5 ms·

Can you explain this more? Why are you so tied to ipv4? I recently enabled IPv6 on my home network, and roughly 30-40% of all internet traffic goes through IPv

Can you explain this more? Why are you so tied to ipv4? I recently enabled IPv6 on my home network, and roughly 30-40% of all internet traffic goes through IPv6. Things are noticeably faster, especially connection times to online games on Xbox Live. My only complaint is that my ISP keeps changing the prefix every quarter or so, so my static addresses need to be updated in the firewall and other places. I am looking into link local addresses but the cocktail of tech is tricky.

teaearlgraycold 3y ago
Why would things be faster over v6?
- danpalmer 3y ago
  IPv6 was a lot more than a numbering scheme, there are performance (and security?) improvements in a number of aspects of IP networking, like more compression in parts of the messages IIRC.
  - whatwhaaaaat 3y ago
    Gonna have to disagree with that. IPv6 was designed in the 90s and lots of it feels like it is. Icmpv6 is fundamental to the implementation and already responsible for multiple remotely exploitable vulnerabilities. Couple that with almost no one understanding it well besides a true handful of engineers and you have yourself a security nightmare. Proof of this is this very thread with the talk about “trying a local link address”. Everything about v6 is over engineered with sharp edges.
- SamuelAdams 3y ago
  > By reducing header complexity, IPv6 contributes to better overall network performance and efficiency. This is especially noticeable in applications sensitive to latency, such as real-time communication and online gaming. https://www.prefixbroker.com/news/is-ipv6-faster-than-ipv4-a-look-at-network-performance-and-efficiency/#:~:text=By%20reducing%20header%20complexity%2C%20IPv6,time%20communication%20and%20online%20gaming https://www.prefixbroker.com/news/is-ipv6-faster-than-ipv4-a....
  - j16sdiz 3y ago
    This is the theoretical benefit. These have never materialize in real life. See https://community.cisco.com/kxiwq67737/attachments/kxiwq67737/5991-discussions-wan-routing-switching/231814/2/15376194-IPv6perf_wp1f.pdf https://community.cisco.com/kxiwq67737/attachments/kxiwq6773...
    - networkchad 3y ago
      [dead]
- supertrope 3y ago
  Simpler routing because address blocks are not fragmented. IPv6 does not have a header checksum so that's one less task for routers. Packet fragmentation is no longer done by routers. IPv6 capable gear tends to be newer and higher performance. There's no NAT step or even worse CGNAT.
  - abrookewood 3y ago
    For those that were wondering: Unlike in IPv4, IPv6 routers never fragment IPv6 packets. Packets exceeding the size of the maximum transmission unit (MTU) of the destination link are dropped and this condition is signaled by a Packet too big ICMPv6 message to the originating node, similarly to the IPv4 method when the Don't Fragment bit is set.
  - toast0 3y ago
    > Packet fragmentation is no longer done by routers. The overwelming majority of IPv4 packets have the DF bit set. A large number of services drop inbound fragments anyway (if you get more than a couple a minute, it's almost certainly abuse).
- lxgr 3y ago
  On networks using NAT64 (and maybe also for DS-Lite, although I'm not so sure there), the IPv6 path is more direct than the IPv4 one since it doesn't need to go through a CG-NAT, which might be at capacity (tracking every TCP connection requires memory) or located farther away than the nearest IPv6 egress router, making routing more indirect. I believe all three large US mobile carriers use NAT64 at this point exclusively, and CG-NAT is quite common in DOCSIS cable networks.
  - SSLy 3y ago
    I am stuck in DS-Lite, and indeed IPv6 is direct while v4 is served via shitty CGNAT
- kiwijamo 3y ago
  Sometimes networks will route IPv6 traffic over different paths compared to IPv4 although that could actually be either an improvement or an regression depending on which gets the better path.
- wjholden 3y ago
  A possible explanation is the service provider routes IPv4 over their old routers but routes IPv6 over their new routers.
karlshea 3y ago
You want a ULA (unique local address) instead of link-local. Link-local can sometimes mean needing to append the interface name to your address and a bunch of other weirdness. If you pick a ULA prefix and announce it (or assign some statically) everything pretty much just works. I’ve been using them internally for over a year and it’s been great, they basically feel like RFC 1918 addresses.
- dcow 3y ago
  +1. Link local is like connecting to a computer by mac address. The only time you’d ever want it is if you for some ungodly reason are worried that all other addressing systems have failed, or to bootstrap said systems.
  - clan 3y ago
    Can you recommend a good book on the subject? Especially one which includes the transitioning pitfalls. I have been living through it all and can get a little confused as to what is status quo. First I heard that SLAAC was great. Then came DHCPv6 and some complained it was an ill concieved bandaid. Now I was under the impression that link local addresses would make my day easier but not you indicate that ULAs are the way to go. All of this is made much harder by ISPs actively fighting IPv6 adoption. They have the usual moat babble that users do not request it. But in my case they even blocked /protocol/ 40. This was not documented anywhere. Imagine the layers of support I had to work through. Imagine working with new technology and be sure enough that you have exhausted all other possibilities. So learning practical IPv6 has been an uphill struggle for me. Years ago I had a SixXS tunnel going before major adoption took off. Now I am living in another place and wanted to look at it seriously. SixXS was no more so I went with HE. To my dismay dark corners of the Internet have abused these offerings so I have my tunnel disabled most of the time as it gives too much grief. And I have even worked in operations at a large ISP in the 90s. Adoption is not easy even for the willing. But the reason? No one here seems to mention it: Money. There are no technical excuses left. But it is surely a nice moat. Sorry for the rant! A good up to date book recommendation would be appreciated :-)
    - 3y ago
tilwidnk 3y ago
> Can you explain this more? Why are you so tied to ipv4? For me, IPv4 doesn't break the privacy barrier, IPv6 blasts a huge hole straight into each and every household, office and IoT device on the planet. No, privacy fixes put into IPv6 do not work.
- lolinder 3y ago
  Can you explain this more? I realize that one IP address per device poses a major problem for privacy, but I thought we somewhat mitigated that by dynamically reassigning IPs. What exactly is the problem with the privacy fixes that were put into IPv6? Why don't they work?
  - kccqzy 3y ago
    I'm guessing that the GP is talking about the fact that if there were two persons in a household using the Internet at the same time, with IPv4 they would connect from the same IP address (though of course with different port numbers), but with IPv6 they would likely connect from distinct IP addresses, and usually only sharing a /64 prefix. You are correct that this isn't a big issue. SLAAC addresses are generally changed fairly frequently by the OS. As for stateful DHCPv6, well I turn it off for both this reason and the fact that Android doesn't support it.
    - jeroenhd 3y ago
      IPv6 privacy extensions are only switched around once a day or so in most default configurations. You can change that, of course, and switch addresses every minute if you want to, but I do find the default a little high.
      - lolinder 3y ago
        Once a day is still way more frequent than most routers switch IPv4 addresses, so I'm not sure that the net result is any worse.
deleted 3y ago
[deleted]
btgeekboy 3y ago
I turned it off on my home network. I have a multi-wan setup (fiber + 5g). The 5g provider supports v6, but only delegates a /64. The fiber provider will delegate me a /56, which is plenty for both my home and guest networks. Failover for v4 works great, as everything's behind NAT so the route just changes when my firewall detects an issue, but clients accessing v6 resources have a hard time, as you're waiting on each device to figure out that the old route is dead. So that's problem number one. Problem number two is that the fiber provider doesn't support native v6; it's actually a 6rd tunnel. Latency isn't great compared to v4. I need to go figure out the ULA situation and do NPTv6. But last I checked, my firewall wasn't able to do NPTv6 with delegated ranges. That may have changed, but I've not found any substantial reason to actually put in the effort to figure out it when my v4 network works fine.

