7 posts tagged “work”

Two Steps Back And A Big Step Forward

Mar 12, 2008
2 comments

Google has pulled the IPv6 trigger. If you have good IPv6 connectivity, then you can see the dancing Google logo. If you're still in the camp who likes beating yourself in the head with the IPv6 hammer, then this will be welcome news to you.

I certainly don't want to disparage Google's efforts here. As near as I can tell from a cursory examination sitting here at IETF 71, they've done everything right— if only a little bit later than I would have advised.

Now, if only it will make any good goddamn difference.

The Future Without IPv6

Mar 10, 2008
6 comments

It's time to start talking about what the Internet will be like in a future where we abandon all our efforts toward the IPv6 transition. Because the transition isn't happening. It's not going to happen. We're going to be living on IPv4/NAT for the rest of our lives.

Many people who get to be called "experts" in their personal biographies think IPv6 is a solution in search of a problem. They can make a strong argument for their case:

There is no shortage of IPv4 addresses, because NAT allows more than one user to share the same address.
When the IPv4 address free pool runs out, the Regional Internet Registries can become title companies and address allocations will become commodities traded in the market.
The costs and benefits of just limping along forever with an IPv4/NAT-only architecture are predictable and well-understood, but the costs and benefits of investing in an expansion to IPv6 is full of uncertainty about both costs and benefits.

So let's talk about what the future they're planning for us looks like. Because we're going to be living in it. Trust me. We are.

NAT is the principle reason that depletion of the free IPv4 address pool hasn't already happened. It was adopted mainly to permit small organizations to multihome efficiently. Nevertheless, the free pool continues to be depleted. Routes in the default-free zone are not aggregating at the rate backbone operators had hoped. Further growth is increasingly coming to depend on the deployment of multiply nested private routing realms, i.e. NAT behind NAT.

There's a limit to how deeply you can stack endpoint nodes behind a single globally routed IPv4 address. It's not a brightly defined limit. It's vague and fuzzy, but it it's a limit. Applications on those nodes are multiplexed into a global address with a single 16-bit port number. The limit shows up sooner with transport protocols other than TCP, so the deeper you stack these NAT devices, the more you limit the ability of Internet applications to use any transport protocol other than TCP. Ubiquitous multilevel NAT means the Internet becomes a system for making TCP connections.

Oh, we'll try multiplexing multiple transports over a single TCP connection. And we'll discover how badly those tunneled transports perform because of how the outer TCP rate control and congestion avoidance mechanisms interfere with the inner transport mechanisms. We'll soon find out what my employers discovered years ago, when they tried to make this stuff work, that multiplexing over TCP is a sucker's game. Just open more than one TCP connection. But the more TCP connections your endpoint node needs, the fewer endpoints you can stack up behind a global IPv4 address— which means you can only expect to get so much out of stacking NAT behind NAT behind NAT. How much? It depends on how many TCP connections per second you expect to serve from the average endpoint node on the Internet. How many do you think YOU need? Do you have any idea? Do you think this guy does?

Let's also talk about how IPv4 addresses are going to be allocated to new organizations after the free pool is exhausted in the next few years. Conservative estimates have the free pool lasting only a couple more years. Some of the more liberal ones see it lasting into the middle of the next decade. Does anyone here think we won't see it within the space of our working lifetimes?

At the moment, IPv4 address blocks are not private property. All the Internet registries have policies for reclaiming unused allocations for reassignment. Because there are still addresses in the free pool, the application of these policies hasn't inconvenienced anyone. To keep your allocation, you basically just have to be able to fog a mirror. When no more IPv4 addresses can be assigned without reclaiming them from prior assignments, those policies will start getting teeth that leave real bite marks on people.

