Subject: Status of Teredo?

From: Jeroen Massar <[email-masked]>
Date: Thu, 9 Sep 2021 14:49:02 +0200

Hi Folks,

What is the status of Teredo? Many parts of it have been shutdown, for instance:
https://www.ietf.org/proceedings/87/slides/slides-87-v6ops-5.pdf
Which is a few years back already again...

But the prefix is still on the Internet:
 https://stat.ripe.net/widget/prefix-routing-consistency#w.resource=2001%3A%3A%2F32

What the BGP column, as some of those sources are IRR related!

Thus still originated from:

  1101 IP-EEND[1]
  6939 HE.net
 25192 CZ-NIC
 29432 Trex.fi
211722 NULLROUTE-AS  which even got it IRR signed... fun

Should that prefix still be:
 a) routable? (given the microsoft teredo service is shutdown; one needs to manually do things)
 b) filtered, as many people do?
 c) marked deprecated in IANA?

Is there still traffic?

Greets,
 Jeroen

[1] Wim Biemolt @ Surfnet-- lookup "WC Eend" to get, part of, the joke ;)

---

From: Michael Richardson <[email-masked]>
Date: Fri, 10 Sep 2021 06:58:40 -0400

Jeroen Massar <jeroen=[email-masked]> wrote:
    > Should that prefix still be: a) routable? (given the microsoft teredo
    > service is shutdown; one needs to manually do things)

I still use it and my users still use it, and with the Debian Miredo package,
I haven't had to do anything manual.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Fernando Gont <[email-masked]>
Date: Fri, 10 Sep 2021 15:51:06 -0300

> I haven't had to do anything manual.

Why Teredo, and not anything else?

The protocol and spec are smart, but my experience with the protocol has
been *bad*. -- IOW, I;d rather go IPv4-only than use Teredo....

Thanks,
--
Fernando Gont
Director of Information Security
EdgeUno, Inc.
PGP Fingerprint: DFBD 63E3 B248 AE79 C598 AF23 EBAE DA03 0644 1531
“This communication is the property of EdgeUno or one of its group companies and/or affiliates. This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and if you are not the intended recipient be aware that any non-explicitly authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, and will be considered a criminal offense. Please notify [email-masked] about the unintended receipt of this electronic message and delete it.”

---

From: Gyan Mishra <[email-masked]>
Date: Thu, 16 Sep 2021 00:27:21 -0400

In my experience Teredo had issues with Windows 7 at the time was about 10
years ago where the tunnel virtual interface instance would cache the
2001::/32 auto allocated by windows and then with DDNS enabled would get
installed in DNS and since v6 is preferred over v4 the host endpoints would
no longer be able to ping.

We ended up disabling all transition technology tunneling on all corporate
desktops which is a registry value to resolve the issue.

ISATAP on windows on the other hand worked really well as a transition
technology tunnel.

Gyan

On Mon, Sep 13, 2021 at 10:10 AM Fernando Gont <fernando.gont=
[email-masked]> wrote:

> “This communication is the property of EdgeUno or one of its group
> companies and/or affiliates. This electronic message contains information
> which may be privileged or confidential. The information is intended to be
> for the exclusive use of the individual(s) named above and if you are not
> the intended recipient be aware that any non-explicitly authorized
> disclosure, copying, distribution or use of the contents of this
> information, even if partially, including attached files, is strictly
> prohibited, and will be considered a criminal offense. Please notify
> [email-masked] about the unintended receipt of this electronic message
> and delete it.”
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>
-- 

<http://www.verizon.com/>

*Gyan Mishra*

*Network Solutions A**rchitect *

*Email [email-masked] <[email-masked]>*

*M 301 502-1347*

---

From: Jeroen Massar <[email-masked]>
Date: Thu, 16 Sep 2021 09:39:09 +0200

Joining multiple replies:

> On 20210909, at 22:58, Brian E Carpenter <[email-masked]> wrote:
> 
> Is it causing active harm?
> 
> If yes: do something like RFC7526.
> 
> If no: don't worry, be happy.

As there are a number of larger networks already filtering, and usage is rather low (I could not find it in the netflow of a few networks that do not filter)...

And as it gets enabled 'per default' on some setups (not corp, see below), though afaik Windows does not anymore since a few revisions...

The problem is that for the few situations where it is enabled it will give suboptimal performance and thus a bad impression of IPv6.

There are too many places where people still call out for "disabling IPv6"... even though mostly that was because of broken DNS recursors in ancient CPEs (which seem to have rotated away by now fortunately).

> On 20210916, at 06:27, Gyan Mishra <[email-masked]> wrote:
> 
> 
> In my experience Teredo had issues with Windows 7 at the time was about 10 years ago where the tunnel virtual interface instance would cache the 2001::/32 auto allocated by windows and then with DDNS enabled would get installed in DNS and since v6 is preferred over v4 the host endpoints would no longer be able to ping.  
> 
> We ended up disabling all transition technology tunneling on all corporate desktops which is a registry value to resolve the issue.
> 
> ISATAP on windows on the other hand worked really well as a transition technology tunnel.

"Corporate" would almost always imply "Active Directory", any Windows box part of AD would have disabled per default most of the transition technologies... otherwise it would avoid most firewalls. (and the reason why the original shipworm was neutered to not work behind some models of NATs and became teredo.... 'worm' is the word that scared people then more than now... ;) )

Greets,
 Jeroen