Hacker News Reader

Comment by 10000truths | Hacker News Reader

It's hard to adopt something that schools don't teach. I know someone who graduated from UCI with a CompSci degree with a specialization in networking, just before the COVID19 pandemic began. He recalled that the networking courses he took did not cover IPv6 at all, except to describe the address format (i.e. 128 bits, written as hexadecimal, colon-separated). Everything he learned about IPv6, he had to learn on his own or on the job. A standard that has been published for over two decades, heavily used for over a decade, and critical in the worldwide growth of the Internet, was treated as an afterthought by one of the premier universities in the US.

Obvious disclaimer: This is a sample size of 1, and an anecdote is not data, yada yada. I'm not involved in academia, and have no insight into the adoption of IPv6 in CompSci networking curricula on a broader level.

View on HN

Meanwhile, I was taught and practiced IPv6 in 2003-5 in engineering school (France).

As of 2024, IPv6 deployment in France was >97% mobile and >98% residential due to not being required for obtaining a 5G radio license (and then v6 simply carried downward to being available on 4G) + every ISP that provides FTTH also providing v6.

https://www.arcep.fr/fileadmin/reprise/observatoire/ipv6/Arc...

Over here IPv6 JustWorks to the point of absolute boredom.

Is it commonly used within small/medium/large businesses?

German situation is mostly/rarely/never. Small businesses have their DSL line where their cheapo router will announce an IPv6 prefix which almost all ISPs over here provide. Medium to large businesses usually have some braindead security policies that include switching off all IPv6 functionality in devices.

Don’t get me started on security policies of large German (non-tech adjacent) companies - so many of them are still stuck in the 90s

Are they still faxing?

I work for an insurtech (!), and something like 90% of our communications with mortgage companies is via fax. I kid you not.

Is there actual ink being printed onto paper or is fax just used as email with extra steps?

Ink on paper, where I work. There have been court decisions that have seen Fax as "remote copying". And said that those remote copies only had any legal value if there was an actual paper original. Thus the workflow always has to involve paper that is then archived as paper in a folder...

I once had to print a form and fax to a company with a signature and the instructions said specifically that "signing with a computer and sending digitally is not allowed".

I just signed with macOS Preview, applied some random noise filter and used a one-off online fax service. ¯\_(ツ)_/¯

On our end, it's all electronic - we never print anything out. So yeah, on our side, "email with extra steps". But I have no idea how the mortgage companies handle it on their end.

> Medium to large businesses usually have some braindead security policies

what's the argument behind that? are they scared they might configure their firewall bad and have no NAT to safe them from accidentally making all devices public?

Usually there is no official justification given, just a list (in excel...) of security requirements that have to be ticked off. One of them is "Disable IPv6".

I've heard some ex-post justifications, make of them what you will: Existing infrastructure like firewalls, VPNs and routers might not be able to handle IPv6 properly. Address distribution in IPv6 is unpredictable. No inhouse knowledge of IPv6. Everything has an address in IPv6, so the whole internet can access it. No NAT in IPv6, so it is insecure. IPv6 makes things slow.

It comes from the same place as "passwords expire every 30 days".

People don't understand something and just apply the most annoying rule possible.

The craziest one I saw in Germany was "cookies are allowed, localStorage is not", that was for our app. CTO overrode the CISO on the spot and called him an idiot for making rules he doesn't understand. Interesting day.

I was taught IPv6 in the mid 2000s too, in Italy.

But penetration there is just about 15% or so :/

Tbh it’s is a huge PITA with little practical benefit. IPv6 is the Perl 6 of networking.

Many of the big benefits are things that don’t deliver anything that folks are lacking. You also need to understand how you fit in the overall universe more.

I absolutely love the things that IPv6 delivers and employ it on purpose.

The world very clearly doesn’t revolve around what HN users “love”.

I think the western world very much revolves around:

* The internet

* Linux servers

* Automation

I get your point, but it falls on deaf ears to me since most people don’t feel the benefits until some passionate nerd makes something that scratches an itch.

For a practical example: peer-to-peer sharing like Airdrop is much easier to implement in a world with ipv6.

> For a practical example: peer-to-peer sharing like Airdrop is much easier to implement in a world with ipv6.

And without firewalls. Unfortunately this world does not exist.

According to my last job interview, linux servers are only for websites and worthless otherwise.

The world at large doesn't care what I love, correct. But my users care about whether they have to remember that they're supposed to use port bla instead of the standard port foo, which is a common scenario with v4. Not enough addresses, and / or you can't get them to the VM or container or VPN client or whatever that needs them. IPv6 can often fix these kinds of issues.

Does the world at large care? No.

Do I care? Yes.

Do my users care? Yes, albeit indirectly.

Does my organization care? Yes, in the sense that it removes friction from what it needs the employees to do.

And that's all the justification that's needed, I'd say. The world very clearly doesn't need to revolve around what I love for IPv6 to be a good thing.

What about the benefit of there being enough addresses?

The widespread deployment of NAT and VPNs has counter acted the market forces that were assumed to make IPv6 appealing.

IPv4 addresses are still expensive. NAT is a value add for a lot of cloud platforms.

IPv6 has arguably done more to counteract market forces related to IPv4 address exhaustion.

It's my dream that one day I'll be able to run an AWS VPC that only has IPv6 for the private subnets and then I'll never have to worry about managing the address space or how many IP addresses each ALB consumes.

> The widespread deployment of NAT and VPNs has counter acted the market forces that were assumed to make IPv6 appealing.

Tell that to everyone who is behind CG-NAT and has issues with (e.g.) video games. Or all the (small(er)) ISPs that have to layout CapEx for translation boxes.

Honestly the games issue might be out of day. Game devs have access to great services to punch through NAT at this point.

Tech finds a way…

Which has led to every game needing a central server running, forcing centralization where p2p used to work great. Also how Skype was able to scale on a budget, something now blocked, forcing you to raise money for more ideas than before. Running a matrix(?) node should be as simple as clicking install and it's just there, next time you're with your friends, nfc tap or whatever and your servers talk to each other directly forever going forward. But nope, there always is a gatekeeper now and they need money and that poisons everything.

I don’t think VOIP was a major factor in game centralization. The big one was selling cosmetics (easily unlock able server-side in community servers), and to some extent being able to police voice chat more. Major game publishers didn’t want to be in the news about the game with the most slurs or child grooming or what not.

Central servers are useful for more than just NAT hole-punching. They’re also great as a centralized database of records and statistics as well as a host for anti-cheating services and community standards enforcement.

Peer to Peer games with no central authority would be so rife with cheating that you’d only ever want to play with friends, not strangers. That sucks!

> Peer to Peer games with no central authority would be so rife with cheating that you’d only ever want to play with friends, not strangers. That sucks!

Back in the the day RtCW had a server anyone could run and you could give out the address:

* https://en.wikipedia.org/wiki/Return_to_Castle_Wolfenstein

There was a server that a ISP / cable company in the southern US ran that I participate in and it was a great community with many regulars.

P2P can be awesome with the right peers.

If you can run your own server then that's still a central server. That still lets a community of people work with a central authority. It's just a different authority from the game's publisher.

In that sense, Mastodon is a centralized service because it's on someone's computer. That's not really what people mean by central. They mean we're increasingly reliant on game companies for networking infrastructure.

Is that all IPV4s fault? I don't think so. But it complicates things

I think you're muddling things up more than they need to be. A peer-to-peer game is one in which players connect directly to each other but neither is the host and there is no dedicated server. Game state is maintained separately on each player's computer and kept in sync by the netcode. Since there is no single source of truth for the game-state, so players are free to cheat by modifying the game's code to lie on their behalf. There is also the side issue of bugs in the game code causing the game-states to become irreparably desynchronized.

All of these issues are solved by having a central server for both players to connect to. Whether that server is owned by the game's publisher or by an open-source community is irrelevant from a technology standpoint. However, the prevalence of IPv4 networks and stateful NAT firewalls is relevant because it privileges those central servers over true peer-to-peer connections.

I don't disagree with you, I just read your comment as deriding people who think hosting their own game servers is meaningful, because it's similar to a company server. Sounds like you didn't mean it that way.

