The Internet as we know it is about to end! These are dramatic words but they tell a story that is very true. With the pending depletion of IPv4 addresses and the scramble to enable IPv6 across networks and devices, the Internet as we know it today really is about to end. Surely, we will still be able to google, tweet, play games with friends and chat using VOIP? We will, won’t we? The answer is a resounding no is some cases. End users will likely suffer the most during the IPv4 → IPv6 transition.
NAT to the rescue?
The reasons for this are actually fairly straight forward. IPv6 and IPv4 are not compatible protocols. They are what is often called wire compatible, meaning they will both run over the same physical wire (or wireless connection in the case of Wifi). This is similar to cars and horses sharing the road in rural Pennsylvania. They may share the road but otherwise they do not have a lot in common. In terms of the Internet, this lack of compatibility means that a server that only speaks IPv4 can not communicate with a client that only speaks IPv6. This is a big problem because as the Internet runs out of IPv4 addresses there will be hosts, either clients or servers, that do not have a globally accessible IPv4 addresses. How do these hosts talk to one another?
Basic web surfing will generally work fine but anything beyond that has the potential to break.
One solution, Network Address Translation or NAT, has been around for years now. Most home Internet connections are behind a NAT and this has not caused that many problems. Can’t we just apply the same principle to servers? The answer to that questions is no. While there are proxies, load balancers and other means to hide servers behind NATs, getting this to work on a large scale is not feasible. While you can share IP addresses easily it is much more difficult to share a single IP address among server applications. There are some exceptions, HTTP being one of them, but for the most part application protocols rely on the fact that the server has a globally reachable IP address. If servers generally must have globally reachable IP addresses then the effort to extend the address space with NAT must focus on the clients.
NAT is going to take many forms during the IPv4 → IPv6 transition. Vendors such as Cisco and Juniper and organizations such as the IETF are developing new ways to perform NAT that will attempt to solve the many problems that will exist in the post IPv4 exhaustion world. Some examples of NAT technologies being deployed or actively being developed are NAT44 (translate IPv4 -> IPv4), NAT64 (translate IPv6 → IPv4) and NAT46 (translate IPv4 → IPv6). All of these technologies very in usage and implementation details but they share one thing in common. They all have potential to break existing applications. This article focuses on the techniques used to translate one IPv4 address to another IPv4 address, or NAT44, because IPv4 is what everyone is using today and is where most of the content resides. NAT44 happens to be the same NAT the many are familiar with already. This is the NAT that is built in to many home cable/DSL modems or wireless routers. NAT44 will be used extensively post IPv4 exhaustion.
Many ISPs are deploying technology to perform NAT44 in mass for all of their customers. In this scenario, many users will find their connections going through some form of NAT multiple times (NAT444 or NAT4444!). First at the edge of their home network, which likely happens today, and again upstream at their ISP. The NAT taking place upstream at the ISP is often called carrier grade NAT or CGN. CGNs will be common place during the transition to IPv6. A CGN will enable an ISP to share a public IPv4 address among multiple customers. In your home today, you may have 3 or 4 computers all sharing the single public IPv4 address your ISP assigns you. In the post IPv4 exhaustion world with CGN you will likely share a single public IPv4 address with hundreds or even 1000s of users. This is in addition to the NAT that has been taking place on the edge of your home network for a long time. What is the impact of this on the applications you use?
Where CGN fails
The impact of CGN is very dependent on the use case. Basic web surfing will generally work fine but anything beyond that has the potential to break. The problem lies in the way NAT works and the fact that multiple NATs make it difficult to track the state of connections even with NAT traversal techniques such as STUN. Another problem end users may face is port exhaustion. In a world of Web 2.0, Bitorrent, XBOX live and other technologies that open up many connections it is possible that users will run out of resources on the CGN.
This is because a CGN shares an IP address by mapping TCP/UDP ports to specific users. One user may get ports 10000 – 10500 and another will get 10501 – 10600. There are only so many ports to go around with 65535 total ports available per IP address. Once you use up your ports new connections will fail. Applications that require access back in to your network to work properly such as Xbox Live, which sets up peer-to-peer adhoc networks to facilitate online multiplayer gaming break when placed behind CGNs. Xbox Live depends on the ability of Xboxes to talk to each other using well known TCP and UDP ports, the port remapping CGNs do breaks the Xbox Live protocol which breaks online gaming.
There are many examples of applications that work in a similar fashion, bittorrent and ichat are additional examples. It will be a challenge to get VOIP to work as well. Vonage and similar services may no longer work when ISPs start using CGN technology. The list of applications that will break with CGN technologies is large. ISPs are aware of the breakage that CGNs will cause and many are aggressively rolling out IPv6 as a result. Does IPv6 solve this problem?
Long term solutions
IPv6 will not make CGNs disappear overnight. However, IPv6 is the long term solution to the problem. For CGNs to become obsolete, IPv6 needs to see wide spread adoption across all facets of the Internet, from web servers, to Xboxes, to wifi access points, VOIP devices and everything in between. Once IPv6 is widely supported and end users are using it to connect to Internet based services, the CGNs will go away. Until this day comes you can expect to see a degradation of service on the Internet. It is very likely that the user experience today will be better than the user experience is in 3 or 4 years as CGNs and other transition related technologies become ubiquitous. These transition mechanisms will hurt performance!
You can help!
Is there anything you can do to help speed the transition, and thus limit the time that you have to cope with performance impacting transition technologies? You should be encouraging your ISPs to support IPv6 right now. Call the sales desk and tell them you want an IPv6 address, tell them you want an entire /56! Call technical support complaining that your Internet connection does not support IPv6! If you have a device that supports configuring an IP address and it will not accept an IPv6 address complain to the manufacturer. A call to Microsoft, Sony or Nintendo complaining that their products do not support IPv6 and you cannot play games with your friends is a great idea too. Asking your VOIP provider if they are IPv6 ready is a must because you may find that their service is unusable behind your ISPs CGN.
Almost the entire world is behind the curve on deploying IPv6. This fact alone is going to make the transition to IPv6 difficult for the end-user. You can help increase awareness and drive adoption by using your power as a consumer to spread the word to your service providers and device manufacturers that you need IPv6 now and you will spend your money on products and services that can give it to you.
{ 4 comments… read them below or add one }
Nice analysis of the NAT issues. An astonishing number of people still believe that IPv4 NAT can support indefinite Internet growth.
I believe that IPv6 deployment will be driven by ISP market disruption:
http://eject3ject.wordpress.com/2010/12/06/bad-news-the-ipv4-well-is-almost-dry-good-news-the-network-will-be-relevant-again/
“There are only so many ports to go around with 65535 total ports available per IP address.”
Not quite.
You do get 65k ports, but unless you need 65k connections to the same destination IP & port you only need a single source port. Many *trillions* of concurrent connections could come from a single IP, and even port.
It’s only really when you need UDP or listening sockets that the number of ports ever really comes into play.
While it is possible for a NAT system to share source ports there is still the problem of scalability. This technique will not scale indefinitely. Also, while it may work for surfing the web it will not work for P2P, VOIP, gaming and many other applications that require connections back to the end users host.
{ 1 trackback }