I wonder if there's anything wrong with my onu config

Hi,

Just sharing only, I used mktxp_exporter a long time ago, and today I've just figured out these metrics, and when I visualize them, surprise, my usage with IPv6 is more than double IPv4.

There is still a lot of work to do…

I have a repurposed gaming laptop as a server, currently it's hosting a minecraft server and a website for that but I want to also self host DNS to get insights on my home networks internet usage essentially.

I had pi hole running in a docker container and got it working, but I came into an issue with IPV6.

The server has IPV4 local DHCP reservation which is port forwarded, but there's no way to set a static IPV6 server address, so I assume that'll constantly change at least with every restart.

What should I do here? Currently it's set to adguard.

Is there a better way to edit an ipv6 ACL in a Cisco IOS oder iOS- xe where there is no resequence command available.

Is painstaking/breath holding act to every time edit a long IPv6 ACL , include a few lines , copy the list in a note pad , remove the sequence, delete the entire existing ipv6 ACL then paste the new one.

Ita better to have any other workaround. Having to work with a legacy Cisco set up, we are slowly migrating to 9500. It's a long road ahead, and it's totally time consuming when it comes to writing an existing ipv6 ACL.

My collegue looked up in AI and got a big NO for an answer, call me old fashioned. but I really like to hear from fellow experts. Looking forward for an interesting conversation

Ran into an interesting problem where users on dual stack networks and windows 11 (prefers IPv6 by default) will sometimes alternate between connecting to Azure resources with IPv4 and IPv6 causing a number of interesting issues.

1. RE-authorization prompts from the IP change
2. Slow performance on IPv6 randomly when it is selected
3. Intermittent blocking of logins from GEOIP database differences between the IPv4 and IPv6 address showing the user in very distant locations.

Turns out some of the home ISPs have just started rolling out dual stack.

Recently upgraded my router from my ISP. Seems like now I have both v4 and v6. I am hosting couple of services on spare laptops and raspberry pi. All exposed only through tailscale. Now I have ipv6, is there anything new I can try? Any services that can make use of this?

I have a nextcloud server at home. Its public domain is only reachable through IPv6, because my internet provider doesn't offer public IPv4. Is there a free solution to tunnel the traffic, so that it can be reachable by IPv4, while maintaining a valid SSL certificate too ? (currently using letsencrypt)
Thanks

Hi all,

Not many changes in that new version.

https://datatracker.ietf.org/doc/draft-martin-retry-over-ipv6/

When to send (§): on the public Internet, operators SHOULD prefer emitting 503 + Retry-Over-IPv6 only for human-facing HTML documents and omit typical subresources (images, scripts, stylesheets, fonts); non-interactive clients (e.g. webmail image loads) otherwise see a broken asset with no explanation. Operator-controlled environments MAY still signal all IPv4 requests for fuller measurement. Cross-reference from Intended Deployment.

This change came from my experience when I migrated my mailing list from Mailchimp to my own web server, but noticed that web clients could not load the embedded images in the email as they were on my site.

1. Even GMail which understands IPv6, will prefer IPv4
2. The email looks broken with little idea on the client side, why.

Note: the following websites are implementing the IPv4 outage on the 6th for 24 hours, which should starts very soon:

• ipv6forum.com
• pacific.ipv6forum.com
• caribbean.ipv6forum.com
• whynoipv6.com
• www.peachymango.org

I you want to follow those websites, instructions at:

https://github.com/franckhlmartin/ietf-draft-retry-over-ipv6/tree/main/docs

And please send comments or your feedback in running this experiment. Please open an issue on the github repo or message v6ops at IETF.

Franck

Why do most VPS providers assign IPv6 /64 blocks as on-link instead of routed? Was there a specific technical workaround during the early days of IPv6 implementation that led to this 'bad' habit becoming the industry standard?

I've noticed that googleadservices.com and www.googleadservices.com both only have A records, maybe someone of you knows someone who knows someone who can forward it to google to also enable IPv6 on these endpoints?

Its the only endpoint connecting over IPv4 on Google itself and also 3rd-party websites using Google Analytics.

​

I’ve been investigating Snapchat’s network traffic using PCAPdroid and also checking the DNS records directly from Termux.

What I noticed is that most of the Snapchat hostnames I see during normal app usage do not have AAAA records.

So far, the only ones I’ve found that appear to support IPv6/AAAA are:

USC v61

USC v62

BOLT

However, the main CT and SF servers I observed do not have AAAA records. The same is true for the other hostnames I checked, including the GCW API.

I also noticed that api.snapchat.com doesn't appear in my actual Snapchat app traffic, despite being associated with Snapchat publicly, so I’m not counting it as an active endpoint in this case.

I verified the DNS side independently with Termux, and the hostnames where I found no AAAA record also returned no AAAA record there.