To get the Internet registries out of the business of adjudicating disputes over allocation policy enforcement matters, they'll have to become title companies just like the IPv6-is-stupid camp claims. Yes. Yes, it's true. So, let's imagine for just a moment what kind of political clusterfnork will break out they day the registries start issuing official deeds to the legacy allocations that were made years and years ago when only Senator Gore and a few hippies thought it would ever amount to anything of lasting commercial value. Take a gander at the names on that list:

Prefix Designation ----- ------ 003/8 General Electric Company 004/8 Level 3 Communications, Inc. 006/8 Army Information Systems Center 008/8 Level 3 Communications, Inc. 009/8 IBM 011/8 DoD Intel Information Systems 012/8 AT&T Bell Laboratories 013/8 Xerox Corporation 015/8 Hewlett-Packard Company 016/8 Digital Equipment Corporation 017/8 Apple Computer Inc. 018/8 MIT 019/8 Ford Motor Company 020/8 Computer Sciences Corporation 021/8 DDN-RVN 022/8 Defense Information Systems Agency 025/8 UK Ministry of Defence 026/8 Defense Information Systems Agency 028/8 DSI-North 029/8 Defense Information Systems Agency 030/8 Defense Information Systems Agency 032/8 AT&T Global Network Services 033/8 DLA Systems Automation Center 034/8 Halliburton Company 035/8 MERIT Computer Network 038/8 Performance Systems International 040/8 Eli Lily & Company 043/8 Japan Inet 044/8 Amateur Radio Digital Communications 045/8 Interop Show Network 047/8 Bell-Northern Research 048/8 Prudential Securities Inc. 051/8 Deparment of Social Security of UK 052/8 E.I. duPont de Nemours and Co., Inc. 053/8 Cap Debis CCS 054/8 Merck and Co., Inc. 055/8 DoD Network Information Center 056/8 US Postal Service 057/8 SITA

How much do we ask those organizations to pay today for the deeds to the allocations they got all those years ago. Nothing? Yeah, that's gonna fly in United Nations organizations. So, let's imagine a non-zero number instead. Just for grins, let's propose that the dollar value of a global IPv4 /8 allocation is US$100M per year. That's about US$5.96 per address per year.

Are you going to be the one who goes to Halliburton and tells them that they owe the Internet US$100M/year (retroactive?) for the continued use of the 34/8 network? How about the U.S. Postal Service? The U.S. Defense Information Systems Agency? What are you going to do when they tell you to Go Cheney Yourselves? Take their addresses away? How do you propose to do that? The truth is, nobody will do that.

What we'll get is not a transparent and free market in IPv4 address allocations. Instead, what we'll get is a patchwork system where the legacy allocations remain mostly in place, and the allocations controlled by the Internet registries are subject to a variety of policies, most of which will be the subject of heated disputes in organizations like the World Trade Organization.

Sure, some address allocations will be obtainable through market processes, but not most, and certainly not all. And the allocations won't really be the same as real estate, so organizations will still have to take out insurance policies to cover the risks of having their addresses called out from under them and having to pay for renumbering.

Better still: imagine you're in the business of squatting on domain names today. It's pretty easy to see that a market is going to be opening up soon allowing you to speculate on the future value of IPv4 address allocations. What would you do? You'd be trying to eat up as much of that free pool as you can before it's all gone.

Now imagine you're the organization trying to figure out how to make a market in address allocations. You've got to figure out how to do it without giving the speculators an opportunity to profit by inducing market failure in the first few iterations before the system stabilizes. You got any ideas? If you do, then I'd like to hear them. I have a lot of smart friends who are keenly interested in figuring this stuff out, and it's giving them big headaches right now.

The costs of maintaining a globally routed IPv4 address are about to go up. Maybe by several multiples. Probably very quickly. Market prices for commodities with a severe supply disruption and a dysfunctional system for clearing transactions tend to swing violently. Ultimately, all these cash flows have to add up. So, what does that mean?

The monthly bill from your ISP is about to have an uncertain new fraction of it devoted to the cost of maintaining that globally routed IPv4 address you're using (and possibly sharing with your neighbors). How much? Nobody knows. You might as well ask how much your bank is going to lose this year on the global implosion of credit markets.

Nobody knows. It could be pennies a year. It could be the better part of a hundred dollars a month. Nobody knows. Nobody freaking knows.

Now, IPv6 proponents think that the cost of maintaining IPv4 address allocations will drive the transition to IPv6. I'm not so sure. In fact, I'm thinking that's Yet More Kool-Aid. There is no cost for IPv4/NAT high enough to drive adoption of IPv6, because IPv6 will never be an alternative to IPv4. The Internet will turn out to be, always and forever, the IPv4/NAT-only Internet we have today. If current IPv6 usage doesn't fall off when its early adopters finally capitulate, then it will always be nothing more than an experimental platform for specialized research applications. And IPv6 wasn't designed to be that. It makes a lousy research platform.

