Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-24 Thread John R. Levine
How long, exactly, do you expect 3.2 billion unicast addresses to provide enough addressing for 6.8+ billion people? Oh, I'd say a decade. Like I said, I have IPv6 on my server and my home broadband, which mostly works, with the emphasis on the mostly. We've just barely started to move

Re: misunderstanding scale

2014-03-24 Thread Owen DeLong
On Mar 22, 2014, at 3:49 PM, Nick Hilliard n...@foobar.org wrote: On 22/03/2014 19:35, Justin M. Streiner wrote: CGN also comes with lots of downside that customers are likely to find unpleasant. For some operators, customer (dis)satisfaction might be the driver that ultimately forces them

Re: misunderstanding scale

2014-03-24 Thread William Herrin
On Mon, Mar 24, 2014 at 8:05 PM, Warren Bailey wbai...@satelliteintelligencegroup.com wrote: FYI He tells everyone they¹re cute. Don¹t buy his tricks, he doesn¹t call back the next morning. Ps. Take it easy on each other. It¹s the beginning of spring.. Head outside.. Spring!? Snow is in

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-24 Thread Owen DeLong
On Mar 22, 2014, at 10:10 PM, John Levine jo...@iecc.com wrote: It will be a long time before the price of v4 rises high enough to make it worth the risk of going v6 only. New ISP's are born everyday. Some of them will be able to have a Buy an ISP that has IPv4 or Buy IPv4 space from

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-24 Thread Owen DeLong
On Mar 23, 2014, at 11:09 AM, Mark Tinka mark.ti...@seacom.mu wrote: On Sunday, March 23, 2014 06:57:26 PM Mark Andrews wrote: ISP's have done a good job of brain washing their customers into thinking that they shouldn't be able to run services from home. That all their machines shouldn't

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-24 Thread Bob Evans
I agree with one thing herein In order for IPv6 to truly work, everyone needs to be moving towards IPv6. Yep, chicken and the egg. I agree. We built an IPv6 native network - no tunneling - no customers to speak of ... didn't even bother to start IPv6 peering on it. Maintaining dual

Re: IPv6 Security [Was: Re: misunderstanding scale]

2014-03-24 Thread Owen DeLong
On Mar 23, 2014, at 2:45 PM, Paul Ferguson fergdawgs...@mykolab.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 3/23/2014 2:27 PM, Timothy Morizot wrote: On Mar 23, 2014 11:27 AM, Paul Ferguson fergdawgs...@mykolab.com mailto:fergdawgs...@mykolab.com wrote: Also, IPv6

Re: misunderstanding scale

2014-03-24 Thread Owen DeLong
On Mar 23, 2014, at 5:24 PM, Mike Hale eyeronic.des...@gmail.com wrote: I wasn't aware that calling out FUD was derisive, but whatever. It's derisive because you completely dismiss a huge security issue that, given the state of IPv6 adoption, a great majority of companies are facing. I

Re: misunderstanding scale

2014-03-24 Thread Michael Thomas
On 03/24/2014 06:05 PM, Owen DeLong wrote: So ULA the printers (if you must). That doesn’t create a need for ULA on anything that talks to the internet, nor does it create a requirement to do NPT or NAT66. From a security perspective, I wouldn't trust my printer to not number itself with

Re: IPv6 Security [Was: Re: misunderstanding scale]

2014-03-24 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 It is unsettling to see such dismissive attitudes. I'll leave it as an exercise for the remainder of... everywhere to figure out why there is resistance to v6 migration, and it isn't just because people can't be bothered. Your customers are your

Re: misunderstanding scale

2014-03-24 Thread Owen DeLong
Your attack surface has already expanded whether or not you deploy IPv6. Not so. If I don't enable IPv6 on my hosts, the attacker can yammer away via IPv6 all day long with no result. If that were true, yes. The reality is that to make that a true statement, you would have to modify it to:

RE: IPv6 Security [Was: Re: misunderstanding scale]

