Subject: RE: NATs as firewalls

From: <[email-masked]>
Date: Wed, 7 Mar 2007 17:18:27 -0000

> 	(i) there is every reason to expect a run on remaining
> 	addresses at some point, whether induced by "public
> 	coverage", "larcenous providers", ISP or RIR anxieties,
> 	or something else. 

In other words HIGH PUBLIC PROFILE. Interestingly, this roughly
coincides with increased public concern over network abuse, reevaluation
of homeland security activities, and the timeframe in which IPv6
services could reasonably be introduced. The time is ripe for the work,
even if it does ultimately fail as some suggest. Nevertheless, an IETF
WG discussion of what should be in the SOHO gateway is likely to lead to
products on the market.

> 	(ii) it is reasonable to expect that by the time such a
> 	stampede gets serious (or somewhat before that), the
> 	RIRs and possibly ICANN will try to change policies to
> 	damp it.  

This has just begun with someone making a proposal in APNIC
http://www.apnic.net/docs/policy/discussions/prop-046-v001.txt

> As I have also suggested earlier, a different way of figuring
> out when we have run out of IPv4 space is not to look at when
> the last address block is allocated but at when the perception
> or claim of scarcity begins to justify bad behavior (in pricing,
> protocol design, etc.).  By that criterion, we ran out several
> years ago and can stop having that particular part of the
> discussion.

I am of the opinion that there will be no hysteria, no market pricing,
just a move towards IPv6 because over the past few years, all Service
Providers have been upgrading to v6 capable devices, and enterprises
have also, at a somewhat slower pace, been shifting towards v6 capable
OSes. They haven't been USING IPv6, but a lot of the capital costs
necessary have already been invested.

> When it does come -- when a lot of
> people reach that conclusion -- it is reasonable to predict a
> catastrophic change in allocation requests and presumably in
> allocations.  Once that occurs, the projections based on models
> of past behavior are trash and IPv4 space will be in very bad
> trouble... probably in a matter of months and not years.

That day will never come because IPv4 addresses can never be in such
short supply. There is fat in the system, outside the RIRs' view and
control. The hoarding behavior happened years ago, before the telecom
collapse. One can always use NAT tricks (double NAT) in some areas,
"borrow" DOD and other address space such as a nice /8 that was recently
allocated exclusively for use in a Japanese cable network. The net is
diverse enough that many people won't care if DoD machines or Japanese
consumers can't reach them. This is an unmeasured and unstudied area.

I still believe that the time is right for an IETF WG to define SOHO
gateway requirements for IPv6 networks because IPv4 wind-down will cause
more people to take a serious look at how and why to deploy IPv6. One
single good idea in a SOHO gateway document could be enough to tip the
scales and make a business case for IPv6 services.

--Michael Dillon

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Nick Staff" <[email-masked]>
Date: Fri, 9 Mar 2007 07:42:40 -0800

> From: [email-masked] [mailto:[email-masked]]

You might be surprised to find how many network and IT managers think we
already ran out of IPv4 addresses years ago, and how many more never thought
about it at all.

IT at most any non-technology company is still not seen as a revenue
generating division and I doubt very little short of losing internet
connectivity will be motivator enough to start thinking about the switch to
IPv6.  To me the problem with using "running out of IPv4 addresses" as a
motivator is that what does that really mean?  Is the internet going to stop
working?  Would anyone notice if not for the media?  Why should an
established company care if their upstart competitor now has to wait 3 years
to get an internet presence?  How is it going to break what people have
that's currently working - that's what most people don't know.  And being
the selfish species that we are, that's why most people don't care.

I think the thing that would help IPv6 the most would be the setting of a
hard date when no new IPv4 addresses would be issued.  This would make it
real for everyone and ignite the IPv6/IPv4 gateway market (I think).  Not to
mention we'd never have to have another debate over when IPv4 was going to
run out which might be benefit enough in itself  ;)

nick

---

From: David Morris <[email-masked]>
Date: Fri, 9 Mar 2007 08:17:46 -0800 (PST)

> run out which might be benefit enough in itself  ;)

What a lawsuit mess that would be ... artificial limits would never work.

