Global IPv4 address drought: Seriously, we're done now. We're done

You say that as if 40% is a small amount to be using. It's actually a really damn high amount to be using. Because of the way IPs are allocated and used, you want the number of actively-in-use-by-a-machine IPs to be less than a few percent. If you reach that high then you start hitting the need to conserve address space and things start to get annoying and expensive to deal with (which is a particularly silly situation to be in, because we're not dealing with a physically-constrained resource here -- these are just numbers).

It's a bit like fragmentation on your hard disk, where things slow down if you fill the drive, but worse because fragmenting IP allocations is really bad and there's no defragger you can run. And your disk is way too small anyway.

Re: And still there are those "legacy" IPv4 blocks...

Thanks! Couldn't recall where I'd read that before and in my case, not recalling is major.

Re: And still there are those "legacy" IPv4 blocks...

Absolutely millions of IP4 by many USA corporations and Universities. EACH.

Re: And still there are those "legacy" IPv4 blocks...

Also, there are those who got allocated Class B IPv4 space 20+ years ago... then keep almost all of it behind a firewall and use less than 20% of the addresses.

Maybe if IPv4 owners had to pay a monthly fee for the public resources they are using, they'd be allocated more efficiently.

Why should we have to mess with v6 so IT fails, like intellectual pygmies described above, don't have to learn about private address blocks?

Re: Y U NO IPV6 BRO

httpS is a fairly recent innovation around here, though .....

Its on the way soon® Bit more explanation in previous post.

Re: So, how do I go about implementing it?

Well, let's see. I'm in northern France (literally: I live in the département du Nord, "nord" == "north"), and I have recently (like, as in, you know, the 23rd of December) had an Orange technician (OK, two technicians, one to push and one to pull) switch me from "up to 20 Mbps" ADSL2+ to "at least 200 Mbps" FTTH.

And the new service, unlike the old, supports IPv6. I have a 2a01:stuff/56 prefix with public IPs on all the machines inside the network as well as IPv4-by-NAPT.

And I have a firewall. Well, a bit more than just a firewall. I have a full-on deep-inspection IPS that supports IPv6. I know it supports IPv6 because I built the core IPv6 support into it. Because it's a work loaner.

And Windows 10 booted up after the installation and its IPv6 support just worked. Wireshark shows IPv6 connections when I go on the Web, and various tools show that my iPhone and iPad get IPv6 addresses from the Livebox. Even my aging Fedora 14 VM works as it should on IPv6.

Advice: hunt down the instructions on the Internet on disabling Windows 10's Teredo service because it is in no way needed when you have real IPv6 support.

Re: So, how do I go about implementing it?

Wait for your ISP to tell you they support IPv6 (almost all British ISP's don't).

Then turn on the IPv6 on your main router/gateway if it supports 6-4 and 4-6 NAT.

Done.

Personally, I have a DrayTek Vigor 2860VN+, which is a serious piece of kit for a home router, and it supports all kinds of stuff - at least five different IPv6 IP discovery / tunnelling protocols, for instance. But no IPv6 support from Virgin Media despite years of promises, so unless I want to tunnel all my traffic through yet-another-third-party, I can't do a thing.

Re: So, how do I go about implementing it?

BT already does IPv6 address allocation and the Draytek supports IPv6 according to their manual, so you should just need to ensure you are running the latest firmware for your router then configure the router for an ISP delegated range. Everything else should just work. Your client will get multiple IPv6 addresses, the Internet routable ones are the ones that don't start fe80: These are for link local and device configuration.

You can check if your IPv6 is working by going to IPv6 config checker or even "Whats my ip address" into google. It will return a V6 address if one is configured.

For those who's ISP's don't support IPv6 yet - raise a support ticket asking for it or change to an ISP that does.

Alternately, Hurricane Electric (and previously SixXs) do IPv6 tunnel brokers that allow you to get on IPv6 when the ISP is a bit backwards. There are loads of guides out there for different hardware to do this on. I started on a Raspberry Pi before my ISP finally woke up, it was a good way to skill up.

Just remember that only Layer 3 of the OSI 7 layer model changed.

Handy sites :

IPv6.com

Ripe's IPv6 primer

Here are some pointers for those who want to learn IPv6.

1. Forget NAT. Its not necessary any more. however, if you really, really want to, there is no difficulty in doing the same thing in IPv6, there is just little point. Don't forget NAT was a bolt-on to the original IPv4 to conserve addresses once the internet started to grow, it broke end-to-end routing.

