4 ms·

There is one practical difference. IPv6 without a NAT exposes information about different devices inside the private network. A NAT (whether ipv4 or ipv6) will

by thayne 11mo ago

There is one practical difference. IPv6 without a NAT exposes information about different devices inside the private network. A NAT (whether ipv4 or ipv6) will obfuscate how many devices are on the network. Whether that is desirable depends on the circumstances.

labcomputer 11mo ago
> IPv6 without a NAT exposes information about different devices inside the private network. In practice this has not been true for over 20 years. IPv6 devices on SLAAC networks (which is to say, almost all of them) regularly rotate their IPv6 address. The protocol also explicitly encourages (actually, requires) hosts to have more than one IPv6 address active at any given time. You are also making a wrong assumption that the externally visible address and port ranges chosen by the NAT device do not make the identity of internal devices easily guessable.
throw0101a 11mo ago
> A NAT (whether ipv4 or ipv6) will obfuscate how many devices are on the network. Whether that is desirable depends on the circumstances. "Revisiting IoT Fingerprinting behind a NAT": * https://par.nsf.gov/servlets/purl/10332218 https://par.nsf.gov/servlets/purl/10332218 "Study on OS Fingerprinting and NAT/Tethering based on DNS Log Analysis": * https://www.irtf.org/raim-2015-papers/raim-2015-paper21.pdf https://www.irtf.org/raim-2015-papers/raim-2015-paper21.pdf Also: > […] In this paper, we design an efficient and scalable system via spatial-temporal traffic fingerprinting from an ISP’s perspective in consideration of practical issues like learning- testing asymmetry. Our system can accurately identify typical IoT devices in a network, with the additional capability of identifying what devices are hidden behind NAT and the number of each type of device that share the same IP address. […] * https://www.thucloud.com/zhenhua/papers/TON'22%20Hidden_IoT.pdf https://www.thucloud.com/zhenhua/papers/TON'22%20Hidden_IoT.... Thinking you're hiding things because you're behind a NAT is security theatre.

by thayne 11mo ago

labcomputer 11mo ago

> IPv6 without a NAT exposes information about different devices inside the private network. In practice this has not been true for over 20 years. IPv6 devices on SLAAC networks (which is to say, almost all of them) regularly rotate their IPv6 address. The protocol also explicitly encourages (actually, requires) hosts to have more than one IPv6 address active at any given time. You are also making a wrong assumption that the externally visible address and port ranges chosen by the NAT device do not make the identity of internal devices easily guessable.

throw0101a 11mo ago

> A NAT (whether ipv4 or ipv6) will obfuscate how many devices are on the network. Whether that is desirable depends on the circumstances. "Revisiting IoT Fingerprinting behind a NAT": * https://par.nsf.gov/servlets/purl/10332218 https://par.nsf.gov/servlets/purl/10332218 "Study on OS Fingerprinting and NAT/Tethering based on DNS Log Analysis": * https://www.irtf.org/raim-2015-papers/raim-2015-paper21.pdf https://www.irtf.org/raim-2015-papers/raim-2015-paper21.pdf Also: > […] In this paper, we design an efficient and scalable system via spatial-temporal traffic fingerprinting from an ISP’s perspective in consideration of practical issues like learning- testing asymmetry. Our system can accurately identify typical IoT devices in a network, with the additional capability of identifying what devices are hidden behind NAT and the number of each type of device that share the same IP address. […] * https://www.thucloud.com/zhenhua/papers/TON'22%20Hidden_IoT.pdf https://www.thucloud.com/zhenhua/papers/TON'22%20Hidden_IoT.... Thinking you're hiding things because you're behind a NAT is security theatre.