Hot answers tagged

145

The first thing that should be mentioned about IPv6 subnetting is that a different mode of thought is called for. In IPv4 you usually think about how many addresses you have available and how you can allocate enough of them to each end user. In IPv6 you usually think about how many /64-subnets you have available and how you can allocate them to end users. ...


48

IPv6 is 128 bits, so why is /64 the smallest recommended subnet for hosts? First of all, a little ASCII art from the RFCs to establish terminology: | n bits | m bits | 128-n-m bits | +------------------------+-----------+----------------------------+ | global routing prefix | subnet ID | interface ID | +------...


30

If the ISP won't give you more than a /64, then that ISP sucks. If it is any relief I can tell you that I have to deal with ISPs that suck even more than that. Around here it is perfectly normal to take public IPv4 addresses away from customers and put them behind a CGN. And if you ask them for IPv6 addresses, they will tell you that they are not offering ...


29

Default route (aka gateway address) has to be owned by something that is capable of forwarding packets to the rest of the internet, and which is willing to do so. It doesn't have to be the "principal" IP address of the thing that owns it (whatever that means). It can be a logical address that floats between two or more devices, and in high-availability ...


25

As stated in other answers, having too many hosts in the broadcast domain can really start to make broadcasts a mess. They'll need a lot of expansion in the subnet before it becomes a potential problem. Future growth planning becomes a mess. Adding extra sites with their own IP space gets difficult when you've already laid a needlessly huge footprint down ...


25

You need to be able to log in on another host on the same network segment. Some of the ways to get access to the misconfigured host requires root on the intermediate host, but there also is one easy way to get access without needing root on the intermediate host. The easy way to access the host using IPv6 ssh -o ProxyCommand='ssh -W [fe80::42:ff:fe:42%%...


24

You should know three things about class-based-routing: Class-based routing was a simpler system that was abandoned (in 1993) long before most people ever heard about the Internet. In all likelihood, nobody you will ever know has used it. And if any of your network equipment is that old, you should seriously consider alternate employment. The system used ...


23

The only people I have ever met who use the terms "Class A/B/C" are people who are using them incorrectly to mean a /8 or a /16 etc (except for just one person who used "Class A" to be the first octet, "Class B" to be the second octet, etc. But he was an idiot who refused to change his phrasing even though it led to so much confusion). So go ahead and learn ...


20

IPv6 is 128 bits, so why is /64 the smallest recommended subnet for hosts? This prefix size was originally recommended in an older RFC - there has since been a revison to this policy where the issue of Neighbour Discovery Attacks is considered and using a /126 is a valid mitigation - nonetheless, if you are setting up PtP links with the sole purpose of ...


20

It is possible to solve this using NAT; it's just not very elegant. So under the assumption you couldn't solve this by having internal nets which have so uncommon network numbers as to never actually come into conflict, here's the principle: As both the local and remote subnet have identical network numbers, traffic from your client will never realize it ...


20

If you need a temporary dirty workaround to a single or a handful known server ips, the simplest solution should be the static client side routing option. In my case I added my desired destination server (192.168.1.100) to my routing table on my linux client via: route add 192.168.1.100 dev tun0 Afterwards, remove this static route with the route delete ...


17

You need a strong end system model. Linux is fundamentally built around a weak send system model, so it's really not a good OS choice for this application. You will have to fake every piece of the behavior you need, from ARP to policy routing to source address selection. You will also need filters to prevent packets from being accepted if they arrive on the ...


16

An ip address consists of four numbers separated with a dot between each. You read it from left to right, and each dot adds a level of detail. This is very similar to a real address, think about: Country.City.Street.Housenumber I'm sorry, but this is simply wrong. The dots do not have any significance. They are only there to make a 32-bit binary number (...


15

The IP address of the gateway can be any valid host IP address in the subnet, i.e. not the network address itself nor the broadcast address. This IP address does not need to belong to a single computer or router, it can be a "floating" IP address used by several gateways. Check out the Wikipedia articles on HSRP, VRRP, GLBP, or CARP. For example, when the ...


14

In a word, yes. People will often talk about it in the same way that the course material does. Nobody uses classful networking, or at least nobody I've encountered; during infrastructure/architecture planning people will often say things like "we'll set them up with two class C's here." It's easier than saying "we'll give them a /23" or "172.16.0.0-172.16....


