My next class:

The End Of IP As We Know It

Published: 2011-02-01. Last Updated: 2011-02-25 06:08:06 UTC
by Johannes Ullrich (Version: 1)
11 comment(s)

Today, IANA announced that it had handed out two more /8 IPv4 assignments to APNIC. As a result, IANA is down to 5 /8s, triggering its special policy to hand out one address to each regional registrar (RIR). The 5 RIRs are AFRNIC (Africa), APNIC (Asia Pacific), ARIN (North America), LACNIC (Latin America) and RIPE (Europe). [1]

IANA hands IP address space to the RIRs in chunks of /8s, who then pass it on to ISPs, who then pass it on to end users. Some large end users may approach their RIR directly, and some "legacy assignments" are managed by IANA directly.

But in the end, what does this all mean?

A Quick FAQ To IPv4 Exhaustion

1 - Will the Internet stop working?

No. As a matter of fact, it is unlikely that the IPv4 internet will stop any time soon. It will likely happily exist next to the IPv6 internet. There are some transition mechanisms set up. While not pretty, the two "internets" can talk to each other via proxies and tunnels.

2 - Why do we run out of addresses?

IPv4 allows for about 4 billion addresses. There are about 6 billion people on the world... how many addresses do you need (phone, home, work...)? Its a simple math issue compounded by the fact that for efficient routing sake, we can't assign all addresses.

3 - A lot of IPv4 space is still unused. Why don't we use it more effectively?

The problem is not just that we are running out of addresses, even though that is the killer issue here. Assigning addresses more effectively would mean that assignments would become smaller and routing tables would become more complex. In order to make this work, we would have to essentially "renumber" the internet, and still be out of addresses at some point.

4 - What about legacy space? Does Apple really need a /8?

In the beginning of the Internet, IPv4 address space was handed out very liberally. Remember it was just an experiment? Some of the original participants still have large IPv4 assignments which they don't use efficiently. However, even if all of them are handed back, it would delay the problem only by 1-2 years at great expense to the effected companies (and they have contracts giving them the rights to use the address space). Some "legacy allocations" have been returned in the past

5 - What do I need to do today?

Relax. Nothing is going to happen fast. the RIRs still have space left, depending on the region a few month to a year. After that, it will get tricky. You may already find it harder to get IP address space. Eventually, your ISP may ask for some space back as they can't get new addresses from the RIR. Over time, IPv4 will get more expensive than IPv6.

6 - So I can just wait and do nothing?

No. What you should do tomorrow (maybe today?) is setup a test lab to familiarize yourself with IPv6. It is easy to get going. Ask your ISP if they support it (or when), or setup a tunnel with a free tunnel provider like Hurricane Electric [2] or Sixxs [3] (there are others). You need a plan on how to deal with it. Even if you don't need IPv6, maybe your business partners start using it and you need to connect to them via IPv6.

7 - Can't I just ignore it?

Remember why you are using IP in the first place? It allows you to connect to customers, suppliers, branch offices. In short: It keeps you in business. Once these people expect IPv6 connectivity, you will likely have to move along with it. It is like any technology in that it ultimately has to support the business (and well... it is fun too!).

8 - What will change from a security point of view?

Everything and nothing. The most important change is probably the fact that NAT will become less important. Endpoint protection and carefully configured firewalls will become more important. Passive asset detection will become more important compared to active scanning. There is a lot of security gear you own that probably does a lousy job dealing with IPv6. Did I mention it requires a plan and testing?

[1] http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml
[2] http://www.tunnelbroker.net
[3] http://www.sixxs.net

 

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Keywords: ipv4 ipv6
11 comment(s)
My next class:

Comments

I hate seeing this news story every 6 months...

If the world really cared about IPV4, they would:

- stop giving every cellphone, fridge, television, and toilet an IP address.

- reclaim wasted networks. eg: where I work, we're wasting an entire /16. There are Fortune 500 companies out there with multiple /8's that don't need every single IP to be publicly available on the internet.

While I won't deny that NAT is not a solve-all solution, maybe if we took care of what we have already, we wouldn't need to look for alternatives.

So please, no more about IP exhaustion. :)

joeblow

Feb 1st 2011
1 decade ago

Joe, you would have a good point, except for one major point: The world, save for a few of us techies, doesn't really care about IPv4. All they care about is that their computers, smart phones, laptops, tablets, ebook readers, and yes, even their refrigerators and networked thermostates, work as advertised. They don't much care whether they use IPv4, IPv6, NetBIOS or black magic.

