Verizon DSL is moving to Carrier Grade NAT | Hacker News Reader

Verizon DSL is moving to Carrier Grade NAT

www22.verizon.com

56 pointsianlevesque39 comments

I'm surprised this is happening already in the US. ARIN still has address space available[1] (not much, but more than Europe and Asia) and (unlike Asia) broadband growth is slowing in the US (since nearly everyone has broadband now)[2]. Does Verizon really expect to run out of IP addresses for new subscribers soon? Or do they need IP addresses for something else? I'd love to hear the thoughts of someone more knowledgeable about this.

[1] https://www.arin.net/resources/request/ipv4_countdown.html

[2] http://gigaom.com/2012/11/14/us-broadbands-new-reality-slowi...

I can't speak for Verizon, but in Canada I know we're looking at Carrier grade NAT since Cellular is requiring additional IP space and is still a massive growth area.

We already use NAT for cellular users, but as the network grows, public IP space is still needed for network equipment, for the NAT gateways, etc.

This isnt that big a deal. They say that you can opt out of this and that it does not apply to Fios or Business customers.

I'm sure there is a huge amount of customers who will never have any clue that anything has changed since they dont play games, run servers, need VPNs, etc.

It's probably a good thing for everyone else given that it does raise even more awareness of the problem.

There are some large-ish groups of people out there for whom this will cause issues, eg. people who play console multiplayer gamers (millions of people including Halo/COD/etc players).

As someone who games on Xbox Live, a part of me would actually like to see this become more common with other carriers to force next gen consoles to move to a dedicated server model since the current "pick a host among the gamers in the lobby and hope for the best" model results in a fairly poor experience a lot of time even without pervasive CGNATing.

Unfortunately, things seem to be moving the other way, with PC FPSs (traditionally using dedicated servers) adopting the lobby model - it's why I never moved beyond CoD 4.

And so? You can still opt out?

I can also opt out of my ISP's DNS hijacking, but I don't bother to anymore. (It keeps forgetting me when I get a new address.) It's simply become the new norm.

This is unfortunately going to be just the first of many consumer ISPs that resort to CGNAT before they have an IPv6 rollout underway.

http://www22.verizon.com/Support/Residential/Internet/HighSp...

Verizon shows some IPv6 support over FIOS. In the quick search I performed I didn't see any info about DSL. I've been hounding Suddenlink about their IPv6 support for some time. The response I received from one of the techs was that they were having issues with Cisco on the headend equipment.

This agrees with what I've read about Comcast's IPv6 deployment to cable modem customers — they're rolling it out quickly in markets served by Arris CMTSes and not at all in markets served by Cisco CMTSes, citing problems with the Cisco gear.

If IPv6 really is undeployable on the uBR line with the current IOS releases, that's one hell of a black eye for Cisco.

Verizon is doing IPv6; hopefully they'll turn on IPv6 at the same time as CGN.

I wouldn't count on it - it seems they plan on a rather limited trial on fios where they control 100% of the CPE. They only started shipping the router they've qualified for it late last year, and even so they are pushing a lot of firmware updates to it.

Not that it would be of much help to folks stuck with private space in the near term - it's not like their gaming or file sharing peers will be on routable 6. Except for some VOIP providers the big traffic sinks with 6 enabled are just bog standard http.

If this isn't just sabre rattling it's pretty stupid that heavy hitters like verizon are SOL while so many old school /8's sit around 99% unreachable. Somebody needs to cut the shit and start the auctions.

This is exactly what I was thinking about. IPv4 with NAT and full IPv6 connectivity. Btw. Does carrier grade NAT support UPnP?

UPnP doesn't leave your local network, so no. You cannot forward ports at all behind CGNAT.

Well, in case of CGNAT is run (naturally) by the ISP, and network connection from that point is bridged. So yes, I think UPnP will reach their system. If they just want to honor it. Maybe with very restricted port number ranges / portscustomer IP or so. If they have smart mapping system, they can map customers even to multiple IP's so that everyone really needing to open specified port can actually do, because I'm sure they'll NAT to range of public IPs.

You misunderstand CGN deployments - there are still different address spaces on either side of the customer router. It's just now both of them are private/non routable prefixes, or in some cases the telco side is done using six. There's no briding and UPNP will never work - once you are on CGN data paths have to be set up from the customer side.

Are there any good alternatives to this?

The correct solution is IPv6 + Dual Stack Lite, but it's probably not mature enough for deployment yet.

What advantages DSLite has vs. dual-stack with CGN IPv4? Seems to complicate things for no good reason.

Dual Stack Lite has a single layer of NAT while NAT444 or 464 have two layers.

You mean by two layers the NAT by CPE and the CGN?

Yes.

Does this mean it will become much more difficult to associate an IP address with a customer account for the purposes of file-sharing-suit trolls?

No. The ISP will just look at a different table to find you.

with CGN: Look in the NAT logs and DHCP logs. without CGN:Look in the DHCP logs.

What is a "file-sharing-suit troll"? Generally "troll" in lawsuit context means a plaintiff whose business model is to buy rights to IP that the IP owner is not using and then litigate. None of the file sharing suits I'm aware of fit that model.

Prenda Law. https://news.ycombinator.com/item?id=5204665 They were caught recently trying to use the identity of a janitor they knew as a defendant. http://www.techdirt.com/articles/20130402/12223322549/deep-d...

Or one may argue that all file-sharing law suits are indeed trolls and a gross waste of resources.

Please read http://www.copyrightreform.eu/sites/copyrightreform.eu/files... , English is not my native language and I can't make the argument half as good as it is written in this book.

No because they will just associate IP address and NAT port number. I'm sure the ISPs are keeping track of the NAT associations for this and other abuse tracking purposes.

That means there will be even more data to log to do this though. Many times the NAT will end up on a different port for different connections so you'll end up with something like 64k (assuming the CGNAT doesn't map under 1024) times as much data to log. It will make it harder and the companies doing the logging will have to have more information to narrow it all down.

There are techniques to reduce the logging overhead, such as [http://tools.ietf.org/html/draft-donley-behave-deterministic...]. Basically give each customer their own range of ports on the NAT address so you only need to log that range.

Thanks for posting this. I'd completely miss that option to opt out.

I'm really not looking forward to this in general.

Isn't there also the option of using the same ipv4 address on a few thousand customers and just assign them 10 routable ports?

That's pretty much what this is.

Goodbye cookieless IP-based metrics.

I wonder what's more expensive, putting up carrier-grade NAT (which sounds like a lot of work) or implementing IPv6 and buying IPv4 addresses for the time being.

Lee Howard from Time Warner Cable has run some numbers: http://asgard.org/documents.html

I've been waiting for a large ISP to do this, its just a matter of time. In the future its going to be IPv6 + CGN. Public IPv4 will be a rarity.

If there is an opt-out scheme, I cannot see this becoming that big a deal for the majority of customers and their service will likely continue working as it did before.

(I am not saying there aren't downsides to CGNAT for consumers, but these downsides aren't likely to be noticed by the average joe)

Personally, I'm surprised this has not happened sooner. I heard rumors of other large US carriers planning this. Maybe now gamers will lead the charge on IPv6 :-)

Reply on news.ycombinator.com