Subject: why market picked up NATs [Re: Writeups on why RFC1918 is bad?]

From: Pekka Savola <[email-masked]>
Date: Thu, 18 Sep 2003 17:30:59 +0300 (EEST)

Hi,

As I sent some thoughts on RFC1918 to the IAB, we had a short personal 
discussion with Geoff, and he made a very good question:

"Why did the market pick up NATs and run so hard with them despite   
 their evident complications and technical compromises?"

I made a few observations of my own, which I believe are not so technical 
(because I don't think picking NATs has been a very technical decision, 
most of the times.)

This discussion -- while maybe off-topic, chairs please speak up if so -- 
may be relevant when considering whether there is something missing in the 
IPv6 protocol set.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
---------- Forwarded message ----------
Date: Mon, 15 Sep 2003 15:34:34 +0300 (EEST)
From: Pekka Savola <[email-masked]>
To: Geoff Huston <[email-masked]>
Subject: Re: Writeups on why RFC1918 is bad? (fwd)

On Mon, 15 Sep 2003, Geoff Huston wrote:
> At 11:19 AM 15/09/2003 +0300, Pekka Savola wrote:
[...]
> So the question that strikes right at the heart of this is:
> "Why did the market pick up NATs and run so hard with them despite
> their evident complications and technical compromises?"
> 
> And if you can provide some insights into market behaviours in
> answering the above question then you will gain some valuable
> insights in answering the related questions listed above.

(hmm.. perhaps we'd have had this discussion on a larger forum, like the 
ipv6 list or the IAB list.. feel free to forward or whatever if you feel 
the latter would be warranted.)

I have thought up four reasons for this; I think all of them, especially
the first two, are pretty obvious, and should not be technology-driven.

 1) they provide for easy, extensible networking.  When you install a NAT
box in the network, the user doesn't have to configure static routes or
anything like that; the NAT box is "transparent" (in a weird sense) to the
network.  The same argument applies to bridging compared to routing; if we
wanted to get rid of NAT's e.g. in home or SOHO environments for IPv6, I'm
pretty certain we'd have to go and specify a bridging architecture
(remember J. Noel Chiappa's posts on why he thinks he made a mistake by
advocating routing instead of bridging at the start of 80's).

 2) NAT's have security properties which are understandable and settable 
even by those who don't have any security expertise.  Just plug it in, and 
bam.. you prevent any incoming traffic except to those nodes which have 
been explicitly configured.  The same would be doable with total-blockage 
access lists as well, but many folks really don't understand this.

 3) IP address space conservation and ISP business models.  ISPs feel that
they cannot give enough IP addresses to the users (e.g. home), unless they
want to spend considerable amount of energy fighting the respective RIR to
get the address space (e.g., our hostmaster boggled when I proposed he'd
apply for some /20 or /21 for a thousand or so DSL users).  On the other
hand, some ISPs do even have a business model of not giving the home users
anything but one address, to get them to get premium service; I don't know
the details of such arrangements.  The bottom line is that getting IP
addresses to those folks that need them (e.g. homes), _easily_, is just
too difficult, impossible or costs too much.

 4) the evident complications and technical compromises are not really so
evident (as in, you don't typically notice or understand them outright,
and when you do, it's already too late), and your favourite vendor is more
than happy to code workarounds to these complications (e.g. ALG's) to gain
you as a customer.

Do you have any answers of your own to the question you posed?

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 19 Sep 2003 00:42:05 +0200

On donderdag, sep 18, 2003, at 16:30 Europe/Amsterdam, Pekka Savola 

>  their evident complications and technical compromises?"

The short answer is of course: because NAT was easier than either

(a) getting new addresses, or
(b) renumbering.

Also, NAT adoption was a fairly gradual process. As far as I can 
remember, the first time I heard about it was as a Cisco feature but 
this was "straight" NAT where address range A was replaced with address 
range B without touching the port numbers. This was an enterprise 
feature for avoiding renumbering. Not much later "IP masquerading" 
showed up as a feature in the Linux firewalling mechanism and after 
that NAT started showing up in SOHO routers under names such as "single 
user account". Then at some point NAT became a more or less respectable 
technology rather than a dirty hack, just when applications that really 
don't mesh well with NAT, with the result that incompatibility with NAT 
became a problem for the application writers rather than for the user 
who was silly enough to try this flakey address translation thing.

