IPv4: North American Addresses Exhausted

[IPv4 and IPv6: The 4 Corners of the World,  courtesy Center for Applied Internet Data Analysis]

IPv4: North American Addresses Exhausted

Abstract:

The TCP/IP Internet was created around 1981, where each participant would get an address out of a total of around 4 Billion. This technical limitation used 32 bit addresses, during a time when people were using 8 bit computing. Internet usage is pervasive today, with items such as cell phones and light bulbs being attached, and it was just a matter of time before the pool of addresses were exhausted. Another benchmark was hit today.

Gwangju Illustration in South Korea

A simple way to view the The Internet is an Apartment Complex. Each building may be a different continent and each apartment has an address. When someone wants to live in that complex, there is limited number apartment numbers in each complex. In the beginning, anyone can live anywhere, rent is cheap, large blocks of apartments are available for friends to rent together, and life is good. As time goes on, space fills up, and you have to wait until someone leaves or dies to get an address. If the population is ever increasing, there is a problem... people start to double-up or triple-up in the apartment, all sharing a single address, but perhaps adding an "a" or a "b" to the end of the number.

[NAT illustration]

Mitigation Using the Illustration

When IP Addresses on The Internet started getting "tight", providers started to make devices share at each location they provided service to. While this sharing solution is not optimal, this is what happens every day when people multiple computers, televisions, tablets, etc. at their homes... the home gets a single IP Address on The Internet and all the devices share that address through a technology called Network Address Translation using an Internet Router/Firewall. This delayed the problem for many years, since tens of thousands of connections could share a single IP Address on the Internet, behind an Internet Gateway Router/Firewall running NAT.

Trouble with NAT: Mitigation is Not Solution

The problem is, not all devices connected on the Internet using NAT can talk directly to other devices using NAT without going through a system on The Internet using a real IP Address. Devices using NAT must communicate to a well known server in The Internet "cloud", so applications started to become more limited in their framework. Furthermore, identification of an end-point on The Internet becomes more difficult to track, so one really does not know who is behind the public IP address since it could be shared by dozens or thousands of devices, potentially anywhere in the world! When trying to manage devices on The Internet, it is always preferable to have a dedicated IP Address, for troubleshooting, otherwise a physical presence may be needed to investigate a problem. Some secure management protocols break with NAT, since the source or destination address are different from what they started as, so the packet must be modified along the way, which raises security concerns. For everyday people, NAT is a solution, but not without drawbacks. Public IP Addresses continue to be eaten away.

[Warning sign from Wikimedia]

The Warning:

In July of 2015, the American Registry for Internet Numbers ran out of larger blocks of addresses to provide. If you needed a presence on The Internet (i.e. Internet Service Provider, Web Hosting company, Banking Institution deploying ATM's, etc.) and had a large project, you could only get a small number of addresses in North & Central America.

[Empty bottles courtesy The Register]

Running Dry:

As of today in September 2015, North America has officially run out of addresses. North America was not the first region to run dry of IP Addresses, leaving large numbers of devices needing to participate on the Internet high-and-dry. Caribbean and Latin America ran out of addresses in 2014. Europe and the Middle East ran out of addresses in 2012. Asia-Pacific ran out of addresses in 2011. Only Africa still has addresses left, projected to be exhausted in 2019 at current rate of consumption.

[Structure of IPv4 and IPv6 Packets]

The Solution:

In a world where computers, and even cell phones, are 64 bit - using a 32 bit number to define addresses for communication over The Internet is antiquated. This original address size was part of the Internet Protocol, version 4 (IPv4) definition. Over a decade ago, a newer address format was created, called IPv6. Movement to IPv6 is the ultimate solution. There are enough addresses in the 64 number for a very long time. Various governments in Asia such as Hong Kong and Japan, being the first to run out, already started the push to IPv6. Providers in Europe, like British Telecom, started the push to IPv6. Internet Service Providers, like Comcast, are deploying under IPv6 in the United States.

The Conclusion:

As providers move to IPv6, this delays the fate of companies bound to IPv4, since they may receive recycled addresses or can purchase formerly assigned addresses from providers who already moved infrastructure to IPv6. Solution providers moving to IPv6 will gain the benefit of peer-to-peer communication over the Internet, for their applications, while legacy IPv4 solution providers will incur greater costs with having to go through a central bottleneck in The Internet "cloud". If there is ever a point in time where innovation and crisis meets - this is that opportunity, don't miss it!

Vonage and MSN Port Usage

Vonage and MSN Port Usage

Abstract:

Adding Voice over IP (VoIP) and Instant Messaging to a home is normally a simple process. The goal is often to increase communication while reducing telecommunications bills. Occasionally, there are problems with access, which required troubleshooting or more advanced features are desired. A user may need to understand the protocols, in order to better maintain security, and limit scope to attacks by viruses and worms.

Vonage Voice Adapters

Vonage is a low-cost VoIP phone provider service. Normally, not much needs to be done, except plug in a device. Here are the protocols which are required.