Most people can't run their own server, because they aren't on a public IP!

Cool. You decided you don't care about that, but what if I do?

Don't put words into my mouth! I never said I didn't care about peer to peer networking and peer to peer gaming. I said it sucks if your only option to avoid cheating is to play with friends.

If you only care about gaming with friends, then peer to peer is an excellent way to do that (assuming the game doesn't have any synchronization issues, which some peer to peer games do).

So we acknowledge v4 and CG-NAT are a problem but don't want to use the already available solution because game developers took it upon themselves to DEFEAT NAT :)

That just reminded me of a peer protocol I worked on a long time ago that used other hosts to try to figure out which hosts were getting translated. Kind of like a reverse TOR. If that was detected, the better peering hosts would send them each other's local and public addresses so they could start sending UDP packets to each other, because the NAT devices wouldn't expect the TCP handshake first and so while the first few rounds didn't make it through, it caused the NAT device(s) to create the table entries for itself.

Was it Hamachi that was the old IPX-over-IP tunneling? I'm fairly sure it used similar tricks. IPX-over-IP is also done on DOSBOX, which incidentally made it possible to play Master of Orion 2 with friends in other continents.

I can spin up a NAT puncher today without having to depend on anybody. Can't say the same for IPv6.

> That just reminded me of a peer protocol I worked on a long time ago that used other hosts to try to figure out which hosts were getting translated. Kind of like a reverse TOR. If that was detected, the better peering hosts would send them each other's local and public addresses so they could start sending UDP packets to each other,

Sounds similar to STUN, really.

If that's the VOIP thing, yes, lots of people came to similar methods. That particular thing was for exchanging state, not VOIP or tunneling, so as long as participant groups overlapped it didn't really need a fixed server to be the middle which was handy for our purposes, although long network interruptions could make reconvergence take a while.

Does make me chuckle that so many people had to be working around NAT for so long and then people are like "NAT is way better than the thing that makes us not have to deal with the problem at all." Just had a bit of NAT PTSD remembering an unrelated, but livid argument between some network teams about how a tool defeating their NAT policies was malware. They had overlapping 10.x.y.z blocks, because of course they did :)

Nat hole punching works... most of the time. There are many edge cases and weird/broken networks which you just can't work around in standard ways. You get to see all kinds of broken setups if you work at VoIP providers. That's why everyone will use a central proxy server as the last resource - you'll mostly notice it only because of a higher ping.

Isn't CGnat due to IPv6 use on the mobiles? You could quit and say that's an IPv6 problem that didn't get solved in the IPv6 engineering

Why would CGNAT be deployed as a response to IPv6 on mobile? I don't understand the logic there. CGNAT is deployed due to a shortage of publicly routable IPv4 addresses. IPv6 was introduced due to having much larger publicly routable space.

Because the internet as a whole is ipv4. The mobiles are IPv6. The ipv4 internet does not care about any server running on any mobile device.

Thus, CG Nat was invented so that IPv6 could talk to IPv4 and get the information from it.

No, CGNAT (Carrier-Grade NAT - https://en.wikipedia.org/wiki/Carrier-grade_NAT) is an IPv4 only thing. https://www.rfc-editor.org/rfc/rfc6598 specifies they should use 100.64.0.0/10 for it, to avoid conflicting with the pre-existing private-use ranges. IPv6 removes the need for using CGNAT, as each home router is allocated a public IP (rather than a CGNAT IP) on its public link.

Oh so cgnat exists for ipv4 addresses to talk to IPv6 servers? Is that what you are telling me?

Because all of the www is in IPv6, and cgnat actually excuses for ipv4 cable users to use the bedrock internet servers and services?

Bullshit. Cgnat is a hack for ipv6 to talk to the ipv4 universe.

Because if there were magically enough iov4 addresses for mobiles, would cgnat exist? No, it wouldn't.

No, CGNAT has absolutely nothing to do with IPv6. CGNAT is nothing more than ISPs not providing a public IP to the gateway on your LAN (i.e. your router). To avoid conflicts with existing ranges, a new ranges for that purpose was allocated. There are different technologies to enable IPv4<->IPv6, none of which care about the existence of CGNAT.

No, NAT64 was invented so v6-only hosts could access v4-only resources. CGNAT was invented so v4 hosts can have a v4 address without having to purchase limited public address space.

IPv6 is used on mobile networks since there aren't enough IPv4 addresses. Some of these mobile networks are so big there aren't even enough private IPv4 addresses for their CG-NAT private side to fit, leaving the only clean solution being NAT64/DNS64.

That particular benefit has no value if you still need to support v4.

It's almost a self-inflicted tragedy of the commons or reverse network-effect.

Adopting IPv6 doesn't alleviate the pain of IPv4 exhaustion if you still need to support dual-stack.

It still helps. I have a 1U in a colo which gives me a /64 for ipv6 and ~5 addresses for ipv4. I just set up a dual stack kubernetes cluster on 6 virtual machines. When I want to ssh into one of the machines, my options are either:

  1. Use IPv6 which works and goes directly to the virtual machine because each virtual machine grabs its own address from one of my 18446744073709551616 addresses.
  2. Use IPv4 and either have to do a jumphost or do port forwarding, giving each virtual machine its own port which forwards to port 22 on the virtual machine.
  3. Use a VPN.

I have all 3 working, but #1 was significantly less setup and works the best.

Also being able to generate unique ULA subnets is super nice.

Really using port 22 is very ill advised anyway because you will get constant nuisance brute force attacks (accomplishing nothing because you're using keys or certificates I hope) but still eating up cycles for the crypto handshake.

Really? I get somewhere in the region of none to barely any, depending on the server.

I mean, yes, you'll get a constant stream of them on IPv4, but why would you run a server on v4 unless you absolutely needed to? The address space is so small you can scan every IP in 5 minutes per port, and if you have my v4 address you can enumerate every single server I'm running just by scanning 65k ports.

Meanwhile, on v6, even the latter of those takes a thousand years. How would people even find the server?

By that same logic, using IPv4 is ill-advised because I could easily give the ssh endpoints their own IPv6 addresses, avoiding the need to hide behind non-standard ports. Scanning through 18446744073709551616 addresses is going to be a lot slower than scanning through 65536 ports.

You don't put your server IP in your DNS? You type the IPv6 address every time?

A lot of servers expose something public so they can be found. Otherwise what's the point of being publicly accessible?

You can't just list out all the DNS names. The three ways that names get discovered are:

1. You listen on IPv4 and someone probes all the IPv4 space and your server announces "Hi, I am web123.example.com" or similar in its responsible

2. You have HTTPS on the server and the HTTPS address ends up in the certificate transparency logs.

3. You have a public service on that server and announce the address somewhere.

But when you have billions of IP addresses, why does SSH need to listen on the same address as HTTPS or anything you're running publicly? It's also infeasible to probe the entirety of IPv6 space the way you can probe all of IPv4, even though we're only assigning addresses in 3/65535 of it right now.

I've had SSH open on a static v6 that isn't even SLAAC or temporary, it's not my/58::1 but not far off and in DNS, and I have not in 8 years seen a single scan or connection attempt over IPv6 (other than myself). This is not to say there is no risk, but it really is a night and day difference.

If you are an ISP running dual stack ipv4 with NAT plus ipv6, the more connections happen via ipv6 and the more traffic happens via ipv6, the better, because it doesn't have to go through the NAT infrastructure which is more expensive, and cost scales with traffic (each packet needs its header to be modified) and number of parallel open connections (each public v4 address gives you only 65k port numbers, plus this mapping needs to be stored in RAM and databases).

NAT accelerated hardware exists almost everywhere now. But yes NAT is a pita overall. CGNAT is even more of a problem.

Not really, this is only true for mobile devices.

7621 devices include hardware NAT. And anything Qualcomm in the recent past does. Most home WiFi 5 and above routers can do hardware NAT just fine. Hardware NAT allows for using cheap and old cpus for CPE. ISP hardware is a different story. Some decent routers that can do that which don’t cost a lot.

https://www.reddit.com/r/openwrt/comments/1lopamn/current_hi...

> Not really, this is only true for mobile devices.

