×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

162 comments

Linux much (4, Interesting)

Enderandrew (866215) | more than 5 years ago | (#25756171)

Apple has a far greater market share than Linux desktops, but you can't completely ignore that Linux has been pushing IPv6 for some time.

Re:Linux much (2, Insightful)

LincolnQ (648660) | more than 5 years ago | (#25756433)

Except I'm under Linux and no ipv6 sites seem to work for me (default Ubuntu installation). If Apple is making it work by default, well, that's better than what Linux has been doing.

This result seems to be because of Apple routers (5, Informative)

JSBiff (87824) | more than 5 years ago | (#25756585)

From the article, I picked up the reason for this result (but not until after posting a similar question, I must confess). Most home computer users, regardless of their platform, tend to connect to the internet through some sort of router device. Most of these routers use IPv4 only, and use NAT to share the Internet connection.

Many Mac users, instead of using some 'generic' WiFi access point, instead use Apple's Airport Extreme router. Per the article, Airport Extreme's have support for IPv6 built right into the router, and the router will *automatically* route IPv6 traffic using the 6to4 standard (which basically tunnels the traffic over the IPv4 connection from the ISP).

I suspect that if you connected your Ubuntu computer (or Vista, or XP if you installed IPv6 manually) to the Internet using an Airport Extreme, then IPv6 would work fine under Ubuntu too. That is, I think the 'magic' here that makes IPv6 "just work" is in the router, not in the OS.

Re:This result seems to be because of Apple router (4, Interesting)

Dolda2000 (759023) | more than 5 years ago | (#25757041)

Many Mac users, instead of using some 'generic' WiFi access point, instead use Apple's Airport Extreme router. Per the article, Airport Extreme's have support for IPv6 built right into the router, and the router will *automatically* route IPv6 traffic using the 6to4 standard (which basically tunnels the traffic over the IPv4 connection from the ISP).

Indeed. I was quite impressed to read about that. I have been thinking for quite a while that router makes should be doing exactly that, so it's good to see that at least one of them does.

On the quite opposite hand, there's Vista. While the article pointed out that Vista sets up 6to4 automatically when it has a globally routable IPv4 address (which is a good thing, of course), there's an annoying other side to that coin. See, Vista announces that it routes through its 6to4 address, but then in actual fact doesn't (it just drops the packets silently). It has been annoying me quite some times when I've connected to a public WiFi access point at my university, only to see every IPv6-enabled site (including my own!) fail miserably since my Linux laptop will try to route through one of these Vista black holes. That's Microsoft for you...

Re:This result seems to be because of Apple router (1, Interesting)

Anonymous Coward | more than 5 years ago | (#25757517)

Can we get a list of home wireless routers that will support this?
I didn't see it in any Belkins or D-Links I purchased in the last 2 years, though IPv6 was somewhat of a hot topic.

So I have to ask. In this age of "Now supporting Draft N!!!" and "MIMO ANTENNAE ARE GOOD FOR YOUR MULTIMEDIA HOME!" "I'M TWICE AS FAST AS G ROUTERS IF YOU BUY MY SAME BRAND G-RECEIVER!" With all the excuses to upgrade your router, where are all the much wanted "NOW WITH IPV6! FUTURE PROOF YOUR HOME LAN SO YOU'LL NEVAARR RUN OUT OF IP ADDRESSES" (wink)

I know cash is hard to come by these days, but geeks in the US are slaves to gadgets.

Re:Linux much (1)

jonbryce (703250) | more than 5 years ago | (#25758217)

It doesn't work on my Mac - Tiger, or my Ubuntu or my Vista.

I think it is the fact I'm using a Netgear router rather than an Airport router.

Re:Linux much (0)

Anonymous Coward | more than 5 years ago | (#25758713)

Connect to Anonet [69.30.55.8] , and you should be able to use IPv6 inside it.

Re:Linux much (1)

Brian Gordon (987471) | more than 5 years ago | (#25756437)

I use linux- does that mean that I have IPv6 support? Is it built into recent kernels?

Re:Linux much (3, Informative)

jonfr (888673) | more than 5 years ago | (#25756529)

Yes, it has been build in into the kernel for several years now. I have IPv6 network already, works like a charm.

You need to get a ISP that supports native IPv6 or a IPv6 PoP to connect to IPv6 sites. Like http://ipv6.google.com/ [google.com]

LAN IPv6 is already build in, no need to configure that.

Re:Linux much (5, Funny)

Anonymous Coward | more than 5 years ago | (#25756505)

you can't completely ignore that Linux has been pushing IPv6 for some time.

Yes, yes we can.

Re:Linux much (2, Funny)

rvw (755107) | more than 5 years ago | (#25758993)

you can't completely ignore that Linux has been pushing IPv6 for some time.

Yes, yes we can.

Sorry? It's the change we need!

