6 ms·

Hello IPv6: a minimal tutorial for IPv4 users

78 points by throwup238 3y ago

Daviey 3y ago
Perhaps someone can do a post on the inverse, to help people coming from an ipv6 background to understand ipv4.
- teddyh 3y ago
  For whom, people who live backwards in time¹? 1. <https://www.gnu.org/software/emacs/manual/html_node/emacs/Antinews.html https://www.gnu.org/software/emacs/manual/html_node/emacs/An...>
  - wmf 3y ago
    We can only hope that one day IPv4 will be considered retrocomputing.
jiggawatts 3y ago
Let's just get this out of the way before the debate commences: DNS was invented in 1985 so that you don't have to memorise IP addresses. DHCP was invented in 1984 so that you don't have to allocate IP addresses manually. You can allocate nice short IPv6 addresses if you like to memorise hundreds of numbers as a hobby instead of letting the computer do that for you. NAT is a hack for getting past the address-space limitations of IPv4. NAT provides security as a side-effect. Firewalls provide the same security. Every router has a firewall built in now, whether they use NAT or not. IPv6 has the same security as IPv4 whether or not you use NAT. There are no "privacy issues" with IPv6. All modern clients randomise the host part of the address. You "look the same" to the rest of the Internet whether your unique address is a single IPv4 address or a /64 prefix. It's a unique identifier in both cases. People that want to track you can use a hundred other techniques, most of which are more robust than your IP address. You're tracked anyway. Giving up on the future of the Internet in a futile attempt to stop your porn habits being tracked is not a valid argument against IPv6.
- trvr 3y ago
  Can you expand on the "All modern clients randomise the host part of the address" statement. Do they randomize this host part for every session or just once per network? I've always been under the impression that it is actually easier to track an individual user on IPv6 because each device now has a unique address. Example Company could now tell the difference between 2 users in a home, for example, instead of just a single NAT'd IPv4 address. Is that not true?
  - tolien 3y ago
    How frequently the randomisation happens is configurable but the expectation is it should be ~daily. The thing you’re looking for is the SLAAC Privacy Extensions [1] 1: https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/ https://www.internetsociety.org/resources/deploy360/2014/pri...
  - ianburrell 3y ago
    IPv6 host can change its address as much as it wants. In fact, it can have as many addresses as it wants. It could use a different address for every outgoing connection. Nothing goes that far. Most modern OSes change IPv6 every hour to once per day. The result is that any tracker can't tell if two IPv6 addresses in the same subnet are two hosts or one that changed its address.
  - arccy 3y ago
    you get a randomized address for the network, but then also temporary addresses that are cycled on reboot / netstack restarts for outgoing connections
  - burnerthrow008 3y ago
    > Can you expand on the "All modern clients randomise the host part of the address" statement. Do they randomize this host part for every session or just once per network? In practice, most OSes generate a new address once per day, but more significantly, it is completely normal for an IPv6 host to have multiple addresses per interface at the same time. In fact, it is effectively mandatory to have at least two: First, you must have a link-local address (fe80::/10), which is non-routable. This is required for SLAAC and DHCPv6 to work. Second, if you want to talk to the rest of internet, you need a routable address (from SLAAC or DHCPv6). In practice, it's even more than that: The computer I'm writing this on currently has 12 IPv6 addresses on one ethernet interface. Besides the link-local address, it has as a bunch of routable addresses on the prefix delegated by my ISP. All but one of the routable are "deprecated" which means that they won't be used for new outgoing connections, but remain active for existing connections. So not only do you get a new randomized address every 24 hours, you may have an arbitrary number of randomized addresses active at any given time. There's nothing stopping a privacy-focused Linux distro from generating a new address for every outgoing connection, and having them all active at once.
oldnetguy 3y ago
IPv6 is horrible. I would rather have many more decimal based addresses than trying to think in hex. As for DNS, DNS is probably 30% of my problems and it just made it worse.
- joe_guy 3y ago
  I've got no horse in the race, but I recall this being an enlightening read https://apenwarr.ca/log/20170810 https://apenwarr.ca/log/20170810
  - mdaniel 3y ago
    That was stellar, thanks so much for sharing it > We'll need to keep running a local DHCP server at home so that our obsolete IPv4 light bulbs keep working. We'll keep needing NAT so that our obsolete IPv4 light bulbs can keep reaching the Internet. I feel seen :-(
  - rstuart4133 3y ago
    As the other poster said, Stellar. At the end I was reading about mobile IP issues, and a voice in my head said I bet he doesn't mention QUIC. Then he mentioned it. Which makes it the most complete piece I've read on IP routing.
  - Dagger2 3y ago
    It's not really, it just spends a lot of time waffling on about bus networks and mobile IPs and then makes some weird claims about the IETF that don't seem to match reality. v6 is designed the way it is precisely because it needs to run on the same networks that v4 does, and v6 is a better design than v4 in our world because our world has completely outgrown v4.
- menotyou 3y ago
  This. I still keep IPv6 turned of in my local network at home.
- kmbfjr 3y ago
