Examining IPv6 Performance
labs.ripe.net
labs.ripe.net
[1] https://torrentfreak.com/popular-torrents-being-sabotaged-by...
What kind of network are they using that lets them send forged source addresses? Also, a temporary solution in that case would be to use a blocklist of non-allocated ranges.
https://defcon.org/images/defcon-22/dc-22-presentations/Grah... but the video is also very entertaining. This is applicable to the IPv4 internet but I'm sure someone will eventually come up with a way to do it for IPv6.
(Edits:grammar)
$ ping -c 3 gstatic.com
PING gstatic.com (82.77.159.222) 56(84) bytes of data.
64 bytes from cache.google.com (82.77.159.222): icmp_seq=1 ttl=61 time=2.11 ms
64 bytes from cache.google.com (82.77.159.222): icmp_seq=2 ttl=61 time=1.98 ms
64 bytes from cache.google.com (82.77.159.222): icmp_seq=3 ttl=61 time=1.78 ms
--- gstatic.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 1.780/1.960/2.118/0.143 m
$ ping6 -c 3 gstatic.com
PING gstatic.com(bud02s22-in-x03.1e100.net) 56 data bytes
64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=1 ttl=55 time=9.85 ms
64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=2 ttl=55 time=9.67 ms
64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=3 ttl=55 time=10.5 ms
--- gstatic.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 9.675/10.031/10.568/0.403 ms
precedence ::ffff:0:0/96 100I thought about using an additional ULA subnet (ipv6 supports multiple subnets), but apparently many vendors do not yet support RFC 6724, or support it poorly with regard to ULA addresses. As such, I get mixed results with devices trying to use the ULA address for internet egress.
NAT66 (npt) is another possibility, and some people end up having to use this when they have more than one ISP (multi-wan balancing) anyway, but I haven't found a good way to update the nat target when the prefix changes yet (might try moving to openbsd and try ifstated calling a script to a pf table or something).
Part of the point of IPv6 is that your addresses reflect the real network topology - when your upstream changes, your addresses change. The right thing is to ensure that your router is also updating DNS for your internal devices, and use names to refer to them. You shouldn't expect anything to have a truly static IPv6 address.
> The right thing is to ensure that your router is also
> updating DNS for your internal devices, and use names
> to refer to them.
For most devices, a constantly changing IP is well and good (eg ipv6 privacy extensions). However, for servers it is less than desirable.
The only solution I've heard so far is to have a client on each machine that would update the DNS server with the new address, which sounds terrible.
I'm just about at the point that I'm just going to install DHCPv6, but last I heard not every OS supported it?
The point is that for an increasing number of users, it's the exact opposite.
Everybody runs behind a NAT anyways, most systems work just find with multiple layers of NATs. I have been running an internal double NAT for months and the only reason I removed one layer from my onion was that back to mac fails badly with multiple layers of NATs.
As you just admitted, NAT breaks things. Double NAT and CGN breaks a lot more. What about people who have no choice or no say in whether or not their Internet is NAT'd? There are ISP's where customers don't get routed IPv4 addresses. They get RFC1918 addresses and lots of double NAT'ing occurs. It's a bad scene.
Every normal customer is, every normal business is. Old institutions do not count because they are in a privileged position nobody else on the web is.
> As you just admitted, NAT breaks things.
And we learned to deal with it for many, many years. For many of us, a NAT is considered a feature not a bug in fact.
When I run a server I already have to assume that clients are NATed and as such I design my system to work that way. IPV6 only is a non existing part of the internet and as such not really something to optimize for. I get absolutely nothing currently by enabling IPV6 on my server because I cannot depend on it.
My position is irrelevant in this discussion. I answered the following question based on my own experience in the field:
> why pretty much anyone except google and facebook isn't?
What? Nat is always a bug with a hack piled upon hack upon hack. The amount of crap that needs done to get ip2ip communications working and other multiport protocols is stupid and introduces piles of security risks. Protocols like uPNP have produced a plethora of critical exploits allowing an attacker full access to the NAT'ed network. Firewall controlled IPv4 with a 1:1 ratio of ip to host is always much easier to control the security risks with.
