Dagger2

51 ms·

661.
by Dagger2 6y ago
Closer to 20 years: https://tools.ietf.org/html/rfc3041 To give you some idea of the time frame: Windows XP uses privacy addresses.
662.
by Dagger2 6y ago
Privacy extensions means that every host on your network picks a random IP to make outbound connections from. They pick new random IPs periodically (by default usually after 24 hours), while keeping the old ones for a short period (by defau
663.
by Dagger2 6y ago
This proposal essentially ended up as part of v6 in the form of 6to4. 6to4 uses an L4 protocol rather than an IP option, but that's more or less equivalent (and since there are a fair few routers on the internet that drop packets with
664.
by Dagger2 6y ago
There wasn't really any way to avoid what v6 did though. v4 can't handle addresses that are bigger than 32 bits, and that's the end of it. v6 also has pretty much every backwards compatibility mechanism that can work with v4.
665.
by Dagger2 6y ago
NAT64+DNS64 works fine for Reddit. I run my desktop without a v4 address and have no problems with it. I'm running the NAT64 myself, but it could be done by the ISP just fine, at which point they wouldn't need to provision me with
666.
by Dagger2 6y ago
There are still benefits to using unique address space on all networks though. The fact that my fridge doesn't need to talk to your toaster isn't a reason for us to not do v6. If you've never had to deal with clashing RFC1918
667.
by Dagger2 6y ago
Not necessarily. I have no v4 on my desktop and I'm not hitting a lot of issues. It only becomes an issue if you don't implement some form of backwards compatibility. I occasionally find websites that are broken and don't loa
668.
by Dagger2 6y ago
It would involve adding a new keyword to the language though. I imagine there was some desire to avoid that.
669.
by Dagger2 6y ago
You can run v4 and v6 side by side easily though -- they work pretty much the same way as each other, and that's the standard deployment model. From an end-user perspective, there is no difference: you go to Google, search for "fa
670.
by Dagger2 6y ago
It will do all of those things in the right circumstances though. Dual-stacked eyeball ISPs see over 50% of their traffic go via native v6. If they're CGNATing then that corresponds to a substantial drop in the amount of traffic that n
671.
by Dagger2 6y ago
That also means that you should beware of "analyses" that ignore the costs of staying on v4 and not doing v6. NAT, split DNS, VPNs, RFC1918 clashes and renumbering... this stuff isn't free, and most of it is totally unnecessa
672.
by Dagger2 6y ago
I run my home desktop and many of my VMs as v6-only and almost everything works fine. There are a few things that have a problem (mostly games, for some reason), but not many. Though I could imagine "enterprise-grade" software,
673.
by Dagger2 7y ago
This scheme isn't designed to make the addresses memorable though. It's designed as a workaround for cases where hostnames are supported but v6 literals aren't, for example in UNC paths to Windows network shares.
674.
by Dagger2 7y ago
The behavior of PAT is, though. You can sniff packets and confirm that it behaves the way I'm describing.
675.
by Dagger2 7y ago
It's common to use it with RFC1918 addresses, but that still doesn't change the behavior of PAT. PAT will not drop connections, and thus won't provide you with security.
676.
by Dagger2 7y ago
The discussion was about the behavior of PAT, and PAT has no influence on whether or not an attacker has a route to you.
677.
by Dagger2 7y ago
...you seem to have just copied and pasted the post I replied to.
678.
by Dagger2 7y ago
It won't prevent an attacker from getting IP packets to your machine. How could it do that, when it only acts on outbound connections and its only act is to change the apparent source address of those connections?
679.
by Dagger2 7y ago
> So someone attempting to make a new connection to an internal host is effectively firewalled off by the lack of a mapping table. The lack of a mapping table entry just means that your packet doesn't get translated. It doesn't
680.
by Dagger2 7y ago
SLAAC is autonomous. It's more accurate to say that it tells a host to assign itself an address, rather than that it assigns an address to the host.
681.
by Dagger2 7y ago
Will it? You'd still have to get around the router firewall, the host would have to have no firewall of its own and be exploitable and also you'd have to _find_ the host first. This also needs to be balanced against the difficulty
682.
by Dagger2 7y ago
A 64 bit address space wouldn't be an excess though, it would be outright too small. The whole point of L3 is to provide a layer of routing and aggregation on top of L2. Routing and aggregation requires sparse allocations, so L3 requir
683.
by Dagger2 7y ago
No... it doesn't drop connections, so it doesn't provide any security.
684.
by Dagger2 7y ago
It's actually closer to 5% according to Google's stats. Still far too low, but 5x higher than you thought.
685.
by Dagger2 7y ago
If you looked, I'm sure you could find somebody somewhere. It's not even close to common though.
686.
by Dagger2 7y ago
And when people talk about "PAT", they're actually talking about a form of NAT that doesn't block connections. Here's how you do "PAT" on Linux: `iptables -t nat -A POSTROUTING -o wan0 -j MASQUERADE`. Noti
687.
by Dagger2 7y ago
AfriNIC still have space. They're expected to run out sometime before the end of January (20% chance) to the end of April (90% chance) next year.
688.
by Dagger2 7y ago
I kinda wondered if that was the thought process, but the extra length of the v6 address only adds 12 bytes to the DNS packet. There's still a bunch of other stuff in the packet; dig says the size for my test query goes from 361 bytes
689.
by Dagger2 7y ago
It's the full addressing of the host... but you're right, I guess it was a bit of a non-sequitor. The only parts you have to actually know are the xx/xxx, which is roughly the same amount of bits. They could even both be, say
690.
by Dagger2 7y ago
Not as many as you think. It's mostly very similar to v4, and the majority of the changes are to handle the extra address width.

More ›