Blockers to IPv6 Adoption

https://labs.ripe.net/Members/david_holder/blockers-to-ipv6-adoption

by okket • 8 years ago

79 138 8 years ago

labs.ripe.net

tehabe• 8 years ago

I have an IPv6 internet connection but in my home network are still devices, like my TV, which do not support IPv6.

I also use some VPN tunnels, which also still rely on IPv4.

tty74• 8 years ago

For me, there is just one thing that prevents me from switching completely to IPv6: Github.

sigjuice• 8 years ago

Really? Each and every other thing you need already does IPv6?

Faaak• 8 years ago

Hacker news is not even v6 ready

cornholio• 8 years ago

I think the author is approaching this the wrong way, it's trivial to show the advantages listed are mostly not true. The marginal benefits are more than negated by the risks and costs of IPv6. IPv6 is not the product that needs to be sold, and deploying it usually has negative cost benefit on short term, for most businesses.

IPv6 needs to be deployed today because the internet literally cannot move forward without it. There are tens of millions of new internet users in Africa and Asia who get an inferior and more costly service for the simple reason their countries weren't around for the great IPv4 feast in the 90s. The data-centers of the world waste enormous energy and hardware for routing the more and more fragmented IPv4 space. The costs of all this, as well as renting IPv4 addresses, which have steadily rised, are passed down to the consumers.

IPv6 should be sold as a status simbol: we deploy it because we care, we are altruist industry leaders not stingy bean-counters.

ianai• 8 years ago

But you still have to sell it to the stingy bean counters. So until the benefits outweigh the costs, ipv4 4eva.

mino2• 8 years ago

Enterprises are doing the right thing, ignoring v6. No advantage whatsoever for a long time to come, only added complexity and training.

As a network engineer and enthusiast, I would do the same.

dvfjsdhgfv4• 8 years ago

I wouldn't say it's "the right thing", but it definitely makes sense in most scenarios. Who in their right mind would voluntarily welcome a new layer of complexity into their network when it's not really necessary?

techrich• 8 years ago

The IT director for a global corporation will care, once the bottom line is being effected and he will have to implement it. Profits will not be allowed to suffer.

kojon99• 8 years ago

Performance? How exactly is ipv6 more performing? It even has bigger headers.

Why would ipv6 be more reliable than ipv4? I’d say it’s the opposite: many times I’ve found websites with AAAA registers that pointed to a dead server. I mean, if you’re going to blame cgn for your problems, let’s steep to your level.

Analytics? Forensics? So you’re telling me ipv6 destroys my privacy. How is that a pro argument?

jjeaff• 8 years ago

I'm by no means am expert in this space, but I was working on some routing issues lately and doing some speed testing with my router.

The specs on the router claimed that the highest speeds could be reached with ipv6 support because you could then avoid the overhead of nat for your ipv4 addresses. So that may be what they are referring to. Nat does create overhead.

kazen444• 8 years ago

Also, it has a simpler checksum to calculate and a far simpler header. The header is larger but has far less fields. This should make packet processing faster aswell.

Also, MTU path-discovery is a pretty big deal in terms of performance, as IPV6 does not allow packet fragmentation. Which should improve performance aswell.

AmericanChopper• 8 years ago

But I like NAT. I don’t want to spark a ‘NAT is not a firewall’ debate, but it solves many security and privacy issues with little overhead, and does so in an incredibly simple and elegant way. Having the private LAN as a trusted network zone makes perfect sense, and for home users is works perfectly well with 0 configuration. Remove it and you’re giving every single device a globally unique L3 identifier (no fucking thank you), and to get the same benefits that NAT provides you’ll have to replace it with an unavoidably more complex solution.

partycoder• 8 years ago

I noticed that enabling IPv6 in the JVM makes many operations slower. Has anyone else noticed this?

skrause2• 8 years ago

Performance? How exactly is ipv6 more performing? It even has bigger headers.

IPv6 has smaller routing tables, doesn't required routers to recalculate header checksums and doesn't support packet fragmentation (the endpoints are required to handle that). This allows more efficient router designs despite the larger headers.

mehrdadn11• 8 years ago

How exactly is ipv6 more performing? It even has bigger headers.