2014-03-24 Thread Naslund, Steve
I can easily answer that one as a holder of v4 space at a commercial entity. The end user does not feel any compelling reason to move to ipv6 if they have enough v4 space. I can't give my employer a solid business case of why they need to make the IPv6 transition. They already hold enough v4

Re: misunderstanding scale

2014-03-24 Thread Owen DeLong
On Mar 23, 2014, at 11:38 PM, Mark Tinka mark.ti...@seacom.mu wrote: On Sunday, March 23, 2014 09:35:31 PM Denis Fondras wrote: When speaking of IPv6 deployment, I routinely hear about host security. I feel like it should be stated that this is *in no way* an IPv6 issue. May the device be

RE: misunderstanding scale

2014-03-24 Thread Naslund, Steve
Exactly right. In fact that is generous because the v6 host having a stateful firewall has a real protocol aware firewall (and often bundled IDS/IPS capability) not just a NAT to protect him. The NAT provides almost no security once a single host behind the NAT is compromised and makes an

Re: misunderstanding scale

2014-03-24 Thread Owen DeLong
On Mar 24, 2014, at 9:20 AM, William Herrin b...@herrin.us wrote: On Mon, Mar 24, 2014 at 3:00 AM, Karl Auer ka...@biplane.com.au wrote: Addressable is not the same as accessible; routable is not the same as routed. Indeed. However, all successful security is about _defense in depth_. If

Re: misunderstanding scale

2014-03-24 Thread Owen DeLong
On Mar 24, 2014, at 9:21 AM, William Herrin b...@herrin.us wrote: On Sun, Mar 23, 2014 at 11:07 PM, Naslund, Steve snasl...@medline.com wrote: I am not sure I agree with the basic premise here. NAT or Private addressing does not equal security. Hi Steve, It is your privilege to

Re: misunderstanding scale

2014-03-24 Thread Valdis . Kletnieks
On Tue, 25 Mar 2014 02:47:31 -, Naslund, Steve said: Lots and lots of enterprises count on a hard perimeter and almost nothing behind it so once I am in behind your NAT, you are unlikely to notice it until something real bad happens. That is the state of most enterprise network security

Re: misunderstanding scale

2014-03-24 Thread Owen DeLong
On Mar 24, 2014, at 9:36 AM, Alexander Lopez alex.lo...@opsys.com wrote: not to mention the cost in readdressing your entire network when you change an upstream provider. Nat was a fix to a problem of lack of addresses, however, the use of private address space 10/8, 192.168/16 has

Re: misunderstanding scale

2014-03-24 Thread Owen DeLong
On Mar 24, 2014, at 10:35 AM, Laszlo Hanyecz las...@heliacal.net wrote: On Mar 24, 2014, at 5:05 PM, Patrick W. Gilmore patr...@ianai.net wrote: On Mar 24, 2014, at 12:21, William Herrin b...@herrin.us wrote: On Sun, Mar 23, 2014 at 11:07 PM, Naslund, Steve snasl...@medline.com wrote:

Re: misunderstanding scale

2014-03-24 Thread George Herbert
On Mon, Mar 24, 2014 at 8:02 PM, Owen DeLong o...@delong.com wrote: On Mar 24, 2014, at 9:21 AM, William Herrin b...@herrin.us wrote: On Sun, Mar 23, 2014 at 11:07 PM, Naslund, Steve snasl...@medline.com wrote: I am not sure I agree with the basic premise here. NAT or Private

RE: misunderstanding scale

2014-03-24 Thread Alexander Lopez
On Mar 24, 2014, at 9:36 AM, Alexander Lopez alex.lo...@opsys.com wrote: not to mention the cost in readdressing your entire network when you change an upstream provider. Nat was a fix to a problem of lack of addresses, however, the use of private address space 10/8, 192.168/16 has

RE: misunderstanding scale

2014-03-24 Thread Alexander Lopez
-Original Message- From: Naslund, Steve [mailto:snasl...@medline.com] Sent: Monday, March 24, 2014 10:48 PM To: Owen DeLong; mark.ti...@seacom.mu Cc: nanog@nanog.org Subject: RE: misunderstanding scale Look at it this way. If I see an attack coming from behind your NAT, I'm

Re: misunderstanding scale

2014-03-24 Thread Mark Andrews
In message f0ca01f52b274d13ad84dbfe6aad2...@bn1pr04mb250.namprd04.prod.outlook .com, Alexander Lopez writes: On Mar 24, 2014, at 9:36 AM, Alexander Lopez alex.lo...@opsys.com wrote: not to mention the cost in readdressing your entire network when you change an upstream provider.

