April 2020 - members-discuss - mailman.ripe.net

Re: [members-discuss] [SPAM] Re: Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world
by Elad Cohen 26 Apr '20

26 Apr '20

I never created an RFC and not familiar with the process, but I wanted to discuss IPv4+ with Ripe members as I'm a Ripe LIR. Respectfully, Elad ________________________________ From: info(a)cowmedia.de Sent: Saturday, April 25, 2020 9:53 PM To: members-discuss(a)ripe.net Cc: 'noc xervers'; Elad Cohen Subject: AW: [SPAM] Re: [members-discuss] Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world Hi, anyhow this is not the right list to discuss this. You need to create an RfC – but as IPv6 already exist there is no real chance of implementing this I would say. Michael Von: members-discuss <members-discuss-bounces(a)ripe.net> Im Auftrag von noc xervers Gesendet: Samstag, 25. April 2020 20:49 An: 'Elad Cohen' <elad(a)netstyle.io>; members-discuss(a)ripe.net Betreff: [SPAM] Re: [members-discuss] Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world That won't be IPv4 but a complete new protocol, and routers/switches/whatever won't support them. It's a better and cleaner solution to move to IPv6. Cheers. [Das Bild wurde vom Absender entfernt. XERVERS] NOC xervers | +351 300 404 316 P Please consider the environment before printing this email [Das Bild wurde vom Absender entfernt. Visit our website]<https://www.xervers.pt/> [Das Bild wurde vom Absender entfernt. Facebook] <https://www.facebook.com/xervers/> [Das Bild wurde vom Absender entfernt. Twitter]<https://twitter.com/xervers> [Das Bild wurde vom Absender entfernt. TrustPilot] <https://www.trustpilot.com/review/www.xervers.pt> De: members-discuss <members-discuss-bounces(a)ripe.net> Em Nome De Elad Cohen Enviada: sábado, 25 de abril de 2020 20:21 Para: members-discuss(a)ripe.net Assunto: [members-discuss] Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world Hello Everyone, I want to share with you my technical solution to the "IPv4 Exhaustion" problem (without to upgrade each and every router that exist in the internet), using the below implementation there will be more 4,294,967,296 IPv4 addresses that the world needs so much: Currently in an IPv4 packet - the source address and the destination address are being represented each by four bytes, each of these four bytes are being displayed as: [0-255].[0-255].[0-255].[0-255] But it is up to us to choose how we want to display them, for example: four bytes can also be displayed as [0-65535].[0-65535] (two numbers and one dot, the two numbers are bigger because in total they also being represented as four bytes) So there can be one set of 4,294,967,296 IPv4 addresses (the one that we know in the display format of [0-255].[0-255].[0-255].[0-255]) and another set of 4,294,967,296 IPv4 addresses (with a new format of [0-65535].[0-65535]) We need to have a mark, a flag, in the ip packet header - in order to know if the source address is of the old formatting (IPv4) or of the new formatting (lets call it IPv4+), for that mark the 'reserved bit' in the ip header can be used, so in case the source address is of IPv4+ or in case that the destination address is of IPv4+ (or in case that both the source and destination addresses are of IPv4+) then the reserved bit in the ip header will be set to 1 , we then also need to know exactly if the source address is of IPv4+ or not (meaning of IPv4) and if the destination address is of IPv4+ or not (meaning of IPv4) - this can be done by marking the DF flag if the source address is of IPv4+ (and not marking the DF flag if the source address is of IPv4) and marking the MF flag if the destination address is of IPv4+ (and not marking the MF flag if the destination address is of IPv4), by using the DF and MF bits which are related to fragmentation (whenever the reserved bit is set to '1') we are losing the ip fragmentation functionality for any traffic with an IPv4+ address (for traffic between two IPv4 addresses, the reserved bit is not set to '1' and hence optional ip fragment functionality is unchanged) We need to know the MTU before an IPv4+ packet will be sent, because no fragmentation will be able to be done with IPv4+ , the current "Path MTU Discovery" (RFC 1191) is not good for that case because it is using the DF bit which we are using as well (and in IPv4+ traffic a DF flag set to 1 is marking that the source address is of IPv4+), and also ICMP protocol can be blocked by routers in the routing path, the solution is to send multiple udp requests (with fixed known MTU sizes) to the destination address (lets call it IPv4+ handshake) - the