response, or similar. Some UDP client applications might also not check the IP addresses of incoming packets. UDP server applications also commonly use the same socket for connections to other hosts as it listens on. So, to elaborate on that last example, you might run, say, a video surveillance server. It might listen for RTP on UDP port 12345. It then uses that same socket to send a UDP packet to licensecheck.example.com. That packet will have a source port of 12345. NAT will then map internal_ip:12345 to external_ip:xyz. Anyone can now view your cameras on external_ip:xyz. So either way, you'll want a stateful firewall. Deny incoming, allow outgoing. That's what firewalls are there for, and that's what gives you your security, NAT or no NAT.
pas 7y ago
So does RIPE automatically hand out a v6 block for every v4 one, and do the LIRs also, and is there a policy to also hand out zero added cost v6 blocks? No? Oh, okay then.

RijilV 7y ago

AFRINIC has a number of available IPv4 free, across multiple /8s: https://www.afrinic.net/stats/ipv4-pool https://www.afrinic.net/stats/ipv4-pool APNIC has "0.32" of a /8 left: https://www.apnic.net/community/ipv4-exhaustion/graphical-information/ https://www.apnic.net/community/ipv4-exhaustion/graphical-in... ARIN reached zero on Sept 24, 2015: https://www.arin.net/resources/guide/ipv4/ https://www.arin.net/resources/guide/ipv4/

1996 7y ago
Can you easily get a free /24 from AFRINIC? What kind of presence do you need? I will soon have to do a small CDN with a POP in ZA. I might as well get the IPv4 from AFRINIC if they have plenty.
- mike_d 7y ago
  You need to have a business presence in Africa, not just a network presence. Cloudflare abused this long ago by creating a subsidiary on paper in Seychelles just to get as many IPs as possible, while doing no business there.
anticensor 7y ago
Public service: LACNIC has 0.09 of a /8 left: https://www.lacnic.net/1039/2/lacnic/ipv4-depletion-phases#tabs-1 https://www.lacnic.net/1039/2/lacnic/ipv4-depletion-phases#t...

peterwwillis 7y ago

We need a Wiki that documents all the problems of migrating from IPv4 to IPv6. Currently it's a scary, unknown process of bumbling into corner cases, which I think is the reason the vast majority of people haven't adopted it into their products. Why do something slow and complicated when you don't need to (yet)? By documenting it fully, it will seem easier, and more people will at least try to adopt IPv6. One of the many things that would speed up adoption is "IPv6 by default". Often it's just a matter of turning on the "IPv6 thing" at the same time as the "IPv4 thing". We need IPv6 name servers added to DHCP leases. We need load balancers to expose IPv6 addresses. We need to provide an AAAA record at the same time as an A record. We need firewall rules for IPv6 at the same time we add one for IPv4. We need SLAAC or DHCPv6 enabled. And we need applications to natively support an "ip address" field that accepts both IPv4 and IPv6 format addresses.

clarry 7y ago
> One of the many things that would speed up adoption is "IPv6 by default". This is precisely why I end up searching for the knob to turn off IPv6 in kernel after installing a new system. That is, if I remember to do so. And then I curse because the system's (or application's) name resolver still keeps performing AAAA queries and breaking because IPv6 doesn't actually work. Recent example: https://bugzilla.mozilla.org/show_bug.cgi?id=1582686 https://bugzilla.mozilla.org/show_bug.cgi?id=1582686 Please don't enable anything by default unless it's actually working.
- IcePic 7y ago
  > Please don't enable anything by default unless it's actually working Then again, we know news of v4 running out and v6 being the only usable replacement has been running for .. 20 years? If people start _now_ and test what v6 means, then we get what we deserve. Not pointing only to you, but equally the server ends mentioned in this thread also. IANA released its last allocations 8 years ago, how much more forewarning do people need in order to actually move their butts? If you get v6 issues today, it is only because people put their heads in the sand and decided "hey, I have this one machine with a v4 on which I can serve data, I don't need to worry about this issue ever". Having to fiddle with do-or-do-not-resolve-v6 to make stuff work is something we should have spent time on in 2003 or so.

shaki-dora 7y ago

I recently decided on a whim to try an IPv6-only VPS which was something like 70% off at my provider. It being for internal stuff only, I thought it shouldn't be too much of a problem. As it turns out, not even the Ubuntu repositories are reachable over IPv6. I believe this was the PPA server, which held some package I needed for some workaround for all the other connectivity problems. So let's hope a few important people/companies/institutions start to be slightly inconvenienced. I bet as soon as this rises to the concern of, say, some peoples' Netflix stream stuttering it's a matter of weeks to solve it.