Re: misunderstanding scale

2014-03-24 Thread hslabbert
Lopez alex.lo...@opsys.com wrote: -Original Message- From: Naslund, Steve [mailto:snasl...@medline.com] Sent: Monday, March 24, 2014 10:48 PM To: Owen DeLong; mark.ti...@seacom.mu Cc: nanog@nanog.org Subject: RE: misunderstanding scale Look at it this way. If I see an attack coming from

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Mark Tinka
On Sunday, March 23, 2014 07:10:37 AM John Levine wrote: In Africa, I suppose, but here in North America, the few remaining ISPs that aren't part of giant cable or phone companies are hanging on by their teeth. Incidentally, this doesn't apply to Africa today, because AFRINIC still have lots

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Tore Anderson
* John Levine Also, although it is fashionable to say how awful CGN is, the users don't seem to mind it at all. You might just be looking in the wrong places. Try searching for playstation nat type 3 or xbox strict nat. Tore

Re: misunderstanding scale

2014-03-23 Thread Nick Hilliard
On 23/03/2014 03:00, Doug Barton wrote: Hyperbole of the past doesn't negate the reality of the future. :) the past and present hyperbole continues to grate. With respect I think you're ignoring some pretty important facts. Not the least of which is the level of pressure that's been taken off

Re: misunderstanding scale

2014-03-23 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 3/23/2014 9:13 AM, Nick Hilliard wrote: yep, agreed - doing ipv6 now is a sensible business proposition. But it needs to be tempered with the realisation that for nearly all networks, ipv6 is complementary to ipv4 and not a replacement; nor

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Mark Andrews
In message 20140323051037.94159.qm...@joyce.lan, John Levine writes: It will be a long time before the price of v4 rises high enough to make it worth the risk of going v6 only. New ISP's are born everyday. Some of them will be able to have a Buy an ISP that has IPv4 or Buy IPv4

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Mark Tinka
On Sunday, March 23, 2014 06:57:26 PM Mark Andrews wrote: ISP's have done a good job of brain washing their customers into thinking that they shouldn't be able to run services from home. That all their machines shouldn't have a globally unique address that is theoritically reachable from

Re: misunderstanding scale

2014-03-23 Thread Bryan Socha
First, there may be those that do not require IPv6 due to size. So what is YOUR big plan to connect all those on IPv4 to the rest of the IPv6 world that has dropped IPv4 addresses. We'll be offering v6 standard really soon. It's growth that got in the way both from employee bandwidth and

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Philip Dorr
On Mar 23, 2014 1:11 PM, Mark Tinka mark.ti...@seacom.mu wrote: On Sunday, March 23, 2014 06:57:26 PM Mark Andrews wrote: I was at work last week and because I have IPv6 at both ends I could just log into the machines at home as easily as if I was there. When I'm stuck using a IPv4 only

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Laszlo Hanyecz
On Mar 23, 2014, at 4:57 PM, Mark Andrews ma...@isc.org wrote: Basically because none of them have ever been on the Internet proper where they can connect to their home machines from wherever they are in the world directly. If you don't know what it should be like you don't complain

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Saku Ytti
On (2014-03-23 20:09 +0200), Mark Tinka wrote: I expect this to change little in the enterprise space. I think use of ULA and NAT66 will be one of the things enterprises will push for, because how can a printer have a public IPv6 address that is reachable directly from the Internet,

