3 ms·
The article is wrong about address assignments. First, /32 is the minimum allocation size, which means you (an ISP) can't get fewer addresses than that (not mo
by agwa 14y ago
The article is wrong about address assignments.
First, /32 is the minimum allocation size, which means you (an ISP) can't get fewer addresses than that (not more as the article claims). The reason you'd want to have a minimum allocation size is because it makes routing tables smaller (better for an organization to have just one entry in the routing table that's huge that they can grow into, than to start small and add lots of small entries to the routing table as they grow).
Second, /48 is what ISPs typically give their subscribers, not what ISPs themselves get.
Edit: to clarify, the /32 minimum is a policy of ARIN and RIPE (not sure about the other RIRs). See for example https://www.arin.net/policy/archive/ipv6_policy.html#43 https://www.arin.net/policy/archive/ipv6_policy.html#43 and http://www.ripe.net/ripe/docs/ripe-552#minimum_allocation http://www.ripe.net/ripe/docs/ripe-552#minimum_allocation. There is no mandatory policy for how ISPs should assign addresses to their subscribers. RFC3177 recommended a /48 in most cases, though that has recently been superseded by RFC6177, which recommends more flexibility rather than a one-size-fits all approach. See http://tools.ietf.org/html/rfc6177 http://tools.ietf.org/html/rfc6177.
I find the article somewhat reckless in recommending that you ban entire /64s instead of individual IPv6 addresses. It's true that you need to be aware that a home user will likely be in control of an entire /64 (and possibly more), but if the offending IP address is at a university or a datacenter then a /64 ban could sweep up a lot of innocent bystanders. You really need to consider bans on a case-by-case basis.
- lucb1e 14y agoThank you for your comments, I'll edit the post accordingly! I thought the RIR could be assigned a /32 subnet at most (by the IANA), and that the RIR would hand /48 out to ISPs. The book I read on IPv6 is from before RFC6177, perhaps that's where the confusion came from.
- stephengillie 14y agoOften, banning whole ISPs is necessary to actually get rid of offenders. Hackers and griefers have known how to get new addresses from their DHCP pool for at least 10 years, and now that they'll get access to an entire /64, many will be sure to exploit it. In fact, I'll bet the malware-infested utility to automate this into a one-click process already exists.
- agwa 14y agoI don't disagree with that, but please do some investigation before banning an entire subnet, or wait until you actually observe a user jumping around the subnet. And never ban an entire ISP if you haven't first given their abuse department a chance to do the right thing. If you don't do this, you're harming innocent people.
- stephengillie 14y agoYour warning has merit, but it's a little out-of-scope for the problem. I'm not talking about banning people from playing Halo, I'm banning them from just my server for medium durations like a day or a week. And chances are they're the only person connecting to my server from that ISP -- each of the ~30 people on the server probably has a different ISP.