Liquix 7y ago
Forgive my naiveté - how does running out of IPV4 addresses result in Netflix stuttering? I'm viewing it a binary problem (you either have an IP and have internet, or you're fighting to get an IP and have no internet) but that seems incorrect.
- orev 7y ago
  I could imagine if your ISP has some big NAT plant that’s overloaded, it would cause connection problems with traffic getting congested at the NAT devices.
  - Liquix 7y ago
    Makes sense, thanks :)
  - toast0 7y ago
    Not just raw bandwidth, but also NAT relies on session tracking, and the NAT device has a limited amount of memory and therefore sessions available. It's often a lot easier to augment bandwidth than to augment available sessions.
- oarsinsync 7y ago
  Peering policies between networks are protocol dependent. You have ipv4 peering and you have ipv6 peering. When your ipv4 peering sessions have problems, as that accounts for >90% of your traffic, you notice and you notice fast. If you don’t, your customers will notice for you. When your ipv6 peering sessions have problems, you may not notice for days, weeks or even months. Source: it took 3 months before the first customer complaint came in about the entire v6 network being down on a network otherwise passing over 1Tbps at peak daily.

purerandomness 7y ago

In the meantime, we still can't have a web server running on a GCP instance that uses an IPv6 address and does TLS termination with your own certificate at the same time.

ergothus 7y ago

Stupid question: Everytime I'm given the option to work with v4 or v6 (which, granted, is not often) I do v4 for one silly, stupid reason: I can remember a v4 address for, like the 10 minutes while configuring that I might at any moment have to record/enter it somewhere. (So: Not just once, but being able to have it as needed in a small time window) What do people do with v6? Have better memories than me? cut-and-paste repeatedly as needed? While I do less-and-less sysadmin work over time, even on my home network, there are opportunities to get more comfortable with v6 that I've skipped because of this, yet I never see anyone talking about it.

briffle 7y ago
We use DNS... Its been around about as long as IPv4
- azinman2 7y ago
  DNS doesn’t help when you’re having to manually enter an IP into a config, which is what the OP implied.
  - oarsinsync 7y ago
    If an application supports IPv6, it should support DNS. If it doesn’t support DNS, that feels like a bug. The only configuration item that should require manual entry of an IPv6 address is a NIC. Even that has other mechanisms. Everything else should support DNS. Edit: doh, the second place is the dns zone file
    - Paperweight 7y ago
      So you gotta log into your registrar and copy paste your IPv6 address and wait god knows how long for it to propagate...
      - oarsinsync 7y ago
        Or you can host your own dns. Or you can get a decent dns host. It doesn’t need to be your domain registrar, much like you don’t need your website or email hosted with your domain registrar.

xfalcox 7y ago

If every engineer took the extra 10 minutes to enable IPv6 for their AWS services we would have a much better availability. I believe it's less than 50 lines of Terraform code to enable it for the standard Application Load Balancer use case.