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Mark Andrews
In message 201403232009.47085.mark.ti...@seacom.mu, Mark Tinka writes: On Sunday, March 23, 2014 06:57:26 PM Mark Andrews wrote: ISP's have done a good job of brain washing their customers into thinking that they shouldn't be able to run services from home. That all their machines

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Mark Tinka
On Sunday, March 23, 2014 08:27:57 PM Philip Dorr wrote: That is what a firewall is for. Drop new inbound connections, allow related, and allow outbound. Then you allow specific IP/ports to have inbound traffic. You may also only allow outbound traffic for specific ports, or from your

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Mark Tinka
On Sunday, March 23, 2014 08:30:21 PM Laszlo Hanyecz wrote: As far as the enterprise side of things, many of the people working in that area today have likely never known any other kind of network except the NAT kind. A lot of these guys say things like 'private ip' and 'public ip' -

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Mark Tinka
On Sunday, March 23, 2014 08:35:48 PM Saku Ytti wrote: Or IT isn't buying the 'renumbering is easy' argument, for any non-trivial size company even figuring how where exactly can be IP addresses punched out statically would be expensive and long process. If you are pushing for customer to

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Mark Tinka
On Sunday, March 23, 2014 08:39:51 PM Mark Andrews wrote: Can I suggest that you re-read what I said. I did not say WILL BE REACHABLE. I said THEORETICALLY REACHABLE. I also said GLOBAL UNIQUE address not PUBLIC ADDRESS. The point is one should be able to get addresses with these

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Cb B
On Sun, Mar 23, 2014 at 11:27 AM, Philip Dorr tagn...@gmail.com wrote: On Mar 23, 2014 1:11 PM, Mark Tinka mark.ti...@seacom.mu wrote: On Sunday, March 23, 2014 06:57:26 PM Mark Andrews wrote: I was at work last week and because I have IPv6 at both ends I could just log into the machines

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Mark Tinka
On Sunday, March 23, 2014 09:05:54 PM Cb B wrote: i would say the more appropriate place for this policy is the printer, not a firewall. For example, maybe a printer should only be ULA or LLA by default. i would hate for people to think that a middle box is required, when the best place

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Cb B
On Sun, Mar 23, 2014 at 12:13 PM, Mark Tinka mark.ti...@seacom.mu wrote: On Sunday, March 23, 2014 09:05:54 PM Cb B wrote: i would say the more appropriate place for this policy is the printer, not a firewall. For example, maybe a printer should only be ULA or LLA by default. i would hate

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Mark Tinka
On Sunday, March 23, 2014 09:24:35 PM Cb B wrote: My hope is that folks stop equating firewalls with security, when the first step is to secure the host, accountability is with the host, then layer other tools as needed. I couldn't agree more. As an example, your home PC (whose OS wasn't

Re: misunderstanding scale

2014-03-23 Thread Denis Fondras
Hi all, Le 23/03/2014 20:13, Mark Tinka a écrit : On Sunday, March 23, 2014 09:05:54 PM Cb B wrote: i would say the more appropriate place for this policy is the printer, not a firewall. For example, maybe a printer should only be ULA or LLA by default. I would support adding security

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Nick Hilliard
On 23/03/2014 18:39, Mark Andrews wrote: As for printers directly reachable from anywhere, why not. because in practice it's an astonishingly stupid idea. Here's why: chargen / other small services ssh www buffer overflows open smtp relays weak, default or non existent passwords information

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Mark Andrews
In message 532f42aa.9000...@foobar.org, Nick Hilliard writes: On 23/03/2014 18:39, Mark Andrews wrote: As for printers directly reachable from anywhere, why not. because in practice it's an astonishingly stupid idea. Here's why: chargen / other small services ssh www buffer overflows

Re: misunderstanding scale

2014-03-23 Thread Timothy Morizot
On Mar 23, 2014 11:27 AM, Paul Ferguson fergdawgs...@mykolab.com wrote: Also, IPv6 introduces some serious security concerns, and until they are properly addressed, they will be a serious barrier to even considering it. And that is pure FUD. The sorts of security risks with IPv6 are mostly in

IPv6 Security [Was: Re: misunderstanding scale]

