Hacker News

I have looked into acquiring an ipv4 block many times but never came across this. Thanks for the lead!

Sure there's historic reason that the DoD has such a large block, but it is definitely unfair in the modern world. There is no way they need or will ever use their massive block of addresses. They have 13 different /8 blocks, ~218 million unique addresses, that's over 5% of the entire IPv4 address space.

I have no deep ip knowlede, but if the companys do not use those addresses , cant we just use them an snatch away those unused addresses?

I'd love to do that, if my ISP would provide me an IPv6 address. Windstream doesn't provide IPv6s. They did a trial a few years ago rolling it out and then undid it.

It's crazy I can get fiber to my house in the US, but not IPv6.

My ISP is only a few years old, but they don't support IPv6 at all. And when I complain about it to support, their response is basically "we don't see the point".

This is an interesting take, however from what I seen its other way around. Most security conscious operators would only allow IPv4 instead of IPv6. Your ACL rules and tools are still better at handling/managing IPv4 compared to IPv6

> IPv4 is old and broken

IPv4 is old, very old. But how is it broken? It's literally been working just fine since it came out.

That there are limited addresses is something else: it doesn't mean it's broken.

I don't care that spying/surveillance devices have more trouble spying on me with IPv4 than with IPv6 and I don't care that some apps have a harder time establishing connection.

IPv4 works. SSH over IPv4 works. Browsing the Web over IPv4 works.

There is no need for that, every modern OS prefer IPv6 over IPv4

Early bad experiences made a lot of people reluctant to try again.

There's a lot of edge cases to bite people still.

That said, something like 50% of users have working v6 now, which helps to file down the edges. Growth of v6 in the last 10 years has been much more significant than the previous 10 years. I suspect the next 10 years will be pretty significant, too.

I don't think many organizations are in a position to force adoption though.

You have mandates from say US government for government services and vendors and similar in some other countries. Some countries can force it through strong regulations on equipment sales. And then there's Jio (and maybe other ISPs) that have significant market power in some locales and a significant lack of v4 resources and can strongly encourage vendors and partners to support v6 for better service to users on their network.

A large chunk of IT people don't understand it. So they don't demand it from their vendors. The vendors see the lack of demand so they spend fewer resources on it. When someone wants to implement IPv6, they see the limited vendor support and decide against it.

The last three companies I've worked at have all been IPv4 only. I set up IPv6 in our lab, but neither the SCADA software nor the PLCs we use support it at all, and none of my coworkers can troubleshoot it if problems pop up.

I've got a buddy that's a technical manager at an ISP and he'll straight up tell you they don't do IPv6 because he and his people don't know it.

We're 10 years out from the Epochalypse as well. Past a certain point you need a governing body to intervene to force the issue in advance of problems with systems, and we've got a dearth of functioning governments these days.

IPv6 brings more address space but also a whole bunch of other stuff, it is much more complex and changes basically everything to how you manage a network. The fact that it's not been widely adopted after 30 years indicates that people generally think the tradeoff is not worth it.

From my readings and limited experience, it's two things.

First, IPv6 in the 90s and 00s is different from IPv6 today. Various extensions and standards have been added that make IPv6 administration easier than it was in the early days. I want to say RDNSS is one of them. Background: one of v6's early selling points was SLAAC, where DHCP could be disposed of and endpoints would auto-configure their own IPs in accordance with the network announced by a router. Problem is, without DHCP, there was no way to get DNS, and DHCPv6 wasn't widely deployed/it was discouraged... so how does one get a DNS server automatically? RDNSS came around to announce DNS servers from the router directly.

TLDR: Early IPv6 sucked more than today.

Second, it's simply a chicken-and-egg problem, particularly at the consumer network level. User-friendly IPv6 router configurations are still rare for home routers, and ISPs have simply dragged their feet. At this point, if we're going to have government mandating all manner of things for consumer products, we should be mandating IPv6 support on home routers and that ISPs delegate at least a /60 to each customer.

You mustn't be on HN very often. People constantly complain about IPv6 being less secure because it doesn't have NAT. And that's part of the reason. Fear and misinformation keeps demand low. The same people don't drive IPv6 implementation where they work, so their fear impacts more than 1 person.

Attempts to force it get routed around.

Fascinating. The resellers, particularly TechSavvy have ipv6. For TechSavvy I believe it was dynamic /64 by default but static /56 for free on request.

