An AAAA-only hostname would sidestep that issue, with the obvious downside. (This behavior is a deliberate choice from Wireguard. They claim it's not broken, but... it's broken.)
They weren't glossed over. Dual-homing is handled in RFC 3484 (https://datatracker.ietf.org/doc/html/rfc3484#section-5 under rule 5) and ND is designed to detect unreachable routers and stop using them (see e.g.…
On the other hand, if Android supported IA_NA we would probably be seeing ISPs in the wild handing out /112s and going "But it's 2^16 IPs! We're being so generous, what could you possibly have to complain about?", so…
It was never going to be a clean cut, which is why we didn't design it for a clean cut and instead developed a bunch of approaches to transitioning to it that deal with the real-world problems of the transition. What…
That really seems more like a problem with the people dropping the packets than with the packet design itself. How else would you do it? Forcing every packet to reserve space for every possible option (including all…
https://datatracker.ietf.org/doc/html/rfc2460#section-4: With one exception, extension headers are not examined or processed by any node along a packet's delivery path, until the packet reaches the node (or each of the…
They aren't actually doing that, as far as I've seen. There are a number of big ISPs in Europe that that have a "new" native v6+CGNATed v4 platform, and an "old" native v4+no v6 one. That's where a lot of the "I had to…
The performance hit for running an emulated CPU would be significant, to the point that it wouldn't really be the same argument. I was thinking more along the lines of network namespaces -- although actually, I should…
Thanks Claude. But maybe we should avoid normalizing ND proxy, lest we end up with ISPs that think it's okay to not provide delegated prefixes? We already have some doing that now; we don't need more. Note that RFC 7278…
> It doesn't. ...it does. You can spend five seconds in tcpdump to see that it does: $ ping6 fe80::506c:e9ff:fe08:9ba3%eth0 11:58:48.741688 d6:57:10:b8:52:77 > 33:33:ff:08:9b:a3, ethertype IPv6 (0x86dd), length 86:…
Get me onto the network that's on the WAN interface of your router, disable the firewall on it, and I will. How do you want to go about doing this? Although, 100% of the time people have asked me to do this they chicken…
It is true. NAT only changes the source address used for outbound connections, it doesn't deny inbound ones. You don't need to take that on faith either -- you can just test it.
No, the reason is that people incorrectly believe it provides security. It doesn't actually do that.
It was engineered like that. It was known from the start that having a flag day wasn't possible (https://datatracker.ietf.org/doc/html/rfc1726#section-5.5): We believe that it is not possible to have a "flag-day" form…
NAT is accepted for transition purposes; for example NAT64 makes it trivial to connect from v6-only clients to v4 servers, and is used by some large ISPs (e.g. T-Mobile in the US) to avoid running v4 inside their access…
But v6 _is_ backwards compatible though? It's got dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... how is this not backwards compatible? You could make a…
All you've done there is reinvent v6 with a combination of dual stack, NAT64 and 6to4, plus add a flag day. You haven't fixed any of the problems involved in deploying v6, and you added a step that was known 35 years…
SLAAC-generated addresses will stay the same so long as the prefix and your MAC address stay the same, so there should be no need to do static leases. Also... service discovery. Needing static addresses is a kludge.
People running servers don't seem to be reliably capable of making sure that either pMTUd works or isn't needed on their network, so... it is indeed broken on random servers. We've mostly decided to go with TCP MSS…
That's basically no burden at all. If we cut the address length down to increase throughput, we would get a one-time increase of about 0.8% -- but consider how much faster Internet connections have gotten over the past…
Except you are, because all the same work needs to be done. > You can use the 8-byte addresses earlier if you want You can't have both this and "The 8-byte phase only starts when v4 has been abandoned" simultaneously.…
$ wget -4 https://github.com/HackerNews/API Resolving github.com (github.com)... 140.82.114.4 Connecting to github.com (github.com)|140.82.114.4|:443... failed: Network is unreachable. $ git clone…
Windows, Linux, OSX, Android and iOS all ship with v6 enabled by default out of the box, so it's already turned on without you needing to think about it. You have to deliberately go out of your way for this not to be…
People are at work during the week, and work networks have a lower average deployment of v6 then home networks do. As evidence, you can also see the impact of holidays and COVID-19 lockdowns on the size of the dips.
I don't have to imagine, because that's how things are right now for the billions of people using v6, and it's fine.
