Hacker News Reader

Comment by simias | Hacker News Reader

The number one excuse in my opinion is: you can't only support IPv6 if you make a service that can interact with anything IPv4, so the real question is not "should I use IPv6 or IPv4?" but rather "Should I use IPv6 and IPv4 or just IPv4?"

Clearly all other things being equal supporting only one stack is easier than two. It's a shame though, at work I've decided to go full IPv6 for one of our software solutions because I'm only talking "to myself" and it's amazing to have so much flexibility in your addressing. Need a unique IP in a distributed system? Just stick your MAC in there and you're good to go. Need a private network prefix that won't clash with anybody, anywhere? Use RFC 4193 and you're good to go.

View on HN

The institutional trading world uses a lot of private network connections, and it would be amazing if the whole industry migrated to IPv6. Then everyone could have a real subnet for each link with genuine globally-unique addresses. It wouldn’t even be a hard migration — vendors force everyone to update their network config on a semi-regular basis anyway.

Honest question, not trying to incite unrest: Why does IPv6 even matter for private networks? My understanding is the main (only?) benefit of IPv6 is the vastly increased address space, are there that many private networks in existence that exhaust all IPv4 private network IP ranges?

> are there that many private networks in existence that exhaust all IPv4 private network IP ranges?

No, but there are many private networks in existence that use overlapping subsets of the private network ip ranges.

I bet there are. It only takes ~16M residential NAT “routers” to hit 2^32 total addresses. And there are way more than 2^32 things on the Internet.

it's much more simple than that.

While there are 16,777,216 available addresses under 10.0.0.0/8, most organizations will do the reasonable thing of allocating nice regular subnets for each area and use case, so you can easily end up with one org using things like

  10.0.0.0/16 for infra
  10.8.0.0/16 for allocating end user /24s
  10.16.0.0/16 for whatever

and then that org will merge with another who as it turns out did exactly the same thing, and now the internal subnets all overlap. Even though each company may only be using a few thousand addresses, the address space itself overlaps.

Even if you can plan things ahead of time and divided the /8 into 32 /13s or something and give each sub company 500k addresses, you'd still be screwed on a merger.

Even with private networks, having plenty of address bits makes things a lot easier.

My employer's internal network includes hosts with addresses in the 10.0.0.0/8 private address range. So does my home network. I have to be careful when choosing subnets, or else things will break in weird ways when I connect to my work VPN. With IPv6, I don't have to worry about this because every machine can be assumed to have a globally-unique address, even if that address isn't normally exposed to the outside world. And more importantly, it's easy to look at the address prefix and figure out where to route packets.

Ah, that's actually something I have hit (a lot.. my employer's and home's networks also clash), but I didn't realize IPv6 would solve it until now!

The right description for most networks in finance isn't really private, but rather semi-public. NYSE's matching engines aren't routable over the public internet, but they'll give access to anybody willing to pay the price. Same goes for any of the hundreds of other exchanges out there. And lots of broker/dealers need to talk to multiple different exchanges, as well as to each other. It would be nice to do all of that communication using one globally unique IP address, rather than with a rats nest of NAT for each gateway.

I’ve seen traceroutes on private network setups that involve a catastrophe of different conflicting uses of 10.whatever addresses. Also, people use NAT on some of these private network for reasons that escape me.

Getting everyone on the same address namespace would be a big simplification.

For institutions on the leading edge, the extra bytes incurred by the IPV6 ethernet frame make it a non starter. 160 bits for IPV4 vs 320bits for IPV6 @ 10GHz is a 16 nanosecond penalty on every message you send.

With those sorts of requirements, it seems like firms would find value in using a different layer-3 protocol (perhaps even custom) to reduce that overhead further.

Yep, the microwave links are often using custom layer 3 tech (1 byte messages!).

Beyond that, you need to vertically integrate a hardware shop and get custom layer 3 hardware, otherwise you're not going to beat off the shelf Arista/Cisco switches doing IPv4 routing.

Also, at the end of the day, you need to be shipping your bytes to an external consumer (e.g. an exchange), so you're probably going to need to have an IPv? layer at some point anyways.

It's crazy the lengths to which trading firms are going to squeeze nanoseconds out of latency. It makes me wonder what value we're getting, from a societal perspective.

Better network tech =). You can probably thank trading for consumer 10G now and 40G in ~5 years.

I doubt that’s true. HFT is big business but nowhere near that big. Keep in mind that a lot of the big HFT players failed a few years back due to revenues being too small to support the R&D operations. I think that what really made 10G affordable is trickle-down from the SAN world.

