<para>The goal of the Linux IPv6 HOWTO is to answer both basic and advanced questions about IPv6 on the Linux operating system. This HOWTO will provide the reader with enough information to install, configure, and use IPv6 applications on Linux machines. Intermediate releases of this HOWTO are available at <ulink url="http://mirrors.bieringer.de/Linux+IPv6-HOWTO/">mirrors.bieringer.de</ulink> or <ulink url="http://mirrors.deepspace6.net/Linux+IPv6-HOWTO/">mirrors.deepspace6.net</ulink>. See also <link linkend="revision-history">revision history</link> for changes.</para>
<para>Information about available translations you will find in section <link linkend="general-translations">Translations</link>.</para><sect1 id='general-copright' >
<para>This documentation is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. </para>
<para>This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. </para>
<para>You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.</para></sect2><sect2>
<title>About the author</title>
<sect3>
<title>Internet/IPv6 history of the author</title>
<listitem><para>1993: I got in contact with the Internet using console based e-mail and news client (e.g. look for “e91abier” on <ulink url="http://groups.google.com/">groups.google.com</ulink>, that's me).</para></listitem><listitem><para>1996: I got a request for designing a course on IPv6, including a workshop with the Linux operating system.</para></listitem><listitem><para>1997: Started writing a guide on how to install, configure and use IPv6 on Linux systems, called <ulink url="http://www.bieringer.de/linux/IPv6/">IPv6 & Linux - HowTo</ulink> (see <ulink url="http://www.bieringer.de/linux/IPv6/IPv6-HOWTO/IPv6-HOWTO-0.html#history">IPv6 & Linux - HowTo/History</ulink> for more information).</para></listitem><listitem><para>2001: Started writing this new Linux IPv6 HOWTO. </para></listitem></itemizedlist></sect3><sect3>
<para>The author can be contacted via e-mail at <pb at bieringer dot de> and also via his <ulink url="http://www.bieringer.de/pb/">homepage</ulink>.</para>
<para>He's currently living in Munich [northern part of Schwabing] / Bavaria / Germany (south) / Europe (middle) / Earth (surface/mainland).</para></sect3></sect2></sect1><sect1 id='general-category' >
<para>For other available versions/translations see also <ulink url="http://www.bieringer.de/linux/IPv6/">http://www.bieringer.de/linux/IPv6/</ulink>.</para></sect2><sect2>
<title>History</title>
<sect3>
<title>Major history</title>
<para>2001-11-30: Starting to design new HOWTO.</para>
<para>2002-01-02: A lot of content completed, first public release of chapter 1 (version 0.10).</para>
<para>2002-01-14: More completed, some reviews, public release of the whole document (version 0.14).</para>
<para>2002-08-16: Polish translation is in progress</para>
<para>2002-10-31: Chinese translation is available (see <link linkend="general-translations">Translations</link> for more)</para>
<para>2002-11-10: German translation is in progress</para>
<para>2003-02-10: German translation is available</para>
<para>2003-04-09: French translation is in progress</para>
<para>2003-05-09: French translation is available</para>
<para>2003-10-16: Italian translation is in progress</para>
<para>2004-03-12: Italian translation is available</para>
<para>2004-06-18: Greek translation is in progress</para>
<para>Translations always have to contain the URL, version number and copyright of the original document (but yours, too). Pls. don't translate the original changelog, this is not very useful - also do not translate the full section about available translations, can be run out-of-date, add an URL to this section here in the English howto.</para>
<para>Looks like the document's change frequency is mostly less than once per month. Since version 0.27 it looks like that most of the content contributed by me has been written. Translations always have to use the English version as source.</para><sect2>
<para>Note: an overview with URLs can be found at <ulink url="http://www.bieringer.de/linux/IPv6/">http://www.bieringer.de/linux/IPv6/</ulink>.</para><sect3>
<para>A Chinese translation by Burma Chen <expns at yahoo dot com> (announced to me at 2002-10-31) can be found on the TLDP: <ulink url="http://www.ibiblio.org/pub/Linux/docs/HOWTO/translations/zh/Linux-IPv6-HOWTO.txt.gz">http://www.ibiblio.org/pub/Linux/docs/HOWTO/translations/zh/Linux-IPv6-HOWTO.txt.gz (g'zipped txt)</ulink>. It's a snapshot translation, don't know whether kept up-to-date.</para></sect3><sect3>
