IPv6. CSCI-4220 Network Programming Spring 2015

Transcription

1 IPv6 CSCI-4220 Network Programming Spring 2015

2 Why IPv6? The primary motivation for IPv6 is IPv4 address exhaustion. Other IPv6 features: Reduce reliance on NAT Anycast addresses Use path MTU discovery instead of fragmentation Compatibility with IPv4 NAT64 and NAT46

3 Address Exhaustion, CG-NAT One solution to the address exhaustion problem is carrier-grade NAT. However, this can create barriers to communication.

4 IPv6 Deployment According to ISP Hurricane Electric (http: //ipv6.he.net/statistics/): 18% of Internet autonomous systems use IPv6. Nearly 6.6 million domain names have associated IPv6 addresses, including... google.com facebook.com rpi.edu kernel.org

5 Main Changes IPv4 to IPv6 IPv4 32-bit addresses ARP Fragmentation NAT common IPv6 128-bit addresses NDP No fragmentation NAT rare

6 IPv6 Header 320 bits (larger than IPv4 but fewer fields) Version Traffic Class Payload Length Flow Label Next Header Source Address Destination Address Hop Limit

7 IPv6 Addresses 128 bits, typically in hexadecimal format examples: 2001:0470:8c21:0001:beae:c5ff:fe07:1d :f8b0:4004:0802:0000:0000:0000:1009

8 IPv6 Address Abbreviation These addresses aren t so easy to write or remember! Drop leading zeroes from a group. A single sequence of zeroes can be replaced by :: example: 2607:f8b0:4004:0802:0000:0000:0000: :f8b0:4004:802::1009

9 IPv6: Ambiguous Addresses We cannot abbreviate IPv6 addresses in a way that causes an ambiguity. example: 2607:0000:0000:0802:0000:0000:0000: 1009 may not be written as 2607::802::1009 but may be written as either 2607:0:0:802::1009 or 2607::802:0:0:0:1009

10 IPv6: Prefixes IPv6 addresses, like IPv4 addresses, have a host and network part. Network part is a prefix and its length is written with the /x notation. Smallest IPv6 network is typically /64 (64 bits in network part of address) example IPv6 prefixes: 2001:470:8c21::/ :470:8c21:1::/64 (subnet of the /48 above)

11 IPv6: Address Types Unicast a normal address Multicast sent to every host in a group of hosts multicast addresses have prefix ff00::/8 Anycast sent to a single host in a group of hosts don t look different from unicast addresses

12 IPv6: Link-Local Addresses These addresses are not routable and can only be used to communicate with directly connected hosts or routers. Prefix fe80::/10 These addresses must be qualified with an interface: fe80::beae:c5ff:fe07:1d66%eth0

13 IPv6: EUI-64 Addresses Many layer 2 addresses fit in 64 bits or less. Longest prefix typically used in IPv6 is /64 (64-bit host addresses) Idea: use layer 2 address as the host part of the layer 3 IPv6 address. example: MAC address bc:ae:c5:07:1d:66 becomes 2001:470:8c21:1:beae:c5ff:fe07:1d66

14 IPv6: EUI-64 Addresses Wait a minute, that wasn t exactly the same Padding was added to make the 48-bit MAC address into a 64-bit EUI-64 address and a couple bits get flipped See RFC 4291 appendix A for the gory details

15 IPv6 Routing IPv6 routing follows the same principles as IPv4 routing. Build a routing table Find longest prefix match Forward packet to appropriate gateway Differences: IPv6 uses NDP instead of ARP. Protocols used to build routing table may differ OSPFv3, RIPng Routers don t fragment packets above MTU

16 IPv6: NDP NDP is the Neighbor Discovery Protocol, part of ICMPv6. To request layer 2 address of a neighbor, send Neighbor Solicitation to a link-local multicast address (ff02::1:ffxx:xx:xx where XX:XX:XX are last 24 bits of IPv6 address). The neighbor replies with a Neighbor Advertisement containing its layer 2

17 Broadcast vs. Multicast: ARP About 200 ARP packets were being broadcast per minute when I grabbed these.

18 Broadcast vs. Multicast: NDP Note the layer 2 address here. It s a layer 2 multicast address, not the broadcast address.