Yeah you're right, above is a bit sensationalized. I think it still probably had a (positive) impact on pricing and time to market though

Yea you can pick up a PCIe 10G adapter for $40 on Amazon and a 4 port 10gb dlink switch for $200

It's all about finding and capitalizing on arbitrages in the market the popup and disappear all the time in the blink of an eye.

I suspect this makes no difference whatsoever as long as everyone is forcibly migrated at once.

You can only forcibly migrate the edge protocol. There will still be competition for small ethernet frames to execute against geo arbitrage opportunities.

What you'll (likely) see is internal networks on V4 and V4->V6 translation switches at the edge so you only pay the 16ns cost on ingress/egress.

> and it's amazing to have so much flexibility in your addressing.

More flexibility than having the entire 10.* block to yourself? What are you, Google?

Yes, flexibility. You don't need to have 2^24 hosts for a 24-bit address space to start becoming cramped. You have to divide up that space into subnets that roughly match your physical network structure, which depends on accurately anticipating future growth; otherwise you'll have to suffer the pain of renumbering later on.

The real benefit of a /48 or /32 IPv6 subnet isn't that you never run out of individual addresses. It's that you're practically guaranteed never to run out of identifiers at any level of the hierarchy.

... but you don't have 10.* to yourself.

I've seen many cases where companies were bought, merged, or linked to other companies and had to put complicated NATs in place to translate org A's 10.* addresses to/from org B's overlapping 10.* addresses.

Then you have the problem of connecting to a VPN for 10.10.0.0/16 from a coffee shop with 10.10.0.1 as its router.

10.* is private. His IPv6-only project was probably using the Internet, so his computing farm at point A could talk with his high performance cluster at point B without a tunnel.

My solution integrates in other networks while having its own private addressing. Think something like a VPN (it's not a VPN but that's a story for an other day). Even if I allocate a random subnet like "10.5.212.0/24" I still take the risk of being unlucky and conflicting with something. On top of that I then only have 256 individual IPs to play with which means that I need to have some kind of dynamic allocation scheme instead of just using the MAC address to have a globally unique ID. This is of course even worse if you want to allocate multiple subnets.

IPv6 is much simpler to deal with.

Bingo. It (DSLite) breaks P2P traffic in the sense that there will be less peers available. Which is a big issue for rare material. I also couldn't use 4G to access my network. I kindly asked my ISP (Ziggo NL) to swap back from DSLite to a router with native IPv4. Not in the least because the router was unstable (a known issue with certain consoles even though we didn't use any of these).

Dual stack, OTOH, is no problem but my ISP doesn't provide that (a competitor -XS4ALL- provided it for nearly 20 years now though it was beta for a long time as well and also it has been a tunnel for a few of those years). I feel sorry for our German neighbours with UnityMedia who are stuck with DSLite.

It's not DS-Lite that does that, it's CGNAT. Unfortunately CGNAT on v4 is unavoidable, because there just aren't enough v4 addresses to avoid it, so although it does suck a lot it's hard to blame ISPs for using it. It's just one of the consequences of v4 exhaustion.

DS-Lite makes the situation better by giving you v6, which means you can still do inbound connections. If you just had CGNATed v4 with no v6, then you wouldn't be able to do that at all.

How much extra work was it to add in IPv6?

Not op, but when I went through the exercise, the only difference was that I changed the type of socket I was creating, and I used `getaddrinfo()` to get a list of addresses to bind to vs just binding to a single entity.

There really isn't a whole lot of work that needs to be done to support IPv6 in an application, especially new build.

It was a brand new design so I just used IPv6 from the ground up, there were no adaptation/rewrite involved.

The main cost was the time spent reading the various IPv6 RFCs to make sure I understood the details (it mostly mapped well to my IPv4 knowledge but there are differences). Beyond that it was smooth sailing, although I'm regularly annoyed that common tools are rather clunky when dealing with numerical IPv6 addresses. For instance Firefox requires that I put [] around the IP for it to treat it like an IPv6. SSH on the other hand does not understand the address between brackets. On the other hand SCP does requires the brackets (since it uses a : to delimit the path) which is even more annoying than Firefox because zsh treats [] like a match pattern. It's just small things but it does hurt usability.

Oh and ZeroMQ didn't support IPv6 in their experimental UDP implementation so that was some additional work.

Reply on news.ycombinator.com