Tell that to my fixed line provider, with their CGNAT ... And its just about every provider in Germany pulling that crap. O, and dynamic IPv6 pre-fix also, because can't have you run any servers!

Yes, plenty of ways to bypass it but when you have ISP's still stuck in 1990's attitude, with dynamic IPv4/IPv6, limited upload (1/3 to 1/5 of your download), etc ...

I was mostly thinking about CGNAT instead of NAT around your home network.

There is a talk by Dmitriy Melnik at RIPE 91 about the costs for ISPs to not adopt ipv6 vs to adopt ipv6 (relevant stuff starts at 9:55).

https://ripe91.ripe.net/programme/meeting-plan/sessions/37/8...

On company/university wifi networks, v6 cuts your v4 DHCP pool address usage by something like 70%, without hurting connectivity to v4 hosts.

> Adopting IPv6 doesn't alleviate the pain of IPv4 exhaustion if you still need to support dual-stack.

Sure it does: the more server-side stuff has IPv6 the fewer IPv4 addresses you need.

If you have money (or were around early in the IPv4 land grab) you have plenty of IPv4 addresses so can give each customer one to for NATing. But if you don't have money to spend (many community-based ISPs) you have to start sharing addresses (16:1 to 64:1 is common in MAP-T deployments). You also have to spend CapEx on CG-NAT hardware to handle traffic loads.

Some of the highest bandwidth loads on the Internet are for video, and Youtube/Google, Netflix, and MetaBook all support IPv6: that's a lot of load that can skip the CG-NAT if the client is given a IPv6 address.

If you can go from 1:1 to 16:1 (or higher) because so few things use IPv4 that means every ISPs can reduce their legacy addressing needs.

You can run a V6 first network with a tiny bit of v4 sprinkled in on the edge where it's needed. The tech to do this is mature and well understood.

There’s zero benefit to you because the carrier is NATing you for other purposes.

They get better network management.

That is a collective problem, though, not an individual one. I have always been able to get enough v4 addresses for all my needs.

Yep, iot would be a tremendously worse security problem if everyone wasn't actually operating a household subnet without knowing it.

When your washing machine, fridge, etc all come with ipv6 5g modems is when your house becomes part of the future IT battlescape between lots of different entities that do not wish you well.

No, because sensibly configured routers would still block incoming traffic regardless of NAT.

If your dishwasher has a 5G antenna + modem built-in and connects to the manufacturer’s own wireless account then your router doesn’t enter the picture. The dishwasher can happily serve you ads and conduct routine surveillance all day long and the only thing you can do is cut power to the device (until they start including a battery backup for that stuff).

True, but the dishwasher should have its own firewall regardless, and assuming it'll be on IPv4 behind a firewalled NAT is by itself an implementation error.

My point is that you don't control what network the dishwasher is on, the manufacturer does. The dishwasher connects to its own cellular network so that you cannot block any of its ads or prevent it from spying on you.

I’m assuming you don’t know how iPv6 works. With SLAAC every device usually rotates the v6 address every few hours and maintains multiple of these. Each subnet for each customer is huge. With rotating MAC it’s virtually impossible to maintain a connection with an IPv6 only device by just IP address. It’s one of the features of IPv6 that such attacks are not going to be feasible.

I am truely a beginner. I am also annoyed by rotating identifiers for devices on the network since it increases the overhead to differentiate for the purpose of firewall rules. Maybe v6 has an identifier better than MAC that can be handled expeditiously for DNS and IP controls?

Why? My router won’t even let me DMZ a single ipv6 device or open all ports to a single ipv6 device. It will only let me open one port at a time.

different routers have different options, but all of them have come with a pretty strong firewall out of the box, turned on by default, for the last 10 years.

Enough addresses for what? Nobody needs or even wants all of their devices to have globally routable addresses.

Enough addresses for proper P2P connectivity, which is kinda useful for newfangled things like video chat?

We’re supposedly mere years away from superintelligence, but it’s still literally impossible to just send a file between two clients without configuring intermediate network hardware or performing some hack to get around NAT (which can still fail and then require an intermediate server) if both clients are behind CGNAT.

It’s genuinely disheartening to see so many people here not even begin to try to understand how much we’re missing by not having effortless end-to-end connectivity, in favor of expensive cloud services. This literally used to be what the “Internet” is - we’re definitionally not on one without this.

> Enough addresses for what? Nobody needs or even wants all of their devices to have globally routable addresses.

They do if they have applications, such as Xbox/PS gaming applications, broken VoIP in gaming lobbies, failure of SIP client to punch through etc. And if an ISP does not have, or cannot afford, to get enough IPv4 to hand each of their customers at least one to assign to the CPE's WAN port, you're now talking about CG-NAT, which a whole other level of breakage.

Everyone who says this is obviously a web developer.

An example for a small environment: I've got the whole homelab on unique ipv6 range. Whatever VPN connection happens to another network, I'll never have range collisions or need any fancy rewriting. Also the DNS will point at a specific address on my network, never at a random 192.168.x.x in a network I happen to be connected to.

> never at a random 192.168.x.x in a network I happen to be connected to.

That’s a pretty good benefit, I hadn’t considered that!

Eh, I've been thus far unimpressed.

Part of it being that a lot of ISP's don't have static prefixes, they do get rotated pretty often and have no guarantee of CIDR size that you're going to get. By default my ISP will only give a single /64. You have to go out of your way to request more subnets and there's no guarantee that the ISP will honor that request.

It's really problematic to try and base a non trivial network setup, when you have no guarantee of how many subnets you can run. Today I've got 256. Tomorrow it might be 16. Or 2. Maybe just 1 again. ISP's can be weird when they smell monetization dollars in the water.

So I have to run a ULA in parallel to the publicly accessible networks specifically for internal routing, and then use a DNS server to try and correct it. Which works great! ...except when you run into this little niche operating system called Android. Which by default doesn't obey a network provided DNS server if you've got privacy DNS enabled. So if I've got guests over and I want them on a network in my place to access some sort of internal resource, then I've got to walk them through disabling privacy DNS.

Either that or I need to go out and buy a domain... for my internal network...and then get a TLS certification for my private internal domain.

I get how IPv6 can be great. But a lot of the advantages are also overhead I don't want to deal with.

Short hand is a good example; I've lost count at the number of times I've typo'd short hand addresses because my eyes skip over a colon. At this point I've gotten into the habit of just writing out the whole address, leading 0's included because the time saved from not making a mistake reading the address often faster overall then making mistakes with shorthand.

> So I have to run a ULA in parallel to the publicly accessible networks specifically for internal routing, and then use a DNS server to try and correct it. Which works great! ...except when you run into this little niche operating system called Android. Which by default doesn't obey a network provided DNS server if you've got privacy DNS enabled. So if I've got guests over and I want them on a network in my place to access some sort of internal resource, then I've got to walk them through disabling privacy DNS.

This also sounds like it would be a problem for v4? I'm not clear on how this is a v6 problem. If I'm picturing it correctly, it's a difference of handing the guests a local v4 address vs disabling privacy DNS and handing them a DNS name. I'd think the latter would be easier

Using a public domain for TLS certs for private networking is pretty standard in /r/selfhosted and /r/homelab at least.

Fair point on ISPs handing out /64 prefixes, but this is the first I've heard of them varying the prefix length once you know what you've got. I don't doubt it though

> Either that or I need to go out and buy a domain... for my internal network...and then get a TLS certification for my private internal domain.

TBF, if you are on HN that should be extremely simple for you. I use a subdomain of my primary email domain I own, and use LetsEncrypt to issue TLS certs on my internal network. Well beyond the means of my mom and sister, but probably pretty easy for most people here.

You’re not wrong, but I have been running complicated multi-site VPNs with a small homelab multi-subnet / VLAN setup for 25 years and still have yet to have a collision.

My home network is dual-stack these days, but because my IPv6 prefix is dynamically delegated by my ISP, I actually use site-private IPv6 addresses for all my internal servers and infrastructure.

The thing is though, I don’t even need IPv6. Comcast Business broke my delegation for six+ months and I literally didn’t even notice.

