4 ms·

Also Android doesn't support DHCPv6

by roygbiv2 3y ago

piperswe 3y ago
What's the benefit of DHCPv6 over SLAAC (genuine question, never looked into DHCPv6 at all)
- chungy 3y ago
  You can do finer-grained subnets with DHCP than SLAAC will give you.
  - darkr 3y ago
    As a general rule, if you're deploying IPv6 subnets sized as anything other than /64, you're doing it wrong
    - tsimionescu 3y ago
      The only reason for that "rule" is SLAAC.
      - darkr 3y ago
        Actually it's primarily due to NDP and EUI-64. Eliminating ARP is a very good thing for reasons of scalability, reliability and security.
        tsimionescu 3y ago
        NDP doesn't impose any restrictions on IP addresses, it uses special prefixes anyway. EUI-64 is a part of SLAAC, not NDP. Finally, NDP is not really any more secure at least than ARP (at least not if you don't implement SEND as well, which I'm not sure if anyone does, at least in consumer networks). Not sure about reliability or scalability either.
      - p1mrx 3y ago
        I think SLAAC's /64 limit functions as a "trojan horse" forcing ISPs to give everyone at least 64 bits of address space. Most would allocate /112-/128 per customer if it were slightly easier. Designing the internet with lots of unused space at the edges will probably be useful in 100 years.
        tsimionescu 3y ago
        Regardless of the /64 limit, I expect DHCPv6 will win out in the consumer side (with ISPs giving customers pre-configured wifi routers with DHCPv6 already configured). SLAAC is both very complicated, and its privacy extensions are anyway not something ISPs have been friendly to even if it weren't such an extra hassle.
        p1mrx 3y ago
        > and its privacy extensions are anyway not something ISPs have been friendly to That is an argument for forcing ISPs to support SLAAC, so it's difficult to bill a customer based on the number of devices in their home. ISP-friendly often means user-hostile. If ISPs can deploy device-counting DHCPv6, then router manufacturers will respond with IPv6 NAT, and then the IPv6 landscape will be as shitty as IPv4.
        tsimionescu 3y ago
        Device counting has always been possible with IPv4 routers, and yet I don't know of a single ISP which does this. To be clear, I'm talking of ISP-provided (usually wifi) routers, which at least in my country are extremely common. Those could receive an IPv6 prefix and do DHCPv6 inside your own network.
        p1mrx 3y ago
        The concept of an IPv4 NAT router exists today because people in the '90s wanted to connect multiple devices without permission from their ISP. SLAAC lets you extend a network without permission using ND Proxy, whereas DHCPv6 IA_NA can only be extended using NAT. So I think SLAAC is good because ND Proxy is less evil than NAT.
    - chungy 3y ago
      It's all too common for ISPs to give you just a single /64 going into your home. So if you want to define subnets within that, you're "doing it wrong"? Nah. Just use DHCPv6 and be happy.
      - ArchOversight 3y ago
        Name and shame the ISP! And update your DHCPv6 Prefix Delegation request for a larger prefix (try /60, that seems to be a common supported PD size for most at home ISPs).
- sgjohnson 3y ago
  all of the DHCP options, for example. SLAAC just tells the endpoint device to self-assign an address and to roll with it. For example, there’s no way to pass in DNS servers with SLAAC.
  - MayeulC 3y ago
    Can't you provide DNS servers as part of router advertisement packets ? RFC8106
    - sgjohnson 3y ago
      I stand corrected, but I haven't seen this in practice yet.
    - magicalhippo 3y ago
      This requires client support though, which isn't a given.
      - stephen_g 3y ago
        I expect basically anything that supports SLAAC would have supported DNS advertisements for at least a few years…
      - ArchOversight 3y ago
        That is most operating systems and devices these days.
  - rnhmjoj 3y ago
    The DNS bit it's not true: there's RFC8106 [1] for this and it's widely supported. You can set a list of DNS servers to use (RDNSS) and a domain suffix for resolving unqualified hostnames (DNSSL), exactly as for DHCP. [1]: https://datatracker.ietf.org/doc/html/rfc8106 https://datatracker.ietf.org/doc/html/rfc8106
- throw0101a 3y ago
  > What's the benefit of DHCPv6 over SLAAC (genuine question, never looked into DHCPv6 at all) In corporate-y environments it allows for easier tracking of user-MAC-IP mappings for auditing purposes. If you use SLAAC there is no auto-logging as the client simply picks an address itself. One way to do tracking with SLAAC could be to SNMP scrape/trap ipNetToPhysicalTable of RFC 4293. Another would be 802.1X or MAC authentication (interim) accounting via RADIUS (RFC 2866).
- aidenn0 3y ago
  The primary advantage is you can delegate prefixes over DHCP, but that probably doesn't matter for most Android devices There are other advantages too, like if you want to assign specific addresses to specific devices without having to configure each device separately.

