5 ms·

The title should probably read,"Bugs in JunOS caused network downtime." This isn't really news. There are bugs in all routing and switching OS's. That's why th

The title should probably read,"Bugs in JunOS caused network downtime." This isn't really news. There are bugs in all routing and switching OS's. That's why they hire support people. This isn't me trying to rag on Juniper. I know lots of people who work for JTAC and they're incredibly smart folks. I'm sure they'll get this sorted out and fixed in JunOS and, like any bug, merged into upstream releases. This isn't me trying to point out that IPv6 is infallible. There might be some design choices that the IETF made with IPv6 that were stupid, but mostly they got it right, and it's too late now to change most of them anyways. This is just reality with new software. New software has bugs. You can blame it on MLD, but really MLD is no more complicated than IGMP. You can blame it on NDP, but really NDP isn't much more complicated than ARP. At a minimum IPv4 required ARP to function. However, in reality it also required atleast IGMPv2. Since without IGMP, or some way to manage multicast, how are you going to get something like VRRP to work. Link-layer multicast is not new to IPv6.

ay 12y ago
++. A small nit to add: IPv4 did not have 1+ multicast groups per every host. That's a dramatic difference in terms of capacity on the middle-gear which escapes if one thinks of IPv6 as "IPv4 with bigger addresses".
- smutticus 12y ago
  Thanks for the upvote :) And you're right about the additional mcast addresses required by IPv6 NDP. It's called the 'solicited-node multicast address' that every host must join. My historical guess about why multicast was chosen over broadcast for NDP was due to NBMA networks. In the 1990's NBMA networks(frame-relay) were much more common than they are today. And NDP just makes more sense than ARP over NBMA networks. This is just a guess. Someone else suggested DOCSIS was the reason that multicast was chosen instead of broadcast. I doubt this. I'm not that familiar with DOCSIS, but I think it has a broadcast type link-layer. Also, IPv6 predates DOCSIS. It could well turn out that multicast was the right choice for NDP once we get over the inevitable roll out problems. NBMA networks could return in 20-30 years. You never know.
  - ay 12y ago
    You're right, DOCSIS has nothing to do with it. The "classic" rationale to choose multicast over broadcast was to try and limit the amount of time to process NDP traffic vs. the time the hosts have to process the ARP broadcast traffic in IPv4. 15 years ago that took a nontrivial amount of host resources, and with the way NDP constructs the solicited node multicast, even if you just flood every packet on the link, you still can filter the packets that are not for you at the NIC HW level. And since there are 16 million unique solicited node multicast addresses, in principle the scaling is pretty impressive. Multicast is a definitely a good choice in the long term, though the "here and now" interaction with some protocols is a bit tricky - e.g. 802.11 WiFi (http://tools.ietf.org/html/draft-vyncke-6man-mcast-not-efficient-01 http://tools.ietf.org/html/draft-vyncke-6man-mcast-not-effic... and http://tools.ietf.org/html/draft-yourtchenko-colitti-nd-reduce-multicast-00 http://tools.ietf.org/html/draft-yourtchenko-colitti-nd-redu...) - though it's not the only offender and frequently not the biggest one (service advertisements may consume a comparable and bigger amount of bandwidth on the volatile network). On NBMA: you can have such a network today in a public WiFi scenario where you do not hosts directly talking to each other but want them to access the internet. In the wired case the moniker is "Private VLANs". With IPv6 you can clear the on-link bit, and make NBMA work quite elegantly. But, depending on the exact details, http://tools.ietf.org/html/rfc4903 http://tools.ietf.org/html/rfc4903 does list quite a few interesting challenges - quite an informative read. BTW, if you are interested more in the "why" rather than just "how" of IPv6, take a look at this: http://www.internetsociety.org/deploy360/resources/ebook-ipv6-for-ipv4-experts-available-in-english-and-russian/ http://www.internetsociety.org/deploy360/resources/ebook-ipv... It's a gem: free, very good quality material, and written as if you are co-designing with the author by solving various problems you see on IPv4 networks, and the protocol evolves into what is the IPv6 today.
    - smutticus 12y ago
      Thanks again for the excellent response, and for the history lesson on why multicast was chosen over broadcast for NDP. I've done tons of work in private vlans over the years. I was part of a months long effort to find and document bugs in private vlans at a vendor, where my primary focus was to find and document bugs only in private vlans. Residential ISPs love private vlans because it prevents different customers from seeing each other's broadcast traffic. DHCP Snooping to prevent things like ARP spoofing, in combination with private vlans to limit broadcast traffic will mostly lock things down pretty well. It's funny you should provide a link to a resource from the Deploy360 Programme. I just finished doing a stint with the Deploy360 Programme as a writer working on, among other things, IPv6 resources. My real name is Andrew McConachie.

