5 ms·

IPv6 may already be irrelevant – but so is moving off IPv4

36 points by beardyw 2y ago

KaiserPro 2y ago
I mean its an opinion. The argument is somewhat thin "CDNs use DNS so it doesn't matter what the IP is" I mean yes, that true, but it should have always been true. Dishing out raw IPs is bad anyway, it limits your flexibility (yes yes anycast exists, but if you're big enough to setup any cast, I bet you're using ipv6 internally already) Ipv6 is here, and will slowly grow as time goes on. There will be growing pains, but its plain cheaper to run at any kind of scale. (especially now AWS are charging for public IPv4 addresses) If you are hosting thousands of servers, and you haven't drunken the batshit K8s networking schema, then ipv6 becomes really rather practical, especially if you are giving out unique addresses to containers 10.0.0.0/8 runs out pretty quick.
- mananaysiempre 2y ago
  > if you're big enough to setup anycast Incidentally, if you want to play with anycast on the public Internet, BuyVM[1] will let you do that on $10.50/mo (3×$3.50/mo very resource-limited VPSes). Catching those VPSes when they’re in stock is something of an ordeal, though. [1] https://buyvm.net/anycast-vps/ https://buyvm.net/anycast-vps/
- batch12 2y ago
  > 10.0.0.0/8 runs out pretty quick 16,777,216 containers, wow.
  - sumtechguy 2y ago
    I am going to give them the benefit of the doubt. Maybe they are thinking it would probably run out due to poor segmentation? It would be quite the interesting problem of network segmentation to run your whole service provider with thousands of customers and network out of a single 10 network. Realistically a better option was each customer gets their own locked off network and vlan level.
  - ReK_ 2y ago
    Except it's not 16 million containers. You need addressing for every link in the network. Want 10 racks of 20 servers with redundant switching in each, redundant spines in the network rack? That's 60 physical links, each of which need two addresses, and that's just the fabric underlay network. You haven't created the actual overlay networks yet, which you need multiple of (front end, back end, database, storage...). Consider that 200 servers is a drop in the bucket at some scales, you can see why data centre is moving to V6 only.
  - throw0101b 2y ago
    >> 10.0.0.0/8 runs out pretty quick > 16,777,216 containers, wow. Have you ever been involved in a corporate merger? IP conflicts are a huge pain point. Quite often you have to NAT with-in the company itself because the acquirer and acquiree are both using 10/8.
    - Volundr 2y ago
      This was literally why we went IPv6 in a previous company. We were acquiring other companies like crazy and it and the conflicts were constant pain where we'd either have to re-IP a location (Active Directory does not like) or do internal facing NATs and DNS weirdness (AD also not a big fan). We quickly discovered it was easier to get the new location up and running on IPv6 and mesh that so all inter-office traffic was IPv6 rather than resolving the conflicts. Sure you couldn't reach the printer in Boise from New York because it was IPv4 only, but for the stuff normal users were doing it worked great.
  - KaiserPro 2y ago
    So, if you have a sane ipv4 network, where everything is dhcp, and nothing apart from a few key things are statically assigned, then yeah _technically_ you can have 16million addresses all at once. But, subnets need to be located next to each other physically, otherwise performance suffers. subnets have affinity. but once you have subnets, you then start loosing packing efficiency. for example, in the batshit world of K8s, you give each node its own /24 to dish out. Not only cant that limit the number of containers you can host, it also is really inefficient. (eating 256k addresses) More over, it also means that you need to reuse addresses. in a large cluster of say 1000 nodes, each hosting 40 containers, starting/stopping anything up to 30 containers a second isn't unreasonable. Its not inconceivable that you'll end up trying to connect to a stale address (either because its not propagated yet, or your brand of service discovery isn't that fast). This can cause hilarious transitory errors. but if you could assign an IP per container, and have enough space to not re-use that address for at least a few hours then that goes away. so instead of getting weird fuzzing errors(or misc 404/401), you get a connection timed out.
