4 ms·

Every packet leaving an IPv6 network that isn't NATed has an effective node ID in the packet. No need to guess just look at the packets.

by waych 4y ago

bityard 4y ago
Most devices support privacy extensions (temporary v6 addresses) for this exact reason. https://www.rfc-editor.org/rfc/rfc4941 https://www.rfc-editor.org/rfc/rfc4941
- waych 4y ago
  This helps mitigate correlations over time but doesn't do anything to mask the identity of the node within a given refresh interval (default one day).
- jlokier 4y ago
  Those IPv6 privacy extensions still reveal when the same node connects to a sequence of destinations within the address change interval, though. E.g. observers can see a single device connects to Facebook, OnlyFans, Pornhub and PayPal in that order. Behind a NAT, observers can only make that connection (using only addresses) for the network as a whole, instead of an individual device on the network. So the privacy extensions are weaker than NAT (If the IPv6 privacy extensions used a different address for each connection, they would be more like NAT in this regard.) That said, other observable clues still allow connections from a single device to be associated, NAT or not. There's TCP OS fingerprinting for example, and the close timing of related connections.
  - bert64 4y ago
    That requires someone who has the ability to monitor all your traffic - ie the government, your ISP, or a hacker who has infiltrated one of those two. In this scenario it's a lot more work trying to map out your infrastructure than to try performing a MITM connection against some of your outbound traffic.
justeleblanc 4y ago
Your machines could change their IPs for every second of every day and you wouldn't come close to exhausting your /64 subnet for the next billion years.
- waych 4y ago
  The limit of changing addresses once every N seconds as N approaches 0 is equal to offline. With any usable N, a clever observer would still easily work out what you were doing and still map out your infrastructure.
  - ianburrell 4y ago
    Why would changing N seconds break network? It would presumably keep active addresses until connections finish. IPv6 requires supporting multiple addresses per interface. More reasonable is to use new address for each connection. Then nobody can tell if 10 addresses and 10 connections are one device or ten.
    - waych 4y ago
      This looks like NAT pushed down to the endpoint itself. You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME. What are valid values in the scenario you are proposing? The defaults are 1 week / 1 day, so 7X. If you chose to rotate each second, and say allowed addresses to only be valid for say 20 minutes, this still appears to be a ~1200X blowup in routing overheads.
      - kazen44 4y ago
        > You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME. They have not? The global routing table size for ipv6 at max is a /32 (if i remember correctly) every customer gets a /56 prefix to use in their network, so the routing table entry would still be the same, no matter how many addresses you use to cycle through in your /64. ARP caches do not exist in IPv6, and Neighbour discovery does not have the same "cache" mechanism as ARP does, it uses an entirely different mechanism for neighbour discovery. (which is also far more lightweight considering it is using multicast, compared to the broadcast of ARP).

Every packet leaving an IPv6 network that isn't NATed has an effective node ID in the packet. No need to guess just look at the packets.

by waych 4y ago

Every packet leaving an IPv6 network that isn't NATed has an effective node ID in the packet. No need to guess just look at the packets.

bityard 4y ago

Most devices support privacy extensions (temporary v6 addresses) for this exact reason. https://www.rfc-editor.org/rfc/rfc4941 https://www.rfc-editor.org/rfc/rfc4941

waych 4y ago
This helps mitigate correlations over time but doesn't do anything to mask the identity of the node within a given refresh interval (default one day).
jlokier 4y ago
Those IPv6 privacy extensions still reveal when the same node connects to a sequence of destinations within the address change interval, though. E.g. observers can see a single device connects to Facebook, OnlyFans, Pornhub and PayPal in that order. Behind a NAT, observers can only make that connection (using only addresses) for the network as a whole, instead of an individual device on the network. So the privacy extensions are weaker than NAT (If the IPv6 privacy extensions used a different address for each connection, they would be more like NAT in this regard.) That said, other observable clues still allow connections from a single device to be associated, NAT or not. There's TCP OS fingerprinting for example, and the close timing of related connections.
- bert64 4y ago
  That requires someone who has the ability to monitor all your traffic - ie the government, your ISP, or a hacker who has infiltrated one of those two. In this scenario it's a lot more work trying to map out your infrastructure than to try performing a MITM connection against some of your outbound traffic.

justeleblanc 4y ago

Your machines could change their IPs for every second of every day and you wouldn't come close to exhausting your /64 subnet for the next billion years.

waych 4y ago
The limit of changing addresses once every N seconds as N approaches 0 is equal to offline. With any usable N, a clever observer would still easily work out what you were doing and still map out your infrastructure.
- ianburrell 4y ago
  Why would changing N seconds break network? It would presumably keep active addresses until connections finish. IPv6 requires supporting multiple addresses per interface. More reasonable is to use new address for each connection. Then nobody can tell if 10 addresses and 10 connections are one device or ten.
  - waych 4y ago
    This looks like NAT pushed down to the endpoint itself. You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME. What are valid values in the scenario you are proposing? The defaults are 1 week / 1 day, so 7X. If you chose to rotate each second, and say allowed addresses to only be valid for say 20 minutes, this still appears to be a ~1200X blowup in routing overheads.
    - kazen44 4y ago
      > You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME. They have not? The global routing table size for ipv6 at max is a /32 (if i remember correctly) every customer gets a /56 prefix to use in their network, so the routing table entry would still be the same, no matter how many addresses you use to cycle through in your /64. ARP caches do not exist in IPv6, and Neighbour discovery does not have the same "cache" mechanism as ARP does, it uses an entirely different mechanism for neighbour discovery. (which is also far more lightweight considering it is using multicast, compared to the broadcast of ARP).