<para>Since 2002-08-16 a Polish translation was started and is still in progress by Lukasz Jokiel <Lukasz dot Jokiel at klonex dot com dot pl>. Taken source: CVS-version 1.29 of LyX file, which was source for howto version 0.27. Status is still work-in-progress (2004-08-30).</para></sect3><sect3>
<para>With 2002-11-10 a German translation was started by Georg K<>fer <gkaefer at gmx dot at> and the first public version was published 2003-02-10. It's originally available on Deep Space 6 at <ulink url="http://mirrors.deepspace6.net/Linux+IPv6-HOWTO-de/">http://mirrors.deepspace6.net/Linux+IPv6-HOWTO-de/</ulink> (mirrored e.g. on <ulink url="http://mirrors.bieringer.de/Linux+IPv6-HOWTO-de/">http://mirrors.bieringer.de/Linux+IPv6-HOWTO-de/</ulink>). This version will stay up-to-date as much as possible.</para></sect3><sect3>
<para>With 2003-04-09 a French translation was started by Michel Boucey <mboucey at free dot fr> and the first public version was published 2003-05-09. It's originally available on Deep Space 6 at <ulink url="http://mirrors.deepspace6.net/Linux+IPv6-HOWTO-fr/">http://mirrors.deepspace6.net/Linux+IPv6-HOWTO-fr/</ulink> (mirrored e.g. on <ulink url="http://mirrors.bieringer.de/Linux+IPv6-HOWTO-fr/">http://mirrors.bieringer.de/Linux+IPv6-HOWTO-fr/</ulink>).</para></sect3><sect3>
<para>A member of the MontevideoLibre, a project in Uruguay (South America) starts the translation into Spanish in wiki format: <ulink url="http://www.montevideolibre.org./manuales:libros:ipv6">http://www.montevideolibre.org./manuales:libros:ipv6</ulink></para></sect3><sect3>
<para>With 2003-10-16 a Italian translation was started by Michele Ferritto <m dot ferritto at virgilio dot it> for the <ulink url="http://ildp.pluto.linux.it/">ILDP</ulink> (Italian Linux Documentation Project) and the first public version was published 2004-03-12. It's originally available on the ILDP at <ulink url="http://it.tldp.org/HOWTO/Linux+IPv6-HOWTO/">http://it.tldp.org/HOWTO/Linux+IPv6-HOWTO/</ulink>.</para></sect3><sect3>
<title>Japanese</title>
<para>On 2003-05-14 Shino Taketani <shino_1305 at hotmail dot com> send me a note that he planned to translate the HowTo into Japanese.</para></sect3><sect3>
<title>Greek</title>
<para>On 2004-06-18 Nikolaos Tsarmpopoulos <ntsarb at uth dot gr> send me a note that he planned to translate the HowTo into Greek.</para></sect3><sect3>
<para>On 2005-07-18 Necdet Yucel <nyucel at comu dot edu dot tr> send me a note that a Turkish translation is available. It's a snapshot translation (currently of 0.61) and can be found at <ulink url="http://docs.comu.edu.tr/howto/ipv6-howto.html">http://docs.comu.edu.tr/howto/ipv6-howto.html</ulink>.</para></sect3><sect3>
<para>On 2007-03-28 Claudemir da Luz <claudemir dot daluz at virtuallink dot com dot br> send me a note that he planned to translate the HowTo in Portuguese-Brazil.</para></sect3></sect2></sect1><sect1>
<para>This HOWTO is currently written with LyX version 1.5.6 on a Fedora 9 system with template SGML/XML (DocBook book). It's available on <ulink url="http://cvs.tldp.org/go.to/LDP/LDP/users/Peter-Bieringer/">TLDP-CVS / users / Peter-Bieringer</ulink> for contribution.</para><sect3>
<para>Code line wrapping is done using selfmade utility “lyxcodelinewrapper.pl”, you can get it from CVS for your own usage: <ulink url="http://cvs.tldp.org/go.to/LDP/LDP/users/Peter-Bieringer/">TLDP-CVS / users / Peter-Bieringer</ulink></para></sect3><sect3>
<title>On-line references to the HTML version of this HOWTO (linking/anchors)</title>
<sect3>
<title>Master index page</title>
<para>Generally, a reference to the master index page is recommended. </para></sect3><sect3>
<title>Dedicated pages</title>
<para>Because the HTML pages are generated out of the SGML file, the HTML filenames turn out to be quite random. However, some pages are tagged in LyX, resulting in static names. These tags are useful for references and shouldn't be changed in the future.</para>
<para>If you think that I have forgotten a tag, please let me know, and I will add it.</para></sect3></sect2></sect1><sect1>
<title>Preface</title>
<para>Some things first:</para><sect2>
<title>How many versions of a Linux & IPv6 related HOWTO are floating around?</title>
<para>Including this, there are three (3) HOWTO documents available. Apologies, if that is too many ;-)</para><sect3>
<title>Linux IPv6 FAQ/HOWTO (outdated)</title>
