Stories
Slash Boxes
Comments

News for nerds, stuff that matters

How Feds are Dropping the Ball on IPv6

Posted by CmdrTaco on Monday December 17, @11:20AM
from the go-long-go-long dept.
BobB-NW writes "U.S. federal agencies have six months to meet a deadline to support IPv6, an upgrade to the Internet's main communications protocol known as IPv4. But most agencies are not grabbing hold of the new technology and running with it, industry observers say. Instead, most federal CIOs are doing the bare minimum required by law to meet the IPv6 mandate, and they aren't planning to use the new network protocol for the foreseeable future."

Related Stories

Display Options Threshold:
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • As things go ... (Score:5, Interesting)

    by foobsr (693224) on Monday December 17, @11:20AM (#21725978) Homepage Journal
    Regional registry IPv4 address exhaustion in... 1442 Days, 07 Hours, 42 Minutes, 42 Seconds. ( http://penrose.uk6x.com/ [uk6x.com] )

    So there is plenty time for someone to wake up, wanting it yesterday.

    CC.
  • by yagu (721525) * <yayagu@NoSPAM.gmail.com> on Monday December 17, @11:22AM (#21725992) Journal

    I don't blame anyone, even government in this case, for avoiding the hassle of getting everything converted to IPv6. Maybe eventually we all will have to be there, but there always seems to be workarounds that work for everyone, minimal hassle, minimal pain.

    If you wanted a Starbucks coffee, and it was one street down, and someone told you you had to go through the in-between building, climb up and down its twenty flights of stairs just to get to the next street for you coffee, and you knew you could just walk around the building on the sidewalk, what would you do? Now, if the building were only two stories high, and the block to walk around were 600 ft each side, it might be a different choice.

    An interesting aside, meeting the mandate only requires they are IPv6 capable, not running it. This is the same height bar the government set for Microsoft in the early nineties when Microsoft delivered the DOA POSIX-compliant (never to be really used) NT. NT, with its barely implemented POSIX subsystem (only implemented the library portion, btw, not the user interface) got to put a check in the POSIX checkbox for government contracts.

    Lesson to be learned? If you want to make an effective mandate, make it a mandate for implementation, not capability.

    The government:

    • couldn't do metric
    • couldn't do POSIX
    • isn't doing IPv6
    • What is IPv6 compliance? (Score:5, Interesting)

      by Midnight Thunder (17205) on Monday December 17, @11:34AM (#21726100) Homepage Journal
      IPv6 isn't that complicated to set up, especially since most recent desktops support IPv6 out of the box, though that doesn't mean that there aren't a few hurdles, including:
          - Upgrading routers, firewalls et al to support IPv6.
          - Some application software still not being fully IPv6 ready.
          - A large number of sites still don't have IPv6 DNS addresses

      I think the problem, like many government proposals is not the recommendation, but the lack of research guidelines or instructions on how to make the infrastructure IPv6 compliant or what it means to be IPv6 compliant. For example is simply having a 6to4 gateway considered IPv6 compliance.

      All this said and done, has anyone here on /. actually upgraded a network to be IPv6 compliant and what can you tell us about real world experience.
      • Re:What is IPv6 compliance? by djupedal (Score:2) Monday December 17, @11:48AM
      • Re:What is IPv6 compliance? by TechHawk (Score:2) Monday December 17, @11:51AM
      • Re:What is IPv6 compliance? by TubeSteak (Score:2) Monday December 17, @11:52AM
      • Re:What is IPv6 compliance? by jd (Score:2) Monday December 17, @11:56AM
      • Re:What is IPv6 compliance? by Midnight Thunder (Score:2) Monday December 17, @12:05PM
      • I've chosen not to be IPv6 compliant by davidwr (Score:1) Monday December 17, @12:06PM
      • Re:What is IPv6 compliance? by CastrTroy (Score:3) Monday December 17, @12:09PM
      • Routers can be a big issue (Score:5, Informative)

        by Sycraft-fu (314770) on Monday December 17, @12:10PM (#21726564)
        That is the reason why we don't do IPv6 where I work (university). A lot of people think it is easier, and more importantly cheaper, than it really is because they've worked on small networks, or have been at a place that did IPv6 wrong.

