6 ms·

The graph is interesting when you zoom in, much more IPv6 use over the holiday period and also recently during the period of lockdown measures. I would guess th

The graph is interesting when you zoom in, much more IPv6 use over the holiday period and also recently during the period of lockdown measures. I would guess the majority of IPv6 traffic comes from devices on 4G networks. More devices are on 4G when visiting family and friends over the Christmas period and when working remotely.

Faaak 6y ago
IPv6 is much less common on enterprise networks (old firewall which don't support v6 still).
wtallis 6y ago
It's not just 4G. It's consumer networking in general, which isn't held back by legacy enterprise networking equipment. When your residential ISP turns on IPv6 for their network, they also tend to turn on IPv6 for the modem+router combo devices they lease to run your LAN. Or if you're the kind of power user that buys your own router, it's almost certainly new enough to support IPv6.
- neals 6y ago
  Just checked. Mine does support it. Should I turn it on?
- jl6 6y ago
  Does IPv6 on an internal network offer any benefit to enterprises (not talking about ISPs here), who may view NAT as a form of defence in depth?
  - treysis 6y ago
    Yes. It offers better scalability! E.g. at my university, our institute has its own IPv4 /24. That means a maximum of ~253 or so devices. We have exhausted that number and for every new client, an old one has to go. Now with a /64 this would be no problem at all. To mitigate this the IT department is currently using VLAN-tagging for some of the devices. But it gets convoluted. And the more convoluted it gets, the higher is the chance for misconfiguration, errors, and security issues. Yet, they don't want to make the switch to IPv6 already.
    - yyyk 6y ago
      In IPv4-land, it's not an 'internal network' if every device must have an externally routable address - if it is required, IPv6 has an obvious advantage. In the requested scenario (internal Enterprise network), the proper comparison should involved IPv4's 16 million private addresses; I can't see any practical advantage to IPv6 there.
      - Dagger2 6y ago
        It's an internal network if it's inside your networking perimeter. The type of addresses you use on it are irrelevant to that. Most enterprise networks need to be routed to other networks -- either other networks inside the enterprise, networks inside other enterprises or the internet. To make that work sanely all of the networks involved need to use address ranges that don't overlap. RFC1918 is pretty much the definition of overlap, and using it makes things way more complicated than they would otherwise be.
        yyyk 6y ago
        It's fine for IPv6 engineers to want to make everything directly routable, but in IPv4 the difference still matters, and therefore that's the scenario we need to compare against. The IPv6 enterprise argument is 'You might one day have to renumber some devices because some other enterprise might have set up overlapping addresses, therefore you definitely have to renumber everything now, and oh, every time the ISP decides they don't like you, because private addresses are icky'. Obviously that's a hard sell.
        ghshephard 6y ago
        Or you could just say screw it, and use RFC4193, and then all you need to ever worry about is prefix remapping at a few key touch points. Particularly if you don't care about external routing in the first place.
        avianlyric 6y ago
        I’m confused why would this happen? > The IPv6 enterprise argument is 'You might one day have to renumber some devices because some other enterprise might have set up overlapping addresses, therefore you definitely have to renumber everything now, and oh, every time the ISP decides they don't like you, because private addresses are icky'. Obviously that's a hard sell. If you’re an enterprise you would just get your own IPv6 block assignment. It’s not like they’re expensive or hard to get hold of. Companies already buy and manage domains, this is no different. Using a domain you don’t own is just plain stupid, same applies to IPv6 ranges.
  - throw0101a 6y ago
    You don't have to futz around with /24 (or /23) subnets anymore, especially for wireless if you want seamless roaming. The default /64 prefix length can fit the 2^32 public Internet addresses 2^32 times, i.e., 4B Internets can fit in one IPv6 subnet.
  - talideon 6y ago
