Subject: RE: Why IPv6 is a must?

From: "Peter Ford" <[email-masked]>
Date: Mon, 12 Nov 2001 14:12:58 -0800

> the locator MUST change with a change in location.

It must change: "eventually".  For short duration changes you have
Mobile IP.  For changes that have longer time horizon you have host
renumbering, which by the design of v6 is now fairly trivial.   Seems
like this base might be adequately covered, no? 

> unfortunately, variable-length addresses are not supported by IPv6.

The good news here is that IPV6 picked worst case length viz the
original CLNS addressing design when you factor out length, AFI and
country codes, so you are covered.  The biggest reasons to have variable
length addresses is: 1) so you can have short packets!, and 2) because
2**128 is not enough hosts!  We gave up on (1) and (2) is just another
opportunity for NATs and Proxies in the 22nd century.

I suspect the addressing plan for the Internet will go through it's
bumps and grinds.   Again, the good news here is that IPv6 has plenty of
addressing bits for "routing" so that people can screw up and recover,
something that IPv4 no longer has.  

>	Sean.

Cheers, peterf

---

From: [email-masked] (Sean Doran)
Date: Tue, 13 Nov 2001 00:00:26 +0100 (CET)

Peter Ford writes:

| It must change: "eventually".  For short duration changes you have
| Mobile IP.  For changes that have longer time horizon you have host
| renumbering, which by the design of v6 is now fairly trivial.   Seems
| like this base might be adequately covered, no?=20

I would love a demonstration of a painless renumbering of a large IPv6 site
over various timescales using these or other mechanisms which might
be brought forward onto the IETF standards track, and would personally
try to help get a successful demonstrator some good press attention.
Perhaps you know of some organization that could use some of that
from a Mac-wielding BSD nerd who votes in the European Union?

Small qualifier: large should be something like MIT[v4] (which has
not renumbered out of 18/8[v4], for example), rather than the largest
IPv6 sites in existence today, which I bet are somewhat smaller.

	Sean.

---

From: Bob Braden <[email-masked]>
Date: Tue, 27 Nov 2001 00:04:45 GMT

*> 
  *> My point remains, a globally meaningful address is something that
  *> should only be applied when it is useful for that endpoint to
  *> be globally addressable.
  *> 

That sounds like an appealing statement, but it hides the potential
cost of giving up generality.  Back when TCP/IP was young, the
operating systems researchers in Computer Science departments had just
found a new playpen -- distributed operating systems.  They disdained
TCP/IP, choosing to implement their OS mechanisms on "bare" Ethernets.
Their statement was that a globally meaningful protocol is something
that should be applied only when it is useful for the endpoints to be
globally reachable.  Since all their boxes were local, and for
efficiency, they insisted on running directly over the link layer.
(And BTW, there was only one link layer, Ethernet ;-))  We told them
that the day would come when they would want the general connectivity
of IP, but they were, as I said, disdainful.  It took a few years for
them the realize the error of their approach, but they did eventually.

So there is a trade-off here.  In general, I think one can say that the
Internet has benefited hugely in the past from taking the approach of
maximum flexibility whenever feasible.

Bob Braden

---

From: "John Stracke" <[email-masked]>
Date: Tue, 27 Nov 2001 09:39:40 -0500

>If a node only requires accessibility by a few specialized nodes (such
>as a water meter) then making it *visible* to more is just creating
>a security hole that has to be plugged.
>
>Yes, the hole can be plugged easily.

If there's a security hole in the meter, putting a firewall in front of it 
won't help.  Remember that the person most likely to be interested in 
hacking the meter is the customer (reduce their costs); the water 
company's engineers should consider the LAN the *most* likely point of 
attack, not the least likely.

Meanwhile, if the meter is insecure, the customer should not allow it on 
their LAN, because it might get used as a way to attack the LAN.  (This 
applies even if the meter uses only outbound connections, as through a 
NAT; if the attacker can spoof the water company's DNS, then they can feed 
the meter false instructions.)

So, firewalls (and NATs) don't meet either party's needs.  Only true 
security on the device itself will do.  You might also want a firewall to 
protect the rest of the LAN in case the device's security fails; but 
protecting the device from the outside world is irrelevant.  Once again, 
security and visibility are orthogonal.

/================================================================\
|John Stracke                   |Principal Engineer              |
[email-masked]  |Incentive Systems, Inc.         |
|http://www.incentivesystems.com|My opinions are my own.         |
|================================================================|
|Never underestimate the power of human stupidity. --I forget who|
\================================================================/

---

From: "John Stracke" <[email-masked]>
Date: Wed, 28 Nov 2001 11:39:15 -0500

>If it hides the IP address of your fridge, wouldn't that impair anyone 
from
>drinking your milk? 

No.  That NAT can still be attacked, or other machines behind the NAT can 
be attacked, and used to attack the fridge.  Or the server the fridge 
talks to may be subverted.