Consumers will continue to demand these devices, as well as others we have not yet foreseen. Industry will continue to produce products that meet these demands. The moment IPv4 isn't the most cost-effective way to do that, the world will move on, and none, save a few of us techies, will shed a tear for it.

Technology exists to serve us - not the other way round.

clubjuggle

Feb 1st 2011
1 decade ago

I think you both have valid points:

- We serve technology (we develop it and push it to the next level)

- Technology serves us (we develop it to make our lives less difficult).

Joe's points are stronger, and I elaborate below.

As with any resource humans are involved with, IPv4 is/was neglected, even if it was initially an experiment. We've known for years that we'd run out of IPv4 space, yet we continued to delve it out to anyone and anything (and didn't reallocated wasted space). As with any resource, when it's not carefully maintained, alternatives are eventually needed. One of the major reasons IPv6 exists is because IPv4 space was found to be finite. While it comes with advantages, those advantages are overshadowed by the fact that we are/were running out of IPv4 space. IPv6 isn't teaching us to reserve...IMO, its actually teaching us to be more wasteful. But that's just me...

Ron

Feb 1st 2011
1 decade ago

I still find it highly ironic that with the number of firewalled-off internal spaces; and systems like cable internet and telephones that get a 10 address and go through NAT, etc. to reach public Internet, that we would run out of addresses so easily. For example one site I'm at with 150 employees has one - one - public IP address. Actually makes my work more difficult but IPv6 wouldn't make it easier because this company would still only *pay* for one single public IP.

krinsh

Feb 1st 2011
1 decade ago

Just a couple of replies to the comments above:

I think IPv6 is about much more then more addresses. It is really about moving forward with the idea of global connectivity. If you don't want more customers, new services and innovation, IPv4 will do fine for you :). Imagine asking in 1980 (or 1990) if you need internet on a cell phone? IPv6 is not just addressing the current issue of IP address space, but also keeping up with modern hardware in general (64 bit addressing, mobile networks and so on)

Yes, IPX would probably work just fine for many applications people envisioned in the 80s and 90s.

Dr. J

Feb 1st 2011
1 decade ago

Joe's comments make logical sense, but are also largely unachievable. It's like saying that we wouldn't have to add more area codes if we didn't have cell phones. It's inarguably true, but asking people to stop buying cell phones is probably not a workable solution.

We could certainly solve the problem by having ISPs use NAT more extensively, but at a pretty severe cost -- end users could no longer host services of *any* kind, which would pretty much guarantee the Internet return to a model of centrally-controlled content. I can remember when always-on connections were expensive and only well-heeled companies or people with academic connections could host servers; I'm not eager to go back to a version of that situation.

David

Feb 1st 2011
1 decade ago

krinsh, Don't worry, the smallest allocation you can get is a /64 that means you only get 18446744073709551616 public addresses.

David, Joe,
No Joe's comments don't make sense. If it were a finite physical resource I might agree, but it's just a number, like a telephone number. If it gets too short you just add digits, it's been done before and will be done again. For the number itself adding digits isn't a problem but all the IPv4 hardware has been hardwired with a fixed size for that number, that's what the problem has been. One possible choice was to allow the address to be expanded in a dynamic fashion, you could do it with IPv4 NATs and tunnelling in theory, but performance would suck. It's a lot more efficient to use an insanely large fixed size number ... you couldn't get anywhere close to filling 340282366920938463463374607431768211456 occupied addresses without smashing past the speed of light.

Space wise the IPv6 packet loses about 1% of the payload over IPv4 for a normal ethernet packet; performance wise it's simpler and so faster.

Robert

Feb 1st 2011
1 decade ago

As if people were actually reading this diary...Comcast starts rolling out IPv6 Trial http://www.comcast6.net.

HackDefendr.com

Feb 2nd 2011
1 decade ago

I think the sarcastic examples of cellphone and toilet having IP addresses is more apt than intended. We still have free toilets in the United States. In some countries, the toilets really are high-tech. Why shouldn't I expect my cellphone to pay for me, or even make a reservation and give me directions to a clean toilet? In the future there might be toilet auctions. We have an app for that.

mexaly

Feb 2nd 2011
1 decade ago

People do read this diary. The Comcast trial suggests that ISPs may roll out IPv6 to home users faster than businesses. For one thing home users are easier to migrate since they do not often need static addresses. Their gateway equipment would need upgrading, but that would still not be as difficult as business customers.

KBR

Feb 2nd 2011
1 decade ago

Login here to join the discussion.


Top of page
Diary Archives