Re:Linux much (4, Interesting)

RalphBNumbers (655475) | more than 5 years ago | (#25756753)

This isn't just a matter of Mac vs Linux desktop market share.
Google's numbers say that the following percentages of users are IPv6 capable, broken down by OS:
2.44% for Mac OS
0.93% for Linux
0.32% for Vista

The article I saw on this at Ars Technica attributed this difference(despite the fact that all three OSes are IPv6 capable by default) to the fact that mac users have a tendency to use other Apple hardware, and Apple's Airport routers use 6to4 to tunnel IPv6 by default.

If linux has been pushing ipv6 (what does that even mean? does your kernel complain when it has to handle ipv4 packets?), perhaps it's been pushing in the wrong place, i.e. on the desktop, or as an end to end solution, rather than in routers, and with tunneling.

Re:Linux much (4, Insightful)

lysergic.acid (845423) | more than 5 years ago | (#25757077)

don't you need both? if you have a router that supports IPv6 but your OS isn't configured to use IPv6 then you're still not going to be able to access IPv6 hosts. Windows XP still doesn't have IPv6 enabled by default--you need to go to network connection properties and add the protocol "Microsoft TCP/IP version 6" in order to enable IPv6 support.

so it's not a matter of it being IPv6 pushed in the wrong place, but a matter of networking hardware manufacturers being too slow to adopt IPv6. that's not really up to OS developers.

most existing networking equipment can probably already support IPv6 with a firmware update. but a lot of consumer networking equipment vendors are probably waiting for IPv6 to gain more traction so that they can a separate line of "new and improved" IPv6-enabled routers/switches/etc. to cash in on unnecessary equipment upgrades.

Pushing IPv6 (1)

jd (1658) | more than 5 years ago | (#25757225)

I don't know about anyone else's definition, but I would consider distros marking themselves as Phase 2 Certified as one way you could define "pushing IPv6". Another might be to enable IPv6 by default in the kernel (since we're talking about IPv6 capability in the article, rather than usage), or to use IPv6 by default on all connections where it is supported at the kernel and application level, whether or not it is genuinely supported end-to-end. Far as I can see, very few distros are certified for IPv6 (I can't honestly remember seeing the logo anywhere), those that provide it don't take advantage of it, and those that do don't make it easy to take advantage of it (Ubuntu provides some IPv6 tunneling software, but nothing that works with any of the IPv6 gateways I'm using, and network administration using IPv6 under Ubuntu is a pain -- and it's by far the best distro I've used in this regard).

Re:Linux much (2, Insightful)

aliquis (678370) | more than 5 years ago | (#25757297)

The BSDs has had IP v6 support forever to (and OS X has probably had it as long as it has existed to.) But what good is it if you can't get a real IP anyway. Proxy ftw? For what reason? *care* as long as the ISP don't give me an IP v6 network.

sounds damn scary (5, Funny)

Anonymous Coward | more than 5 years ago | (#25756197)

IPv6 Eyeballs! Run!!!!

Re:sounds damn scary (2, Funny)

Anonymous Coward | more than 5 years ago | (#25756559)

Not only that, more eyeballs than Asia. It's like an IPv6 Shoggoth!

Re:sounds damn scary (4, Insightful)

caitsith01 (606117) | more than 5 years ago | (#25757659)

You're kidding, but why do stories have to use lame 'industry insider' phrases when an ordinary one would do just as well ("actual users" might fit the bill)?

Re:sounds damn scary (4, Funny)

mattytee (1395955) | more than 5 years ago | (#25758083)

Eyeball revenueization is how we leverage marketicompetencies to extendify the bottom line.

False negatives abound (5, Insightful)

Anonymous Coward | more than 5 years ago | (#25756227)

OK, so I have 7 computers in my house. They all run either Linux or Vista. (Some both as two are dual boot). They are all IPv6 capable. However, my Linksys NATing router is not. So unless my machines find an ISATAP server somewhere, there is going to be no information that Google gets showing that all my machines could do it if I just sprung for a new router. I would imagine there are a lot of people in the same situation. I guess if they are trying to find out how many homes are capable - then maybe this is the right way. But if they are trying to just see how many COMPUTERS - then it isn't going to be correct.

Re:False negatives abound (3, Interesting)

Spy der Mann (805235) | more than 5 years ago | (#25756419)

However, my Linksys NATing router is not.

Exactly. I feel like left out - what use is having an IPv6 capable machine, if my ISP blocks all my IPv6 traffic simply because they don't support it?

Re:False negatives abound (1)

B4light (1144317) | more than 5 years ago | (#25756783)

Well then obviously some people should start pushing for their ISPs and routers to upgrade to IPv6.

Re:False negatives abound (2, Interesting)

Anonymous Coward | more than 5 years ago | (#25756921)

ISPs don't like IPv6 as it "flattens" the internet. NAT is good for them, keeps clients clients and servers servers, also makes it easy to install what are really shaping / deep packet inspection / logging black boxes as "NAT" appliances, etc.

Re:False negatives abound (1, Funny)

Anonymous Coward | more than 5 years ago | (#25757439)

False. IPv6 is a paradise for network crackers.

It doesn't support NAT (unless you fall back to v4), so anyone in the world can go and grab your network topo, nmap every host on it by figuring out your IPv6 addresses from what your ISP has. Then, they can do highly targeted attacks against every single router, host, server, and network attached toaster.

