Subject: Time to move beyond the 32 bit Internet.

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 24 Jun 2014 11:38:45 -0400

This might be a random thought, but one of the main problems we have as an
organization is getting people to take deployment of IETF specs seriously.
Particularly when they are enhancements of existing specs that work 'well
enough' for existing users.

While going through the Windows API calls and thinking how old fashioned
and lame all those 'Win32' classes look now, a sudden thought:

Ordinary users don't understand the importance of going from IPv4 to IPv6.

But Ordinary users do understand that 32 bits is bad and old and obsolete
and rubbish and 64 bits is better.

So lets stop asking ISPs 'do you support IPv6' and instead ask 'Is your
Internet service 32 bit or 128'?

This might sound a trivial matter but I can assure you its not. Banging on
about how the wealthy Wall Street types got a bailout during Bush's fiscal
crisis got nowhere. "The wealth of the 1% or the welfare of the 99%" had
real effect.

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Tue, 24 Jun 2014 20:27:30 +0100

On 24 Jun 2014, at 16:38, Phillip Hallam-Baker <[email-masked]> wrote:
> This might be a random thought, but one of the main problems we have as an organization is getting people to take deployment of IETF specs seriously. Particularly when they are enhancements of existing specs that work 'well enough' for existing users.

Having fielded yet another “IPv6 is moronic! I can explain IPv4+DHCP+NAT in five seconds, but IPv6 is just sooooooooo complicated!” exchange, which ended (as usual) with the admin both not deploying the protocol and accusing the IETF of “Rolling over” when the end-user CPE makers can’t pull their fingers out, I do wonder whether we shouldn’t be shouting ever-so-slightly louder from the rooftops?

I do my best, honest, but I think it’s just possible that we should be trying to make “UX” some sort of priority.

Of course we all know that IPv6 is *supposed* to work out of the box, but it seems to me that we do not even attract *market* power, and we’re essentially going by social response alone.  People who can will continue to use kludges, because honestly, they actually do work.  And the end-user is driving that apathy.

> While going through the Windows API calls and thinking how old fashioned and lame all those 'Win32' classes look now, a sudden thought:
> 
> But Ordinary users do understand that 32 bits is bad and old and obsolete and rubbish and 64 bits is better.
> 
> 
> So lets stop asking ISPs 'do you support IPv6' and instead ask 'Is your Internet service 32 bit or 128'?
> 
> 
> This might sound a trivial matter but I can assure you its not. Banging on about how the wealthy Wall Street types got a bailout during Bush's fiscal crisis got nowhere. "The wealth of the 1% or the welfare of the 99%" had real effect.

Mmm.  I like the way you think. :)

Cheers,
Sabahattin

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 24 Jun 2014 22:06:41 +0200

On 24 Jun 2014, at 17:38, Phillip Hallam-Baker <[email-masked]> wrote:

> 'Is your Internet service 32 bit or 128'?

Yeah, I googled “128-bit Internet” and found this article which shows everything you need to do.

http://www.errorfixes.net/128-bit-internet-explorer.php
(including a link "click here to download the 128 Bit Internet Explorer repair program.”)

Grüße, Carsten

(For the humor-impaired: This appears to be an adware site, one of many you find with Google under the search term “128-bit Internet”.)

---

From: Gary Mulder <[email-masked]>
Date: Tue, 24 Jun 2014 22:20:49 +0100

People, ISPs, etc. will move to the 128-bit Internet when they're forced to
and no sooner. The fact that there is a workable solution to a known
problem both proposed and implemented means that the transition will be
less painful that it would be if there was no alternative and people are
forced to "go digital or else".

It is a credit to the IETF that a multi-decadal design still functions
amazingly well and no dictatorial edict requires that all unilaterally
relinquish all the perceived advantages of IPv4 until there is consensus
and need to do so. Survival of the fittest!

Regards,
Gary (sent from an IPv4 IP, sorry...)

---

From: [email-masked] (Martin Rex)
Date: Wed, 25 Jun 2014 00:05:13 +0200 (CEST)

> and rubbish and 64 bits is better.

Experienced users know painfully well just how smooth and painless
32-bit (windows) and 32-bit IPv4 is, whereas newer 64-bit (windows)
and newer 128-bit IPv6 is just many painful problems and ZERO benefit.

A lot of the equipment that me and my family is using is not IPv6 capable,
and *ALL* Software that I've used so far (Linux, WinXP, Win7) runs
***MUCH*** better when configured with IPv4-only anyway, so why bother.

If someone needs to be pushed, then it is *VENDORS*, not users,
that they ship their equipment in a fashion that it will work with IPv6,
should this ever become available.  Then maybe in 10 years from now,
this might become interesting to end users.

-Martin

---

From: Dave Cridland <[email-masked]>
Date: Tue, 24 Jun 2014 23:50:06 +0100

> If someone needs to be pushed, then it is *VENDORS*, not users,

No - user demand creates the market that'll get the vendors moving. Phillip
is spot-on, here.

---

From: Mark Andrews <[email-masked]>
Date: Wed, 25 Jun 2014 09:44:44 +1000

> this might become interesting to end users.