Also Android doesn't support DHCPv6

piperswe 3y ago

What's the benefit of DHCPv6 over SLAAC (genuine question, never looked into DHCPv6 at all)

chungy 3y ago
You can do finer-grained subnets with DHCP than SLAAC will give you.
- darkr 3y ago
  As a general rule, if you're deploying IPv6 subnets sized as anything other than /64, you're doing it wrong
  - tsimionescu 3y ago
    The only reason for that "rule" is SLAAC.
    - darkr 3y ago
      Actually it's primarily due to NDP and EUI-64. Eliminating ARP is a very good thing for reasons of scalability, reliability and security.
      - tsimionescu 3y ago
        NDP doesn't impose any restrictions on IP addresses, it uses special prefixes anyway. EUI-64 is a part of SLAAC, not NDP. Finally, NDP is not really any more secure at least than ARP (at least not if you don't implement SEND as well, which I'm not sure if anyone does, at least in consumer networks). Not sure about reliability or scalability either.
    - p1mrx 3y ago
      I think SLAAC's /64 limit functions as a "trojan horse" forcing ISPs to give everyone at least 64 bits of address space. Most would allocate /112-/128 per customer if it were slightly easier. Designing the internet with lots of unused space at the edges will probably be useful in 100 years.
      - tsimionescu 3y ago
        Regardless of the /64 limit, I expect DHCPv6 will win out in the consumer side (with ISPs giving customers pre-configured wifi routers with DHCPv6 already configured). SLAAC is both very complicated, and its privacy extensions are anyway not something ISPs have been friendly to even if it weren't such an extra hassle.
        p1mrx 3y ago
        > and its privacy extensions are anyway not something ISPs have been friendly to That is an argument for forcing ISPs to support SLAAC, so it's difficult to bill a customer based on the number of devices in their home. ISP-friendly often means user-hostile. If ISPs can deploy device-counting DHCPv6, then router manufacturers will respond with IPv6 NAT, and then the IPv6 landscape will be as shitty as IPv4.
        tsimionescu 3y ago
        Device counting has always been possible with IPv4 routers, and yet I don't know of a single ISP which does this. To be clear, I'm talking of ISP-provided (usually wifi) routers, which at least in my country are extremely common. Those could receive an IPv6 prefix and do DHCPv6 inside your own network.
        p1mrx 3y ago
        The concept of an IPv4 NAT router exists today because people in the '90s wanted to connect multiple devices without permission from their ISP. SLAAC lets you extend a network without permission using ND Proxy, whereas DHCPv6 IA_NA can only be extended using NAT. So I think SLAAC is good because ND Proxy is less evil than NAT.
  - chungy 3y ago
    It's all too common for ISPs to give you just a single /64 going into your home. So if you want to define subnets within that, you're "doing it wrong"? Nah. Just use DHCPv6 and be happy.
    - ArchOversight 3y ago
      Name and shame the ISP! And update your DHCPv6 Prefix Delegation request for a larger prefix (try /60, that seems to be a common supported PD size for most at home ISPs).
sgjohnson 3y ago
all of the DHCP options, for example. SLAAC just tells the endpoint device to self-assign an address and to roll with it. For example, there’s no way to pass in DNS servers with SLAAC.
- MayeulC 3y ago
  Can't you provide DNS servers as part of router advertisement packets ? RFC8106
  - sgjohnson 3y ago
    I stand corrected, but I haven't seen this in practice yet.
  - magicalhippo 3y ago
    This requires client support though, which isn't a given.
    - stephen_g 3y ago
      I expect basically anything that supports SLAAC would have supported DNS advertisements for at least a few years…
    - ArchOversight 3y ago
      That is most operating systems and devices these days.
- rnhmjoj 3y ago
  The DNS bit it's not true: there's RFC8106 [1] for this and it's widely supported. You can set a list of DNS servers to use (RDNSS) and a domain suffix for resolving unqualified hostnames (DNSSL), exactly as for DHCP. [1]: https://datatracker.ietf.org/doc/html/rfc8106 https://datatracker.ietf.org/doc/html/rfc8106
throw0101a 3y ago
> What's the benefit of DHCPv6 over SLAAC (genuine question, never looked into DHCPv6 at all) In corporate-y environments it allows for easier tracking of user-MAC-IP mappings for auditing purposes. If you use SLAAC there is no auto-logging as the client simply picks an address itself. One way to do tracking with SLAAC could be to SNMP scrape/trap ipNetToPhysicalTable of RFC 4293. Another would be 802.1X or MAC authentication (interim) accounting via RADIUS (RFC 2866).
aidenn0 3y ago
The primary advantage is you can delegate prefixes over DHCP, but that probably doesn't matter for most Android devices There are other advantages too, like if you want to assign specific addresses to specific devices without having to configure each device separately.