Comment by ghshephard | Hacker News Reader

Comment by ghshephard | Hacker News Reader

The article engages in a little bit of hyperbole with statements like this: "Not only is this a protracted calamity for the Internet".

I work in a lot of regions in the world, (Mexico, UAE), where they've been used to the reality that they won't be assigned any IPv4 addresses. I'm talking about large $Billion+ organizations that made it abundantly clear to me, that the applications we were deploying ($100million plus network deployments) - would have to operate with PAT, or we would not be able to deploy them.

And so we worked around the requirements that we deploy everything on PAT, and our network deployments (sometimes with thousands of IPV4 network elements) would have to operate purely within RFC1918 address space.

Speaking as someone who has worked on million+ IPv6 node deployments, (So I clearly don't have a bias against IPv6) I can say with some certainty that the only "calamity" we are going to see is increased use of PAT on clients, and somewhat more expensive IPv4 addresses for those who need to act as a server. Everyone else will be fine. (Have been fine for years in places where public IPv4 addresses ceased to be available).

The reality is that this lack of pressure to transfer to IPv6 means that we're going to see an extended period of time in which we migrate. It will happen eventually (IPv6 has a lot of awesome features, particularly around self-addressing, and lord is it wonderful not to have to play CIDR addressing games, everything is a ::/64) - but it's going to be a lot longer than most IPv6 advocates would prefer.

> I can say with some certainty that the only "calamity" we are going to see is increased use of PAT on clients, and somewhat more expensive IPv4 addresses for those who need to act as a server.

Quite the calamity if you ask me: Users have to actively ask for the permission to act as a server. And at a significant monetary cost, if I understand the constraints correctly. Sure, right now, nobody has a server at home. But if we did (and this is certainly technically possible), then centralised spying-ridden services such as Gmail, Facebook, and YouTube would be mostly useless. (Assuming peer to peer distribution, you don't need a server farm to scale.)

This would also help with routing by the way, by keeping communications more local.

> right now, nobody has a server at home

I don't think it's that uncommon (and I say that not only because I have one myself). Home routers make it trivial to add one, and NAS boxes are more common than ever. Almost every game and torrent client needs to have ports forwarded (which it a server in the network sense), and UPnP is a "feature" most people have that makes it possible to be unaware of it all.

In the US, every ISP contract I've seen says you're not allowed to run a server from your home. And when they structure your connection to have 50mbps down and 0.5mbps up, that's the enforcement.

And that's a pretty unenforceable contract.

A lot of video-games have the host of a match actually work as a server. NAS as servers. In lots of inter-device applications, one of them works as a server. Oh, right, and Xorg.

What will happen is that IPv4 addresses won't be free anymore, and you'll have to pay a surcharge. This is already happening with some providers. Also, instead of being given a /29, providers will start handing out /32s. I'm not suggesting this is a good thing, but "calamity" isn't the word that comes to mind.

I'm not sure you comprehend the magnitude of the disaster.

Right now, many people, mostly in countries that are lacking in IPv4 allocation, do not have an internet connection.

An internet connection is a public IP. If you're behind a NAT, or something like it, you don't have a public IP, therefore you are not connnected to the internet. You are connected to a private network, which forwards some of your packets to the open internet. And that server thing. No public IP, no server. Not such a big problem when you control the NAT (assuming it's in your router), and can forward some ports. But if you share the same public IP with 50 other customers, it is theoretically impossible to have more than one HTTP server for those 50 people. The practical limit, of course, is zero.

"Magnitude of the Disaster" is the type of hyperbole that doesn't bring clarity to the situation.

I've spent the majority of my working life in the last three years happily accessing the internet, internet services, and I've always been behind a PAT device when in a hotel, serviced apartment, etc...

For example, right now, in my Office in Singapore, my IP address is: 192.168.108.34. And I do all my conferences, whiteboarding, VPNs, etc.. from this office.

Now - back to your scenario - You certainly can share a lot of HTTP Servers on a single IP address - a lot of the customers I've worked with do so using PAT, and, you get very used to the port number being part of the HTTP server address:

I.E. http://www.acme.com:3031

In a ultra-low IP address environment, you have teams with not only IPAM (IP address Management tools), but also Port Address Management - they track who has been allocated to which port.

Now - is this the best case scenario? - No, obviously not - it would be awesome to have a Static IP address, and, there are some scenarios in which I have to have a static IP address - in particular getting IPSec VPNs through PAT can be problematic, so if I want to run a VPN concentrator, I start begging and pleading to get a static IP address. But I know this is going to cost me a lot of money. And that's where I started - once we run out of IPv4 addresses, the market will just start bidding the price of them up. Right now, most ISPs in Singapore will give you a static IP address for $120/year. I expect, as they run out of IP addresses, that price will start to increase - and people who might have opted in for one at $120/year, will probably decline at $500/year - returning those IP addresses back into circulation.

At the same time, if someone is sitting on a /20 that they aren't using very using very much (4,000 addresses) - and those IP addresses have $2million/year of value to other people, they will be highly incentivized to capture that value.