An AAAA-only hostname would sidestep that issue, with the obvious downside. (This behavior is a deliberate choice from Wireguard. They claim it's not broken, but... it's broken.)
They weren't glossed over. Dual-homing is handled in RFC 3484 (https://datatracker.ietf.org/doc/html/rfc3484#section-5 under rule 5) and ND is designed to detect unreachable routers and stop using them (see e.g.…
On the other hand, if Android supported IA_NA we would probably be seeing ISPs in the wild handing out /112s and going "But it's 2^16 IPs! We're being so generous, what could you possibly have to complain about?", so…
It was never going to be a clean cut, which is why we didn't design it for a clean cut and instead developed a bunch of approaches to transitioning to it that deal with the real-world problems of the transition. What…
That really seems more like a problem with the people dropping the packets than with the packet design itself. How else would you do it? Forcing every packet to reserve space for every possible option (including all…
https://datatracker.ietf.org/doc/html/rfc2460#section-4: With one exception, extension headers are not examined or processed by any node along a packet's delivery path, until the packet reaches the node (or each of the…
They aren't actually doing that, as far as I've seen. There are a number of big ISPs in Europe that that have a "new" native v6+CGNATed v4 platform, and an "old" native v4+no v6 one. That's where a lot of the "I had to…
The performance hit for running an emulated CPU would be significant, to the point that it wouldn't really be the same argument. I was thinking more along the lines of network namespaces -- although actually, I should…
Thanks Claude. But maybe we should avoid normalizing ND proxy, lest we end up with ISPs that think it's okay to not provide delegated prefixes? We already have some doing that now; we don't need more. Note that RFC 7278…
> It doesn't. ...it does. You can spend five seconds in tcpdump to see that it does: $ ping6 fe80::506c:e9ff:fe08:9ba3%eth0 11:58:48.741688 d6:57:10:b8:52:77 > 33:33:ff:08:9b:a3, ethertype IPv6 (0x86dd), length 86:…
Get me onto the network that's on the WAN interface of your router, disable the firewall on it, and I will. How do you want to go about doing this? Although, 100% of the time people have asked me to do this they chicken…
It is true. NAT only changes the source address used for outbound connections, it doesn't deny inbound ones. You don't need to take that on faith either -- you can just test it.
No, the reason is that people incorrectly believe it provides security. It doesn't actually do that.
It was engineered like that. It was known from the start that having a flag day wasn't possible (https://datatracker.ietf.org/doc/html/rfc1726#section-5.5): We believe that it is not possible to have a "flag-day" form…
NAT is accepted for transition purposes; for example NAT64 makes it trivial to connect from v6-only clients to v4 servers, and is used by some large ISPs (e.g. T-Mobile in the US) to avoid running v4 inside their access…
But v6 _is_ backwards compatible though? It's got dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... how is this not backwards compatible? You could make a…
All you've done there is reinvent v6 with a combination of dual stack, NAT64 and 6to4, plus add a flag day. You haven't fixed any of the problems involved in deploying v6, and you added a step that was known 35 years…
SLAAC-generated addresses will stay the same so long as the prefix and your MAC address stay the same, so there should be no need to do static leases. Also... service discovery. Needing static addresses is a kludge.
People running servers don't seem to be reliably capable of making sure that either pMTUd works or isn't needed on their network, so... it is indeed broken on random servers. We've mostly decided to go with TCP MSS…
That's basically no burden at all. If we cut the address length down to increase throughput, we would get a one-time increase of about 0.8% -- but consider how much faster Internet connections have gotten over the past…
Except you are, because all the same work needs to be done. > You can use the 8-byte addresses earlier if you want You can't have both this and "The 8-byte phase only starts when v4 has been abandoned" simultaneously.…
$ wget -4 https://github.com/HackerNews/API Resolving github.com (github.com)... 140.82.114.4 Connecting to github.com (github.com)|140.82.114.4|:443... failed: Network is unreachable. $ git clone…
Windows, Linux, OSX, Android and iOS all ship with v6 enabled by default out of the box, so it's already turned on without you needing to think about it. You have to deliberately go out of your way for this not to be…
People are at work during the week, and work networks have a lower average deployment of v6 then home networks do. As evidence, you can also see the impact of holidays and COVID-19 lockdowns on the size of the dips.
I don't have to imagine, because that's how things are right now for the billions of people using v6, and it's fine.