    Yes, tonnes of benefits. If you've ever been through a merger, you'll know the pain of dealing with getting the everything working when merging networks. That issue doesn't exist with IPv6 to anywhere near the degree because you don't have overlapping RFC1918 space to deal with. IPAM with IPv4 is a massive pain in the backside once you get up to a certain scale, even if you're allocating from 10/8. If you have multiple DCs, you're in for a world of pain. $WORK is having to use internal NATting for some stuff due to us running low on RFC1918 space, but guess what: even that doesn't quite work because there's a lot of software used in DCs that doesn't play at all nice with NAT.
    - throw0101a 6y ago
      > IPAM with IPv4 is a massive pain in the backside once you get up to a certain scale, even if you're allocating from 10/8. Comcast (an US cable ISP) starting deploying IPv6 because they have so many CPE devices that they are out of IPv4 addresses to do management on them. Story from 2010: * https://arstechnica.com/tech-policy/2010/01/comcast-running-out-of-ipv4-addresses-beginning-ipv6-trial/?comments=1 https://arstechnica.com/tech-policy/2010/01/comcast-running-... It's also why Apple mandated at some points that iOS apps had to work on IPv6-only networks: it was a requirement from mobile phone companies, as IPv4 addresses are getting scarce, and mobile telcos don't want to shell out cash, so they use IPv6 on phones and do NAT64.
    - ghshephard 6y ago
      Well - you may have overlapping RFC 4193, but if your network engineers have done their job well, you are randomly choosing from a big honking FD/8 address space, and the odds of a collision are statistically very unlikely.
      - richardwhiuk 6y ago
        FD/8 space? You mean 10.0.0.0/8? No the odds of a collision on 10.0.0.0/8 are high because: - Both corporations probably started allocating from the top - Both corporations probably allocated huge subnets.
  - deleted 6y ago
    [deleted]
  - api 6y ago
    The idea that NAT is in any way related to security needs so badly to die. You don't need NAT for a firewall or access control. NAT is a hack to stretch IPv4 and that's it. Nearly all security intrusions today are "pulled" in anyway via the web, e-mail, update channels, etc., or are injected by human beings via large scale or targeted phishing. I did netsec for a while and during my tenure all the incidents we had were caused by phishing of one form or another. Once you are inside the network, any tiny bit of defense in depth supplied by NAT becomes irrelevant. Security is so full of mindless cargo cultism...
  - topranks 6y ago
    At very least it might cure them of that delusion, and prompt them to use a proper firewall.
- comprev 6y ago
  My parent's BT internet connection got upgraded in the last few months and they were provided a new BT Hub 2 with IPv4/IPv6 enabled. They live in a moderately rural village in the UK.
1f60c 6y ago
My ISP is still refusing to implement IPv6 :-( I don’t have it on 4G, either. edit: am I missing something? The graph shows total IPv6 is 29.86% (which is clearly less than 33.33…%)
- Arnt 6y ago
  You're missing the weekly peak/troughs. The highest weekly peak so far is 33.42%, and the troughs are just below 30% at the moment. The last time the weekly peak was ~30% was in December last year.
tialaramex 6y ago
It is very different week days vs weekends too. Mobile connectivity is part of the answer, especially in the US - but more over businesses tend to have crappy network connectivity which is perversely small-C conservative and that means lots of them are still doing IPv4 even when that's directly contrary to their own needs. Corporate networks tend to have a lot of local policy, and so that's a maintenance burden that probably nobody is paying for so it's just a growing debt for the organisation. Even if every policy was excellent when it was deployed many of them probably hurt by now. At home that stuff tends to get flushed periodically but medium-large businesses have processes to preserve the status quo. The same underlying mechanism that prefers to terminate the 25 year secretary who "made fuss" about a VP putting his hand up her skirt rather than do anything about that senior executive will also prefer to buy $5000 Cisco switches and then disable everything that makes them better than a $50 Costco switch over just buying the Costco switch (let alone using the features of the expensive switch). Change is seen as bad and must be prevented. This hurts for security a lot too. There's a very good chance that accessing work email from a work laptop in the office is meaningfully less safe than accessing GMail on your phone in a random coffee shop because of such policies.
samtheprogram 6y ago
Maybe I'm weird, but I would assume that less devices are using 4G because of the lockdown, at least in the US are similar countries... most people are staying at home, i.e. on their Wifi, right?
danceparty 6y ago
I work on a very large internet property and can confirm that the majority of v6 internet traffic we see is mobile (easily discerned by ASN)