It's something I've only recently been made aware of as well. Shocked we're not seeing more push for ipv6 everywhere given that it sounds common enough. If I don't have an IP address, I'm not getting the Internet I'm paying for; I'm getting access to a network that happens to itself have a connection to the Internet. Not unlike some of the BBS's in the early 90s which had Internet access -- I might be dialed in, but that didn't mean my computer itself was on the Internet.

I can't tell if this is sarcasm, Poe's law and all.

But if you are living in a Western country, then you are probably blessed with CGNAT-free residential internet.

>Meanwhile in Europe it's near universal

False: https://stats.labs.apnic.net/ipv6

Unless I've missed something, the US only mandates it for government networks. I don't think there is any mandate for private entities to implement it.

I wish, just 37.73% of IPv6-capable users in Europe according to APNIC despite much higher availability in transit AS. Highest subgroup is Western Europe at around 72.09%, which is still far from near universal. Similar per-country numbers from Cisco.

and one of the countries has an over-reported while the other is underreporting

On the other hand, sometimes you get randomly banned due to someone else’s action on the CGNAT IP. Wikipedia is an obvious example.

Sure, around 50% is a worldwide estimate.

ah yeah, golden times of crawling google when they actually didn't monitor ipv6 traffic properly against scraping (seo monitoring tools were first to drive 'adoption', lol)

I wonder how they measure.

> ...IPv6-only should be plug-and-play by now.

The obsession about "IPv6 only" has never made sense to me. Any decent firewall software will let you write rules that apply regardless of IP version. The "software complexity" argument is bunk... you already have v4 and v6 IP implementations in your OS, and every major OS has provided IP-version-agnostic socket interface code for much more than ten years. If you are using software that is IPv6-capable, it's very likely that it's using IP version agnostic library functions.

Unless stewardship of the Internet is wrested from the hands of the responsible, level-headed type of folks that run it now and transferred to the hands of folks who think nothing of making backwards-incompatible changes every six months, IPv4 won't stop running across the Internet within the lifetime of anyone who's currently reading HN. This delay is fine. The only thing about IPv4 that's a problem is that its address space is 32 bits wide. Had it been defined with a 128+ bit address space, we wouldn't have seen another version of IP on the Internet. Now that IPv6 is around to reduce address pressure, there's no big need to do anything about IPv4.

That's very surprising. Cloudflare supports ipv6 and it would be surprising if only 10% of websites you visit use Cloudflare.

Cloud providers and hosters seem to have the least interest in implementing IPv6. Sitting on a huge supply of IPv4 addresses gives them a competitive advantage. So they try to disable IPv6 as a default.

Last time I was in a California hotel, it had IPv6 just fine. That was 2012. Perhaps you choose the wrong hotels :-)

> IPv6 is dead. Nobody cares about it.

Except for everyone on T-Mobile US:

* https://www.youtube.com/watch?v=d6oBCYHzrTA

Or all of FaceMeta's internal infrastructure:

* https://engineering.fb.com/2017/01/17/production-engineering...

Or 86% of France:

* https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...

Okay, if you say so. Hotel Wifis are known for being on the bleeding edge of technology, and as the main innovator pushing new internet technology. Everything starts with hotel Wifis. /s

one is close to hundreds of millions in cost and with likeminded stakeholders. the other is hundreds of trillions in costs with the entire human population as stakeholders.

but climate change is not up to the tech industry

This is quite similar situation indeed. It was once easier to adopt the metric system when the infrastructure was not yet as developed around the previous ones.

Austria-Hungary adopted the metric system in the 1870s. Back then: no cars, no highways, no speeding laws etc. Oxen-drawn wagons in the countryside were not built to a precise spec.

Only the railway, the architects and the artillery had to really switch. Ordinary people would still ask the grocer for half a pound of ham in the 1930s.

USA in the 1970s would have to remeasure all the land communications etc., or end up with a weird hybrid like the UK.

WHat we have in IPv4 and IPv6 is the weird UK-like hybrid...

IPv4 is better than IPv6, and imperial is better than metric. I would like something to replace IPv4, but that thing shouldn't be IPv6 and probably won't be at this rate.

If you have a dedicated IPv4 address, those behind NAT and CGNAT face significant throttling and false positive blocking. It's been made worse by scraper botnets.

  https://en.wikipedia.org/wiki/End-to-end_principle

> IPv4 is perfectly and objectively fine on internal networks. IPv6 is overkill and way too complicated for most.

Unless there's a merger/acquisition and the two companies both use 10.0.0.0.

Most home networks use 192.168, and so you can't use that in corporate environments, because the WFH people who VPN in could then have routing snags between local and remote locations.