<para>The first IPv6 related document was written by <emphasis>Eric Osborne</emphasis> and called <ulink url="http://www.linuxhq.com/IPv6/">Linux IPv6 FAQ/HOWTO</ulink> (please use it only for historical issues). Latest version was 3.2.1 released July, 14 1997.</para>
<para>Please help: if someone knows the date of birth of this HOWTO, please send me an e-mail (information will be needed in “history”).</para></sect3><sect3>
<title>IPv6 & Linux - HowTo (maintained)</title>
<para>There exists a second version called <ulink url="http://www.bieringer.de/linux/IPv6/">IPv6 & Linux - HowTo</ulink> written by me (<emphasis>Peter Bieringer</emphasis>) in pure HTML. It was born April 1997 and the first English version was published in June 1997. I will continue to maintain it, but it will slowly fade (but not full) in favour of the Linux IPv6 HOWTO you are currently reading.</para></sect3><sect3>
<title>Linux IPv6 HOWTO (this document)</title>
<para>Because the <ulink url="http://www.bieringer.de/linux/IPv6/">IPv6 & Linux - HowTo</ulink> is written in pure HTML it's not really compatible with the <ulink url="http://www.tldp.org/">The Linux Documentation Project (TLDP)</ulink>. I (<emphasis>Peter Bieringer</emphasis>) got a request in late November 2001 to rewrite the <ulink url="http://www.bieringer.de/linux/IPv6/">IPv6 & Linux - HowTo</ulink> in SGML. However, because of the discontinuation of that HOWTO (<ulink url="http://www.bieringer.de/linux/IPv6/IPv6-HOWTO/IPv6-HOWTO-0.html#history">Future of IPv6 & Linux - HowTo</ulink>), and as IPv6 is becoming more and more standard, I decided to write a new document covering basic and advanced issues which will remain important over the next few years. More dynamic and some advanced content will be still found further on in the second HOWTO (<ulink url="http://www.bieringer.de/linux/IPv6/">IPv6 & Linux - HowTo</ulink>).</para></sect3></sect2></sect1><sect1>
<varlistentry><term>Base 10</term><listitem><para>Well known decimal number system, represent any value with digit 0-9.</para></listitem></varlistentry><varlistentry><term>Base 16</term><listitem><para>Usually used in lower and higher programming languages, known also as hexadecimal number system, represent any value with digit 0-9 and char A-F (case insensitive).</para></listitem></varlistentry><varlistentry><term>Base 85</term><listitem><para>Representation of a value with 85 different digits/chars, this can lead to shorter strings but never seen in the wild.</para></listitem></varlistentry><varlistentry><term>Bit</term><listitem><para>Smallest storage unit, on/true (1) or off/false (0)</para></listitem></varlistentry><varlistentry><term>Byte</term><listitem><para>Mostly a collection of 8 (but not really a must - see older computer systems) bits</para></listitem></varlistentry><varlistentry><term>Device</term><listitem><para>Here, hardware of network connection, see also NIC</para></listitem></varlistentry><varlistentry><term>Dual homed host</term><listitem><para>A dual homed host is a node with two network (physical or virtual) interfaces on two different links, but does not forward any packets between the interfaces.</para></listitem></varlistentry><varlistentry><term>Host</term><listitem><para>Generally a single homed host on a link. Normally it has only one active network interface, e.g. Ethernet or (not and) PPP.</para></listitem></varlistentry><varlistentry><term>Interface</term><listitem><para>Mostly same as “device”, see also NIC</para></listitem></varlistentry><varlistentry><term>IP Header</term><listitem><para>Header of an IP packet (each network packet has a header, kind of is depending on network layer)</para></listitem></varlistentry><varlistentry><term>Link</term><listitem><para>A link is a layer 2 network packet transport medium, examples are Ethernet, Token Ring, PPP, SLIP, ATM, ISDN, Frame Relay,...</para></listitem></varlistentry><varlistentry><term>Node</term><listitem><para>A node is a host or a router.</para></listitem></varlistentry><varlistentry><term>Octet</term><listitem><para>A collection of 8 real bits, today also similar to “byte”.</para></listitem></varlistentry><varlistentry><term>Port</term><listitem><para>Information for the TCP/UDP dispatcher (layer 4) to transport information to upper layers</para></listitem></varlistentry><varlistentry><term>Protocol</term><listitem><para>Each network layer contains mostly a protocol field to make life easier on dispatching transported information to upper layer, seen in layer 2 (MAC) and 3 (IP)</para></listitem></varlistentry><varlistentry><term>Router</term><listitem><para>A router is a node with two or more network (physical or virtual) interfaces, capable of forwarding packets between the interfaces.