Subject: [RRG] Migration to IPv6-only addresses

From: Robin Whittle <[email-masked]>
Date: Fri, 28 Sep 2007 12:32:39 +1000

In the thread "End user network size [ [Q] draft-farinacci-lisp:
IPv4 address depletion]", Iljitsch van Beijnum wrote of two classes
of applications which present the greatest difficulties in a user
being happy with an IPv6-only IP address.

I initially wrote of the end-user networks having IPv6-only
addresses, but Iljitsch tended to discuss end-user computers having
IPv6-only addresses, with some servers in their network (or perhaps
the ISP network) having IPv4 addresses as well.

I found this analysis interesting, but there is so much devil in the
detail of all the forms of Internet communication, that I imagine
there are many other types of application which also present
problems, and which are not amenable to proxying.  For instance,
computer gaming applications - where real-time, direct, unmediated
communication is required, and where there is no general protocol -
just a bunch of separate protocols written by generally commercial
developers for mass-market users with Windows machines.

I am not convinced that IPv6 is simpler than IPv4, but even if it
was, the question is who is going to be happy with an IPv6 only
address in a situation where many other Internet computers (or as
few as 1% or less) have only IPv4 addresses.

Iljitsch, you wrote, in part:

> Fortunately, the 99% issue is only applicable to a small subset of
> all applications. IPv6 deployment issues depend on the type of
> application: client/server or peer-to-peer, and one-to-few or
> one-to-many.
>
> Client/server one-to-few would be email: you only talk to a very
> small number of mail servers.

I understand you mean the desktop machine only has an IPv6 address
and its email client software communicates using SMTP, IMAP and POP3
to the mail server of the network of which it is a part.

This assumes that a visiting person doesn't want to use the computer
for IMAP etc. to their own (IPv4-only) server.

I am keen to keep the MTA (Postfix) and IMAP server (actually
Courier Maildrop filtering, various spam and antivirus filters and
Courier IMAPD) on the same machine, within my network.  The MTA
(Postfix) certainly needs to have an IPv4 address in order to
interoperate with all other MTAs in the world.

I imagine that many other end-user networks insist on running their
own mail server, rather than paying the ISP to do so.  Years of mail
archives are huge, and there's no way an ISP wants to be responsible
for maintaining all that stuff.  For fast access, the IMAP server
needs to be on the local network.   If it is an IPv6-only network,
then it will be on a machine without an IPv4 address, but the MTA
needs to have an IPv4 address.  I guess the MTA could be separate -
at the ISP for instance, but I would much rather run the whole lot
on one machine, or on separate machines within my own network.

> If those servers that you use are dual stack, you can run
> IPv6-only on your workstation and still read and write mail
> without trouble.

I agree.  However, if the whole network has only IPv6 addresses,
which is a more specific form of the original question, then the
mail server can't be dual stack without tunneling to some network
which gives it a stable IPv4 address.

> Client/server one-to-many is web: you talk to many different web
> servers. You can only be IPv6-only once ALL these servers are dual
> stack.

Yes - we return to this below.

> Peer-to-peer one-to-few is BitTorrent: you download pieces of
> files from different peers, but you don't really care from which
> peer. So as long as the tracker (coordinating server) and a
> reasonable subset of all peers is dual stack, you're in business.

I agree in principle, assuming the BitTorrent system - perhaps just
the coordinating server system - is made to work with IPv6.
However, there are many such systems beyond BitTorrent.  Why would
the authors of BitTorrent et al. complexify their systems
appreciably (a lot more work, documentation, configuration items and
bugs) for IPv6 until there are an appreciable number of end-users
with IPv6-only addresses?

  (There is apparently an IPv6 client and tracker, after 2 days
   effort, at:  http://reboot.animeirc.de/bittorrent/ .)

> Peer-to-peer one-to-many is VoIP: in theory, you can dial any
> number, so you can only run IPv6-only once your SIP server and all
> possible peers are dual stack.

> Turns out you can easily move an application from the one-to-many
> to the one-to-few category by implementing proxies. So once your
> ISP (or IT department) has set up a dual stack HTTP/HTTPS proxy
> you can reach the web (in theory everything that uses TCP with the
> HTTPS proxy) and if your VoIP provider has an IPv6-capable gateway
> towards other networks, you can make calls over IPv6, too.

I am sure there are lots of applications where, due to performance
degradation, proxy load problems, the need for privacy, security and
encryption etc. it is impossible or very much second-best approach
to use an IPv6 - IPv4 proxy.

How many such applications are built to work with proxies?
BitTorrent isn't AFAIK.  I don't know a way of finding out 99% of
the applications people are actually using.  I think that any
broad-brush statement about whole classes of applications being
suitable for proxying would not withstand close scrutiny.

> So in an environment where only a subset of all possible
> applications must be supported (i.e., an enterprise network) it's
> entirely possible to ditch IPv4 and proxy to the IPv4 world at the
> edge of the network.