IPv6 has no support for encryption. Its talked about, but not really part of the standard. Packets are always in plaintext, and they assume another layer like SSH will handle that.

IPv6 shows your physical location to all comers.

IPv6 forces you to re-IP every single machine you have including your servers if you change ISPs. This means you are shackled to your ISP unless you want to do an enterprise level renumbering of every single static IP you own.

All and all, IPv6 is great for those spying upon the masses, but there doesn't seem to be much thought or design in security.

Re:False negatives abound (2, Insightful)

batkiwi (137781) | more than 5 years ago | (#25757931)

Firewalls and routers existed well before NAT became mainstream. You do realize that just because NAT acts as a firewall doesn't mean that it is a GOOD firewall, nor the ONLY type of firewall? (most NAT routers now allow in UDP packets from ANY source once a port is opened, for example, to allow for games to work)

Re:False negatives abound (2, Informative)

Lennie (16154) | more than 5 years ago | (#25758153)

You do realize it will take months to map a LAN with IPv6 through nmap ? Because the IPv6-address space for the LAN is bigger then the whole IPv4-internet.

Re:False negatives abound (0)

Anonymous Coward | more than 5 years ago | (#25758987)

Just a sidenote, what is the rationale for making the IPv6 address spaces for LANs so freaking large? It's unlikely even the largest of organizations will need an address space as big as the entire IPv4 address space, much less individuals....

Re:False negatives abound (1)

Joe U (443617) | more than 5 years ago | (#25757335)

Yeah, TimeWarner/Roadrunner tech support will get right on that, I'm amazed they support ping.

Re:False negatives abound (3, Informative)

Chandon Seldon (43083) | more than 5 years ago | (#25756843)

That's not a false negative, that's you misunderstanding the test. They are testing users who are actually IPv6 enabled, not just users running IPv6 capable hardware.

How can they tell? (1)

pembo13 (770295) | more than 5 years ago | (#25756271)

I have 4 machines at home, all run Linux and do are IPV6 capable. Most mac users have one mac though. I'm guessing they are only checking the external facing router?

Re:How can they tell? (1)

Anonymous Coward | more than 5 years ago | (#25756305)

Why on earth would you use NAT on an IPv6-capable connection? Sort of defeats the purpose, doesn't it?

Re:How can they tell? (3, Informative)

networkBoy (774728) | more than 5 years ago | (#25756327)

not at all.
While NAT is not a be-all end-all security measure, it certainly helps, as my router provides a (stupid-basic) blank face at port-scan attempts.
Layers of defense. My router is the drawbridge of my castle.
-nB

Re:How can they tell? (3, Informative)

Brian Gordon (987471) | more than 5 years ago | (#25756497)

Yes; just because you can give every molecule in the solar system an IP address doesn't mean you should. There's no reason to let your home networked devices face the internet directly- it's a very bad idea to even open any ports, since you shouldn't need to. You shouldn't be providing any services to the internet from your home, even remote desktop or a network share; it's bad practice and you won't sleep well at night- it's against your ISP's terms of service anyway, if you're in America. Get a virtual server somewhere if you really need something while on the go. I'm sitting comfortably in my NAT fortress knowing everything within the physical space of my house is nmap-proof.

Re:How can they tell? (2, Informative)

Brian Gordon (987471) | more than 5 years ago | (#25756545)

And yes, it's probably against your terms of service to offer any kind of internet services from your home without a hosting service account. That doesn't mean you can't forward ports- you can still netcat data into your network and stuff like that- but you can't provide services. Of course it's absurd and unenforcable, but it's not good to break the ToS for years at a time; play it safe.

Re:How can they tell? (2, Informative)

aliquis (678370) | more than 5 years ago | (#25757581)

I doubt it's really not allowed where I live (not in USA though), and the first three months I had only plugged in the TP-cable without signing any paper or anything. No login required, just plug the machine in and voila Internet with DHCP.

Re:How can they tell? (1)

LingNoi (1066278) | more than 5 years ago | (#25756687)

You can still do that with a firewall. I think you need to change your religious believe in NATs.

Re:How can they tell? (2, Insightful)

hedwards (940851) | more than 5 years ago | (#25757003)

Except he's ultimately right. There's no reason why I should have to replace any network devices on my home network because everybody else is using IPV6. That would be costly and wasteful. And for the near term that's going to be supported by most ISPs out of cheapness, no reason to drag people's home networks into it needlessly.

I prefer to spend my extra cash on death rays and doom devices. Also large quantities of obscure computing equipment bits.

Re:How can they tell? (1)

LingNoi (1066278) | more than 5 years ago | (#25757057)

No where does the GP mention anything about replacing equipment...

The GP was talking about devices facing the internet which isn't true if you set to disallow incoming connections.

It's a myth that NAT stops incoming connections, your firewall does this, which is my point you can still do this with a firewall.

Re:How can they tell? (1)

aliquis (678370) | more than 5 years ago | (#25757585)

Replace? Why would you need to replace anything? (Ok, people have mentioned some routers is crap and can't handle IP v6, but except that?)