Contrary to what the IPv6 detractors say, i.e. that the failing of IPv6 is that it isn't sufficiently compatible with the IPv4/NAT we have today, I have now come to believe that the principle failure of IPv6 is that it wasn't enough of a departure.

One Internet To Rule Them All

Feb 22, 2008
4 comments

The context for today's rant is the rapidly approaching Internet Address Space Crisis. This topic has been on my mind a lot lately, for a variety of professional reasons, many of them related to the constellation of issues that got me invited to be the Technical Editor for an Internet-Draft in the V6OPS working group of IETF on the subject of Recommended Simple Security Capabilities in Customer Premises Equipment for Providing Residential IPv6 Internet Service. Lately, the urgency of public calls for accelerating the transition of the Internet to IPv6 have grown louder, and so have the heat surrounding the arguments revolving around...

Why IPv6 Sucks Balls
How IPv6 Is So Amazingly Bad At Sucking Balls

and most importantly...

Who's To Blame For The Fact That The Internet Needs To Transition To A Next Generation Protocol That Sucks Balls So Badly Right Now.

I've had just about as much as I can take of this. A lot of people who should know better have said a lot of stupid things about this problem, but there's one particular stupid thing that a lot of them have said that really drives me up the goddamn wall, and here is where I'm composing my answer to them. Who are some of these people?

First, it was Daniel J. Bernstein complaining about how...

Unfortunately, the straightforward transition plan described above does not work with the current IPv6 specifications. The IPv6 designers made a fundamental conceptual mistake: they designed the IPv6 address space as an alternative to the IPv4 address space, rather than an extension to the IPv4 address space.

Now, it's Randy Bush ranting about how...

IPv6 is Incompatible with IPv4 on the Wire!
The Stupidity and Short-
Sighted Arrogance of this
is Utterly Mind-Blowing

Could have been avoided, e.g. if IPv6

had variable length addressing, IPv4

could have become the 32 bit variant.

These people are extremely senior computer scientists. Widely regarded as brilliant super-geniuses. Deny the truth and correctness of their dissertations at grave peril to your reputation. Or, so it's supposed. There are a lot of others who keep trotting out this nonsense. Big name Internet greybeards. I don't understand what is their major malfunction.

Okay. So, what's wrong with this argument?

On the surface, it seems sensible. When the North American Numbering Plan started running out of area codes, they had to transition to a system that allowed the middle digit in the area code to be a number other than one or zero. It was a mess, but nobody had to upgrade their telephones to be able to dial the new telephone numbers. A slightly more applicable analogy arose with overlay plans, which are the reason many Americans are now required to dial ten digits instead of seven.

Alas, if you drill a little deeper, the distinction between IPv6 being an alternative to IPv4 and it being an extension to IPv4 is completely illusory. Yes, I'm saying that Dan Bernstein is missing the point, and the Randy Bush is actively avoiding it.

To begin with, let's just observe that every IPv4 address is also an IPv6 address. The IPv4 address for my home server is currently 69.12.155.90. Can you guess what IPv6 address that is? Hint: it's really easy. It's 0000:0000:0000:0000:0000:0000:450c:9b5a. All those preceding zeroes are usually collapsed into a '::' prefix, so that address might be more easily written as ::450c:9b5a. And since this address is in the reserve IPv6 prefix for IPv4 addresses, i.e. ::/96, it's actually more commonly written as ::69.12.155.90.

This is cheating, I hear you bleat. My home server isn't reachable at that IPv6 address. Look up the AAAA record for conjury.org and this is what it says:

~ 501$ dig aaaa conjury.org
; <<>> DiG 9.4.1-P1 <<>> aaaa conjury.org
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28106
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4
;; QUESTION SECTION:
;conjury.org. IN AAAA
;; ANSWER SECTION:
conjury.org. 86400 IN AAAA 2001:5a8:4:2290::2
;; AUTHORITY SECTION:
conjury.org. 119 IN NS c.auth-ns.sonic.net.
conjury.org. 119 IN NS grymling.conjury.org.
conjury.org. 119 IN NS a.auth-ns.sonic.net.
conjury.org. 119 IN NS b.auth-ns.sonic.net.
;; ADDITIONAL SECTION:
c.auth-ns.sonic.net. 32092 IN A 69.9.186.104
grymling.conjury.org. 58152 IN A 69.12.155.90
a.auth-ns.sonic.net. 9576 IN A 209.204.159.20
b.auth-ns.sonic.net. 61677 IN A 64.142.88.72
;; Query time: 24 msec
;; SERVER: 17.206.12.12#53(17.206.12.12)
;; WHEN: Fri Feb 22 17:21:58 2008
;; MSG SIZE rcvd: 220