rzzzt 2y ago
Geoff's post was also discussed here this week: https://news.ycombinator.com/item?id=41893200 https://news.ycombinator.com/item?id=41893200
wjholden 2y ago
I actually made the unusual decision, last year, to go IPv6-only on a small website I operate. The reason why is that AWS changed their billing policy for public IPv4 addresses. This is a tiny website that people only access on their cell phones, so I can accept an occasional inconvenience for the marginal cost savings. I haven't heard of anyone else doing this, but I doubt I'm completely alone in trying to minimize hosting costs.
- mobilio 2y ago
  IF you need IPv4 for some users like me where ISPs is IPv4 only then you can use a CloudFlare or CloudFront and expose IPv4 too.
- aeurielesn 2y ago
  On the other hand, same as you I tried IPv6-only to reduce costs but I couldn't load my website at all on my mobile.
- NAHWheatCracker 2y ago
  I did this as well for 3 domains that use the same EC2. There were random connectivity problems from my phone for a couple months, but it works perfectly for the past 6 months. I have no idea why the issues went away.
mort96 2y ago
I don't understand the title. What's the "but" there? IPv6 being irrelevant and moving off IPv4 being irrelevant seem like they go hand in hand, if moving off IPv4 is irrelevant then of course IPv6 is irrelevant!
- Suzuran 2y ago
  Don't think about it too much, just remember that only large corporations are supposed to be peers on the internet, everyone else should be behind layers of NAT to ensure they can't become a problem.
ports543u 2y ago
The resistance to switch to ipv6, or the comfort with the ipv4-born address exhaustion remedies, only helps an internet of consumers, not an internet of peers that create and share. If you are behind NAT or CG-NAT, you can only consume, not create. You can't host a server, expose a port. You are at the mercy of the big fish.
- wpm 2y ago
  My ISP is IPv4 only and I host plenty of shit and punch plenty of holes. That’s a function of my firewall not how many bits are in my IP address.
  - akdev1l 2y ago
    You can’t punch any holes through carrier-grade NAT (CGNAT).
    - vetinari 2y ago
      You can, if your ISP cooperates, using PCP.
      - fooqux 2y ago
        Frankly, you lost me at "if your ISP cooperates".
        vetinari 2y ago
        It is a function of the CGNAT at the ISP side. They need to have that enabled. Some do.
  - ReK_ 2y ago
    That's only true if you aren't behind CG-NAT. If you are, your firewall can port forward all it wants but it won't matter, the ISP would have to also port forward to you.
pwarner 2y ago
Anycast and SNI mean someone like cloud flare only needs one IPv4 for their entire public facing service? Is that the gist? Obviously I exaggerate but I think that's their point?
throw0101b 2y ago
Discussion on the original weblog post this article talks about (The IPv6 Transition (potaroo.net), 224 points by todsacerdoti 3 days ago): * https://news.ycombinator.com/item?id=41893200 https://news.ycombinator.com/item?id=41893200 (The The APNIC article is a repost of the potaroo.net article.)
oldandboring 2y ago
