Hacker News Reader

Comment by dmitrygr | Hacker News Reader

My #1 step in troubleshooting any network issues is to disable IPv6. Step #2 is so rarely needed that I no longer remember what it was. IPv6 has been a failure, it is about time we openly admitted it. Why? Simple - it causes consumer pain and no consumer gain

View on HN

I feel similarly, but what is the solution? IPv4 blocks are all but impossible to get anymore, there's a waiting list at ARIN that doesn't really ever move. The company I was working at signed up 3 or 4 years ago for a /24 and never heard back to this day. Sure you can rent/buy them on the open market, but that's only going to last so long, and eventually puts anyone without FAANG money out of the running...

Regulation. Incentivize ipv6, tax ipv4 only devices, mandate ipv6 in government networks.

Ah yes "the government will fix it" okay .

Maybe practice what you preach and deploy v6. I have. Infact I run v6 only.

You can’t just change the size of an IPv4 address without creating a whole new thing.

Yes, but let's not pretend that IPv6 was just IPv4 with a larger addr size. A lot of other unnecessary cruft got changed. That is kinda the issue. Add an extra octet to IPv4, call it IPv5. Done. DHCP (as is) can already handle variable-length addresses so it'll work unmodified for 5-byte addrs, for example. Same for ARP.

I am wondering if we could hack the ipip tunnel to automagically handle a bigger address space.

Much akin to your idea but mostly supported already

But the IPv6 changes are actually good, right? IPv4 was designed for an entirely different world and IPv6 was designed for this world. You're only going to get one chance to make these kind of improvements.

IPv6 has link-local, v4 doesn't. That is a huge configuration win.

IPv4 also has link-local addresses. They belong to the range 169.254.0.0/16.

And is it enabled by default?

Also is it mathematically unique not to cause any potential conflicts.

Yes. 169.254.0.0/24 addresses show up quite often.

> Yes, but let's not pretend that IPv6 was just IPv4 with a larger addr size. A lot of other unnecessary cruft got changed.

Mostly removed (e.g. removing fragmentation). If you're making an incompatible protocol, might as well take the chance to remove the cruft.

> Add an extra octet to IPv4, call it IPv5. Done.

Have fun debugging nondeterministic routing loops lol.

Fragmentation is mostly removed on IPv4 as well. Almost everything sends DF, and there's very little legitimate fragmented traffic. You can just drop fragments wherever convenient. If you want to be nice, it's a good idea to have a small reassembly buffer, but if it's too much work, just drop them.

It's beyond too late to change anything, but I imagine if IPv6 had started with a sensible rollout plan and worked backward from there, it would look somewhat different and it would have taken a lot less time to take hold.

IPv6 doesn't remove fragmentation. IPv6 fragmentation works differently. See https://www.rfc-editor.org/rfc/rfc8200#section-4.5

The Fragment header is used by an IPv6 source to send a packet larger than would fit in the path MTU to its destination. (Note: unlike IPv4, fragmentation in IPv6 is performed only by source nodes, not by routers along a packet's delivery path -- see Section 5.)

You can though, there is an options field in IPv4 that could have been made to hold extended address values.

It was used as part of the Extended Internet Protocol: https://www.rfc-editor.org/rfc/rfc1385

And the Address Extension protocol aka IPv7: https://www.rfc-editor.org/rfc/rfc1475

And now you need all routers in your path to support it. Effectively creating two incompatible networks and achieving a worse result.

Routers already support the Options field, it's part of IPv4. The old RFCs mentioned are specifically designed so only routers at the edge need to support them.

You should try reading the specs before making technical claims instead of completely missing the point of why those RFCs were created in the first place.

Instead we have to rehash an argument from 30 years ago.

IPv6 was enabled about 6 months ago in my area by my ISP. I noticed it was on about a week after they enabled it because I saw funny IPv6 networks I didn’t recognize in a log somewhere. I doubt this national ISP would turn on IPv6 like this without any notification if they were concerned it would cause “consumer pain and no consumer gain”. No pain here, and I’m hosting IPv6 only sites I can easily access from my mobile (with native IPv6) for fun.

Is it possible your ISP’s IPv6 network was problematic? I’m not sure how you can draw the conclusion that “IPv6 has been a failure” given evidence it’s live, in public, serving its purpose. The world has not exploded.

That hasn't been my experience at all. Working around slow, unreliable NAT devices (all of them) causes stuff that runs over ipv6 (these days, almost anything that uses significant bandwidth) to work better and faster for me.

There is a cost there though as mentioned in the forum post. The ISP in question is using CGNAT, but they need more IPv4 addresses even with CGNAT to support higher loads. CGNAT only reduces the number of IPv4 addresses required, it does not eliminate the scaling.

However, I do think IPv4 is honestly pretty good for local or even WAN networking for organizations. You're unlikely to ever hit limits in the reserved blocks and it's much easier to read and work with IPv4 addresses. Maybe we need easier configs to block IPv6 except for external addresses?

> I do think IPv4 is honestly pretty good for local or even WAN networking for organizations

Strong disagree here: I sometimes do work which involves VPNing-in to SMB company on-prem networks from within other SMB’s on-prem networks, so they’re all invariably using 192.168.x.x or 172.16.x.x whuch means they all conflict with each other when you want to use LAN resources at the same time you’re VPN-ing to another network.

My hope is that IPv6 will mean point-to-site and site-to-site VPNs will die-off and we’ll be able to connect all hosts directly to other hosts (IPSec Transport Mode) - but then I’m reminded that configuring an IPv6 firewall for IPSec is conceptually much harder than setting up OpenVPN - and SMBs don’t have much in the way of people who even know what IPSec is, ugh.

I remember when I first got Google Fiber and the solution to "amazon.com will not load, ever, period" was to disable ipv6 on their router.

Not sure I've ever bothered to turn it back on.

If only everyone hadn't dragged their feet "because it's too hard"; we could maybe be living in an IPv6 utopia? Maybe if the government started handing out fines? haha

At least for local applications at home, this has been my experience as well. I'm sure data center operators love ipv6 but it's been nothing but a headache with no benefit for home consumer use.

Please leave the profession - you lack the required qualification.

Reply on news.ycombinator.com