Given there are ISP delivering IPv6 + DS-Lite today over fibre
because they have run out of addresses it is time that *everybody*
starts complaining to every supplier that doesn't ship equipement
/ services with IPv6 enabled by default.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: [email-masked] (Martin Rex)
Date: Wed, 25 Jun 2014 01:55:43 +0200 (CEST)

Mark Andrews wrote:
> Martin Rex writes:

Why would any private individual want to get an IPv6 address?
With DHCP IPv4 + NAT (on your Home router) and even more so with CGN,
you may have at least a vague chance that your ID doesn't stick out
of every IP datagram like a sore thumb.  With IPv6, you're stripped
naked for traffic analysis by every governmental agency worldwide, no matter
how strong you encrypt your traffic.

The end-2-end principle is equivalent to a fairly complete loss of privacy.
Really, I'm glad that I can use IPv4 and get a new IPv4 address assigned
several times a day.

-Martin

---

From: David Farmer <[email-masked]>
Date: Tue, 24 Jun 2014 19:16:26 -0500

> Really, I'm glad that I can use IPv4 and get a new IPv4 address assigned

But do you really get a different IPv4 address?  In the situation you 
discuss that is completely up to your provider, not really up to you. 
With IPv6 my laptop, iPhone, and iPad are continually changing their 
IPv6 address and my devices are in control of the address selected not 
my providers.  For IPv4 my address for my home NAT changes only every 6 
months or so at best.

No if you mean you IPv4 address changes as you go from home to work to 
the mall, etc...  But, the same thing is true for IPv4.  Change in the 
world is inevitable, get over it.

I recommend you read the Why64 draft, it talks about both security and 
privacy provided by 64 bit host addresses.

http://tools.ietf.org/html/draft-ietf-6man-why64

As for 32bit vs. 128bit Internet, nice spin, doesn't hut, but not a new 
idea, just not a silver bullet either.

-- 
================================================
David Farmer               Email: [email-masked]
Office of Information Technology
University of Minnesota
2218 University Ave SE     Phone: 1-612-626-0815
Minneapolis, MN 55414-3029  Cell: 1-612-812-9952
================================================

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 24 Jun 2014 20:26:39 -0400

On Tue, Jun 24, 2014 at 5:20 PM, Gary Mulder <[email-masked]>
wrote:

> People, ISPs, etc. will move to the 128-bit Internet when they're forced
> to and no sooner. The fact that there is a workable solution to a known
Actually IPv6 is a 64 bit Internet, not 128 bits.

Only 64 bits of an IPv6 address are routable. It is the Inter-network after
all. Another 64 bits are reserved for the local network. One of the biggest
changes since the ARPANET days is that sites typically have local networks
with tens of machines. This house has 64 IPv4 addresses with static DHCP
allocations and I expect that to grow by at least an order of magnitude.

So we are really going from a 32 bit Internetwork+Network routing space to
64 bits of Internet and 64 bits of Network.

---

From: Mark Andrews <[email-masked]>
Date: Wed, 25 Jun 2014 10:56:27 +1000

> how strong you encrypt your traffic.

Because with CGN, DS-Lite and NAT64 you have a third class IPv4
internet.  You can't run any services what so ever.  You cannot do
anything that requires anything other than UDP or TCP over IPv4.
Try running IPv4 in IPv4 or IPv6 in IPv4 tunnels over CGN, DS-Lite
and NAT64.  They do not work due to the addresses sharing.  Try
running a NAS from behind them, it does not work.

With one level of NAT that you control (second class internet) you
can kludge around some of the issues cause by not having global
addresses ability of every machine.  UPNP helps here.

As for you ID sticking out, IPv6 is no worse that IPv4 is for all
practical purposes with currently shipping IPv6 stacks.  They have
privacy addresses and they are turned on by default.

Now with IPv6 you have a choice of whether to offer a service or
not and you don't have configure port forwarding etc.  You can have
both stable and temporary addresses at the same time for the same
box.  You can choose which to use on a service and/or role basis.

But hey a third class internet is "good enough" for the plebes at
home.  They don't deserve to be able to run servers from home.  They
don't deserve to have a first class internet.

Mark

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 25 Jun 2014 13:08:07 +1200

> how strong you encrypt your traffic.

Er, your ISP-based IPv4 address often sticks out plenty even if your
host is behind a NAT. Just look at the headers for gmail SMTP users,
for example. As far as having the Bundespolizei at your door
goes, that is sufficient.

Most private individuals simply don't care, anyway. They do care
if they can't get connected at all, which is why we need to move
beyond 32 bits in the first place.

   Brian

---

From: Ted Lemon <[email-masked]>
Date: Tue, 24 Jun 2014 23:02:47 -0400

I wonder if this will be the big debate about whether or not IPv6 will get deployed that actually comes to a conclusion everybody can accept.   It's got to happen one of these days...

;)

---

From: Randy Bush <[email-masked]>
Date: Wed, 25 Jun 2014 12:20:13 +0900

> I wonder if this will be the big debate about whether or not IPv6 will
> get deployed that actually comes to a conclusion everybody can accept.
> It's got to happen one of these days...

i am always impressed by optimism in the face of reality

maybe if we scream at the evil {vendors,backbones,content,lastmile,.*}
some more and tell them that the sky will fall on them and that they
will be struck by falling frogs ...

or maybe if we put more cologne on the mis-designed incompatible botch?

randy

---

From: Ted Lemon <[email-masked]>
Date: Tue, 24 Jun 2014 23:26:09 -0400

> or maybe if we put more cologne on the mis-designed incompatible botch?