This is something I don't really see anybody mention, but IPv6 doesn't allow packet fragmentation as far as I know -- which means you don't get the sudden performance degredation (and extra data loss probability, etc.) that comes with using the wrong packet size. I expect that boosts performance but I haven't had a chance to measure.

y0ghur7_xxx2• 8 years ago

I deployed a dual ipv4 + ipv6 stack on my home lan a few years ago. I got myself a /48 from hurricane electric, and did everything like it's in the book: SLAAC for subnets, fixed addresses on servers, every device had a public ipv6 and the firewall allowed or denied stuff. Everything worked as it should work. One day something stopped working on the he tunnel, and as I was about to debug what went wrong, I just asked myself "Why am I doing this? My ISP has no ipv6, every site I visit has an ipv4 address, why am I keeping all this ipv6 stuff on? I don't need it. It's just useless work". And so I reverted everything to ipv4 and I am happy since. Less work for me.

I see NO reason to deploy ipv6 at the moment. I don't see it for home lans, I don't see it for my workplace, I don't see it for bigger enterprises.

But you can have a gazillion IPs with ipv6!! Yeah, so what?

mort96• 8 years ago

"You can have a gazillion IP addresses with IPv6" isn't necessarily that interesting, but "You can have one IP address with IPv6", or "You can have on IP address per device with IPv6", or "You can get rid of NAT with IPv6", are very interesting.

kazen444• 8 years ago

IPv6 brings some pretty nice features in terms of network engineering.

the major one is a vastly smaller BGP routing table, which is becoming more and more of an issue.[1]

We need IPv6 to remove the horrible IPV4 space fragmentation.

http://bgphelp.com/2017/01/01/bgpsize/

y0ghur7_xxx2• 8 years ago

the major one is a vastly smaller BGP routing table, which is becoming more and more of an issue.

But that's not a problem for me. It's a problem for my isp. And if he does not care, why should I?

ti_ranger• 8 years ago

I deployed a dual ipv4 + ipv6 stack on my home lan a few years ago. I got myself a /48 from hurricane electric, and did everything like it's in the book: SLAAC for subnets, fixed addresses on servers, every device had a public ipv6 and the firewall allowed or denied stuff. Everything worked as it should work. One day something stopped working on the he tunnel

If your IPv4 address changes, you need to re-start the tunnel.

I ran a setup like this, but since the closest HE tunnelbroker end-point was 180+ms away I configured radvd to only advertise to the RIPE Atlas probe I was running at the time, so only my gateway/firewall and the Atlas probe were IPv6 enabled.

My ISP can't enable IPv6 because the last-mile ISP, who does layer-3 hand-over uses half-duplex MPLS VPNs for traffic hand-over (separate VPNs for each ISP), and the equipment (Cisco and Alcatel-Lucent BNGs) in use doesn't support Half-Duplex VRF for IPv6 (only IPv4). I am not aware of another last-mile fixed-line provider (there are quite a few here) that supports IPv6 at all. When I enquired with one of them, they indicated that it was on their roadmap (or backlog, they didn't have any idea of timeline ...).

GvS3• 8 years ago

I've enabled ipv6 on my ubuntu server recently and it was 100x slower. The only solution I found is to go back to ipv4: https://askubuntu.com/questions/759524/problem-with-ipv6-sud...

M_Bakhtiari• 8 years ago

Was all IPv6 traffic slower or just this one apparently misconfigured host?

If the former I'd image this is a kernel bug and has nothing to do with any Ubuntu servers.

Avamander• 8 years ago

It honestly doesn't matter what bug it is. It should be promptly investigated further and solved. Random blame assignment doesn't help anyone. In this case though, seeing how most mirrors still can't do HTTPS I would not be surprised if the IPv6 issue is caused by the mirrors - another thing not yet properly configured.

GvS3• 8 years ago

All IPv6 traffic. Checking out from bitbucket took 6 minutes instead of 10 seconds.

Symbiote2• 8 years ago

My Kubuntu desktop has IPv6, and I have no problems running apt.

