[ipv6-wg] Invitation to supply feedback on ITU draft Recommendation on IPv6 address planning for IoT

Hello everyone,

as promised during the WG session in Marseille, here is the result of my
analysis of the draft ITU Recommendation Y.IPv6RefModel “Reference model
of IPv6 subnet addressing plan for Internet of things deployment”.  It's
not exactly a scientific masterpiece, but right now I have only limited
time to get this out...

Upon another closer look at the document I realized that in *all*
relevant cases not 8 but 16 bits of each address are re-purposed.  This
leads to an even more dramatic reduction of the expected usable life
time of IPv6, as explained in point 5.

If I manage to turn this into a video blog session (no promises, but
I'll try to find the time somehow) I'll let you know.  And yes, I've
already recorded a session on this topic in late 2013 at
https://www.stepladder-it.com/bivblog/2/, so this problem has been
around for at least a good four years.

Enjoy the read.


Cheers,

    Benedikt

---8<---

In One Sentence
===============

The entire document is flawed beyond repair due to its underlying
approach; if applied as a "reference model" it will critically endanger
the future of the IPv6 based Internet.


Some Core Problems
==================

1. The model is inapplicable to real-world networks.
2. The model will dramatically hinder any further evolution of all IP
   based networking.
3. The model carries all legacy problems from IPv4 into the IPv6 era.
4. The model precludes the application of several of the most basic
   security measures considered best practice by todays standards.
5. The model shortens the expected usable life time of IPv6 by at least
   25%, or 42+ years at the current Internet growth


Analysis and Explanations
=========================

1. The model is inapplicable to real-world networks
---------------------------------------------------

Real world networks are split into subnets based on a number of
fundamental criteria.  These usually include

  - real-time behaviour
    (e.g. low latency for VoIP vs. high bandwidth for SAN)
  - security considerations
    (e.g. splitting networks into adequate security zones)
  - service level considerations

and many more.  The document defines a categorization that ignores all
of these criteria but for some reason considers "IoT"---without any
consideration of the normal criteria applied to the particular IoT
application---as special.

As a result, when designing networks according to the proposed model,
there are two possible results:

If the commonly used criteria are ignored, then the result is a network
that is an ill fit to the purposes and security requirements it should
be designed for.

If the commonly used criteria are applied, then the encoding of the
categories required by the model will lead to a fragmentation of the
network that causes a tremendous increase in the number of routes needed
throughout the network.  In sufficiently large networks, e.g. at an
enterprise level, this will make it impossible to apply the commonly
used criteria for network design.


2. The model will dramatically hinder any further evolution of all IP
---------------------------------------------------------------------
   based networking
   ----------------

The proposed model doesn't cater for future development of IP based
networks.  (Having a category "Reserved & Others" in obviously doesn't
do, since a "reserved" subnet range can't be possibly used for "other"
applications.)

But even if this was somehow fixed in the document, this wouldn't help
any.  Reserving a sufficiently large part of the address space for
future specifications would seriously aggravate the other problems in
this analysis to the point that the entire model becomes impossible to
implement.

Not reserving a sufficiently large part of the address space however
will quickly lead to the situation that the Internet outgrows the model
proposed.  Considering that it took IPv6 approximately 30 years to get
to where it is right now, then even if we started on a successor IP
protocol today---which to my knowledge is nowhere in sight---then we
have to assume that IPv6 will by around for another 30+ years until it
can be replaced.  Considering the speed at which the Internet, and IP
networking in general, have evolved in the last 30 years there is no
chance that the proposed model can be used throughout such a period in
an evolutionary way.


3. The model carries all legacy problems from IPv4 into the IPv6 era
--------------------------------------------------------------------

Attempting to map IPv4 and IPv6 in a 1:1 fashion carries all the legacy
issues we have with IPv4, like broadcast-based applications leading to 
undesirable network topologies, over into the IPv6 world.

Once IPv4 gets obsolete in parts of a network, this approach either
forces yet another redesign of the then-productive IPv6 network, or it
carries the IPv6-related problems even after IPv4 has otherwise been
removed from the network into the IPv6-only period.


4. The model precludes the application of several of the most basic
-------------------------------------------------------------------
   security measures considered best practice by todays standards
   --------------------------------------------------------------

In enterprise and other data center environments, microsegmentation and
hierarchical security zones as well as a number of other, more specific
designs, are used to reach a sufficient level of security.

All of these measures however require a network design that can't be
implemented within the constraints of the proposed model except through
an excessive bloat of the routing tables, firewall configurations and
application based access control lists involved.

Depending on the security requirements of the given network environment,
this is unacceptable at best and violating various legal requirements at
worst.


5. The model shortens the expected usable life time of IPv6 by at least
-----------------------------------------------------------------------
   25%, or 42+ years at the current Internet growth
   ------------------------------------------------

IP addresses by their very design are supposed to hold all the
information needed to route IP packets from their source to their
destination.  As such IP addresses must be assigned in a way that
matches the chosen network topology, and nothing else.

The proposed model however effectively re-purposes two octets of data
for purposes unrelated to routing.

Applying the HD ratio concept (as used for IPv6 subnets in general), or
basic information theory (Shannon 1948/1949), this can be worked into
more palatable numbers:  The proposed model

- reduces the number of usable subnet prefixes to 1/65536 = 0.00153% of
  the address space,
- at a continued exponential growth of the Internet reduces the
  expected usable life time of IPv6 by (64-48)/64 or 25% and
- at a continued exponential growth of the Internet by the commonly
  measured/estimated factor of 1.3/year, reduces the effective
  life time by log_1.3(2**16)=42.27 years.

This doesn't even take into account the impact it has on the size of
routing tables, access control lists and such, which may or may not
reduce the usable life time of IPv6 at the Internet level even further.

Only when the network topology correlates, or is made to correlate, the
encoding of the categorization data in the addresses could this effect
be slightly reduced.  Trying to make use of this fact will however make
network design decidedly more complex while at the same time only
generating a marginal effect.


Conclusion
==========

Following from the results of this analysis---which is by no means meant
to be complete---the proposed reference model is ill-conceived and
critically endangers the future of the Internet.

---8<---

-- 
Benedikt Stockebrand,                   Stepladder IT Training+Consulting
Dipl.-Inform.                           http://www.stepladder-it.com/

          Business Grade IPv6 --- Consulting, Training, Projects

BIVBlog---Benedikt's IT Video Blog: http://www.stepladder-it.com/bivblog/