Lots of consumer router/gateways out there are old and don't have IPv6 turned on. If you turn off IPv4 for your services, those folks just won't be able to connect and they won't know why, they'll just move on. Any who want to complain won't even know who to complain to, and they won't be able to fix it themselves. That's bad. And yes, you could put a CDN in front of everything, but won't that wipe out some/all of the savings (assuming you're with a cloud provider that's charging for IPv4)? This basically explains why I put the brakes on our IPv6 migrations. From our clients' perspective it would have been an unforced error.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
mmaunder 2y ago
Felt like the article went off into lala land towards the end: “The last couple of decades have seen us stripping out network-centric functionality and replacing this with an undistinguished commodity packet transport medium. It's fast and cheap, but it's up to applications to overlay this common basic service with its own requirements." The result is networks become "simple dumb pipes!" Given that, Huston wonders if it's time to revisit the definition of the internet as networks that use a common shared transmission fabric, a common suite of protocols and a common protocol address pool. Rather, he posits "Is today's network more like 'a disparate collection of services that share common referential mechanisms using a common namespace?'"
ryandvm 2y ago
IPv6 and Python 3 are case studies in How to Not Upgrade Something. They basically created entirely different products that provided a marginal immediate benefit to the users and then said "upgrade whenever you get around to it". They are both now in the 2nd decade of their upgrade cycle. PowerPC->Intel, Xbox/PlayStation emulation, x86 32-bit>64-bit, and Java are all technologies that had successful upgrade strategies that were centered around replacing the original product rather than indefinitely providing an alternative.
- JohnFen 2y ago
  I think this describes very well what's happened. I haven't moved my systems to IPv6, and have no current plans to do so, because it's a pretty major change (meaning a ton of hassle) that brings me no benefits that I care about. If/when IPv6 becomes mandatory to connect to the internet, I'll go to the trouble of shifting my systems.
- throw0101a 2y ago
  > IPv6 and Python 3 are case studies in How to Not Upgrade Something. There was no other way to do it with IPv6: IPv4 has 32-bits of address space and >32 was needed for more addresses. That 32-bits is hard-coded in data structures, APIs, and even DNS formats (e.g., A records). So regardless of anything else related to IPv6 (ARP vs ND), you would have still needed to release a bunch of code that had to be installed on every router, L3 switch, firewall, DNS server, and end device. It was also recognized that, given the size of the Internet even in the 1990s, that a flag day like was done for the NCP->IP transition would not be possible: We believe that it is not possible to have a "flag-day" form of transition in which all hosts and routers must change over at once. The size, complexity, and distributed administration of the Internet make such a cutover impossible. * https://datatracker.ietf.org/doc/html/rfc1726#section-5.5 https://datatracker.ietf.org/doc/html/rfc1726#section-5.5 So you were always going to have to have a 'rolling upgrade' to get a larger address space. You were always going to have translation systems. It was also recognized that the 'legacy' may never go away: Furthermore, we note that, in all probability, there will be IPv4 hosts on the Internet effectively forever. IPng must provide mechanisms to allow these hosts to communicate, even after IPng has become the dominant network layer protocol in the Internet. * Ibid
fanf2 2y ago
Previously: • https://news.ycombinator.com/item?id=41893200 https://news.ycombinator.com/item?id=41893200 – https://www.potaroo.net/ispcol/2024-10/ipv6-transition.html https://www.potaroo.net/ispcol/2024-10/ipv6-transition.html – The IPv6 Transition – (224 points / 416 comments)