regecks 7y ago
I have the opposite experience when it comes to availability. I sell some software that runs on servers, and we used to get so many tickets that came down to the server's IPv6 transit being busted in sometimes obvious, sometimes subtle ways. And then we have to fight with their NOC to convince them something is broken. IPv6 is an afterthought in many networks. There is less peering, less monitoring, less users overall to uncover issues. It got so tedious to deal with that support burn that I just changed our software to not dual-stack any of its outgoing connections. Not heard a peep since.
- xfalcox 7y ago
  Does the software runs well under heavy CGNAT? Because that is where we are going if everyone follows you.
  - seppel 7y ago
    The whole problem with ipv6 is that earlier adaptors have not much advantages (while still having to support ipv4 anyway) whereas late adaptors will have it much easier (better ecosystems, much less bugs anywhere else, problems are documented and well understood, infrastructure is tested, etc.). The incentives from the business side are just plain wrong. They can change when CGNAT causes problems. But they don't as long as other stuff is more important.
  - saurik 7y ago
    What is the concrete problem you envision from "heavy CGNAT"?
paulddraper 7y ago
Lots of networks and software is broken on ipv6. The more you use ipv4, the more reliable things are. Someday that will hopefully change.

eat_veggies 7y ago

I believe even Hacker News is inaccessible via ipv6. https://news.ycombinator.com/item?id=19833362 https://news.ycombinator.com/item?id=19833362 I noticed this at my parents' house, where their new wifi setup was toggled to "ipv6 only" mode, and HN didn't work.

pera 7y ago
$ ping -6 news.ycombinator.com ping: news.ycombinator.com: Name or service not known There is no AAAA record :/
icebraining 7y ago
Accessing an IPv4-only website from IPv6 is not a major problem. A NAT64 gateway to access such legacy services works fine. IPv4-only clients is another issue.
- p1mrx 7y ago
  Running an IPv4-only website becomes a problem as ISPs migrate their IPv4 traffic to NAT44/NAT64, and you can no longer tell users apart for abuse detection purposes.
  - icebraining 7y ago
    If you run a dual-stack site, the attackers can just use your IPv4 (if their ISP gives them a private one) or the equivalent NATed IPv6 (forcing the use of NAT64) instead of your real IPv6.
    - p1mrx 7y ago
      Sure, but you can block the attacking IPv4 addresses without affecting normal IPv6 users. This is why it's a good idea for ISPs to deploy IPv6 alongside NAT, and for browsers to prefer IPv6 by default.
  - blotter_paper 7y ago
    > you can no longer tell users apart for abuse detection purposes s/abuse detection/tracking As a user, this sounds like a feature -- but really, there are a ton of other metrics to track most users by (assuming we're talking about abuse done via the actual website interface rather than just flooding ports with packets from a specific IP).

ulkesh 7y ago

I have been hearing this end-of-the-IPv4 world chatter for 10+ years now. While I understand it is a real problem, I wonder if we’ll still be talking about it in the present tense 10 years from now.

fortran77 7y ago
It's like "peak oil." They keep saying we'll run out, but if we keep drilling or fracking, we keep finding more.
- kstrauser 7y ago
  That's a great analogy. Like peak oil, we've passed the point of exhausting the cheap, plentiful reserves. Now we're scrounging for harder-to-get, scarcer deposits which means that the prices of both will go up, inevitably. No, we're not out of oil or IPv4 addresses. It's just getting a lot harder to come by either one, and the writing's on the wall that the invisible hand is able to slap us silly if we don't seriously start migrating to the replacements ASAP.
- p1mrx 7y ago
  IPv4 addresses are more like land than oil. We're never going to find any more, but they aren't consumed, and existing ones can be traded. IPv6 lets us build in the sky, where space is no longer a constraint.
  - mysterydip 7y ago
    There are no more, but there are a lot wasted. In the early days when it was assumed everything would be publicly accessible, large organizations were given class A's or more.
    - p1mrx 7y ago
      There's a lot of wasted land too (e.g. single-story buildings in the Bay Area.) In any case, many of those "wasted" /8s have been resold for $100M+ in the last decade. Grep this page for "formerly" https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...

magicalhippo 7y ago

I'm currently running a pfSense router at home, which has limited IPv6 support. Does anyone have any suggestions for something with more extensive IPv6 support? Specifically what I need is something which can handle my ISP only handing me a /64, and can smoothly handle prefix changes (update firewall rules etc). Ideally also being able to register/update LAN clients on dyndns service so I don't need to install an update client locally on every device.