IPv6 tried to do way too much. The second system syndrome was strong. It’s no wonder folks are annoyed at the complexity, and as long as IPv4 continues to works for them, they aren’t particularly pressed to adopt it.

Even supposedly prosumer gear sucks at ipv6. The ubiquiti situation was awful about a year ago. I got a dynamic prefix and wanted to setup ULA. Maybe I was dumb, but I couldn't find any way to do it.

Heck, I couldnt even see which prefix I was handled, nor could I see any ipv6 address anywhere in the gui. This was with a self hosted up to date controller though. YMMV.

Ubiquiti software was uniquely awful at IPv6 for a very, very long time. It's one of the reasons I abandoned it for OpenWRT and Mikrotik.

> You’re not wrong, but I have been running complicated multi-site VPNs with a small homelab multi-subnet / VLAN setup for 25 years and still have yet to have a collision.

And I've been in corporate IT networks with mergers/acquisitions where both organizations involved had 10.0.0.0/24. Ever have NAT inside a company? Fun stuff. (Thrown in some internal-only split-horizon DNS too.)

Then there's the fact that in the COVID period we had IPs for VPN clients (172.*) in the same range as what some developers used for their Docker stuff. Hilarity.

Only one has to change, the smaller one presumably. Do it on the weekend, done. Planned ahead, easier than crowdstrike.

That's a pretty bold claim. IMO IPv6 is not hard at all, and delivers significant benefit when dealing with anything outside your local network.

This is so right.

No One believes us on hacker News. It feels very gaslighty. I have never talked to an IT engineer in person that thought IP version 6 in the data center or in the corporate network was a good idea.

I recently passed the CCNA again and they really spend a lot more time on IPv6 compared to 15 years ago. It inspired me to go all in this time and configured my home network with a PD allocation from my ISP. I also came up with some fun labs and even got a IPv6 sage T-shirt from Hurricane Electric.

Did you have to do anything special to get the t shirt? I got the sage cert ages ago and they never sent my shirt...

No, but it did arrive several months later. Maybe they wait and send it in batches?

It arrived. Maybe the send them out yearly.

Any recommended courses? I'm a SWE and never felt compelled for the CCNA but my intersection with networking-related problems seems to continuously increase and I would like to up my game before getting in over my head at work.

I just bought the official exam guide found Neil Anderson’s videos helpful. One thing that bugged me a bit was they spent a little too much time on their WiFi, including the obsolete Airie OS.

This doesn’t hold up. Schools can’t teach everything, especially in a field where innovation happens in the workplace, not the classroom. Should I have learned about LLMs when I was an undergraduate 20 years ago?

This is just further proof that university educations are still not job training. The sooner we disabuse ourselves of that perception the better off society will be.

Higher education is about creating a breadth of knowledge, not specific marketable skills. CompSci is a research field, not job training.

If your friend wanted to learn specific job skills a technical college would be the appropriate setting.

I realize this misperception is perpetuated by the job market but I’m still not surprised at the education provided by UCI and don’t fault them for providing it.

They taught us, they also taught ipv4 in the old "separate address per host" way instead of jumping to NAT, but I think ipv6 is inherently more complicated than ipv4 for the average use case. It's not just a thinking shift.

Separate from that, deliberate decisions were made to make it a "clean slate" without consideration for existing ipv4 hosts. Guess they were hoping the separate stacks would go away eventually, but in hindsight, no way.

ipv6 would have been a breaking change anyway, just take the opportunity to push through any changes that they want to make

> ... but I think ipv6 is inherently more complicated than ipv4 for the average use case. It's not just a thinking shift.

IPv6 isn't all that complicated for most common use cases. Its fundamental concepts and rules are simple. It also obviates the necessity of the complicated workaround called NAT, without which IPv4 is impractical these days.

It's more like the imperial vs metric system debate. If the world hadn't seen IPv4, I believe that we'd all be using IPv6 without any complaints. The real problem is that IPv6 isn't taught well.

> Separate from that, deliberate decisions were made to make it a "clean slate" without consideration for existing ipv4 hosts. Guess they were hoping the separate stacks would go away eventually, but in hindsight, no way.

I'm not sure what to make of this. The presence of the IPv4 stack isn't what blocks the adoption of IPv6 - at least not technically. They can coexist on the same host and function concurrently without interfering with each other. It was designed to operate like that. The actual blocker is the attitude that people hold towards IPv6 - "We have IPv4 that works already. Why should we care about an alternative?". You can see that expressed on this discussion thread itself.

There is one crucial detail that the IPv6 detractors neglect - the scarcity of IPv4 addresses means that IPv4 address blocks are now heavily coveted and therefore subject to moneyed interests. That isn't very good for the health of the open internet, digital rights and equity. They're thinking about individual trees and losing sight of the whole damn forest. IPv6 isn't a solution looking for a problem. It's the solution for a problem that people simply ignore.

The IPv6 spec was being modified up through 2017. It has more kinds of addresses that behave in fancier ways, with one host having multiple. The very first thing you see with ipv6 is your nice memorable ipv4 addr replaced with a long hex string with some ::s thrown in. Local DNS is commonly recommended with ipv6 for that reason, which maybe is just some misguided advice because it sounds crazy. I guess you could assign and memorize ULAs?

NAT is technically complicated if you're looking inside it, but most people aren't, and for them it's really easier to think about. You've got a public and a private, and there's a very strong default that private isn't exposed. People screw up firewall rules all the time or routers have bad defaults, but it takes more deliberate action to publicly expose a port over NAT. Plus you don't need privacy addresses that way (introduced to ipv6 in 2007). I know "NAT isn't security" but for most people, it is.

Still not even sure what the accepted default firewall behavior is in ipv6, cause some people say "ipv6 lets any device do p2p by its own choice" and then when you ask about security, "your router firewall should always default-deny anyway," so which one is it?

> The presence of the IPv4 stack isn't what blocks the adoption of IPv6

It is. Like they say, most technical problems are really people problems, especially this one.

> Local DNS is commonly recommended with ipv6 for that reason, which maybe is just some misguided advice because it sounds crazy.

Many (most?) SOHO routers already run a combined DHCP and DNS server called 'dnsmasq', which supports DHCPv6. IIRC, dnsmasq automatically adds DNS records for hosts to which it gives out a lease. Android computers don't use DHCPv6, so this won't help you access them by name, but how often do you care to directly access an Android computer?

I wasn't under the impression that SOHO routers normally have DHCPv6 enabled by default. At least checked mine now and it doesn't.

> I wasn't under the impression that SOHO routers normally have DHCPv6 enabled by default.

The fellow I replied to indicated that running a local DNS server on one's LAN "sounds crazy".

My commentary was intended to indicate that it's very common in SOHO networks to already be running a DNS server that automatically adds hostname->address mappings of DHCP clients on that network. It also mentioned that DHCPv6 support is supported by the combined DHCP+DNS daemon used by many (most?) SOHO routers.

My commentary was not intended to indicate that DHCPv6 support is on by default on many or most SOHO routers, only that it's likely to be supported, and that -if supported- it is very, very likely to put hostname->AAAA mappings of DHCPv6 clients into its DNS server, just as it adds hostname->A mappings for DHCPv4 clients.

Ah, I understand. Well having dnsmasq fully automatically run DNS isn't crazy at all if you're using DHCPv6. If you're not, it sounds unreasonable for you to need to spin up your own DNS server.

> If you're not, it sounds unreasonable for you to need to spin up your own DNS server.

If you're using a SOHO router, you're very likely to already be using dnsmasq; a DNS server. In that configuration, if you're using DHCP then you get your hostnames in DNS for free.

If you're not using DHCP and don't have a DNS server running on your network that you have figured out how to update with host IP addresses, then it's on you to select memorable static addresses. [0] This is a long-standing baseline fact of IP addressing for LANs and other private networks.

[0] Nothing prevents you from assigning addresses to your LAN machines in the fd00::/64 prefix starting from 1 (that is, fd00::1) and going up. The fd00::/8 space is for uncoordinated network-local addressing.

Helsinki CS masters had ipv6 20 years ago, but nobody listened at the lectures because all of our home LANs ran ipv4

You have it backwards, education always lags industry adoption. (*Assuming it's a software engineering-focused curriculum.)