Or maybe we should stop arguing about it, since it's not in our hands anyway.

---

From: Randy Bush <[email-masked]>
Date: Wed, 25 Jun 2014 12:36:01 +0900

> Or maybe we should stop arguing about it, since it's not in our hands

depends.  some of us here actually operate networks, make cpe, ...  iij
deployed v6 pretty early, like the last century.  and we make the cpe.
so our money is where our mouth is.  but it was religion, not profit
driven.  i fear that ipv6 makes no money for anybody except the rirs.

randy

---

From: Ted Lemon <[email-masked]>
Date: Tue, 24 Jun 2014 23:43:49 -0400

On Jun 24, 2014, at 11:36 PM, Randy Bush <[email-masked]> wrote:
> some of us here actually operate networks, make cpe

Sigh, and now I am prolonging the conversation.   Sorry.   But my point was not that we have nothing to do about it.   Just that we aren't going to have a discussion where we all agree about what the outcome will be, because no matter what we do or try to do, it's not really in our hands.   Doesn't mean we can't (or shouldn't) try!

---

From: "Michel Py" <[email-masked]>
Date: Tue, 24 Jun 2014 21:28:26 -0700

> Phillip Hallam-Baker wrote :

Creative. Since freeIPv6porn.com this is the definitely one of the best marketing attempts that I can remember.

However, I would be concerned that deciders who would be tempted by that pick-up line had been earlier adopters of 64-bit OS and found 64-bit drivers for their existing peripherals (or the lack, thereof) disturbing.

OS upgrades from 8 to 16 bit, 16 to 32 and 32 to 64 versions have all been painful; all of them left some scars. I'm afraid that the current mindset is that it is urgent to wait, both to let the other guy sweat the unavoidable bugs out, and to see if the upgrade is worth the money.

Dangerous move, but worth a shot at it. IPv6 does not have many shots left.

> Actually IPv6 is a 64 bit Internet, not 128 bits.

Better to forget that and try to sell it as 128 bits, as nobody else has been burned but that number yet.

> Ted Lemon wrote :
> I wonder if this will be the big debate about whether or not IPv6
> will get deployed that actually comes to a conclusion everybody can accept.
> It's got to happen one of these days... ;)

I have been waiting on the sidelines for that day for a long time. However, one two or three more years more won't make a difference; please consider having a nice "Plan B" ready when that day does come; making it come earlier than the market is ripe for is a waste of energy.

Michel.

---

From: Brian Trammell <[email-masked]>
Date: Wed, 25 Jun 2014 07:55:22 +0200

hi Martin, all,

> how strong you encrypt your traffic.

There is an incredibly dubious assumption hidden in this statement that it's hard to map NATted addresses to user and session identifiers. Not only is it not particularly hard, it's actually _required_ in certain jurisdictions for ISPs to keep this mapping information to respond to LE requests. 

Even if you're _not_ the ISP or (quasi-)legally empowered to compel it to give you this information, there's enough information radiated by application layer protocols that you can tease session identifiers back out of traces even without payload and with addressing information *purposefully* destroyed, as opposed to merely tweaked for operational expediency. See e.g. Coull et al "Playing Devil's Advocate: Inferring Sensitive Information from Anonymized Network Traces" NDSS 2007; Wright et al "On Inferring Application Protocol Behaviors in Encrypted Network Traffic" Journal of Machine Learning Research 2006; and the citation trees rooted at those two papers.

Network address translation is simply an expedient technique to tease a few more bits out of the address space by hiding those bits in transient state kept along the path. The assumption that it is somehow hard to store or reconstruct that transient state is simply incorrect. 

As a method for protecting privacy, NAT is privacy theater, full stop.

> Really, I'm glad that I can use IPv4 and get a new IPv4 address assigned

I'm pretty sure I read somewhere that we're out of "new" IPv4 addresses. :) So those addresses aren't new, they're reused. So the important metric here isn't the frequency of change, but (1) the size of the set of addresses and (2) the predictability of that set. Unless you're changing your ISP several times a day, NAT serves only to "hide" you in a pool of a very small number of bits of address entropy.

Regards,

Brian

---

From: Floris Van den Abeele <[email-masked]>
Date: Wed, 25 Jun 2014 10:45:02 +0200

FWIW, in Flanders (Northern region of Belgium) the two largest ISPs
(Telenet and Belgacom) have been enabling IPv6 for their customers for
the last year or so. Unfortunately, this only includes residential
customers that got the latest CPE model (though luck if you're stuck
with an older model). In the case of Telenet (monopoly ISP on HFC
network) every customer gets a /56 subnet.

This is just to say that (some) ISPs are actually rolling out IPv6. I
would imagine the situation to be similar in other regions of the world.