36 points by beardyw 2y ago

I mean its an opinion. The argument is somewhat thin "CDNs use DNS so it doesn't matter what the IP is" I mean yes, that true, but it should have always been true. Dishing out raw IPs is bad anyway, it limits your flexibility (yes yes anycast exists, but if you're big enough to setup any cast, I bet you're using ipv6 internally already) Ipv6 is here, and will slowly grow as time goes on. There will be growing pains, but its plain cheaper to run at any kind of scale. (especially now AWS are charging for public IPv4 addresses) If you are hosting thousands of servers, and you haven't drunken the batshit K8s networking schema, then ipv6 becomes really rather practical, especially if you are giving out unique addresses to containers 10.0.0.0/8 runs out pretty quick.

mananaysiempre 2y ago
> if you're big enough to setup anycast Incidentally, if you want to play with anycast on the public Internet, BuyVM[1] will let you do that on $10.50/mo (3×$3.50/mo very resource-limited VPSes). Catching those VPSes when they’re in stock is something of an ordeal, though. [1] https://buyvm.net/anycast-vps/ https://buyvm.net/anycast-vps/
batch12 2y ago
> 10.0.0.0/8 runs out pretty quick 16,777,216 containers, wow.
- sumtechguy 2y ago
  I am going to give them the benefit of the doubt. Maybe they are thinking it would probably run out due to poor segmentation? It would be quite the interesting problem of network segmentation to run your whole service provider with thousands of customers and network out of a single 10 network. Realistically a better option was each customer gets their own locked off network and vlan level.
- ReK_ 2y ago
  Except it's not 16 million containers. You need addressing for every link in the network. Want 10 racks of 20 servers with redundant switching in each, redundant spines in the network rack? That's 60 physical links, each of which need two addresses, and that's just the fabric underlay network. You haven't created the actual overlay networks yet, which you need multiple of (front end, back end, database, storage...). Consider that 200 servers is a drop in the bucket at some scales, you can see why data centre is moving to V6 only.
- throw0101b 2y ago
  >> 10.0.0.0/8 runs out pretty quick > 16,777,216 containers, wow. Have you ever been involved in a corporate merger? IP conflicts are a huge pain point. Quite often you have to NAT with-in the company itself because the acquirer and acquiree are both using 10/8.
  - Volundr 2y ago
    This was literally why we went IPv6 in a previous company. We were acquiring other companies like crazy and it and the conflicts were constant pain where we'd either have to re-IP a location (Active Directory does not like) or do internal facing NATs and DNS weirdness (AD also not a big fan). We quickly discovered it was easier to get the new location up and running on IPv6 and mesh that so all inter-office traffic was IPv6 rather than resolving the conflicts. Sure you couldn't reach the printer in Boise from New York because it was IPv4 only, but for the stuff normal users were doing it worked great.
- KaiserPro 2y ago
  So, if you have a sane ipv4 network, where everything is dhcp, and nothing apart from a few key things are statically assigned, then yeah _technically_ you can have 16million addresses all at once. But, subnets need to be located next to each other physically, otherwise performance suffers. subnets have affinity. but once you have subnets, you then start loosing packing efficiency. for example, in the batshit world of K8s, you give each node its own /24 to dish out. Not only cant that limit the number of containers you can host, it also is really inefficient. (eating 256k addresses) More over, it also means that you need to reuse addresses. in a large cluster of say 1000 nodes, each hosting 40 containers, starting/stopping anything up to 30 containers a second isn't unreasonable. Its not inconceivable that you'll end up trying to connect to a stale address (either because its not propagated yet, or your brand of service discovery isn't that fast). This can cause hilarious transitory errors. but if you could assign an IP per container, and have enough space to not re-use that address for at least a few hours then that goes away. so instead of getting weird fuzzing errors(or misc 404/401), you get a connection timed out.

rzzzt 2y ago

Geoff's post was also discussed here this week: https://news.ycombinator.com/item?id=41893200 https://news.ycombinator.com/item?id=41893200

wjholden 2y ago

I actually made the unusual decision, last year, to go IPv6-only on a small website I operate. The reason why is that AWS changed their billing policy for public IPv4 addresses. This is a tiny website that people only access on their cell phones, so I can accept an occasional inconvenience for the marginal cost savings. I haven't heard of anyone else doing this, but I doubt I'm completely alone in trying to minimize hosting costs.

mobilio 2y ago
IF you need IPv4 for some users like me where ISPs is IPv4 only then you can use a CloudFlare or CloudFront and expose IPv4 too.
aeurielesn 2y ago
On the other hand, same as you I tried IPv6-only to reduce costs but I couldn't load my website at all on my mobile.
NAHWheatCracker 2y ago
I did this as well for 3 domains that use the same EC2. There were random connectivity problems from my phone for a couple months, but it works perfectly for the past 6 months. I have no idea why the issues went away.

mort96 2y ago

I don't understand the title. What's the "but" there? IPv6 being irrelevant and moving off IPv4 being irrelevant seem like they go hand in hand, if moving off IPv4 is irrelevant then of course IPv6 is irrelevant!

Suzuran 2y ago
Don't think about it too much, just remember that only large corporations are supposed to be peers on the internet, everyone else should be behind layers of NAT to ensure they can't become a problem.

ports543u 2y ago

The resistance to switch to ipv6, or the comfort with the ipv4-born address exhaustion remedies, only helps an internet of consumers, not an internet of peers that create and share. If you are behind NAT or CG-NAT, you can only consume, not create. You can't host a server, expose a port. You are at the mercy of the big fish.

wpm 2y ago
My ISP is IPv4 only and I host plenty of shit and punch plenty of holes. That’s a function of my firewall not how many bits are in my IP address.
- akdev1l 2y ago
  You can’t punch any holes through carrier-grade NAT (CGNAT).
  - vetinari 2y ago
    You can, if your ISP cooperates, using PCP.
    - fooqux 2y ago
      Frankly, you lost me at "if your ISP cooperates".
      - vetinari 2y ago
        It is a function of the CGNAT at the ISP side. They need to have that enabled. Some do.
- ReK_ 2y ago
  That's only true if you aren't behind CG-NAT. If you are, your firewall can port forward all it wants but it won't matter, the ISP would have to also port forward to you.