I think this may well be the case in highly controlled enterprise
networks such as banks.  But those networks are doing fine with NAT
and IPv4 anyway - probably having thousands of users accessing the
Net via a handful of IPv4 addresses.  So shortage of IPv4 address
space is not going to be an impetus to IPv6 adoption, especially if
and when LISP etc. is available to provide stable PI IPv4 addresses
to such networks in smaller than 256 increments.

>> I think we are still going to be clamouring for IPv4 addresses in
>> ten or fifteen years time.  Maybe we will be stuck with it
>> forever.  I hope a new routing and addressing architecture can be
>> implemented around 2012.
>
> I find it strange how people can make predictions that far in the
> future. Less than 1% of all people that are now running IPv4 were
> doing so 15 years ago. If you can go from 0 to 4 in 15 years, why
> not from 4 to 6 in as many or fewer years?

15 years ago, there was no installed base.  IPv4 was not
incompatible with existing practice.

IPv6-only is incompatible with existing IPv4 practice and provides
no obvious benefit for a dual-stack machine - until perhaps there
are large numbers of IPv6-only users.  In that case, if there is a
performance improvement, it is only to the extent that IPv6-only
computers suffer a performance problem or communications
impossibility when trying to communicate with an IPv4-only machine,
which is what I think must be prevented before IPv6 will ever be
widely adopted.

If MS-DOS and IBM PCs hadn't been widely deployed when the Mac was
introduced, everyone would probably be running Macintosh software
now and all PCs would probably be based on 68000 derivatives.
(While I don't use or like the Mac, I think this would have been a
much clearer path - starting with a decent 32 bit CPU.)

The IBM 360 was introduced in 1964 and I understand that in the 43
years since (the 360 was produced until 1977), all IBM mainframes
have been compatible with this now completely antiquated
architecture - with no stack pointer and with software based on
EBCDIC (according to Wikipedia, also for backwards compatibility).

IPv6 is not backwards compatible with IPv4 - due to the
impossibility of any larger addressing system and/or set of IP
protocols (as far as I know) being backwards compatible with
installed IPv4 operating systems and applications.

I can't avoid the conclusion that we are likely to be stuck with
IPv4 and NAT forever.  I would be happy for someone to prove me wrong!

  - Robin

--
to unsubscribe send a message to [email-masked] with the
word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/rrg/> & ftp://psg.com/pub/lists/rrg

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 30 Sep 2007 11:11:09 +1300

Robin,

> IPv4 and NAT forever.  I would be happy for someone to prove me wrong!

The model has always been to plan for an indefinite period of
co-existence, with the background assumption that after some
large number of years, IPv4-only devices would die a natural
death. Whether you include that assumption or not has no
practical impact today in terms of what we should do. I'm not sure
that discussion beyond that point belongs on RRG.

     Brian

---

From: Robin Whittle <[email-masked]>
Date: Sun, 30 Sep 2007 12:25:13 +1000

Hi Brian,

You wrote:

RW> I can't avoid the conclusion that we are likely to be stuck with
RW> IPv4 and NAT forever.  I would be happy for someone to prove me
wrong!
> practical impact today in terms of what we should do. 

I should have written "several decades" rather than "forever".

The main task of the RRG is to choose some architectural proposals -
probably for improving BGP and for a new IP-level ITR-ETR tunneling
system for both IPv4 and IPv6 - to be developed and widely deployed
in a timeframe of a few years.

> I'm not sure that discussion beyond that point belongs on RRG.

I believe it is pertinent, since I sense a number of folks here -
perhaps including yourself - seem to think that the solution is to
migrate to IPv6.

In the foreseeable future - say ten years or more - I can't see how
anyone would pay for an Internet service which had only an IPv6
address.  (A likely exception is a cell-phone, which has highly
restricted communications abilities and in which the application
software is usually not chosen or provided by the user.)  It would
not be useful in general, since only a handful of protocols could be
supported via proxies to communicate with the rest of the Net which
uses IPv4.

I really appreciate you pointing out the errors of some proposals,
such as the use of option headers.

I understand that not everyone has the time or the inclination to do
so, but what I would really appreciate is a critique of Ivip.  The
I-D has been around for over two months now.  I have provided what I
intend to be constructive critiques of the other proposals, apart
from TRRP.

I don't think it is reasonable to talk up IPv6 as a solution to the
problems of the next 5 to 10 years:

  1 - IPv4 address depletion (possible solution: more efficient
      use of space, for more actively used IP addresses and/or
      more user networks, perhaps with smaller numbers of
      addresses than existing BGP arrangements can handle).

  2 - Minimising growth in global routing table vs. supporting
      more and more end-user networks for multihoming and for
      choice of ISP without renumbering.

  3 - Robustness and convergence time of the BGP system.

IPv6 is just as bad as IPv4 for 2 and 3.  Since IPv4 was not
designed with an upgrade strategy, IPv6 doesn't help with 1 either -
because having an IPv6-only address will provide a far smaller
subset of connectivity (in terms of protocols, applications and/or
reachable hosts) than almost anyone would find acceptable.