Floris

On wo 25 jun 2014 07:55:22 CEST, Brian Trammell wrote:
> There is an incredibly dubious assumption hidden in this statement
> that it's hard to map NATted addresses to user and session
> identifiers. Not only is it not particularly hard, it's actually
> _required_ in certain jurisdictions for ISPs to keep this mapping
> information to respond to LE requests.
>
> Even if you're _not_ the ISP or (quasi-)legally empowered to compel it
> to give you this information, there's enough information radiated by
> application layer protocols that you can tease session identifiers
> back out of traces even without payload and with addressing
> information *purposefully* destroyed, as opposed to merely tweaked for
> operational expediency. See e.g. Coull et al "Playing Devil's
> Advocate: Inferring Sensitive Information from Anonymized Network
> Traces" NDSS 2007; Wright et al "On Inferring Application Protocol
> Behaviors in Encrypted Network Traffic" Journal of Machine Learning
> Research 2006; and the citation trees rooted at those two papers.
>
> Network address translation is simply an expedient technique to tease
> a few more bits out of the address space by hiding those bits in
> transient state kept along the path. The assumption that it is somehow
> hard to store or reconstruct that transient state is simply incorrect.
>
> I'm pretty sure I read somewhere that we're out of "new" IPv4
> addresses. :) So those addresses aren't new, they're reused. So the
> important metric here isn't the frequency of change, but (1) the size
> of the set of addresses and (2) the predictability of that set. Unless
> you're changing your ISP several times a day, NAT serves only to
> "hide" you in a pool of a very small number of bits of address entropy.
>
> Regards,
>
> Brian
>

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 25 Jun 2014 18:50:45 +0900

> Internet service 32 bit or 128'?

FYI, NAT means 48 bit Internet, which is large enough for
all the practical purposes.

You can enjoy the 48 bit space even with the end to end transparency
with RSIP (rfc3130), A+P (rfc6346), E2ENAT (draft-ohta-e2e-nat) or
PE-ARP (NANOG47), though A+P is written as if it can't.

						Masataka Ohta

---

From: Jelte Jansen <[email-masked]>
Date: Wed, 25 Jun 2014 11:57:51 +0200

On 06/25/2014 07:55 AM, Brian Trammell wrote:
> 
> Network address translation is simply an expedient technique to
> tease a few more bits out of the address space by hiding those bits
> in transient state kept along the path. The assumption that it is
> somehow hard to store or reconstruct that transient state is simply
> incorrect.
> 

I'd go a step further. Given that address translation needs things like
CGN, STUN, uPnP and portforwarding to get the most basic of things
working, I think the whole picture gives you less privacy and security
than a completely untranslated end-to-end world does.

BTW, now that Microsoft is finally feeling some actual pain due to a
lack of new addresses in their azure cloud, perhaps there is some hope
that some big parties are finally starting to move.

BTW2, tbh i think calling it 32 vs 64/128 bits 'internet' will make it
even more confusing. I'd prefer something like 'ye olde obsolete
adressing'.

Jelte

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 25 Jun 2014 20:06:16 +0900

Jelte Jansen wrote:

> Given that address translation needs things like
> working,

Wrong.

While uPnP involves end systems a little, they hide address
translation from the end systems, which is why they destroy
the end to end transparency (with uPnP, there can be the end
to end transparency for applications over TCP or UDP).

> I think the whole picture gives you less privacy and security

The amount of privacy is same. It is merely that ISPs must have
more log, as long as they assign address/port dynamically on
demand.

But, if ISPs assign one of their customer an address and a range
of port numbers, the amount of log is same.

That is, assigning a customer 192.0.2.1 is not very different
from assigning the customer port 1024 to 1279 of 192.0.2.1.

						Masataka Ohta

---

From: Jelte Jansen <[email-masked]>
Date: Wed, 25 Jun 2014 13:32:31 +0200

> to end transparency for applications over TCP or UDP).

and upnp has been a security nightmare. It may hide your internal
addresses but who cares about that if it creates an attack surface that
can open up your entire network?

Other NAT-workarounds include (sometimes unpredictable) third parties
that should be unnecessary (stun, skype, and probably any number of
game-related solutions). Or force people on a fixed internal address
while they could be switching it around (portforwarding).

> from assigning the customer port 1024 to 1279 of 192.0.2.1.

yeah, from an ISP point of view it's the same.

Jelte

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 25 Jun 2014 08:26:18 -0400

On Wed, Jun 25, 2014 at 12:28 AM, Michel Py <
[email-masked]> wrote:

> However, I would be concerned that deciders who would be tempted by that
> pick-up line had been earlier adopters of 64-bit OS and found 64-bit
> drivers for their existing peripherals (or the lack, thereof) disturbing.
>

Actually, that is part of the message.

Going to IPv6 is not easy or inexpensive. And one of the reasons that is
the case is that there has been an assumption that it will 'just happen'
and that there is no need to consider bridge technologies.

People literally laughed at me when I said that we needed to embrace NAT to
deploy IPv6. Today there are very few people who don't get the reasons why.
But if you look at the efforts O/S vendors had to go through to get to 64
bits, NAT is a minor carbuncle in comparison. The way a 64 bit O/S runs a
32 bit program is not pretty.

> been burned but that number yet.

I think it would sound like twice the pain.

---

From: [email-masked] (Martin Rex)
Date: Wed, 25 Jun 2014 17:39:51 +0200 (CEST)

David Farmer wrote:
> But do you really get a different IPv4 address?

