IPv6 on Solaris

Introduction

Addressing

• Types of addresses

• Multiple addresses  of the same interface

• Multicasting

IPv6 Routing

Configuring IPv6-Over-IPv4 Tunnels

Summary

• Unicast address types. With the unicast address type, a unique address is assigned to an interface. A unicast datagram is sent to a single machine with the matching destination IPv6 address. Unicast addressing is called point-to-point addressing in IPv4
  • Link-local addresses are intended to identify hosts on a single network link. They are similar to the way Ethernet addresses are used to communicate on an Ethernet segment or subnet. A Link-local address starts with 1111111010,or FE8 in hexadecimal format.
  • Site-local addresses are valid across an intranet. They are similar to an organization choosing a random IPv4 address class for the organization, but not connecting to the Internet.
• Multicast address types. With the multicast address type, an address is assigned to a group of systems. Datagrams are delivered to all interfaces as identified by the multicast address. Multicast addressing in IPv6 replaces broadcast addressing in IPv4. Messages are sent to a subset of all of the hosts' interfaces on the network. The FP of 11111111 or FF in hexadecimal format in an address identifies the datagram as being a multicast datagram.
• Anycast address types.With the anycast address type, an address is assigned to a group of systems. Datagrams are delivered to the nearest interface member, as identified by the anycast address, instead of being delivered to all members of a group. Anycast addresses identify the nearest member of a group of systems that provide a particular type of service.

Introduction

Internet Protocol version six (IPv6) as defined in RFC 2460 is the most recent version of the IPv6 protocol specification. In 1991, the Internet Architecture Board (IAB) sponsored a working group to resolve the issue of running out of IP addresses. The IAB working group incorrectly predicted that all Class B networks would be allocated by 1994 and that all IP addresses would be allocated by 2002 (see Christian Huitema, Routing in the Internet, Second Edition, 2000). Neither event happened.

Invented by Steve Deering and Craig Mudge at Xerox PARC, IPv6 was adopted by the Internet Engineering Task Force in 1994. That means that currently the protocol is 12 years old and deserve to be entered to Guinness book as one of the protocols that took the longest time from specification to full scale implementation. The other possible, and probably simpler, solution was just to double the size of all fields of IPv4 headers, preserving full compatibility. That would ensure that addresses became 64 Bits and would be very natural due to gradual move from 32-bit CPU to 64-bit CPUs.

But IPv6 was designed by the IETF not to enhance but to replace IP Version 4 ("IPv4") with very little thought about optimal transition path and associated costs. Moreover as with many "version two" attempts the designers solved issues that proved to be premature (address depletion) and did not address really critical issues that matter (transition from IP v4) and that ensured that for so many years after the initial design IPv6 still is a mirage rather then fact of Internet life.

IPv6 might solve several of IPv4's shortcomings, but the longer headers and much larger address space with multiple addresses per single interface add overhead that affects a range of performance metrics for both TCP and UDP.

Internet Protocol version 6 (IPv6) is the most recent version of the IP specification. Refer to RFC 2460 for a description of IPv6. In 1991, the Internet Architecture Board (IAB) sponsored a working group to address
a pending IP address shortage.

The IPv4 address shortage is only one reason that IPv6 was developed. IPv6 was designed to be a generic improvement of IPv4 and among other problems designed to resolve the following:

1. Autoconfiguration IPv6 systems configure their IPv6 addresses automatically like in IPX using MAC addresses of interfaces. That means that there is no need for complex machinery of assigning IPv6 addresses, as is done in IPv4. For example there is no need in DHCP. Autoconfiguration automatically allocates IPv6 addresses to systems. DNS is still required.
2. Performance. IPv4 routing consumes a large amount of processing power on each router. IPv6 uses a simpler header that theoretically makes routing IPv6 more efficient; therefore, IPv6 might provides improved performance on higher speeds.

3. Security. Internet Protocol Security Architecture (IPsec) provides optional security mechanisms that include secure datagram authentication and encryption mechanisms within IP. When you invoke IPsec, it applies the security mechanisms to IP datagrams that you enabled in the IPsec global policy file. Applications can invoke IPsec to apply security mechanisms to IP datagrams on a per-socket level. When you invoke IPSec with IPv4, it applies encryption to the whole network stream creating a virtual circuit for all traffic both that requires security protection and the traffic that is not.