2014-03-23 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 3/23/2014 2:27 PM, Timothy Morizot wrote: On Mar 23, 2014 11:27 AM, Paul Ferguson fergdawgs...@mykolab.com mailto:fergdawgs...@mykolab.com wrote: Also, IPv6 introduces some serious security concerns, and until they are properly addressed,

Re: misunderstanding scale

2014-03-23 Thread bmanning
On Sun, Mar 23, 2014 at 04:27:16PM -0500, Timothy Morizot wrote: On Mar 23, 2014 11:27 AM, Paul Ferguson fergdawgs...@mykolab.com wrote: Also, IPv6 introduces some serious security concerns, and until they are properly addressed, they will be a serious barrier to even considering it. And

Re: misunderstanding scale

2014-03-23 Thread Nick Hilliard
On 23/03/2014 21:02, Mark Andrews wrote: Actually all you have stated in that printer vendors need to clean up their act and not that one shouldn't expect to be able to expose a printer to the world. It isn't hard to do this correctly. perish the thought - and I look forward to the day that

Re: misunderstanding scale

2014-03-23 Thread bmanning
On Sun, Mar 23, 2014 at 10:31:57PM +, Nick Hilliard wrote: On 23/03/2014 21:02, Mark Andrews wrote: Actually all you have stated in that printer vendors need to clean up their act and not that one shouldn't expect to be able to expose a printer to the world. It isn't hard to do this

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Matt Palmer
On Sat, Mar 22, 2014 at 07:57:04PM -, John Levine wrote: In such a case, where you are still pushing the case for IPv4, how do you envisage things will look on your side when everybody else you want to talk to is either on IPv6, or frantically getting it turned up? Do you reckon anyone

Re: misunderstanding scale

2014-03-23 Thread Timothy Morizot
On Mar 23, 2014 4:45 PM, bmann...@vacation.karoshi.com wrote: Yo, Tim/Scott. Seems you have not been keeping up. http://go6.si/wp-content/uploads/2011/11/DREN-6-Slo-IPv6Summit-2011.pdf points out several unique problems w/ IPv6 and in deployments where there are

Re: misunderstanding scale

2014-03-23 Thread Mark Andrews
In message 532f60dd.3030...@foobar.org, Nick Hilliard writes: On 23/03/2014 21:02, Mark Andrews wrote: Actually all you have stated in that printer vendors need to clean up their act and not that one shouldn't expect to be able to expose a printer to the world. It isn't hard to do this

Re: misunderstanding scale

2014-03-23 Thread Matt Palmer
On Mon, Mar 24, 2014 at 10:15:27AM +1100, Mark Andrews wrote: In message 532f60dd.3030...@foobar.org, Nick Hilliard writes: On 23/03/2014 21:02, Mark Andrews wrote: Actually all you have stated in that printer vendors need to clean up their act and not that one shouldn't expect to be

RE: misunderstanding scale

2014-03-23 Thread Ray
Not necessarily. Printers generally run unattended, printers generally are not rebooted periodically for updates (assuring malware can continue to run), printers generally are not updated even periodically, printers generally have almost no logging that could be reviewed, printers are generally

Re: IPv6 Security [Was: Re: misunderstanding scale]

2014-03-23 Thread Timothy Morizot
On Mar 23, 2014 4:45 PM, Paul Ferguson fergdawgs...@mykolab.com wrote: Also, neighbor discovery, for example, can be dangerous (admittedly, so can ARP spoofing in IPv4). And aside from the spoofable ability of ND, robust DHCPv6 is needed for enterprises for sheer operational continuity. Yes.

