6 ms·

I used Ubuntu as an example, but it is hardly the worst offender. We have seen Windows machines with more than 300 IPv6 addresses Wow! I don't operate a ve

I used Ubuntu as an example, but it is hardly the worst offender. We have seen Windows machines with more than 300 IPv6 addresses Wow! I don't operate a very large network, but I do operate an IPv6 network and I've never seen one of our machines use more than 2 addresses. I feel like they've got some other configuration option or oddity going on that's causing a lot of these problems, but I am guessing they're much smarter than I am, so I don't know what to say. Could someone elaborate on this? I've never seen this behavior on an IPv6 network, and I'm just running a server or two with radvd and no custom switch configuration.

rjsw 12y ago
Do you use privacy addresses ? I don't, the /64 is identifiable as "my house" so there is no reason to hide which particular machine is doing something.
- mgbmtl 12y ago
  A house may have multiple people living there, multiple devices, visitors, etc. You could track a person connecting through multiple locations by using their MAC address used to assign their IP. i.e. if I am connecting with my laptop from various places, my IP address will be roughly the same, only the network prefix will change.
  - rjsw 12y ago
    A house could have multiple users, mine doesn't. I would maybe see turning on privacy addresses as part of a general "leaving home" script that also turned on other stuff like the firewall.
    - RRRA 12y ago
      Time to participate in open wifi or a mesh network :-)
    - ay 12y ago
      You are completely right. Privacy IPv6 address are an illusion when used in a household that has effectively an active /64 per subscriber. (Those who say "but IPv4..." last time my IPv4 address changed, was half a year ago). Anyway this is mostly a political give-in, that happens to also help ruggedize the rest of the stack (the relatively rapid change of privacy addresses uncovers more bugs than we'd otherwise find - so from that standpoint they're to be advocated). But privacy.. huh. Last IETF there was precisely this discussion that one might want to force a new /64 on themselves, and privacy addresses have nothing to do with that. (DHC WG, FWIW).
      - X-Istence 12y ago
        Comcast is more than willing to send you more than one /64 prefix if you ask for it!
        ay 12y ago
        "effectively an active /64". Comcast folks did a ton of testing with the CPEs, and very very few could ask for anything than an active /64, that's why this qualifier :-) There's active (and pretty cool) work in the HomeNet IETF workgroup, with running code and all (http://www.homewrt.org/doku.php http://www.homewrt.org/doku.php) to make the multi-subnet home network a sane reality. But a different /64 from within the same /56 helps not much, and indeed to correctly reflect the spirit of the discussion in the DHC working group, would be to say "I want to be able to press a button and release my currently used allocation and get some completely new one, be it /48, /56 or whatever". Thanks for the correction!
    - agwa 12y ago
      The proper solution is Stable Privacy addresses, recently standardized in RFC7217 [1]. The interface ID is essentially hash(secret || prefix || mac-address), so it stays the same when you're on the same network, but changes as soon as you go somewhere else. [1] https://tools.ietf.org/html/rfc7217 https://tools.ietf.org/html/rfc7217
      - cm2187 12y ago
        But that defeats the purpose of a privacy address. The idea is precisely not to use your address as a way to track individual users, like a cookie tattooed on your skin. I fail to see how a hash of the MAC address is better than the MAC address itself.
        agwa 12y ago
        Because even with traditional privacy addresses, the first 64 bits of your address never change, and you can be tracked that way. If you happen to share those first 64 bits with many other people, then privacy addresses provide value, but that's simply not the case on your home network. Now keep in mind that a stable privacy interface ID is not a hash of just the MAC address, it's also a hash of the network prefix and a secret that's specific to your system. Including the prefix ensures that the interface ID changes completely when you move to a different network, preventing you from being tracked all over the world. Including a secret ensures that someone can't build a lookup table from MAC address||prefix to stable privacy interface ID. So it's quite superior to using just the MAC address.
