The title is no longer required
IPv6 is the work of the devil. Not on my network!!
IPv4 apocalypse means we just can't measure the internet any more
IPv4 address exhaustion is making it harder to measure the size of the Internet, even as IPv6 deployment accelerates. While IPv6 activity doubled in 2015 (to 400 million addresses by year-end), the vast majority of users are still on IPv4 addresses, mostly via dynamic assignment or behind carrier-grade Network Address …
-
-
Monday 19th September 2016 10:50 GMT Roland6
Re: The title is no longer required
Actually, the title is totally misleading!
NAT etc. has been around for decades, so there has (as far as the WWW incarnation of the Internet is concerned) always been a discrepancy in the numbers, just that now with increasing usage of NAT is the discrepancy become both visible and significant.
-
Monday 19th September 2016 13:03 GMT Anonymous Coward
Re: The title is no longer required
> NAT etc. has been around for decades,
And IPv6 won't make it go away. NAT has too many advantages (OK it has horrendous disadvantages too) for client systems to want to go to an open addressing model. Even when I switch networks to v6 they'll still be running NAT.
-
-
Monday 19th September 2016 15:49 GMT Anonymous Coward
Re: The title is no longer required
> Correct me if I'm wrong, but wasn't one of the points of contention on IPv6 implementation that it did not support NAT? So how to you plan to roll this?
From Linux you can just use
ip6tables -t nat -A POSTROUTING ... -j MASQUERADE
So in pretty much the same way I can do it for IPv4
(apparently there are other sorts of routers, but I can't comment on those)
-
-
-
-
Tuesday 20th September 2016 01:58 GMT PNGuinn
Re: The title is no longer required @bb
Yup, you've hit the nail on the head there all right.
If we don't all move to IPv6 all the advertisers' kittens will DIE. Or something.
Well, if they have to die may they do so somewhere where they poison the ad slingers' water supply. Or something.
Here's a prediction. If that internets of stuff thingie really does take off we'll have run out of addresses again in five years or so, 'cos every grain of sand really does want to be connected to the net, if only to watch all those dying kitten videos on spewtube. Or something.
-
Tuesday 20th September 2016 05:03 GMT Yes Me
Re: The title is no longer required @bb
" If that internets of stuff thingie really does take off we'll have run out of addresses again in five years or so"
Actually, no. The reason for picking 128 bits addresses was exactly that - visions of a future with every light switch on the network - back in 1994. IoT is the current buzzword but the idea is 20+ years old.
-
-
-
Tuesday 20th September 2016 07:47 GMT Joe Montana
Re: The title is no longer required
NAT was in use at endpoints, but not really at ISPs... One IP usually correlated to one customer.
Now widespread NAT at ISPs, as well as dynamic addressing makes it much harder to block abusive users by IP... Spammers know this too, and will release/renew or redial a ppp connection to get a fresh IP.
-
Friday 23rd September 2016 22:44 GMT gnarlymarley
Re: The title is no longer required
>NAT etc. has been around for decades
Which is why I have been successfully using NAT on IPv6 since January of 2011. Works great when you need a private IPv6 address to access the internet. They changed the name of the address from "private" to "site local" to "unique local". All in attempts to avoid folks implementing NAT6. Oh well, folks have had NAT on IPv6 since before 2006. Just means no matter what folks say, we already have it.
-
Sunday 25th September 2016 00:11 GMT Vic
Re: The title is no longer required
Oh well, folks have had NAT on IPv6 since before 2006. Just means no matter what folks say, we already have it.
And that should be the end of it.
With IPv6, no-one should be forced to use NAT. That's a good thing.
But numerous people are trying to *prevent* anyone using NAT. and that's a bad thing.
Give people the freedom to decide for themselves whether or not to NAT, and the progress of IPv6 will be comparatively easy.
But try to enforce dogma that really isn't necessary, and you will get push-back.
Vic,
-
-
-
Monday 19th September 2016 21:35 GMT Herby
Work of the Devil, etc...
I always want to ask the same question:
Why do we need an addressing scheme that can accommodate every grain of sand on the planet and have some left over. If they went to 6 byte addresses with a simple translate scheme, we would all be using it now.
Yes, it is terrible!!