        What happens on a large, high speed, network is that your routers rely on hardware acceleration to be able to pass traffic as quickly as you want, while still implementing all the rules you want. What that means is there are ASICs of various kinds that can handle various kinds of traffic. On older hardware (and some newer too), these are for IPv4. So anything else has to be handled by the router's CPU, which really isn't very powerful.

        So, what that means is that you can technically support IPv6 by just turning it on, but only if you are willing to do it poorly. If we enabled it on all the routers, we would effectively support IPv6 internally. Great, and initially everything would work fine. However if any significant number of people actually decided to use it, network performance issues would come up in a hurry.

        To really support it we have to buy new routers that support IPv6 in hardware. This could be done, but it would be expensive. Last time it was looked at the price tag was over $5 million. As you can probably guess, the university wasn't that interested in spending money like that for what was perceived to be no gain at all.

        So while in a smaller network, where there's only an edge router and it isn't very high speed, yes IPv6 can be as simple as some software updates and turning it on for all devices. However when you have a larger, higher performance, network, you often need new hardware. That's a lot of money, and it is hard to justify that being spent for no real gain.
      • Re:What is IPv6 compliance? (Score:5, Interesting)

        by Tony Hoyle (11698) <tmh@nodomain.org> on Monday December 17, @12:11PM (#21726572) Homepage
        IPv6 isn't that complicated to set up

        Yes it is.

        Desktops are only the start.
        Your servers need it (no ipv6 AD support).
        No ipv6 network printer support.
        No ipv6 VOIP support.
        Poor to nonexistant ipv6 router support, and of those that do most of them don't support firewalling it.
        Poor to nonexistant connectivity. Try asking the average ISP for an ipv6 address and they'll just look at you funny. It's not just consumer ISPs either - this business park I'm in at the moment has *no idea* what ipv6 is and has no timescale to look at it either.

        Then there's the bits and pieces.. Dies Blackberry support ipv6? I know iphone doesn't, and Symbian's implementation is broken (relies on a dhcpv6 server and even then seems to need some kind of proprietary extension to that).
      • Re:What is IPv6 compliance? (Score:5, Insightful)

        by Russ Nelson (33911) on Monday December 17, @12:44PM (#21727134) Homepage
        - A large number of sites still don't have IPv6 DNS addresses
        That's the biggest problem. Until I can reach every server with IPv6, I'll still need IPv4. Since I need IPv4, why should I bother with IPv6?
      • IPv6 is a dumb protocol by loki_tiwaz (Score:1) Monday December 17, @01:39PM
      • Re:What is IPv6 compliance? (Score:5, Informative)

        by anticypher (48312) <`moc.liamg' `ta' `rehpycitna'> on Monday December 17, @01:51PM (#21728140) Homepage
        has anyone here on /. actually upgraded a network to be IPv6 compliant and what can you tell us about real world experience.

        I've done it. And now that I have a couple of posts in this thread banging the drum FOR IPv6 and correcting serious misconceptions, I'll use this thread to trash IPv6 :-)

        On most networking equipment, turning on IPv6 is no more complex than a global "ipv6 routing" and setting the address on interfaces just like you do for IPv4. I'll use a pseudo-cisco example
        interface Gig0/0
        ip address 223.123.40.1 255.255.224.0
        ipv6 address 2001:1a1:98b5:1::1/64

        After that, most modern OSes on that segment will recognize the router announcements, autoconfigure, and start using IPv6. That's the easy part.

        All routers and switches introduced to the market in the last two or so years seem to support v6 traffic, in VLSI hardware for the higher end kit. In fact, I haven't seen one new product announcement in at least two years that didn't have wire speed IPv6, no more passing unknown packets to CPU. But new kit is only put in slowly, and old kit has a useful lifespan of around a decade. Try passing IPv6 traffic on an older layer2 switch over a dedicated vlan, and many older switches can't deal with production traffic levels.

        Once you start climbing the protocol stack you run into more problems.