  Not trying to be a smartass, but managing DNS at scale IS a solved problem. Maybe change tooling? IPv6 is awful, but it is what it is and I appreciate the death of NAT.
binkHN 3y ago
Just a note that this is from 2020, but probably still an important read for those who need a primer.
o11c 3y ago
You can mostly migrate to just using IPv6 APIs (as long as the sockopt IPV6_V6ONLY is disabled), but there are a couple major regressions. There is no equivalent to 127.0.0.0/8, so you can't start separate servers on e.g. 127.0.0.2, 127.0.0.3, and 127.0.0.4 /etc/hosts cannot be enumerated; you can only do lookups. You have to do that stupid wrap/unwrap with [] dance when converting between host names and addresses. The other major porting concern is that you have to use `struct sockaddr_storage` where before you could get away with `struct sockaddr`.
gerdesj 3y ago
This is a post from 2020 using a 2018 Ubuntu LTS release. Its 2024 and not really topical any more unless as a historical how we did stuff back then.
- nightpool 3y ago
  Which parts are outdated? It mostly looks like an explanation of IPv6 networking fundamentals, such as how DHCPv6 works. I wouldn't expect those to change substantially based on OS version.
deleted 3y ago
[deleted]
guilhas 3y ago
So if I have 1000 devices I have to advertise every single one to my ISP? Couldn't they start a pricing based on how many devices I have? By default it will send the mac addresses of all devices? Is there a way to enable IPv6 NAT?
- burnerthrow008 3y ago
  > So if I have 1000 devices I have to advertise every single one to my ISP? Generally: No, if they use Prefix Delegation (which is what most non-mobile ISPs use). Your router sends a DHCPv6-PD request and the ISP delegates a /48 (usually) or /64 (if they are run by morons) prefix to your router. Your router advertises that prefix on the local network, and hosts self-assign addresses within that prefix. > Couldn't they start a pricing based on how many devices I have? Most OSes generate new random addresses every 24 hours (and keep old addresses with open connections), so there is no reliable way for your ISP to determine how many hosts are on your network.
- overstay8930 3y ago
  It is easier to determine number of devices using network flows and DNS queries than it is to use IPv6 because of the many privacy extensions in use today.
Uptrenda 3y ago
Honestly quite a horrible reference for people new to IPv6. Seems like the author was more concerned with flexing how much they know about IPv6 than teaching anyone how to use it. In that rambling, wall of text and literal packet dumps no where are they even close to: 1. Explaining the basic details about IPv6's address model (e.g. what is link-local, what is global scope? where should one use them?) 2. Letting anyone make an IPv6 connection to various address types (gee, would be useful, right? Kinda the point, no?) 3. Maybe letting someone use their browser to connect to an IPv6 address. (also helpful as it would show the above catches.) 4. Hosting services that use IPv6 in software. Can you really blame people for not using IPv6 when people try pull this shit.
1vuio0pswjnm7 3y ago
"DNS was invented so that you don't have to memorise IP addresses." Prior to DNS it was necessary to have all the IP addresses one needed stored in a local file, HOSTS.TXT. It was not necessary to to memorise the addresses stored in this file. Memorisation of IP addresses was never a requirement to use the internet. To this day, /etc/hosts allows me to avoid memorising IP addresses. No DNS required. But more importantly it allows me to avoid _having to type_ either IP addresses or domain names. I can assign short strings in place of typing addresses or domain names. For example, echo 127.0.0.1 localhost lo|sed -i -e 1r/dev/stdin -e 1N /etc/hosts Now I can type "lo" without having to type "127.0.0.1" or "localhost" echo 5.179.1.4 ftp.lanet.lv ftp1|sed -i -e 1r/dev/stdin -e 1N /etc/hosts Now I can type "ftp1" instead of having to remember 5.179.1.4 or ftp.lanet.lv echo ls |ftp ftp://ftp1/pub There are some useful IPv4 addresses that I did memorise over the years. For example, by memorising a root server address such as 198.41.0.4 I can lookup the IP address for any domain name, using non-recursive queries to only authoritative DNS servers, without using a DNS cache like 8.8.8.8 or some other third party DNS "service". All I need is a stub resolver, like dnsq, drill or dq. By memorising the IP address of a .com nameserver, such as 192.5.6.30, I can lookup any .com domain name using the same non-recursive methodology. All the third party DNS caches could be poisoned, have outages or whatever. I would not need any of them to continue using the web. And by memorising the address for getting a copy of the root zone, i.e., 192.0.32.9, I can avoid having to make DNS queries to find out the namservers for any TLD. I can use HTTP or FTP to retrieve the zone data. ftp -4 ftp://192.0.32.9/pub/root.zone As it happpens I store lots of historical DNS data so if there was a massive DNS outage I can still continue using the web uninterrupted. Day-to-day I'm not using remote DNS much. I'm using stored DNS data retrieved in bulk at some time point in the past. For the data I retrieve, very few addresses change often if at all. I like IPv4. I think it will be around for the duration of my lifetime. It works everywhere and I like reliability. I disable IPv6 on the computers I can fully control. (Obviously "smartphones" are excluded from the list, that's why they suck as computers.) When compiling software that has "--disable-IPv6" as a configure option, I always disable IPv6. I also disable getaddrinfo() when it's an option. I prefer gethostbyname().
- orangeboats 3y ago
  The last paragraph is confusing. Why still disable IPv6 when you are obviously not concerned by memorization of long addresses?
sgammon 3y ago
This is pretty useful. Thank you

