3 ms·

That is not ARP problem. Its called broadcast storm and its problem of stupid people and/or bad equipment. You can bring any network down with incompetence. Th

by Borg3 2y ago

That is not ARP problem. Its called broadcast storm and its problem of stupid people and/or bad equipment. You can bring any network down with incompetence. Thats why newer switches have STP, DHCP Snooping, ARP security and so on. Now take a look at ND tables exchaustion alone. Trival attack to do on IPv6 segment. Is it solved yet? I dont know. I do NOT track it. The whole PnP (I call it Plug and Pray) is terrible aproach imo. IoT created hella of security problems (biggest DDoS botnets are IoT). If someone need autoconfiguration, he can slap DHCP on segment. Easy and super old protocol on IPv4. (IoT connected directly to internet? thats stupidy.. but I will leave that to other talk). So, IPv6 should be simple, easy to implement and so less prone to mistakes. All extras should be put layer up.

throw0101d 2y ago
> That is not ARP problem. Its called broadcast storm and its problem of stupid people and/or bad equipment. You can bring any network down with incompetence. It's a footgun. All footguns have ways to not trigger them, but saying you can't blow off a leg is also inaccurate. Reducing the number of footguns laying about is generally a good thing > Now take a look at ND tables exchaustion alone. No different than ARP table exhaustion (a finite L2-L3 mapping table). "First hop security" is a thing in both protocols. > So, IPv6 should be simple, easy to implement and so less prone to mistakes. All extras should be put layer up. I would argue that IPv6 is simpler to get going than IPv4: to start you don't need BOOTP/DHCP. In fact IPv4 later took some ideas from IPv6, e.g., 169.254.0.0/16 link-local addresses: This document describes a method by which a host may automatically configure an interface with an IPv4 address in the 169.254/16 prefix that is valid for Link-Local communication on that interface. This is especially valuable in environments where no other configuration mechanism is available. The IPv4 prefix 169.254/16 is registered with the IANA for this purpose. Allocation of IPv6 Link-Local addresses is described in "IPv6 Stateless Address Autoconfiguration" [RFC2462]. * https://datatracker.ietf.org/doc/html/rfc3927 https://datatracker.ietf.org/doc/html/rfc3927
- Borg3 2y ago
  It looks simpler to start with.. Aka PnP.. you just plugin in stuff, SLAC and later ND discovery kicks in and vioala, we have network up and running. But somehow I see it less managable and controlable. In Enterprise networks this is a serious issue. We need static IP, we need well known subnets, because we run FWs everywhere. And yeah.. soft LL in IPv4 is good idea. You can use it. In IPv6 you are forced to use it. Oh thank you, OSPFv3 configuration is so cool on in IPv6..
  - throw0101d 2y ago
    > In Enterprise networks this is a serious issue. We need static IP, we need well known subnets, because we run FWs everywhere. Yes, and there are tools and procedures for that: * https://datatracker.ietf.org/doc/html/rfc9099 https://datatracker.ietf.org/doc/html/rfc9099 But as the old saying goes: easy things should be simple, and hard things should be possible. I think IPv6 does that.

by Borg3 2y ago

throw0101d 2y ago

> That is not ARP problem. Its called broadcast storm and its problem of stupid people and/or bad equipment. You can bring any network down with incompetence. It's a footgun. All footguns have ways to not trigger them, but saying you can't blow off a leg is also inaccurate. Reducing the number of footguns laying about is generally a good thing > Now take a look at ND tables exchaustion alone. No different than ARP table exhaustion (a finite L2-L3 mapping table). "First hop security" is a thing in both protocols. > So, IPv6 should be simple, easy to implement and so less prone to mistakes. All extras should be put layer up. I would argue that IPv6 is simpler to get going than IPv4: to start you don't need BOOTP/DHCP. In fact IPv4 later took some ideas from IPv6, e.g., 169.254.0.0/16 link-local addresses: This document describes a method by which a host may automatically configure an interface with an IPv4 address in the 169.254/16 prefix that is valid for Link-Local communication on that interface. This is especially valuable in environments where no other configuration mechanism is available. The IPv4 prefix 169.254/16 is registered with the IANA for this purpose. Allocation of IPv6 Link-Local addresses is described in "IPv6 Stateless Address Autoconfiguration" [RFC2462]. * https://datatracker.ietf.org/doc/html/rfc3927 https://datatracker.ietf.org/doc/html/rfc3927

Borg3 2y ago
It looks simpler to start with.. Aka PnP.. you just plugin in stuff, SLAC and later ND discovery kicks in and vioala, we have network up and running. But somehow I see it less managable and controlable. In Enterprise networks this is a serious issue. We need static IP, we need well known subnets, because we run FWs everywhere. And yeah.. soft LL in IPv4 is good idea. You can use it. In IPv6 you are forced to use it. Oh thank you, OSPFv3 configuration is so cool on in IPv6..
- throw0101d 2y ago
  > In Enterprise networks this is a serious issue. We need static IP, we need well known subnets, because we run FWs everywhere. Yes, and there are tools and procedures for that: * https://datatracker.ietf.org/doc/html/rfc9099 https://datatracker.ietf.org/doc/html/rfc9099 But as the old saying goes: easy things should be simple, and hard things should be possible. I think IPv6 does that.