Re: IPv6 address usage

[Fernando Gont <[e-mail]>]

On 24/1/20 17:23, Michael Richardson wrote:
> 
> Fernando Gont <[e-mail]> wrote:
>      >> I think that it is reasonable to establish an upper limit (8? 16?) of number
>      >> of entries per MAC address in a border router in those environments.
> 
>      > HOw would that go along with RFC7834/BCP204?
> 
> 1) Number of Neighbor Cache Entries, not necessarily addresses...
> 2) there is a different between avoiding the limit of "1" address and
>     suppporting NCE 2^8 per host.  A /64 delegation occupies 1 NCE, or
>     more accurately, 1 TCAM entry. It's likely that routing and NCE
>     occupy the same TCAM.
> 3) a problem with PD per-host is that the upper bits are now unique for host,
>     which makes 4941 somewhat useless, because you can't really hide in a
>     crowd of one.

Well, in that case, that would imply your adversary knows you're 
connected to a one-prefix-per-host network.



>      >> This is exactly the place where temporary addresses make the most sense.
>      >> The only reason it isn't a problem now is because (a) lack of IPv6,
>      >> (b) most coffee-shop visits are shorter than lifetime.
> 
>      > Where, specificallt, would you expect temporary addresses to be causing
>      > trouble?
> 
> On a network like the IETF's, where supporting 1500 laptops winds up
> requiring 64K NCE entries in every router, and we have only 8K.

Questions:

Does the network really hit 64K as a result of temporary addresses?

(that would also assume that clients employ multiple long-live 
connections issued during the week. Otherwise, while a client might have 
multiple valid addresses, you wouldn't hear from them).

Any clues whether folks would use DHCPv6 if they could? (for all 
practical purposes)



> On a campus network I can see there being 30,000 student-devices.
> If we allow for 8-16 per device, that's probably manageable, but 200 per
> device is not.

The underlying problem is that we slaac, you don't get to allow or 
disallow. But rather advertise and hope for the best.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492