> apply for some /20 or /21 for a thousand or so DSL users).

Note that there is no good way for an ISP to give a customer just a few 
individual IP addresses. It's either a single address or a subnet, 
which means a minimum of 8 address of which 3 are wasted. And the RIRs 
require ISPs to register /29s or larger assignments individually in the 
database.

> On the other

Yes, for many reasons, but the addresses being unavailable per se isn't 
one of them.

> than happy to code workarounds to these complications (e.g. ALG's) to 

Right.

---

From: Geoff Huston <[email-masked]>
Date: Fri, 19 Sep 2003 07:41:07 +1000

With the indulcence of the working group perhaps a preface to
the question I posed to Pekka might help here, to understand where I
was coming from:...

Why are NATs so prevalent.?

I have this personal hunch that technologists are not natural economists,
and the dynamics of the market leaves the technologist mystified.
Why is it that NATs are so popular when you and I know that
they are a rather uncomfortable compromise. Why was QoS
simply not a goer? Why has multicast gone nowhere? And
what's happening with IPv6? I have this feeling that the technology
approach is "well if you liked IP then you _will_ like
everything else we have to offer!" Markets are somewhat different.
Markets were willing to ditch CPM-M in favour of DOS (old analogy,
but if you'd ever tried to make both of them do anything
useful you'd see what I mean about the market making a poor
decision!), wiling to ditch the MAC in favour of the IBM PC architecture,
and, in general markets are just as willing to ignore good technology
as they are likely to pick it up and run with it.

That lead  onto the question I posed Pakka about NATs.

    Geoff

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 23 Sep 2003 02:32:19 +0200 (CEST)

Pekka,

I think there is an overarching issue about deployment/transition
that relates to the NAT thing;
providing a new service/feature/capability by only adding one box to
the network is a lot easier sell than for instance 
 - requring a box in the peer's network
 - requring all the routers in the path to do something new
 - requring the ISP to do something new

Thus even though NATs cause lots of problems, many would be swayed by
the low entry cost of just adding a box to get some particular new capability.
And NATs are used as a technology as part of providing different
user visible capabilities such as 
 - "connection sharing" from home
 - load balancers (without needing any support in the servers behind the LB)
 - multihoming boxes (some combining NAT and a DNS server for inbound and 
   outbound multihoming support without ISP involvement or host awareness)

It isn't clear to me at what point the pain caused by NAT in different cases
will be high enough to motivate a transition to some different technology, or
whether there must be new capabilities (such as the ability to have 
multiple servers at the same port number in a home) that are perceived
important enough to cause migration away from NAT solutions.

  Erik

---

From: Michael Thomas <[email-masked]>
Date: Mon, 22 Sep 2003 17:53:54 -0700 (PDT)

>  - "connection sharing" from home

From my SF-centric Nexus-of-the-web-trendiod
standpoint: for residential use (especially with
broadband) it is simply impossible to have an
argument about the evils of NAT. Those who try are
on a different planet and and they look awfully
small and green to the native denizens. 

You might be able to convince network IT types
given enough ROI's and TCO's and all the rest of
the PHBisms, but until IPv6 is at the same level
of complete user-idiocy-bliss as a linksys-like
NAT box, you might as well be trying to sell them
on a new religion because it requires that much of
a leap of faith.

	  Mike

---

From: Keith Moore <[email-masked]>
Date: Mon, 22 Sep 2003 22:38:12 -0400

> argument about the evils of NAT. 

that's the stupidest thing that's been said here in a long time.

NATs are at least as harmful in a residential environment as in any other
environment.  It's just that residential customers are slower to realize
the problems with NAT and they have less ability to get blocks of addresses
routed to them at reasonable prices than other customers.