        With the sole exception of OpenBSDs pf firewall, there isn't a firewall out there that does IPv6 fully. Many firewall manufacturers will announce IPv6 support, but all that means is they have a rule for detecting IPv6 packets and either dropping them or passing them. They can't filter on address ranges or higher level protocols. One big manufacturer of firewalls now claims they support IPv6 because although their equipment doesn't yet support it, their tech support will take feature requests. Network security software (types like nmap) have little to no support, mostly because the authors have no real world examples to code around.

        Services vary in their v6 support. Bind is fantastic. Apache kind of supports it, but many modules in Apache2 choke when it's turned on. The web programming languages are all a mess in their support; perl, PHP, java, python and the rest are a complete gamble, and even when support is mostly there, bugs crop up all over the place. The databases used behind many websites, such as MySQL and Postgres have spotty support, and if you don't go back and clean up your database code, they'll return all kinds of shit if the webserver starts passing in IPv6 addresses where someone hardcoded 4 bytes. Some of the freeware/GPLed/opensource projects like ircd and jabberd seem to have full support, and there are very few service daemons that don't at least acknowledge IPv6 existence.

        Up at the application level, all modern browsers will use IPv6 correctly. Many apps written for Apple OSX make use of IPv6 if it's present, the only exception I know of is skype. All my networks, and most of my client's networks are dual stacked, so I never even notice that all my SSH sessions are over IPv6, as are all my web connections to nagios or cacti machines, our instant messenger traffic and most everything else. At least at the user application level, there has been years of preparation and it shows. On Vista, what little playing around I've done shows almost no application level support except IE7 which works as well as IE7 possibly can.

        Small networking appliance support is almost non-existant. Except for Apple's wireless networking box, there isn't a DSL or cable modem on sale in the west that has support. In China, Korea, Japan and a few other south-east asian countries, most CPE boxes have IPv6 support, because most ISPs are forced to use it as they can't get enough IPv4 addresses for their end users. Much of the IPv6 web traffic I see outside my own little European island is to sites in the far east, where support is widespread.

        Mandatory IPSec security is a joke, many v6 n
      • Re:What is IPv6 compliance? by Znork (Score:2) Monday December 17, @02:57PM
      • Re:What is IPv6 compliance? by g-san (Score:2) Monday December 17, @03:30PM
      • Re:What is IPv6 compliance? by nschubach (Score:2) Monday December 17, @12:05PM
      • 2 replies beneath your current threshold.
    • Re:I don't blame anyone for avoiding IPv6, by Bert64 (Score:2) Monday December 17, @11:35AM
    • Blame Yourself by fm6 (Score:2) Monday December 17, @11:57AM
    • Re:I don't blame anyone for avoiding IPv6, by dubl-u (Score:1) Monday December 17, @12:25PM
    • Re:I don't blame anyone for avoiding IPv6, by Quiet_Desperation (Score:2) Monday December 17, @01:11PM
    • Re:I don't blame anyone for avoiding IPv6, by wertigon (Score:1) Monday December 17, @02:14PM
    • Re:I don't blame anyone for avoiding IPv6, by ghjm (Score:2) Monday December 17, @02:35PM
    • Re:I don't blame anyone for avoiding IPv6, by plague3106 (Score:1) Monday December 17, @12:03PM
    • Re:I don't blame anyone for avoiding IPv6, by CastrTroy (Score:2) Monday December 17, @12:11PM
    • Re:I don't blame anyone for avoiding IPv6, by ColdWetDog (Score:1) Monday December 17, @12:14PM
    • The Military's fuck up in Iraq is a warning. by FatSean (Score:2) Monday December 17, @12:33PM
    • Re:I don't blame anyone for avoiding IPv6, by zippthorne (Score:2) Monday December 17, @12:51PM
    • Re:I don't blame anyone for avoiding IPv6, by vtcodger (Score:2) Monday December 17, @01:11PM
    • Re:I don't blame anyone for avoiding IPv6, by vtcodger (Score:2) Monday December 17, @01:18PM
    • Re:I don't blame anyone for avoiding IPv6, by cayenne8 (Score:2) Monday December 17, @01:56PM
    • 2 replies beneath your current threshold.
  • No real drive (Score:5, Interesting)

