Hacker News Reader

Hacker News

Comment by shmde | Hacker News Reader

Parent Full thread

shmde

Are there any advantages to IPv6 other than more addresses ?

View on HN

In theory, IPv6 could be slighty faster over IPv4.

https://superuser.com/questions/1055584/how-does-ipv6-affect...

- Smaller headers

- Simpler routing

v6 actually has longer headers on average (40B instead of 20B) but is generally more efficient to process because it's a fixed header length.

ON the other hand, theoretically IPv4 header length could vary depending on the presence of IP options, so you'd need to compute the offset to continue processing the packet.

(I say theoretically because conventional wisdom is that IP options are unreliable in the face of middleboxes, so they're mostly unused. But compliant IPv4 processors have to calculate the header size anyways...)

And no CGNAT which should make a bigger difference. Xbox live supported IPv6 for years because gamers really care about latency.

"More addresses" has a handful of knock-on benefits; or, perhaps more accurately, ipv6 would let greenfield systems skip out on some workarounds made necessary by not enough addresses.

I just hope ipv6 doesn't have privacy nightmare that 1 device will always get 1 IP. Currently, the isp I use provides dynamic ip, so on every router restart my ip gets changed. If they starts to provide ipv6, I hope they give options to rotate it frequently, so toxic companies like meta, facebook, microsoft can't connect my device & ip.

It rotates about once a day in most operating systems. Called ipv6 privacy extensions. This is of course defeatable, but it provides a nice black hole for a device. It moves on and you can't connect to it anymore.

yeah im not sold by this. i want all of my source traffic to show my gateway as the origin, not my unique end devices.

privacy nightmare

On a protocol level, there is nothing in ipv6 preventing you from doing NAT. There are only less implementations of that, but it doesn't need buy-in from your ISP, as long as you control the router (and if not, you put a second router behind the first one which has your actual network).

I work for a large online service. We barely need your IP to track you. There are _so_ many other variables sites can use to track you. Even when you switch networks completely.

You're fear of IP tracking is outdated.

It's not a privacy nightmare. You could just run a proxy on your gateway and your connections would legitimately end up coming from it, but it wouldn't actually do much for your privacy.

Rotating the IP to get similar privacy to what NAT/PAT gave you is annoying I know with v6 we need to use DNS but I hate to say it. I miss Nat I hope the just give us nat66.

It only rotates the IP used for outbound connections; you still have a non-rotating IP you can use for inbound.

"This is of course defeatable"

Yes, which is why I don't use IPv6.

https://blog.apnic.net/2022/01/31/defeating-ipv6-prefix-rota...

You are mixing up IPv6 prefix rotation and IPv6 privacy extensions, and you don't seem to take into account that IPv4 from most ISPs is much worse (typically, you get an IPv4 address from your ISP via DHCP and keep it nearly forever, nothing to defeat).

With IPv6 each device getting a unique IP is not a bug but a feature -- what will probably happen is that your ISP will lend out a /64 range to you, which your devices will use to assign a unique IP to themselves. This completely removes the need for NAT (also, keep in mind that a NAT is not a firewall or a security feature). BTW, dynamic IP rotation was never a guarantee and is only used because the pool of IPs were small. Use a VPN to avoid FAANG.

oh perfect for device tracking!!

hope you dont have any tweets that offend your goverment lol

How is it any worse than the current system? Use Tor or I2P.

NAT is not a privacy or security feature. You can treat it like it is, but only at your own risk.

While I understand the sentiment, NAT does so much to protect most users, it should be considered a security feature.

It's really not and here's some of the multiple methods on which NAT can be bypassed because it's not a security feature:

https://www.anvilsecure.com/blog/dhcp-games-with-smart-route...

https://datatracker.ietf.org/doc/html/rfc2993#page-22

https://threatpost.com/remote-attackers-internal-network-dev...

NAT itself doesn't provide any protection at all. You can set up NAT in dozens of different configurations (1:1 NAT comes to mind), but in the way consumer routers generally set up NAT, I can see why you'd say that (despite there being standard ways to forward ports without any user intervention such as uPnP). There's nothing "secure" about NAT.

Not having client devices accessable via unique IPs is a great security feature. Certainly an unintended side effect but NAT is what is dropping unwelcomed incoming traffic on consumer devices.

You mean a firewall? NAT doesn’t have to drop any packets. It can translate unknown flows into broadcast packets, forward them to a set ip (dmz), or drop them. NAT is not a firewall, even if some configurations make it kinda sorta, if you squint, look like one.