Programs will teach Docker only years after it is adopted.

Same with AWS, JavaScript, etc.

If it’s not adopted by industry, it won’t be taught about in schools.

I got taught IPv6 in 1995. At that time they said it was super important because it would replace IPv4 within a year lolololol

I can’t think of any technology where mass adoption was driven by knowledge forcibly inserted into students’ brains by schools… if anything, adoption comes when people realize their out-of-touch curriculum is no longer relevant.

To be clear, degree programs have value, but it’s not in future-proofing students against needing to learn things after they leave school. Ideally it should prepare them and encourage them to do so.

>> I know someone who graduated from UCI with a CompSci degree with a specialization in networking, just before the COVID19 pandemic began. He recalled that the networking courses he took did not cover IPv6 at all...

I am not doubting you, but I feel this story is too hard to believe without adding further nuances...

MIT 6.829 teaches IPv6 since 2002: https://ocw.mit.edu/courses/6-829-computer-networks-fall-200...

In Portugal and other countries, there are subjects on Computer Science before College or University, and they teach it on High School...

The issue is that it’s not taught with IPv6 first. Networking courses do all kinds of stuff using IPv4 to demonstrate various protocols on top (e.g. http, tcp, icmp, etc).

Then there is usually a chapter on IPv6 that just briefly covers the differences.

I.e. the exercises all tend to use IPv4 as the foundation so people don’t practice v6

Well it makes sense, no one uses ipv6 anyhow. Most I know are waiting for ipv8.

But TCP or HTTP don’t care about the underlying transport. They’re higher level protocols that are payloads to either IPv4 or IPv6. It’s irrelevant what the transport is when dissecting HTTP and very little time should be spent on it.

IPv4 is, for all intents and purposes, still the default transport. It’s also simpler than IPv6 in some regards. When teaching layer 3, it makes sense to teach both, and teach IPv4 first. Though I fully agree that they should be taught with equal emphasis. I don’t doubt there’s a good number of programs out there that don’t into sufficient detail on IPv6.

No, this is wrong and it’s why academia is failing.

IP addresses show up everywhere when you are working with both TCP and HTTP. Sockaddr is all over sockets programming, IPs show up in HTTP headers, etc.

They absolutely care about the underlying protocol because the underlying protocol is how you address the other end.

I've been of the opinion this is one of those "the art advances one funeral at a time." A lot of people are married to IPv4 and its arcane warts and really, really do not want to deal with IPv6 even though most of the core concepts are almost exactly the same thing, except better. I can't imagine anyone who dealt with V4 multicast ever wanting to go back, and I bet they've memory-holed parts of V4 that simply can't be used anymore and so have been turned off for decades(RIP to RIP). Has anyone seen the automated address assignment in V4 ever work? The usual hint it even exists is that if you see one of those addresses it means something is messed up in your Windows host or the DHCP server died.

People complain about dual stacks and all that but with a modicum of planning it is minimal extra effort. Anything made in the last decade has V4/V6 support and unless you're messing with low level network code, it's often difficult to even know which way you're being routed. Network devices pretty much all support using groups of names or addresses and not hard coded dotted-quad config statements now, and have for a while. And that was good practice on V4 networks too.

Part of it is probably that remembering various V4 magic is easy enough to do but feels complicated enough to be an accomplishment. In V6, there is no point in doing most of that because the protocol has so much more automation of addressing schemes. But if you like those addressing schemes, V6 can do them even better. You can do all sorts of crazy address translation on either the network or host id portion, like giving an internal network a ULA that is magically translated to a public network prefix without any stateful tracking unless that is desirable.

I feel there is some analog to DNS in that regard, people who have gotten used to DNS don't give a damn about host IP addresses but some people seem to really like the idea of a fixed address statement. People also seem to be stuck on the idea that NAT creates some kind of security when that's really the stateful tracking that is required for many-to-few translations (thus making firewalls a common place to implement it), not the translation itself. Similar to certificates/pki versus shared keys, yes, one is more upfront effort but that's because it's solving the problem of the Sisyphean task that is the other.

edit: This all reminded me that we lived with dual stacks before, in the IP and IPX days, or DECnet, and that GE Ether-whatever, and those had less in common. IPX mostly died with Netware but it had a number of advantages that wouldn't be bolted on top of IP for years, some of which are present in IPv6. I rather liked IPX and had history gone differently that it used 48-bit addressing would be causing us to discuss whether or not EUID was a mistake or not :)

IPv4 link local addressing is awesome for direct PC to PC connectivity with no hassle

So like plugging two laptops together? Honestly curious, I can't recall ever seeing anyone using it and the situations that it seems like it should be good for, like initial configuration of stuff coming out of the box, instead come with instructions for setting specific IPv4 addressing or use DHCP. Possibly a lack of some LLNMR equivalent at the time.

link-local is mandatory for ipv6 to work. Technically everybody you have ever seen is using it. It is unlikely that you know somebody without a cellphone. And as far as I know, all cellphone networks are ipv6 first.

https://en.wikipedia.org/wiki/Link-local_address#IPv6

Did you reply to the wrong comment? I know link-local works in IPV6, we were discussing IPv4.

Well you will be happy to hear that ipv6 has the same thing with the FFfe::/10 network just like 169.254.0.0/16 apipa range

I get this strong feeling that most of the opposition against IPv6 stems from misconceptions.

Ipv6 was a protocol engineered in isolation from the social / political environment it had to be adopted in.

A successor to ipv4 wasnt a technical issue. duh, use longer addresses. The problem was social.

It's a miracle it was used at all

What's annoying about ipv6 discussions is that the ipv6 people are incredibly condescending when the problems of its adoption were engineered by them.

The problem of IPv6 adoption in the US was largely engineered by major ISPs not caring while hardware manufacturers take their cues from major ISPs.

Exactly. IPv6 was developed in the ivory towers where it was still assumed that everyone wanted to be a full participant of the internet.

But the social/political environment was that everyone just wants to be a passive consumer, paying monthly fees to centralized hosts to spoon-feed them content through an algorithm. For that, everyone being stuck behind IPv4 CG-NAT and not being able to host anything without being gatekept by the cloud providers is actually a feature and not a bug.

Well, with such a description of the 'vices' of IPv6 vs the 'virtues' of IPv4 count me as one who considers himself in full support of the ivory towered greybeards who decided the 'net was meant to be more than a C&C network for sheeple. Once I got a /56 delegated by my IAP - which coincided with me digging down the last 60 metres of fibre conduit after which our farm finally got a real network connection instead of the wires-on-poles best-effort ADSL connection we had before that - I implemented IPv6 in nearly all - but not all - services. Not all of them, no, because IPv6 can make life harder than it needs to be. Internally some services still run IPv4 only and will probably remain doing so but everything which is meant to be reachable from outside can be reached through both IPv4 as well as IPv6. I recently started adding SIP services which might be the first instance of something which I'll end up going IPv6-only due to the problems caused by NATting the SIP control channels as well as the RTP media channels, something reminiscent of how FTP could make life difficult for those on the other side of firewalls and NAT routers. With IPv6 I do not need NAT so as long as the SIP clients support it I should be OK. Now that last bit, client support... yes, that might be a problem sometimes.

Don't you think everyone should have the option to be a full participant? Being locked behind cloud providers and multiple layers of NAT with IPv4 means that can never happen, even if consumers want it to.

I was lucky enough to experience the 90's internet where static IP addresses were common. I had a /24 (legacy "class C" block) routed to my home, and still do.

We've seen only the world where everything has been adopted to IPv4. p2p technologies strive even under it, but they could really shine with the ability to connect directly between devices. Imagine BitTorrent on steroids, where you don't have peers with assigned IPv4 and seedboxes and everybody else. Torrents are generally faster than usual channels to download things, but with ipv6 it would be far faster than now.

Cloudless cameras streaming to your phone without Chinese vendor clouds, e2e encrypted emails running on your phone without snooping by marketing people and three-leter agencies, content distribution network without vendor lock-ins. The possibilities are impressive if we have a way to do it without TURN servers that cost money and create a technical and legal bottlenecks.

We can't say nobody wants that world because we've never tried it in the first place. I definitely would like to see that.