Add to your list of reasons why people aren't motivated ... remember the
Y2K meltdown? Not! The little boy has already cried wolf one too many
times.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 9 Mar 2007 09:20:14 -0800

Y2K had a slightly different dynamic, largely driven by the marketing practices of Y2K vampires. As soon as the fangs were buried in a fresh prey the victim was forced to send letters to all its suppliers asking if they were Y2K compliant, thus creating fresh meat for the pack to hunt, "and so the poison slowly spreads"

Nobody was willing to give skeptics time in the mainstream media in case someone followed their advice and got sued.

IPv4 is not a sudden catastrophe, there will always be availability if you are willing to pay. The problem is that if you are trying to add the the 4,294,967,297th host to the Internet you have to pay one of the previous 4,294,967,296 hosts to get off. So you have to compensate them for the marginal value of being on the Internet as the 4,294,967,296th member.

> -----Original Message-----
> From: David Morris [mailto:[email-masked]] 
> Sent: Friday, March 09, 2007 11:18 AM
> To: Nick Staff
> Cc: [email-masked]
> Subject: RE: NATs as firewalls
> 
> 
> 
> > I think the thing that would help IPv6 the most would be 
> the setting 
> > of a hard date when no new IPv4 addresses would be issued.  
> This would 
> > make it real for everyone and ignite the IPv6/IPv4 gateway 
> market (I 
> > think).  Not to mention we'd never have to have another debate over 
> > when IPv4 was going to run out which might be benefit 
> enough in itself  
> > ;)
> 
> Add to your list of reasons why people aren't motivated ... 
> remember the Y2K meltdown? Not! The little boy has already 
> cried wolf one too many times.
>

---

From: "Tony Hain" <[email-masked]>
Date: Fri, 9 Mar 2007 10:41:18 -0800

Nick Staff wrote:
> to get an internet presence?  

That is where your logic train breaks down. You assume that the established
company would maintain the status-quo and the upstart would feel the pain.
The reality is more likely to be that the service provider is sitting on the
finite resource of a single address and will lease it to the highest bidder,
and the upstart is probably losing money anyway so a little more won't
matter. If the established company is sitting on a pile of PI space, they
are insulated from the initial round of bidding, but as awareness of the
resource shortage spreads there will be pressure from the short-term focused
management to sell off that resource for immediate financial gain, only to
force the organization into the bidding process down the road.

Don't assume that the status-quo for routing and addressing policy is the
one you will be living in once the IANA & RIR pools run dry.

Tony

> How is it going to break what people have

---

From: "Tony Hain" <[email-masked]>
Date: Fri, 9 Mar 2007 10:41:18 -0800

Tony

---

From: "Nick Staff" <[email-masked]>
Date: Fri, 9 Mar 2007 20:16:06 -0800

> What a lawsuit mess that would be ... artificial limits would never

I think the US FCC Digital Broadcast Deadline is a good example - though
more drastic than I was suggesting.

I think artificial limits are inevitable unless the intention is to support
IPv4 until there's no one left in the world who wants to use it (and even
that is an artificial limit).   I also don't understand what is gained by a
sliding doomsday other than procrastination, avoidance, and a neutered
stimulus.  I mean if IPv4 addresses are going to run out wouldn't it be
better to know exactly when?  In my opinion you make it real if you give it
a date but until then it's like saying "smoking may cause cancer".  If any
smoker knew for a fact that the next drag on a cigarette would give them
cancer they'd never smoke again.  If a network manager knew that in 7 years
all new address space would be IPv6 it would become a consideration from
that point forward.  In my opinion.

Nick

---

From: David Morris <[email-masked]>
Date: Fri, 9 Mar 2007 22:17:36 -0800 (PST)

Well we don't yet know that the FCC deadline will actually stick when
society recognizes that many folks of low economic means are suddenly
w/o TV.