Me? Yes, I have a nice NAT router that works very nicely, thank you. I use the same model for at least 3 installations.
-
Tuesday 20th September 2016 05:00 GMT Yes Me
Re: Work of the Devil, etc...
"Why do we need an addressing scheme that can accommodate every grain of sand on the planet and have some left over."
We don't. But while we're making the address space bigger, we might as well make it plenty bigger.
"If they went to 6 byte addresses with a simple translate scheme, we would all be using it now." No. Any increase whatever from 32 bits creates the same problem, since (as has been said here very recently) IPv4 has no, zero, zilch provision for forward compatibility.
-
-
Tuesday 20th September 2016 15:25 GMT Charles 9
Re: Work of the Devil, etc...
"So we can internet enable ebvery grain of sand, which is good because connectivity internetofthings future"
It's basically a way to ensure we don't run out again, much like how ZFS uses 128-bit provisioning to ensure filesystem limitations are never reached in real life (and before you quote 640K, physical limits would be hit first).
-
-
-
-
Monday 19th September 2016 07:12 GMT Anonymous Coward
Re: How much is a IPv4 address worth
Probably nothing. It is surprising how many ISPs now do not offer NAT. You can only have a reserved IPV4 address.
I tried unsuccessfully to get Demon/Thus to move me to a NAT for extra protection - as I never use my address for unsolicited incoming traffic. They apparently were in the middle of changing their business model and were getting out of the home domestic market that used NAT. It was apparently a given that SOHO users always needed a reserved address.
-
Monday 19th September 2016 09:36 GMT Anonymous Coward
Re: How much is a IPv4 address worth
You are confusing "static IP" (or conversely, "dynamically allocated address from a pool") with "NAT".
You are almost certainly using NAT. If the IP address on your PC's network card (shown by e.g. "ipconfig /all") is different from the public IP address you're using on the Internet (shown by e.g. visiting www.whatsmyip.org) then you are using NAT.
Now, "static" or "dynamic/pool" IP means whether the public IP address you're using on the Internet stays the same, or changes every time you disconnect and reconnect.
A dynamic IP address doesn't really offer you any "protection". Your ISP is still logging every time you connect/disconnect from the Internet and what address you are using at each time, so any malicious activity from that address can be traced back to you.
And in any case, if you have a stable DSL line and don't power off your router every night, you are likely to stick with the same IP address for days or weeks at a time.
And Demon/Thus is very much an oddball here, by giving a static IP address. Most ISPs won't give you this unless you ask for and/or pay for it. Many don't even offer it at all.
-
Monday 19th September 2016 12:10 GMT Anonymous Coward
Re: How much is a IPv4 address worth
"You are almost certainly using NAT. If the IP address on your PC's network card (shown by e.g. "ipconfig /all") is different from the public IP address you're using on the Internet (shown by e.g. visiting www.whatsmyip.org) then you are using NAT."
The address used by my local devices is irrelevant to the point I made about ISP NAT - or rather what could be called PAT (Port and Address Translation). That multiplexes my connections onto an arbitrary IPV4 address from the ISP's groups.
My presence on the internet has an IPV4 address that resolves in network-tools.com to mydomain.demon.co.uk. It is always the same address assigned by Demon to my router when it connects to the ADSL. The only NAT is my router turning that address into a 192.168.0.1 local net for my home devices.
If I set up a DMZ in my router then I could route unsolicited connections from the internet to selected local devices to handle the protocol. Those callers will have either used DNS to resolve my subdomain - or have used my raw IPV4 address.
-
Monday 19th September 2016 12:17 GMT SImon Hobson
Re: How much is a IPv4 address worth
> The address used by my local devices is irrelevant to the point I made about ISP NAT
Err, no it isn't. That was given as a way to see that you are indeed using NAT. But in any case, the "problem" you have is that you have a static IP address - if you don't want that, just ask your ISP for a dynamic one and it'll change every time your connection drops and has to be re-established. If Demon won't do that, then you can switch ISP - I switched ISP not long ago for the reverse reason, apart from being a sh*te ISP, they didn't do static IPs for residential connections at all and I want one for various reasons.
If you aren't using any inbound connections, then just ignore them. If you haven't configured your router to send them somewhere, they'll just be dropped.