    by Marillion (33728) <ericbardes.gmail@com> on Monday December 17, @11:27AM (#21726034)
    I also look at the industry as a whole. I don't see any real drive, a critical mass if you will, for getting off of IPv4. My ISP doesn't offer IPv6. My company doesn't use IPv6. It's little wonder that the government is dragging it's feet.
  • by 12357bd (686909) on Monday December 17, @11:29AM (#21726062)
    They are just making too much money managing the current ipv4 limitations, that's the problem.
  • A rough guide as to why... (Score:4, Interesting)

    by jd (1658) <[imipak] [at] [yahoo.com]> on Monday December 17, @11:36AM (#21726136) Homepage Journal
    ...this is important (beyond the address count issue) for the Feds specifically:

    • IPv6 has better security provisions within the protocol itself, making the usual run of D- through to F- on Federal security audits less likely.
    • The protocol incorporates many of the features back-engineered into IPv4 as standard, producing a cleaner design with fewer compromises and fewer flaws
    • Built-in support for protocol expansion means future updates should have less impact and be adoptable faster
    • Automatic configuration means fewer errors and less maintenance
    • Alignment of entries in the header means potentially greater throughput
    • Skript Kiddies will end up jumping off bridges as they won't know what to do
    • Software contracting firms are located in regions in which elections are due, creating excellent opportunities on both sides of the table
  • by postbigbang (761081) on Monday December 17, @11:37AM (#21726144)
    and many would argue that it's not. The IPV6 address space is beyond reasonable, and the onerous idea of tracking every conceivable device right down to bullets fired (look it up) is staggeringly senseless overkill. We still have huge Class B spaces taken up by various hoarders that need to give it up and use some common sense. There are loads of CIDR blocks that need to be used or pushed back into the pools of available IPV4 space.

    Those that do only the minimum to achieve IPV6 addressing are in my personal and technical opinion, doing nothing incorrectly beyond violating the spirit of mind-numbing nonsensical regulation. Even if IPV6 addressing were rational, then managing that space still needs work-- even after more than a decade of implementation.
  • Where is the carrot? (Score:4, Insightful)

    by Slashdot Parent (995749) on Monday December 17, @11:41AM (#21726200)
    What benefit does your average government agency get for switching to IPv6, and does it outweigh the costs?

    Obviously not, because if the benefits outweighed the costs, no mandate would be necessary. Agencies would have long ago switched on their own.

    And since costs outweigh the benefits, who can blame agencies for doing the bare minimum to achieve compliance? The writeup makes it sound like agency obstinance, but I view it is good budget stewardship. Agencies don't seem to want to flush good budget down the IPv6 toilet.
  • by infonography (566403) on Monday December 17, @11:42AM (#21726218) Homepage
    Since Iraq and Afghanistan didn't go so well and Iran isn't popular expect the Bush administration to declare war on the 10.0.0.0 addresses.

    Banner to read TRANSMISSION ACCOMPLISHED

    I got the karma go ahead and troll me.
  • Dropping the ball? (Score:1)

    by chriscoolc (954268) on Monday December 17, @11:46AM (#21726252)
    Relax. They have six months to pick up the ball, and even at that who cares?

    Perhaps they are rightly spending time on critical issues such as people running live wires into passenger jet fuel tanks, which -- on the face of it -- seems like a really bad idea.
    • 1 reply beneath your current threshold.
  • By the way (Score:1)

    by ValiSystem (845610) on Monday December 17, @11:46AM (#21726256)
    One of the major french ISP has activated IPv6 last week, with autoconfiguration of user lan with global scope address. It's the first step for IPv6 here in france, and only geeks activated that option, but if a major application has success with IPv6 (read : a P2P file sharing that work well and only in IPv6), It is very likely that many people will activate it. The major problem is that people use their NAT as an "automatic" firewall, and i wonder the impact of global scope IPv6 address will have on machines corruption. Certainly a few impact at this time, but for the future, i don't know.