I just updated from 2001:878:346::116 / mirrors.dotsrc.org; no problems.

Which mirror were you using, and did you file a report?

GvS3• 8 years ago

I used default mirrors and I didn't file a report because I'm not sure where and which part of the system is to blame. All IPv6 traffic was slow. This question is from 2 years ago so I assumed it's a known issue.

JdeBP2• 8 years ago

That AskUbuntu question does not describe a scenario that is "slower". 0% progress and 100% packet loss is no IP connectivity, not "slower".

lwhalen3• 8 years ago

Comcast is my biggest blocker to IPv6 adoption. I maintain a static v4 block with them, they tell me I have to give that up if I want a v6 block. Until I give up v4, v6 works on my network right up to the Comcast modem, and is promptly dropped on the floor. Regrettably, that is 'no bueno' for a multitude of reasons. :-(

4ad6• 8 years ago

Here in Vienna, the "local Comcast" started deploying IPv6. However, they stopped providing real IPv4 for IPv6 customers, and instead do CGN. Well thanks, but no thanks.

vetinari5• 8 years ago

That's the problem with most consumer-grade ISPs that "embrace" IPv6. They will give it to you, but you have to give up your public IPv4 adress and be stuck within private address range.

Of course, given the state of IPv6 in the world, that's not usable for anyone who uses IPv4 today, so instead of using both simultaneously and using IPv6 when possible, you are stuck with IPv4 only, and be counted in the IPv4 stats.

sliken2• 8 years ago

Very weird, the Comcast consumer lines support IPv6 quite well. Their default is to give a /60, which seems appropriately overkill. Generally it "just works", and my roku, android phones, and similar average over 50% of the packets on IPv6.

Comcast seems like one of the largest deployments of IPv6 for normal consumers outside of the cell companies.

4ad6• 8 years ago

Their default is to give a /60, which seems appropriately overkill.

A /60 is pathetically small, with SLAAC you have 16 (!!) subnets for your whole network. With people having multiple computers and multiple phones, this is not enough even for a normal household of 3 people. If you are a IT person, with multiple computers and VMs, forget it.

The recommended size of block that every ISP should give is /48 (RFC 6177). Good ISPs will give you a /48, some lesser ISPs will give you a /56. Comcast and crappy ISPs will give you a /60.

merb• 8 years ago

well K8s can't be run in Dual Stack, which is a major Pita. Also most Clouds (especially Gcloud) mostly work on the IPv4 level.

grandinj3• 8 years ago

What we should take away from the IPv6 debacle is a fine lesson in hubris.

I was hanging out in the IPv6 mailing lists at the time the various solutions were being debated.

The prevailing attitude was "the Internet is about to die from routing overload without IPv6, so we can stick whatever complexity we want inside it, and they will have no choice but to accept it."

Except that new router hardware and new incremental software improvements came out, and the enormous complexity of the "boil the ocean" redesign inherent in IPv6 was rightly regarded as completely unnecessary.

If the IETF had simply made IPV6 "ipv4 with longer addresses", (and there was a proposal to do just that), implementations and deployment would have been dramatically simpler and would have stood a real chance of succeeding.

Instead we have this baroque construction, which I _still_ have to explicitly disable in my work environment because various bits of supposedly IPV6 software don't play nice together.

MR4D• 8 years ago

Well said!

I was in the camp hoping for two octects at the beginning of the address (so they could be zeroes). Actually, a single i text would have taken us to a trillion IPs and given us enough time to think about the topic a bit more.

Large changes rarely succeed. Perl 6, Mozilla (back in the 1990’s) and others come to mind.

This is hard stuff, and we were made to swallow the kitchen sink.

magicalhippo• 8 years ago

I guess one could say, to paraphrase, extraordinary change requires extraordinary motivation.

For me as a home user, IPv6 seems like what you'd get when you ask a group of 6-year olds to design a concept car.

zAy0LfpBZLC8mAC4• 8 years ago

So, what are the changes in IPv6 other than change in address size that hinder adoption?

throwaway20485• 8 years ago

Its not like "ipv4 with longer addresses" would have been any more compatable, we would be stuck in exactly the same situation wrt actually deploying it.