---

From: Ron Lee <[email-masked]>
Date: Tue, 23 Sep 2003 11:48:31 +0900

Hello, 
Is it really true that most of the market chose to use NAT rather than
tunneling or dual-stack for IPv6 transition mechanism?
As far as I know, many providers in Japan have long been servicing IPv6
service, and their choice was never NAT. It was mostly tunneling, with
small number of dual-stack services.
Am I mistaken?

Thanks in advance for any comments.

Ron

--------------------------
Ron Lee
Senior Engineer/ Ph.D.
Samsung Electronics
Suwon, South Korea

' spamcontrol ' 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Pekka Savola
Sent: Thursday, September 18, 2003 11:31 PM
To: [email-masked]
Subject: why market picked up NATs [Re: Writeups on why RFC1918 is bad?]

Hi,

I made a few observations of my own, which I believe are not so
technical 
(because I don't think picking NATs has been a very technical decision, 
most of the times.)

This discussion -- while maybe off-topic, chairs please speak up if so -
- 
may be relevant when considering whether there is something missing in
the 
IPv6 protocol set.

---------- Forwarded message ----------
Date: Mon, 15 Sep 2003 15:34:34 +0300 (EEST)
From: Pekka Savola <[email-masked]>
To: Geoff Huston <[email-masked]>
Subject: Re: Writeups on why RFC1918 is bad? (fwd)

[...]
> So the question that strikes right at the heart of this is: "Why did 
> the market pick up NATs and run so hard with them despite their 
> evident complications and technical compromises?"
> 
insights 
> in answering the related questions listed above.

(hmm.. perhaps we'd have had this discussion on a larger forum, like
the 
ipv6 list or the IAB list.. feel free to forward or whatever if you
feel 
the latter would be warranted.)

I have thought up four reasons for this; I think all of them,
especially the first two, are pretty obvious, and should not be
technology-driven.

 1) they provide for easy, extensible networking.  When you install a
NAT box in the network, the user doesn't have to configure static
routes or anything like that; the NAT box is "transparent" (in a weird
sense) to the network.  The same argument applies to bridging compared
to routing; if we wanted to get rid of NAT's e.g. in home or SOHO
environments for IPv6, I'm pretty certain we'd have to go and specify a
bridging architecture (remember J. Noel Chiappa's posts on why he
thinks he made a mistake by advocating routing instead of bridging at
the start of 80's).

 2) NAT's have security properties which are understandable and
settable 
even by those who don't have any security expertise.  Just plug it in,
and 
bam.. you prevent any incoming traffic except to those nodes which have 
been explicitly configured.  The same would be doable with total-
blockage 
access lists as well, but many folks really don't understand this.

 3) IP address space conservation and ISP business models.  ISPs feel
that they cannot give enough IP addresses to the users (e.g. home),
unless they want to spend considerable amount of energy fighting the
respective RIR to get the address space (e.g., our hostmaster boggled
when I proposed he'd apply for some /20 or /21 for a thousand or so DSL
users).  On the other hand, some ISPs do even have a business model of
not giving the home users anything but one address, to get them to get
premium service; I don't know the details of such arrangements.  The
bottom line is that getting IP addresses to those folks that need them
(e.g. homes), _easily_, is just too difficult, impossible or costs too
much.

 4) the evident complications and technical compromises are not really
so evident (as in, you don't typically notice or understand them
outright, and when you do, it's already too late), and your favourite
vendor is more than happy to code workarounds to these complications (e.
g. ALG's) to gain you as a customer.

---

From: Mark Smith <[email-masked]>
Date: Tue, 23 Sep 2003 12:22:59 +0930

As a datapoint, it might be worth reading the comments posted to slashdot relating to this story

End Of the Line for SpeakFreely: NATed to Death

http://slashdot.org/article.pl?sid=03/09/20/1556253&mode=thread&tid=126&tid=185&tid=95

(And yes, I got sucked into it, and ended up looking like I'd just stepped out of my spaceship)

On Mon, 22 Sep 2003 22:38:12 -0400

---

From: Keith Moore <[email-masked]>
Date: Mon, 22 Sep 2003 23:55:11 -0400

> tunneling or dual-stack for IPv6 transition mechanism?

there is zero truth to that.  if you're going to use NAT there is (almost)
no point in using IPv6.