Yes, definitely.

>
> In the situation you discuss that is completely up to your provider,
> not really up to you. 

Agreed.  But the national regulator&legislator can help.

> IPv6 address

Do you really get a new _prefix_ (One than is randomly drawn from
a pool of ISP customers)?

-Martin

---

From: Thierry Moreau <[email-masked]>
Date: Wed, 25 Jun 2014 16:21:45 +0000

> Agreed.  But the national regulator&legislator can help.

In here, the legislator helps law enforcement agencies by mandating the 
ISPs to keep records of dynamic IP address assignments for some minimal 
duration, notably. (At least this is my understanding of legislative 
amendments pushed in our parliament.)

Privacy enhanced with IPv4? Maybe a false sense of privacy.

- Thierry

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Wed, 25 Jun 2014 16:29:10 +0000

> network) every customer gets a /56 subnet.

We also see measurable growth in traffic and deployment.

Eric put together some graphs of Ipv6 growth, using Google data. It attempts to project traffic level a year hence, with obvious dependency on the regression model. You may find it interesting to poke around in. An “IPv6-enabled web browser” is a web browser that exchanges data with Google using IPv6, and implies not only the browser and laptop, but intervening network.

An interesting comparison regarding “a year hence” is the range between the logistic curve prediction and the quadratic projection; where it’s actually going to be is probably bracketed by those numbers. Take some time poking around.

https://www.vyncke.org/ipv6status/project.php?metric=p&timeforward=&timebackward=&country=be
https://www.vyncke.org/ipv6status/project.php?metric=p&timeforward=&timebackward=&country=us
https://www.vyncke.org/ipv6status/project.php?metric=p&timeforward=&timebackward=&country=de
https://www.vyncke.org/ipv6status/project.php?metric=p&timeforward=&timebackward=&country=ww

---

From: Ted Lemon <[email-masked]>
Date: Wed, 25 Jun 2014 12:37:20 -0400

> Eric put together some graphs of Ipv6 growth, using Google data. It attempts to project traffic level a year hence, with obvious dependency on the regression model. You may find it interesting to p…

What's that weird blip in December 2013?   Also, the numbers for France look pretty grim!

---

From: Dan Wing <[email-masked]>
Date: Wed, 25 Jun 2014 10:08:50 -0700

> privacy addresses and they are turned on by default.

IPv6 privacy addresses aren't changed very frequently -- I see them change only every 24 hours.  Can they change more frequently with sysctl or application encouragement?  I know NAPT assigns a new port for every connection, which is how often we need a new IPv6 privacy address to provide NAPT-equvilence host obfuscation.

-d

---

From: joel jaeggli <[email-masked]>
Date: Wed, 25 Jun 2014 10:16:39 -0700

On 6/25/14 10:08 AM, Dan Wing wrote:
<snip>
> 
> IPv6 privacy addresses aren't changed very frequently -- I see them
> change only every 24 hours.  Can they change more frequently with
> sysctl or application encouragement?  I know NAPT assigns a new port
> for every connection, which is how often we need a new IPv6 privacy
> address to provide NAPT-equvilence host obfuscation.

you pay the price for that in the size of your ND cache. which unlike
that napt connection table doesn't get expired when the connection
terminates. having thousands of l3 nexthops for each device isn't a
great way to scale ethernet switches.

---

From: [email-masked] (Martin Rex)
Date: Wed, 25 Jun 2014 19:23:44 +0200 (CEST)

Mark Andrews wrote:
> internet.  You can't run any services what so ever.

The majority of home users actually do not want and do not need to
run any service in the first place.

And the majority of home users who do run services on their home
network today (Bots; trojaned PC) would probably rather not to do so.

>
> You cannot do anything that requires anything other than
> UDP or TCP over IPv4.

There is nothing any members of my family or any of my equipment
needs that doesn't fit here.

> running a NAS from behind them, it does not work.

I do *NOT* use IPv6 anywhere, and of the few equipment that I have
that is IPv6 capable at all, I have IPv6 removed or disabled, because
that makes it run smoother and safer.

> addresses ability of every machine.  UPNP helps here.

There is a difference between using a random changing DHCP-assigned
IPv4 address that is NATed on your home gateway by default, and not
being able to get a static IPv4 or static IPv6 address assigned (and used)
for _very_limited_and_very_specific_ services.

> privacy addresses and they are turned on by default.

IPv6 privacy addresses are security theater when the network prefix
is constant and the number of users sharing the prefix is tiny.

> box.  You can choose which to use on a service and/or role basis.

*NOT* having to configure port forwarding is a real security issue,
that you really can not seriously want to be the default for home users.

> 
> But hey a third class internet is "good enough" for the plebes at home.

Given the small bandwith that many home DSL subscribers face, there simply
is no use case for "offering services" from home in the first place.

-Martin

---

From: Dan Wing <[email-masked]>
Date: Wed, 25 Jun 2014 10:25:21 -0700

> great way to scale ethernet switches.

Yep, we've seen that problem.

-d

---

From: Lee Howard <[email-masked]>
Date: Wed, 25 Jun 2014 13:26:05 -0400

Venue question: Is this the right place to discuss marketing techniques?

>***MUCH*** better when configured with IPv4-only anyway, so why bother.