The things that ipv6 brings along that are not present in ipv4 are pretty inconsequential.

grandinj3• 8 years ago

Not really.

Virtually every related protocol (e.g. ARP, BOOTP, OSPF, BGP) was modified in non-trivial ways, the rules around different kinds of addresses (link-local, etc) are very different, IP-level encryption stuff started out mandatory (may not be anymore), various flow-control stuff was tweaked (and tweaked again since then to match the improvements in IPv4), rules for parsing optional header fields was tweaked, etc, etc.

billpg• 8 years ago

Do you have a link to the "ipv4 with longer addresses" proposal please?

dvfjsdhgfv4• 8 years ago

Instead we have this baroque construction, which I _still_ have to explicitly disable in my work environment because various bits of supposedly IPV6 software don't play nice together.

Most security-conscious people do the same.

dvfjsdhgfv4• 8 years ago

To the downvoters: I'd be curious to read your counter-arguments. To start the discussion - "NATO cybersecurity bods warn about transition to new protocol":

What's the solution? According to the authors, nothing short of a wholesale review of how network traffic is interpreted. Sysadmins need to look at how their security systems are configured to make sure they pick up any unusual traffic flows made using this technique.

https://www.theregister.co.uk/2017/04/10/ipv6_security_conce...

This is just one example of many IPv6 security threats.

joquarky• 8 years ago

I've had this question for some time, and you mentioned that you were present during the debate phase.

I wonder if I could ask if there was any mention of a solution to expand IP address space in a manner similar to how UTF-8 expands as needed?

I'm not a SME on low-level protocols, but it seems the jump from 32 to 128 bits was an ambitious leap to future-proof and maybe a small part of the reason adoption is slowed.

grandinj3• 8 years ago

I don't remember any variable-length encodings being proposed, but it was a long time ago.

I don't think the 128-bit length was ever an issue, that is just a field length, one parameter amongst many. It's all the other details that make a protocol (and it's surrounding infrastructure) more or less difficult to implement.

One of the contending proposals literally modified an existing TCP/IP stack with a constant in all the relevant places, and was then compiled twice. It had

#ifdef IPV6 #define ADDR_LENGTH 4 #else #define ADDR_LENGTH 16 #endif

and then you could compile the same source twice, once for each protocol, just passing a -DIP6 on the command line for the IPV6 version.

m0dest• 8 years ago

Decades from now, the story of IPv6 will be a cautionary tale about the danger of ignoring incentives when enhancing open standards.

So much of the spec seems to have been designed in an idealist vacuum that the promoters are blind to its own failures. The addresses are ugly and impossible to memorize but that shouldn't matter because... There are no performance advantages but that was out of scope because... There are few security advantages because that wasn't a core goal because...

I'm not saying that we should give up on IPv6. But we should acknowledge that its slow adoption is entirely due to a standard that was poorly designed for the real needs of critical stakeholders and poorly marketed to everyone else.

rjsw• 8 years ago

There is one performance advantage, IPv6 requires one fewer checksum calculation on each packet.

kelnage• 8 years ago

Isn't the same true of HTTPS (first developed in 1994, but has only seen wide usage recently, outside of specific use-cases), or even programming languages like Python 3? At the end of the day, it seems to me that incumbent internet technologies that are widely used will always see slow incremental change to a new incompatible version, regardless of how small the changes or how many improvements there are, without significant and clear external incentives. Such incentives are very hard to manufacture - so foresight of upcoming issues (such as IPv4 address space depletion) will always seem premature until they actually occur. But it certainly doesn't make forward planning a bad idea.

olavk• 8 years ago

IPv6 was designed in the early 90'ies where the internet looked very different - this was even before the web. Large scale changes were much easier to coordinate and roll out. I dont think the players at that time needed incentives beyond knowing that the upgrade solved the address space problem.

The problems of adoption can be compared to the Python 3 debacle. When Python 3 was first planned, Python were mostly used by enthusiasts which would be quick to adopt a new version - even if it had a few minor incompatible changes. But when the release finally rolled out, Python had become much more popular and entrenched and widely used by business and scientists which were more reluctant to adopt breaking changes.

rwmj2• 8 years ago

I wonder if anyone has tried making their home network IPv6 only? How did that work out for you?