pwarner 2y ago

Anycast and SNI mean someone like cloud flare only needs one IPv4 for their entire public facing service? Is that the gist? Obviously I exaggerate but I think that's their point?

throw0101b 2y ago

Discussion on the original weblog post this article talks about (The IPv6 Transition (potaroo.net), 224 points by todsacerdoti 3 days ago): * https://news.ycombinator.com/item?id=41893200 https://news.ycombinator.com/item?id=41893200 (The The APNIC article is a repost of the potaroo.net article.)

oldandboring 2y ago

Lots of consumer router/gateways out there are old and don't have IPv6 turned on. If you turn off IPv4 for your services, those folks just won't be able to connect and they won't know why, they'll just move on. Any who want to complain won't even know who to complain to, and they won't be able to fix it themselves. That's bad. And yes, you could put a CDN in front of everything, but won't that wipe out some/all of the savings (assuming you're with a cloud provider that's charging for IPv4)? This basically explains why I put the brakes on our IPv6 migrations. From our clients' perspective it would have been an unforced error.

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

mmaunder 2y ago

Felt like the article went off into lala land towards the end: “The last couple of decades have seen us stripping out network-centric functionality and replacing this with an undistinguished commodity packet transport medium. It's fast and cheap, but it's up to applications to overlay this common basic service with its own requirements." The result is networks become "simple dumb pipes!" Given that, Huston wonders if it's time to revisit the definition of the internet as networks that use a common shared transmission fabric, a common suite of protocols and a common protocol address pool. Rather, he posits "Is today's network more like 'a disparate collection of services that share common referential mechanisms using a common namespace?'"

ryandvm 2y ago

IPv6 and Python 3 are case studies in How to Not Upgrade Something. They basically created entirely different products that provided a marginal immediate benefit to the users and then said "upgrade whenever you get around to it". They are both now in the 2nd decade of their upgrade cycle. PowerPC->Intel, Xbox/PlayStation emulation, x86 32-bit>64-bit, and Java are all technologies that had successful upgrade strategies that were centered around replacing the original product rather than indefinitely providing an alternative.

JohnFen 2y ago
I think this describes very well what's happened. I haven't moved my systems to IPv6, and have no current plans to do so, because it's a pretty major change (meaning a ton of hassle) that brings me no benefits that I care about. If/when IPv6 becomes mandatory to connect to the internet, I'll go to the trouble of shifting my systems.
throw0101a 2y ago
> IPv6 and Python 3 are case studies in How to Not Upgrade Something. There was no other way to do it with IPv6: IPv4 has 32-bits of address space and >32 was needed for more addresses. That 32-bits is hard-coded in data structures, APIs, and even DNS formats (e.g., A records). So regardless of anything else related to IPv6 (ARP vs ND), you would have still needed to release a bunch of code that had to be installed on every router, L3 switch, firewall, DNS server, and end device. It was also recognized that, given the size of the Internet even in the 1990s, that a flag day like was done for the NCP->IP transition would not be possible: We believe that it is not possible to have a "flag-day" form of transition in which all hosts and routers must change over at once. The size, complexity, and distributed administration of the Internet make such a cutover impossible. * https://datatracker.ietf.org/doc/html/rfc1726#section-5.5 https://datatracker.ietf.org/doc/html/rfc1726#section-5.5 So you were always going to have to have a 'rolling upgrade' to get a larger address space. You were always going to have translation systems. It was also recognized that the 'legacy' may never go away: Furthermore, we note that, in all probability, there will be IPv4 hosts on the Internet effectively forever. IPng must provide mechanisms to allow these hosts to communicate, even after IPng has become the dominant network layer protocol in the Internet. * Ibid

fanf2 2y ago

Previously: • https://news.ycombinator.com/item?id=41893200 https://news.ycombinator.com/item?id=41893200 – https://www.potaroo.net/ispcol/2024-10/ipv6-transition.html https://www.potaroo.net/ispcol/2024-10/ipv6-transition.html – The IPv6 Transition – (224 points / 416 comments)