Re: misunderstanding scale

2014-03-23 Thread Timothy Morizot
On Mar 23, 2014 6:21 PM, Paul Ferguson fergdawgs...@mykolab.com wrote: Says you. And many others. My comments were actually reiterating what I commonly see presented today. On the other hand, there are beaucoup enterprise networks unwilling to consider to moving to v6 until there are

Re: misunderstanding scale

2014-03-23 Thread Mike Hale
I wasn't aware that calling out FUD was derisive, but whatever. It's derisive because you completely dismiss a huge security issue that, given the state of IPv6 adoption, a great majority of companies are facing. Calling it FUD is completely wrong because it *is* a legitimate security issue for

Re: misunderstanding scale

2014-03-23 Thread Timothy Morizot
On Mar 23, 2014 7:24 PM, Mike Hale eyeronic.des...@gmail.com wrote: It's derisive because you completely dismiss a huge security issue that, given the state of IPv6 adoption, a great majority of companies are facing. The original assertion was that there are unaddressed security weaknesses in

Re: misunderstanding scale

2014-03-23 Thread Mike Hale
unless by few you simply mean a minority Which I do. appropriately mitigating the security risks shows the claim that there are security weaknesses in IPv6 preventing its adoption is false. No. It doesn't. It's not the sole reason, but it's a huge factor to consider. But there's nothing

Re: misunderstanding scale

2014-03-23 Thread Mark Andrews
In message CAN3um4wnMPW=BQ6ec_=nh-ua50nn3ql9t+nxdo-adnzcjhk...@mail.gmail.com , Mike Hale writes: I wasn't aware that calling out FUD was derisive, but whatever. It's derisive because you completely dismiss a huge security issue that, given the state of IPv6 adoption, a great majority of

Re: misunderstanding scale

2014-03-23 Thread Timothy Morizot
On Mar 23, 2014 7:54 PM, Mike Hale eyeronic.des...@gmail.com wrote: unless by few you simply mean a minority Which I do. Then that's fine. But there are numerous enterprises in that minority and it includes some pretty large enterprises. My own enterprise organization has more than 600 sites,

Re: misunderstanding scale

2014-03-23 Thread Michael Thomas
[] It seems to me that the only thing that really matters in v6 wars for enterprise is whether their content side has a v6 face. Who really cares whether they migrate away from v4 so long as they make their outward facing content (eg web, etc) available over v6? That's really the key. Mike

Re: misunderstanding scale

2014-03-23 Thread Mike Hale
then there aren't any inherent security weaknesses preventing its adoption by enterprises. You're right. There's not an inherent security weakness in the protocol. The increased risk is due to the increase in your attack surface (IMHO). Your attack surface has already expanded whether or not

Re: misunderstanding scale

2014-03-23 Thread Timothy Morizot
On Mar 23, 2014 8:44 PM, Mike Hale eyeronic.des...@gmail.com wrote: Your attack surface has already expanded whether or not you deploy IPv6. Not so. If I don't enable IPv6 on my hosts, the attacker can yammer away via IPv6 all day long with no result. I suppose it depends on the size of your

Re: misunderstanding scale

2014-03-23 Thread Timothy Morizot
On Mar 23, 2014 8:44 PM, Michael Thomas m...@mtcc.com wrote: It seems to me that the only thing that really matters in v6 wars for enterprise is whether their content side has a v6 face. Who really cares whether they migrate away from v4 so long as they make their outward facing content (eg

Re: IPv6 Security [Was: Re: misunderstanding scale]

2014-03-23 Thread Dobbins, Roland
On Mar 24, 2014, at 6:37 AM, Timothy Morizot tmori...@gmail.com wrote: You'll pardon my skepticism over claims that unspecified security weaknesses make it impossible to do what we have done and are continuing to do. All this unfilterable ICMP makes for interesting times - I've already run

RE: misunderstanding scale

2014-03-23 Thread Naslund, Steve
I am not sure I agree with the basic premise here. NAT or Private addressing does not equal security. A globally routable address does not necessarily mean globally accessible. Any enterprise that cares a wit about network security is going to have a firewall. If you are relying on NAT to

misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread TJ
Millions of IPs don't matter in the face of X billions of people, and XX-XXX billions of devices - and this is just the near term estimate. (And don't forget utilization efficiency - Millions of IPs is not millions of customers served.) Do IPv6. /TJ On Mar 22, 2014 3:09 AM, Bryan Socha

