Re: RFC4941bis: consequences of many addresses for the network

[[e-mail]]

Hi Philip,

> The question of an address per transport connection is why would you do that?
> In many IPv4 installations, the NAT box has state per flow. So having an IPv6
> address per transport connection doesn't seem beyond what we can do.

On reason might be because the application uses the temporary address in a way that taints it.
E.g. the address is used in a connection where the user is identified through authentication.
That address is now tained from thew perspective of privacy, and should not be used for other connections.

Given that we are downgrading 4941 to proposed standard, it might also be worth evaluating the state of 4941 implementations.
Are applications clever enough to not reuse tainted addresses?
Are they incorrectly exposed by e.g. MP-TCP or ICE implementations?
Anyone with data on this?

> The question is what the benefits are. I don't see a lot of privacy benefits
> for lots of addresses.
> 
> Note that a single network port may still end up with losts of addresses:
> - users may use bridges to extend the network and connect more than one host
>  to a single port
> - users may run virtual machines (or containers) in bridged mode and end up
>  with multiple virtual hosts by behind a single port
> - having an IPv6 address per process on a host may have benefits in particular
>  if many processes would like to use the same port for some reason
> 
> Typically, even very small network switches support many thousand MAC
> addresses. I think that network devices should support similar numbers of
> IPv6 addresses per /64.

Sure, but when a host incurs a cost in the network, and the network has to have some policy in place to protect itself, there is going to be a limit.
I think we need some text in 4941 discussing this, and also give a recommendation for host behaviour. And perhaps also for network configuration.

Cheers,
Ole