My question is: why doesn't Snapchat provide AAAA/IPv6 support for all of its hostnames? Is this intentional because certain services (such as CT/SF) are still IPv4-only, while USC/BOLT handle IPv6? Or is there some other reason for this architecture?

I’d be interested to hear from anyone who has analyzed Snapchat’s network infrastructure or IPv6 behavior in more detail.

Also i think since 2016 apps on appstore and Google play need to fully support ipv6? But seems like snapchat dont allow that rule

Most people in this sub are familiar with the IPvfoo extension. There is also now a Firefox extension called "Modern Web Checker" which takes this a bit further:

https://addons.mozilla.org/en-US/firefox/addon/modern-web-checker/

As well as reporting if the site you're connecting to and sub elements within it are reached over IPv6, it also:

• Reports if the site is using modern crypto - ie TLSv1.3 with post-quantum key exchange.
• Reports if the site is using or supports HTTP3
• Tests if your connection actually supports IPv6 - with IPvfoo all sites show up as legacy sites which leads to confirmation bias whereby users will conclude sites don't support IPv6 when it's their local connection causing the problem.

There are also a number of optional features, which are disabled by default as they require sending the names of sites you visit to google or cloudflare public DNS services:

• Checks if the site's domain supports DNSSEC.
• Tests if a site supports IPv6 and would have used it if your connection was capable.

Source code of this plugin is available from: https://git.ev6.net/bert/modern_web_checker

Spinning up a new instance for a pet project this weekend and I just have to vent for a sec. Why do so many default cloud images still treat ipv6 like it's some experimental beta feature from 2005? I was literally just trying to get a pure v6-only environment going. No legacy ipv4, no messy NAT garbage. Just clean routable addresses. but half the time the default network manager straight up panics if it can't bind to a v4 interface first and stalls the boot process.

Was skimming through a ServerMania post trying to see if there's any consensus right now on which distro actually defaults to a sane, v6-first approach out of the box (ended up going with debian as usual, kinda just brute-forced the SLAAC config).

It's just so exhausting tbh. The protocol works perfectly. we have the address space. But the broader tech industry is still so obsessed with holding onto ipv4 life support that it feels like you're actively punished for trying to build modern infrastructure.

Anyway. Just wanted to complain to a crowd who actually understands the pain of troubleshooting neighbor discovery at 2 am.

I have some issues with my ISP, so I was looking for a VPN provider that can route my traffic instead.

I ran into multiple problems setting up a LAN which routes all v4 and v6 traffic over the VPN:

Most providers don't support IPv6 at all. All that do which I've encountered so far, do it in a an (imo) terrible way:

• The server has one(!) IPv6 exit IP
• Each tunnel (OpenVPN, Wireguard, ...) gets assigned a single /128 ULA address
• All tunnel addresses are NAT'ed to the exit IP

If I want to use this in my local network, I need ULA addresses on LAN (making most devices prefer IPv4 anyway), and have two layers of NAT66: One from the LAN ULAs to the tunnel ULA (on my router), another one from the tunnel ULA to the exit server IPv6 (on the VPN server).

I get that this is the same setup these providers have been shipping for years with IPv4, but they could do so much better:

• Give each server it's own /64 subnet
• Assign every tunnel it's own GUA address

Or, even better:

• Give each server it's own /48 subnet
• Assign every tunnel it's own /64 subnet

I get that this can cause some privacy concerns, as every user receives their own addresses, allowing potential traffic correlation attacks. However, I'd argue this is a moot point in most configurations:

• With OpenVPN / IPsec, the server can configure a new client IP / subnet on each reconnect
• With Wireguard, providers could just provide their own software which automatically reconfigures tunnels if a user wishes to receive a new IP.

I can't imagine it would be that hard to configure servers this way, and have providers treat IPv6 as a first-class citizen.

Edit: Other issues I've noticed with VPNs and IPv6:

• Entry traffic is often v4-only
• VPN DNS servers are unreachable over v6, or can't resolve with v6-only name servers

Only really tangentially related to the transition from IPv4 to IPv6, but I thought the video would be of general interest to this audience nonetheless.

Broersma talks about the experience of using the ARPANET on mainframes in the 1970s, technical concepts pertinent to the ARPANET's usage, how TCP/IP supplanted NCP in a well-organised way such that NCP was completely gone by the end of 1983 (just 6 months after flag day), and some notable security incidents and attitude towards cybersecurity during the 1980s.

Does someone know an iOS app to send wake on LAN packets via IPv6?

Most apps I‘ve tried so far are unfortunately IPv4 only.

I activated CLAT on a windows 11 laptop and it only has an IPV6 address and a CLAT virtual ip address of 192.0.0.1. When I try to access an ipv4 only service on another vlan it can not reach it. In contrast, my android phone on the same network also with only a IPv6 address and a CLat 192.0.0.2 IPv4 address is able to reach the service.

Is there a difference between the implementation of CLAT between Windows 11 and Android that allows it?