IPv6 is supported on Solaris since March 2000 (Solaris 8 was the first version of IP v6 support). Solaris has dual stack implementation and can run IPv4 and IPv6 simultaneously.

Solaris is probably the leading OS as for IPv6 support: it supports IPv6 for more then 6 years. Suppput for IPv6 was significantly improved versions 9 and 10. Solaris 10 has rather complete support of IPv6 including X11 support (see Solaris 10 Data Sheets and [PDF] Sun & IPv6 ) :

New Solaris 10 Networking Features

• Enhanced TCP/IP, UDP/IP, and SSL performance-Highly efficient, optimized stack leverages CPU processing power, which greatly enhances network speeds
• Leverages UltraSPARC T1 multithreaded CPU for increased throughput
• IPv6-Next-generation protocol includes increased address space, end-to-end security, and auto configuration features
• Berkeley Internet Name Domain (BIND) 9-The latest Internet domain name server
• IP Filter-IPv6-capable, integrated open source firewall
• IP Multipathing-Delivers high availability of network connectivity and services through end-to-end redundancy
• Support for: Stream Control Transmission Protocol (SCTP), Session Initiation Protocol (SIP), Multicast Listener Discovery (MLDv2), Open Shortest Path First (OSPFv2), Border Gateway Protocol (BGP-4)
• Comprehensive support for gigabit and 10-Gb adapters from leading vendors

So far major deployment were limited to government and military: Federal agencies have until June 2008 to upgrade their network backbones to IPv6. The movement toward IPv6 2008 deadline set by the Office of Management and Budget is very sluggish (see GCN report).

As Microsoft's Vista will be fully IPv6-capable that might create some opportunities to deployment of ipv6 on mass scale among large businesses as well.

In current version of Solaris most network related applications and daemons are "IPv6-ready", for example bind provides DNS service for IPv6 addresses.

Right now outside government networks, public IPv6 addresses are practically useless. There are some providers in Asia, Europe and Eastern Europe that attempt to use it as public service, but they face uphill battle against entrenched IPv4 universe. As David Bernstein noted: "The IPv6 designers made a fundamental conceptual mistake: they designed the IPv6 address space as an alternative to the IPv4 address space, rather than an extension to the IPv4 address space. "[ipv6mess]

So despite all problems with IPv4, it still dominates Internet and as of 2006 adoption of IPv6 is almost invisible. Due to recent innovations like CIDR, IPv4 proved to remarkably resilient despite of its age. NAT generally resolved the problem of a shortage of IPv4 addresses, the key motivation of designing IPv6 and IP space exhaustions might not happen before, say 2012 (again as I mentioned above the U.S. Government mandated that all network backbones of federal agencies must deploy IPv6 by 2008.[1]; that meains that 2012 is right guestimate :-) Actually the Department of Defense currently is the only federal body to have made some real progress in implementing IPv6.

Along with providing larger address space (the problem that was solved by CIDR in IPv4) IPv6 tried to simplify headers to provide to high speed routing and add a couple of improvements to IPv4 such as address autoconfiguration. The host part of IPv6 addresses can replicate MAC addresses and thus can be assigned automatically.

Some introductory information about the protocol can be found in our IPv6 FAQ. For those interested in the technical details, we have a list of IPv6 related specifications.

IPv6 Addressing

An IPv4 address is a 32-bit value that's usually written in "dotted quad" representation, where each "quad" represents a byte value between 0 and 255, for example: 127.0.0.1. This allows a theoretical number of 2^32 or ~4 billion hosts to be connected on the Internet.

IPv6 addresses use 128-bit technology, which results in 2¹²⁸ theoretically addressable hosts. Because of the autoconfiguration capability in IPv6 (host address is based on MAC), it less difficult to administer IPv6 addressing than iIPv4. The first part of the address is the format prefix, followed by a routable prefix or padding. The second part of the address is the interface identifier, analogous to the IPv4 host portion, and is derived from the system's media access control (MAC) address.