The reason I ask is (as described in the article) I've nearly run out of RFC1918 space because of dozens of machines, gadgets and many more virtual machines. (For complicated reasons to do with the VPN routing, I cannot use 10.x).

letsgetphysITal• 8 years ago

Can't use 172.16.0.0/12 either? That's over 1m hosts. You don't have 1m hosts unless your homelab is actually a large domestic ISP.

rwmj2• 8 years ago

Either way I'd have to renumber everything. If I'm going to do that why wouldn't I just go straight to IPv6? I already have IPv6 on my home network (but everything has an IPv4 primary address and name resolution always resolves to IPv4); and an IPv6-supporting ISP. The question is if it's a good idea to go IPv6 only for some or all machines, and how to deal with the IPv4<->IPv6 issues.

virtuallynathan2• 8 years ago

Quite a few folks have done it using DNS64/NAT64, I might set it up. Most of my traffic is IPv6 at home.

guidedlight• 8 years ago

I see IPv6 as a privacy issue.

It will enable clients to be individually identified without needing to rely on cookies and fingerprinting anymore.

NAT is great in that it obscures individual machines without too much lose of functionality.

andrewaylett• 8 years ago

https://tools.ietf.org/html/rfc4941 defines IPv6 privacy extensions, which mitigate that issue.

One of the few benefits of an extended roll-out of IPv6 is that there's been time for people to identify issues like this and get fixes rolled out widely before systems started relying on the old behaviour.

mehrdadn11• 8 years ago

What percentage of IPv6-supporting routers have implemented and activated those privacy extensions?

gigatexal2• 8 years ago

couldn't you get around this by wrapping all tcp/udp connections in an encrypted manner say a tunnel and using dns+tls to encrypt dns queries? Sure it's not as easy as just using NAT but not having to translate via NAT to get to the internet sounds good to me. Access points wouldn't need to route anymore would they?

atemerev5• 8 years ago

Of course it is the NAT. It always was the NAT. NAT is the easy thing, nearly effortless, that dramatically improves network security — there is a "bastion host" (router) and private network computers, almost impossible to be accessed from the outside without breaking the bastion host first. This is good security, and with NAT, everybody was getting it for free. With IPv6, it doesn't work this way, everybody needs to know how to set up proper packet filtering, ACLs, and whatsnot. It is really easy to misconfigure the network, especially in the unfamiliar environment which is IPv6. Huge loss for security. Of course IPv6 adoption suffers.

okket4• 8 years ago

Actually, I don't know one CPE IPv6 router that ships _without_ blocking the home network from the outside by default.

atemerev5• 8 years ago

It is easy enough with home routers (packet filtering is hidden from the user, and no need to configure it). It is much harder for corporate networks where you need to configure everything yourself and maintain ACLs. No more easy default option.

skrause2• 8 years ago

It's actually just as easy with IPv6. All you need is a stateful firewall which allows all outgoing connections and only allows incoming packets for already established connections. This was the default setting on my home router and behaves exactly like a NAT.

atemerev5• 8 years ago

It is easy enough, but it is fragile. If NAT is misconfigured, your network stops working. If firewall is misconfigured (or e.g. your network topology has changed and you forgot to update the firewall configuration), the network works, but it is exposed to the elements and security goes away. We have enough security problems with IoT even in mostly IPv4 world; with massive IPv6 deployment, it wilk be a total nightmare.

kazen444• 8 years ago

NAT is not a firewall. You are confusing the firewall function of your home router with NAT. NAT does nothing to prevent packets from flowing into your network, as NAT hole punching is fairly doable to accomplish.

Also, all consumer routers simply block any incoming IPV6 packets, this has been the default for more then 10 years now. (the only thing not blocked is ICMP for MTU path-discovery, which is actually a good thing).

atemerev5• 8 years ago

NAT hole punching requires cooperation from inside the network.

raesene92• 8 years ago

This, whilst technically correct, isn't necessarily end-users experience of things.