destination address may or may not receive them (in case a router in the routing path have multiple upstreams and wasn't upgraded to an upper version that supports IPv4+ then it will not recognize the reserved bit and the DF and MF bits related to it, it will not recognize the new IPv4+ addresses and even if the reserved bit is set to '1' and MF flag is set to '1' in the ip packet - it will route to to the destination address just like it is an IPv4 address and not IPv4+ address, meaning to a completely different destination address) - in case the destination address indeed received the IPv4+ packets - it will send back the udp requests to the source address at the exact same sizes (with the reserved bit flag set to '1' and with the DF and MF flags set accordingly) - when the source address will receive them - the source address will know that the destination address is supporting IPv4+ , that ip packets with new IPv4+ formatting will reach the destination and the source address will know what is the biggest size of the udp request that was received - and it will be the MTU for that specific connection between the source and the destination addresses (The IPv4+ handshake will be done again if there is no response from the destination after the initial udp handshake was already completed successfully). The udp handshake between a source address and a destination address (that any of them or them both is an IPv4+ address) will use a specific udp port, an availalbe unassigned port between 0 to 1023, an operating system networking stack (that was updated for IPv4+ with the operating system automatic updating system) will know exactly what this udp port is for - and will react accordingly, the upgraded operating system networking stack will also check that the destination address (in the IPv4 or in the IPv4+ format) is set locally in the operating system, before sending the udp requests back to the source address (if not then the ip packet will be dropped by the upgraded operating system networking stack). Any operating system that wasn't upgraded to support IPv4+ - will just drop that kind of udp requests. IPv4+ is fully backward compatible to IPv4 (and any router that was not upgraded yet to IPv4+ will not cause IPv4 traffic to break), it is also not adding any new fields to ip packets or using new fields, IPv4+ will not cause any performance overload for any supported router. The reason that the MF and DF bits are being use for IPv4+ and not the ToS / IP-ID / Options in ip header are being used is because we cannot be 100% sure that the ToS / IP-ID / Options in the ip header will not be changed or dropped by any rouer in the routing path that wasn't upgraded to IPv4+ (and we don't want to upgrade any router in the world because it is an impossible mission) - in the ip header ToS is being cleared by some routers - IP-ID can be changed by NAT routers - Options field is dropped by many routers, we can trust that the DF and MF flags will not be modified in the routing path by routers that weren't upgraded to IPv4+. For the above solution not all the internet devices in the world needs to be patched/upgraded to support IPv4+ which is an impossible mission, end-users operating systems need to be upgraded (but it can be done simply using their automatic updating system), BGP routers (and any router with multiple physical routing paths) will need to have its firmware upgraded to support IPv4+, any NAT router that will want to use an external IPv4+ address will need to have its firmware upgraded (any NAT router that will use an external IPv4 address will not need to have its firmware upgraded, only the internet devices in the LAN of the NAT router will need to have a single operating system update in order for them to access IPv4+ addresses in the internet), any home router (not NAT) or home modem will not need to have a firmware upgrade and IPv4+ functionality will be transparent to them. The deployment of IPv4+ can be fairly easy and very fast, a round table of one person from each one of the 5 RIRs and from each one of the operating systems vendors and from each one of the router manufacture vendors. Even if IPv4+ will be deployed over time, it will not cause the internet to break (devices that need to be upgraded to IPv4+ and didn't yet will work exactly as they are now with IPv4, they will just not yet support IPv4+). The above will resolve the "IPv4 Exhaustion" problem and will bring to each one of the 5 RIRs almost 900,000,000 new IPv4+ addresses that will be able to the provided to the LIRs worldwide, if you have any question please let me know. Respectfully, Elad