IPv6 addresses are written as a 16-bits groups using hex notation with groups separated by colons and as such much less transparent, memorizable or understandable then IPv4 addresses. For example:

fe80::2a0:d2ff:fea5:e9f5

This address shows a special IPv6 trick -- a number of consecutive zeros can be abbreviated by a single "::". The above address is thus equivalent to fe80:0:0:0:2a0:d2ff:fea5:e9f5 -- leading zeros within 16-bit groups can be omitted.

Like in IPv4 addresses are split in two network and host parts. The bits are known as netbits and hostbits, and in both IPv4 and v6, the netbits are the "left," or most significant bits of an IP number; and the host bits are the "right," or least significant bits:

+--------------------+--------------------+
|      n netbits     |   128-n  hostbits  |
+--------------------+--------------------+

In IPv4, the border is drawn with the aid of the netmask, which is an implicit additional information for the address and is used to mask all net/host bits. Typical examples are 255.255.0.0 which uses 16-bit for addressing the network, and 16-bit for the host.

When addressing switched from classful addressing to CIDR routing, the borders between net and host bits stopped being 8-bit boundaries and netmask value became less transparent. As a replacement, the number of network bits is used for a given address, to denote the border. Thus

10.0.0.0/24

is the same as a netmask of 255.255.255.0 (24 netbits). The same scheme is used in IPv6:

2001:638:a01:2::/64

tells us that the address used here has the first (left-most) 64 bits used as the network address, and the last (right-most) 64 bits are used to identify the machine on the network. The network bits are commonly referred to as the (network) "prefix", and the prefix here would be 64 bits.

Common addressing schemes found in IPv4 are the (old) class B and class C nets. With a class C network (/24), 24 bits are assigned by your provider, which leaves 8 bits to be assigned by you. If you want to add any subnetting to that, you end up with "uneven" netmasks that are a bit tricky to deal with. Class B networks (/16) are easier cases where only 16 bits are assigned by the provider, and systems that allow subnetting, or splitting of the right-most bits into two parts -- one to address the on-site subnet, and one to address the hosts on that subnet. Usually, this is done on byte (8-bit) boundaries. Using a netmask of 255.255.255.0 (or a /24 prefix) allows flexible management even of bigger networks. Of course there is the upper limit of 254 machines per subnet, and 256 subnets.

With 128 bits available for addressing in IPv6, the scheme commonly used is the same, only the fields are wider. Providers usually assign /48 networks, which leaves 16 bits for a subnetting and 64 host bits.

Now while the space for network and subnets is sufficient, using 64 bits for addressing hosts seems like a waste. It's unlikely that you will want to have several billion hosts on a single subnet, so what is the idea behind this?

The idea behind having fixed-width, 64-bit wide host identifiers is that they aren't assigned manually as in IPv4. IPv6 borrows a trick from Novell IPX playbook and use MAC addresses as the base for forming host addresses.

IPv6 host addresses are recommended (but not mandated!) to be built from so-called EUI64 addresses. EUI64 addresses are -- as the name says -- 64-bits wide, and derived from MAC addresses of the underlying network interface. For example, with Ethernet, the 6-byte (48-bit) MAC address is usually filled with the hex bits "fffe" in the middle -- the MAC address

01:23:45:67:89:ab

results in the EUI64 address

01:23:45:ff:fe:67:89:ab

which again gives the host bits for the IPv6 address.

::0123:45ff:fe67:89ab

These host bits can now be used to automatically assign IPv6 addresses to hosts, which supports autoconfiguration of v6 hosts -- all that's needed to get a complete v6 IP number is the first (net/subnet) bits. IPv6 also offers a solution to assign them automatically.

When on a network of machines speaking IP, there's usually one router which acts as the gateway to outside networks. In IPv6 land, this router will send "router advertisement" information which clients are expected to either receive during operation or solicit upon startup. The router advertisement information includes data on the router's address, and which address prefix it routes. With this information and the host-generated EUI64 address, a v6-host can calculate its IP number, and there is no need for manual address assignment. Of course, routers still need someconfiguration.

The advertisement information routers create is part of the Neighbor Discovery Protocol (NDP, see [RFC2461]), which is the successor to IPv4's ARP protocol. In contrast to ARP, NDP does not only do lookup of v6 addresses for MAC addresses (the neighbor solicitation/advertisement part), but also does a similar service for routers and the prefixes they serve, which is used for autoconfiguration of IPv6 hosts as described in the last paragraph.

