Hacker News Reader

Comment by mrkurt | Hacker News Reader

IPv4 with nat is effectively routing your 100,000 hosts through one of 4,294,967,296 possible IP prefixes (a /32).

IPv6 with a /64 routes one of 18,889,465,931,478,580,854,783 possible IP prefixes to your router. Everything that happens behind that is opaque. There are so many IPs in that prefix that people can't even guess which ones you're using. It's easier to guess internal IPv4 NAT addresses.

The internet can't see your IPs. "Publicly routable" doesn't mean much when you're talking about prefixes.

View on HN

Unless you're planning to assign random IPv6 addresses for each connecton then it's not at all the same thing.

And anyways, when you have a NAT you're probably routing traffic through a level 4 balancer or jumphost or using a VPN somewhere in your LAN.

> Unless you're planning to assign random IPv6 addresses for each connecton then it's not at all the same thing.

SLAAC

SLAAC has an option to randomize, but it's a lot slower than per-connection.

We assign IPv6 deterministically. Incrementing them is the most boring way to use IPv6 space.

You can also just start in the middle of a block and make a sequence of 10,000 IPs effectively unguessable.

I don't buy that keeping addresses private has much value, but IPv6 still isn't worse than NAT in that respect.

As soon as one of the computers in the subnet initiates traffic outside the network, its IP address becomes public knowledge though, right? Doesn't matter how large the space is, that information leaks, whereas with NAT it doesn't.

Modern OS change their outgoing IPv6 address fairly often. They could grab 10,000 from the pool and rotate between them every second.

IPv6 addresses can be ephemeral? What, DHCP is assigning a whole range to each client? Didn't know that.

Pretty weird. For internal stuff I would be using IP addresses to identify peers. Ephemeral IP addresses in logs aren't very useful.

Reply on news.ycombinator.com