2 4

Another solution to the IPv4 shortage
by Jens Link 25 Apr '20

25 Apr '20

Hi, as I'm struggling to find the political correct words for people subscribing a ticket system to a mailing list with "-discuss" in the name i came up with another solution to the IPv4 shortage: Every person / organization adding this mailing list to a ticket system and thereby creation unnecessary (auto reply) messages or other messages of that kind: - are immediately unsubscribed form any mailing list - forfeit all their resources (IPv4, IPv6, ASN) - can never become a RIPE member again As I just got a mail from a large advertising / could / search engine company this might free up significant resources. Jens -- ---------------------------------------------------------------------------- | Delbrueckstr. 41 | 12051 Berlin, Germany | +49-151-18721264 | | http://blog.quux.de | jabber: jenslink(a)quux.de | --------------- | ----------------------------------------------------------------------------

2 2

Re: [members-discuss] [SPAM] Re: Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world
by Elad Cohen 25 Apr '20

25 Apr '20

Thilo, The problem is that there is a demand in the world for IPv4 and IPv4 will soon runout in all the RIRs. IPv6, to my opinion, is not deployed because it costs money, manpower, IT department, learning, etc - companies are basing their actions on profitable / not profitable - you will not see companies rushing to IPv6 when they are not have to, when IPv4 works perfectly fine for them, they will not put expenses for something that can only cause them more expenses if there will be any problem with the IPv6 deployment (to my opinion this is what the reasonable company will react) and specially in these times of COVID, reasonable companies will minimize expenses and will try less to change things which are working. NAT is being used for many years, and still the demand for IPv4 is huge (all RIRs soon will not have any available single IPv4), datacenters are not using NAT. The main problem with IPv6 is by-design, creating a completely different ip protocol which is not backward-compatible is very bad, the design of it is very bad and it what brought us to this state (and also the 4 byte limitation in IPv4), but I'm not against the deployment of it, the deployment of IPv6 will be completed and I believe that more IPv4 addresses will help the deployment of IPv6, specially in these times we need more connectivity and IPv4+ brings more connectivity in the very immediate near future (IPv6 will do it in the longer term). I do believe also as you wrote that IPv4 addresses will become more and more expensive (if IPv4+ will not be implemented), regulators intervention in each country for IPv4 rate seems to me a more difficult task than the deployment of IPv6 and IPv4+ together :) Respectfully, Elad ________________________________ From: Thilo Mohri <inbox(a)tmohri.de> Sent: Saturday, April 25, 2020 11:36 PM To: Elad Cohen <elad(a)netstyle.io> Cc: members-discuss(a)ripe.net <members-discuss(a)ripe.net> Subject: Re: [members-discuss] [SPAM] Re: Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world Elad, I like your solution - however, where is the problem you are trying to solve? The problem we have with IPv6 is absolutely non-technical, most devices natively support IPv6, for legacy devices we have 4in6 and to deal with IPv4 exhaustion we have NAT at least on the b2c side. The solution to IPv4 exhaustion is there - it is called IPv6, it is just not deployed! The problem is with organizations who don’t have IPv6 on their priority list - and this will change over time when IPv4 will get more expensive and not possible to run anymore. I agree it’s a slow adoption, but the market will settle this over time. The only risk I see here is that the market will be dominated by big players in the future as small players cannot get any footprint into the IPv4 market anymore and not able to reach all their customers with IPv6 -> this must be solved by the different telco regulators in the respective countries. Just my two cents, Thilo - sent from my mobile. On 25. Apr 2020, at 22:31, Elad Cohen <elad(a)netstyle.io> wrote: Michael, Please see my following answers: 1. No additional header bit is needed, the ip packet is exactly as it is now, the 'reserved bit flag' will just be '1' instead of '0' , the reserved bit is available in the ip header and hence the filter will see the whole ip packet. (any router that do any check regarding the source address or the destination - will need to be upgraded). 2. This is not a new protocol, IPv6 is a new protocol, it is an adjustment to a current protocol and not any device which implemented that protocol (IPv4) will need to be upgraded, providing IPv4 address (of IPv4+) to all the parties involved (when IPv4 addresses are so much needed in these days) and using the automatic updating mechanism of operating systems - can and will make this whole process much much faster. 3. It is an adjustment to a current protocol and not a completely new protocol, clean code updates will resolve it. There is no need to know what is the main protocol (IPv4+ or IPv4) because the exact same IPv4 packet is being used, upgraded routers will just know how to route it well (if the four bytes of source address are of IPv4 or IPv4+ and if the four bytes of destination address are of IPv4 or IPv4+). 4. Please see what I wrote, I didn't write that only some of the needed routers will be upgraded, I wrote that all the end-users operating systems will be updated (through the automatic updating mechanism of the operating systems). 