</para></listitem></varlistentry><varlistentry><term>Socket</term><listitem><para>An IP socket is defined by source and destination IP addresses and Ports and (binding) </para></listitem></varlistentry><varlistentry><term>Stack</term><listitem><para>Network related a collection of layers</para></listitem></varlistentry><varlistentry><term>Subnetmask</term><listitem><para>IP networks uses bit masks to separate local networks from remote ones</para></listitem></varlistentry><varlistentry><term>Tunnel</term><listitem><para>A tunnel is typically a point-to-point connection over which packets are exchanged which carry the data of another protocol, e.g. an IPv6-in-IPv4 tunnel.</para></listitem></varlistentry></variablelist><sect3 id='Glossar' >
<varlistentry><term>ACL</term><listitem><para>Access Control List</para></listitem></varlistentry><varlistentry><term>API</term><listitem><para>Application Programming Interface</para></listitem></varlistentry><varlistentry><term>ASIC</term><listitem><para>Application Specified Integrated Circuit</para></listitem></varlistentry><varlistentry><term>BSD</term><listitem><para>Berkeley Software Distribution</para></listitem></varlistentry><varlistentry><term>CAN-Bus</term><listitem><para>Controller Area Network Bus (physical bus system)</para></listitem></varlistentry><varlistentry><term>ISP</term><listitem><para>Internet Service Provider</para></listitem></varlistentry><varlistentry><term>KAME</term><listitem><para>Project - a joint effort of six companies in Japan to provide a free IPv6 and IPsec (for both IPv4 and IPv6) stack for BSD variants to the world <ulink url="http://www.kame.net/">www.kame.net</ulink></para></listitem></varlistentry><varlistentry><term>LIR</term><listitem><para>Local Internet Registry</para></listitem></varlistentry><varlistentry><term>NIC</term><listitem><para>Network Interface Card</para></listitem></varlistentry><varlistentry><term>RFC</term><listitem><para>Request For Comments - set of technical and organizational notes about the Internet</para></listitem></varlistentry><varlistentry><term>USAGI</term><listitem><para>UniverSAl playGround for Ipv6 Project - works to deliver the production quality IPv6 protocol stack for the Linux system.</para></listitem></varlistentry></variablelist></sect3></sect2><sect2>
<title>Document related</title>
<sect3>
<title>Long code line wrapping signal char</title>
<para>The special character “<3B>” is used for signaling that this code line is wrapped for better viewing in PDF and PS files.</para></sect3><sect3>
]]></screen><para>For real use on your system command line or in scripts this has to be replaced with relevant content (removing the < and > of course), the result would be e.g.</para><screen>
<para>You should be familiar with the major Unix tools e.g. <emphasis>grep</emphasis>, <emphasis>awk</emphasis>, <emphasis>find</emphasis>, ... , and know about their most commonly used command-line options.</para></sect3><sect3>
<para>You should know about layers, protocols, addresses, cables, plugs, etc. If you are new to this field, here is one good starting point for you: <ulink url="http://www.rigacci.org/docs/biblio/online/intro_to_networking/book1.htm">http://www.rigacci.org/docs/biblio/online/intro_to_networking/book1.htm</ulink></para></sect3><sect3>
<para>You should definitely have some experience in IPv4 configuration, otherwise it will be hard for you to understand what is really going on.</para></sect3><sect3>
<title>Experience with the Domain Name System (DNS)</title>
<para>Also you should understand what the Domain Name System (DNS) is, what it provides and how to use it.</para></sect3><sect3>
<title>Experience with network debugging strategies</title>
<para>You should at least understand how to use <emphasis>tcpdump</emphasis> and what<emphasis> </emphasis>it can show you. Otherwise, network debugging will very difficult for you.</para></sect3></sect2><sect2>
<title>Linux operating system compatible hardware</title>
<para>Surely you wish to experiment with real hardware, and not only read this HOWTO to fall asleep here and there. ;-7)</para></sect2></sect1></chapter><chapter id='chapter-basics' >
