Subject: RE: site local addresses (was Re: Fw: Welcome to the InterNAT...)

From: "Christian Huitema" <[email-masked]>
Date: Thu, 27 Mar 2003 17:48:44 -0800

> > You are mixing cause and effect. In IPv4 the vast majority of nodes
> > are limited to a single address at a time.
> 
> Well, I don't know about windows boxes, but real operating systems
have
> supported virtual hosting in IPv4 for many years.  Having multiple
> addresses on a node, even a node with a single network interface, is
> nothing new.

My Windows-XP laptop currently has 14 IPv6 addresses, and 2 IPv4
addresses. The sky is not falling.

-- Christian Huitema

---

From: Tim Chown <[email-masked]>
Date: Fri, 28 Mar 2003 08:47:06 +0000

> addresses. The sky is not falling.

Except of those 14 some seven(?) are RFC3041 addresses, which break a
number of applications... so there are some clouds in the sky.

Tim

---

From: "Matt Crawford" <[email-masked]>
Date: Fri, 28 Mar 2003 09:11:07 -0600

> number of applications... so there are some clouds in the sky.

3041 may be next on the hit-list.  Pretty soon it truly will be
nothing but bigger addresses.

---

From: "Tony Hain" <[email-masked]>
Date: Fri, 28 Mar 2003 10:47:02 -0800

Tim Chown wrote:
> Except of those 14 some seven(?) are RFC3041 addresses, which 
> break a number of applications... so there are some clouds in the sky.

Excuse me, but it is not the addresses that are the problem here. There
are applications out there that have an unreasonable expectation that a
ptr record in DNS provides some degree of security. We know that not all
IPv4 nodes have ptr records, so it is arguable that these applications
are inherently broken. The lack of IPv6 ptr records for some addresses
doesn't change that. 

Tony

---

From: Ole Troan <[email-masked]>
Date: Fri, 28 Mar 2003 21:05:37 +0000

> nothing but bigger addresses.

lets shoot down those 128 bit addresses too, 64 must be enough.

/ot

---

From: Tim Chown <[email-masked]>
Date: Sat, 29 Mar 2003 13:35:58 +0000

> nothing but bigger addresses.

Personally, I like the concept of 3041, but it may have implications for 
applications that applications need to be aware of, e.g. if the app sends
UDP data to a remote host on its global IP but is unable to match up UDP
packets that may come in from the (different) RFC3041 IP of the remote host.

Also, for example, I can't use RFC3041 and use my Windows XP box to web
surf "anonymously" while also relying on per-host IP access control lists to
a remote system.

The "RFC3041 Considered Harmful" I-D expresses some other concerns, e.g.
with DoS attack detection.

Thus I think RFC3041 should be recommended, but only so long as there are
per application userland controls on its use?

One for the ipng list also...

Tim