Sorry, but it's a non-problem. Getting the ISP to put you behind a CGN gateway won't actually make that much difference since (for various reasons) you are still likely to have a "slightly sticky" public IP. And trust me, if you had a truly dynamic (as in every outbound connection got mapped differently) IP then you would hate it due to the amount of stuff it would break.
-
-
Monday 19th September 2016 12:23 GMT Anonymous Coward
Re: How much is a IPv4 address worth
"A dynamic IP address doesn't really offer you any "protection"."
The protection it gives is that no one can use my subdomain name via DNS to attack my router specifically. All they can do is attack my ISP's firewall - which will know if it is expecting a reply on that address and port for a prior outward connection eg FTP.
Depending on the way the ISP has set up their PAT (Port and Address Translation) then my outward connections will be multiplexed with other users' onto dynamic ports on IPV4 addresses from the ISP's allocations. How they log the mapping of ports and addresses to comply with legal processes is up to the ISP.
-
Monday 19th September 2016 15:20 GMT Anonymous Coward
Re: How much is a IPv4 address worth
"The protection it gives is that no one can use my subdomain name via DNS to attack my router specifically. "
You're still confusing a few items... if you have "a subdomain name" pointing to your connection, you must have a dynamic DNS service updating per your current IP address, which negates the "advantage" of dynamic vs. static.
If you are relying on a router to "know if it is expecting a reply..." that's NAT.
I used to work with some people who thought that a randomly changing IP would protect them from the bad guys, "because then they don't know where to find me". Here's the thing: there aren't any hackers out there that are targeting *you*. I know you're picturing some guy with green characters projected on his face who is going to reverse-couple the firewall to the uplink in order to hack you. In reality, 99% or more of what you need to worry about are automated attacks that scan the Internet looking for vulnerable computers. dynamic IPs don't help against those, they'll just scan by eventually.
-
Monday 19th September 2016 15:42 GMT Blotto
Re: How much is a IPv4 address worth
proof a little knowledge is dangerous in the wrong hands.
"The protection it gives is that no one can use my subdomain name via DNS to attack my router specifically" -- WTF?
"All they can do is attack my ISP's firewall - which will know if it is expecting a reply on that address and port for a prior outward connection eg FTP" -- Double WTF, FTP has 2 modes, one requires fw's to inspect the unencrypted comms to know which ports to open.
"Depending on the way the ISP has set up their PAT (Port and Address Translation) then my outward connections will be multiplexed with other users' onto dynamic ports on IPV4 addresses from the ISP's allocations." -- WTF not even close, this is proxying.
i'd suggest you forget all you know about networking and start again
-
Monday 19th September 2016 16:04 GMT Anonymous Coward
Re: How much is a IPv4 address worth
"i'd suggest you forget all you know about networking and start again"
I fear there is a disjunct between what I am saying and what people are reading into it. Nothing I have said contradicts the way that network kit works. Afraid all I can offer as credentials is 45 years in computer networking development and troubleshooting a large number of very convoluted large system problems.
-
Tuesday 20th September 2016 10:41 GMT SImon Hobson
Re: How much is a IPv4 address worth
>I fear there is a disjunct between what I am saying and what people are reading into it.
No, I see no disjunct there.
> Nothing I have said contradicts the way that network kit works.
Wrong again, sorry.
> Afraid all I can offer as credentials is 45 years in computer networking development and troubleshooting a large number of very convoluted large system problems.
"Oh dear".
The DNS is irrelevant - because as stated, the bad guys won't be using it. Fixed vs dynamic IP is irrelevant, because the bad guys aren't targeting YOU, they will be scanning address ranges just looking for open ports etc. And if you don't trust your own router, then YOU have the power to install a decent one - expecting your ISP to do it better is (in many cases) ... err lets just call it optimistic !
So basically your rant comes down to paranoia over a DNS entry that the bad guys won't be using, paranoia over the potential for your router to have flaws, and an irrational belief that your ISP will do it better.
-
-
-
Tuesday 20th September 2016 10:18 GMT Anonymous Coward
Re: How much is a IPv4 address worth
> Depending on the way the ISP has set up their PAT (Port and Address Translation) then my outward connections will be multiplexed with other users' onto dynamic ports on IPV4 addresses from the ISP's allocations.