5. We can argue on it, I believe that if companies and organizations will have a high pool of IPv4 then they will be able to support both IPv6 and IPv4 and then more and more companies and organizations will support both IPv4 and IPv6 until the whole internet will be able to move to only IPv6. IPv6 is being talked for 20 years and currently the world is in a very big problem because of the lack of IPv4. 6. From the very beginning with the round table and IPv4+ addresses incentives to everyone - IPv4+ will be deployed very very fast, I wrote about very margins cases, from the very beginning through the round table IPv4+ will be deployed (Automatic operating system updates will done only after the ISP's and ASN's will complete to update their routers and will receive their amount of free new IPv4 addresses). And just in case an ISP will assign to its user an IPv4+ addresses to use the internet then that IPv4+ addresses need to access the whole internet (there are many online services that are not yet supporting IPv6+). I'm not against IPv6 - I surely believe it is the future, but more IPv4 addresses are needed for and until IPv6 to be fully adapted. 7. Please write about any unanswered point. I don't believe that I'm late because 20 years ago there wasn't any need to use the 'reserved bit flag' in the ip header, it was intended for future use, and what would be a better use to the 'reserved bit flag' than to use it for the current IPv4 Exhaustion problem. Respectfully, Elad ________________________________ From: members-discuss <members-discuss-bounces(a)ripe.net> on behalf of info(a)cowmedia.de <info(a)cowmedia.de> Sent: Saturday, April 25, 2020 11:00 PM To: members-discuss(a)ripe.net <members-discuss(a)ripe.net> Subject: Re: [members-discuss] [SPAM] Re: Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world Elad, i really appreciate your idea, but there are unfortunately some issues to this. 1. It requires an additonal header bit that is not part of the address itself, how would a filter know about this when there is only the ip address given (the bit it not available to them). 2. The time of developing and rollout a new type of protocol (what this is) takes years (maybe 10-15 years) even this is theoretically just a small change) 3. Configuring dual protocol is already with IPv4+6 sometimes a hard issue. There are issues with what protocol is the main one and how applications are using them 4. It is not enough to update only networking equipment because the application layer decides about the target (for example the browser via DNS), even today so many software is not compatible with IPv6, how would you expect them to include IPv4+? 5. IPv4+ would slow down IPv6 rollout 6. Your thinking about users will complain when sites are not reachable is not correct. ISPs and service owner make sure right now that the service is at least reachable by IPv4 and they are in the process of trying to add IPv6 to them. There is no way of having users not access any service just because a provider or any MITM is not yet ready. Hence IPv4+ will NEVER be solely rollout to any service. 7. Plus many more points that were raised. You are really 20 years too late. I am so sorry. Michael Von: members-discuss <members-discuss-bounces(a)ripe.net> Im Auftrag von Elad Cohen Gesendet: Samstag, 25. April 2020 21:42 An: Torbjörn Eklöv <torbjorn.eklov(a)interlan.se> Cc: members-discuss(a)ripe.net Betreff: [SPAM] Re: [members-discuss] Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world Torbjorn, Equipment which is old enough not to support IPv6+ will probably won't be able to be upgraded to IPv4+ , but it is still using an IPv4 address, and it is the main point, it is using IPv4 address and there is a global need for IPv4 addresses. Regarding homerouters and iot that you wrote - they will not need to be upgraded to IPv4+ , IPv4+ will be transparent to them. Hosts will be upgraded using the automatic update mechanism of their operating system. Respectfully, Elad ________________________________ From: Torbjörn Eklöv <torbjorn.eklov(a)interlan.se<mailto:torbjorn.eklov@interlan.se>> Sent: Saturday, April 25, 2020 10:36 PM To: Elad Cohen <elad(a)netstyle.io<mailto:elad@netstyle.io>> Cc: Stuart Willet (primary) <stu(a)safehosts.co.uk<mailto:stu@safehosts.co.uk>>; noc xervers <noc(a)xervers.pt<mailto:noc@xervers.pt>>; members-discuss(a)ripe.net<mailto:members-discuss@ripe.net> <members-discuss(a)ripe.net<mailto:members-discuss@ripe.net>> Subject: Re: [members-discuss] Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world Stuart, More IPv4 will not make the transition faster. If you and other have equipment that can’t be upgraded and support IPv6 its probably to old for IPv4 upgrade also and with all security issues they can’t be patched for. The OS upgrade for some mix with IPv4+ is a bigger issue than IPv6 deployment. There are billions of hosts/homerouters/IoT that never will get an upgrade to support that. /T > On 25 Apr 2020, at 21:13, Elad Cohen <elad(a)netstyle.io<mailto:elad@netstyle.io>> wrote: > > My main issue is that it is not a replacement for IPv6, it is just an additional pool of ip addresses for IPv4, I do understand that IPv4 ip addresses don't come near to the amount of ip addresses in IPv6, but we will always have devices that are too old to be upgraded to IPv6 and the solution I wrote is doubling the amount of IPv4 (comparing to IPv6 it is meaning less but comparing to the number of ip addresses in IPv4 it is doubling the amount of IPv4), and I do believe that more IPv4 addresses will make the transition to IPv6 faster (everyone will be able to support both IPv6 and IPv4 and then transition to only-IPv6 will be smoother). > > Regarding the number of devices: > • Any routing device with more than two physical routes > • Any BGP router > • Any operating system > The operating systems updates can be fast through their automatic update