Subject: Re: (ngtrans) SIIT and Shipworm

From: Caitlin Bestler <[email-masked]>
Date: Tue, 24 Sep 2002 12:52:02 -0500

On 9/23/02, Michael Cole wrote:

> 
>
>3. Assigning an IPv4-translated address to an IPv6 client
>is going to use up IPv4 address space. The preferred
>method should be for the IPv4 client to get an IPv6 mapped
>address of their IPv4 address so as not to use any more
>IPv4s. See statement 4 below.
>
> 

But how often can that be achieved?

It is very easy for a system administrator to provide an
IPv6 address for each of their hosts, even without
installing internal IPv6 routing capability. An edge
IPv6/IPv4 NAT/router can do so. It could also provide
a private IPv4 address for all IPv6-only addresses that a
local client made a DNS query upon.

The problem is when the local system administrator has not
done anything.

Providing a public IPv4 address for the remote node, while
it 'wastes' an IPv4 address, is fully compatible with all
security measures in place at an IPv4 only site. A DNS query
is made, an IPv4 address is returned, the client connects
with that IPv4 address. The fact that it is translated to an
IPv6 address off-site is no different than the remote site
having a NAT or load-balancing switch. The local system
admin still has a loggable, meterable and controllable
connection.

Providing an IPv6 address to an IPv4-only node without sys
admin support would require a tunneling client that sent
IPv6 packets over a IPv4 tunnel from user mode software.

That works, but the sys admin is quite likely to view it as
an unauthorized tunnel. They would be justified in shutting
it down. Of course they would be shutting down *all*
tunneled IPv6 traffic.

If you are going to respect the security measures of an
existing IPv4-only site, and provide services to it, you
will have to have an IPv4 address. I don't see any way
around this.

Caitlin Bestler
http://asomi.com/CaitlinBestler/