That is absolutely wrong, wrong, wrong, wrong, wrong. ISPs simply don't work like that.
The Internet, including your ISP's network, is build out of devices called "routers". They forward things called "IP datagrams". They do not modify the datagram, except for reducing a field called the TTL (Time To Live) and making an update to the IP header checksum to compensate.
Your home router likely also does NAT and/or PAT; it has enough CPU grunt to handle the tiny amount of traffic passing through it, and to retain all the state necessary to perform the same updates on related packets, e.g. packets belonging to the same TCP strea.
But in the core of an ISP, you're talking tens or hundreds of gigabits of traffic or more. All the datagram forwarding is done in hardware, by the line cards. And they do NOT modify addresses or ports on a packet-by-packet basis; they simply pass them onto the next device and instantly forget about them.
Now, at the time your home device connects to the ISP, they allocate you a single IP address which is dedicated to you for the duration of your connection. Any packet which arrives at the ISP with that address is forwarded down your link.
In the case of Demon or any other ISP static-IP service, they assign you the same IP address every time you connect - and don't give it to anyone else while you are not connected.
On an ISP which does dynamic IP addressing, they assign you a different IP address out of a pool each time you connect.
By "connect" this means "when your router establishes the link to the ISP", not each time you open a TCP connection to a different web site or whatever.
But for a long as that link is established, any packets you send out of your router with a particular header [source address, source port, destination address, destination port] will arrive at the destination *exactly* the same, apart from the TTL having been decremented.
-
-
Monday 19th September 2016 12:33 GMT Anonymous Coward
Re: How much is a IPv4 address worth
"And Demon/Thus is very much an oddball here, by giving a static IP address"
I was thinking of switching to Andrews and Arnold - as an ISP with the good reputation that Demon once had amongst techies. Their service offerings seem to assume you will take up a real IP address that will be in some way assigned to you. If that is an incorrect assumption then please will an AAISP user tell me.
-
-
Tuesday 20th September 2016 00:50 GMT bombastic bob
Re: How much is a IPv4 address worth
"Probably nothing. It is surprising how many ISPs now do not offer NAT. You can only have a reserved IPV4 address."
and yet, for a FIXED IP address, you'll be charged EXTRA, and may ONLY be able to do so with a "business class" subscription, and so the cost inflates...
But with IPv6, everyone's address could be static. I assume we'll get assigned netblocks, for our entire network, and by doing so, will have a fixed IPv6. Byby need for "all that" we have to pay EXTRA for in the IPv4 world...
-
-
Tuesday 20th September 2016 13:08 GMT SImon Hobson
Re: How much is a IPv4 address worth
reboot the router and your address changes
And of course, with no address translation, this means all your internal addresses also change. That's one heck of a PITA for anyone but the "consume only" ones for whom the internet consists of Google and FarceBork.
-
Tuesday 20th September 2016 16:04 GMT Vic
Re: How much is a IPv4 address worth
you will likely get a dynamic /56
Why?
IPv6 gives 264 MAUs, which is enough for one each for up to 1.8x1019 people. Each MAU gives you 1.8x1019 addresses, which is more that I'm likely to need this week.
So the only reason to have more than a /64 is if you're sub-allocating (which most people won't be), and there are more than enough MAUs to have a static allocation.
I would expect the standard allocation to be a static /64; is there reason to suspect something else?
Vic.
-
Wednesday 21st September 2016 12:48 GMT SImon Hobson
Re: How much is a IPv4 address worth
I would expect the standard allocation to be a static /64; is there reason to suspect something else?
Err, how about because most large ISPs are run by complete sh**s who will do anything to make it easier to squeeze more money out of "power" users. Given that some ISPs will not give a static IPv4 address, and others will only do it if you pay extra for a business connection AND also charge you extra rent for the address - I see no reason they won't do exactly the same with IPv6.
These are the ISPs in the race to the bottom of the murky pond where life is a muddy mess of squeezed margins and gullible punters who can't see past the headline price. Having outcompeted themselves on how cheap they can sell the service, they then need every trick they can muster to make a profit.
Needless to say, I'm with an ISP that costs more, but doesn't do this sort of stuff.