/=============================================================\
|John Stracke                   |Principal Engineer           |
[email-masked]  |Incentive Systems, Inc.      |
|http://www.incentivesystems.com|My opinions are my own.      |
|=============================================================|
|Beware of wizards, for you are crunchy and good with ketchup.|
\=============================================================/

---

From: "Schliesser, Benson" <[email-masked]>
Date: Wed, 28 Nov 2001 15:08:57 -0600

> it's rather odd to argue that a technology that partitions the network
> into separate realms, such that the hosts in those realms 
> can't talk to 
> each other except by coincidence, is allowing us to maintain global 
> connectivity.

I entirely agree. One goal of network engineering should be wide support of
applications. (i.e., network engineers should try to not make assumptions
about what the applications will want, but should design an 'open'
architecture that will support any application model, etc.) The network
engineer shouldn't have to re-design for every new application that comes
along. If he does, then he did a poor job to begin with. That is why
ubiquitous IP host to IP host communication is 'better than' an application
gateway or NAT approach. From the network perspective, it is a solution that
provides open connectivity. (Further, instituting policy can still be done,
but the network itself shouldn't be the limiting factor--the policy control
point (firewall, etc.) should be.)

The overhead incurred in managing NAT is acceptable as a work-around (i.e.,
a hack) until a real solution is available. In my opinion IPv6 is a real
solution.

-Benson

---

From: "John Stracke" <[email-masked]>
Date: Wed, 28 Nov 2001 16:30:46 -0500

>billions of  new routable addresses  are going to  be added to  the 
existing
>routing system. 

That's not a useful measure--what matters is the number of prefixes, not 
the number of addresses.  If everyone on the planet magically converted 
from IPv4 to IPv6, and kept the same topology, the number of prefixes 
would not increase.

...modulo multihoming...

/================================================================\
|John Stracke                   |Principal Engineer              |
[email-masked]  |Incentive Systems, Inc.         |
|http://www.incentivesystems.com|My opinions are my own.         |
|================================================================|
|He wondered if Elli was going to buy that explanation. His taste|
|for heavily-armed girlfriends did have its drawbacks.           |
\================================================================/

---

From: Julia Finnegan <[email-masked]>
Date: Thu, 29 Nov 2001 10:00:52 -0500

Cheese... this helps... I know it sounds crazy- but it works... but only
brie.

-----Original Message-----
From: Meritt James [mailto:[email-masked]]
Sent: Thursday, November 29, 2001 9:33 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: Why IPv6 is a must?

I wish to express doubt on the (as you mentioned in an aside) there
should be.  Consider what these addresses would be for and the
implications of THAT.

Eric Rosen wrote:
> 
> Sure, in  theory one could add  zillions of new  globally routable
addresses
> without increasing the  size of the routing tables  in the default-free
zone
> at all.
> 
> The skepticism is about whether there is (or even could be) a realistic
plan
> to make this happen.

-- 
James W. Meritt CISSP, CISA
Booz | Allen | Hamilton
phone: (410) 684-6566

---

From: "Da Silva, Pedro" <[email-masked]>
Date: Thu, 29 Nov 2001 15:42:12 -0000

That depends on what you mean by 'realistic'

-----Original Message-----
From: Steve Deering [mailto:[email-masked]]
Sent: Thursday, November 29, 2001 3:02 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: Why IPv6 is a must?

addresses
zone
plan
>to make this happen.

What's the realistic plan to prevent the IPv4 routing table from growing
to 2^32 route entries?

Steve

---

From: Julia Finnegan <[email-masked]>
Date: Thu, 29 Nov 2001 11:18:37 -0500

Completely fantasimal

-----Original Message-----
From: Steve Deering [mailto:[email-masked]]
Sent: Thursday, November 29, 2001 3:02 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: Why IPv6 is a must?

addresses
zone
plan

Steve

---

From: "J. Noel Chiappa" <[email-masked]>
Date: Thu, 29 Nov 2001 13:55:37 -0500

> From: Keith Moore <[email-masked]>

    > forcing most of the internet into a tree structure has its own scaling
    > problems.

A tree structure is not at all needed. What is needed is more aggregation.
Please see the definitive mathematical analysis of routing scaling via
aggregation:

  Leonard Kleinrock and Farouk Kamoun, "Hierarchical Routing for Large
    Networks: Performance Evaluation and Optimization",
    Computer Networks 1 (1977), North-Holland Publishing Co., pp. 155-174.

which explains this all clearly.

    > the only benefit that IPv4 has over IPv6 (relative to routing table
    > size) is that IPv4 discourages growth of the Internet. 

"Cazart!", as Hunter Thompson would say.

So perhaps what we really need, instead of IPv6, is something that looks less
like IPv4 (with a few fields made larger).

	Noel