Re: [v6ops] Thoughts about wider operational input

[David Conrad <[e-mail]>]

On Apr 2, 2022, at 10:37 AM, Simon <[e-mail]> wrote:
>> What you dont know is what IP address YOU have from the point of view of the other endpoint.
> Indeed, and that’s why Nat == broken. Pretty well the entire foundation of networking falls over if you have no idea who *you* are.

No. An IP address identifies and locates a connection point for IP service.  What is behind that service, including identity, is determined by higher layers. The service connection point could be a single process, or multiple processes, or, in the case of NAT, an entire network. You cannot rely on an IP address alone as any indication of “who *you* are”.

> That is the foundation of IP - globally unique addresses, so that an address can only refer to one end node;

Even ignoring NAT, no.  See, for example, https://datatracker.ietf.org/doc/html/rfc4786.

> and end-end communication, so any end node can communicate with any other end node. NAT plus private addressing breaks this - I can tell someone that I’m at 192.168.1.1 and that doesn’t differentiate me from the thousands or millions of other 192.168.1.1 nodes in other 192.168.0.0/16 (or 192.168.1.0/24) address spaces; nor does it enable them to send a packet to me. I.e. the network is broken.


Given the vast majority of Internet users (including myself, don’t know about you) are behind NAT boxes and we’re having this conversation, I gather you’re using the term “the network is broken” in a non-traditional way.

All communication over IP must be demultiplexed by higher-layer processes via protocol and/or port. NAT adds an additional form of demultiplexing, mapping a single address plus port into multiple addresses.  NAT breaks things because higher-layer protocol designers violated layer boundaries, granting those higher-layer protocols knowledge of lower-layer identifiers, which should have been opaque. Given the actual endpoint of communication (i.e., the application) cannot rely on the IP address, swapping out one IP address for another should have no impact on the integrity of the communication. The fact that current applications have intimate knowledge of the underlying identifiers means e.g., changing an endpoint’s connection to the IP network topology fatally breaks communication. This is not a feature.

However, bringing this back to the original question: if you want to bring more enterprises into the IPv6 fold, arguments about how NAT is evil are worse than a complete waste of time, they’ll probably result in your input being ignored. For good or ill, NAT is embedded into the architecture of the Internet for the foreseeable future (IPv4-only devices are not going to magically vanish) and, with the possible exception of mergers of multiple, conflicting RFC 1918-based networks, the benefit of deploying IPv6 is overwhelmed by the risk and cost. I’d assume most enterprises see the Internet as they do other utilities: a necessary evil (because of the cost) they need to have to get their job done.  I imagine they couldn’t care less about the first 4 bits of the IP header or the length of the address; what they care about is reducing costs and/or improving services. This isn’t religion, it’s business. Understanding, without condescension, what enterprises’ business requirements are would probably be a good first step.

Regards,
-drc