-
Wednesday 21st September 2016 14:18 GMT Vic
Re: How much is a IPv4 address worth
how about because most large ISPs are run by complete sh**s
Fair point.
Given that some ISPs will not give a static IPv4 address, and others will only do it if you pay extra for a business connection AND also charge you extra rent for the address - I see no reason they won't do exactly the same with IPv6.
Given the scarcity of IPv4 addresses, there are *some* grounds for this - although I agree that many ISPs just gouge such customers because they can. But with IPv6, it actually requires more effort on their behalf to allocate dynamically than to do so statically.
Needless to say, I'm with an ISP that costs more, but doesn't do this sort of stuff.
Likewise. AAISP have done a fantastic job for me...
Vic.
-
-
Monday 26th September 2016 01:08 GMT Trevor_Pott
Re: How much is a IPv4 address worth
Er....my ISP assigns me one IPv6 address. Not a block. An address. I have to set up a sixxs tunnel and use my block from there to do anything useful with IPv6. An the other two ISPs in the area don't assign IPc6 at all!
So, yeah, that whole thing where ISPs will do whatever ivory tower intellectuals tell them to do? That's not how the real world works. People are shit. ISPs and ivory tower engineers alike.
-
-
-
-
-
Monday 19th September 2016 10:36 GMT Roland6
Re: How much is a IPv4 address worth
what's my fixed address worthg?
Suggest you look it up on Zoopla or Rightmove... :)
However, I think the premise "It's quite likely that as address value rises, more static addresses will be returned by the organisations that hold them." only applies where an organisation has to pay a subscription to their ISP for their static IP address.
If you are one of the lucky one's who was assigned an IP address block way back and thus pay nothing, there is no real incentive to cash in at the present time - instead use them to benefit your business by running your own bit barn and hosting service...
If you have purchased a static block of address'es from ARIN et al then you are paying the going rate and have probably sized your allocation to your needs and so have little room to manoeuvre, but 250USD pa for a /24 isn't all that expensive.
Finally, given the current price's BT are charging (£5.50 pcm for 1 and £15.50 pcm for 13), whilst 'high' compared to ARIN's prices, I suggest retail prices for static IP addresses are going to have to rise significantly before businesses begin to treat individual addresses as gold dust. but then I suggest those who are purchasing from their ISP are smaller businesses and hence are between a rock and a hard place and so typically need only a handful of static addresses and hence aren't going to be giving any back, whilst they remain in business...
-
-
Monday 19th September 2016 07:03 GMT Anonymous Coward
And who told you I want to be measured?
My (on last count) 20+ devices on my home network are my own F*** business.
The v6 people should really take their end to end principle, chose a high priest of v6 of choice and make him stuff it. Attached to a chainsaw. I know it is difficult for people who have made their career on starting every second sentence with "v4 is obsolete".
All the IoT devices (usually used as the primary justification for v6) SHOULD NOT be entitled to talk to anything but the gateway and I would like that gateway to be on _MY_ premises under _MY_ control. For that v4 suffices. End of story.
All the data leaching admen scum with their ideas that that they will talk to the "cloud" so they can monetize the refresh cycle of my dirty laundry can join the aforementioned v6 priest in gently buggering themselves with a chainsaw (though so far they are very happily showing that they do need no end-to-end principle to spy on me).
So, going back to the article - I am very happy that I did not get measured correctly. Can we have a repeat of that for as long as possible.
-
Monday 19th September 2016 07:10 GMT Lee D
Re: And who told you I want to be measured?
At the very least, get yourself one outside IPv6 address and map it through.
Still only one address to handle.
Only your gateway to upgrade / reconfigure.
Works just the same and hides stuff just the same.
Allows you to get onto IPv6-only resources when the inevitable happens.
It bugged me from day one that people were told that they "can't" use NAT with IPv6. Of course you can. And the easiest way to transition is to transition your NAT device to have a IPv6 address to the outside world and let it handle the conversion to your legacy IPv4 network.
Then NOBODY cares when you transition the clients themselves, if at all.
For years the IPv6 crowd were up in arms against the idea and look what that's done. Everyone with NAT has INCREASED usage and stayed on IPv4.