<para>IPv6 is a new layer 3 protocol which will supersede IPv4 (also known as IP). IPv4 was designed long time ago (<ulink url="http://www.faqs.org/rfcs/rfc760.html">RFC 760 / Internet Protocol</ulink> from January 1980) and since its inception, there have been many requests for more addresses and enhanced capabilities. Latest RFC is <ulink url="http://www.faqs.org/rfcs/rfc2460.html">RFC 2460 / Internet Protocol Version 6 Specification</ulink>. Major changes in IPv6 are the redesign of the header, including the increase of address size from 32 bits to 128 bits. Because layer 3 is responsible for end-to-end packet transport using packet routing based on addresses, it must include the new IPv6 addresses (source and destination), like IPv4.</para>
<para>For more information about the IPv6 history take a look at older IPv6 related RFCs listed e.g. at <ulink url="http://www.switch.ch/lan/ipv6/references.html">SWITCH IPv6 Pilot / References</ulink>.</para></sect1><sect1 id='basic-history-IPv6-Linux' >
<title><!-- anchor id="basic-history-IPv6-Linux" -->History of IPv6 in Linux</title>
<para>The years 1992, 1993 and 1994 of the IPv6 History (in general) are covered by following document: <ulink url="http://www.laynetworks.com/IPv6.htm#CH3">IPv6 or IPng (IP next generation)</ulink>.</para>
<para>To-do: better time-line, more content...</para><sect2>
<title>Beginning</title>
<para>The first IPv6 related network code was added to the Linux kernel 2.1.8 in November 1996 by Pedro Roque. It was based on the BSD API:</para><screen>
<para>Because of lack of manpower, the IPv6 implementation in the kernel was unable to follow the discussed drafts or newly released RFCs. In October 2000, a project was started in Japan, called <ulink url="http://www.linux-ipv6.org/">USAGI</ulink>, whose aim was to implement all missing, or outdated IPv6 support in Linux. It tracks the current IPv6 implementation in FreeBSD made by the <ulink url="http://www.kame.net/">KAME project</ulink>. From time to time they create snapshots against current vanilla Linux kernel sources.</para>
<para>Until kernel development series 2.5.x was started, the <ulink url="http://www.linux-ipv6.org/">USAGI</ulink> patch was so big, that Linux networking maintainers were unable to include it completly in the production source of the Linux kernel 2.4.x series.</para>
<para>During kernel development series 2.5.x, <ulink url="http://www.linux-ipv6.org/">USAGI</ulink> tried to insert all of their current extensions into this.</para></sect2><sect2>
<para>Many of the long-term developed IPv6 related patches by <ulink url="http://www.linux-ipv6.org/">USAGI</ulink> and others are integrated into vanilla kernel series 2.6.x.</para></sect2><sect2>
<para><ulink url="http://www.linux-ipv6.org/">USAGI</ulink> and others are still working on implementation of newer features like mobililty and others. From time to time, new extension patches are released and also integration into vanilla kernel series is made.</para></sect2></sect1><sect1>
<para>As previously mentioned, IPv6 addresses are 128 bits long. This number of bits generates very high decimal numbers with up to 39 digits: </para><screen>
]]></screen><para>Such numbers are not really addresses that can be memorized. Also the IPv6 address schema is bitwise orientated (just like IPv4, but that's not often recognized). Therefore a better notation of such big numbers is hexadecimal. In hexadecimal, 4 bits (also known as “nibble”) are represented by a digit or character from 0-9 and a-f (10-15). This format reduces the length of the IPv6 address to 32 characters.</para><screen>
]]></screen><para>This representation is still not very convenient (possible mix-up or loss of single hexadecimal digits), so the designers of IPv6 chose a hexadecimal format with a colon as separator after each block of 16 bits. In addition, the leading "0x" (a signifier for hexadecimal values used in programming languages) is removed:</para><screen>
]]></screen><para>One sequence of 16 bit blocks containing only zeroes can be replaced with “::“. But not more than one at a time, otherwise it is no longer a unique representation. </para><screen>
]]></screen><para>There is also a so-called <emphasis>compact</emphasis> (base85 coded) representation defined <ulink url="http://www.faqs.org/rfcs/rfc1924.html">RFC 1924 / A Compact Representation of IPv6 Addresses</ulink> (published on 1. April 1996), never seen in the wild, probably an April fool's joke, but here is an example: </para><screen>