Also, in your VPN software be sure to perhaps not use 172 addresses (like my previous job did), as some of those ranges are used by Docker by default, and so you can cause issues for developers.

But other than that IPv4 RFC 1918 is not complicated at all…

You can't selectively use IPv6 in the WAN and IPv4 in the LAN.

How would an IPv4 client send a packet to an IPv6 server? The IPv4 packet has only 4 bytes to spare for the destination address.

You can't.

Anything longer, even if it's just 1 bit, would require a new IP version.

Alternatively, IPv4 simply does not scale effectively on the LAN, whereas IPv6 allows much simpler addressing and routing topologies. Simple = good.

> No, backwards compatibility is competence.

Creating an IPng was always going to be complicated:

      So it's a matter of mathematical and physical fact that to expand
      the address size, you must change the protocol, and that means 
      [three] things immediately:

            You have to change the version number.

            You have to add new code to handle the new version.

      […]

            You need a coexistence technique so that updated systems, 
            with the new protocol, can connect to old systems that know 
            nothing of the new protocol.

      Two minutes of thought show that this third requirement has only 
      two solutions:

            (3A) Dual stack, in which the new machines speak both 
                 the old (IPv4) and new (IPng) protocol.

            (3B) Translation, in which something translates addresses
                 between the old and new protocols.

* https://datatracker.ietf.org/doc/html/rfc1671

For anyone curious as to the decision-making process, here are the criteria for what the IETF was looking for in an IPng:

* https://datatracker.ietf.org/doc/html/rfc1726

Here are the candidates that were floating around at the time, and the reason why the winner was chosen:

* https://datatracker.ietf.org/doc/html/rfc1752

It's impossible for a long address system to be compatible with a short address system. No one has ever found a way to make it work. Plenty of people think they have, but upon closer inspection, they haven't.

NAT is the only one that actually does work, and it's terrible.

Yep. IPv6 should be thought of as 2^64 subnets, each with "enough space for everyone" within each subnet.

> IMO, IPv6 solved the address pool size part of the issue, but it made managing the v4 to v6 transition very painful.

There is no easy way to transition from IPv4 to any kind of IPng; see my other comment:

* https://news.ycombinator.com/item?id=50288091

You can still control access. Most home routers have firewalls that work a lot like V4 port forwarding except they don't have to maintain NAT tables or use as much CPU .

Perhaps I am being uncharitable, but I don't see what's interesting about it at all. Visualizing IPv4 against population (or maybe GDP) would have been far more illuminating.

NAT is the solution so far

> Absolutely not. Existing IPv4 hardware and software expects addresses to be 4 bytes long.

As does DNS.

"A" records are fixed at 32 bits, so you have to add a new record type and update all DNS software, plus user-space API/library code and data structures to ask for and store the new record type.

Just like IPv6.

There is no "just" adding more addresses: whatever scheme anyone comes up with is the same amount of work as IPv6.

* https://github.com/becarpenter/misc/blob/main/why6why.md

For every complex and difficult problem, someone has an easy, simple and wrong solution. Usually the presence of "just" is a good clue.

The set of all ip hardware and software is much much larger than just what currently exists, as it includes all hardware and software that is yet to be produced. Said another way, it’s a foolish consistency.

128 innit? Otherwise your /64 would have no subnets.

Not using hex is a plus I guess?

It's always the same with those "I hope IPv6 were just IPv4 with more octets" proposals on Hacker News, aka Godwin's law of the Internet Protocol.

It turns out when you ignore the hardest part of the problem, you can always make a good-looking proposal!

It’s a draft RFC.

There's still quite a few pockets of the industry where IPv6 just isn't available. Industrial control systems, for instance - there's lots of PLCs and SCADA software that are still IPv4-only. It's changing slowly, but industrial computing runs on thirty year time scales and there's still a lot of stuff out there that won't even run on modern operating systems. We use 32-bit Windows XP VMs or sometimes even FreeDOS for some of the software we use.

Kids these days can fit 64-bits into a 3-bit hole, and if you squint hard enough it still sounds like a robot. Amazing times, I tell you.

You just drop the top half. Or xor it? That'd make for some nice traffic-pattern art ;)

Now the reason this doesn't work is that the address length is not encoded, so if you make the address longer, no one knows about it and they [routers and destinations] just assume the wrong address and send it on or discard the frame

I can read one at a glance and the other makes me fill in the blanks myself after having to count how many invisible blanks I need to fill in.

Of all the sins of IPv6, its tied between using ':' as the separator, and the god awful '::' "just skip writing the address because we made them too fucking big lol"

Wouldn't have been a problem if they hadn't given every square millimeter of the planet 100 billion addresses.