Re:How can they tell? (2, Informative)

Ilgaz (86384) | more than 5 years ago | (#25758487)

I think the future means every single device having a IP, perhaps even human beings if you are paranoid. :)

Don't think about today, think about the future. Can you imagine every cell phone user somehow browses the net and plays some games?

It is not like today's concept, it is about the very weird and connected future. I agree demanding IPV6 from a consumer level ISP today is a bit overkill but recently my heater company called me and asked if I wanted my combination heater (Vaillant) to be connected to net. I asked if it is Windows some sort, they said "yes" and I said "good luck with that".

I hate your future (0)

Anonymous Coward | more than 5 years ago | (#25758527)

Every device having an IP address? *shudders*

Re:How can they tell? (3, Insightful)

aoteoroa (596031) | more than 5 years ago | (#25758895)

You shouldn't be providing any services to the internet from your home

Where's the fun in that?

Sure a virtual server somewhere might have more bandwidth than my home cable but at home I can experiment with different setups. Some people play video games. . .I like to play with new distros, or software. If running a http or ssh server from home is wrong then I don't want to be right :-)

Re:How can they tell? (1)

Yosho (135835) | more than 5 years ago | (#25756509)

While NAT is not a be-all end-all security measure, it certainly helps

No it doesn't. It's not a security measure at all. Having your computers behind a NAT provides absolutely no advantage over having public IPs behind a router that disallows incoming connections by default. The only difference is that in one situation you have to set up port forwarding to allow any incoming connections, and in the other you just have to allow connections on a particular port to a particular IP. Oh, and you can't have multiple computers that listen on the same incoming port if you're using NAT.

Port scanning would be practically infeasible with IPv6, anyway; the address space is so large that even your own little subnet would take longer to scan than any potential attacker would be willing to spend.

My router is the drawbridge of my castle.

And you will still have a router whether or not you use NAT.

Re:How can they tell? (1)

Annymouse Cowherd (1037080) | more than 5 years ago | (#25756631)

Having your computers behind a NAT provides absolutely no advantage over having public IPs behind a router that disallows incoming connections by default.

Nobody knows how to do this.

Re:How can they tell? (0, Flamebait)

LingNoi (1066278) | more than 5 years ago | (#25756707)

It's almost the same thing, just no NAT! Damn you people are fucking morons..

You're not so smart yourself (0, Flamebait)

TheLink (130905) | more than 5 years ago | (#25756953)

Without a NAT, how does a "NoNAT router" know what public IP range to give via DHCP (or other means) to Joe User's WinXP/Mac box, BEFORE it manages to get that public IP range from the ISP?

A public IPv4/IPv6 range that needs to be preconfigured on the router, is one more thing for the ISP and router manufacturers to deal with and one more thing for Joe User to screw up or have trouble with.

Go think about that.

My guess is you can't be a fucking moron since you're a slashdotter.

Re:You're not so smart yourself (1)

LingNoi (1066278) | more than 5 years ago | (#25757037)

Without a NAT, how does a "NoNAT router" know what public IP range to give via DHCP

What... the... fuck?

Re:You're not so smart yourself (-1, Flamebait)

Anonymous Coward | more than 5 years ago | (#25757147)

You're a fucking retard. With NAT, you plug in the router and it works. Without NAT, you plug in the router and it doesn't work.

Re:You're not so smart yourself (0)

Anonymous Coward | more than 5 years ago | (#25758587)

Except for the teenie, weenie detail that it does.

Re:You're not so smart yourself (1)

TheLink (130905) | more than 5 years ago | (#25758195)

In order for Joe Public's PC to talk to other computers on the Internet, it needs an address.

Joe's ISP's routers all have addresses of their own which are fairly fixed in practice. The ISP can't just change them and automatically expect the rest of the Internet to still be able to reach them.

Without NAT, Joe's PC needs addresses that belongs to Joe's ISP before it can talk to the rest of the Internet.

BUT before Joe's router is connected to the ISP, how does his router or PC know what address they should be using?

With the popular NAT stuff, Joe's PC can be given important stuff like DNS server, default gateway, IP address - all using RFC1918 addresses, way before Joe's router connects to the ISP.

And then stuff can work for Joe almost immediately after connection.

Joe would not have to wait for "dhcp renewal time" seconds, or "some other public IP update period" seconds, before his PC realizes that "Oh I'm supposed to be using this public IP address and this gateway".

In short, with the NAT system when Joe sees the "Internet" LED lit on his router, he knows that PCs connected to the router should be able to access the Internet - if they can't there is a problem somewhere.

With the "public IP" system, when Joe sees the "Internet" LED lit, if the PCs can't access the internet it doesn't mean there is a problem or there isn't a problem. He has to wait a few minutes first (timeouts, renewals etc). Go ask an ISP call center manager how much a few minutes of waiting costs.

Maybe to you that's "almost the same thing", but to me it's not.

Re:You're not so smart yourself (2, Interesting)

chrome (3506) | more than 5 years ago | (#25759021)

Perfectly valid for ipv4. Ipv6 is a different story. Go read up on how it works. Ipv6 needs no dhcp server.