    Anyway, get prepared for more and more IPv6 traffic, at least from france :)
    • Re:By the way by Tony Hoyle (Score:2) Monday December 17, @12:36PM
    • Re:By the way by klapaucjusz (Score:1) Monday December 17, @03:04PM
  • by Besna (1175279) * on Monday December 17, @11:46AM (#21726258)
    Where I work, I'm trying to push IPv6. Some are reluctant--only considering in face of federal policy. We're not really too far into networking, but there's room in both product and IT for it. You have to beat down the thick molasses when upgrading.
  • Why bother? (Score:2, Insightful)

    by davidwr (791652) on Monday December 17, @11:47AM (#21726266) Homepage Journal
    As much as people hate stop-gaps like NAT, in some environments it is a cheap solution to several problems and doesn't introduce new ones.

    Besides, how long did it take government computer networks to switch from proprietary systems like IBM's SNA, Microsoft's NetBIOS, Banyan's VINES, Digital's DECNET, Apple's Appletalk, and others to IPv4? IPv4 came out in the early '80s. I'd venture to say more than one government office was still using a completely-non-IPv4 network well into the '90s.

    No, unless there is a big benefit that justifies the cost, most System Administrators are going to do as little as they can get away with, both in the government and in Corporate America.

    Now, if you are in a shop where it's cost-effective to be on IPv6 then by all means why aren't you there already?
    • Re:Why bother? (Score:4, Insightful)

      by Antique Geekmeister (740220) on Monday December 17, @12:27PM (#21726826)
      Oh, NAT is more useful in several ways. It provides a single router or entry point that you can monitor for security reasons, it prevents people from running announced services such as HTTP, SMTP, or file sharing from their internal machines, and it draws a useful curtain of obscurity against activities you don't want traced back to their source.

      Switching to IPv6 often involves hardware switchovers and the elimination of old services that simply cannot interoperate with it because they weren't designed to, and should have been discarded years ago but haven't been, and the original author has very much moved on.
    • NAT introduced *lots* of problems by billstewart (Score:2) Monday December 17, @12:45PM
  • why not an IPv4.1 (Score:2)

    by FudRucker (866063) on Monday December 17, @11:48AM (#21726272)
    add a nation tag to the end of IP addresses like 123.456.78.90.usa or 123.456.78.90.cn for China, would this be possible to implement @ the root backbone servers?
    • Re:why not an IPv4.1 by plague3106 (Score:1) Monday December 17, @11:59AM
    • Re:why not an IPv4.1 (Score:5, Informative)

      by jandrese (485) <kensama@vt.edu> on Monday December 17, @12:01PM (#21726454) Homepage Journal
      Because there is no space in the IP header for that, and no router support. This means you'd have to extend the IP packet header by creating a new protocol number and once you get all of that stuff done and implemented, you have done just as much work as you would have done to switch over to IPv6 (which is afterall just another protocol number). One of the primary design goals of IPv6 was to avoid ever having to make this transition again (look how painful it has been already), so halfassed solutions that will require us to make yet another transition down the road are less than appealing.
    • It's already done, it's called 10. by davidwr (Score:1) Monday December 17, @12:19PM
  • IPv6 Changes (Score:1)

    by GodCandy (1132301) on Monday December 17, @11:49AM (#21726286)
    Having worked for a web hosting provider at one point, migration to anything new is scary. In our case it was more like will our clients sites still function correctly after they are migrated. Thus far they have put off migrating hoping that someone else would be the gunni pig on this one. I don't know of too many larger networks running on the IPV6 protocols yet. Hopefully in the near future someone will suck it up and convert. I think that someone will have to be the test bed and hopefully there migration will serve as a wakeup call to all providers who are still waiting to see what will happen. I honestly don't see a worldwide usage of ipv6 any time in the next few years. Maybe someone will prove me wrong. We will see.
  • Doesn't matter... (Score:1, Insightful)

    by HogGeek (456673) on Monday December 17, @11:49AM (#21726290)
    ... The world is going to end December 21st, 2012.