I think the argument is about the address origin being overwritten vs forwarded to the destination.

Is about device tracking and privacy

I don't think that works. A router should decrement the TTL of the frame, and thus showing that there is a router between the host device. The linux default is 64 and windows is 128 IIRC, so you can easily deduce the OS just from looking at the TTL. This can tell you whether an ipv4 device is directly connected. From there, you just need to look at IP ID in the packet and figure out which ones are increasing independently to determine individual devices behind the NAT.

So, no. NAT gives you 0 privacy.

Every ISP I know has their routers set to block incoming traffic by default. With most consumer router SIP ALG being defeated easily (NAT slipstreaming attacks etc) I'd argue that NAT is actually worse for security than just a simple firewall.

NAT doesn't.

1:many NAT does.

1:many NAT requires an affirmative choice on where to route incoming packets that aren't part of an existing stream.

In adaptation to that, most attacks are malware spread by email, or attack browser vulnerabilities, or attack services running on network devices, especially remote management systems.

> NAT doesn't.

> 1:many NAT does.

This is technically correct but how often do you really see 1:1 NAT.

It's not even technically correct; it's just wrong.

NAT doesn't make any choices on where a packet gets delivered. For packets that aren't part of an existing steam, NAT will simply not edit the packet. Unless there's a separate firewall that chooses to drop it, the packet will get delivered to whatever IP was already in the destination field, which could be the IP of one of your LAN machines.

> For packets that aren't part of an existing steam, NAT will simply not edit the packet.

A 1:1 NAT should generally just swap IP for IP and not know about streams or ports at all.

> Unless there's a separate firewall that chooses to drop it, the packet will get delivered to whatever IP was already in the destination field, which could be the IP of one of your LAN machines.

I would call that a routing rules error, even in the absence of a firewall.

You can still set up inbound firewall on IPv6, my ISP does it (to my annoyance).

IPV6 is sort of like the new MAC address hardware identifier. An IP for every atom in the universe!

There are a lot more atoms (10^80 or so) than IPv6 addresses (10^38).

How could a device have a hardware-embedded IP address, if the hardware vendor doesn't know which ISP you will use?

> How could a device have a hardware-embedded IP address, if the hardware vendor doesn't know which ISP you will use?

By putting the hardware part in the second half, and the ISP part in the first half.

You know, like how it works by default.

Most devices randomize the second half by default, using RFC3041 and its successors.

They do, these days.

But then why were you asking "how" a device could have a permanent hardware identifier with its address? Just don't implement those optional RFCs.

And the comment you were replying to didn't say it had to be the entire address, and there's no reason for it to be.

That's the issue I have with it, it's not a feature.

It's sad how much has changed in the past 10+ years. I remember arguments advocating for ipv6 for exact reason. 1 device per 1 ip. Back then, it was seen as something great.

I agree with what you said. It's just interesting how it illustrates how different things are now.

> I remember arguments advocating for ipv6 for exact reason. 1 device per 1 ip. Back then, it was seen as something great.

I remember a bunch of people being horrified by the idea of 1 device per IP. I think it's more a matter of who you were around then the group changing their mind, but maybe that happened too.

https://www.thousandeyes.com/learning/techtorials/ipv4-vs-ip...

Another, different take: http://www.networkcomputing.com/networking/six-benefits-ipv6

The first link mentions no more NAT as an advantage, but I think it's actually one of the big issues holding up adoption. Rightly ot wrongly, since the 00's the perception is that sitting directly on the internet with a public address is a big security no-no.

There's an argument to be made that mixing dynamic addresses with the pool of other users of the same ISP is beneficial for privacy.

The fact that peer-to-peer applications can finally start working is an unquestionable advantage.

I assume for mobile operators there are advantages for location roaming. I'm not sure when you change cells if IP stays the same, but must be a routing nightmare.

Ooooh, this is actually fun. Your IP does not change, even when switching from LTE, 3G, 4G and 5G. There's an excellent post in the old Sprint forums where a company network engineer explains how it works. I can't find it though, but it's pretty wild.

In brief, it is because internet connectivity on most cellular networks goes through single gateways and devices are effectively "tunnelling" to those gateways. As long as the tunnel stays up and the mobile device is still identifiable on the RAN then the IP address assigned from the internet gateway doesn't need to change.

What I found especially interesting is how it keeps track of the device, especially when transferring from say a LTE capable station to a station that only supports 3G.

OK so no advantage with IP6?

Reply on news.ycombinator.com