Hacker News Reader

Comment by imoverclocked | Hacker News Reader

IPv6 is pretty great. You don’t run out of numbers locally, you don’t run out of numbers globally. Most software and OSs just support it these days… many embedded things still don’t.

I think the biggest pain point with IPv6 adoption is probably the large number of customers with a little netgear router that doesn’t know how to pass IPv6 through it. I also think local administrators that still purchase stuff that doesn’t support IPv6 are just shooting themselves in the foot. After all, the writing has been on the wall for over two decades.

View on HN

> After all, the writing has been on the wall for over two decades.

That IPv6 has been around so long and is still not ubiquitous means that writing is faded and partially obscured by graffiti.

Anything as large and hodgepodge as the Internet isn’t going to change in a day. I’d say that the writing has been kept fresh [1] and the underlying need hasn’t gone away.

[1] https://www.google.com/intl/en/ipv6/statistics.html

25 years is a whole lot longer than a day!

> the underlying need hasn’t gone away

That's 100% true. I think almost everyone sees the problem that IPv6 is addressing.

> IPv6 is addressing

Exactly!

Biggest pain point in adoption are lazy ISPs who actively resist the transition. Once it's mandated, like in India or China, transition happens very quickly.

I don't think it's lazy ISPs, I think it's economics. I think it's that the cost/benefit ratio of making the change isn't clearly favorable to making the change.

The IPv6 spec was published in 1998. 25 years on it should be nearly flawless. Not “most software,” all software including firewalls should support it with safe and sensible defaults.

The current state of support and adoption is frankly abysmal. The attack surface is non-negligable. And there is no end in sight.

The idea of deploying a new version of the internet protocol (which lacks backwards compatibility for reasons) in parallel to the existing version should never have left the drafting table.

I agree it should be better but you’re talking roughly half of Google’s total traffic now, and it’s really common for people to be using it without even realizing that so I’m not sure I’d call it abysmal in the context of a large distributed system operated by millions of independent organizations around the world.

My understanding is that's because of smartphones, which automatically and seamlessly use IPv6, and most carriers support IPv6.

Outside of the world of smartphones, though, adoption is awful.

Thats the case in the US afaik. I don't know the stats globally but Switzerland has 40% and no mobile carrier supports IPv6 yet.

Phone carriers are responsible for a lot because they had nowhere near enough IPv4 capacity to handle all of the phones & other devices, but it’s not just them. A lot of people use IPv6 but never realize it because the experience is so smooth — all browsers use Happy Eyeballs and it tends to pick IPv6 because it’s often faster. I know that because I semi-regularly get support requests from developers wondering why they couldn’t access an IP-restricted service because they didn’t even realize that their browser had picked the IPv6 record because it responded faster.

> Phone carriers are responsible for a lot because they had nowhere near enough IPv4 capacity

Precisely so.

> all browsers use Happy Eyeballs and it tends to pick IPv6 because it’s often faster.

I know. This sort of thing causes me trouble every so often. I wish I could make browsers not do that.

I’m not sure there’s a better option: too many network operators are asleep at the switch and you’ll find networks where IPv6 works but v4 is subtly broken or vice versa. Asking nicely won’t get the stragglers to upgrade so what we probably need are economic incentives: as IPv6 becomes more common, providers charging for IPv4 is a good prod.

The most important thing is probably just pushing equipment vendors to set better defaults since that’s what a disturbing number of places will be using.

I'm not sure we ever really hit that bar (beyond adoption) with IPv4 either. A surprising amount of things don't really do it right and definitely not securely.

> many embedded things still don’t.

For home IoT, Matter uses IPv6, and may start picking up this year. (I worked on some IPv6-related things for it for my then-employer.)

Matter is based on thread which is full IPv6 I believe and thread has been around a while.

Thread or WiFi transport, but yes, I'm sure Thread was influential.

Is Thread related to 6LoWPAN?

it builds on top of it

A real pain point with IPv6 is being unable to make subnets smaller than /64. So much wasted space and hassle to get more than one network going.

IPv6 subnets are supposed to be super cheap. As an individual, through a RIPE LIR, I was able to get a /44 (2^20 /64 subnets), no questions asked. I have these tunneled into my home lab and a couple other locations. I realize my setup is unusual: I have my own ASN and am running BGP.

In most countries you can't even get an ASN as a private individual. I found I couldn't without having a business identity.

FWIW, ARIN will let you register as an individual sole proprietor, even in jurisdictions where this doesn't require state registration/licensing.

If you work with a RIPE LIR, they may be more than willing to help you, even if you are outside of Europe. You just need a "presence" in Europe, which can be virtual (a VPS counts.)

I am in the ARIN region but I did not want to pay the ARIN registration fees for an ASN. It was $550 + $150/year, so I went with a RIPE LIR.

There's no technical reason why you can't if you use active DHCPv6 and other such tricks. They make life harder than standard IPv6, but there's no reason why you can't turn one of your /64s into /120s. With a /56 being the standardised assignment for ISP customers (=256 subnets), I think there's more than enough space for a home network. /48s used to be the recommended space assignment but I think these days you can only get those as a business customer or through an independent party (i.e. Tunnelbroker).