    We should have enough to get us there...
  • Academic Attitude (Score:5, Insightful)

    by jeremiahbell (522050) on Monday December 17, @11:49AM (#21726292) Homepage
    During this last college semester I expressed my disappointment that IPv6 wasn't being implemented as widely as I thought it should be. I also subtly hinted at my disappoint that IPv6 wasn't covered at all (except one half a page of 405). My teacher said "I think it will take a new generation of Network Tech to implement IPv6". How in the hell are we going to have a new generation implementing it when it isn't even taught? I just took that joke of a Network+ test and now I'm certified, and I don't know diddly-squat about IPv6. Thankfully Wikipedia is there to explain a little bit of it to me.
  • What doesn't support IPv6 these days? (Score:3, Informative)

    by anticypher (48312) <`moc.liamg' `ta' `rehpycitna'> on Monday December 17, @11:55AM (#21726356) Homepage
    Every major OS has IPv6 installed and enabled. Vista and XP, MacOS-X, all the BSDs, all the major Linux distros, Solaris. Older OSes like XP-SP1 or Win2k can get IPv6 installed or enabled with little trouble. It's a package install on Linux if it isn't there already.

    Every major networking equipment supplier has IPv6 support on their product lines, although some still charge for turning it on. All the high-end Cisco routers and switches support it natively, but charge extra for the IOS image that can use it. Foundry's current product line supports it everywhere. Juniper has pretty much always had IPv6. Working down the list of less popular suppliers shows most of them have some level of IPv6 support. Sure, most of the older networking equipment can't deal with v6 traffic, and the useful life for old kit is long enough that it's still probably 70% of the installed base.

    Most internet enabled mobile phones have IPv6 built in, but it tends to be invisible to the user because the phone companies are only using it for local communications, if at all. All the Nokias support IPv6 in their network stack, but I haven't seen one system that takes advantage, yet. iPhones and iPod Touches have v6 enabled by default, and if they connect to a WiFi system that has v6 router announcements, they'll autoconfigure and Safari will use it transparently.

    Where IPv6 support falls down is in super-cheap consumer networking products. All those little $40 DSL modem+firewall+4 port switch boxes just don't support v6 at all. The only good news is from when I was in discussions with the Chinese company behind many of these boxes. The versions released in China are all IPv6, it's only the versions sold outside China where they just don't include it because there is no market demand.

    The only real problem right now is with ISPs. Until the engineering staff inside ISPs and hosting companies take the responsibility to start turning it on, sales and marketing will remain blissfully unaware that it can be sold.

    One of the largest IPSs in Europe turned on IPv6 to all 8 million users this week. They've done the right thing and made it opt-in for now, their customers have to go to their control panel web page and turn it on, but almost 50,000 people did in the first 24 hours. They turned it on, and their Macs and Win machines started using IPv6 with no need to do anything other than tell Firefox and Tbird to start using IPv6 for DNS lookups. Because this one major ISP did this, their main competitor has been forced to make plans to enable IPv6 in January. After that, any ISP that doesn't have IPv6 turned on will be branded as "obsolete" or "incompetent".

    the AC
  • IPv6 still does nothing (Score:3, Insightful)

    by Russ Nelson (33911) on Monday December 17, @11:56AM (#21726394) Homepage
    IPv6 still does nothing for me. Until I can reach everybody who is listen()'ing for me using IPv6, having an IPv6 address, or IPv6 stack, or IPv6 routing doesn't help me one bit.

    Until that happens, NOBODY can adopt IPv6. That's the law, and no legislation can change that.
  • who cares? (Score:1)

    by moracity (925736) on Monday December 17, @12:12PM (#21726602)
    Does it really matter if we run out of IP4 address space? A majority of the internet is either a waste or a joke - myspace, facebook, etc...it's all pointless crap.