systems, regarding updating the routing equipment - if each ASN will be know the he will receive a free /21 from the IPv4+ you will see that it will be fast as well (and after it each of the 5 RIRs will have more than 800,000,000 new IPv4 addresses). > > When the ip protocol was created with the saved reserved bit, the reserved bit was saved for just such case, for the case that we are in, what better use would be to the reserved bit in the IPv4 packet header if not to double the amount of IPv4 addresses (at the last stage of the transition to IPv6). > > Respectfully, > Elad > From: Stuart Willet (primary) <stu(a)safehosts.co.uk<mailto:stu@safehosts.co.uk>> > Sent: Saturday, April 25, 2020 10:01 PM > To: Elad Cohen <elad(a)netstyle.io<mailto:elad@netstyle.io>>; noc xervers <noc(a)xervers.pt<mailto:noc@xervers.pt>>; members-discuss(a)ripe.net<members-discuss(a)ripe.net<mailto:members-discuss@ripe.net%3cmembers-discuss@ripe.net>> > Subject: RE: [members-discuss] Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world > > Sorry, there are far too many Layer3 switches and routers which already support IPv6 and would need to be updated to support IPv4+. > There are also many firewalls, both hardware and software which would need updating but can already use IPv6. > > If you had proposed this before the introduction of IPv6 I am sure it would have worked, but it is inferior to IPv6 in two respects. > 1: it would require updating millions of routers, L3 switches, firewalls, operating systems and 3rd party devices. > 2: it would not offer anywhere close to the amount of IPv6 addresses which already work. > > Best, > Stuart Willet. > > From: members-discuss [mailto:members-discuss-bounces@ripe.net] On Behalf Of Elad Cohen > Sent: 25 April 2020 19:56 > To: noc xervers <noc(a)xervers.pt<mailto:noc@xervers.pt>>; members-discuss(a)ripe.net<mailto:members-discuss@ripe.net> > Subject: Re: [members-discuss] Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world > > It is not a complete new protocol, the reserved bit (in IPv4 packet header) was intended to be reserved for future use, the future usage of it was planned. > > I'm not against IPv6, but IPv6 is not backward compatible with IPv4 by design and the world currently need more IPv4 addresses, the number of IPv4 addresses can be easily doubled even in one week, through operating system update of the biggest operating system vendors and simple firmware upgrades by the routing equipment manufacturers. > > switches are working on layer2, they are not related to ip. > > Respectfully, > Elad > > From: noc xervers <noc(a)xervers.pt<mailto:noc@xervers.pt>> > Sent: Saturday, April 25, 2020 9:48 PM > To: Elad Cohen <elad(a)netstyle.io<mailto:elad@netstyle.io>>; members-discuss(a)ripe.net<mailto:members-discuss@ripe.net> <members-discuss(a)ripe.net<mailto:members-discuss@ripe.net>> > Subject: RE: [members-discuss] Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world > > That won't be IPv4 but a complete new protocol, and routers/switches/whatever won't support them. > It's a better and cleaner solution to move to IPv6. > > Cheers. > > <image001.jpg> > NOC xervers | +351 300 404 316 > P Please consider the environment before printing this email > <image002.jpg> <image002.jpg> > <image002.jpg> <image003.jpg> > > > De: members-discuss <members-discuss-bounces(a)ripe.net<mailto:members-discuss-bounces@ripe.net>> Em Nome De Elad Cohen > Enviada: sábado, 25 de abril de 2020 20:21 > Para: members-discuss(a)ripe.net<mailto:members-discuss@ripe.net> > Assunto: [members-discuss] Technical solution to resolve the IPv4 Exhaustion problem and to add more 4, 294, 967, 296 IPv4 addresses that are needed in the world > > Hello Everyone, > > I want to share with you my technical solution to the "IPv4 Exhaustion" problem (without to upgrade each and every router that exist in the internet), using the below implementation there will be more 4,294,967,296 IPv4 addresses that the world needs so much: > > Currently in an IPv4 packet - the source address and the destination address are being represented each by four bytes, each of these four bytes are being displayed as: [0-255].[0-255].[0-255].[0-255] > > But it is up to us to choose how we want to display them, for example: four bytes can also be displayed as [0-65535].[0-65535] (two numbers and one dot, the two numbers are bigger because in total they also being represented as four bytes) > > So there can be one set of 4,294,967,296 IPv4 addresses (the one that we know in the display format of [0-255].[0-255].[0-255].[0-255]) > > and another set of 4,294,967,296 IPv4 addresses (with a new format of [0-65535].[0-65535]) > > We need to have a mark, a flag, in the ip packet header - in order to know if the source address is of the old formatting (IPv4) or of the new formatting (lets call it IPv4+), for that mark the 'reserved bit' in the ip header can be used, so in case the source address is of IPv4+ or in case that the destination address is of IPv4+ (or in case that both the source and destination addresses are of IPv4+) then the reserved bit in the ip header will be set to 1 , we then also need to know exactly if the source address is of IPv4+ or not (meaning of IPv4) and if the destination address is of IPv4+ or not (meaning of IPv4) - this can be done by marking the DF flag if the source address is of IPv4+ (and not marking the DF flag if the source address is of IPv4) and marking the MF flag if the destination address is of IPv4+ (and not marking the MF flag if the destination address is of IPv4), by using the DF and MF bits which are related to fragmentation (whenever the reserved bit is set to '1') we are losing the ip fragmentation functionality for any traffic with an IPv4+ address (for traffic between two