bn7t 7y ago
I think OPNSense has proper IPV6 support

mingabunga 7y ago

Some ISPs are resorting to CGNAT eg. https://help.2degreesmobile.co.nz/app/answers/detail/a_id/402/~/changes-to-ip-addresses-%28cgnat%29 https://help.2degreesmobile.co.nz/app/answers/detail/a_id/40...

pkulak 7y ago
Man, that would suck to be behind one of those.
- ripdog 7y ago
  I use 2degrees. They gave me a static public IP for free when I asked and justified it. Most people who just browse Facebook and Instagram, watch YouTube and Netflix won't notice a thing.
- lucb1e 7y ago
  Tell me about it. Rented a place in Amsterdam that came with a Ziggo connection. Wanted to play a game online with someone and I couldn't. No way to host a game. Called support, they said I had a shared ipv4 address. They'd be happy to switch it to a real one but then I'd lose my v6 connection. I didn't know what to tell them. These connections need to come with warning symbols, this isn't what I expect of an Internet connection (I think they deployed "dual-stack lite" but it isn't mentioned in the contract, and even if it is, it should be called "Internet lite"). Still happy with my XS4ALL connection on fiber. Proper /48 subnet and static legacy IPv4 address since ~2011.
  - saurik 7y ago
    Why can't you host a game behind CGNAT? You should be able to use PCP or STUN to establish an incoming port, no?
    - MayeulC 7y ago
      But wouldn't the game itself would have to support something like STUN? AFAIK, it's a handshake between the two ends, made trough a third party server. Both parties need to contact the third party server, then they get an IP:port combination. So you would have to do that, then quickly enter that information in the game client and server, while making sure that the TTL doesn't expire. You might also have to fight your OS a bit. Moreover, STUN doesn't work on symmetrical NAT, where the router uses the incoming address of a packet to route it trough the host. I don't know PCP; I'll look into that. IMO, the solution to the GP's issue is a VPN. Hamachi used to be a popular solution among gamers, I think.

Havoc 7y ago

Now if only my ISP would get onboard. I applaud the 1gbps fibre, but IPV6 has been "in progress" for like 3 years now...

umanwizard 7y ago
Verizon FiOS?
- tambre 7y ago
  IIRC, they plan to deploy IPv6 in 2020 spring. Unfortunately I can't remember the source. And they've had it in few select residential areas as a trial since 2018 autumn [1]. [1]: https://www.dslreports.com/forum/r32136440-Networking-IPv6-working https://www.dslreports.com/forum/r32136440-Networking-IPv6-w...
- Havoc 7y ago
  Small local player. But they posted on twitter in 2016 that their network is technically ready. Apparently finding the ON switch takes years

nikanj 7y ago

Again?

Dagger2 7y ago
Nope, not again. This is the first time that RIPE has ever had more applications for v4 space than v4 ranges to satisfy those applications with (even with the strict limits on how much people can request).

xvilka 7y ago

At the same time, GitHub Pages do not work[1] with IPv6 yet... [1] https://github.community/t5/GitHub-Pages/Cannot-reach-any-github-io-page-via-IPv6/td-p/4021 https://github.community/t5/GitHub-Pages/Cannot-reach-any-gi...

1f60c 7y ago
Not if you don’t use Cloudflare ;-)
tambre 7y ago
They used to support IPv6. When they added HTTPS support they removed it because of it [1]. Which is a complete nonsense reason. Using the old IPv6 range works for *.github.io domains even now. But IIRC, you can fetch GitHub Pages custom domains over IPv6 with HTTPS too, but you don't get the correct certificates, because they simply don't have an IPv6 range pointing to the newer HTTPS-supporting infra. [1]: https://github.com/isaacs/github/issues/354#issuecomment-385746014 https://github.com/isaacs/github/issues/354#issuecomment-385...

jakeogh 7y ago

IPv4's inability to label all the things may be a feature. NAT's are like borders in some ways, and prevent fine grained censorship without larger consequences.

nodesocket 7y ago

Is there a graph of the average price of a /24 block of ipv4 addresses? Is the price going to keep appreciating as supply falls until there is no more supply? I.E. is there potential to treat ipv4 addresses like a commodity? I don't see ipv6 being widly adopted (major cloud providers only offering ipv6 for new servers) in the near future.