<para>Info: <emphasis>ipv6calc</emphasis> is an IPv6 address format calculator and converter program and can be found here: <ulink url="http://www.deepspace6.net/projects/ipv6calc.html">ipv6calc homepage</ulink> (<ulink url="http://mirrors.bieringer.de/www.deepspace6.net/projects/ipv6calc.html">Mirror</ulink>)</para>
</blockquote></sect1><sect1>
<title>FAQ (Basics)</title>
<sect2>
<title>Why is the name IPv6 and not IPv5 as successor for IPv4?</title>
<para>On any IP header, the first 4 bits are reserved for protocol version. So theoretically a protocol number between 0 and 15 is possible:</para><itemizedlist>
<listitem><para>4: is already used for IPv4</para></listitem><listitem><para>5: is reserved for the Stream Protocol (STP, <ulink url="http://www.faqs.org/rfcs/rfc1819.html">RFC 1819 / Internet Stream Protocol Version 2</ulink>) (which never really made it to the public)</para></listitem></itemizedlist><para>The next free number was 6. Hence IPv6 was born!</para></sect2><sect2>
<title>IPv6 addresses: why such a high number of bits?</title>
<para>During the design of IPv4, people thought that 32 bits were enough for the world. Looking back into the past, 32 bits were enough until now and will perhaps be enough for another few years. However, 32 bits are not enough to provide each network device with a global address in the future. Think about mobile phones, cars (including electronic devices on its CAN-bus), toasters, refrigerators, light switches, and so on...</para>
<para>The usable size is smaller than it may appear however. This is because in the currently defined address schema, 64 bits are used for interface identifiers. The other 64 bits are used for routing. Assuming the current strict levels of aggregation (/48, /32, ...), it is still possible to “run out” of space, but hopefully not in the near future.</para>
<para>See also for more information <ulink url="http://www.faqs.org/rfcs/rfc1715.html">RFC 1715 / The H Ratio for Address Assignment Efficiency</ulink> and <ulink url="http://www.faqs.org/rfcs/rfc3194.html">RFC 3194 / The Host-Density Ratio for Address Assignment Efficiency</ulink>.</para></sect2><sect2>
<title>IPv6 addresses: why so small a number of bits on a new design?</title>
<para>While, there are (possibly) some people (only know about Jim Fleming...) on the Internet who are thinking about IPv8 and IPv16, their design is far away from acceptance and implementation. In the meantime 128 bits was the best choice regarding header overhead and data transport. Consider the minimum Maximum Transfer Unit (MTU) in IPv4 (576 octets) and in IPv6 (1280 octets), the header length in IPv4 is 20 octets (minimum, can increase to 60 octets with IPv4 options) and in IPv6 is 48 octets (fixed). This is 3.4 % of MTU in IPv4 and 3.8 % of MTU in IPv6. This means the header overhead is almost equal. More bits for addresses would require bigger headers and therefore more overhead. Also, consider the maximum MTU on normal links (like Ethernet today): it's 1500 octets (in special cases: 9k octets using Jumbo frames). Ultimately, it wouldn't be a proper design if 10 % or 20 % of transported data in a Layer-3 packet were used for addresses and not for payload.</para></sect2></sect1></chapter><chapter id='chapter-addresstypes' >
<para>Like IPv4, IPv6 addresses can be split into network and host parts using subnet masks.</para>
<para>IPv4 has shown that sometimes it would be nice, if more than one IP address can be assigned to an interface, each for a different purpose (aliases, multi-cast). To remain extensible in the future, IPv6 is going further and allows more than one IPv6 address to be assigned to an interface. There is currently no limit defined by an RFC, only in the implementation of the IPv6 stack (to prevent DoS attacks).</para>
<para>Using this large number of bits for addresses, IPv6 defines address types based on some leading bits, which are hopefully never going to be broken in the future (unlike IPv4 today and the history of class A, B, and C).</para>
<para>Also the number of bits are separated into a network part (upper 64 bits) and a host part (lower 64 bits), to facilitate auto-configuration.</para><sect1>
<para>This is a special address for the loopback interface, similiar to IPv4 with its “127.0.0.1”. With IPv6, the localhost address is:</para><screen>
]]></screen><para>These addresses are mostly used/seen in socket binding (to any IPv6 address) or routing tables.</para>
<para>Note: the unspecified address cannot be used as destination address.</para></sect2><sect2>
