5 ms·

But the /64 would not be publicly routable (i.e., be visible in the global BGP table). I guess in practice, it's more like IPv4 /24 = IPv6 /48, though. The clo

But the /64 would not be publicly routable (i.e., be visible in the global BGP table). I guess in practice, it's more like IPv4 /24 = IPv6 /48, though. The closest analog to an IPv4 /32 would probably be an IPv6 /64.

lxgr 2y ago
How do routeability and BGP matter for the purpose of traffic source identification and rate limiting?
- Sesse__ 2y ago
  If you have two addresses in the same /64, you know almost certainly they are on the same LAN. If you have two addresses in neighboring /64s (same initial 63 bits), or in general within the same /48 (same initial 48 bits), you know almost certainly that they are somehow within the same organization. They could be within the same building, or in the same company, or using the same ISP or cloud provider; you don't know, but they are somehow related. How do you know? Well, since a /49 isn't individually routable in BGP, they have to _somehow_ originate at the same upstream network. There has to be some sort of cooperation between them (possibly through an ISP as a middleman). But if they are in _neighboring_ /48s, you don't have this kind of guarantee. They could be from completely different organizations. Most likely, they are on the same continent (since they were given out by the same regional internet registry; RIR), but even that is not really guaranteed. So when you are bucketing addresses for rate limiting purposes, a /48 is a reasonable place to start doing that, just like /24 is for IPv4. Of course, you may need to get smarter than that (e.g. an attacker could have access to a /32), but it's a reasonable starting spot.
  - lxgr 2y ago
    > So when you are bucketing addresses for rate limiting purposes, a /48 is a reasonable place to start doing that, just like /24 is for IPv4. I've encountered assumptions such as this one as a user, and they're really frustrating. More than once I've found myself banned from being able to log in, view a site etc. because of somebody else's bad behavior I temporarily share a CG-NAT or large public Wi-Fi with, or more likely because somebody topologically close to me got hacked. Meanwhile, actual attackers are using pretty much the entire IPv4 space worth of compromised embedded devices spread across the globe...
ikiris 2y ago
How exactly is a non routable ipv6 address going to try to log in to your ssh server?
- Sesse__ 2y ago
  By being part of a larger, routable prefix. gnfargbl didn't say the _address_ was unroutable, but that effectively, routing policies mean that /48 is a common minimum unit for administrative purposes (similar to how /24 has a special “minimum size” meaning for IPv4).

lxgr 2y ago

How do routeability and BGP matter for the purpose of traffic source identification and rate limiting?

Sesse__ 2y ago
If you have two addresses in the same /64, you know almost certainly they are on the same LAN. If you have two addresses in neighboring /64s (same initial 63 bits), or in general within the same /48 (same initial 48 bits), you know almost certainly that they are somehow within the same organization. They could be within the same building, or in the same company, or using the same ISP or cloud provider; you don't know, but they are somehow related. How do you know? Well, since a /49 isn't individually routable in BGP, they have to _somehow_ originate at the same upstream network. There has to be some sort of cooperation between them (possibly through an ISP as a middleman). But if they are in _neighboring_ /48s, you don't have this kind of guarantee. They could be from completely different organizations. Most likely, they are on the same continent (since they were given out by the same regional internet registry; RIR), but even that is not really guaranteed. So when you are bucketing addresses for rate limiting purposes, a /48 is a reasonable place to start doing that, just like /24 is for IPv4. Of course, you may need to get smarter than that (e.g. an attacker could have access to a /32), but it's a reasonable starting spot.
- lxgr 2y ago
  > So when you are bucketing addresses for rate limiting purposes, a /48 is a reasonable place to start doing that, just like /24 is for IPv4. I've encountered assumptions such as this one as a user, and they're really frustrating. More than once I've found myself banned from being able to log in, view a site etc. because of somebody else's bad behavior I temporarily share a CG-NAT or large public Wi-Fi with, or more likely because somebody topologically close to me got hacked. Meanwhile, actual attackers are using pretty much the entire IPv4 space worth of compromised embedded devices spread across the globe...

ikiris 2y ago

How exactly is a non routable ipv6 address going to try to log in to your ssh server?

Sesse__ 2y ago
By being part of a larger, routable prefix. gnfargbl didn't say the _address_ was unroutable, but that effectively, routing policies mean that /48 is a common minimum unit for administrative purposes (similar to how /24 has a special “minimum size” meaning for IPv4).