Dagger2 7y ago
https://auctions.ipv4.global/prior-sales https://auctions.ipv4.global/prior-sales https://www.vultr.com/products/cloud-compute/#pricing https://www.vultr.com/products/cloud-compute/#pricing

proverbialbunny 7y ago

When a dns request is sent the dns software most of the worlds ISPs uses pulls both the A and the AAAA record, but the AAAA (ipv6) record takes on average 4x longer than the A record to pull. The dns software short circuits this so what you get back is almost always an ipv4 address. If you're accessing a website, you're almost always going to end up getting its ipv4 address. This is significant, because still the entire internet doesn't support ipv6. (I'm looking at you Sonic.) If website providers can't get a dedicated ipv4 address, they could use some sort of 6to4 like tunnel to support ipv4. But because of the way the current dns software works, by default all of their traffic will run through that ipv4 tunnel. This leaves ipv6 almost exclusively used for p2p or other types of home connections. The future of the internet is shaping up in such a way where websites run over ip4v and end users to have a sort of firewalled ipv4 access, then use ipv6 for everything else. A law that requires ISPs fully support ipv6 may be beneficial.

300bps 7y ago
Is there a reason why certain companies get to retain their originally allocated Class-A netblocks with their 16 million addresses? http://www.aturtschi.com/whois/neta1.html http://www.aturtschi.com/whois/neta1.html Even companies that were given Class-B netblocks with about 65,000 addresses seems a bit wasteful. I remember when I started an ISP in 1996 it was like pulling teeth to get a Class-C with 255 addresses but there Ford sits with 16 million of their own.
- Dagger2 7y ago
  Yes: those netblocks belong to them and you can't take their stuff just because you like the look of it. There aren't enough addresses in v4. Reclaiming one or two /8s here or there won't fix that. Before IANA runout in 2011, we were going through over one /8 per month, and demand has only gone up since then. Those class Bs you're so worried about would last the internet maybe 2 hours each. You can push as many allocations around as you like, but there just plain and simply isn't enough v4.
Dagger2 7y ago
My experience doesn't match that. ISP DNS servers just return the A or AAAA record that they're asked for, and the return time is more or less identical for the two, not 4x longer. All of the client resolvers I've ever used wait for both records to come back, and your DNS resolution returns both sets of addresses. I think OSX does some sort of racing here, but it still gives v6 some amount of head start (~150ms?). Also, Google's published v6 stats say that 29% of their users reach them over v6. That doesn't seem to match with "you're almost always going to end up getting its ipv4 address".

commandersaki 7y ago

Meanwhile ipv6 which had literally one job* remains fairly useless. * that is to avert impending address exhaustion, but it happened, and ipv6 sat idle and did nothing.

peterwwillis 7y ago
If that were its only job, the only change would have been 128 bits instead of 32 for the address. There's like a bazillion other changes, unfortunately :(
- Dagger2 7y ago
  Not as many as you think. It's mostly very similar to v4, and the majority of the changes are to handle the extra address width.

illys 7y ago

Well, to me, the issue of IPv6 adoption is that it is not a natural extension to IPv4, but two different protocols. It requires two settings efforts and additional efforts for interoperability with third parties still limited to IPv4. I am sure there must be some tools to smooth the efforts, but it is not native in the protocols.

neckardt 7y ago

Would it be ethical/useful to overwhelm NATs with addr:port combinations to overflow the NAT's translation table? If NATs start breaking down, it might force upstream to start adopting IPv6. I could see a system of doing this as setting a different port for each outgoing connection. Thoughts?

rb12345 7y ago
I doubt it would be either ethical or useful to deliberately overload translation tables. That said, I would imagine that the migration to QUIC and HTTP/3 would increase pressure on NATs. QUIC's use of UDP means that it's harder to safely reuse source ports for connections to different destinations compared to TCP, so the density of connections per external IP address should be lower.