Are you looking to deploy 100 subnets at your house or something? I just don't follow the relation to the /64 size and any hassle.

This sounds like and A/B problem. You’re asking how to do A but what you really want is B. But you’re asking about A because that’s how you think you’d get B in the ipv4 world.

Your ISP should give your router a /56 prefix via PD, which you can divvy up into 256 networks internally. Alternatively, if you don’t need globally-routable addresses, just pick a ULA prefix and have your router advertise it internally.

What happens if your ISP just gives you a /64?

What happens if the moon is made of cheese?

Outside of obscure hypotheticals you make do or switch providers.

It's not that obscure. It's common to be given a /64 to a home, or even to small business premises. Some even get a /128.

So it's reasonable to wonder how people deal with that problem when needing multiple subnets. Many locations don't have a realistic choice of affordable providers, or none of them provide IPv6 with a shorter prefix anyway.

Depends on what you want to do. Maybe use one network or assign static addresses. Here's a post on /120 networks: https://blog.ipspace.net/2011/05/ipv6-neighbor-discovery-exh...

My ISP doesn't even give me a /32 v4 or a /128 v6. CGNAT v4 only.

I'd love to have to make do with a /64.

My ISP did exactly that. I bugged their customer support several times over a month and they finally caved and gave me /60 now.

My ISP gives me /64. It is unusable with consumer routers.

ISPs should do a lot of things, but when it comes to IPv6 many don't. Mine gives me a new prefix every time my router boots. Meanwhile I've had my DHCP allocated IPv4 for 3 years now...

Given that the IPv6 standard was written by enterprise network people with no thought how it would get deployed to the masses, lots of software is still a PITA to work with if you got an ISP like mine.

How does a larger subnet hurt you?

Using /64s can make you vulnerable to NDP exhaustion attacks: http://inconcepts.biz/~jsw/IPv6_NDP_Exhaustion.pdf

Thankfully, contrary to GP's claim, you can just use smaller subnets to mitigate on links where this might be a problem.

What does this have to do with the thread discussion?

It answers the question posed by the parent comment. You asked how using a larger subnet hurts. I provided an example of how using a larger subnet might hurt. How is that irrelevant?

>IPv6 is pretty great. You don’t run out of numbers locally, you don’t run out of numbers globally.

If that's everything IPv6 has going for it it's no wonder its adoption is still so low.

Based on the way IPv6 is currently allocated we only leverage about 56 bits of usable address space but IPv4 with NAT gives us a max of 96 bits of address space

Edit: don't know why I'm being downvoted, I guess the network gurus here don't research

https://www.potaroo.net/ispcol/2017-09/natdefence.html

> IPv4 with NAT gives us a max of 96 bits of address space

But then you need NAT piercing everywhere for even "basic use". How is not being able to connect to things "usable"?

By that same metric, you also get a bare minimum, naive count of of 144 bits of IPv6 address with 2 layers of link-local address + all ports.

144 is much larger that 96.

Even the naive 64 bits "just use one layer of link-local" is still larger that the entire current 32-bits of IPv4.

I think the point is that 96 is quite enough to not run out. Which is plausibly fair, if you can actually get that many bits (or close enough to actually cover everyone) and can deal with the ugliness of NAT. It's especially fair, I think, to argue that the reason that IPv6 adoption has been so slow is because IPv4+NAT is good enough for most people. Just because IPv6 is better doesn't mean that people will want it if the old option can be hacked up to keep working.

So is 56. That’s about 9 million addresses for every human on earth.

And, of course OP is wrong about 56 anyway, but so it goes

Oh, sure; arguing that IPv6 doesn't, in any way shape or form, have enough addresses would be extremely misguided. I was reading it as "IPv4 already has enough address space (if we include NAT) so we don't need to deal with v6".

FYI: After skimming the article, I'm downvoting because you conflated what the article calls "This 96-bit NAT address space is a highly theoretic ceiling, […]" became a plain unqualified "96 bits of address space" in your comment. Which you're then comparing with the "56 bits of usable address space" in IPv6.

Also, that sentence continues in the article with: "[…] but the pragmatic question is how much of this space can be exploited in a cost-effective manner such that the marginal cost of exploitation is lower than the cost of an IPv6 deployment."

Pretty much anything is lower than the cost of IPv6 deployment if you already have a large IPv4 deployment.

CGNAT routers aren't cheap. At some point you're spending more keeping your IPv4 running than it would take to replace it.

Except you can't really replace it. You need to keep BOTH for the good old internet to work.

You probably need some amount of CGNAT or equivalent (e.g. DS-Lite). But if you offload the vast majority of your traffic onto v6 (which is easier than it sounds, because most traffic is to a few big sites and most of them are v6-enabled) then you can reduce the number of connections you have to track by orders of magnitude, which saves you real money.

Yeah I remember seeing that in a talk about an ISP adding IPv6 support: https://youtu.be/75h4gm7t1oI . They say that 30% of traffic is IPv6, which means 30% less CGNAT hardware needed.

> If that's everything IPv6 has going for it it's no wonder its adoption is still so low

IPv6 has numerous things going for it. But it also has numerous downsides. I suspect that's why the adoption is so slow.

Reply on news.ycombinator.com