IPv4 address exhaustion and IPv6 Glen Turner 2008-11-21 AIS IT managers' meeting aar net Australia's Academic and Research Network
IPv4 address format ● Internet protocol v4 addresses are 32 bits long ● They are divided into three parts Network Sub-network Hosts ● The parts are of variable length so that none of the few 32 bits are wasted
IPv4 address exhaustion ● The pool of new IPv4 network addresses is emptying. It will empty in 2012 See ipv4.potaroo.net
What is likely to happen? ● Underutilised addresses will be sold ● ISPs will run network address translation ● Some ISPs will offer IPv6
Market for IPv4 addresses aar net Australia's Academic and Research Network
Rationale for a market ● Even after 2011, ISPs need IPv4 addresses ● Current address allocations are under-used by sites they have been allocated to ● So ISPs could encourage assignees who can easily give up their allocations to give their allocations to the ISP, who can use the addresses more efficiently ● “encourage” = pay cash
Who owns addresses? ● In the beginning they were allocated to sites – Unsustainable routing table growth, as one entry per site in core routers – “Portable” between ISPs ● Regional internet registries allocate to ISPs, who allocate to customers' sites – One entry per ISP in core routers – “Non-portable” between ISPs
Checking address allocation $ whois 129.127.0.0/16 inetnum: 129.127.0.0 - 129.127.255.255 netname: ADELAIDE descr: University of Adelaide country: AU admin-c: LC457-AP tech-c: LC457-AP tech-c: SB248-AP status: ALLOCATED PORTABLE remarks: This object was transferred from ARIN database remarks: on 11 December 2002 mnt-by: APNIC-HM changed: hm-changed@apnic.net 20021211 changed: hm-changed@apnic.net 20040926 changed: hm-changed@apnic.net 20041214 source: APNIC
mnt-by and portable addresses ● Who can make changes? ● The people in the mnt-by field ● If this is not correct or updates using that maintainer are not secure then your address allocation can be altered without your agreement ● You can – and should – protect your maintainer record by requiring a password for changes or, better still, requiring a GPG signature
Contracts and non-portable ● Non-portable addresses do not belong to the site ● But site's have a significant investment in their allocated addressing ● The ISP could remove this allocation and assign it to another use – No need for the ISP to do this – Until they run out of addresses themselves ● Future contracts with ISPs need to spell out addressing more specifically
Trading addresses ● When originally allocated, the regional routing registries explicitly said that IP addresses would not be tradeable ● They're changing their mind, and the routing registries will eventually act as a registry for address ownership rather than address allocation ● Addresses will be worth money – You may be wish to sell all or part of your addresses and move to NAT – You may need to buy addresses if you need a public address
Network address translation Technology aar net Australia's Academic and Research Network
How does NAT work? ● Inspect outgoing traffic – Collect ( src_addr , src_port , dst_addr , dst_port ) ● Re-write src_addr to my exterior interface, find an unused source port on my exterior interface and re-write src_port to that ● Record these addresses and ports in the expectation table (150.101.30.33, 20000, (10.1.1.1, 10000, 202.158.201.38, 80) 202.158.201.38, 80) (150.101.30.33, 20000, 10.1.1.1, 10000, 202.158.201.38, 80)
How does NAT work? ● Inspect incoming traffic ● Is the incoming ( src_addr , src_port , dst_addr , dst_port ) in the expectation table? ● Re-write the dst_addr and dst_port to the original values in the table (202.158.201.33, 80 (202.158.201.38, 80 150.101.30.33, 20000) 10.1.1.1, 10000) (150.101.30.33, 20000, 10.1.1.1, 10000, 202.158.201.38, 80)
Wrinkles with NAT ● Some protocols embed IPv4 addresses – These need to be rewritten too – May be complex and thus dangerous to do in the forwarding plane ● eg: SNMP uses ASN.1 encoding ● Some protocols embed forthcoming connection information ● FTP, Cisco Skinny, a lot of multimedia ● These wrinkles are handled by “NAT modules” – inspect the traffic, add entries to the expectation table
Problems with NAT ● Complex – Forwarding plane moves from ASIC to CPU ● Jitter and complexity attacks – Some packets need a lot more work than others ● Exploits of code with errors – Complex code, so errors certain ● Huge amounts of state – Abundant opportunity for resource exhaustion ● Timeouts – Some traffic simply isn't suitable: low-power devices, sensors, episodic multimedia