Everyone else simply uses NAT because they have no other choice, there simply isn't IPs in the 4 address space to do whats needed.
So yet again we have a implementation tragedy where everyone would be better off with it working, but no one will do it, leaving us with a hulking crapsack we are used to in every aspect of our life.
Further reading: http://slatestarcodex.com/2014/07/30/meditations-on-moloch/
I'm sorry, but you are naive if you think that NATs will go away with IPv6 or that the absence of NATs would make it safer. In fact, NATs have found a way back to IPv6 and any deployment I have seen with IPv6 that was not done by a university actually goes through a NAT.
In the IPv4 realm the term NAT is often interpreted to mean connection rules in addition to network address translation. It is the address translation that is the source and focus of much criticism of IPv4 "NAT" and it is exactly that feature that is unneeded in the IPv6 realm.
So while network address translation is superfluous in IPv6, there is still an argument to be made for network access rules.
I would be interested to here what technical arguments were being made for true network address translation in an IPv6 network.
There is no need, but typically desire. Which company is comfortable leaking out individual employees IP addresses if they can avoid it? There are more downsides from a security point of view than upsides.
But thank you for pointing out explicitly one of the 'reasons' that is given for IPv6 NAT.
> This doesn't sound right to me. There is no need
> to do address translation in IPv6 networks. It may
> be that there is still a firewall in place with rules
> about incoming and outgoing connections, though.
Sounds like Stockholm syndrome. Are there any desirable properties of NAT that can't be duplicated with a firewall?
That they are widely deployed, reasonably predictable and quite transparent to the user. Which means that in the default configuration a user has a secure setup that apps however can partially circumvent to enable incoming traffic on UDP ports. Many computer games or P2P systems exploit this setup quite successfully to set up P2P networks without any user interaction.
If you like the "game requests a firewall exception by making a uPnP call to the router" model, there's no reason at all you can't do exactly the same thing under IPv6. The only difference is that games that don't have all the hacky workarounds will also work.
WHAT?
I am at a tiny German ISP, got a new contract one year ago, and have a publicly routable IP.
I’ve never seen an ISP that doesn’t provide at least one publicly routable IP per customer, some, like mine, even provide additional ones for a few euros each.
There are a few ISP's in APNIC and LACNIC regions that hand out RFC1918 addresses to end users. I've seen a few NANOG posts of people trying to greenfield such setups in the US, too. Mostly in the RF/radio space.
You have one IP, not one per computer. Thus your router becomes a NAT for the devices you have internally.
Currently I only have one, as I don’t need more, but I can easily get one per computer.
Just like I can get one phone number per room.
Very few ISPs let you do that and if they do, continuous blocks are really expensive these days, even for servers. For end user networks it's even less likely that you get them. Maybe in the states, but not in Europe. In Germany especially there are many ISPs that do not give you any IP address any more but have a carrier side NAT unless you call phone support or switch it in a panel somewhere and then you get exactly one dynamic IP that rotates every 24 hours.
If you have an ISP that gives you anything larger than /24 I would really like to hear which one that is.
Those, like TNG, often offer far better contracts.
First of all we're reaching the point where we basically discuss a tiny part of the overall space and as such this is not even relevant to the original point any more.
Secondly, the ISP you named (TNG) does not appear to even give out blocks for customers.
The "small ISPs give out multiple IPs on request" is a different, but related part.
It’s effectively like the standard 24h dynamic IPs, just that they never change them. You don’t own the IP, but are still guaranteed to be reachable under it.
You know you can dual stack right? It's not a binary option. You can run IPv4 and IPv6 addresses side by side, offering the best connectivity to all clients. You gain a lot by enabling IPv6, and not much to lose. Out of curiosity, why are you against IPv6 so much? It's coming, it's not going away. Over 25% of US residences have routed IPv6 addresses. Adoption is higher in other parts of the world.
I know, but why should I? When the time comes I will enable IPv6 but right now it's more hassle than it's worth.
> You gain a lot by enabling IPv6, and not much to lose. Out of curiosity, why are you against IPv6 so much?
I'm not against IPv6, I just don't gain anything from it. Which means that effectively it just complicates the general setup for me, more things that can break etc.
> Adoption is higher in other parts of the world.
