Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need to become an IPV4 and IPV6 expert in a couple of hours.

Our company is being bullied by the internet legislator in our country to move fast to offer the site in IPV6 only (we are just content providers, not a ISP or the like)

The demand that the internet legislator here in Brazil is making upon us is that by sticking to IPV4 we wont be able to offer the Justice system enough information on certain users (when probed) once IPV6 is fully operational. That is certainly bogus.

But what is not bogus and can affect us is the following attribution they are impinging upon us:

That by sticking to IPV4 we are going to log the IP address from all the users + the OUTGOING port they got from their ISPs. Is that info even available in the IP protocol? They tell us that when the ISPs start to use NAT to give the same address to a group of users, we will need the outgoing port to uniquely identify these people.

Another question is: when someone gets out of their ISP using IPV6 will they be able to reach our old IPV4 website?

share|improve this question

migrated from stackoverflow.com Apr 24 '14 at 22:24

This question came from our site for professional and enthusiast programmers.

1  
Hmmm... IP protocol does not have ports, ports are used in tcp/udp... –  Gusman Apr 24 '14 at 22:02
3  
The FBI is also interested in ISP's converting to IPv6 for similar reasons gcn.com/Articles/2012/06/07/… –  Eric J. Apr 24 '14 at 22:05
1  
I need to become an IPV4 and IPV6 expert in a couple of hours. - My sincere wish of good luck to you on that. –  joeqwerty Apr 25 '14 at 1:24

2 Answers 2

up vote 3 down vote accepted

Yes, you can log the remote port number for incoming HTTP connections.

For instance, with Apache, you would add %{remote}p to your CustomLog to log the remote port number.

With nginx, the remote port number is in $remote_port which you can add to your log_format.

Remember when you change the log format, you also need to adjust any tools that you use to parse the logs.

As for IPv6, the usual thing for content providers (and everyone else) is to run dual-stack, i.e. serve content on both IPv6 and IPv4. You should have already pressured your data center to provide you with IPv6 service and deployed it on your web site. If they won't give it to you, consider moving your site to some provider who will.

share|improve this answer
    
If they won't give it to you, consider moving your site to some provider who will - or just have the Brazilian government pressure them for you. They are the ones with the interest, and they certainly have power. –  Eric J. Apr 24 '14 at 22:11
    
@EricJ. Haha, yes, that too. But with carrier grade NAT, using IPv6 is a performance optimization for web sites; it will be faster for people who have native IPv6 but IPv4 via CGNAT. –  Michael Hampton Apr 24 '14 at 22:11
    
@michael a question: how does our surfing on the interwebs happens nowadays? is that hibrid? do I have both IPV4 AND IPV6 addresses for surfing? –  Draconar Apr 24 '14 at 22:34
    
@Draconar If you got IPv6 from your ISP, then you will use IPv6 if the remote site has IPv6, or fall back to IPv4 otherwise. –  Michael Hampton Apr 24 '14 at 22:35
    
@MichaelHampton I see.. so that means that I have both addresses available for me (IVP4 AND IPV6) for normal surfing after hopping out of my ISP? –  Draconar Apr 24 '14 at 22:58

It makes sense, from a law enforcement point of view. Yes, to be able to trace sessions through Carrier NATs you need to log source address and port + destination address and port. And very accurate time stamps. And even then it requires a huge amount of ligging in the NAT as well. IPv6 usually doesn't have NAT, so just logging addresses is usually enough. The world is (still slowly, but picking up speed) moving to IPv6, and everybody needs to move. Both content and access. The quicker we move, the quicker we can get rid of IPv4 and the NATing, timestamped port logging and routing table mess that IPv4 is becoming.

share|improve this answer
    
But for now we need dual-stack. The worst of both worlds, but necessary in the transition. (A bit exaggerated, but you get the point ;) –  Sander Steffann Apr 24 '14 at 22:44
    
However IPv6 does have it's own provisions meant to help ensure anonymity, such as a single device having multiple IPs and formal mechanisms for the device to change IPs. –  Eric J. Apr 24 '14 at 23:22
    
True, but the subnet doesn't change, and that is approximately the same information law enforcement would get in case of a client-side NAT. –  Sander Steffann Apr 25 '14 at 5:38
    
Logging on the NAT can be avoided, if a range of port numbers is statically allocated to each customer. That also reduces the accuracy requirement on time stamps. –  kasperd Apr 29 '14 at 12:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.