Re:You're not so smart yourself (2, Informative)

ArbitraryConstant (763964) | more than 5 years ago | (#25757145)

> Without a NAT, how does a "NoNAT router" know what public IP range to give via DHCP (or other means) to Joe User's WinXP/Mac box, BEFORE it manages to get that public IP range from the ISP?

Before it connects to the ISP you'll be using link-local addresses. The router will then get a prefix from the ISP via DHCP prefix delegation and begin sending router advertisements so internal computers can configure themselves with public addresses (though they retain their link-local addresses).

Re:You're not so smart yourself (1)

TheLink (130905) | more than 5 years ago | (#25757975)

So either you'll keep getting router advertisements on your network indefinitely, or your computers will have to keep requesting for it (instead of eventually giving up- which is what happens now).

Next question: What url does Joe Public enter on his browser to get to the router config page, so that he can enter the username and password in order to get access to the ISP's network?

Re:You're not so smart yourself (1, Informative)

Anonymous Coward | more than 5 years ago | (#25758301)

What the hell are you talking about? You're using link-locals till the route gets a real IP, then it advertises the new route, the clients get new IPs and everything functions just as normal the whole time.

And the URL Joe Public types in is the same as now. "http://name.your.router", supplied by the manual, provided by the DNS server in the router, the same as he does now. You don't think he types in cryptic ip adresses, do you?

Re:You're not so smart yourself (1)

TheLink (130905) | more than 5 years ago | (#25758321)

I'm curious - how long would it take for the clients to get new IPs?

Secondly "router." isn't a reserved TLD. So what RFC compliant TLD should be used?

Many years ago I personally tried convincing ICANN etc to reserve .here for free private use just like RFC1918.

But they didn't listen - maybe it's because I didn't give them lots of $$$.

Re:You're not so smart yourself (0)

Anonymous Coward | more than 5 years ago | (#25758393)

IIRC the router advertises the change, so i guess instantly.

And 192.168.0.1 isn't reserved for the router either. Mine has 192.168.178.1, guess that. The router has its own DNS Server, reserving e.g. my.router or something similar as this.

Re:You're not so smart yourself (1)

mikael_j (106439) | more than 5 years ago | (#25758711)

So either you'll keep getting router advertisements on your network indefinitely, or your computers will have to keep requesting for it (instead of eventually giving up- which is what happens now).

Ok, you clearly should never be put in charge of any ISP's backbone.

Next question: What url does Joe Public enter on his browser to get to the router config page, so that he can enter the username and password in order to get access to the ISP's network?

Well, there are lots of ways of solving this, the first option (which is commonly used in europe) is to simply not require a username and password for the connection (what's the point if it's an always-on connection anyway?

Also, why would joe user even need a router? A transparent packet filtering firewall could work just as well. But I'm assuming you want to be able to have a machine act as the default gateway, well in that case the IP address of the default gateway will be known when the clients are auto-configured.

/Mikael

Re:You're not so smart yourself (1)

jandrese (485) | more than 5 years ago | (#25757263)

Uh, because you tell it which set of IP addresses is your local subnet? Firewalls aren't magic, people have been using them for years and years now. In the worst case scenario, there's a port labeled "WAN" and it has the firewall. In fact that's how most home routers work already!

Re:You're not so smart yourself (1)

TheLink (130905) | more than 5 years ago | (#25758003)

"because you tell it which set of IP addresses is your local subnet? Firewalls aren't magic..."

Wrong answer.

With the current NAT router+ISP stuff, Joe Public at the most needs to provide the username+password. And in some ISP configs, Joe doesn't even need to provide that- they just plug it in and it works "like magic" - and the sort of magic that Joe Public barely notices.

That's why it's far from "almost the same thing".

Re:You're not so smart yourself (0)

Anonymous Coward | more than 5 years ago | (#25758363)

You mean different as "Plug In, Functioning." with IPv6 routers? Yeah, totally different.

Re:You're not so smart yourself (1)

mikael_j (106439) | more than 5 years ago | (#25758699)

Without a NAT, how does a "NoNAT router" know what public IP range to give via DHCP (or other means) to Joe User's WinXP/Mac box, BEFORE it manages to get that public IP range from the ISP?

Well, the IPv6 subnet to be handed out can be configured automatically, and with IPv4 the common method is to simply have one ISP-level DHCP server that hands out IP addresses to all hosts (since there is no pesky NAT to screw things up).

/Mikael

Re:How can they tell? (3, Informative)

TheLink (130905) | more than 5 years ago | (#25756747)

Actually it is.

The difference between a "NAT router" and a "stateful firewall with public IP stuff behind"

You need the NAT working in order to reach the stuff behind it.

You don't need the stateful stuff working in order to reach the stuff behind it.

So in event of bugs, the hacker is more likely to have to work harder to exploit the stuff behind a NAT.

Now the issue with "just NAT" is the ISP can usually access the stuff behind the NAT - just as long as they know what IP range you have behind- they just have to get IP packets with dest=your.private.ip to your NAT device and _typically_ it will pass it through (some NAT devices also have a stateful firewall so they may not pass it through).