> Exactly. IPv6 was developed in the ivory towers where it was still assumed that everyone wanted to be a full participant of the internet.

IPv6 was developed in the open on mailing lists that anyone could subscribe to:

    The criteria presented here were culled from several sources,
    including "IP Version 7" [1], "IESG Deliberations on Routing and
    Addressing" [2], "Towards the Future Internet Architecture" [3], the
    IPng Requirements BOF held at the Washington D.C. IETF Meeting in
    December of 1992, the IPng Working Group meeting at the Seattle IETF
    meeting in March 1994, the discussions held on the Big-Internet
    mailing list (big-internet-at-munnari.oz.au, send requests to join to
    big-internet-request-at-munnari.oz.au), discussions with the IPng Area
    Directors and Directorate, and the mailing lists devoted to the
    individual IPng efforts.

* https://datatracker.ietf.org/doc/html/rfc1726

Just like all current IETF discussions are in the open and free for all to participate. If you don't like the direction things are going in participate: as Gandhi did (not) say, “Be the change you want to see in the world.”

One of the co-authors on that RFC worked at BBN: you know, the folks that actually built the first the routers (IMPs) that created the ARPA/Internet in the first place. I would hazard to guess they have know something about network operations.

* https://www.goodreads.com/book/show/281818.Where_Wizards_Sta...

> But the social/political environment was that everyone just wants to be a passive consumer, paying monthly fees to centralized hosts to spoon-feed them content through an algorithm.

Disagree, especially with the hoops that users and developers have to jump through to deal with (CG-)NAT:

> [Residential customers] don't care about engineering, but they sure do create support tickets about broken P2P applications, such as Xbox/PS gaming applications, broken VoIP in gaming lobbies, failure of SIP client to punch through etc. All these problems don't exist on native routed (and static) IPv6.

* https://blog.ipspace.net/2025/03/response-end-to-end-connect...

80% of my career knowledge as a devops engineer, systems administrator, and IT engineer has been on the job training. That's just how it works.

The real reason is IT people hate ipv6. They want NAT. They don't want all the security holes and extra complexity. I don't want having to work with a network stack that is poorly supported by some switches and routers.

> Everything he learned about IPv6, he had to learn on his own or on the job.

Replace "IPv6" in that sentence with any practical knowledge or skill and it's probably true for my entire master's degree....

Weird, I graduated from RIT in 2009 with a B.S. in Applied Networking and Systems Administration and we covered IPV6 quite a bit

I certainly can validate this anecdote, I also had to learn almost everything about IPv6 myself.

IPv6 was superceded by NAT a long time ago. It will die a slw and quiet death which is why it is now being ignored by training facilities and experts worldwide.

It was?

Isn’t it what all the cell phones networks use these days? And most ISP’s?

They may hand the end user device a IPv4 address but don’t they actually use IPv6?

Yes as I said in a sibling post the telcos are the only ones using it, and that is the only reason that graphs like the google client one exist. That is only because it already exists and is cheaper than using NAT when you have hundreds of millions of clients.

IPv6 only ISPs will never leave the mobile space.

“The largest ISPs are the only ones using it” is another way of describing it as ubiquitous.

I disagree. If they were the largest ISPs then adoption would already be over 50% instead of stalling below it.

I would say its more "Wireless only ISPs are the only ones using it"

> I would say its more "Wireless only ISPs are the only ones using it"

So… the largest ISPs.

Recent number show about 94% of Americans have cell phones and 92% of American households have Internet connections. In raw numbers, that’s about 300M cell phones and 111M households.

If zero fixed ISPs support IPv6, that’d still be about 75% of total Internet connections that do.

> So… the largest ISPs.

Yep, a few gatekeepers of a single device space.

Your numbers are wrong, seee the google graph everybody is pointing to:

https://www.google.com/intl/en/ipv6/statistics.html

Name a large isp not using V6

They are all using IPv6.

Name one which has stopped using IPv4.

Goalposts -> thataway.

Maybe in the US. I've seen IPv6-only connections via DS-Lite in more than one other country on wired home ISPs.

https://www.google.com/intl/en/ipv6/statistics.html

People love this graph and regularly tout it as if it explains full internet usage. Especially when they dont bother to add any explanation or comment alongside it.

This graph is mainly due to the fact that telcos use IPv6 for mobile devices, nothing more. Over time you will see that graph flatline and peter out as mobile device uage reaches critical mass.

Every major ISP in the US, India, and most of the rest of Asia that I’ve seen is handing out and using IPv6 now too.

Hell, chances are if you got a new router (like any new client) for your ISP, you’d be on v6 too.

Yep, and even with all those countries with their billions of mobile devices IPv6 use still hasnt even reached 50%.

Pretty much all ISPs hand out both IPv6 and IPv4 addresses to their clients, this is nothing new. When they start only issueing IPv6 IPs is when it would start truly taking off, but it will never get to that point and it will never happen.

Looks like it’s right at 50% and rapidly increasing.

[https://www.google.com/intl/en/ipv6/statistics.html]

What exactly are you going on about? 5-10 years for the old devices to be EOL’d, and we’ll likely be at 95%.

Devices maybe, software won't :-\ (We're going to see ever-diminishing pockets of IPv4 around for a loooong time, much like we still see pockets of Cobol.)

pick a lane?

The trend on that graph is slowing, and when we reach criticl mass on the number of mobile devices the graph will be flat.

There is no chance we will be at 95% usage in 5 years or so.

If you like, we can make a wager?

According to APNIC labs, IPv6 adoption in India is ~79% and in China it is ~53%.

Those are the only two countries that could plausibly have billions of mobile devices and they appear to have reached 50%.

India: https://stats.labs.apnic.net/ipv6/CN?c=IN&x=1&v=1&p=1&r=1&w=...

China: https://stats.labs.apnic.net/ipv6/CN?c=CN&x=1&v=1&p=1&r=1&w=...

Wow, billions of devices per country and they have still only reached 50%.

Damn, the jealousy (?) is palpable. You know you will have literally zero impact on adoption no matter how snarky you are, right?

Jealousy? I think you may need to expand your vocabulary a bit!

I have an opinion on something, I assume thats ok? You seem to be here trying to prove me wrong, and also commenting on my tone of reply.

Im not trying to tell you that you are wrong, only stating what I think. If you dont like my opinion, feel free to ignore it. You are not forced to comment.

It feels like you are constantly moving goal posts here. Your original statement was it will die a slow and quiet death. Are you now saying that this mobile use case will start to switch back to IPv4? It may not kill IPv4, like was initially planned, but it's not going away.

Apologies maybe slow death was the wrong phrase. I did mean that, but only in the non-mobile space. Obviously mobile device networks have made good use of IPv6 and will continue to.

However In another thread it was argued that when IPv4 addresses become very expensive, that could trigger a big shift to IPv6. I agree with this statement and so IMO it is possible that IPv6 may well become ubiquitous in the future.

When usage is increasing rapidly and is literally ~ 50% of the entire planet right now, how is ANY kind of 'death' a useful descriptor?

IPv4 is the one that descriptor belongs on, eh?

No I dont agree at all.

Usage is in no way 'rapidly increasing', in fact the google graph everyone is touting around shows that it has taken over 10 years to not even get to 50%. It also shows it is slowing down, the curve is starting to become less steep.

When Maximum possible IPv6 usage is not even at 50% after over a decade and the usage curve is slowing, how can you possibly say that IPv4 is dying and IPv6 usage is rapidly increasing?

Oh, now it’s a problem because it’s been about a decade?

So what, another decade and we should be mostly done?

What do you think is a reasonable amount of time to redo the entire world’s networking infrastructure across 200+ countries and 8 something billion people, exactly?

This is an absurd argument, you know that right?

> Oh, now it’s a problem because it’s been about a decade?

No, but taking over a decade to not even be half adopted does not count as rapid in my opinion.

> So what, another decade and we should be mostly done?

No, as I have said many many times, the graph is slowing.

> What do you think is a reasonable amount of time to redo the entire world’s networking infrastructure

We dont need to, thats the point. All networking equipment in the world already supports IPv6, so why isnt it at 100% usage and IPv4 is turned off already?