<title>IPv6 address with embedded IPv4 address</title>
<para>There are two addresses which contain an IPv4 address.</para><sect3>
<title>IPv4-mapped IPv6 address</title>
<para>IPv4-only IPv6-compatible addresses are sometimes used/shown for sockets created by an IPv6-enabled daemon, but only binding to an IPv4 address.</para>
<para>These addresses are defined with a special prefix of length 96 (a.b.c.d is the IPv4 address):</para><screen>
<para>Used for automatic tunneling (<ulink url="http://www.faqs.org/rfcs/rfc2893.html">RFC 2893 / Transition Mechanisms for IPv6 Hosts and Routers</ulink>), which is being replaced by <link linkend="tunneling-6to4.">6to4 tunneling</link>.</para><screen>
<para>Designers defined some address types and left a lot of scope for future definitions as currently unknown requirements arise. <ulink url="http://www.faqs.org/rfcs/rfc4291.html">RFC 4291 / IP Version 6 Addressing Architecture</ulink> defines the current addressing scheme.</para>
<para>Now lets take a look at the different types of prefixes (and therefore address types):</para><sect2>
<title>Link local address type</title>
<para>These are special addresses which will only be valid on a link of an interface. Using this address as destination the packet would never pass through a router. It's used for link communications such as:</para><itemizedlist>
<listitem><para>anyone else here on this link?</para></listitem><listitem><para>anyone here with a special address (e.g. looking for a router)?</para></listitem></itemizedlist><para>They begin with ( where <emphasis>“x”</emphasis> is any hex character, normally <emphasis>“0</emphasis>”)</para><screen>
<![CDATA[]]>fe8<emphasis>x: <- currently the only one in use.</emphasis>
<![CDATA[]]>fe9<emphasis>x:</emphasis>
<![CDATA[]]>fea<emphasis>x:</emphasis>
<![CDATA[]]>feb<emphasis>x:</emphasis>
<![CDATA[]]></screen><para>An address with this prefix is found on each IPv6-enabled interface after stateless auto-configuration (which is normally always the case).</para></sect2><sect2>
<title>Site local address type</title>
<para>These are addresses similar to the <ulink url="http://www.faqs.org/rfcs/rfc1918.html">RFC 1918 / Address Allocation for Private Internets</ulink> in IPv4 today, with the added advantage that everyone who use this address type has the capability to use the given 16 bits for a maximum number of 65536 subnets. Comparable with the 10.0.0.0/8 in IPv4 today.</para>
<para>Another advantage: because it's possible to assign more than one address to an interface with IPv6, you can also assign such a site local address in addition to a global one.</para>
<para>This address type is now deprecated <ulink url="http://www.faqs.org/rfcs/rfc3879.html">RFC 3879 / Deprecating Site Local Addresses</ulink>, but for a test in a lab, such addresses are still a good choice in my humble opinion.</para></sect2><sect2>
<title>Unique Local IPv6 Unicast Addresses</title>
<para>Because the original defined site local addresses are not unique, this can lead to major problems, if two former independend networks would be connected later (overlapping of subnets). This and other issues lead to a new address type named <ulink url="http://www.faqs.org/rfcs/rfc4193.html">RFC 4193 / Unique Local IPv6 Unicast Addresses</ulink>. </para>
<![CDATA[]]></screen><para>A part of the prefix (40 bits) are generated using a pseudo-random algorithm and it's improbable, that two generated ones are equal.</para>
<para>Example for a prefix (generated using a web-based tool: <ulink url="http://www.goebel-consult.de/ipv6/createLULA">Goebel Consult / createLULA</ulink>):</para><screen>
<title>Global address type "(Aggregatable) global unicast"</title>
<para>Today, there is one global address type defined (the first design, called "provider based," was thrown away some years ago <ulink url="http://www.faqs.org/rfcs/rfc1884.html">RFC 1884 / IP Version 6 Addressing Architecture [obsolete]</ulink>, you will find some remains in older Linux kernel sources).</para>
<para>It begins with (<emphasis>x</emphasis> are hex characters)</para><screen>
]]></screen><para>and is mostly shown in older examples. The reason for this is, if real addresses are are shown, it's possible for someone to do a copy & paste to their configuration files, thus inadvertently causing duplicates on a globally unique address. This would cause serious problems for the original host (e.g. getting answer packets for request that were never sent).