        cm2187 12y ago
        Not really, how many networks do you use in a week. Perhaps 3 or 4. And with this, once a link has been established between the IP, it becomes a permanent static link. It is trivial for advertisers through browser cookies to establish this link, and they only need to do it once.
        agwa 12y ago
- X-Istence 12y ago
  I use privacy addresses even while I am at home. Yes, a /64 identifies my house, it doesn't identify all of the people in it.
  - cm2187 12y ago
    In fact you know it's a home, but an advertiser has no way to tell. It could be a restaurant, an office, a flatshare, a gym or anything else. If they see two IPs on the same /64, all they can assume is some form of weak correlation. Correlating "stable privacy addresses" (cf agwa comment) is trivial. How many network do we use in a day? Home, office, mobile provider, perhaps a couple more. Chances are that advertisers will see you using the same cookie across multiple networks and if your IPv6 address is persistent then you can bet that within a week all your stable IPv6 will be mapped to your profile. It only takes one observation to establish the link and then it is a static link. Ideally you would like your /64 to be renewed regularly (it's not a bad idea to reboot the modem from time to time anyway) and to have randomized IPv6 addresses.
    - deleted 12y ago
      [deleted]
- jmreid 12y ago
  I find the Privacy addresses a pain when it comes to managing traffic on my network. My (mostly Apple) devices will never use their DHCP provided v6 address to connect to a public service and this means that my gateway doesn't know what the hostname is for that connection. I ended up writing a little script to scan the "ip -6 neigh" and correlate hosts together based on MAC, then write that to a hosts file for DNSMasq to use. Hack, but it works for me.
ingenium 12y ago
I had a raspberry pi on my network via ethernet and saw it had accumulated a ton of IPv6 addresses. Ended up just disabling privacy extensions on it. If your machines reset their network connection (ie wireless reconnects) then they'll flush their IPv6 privacy addresses. Your machines might just have a long timeout before they use a new privacy address. You can find more info here: https://home.regit.org/2011/04/ipv6-privacy/ https://home.regit.org/2011/04/ipv6-privacy/
- ay 12y ago
  Set your reachable and valid lifetimes to the max. Though you will still end up cycling through some of the privacy address, it's not going to be bad.
stock_toaster 12y ago
I just checked a couple of freebsd 10 boxes I have. Both have 5 addresses in 'deprecated autoconf temporary' state, and 1 in the 'autoconf temporary' state. Privacy addresses are enabled via these sysctls: * net.inet6.ip6.use_tempaddr (default 0) use temporary (privacy) ip6 addresses * net.inet6.ip6.prefer_tempaddr (default 0) prefer them over the default ip6 address for egress The lifetimes are controlled via sysctls: * net.inet6.ip6.temppltime (defaults to 86400) Specifies the “preferred lifetime” for privacy addresses * net.inet6.ip6.tempvltime (defaults to 604800) Specifies the “valid lifetime” for privacy addresses So if private addresses are enabled.. by default a temporary ip6 address is changed every 24 hours, and will linger for 7 days. However, they are not enabled by default on freebsd 10.
- ay 12y ago
  They're enabled on quite some of the Linux distros. And if someone did not know the consequences of what they were doing when they decided to play with the reachable/valid lifetimes on the prefix, they could end up with a lot of addresses. I'd love to know more on the origin of the story to understand how we can fix the defaults in IPv6 so they do not blow people's network - but I have a vague feeling someone played with them anyway.
rincebrain 12y ago
You may find https://communities.intel.com/thread/48051 https://communities.intel.com/thread/48051 and similar useful; I've run across mention of it before but have not personally encountered it (but we don't usually have WoL enabled, so...)