Types of addresses

Like IPv4, IPv6 has three types of addresses that you can use to communicate across a network. For sending messages, IPv6 supports:

• Unicast address types. With the unicast address type, a unique address is assigned to an interface. A unicast datagram is sent to a single machine with the matching destination IPv6 address. Unicast addressing is called point-to-point addressing in IPv4
  • Link-local addresses are intended to identify hosts on a single network link. They are similar to the way Ethernet addresses are used to communicate on an Ethernet segment or subnet. A Link-local address starts with 1111111010,or FE8 in hexadecimal format.
  • Site-local addresses are valid across an intranet. They are similar to an organization choosing a random IPv4 address class for the organization, but not connecting to the Internet.
• Multicast address types. With the multicast address type, an address is assigned to a group of systems. Datagrams are delivered to all interfaces as identified by the multicast address. Multicast addressing in IPv6 replaces broadcast addressing in IPv4. Messages are sent to a subset of all of the hosts' interfaces on the network. The FP of 11111111 or FF in hexadecimal format in an address identifies the datagram as being a multicast datagram.
  • Scope bits. Multicast addresses include four scope bits after the flag bits. Refer to RFC 2373 for an example of a Network Time Protocol (NTP) multicast group. The scope bits determine how far the multicast datagram is routed, as follows:
    • Node-local FF01:0:0:0:0:0:0:101means that all NTP servers are on the same node as the sender.
    • Link-local FF02:0:0:0:0:0:0:101 means that all NTP servers are on the same link as the sender.
    • Site-local FF05:0:0:0:0:0:0:101 means that all NTP servers are at the same site as the sender.
    • Global FF0E:0:0:0:0:0:0:101 means that all NTP servers are on the Internet.
      
• Anycast address types.With the anycast address type, an address is assigned to a group of systems. Datagrams are delivered to the nearest interface member, as identified by the anycast address, instead of being delivered to all members of a group. Anycast addresses identify the nearest member of a group of systems that provide a particular type of service.

Multiple addresses of the same interface

In IPv4, a host usually has one IP number per network interface -- or even per machine if the IP stack supports it. Only very rare applications like web servers result in machines having more than one IP number.

In IPv6, this is different. For each interface, there is not only a globally unique IP address, but there are two other addresses that are of interest:

• The link-local address. The link-local address has a prefix of fe80::/64, and the host bits are built from the interface's EUI64 address. The link-local address not routable and are similar to 10.*.*.* addresses. They can be used for communication on the same network only, the addresses are not visible or reachable from different subnets. If desired, there's the choice of either using global addresses (as assigned by a provider), or using site-local addresses.
  
• The site-local addresses. They are are assigned the network address fec0::/10, and subnets and hosts can be addressed just as for provider-assigned networks. The only difference is, that the addresses will not be visible to outside machines, as these are on a different network, and their site-local addresses are in a different physical net (if assigned at all). As with the 10/8 network in IPv4, site-local addresses can be used, but don't have to be. For IPv6, it's most common to have hosts assigned a local link and a global IP address.

  Site-local addresses are rather uncommon today, and is no substitute for globally unique addresses if global connectivity is required.

The format prefix (FP) in the address indicates the type of IPv6 address that is used. Similar to local and non-routable addresses in IPV4. For example:

• Link-local addresses are intended to identify hosts on a single network link. They are similar to the way Ethernet addresses are used to communicate on an Ethernet segment or subnet. Link-local addresses starts with 1111111010,or FE8 in hexadecimal format.
  
• Site-local addresses are valid across an intranet. They are similar to an organization choosing a random IPv4 address class for the organization, but not connecting to the Internet. A site-local address starts with 1111111011,or FEC in hexadecimal
  
• Aggregatable global addresses are valid across the Internet. The first three bits of aggregatable global addresses are always set to 001. In other words an aggregatable global address always starts with 2 or 3 in hexadecimal format. They are similar to an officially registered IPv4 address class for organizations connected to the Internet.