It would appear those parts of the world are not customers to me, users of my software or they are fine with IPv4. And again, that's what is the thinking process for many, many people that have small web services or websites.
How do you know if you don't have IPv6 endpoints?
> that's what is the thinking process for many, many people that have small web services or websites.
And those sites will continue to be small with that kind of thinking.
> When the time comes I will enable IPv6
The user stats show that the time is now. What kind of signal are you waiting for?
For my open source projects I do not care. For the business side of things at any company I worked for the bulk of the revenue came from a handful of countries where invoicing was set up, the interface was translated to, everybody spoke English in support etc. If I would ever have to grow a business into an area where there is no IPv4 connectivity or problematic one, there would be plenty of other issues before.
> And those sites will continue to be small with that kind of thinking.
One has nothing to do with the other. Sites grow because they grow their consumer base and that has pretty much nothing to do with IPv6 connectivity (at the moment). The future is irrelevant in this discussion as the thread was about why few people care currently.
> The user stats show that the time is now. What kind of signal are you waiting for?
Not the stats I am looking at, but I'm willing to be shown different statistics. For all companies I worked for IPv6 has been not even a topic worth discussing so irrelevant was it for the the operations.
When I started managing a /24, the network administration was so amazing. Like relaxing on a big squishy couch. The internal nameserver and the external nameserver... were the same nameserver with one set of records. The firewall was actually a firewall, not set of limitations that could be imposed by a firewall but were in fact a technical limitation of the network gateway.
I miss it so much. Now I'm sitting on a network that uses a private block, VPN-ed into a network that uses ALL 3 1918 blocks (don't ask). From the computer I'm sitting at various subnets will be routed to the local network, and others to the remote network. There are systems that I can not communicate with on both networks. I will stand up SSH tunnels to whenever I need to talk to them.
Heh, yep, with a firewall that dropped all incoming connections. Worse than configurable NAT.
Anyway I found something funny, they finally 'fixed' the FAQ.
In 2010 and earlier:
> ResNet does not have a firewall , we simply block all incoming TCP connections outside of ResNet.
From 2011 on:
> ResNet have a firewall and we block all incoming TCP connections outside of ResNet.
- https://www.reddit.com/r/blog/comments/2ftv08/hell_its_about... - https://www.reddit.com/r/ipv6/comments/3cfqrw/cloudflare_sup...
That's about it though for IPv6 support on AWS. Annoyingly, Route53 supports AAAA records but their nameservers are only reachable via IPv4.
Unfortunately, only ELBs in EC2 Classic support IPv6: "Load balancers in a VPC support IPv4 addresses only."
Cloudflare handles their front end, so it should be as easy as toggling an option in the CF admin page.
It prefers, but only if it gets a response within 25milliseconds. It still queries AAAA and A in parallel.
Correct. The large technology companies that shape the world are indicating their preference and shift towards an IPv6 world, yet you still claim that you see no benefit? You don't want to be on board with them?
Did you reply to the wrong thread? I did not indicate my preference here, I replied to OPs question about why his server might be slow and what other systems are doing.
Thanks to teksavvy that blames videotron. Customer services says: not a problem.
There is a growing balkanisation between highly dense zone with the critical mass for getting a ROI in IPv6 transition and less dense zone that where equiped with a correct IPv4 backbone.
Non mobile land connection is getting less and less connected to the internet, because "mobile" is the future. But mobile data plan and hardware are freakingly expensive as if there was a money divide on the internet between riches and poors. I don't want no smartphone, no mobile connection, no netflix: I just want a 1Megabyte/s clean internet with 100% internet connection.
It is really the IPv6pocalypse here. Half baked technologies put on the front, while the basics (100% access, UDP not dropping too much, not too much lags) are decaying (as if equipments where not upgraded).
I used to be a QIII player. Nowadays it is excessive lags, spikes everywhere on every continent. My internet sux balls big, QIII was a good reason to have internet. Now, everyone is happy with buggy crashy games that are sloooooowwww in gameplay but with a 4KHD 120fps.
Why must I have internet? Because administrative tasks requires me to have it to gather and send forms. Else, I would drop it.
2.8% of mondial energy burnt...for this