4 ms·

I'm not clear that IPv4 doesn't offer at least one measure of reduction against a DDoS, and that's just one time hits every second from 1 quadrillion unique IPv

I'm not clear that IPv4 doesn't offer at least one measure of reduction against a DDoS, and that's just one time hits every second from 1 quadrillion unique IPv6 addresses. You simply can't have that level of problem in IPv4. However, I have never been on the inside of a DDoS attack, so I don't speak from experience on this. In regards to mitigation, what we are talking about is an exclusive network with central controllers in the form of ICANN. Every packet has digital footprints, so what ICANN could do is permit IP address blocks to be seized and transferred when it is demonstrated the owners are consistently using the network for purposes of doing harm, even when it is through negligence. This would work its way through the service level agreements between various ISPs. As in the rest of the business world, you cannot just dump your garbage onto someone's property without eventually being forced to pay for it.

api 5y ago
IPv6 /64 prefixes are analogous to the role IPv4 addresses typically play. Most cloud endpoints have one or more /64s and most endpoint connections from ISPs get a /64. Yes this does mean your house can have 18,446,744,073,709,551,616 devices in it with unique public addresses, but they're behind one /64. When DDOS black holing is done the recipient will actually look up the BGP advertised prefix from which the attack is coming and black hole the whole thing. Many IPv6 prefixes are /32 and /48. I am pretty deeply familiar with this stuff. There's nothing about IPv6 that makes current mitigation techniques much harder. The most logical explanation for IPv4-only in the DDOS protection world is just to limit the attack surface by picking the lowest common denominator address. That way you only have to defend in the IPv4 realm instead of in two addressing realms. IPv6-only would give you the same effect but there are still too many edge devices without IPv6 addresses to use IPv6 alone for anything public facing. IPv6-only systems are sometimes used in private networks, as bastion boxes, etc.
welterde 5y ago
With spoofed addresses (which are not uncommon in ddos attacks) you have exactly the same issue with IPv4. And I don't really see it making any difference if the packets contain 32bit of random information or 128bit.

api 5y ago

IPv6 /64 prefixes are analogous to the role IPv4 addresses typically play. Most cloud endpoints have one or more /64s and most endpoint connections from ISPs get a /64. Yes this does mean your house can have 18,446,744,073,709,551,616 devices in it with unique public addresses, but they're behind one /64. When DDOS black holing is done the recipient will actually look up the BGP advertised prefix from which the attack is coming and black hole the whole thing. Many IPv6 prefixes are /32 and /48. I am pretty deeply familiar with this stuff. There's nothing about IPv6 that makes current mitigation techniques much harder. The most logical explanation for IPv4-only in the DDOS protection world is just to limit the attack surface by picking the lowest common denominator address. That way you only have to defend in the IPv4 realm instead of in two addressing realms. IPv6-only would give you the same effect but there are still too many edge devices without IPv6 addresses to use IPv6 alone for anything public facing. IPv6-only systems are sometimes used in private networks, as bastion boxes, etc.

welterde 5y ago

With spoofed addresses (which are not uncommon in ddos attacks) you have exactly the same issue with IPv4. And I don't really see it making any difference if the packets contain 32bit of random information or 128bit.