2 ms·
Things will be simpler without NAT for sure, but the article assumes that carriers won't still have stateful firewalls with IPv6 that also require battery-drain
by agwa 14y ago
Things will be simpler without NAT for sure, but the article assumes that carriers won't still have stateful firewalls with IPv6 that also require battery-draining keepalives. If IPv6 mobile networks don't have stateful firewalls, then the battery-draining keepalives could be replaced by battery-draining port scans and other probing/DoS attempts by attackers.
On the other hand, perhaps if the carriers sparsely assign IPv6 addresses from their vast address space, it won't be feasible for attackers to scan for nodes as they do now.
I think the article is premature in suggesting anything about how IPv6 will be implemented in mobile networks in practice.
- Aloisius 14y agoIt seems incredibly unlikely that anyone is going to be able to do a active network scan of an address block to find devices with IPv6. Each end-user is granted a /64 network which has over 4 billion times the number of IPs than exist on the entire IPv4 internet. Even with MAC-based IPv6 autoconfiguration to reduce the number of IPs you have to scan using tables of assigned vendor prefixes, you still have a truly massive number of IPs to scan before you find anyone. Put another way, it would take over 500,000 years to just send an ICMPv6 packet to a /64 block (assuming you could even narrow it down to a /64 which itself seems just as unlikely) with a 1 Gbps connection (over ethernet).
- agwa 14y agoIf a mobile phone is given a /64 that means that entire /64 is routed to the phone, so any attempt to scan it (even if it doesn't find the actual address in use by the device) will cause battery drain. But maybe attackers just won't even try.