Secondly, the FCC's span of control is geographic ... not quite the same
as dictating an end to IPV4 addresses on a world wide basis.

In the low end bandwidth space I play, a extra 192 bits on every packet is
significant to end user performance. As others have noted, it seems like
the fairly effective anti-spam technique of associating reputations with
network addresses will be stressed by exploding the number of addresses
... stressed because the originators of spam will be able to be more agile
and because the memory and CPU required to track such reputations
explodes.

Perhaps by the time IPV4 scarcity is a critical economic issue, the
continuing trend of cheaper faster last mile internet connectivity as
well as server system capability cost reductions will converge... or
perhaps some combination of legal and techical solutions will push spam
into the noise level. Etc.

Dave Morris

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 10 Mar 2007 05:48:22 -0800

The FCC digital TV guideline is a bad example. There is no credibility in a plan that says that the govt. is going to cut off their primary means of outreach to voters. 

The networks know that and are acting accordingly.

> From: Nick Staff [mailto:[email-masked]] 
> Sent: Friday, March 09, 2007 11:16 PM
> To: [email-masked]
> > From: David Morris [mailto:[email-masked]] On Fri, 9 Mar 2007, Nick 
> > Staff wrote:
> > 
> > of a
> > > real for everyone and ignite the IPv6/IPv4 gateway market 
> (I think).
> > Not to
> I think the US FCC Digital Broadcast Deadline is a good 
> example - though more drastic than I was suggesting.
> 
> sliding doomsday other than procrastination, avoidance, and a 
> neutered stimulus.  I mean if IPv4 addresses are going to run 
> out wouldn't it be better to know exactly when?  In my 
> opinion you make it real if you give it a date but until then 
> it's like saying "smoking may cause cancer".  If any smoker 
> knew for a fact that the next drag on a cigarette would give 
> them cancer they'd never smoke again.  If a network manager 
> knew that in 7 years all new address space would be IPv6 it 
> would become a consideration from that point forward.  In my opinion.
> 
> Nick 
> 
>

---

From: Douglas Otis <[email-masked]>
Date: Sat, 10 Mar 2007 07:21:38 -0800

On Mar 9, 2007, at 10:17 PM, David Morris wrote:

> In the low end bandwidth space I play, a extra 192 bits on every  
> packet is significant to end user performance. As others have  
> noted, it seems like the fairly effective anti-spam technique of  
> associating reputations with network addresses will be stressed by  
> exploding the number of addresses ... stressed because the  
> originators of spam will be able to be more agile and because the  
> memory and CPU required to track such reputations explodes.
>
> continuing trend of cheaper faster last mile internet connectivity  
> as well as server system capability cost reductions will  
> converge... or perhaps some combination of legal and techical  
> solutions will push spam into the noise level. Etc.

Unwanted traffic will likely become much worse.  DKIM is an example  
of how it took years to define a domain-specific cryptographic  
signature for email.  Although defining a signing policy  remains, it  
is doubtful the results will prove practical at controlling  
cryptographic replay abuse in a diverse network landscape.  Where a  
responsible signer might rate-limit account holders or exclude bad  
actors, some means is still needed to authorize transmitters to  
determine whether an assumption of control is still valid.  DKIM has  
no safe provision to authorize transmitters unless within the domain  
of the signer.  It seem unreasonable, when considering how diverse a  
IPv4/IPv6 landscape will become, to then expect all related network  
providers will obtain a zone from each of their customer's domains  
and configure it for each of the protocols.  That constraint  
represents an administrative nightmare.

DKIM can be adjusted, but can this be done within a suitable  
timeframe?  Without a name-to-name authorization scheme, controlling  
abuse will remain by the IP address.  When those addresses happen to  
be gateways into IPv4 space operating as giant NATs, the collateral  
impacts will make today's problems seem like the good old days.   
Retaining an open system of communication may then become untenable,  
and that would be a shame.

-Doug