  The frame format of an aggregatable global unicast address includes:

  • A prefix – The assigned prefix for aggregatable global addresses (001).
    • The top-level aggregator (TLA) – The identifying number of the Internet authority that assigned the provider portion of the address,
      for example, Internet Assigned Numbers Authority (IANA).
      
    • The next level aggregator (NLA) – The address identifier that is assigned to a company or organization by its ISP.
      
    • The site-level aggregator (SLA) – The subnet address assigned to networks in the company or organization.
      
    • Interface ID – The portion of the IP address that derives from the MAC address, that is, the EUI-64 address.

    RFC 2373 describes how IPv6 addresses use prefix notation in a similar way to IPv4 addresses that are written in CIDR notation. IPv6 addresses have two parts. The first part is the format prefix. The second part is the interface identifier and is analogous to the IPv4 host portion.

    An example of a subnet prefix address is:

    fec0::0003:a00:20ff:feb5:4137/64

    The /64 indicates that the subnet prefix is 64 bits in size. The first 64 bits of the address contain a subnet mask. The address can be broken into a subnet prefix and a node address or into an interface identifier.

    • fec0::0003 – The subnet prefix
      
    • > a00:20ff:feb5:4137 – The interface identifier

  
  

• A multicast address is an identifier for a group of systems. A node can belong to any number of multicast groups.

Note: Refer to RFC 2373 for information about FPs

Multicasting

In IP land, there are three ways to talk to a host: unicast, broadcast, and multicast. The most common way to talk to a host is by talking to it directly using its unicast address. In IPv4, the unicast address is the "normal" IP address assigned to a single host, with all address bits assigned. The broadcast address used to address all hosts in the same IP subnet has the network bits set to the network address, and all host bits set to "1" (which can be easily done using the netmask and some bit operations). Multicast addresses are used to reach a number of hosts in the same multicast group, which can be machines spread across the Internet. Machines must join multicast groups explicitly to participate, and there are special IPv4 numbers used for multicast addresses, allocated from the 224/8 subnet. Multicast isn't used very much in IPv4, and only few applications like the MBone audio and video broadcast utilities use it.

In IPv6, unicast addresses are used the same as in IPv4, no surprise there -- all the network and host bits are assigned to identify the target network and machine. Broadcasts are no longer available in IPv6 in the way they were in IPv4, this is where multicasting comes into play.

Addresses in the ff::/8 network are reserved for multicast applications, and there are two special multicast addresses that supersede the broadcast addresses from IPv4.

One is the "all routers" multicast address, the others is for "all hosts".

The addresses are specific to the subnet, for example, a router connected to two different subnets can address all hosts/routers on any of the subnets it's connected to. Addresses here are:

• ff0X::1 for all hosts and
• ff0X::2 for all routers,

where "X" is the scope ID of the link here, identifying the network. Usually this starts from "1" for the "node local" scope, "2" for the first link, etc. Note that it's perfectly OK for two network interfaces to be attached to one link, thus resulting in double bandwidth:

One use of the "all hosts" multicast is in the neighbor solicitation code of NDP, where any machine that wants to communicate with another machine sends out a request to the "all hosts" group, and the machine in question is expected to respond.

Duplicate Address Detection

Systems run a duplicate address detection algorithm on an address before that address is assigned to an interface. This is done without regard to how manner in which the address was obtained. The duplicate address detection algorithm works by sending a neighbor solicitation message to the network that contains the address in question.

The system receives a neighbor advertisement from any device that is currently using the address. Therefore, if no response is received, the systems assume that the address is available for use and is assigned to the interface.

The autoconfiguration process requires manual intervention if the address in question is not unique.

NEWS CONTENTS

• 20061204 : Command Information ( Command Information, Dec 4, 2006 )
• 20061204 : Basic IPv6 on Solaris ( Basic IPv6 on Solaris, Dec 4, 2006 )
• 20060920 : Tom Patterson on Federal News Radios The Federal Drive with Mike Causey & Jane Norris ( softpanorama.org, Sept 20, 2006 )
• 20060913 : Command Education Center Grand Opening ( softpanorama.org, Sept 13, 2006 )
• 20060913 : Microsoft Vista Collaboration ( Microsoft Vista Collaboration, Sept 13, 2006 )
• 20060722 : IPv6 Forum Driving IPv6 Deployment ( IPv6 Forum Driving IPv6 Deployment, Jul 22, 2006 )
• 20060722 : IP Next Generation Overview by Robert M. Hinden ( IP Next Generation Overview, )
• 20060722 : IP Version 6 (IPv6) ( IP Version 6 (IPv6), )
• 20060722 : IPv6 Resource Centre ( IPv6 Resource Centre, )

Old News ;-)

[Dec 4, 2006] Command Information

Part One: A Business Perspective
Command Information demonstrates the business case for the U.S. to embrace IPv6.