Benefits of NAT ● Has lead to the widespread deployment of stateful, deep packet inspection firewalls – Although coding inspection for NAT and firewall can require choices, so NAT is not the best choice of DPI firewall ● Which is why defence runs real addresses ● Reduced the rate of IPv4 address exhaustion, delaying the crisis until now
Network address translation Economics aar net Australia's Academic and Research Network
“Carrier-class NAT” ● If ISPs run out of addresses, they can use network address translation
Implications ● The edge of the customer is no longer globally reachable – as it is no longer a globally-unique address ● The customer cannot run web servers, e-mail, etc ● But schools like to have their resources hosted on-site – That's where the users are ● But also like to have their resources accessed across the Internet
Implications ● So to continue as things are, ISPs will need to allocate an increasingly-scarce IPv4 address to the school's network edge ● The ISP will charge the school for this – Since the ISP themselves will need to pay for addresses ● The worst-case figure I've seen from an educated industry participant is $1,000pa – But no one really knows
Design implications ● Increased complexity and storage of NAT is expoitable – A less robust Internet ● Latency will increase – These will be expensive boxes, so there will be only a few in a ISP's network – Gamers will love IPv6 ● There is no end-to-end visibility
No end-to-end visibility ● We're sort of used to that: sharing photos on Flickr rather than on a home router ● Real IPv4 addresses are already special – Skype supernode – Who wants to volunteer to run a real IPv4 address in a NAT world? ● Some applications work better when all participants are reachable – peer-to-peer protocols – large videoconferencing
The “walled garden” ● Telcos maximise profits by charging users the value of the service, not the cost of provision – This is why ISD phone calls used to be charged for at outrageous rates, even though costs are <$0.01/ min – It's why telcos try to do exclusive content deals ● In interests of other vendors to team with the telco rather than with the customer ● The customer-built Internet broke this – Telco customers built it, so their interests ruled – Telcos reduced to being low-rent packet shifters
The return of the walled garden? ● Potential for Evil ISPs to move the Internet from a low-rent transport to a walled garden where the only services available are those selected by the ISP ● eg: – SIP is the protocol used for phone calls – Let's not run the NAT module for SIP and friends – Customers will need to use our voice service – No other voice service can be easily accessed (and doing so is arguably “hacking”) – Evil ISP charges VoIP packets at higher rate than other packets
IPv6 aar net Australia's Academic and Research Network
Where is AARNet? ● Native IPv6 service to our customers – Not-for-profit education and research, health, cultural institutions ● IPv6 broker – A best effort service to the greater community, especially developers ● Low deployment by customers – Didn't used to matter: by definition research has low initial usage – Slowly becoming a strategic issue, and we're trying various approaches to see what will fix that
IPv6 Technology aar net Australia's Academic and Research Network
IPv6's design goals ● In short, fix the problems with IPv4, so: ● Larger addresses ● Automated configuration – No manual configuration or central servers ● Secure communications ● Remove poor ideas
Larger addresses ● Larger, 128 bits ● Plenty of addressing allowed a waste/simplicty trade-off ● So fixed network, subnet, and host boundaries are seen by sites – 48 bits Network – 16 bits Subnetwork – 64 bits Host
Larger addresses, subnetworking ● 16 bits of subnetwork address ● Small sites will treat this as 2 16 (~65,000) subnets ● Complex sites will use about 4 bits to identify campuses and 12 bits for subnets within that campus
Textual representation ● Each 16 bits is in hexadecimal and separated from the next using “:” – 2001:388:1:2020:200:e2ff:fea5:80ff – Unlike most hex, leading zeroes are dropped ● The left-most run of zero-valued groups can be abbreviated as “::” – Makes sense for describing ● Subnets 2001:388:1:2020:200::/64 ● Routers addresses 2001:388:1:2020:200::1/64 ● Subnets described using prefix-length rather than a subnet bitmask
Recommend
More recommend