This is not ::69.12.155.90. There's no point in making any of the addresses in ::/96 reachable over IPv6. Any nodes that are reachable over IPv4 do not need to be reachable over IPv6 at their IPv4-compatible addresses. They're reachable over IPv4. Use IPv4 when communicating with them. In any case, IPv6 addresses are completely backward compatible with IPv4 addresses, i.e. it's trivial to use IPv6 addresses to identify all the same things identified today by IPv4 addresses. Just pad the upper 96 bits with zeroes. You're done.

"But wait," you say. "Look at the IPv6 header and packet format. It's completely different from the IPv4 header and packet format! Surely, they're not compatible on the wire!" Ah, look closely my young initiate.

Here's the IPv4 header:

+ Bits 0–3 4–7 8–15 16–18 19–31
0 Version Header length Type of Service
(now DiffServ and ECN) Total Length
32 Identification Flags Fragment Offset
64 Time to Live Protocol Header Checksum
96 Source Address
128 Destination Address
160 Options
160
or
192+
Data

+	Bits 0–3	4–7	8–15	16–18	19–31
0	Version	Header length	Type of Service (now DiffServ and ECN)	Total Length
32	Identification	Flags	Fragment Offset
64	Time to Live	Protocol	Header Checksum
96	Source Address
128	Destination Address
160	Options
160 or 192+	Data

Here's the IPv6 header:

Look very closely at the first four bits of the each header. That version field is there for a goddamn reason. See, in IPv4, the value in that field is a 4. In IPv6, the value in that field is a 6. It's how you tell the difference between an IPv4 header and an IPv6 header when all you have are the raw bits.

The Internet Protocol has ALWAYS had extensible addressing and packet formats. Every version of the protocol ever designed had the first four bits reserved for identifying the Version of the Internet Protocol in use. IPv4 is the 32 bit variant of the Internet Protocol. That's what that 4 is doing there taking up all that valuable space on the wire in the goddamn IPv4 header.

Bernstein goes on a long rant in his piece. Here's an illustrative excerpt...

[...]

Keith [Moore], there is one network that has aol.com and cnn.com and cs.utk.edu and an incredible number of other sites.

Normal people call this network ``the Internet.'' They insist on being connected to the Internet, so that they can exchange email and web pages and so on with other Internet sites.

The universe you're imagining, in which sites are split across two global networks that have trouble talking to each other, is an ancient historical mistake that will never be repeated. What kind of idiot would be the first to disconnect his site from the original Internet in favor of the new Internet? Why haven't you cut yourself off from IPv4, Keith?

[...]

Except, the universe where IPv6 and IPv4 coexist properly is a single global network. All those useful sites Bernstein is talking about are all on that network. It's called the Internet, and all those sites are reachable today on it by IPv4. Soon, when those sites want to communicate with other nodes that can get affordable IPv6 service but not IPv4 service— which is what the IPv4 Address Crisis is all about— all those legacy sites, e.g. google.com, cnn.com and playboy.com, will be reachable by IPv6 as well. Or they will be replaced by competitors who are.

So please— spare me the crap about how the designers of IPv6 failed to consider the engineering issues surrounding transition properly. They did make a couple major mistakes, e.g. site-local address scoping, excessively loose source routing, et cetera— but those are all ancient history now. The remaining minor issues are lot less intractable than you think. IPv6 would be ready for industrial use today, except for the sad fact that network operators— yes, if you've read all the way this far, and you think I'm talking about you personally, then I probably am— are deliberating trying to impede the progress of transition to IPv6 by making it harder to deploy than it needs to be.

More on all that later. I gotta run to catch a commuter shuttle.

RIP Itojun

Nov 1, 2007
1 comment

Sadly, Itojun has died. I was expecting to meet with him tomorrow along with a number of coworkers. I received news that our appointment must be cancelled due to his unavailability for any further meetings. I don't know anything about the circumstances of his death, and his family is holding a small memorial and funeral service in Tokyo.