Part Two: An Analysis of the Business & Financial IPv6 Marketplace
Command Information examines the business facts and figures behind this rapidly sweeping technology.

802.11 Wireless vLAN Trunking and IPv6 Deployment BriefWireless vLAN implementations can allow broadcast and multicast traffic to "leak" across vLAN boundaries. Depending on the deployment, while running only IPv4, this might not cause any unusual observed behavior. Once some vLANs are enabled for IPv6, creating dual-stack or IPv6-only vLANs, IPv6 multicast traffic may leak onto IPv4-only subnets, resulting in connectivity problems. This brief describes the issue, and provides an explanation and solutions.

IPv6 Explained: Anatomy of an IPv6 Address

IPv6 is the next generation Internet protocol. In simplest terms, Internet protocol is the set of techniques used to transmit data over the Internet. IPv6 was designed to replace the current version, IPv4, and will bring superior reliability, flexibility and security to the Internet. IPv6 will have a dramatic impact on military operations, corporate security, mobility, supply chain management and other key business functions worldwide.

[Dec 4, 2006] Basic IPv6 on Solaris

Jul 19, 2006 (www.eyrie.org) For testing INN, I needed to get IPv6 working on a Solaris 8 system that wasn't actually connected to any sort of IPv6 network. I just needed IPv6 working on the loopback interface, and didn't want to go through the full IPv6 configuration. This turned out to be very simple once I figured it out, but for some reason I had a horrible time finding the details that I needed.

Running the following commands as root got the IPv6 loopback interface up enough to do testing:

    ifconfig lo0 inet6 plumb
    route add -inet6 ::1/128 localhost
    ifconfig lo0 inet6 up

You can test this by using telnet. Try running:

    /usr/bin/telnet ::1 99999

You should get a connection refused error (since inetd isn't listening to the new IPv6 address) rather than some other error about having no route to the host or an inability to assign an address.

[Sept 20, 2006] Tom Patterson on Federal News Radio's The Federal Drive with Mike Causey & Jane Norris (MP3)

9/20/2006: Command Information CEO, Tom Patterson discusses the real benefits of IPv6 on Federal News Radio's The Federal Drive with Mike Causey and Jane Norris.

[Sept 13, 2006] Command Education Center Grand Opening (QuickTime)

Command Information launched America's first dedicated IPv6 training center on September 13, 2006. This :60 second clip contains event footage, including the ribbon cutting.

[Sept 13, 2006] Microsoft Vista Collaboration (Windows Media Video)

With Vista comes some very innovative and exciting peer to peer technologies accompanying a completely re-written network stack. There are some really cool scenarios for peer to peer applications that can be developed on top of the Collaboration framework. Check out this great conversation with Noah Horton, Collaboration program manager and others.

[Sept 7, 2006] ICANN ICANN Ratifies Global Policy for Allocation of IPv6 Addresses

At its September 7, 2006 Meeting the Board of ICANN ratified a global policy for the allocation of IPv6 addresses by the Internet Assigned Numbers Authority (IANA) to Regional Internet Registries.

IPv6 is the next generation Internet Protocol (IP) addressing scheme. Internet protocol addresses are the unique numerical identifiers used to identify each computer on the Internet, so that Internet data is transmitted to the correct destination. The introduction of IPv6 has greatly expanded the number of IP addresses available for the world to use.

"This is an outcome which provides certainty to Internet Registries and their customers who include Internet Service Providers and users" said Dr Paul Twomey, President and CEO of ICANN.

"It addresses concerns about the method for future allocations of Internet address space and ensures projected demand can be met for many years to come", he said.

ICANN is responsible for IANA, which coordinates the world-wide IP address space.