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Tue, 23 Sep 2003 08:51:13 +0200

>  - requring the ISP to do something new

To be honest I think there is a much simpler reason as to why NAT 
picked up. The concept of "if the outside world can't see what I have 
in my network - it must be secure" is much easier to accept by most 
people than "NAT does not really give you increased security" and "you 
break the end-to-end model".

- - kurtis -

---

From: "Christian de Larrinaga" <[email-masked]>
Date: Tue, 23 Sep 2003 10:23:08 +0100

> there is zero truth to that.  if you're going to use NAT

well use v6 through the NAT :-) so you keep on friendly terms with the folks
who think NAT is a security "must have" and still get to give all real users
an individual IP address.

Christian de Larrinaga

---

From: Keith Moore <[email-masked]>
Date: Tue, 23 Sep 2003 09:25:00 -0400

> an individual IP address.

sort of seems like a contradiction - either you have the NAT to provide
security or you use the same address for a host everywhere so that 
applications can (modulo access control) talk to hosts using the same address
no matter where they are.

---

From: Michael Thomas <[email-masked]>
Date: Tue, 23 Sep 2003 10:06:44 -0700 (PDT)

> routed to them at reasonable prices than other customers.

I have no idea what it is that you think you're
arguing with because it is simply my observation
having tried to get people to understand why their
innocent cuddly NAT boxen are really wolves in
sheep's clothing. How you derive "stupid" from
that is beyond me as it's a complete non-sequitur
unless a mere observation can now be assessed for
its intelligence quotient.

		 Mike

---

From: Mark Smith <[email-masked]>
Date: Tue, 23 Sep 2003 12:22:28 +0930

---

From: Keith Moore <[email-masked]>
Date: Tue, 23 Sep 2003 19:04:25 -0400

>  > NATs are at least as harmful in a residential environment as in any
>  > other environment.  It's just that residential customers are slower
>  > to realize the problems with NAT and they have less ability to get
>  > blocks of addresses routed to them at reasonable prices than other
>  > customers.
> 

Sorry, I must have taken that statement in a different way than was
intended.  

I have also seen that it's difficult to convince people that their NATs
cause problems. The people I've talked to fall into two categories:

1. Those who are technically savvy enough to be aware of the
limitations of NAT.  These people are usually also savvy enough to work
around those limitations for small-scale use, but they might have to 
deal with some annoying restriction or another - e.g. having to run
certain apps on one particular machine.   They don't see NAT as the
problem - they see NAT as an imperfect workaround for the inability
to get multiple addresses routed to their home net at a reasonable
price.  (some of these people think that NAT has a security benefit,
so a bit of education would still help.)

2. Those who aren't technically savvy enough to be aware of NAT's
limitations.  To those people, NAT is how you hook up multiple computers
to the net - they are probably not even aware that there is such a thing
as address translation going on.  And if any apps don't work in that
environment, it must be the app vendor's fault - after all, everyone
else's network works just like theirs, right?

Most of the people in group 1 can be convinced, with some effort, that
the workarounds they use for NAT's limitations don't scale well to
ordinary users, and that the widespread deployment of NAT limits the
ability to deploy certain kinds of applications.  The people in group 2
(i.e. the vast majority) are hopeless, because they don't realize that
the Internet has the potential to provide any more services than email,
the web, and IM.  (anything that AOL doesn't provide doesn't exist)

So I'd say that it certainly is possible to have an informed argument
about the evils of NAT for residential use, what is difficult is to
have a useful discussion about NAT with the typical residential user.

Keith

---

From: Benny Amorsen <[email-masked]>
Date: Wed, 24 Sep 2003 03:31:23 +0200

One thing that has not been mentioned so far in the discussion is that
NAT is empowering many users. It allows them to share connectivity,
working around draconian policies imposed on them by outside entities
such as ISP's. With NAT, any single address can now give access to a
whole network, and it can even happen recursively. No need to ask anyone
for extra addresses, no need to play with routing tables or proxy arp...