>This is an absurd argument, you know that right?

Who is the fool, the person saying what they think or the person continuing to participate in an argument they consider absurd?

You dont need to make everybody in the world agree with what you are saying, it is ok to have differing opinions. You know that right?

I am done now. I accept that you disagree with me and thats fine. Can you afford the same decency or will you continue to tell me I'm wrong?

Hahahahaha

In US even desktops have 45% adoption rate: https://radar.cloudflare.com/explorer?dataSet=http&groupBy=i...

afaik every single major US fixed line ISP is rolling out ipv6.

Yep, every ISP and every device supports IPv6 and has done for ages.

Show me one where they have disabled IPv4 and only use IPv6 that is not a mobile device or Telco ISP.

It seems more the other end of the stick: the IPv4 side of the graph is mainly held up due to corporations. The consumer internet continues to switch, but corporate VPNs are going to continue to drag down the numbers until corporations get charged enough for IPv4 address space that bottom lines start to notice.

Yes good point, I agree that IPv4 addresses are going to become a commodity in the future and their value will start to increase dramatically to the point where it is only corporations which can afford to use them. IPv6 use may well start to spike again if that happens.

It was simply to point out that you are objectively incorrect. No commentary was necessary. My phone and home broadband both use IPv6 primarily.

If you were correct, that graph would have been over 50% ages ago.

As it is, that graph is showing how adoption is slowing and has been for the last 10 years.

Hardly anybodies physical internet connection is using IPv6 primarily worldwide, those numbers are all mobile device space.

> Over time you will see that graph flatline and peter out as mobile device uage reaches critical mass.

...what? The majority of people access the Internet from their phone, and not only since yesterday either. Are you arguing that this is temporary fad somehow?

I don't think they are arguing for a decrease. I took flatline and peter out to mean stabilize.

That is correct, thankyou for assuming the positive instead of the negative.

I personally believe that at about 60% utilisation the line on the graph will become flat and stay that way.

I am arguing that at some point there wont be any more people without phones, meaning it has reached critical mass and so IPv6 adoption will stall. The number of smartphones in the world will not keep on going up forever.

That would only happen if all of v6's growth is coming from mobile users, no mobile networks are growing/deployed without v6, and also no users are dropping their wired connections.

You can look at the AS breakdowns on APNIC's stats and see that ASs that serve non-mobile customers are getting v6, and that some ASs for mobile users aren't. So no, it won't stall.

Slow down perhaps, but it has to slow down at some point or it'll go above 100%.

What is the source of the seasonality in that graph? Spikes up a little each summer.

Maybe iPhone release time?!

If that is the case then why does it drop in absolute terms later in the year?

Digital Ocean didn’t even have an ipv6 address on by default in the droplet I created last week. It’s just a switch to flip, but I’ll bet the support costs of hobbyists/enthusiasts not realizing they needed to also write firewall rules, make sure ports weren’t open for databases and things like that for ipv6.

My memory of IPv6 is getting waves of support tickets from people who took their (already questionable) practice of blocking ICMP on IPv4, blocked ICMPv6, and then got confused when IPv6 stopped working.

The legacy of the Ping of Death and redirect abuse still looms over people that may not have been born yet :)

It's a "just doesn't work" experience every time that I try it and I don't experience any value from it, it's not like there isn't anything I can connect to on IPv6 that I can't connect to on IPv4.

My ISP has finally mastered providing me with reliable albeit slow DSL. Fiber would change my life, there just isn't any point in asking for IPv6.

Also note those bloated packets are death for many modern applications like VoIP.

Exactly. Spectrum delivers good IPv6 service in my area. I tried it when I upgraded my gateway. All of my devices are assigned 4 IPv6 IPs, hostnames are replaced by auto assigned stuff from the ISP, and lots of random things don’t work.

I went from being pumped to learn more to realizing I’m going to invest a lot of time and I could not identify and tangible benefit.

The biggest tangible benefit is you don't need to worry about NAT port mapping any more. Every device can have a public address, and you can have multiple servers exposing services on the same port without a conflict.

(The flip side is having a network-level firewall is more important than ever.)

You also don't have to worry about running a DHCP server anymore, at least on small networks. The simplicity of SLAAC is a breath of fresh air, and removes DHCP as a single point of failure for a network.

Few people care about exposing a server in the first place, even fewer care about multiple servers on a single port.

So the benefit is that you dont need to worry about NAT for a couple of port forwarded services you may use (which might well even use UPnP for auto setup), but the tradeoff is you now need to think about full individual firewall protection for every device on your network?

I'll take full security by default and forward a couple of ports thankyou!

> All of my devices are assigned 4 IPv6 IPs

Loopback, link local and network assigned. What's that problem? Your ipv4 hosts are can reach themselves through millions of addresses already.

> hostnames are replaced by auto assigned stuff from the ISP

Hostnames replaced? IPv6 doesn't do DNS...

> lots of random things don’t work.

Lots of random things also don't work on ipv4. :)

> those bloated packets are death for many modern applications like VoIP.

Huh? The packet sizes aren’t that much different and VOIP is hardly a taxing application at this point anyway. VOIP needs barely over dial-up level bandwidth.

It's not the bandwidth it's the latency. Because of the latency you need to pack a small amount of data in VoIP packets so the extra header size of IPv6 stings more than it would for ordinary http traffic

https://www.nojitter.com/telecommunication-technology/ipv6-i...

I have a lot of trouble believing IPv6 matters here. Your link only talks about bandwidth (an extra 8kbps) and doesn’t even mention latency.

Edit: NAT also adds measurable latency. If anything I’d think avoiding NAT might actually make IPv6 lower latency than IPv4 on average.

You can maybe connect to everyone over IPv4, but chances are that that path is strictly worse (in terms of latency, P2P reachability, congestion et.c) than a v6 one would be.

For example, two IPv6 peers can often trivially reach each other even behind firewalls (using UDP hole punching). For NAT, having too restrictive a NAT gateway on either side can easily prevent reachability.

I have tailscale on all my mobile/portable devices I use away from home. It punches holes so I don't have to, even makes DNS work for my tailnet in a way I've never been able to get to work the way I want the normal way.

Yes, Tailscale is great, and it does manage to traverse pretty much every firewall or NAT in my experience as well. Quite often, it even does so using IPv6 :)

Last time I looked at Digital Ocean they had completely missed the purpose of IPv6 and would only assign a droplet a /124 and even then only as a fixed address like they were worried we are going to run out of addresses.

But really what's the point of giving half an internet worth of addresses to every machine? I never understood that part of IPv6.

I think it would have been better having shorter addresses and not waste so many on every endpoint.

Yeah, the current system is really weird, with many address assigning services refusing to create smaller pools. I really hope that's fixed one day. We already got an RFC saying effectively "going back to classful ranges was stupid" https://datatracker.ietf.org/doc/html/rfc6177 (for over a decade...)

Because 2^128 is too big to be reasonably filled even if you give a ip address to every grain of sand. 64 bits is good enough for network routing and 64 bits for the host to auto configure an ip address is a bonus feature. The reason why 64 bits is because it large enough for no collisions with picking a ephemeral random number or and it can fit your 48 bit mac address if you want a consistent number.

With a fixed size host identifier compared to a variable size ipv4 host identifier network renumbering becomes easier. If you separate out the host part of the ip address a network operator can change ip ranges by simply replacing the top 64 bits with prefix translation and other computers can still be routed to with the unique bottom 64 bits in the new ip network.

This is what you do if you start with a clean sheet and design a protocol where you don't need to put address scarcity as the first priority.

Thanks for this. It's pointless to argue, but I wonder if shifting from 32 to 64 bits, instead 128, would have seen faster uptake.

Aside, isn't embedding MAC addrs in ones IP address a bad idea?

Point of fact it's giving 4 billion Internets worth of addresses to every local subnet.

You will sometimes see admins complain that IPv6 demands that you allow ICMP (at least the TOOBIG messages) through the firewall because they're worried that people on the internet will start doing pingscans of their network. This is because they do not understand what 2^64 is.

And won't that allow pingscans?