Faaak 6y ago

IPv6 is much less common on enterprise networks (old firewall which don't support v6 still).

wtallis 6y ago

It's not just 4G. It's consumer networking in general, which isn't held back by legacy enterprise networking equipment. When your residential ISP turns on IPv6 for their network, they also tend to turn on IPv6 for the modem+router combo devices they lease to run your LAN. Or if you're the kind of power user that buys your own router, it's almost certainly new enough to support IPv6.

neals 6y ago
Just checked. Mine does support it. Should I turn it on?
jl6 6y ago
Does IPv6 on an internal network offer any benefit to enterprises (not talking about ISPs here), who may view NAT as a form of defence in depth?
- treysis 6y ago
  Yes. It offers better scalability! E.g. at my university, our institute has its own IPv4 /24. That means a maximum of ~253 or so devices. We have exhausted that number and for every new client, an old one has to go. Now with a /64 this would be no problem at all. To mitigate this the IT department is currently using VLAN-tagging for some of the devices. But it gets convoluted. And the more convoluted it gets, the higher is the chance for misconfiguration, errors, and security issues. Yet, they don't want to make the switch to IPv6 already.
  - yyyk 6y ago
    In IPv4-land, it's not an 'internal network' if every device must have an externally routable address - if it is required, IPv6 has an obvious advantage. In the requested scenario (internal Enterprise network), the proper comparison should involved IPv4's 16 million private addresses; I can't see any practical advantage to IPv6 there.
    - Dagger2 6y ago
      It's an internal network if it's inside your networking perimeter. The type of addresses you use on it are irrelevant to that. Most enterprise networks need to be routed to other networks -- either other networks inside the enterprise, networks inside other enterprises or the internet. To make that work sanely all of the networks involved need to use address ranges that don't overlap. RFC1918 is pretty much the definition of overlap, and using it makes things way more complicated than they would otherwise be.
      - yyyk 6y ago
        It's fine for IPv6 engineers to want to make everything directly routable, but in IPv4 the difference still matters, and therefore that's the scenario we need to compare against. The IPv6 enterprise argument is 'You might one day have to renumber some devices because some other enterprise might have set up overlapping addresses, therefore you definitely have to renumber everything now, and oh, every time the ISP decides they don't like you, because private addresses are icky'. Obviously that's a hard sell.
        ghshephard 6y ago
        Or you could just say screw it, and use RFC4193, and then all you need to ever worry about is prefix remapping at a few key touch points. Particularly if you don't care about external routing in the first place.
        avianlyric 6y ago
        I’m confused why would this happen? > The IPv6 enterprise argument is 'You might one day have to renumber some devices because some other enterprise might have set up overlapping addresses, therefore you definitely have to renumber everything now, and oh, every time the ISP decides they don't like you, because private addresses are icky'. Obviously that's a hard sell. If you’re an enterprise you would just get your own IPv6 block assignment. It’s not like they’re expensive or hard to get hold of. Companies already buy and manage domains, this is no different. Using a domain you don’t own is just plain stupid, same applies to IPv6 ranges.
- throw0101a 6y ago
  You don't have to futz around with /24 (or /23) subnets anymore, especially for wireless if you want seamless roaming. The default /64 prefix length can fit the 2^32 public Internet addresses 2^32 times, i.e., 4B Internets can fit in one IPv6 subnet.
- talideon 6y ago
  Yes, tonnes of benefits. If you've ever been through a merger, you'll know the pain of dealing with getting the everything working when merging networks. That issue doesn't exist with IPv6 to anywhere near the degree because you don't have overlapping RFC1918 space to deal with. IPAM with IPv4 is a massive pain in the backside once you get up to a certain scale, even if you're allocating from 10/8. If you have multiple DCs, you're in for a world of pain. $WORK is having to use internal NATting for some stuff due to us running low on RFC1918 space, but guess what: even that doesn't quite work because there's a lot of software used in DCs that doesn't play at all nice with NAT.
  - throw0101a 6y ago
    > IPAM with IPv4 is a massive pain in the backside once you get up to a certain scale, even if you're allocating from 10/8. Comcast (an US cable ISP) starting deploying IPv6 because they have so many CPE devices that they are out of IPv4 addresses to do management on them. Story from 2010: * https://arstechnica.com/tech-policy/2010/01/comcast-running-out-of-ipv4-addresses-beginning-ipv6-trial/?comments=1 https://arstechnica.com/tech-policy/2010/01/comcast-running-... It's also why Apple mandated at some points that iOS apps had to work on IPv6-only networks: it was a requirement from mobile phone companies, as IPv4 addresses are getting scarce, and mobile telcos don't want to shell out cash, so they use IPv6 on phones and do NAT64.
  - ghshephard 6y ago
    Well - you may have overlapping RFC 4193, but if your network engineers have done their job well, you are randomly choosing from a big honking FD/8 address space, and the odds of a collision are statistically very unlikely.
    - richardwhiuk 6y ago
      FD/8 space? You mean 10.0.0.0/8? No the odds of a collision on 10.0.0.0/8 are high because: - Both corporations probably started allocating from the top - Both corporations probably allocated huge subnets.
- deleted 6y ago
  [deleted]
- api 6y ago
  The idea that NAT is in any way related to security needs so badly to die. You don't need NAT for a firewall or access control. NAT is a hack to stretch IPv4 and that's it. Nearly all security intrusions today are "pulled" in anyway via the web, e-mail, update channels, etc., or are injected by human beings via large scale or targeted phishing. I did netsec for a while and during my tenure all the incidents we had were caused by phishing of one form or another. Once you are inside the network, any tiny bit of defense in depth supplied by NAT becomes irrelevant. Security is so full of mindless cargo cultism...
- topranks 6y ago
  At very least it might cure them of that delusion, and prompt them to use a proper firewall.
comprev 6y ago
My parent's BT internet connection got upgraded in the last few months and they were provided a new BT Hub 2 with IPv4/IPv6 enabled. They live in a moderately rural village in the UK.

