8 ms·
IPv6 is a crux example of the tradeoff between security and convenience. I understand a lot of the pros of it, and I like them, but... The protocol is certain
by kempbellt 6y ago
IPv6 is a crux example of the tradeoff between security and convenience.
I understand a lot of the pros of it, and I like them, but...
The protocol is certainly much less human-brain-friendly, which gives points for security, but kills in the area of convenience - even for experienced engineers. As someone who frequently manages networks professionally and personally, I constantly need to look up information on the how the address hashing works, CIDR block ranges, short-hand notation, etc, etc...etc (because there is a lot). It's really added a hinderance to my workflow and makes typical network configuration take much longer than it would have before.
It was easy for me to differentiate between LANs and WANs, subnets, etc in IPv4-land because the address space is much more intuitive to work with. CIDR block notation for IPv4 takes a minute to get used to (for new people), but it's easy to learn quickly and understand the ranges of your networks, or at least get a feel for it.
Even after working with IPv6 for over a year, I still do not have an intuitive feel for how many addresses or what address range a CIDR block contains - which is extremely useful for debugging issues. If I can look at an IPv4 address in a log, I can immediately track down what subnet/machine had the issue and dig into the issue. IPv6 requires extra steps, and a lot of them.
Naturally, NAT became a thing for IPv4. I don't know if it was originally introduced as a firewall mechanism or to cut down on publicly used IPs, but it works well for both. IPv6 circumvents the need for NAT, but then we have NPT, which is also unintuitive.
Numbers are much more human friendly, as time has shown. It's easy to understand 127.x.x.x and 192.x.x.x are common prefix to local networks and I think that most people who have worked with computers at all have some understanding of what a "local" network is, but even after reading the article, my brain says "any IPv6 address that starts with an f is probably a special one, but I don't know why, just assume it means something and I'll have to do some Googling about 'prefixes' to figure it out".
I like some of the pros of IPv6, and maybe after another year of usage it might feel more intuitive, but right now it comes with a serious learning curve and anytime I need to work with it, I get an instant headache.
Also, have you ever looked at one screen to mentally grab an IP address and then needed to type it into another? Or asked a coworker for the machine's address so that you can take a look? Get used to using copy-paste a lot, because there's no way that you can glance at a screen for 2 seconds and mentally go, "aaah. Just need to ssh user@aksj:dfja:skja:sviw:eijf:000i:hate:00my:life....easy peasy"
- Dagger2 6y agoI've found v6 is easier to deal with in practice. When you've got a host whose address is 192.168.2.42, but it shows up as 203.0.113.8 to internet hosts, but you had an RFC1918 clash on a few of your acquisitions so some parts of your company access it via 192.168.202.42 and other parts need 172.16.1.42 and your VPN sometimes can't reach it because some home users use 192.168.2.0/24... how is that easier than "the IP is 2001:db8:113:2::42"? > I still do not have an intuitive feel for how many addresses or what address range a CIDR block contains This is just lack of practice, not an issue with v6. Also, v6 subnets are basically always /64, so the answer to the question of how many addresses are in them is always who cares it's enough. I find v4 and its fiddly /27s and /21s much more of a pain (partly because, yes, I'm out of practice dealing with them). Same deal with knowing the prefixes. 'fd' is "RFC1918", 'fe' is link-local, 'ff' is multicast. This isn't hard stuff. > 192.x.x.x are common prefix to local networks This is 99.6% wrong. I guess v4 isn't _that_ simple, huh?
- kempbellt 6y agoAside from occasional snark, I don't understand most of your comment, and certainly don't see any good points that support IPv6 over IPv4. > This is 99.6% wrong. I guess v4 isn't _that_ simple, huh? Apologies for not being concise enough, I thought my point would have stuck regardless... 192.168.x.x You are correct though. Mistakes also happen with v4 and it's not simple to a laymen, but it is certainly simpler than v6.
- Dagger2 6y agoI think v6 is simpler in practice, due to not needing NAT. If the first part of my post is difficult to understand then that serves as a good demonstration of how hard v4 is once address exhaustion and NAT enter the picture.