IPv4 addresses, the reserved bit is not set to '1' and hence optional ip fragment functionality is unchanged) > > We need to know the MTU before an IPv4+ packet will be sent, because no fragmentation will be able to be done with IPv4+ , the current "Path MTU Discovery" (RFC 1191) is not good for that case because it is using the DF bit which we are using as well (and in IPv4+ traffic a DF flag set to 1 is marking that the source address is of IPv4+), and also ICMP protocol can be blocked by routers in the routing path, the solution is to send multiple udp requests (with fixed known MTU sizes) to the destination address (lets call it IPv4+ handshake) - the destination address may or may not receive them (in case a router in the routing path have multiple upstreams and wasn't upgraded to an upper version that supports IPv4+ then it will not recognize the reserved bit and the DF and MF bits related to it, it will not recognize the new IPv4+ addresses and even if the reserved bit is set to '1' and MF flag is set to '1' in the ip packet - it will route to to the destination address just like it is an IPv4 address and not IPv4+ address, meaning to a completely different destination address) - in case the destination address indeed received the IPv4+ packets - it will send back the udp requests to the source address at the exact same sizes (with the reserved bit flag set to '1' and with the DF and MF flags set accordingly) - when the source address will receive them - the source address will know that the destination address is supporting IPv4+ , that ip packets with new IPv4+ formatting will reach the destination and the source address will know what is the biggest size of the udp request that was received - and it will be the MTU for that specific connection between the source and the destination addresses (The IPv4+ handshake will be done again if there is no response from the destination after the initial udp handshake was already completed successfully). > > The udp handshake between a source address and a destination address (that any of them or them both is an IPv4+ address) will use a specific udp port, an availalbe unassigned port between 0 to 1023, an operating system networking stack (that was updated for IPv4+ with the operating system automatic updating system) will know exactly what this udp port is for - and will react accordingly, the upgraded operating system networking stack will also check that the destination address (in the IPv4 or in the IPv4+ format) is set locally in the operating system, before sending the udp requests back to the source address (if not then the ip packet will be dropped by the upgraded operating system networking stack). Any operating system that wasn't upgraded to support IPv4+ - will just drop that kind of udp requests. > > IPv4+ is fully backward compatible to IPv4 (and any router that was not upgraded yet to IPv4+ will not cause IPv4 traffic to break), it is also not adding any new fields to ip packets or using new fields, IPv4+ will not cause any performance overload for any supported router. > > The reason that the MF and DF bits are being use for IPv4+ and not the ToS / IP-ID / Options in ip header are being used is because we cannot be 100% sure that the ToS / IP-ID / Options in the ip header will not be changed or dropped by any rouer in the routing path that wasn't upgraded to IPv4+ (and we don't want to upgrade any router in the world because it is an impossible mission) - in the ip header ToS is being cleared by some routers - IP-ID can be changed by NAT routers - Options field is dropped by many routers, we can trust that the DF and MF flags will not be modified in the routing path by routers that weren't upgraded to IPv4+. > > For the above solution not all the internet devices in the world needs to be patched/upgraded to support IPv4+ which is an impossible mission, end-users operating systems need to be upgraded (but it can be done simply using their automatic updating system), BGP routers (and any router with multiple physical routing paths) will need to have its firmware upgraded to support IPv4+, any NAT router that will want to use an external IPv4+ address will need to have its firmware upgraded (any NAT router that will use an external IPv4 address will not need to have its firmware upgraded, only the internet devices in the LAN of the NAT router will need to have a single operating system update in order for them to access IPv4+ addresses in the internet), any home router (not NAT) or home modem will not need to have a firmware upgrade and IPv4+ functionality will be transparent to them. > > The deployment of IPv4+ can be fairly easy and very fast, a round table of one person from each one of the 5 RIRs and from each one of the operating systems vendors and from each one of the router manufacture vendors. Even if IPv4+ will be deployed over time, it will not cause the internet to break (devices that need to be upgraded to IPv4+ and didn't yet will work exactly as they are now with IPv4, they will just not yet support IPv4+). > > The above will resolve the "IPv4 Exhaustion" problem and will bring to each one of the 5 RIRs almost 900,000,000 new IPv4+ addresses that will be able to the provided to the LIRs worldwide, if you have any question please let me know. > > Respectfully, > Elad > _______________________________________________ > members-discuss mailing list > members-discuss(a)ripe.net<mailto:members-discuss@ripe.net> > https://lists.ripe.net/mailman/listinfo/members-discuss > Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/torbjorn.eklov%40int… _______________________________________________ members-discuss mailing list members-discuss(a)ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/inbox%40tmo.sh