Of course there are a few applications that do not work in this setup,
but those applications are by far in the minority - and therefore those
applications are blamed for any problems. Most applications either just
work or have implemented workarounds for NAT.

With IPv6 you get some of that flexibility, but not all of it. Sure,
each user hopefully gets a /48 assigned by their ISP, but if they want
to partition a bit of it out to their neighbour, they need to learn
about routing... An IPv4 NAT box just grabs an address with DHCP and in
turn serves out addresses to others.

In order to reach the same ease of configuration, it would be necessary
to make a routing protocol where a router could ask its upstream to be
assigned a /64. The upstream would pass the request on, until the
request is granted by the router which was given a /48. Is anything like
that possible today?

/Benny

---

From: Keith Moore <[email-masked]>
Date: Tue, 23 Sep 2003 21:40:02 -0400

On Wed, 24 Sep 2003 03:31:23 +0200

> work or have implemented workarounds for NAT.

the problem with that statement is that the set of "most" applications
is different in the presence of NAT than it would have been in the
absence of NAT.  your statement is true for "most" applications partially
because the applications that would have worked without NAT have been 
denied a significant portion of the market.

but I strongly agree that autoconfiguration of routers (including the
ability of a router to ask its upstream routers for a /64 prefix) is
a significant missing piece for IPv6.

IMHO we need to compile a list of these pieces and start working on them.

Keith

---

From: Eliot Lear <[email-masked]>
Date: Tue, 23 Sep 2003 18:49:57 -0700

> a significant missing piece for IPv6.

Why is this "missing"?  Isn't this what prefix-delegation does?

Eliot

---

From: Keith Moore <[email-masked]>
Date: Tue, 23 Sep 2003 22:12:41 -0400

> Why is this "missing"?  Isn't this what prefix-delegation does?

maybe I'm the one missing something.  where is the protocol for this defined?

---

From: Eliot Lear <[email-masked]>
Date: Tue, 23 Sep 2003 19:30:32 -0700

> maybe I'm the one missing something.  where is the protocol for this defined?

draft-ietf-dhc-dhcpv6-opt-prefix-delegation-03.txt

Eliot

---

From: Ralph Droms <[email-masked]>
Date: Tue, 23 Sep 2003 22:30:31 -0400

draft-ietf-dhc-dhcpv6-opt-prefix-delegation-04.txt

The doc has been sent to the IESG for publication.

- Ralph

---

From: Ralph Droms <[email-masked]>
Date: Tue, 23 Sep 2003 22:40:11 -0400

DHCPv6 prefix delegation,
draft-ietf-dhc-dhcpv6-opt-prefix-delegation-04.txt, provides this
capability.  Interoperability among several implementations has been
demonstrated at TAHI and Connectathon.

- Ralph

---

From: Pekka Savola <[email-masked]>
Date: Wed, 24 Sep 2003 07:04:15 +0300 (EEST)

[...]
> a significant missing piece for IPv6.

.. IMHO, that may be too "technological" way to solve the problem (of
course, we still need it, but I'm arguing that we may very well need
something else too!).  Very likely this calls for the limited form of
Bridge-like ND-proxies, or something.  That's how you can extend your
network like magic (provided the ISP gives you at least /64), without
having to configure anything.

---

From: Mark Smith <[email-masked]>
Date: Wed, 24 Sep 2003 15:27:53 +0930

I don't think it has been mentioned as a reason why NAT took off, but the other thing that may  need to be provided is the "default  "security" with no configuration" that these end users believe these NATting (or NATting + firewall) products provide.

Of course, tight default security policies also provide similar limitations that NAT does when it comes to new killer apps becoming available and popular on the Internet - the non-technological user doesn't know how to turn off security for that application (ie. open up a port), or doesn't know how to turn it off safely.

Mark.

