Introduction to IPv6 Last modified

Motivation Last modified 7 am

IPv4 Exhaustion TheEndOfTheWorld!

IPv4 Addresses: 32 Bits IPv4 address: IPv4 address: Four bytes Four bytes In Binary: In Binary: ^32 total addresses 2^32 total addresses 4 billion 4 billion

Internet Registry Regions

IPv4 Address Depletion (2011)

Jan 14, 2014 Phase 4: All IPv4 requests, regardless of size, are subject to team review. Requests for IPv4 address blocks of /15 and larger require department director approval. Phase 4: All IPv4 requests, regardless of size, are subject to team review. Requests for IPv4 address blocks of /15 and larger require department director approval. html html

No Reprieve IANA will not re-purpose class D or E addresses for general use People who ask for IPv4 addresses after exhaustion will not get them Hoarding, scalping, and simple direct sale of used IPv4 addresses will begin soon

IPv6 The Solution

IPv6 Addresses: 128 Bits IPv6 address IPv6 address 2001:05c0:1000:000b:0000:0000:0000:66fb 2001:05c0:1000:000b:0000:0000:0000:66fb Omitting unnecessary zeroes; Omitting unnecessary zeroes; 2001:5c0:1000:b::66fb 2001:5c0:1000:b::66fb Eight fields, each 16 bits long Eight fields, each 16 bits long 4 hexadecimal characters 4 hexadecimal characters 2^128 total addresses 2^128 total addresses 340 billion billion billion billion 340 billion billion billion billion Enough for a while Enough for a while

Link BayThreat-10 Link BayThreat-10

Federal IPv6 Transition Timeline From Cisco (link BayThreat-11)

Migration to IPv6

Methods of IPv6 Migration Ignore IPv6: Stay on IPv4-only Gateways: Devices that convert IPv6 to IPv4 Cloudflare provides this service for free! Tunnel: IPv6 over IPv4 Dual-Stack: IPv4 and IPv6 together Nirvana: IPv6-only

IPv6 Tunnels Fast and easy to set up--best for n00bs Not the best for security or performance Free IPv4-to-IPv6 Tunnels Gogo6.com Sixxs.net Tunnelbroker.com

GoGo6 Easiest

Demonstration

Companies Already on IPv6 ipv6.google.com ipv6.google.com comcast6.net comcast6.net ipv6.cnn.com ipv6.cnn.com More at link Baythreat-12 More at link Baythreat-12

IPv6 Certifications Fun, realistic projects He.net Link BayThreat-13

IPv6 Sages As of Link BayThreat-18

IPv6 Sages at CCSF 22 IPv6 Sages at CCSF so far ( ) Link BayThreat-19

T-Shirt #1 motivator for IPv6 Certification #1 motivator for IPv6 Certification Link Baythreat-9 Link Baythreat-9

Security Problems

Used by Ethernet

Privacy Risk Anyone who has your IP address also has your MAC address! There is a "Privacy Extensions" technique to avoid this, enabled by default in Vista and Windows 7

ICMPv6 Required for all networks Cannot be blocked Replaces ARP "Neighbor Discovery" is trivial

THC-IPv6 Hacker's Toolkit Runs fine on Ubuntu, even in VMware on Windows 7 Instructions: link BayThreat-14

Other Risks Many security appliances are not ready for IPv6, so it often bypasses them Torrents run over IPv6 Link BayThreat-15 Some VPN appliances are not ready, so IPv6 connections must bypass them Packet Amplification Attacks Routing Header Zero Ping-pong Links BayThreat-16 and 17

Class Overview

IPv6 Certification Every student should be a Certified IPv6 Guru by the end of the class Every student should be a Certified IPv6 Guru by the end of the class Many extra credit projects go beyond that Many extra credit projects go beyond that Cisco routing for students who know Cisco routing Cisco routing for students who know Cisco routing Windows: Router advertisements Windows: Router advertisements Linux: IPv6-to-IPv4 Reverse Proxy Linux: IPv6-to-IPv4 Reverse Proxy

Hurricane Electric IPv6 Certification (Part 1) 1. Registering at Hurricane Electric 2. Newb Test Demonstrate basic knowledge of IPv6 Demonstrate basic knowledge of IPv6 Become an IPv6 Newbie Become an IPv6 Newbie 3. Connecting as an IPv6 Client with the Gogo6 Tunnel IPv6 over UDP over IPv4 IPv6 over UDP over IPv4 Connect to a Web server as a client over IPv6 Connect to a Web server as a client over IPv6 Become an IPv6 Explorer Become an IPv6 Explorer

Hurricane Electric IPv6 Certification (Part 1) 4. IPv6 Web Server You need to buy a domain name from GoDaddy ($2.17) You need to buy a domain name from GoDaddy ($2.17) Apache will NOT work on Windows--use IIS instead Apache will NOT work on Windows--use IIS instead DNS: Creating an AAAA Record DNS: Creating an AAAA Record Become an IPv6 Enthusiast Become an IPv6 Enthusiast

Hurricane Electric IPv6 Certification (Part 1) 5. IPv6 Server Use the Apache James Java SMTP server Use the Apache James Java SMTP server Adding an MX Record to your DNS Zone Adding an MX Record to your DNS Zone Installing the Thunderbird Client Installing the Thunderbird Client Becoming an IPv6 Administrator Becoming an IPv6 Administrator

Hurricane Electric IPv6 Certification (Part 2) DNS Configurations Reverse DNS Servers Reverse DNS Servers Routing Advertisements Routing Advertisements Getting your own public IPv6 address block Getting your own public IPv6 address block Forward DNS Zone at Hurricane Electric Forward DNS Zone at Hurricane Electric Reverse DNS Zone at Hurricane Electric Reverse DNS Zone at Hurricane Electric Authoritative DNS Servers Authoritative DNS Servers Passing the Reverse DNS Test Passing the Reverse DNS Test

Hurricane Electric IPv6 Certification (Part 2) Becoming an IPv6 Professional Becoming an IPv6 Professional Becoming an IPv6 Guru Becoming an IPv6 Guru Becoming an IPv6 Sage Becoming an IPv6 Sage Get the T-Shirt Get the T-Shirt Fame, Fortune, Glory Fame, Fortune, Glory

The Hardest Part You need to make THREE accounts You need to make THREE accounts Hurricane Electric Hurricane Electric Gogo6 Gogo6 Freenet6 Freenet6 Each one has a name and password you need to write down Each one has a name and password you need to write down