rjsw 12y ago

Do you use privacy addresses ? I don't, the /64 is identifiable as "my house" so there is no reason to hide which particular machine is doing something.

mgbmtl 12y ago
A house may have multiple people living there, multiple devices, visitors, etc. You could track a person connecting through multiple locations by using their MAC address used to assign their IP. i.e. if I am connecting with my laptop from various places, my IP address will be roughly the same, only the network prefix will change.
- rjsw 12y ago
  A house could have multiple users, mine doesn't. I would maybe see turning on privacy addresses as part of a general "leaving home" script that also turned on other stuff like the firewall.
  - RRRA 12y ago
    Time to participate in open wifi or a mesh network :-)
  - ay 12y ago
    You are completely right. Privacy IPv6 address are an illusion when used in a household that has effectively an active /64 per subscriber. (Those who say "but IPv4..." last time my IPv4 address changed, was half a year ago). Anyway this is mostly a political give-in, that happens to also help ruggedize the rest of the stack (the relatively rapid change of privacy addresses uncovers more bugs than we'd otherwise find - so from that standpoint they're to be advocated). But privacy.. huh. Last IETF there was precisely this discussion that one might want to force a new /64 on themselves, and privacy addresses have nothing to do with that. (DHC WG, FWIW).
    - X-Istence 12y ago
      Comcast is more than willing to send you more than one /64 prefix if you ask for it!
      - ay 12y ago
        "effectively an active /64". Comcast folks did a ton of testing with the CPEs, and very very few could ask for anything than an active /64, that's why this qualifier :-) There's active (and pretty cool) work in the HomeNet IETF workgroup, with running code and all (http://www.homewrt.org/doku.php http://www.homewrt.org/doku.php) to make the multi-subnet home network a sane reality. But a different /64 from within the same /56 helps not much, and indeed to correctly reflect the spirit of the discussion in the DHC working group, would be to say "I want to be able to press a button and release my currently used allocation and get some completely new one, be it /48, /56 or whatever". Thanks for the correction!
  - agwa 12y ago
    The proper solution is Stable Privacy addresses, recently standardized in RFC7217 [1]. The interface ID is essentially hash(secret || prefix || mac-address), so it stays the same when you're on the same network, but changes as soon as you go somewhere else. [1] https://tools.ietf.org/html/rfc7217 https://tools.ietf.org/html/rfc7217
    - cm2187 12y ago
      But that defeats the purpose of a privacy address. The idea is precisely not to use your address as a way to track individual users, like a cookie tattooed on your skin. I fail to see how a hash of the MAC address is better than the MAC address itself.
      - agwa 12y ago
        Because even with traditional privacy addresses, the first 64 bits of your address never change, and you can be tracked that way. If you happen to share those first 64 bits with many other people, then privacy addresses provide value, but that's simply not the case on your home network. Now keep in mind that a stable privacy interface ID is not a hash of just the MAC address, it's also a hash of the network prefix and a secret that's specific to your system. Including the prefix ensures that the interface ID changes completely when you move to a different network, preventing you from being tracked all over the world. Including a secret ensures that someone can't build a lookup table from MAC address||prefix to stable privacy interface ID. So it's quite superior to using just the MAC address.
        cm2187 12y ago
        Not really, how many networks do you use in a week. Perhaps 3 or 4. And with this, once a link has been established between the IP, it becomes a permanent static link. It is trivial for advertisers through browser cookies to establish this link, and they only need to do it once.
        agwa 12y ago
X-Istence 12y ago
I use privacy addresses even while I am at home. Yes, a /64 identifies my house, it doesn't identify all of the people in it.
- cm2187 12y ago
  In fact you know it's a home, but an advertiser has no way to tell. It could be a restaurant, an office, a flatshare, a gym or anything else. If they see two IPs on the same /64, all they can assume is some form of weak correlation. Correlating "stable privacy addresses" (cf agwa comment) is trivial. How many network do we use in a day? Home, office, mobile provider, perhaps a couple more. Chances are that advertisers will see you using the same cookie across multiple networks and if your IPv6 address is persistent then you can bet that within a week all your stable IPv6 will be mapped to your profile. It only takes one observation to establish the link and then it is a static link. Ideally you would like your /64 to be renewed regularly (it's not a bad idea to reboot the modem from time to time anyway) and to have randomized IPv6 addresses.
  - deleted 12y ago
    [deleted]
jmreid 12y ago
I find the Privacy addresses a pain when it comes to managing traffic on my network. My (mostly Apple) devices will never use their DHCP provided v6 address to connect to a public service and this means that my gateway doesn't know what the hostname is for that connection. I ended up writing a little script to scan the "ip -6 neigh" and correlate hosts together based on MAC, then write that to a hosts file for DNSMasq to use. Hack, but it works for me.

ingenium 12y ago

I had a raspberry pi on my network via ethernet and saw it had accumulated a ton of IPv6 addresses. Ended up just disabling privacy extensions on it. If your machines reset their network connection (ie wireless reconnects) then they'll flush their IPv6 privacy addresses. Your machines might just have a long timeout before they use a new privacy address. You can find more info here: https://home.regit.org/2011/04/ipv6-privacy/ https://home.regit.org/2011/04/ipv6-privacy/

ay 12y ago
Set your reachable and valid lifetimes to the max. Though you will still end up cycling through some of the privacy address, it's not going to be bad.

stock_toaster 12y ago

I just checked a couple of freebsd 10 boxes I have. Both have 5 addresses in 'deprecated autoconf temporary' state, and 1 in the 'autoconf temporary' state. Privacy addresses are enabled via these sysctls: * net.inet6.ip6.use_tempaddr (default 0) use temporary (privacy) ip6 addresses * net.inet6.ip6.prefer_tempaddr (default 0) prefer them over the default ip6 address for egress The lifetimes are controlled via sysctls: * net.inet6.ip6.temppltime (defaults to 86400) Specifies the “preferred lifetime” for privacy addresses * net.inet6.ip6.tempvltime (defaults to 604800) Specifies the “valid lifetime” for privacy addresses So if private addresses are enabled.. by default a temporary ip6 address is changed every 24 hours, and will linger for 7 days. However, they are not enabled by default on freebsd 10.

ay 12y ago
They're enabled on quite some of the Linux distros. And if someone did not know the consequences of what they were doing when they decided to play with the reachable/valid lifetimes on the prefix, they could end up with a lot of addresses. I'd love to know more on the origin of the story to understand how we can fix the defaults in IPv6 so they do not blow people's network - but I have a vague feeling someone played with them anyway.

rincebrain 12y ago

You may find https://communities.intel.com/thread/48051 https://communities.intel.com/thread/48051 and similar useful; I've run across mention of it before but have not personally encountered it (but we don't usually have WoL enabled, so...)