On Wed, 24 Sep 2003 07:04:15 +0300 (EEST)

---

From: Thomas Narten <[email-masked]>
Date: Wed, 24 Sep 2003 07:31:03 -0400

> argument about the evils of NAT.

It's even worse than that. If you are residential user, try finding a
home router that is actually a Real Router. I've come to the
unfortunate conclusion that they no longer exist.  The market
landscape has shifted dramatically. All home routers come with NAT
builtin and the functionality can simply _NOT_ be disabled.

I was forced not too long ago to switch DSL providers. I had been
living in bliss: my DSL modem was a bridge to an ISP that gave me as
many public addresses as I wanted using DHCP. It worked well and I was
happy.

My current provider is more typical. It is willing to give me extra
addresses (for a monthly charge), so I naively thought I would do this
with a home router. The two home routers I've looked at most closely
(D-Link and Linksys) do not allow one to disable the NAT
functionality. My ISP (after having supposedly done research) says
this is the case for all home routers. To get a real router would seem
to cost a lot more (i.e, low hundreds of $$).  It has been suggested
that if I want a cheap router, I should go to eBay and by a used
low-end Cisco. Kind of shows how bad the situation actually is.

If one looks at the price point/functionality of home routers, the
situation is not very encouaraging. They typically come with a 4 port
ethernet switch, all for something like $40. They heavily market
security as important, i.e., none of the internal machines are visible
to outside hackers by default.

Given the current feature/functionaliy/price point reality of home
routers, getting them to implement reasonable functionality as an IPv6
router seems like it will be a rather hard sell. :-(

Thomas

---

From: Andrew White <[email-masked]>
Date: Wed, 24 Sep 2003 11:59:33 +1000

Benny,

In general, I agree with your analysis.

> request is granted by the router which was given a /48. Is anything like

I think it's a little more complex.

Let's leave aside the daisy-chained NATs for a moment (which is a nightmare
waiting to happen) and look at the home deployment scenario.

Using 6to4, it is reasonably easy to build an all-in-one IPv6 home gateway
right now.  Currently, it's advantageous if the gateway does both IPv4 and
IPv6, since DNS support virtually requires v4.  At this point, you have
end-to-end connectivity from any host (something you don't get with NAT),
less whatever your firewall chooses to filter out.

The real issue is application support.  In the consumer market, OS X has
IPv6, but it's hidden from most users.  Win XP also has IPv6, but it
requires a bunch of chicanery to get it working.  The real killer is that
few developers are building IPv4/6 agnostic stacks into their software, even
though the overhead is minimal.

I follow several games mailing lists, and it is quite common to see lots of
issues with peer-peer games being blocked by home "routers".  I suspect if
these devs could be convinced to go IPv6 then the IPv6 home market could
grow quite rapidly.

The other issue is cascading these setups.  Currently, I am unaware of a
deployed solution for automatically telling a gateway home router what it's
IPv6 network is (Haberman has written a draft, however, and there may be
others).  A second issue occurs with cascading.  I have built a zeroconf
system for doing peer-peer routing, but that's different from hierarchical
delegation.  These issues are very soluble, but it's a matter of how the
market wishes to deploy the solutions.

-- 
Andrew White

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 24 Sep 2003 19:27:46 +0200 (CEST)

> builtin and the functionality can simply _NOT_ be disabled.

Hmm - must be the $50 routers and the cheapest service.

The box I got installed last week as part of a DSL install (which is
"SOHO class" i.e. not the cheapest on the market) is
not only a real router, but when you disable NAT it has a default
firewall policy (outbound only connections).

To get this setup by the ISP all I had to do is tell them that
I need public IPv4 address space by filling in a form, and
then they spent 10 seconds to put that address space range in the router.

> My ISP (after having supposedly done research) says
> to cost a lot more (i.e, low hundreds of $$).

My cost $149 with a $149 mailin rebate = zero. Cheap enough for me.

But different regions and countries are likely to have different competitive
pressure; my attempts at getting non-NATed service in France failed and
UDP tunneling came to my rescue.