78 points by throwup238 3y ago

Daviey 3y ago

Perhaps someone can do a post on the inverse, to help people coming from an ipv6 background to understand ipv4.

teddyh 3y ago
For whom, people who live backwards in time¹? 1. <https://www.gnu.org/software/emacs/manual/html_node/emacs/Antinews.html https://www.gnu.org/software/emacs/manual/html_node/emacs/An...>
- wmf 3y ago
  We can only hope that one day IPv4 will be considered retrocomputing.

jiggawatts 3y ago

Let's just get this out of the way before the debate commences: DNS was invented in 1985 so that you don't have to memorise IP addresses. DHCP was invented in 1984 so that you don't have to allocate IP addresses manually. You can allocate nice short IPv6 addresses if you like to memorise hundreds of numbers as a hobby instead of letting the computer do that for you. NAT is a hack for getting past the address-space limitations of IPv4. NAT provides security as a side-effect. Firewalls provide the same security. Every router has a firewall built in now, whether they use NAT or not. IPv6 has the same security as IPv4 whether or not you use NAT. There are no "privacy issues" with IPv6. All modern clients randomise the host part of the address. You "look the same" to the rest of the Internet whether your unique address is a single IPv4 address or a /64 prefix. It's a unique identifier in both cases. People that want to track you can use a hundred other techniques, most of which are more robust than your IP address. You're tracked anyway. Giving up on the future of the Internet in a futile attempt to stop your porn habits being tracked is not a valid argument against IPv6.