2. Mostly forget about variable length subnet masks. Masks are generally /64 or more. /64 and /48 are common for home and corporate use. This is partly for automatic client configuration (SLAAC) and to ensure that routing tables remain small - fixing a problem on the Internet today. The 16 bits between /64 and /48 are effectively for subnet use, so you get 64K subnets in your address block. The bits up to /48 are used for the backbone routing and are of interest to ISP's

3. Forget ARP, its been replaced with link local IPv6 addresses which start with fe80::0/16

4. Forget the hype about address tracking - user tracking is a problem on IPv4 and the IP address is just one of the things they track on. On IPv6 you can choose to have client addressess generated automatically by SLAAC (which uses the MAC address, you can use DHCPv6 if you wish or you can generate dynamic privacy extension addresses if you want. (see RFC4941)

5. Broadcast traffic has gone, everything is unicast (same as IPv4) or multicast.

6. IPv6 uses ICMP a lot more, so you cant just filter it at your perimeter

7. Security in depth. This shouldn't come as a shock, in 2017 - You need a firewall on ALL devices, not just at the perimeter. The majority of devices shipped in recent years have defaulted to firewalls on due to more sophisticated malware. This does not change for IPv6, however your perimeter firewall rules can generally be simpler.

8. IPv6 fixes a lot of whats broken in IPv4, for example built in features to help identifying the remote endpoint, so that problems such as SPAM can be resolved. There is embedded IPSEC encryption, larger frame sizes. Oh and there are a few more addresses ;-)

9. To type an address into a browser, you need to do it in an RFC2732 format,basically you enclose the address in square brackers, so it looks like this http://[2001:db8::2]:8080/folder/file.html

10. A host will have multiple IPv6 addresses, for example its self-assigned link local address, its old IPv6 address and its new IPv6 address if something allocates a new one (ie privacy extension, DHCP etc). The old one will work for current sessions, but will not be allocated to anything new, it will show in ipconfig /all as (deprecated)

11. Modern DNS servers can provide IPv4 or IPv6 responses, you don't need a V6 DNS to resolve V6 addresses. V6 addresses are AAAA records as opposed to IPv4 A records. Fun fact - A=32 bits in IPv4, AAAA was chosen for IPv6 as 4xA = 128 bits just like an IPv6 address.

12. Reverse addresses are the same as the current in-addr.arpa form, except that each octet of an address is separated out, so just like IPv4 192.168.1.0 gives 1.168.192.in-addr.arpa. For IPv6 2001:2b8::2 converts to

2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. 1h IN PTR host1.example.com. Note that the :: address compression does not apply here (its a simplification for users).

13. A lot of IPv6 is automatic, for example location of routers, client IP address allocation, etc. radvd, the router advertisement daemon is the process on Linux that does some of this.

14. IPv6 isn't perfect and will continue to evolve as issues are identified and RFC's are raised to resolve them. This is no different to IPv4's history.

15. IPv6 is not going away. Growth is continuing, see <ahref="http://ipv6-test.com/stats/country/US">US graph.

@AC - Re: So, how do I go about implementing it?

Easy pie! Just go to your medium/large multinational company's CFO/board, ask them for millions of dollars, warn them that the fully redundant 24/7 99.999999999...% uptime back-end, mission critical systems will probably be impacted without any sound business reason except the fact that outside Internet is running out of IPv4 addresses. Wait until they stop laughing and say "No, seriously! This IPv6 is so cool, it does offer increased address space, IPSec, eases the pressure caused by large routing tables, does away with NAT and... Please don't leave! Hello! Anyone ?"

Re: class D address space

"Why don't we use class D addresses ? It's not really used for multicast"

Most IP stacks have special behavior hard-coded for the "special" IP ranges, i.e. multicast, link-local, etc. It would be an absolutely mammoth task to make those address ranges globally routable.

Re: Address allocated but not live

No, I'm pretty sure that most people do want their stuff on the internet. That's why they bother to deploy NAT -- to get their machines on the internet even in the face of a lack of IP space to do it with.

And it definitely is true that there's not enough v4 space for everybody. It's also true that you can find unused v4 addresses, but... there aren't anywhere near enough (and fragmentation is a big issue). v4 is just not big enough.

(Also I shouldn't really need to say this again and again, but using v6 doesn't magically mean that all of your devices are accessible from the internet. Rejecting v6 because you think it means that is mistaken.)

Re: Address allocated but not live

@sean.fr. Its not that simple. IPv4 has had its day, its lasted well, but change has to happen as we have just outgrown its capabilities.

Just because something does not respond to ping doesn't mean its not there, it just means that it refuses to talk to you or perhaps it can't be used. Remember that some addresses are not usable (for example the all 0's and all 1's on each subnet), so the more you break things down, the higher the level of wastage becomes.

Secondly the more fragmented the ranges become, the larger the routing tables become on all the backbone router. This makes routing slower - as it takes time to parse the tables for each frame.

The bigger issue is that on backbone routers (ie not the home grade stuff), the routing decisions are done in hardware to speed things up, you can't expand the tables without new hardware and that's very expensive in terms of hardware and projects to swap them. IPv6 fixes this by streamlining the routing to reduce the overhead and improve performance.