I met him at IETF 69 in Chicago earlier this year, and he was a delight. We spoke in the lobby of the hotel for about two hours, and our conversation ranged over a wide array of topics. I looked forward to meeting him again and working with him on some of the projects I have that overlap with his interests. (At work, I am up to my eyeballs in a lot of source code that says "itojun" way up at the top of every last header file.)

I only met him once, corresponded with him by email several times before and since. Already, I miss him.

Yay! I Can Write Again!

Oct 24, 2007
1 comment

My employers have started operating a commuter coach service that runs between the Park And Ride center in Colma / Daly City straight to the corporate campus where my office is located. It only adds about fifteen minutes to my commute time, but it saves me about seven dollars per day in gasoline plus additional maintenance costs. The huge extra benefit to this is that I sometimes have time to spare while riding the coach to work on personal projects, and not company business.

This means I can write again. Progress on Arts Of The Wize is now proceeding at a completely reasonable pace. I feel certain I will finish the second draft by the end of the year, and probably not long after the Thanksgiving holiday.

I cannot tell you how happy this makes me.

The BookHate And Other Discontents

May 7, 2007
Post a comment

I continue rewriting Arts Of The Wize. The manuscript is now 192 pages, and it's about half completed. The BookHate is almost overpowering now. I can't remember when I started this project, and the only thing that keeps me from quitting at this point is the shame I would feel for having spent so much of my disposable free time only to abandon it before even receiving a single rejection notice. That would be undescribably lame.

I like my characters, and I like the world I've imagined for them (especially the world of my rewrite, which is a bit different than the first one). I like the story. There is just no way in hell it will sell.

How do I know this? I know it, because I'm dismayed at the prospects of trying to write a 100-word hook for Arts Of The Wize that will make it seem both fresh and interesting to a literary agent or publisher. Meanwhile, I've still got about another 200 pages to go with about 300 pages of first draft to use for raw material. Today, I actually gave serious consideration to the idea of adding a talking squid to Chapter Fourteen, just because I figured that would round out the collection. I'm imagining the conversation with the hypothetical agent who gets suckered into asking for my full manuscript.

"So, J.H.— why'd you put a talking squid here?"

"Because it's fantasy, not science fiction, but it's already got spaceships and robots, so I figured— hey, why not complete the set with talking squids?"

"Lose the squid."

"Could you sell it if I took it out?"

"Um… well…"

"You were just playing me there, weren't you?"

"Can you blame me? It was a moment of weakness. Freakin' talking squid. WTF is wrong wit you?"

In other [completely unrelated] news, I'm very close to releasing an Internet Draft that I expect will go over like a lead balloon in the V6OPS and IPV6 working groups. I'll post a link to it here when it goes up on the IETF.Org servers. So far, readers to whom I've privately circulated it have reacted with a collective Why-The-Fnork-Are-You-Doing-This? I wish I had a good answer to that. The truth is abjectly, painfully embarrassing, i.e. no one else is dumb enough to bring this idea up in front of the IETF, and it's my job to be this goddamn dumb.

Secretly, there is a part of me that hopes my idea will be so obviously dumb that everyone will come to their senses and realize that network layer policy-enforcing packet filters in organizational-boundary IPv6 routers are just a phenomenally bad idea, and we should have never listened to anybody who wrongly insisted they were essential for proper functioning of the Internet. My worst fear, actually, is that IETF might actually take the idea I've been tasked with championing seriously enough to make it a standards-track effort. At that point, firewalls in your ISP will be able to collect vast amounts of information about what software you are running and for what purpose, even if your computer doesn't actively communicate with anyone else. When I think about what a Big Brother authoritarian could do with the protocol I'm proposing, it makes my blood run cold, and my boss is insisting I fight for this thing in the IETF.

Now, do you see how talking squids could seem like a good idea to me? (Okay, okay— losing the squid. Jeebus.)

en passant

Sep 15, 2006
Post a comment

I'm about to fly out to Melbourne, Australia for an interim session of the IEEE 802.11 standards working group. We're resolving comments in the development of the forthcoming high-throughput wireless LAN protocol. I'll be sitting a convention center conference room all day every day for the whole week. Pity me.