Re: IPv6 address usage (was: Re: RFC4941bis: consequences of many addresses for the network)

[Michael Richardson <[e-mail]>]

Fernando Gont <[e-mail]> wrote:
    >> I think that it is reasonable to establish an upper limit (8? 16?) of number
    >> of entries per MAC address in a border router in those environments.

    > HOw would that go along with RFC7834/BCP204?

1) Number of Neighbor Cache Entries, not necessarily addresses...
2) there is a different between avoiding the limit of "1" address and
   suppporting NCE 2^8 per host.  A /64 delegation occupies 1 NCE, or
   more accurately, 1 TCAM entry. It's likely that routing and NCE
   occupy the same TCAM.
3) a problem with PD per-host is that the upper bits are now unique for host,
   which makes 4941 somewhat useless, because you can't really hide in a
   crowd of one.

    >> (Are there such controls today in APs/routers?)

    > I'm aware there are things like that for devices implementing first home
    > security.

    > Now, given that rfc4941 is a deployed reality, trying to enforce a limit
    > that's so close to the number of addresses that a host might use -- as per
    > rfc4941 -- doesn't seem to be a good idea (actually, it's asking for
    > breakage).

I agree.

    >> This is exactly the place where temporary addresses make the most sense.
    >> The only reason it isn't a problem now is because (a) lack of IPv6,
    >> (b) most coffee-shop visits are shorter than lifetime.

    > Where, specificallt, would you expect temporary addresses to be causing
    > trouble?

On a network like the IETF's, where supporting 1500 laptops winds up
requiring 64K NCE entries in every router, and we have only 8K.
On a campus network I can see there being 30,000 student-devices.
If we allow for 8-16 per device, that's probably manageable, but 200 per
device is not.

What's *really* bad is that the failures are really hard to diagose, do not occur
for IPv4 (makes IPv6 look bad), and are "fixable" by rebooting the device.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-