"This was developed through the ICANN community's bottom up consensus approach which saw IPV6 adopted as a policy development process. That means ICANN's stakeholders and constituencies have shaped this policy from day one" Dr Twomey said.

"On behalf of the Board I congratulate all those that worked for this outcome" he said.

Proposed Global Policy for Allocation of IPv6 Address Space

http://www.icann.org/policies/proposed-ipv6-policy-14jul06.htm

[Jul 22, 2006] IPv6 Forum Driving IPv6 Deployment

IPv6 Security Technology Paper
Version 1.0 July 22, 2006 Primary
Author/Editor: Merike Kaeo
Contributing Authors: David Green, Jim Bound,Yanick Pouffary

As IPv6 networks migrate from lab environments into dependable production systems, we are presented with both the challenge of adapting our Information Assurance (IA) architecture to a new protocol and the opportunity to leverage new features to enhance network security. Native
IPv6 networks will coexist with environments where IPv6 capabilities are introduced into production networks with existing IPv4-based infrastructures. While security of our current production networks must be evolved for IPv6, there are features in IPv6 and new trends in networking
that should lead us to changing security paradigms. End-to-end security between hosts has had limited practicality in IPv4-based networks but is a key feature of IPv6. A return to the end-to-end network model should be architected into any dual stacked transition architecture with careful
consideration for not compromising IPv4 security.
This white paper will enumerate the security advantages which are relevant in today's IPv6 networks and will detail the deployment considerations to effectively design and architect secure IPv6 networks. Please download it
from here: NAv6TF_Security_Report.pdf

IP Next Generation Overview by Robert M. Hinden

May 14, 1995

• 1 Introduction
• 2.0 Key Issues
• 3.0 History of the IPng Effort
• 4.0 IPng Overview
• 5.0 IPng Header Format
• 6.0 IPng Extensions
• 7.0 IPng Addressing
• 8.0 IPng Routing
• 9.0 IPng Quality-of-Service Capabilities
• 10. IPng Security
• 11. IPng Transition Mechanisms
• 12. Why IPng?
• 13. Where to Get Additional Information
• References
• Author Information

This paper presents an overview of the Next Generation Internet Protocol (IPng). IPng was recommended by the IPng Area Directors of the Internet Engineering Task Force at the Toronto IETF meeting on July 25, 1994, and documented in RFC 1752, "The Recommendation for the IP Next Generation Protocol" [1]. The recommendation was approved by the Internet Engineering Steering Group on November 17, 1994 and made a Proposed Standard.

The formal name of this protocol is IPv6 (where the "6" refers to it being assigned version number 6). The current version of the Internet Protocol is version 4 (referred to as IPv4). This overview is intended to give the reader an overview of the IPng protocol. For more detailed information the reader should consult the documents listed in the reference section.

IPng is a new version of IP which is designed to be an evolutionary step from IPv4. It is a natural increment to IPv4. It can be installed as a normal software upgrade in internet devices and is interoperable with the current IPv4. Its deployment strategy was designed to not have any "flag" days. IPng is designed to run well on high performance networks (e.g., ATM) and at the same time is still efficient for low bandwidth networks (e.g., wireless). In addition, it provides a platform for new internet functionality that will be required in the near future.

This paper describes the work of IETF IPng working group. Several individuals deserve specific recognition. These include Paul Francis, Bob Gilligan, Dave Crocker, Ran Atkinson, Jim Bound, Ross Callon, Bill Fink, Ramesh Govindan, Christian Huitema, Erik Nordmark, Tony Li, Dave Katz, Yakov Rekhter, Bill Simpson, and Sue Thompson.

IP Version 6 (IPv6)

This set of Web pages provides information of Internet Protocol Version 6 (IPv6). IPv6 is sometimes also called the Next Generation Internet Protocol or IPng. IPv6 was recommended by the IPng Area Directors of the Internet Engineering Task Force at the Toronto IETF meeting on July 25, 1994 in RFC 1752, The Recommendation for the IP Next Generation Protocol . The recommendation was approved by the Internet Engineering Steering Group and made a Proposed Standard on November 17, 1994.