teaearlgraycold 3y ago

Why would things be faster over v6?

danpalmer 3y ago
IPv6 was a lot more than a numbering scheme, there are performance (and security?) improvements in a number of aspects of IP networking, like more compression in parts of the messages IIRC.
- whatwhaaaaat 3y ago
  Gonna have to disagree with that. IPv6 was designed in the 90s and lots of it feels like it is. Icmpv6 is fundamental to the implementation and already responsible for multiple remotely exploitable vulnerabilities. Couple that with almost no one understanding it well besides a true handful of engineers and you have yourself a security nightmare. Proof of this is this very thread with the talk about “trying a local link address”. Everything about v6 is over engineered with sharp edges.
SamuelAdams 3y ago
> By reducing header complexity, IPv6 contributes to better overall network performance and efficiency. This is especially noticeable in applications sensitive to latency, such as real-time communication and online gaming. https://www.prefixbroker.com/news/is-ipv6-faster-than-ipv4-a-look-at-network-performance-and-efficiency/#:~:text=By%20reducing%20header%20complexity%2C%20IPv6,time%20communication%20and%20online%20gaming https://www.prefixbroker.com/news/is-ipv6-faster-than-ipv4-a....
- j16sdiz 3y ago
  This is the theoretical benefit. These have never materialize in real life. See https://community.cisco.com/kxiwq67737/attachments/kxiwq67737/5991-discussions-wan-routing-switching/231814/2/15376194-IPv6perf_wp1f.pdf https://community.cisco.com/kxiwq67737/attachments/kxiwq6773...
  - networkchad 3y ago
    [dead]
supertrope 3y ago
Simpler routing because address blocks are not fragmented. IPv6 does not have a header checksum so that's one less task for routers. Packet fragmentation is no longer done by routers. IPv6 capable gear tends to be newer and higher performance. There's no NAT step or even worse CGNAT.
- abrookewood 3y ago
  For those that were wondering: Unlike in IPv4, IPv6 routers never fragment IPv6 packets. Packets exceeding the size of the maximum transmission unit (MTU) of the destination link are dropped and this condition is signaled by a Packet too big ICMPv6 message to the originating node, similarly to the IPv4 method when the Don't Fragment bit is set.
- toast0 3y ago
  > Packet fragmentation is no longer done by routers. The overwelming majority of IPv4 packets have the DF bit set. A large number of services drop inbound fragments anyway (if you get more than a couple a minute, it's almost certainly abuse).
lxgr 3y ago
On networks using NAT64 (and maybe also for DS-Lite, although I'm not so sure there), the IPv6 path is more direct than the IPv4 one since it doesn't need to go through a CG-NAT, which might be at capacity (tracking every TCP connection requires memory) or located farther away than the nearest IPv6 egress router, making routing more indirect. I believe all three large US mobile carriers use NAT64 at this point exclusively, and CG-NAT is quite common in DOCSIS cable networks.
- SSLy 3y ago
  I am stuck in DS-Lite, and indeed IPv6 is direct while v4 is served via shitty CGNAT
kiwijamo 3y ago
Sometimes networks will route IPv6 traffic over different paths compared to IPv4 although that could actually be either an improvement or an regression depending on which gets the better path.
wjholden 3y ago
A possible explanation is the service provider routes IPv4 over their old routers but routes IPv6 over their new routers.