This means a 3rd party could get past your NAT if they have control over your ISP's routers route tables. But if they achieve that control you're probably screwed anyway.

Anyway, it's good enough protection, the hackers and malware bunch hardly do direct network attacks anymore against Joe User, much easier to convince Joe User to run stuff :).

Re:How can they tell? (3, Insightful)

A beautiful mind (821714) | more than 5 years ago | (#25758185)

NAT is causing fucked up problems that are serious but aren't given enough publicity, like making the big DNS vulnerability of the year still apply, even if the software side is fixed due to NAT's tendency to line up/reuse port numbers instead of randomizing them - even if the application side did randomize.

NAT is a horrible, horrible thing that shouldn't be used because it's causing subtle but ultimately very bad things to happen. Besides, home routers could just come with a default denial of all incoming packets unless they are related to an open connection rule to substitute the "firewalling" people enjoy with NAT.

Re:How can they tell? (2, Interesting)

TheLink (130905) | more than 5 years ago | (#25758271)

1) You still need to use IPv4 if sites you need to use still don't support IPv6 or are unreachable from your network.

For example - say you have a machine without an IPv4 address at all. How would you access the following sites:
mail.google.com
www.windowsupdate.com
security.ubuntu.com
mail.yahoo.com

I can list more.

2) You still need NAT if you are using dynamic IPv4 addresses.

Why?

Imagine what happens if the ISP gives you public IP range 4.5.5.0/252

But you drop and reconnect and are given public IP range 4.6.6.0/252

How long will it take for your machine to realize that it's IP address, DNS server and default gateway settings are wrong?

3) You still need NAT even if you are using static IPv4 addresses

There is an IPv4 shortage, so you need NAT to share the address(es) you get from the ISP.

If you think we can ignore the IPv4 shortage by switching your machines to IPv6, see 1).

Lastly, saying that DNS problem still applies because of NAT is wrong. NAT devices could randomize port numbers, there is nothing about doing NAT that requires a NAT device to not randomize port numbers. It's just like BIND could have randomized port numbers like djbdns did, but it didn't, so whose fault was that?

Re:How can they tell? (1)

A beautiful mind (821714) | more than 5 years ago | (#25758335)

1.) Once IPv6 kicks in at the ISP level proper, it's their responsibility from there on to provide connectivity between IPv4 and IPv6 space. IPv4 ip addresses are embedded in IPv6 btw, so addressing them is not a problem.

2.) There are established procedures for that. Otherwise, how could your cable modem/router doing the NAT tell? :) The keyword here is "drop and reconnect". You can use DHCP the same way your modem/router can.

3.) It would only help the IPv4 shortage if large swaths of ISPs would be behind NAT, multiple levels of NAT actually. It is not practical to do so on the global scale and therefor does nothing to help conserve IPv4 addresses. Your reasoning in 1. is flawed, IPv6 does solve shortage problems.

NAT devices can't really do that, not if they want to carry on working properly - at least not in a busy environment. NAT if you think about extending the numbering of IPv4 just by mapping ports to machine addresses. Once you have a number of non-trivial machines running inside NAT, like the environment where you'd be running DNS servers, that's the environment exactly where you have a shortage of ports to randomize from. Tough luck, innit?

Re:How can they tell? (1)

grahamm (8844) | more than 5 years ago | (#25758677)

1) You still need to use IPv4 if sites you need to use still don't support IPv6 or are unreachable from your network.

Actually the problem is the other way round. It should be possible to access an IPv4 service from your IPv6 network. What would not be possible would be for an IPv4 only host to access a serv(er|ice) on your IPv6 only network.

Re:How can they tell? (2, Interesting)

mikael_j (106439) | more than 5 years ago | (#25758687)

2) You still need NAT if you are using dynamic IPv4 addresses. Why? Imagine what happens if the ISP gives you public IP range 4.5.5.0/252 But you drop and reconnect and are given public IP range 4.6.6.0/252 How long will it take for your machine to realize that it's IP address, DNS server and default gateway settings are wrong?

I take it someone has never encountered an ISP that provides more than one IP address to each customer? Back in 1998 when I first got ADSL the ISP I used handed out 5 IP addresses per connection, and I've worked with ISPs that will gladly hand out up to 10 IP addresses per (physical) connection, so a lot of their more knowledgeable users are actually skipping NAT altogether and instead using public IP addresses for all their computers. And guess what, this is how the internet used to work and how it was intended to work. End to end connectivity.

/Mikael

Re:How can they tell? (2, Funny)

Anonymous Coward | more than 5 years ago | (#25756531)

Layers of defense. My router is the drawbridge of my castle.

Let me guess, your inner keep is Goatse/tubgirl/lemon party montage, deceptively labelled "secretpasswordstomybankaccountsandthat.png"

Anyone cracking yo' stuff will be sick for a week.