IPv6 Resource Centre -- UK

Recommended Links

Softpanorama Recommended

Top articles

Sites

IPv6 on Solaris

IPv6 Administration Guide

IPv6 - Wikipedia, the free encyclopedia

Google Directory - Computers Internet Protocols IP IPv6

Open Directory - Computers Internet Protocols IP IPv6

IPv6 The Next Generation Internet!

JOIN Homepage -- IPv6 documents

IPv6 Intro Page

See also chapter 6 in IBM Redbook(above) and Recommended Books

draft-ietf-iab-case-for-ipv6-01

IPv6 for FreeBSD

IPv6 for Linux

IPv6 for NetBSD

RFC 2292 - Advanced Sockets API for IPv6

http://www.freenet6.net/

Freenet6 server delivers IPv6 connectivity for end stations using IPv6 over IPv4 tunnels. Computers connected to Internet can use this free service to get connected on the 6Bone.

http://playground.sun.com/pub/ipng/html IP Next Generation (IPng) Working Group Home Page

http://www.6bone.net 6bone Home Page

http://www.6ren.net 6ren Home Page

http://www.stardust.com/ipv6/index.htm Technology channel on Startdust.com for IPv6

http://www.ipv6.ru/ Russian National IPv6 Forum

http://www.eurescom.de/public/projects/P700-series/P702/html/brochure.htm European Institute for Research and Strategic Studies in Telecommunications

http://www.ipv6forum.com A world-wide consortium of leading Internet vendors, Research & Education Networks.

http://hs247.com/ IPv6 News & Links

Recommended Papers

Overview of the Solaris IPv6 Implementation

IPv6 on Solaris

IPv6 Administration Guide

[PDF] IPv6 in Solaris 8

IPv6 Support in Trusted Solaris 8

ONLamp.com -- Introduction to IPv6

Supporting IPv6 on a Linux Server Node Linux Journal

IBM developerWorks - Discover Internet Protocol, version 6 (IPv6)

Understanding IP Addressing Everything You Ever Wanted To Know Detailed explanation of IPv4/6 implementation.

Linux IPv6 HOWTO

Reference

• RFC 2460: Internet Protocol, Version 6 (IPv6) Specification (obsoletes RFC 1883)
• RFC 2461/4311: Neighbor Discovery for IP Version 6 (IPv6) (4311 updates)
• RFC 2462: IPv6 Stateless Address Autoconfiguration
• RFC 4443: Internet Control Message Protocol (ICMPv6) for the IPv6 Specification (obsoletes RFC 2463)
• RFC 2464: Transmission of IPv6 Packets over Ethernet Networks
• RFC 4291: Internet Protocol Version 6 (IPv6) Addressing Architecture (obsoletes RFC 3513)
• RFC 3041: MAC address use replacement option
• RFC 3587: An IPv6 Aggregatable Global Unicast Address Format

Internet Engineering Task Force P. Savola Internet Draft CSC/FUNET ...

Etc

JOIN Homepage -- IPv6 documents

• RFCs and Internet Drafts: All Documents listed in reverse order of publication. (Note: Also old versions of internet drafts are available.)
• Search for specific Internet Drafts and RFCs: Search our database of all current versions of IPv6 relevant RFCs and Internet Drafts by specifiing parts of either filname, title or autor/editor.
• Document search with ht://dig: We have indexed the whole pages including rfcs and internet-drafts with htdig which makes it possible to look for certain documents by a fulltext search.
• Howtos:This section presents howto documents JOIN has written to help customers deploy IPv6 and IPv6 applications in different kinds of scenarios.
• FAQs: An (as yet) very small section containing FAQs focusing on IPv6 and its deployment in the world wide Internet.
• JOIN slides: All slides of talks JOIN has held on different occasions.
• Books: List of books and other printed publications about IPv6.
• Internet-Draft Archive: Directory of all (IPv6 relevant) Internet_Drafts we collected over time.
• RFC

Quiz

Q1: Which two are legitimate types of IPv6 address? (Choose two.)

1. Anycast
2. Broadcast
3. Multicast
4. Simulcast

Q2: Which daemon is responsible for distributing IPv6 network prefixes to IPv6 clients on a network?

1. in.ndpd
2. in.ripngd
3. rpc.ipsixd
4. in.ipaddrd
5. in.ndpd

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March 12, 2019