Service	TCP	UDP	Notes
DNS		53	Name Resolution
TFTP	21,69,2400		Firmware Upgrade
HTTP	80		Configuration
SIP		5061	pre-2005 Vonage devices
RTP		10000-20000	RTP (Voice) traffic

When a call is made, a random port between 10000 and 20000 is used for RTP (Voice) traffic. If any of these ports are blocked, you may experience one way or no audio.

Microsoft MSN and Windows Messenger

Microsoft provides various tools like MSN and Windows Messenger, but in order to get full functionality, occasionally users must forward ports through firewalls and expand exposure to worms and viruses. Use very carefully.

Service	TCP	UDP	Notes
Windows Messenger - voice		2001 - 2120 6801, 6901	Computer to Phone
MSN Messenger - file transfers	6891 - 6900		Allows up to 10 simultaneous transfers
MSN Messenger - voice	6901	6901	Voice communications computer to computer.
MSN Messenger text	1863		Instant text messages

The ports may be helpful when you want to limit vulnerabilities within your environment to unfriendly viruses and worms.

Solaris 10: Digging Into TCP/IP Problems

Solaris 10: Digging Into TCP/IP Problems

Abstract:
Transmission Control Protocol / Internet Protocol (TCP/IP) has been embedded into most UNIX platforms since the beginning days of the Internet. With the enhancement of TCP/IP protocols over the decades, configuration & debugging has become increasingly more sophisticated. In the process of converting to a 100% open source system, Solaris 10 has acquired newer tools to work through issues.

Key Files:
Some key files needed to validate a configuration:

/etc/inet/hosts
/etc/inet/ipnodes
/etc/inet/netmasks
/etc/inet/services
/etc/defaultrouter
/etc/hostname.{interface}
/etc/nsswitch.conf
/etc/resolv.conf

Key Commands:
Some key commands used to validate the configuration:

/usr/sbin/ifconfig
/usr/bin/netstat
/usr/sbin/dladm
/usr/sbin/inetadm
/usr/sbin/ping

Key Tasks:
Issues with debugging connectivity of a device or a service includes various steps.

Validate the machine host name is tied to an IP address:

sunt2000/root# grep `uname -n` /etc/inet/hosts /etc/inet/ipnodes
/etc/inet/hosts:192.168.254.7 sunt2000 loghost
/etc/inet/ipnodes:192.168.254.7 sunt2000 loghost

Validate the machine host name and ip address is tied to a network interface:

sunt2000/root# grep `uname -n` /etc/hostname.*
/etc/hostname.ipge2:sunt2000

Validate a default gateway for traffic to pass off of the network:

sunt2000/root# grep -v ^# /etc/defaultrouter
192.168.254.2 1

Validate the configuration of the interface by the OS during the past reboot:

sunt2000/root# ifconfig ipge2
ipge2: flags=1000843 mtu 1500 index 4
inet 192.168.254.7 netmask ffffff00 broadcast 192.168.254.255
ether 0:14:4f:2:6a:5e

Validate the interface parameters for duplex and speed

sunt2000/root# dladm show-dev ipge2
ipge2 link: unknown speed: 100 Mbps duplex: full

Validate routing is set up from last reboot:

sunt2000/root# netstat -rn
Routing Table: IPv4 Destination Gateway Flags Ref Use Interface
-------------- ------------- ----- ----- ---------- ---------
default 192.168.254.2 UG 1 6719031
192.127.254.0 192.168.254.7 U 1 23399 ipge2
224.0.0.0 192.168.254.7 U 1 0 ipge2
127.0.0.1 127.0.0.1 UH 1 26319 lo0

Validate traffic is passing without errors or collisions on the interface.

sunt2000/root# netstat -ni -I ipge2
Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue
ipge2 1500 192.168.254.0 192.168.254.7 419830401 0 538731765 0 0 0

Check to see what kind of name resolution is used on devices and services.

sunt2000/root# egrep '(^hosts|^services)' /etc/nsswitch.conf
hosts: dns files
services: files

When dns is being used, ensure the name services are running correctly.

sunt2000/root# nawk '/^nameserver/ { Cmd="nslookup www.oracle.com " $2 ; system(Cmd) }' /etc/resolv.conf
Server: 192.168.1.19
Address: 192.168.1.19#53

Non-authoritative answer:
www.oracle.com canonical name = www.oracle.com.edgesuite.net. www.oracle.com.edgesuite.net canonical name = a398.g.akamai.net.
Name: a398.g.akamai.net
Address: 63.216.54.107
Name: a398.g.akamai.net
Address: 63.216.54.106

Server: 192.168.24.231
Address: 192.168.24.231#53

Non-authoritative answer:
www.oracle.com canonical name = www.oracle.com.edgesuite.net. www.oracle.com.edgesuite.net canonical name = a398.g.akamai.net.
Name: a398.g.akamai.net
Address: 63.216.54.106
Name: a398.g.akamai.net
Address: 63.216.54.107