trvr 3y ago
Can you expand on the "All modern clients randomise the host part of the address" statement. Do they randomize this host part for every session or just once per network? I've always been under the impression that it is actually easier to track an individual user on IPv6 because each device now has a unique address. Example Company could now tell the difference between 2 users in a home, for example, instead of just a single NAT'd IPv4 address. Is that not true?
- tolien 3y ago
  How frequently the randomisation happens is configurable but the expectation is it should be ~daily. The thing you’re looking for is the SLAAC Privacy Extensions [1] 1: https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/ https://www.internetsociety.org/resources/deploy360/2014/pri...
- ianburrell 3y ago
  IPv6 host can change its address as much as it wants. In fact, it can have as many addresses as it wants. It could use a different address for every outgoing connection. Nothing goes that far. Most modern OSes change IPv6 every hour to once per day. The result is that any tracker can't tell if two IPv6 addresses in the same subnet are two hosts or one that changed its address.
- arccy 3y ago
  you get a randomized address for the network, but then also temporary addresses that are cycled on reboot / netstack restarts for outgoing connections
- burnerthrow008 3y ago
  > Can you expand on the "All modern clients randomise the host part of the address" statement. Do they randomize this host part for every session or just once per network? In practice, most OSes generate a new address once per day, but more significantly, it is completely normal for an IPv6 host to have multiple addresses per interface at the same time. In fact, it is effectively mandatory to have at least two: First, you must have a link-local address (fe80::/10), which is non-routable. This is required for SLAAC and DHCPv6 to work. Second, if you want to talk to the rest of internet, you need a routable address (from SLAAC or DHCPv6). In practice, it's even more than that: The computer I'm writing this on currently has 12 IPv6 addresses on one ethernet interface. Besides the link-local address, it has as a bunch of routable addresses on the prefix delegated by my ISP. All but one of the routable are "deprecated" which means that they won't be used for new outgoing connections, but remain active for existing connections. So not only do you get a new randomized address every 24 hours, you may have an arbitrary number of randomized addresses active at any given time. There's nothing stopping a privacy-focused Linux distro from generating a new address for every outgoing connection, and having them all active at once.

oldnetguy 3y ago

IPv6 is horrible. I would rather have many more decimal based addresses than trying to think in hex. As for DNS, DNS is probably 30% of my problems and it just made it worse.

joe_guy 3y ago
I've got no horse in the race, but I recall this being an enlightening read https://apenwarr.ca/log/20170810 https://apenwarr.ca/log/20170810
- mdaniel 3y ago
  That was stellar, thanks so much for sharing it > We'll need to keep running a local DHCP server at home so that our obsolete IPv4 light bulbs keep working. We'll keep needing NAT so that our obsolete IPv4 light bulbs can keep reaching the Internet. I feel seen :-(
- rstuart4133 3y ago
  As the other poster said, Stellar. At the end I was reading about mobile IP issues, and a voice in my head said I bet he doesn't mention QUIC. Then he mentioned it. Which makes it the most complete piece I've read on IP routing.
- Dagger2 3y ago
  It's not really, it just spends a lot of time waffling on about bus networks and mobile IPs and then makes some weird claims about the IETF that don't seem to match reality. v6 is designed the way it is precisely because it needs to run on the same networks that v4 does, and v6 is a better design than v4 in our world because our world has completely outgrown v4.
menotyou 3y ago
This. I still keep IPv6 turned of in my local network at home.
kmbfjr 3y ago
Not trying to be a smartass, but managing DNS at scale IS a solved problem. Maybe change tooling? IPv6 is awful, but it is what it is and I appreciate the death of NAT.

binkHN 3y ago

Just a note that this is from 2020, but probably still an important read for those who need a primer.

o11c 3y ago

You can mostly migrate to just using IPv6 APIs (as long as the sockopt IPV6_V6ONLY is disabled), but there are a couple major regressions. There is no equivalent to 127.0.0.0/8, so you can't start separate servers on e.g. 127.0.0.2, 127.0.0.3, and 127.0.0.4 /etc/hosts cannot be enumerated; you can only do lookups. You have to do that stupid wrap/unwrap with [] dance when converting between host names and addresses. The other major porting concern is that you have to use `struct sockaddr_storage` where before you could get away with `struct sockaddr`.

gerdesj 3y ago

This is a post from 2020 using a 2018 Ubuntu LTS release. Its 2024 and not really topical any more unless as a historical how we did stuff back then.

nightpool 3y ago
Which parts are outdated? It mostly looks like an explanation of IPv6 networking fundamentals, such as how DHCPv6 works. I wouldn't expect those to change substantially based on OS version.