12

Right. I'm going to be brutally honest, because it's what I'm good at. Throw away your Trendnet switches. Get HP Procurves. Don't settle for anything less than 2510-48Gs, with PoE if you want to use VoIP phones which are powered from the network. If you're going PoE, make sure that your phones and switches are both certified as 802.3af/at compatible, (...


11

Those ranges you list are described in this RFC 1918 - Address Allocation for Private Internets The title gives away their use case: "... for Private Intranets". All IP Address ranges are technically routable including those listed in the RFC. But they are often referred to as non-routable. That's because they are not meant to be routable or reachable ...


11

Route Print on my local machine shows: 192.168.10.99 255.255.255.255 On-link 10.168.10.154 26 That is why, the On-link routes are accessible locally without any gateway, many times they are created when you connect via dial-up (to Avaya device maybe). You have to find out why this route is being created. Maybe it was just a left over or was added ...


11

You can use CloudFormer to export your existing AWS infrastructure into CloudFormation template. Alternatively you can use terraforming ruby gem to export your infrastructure as Terraform files.


10

Yes, pressuring your ISP to not suck is the preferred option. RIR allocation policies assume that the ISP is giving each customer a /48; there is absolutely zero reason for the ISP to not do that. IPv6 is not a fan of smaller subnets, however the only thing that is supposed to break, that I'm aware of, is SLAAC. You'll have problems with bugs and ...


10

I guess I'm going to be the contrarian on this one. IMO, too many people make too much of a fuss trying to correct people when they talk about class-full ip addressing. The RFC 1918 reserved addresses were carved out of what was at the time the class-full address space. In fact, every piece of documentation I've ever read about the RFC 1918 addresses refers ...


10

A NAT Gateway (as well as a NAT Instance, for what it's worth) must be in a public subnet because only devices on public subnets can actually use a public IP address. That's what makes a public subnet a public subnet. The pedantic definition of a public subnet is a subnet whose associated VPC route table has at least one route pointing to the Internet ...


10

The best start is to refer to VPC and Subnet Basics which explains the VPC addressing and sizing reqirements. Not sure if you are familiar with CIDR addressing? Essentially the bigger the number after / the less hosts and subnets you can fit inside such network. For example: Your VPC CIDR is 172.22.130.0/28 where /28 means that out of the 32 bits in the IP ...


9

No matter what you do, you can't prevent the "other guy" from sending a DHCPOFFER to "your" clients. Two un-coordinated DHCP servers on one network is not going to work in any kind of sane way.


9

Based on the combination of an IP and a subnet mask the OS can figure out if a destination IP that it's user space application wants to contact is in it's local network or needs to be sent via some router. If it needs to be sent via a router, it does a routing table lookup to determine which router to use.


9

kasperd posted a great answer detailed enough for me to learn how I can recover from situation in the question. This answer is the exact step-by-step of how I did it. SSH to server on same physical network Using arp -a or ip neighbor list as root find the MAC address of misconfigured server. Using MAC to link-local converter find link-local for ...


9

The best algorithm is to start blocking separate addresses. Then when multiple addresses are blocked in the same /64 you block the whole /64. Repeat that for bigger aggregates. Prefixes are usually given out on nibble boundaries (multiples of 4, or one hexadecimal digit). Do you might want to scale from /64 to /60, /56, /52 and /48. A /48 is usually the ...


9

"Logical entity" in your usage is a tiny bit confusing. But I'll try to answer it best I can. From my experience, a gateway in an IP configuration is usually a physical device. While it doesn't have to be a computer in the traditional sense (it can also be a network appliance) it does have to be device. As you may know, the purpose that a default gateway ...


8

Think of the /16 and /24's as a notation for how large a network is. A /24 is ~255 times smaller than a /16, but that does not mean it's not in the same range of addresses. so yes, 192.168.0.0/24 is private, so is 192.168.1.0/24, as both are subsets of 192.168.0.0/16.


8

It is not possible to change the CIDR block for a VPC. So if you have created the VPC with 192.168.0.1/24, then that's as big as the VPC can get. You'll have to re-create the VPC to get more space. Also, it's not possible to change a VPC subnet. You can only delete it and re-create it differently. On top of that, it's not possible to delete a VPC subnet ...


Only top voted, non community-wiki answers of a minimum length are eligible