Yes NAT doesn't block packets, however without explicit configuration traffic from the Internet will be very unlikely to flow into an RFC1918 addressed network from the Internet.

So effectively it does prevent traffic inbound in the same way a firewall does.

Yes you can punch holes in NAT, but that's an explicit action (well side-stepping the insanity that is UPnP) for for non-technical users sitting behind a NAT router will effectively mean that they're unlikely to receive direct inbound network attacks from the Internet.

JdeBP2• 8 years ago

I recommend reading the likes of https://security.stackexchange.com/questions/8772/ , https://superuser.com/questions/237790/ , https://security.stackexchange.com/questions/155159/ , https://f5.com/resources/white-papers/the-myth-of-network-ad... , and a lot of other writings in this vein.

Jack5500• 8 years ago

I still think that while the hardware may be ready by now, the software certainly isn't. Not only does an IPv6 break a lot of old software,that's not designed for the stack. Even today, not all network librarys do support IPv6. It's nothing that can't be worked out, but we are just not there yet and will never be there until a forced adaption comes into play.

gigatexal2• 8 years ago

Couldn’t you get rid of nat altogether with ipv6?

mehrdadn11• 8 years ago

Not if you want to keep its benefits. See discussion below.

mehrdadn11• 8 years ago

I'm surprised security and privacy weren't mentioned. In the current state of affairs (no, I'm not talking about some ideal utopia with IPv6 perfection where fifty quintillion additional RFCs have been finally deployed and battle-tested world-wide; I'm talking about IPv6 as available to the ordinary user /today/) I simply do not trust using IPv6 to provide as much security or privacy as IPv4. More than happy to change my mind when (...if?) the technology moves forward 10 years from now, but I just can't see it working right now. Sorry.

ge0rg• 8 years ago

It is really sad to see that essentially all security issues of IPv4 were inherited, at least on the LAN level. However, besides of the "firewall protection" provided by NAT, which is largely mirrored as "outgoing connections only" in ipv6 deployments, I fail to see how it actually makes security worse. Do you have examples for what you had in mind?

mehrdadn11• 8 years ago

The one you excluded (why?) is a pretty darn big one. It means for example that a random hacker would have a hell of a hard time spontaneously reaching my phone via the cellular data connection... or the WiFi connection for that matter, since that's NAT'ed too. Which reduces the attack surface immensely. I don't see why even this by itself would be insufficient reason...

neojima2• 8 years ago

As others have said, most major operating systems implemented RFC4941 (IPv6 Privacy Extensions) years ago. Unless you're using unmaintained OSes (in which case you shouldn't be complaining about security), what privacy implications are you calling out?

alex_duf• 8 years ago

Yet adoption is still growing exponentially https://www.google.com/intl/en/ipv6/statistics.html

It's not as fast as past me would have hoped for and I think the criticism is perfectly valid but I'm quite happy to look at this graph no and again

mino2• 8 years ago

Not really, see slide 4 of Geoff Huston's talk at RIPE76:

https://ripe76.ripe.net/wp-content/uploads/presentations/9-2...

It is actually growing slower and slower and looking as a logistic curve, which is perhaps unsurprising. Also note the increasing gap between weekdays and weekends, which is a sign that enterprises don't care about v6.

tinus_hn• 8 years ago

Enterprises move very slowly and don’t implement unnecessary changes. Unsurprising indeed.

pwinnski• 8 years ago

That entire presentation is worth going through. The conclusion is great.

singularity20012• 8 years ago

Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)?

neojima2• 8 years ago

In 2005 or so, sure. Now...not so much?

What privacy erosion/easier tracking are you talking about that wasn't remedied by the very wide deployment of RFC4941 (IPv6 Privacy Extensions) in operating systems?

singularity20012• 8 years ago

with IPv4 my ISP has to shuffle IPs with every reconnect. with IPv6 you could get one IP for lifetime?

rektide• 8 years ago

Google offering no ipv6 networking options in their cloud is one giant dick of a blocker. Screw this. Immoral awful cataclysmic prevention of us getting better at #ipv6. Wtf Google. https://issuetracker.google.com/issues/35904387

Blockers to IPv6 Adoption

Related Stories