There are a bunch of people trying to develop IP-based ITR-ETR etc.
solutions which will actually help with the immediate problems 2 and
3 above.  I intend Ivip to help with 1 too.  I think they would all
help with 1 - by enabling more effective use of IPv4 address space.
 Dino seems to agree that LISP would help to some extent with this:

  http://psg.com/lists/rrg/2007/msg00368.html

What I think is really needed is constructive critiques of the
current ITR-ETR proposals.  If you (and others) think they won't
work at all, then please say so.  If you (and others) think they
have some chance of working, then please say so, and point out their
faults or how they might be improved.

I think it was you who pointed out a fundamental flaw in LISP-NERD -
that all its ITRs are caching ITRs, reliant on DNS lookups, which
take a second or more (perhaps several seconds) before they are able
to tunnel a packet to the correct ETR.  This means that the whole
thing will not work since TCP SYN and/or SYN-ACK packets (depending
on whether the sending and/or the receiving host uses
LISP-NERD-mapped addresses) will be delayed by so long that the host
software will give up, or (I guess) send multiple retries, or try
some other host.  Similar delays would probably clobber or disrupt
UDP-based protocols.  If they didn't stop the protocols from
working, they would certainly slow things down unacceptably.

I agree entirely with this critique.  I think this reliance on DNS
and caching makes LISP-NERD and TRRP unworkable.

That leaves LISP-CONS, eFIT-APT and Ivip.

What I am suggesting is that if you or anyone else has time, it
would be helpful for you to discuss whatever you think is good or
bad about the current ITR-ETR proposals regarding IPv4.

In the next five or ten years, I believe IPv6 is at best going to be
an adjunct to IPv4, rather than a replacement for it.  I think this
is what you wrote in your last message.  If anyone can show why
almost all hosts (3G cellphones and experimental, special-purpose
hosts excepted) will not need to communicate directly with IPv4
hosts in the next 10 years, then please do so.

I don't think it is good enough to portray what a screaming disaster
IPv4 will be as an argument for why enough people will soon jump
ship and adopt IPv6.  Humans have an extraordinary capacity to
battle on through incrementally worsening disasters - including
especially in IT when everyone is dependent on an existing system.

For IPv6 to be part of the solution to the current crisis, there
would have to be a way that ordinary users will be happy to have
IPv6-only addresses, in the 2010 to 2015 timeframe.  (Unless it
could be shown that a subset of users with IPv6 addresses will
appreciably reduce the load on the IPv4 system.) Its no fault of
IPv6 that this is a difficult or impossible task.

  - Robin

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 01 Oct 2007 11:43:06 +1300

> perhaps including yourself - seem to think that the solution is to

To be clear, I don't believe, and hope I've never implied, that
IPv6 solves the problem we're discussing here. I believe that
deployment of IPv6 is essential, but for other reasons that
are nothing to do with RRG's mission. Solutions to the problem
we're discussing here need to be orthogonal to the size of
the address space, IMHO. For that reason, I don't want to enter
a discussion of IPv6 deployment here.

     Brian

---

From: [email-masked]
Date: Mon, 1 Oct 2007 03:05:07 EDT

In einer eMail vom 01.10.2007 00:44:45 Westeuropäische Normalzeit schreibt  
[email-masked]:

Solutions to the problem

Brian

...and, as I believe, othogonal to the address aggregation.
 
Heiner

---

From: Markus Stenberg <[email-masked]>
Date: Mon, 1 Oct 2007 16:55:20 +0900

> supported via proxies to communicate with the rest of the Net which

(This seems like rehash of the discussion on some other IETF list  
this summer..)

I used to live in a country with semi-abundant IP addresses; on my  
(business-grade) ADSL I had 16 to my name just so my two servers at  
home could talk with outside world without NAT. When moving to Japan,  
I thought world would end for me as I decided to put up with home  
ADSL + NAT instead of business-grade one, for various reasons.

So what happened? I wound up punching one hole in the NAT, and I  
hardly noticed it. 5 out of 6 IPv4-using machines behind the NAT do  
not even have holes pointing their way.

The point? I'm willing to bet that if it's easier (for some reason)  
for ISP to NAT, and they happen to have more than 2^24 addresses  
(RFC1918) to deal with, for various reasons, they will go for IPv6  
either with or without NATs as soon as about all of the clients are  
likely to support it. It will be in few years due to EOL of XP, so  
things will work out(?)

Despite the pure E2E principle or whatever being violated, I'd rather  
be behind IPv6-IPv4 NAT box and use pure IPv6 than enjoy the horrors  
of the dual stack; also, I'd want that magic box to prefer v4 over v6  
connectivity due to the fact that v6 connectivity is not and will not  
be there for many, many years.. :p

What evades me is why the IETF hasn't standardized the magic box yet.

Cheers,

-Markus

P.S. You can sign me up for IPv6-only internet access as long as  
something approaching quality of the NAT I get from my current 20$  
Linksys box is available for it; most of my home network hasn't had  
public IP in two years and I'm not losing sleep over it. And I think  
I have possibly one or two v4 apps hiding there, but I wouldn't lose  
sleep over them even now, not to even mention in ten years - it is a  
long time..