8

Given that blocking a single IPv6 address would seem to be somewhat pointless as an end user typically has at least 2**64 of them, we need to block a range, which identifies a "site".

A "site" in this context is something like a home or small office user. RFC 6177 discusses the allocation of address blocks to small sites:

... it might be tempting to give home sites a single /64, since that is already significantly more address space compared with today's IPv4 practice.

However, this precludes the expectation that even home sites will grow to support multiple subnets going forward. Hence, it is strongly intended that even home sites be given multiple subnets worth of space, by default. Hence, this document still recommends giving home sites significantly more than a single /64, but does not recommend that every home site be given a /48 either.

That said, I have read in online discussions that /64 and /56 are both common allocations for domestic users.

If I block a /64, and the attacker has a /56, then they have 255 more subnets to attack me from.

Conversely, if I block /56, and it turns out the ISP allocates blocks of /64, I might also have excluded 255 other users. Now the probability of you actually affecting your traffic by randomly excluding 255 sites is pretty low if you consider a random distribution. However, it is not, by definition random. It is feasible that I could in this sense block a small geographical area where my website is popular.

I use the example of blocking, but really it's a more general question, which extends to rate limiting, analytics etc.

In short, what is the best prefix size to identify a "site"? Are there any guidelines about this?

Improve this question

1 Answer 1

Reset to default
14

The best algorithm is to start blocking separate addresses. Then when multiple addresses are blocked in the same /64 you block the whole /64. Repeat that for bigger aggregates.

Prefixes are usually given out on nibble boundaries (multiples of 4, or one hexadecimal digit). Do you might want to scale from /64 to /60, /56, /52 and /48. A /48 is usually the largest prefix given to a single site.

Depending how careful you want to be you can skip from /64 straight to /56 and /48.

Depending on which region you are in you also might use the regional internet registry's (RIR) public database. In the RIPE database internet providers document the aggregation size they give to customers there. In that case you know exactly what size to use.

Improve this answer
3
  • Yeah this kind of gradual aggregation could be used for rate limiting and analytics too. When I've figured out my rate limiting algo I'll post a supplementary answer.
    – Rodney
    Jul 22, 2017 at 8:35
  • I have done various experiments with algorithms over the years. It's more difficult than it seems to do this efficiently. If I find a good one I'll update my answer too :)
    – Sander Steffann
    Jul 22, 2017 at 20:07
  • 1
    You can implement this gradual aggregation approach in a fairly simple way. Track separate rate limits at the /64 /56 and /48 level all the time. Use higher limits for higher levels. That way there is no aggregation logic at all. It's just three separate limits based on different keys.
    – usr
    Apr 12, 2019 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.