Everything in v6 was for a good reason, but it was targeting now-outdated use cases. Separately, there's no good migration path from v4. They should've kept the v4 address blocks in v6, and following the natural consequences of that, it'd be way easier to migrate. But they didn't do this with v6 because they were trying to solve the address fragmentation issue upfront, which again had valid reasoning but in hindsight wasn't the right move.

Not really, it assumes people will make IPv5 devices without a reason to. If you can get them to make IPv5 you can use the same mechanism to get them to make IPv4/6 dual-stack.

Not really. My home IP is 71.177.17.171, how do I get an equivalent v6 that gets routed directly to me? NAT64 and 6to4 don't do this.

There already is a subnet. Actually a few. ::ffff:192.168.0.1 is reserved for when you need to pass an ipv4 address through an ipv6 API (e.g. v6 client application on a dual-stack OS on a dual-stack network) and 64:ff9b::192.168.0.1 is reserved as an actual address for NAT64 gateways to use (v6-only client, network has a NAT64 gateway somewhere on it)

I thought IPv5 was a protocol designed for telecoms to route voice data over packet networks, though? It wasn't supposed to be a replacement for IPv4.

And fix all vulnerabilities while we're at it.

Amsterdam, specifically Science Park, is basically the biggest internet hub in Europe. Frankfurt is second. A lot of stuff is there. It also helps they don't have overly strict policing like in Germany.

> I don't know much about your imaging servers: Do they accept incoming https connections, or is it some other kind of TCP or UDP protocol?

Yes

>why do you need to stick with IPv4?

To support devices and routes that do not have ipv6 support?

>1: If you require IPv4, that needs to be part of the contract with your ISP. If they just arbitrarily turned you off, it means that you didn't contract for the services you thought you had.

That is correct in principle. Although, in the absence of a contract, if a service has been provided for a long time in one way, I'd say there's an argument for breach of contract when that way changes for the worst.

Another argument for breach of contract, which can work jointly with the previous, are industry standards, as far as they define the terms that are implied by common words like "internet connection".

Finally, there's the specifications themselves, since the service is billed as "internet", one can refer to the Internet Protocol Specification, although if they do offer IPv6, that might be reasonably considered a substitute, it is a material change that was not agreed to originally (this being a pre IPv6 contract). That said, an IPv4 with a local address might technically still be defined as internet, what is broken in this case is TCP, not the IP, although by lacking a public IP address, TCP is broken via an IP protocol failure, so there's an argument that something is being sold as Internet but it isn't really internet, there's no written contract necessary, the term used to describe the product creates the contract in the same way that selling a carton labeled Milk would create a contract based on milk coming from mammaries of a domestic mammal, and not pressed Soy Juice with artificial coloring.

>2: IPv6 is supposed to solve a lot of these problems... So again, why can't you move to IPv6?

I'm open to proposals to moving IPv6, I'm not content with having that be forced and removing it from people and institutions, if there's a shortage, then that means no new IP addresses can be issued, why are we normalizing the removal of IPv4 addresses? Are they being removed from lower priority users in order to serve high priority usecases? If so is a hospital a low priority user?

The main issue with IPv6 seems to be IPv6 proponents that try to kill IPv4, no one will migrate if you force them to, if you propose, we will consider.

>You're a hospital.

I work for the hospital, occasionally, they are my client.

> You have an actual contract with the ISP, right?

They do not, it's an implied consumer contract, like when someone buys a hot dog from a stand.

I'd like a written contract too, but when trying to negotiate one, they want a lot more money for them, it depends of the nuances of the terms, but I've talked to sales reps, and it comes down to having a 1Gbps line that works right now vs a 100Mbps line that's more expensive, with the only difference being that the contract is now written and there's a symbolic SLA with some 10% penalty, and a single professional beration receiver instead of multiple anonymous on call rotation.

It's not a clear choice, especially considering that the dedicated route with SLA means introducing change risk to the operational and SLA benefit of the ISP, fiber, new holes, new lines, etc..

>You could also update to IPv6.

I would, they don't offer IPv6

>You don't need an address block from an RIR. You just need your ISP to give you an address.

Yeah, maybe. If I get an IPv4 block though what I'd do is a regional entity whether for profit or NFP to offer emergency regional tunneling, potentially while finding alternative revenue streams like collecting lists of wronged ISP customers and notifying them of class action lawsuits they may participate in. A 25K check, or a 5K check with an ipv4 block and I'm golden.