    Why not reclaim all the wasted, unused existing space? Adding IPv6 seems akin to raising taxes instead of controlling spending. It's going to cost a shitload of money and Regular Joe won't see any benefit.
  • Miredo (Score:2)

    by Midnight Thunder (17205) on Monday December 17, @12:26PM (#21726808) Homepage Journal
    If you are interested in playing with IPv6 and are behind a NAT, then Teredo provides the necessary solution. There are certainly other 6to4 solutions, but they usually fail behind a NAT or require that your local gateway lets through certain packet types. Windows Vista already supports Teredo, from what I understand, but for other platforms an implemenation is available in the form of Miredo [remlab.net]. Its GPL licensed, for those who care.
    • Re:Miredo by Tony Hoyle (Score:2) Monday December 17, @12:52PM
  • Obligatory (Score:1)

    by vslashg (209560) on Monday December 17, @12:48PM (#21727180)
    A link to DJB's essay on the issues of IPV6 adoption [cr.yp.to] feels obligatory here.
  • ...so they can reset it. Seriously, it's not like there's a scientific law that says the world will break if they're not moved in six months. They set a goal. They might not make it. OH MY GOD...
  • Dropping the Ball? (Score:2, Interesting)

    by Anonymous Coward on Monday December 17, @01:21PM (#21727716)
    Hope you all don't think this just applies to computer networks. I am the avionics lead for a military aircraft and I have to periodically explain what we are doing (very little) to make the aircraft internal busses and avionics IPv6 compliant. Since our plane isn't connected to a live network there is little need for us to be IPv6 compliant now. But DoD policy is that everything eventually be IPv6 compliant. And the civil aviation world is talking about making their data links IPv6 based, too. Huge headache for us if we are ever directed to do this. I know some platforms are facing some big problems and bills - imagine re-writing the OFP to handle IPv6 addressing. Fortunately because we do not have an active military data link on our busses we are somewhat exempt for now.

    And if you want another "great" idea, try this: I was just tasked to explain what we are doing to impliment PKI on our aircraft (again, very little). Some things just don't make sense now, and having PKI to logon or use a tactical aircraft doesn't make sense. I can see it now, "Sorry, I can't do the mission today. The hardware reader for the PKI isn't working or I forgot/misentered my password." Someday the hardware/software will be reliable enough for tactical systems but it ain't there yet. And lets not go down the biometrics path either.

    Writing as AC since its been so long since I actually submitted anything that I have forgotten all account info.
  • by dada21 (163177) <adam.dada@gmail.com> on Monday December 17, @01:21PM (#21727738) Homepage Journal
    I thought LANtastic barely supported IPv4. That IS what the Feds are using still, right?
  • The Real Problem (Score:1)

    by tgunsch (1204468) on Monday December 17, @01:50PM (#21728126)
    The main point of this article is that the Feds are not implementing IPv6 as mandated. What the article fails to reveal is that industry is not making IPv6 products that will encourage implementation of IPv6. If I want to implement IPv6 on my production network, I have to step backwards in capability from my IPv4 network. When the mandates were first published (DoD in 2003, OMB in 2005), the expectation was that industry would rush to produce IPv6 capabilities, equivalent or better than currently available in IPv4. Reality has been quite different. The Department of Defense and the US Govt just don't have the influencing power over industry that they once had, because they make up a much smaller percentage of the marketplace now.

    What we need from industry are advanced capabilities in IPv6 products - products that utilize IPv6 mobility and auto-configuration, and of course security, in ways that IPv4 cannot. When applications exist that can do things in IPv6 that they cannot do in IPv4, then the incentive to migrate will finally be positive. Right now, we can't even get basic security capabilities for our IPv6 networks. Network management over IPv6 is all but non-existent and advanced IPv4 features, like multicast and prioritization, are supported in only a few IPv6 products. Security, though, is the biggest hold-up, and it isn't because OMB did not mandate implementation of IPv6 security. It is because the commercial products don't exist. Federal agencies are not going to implement IPv6 with gaping security holes.

    The DoD and OMB mandates provided a target on the wall, a target that we are obviously not going to hit, but one that we continue to at least aim at. Hopefully the target will continue to provide incentive to industry to provide the IPv6 products needed, not only by the first responders (DoD, Emergency workers), but by all of the federal government.