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread Bryan Socha
Fair point. There are some situations that do need more than most, but aren't they the ones that should be on ipv6 already??? I know a few are shouldn't I be on ipv6 and that's fair too. I'm plqnnning some speaking engagements to cover that. Its not blind and ignoring. On Mar 22, 2014

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread Bryan Socha
Oh btw, how many ipv4s are you hording with zero justification to keep them? I was unpopular during apricot for not liking the idea of no liability leasing of v4. I don't like this artificial v4 situation every eyeball network created.Why is v4 a commodity and asset? Where is the

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread Cb B
On Mar 22, 2014 2:32 AM, Bryan Socha br...@digitalocean.com wrote: Oh btw, how many ipv4s are you hording with zero justification to keep them? I was unpopular during apricot for not liking the idea of no liability leasing of v4. I don't like this artificial v4 situation every

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread Chris Knipe
On Sat, Mar 22, 2014 at 11:30 AM, Bryan Socha br...@digitalocean.com wrote: Oh btw, how many ipv4s are you hording with zero justification to keep them? I was unpopular during apricot for not liking the idea of no liability leasing of v4. I don't like this artificial v4 situation

Re: misunderstanding scale

2014-03-22 Thread Robert Webb
So two things here, Bryan... First, there may be those that do not require IPv6 due to size. So what is YOUR big plan to connect all those on IPv4 to the rest of the IPv6 world that has dropped IPv4 addresses. Second, as a DO customer, I am now beginning to understand the culture and

Re: misunderstanding scale

2014-03-22 Thread Doug Barton
On 03/22/2014 08:47 AM, Robert Webb wrote: First, there may be those that do not require IPv6 due to size. It is a mistake to believe that the only reason to add IPv6 to your network is size. Adding IPv6 to your network _now_ is the right decision because at some point in the not-too-distant

Re: misunderstanding scale

2014-03-22 Thread Nick Hilliard
On 22/03/2014 16:29, Doug Barton wrote: It is a mistake to believe that the only reason to add IPv6 to your network is size. Adding IPv6 to your network _now_ is the right decision because at some point in the not-too-distant future it will be the dominant network technology, and you don't

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread Justin M. Streiner
On Sat, 22 Mar 2014, Bryan Socha wrote: Oh btw, how many ipv4s are you hording with zero justification to keep them? I was unpopular during apricot for not liking the idea of no liability leasing of v4. I don't like this artificial v4 situation every eyeball network created.Why is

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread William Herrin
On Sat, Mar 22, 2014 at 10:33 AM, Justin M. Streiner strei...@cluebyfour.org wrote: All of these 'Hail Mary' options for 'saving' IPv4 really are pointless. Hi Justin, IPv4 is like the U.S. Penny. It'll be useless long before it goes away. And right now it's far from useless. Regards, Bill

Re: misunderstanding scale

2014-03-22 Thread George William Herbert
On Mar 22, 2014, at 10:16 AM, Nick Hilliard n...@foobar.org wrote: On 22/03/2014 16:29, Doug Barton wrote: It is a mistake to believe that the only reason to add IPv6 to your network is size. Adding IPv6 to your network _now_ is the right decision because at some point in the

Re: misunderstanding scale

2014-03-22 Thread Tore Anderson
* Nick Hilliard the level of pain associated with continued deployment of ipv4-only services is still nowhere near the point that ipv6 can be considered a viable alternative. This depends on who you're asking; as a blanket statement it's demonstrably false: For the likes of T-Mobile USA¹ and

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread Justin M. Streiner
On Sat, 22 Mar 2014, William Herrin wrote: On Sat, Mar 22, 2014 at 10:33 AM, Justin M. Streiner strei...@cluebyfour.org wrote: All of these 'Hail Mary' options for 'saving' IPv4 really are pointless. IPv4 is like the U.S. Penny. It'll be useless long before it goes away. And right now it's

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread Mark Tinka
On Saturday, March 22, 2014 05:54:06 PM Justin M. Streiner wrote: Interesting analogy, but it misses the larger point. The larger point is that the ongoing effort to squeeze more mileage out of IPv4 will soon [1] outweigh the mileage we (collectively) get out of it. IMHO, that effort is