  Erik

---

From: Fred Templin <[email-masked]>
Date: Wed, 24 Sep 2003 14:16:02 -0700

Thomas Narten wrote:

>To get a real router would seem

Maybe salvage a low-end PC with multiple NICs and and run Linux on it?

Fred
[email-masked]

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 24 Sep 2003 23:31:01 +0200

On woensdag, sep 24, 2003, at 13:31 Europe/Amsterdam, Thomas Narten 

> builtin and the functionality can simply _NOT_ be disabled.

Is this surprising if you only want to pay $40? I don't think the 
landscape has shifted, because people never used to have routers of any 
kind in their homes.

I spent 500 euros on a Cisco 826 ADSL router (yes, original meaning of 
the word although I must admit I have it do NAT) and an Apple base 
station, and it's well worth the additional money to have a router that 
actually does what I want (which includes forwarding IP unmolested) and 
a base station that sits transparently between the wired and wireless 
LANs. And this combo supports IPv6 the way it was intended. (But the 
router terminates a tunnel, I didn't want to spend more money on DSL 
service that supports native v6 although that's of course much cooler.)

> router seems like it will be a rather hard sell. :-(

For stuff like this all costs except shipping and support eventually 
approach zero when the numbers get bit enough. Putting in an IPv6 stack 
that takes an automatically configured IPv4 address and sets up 6to4 
would take some development, but that's well worth it if you can sell a 
few million additional boxes because these boxes allow more than a 
single computer in a household to do peer to peer file sharing.

---

From: Bob Hinden <[email-masked]>
Date: Wed, 24 Sep 2003 15:38:17 -0700

Andrew,

>market wishes to deploy the solutions.

As has been pointed out for prefix delegation there is the requirements 
document:

    <draft-ietf-ipv6-prefix-delegation-requirement-03.txt>

and the DHCPv6 prefix delegation option:

    <draft-ietf-dhc-dhcpv6-opt-prefix-delegation-04.txt>

Both of these are now in the IESG.

One cut at the cascading problem is:

   <draft-thaler-ipv6-ndproxy-00.txt>

It would be good to get some discussion on this draft.  It was intended to 
meet the ND proxy part of prefix delegation, but there hasn't been very 
much discussion to date.

Bob

---

From: Bob Hinden <[email-masked]>
Date: Wed, 24 Sep 2003 15:59:13 -0700

Thomas,

>builtin and the functionality can simply _NOT_ be disabled.

They do exist, but I agree with you not at the very low end.  When I 
switched DSL providers (actually my old one decided it could no longer 
support my area), my new one supplied me with a small router (not one of 
brand names one can buy in places like Fry's).  This box was a real router 
(e.g., it even supported RIPv2) and had NAT that could be 
enabled/disabled.  Note that I did pay extra for a higher grade of DSL and 
a block of public IPv4 addresses.

I figured it would be hypocritical for me to run NAT at home and work on 
IPv6 in the IETF, so I was willing to pay a bit more money.  Everyone has 
to make their own decision.  It's a version of "think globally, act locally".

>router seems like it will be a rather hard sell. :-(

I think it will be driven by vendors shipping products with applications 
that make good of IPv6 and that people want to run.  This will give the 
home router vendors some real incentive to add IPv6 support.

Bob

---

From: Mark Smith <[email-masked]>
Date: Thu, 25 Sep 2003 13:56:47 +0930

Hi All,

On Wed, 24 Sep 2003 15:59:13 -0700

> home router vendors some real incentive to add IPv6 support.

John Walker has an interesting point of view on NAT, in his Q&A on why he is EOLing his Speak Freely software (http://www.fourmilab.ch/speakfree/eol/), under the question "What do you mean--isn't the Internet still in its infancy?"

" A user behind a NAT box is no longer a peer to other sites on the Internet. Since the user no longer has an externally visible Internet Protocol (IP) address (fixed or variable), there is no way (in the general case--there may be "workarounds" for specific NAT boxes, but they're basically exploiting bugs which will probably eventually be fixed) for sites to open connections or address packets to his machine. The user is demoted to acting exclusively as a client. While the user can contact and freely exchange packets with sites not behind NAT boxes, he cannot  be reached by connections which originate at other sites. In economic terms, the NATted user has become a consumer of services provided by a higher-ranking class of sites, producers or publishers, not subject to NAT.