You know that WinXP is end of support, right?
I haven't seen data showing dual-stack to be in any way inferior to
IPv4-only.
If you have some, please forward.
I have seen data showing IPv6 latency is lower.

>this might become interesting to end users.

I believe it was Joe St. Sauver who said:
	Consumers don't care about plumbing, they want water.

	Whether the water comes over cast iron, copper, or PVC only matters to
	the plumbers.

In my humble opinion, it is too late to argue about whether IPv6 will be
deployed.  It is.
We can argue about where there are gaps, and whether IPv6 will be
universal enough (and "enough for what?", and how to sunset IPv4 (q.v.),
and how to avoid or improve NATs.  We could argue about whether IETF
should keep updating IPv4 and working around NAT
(draft-george-ipv6-support).

And of course, we each 2119-SHOULD deploy IPv6 as universally as possible.

Lee

---

From: Niels Dettenbach <[email-masked]>
Date: Wed, 25 Jun 2014 19:43:08 +0200

> is constant and the number of users sharing the prefix is tiny.
...ahh,
which is 'not' the case with (much) shorter IPv4 network prefixes and (much) 
smaller address pools?!...

Seeing NAT as any kind of "network security" or "anonymity" feature is a major 
reason for the major security and abuse problems within the internet today 
(incl. bots and similiar you mentioned).

The fact that most users are not providing services on the net is not true at 
all.

Alone all that "nice" stuff from Skype to TeamViewer whose major point is that 
they "trick out" typical, non managed stateful inspection firewalls on NAT and 
the fact that even most typical IT service providers are using and 
recommending that crap for high risky scenarios shows that it is time to bring 
up pressure to think about. 

And if IPv6 will bring up this too - plus one point from me...

On the other hand - i have a lot of new internet app scenarios in mind which 
are not practical today without a more flexible - access network transparent - 
end user access to IP.

cheerioh,

Niels.
-- 
 ---
 Niels Dettenbach
 Syndicat IT & Internet
 http://www.syndicat.com
 PGP: https://syndicat.com/pub_key.asc
 ---

---

From: Yoav Nir <[email-masked]>
Date: Wed, 25 Jun 2014 21:43:28 +0300

> run any service in the first place.

I think it’s more correct to say that the majority of home users have learned to make do without running services.

I have a desktop computer at home with about a terabyte of free disk space and a connected printer. That computer can easily run services with protocols such as SMTP+IMAP, NFS, IPP and VoIP. In fact, OS vendors like Apple and Microsoft could include these services very easily and with little need to configure anything. 

And yet these home users use cloud services for all of these things. Why?  Because getting to those home servers is such a hassle when they’re behind NAT. Sure, there are ways to print on my home printer. But those ways always boil down to printing to a cloud service, with the hope printer occasionally pulling print jobs from the cloud. That’s an awkward way to get around the limitation.

So we’ve been using Gmail and Gdrive and iCloud and DropBox and a bunch or others for so long, that we feel as though that’s the right way for things. It sure is convenient, but it’s not the only way.

We can speculate about whether cloud services for consumers would have taken off if IPv6 had taken off in ’98 and NATs quietly died. I tend to think that the risk of losing everything would have led to where we are today anyway, at least for mail and file storage. Usable backups have only been in mainstream operating system for the last few years. It’s all speculation, but we shouldn’t assume that consumers would not do something else if it was technically feasible.

Yoav

---

From: [email-masked] (Martin Rex)
Date: Wed, 25 Jun 2014 20:48:50 +0200 (CEST)

Niels Dettenbach wrote:
> Martin Rex:

Correct.

AFAIK, to change an IPv6 network prefix in a "fully transparent" home
network, you would have to renumber every machine&device on that network.
So for a DSL subscriber, the network prefix is the size of that
subscriber household, which often is a family or just one single person.

With NAT and a regularly reassigned randomly chosen IPv4-Address on
the WAN interface of your home gateway, you not only get rid of the
entire renumbering crap for the inside of your (home) network,
but you also get blended with many other subscribers of the same ISP
in the perception of everyone else on the internet other than your ISP.

I've just glanced over the IPv4 addresses assigned over the past 4 days.

The "lowest" IP address  was  a.b.4.x
The "highest" IP address was  a.b.118.x

and the other addresses look fairly well distributed between these.

Looking at the past ~50 addresses, I see 3 addresses twice, the other
addresses are unique.

Absolute anonymity doesn't exist.  In the real world, anonymity
means always some form of "blending in a group".  And the larger
that group, the better.

Randomly dynamic DHCP-assigned IPv4 addresses do not _provide_ anonymity,
but static IPv6 network prefixes completely preclude anonymity, and 
therefore completely preclude privacy when the groups size is ~10 or less,
or in the extreme, just a single subscriber/customer.

To get a decent level of privacy, you really want to blend with
1000+ plus other ISP customers, preferably 10000+ or more.

-Martin

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Wed, 25 Jun 2014 19:03:52 +0000

On Jun 25, 2014, at 10:43 AM, Niels Dettenbach <[email-masked]> wrote:

> The fact that most users are not providing services on the net is not true at all.

Agreed.