Re:How can they tell? (1)

ArbitraryConstant (763964) | more than 5 years ago | (#25756633)

You can get a similar level of security by using a stateful firewall. The main security advantage to NAT is really the property of limiting inbound packets to those that are associated with existing connections, and that's what you get with a stateful firewall. You don't have to have disjoint address spaces to get this feature.

Re:How can they tell? (1)

aliquis (678370) | more than 5 years ago | (#25757571)

Or like, they could ship OSes and servers only listening to local IPs by default, or none at all, and that point wouldn't matter at all.

Re:How can they tell? (1)

MacColossus (932054) | more than 5 years ago | (#25756515)

I have multiple macs and am using a linksys router using NAT. I also run Vista 64 Business (bootcamp) on my Mac Pro desktop for games, XP (Vmware Fusion) on my Macbook Pro laptop for the trouble ticket database my work uses that require Microsoft Access. I also play with Ubuntu Server on my network from time to time. Most mac users I know have a desktop and laptop. My parents have a Athlon based Windows XP machine I built them and a Macbook Pro laptop sitting behind a Netgear router. I'm not sure how google culls the IPv6 data, but most people have multiple computers sitting behind a router. If not, they usually have only a laptop and a wireless router.

Re:How can they tell? (1)

clang_jangle (975789) | more than 5 years ago | (#25756561)

Most mac users have one mac though.

That doesn't sound right to me. What is your source for that statistic? I would think the percentage of multiple computer owners is probably roughly the same. I've had multiple Macs (and PCs running Linux and FBSD) for years, and so do several people I know. I realize Apple is often perceived as being more of a CE manufacturer recently, but there are still plenty of Mac-using geeks -- in fact, I think there are more than there used to be.

Re:How can they tell? (0)

Anonymous Coward | more than 5 years ago | (#25756619)

I would especially expect Mac developers to have multiple machines right now - a fast, modern Intel machine to get work done, and a PPC Mac for testing purposes.

Re:How can they tell? (3, Informative)

AKAImBatman (238306) | more than 5 years ago | (#25756653)

Most mac users have one mac though

Nonsense. I've visited the homes of Mac-only users. They usually have two or three. Where things get interesting however, is that they tend to be using an Airport Router. (Which caused me no end of grief when I didn't spring to have WiFi added to my last laptop.) As someone mentioned higher up in the discussion, Airport routes IPv6 by default. Something that most other consumer routers (typically paired with Windows and Linux machines) do not.

Re:How can they tell? (0)

Anonymous Coward | more than 5 years ago | (#25757033)

Most mac users have one mac though

We've got 6...

Re:How can they tell? (2, Insightful)

ceoyoyo (59147) | more than 5 years ago | (#25757695)

Okay, I've got four macs, an airport and an iPhone. Each one gets an IP. I know the airport and the Macs support IPv6. Not sure about the phone.

My anecdote cancels your anecdote?

Re:How can they tell? (1)

rugatero (1292060) | more than 5 years ago | (#25758513)

My anecdote cancels your anecdote?

I call your anecdote and raise one poll. [mactalk.com.au] More than 80% of Mac owners polled own more than one - of course the sample is rather small and not necessarily representative, but it does weaken the GP's uncited claim.

Do Macs automatically setup a 6over4 Tunnel? (3, Informative)

JSBiff (87824) | more than 5 years ago | (#25756323)

I don't believe any US ISPs have begun providing IPv6 connections yet, have they? So, does this statistic reflect that not only are Macs IPv6 capabable, but all of them are automatically setting up an IPv6 tunnel over their IPv4 connections? If so, what tunnel broker are they using as an endpoint (is Apple itself providing a tunnel broker service for them)?

Or, instead of using a tunnel, are they using the technology (don't remember the name, maybe 4to6?) where an IPv6 address is automatically generated from the public IPv4 address, and then IPv6 packets are sent to an IPv4 anycast address which automatically routes them to the nearest 'public' 4ot6 gateway? Unfortunately, I don't believe the latter solution works well behind NATted connections, which I think would dramatically reduce these statistics, so the sheer size of the Mac IPv6 'population' suggests to me that tunnels are being used instead?

I've recently been playing with IPv6 via Hexago Freenet6 [go6.net] , but truth be told, there's really not much use for IPv6 yet, since very few apps (like IM clients [skype: I'm looking at you], network games, etc) or websites actually support IPv6 on the other end yet. I've also noticed a problem with packet loss and high latency with Freenet6, so I'm thinking I'm going to try to find a different tunnel broker.

Re:Do Macs automatically setup a 6over4 Tunnel? (4, Informative)

JSBiff (87824) | more than 5 years ago | (#25756393)

Guess I should have read the article first. Looks like this result is because Apple's Airport Extreme AP automatically sets up 6to4 (which is the 'anycast' based system I was referring to previously, but got the name backwards), and because the router itself supports 6to4, there's no problem giving the systems behind the router a public IPv6 address in the sub-net of the 6to4 address.

I didn't realize there were any IPv6-capable home routers on the market (other than routers that have been hacked to replace the OEM firmware with OpenWRT or DD-WRT). Kudos to Apple for showing some leadership here. Anyone know of any other makers with affordable home routers with IPv6?

