5 ms·

Maybe people don't want to disclose the number and purposes of interior machines?

silon42 4y ago
Yeah, I had an idea to have an IP for each container (which means almost every "containerized" application soon, possibly even every browser window).
deleted 4y ago
[deleted]
petertodd 4y ago
IPv6 has so many addresses that the default is for /64 subnets to be the minimum network size, allowing devices to choose their addresses randomly within that range. If they do that, 2^64 is big enough that it's not practical to enumerate all devices on a given network. Attempting to do so would be a bandwidth DoS attack: attempting to ping 2^64 devices requires 2^64 * 64 bytes = 1024EiB, roughly equal to total global internet traffic per year. Now, sometimes NAT is needed anyway: QubesOS supports IPv6 using NAT because it splits things up into many different VMs on one computer. But that's a pretty rare case.
- drbawb 4y ago
  EUI64 means that random space is effectively reduced to just 48-bits of real entropy, <40 bits if you start making assumptions about device vendors. For example maybe the attacker has a VMWare exploit: enumerating that OUI (00:50:56) leaves them with just 24-bits of address space to scan, a measly 1GiB of traffic. It's security through obscurity at best, i.e: not security. You shouldn't be relying on size of address space to protect you from anything. An IDS/IPS that alerts on abnormal ICMP behavior will be useful whether an attack is 1GiB of traffic in size or 1024EiB of traffic in size. (Also you don't even need automated scanning to find some juicy targets: I've seen a lot of routers on the edge of a prefix configured at ::1/64 and ::2/64 for instance.)
  - CaliforniaKarl 4y ago
    Most systems aren't using EUI64. Within a subnet, they're using random addresses per RFC 4941. So, if I've got a /64 IPv6 allocation (which I do right now), that means I've got 64 bits of randomness to play with. Right now, my macOS system has four publicly-routable IPv6 IPs, all of which were randomly-generated, and which regularly regenerate. I did not have to do anything to get this. My macOS system has IPv6 set to Automatic. My home ASUS router picks up the /64 allocation from my ISP, passes the info on to things on the LAN, and acts as a firewall for IPv6 (while continuing to act as a NAT for IPv4). According to https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/ https://www.internetsociety.org/resources/deploy360/2014/pri..., this has been common for some time.
  - hot_gril 4y ago
    I don't see what's wrong with the outside knowing your local IP addresses. But I absolutely wouldn't want EUI64 encoding my device vendors in the addrs.
temp2022account 4y ago
To be fair that info is already available w/ port sequence analysis, the same machine will pick from the same set of ephemeral ports for outgoing connections. I'd say the time for vanity privacy arguments is over, I'm all-in for team globally routable addresses w/ firewalls just saying "yes" or "no" to connections instead of routers guessing at port mappings.
- waych 4y ago
  Port sequence analysis is stifled by SNAT though.
- adriancr 4y ago
  > the same machine will pick from the same set of ephemeral ports for outgoing connections. Ports on router are allocated by it and not client machines. So far my experience has been they're usually sequential without any preferrence.
dale_glass 4y ago
That's what the privacy extensions are for. You can have a regularly changing, randomly generated IP address on each machine.
justeleblanc 4y ago
Your machines could change their IPs for every second of every day and you wouldn't come close to exhausting your /64 subnet for the next billion years.
- TheLoafOfBread 4y ago
  Why do network stuff easy, when you can do it hard.
- mqus 4y ago
  Won't this break your TCP connections? NAT won't, because it's connection-aware by its nature. And you also get a new "address"(=port) on each new connection, regardless of any setting.
  - yrro 4y ago
    Deprecated addresses still work, they just aren't removed from an interface until there are no more sockets using them. (Hand waving a bit here with terminology don't shoot me)
stephen_g 4y ago
My network would look like it has dozens of machines, since everything is periodically rotating its IP randomly around the subnet, and often have multiple IP addresses at once with privacy extensions…

Yeah, I had an idea to have an IP for each container (which means almost every "containerized" application soon, possibly even every browser window).

deleted 4y ago

[deleted]

petertodd 4y ago

IPv6 has so many addresses that the default is for /64 subnets to be the minimum network size, allowing devices to choose their addresses randomly within that range. If they do that, 2^64 is big enough that it's not practical to enumerate all devices on a given network. Attempting to do so would be a bandwidth DoS attack: attempting to ping 2^64 devices requires 2^64 * 64 bytes = 1024EiB, roughly equal to total global internet traffic per year. Now, sometimes NAT is needed anyway: QubesOS supports IPv6 using NAT because it splits things up into many different VMs on one computer. But that's a pretty rare case.

drbawb 4y ago
EUI64 means that random space is effectively reduced to just 48-bits of real entropy, <40 bits if you start making assumptions about device vendors. For example maybe the attacker has a VMWare exploit: enumerating that OUI (00:50:56) leaves them with just 24-bits of address space to scan, a measly 1GiB of traffic. It's security through obscurity at best, i.e: not security. You shouldn't be relying on size of address space to protect you from anything. An IDS/IPS that alerts on abnormal ICMP behavior will be useful whether an attack is 1GiB of traffic in size or 1024EiB of traffic in size. (Also you don't even need automated scanning to find some juicy targets: I've seen a lot of routers on the edge of a prefix configured at ::1/64 and ::2/64 for instance.)
- CaliforniaKarl 4y ago
  Most systems aren't using EUI64. Within a subnet, they're using random addresses per RFC 4941. So, if I've got a /64 IPv6 allocation (which I do right now), that means I've got 64 bits of randomness to play with. Right now, my macOS system has four publicly-routable IPv6 IPs, all of which were randomly-generated, and which regularly regenerate. I did not have to do anything to get this. My macOS system has IPv6 set to Automatic. My home ASUS router picks up the /64 allocation from my ISP, passes the info on to things on the LAN, and acts as a firewall for IPv6 (while continuing to act as a NAT for IPv4). According to https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/ https://www.internetsociety.org/resources/deploy360/2014/pri..., this has been common for some time.
- hot_gril 4y ago
  I don't see what's wrong with the outside knowing your local IP addresses. But I absolutely wouldn't want EUI64 encoding my device vendors in the addrs.

temp2022account 4y ago

To be fair that info is already available w/ port sequence analysis, the same machine will pick from the same set of ephemeral ports for outgoing connections. I'd say the time for vanity privacy arguments is over, I'm all-in for team globally routable addresses w/ firewalls just saying "yes" or "no" to connections instead of routers guessing at port mappings.

waych 4y ago
Port sequence analysis is stifled by SNAT though.
adriancr 4y ago
> the same machine will pick from the same set of ephemeral ports for outgoing connections. Ports on router are allocated by it and not client machines. So far my experience has been they're usually sequential without any preferrence.

dale_glass 4y ago

That's what the privacy extensions are for. You can have a regularly changing, randomly generated IP address on each machine.

justeleblanc 4y ago

Your machines could change their IPs for every second of every day and you wouldn't come close to exhausting your /64 subnet for the next billion years.

TheLoafOfBread 4y ago
Why do network stuff easy, when you can do it hard.
mqus 4y ago
Won't this break your TCP connections? NAT won't, because it's connection-aware by its nature. And you also get a new "address"(=port) on each new connection, regardless of any setting.
- yrro 4y ago
  Deprecated addresses still work, they just aren't removed from an interface until there are no more sockets using them. (Hand waving a bit here with terminology don't shoot me)

stephen_g 4y ago

My network would look like it has dozens of machines, since everything is periodically rotating its IP randomly around the subnet, and often have multiple IP addresses at once with privacy extensions…