I suppose part of this is the definition of a “service”. I think it’s fair to say that your average residential user doesn’t have the kind of service infrastructure in his or her home that an ISP would provide. But I think that’s actually a pretty restrictive definition of a "service”.

To me, networked applications fall into two broad categories: those that need an address before a application session opens, and those that have no need of an address until the instant an application session opens. The latter are obviously clients - the fact that I can readily connect from a web browser to a web server through an arbitrarily long sequence of NATs says to me that the client’s address is mostly-irrelevant from its perspective, and it could be supplied with an address at the instant it decided to create the connection. That’s not a service, that’s the client of a service.

However, if I need an address to connect to an application on some remote device, that remote application is in some sense a service.

Let’s talk about services that people often do operate from their homes.

My daughter has had a couple o break-ins, and lives in a neighborhood that has had trouble with that. It’s not a “bad” neighborhood, but police cruisers seem to spend their time in more upscale neighborhoods or the business parts of her town, so her neighborhood has had trouble. I installed a surveillance system for her. One of the really nice things is that the computer in her home can use Dynamic DNS to enable and application on her phone or laptop to access the current camera or stored footage from somewhere else. There are several systems that allow that. https://www.google.com/search?q=surveillance+dynamic+dns. It works through a NAT by configuring the NAT appropriately. In her case, however, she has the NAT in her router and a NAT somewhere upstream (in her modem, probably, or perhaps CGN if the provider is using that), so that the service doesn’t actually WORK. IPv6 would solve that issue cold, although it would perhaps highlight security issues (so who is looking at her surveillance footage?).

And then there are things on one’s phone or notebook. Think Skype, FaceTime, Voice/Video in general, gaming, photo exchange, p2p-anything. These services today have large infrastructure “in the cloud”, because NATs pretty much force the thing in the home to be a client of something somewhere else. However, that has some direct impacts - if every user has the option of sending at mumble kbps or mbps, the cloud infrastructure has to be able to receive at that rate and retransmit to one or more other users at that rate. Count noses, and then say “MBPS”. 

Now, imagine a different model. Your membership in, say, Skype-or-whatever gives you the opportunity to ask a server somewhere “what address is my buddy at right now”, or perhaps “buddies". The infrastructure cost drops like a rock, and connections between users of the service become direct. Did you say that, maybe, privacy was important and you wanted to “go dark”? OK, encrypt the session and give only your buddy the key. Skype wants to deploy a service in which a client can share with an arbitrary number of buddies simultaneously? Hey, if you have the bandwidth, whatever, Skype simply gives you the addresses of several buddies. So these things in which a system in a house has to be a client of some kind of expensive infrastructure suddenly become SERVICES in the sense that they have an address when someone needs to connect to them, and one connection goes end to end.

A classic example of that is Free’s IPv6 video service. I don’t live in France and I haven’t used it, so I’m propagating hear-say here. But as I understand it, it is a lot like youtube, but the rotating storage is provided by the Free subscribers that share videos using it, at no cost to Free.

If the defining characteristic of a service is that someone ELSE connects to IT when THEY decide to do so, I think you will find that the typical residential user runs services all the time, and they would work at least as well and probably better without the middleware. They just don’t know it, and they depend on some pretty heavy-duty stuff “in the cloud” to make it possible.

---

From: Dave Cridland <[email-masked]>
Date: Wed, 25 Jun 2014 20:26:52 +0100

> run any service in the first place.

You're surely joking?

Let's assume that by "service" you actually meant "service accessible to
anywhere on the internet", because it's just silly to assume you might have
meant internal services.

There's a fairly large number of devices sold with the explicit feature
that they have a [horrendously complex] mechanism by which they're
reachable from the outside world.

The Western Digital NAS I have sitting on a bookshelf in my office is one
such, as is the HP printer behind me. There are various digital TV set-top
boxes that are able to be programmed to record from outside the consumer's
network, too.

These aren't obscure undocumented features; these are headline USPs.

They're not *public* services, of course, but they're certainly services in
every meaningful technical sense, and they're all reliant on weird hacks,
proxy services, and so on. IPv6 instantly makes these simpler for
developers and users.

Dave.

---

From: Hector Santos <[email-masked]>
Date: Wed, 25 Jun 2014 15:52:14 -0400

Phillip, I still deal in a RS232 dial up market that is "mission critical" at every segment of the market place; from the hobbyist to mom&pop, to small to large commercial and government, level operational communications needs.   Change is slow and as long as it remains cost effective and automatic with low support needs, etc, it's going to take a long time to dismantle the long time established infrastructure.

I do feel there needs to be better education, not for the end-user, but for the communications market engineers, people like myself, those that develop and maintain the unified virtual communications applications.  We also need funding and grants to assist with the migration.  But in all honesty, their really hasn't been any market pressure to change and I doubt the ISP is going to take a chance with tortious interference lawsuits by long time well establishment businesses.

I do agree the NAT should of been used as a carrot toward ipv6 in the same way i feel author domain policy should be used as a DKIM carrot to help establish a non-existing 3rd party trust market.   

