3 ms·
Yes, I meant IPv4. And rate limiting is very uncertain. If I limit per /56, users that have an entire /48 can outright bypass the rate limit. If I limit per /4
by redox99 2y ago
Yes, I meant IPv4.
And rate limiting is very uncertain. If I limit per /56, users that have an entire /48 can outright bypass the rate limit. If I limit per /48, maybe I'll erroneously limit thousands of users whose ISP has all of them on the same /48.
- pests 2y agoDon't you have those same issues with banning/rate limiting IV46 though?
- ta1243 2y agoThe difference between a /48 (like my residential handoff) and a /64 (like some people get) is the same as a difference between blocking a single /32 ipv4 address and blocking an entire /16 - which is a very large allocation If you wanted to block me, you'd have to block the whole /48. If you blocked a /48, you could be blocking 64,000 people.
- pests 2y agoI meant IPv4 - one IP might represent thousands of users. Looks like crote brought the issue up in a sibling thread.
- redox99 2y agoI haven't experienced such congested CGNATs. And assuming there are people who are under such CGNATs, they are probably used to being rate limited all the time.
- crote 2y agoBut the exact same issue exists with IPv4 due to CGNAT? A single IPv4 address could be used by a single user, or their ISP could be sharing that same single IP with many thousands of users.