Re:Do Macs automatically setup a 6over4 Tunnel? (5, Funny)

Anonymous Coward | more than 5 years ago | (#25757197)

Well, you went through
  • Denial (No way! Apple would have to be tunneling)
  • Anger (Damn it, I shoulda read the article... Apple IS tunneling. Why hasn't anyone told me!!), and
  • Bargaining(So is anyone ELSE doing tunneling? I'd like to get one, but Apple's so expensive)

After you Google for it, it will be Depression (*SIGH* No, nobody else is doing it any cheaper.) and finally Acceptance (Apple is so Awesome! I really shoulda switched sooner)... so, spare yourself the depression and just buy one. k? :)

Re:Do Macs automatically setup a 6over4 Tunnel? (1, Funny)

Anonymous Coward | more than 5 years ago | (#25757619)

Then I'll prepare for homosexual anal sex until I'm like Mr. Goatse with the "Married to Mac" wedding ring.

Or, I'll just get pussy and forget about it. Everything works with IPv4 on Firefox Windoze anyway.

Re:Do Macs automatically setup a 6over4 Tunnel? (1)

Gruff1002 (717818) | more than 5 years ago | (#25756485)

If you read TFA "It turns out that no less than 52 percent of all IPv6 users have a Mac and use 6to4. Apparently, those users have an Airport Extreme Wi-Fi base station / home router, which has the 6to4 tunneling mechanism enabled. (6to4 creates IPv6 addresses from an IPv4 address and "tunnels" IPv6 packets in IPv4 packets.)"
This answers the question about 6to4.

Re:Do Macs automatically setup a 6over4 Tunnel? (1)

ArbitraryConstant (763964) | more than 5 years ago | (#25757231)

I got a /48 from Hurricane Electric, I used OpenVPN to become my own tunnel broker. Probably the most useful thing so far for me has been making machines behind NATs accessible without having to get ports forwarded (this is often a pain if the eg someone doesn't remember their router's password).

This could obviously be done with RFC1918 addresses on v4, but it's hard to pick a range there because someone somewhere will end up being incompatible with it.

Re:Do Macs automatically setup a 6over4 Tunnel? (0)

Anonymous Coward | more than 5 years ago | (#25758119)

I don't believe any US ISPs have begun providing IPv6 connections yet, have they?

Sonic.net [sonic.net] has been offering IPv6 tunneling to DSL subscribers for years at no additional charge.
I like that VPN endpointing is included with dialup and DSL accounts too.

Something Mildly Amusing (1)

tekiegreg (674773) | more than 5 years ago | (#25756599)

The fact that according to this chart, the country in Africa most adapted to IPv6 is Nigeria. Guess those scamsters are getting more sophisticated daily, or maybe the 400k this woman gave them [slashdot.org] upgraded a few routers.

Mac market share? (0, Redundant)

Valdrax (32670) | more than 5 years ago | (#25756609)

I know that most of the people registering as Mac users with IPv6 are actually Mac users with an Airport Extreme wireless base station (which many Mac users like myself don't have), but is there anything that can be extrapolated about Mac market share from this?

By Default... (3, Informative)

actionbastard (1206160) | more than 5 years ago | (#25756873)

IPv6 is enabled on all OS X installs as the default. Few, if any, users -either at home or in a corporate setting- turn it off. At my site, IPv6 is not enabled on the network so all Macs have it disabled in all system images.

Re:By Default... (0)

Anonymous Coward | more than 5 years ago | (#25758989)

Same with linux distros for several years, including debian. The fact of the matter is it all comes down to what router your use supports, and your hookup to the net.

Sonic.net supports IPv6, sort of (1)

Animats (122034) | more than 5 years ago | (#25757803)

Sonic.net will, if requested, deliver IPv6 packets to their DSL subscribers. Unfortunately, their upstream connections are IPv4, so they're just offering tunneling at their end.

Re:Sonic.net supports IPv6, sort of (1)

j h woodyatt (13108) | more than 5 years ago | (#25758343)

Yeah, but you say that like it's not as good as the real thing. I'm a Sonic.Net customer, and I use an AirPort base station as my IPv6 tunnel endpoint. My home network is fully dual-stack, and the Sonic.Net tunnel is just as reliable as the rest of their service. I'm a huge fan of Sonic.Net.

"Than Asia"? (0)

Anonymous Coward | more than 5 years ago | (#25757969)

What is Russia then? Or does all the IPv6 traffic come from Moscow?

Anonymous Coward (1, Informative)

Anonymous Coward | more than 5 years ago | (#25758255)

This may be the answer

Apple's secret "Back to My Mac" push behind IPv6

http://www.appleinsider.com/articles/08/08/19/apples_secret_back_to_my_mac_push_behind_ipv6.html

Re:Anonymous Coward (1)

Ash-Fox (726320) | more than 5 years ago | (#25758809)

I wouldn't rely on information from a article that gets simple things wrong, such as:

Routers typically run BSD or Linux; Microsoft's software dominance on the desktop isn't even relevant in the world of routers.

The majority of routers do not typically run Linux or BSD.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...