19 Multicast Listener Reports Switches look at these to determine which ports correspond to a given multicast address.

20 IPv6: Autoconfiguration Neat NDP trick. NDP defines router solicitation and router advertisement messages as well. A new client can send a router solicitation to the all-routers multicast address from a linklocal EUI-64 address. It gets back a router advertisement with the globally routable prefix for its current

21 IPv6: Path MTU Discovery We said IPv6 routers never fragment packets. How does IPv6 cope with the issue of varying MTUs across a network? Requires minimum 1280 byte MTU for all links Router sends back an ICMPv6 message if the packet is too big. This message includes the MTU. Sender must send a smaller packet. IPv6 does have optional fragmentation but it is

22 Path MTU Discovery Example MTU 1500 MTU 1400 H1 R1 MTU 1300 R bytes too big, try bytes too big, try bytes (success) MTU 1500 R3 H2

23 IPv6: Backwards Compatibility IPv6 and IPv4 network programs can interoperate! Modern dual-stack OSs allow IPv6 programs to communicate over both IPv4 and IPv6 using the same code and APIs. The application only sees IPv6. What makes this possible?

24 IPv6-mapped IPv4 Addresses Since IPv4 addresses are smaller than IPv6 addresses, we can add a prefix to IPv4 addresses and turn them into IPv6 addresses! Prefix is ::ffff:0:0/96 Mapped addresses sometimes written as ::ffff: (last 4 bytes written in decimal form)

25 IPv6 NAT Typically written as NATxy (x, y = 6 or 4). We already know about NAT44. NAT66: many IPv6 hosts sharing a v6 address NAT64: allows v6-only hosts to share an IPv4 address to communicate with v4-only hosts NAT46: provide an IPv4 address to allow v4only hosts to reach an IPv6-only host NAT64 and NAT46 possible because transport layer protocols are similar or identical.

26 IPv6: NAT66 NAT66 works the same way as NAT44. NAT66 is rare due to the abundance of IPv6 addresses.

27 IPv6: NAT64 and NAT46 64:ff9b::a.b.c.d/96 well-known IPv6 format used for NATted IPv4 addresses (RFC 6052)

28 NAT64 example from 2001:0:0:1::1 to 64:ff9b:: from 64:ff9b:: to 2001:0:0:1::1 from to from to

29 NAT64 example original source original dest translated source translated dest 2001:0:0:1::1 [port 12345] 64:ff9b:: [port 22] [port 23456] [port 22] In NAT64, original addresses are IPv6 and translated addresses are IPv4.

30 NAT64 example original source original dest translated source translated dest 2001:0:0:1::1 [port 12345] 64:ff9b:: [port 22] [port 23456] [port 22] In NAT64, sources are translated. IPv4 destinations are extracted from the IPv6

31 NAT46 example from to from to from 64:ff9b:: to 2001:0:0:1::1 from 2001:0:0:1::1 to 64:ff9b::

32 NAT46 example original source original dest translated source translated dest [port 12345] [port 22] 64:ff9b:: [port 23456] 2001:0:0:1::1 [port 22] In NAT46, original addresses are IPv4 and translated addresses are IPv6.

33 NAT46 example original source original dest translated source translated dest [port 12345] [port 22] 64:ff9b:: [port 23456] 2001:0:0:1::1 [port 22] In NAT46, the destination address is translated and the IPv4 source is

34 NAT64 vs. NAT46 The difference is which side talks first: IPv4 or IPv6. If we have a client and server, and the client talks first, then... NAT64 = IPv6-only client trying to reach IPv4 server NAT46 = IPv4 client trying to reach IPv6-only server

35 NAT64 vs. NAT46 NAT64: Original addresses are IPv6 Translated addresses are IPv4 Forward direction translates source address and de-embeds destination address from v6 address. NAT46: Original addresses are IPv4 Translated addresses are IPv6 Forward direction translates destination

36 NAT64/NAT46 Potential Issues Problems if upper-layer protocols transfer addresses (e.g. a SIP VoIP proxy) NAT46 assigns IPv4 addresses to IPv6 servers (doesn t help with address exhaustion)

37 IPv6: Summary Most of today s hosts are dual-stack (capable of both IPv4 and IPv6 communication) IPv4 address exhaustion is driving the move to IPv6. Network software needs to be ready for the transition!

38 References RFC 2460: Internet Protocol, Version 6 RFC 4038: Application Aspects of IPv6 Transition RFC 4291: IP Version 6 Addressing Architecture RFC 6052, IPv6 Addressing of IPv4/IPv6 Translators