1f60c 6y ago

My ISP is still refusing to implement IPv6 :-( I don’t have it on 4G, either. edit: am I missing something? The graph shows total IPv6 is 29.86% (which is clearly less than 33.33…%)

Arnt 6y ago
You're missing the weekly peak/troughs. The highest weekly peak so far is 33.42%, and the troughs are just below 30% at the moment. The last time the weekly peak was ~30% was in December last year.

tialaramex 6y ago

It is very different week days vs weekends too. Mobile connectivity is part of the answer, especially in the US - but more over businesses tend to have crappy network connectivity which is perversely small-C conservative and that means lots of them are still doing IPv4 even when that's directly contrary to their own needs. Corporate networks tend to have a lot of local policy, and so that's a maintenance burden that probably nobody is paying for so it's just a growing debt for the organisation. Even if every policy was excellent when it was deployed many of them probably hurt by now. At home that stuff tends to get flushed periodically but medium-large businesses have processes to preserve the status quo. The same underlying mechanism that prefers to terminate the 25 year secretary who "made fuss" about a VP putting his hand up her skirt rather than do anything about that senior executive will also prefer to buy $5000 Cisco switches and then disable everything that makes them better than a $50 Costco switch over just buying the Costco switch (let alone using the features of the expensive switch). Change is seen as bad and must be prevented. This hurts for security a lot too. There's a very good chance that accessing work email from a work laptop in the office is meaningfully less safe than accessing GMail on your phone in a random coffee shop because of such policies.

samtheprogram 6y ago

Maybe I'm weird, but I would assume that less devices are using 4G because of the lockdown, at least in the US are similar countries... most people are staying at home, i.e. on their Wifi, right?

danceparty 6y ago

I work on a very large internet property and can confirm that the majority of v6 internet traffic we see is mobile (easily discerned by ASN)