There are powerful forces, including government, large media organisations, and music publishers who think this situation is just fine. In essence, every time a user--they love the word "consumer"--goes behind a NAT box, a site which was formerly a peer to their own sites goes dark, no longer accessible to others on the Internet, while their privileged sites remain. The lights are going out all over the Internet. My paper, The Digital Imprimatur, discusses the technical background, economic motivations, and social consequences of this in much more (some will say tedious) detail. Suffice it to say that, as the current migration of individual Internet users to broadband connections with NAT proceeds, the population of users who can use a peer to peer telephony product like Speak Freely will shrink apace. It is irresponsible to encourage people to buy into a technology which will soon cease to work."

It was technically obvious that NAT turns end-users into consumers rather than peers, but it hadn't occured to me that there would be non-networking and other market forces that would be quite happy for that trend to continue.

As much as the uses of it commonly tend to be illegal, it seems that the only killer app that has emerged for which IPv6 would be a real benefit is peer to peer file sharing eg., Kazaa.

Maybe we should suggest to them that they work on simple methods to move their end-users from IPv4 to IPv6, rather than spending time developing NAT work arounds.

I wonder if Micrsoft's IPv6 stack license terms would permit it to be distributed as "adware" :-)

Regards,
Mark.

---

From: Pekka Savola <[email-masked]>
Date: Thu, 25 Sep 2003 08:44:24 +0300 (EEST)

On Wed, 24 Sep 2003, Bob Hinden wrote:
[...]
> meet the ND proxy part of prefix delegation, but there hasn't been very 

I think there was some discussion after Vienna.  I think there was
something looking like consensus that the document's applicability should
be cleared up and some the mechanisms simplified.  I don't think much is
likely to happen prior to an updated document.

---

From: Antonio Querubin <[email-masked]>
Date: Fri, 26 Sep 2003 10:13:23 -1000 (HST)

> requires a bunch of chicanery to get it working.  The real killer is that

Actually, the Windows XP implementation is pretty much plug and play.  
Run 'ipv6 install' and it's ready to do 6to4 automatically.  If it's
already attached to a network that has an IPv6 router it'll favor the
advertised local router over the tunnel and obtain it's prefix from the
local router.  One of the 6to4 gateway addresses it automatically uses is
the RFC 3068 anycast 6to4 relay.

---

From: Lutz Pressler <[email-masked]>
Date: Sun, 28 Sep 2003 11:24:26 +0200 (CEST)

On Fri, 26 Sep 2003, Antonio Querubin wrote:
> Run 'ipv6 install' and it's ready to do 6to4 automatically.
One (the?) major problem is, that the DNS resolver cannot use IPv6
as transport. That makes IPv6-only setups impossible.
Application problems are still there, too, of course.
For example, it is possible to let IE use a proxy via IPv6,
but only with the trick of putting a hostname IPv6-address into
the hosts file (and using that name in the IE configuration,
not the literal address).

Lutz

-- 
  _              |  Lutz Pressler          |  Tel: ++49-551-3700002
 |_     |\ |     |  Service Network GmbH   |  FAX: ++49-551-3700009
 ._|ER  | \|ET   |  Bahnhofsallee 1b       |   mailto:[email-masked]
Service Network  |  D-37081 Goettingen     |  http://www.SerNet.DE/

---

From: Antonio Querubin <[email-masked]>
Date: Sun, 28 Sep 2003 13:36:40 -1000 (HST)

> not the literal address).

True there are a few missing features but I wouldn't call them major nor
would I characterize the stack as requiring quite a lot of extra steps to
get it to 'work'.  Setting up an IPv6-only configuration isn't practical
or useful to the majority of end-users.  Considering what you get from
running a single command I'd say it's fairly functional for the majority
of things that most Windows users would require.  Some content sites may
want to do IPv6-only networks but at least Windows users will still have
easy access.