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread William Herrin
On Sat, Mar 22, 2014 at 11:54 AM, Justin M. Streiner strei...@cluebyfour.org wrote: On Sat, 22 Mar 2014, William Herrin wrote: On Sat, Mar 22, 2014 at 10:33 AM, Justin M. Streiner strei...@cluebyfour.org wrote: All of these 'Hail Mary' options for 'saving' IPv4 really are pointless. IPv4

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread John Levine
In such a case, where you are still pushing the case for IPv4, how do you envisage things will look on your side when everybody else you want to talk to is either on IPv6, or frantically getting it turned up? Do you reckon anyone will have time to help you troubleshoot patchy (for example)

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread Justin M. Streiner
On Sat, 22 Mar 2014, William Herrin wrote: That's what I hear. Interesting thing though: it hasn't happened yet. IANA ran out of /8's and it didn't happen. The RIRs dropped to high-conservation mode on their final allocations and it didn't happen. How could that be? I never said that things

Re: misunderstanding scale

2014-03-22 Thread Nick Hilliard
On 22/03/2014 18:50, Tore Anderson wrote: * Nick Hilliard the level of pain associated with continued deployment of ipv4-only services is still nowhere near the point that ipv6 can be considered a viable alternative. This depends on who you're asking; as a blanket statement it's

Re: misunderstanding scale

2014-03-22 Thread Justin M. Streiner
On Sat, 22 Mar 2014, Nick Hilliard wrote: FB, T-mobile and you are all using ipv6-ipv4 protocol translators because ipv6-only services are not a viable alternative at the moment. Using IPv6 internally is different from being able to use IPv6 end-to-end. 6-4 translators will be needed to

Re: misunderstanding scale

2014-03-22 Thread Nick Hilliard
On 22/03/2014 19:35, Justin M. Streiner wrote: CGN also comes with lots of downside that customers are likely to find unpleasant. For some operators, customer (dis)satisfaction might be the driver that ultimately forces them to deploy IPv6. don't believe for a moment that v6 to v4 protocol

Re: misunderstanding scale

2014-03-22 Thread Justin M. Streiner
On Sat, 22 Mar 2014, Nick Hilliard wrote: On 22/03/2014 19:35, Justin M. Streiner wrote: CGN also comes with lots of downside that customers are likely to find unpleasant. For some operators, customer (dis)satisfaction might be the driver that ultimately forces them to deploy IPv6. don't

Re: misunderstanding scale

2014-03-22 Thread Michael Hallgren
Le 22/03/2014 23:49, Nick Hilliard a écrit : On 22/03/2014 19:35, Justin M. Streiner wrote: CGN also comes with lots of downside that customers are likely to find unpleasant. For some operators, customer (dis)satisfaction might be the driver that ultimately forces them to deploy IPv6. don't

Re: misunderstanding scale

2014-03-22 Thread Randy Bush
don't believe for a moment that v6 to v4 protocol translation is any less ugly than CGN. it can be stateless randy

Re: misunderstanding scale

2014-03-22 Thread Doug Barton
On 03/22/2014 10:16 AM, Nick Hilliard wrote: On 22/03/2014 16:29, Doug Barton wrote: It is a mistake to believe that the only reason to add IPv6 to your network is size. Adding IPv6 to your network _now_ is the right decision because at some point in the not-too-distant future it will be the

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread Mark Tinka
On Saturday, March 22, 2014 09:57:04 PM John Levine wrote: We've just barely started to move from the era of free IPv4 to the one where you have to buy it, and from everyhing I see, there is vast amounts of space that will be available once people realize they can get real money for it.

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-22 Thread John Levine
It will be a long time before the price of v4 rises high enough to make it worth the risk of going v6 only. New ISP's are born everyday. Some of them will be able to have a Buy an ISP that has IPv4 or Buy IPv4 space from known brokers line item in their budget as part of their launch plans.

<    1   2