For an "ordinary home network", everything you know today about your home LAN with its different VLAN's, local routing, etc still works the same, you just end up with a different prefix. Where you probably use 192.168.xxx.yyy with the 3rd octet for the subnet, in IPv6 it just becomes the 4th block in the address, so 2001:db8:abcd:xxxx:: and the yyy bit becomes yyyy:yyyy:yyyy:yyyy. If you don't care what the yyyy bit is, then let dnsmasq take care of this and use proper device names. If you do care about addresses (ie your DNS is not working), then you can DHCP allocate and end up with addresses like 2001:db8:abcd:xxxx::yyyy. You still end up with an xxxx and yyyy portion so its virtually identical to what you are used to today.

The idea of 6to4 and 4to6 connectivity whilst simple on paper generally don't work well as v4 clients can't put a 128 bit address in the 32 bits of storage compiled into the older apps. This is the whole reason why there has been a deliberate long period of parallel running,

As to firewall separation, you can still configure your home router/firewall to allow the bits you want to access externally whilst protecting your garage door just like you do today. IPv6 firewalls work just like IPv4 firewalls do.

Re: Address allocated but not live

In other words don't move my cheese.

IPv6 isn't perfect but the lack of addresses in only one problem that it attempts to solve for which there is no solution in IPv4. IPv4 was designed for a couple of million devices (address contention is not a problem you ever want to have on a network) and it's a testimony to how well it was designed that it copes with billions of devices on it and the huge volumes of streaming traffic it handles.

A comparison with HTTP is imperfect but still perhaps useful. For many years it was acknowledged that HTTP 1.1 had limitations (no TLS, no multiplexing) but there was a lot of inertia to overcome so no work was done on HTTP 2. A few years ago, Google and others started working on an imperfect replacement SPDY to help mitigate some of the problems they had due directly to HTTP 1. The ideas formed the basis of HTTP 2, which while still not perfect is being rolled out around the world and will soon be given privileged access. This, in my opinion, is how the IETF is supposed to work and I wouldn't be surprised if Google and others start privileging IPv6 traffic once the numbers are right.

Re: Address allocated but not live

"We want none of it inside our companies and homes. We are happy with or 10 and 172 addresses."

This is a really naive attitude and it is exactly this attitude (and ignorance) that makes the IPv6 transition so difficult.

Ignoring the really obvious problem of being expected to unnecessarily translate between IPv6 and IPv4 on your network boundaries, why are IPv4 private address ranges preferable? The answer is they aren't.

Even if you are hell-bent on your outdated thinking, you could use ULA address ranges in IPv6 for places that you do not want to be globally routable.

The correct tool for the job of controlling network traffic in and out of your network is a firewall. A device with a globally routable IPv6 address behind a correctly configured firewall is just as safe as a device with an internal IPv4 address behind a NAT configuration on a firewall.

Repeat after me: NAT is not a firewall. NAT does not provide security. NAT makes absolutely no guarantees.

"We have are comfortable with NAT"

No, globally, we're not comfortable with NAT.

NAT creates massive headaches and fundamentally pushes us towards service centralisation, as we are forever having to create applications that have to "call outbound" instead of being able to work in true peer-to-peer fashion. It makes even simple applications complicated as we have to constantly be concerned with NAT traversal, or UPnP, or NAT-PMP.

NAT is a hack. It was a hack when it was first implemented, and it's still a hack now. Unfortunately it's a hack that people are sadly attached to.

"OSPF, Vlans and tags."

None of this changes with IPv6 apart from an uplift to the OSPFv3 protocol. VLANs and tagging do not change - those are part of Layer 2, not Layer 3. Please see the OSI model.

"We DO NOT WANT an internet for every device."

This is not a problem with IPv6, but instead with your network topology. Put them on a VLAN that doesn't route to the Internet, or use a firewall to prevent traffic to/from them. There are correct tools for this job. Avoiding IPv6 forever is not.

"I do NOT want my LED light bulbs or my garage door on the internet, because I can not protect them."

See above statement.

Re: Really

Because they already have an allocation and can just shufty them around.

But new allocations are dead in the water.

Tagadab (part of ClaraNet) are basically into the charge-per-IP now, whether you buy a dedicated server or a VPS. Other companies are following suit.

But if you're not growing your userbase and you have "enough" IPv4's, you have a little insurance. Meanwhile, everyone else is ALREADY giving out IPv6 for free like it's going out of fashion but charging for each individual IPv4.

Re: NAT is a problem

Actually, IPv6 DOES have NAT. It's just that it's one-to-one NAT, not the one-to-many NAT we're seeing with IPv4 (and if you thing IPv4's NAT is bad, wait until you're behind a CGN or two).