Re: RFC4941bis: consequences of many addresses for the network

[Mark Smith <[e-mail]>]

On Fri, 24 Jan 2020, 21:36 Philip Homburg, <[e-mail]>
wrote:

> >Absolutely. Just that temporary addresses changes the equation quite a
> bit.
> >A network might be willing to serve a small set of addresses to a host,
> but wi
> >th temporary addresses there are really no limit.
> >If you do an address per transport connection, would you expect the
> network to
> > serve that?
> >And if it doesn't, how is the host supposed to detect it? An happy
> eyeballs ap
> >proach?
> >Right now that is completely unspecified in 4941bis (and sure it also was
> in 4
> >941).
> >Question is if we should (try to) fix that?
>
> I'd say that if a network wants to have control over how addresses are
> allocated it should use DHCPv6. Certainly if we are talking about
> relatively
> low limited on the number of addresses per host.
>
> However, given the desire to fit everything in SLAAC, what is missing at
> the moment is a way for the network to express intent.
>
> The most basic way would be for a flag that disables temporary addresses.
>
> A more adavanced option would be specify limits on the number of temporary
> addresses and possibly ways to register/deregister an address. For example,
> nodes can keep addresses alive be periodically generating a NA for the
> address.
>
> The question of an address per transport connection is why would you do
> that?
>

(Sorry for the size, this is how it copy-and-pasted)
Transient Addressing for Related Processes: Improved Firewalling by Using
IPV6 and Multiple Addresses per Host

https://www.cs.columbia.edu/~smb/papers/tarp/tarp.html
Many Addr

In many IPv4 installations, the NAT box has state per flow. So having an
> IPv6
> address per transport connection doesn't seem beyond what we can do.
>
> The question is what the benefits are. I don't see a lot of privacy
> benefits
> for lots of addresses.
>


Hiding in the crowd.



> Note that a single network port may still end up with losts of addresses:
> - users may use bridges to extend the network and connect more than one
> host
>   to a single port
> - users may run virtual machines (or containers) in bridged mode and end up
>   with multiple virtual hosts by behind a single port
> - having an IPv6 address per process on a host may have benefits in
> particular
>   if many processes would like to use the same port for some reason
>
> Typically, even very small network switches support many thousand MAC
> addresses. I think that network devices should support similar numbers of
> IPv6 addresses per /64.


>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>