karlshea 3y ago

You want a ULA (unique local address) instead of link-local. Link-local can sometimes mean needing to append the interface name to your address and a bunch of other weirdness. If you pick a ULA prefix and announce it (or assign some statically) everything pretty much just works. I’ve been using them internally for over a year and it’s been great, they basically feel like RFC 1918 addresses.

dcow 3y ago
+1. Link local is like connecting to a computer by mac address. The only time you’d ever want it is if you for some ungodly reason are worried that all other addressing systems have failed, or to bootstrap said systems.
- clan 3y ago
  Can you recommend a good book on the subject? Especially one which includes the transitioning pitfalls. I have been living through it all and can get a little confused as to what is status quo. First I heard that SLAAC was great. Then came DHCPv6 and some complained it was an ill concieved bandaid. Now I was under the impression that link local addresses would make my day easier but not you indicate that ULAs are the way to go. All of this is made much harder by ISPs actively fighting IPv6 adoption. They have the usual moat babble that users do not request it. But in my case they even blocked /protocol/ 40. This was not documented anywhere. Imagine the layers of support I had to work through. Imagine working with new technology and be sure enough that you have exhausted all other possibilities. So learning practical IPv6 has been an uphill struggle for me. Years ago I had a SixXS tunnel going before major adoption took off. Now I am living in another place and wanted to look at it seriously. SixXS was no more so I went with HE. To my dismay dark corners of the Internet have abused these offerings so I have my tunnel disabled most of the time as it gives too much grief. And I have even worked in operations at a large ISP in the 90s. Adoption is not easy even for the willing. But the reason? No one here seems to mention it: Money. There are no technical excuses left. But it is surely a nice moat. Sorry for the rant! A good up to date book recommendation would be appreciated :-)
  - 3y ago

tilwidnk 3y ago

> Can you explain this more? Why are you so tied to ipv4? For me, IPv4 doesn't break the privacy barrier, IPv6 blasts a huge hole straight into each and every household, office and IoT device on the planet. No, privacy fixes put into IPv6 do not work.

lolinder 3y ago
Can you explain this more? I realize that one IP address per device poses a major problem for privacy, but I thought we somewhat mitigated that by dynamically reassigning IPs. What exactly is the problem with the privacy fixes that were put into IPv6? Why don't they work?
- kccqzy 3y ago
  I'm guessing that the GP is talking about the fact that if there were two persons in a household using the Internet at the same time, with IPv4 they would connect from the same IP address (though of course with different port numbers), but with IPv6 they would likely connect from distinct IP addresses, and usually only sharing a /64 prefix. You are correct that this isn't a big issue. SLAAC addresses are generally changed fairly frequently by the OS. As for stateful DHCPv6, well I turn it off for both this reason and the fact that Android doesn't support it.
  - jeroenhd 3y ago
    IPv6 privacy extensions are only switched around once a day or so in most default configurations. You can change that, of course, and switch addresses every minute if you want to, but I do find the default a little high.
    - lolinder 3y ago
      Once a day is still way more frequent than most routers switch IPv4 addresses, so I'm not sure that the net result is any worse.

deleted 3y ago

[deleted]

btgeekboy 3y ago

I turned it off on my home network. I have a multi-wan setup (fiber + 5g). The 5g provider supports v6, but only delegates a /64. The fiber provider will delegate me a /56, which is plenty for both my home and guest networks. Failover for v4 works great, as everything's behind NAT so the route just changes when my firewall detects an issue, but clients accessing v6 resources have a hard time, as you're waiting on each device to figure out that the old route is dead. So that's problem number one. Problem number two is that the fiber provider doesn't support native v6; it's actually a 6rd tunnel. Latency isn't great compared to v4. I need to go figure out the ULA situation and do NPTv6. But last I checked, my firewall wasn't able to do NPTv6 with delegated ranges. That may have changed, but I've not found any substantial reason to actually put in the effort to figure out it when my v4 network works fine.