Check inet services which are not disabled.

sunt2000/root# inetadm | grep -v disabled
ENABLED STATE FMRI enabled online svc:/application/x11/xfs:default enabled online svc:/application/font/stfsloader:default enabled offline svc:/application/print/rfc1179:default enabled online svc:/network/rpc/smserver:default enabled online svc:/network/rpc/gss:default enabled online svc:/network/rpc/rstat:default enabled online svc:/network/security/ktkt_warn:default enabled online svc:/network/telnet:default enabled online svc:/network/nfs/rquota:default enabled online svc:/network/ftp:default enabled online svc:/network/login:rlogin enabled online svc:/network/shell:default enabled online svc:/network/rpc-100235_1/rpc_ticotsord:default enabled online svc:/network/bpcd/tcp:default enabled online svc:/network/vnetd/tcp:default enabled online svc:/network/vopied/tcp:default enabled online svc:/network/bpjava-msvc/tcp:default enabled online svc:/network/bootps/udp:default enabled online svc:/network/tftp/udp6:default enabled online svc:/network/rpc/cde-calendar-manager:default enabled online svc:/network/rpc/cde-ttdbserver:tcp

Check global properties for all inet services.

sunt2000/root# inetadm -p
NAME=VALUE
bind_addr=""
bind_fail_max=-1
bind_fail_interval=-1
max_con_rate=-1
max_copies=-1
con_rate_offline=-1
failrate_cnt=40
failrate_interval=60
inherit_env=TRUE
tcp_trace=FALSE
tcp_wrappers=FALSE
connection_backlog=10

List inet properties for any service which is suspect of not running correctly.

sunt2000/root# inetadm -l telnet
SCOPE NAME=VALUE
name="telnet"
endpoint_type="stream"
proto="tcp6"
isrpc=FALSE
wait=FALSE
exec="/usr/sbin/in.telnetd"
user="root"
default bind_addr=""
default bind_fail_max=-1
default bind_fail_interval=-1
default max_con_rate=-1
default max_copies=-1
default con_rate_offline=-1
default failrate_cnt=40
default failrate_interval=60
default inherit_env=TRUE
default tcp_trace=FALSE
default tcp_wrappers=FALSE
default connection_backlog=10

Conclusion:
For setting up and maintaining basic Network Management infrastructure under Solaris, these basic commands will take someone a long way.

Administer Interfaces Under Solaris

Administer Interfaces Under Solaris

Abstract:

Under Solaris, users could configure some flat files and reboot a system in order to bring up their machine on an IP network. The startup scripts under Solaris traditionally leveraged the straight "ifconfig" command to add the network interfaces for the IP layer. The command for managing interfaces as the data link layer had been "dladm". Sun also bundled "IPFilter" into Solaris 10 for firewalling and NAT'ing. Configuring the various IP interfaces has been somewhat complex, so a new user friendly command has recently landed in OpenSolaris to help: "ipadm".

Configuration File Method:

The configuration files which are normally leveraged to configure a simple system before restart include:

• /etc/inet/hosts
  Holds the IP Address & hostname of the machine. Can also be used for the default router. Example entries include:
  192.168.3.250 Ultra60 loghost
  192.168.3.1 WRT600 defaultrouter
  
  
• /etc/inet/ipnodes
  Holds the IP Address & hostname of the machine. Can also be used for the default router. Example entries include:
  192.168.3.250 Ultra60 loghost
  192.168.3.1 WRT600 defaultrouter
  
  
• /etc/netmasks
  Hosts the address of the network that the machine is sitting on. Example entry includes: 192.168.3.0 255.255.255.0
  
  
• /etc/defaultrouter
  Holds the IP Address or host name of the default router. Example entry includes:
  defaultrouter
  
  
• /etc/hostname.[interface]
  Holds the hostname for the physical[:logical] IP interface. Example for "ce0" includes:
  Ultra60
  

The "files" method is persistent across reboots, but of course requires a reboot. If a reboot is not possible, then follow the instructions below to perform the On-Line Method of configuration.

On-Line Method:

For people who can not afford to perform reboots of a system, interfaces can be added while the operating system remains on-line using the "ifconfig" command.

• ifconfig [interface] plumb
  Puts the "plumbing" in place to configure an IP interface. Example command:
  ifconfig ce0 plumb
  
  
• ifconfig [interface] addif [ipaddress/netmask]
  
  Assigns an address to a plumbed interface.
  ifconfig ce0 addif 192.168.3.2/24
  

In order for on-line changes to be persistent across reboots, it is important that the Configuration File Method has already been followed.



The New Method

With the PSARC/2010/080, OpenSolaris includes a unified interface to build interfaces on-line, which can also be made persistent.

For some examples on how to use the new OpenSolaris "ipadm" command are here.

We are all looking forward to this making it into Solaris!