Do the math on 2^64 possible host addresses, multiply by the length of an IPv6 ICMP ECHOREQUEST, and then divide by available bandwidth to determine how long it might take you to scan a single subnet.

Hint: the ICMPv6 packet is no shorter than 48 bytes and there are 1.8446744e+19 addresses to scan.

"Simple" VPS providers like DigitalOcean, etc. really need to get the hell onboard with network virtualization. It's 2026, I don't want to be dealing with individual hosts just being allocated a damned /64 either. Give me a /48, attach it to a virtual network, let me split it into /64's and attach VM's to it - if I want something other than SLACC addresses (or multiple per VM) then I can deal with manually assigning them.

To be fair, the "big" cloud providers can't seem to figure this shit out, either. It's mind boggling, I'm not saying I've gone through the headache of banging out all the configuration to get FRRouting and my RouterOS gear happily doing the EVPN-VXLAN dance; but I'm also not Amazon, Google, or Microsoft...

Do you think anything other than trivial internal networking is a common requirement on DO? I’m not saying it’s not, I really don’t know— I haven’t been in the production end of things for a while and when I was, everyone was basically using AWS et. al. for non-trivial applications. They make it easy enough to set up a private ipv4 subnet to connect your internal services. Does that not satisfy you use case or are you just avoiding tooling that might be obsolete sooner than ipv6?

I use IPv6 on my authoritative DNS servers and that's basically it. To your point keeping it disabled on all my hobby crap keeps everything simple for me. If someone can not reach IPv4 then something is broken on their end.

IMO ipv6 is a perfect example of why interface designers can be valuable on technical projects. One of the genius things about ipv4 is it’s a pre-chunked number you can shout across the room or keep in your head as you run down the hall to your keyboard. IPv6 addresses simply don’t have that feature. If they had kept the 4-chunk format and made it alphanumeric, or added a chunk and made it hexadecimal, or something along those lines, I think they could have reasonably alleviated the problem of running out of addresses while not making the addresses SO unfriendly to remember.

But when designers bring things like that up, you get “it’s really not that complicated,” or “I explained this to my 200 year old grandmother over tea/my 16 month old child over the course of a diaper change/my non-technical wife that I intellectually respect less than I should/etc. and they wrote a book on it the next day,” kind of crap. Human factors engineering. Ergonomics matter in technical products.

What are you even basing that on? Here are some facts:

- You have to pay money to get a static IPv4 address for cloud machines on eg AWS. Anything needing a static IPv4 will cost more and more as demand increases. NAT doesn’t exactly fix that.

- Mainstream IoT protocols have a hard dependency on IPv6 (eg Matter/Thread). Not to mention plenty of 5g deployments.

- Many modern networks quietly use IPv6 internally. I mean routing is simpler without NAT.

So it almost definitely won’t die. It’s more likely it’ll slowly and quietly continue growing behind the scenes, even if consumers are still seeing IPv4 on their home networks.

Matter/Thread use private IPv6 addresses so it's just an implementation detail. Nobody is exposing light switches to the public Internet.

IPv4 addresses have been dropping in price for a few years and are cheaper in real terms than at my point in the last 15

> IPv4 addresses have been dropping in price for a few years and are cheaper in real terms than at my point in the last 15

More IPv6 deployments may (ironically?) help reduce IPv4 prices as you can get IPv6 'for free' and have Internet connectivity (and not have to worry about exhaustion in any practical way). Doing CG-NAT could reduce the number IPv4 addresses you need to acquire.

IPv4 addresses are basically free - indeed they are a profit centre. At $20 an address that’s $2 a year at most (10% ROI) where many charge 20 times that ($5/month isn’t unheard of)

NAT fixes it in the sense that blocks become available when providers switch to CGNAT.

This is not even funny to read, given huge networks like T-Mobile USA being IPv6-only.

They are using IPv6 as a fancy transport protocol for IPv4 NAT.

No; most sites I reach from the phone seem to be reached via IPv6. E.g. hitting whatismyip.org exposes an IPv6 (though mentions an IPv4 because they're trying to discover that, too). Some sites do not support IPv6; for those indeed there's a XLAT464 service.

464XLAT is for dealing with IPv4 literal addresses in a v6 only network. Non-literals can be addressed with DNS64 & NAT64

GitHub only has IPv4 addresses, for instance :-/

By being IPv6-only they are effectively making their users to preferentially connect over native IPv6 though.

Personal anecdote, but once you have IPv6 setup properly (meaning your devices prefer IPv6 over IPv4) 70-80% of your internet traffic will be IPv6.

The NAT64 is really just there for the holdouts.

I run dual stack at home with dns64/nat64. I average 50/50 traffic v4/v6. Web browsing gets skewed v6 but large file transfers and some streaming pushed it back to 50/50 overall. My family would revolt if I went v6 only so I'm not sure I'd say its just there for holdouts. Major annoyances include any old device and my hue bridge.

That's a bit like saying AC electricity was just a fancy way of delivering what customers really wanted, DC energy.

I'm sure that DC customers used their Edison DC equipment for decades after the grid went AC only; but in the long run the newer, flexible, lower overhead system became the default for new equipment and the compatibility cludges were abandoned.

High voltage AC actually gives more overhead than the same voltage DC.

HVDC is enormously expensive even today and completely impractical for bulk transport 100 years ago. You can't look just at corona, capacitive etc. losses of HVAC, you need to factor in the entire economic equation. The total overhead of AC (cost of equipment + energy lost for the lifetime of the line) is still lower for overground transport over reasonable distances and will remain so for the foreseeable future.

I don't think they even had a way to do dc-dc voltage step-up and step-down at high power and efficiency, needed semiconductors for that to do high speed switching in buck and boost converters

Well, yes. Except that AC came to dominance much faster than IPv6, the AC/DC war lasted less than 10 years, with the AC quickly coming to domination. Because AC provides a clear performance advantage over DC.

This is not really true of IPv6. It _still_ has tons of actual operational issues, and in the best case, it does not provide any tangible improvements over IPv4+NAT for the vast majority of users.

For example, in-flight entertainment works by assigning you an IPv4 address and allowlisting it in the gateway rules. This does not work with IPv6 because of privacy addresses and SLAAC. You might think that you just need to do stateful DHCPv6, but Android doesn't support it. Heck, even simple DHCPv6 PD automatic configuration is _still_ not a standard ( https://datatracker.ietf.org/doc/rfc9762/ )!

So to this day, some of the most visited sites like amazon.com, ebay.com, tiktok.com, slack.com or even github.com do not support IPv6. I also keep providing this example, year after year: there are no public VoIP SIP providers in the US that simply _support_ IPv6. Go on, try to find one.

Yep, mobile device space ISPs again which is what keeps being argued. IPv6 only connections will never gain full traction outside of the mobile marketplace.

AWS charges for ipv4 addresses but ipv6 addresses are free. ipv4 with NAT doesn't supercede ipv6, it just extends its life.

NAT doesn't solve everything, and creates a whole new class of problems that you can just avoid by adopting IPv6 natively. And it's definitely not being ignored at larger companies.

In particular, just off the top of my head...

- T-Mobile US doesn't even assign clients an IPv4 address anymore. Their entire network is IPv6 native.

- Many cloud providers charge extra for IPv4 addresses, but give IPv6 addresses out for free.

For trivial cases NAT is easy, for complex situations it's a nightmare. I've been fighting a lonely battle against multiple-NAT VPNs as being the solution to the wrong problem for longer than I care to remember, and I'm tired boss. A few years ago we had a client site go offline because a local network guy just didn't like IPv6 and turned it off, not realizing that a huge amount of stuff was happening automatically and that's why he hadn't been needing to work on it.

Oh no, somebody should warn all the ISPs deploying IPv6-native connections with v4 reachable over some fallback technology (464XLAT, DS-Lite, NAT64 etc.) to their hundreds of millions if not billions of customers!

--Sent from my IPv6

The only ISPs issuing IPv6 only connections are mobile device operators and Telcos. THey are a small subset of ISPs in the world and IPv6 only connections will never gain any traction outside of that world.

I agree it will not die so I retract that statement, but it will never fully replace IPv4 in standard wired internet connections.

Reply on news.ycombinator.com