  • by Lookin4Trouble (1112649) on Monday December 17, @02:03PM (#21728312)
    I'll comment that the federal agency I work for has our points of presence on the internet IPv6-compatible. Don't lump us together with the folks who aren't ready.
  • What Went Wrong (Score:2)

    by Effugas (2378) * on Monday December 17, @02:45PM (#21729224) Homepage
    Couple major things went wrong:

    First, we only needed 48 to 64 bit addresses. 128 bits are actually unmanageable. I'm not going to argue it out, as it's an old and painful discussion. Suffice it to say, the real world has shown that raw IP's are used a lot more than people thought.

    Second, autoconfiguration has been a nightmare. Addressing depended on DNS, and then DNS was bolted on, poorly. *sighs*

    Third, it really should have been partially backwards compatible with IPv4. I know they wanted to build new toys and all that, but the correct approach would have been a standard V4 header, with a V6 extension that added between 16 and 32 bits of endpoints. Core IPv4 routers would have been limited to routing based on only the first four bytes of the IP at best, but that's better than the present 0.

    There's more, of course. Too many spherical holy cows involved, and we've suffered for it.
    • 1 reply beneath your current threshold.
  • No Need To (Score:1)

    by VonSkippy (892467) on Monday December 17, @04:01PM (#21730758) Homepage
    As anyone who has recently provisioned a new circuit knows, you have to justify your needs in order to get a large subnet (usually anything bigger then a /27).

    So the answer to NOT running out of IPv4 space is to UN-grandfather all of the current assignments, and make all those Class A and Class B hogs justify their usage/ownership.

    Eminent domain should be applicable.

    Having a bunch of corp's re-ip their network is work, but certainly it's WAY less expensive then redesigning the internet (and the associated new hardware costs said redesign would incur).
  • by kc8jhs (746030) on Monday December 17, @04:56PM (#21731646)
  • by peter (3389) on Monday December 17, @07:57PM (#21733434) Homepage
    I haven't kept up with TCP developments recently, but a couple years ago I read up on TCP Vegas vs. Reno, and all that. Vegas would make the Internet better if everyone used it (IIRC, its congestion control tried to back off sooner when packets are late, to avoid getting packet drops. Reno only considers drops). But nobody will switch to it first because it gets out-competed for bandwidth by TCP Reno and variants (which everyone uses). I know there are tweaks to Reno (NewReno), but AFAIK everyone using Vegas would still be the ideal case.

      TCP Vegas over IPv6 is no different from TCP Vegas over IPv4. It still doesn't take its fair share of bandwidth vs. TCP Reno (v4 or v6). Can anyone think of a way to link these switch-overs? I don't think many people would want to bias routers against dropping v6 TCP packets on the assumption they were TCP Vegas.

      But v6 and Vegas seem like two big switchovers that would both be useful. There's got to be a way to get people to make both switches, if they're going to use IPv6.
  • by Skapare (16644) on Monday December 17, @09:12PM (#21733890) Homepage

    The fundamental problem as to why there is so little drive to make a big switch to IPv6 is because what IPv6 offers ... and this is important ... over IPv4 is relatively small compared to what IPv4 offered over its predecessor, which was essentially going from no internet at all to having what we have today. There needs to be some kind of real motivating force to make it happen. IPv4 happened because having an internet was a motivating force. What does IPv6 offer? Very little as long as we still get IPv4 addresses. Other kinds of motivations are also possible. Take a look at how much the over-the-air TV broadcasters dragged their feet in deploying digital transmission at full capacity. Now we have a pretty solid analog shutoff date, so they better get those digital transmitters going (most have, to at least some degree, now). The biggest encouragement to getting IPv6 rolling is to schedule a definite, but very doable, IPv4 cutoff date for at least some critical piece of the net most people want. But we have to choose what that is. Access to the government? Access to routers going across national borders? Access to porn?

  • by davidwr (791652) on Monday December 17, @12:10PM (#21726570) Homepage Journal
    #ping anonymouscoward.slashdot.org
    Pinging anonymouscoward.slashdot.org [66.35.250.151] with 32 bytes of data:

    No reply. I guess you got your wish.
  • 7 replies beneath your current threshold.