ay 12y ago

++. A small nit to add: IPv4 did not have 1+ multicast groups per every host. That's a dramatic difference in terms of capacity on the middle-gear which escapes if one thinks of IPv6 as "IPv4 with bigger addresses".

smutticus 12y ago
Thanks for the upvote :) And you're right about the additional mcast addresses required by IPv6 NDP. It's called the 'solicited-node multicast address' that every host must join. My historical guess about why multicast was chosen over broadcast for NDP was due to NBMA networks. In the 1990's NBMA networks(frame-relay) were much more common than they are today. And NDP just makes more sense than ARP over NBMA networks. This is just a guess. Someone else suggested DOCSIS was the reason that multicast was chosen instead of broadcast. I doubt this. I'm not that familiar with DOCSIS, but I think it has a broadcast type link-layer. Also, IPv6 predates DOCSIS. It could well turn out that multicast was the right choice for NDP once we get over the inevitable roll out problems. NBMA networks could return in 20-30 years. You never know.
- ay 12y ago
  You're right, DOCSIS has nothing to do with it. The "classic" rationale to choose multicast over broadcast was to try and limit the amount of time to process NDP traffic vs. the time the hosts have to process the ARP broadcast traffic in IPv4. 15 years ago that took a nontrivial amount of host resources, and with the way NDP constructs the solicited node multicast, even if you just flood every packet on the link, you still can filter the packets that are not for you at the NIC HW level. And since there are 16 million unique solicited node multicast addresses, in principle the scaling is pretty impressive. Multicast is a definitely a good choice in the long term, though the "here and now" interaction with some protocols is a bit tricky - e.g. 802.11 WiFi (http://tools.ietf.org/html/draft-vyncke-6man-mcast-not-efficient-01 http://tools.ietf.org/html/draft-vyncke-6man-mcast-not-effic... and http://tools.ietf.org/html/draft-yourtchenko-colitti-nd-reduce-multicast-00 http://tools.ietf.org/html/draft-yourtchenko-colitti-nd-redu...) - though it's not the only offender and frequently not the biggest one (service advertisements may consume a comparable and bigger amount of bandwidth on the volatile network). On NBMA: you can have such a network today in a public WiFi scenario where you do not hosts directly talking to each other but want them to access the internet. In the wired case the moniker is "Private VLANs". With IPv6 you can clear the on-link bit, and make NBMA work quite elegantly. But, depending on the exact details, http://tools.ietf.org/html/rfc4903 http://tools.ietf.org/html/rfc4903 does list quite a few interesting challenges - quite an informative read. BTW, if you are interested more in the "why" rather than just "how" of IPv6, take a look at this: http://www.internetsociety.org/deploy360/resources/ebook-ipv6-for-ipv4-experts-available-in-english-and-russian/ http://www.internetsociety.org/deploy360/resources/ebook-ipv... It's a gem: free, very good quality material, and written as if you are co-designing with the author by solving various problems you see on IPv4 networks, and the protocol evolves into what is the IPv6 today.
  - smutticus 12y ago
    Thanks again for the excellent response, and for the history lesson on why multicast was chosen over broadcast for NDP. I've done tons of work in private vlans over the years. I was part of a months long effort to find and document bugs in private vlans at a vendor, where my primary focus was to find and document bugs only in private vlans. Residential ISPs love private vlans because it prevents different customers from seeing each other's broadcast traffic. DHCP Snooping to prevent things like ARP spoofing, in combination with private vlans to limit broadcast traffic will mostly lock things down pretty well. It's funny you should provide a link to a resource from the Deploy360 Programme. I just finished doing a stint with the Deploy360 Programme as a writer working on, among other things, IPv6 resources. My real name is Andrew McConachie.