--
Hector Santos
http://www.santronics.com

> On Jun 25, 2014, at 8:26 AM, Phillip Hallam-Baker <[email-masked]> wrote:
> 
>> On Wed, Jun 25, 2014 at 12:28 AM, Michel Py <[email-masked]> wrote:
> Going to IPv6 is not easy or inexpensive. And one of the reasons that is the case is that there has been an assumption that it will 'just happen' and that there is no need to consider bridge technologies.
> 
> People literally laughed at me when I said that we needed to embrace NAT to deploy IPv6. Today there are very few people who don't get the reasons why. But if you look at the efforts O/S vendors had to go through to get to 64 bits, NAT is a minor carbuncle in comparison. The way a 64 bit O/S runs a 32 bit program is not pretty. 
> 
> 
>>

---

From: [email-masked] (Martin Rex)
Date: Wed, 25 Jun 2014 22:50:38 +0200 (CEST)

Dave Cridland wrote:
> Martin Rex <[email-masked]> wrote:
> 

Nope, I'm dead serious.

> anywhere on the internet", because it's just silly to assume you might have

Correct.  "Services" attached to the home network and accessed from
within the home network don't care about the IPv4 address on the
WAN interface of your home gateway.

They would have to care about changing network prefixes of a home gateway
that provided end-to-end transparent IPv6, on the other hand, and that
would be a real nightmare.

> boxes that are able to be programmed to record from outside the consumer's

While that might be true, the security of most of these devices is
so ridiculously lame (read _not_ there), that *EVERYONE* is better
off when few to none of these ever become transparently accessible
from the internet.  And for those devices that aren't huge gaping
security problem as shipped, they *ALL* turn into one within a few months.

> These aren't obscure undocumented features; these are headline USPs.

Pretty much all of them are irresponsible features from a product safety
perspective, and NAT is probably the best (and by far most important) thing
that happened to the internet after the invention of the World Wide Web.

> proxy services, and so on. IPv6 instantly makes these simpler for

If the equipment running these services were transparently accessible
from the internet by default, then the vast majority of them would also
be publicly accessible without the owners consent and probably without
the owners knowlegde.

-Martin

---

From: "Niels Dettenbach (Syndicat.com)" <[email-masked]>
Date: Wed, 25 Jun 2014 22:55:00 +0200

> I suppose part of this is the definition of a “service”. I think it’s fair to say that your average residential user doesn’t have the kind of service infrastructure in his or her home that an ISP w…

You’re thinking in that old fashion i described.

As i wrote i.e. Skype and TeamViewer ARE products who show that even many (or most?) end users STILL want to provide IP services to the public network in any way. 

By fact, these „i want to offer IP services from home sometimes solutions“ are much more insecure by structure and principle than anything i can imagine today - they require a perforated „Firewall“ and full access of a third party as super user into their own networks. 

NAT is no workaround for a bad configured firewall or similar.

cheerioh,

Niels.
—
Syndicat IT & Internet
Gosslerstr. 34, Goettingen, DE
http://www.syndicat.com

---

From: Dave Cridland <[email-masked]>
Date: Wed, 25 Jun 2014 21:56:45 +0100

> >> run any service in the first place.
Well, you prove yourself wrong in your own email. These things exist, and
are sold, and are run, all of which you agree with. You should have opted
to claim a failed joke while you had the chance.

You might think users shouldn't be allowed to run such things, but the fact
is they do want to, and they certainly think they need to.

Your opinion of whether this is acceptable behaviour on behalf of the
proletariat is entirely irrelevant.

Dave.

---

From: Randy Bush <[email-masked]>
Date: Thu, 26 Jun 2014 06:42:28 +0900

> The fact that most users are not providing services on the net is not

making it difficult for the end user to provide services is a dangerous
disfunction, the consumer-only couch potato intertnet.  we should strive
for a world where the user can control and publish their own data, not
be forced by isp edge policies and technologues into being owned by the
googles.

[ my edge router in hawi is an openwrt, and time warner will not even
  let me https or ssh to maintain it from the outside, e.g. to install
  security updates.  this is badly broken. ]

in the IoT, this will force the home user to be owned by the IoT device
providers with schemes where the devices have to 'call' their original
manufacturers to rendezvous.

randy

---

From: Masataka Ohta <[email-masked]>
Date: Thu, 26 Jun 2014 07:08:40 +0900

> run any service in the first place.

Joining peer to peer service means simultaneously acting as a
server and a client of the service.

						Masataka Ohta

---

From: Michael Richardson <[email-masked]>
Date: Tue, 24 Jun 2014 13:23:06 -0400

> Internet service 32 bit or 128'?

Good idea.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: <[email-masked]>
Date: Mon, 30 Jun 2014 02:19:34 +0000

So NAPT (32bit IPv4 address + necessary 16-bit send/receive ports) must be 64 bit?

Lloyd Wood
http://about.me/lloydwood
________________________________________
From: ietf <[email-masked]> on behalf of Michael Richardson <[email-masked]>
Sent: Wednesday, 25 June 2014 3:23 AM
To: Phillip Hallam-Baker
Cc: IETF Discussion Mailing List
Subject: Re: Time to move beyond the 32 bit Internet.

Good idea.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 30 Jun 2014 08:40:57 -0400

On Sun, Jun 29, 2014 at 10:19 PM, <[email-masked]> wrote:

> Its 64 bits the same way that paged memory gave you a 32 bit address space
on 16 bit chips.