1 0

Executive Board Decision on Brokers List
by Christian Kaufmann 22 Apr '20

22 Apr '20

Dear colleagues, After analysing all of your comments and weighing the pros and cons of keeping the brokers list on the website, the board has reached a decision. We’ve decided to keep the broker’s list on the website because we think that this list is a valuable resource for our members. However, we will apply stronger due diligence checks and stronger obligations to all brokers in order to prevent abuse. We are currently developing the relevant procedures and legal framework together with the RIPE NCC. We will give you another update when we have more information. Best regards, Christian Kaufmann RIPE NCC Executive Board Chairman

1 0

RIPE Validator v3 error
by Fabiano D'Agostino 17 Apr '20

17 Apr '20

Good evening, yesterday I managed to install RIPE Validator v3. Today I rebooted my VM and tried to execute the script again with ./rpki-validator-3.sh, but I get this errors: https://pastebin.com/xtHTCZnq Thanks in advance, Fabiano

2 1

RPKI ROAs for sponsored resources got deleted?
by Dominic Schallert 02 Apr '20

02 Apr '20

Hello Community, what happened to RPKI ROAs for Sponsored Resources yesterday? All of a sudden, all ROAs for Sponsored Resources got deleted... 2020-04-01 16:16:41 system Updated ROA configuration. Additions: none. Deletions: [asn=ASxxx, prefix=x.x.x.x/22, maximumLength=22]. 2020-04-01 16:16:41 system Updated suppressed routes for ROA alerts. Additions: none. Deletions: [asn=ASxxx, prefix=x.x.x.x/22]. Not only our customers affected but also others. Thanks

6 5