P.S. Hello, The Reg. How's that IPv6 transition coming along? For the twenty-seventh time of asking and only ever being told "it's in the works" while still pushing IPv6 articles that try to make US feel guilty.
-
Monday 19th September 2016 07:20 GMT Anonymous Coward
Re: And who told you I want to be measured?
At the very least, get yourself one outside IPv6 address and map it through
I had a /64 for 5+ years.
I let my RIPE record lapse which resulted in SIXX turning it off. I initially considered going through the motions to re-enable it, but why? The use was so little that nobody noticed it disappearing. It was in use initially with a lot of mail going through it, but dropped to nearly nil after I had to turn off the v6 MX for my domain because of Google/Microsoft idiocies - not retrying v4 MXes if there is a v6. I am not the only one there too - even Comcast turned their v6 MXes off.
So actually my v6 use has _DROPPED_ off over time, not increased (as preached by the v6 high priesthood).
I do not see a point in getting one for now. When and if the inevitable happens I have the config for it, I will enable it. So far - I do not see it happening for at least 10 more years due to trade in ip addresses and virtually zero residential growth in the developed world.
-
Tuesday 20th September 2016 05:11 GMT Yes Me
Re: And who told you I want to be measured?
"So actually my v6 use has _DROPPED_ off over time"
Yes, and nobody in v6-land cares. Because the growth at the moment is in v6 use by very large mobile networks who ran out of IPv4 space several years ago; most users have no idea they're using v6. If they have a domestic ISP with IPv6 support, who ships v6-capable home routers, most home users have no idea either. The heroic days of Teredo, 6to4 and even SixXs.net are almost over now that production quality IPv6 is so easy. Of course, the IPv4 legacy will be around for many years.
-
Tuesday 20th September 2016 09:57 GMT AndrueC
Re: And who told you I want to be measured?
Of course, the IPv4 legacy will be around for many years.
Certainly will in Blighty where all but one of our biggest ISPs do not yet fully (or at all) support IPv6. Last I heard of the 'big six' only Sky was getting close to complete with their roll out. BT might be complete in early 2017. TT I don't think has current plans. Plusnet appears not to have current plans.
-
-
Monday 19th September 2016 09:45 GMT Anonymous Coward
Re: And who told you I want to be measured?
> Allows you to get onto IPv6-only resources when the inevitable happens.
It won't.
Nobody's business plan includes making their content available to a tiny proportion of the Internet.
Just look at what happened with IE5 support: people kept supporting IE5 until less than 1% of users were on it. And supporting IE5 was *hard* and *expensive*, often requiring a completely separate parallel version of the website.
The Internet is about business, and business is about customers, and until 99% of customers have IPv6, all content of any significance will be available on IPv4 as well.
> And the easiest way to transition is to transition your NAT device to have a IPv6 address to the outside world and let it handle the conversion to your legacy IPv4 network
That won't work: your legacy devices will look up a DNS name, find there is no "A" record, and fail.
It can work if you build a SOCKS5 proxy or HTTP proxy at the border, and configure your 'legacy' devices to access the Internet through that.
-
Monday 19th September 2016 12:44 GMT Roland6
Re: And who told you I want to be measured?
@Lee D. "And the easiest way to transition is to transition your NAT device to have a IPv6 address to the outside world and let it handle the conversion to your legacy IPv4 network.
...
P.S. Hello, The Reg. How's that IPv6 transition coming along?"
Are you sure El Reg aren't IPv6 internally and have not simply used a NAT device with an IPv4 address to the outside world to hide it's internal network... :)
Actually given the power of today's 'routers' it isn't that far fetched for the router to provide an IPv4 to IPv6 gateway, given how practically everything revolves around URL's and DNS these days. Okay Voice over HTTP might be rubbish, but I suspect for the majority of 'home' users there will only be a few exceptions, just as there are todat with NAT.
-
-
Monday 19th September 2016 07:31 GMT Novex
Re: And who told you I want to be measured?
Yep. Pretty much how I feel too.
If the industry wants me to adopt IPv6, then give me a translation router that: allows my v4 network to work internally, via static addresses if necessary; allows my website and email servers to be connected either via v4 or v6; allows me to prevent snooping backwards into my individual devices.
Otherwise, bugger off.
-
Biting the hand that feeds IT
