Subject: an unplanned benefit of IPv6

From: "Matt Crawford" <[email-masked]>
Date: Tue, 27 Mar 2001 13:59:54 -0600

You know what I'm going to liker about the shining all-v6 future?
It's going to be rather difficult for the script kiddies to scan my
entire address space looking for their favorite port.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Niall Richard Murphy <[email-masked]>
Date: Tue, 27 Mar 2001 23:45:50 +0100

> entire address space looking for their favorite port.

An unplanned deficit of IPv6: operating without DNS will be much, much
harder. (Particularly if you can't type ":" quickly)

Niall
-- 
Enigma Consulting Limited: Security, UNIX and telecommunications consultants.
Address: Floor 2, 45 Dawson Street, Dublin 2, Ireland.
http://www.enigma.ie/
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Bill Manning <[email-masked]>
Date: Tue, 27 Mar 2001 14:56:14 -0800 (PST)

% 
% On Tue, Mar 27, 2001 at 01:59:54PM -0600, Matt Crawford wrote:
% > You know what I'm going to liker about the shining all-v6 future?
% > It's going to be rather difficult for the script kiddies to scan my
% > entire address space looking for their favorite port.
% 
% An unplanned deficit of IPv6: operating without DNS will be much, much
% harder. (Particularly if you can't type ":" quickly)
% 
% Niall
% -- 

	or try the functional equivalent of  dig -x 198.32.4.13, which
	with nibble support looks like:

dig 6.a.7.4.7.7.e.f.f.f.0.2.0.0.a.0.0.0.0.0.0.0.0.0.5.0.8.0.e.f.f.3.ip6.int.

	(I think I am missing a "0" in there somewhere)
	bitstrings are even more "interesting".

-- 
--bill

---

From: Stig Ven�s <[email-masked]>
Date: Wed, 28 Mar 2001 01:09:50 +0200

> 	bitstrings are even more "interesting".

Hexadecimal numeric keypads would help, preferably with a : key as well.
Using words like dead and beef might make addresses easier to remember.

Sorry, I couldn't resist

Stig

---

From: Feico Dillema <[email-masked]>
Date: Wed, 28 Mar 2001 01:40:46 +0200

> dig 6.a.7.4.7.7.e.f.f.f.0.2.0.0.a.0.0.0.0.0.0.0.0.0.5.0.8.0.e.f.f.3.ip6.int.

Well, mostly a matter of time till the tools have been updated with
proper support for IPv6. I personally use a little perl-script to make
the above easier (both for v4 and v6 addresses, like:

`ptrconf.pl 3ffe:2a00:100:3fff::1` gives me the nibble representation.
Rest is most of the time cut 'n paste right?

Feico.

---

From: "Tony Hain" <[email-masked]>
Date: Tue, 27 Mar 2001 16:24:28 -0800

Add to that the anonymous address feature, where all the workstations
without need for inbound connections will appear to be hopping around in
random order. Setting policies like the preferred lifetime on anonymous
addresses to very low and deprecate the hardware-based address, would
minimize the exposure to scans ever finding the bulk of the workstations.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Matt Crawford
Sent: Tuesday, March 27, 2001 12:00 PM
To: [email-masked]
Subject: an unplanned benefit of IPv6

---

From: "Tony Hain" <[email-masked]>
Date: Tue, 27 Mar 2001 16:32:11 -0800

Matt,

---

From: Robert Elz <[email-masked]>
Date: Fri, 30 Mar 2001 20:55:15 +1000

Date:        Tue, 27 Mar 2001 23:45:50 +0100
    From:        Niall Richard Murphy <[email-masked]>
    Message-ID:  <[email-masked]>

  | An unplanned deficit of IPv6: operating without DNS will be much, much
  | harder. (Particularly if you can't type ":" quickly)

That wasn't unplanned, and isn't a defecit - ridding the world of the
use of literal IP addresses is one of the things needed to make
renumbering conceivable (if not by itself make it easy).

kre

---

From: Niall Richard Murphy <[email-masked]>
Date: Fri, 30 Mar 2001 12:03:07 +0100

> renumbering conceivable (if not by itself make it easy).

Perhaps I was exaggerating for the sake of effect :-)

I feel there will still be a need to type IPv6 addresses in some circumstances
no matter what, unfortunately...

Niall

---

From: Robert Elz <[email-masked]>
Date: Sat, 31 Mar 2001 10:57:11 +1000

Date:        Fri, 30 Mar 2001 12:03:07 +0100
    From:        Niall Richard Murphy <[email-masked]>
    Message-ID:  <[email-masked]>

  | I feel there will still be a need to type IPv6 addresses in some
  | circumstances no matter what, unfortunately...

Yes, of course, that cannot be avoided.   The feature is to make it
as hard as possible, so no-one wants to do that ahen there is any
conceivable better method available.

But just typing addresses (or even sending them around in protocols,
if they're designed correctly - and I don't know if the ones Christian
mentioned are or not) isn't the real problem, it is recording the
addresses in places that don't get automatically updated.

The real killer to IPv4 renumbering is all the other people that you don't
know who have your IPv4 address recorded somewhere for one reason or
another.  That is what IPv6 really needs to avoid.   And that includes
making all things like router filter lists be able to use DNS names,
and then use them correctly (update them as the TTL's expire automatically).

kre

---

From: Stig Ven�s <[email-masked]>
Date: Sat, 31 Mar 2001 10:07:17 +0200

> and then use them correctly (update them as the TTL's expire automatically).

I agree but.... One problem I see, is that a DNS name might have several
addresses, and you might want to filter them differently. Only way out of
that, as far as I can see, is to register additional names for each of the
addresses. It might be that the filter parsers and builders are able to sort
out which addresses cannot apply in some situations, but still. Or you need
a filter language where you can say filter those addresses of foo.bar that
are "some conditional expression". I think one somehow could make router
renumbering actually change prefixes in filter addresses in the filters,
something like that must be implemented with great care, if it is possible.

Stig