With all that said - was it not wonderful to call Layer 42, and, within 30 seconds, be granted 2001:1868:209::/48 off of their /32 ISP range? Yes, it was. I had 65,000 networks I could play with, each of which had effectively infinite address space. Do I look forward to that the day that is universal, in which every ISP user is immediately granted a /64 without asking, and anybody with a home network gets a /56 without paperwork, and a /48 is available with just a quick, inexpensive surcharge? Yes, also looking forward to that.

But - "Disaster" and "Catastrophe" doesn't capture what will happen if IPv4 takes a few extra years to get traction. The market and people's behavior will adjust.

The disaster is that app developers can't rely on their users being on the internet in the sense of end-to-end addressability in developing new applications. This has major chilling effects on less centralised types of applications, and tilts the tables toward big content providers and "enterprise" users with "intranets" behind centralized firewalls.

IPv6 deployment is massively late, users have already been conditioned into accepting NAT as internet access, even going so far as NAT boxes being called "routers"- even though NAT flatly contradicts the RFC definition of IP router, which are forbidden from doing port/address NAT along with other arbitrary traffic interference.

It's been the case for at least 15 years that app developers couldn't rely on their users being on the internet. It's annoying, and I agree with you has a chilling effect on less-centralized applications, but doesn't rise to the level of "Disaster."

One thing that people need to be precise about, particularly as IPv6 comes online, is the difference between NAT and PAT. I realize that 90%+ of the HN community understand the difference, (NAT changes your Address only, PAT changes your address to a single outbound address, and multiplexes a PORT) but with IPv6 it has a very real significance.

Deployment of PAT in IPv6 is really quite frowned upon, but there a number of very real administrative reason why Network Prefix Translation (NPT, https://tools.ietf.org/html/rfc6296 ) - which is really just stateless NAT, makes sense.

With NPT, you convert the first 64 bits (the "Network"), but leave the last 64 bits (the "Interface") untouched. This gives the inside of your network really good ISP mobility - allowing you to switch to a new ISP at the drop of a hat, without having to worry about any internal renumbering, updating thousands of DNS records, etc... The only DNS records you would need to worry about would be for external connectivity (which is typically orders of magnitude less than internal hosts, and also typically more well documented.

I expect that most forward looking enterprises deploying IPv6 will use some combination of RFC 4193 (Unique Local IPV6 Unicast, https://tools.ietf.org/html/rfc4193, the IPv6 variant of RFC 1918) + RFC 6296 Network Prefix Translation.

> It's been the case for at least 15 years that app developers couldn't rely on their users being on the internet. It's annoying, and I agree with you has a chilling effect on less-centralized applications, but doesn't rise to the level of "Disaster."

My point is, it does. It is not an "end of the wolrd" disaster, but it is an Orwellian one. We're only beginning to realise the insanity behind centralised services such as Gmail. I personally suspected those dangers for a long time, (as did the FSF, the EFF, and many others). Edward Snowden only confirmed some of our worst fears.

That said, the lack of public IP is only half of the catastrophe. The other half is asymmetric bandwidth.

> lord is it wonderful not to have to play CIDR addressing games, everything is a ::/64

/64 is the smallest network, but there are certainly larger aggregates with smaller prefixes.

Honestly, did he say otherwise? "Everything" in his world is "I use /64s everywhere."

"I use /64s everywhere" would be unusual for "someone who has worked on million+ IPv6 node deployments".

I think he's talking from an end-user point of view.

Even from an end user point of view, the recommendation is to assign a /64 for a single network or a /48 for multiple networks. (Assuming 'end user = homeowner' here.)

And, as it turns out, the original recommendation to go with /48s turned out to be insufficiently flexible, and was overridden with https://tools.ietf.org/html/rfc6177.

In particular, some ISPs will hand out a /56 - allowing the home user 256 /64s. But, once again, these are administrative routing decisions - on the interface, it's always a /64 or (in some rare cases - though I'd love to hear if people still see this in the wild) /127s for router-router connections.

You will never, ever see, for example, a /72 IPv6 network in the wild.

Yes - you're absolutely right. There are administrative collections of /32s, /48s, /56s - but when it comes time to lighting up a network interface - it's a /64. Even if I only have two devices on a network segment, (two routers that can perform ND with each other), a place that would have used a /30 in the IPv4 space, I'll light up a /64 and burn the other (2^64)-2 addresses. With the possible exception of some security scenarios in which a /127 might be desirable, there is no "address conservation" requirement to use blocks smaller than a /64.

For those IPv4 network engineers who have a decade+ of jugglings /25s, /26s, /27s, /28s and /29s, and trying to preserve IP space (particularly globally routable), this is nice change of affairs.

Okay, sure, on hosts you're only going to see /64s, but unless I'm seriously misunderstanding something, anyone dealing with route aggregation is going to have to deal with smaller prefixes.

And even just talking about "this is global unicast space", "this is 6to4 space" and "this is link local space" involves small prefixes. So, for example, you still need to do the same mental juggling to know that 2000::/3 is 2000... to 3fff....

Agreed. You can't get away from network blocks at the administrative routing level. But, at least life is a bit easier by making more common use of /48s and /32s - I.E. 2001:1868::/32 being 2001:1868:0000:0000::/64 -> 2001:1868:FFFF:FFFF::/64.

Thankfully, the 100x more common task of configuring an interface, will always be a /64.

Reply on news.ycombinator.com