deleted 3y ago

[deleted]

guilhas 3y ago

So if I have 1000 devices I have to advertise every single one to my ISP? Couldn't they start a pricing based on how many devices I have? By default it will send the mac addresses of all devices? Is there a way to enable IPv6 NAT?

burnerthrow008 3y ago
> So if I have 1000 devices I have to advertise every single one to my ISP? Generally: No, if they use Prefix Delegation (which is what most non-mobile ISPs use). Your router sends a DHCPv6-PD request and the ISP delegates a /48 (usually) or /64 (if they are run by morons) prefix to your router. Your router advertises that prefix on the local network, and hosts self-assign addresses within that prefix. > Couldn't they start a pricing based on how many devices I have? Most OSes generate new random addresses every 24 hours (and keep old addresses with open connections), so there is no reliable way for your ISP to determine how many hosts are on your network.
overstay8930 3y ago
It is easier to determine number of devices using network flows and DNS queries than it is to use IPv6 because of the many privacy extensions in use today.

Uptrenda 3y ago

Honestly quite a horrible reference for people new to IPv6. Seems like the author was more concerned with flexing how much they know about IPv6 than teaching anyone how to use it. In that rambling, wall of text and literal packet dumps no where are they even close to: 1. Explaining the basic details about IPv6's address model (e.g. what is link-local, what is global scope? where should one use them?) 2. Letting anyone make an IPv6 connection to various address types (gee, would be useful, right? Kinda the point, no?) 3. Maybe letting someone use their browser to connect to an IPv6 address. (also helpful as it would show the above catches.) 4. Hosting services that use IPv6 in software. Can you really blame people for not using IPv6 when people try pull this shit.

1vuio0pswjnm7 3y ago

"DNS was invented so that you don't have to memorise IP addresses." Prior to DNS it was necessary to have all the IP addresses one needed stored in a local file, HOSTS.TXT. It was not necessary to to memorise the addresses stored in this file. Memorisation of IP addresses was never a requirement to use the internet. To this day, /etc/hosts allows me to avoid memorising IP addresses. No DNS required. But more importantly it allows me to avoid _having to type_ either IP addresses or domain names. I can assign short strings in place of typing addresses or domain names. For example, echo 127.0.0.1 localhost lo|sed -i -e 1r/dev/stdin -e 1N /etc/hosts Now I can type "lo" without having to type "127.0.0.1" or "localhost" echo 5.179.1.4 ftp.lanet.lv ftp1|sed -i -e 1r/dev/stdin -e 1N /etc/hosts Now I can type "ftp1" instead of having to remember 5.179.1.4 or ftp.lanet.lv echo ls |ftp ftp://ftp1/pub There are some useful IPv4 addresses that I did memorise over the years. For example, by memorising a root server address such as 198.41.0.4 I can lookup the IP address for any domain name, using non-recursive queries to only authoritative DNS servers, without using a DNS cache like 8.8.8.8 or some other third party DNS "service". All I need is a stub resolver, like dnsq, drill or dq. By memorising the IP address of a .com nameserver, such as 192.5.6.30, I can lookup any .com domain name using the same non-recursive methodology. All the third party DNS caches could be poisoned, have outages or whatever. I would not need any of them to continue using the web. And by memorising the address for getting a copy of the root zone, i.e., 192.0.32.9, I can avoid having to make DNS queries to find out the namservers for any TLD. I can use HTTP or FTP to retrieve the zone data. ftp -4 ftp://192.0.32.9/pub/root.zone As it happpens I store lots of historical DNS data so if there was a massive DNS outage I can still continue using the web uninterrupted. Day-to-day I'm not using remote DNS much. I'm using stored DNS data retrieved in bulk at some time point in the past. For the data I retrieve, very few addresses change often if at all. I like IPv4. I think it will be around for the duration of my lifetime. It works everywhere and I like reliability. I disable IPv6 on the computers I can fully control. (Obviously "smartphones" are excluded from the list, that's why they suck as computers.) When compiling software that has "--disable-IPv6" as a configure option, I always disable IPv6. I also disable getaddrinfo() when it's an option. I prefer gethostbyname().

orangeboats 3y ago
The last paragraph is confusing. Why still disable IPv6 when you are obviously not concerned by memorization of long addresses?

sgammon 3y ago

This is pretty useful. Thank you