Because IPv6 is now in production, this prefix is no longer be delegated and is removed from routing after 6.6.2006 (see <ulink url="http://www.faqs.org/rfcs/rfc3701.html">RFC 3701 / 6bone Phaseout</ulink> for more).</para></sect3><sect3>
<para>These addresses, designed for a special tunneling mechanism [<ulink url="http://www.faqs.org/rfcs/rfc3056.html">RFC 3056 / Connection of IPv6 Domains via IPv4 Clouds</ulink> and <ulink url="http://www.faqs.org/rfcs/rfc2893.html">RFC 2893 / Transition Mechanisms for IPv6 Hosts and Routers</ulink>], encode a given IPv4 address and a possible subnet and begin with </para><screen>
]]></screen><para>See also <link linkend="tunneling-6to4.">tunneling using 6to4</link> and <link linkend="information-joinipv6-6to4-tunneling">information about 6to4 relay routers</link>.</para></sect3><sect3>
<title>Assigned by provider for hierarchical routing</title>
]]></screen><para>Prefixes to major (backbone owning) ISPs (also known as LIRs) are delegated by <link linkend="information-majorregionregistries">local registries</link> and currently have a prefix with length 32 assigned.</para>
<para>Currently, two address ranges are reserved for examples and documentation <ulink url="http://www.faqs.org/rfcs/rfc3849.html">RFC 3849 / IPv6 Address Prefix Reserved for Documentation</ulink>:</para><screen>
]]></screen><para>These address ranges should be filtered based on source addresses and should NOT be routed on border routers to the internet, if possible.</para></sect3></sect2><sect2>
<title>Multicast addresses</title>
<para>Multicast addresses are used for related services. </para>
<para>They alway start with (<emphasis>xx</emphasis> is the scope value)</para><screen>
<![CDATA[]]>ff<emphasis>x</emphasis>y:
<![CDATA[]]></screen><para>They are split into scopes and types:</para><sect3>
<title>Multicast scopes</title>
<para>Multicast scope is a parameter to specify the maximum distance a multicast packet can travel from the sending entity.</para>
<para>Currently, the following regions (scopes) are defined:</para><itemizedlist>
<listitem><para>ffx1: node-local, packets never leave the node.</para></listitem><listitem><para>ffx2: link-local, packets are never forwarded by routers, so they never leave the specified link.</para></listitem><listitem><para>ffx5: site-local, packets never leave the site.</para></listitem><listitem><para>ffx8: organization-local, packets never leave the organization (not so easy to implement, must be covered by routing protocol).</para></listitem><listitem><para>ffxe: global scope.</para></listitem><listitem><para>others are reserved</para></listitem></itemizedlist></sect3><sect3>
<para>There are many types already defined/reserved (see <ulink url="http://www.faqs.org/rfcs/rfc4291.html">RFC 4291 / IP Version 6 Addressing Architecture</ulink> for details). Some examples are:</para><itemizedlist>
<listitem><para>All Nodes Address: ID = 1h, addresses all hosts on the local node (ff01:0:0:0:0:0:0:1) or the connected link (ff02:0:0:0:0:0:0:1).</para></listitem><listitem><para>All Routers Address: ID = 2h, addresses all routers on the local node (ff01:0:0:0:0:0:0:2), on the connected link (ff02:0:0:0:0:0:0:2), or on the local site (ff05:0:0:0:0:0:0:2)</para></listitem></itemizedlist></sect3><sect3>
]]></screen><para>Used prefix shows that this is a link-local multicast address. The suffix is generated from the destination address. In this example, a packet should be sent to address “fe80::1234”, but the network stack doesn't know the current layer 2 MAC address. It replaces the upper 104 bits with “ff02:0:0:0:0:1:ff00::/104” and leaves the lower 24 bits untouched. This address is now used `on-link' to find the corresponding node which has to send a reply containing its layer 2 MAC address.</para></sect3></sect2><sect2>
<para>Anycast addresses are special addresses and are used to cover things like nearest DNS server, nearest DHCP server, or similar dynamic groups. Addresses are taken out of the unicast address space (aggregatable global or site-local at the moment). The anycast mechanism (client view) will be handled by dynamic routing protocols.</para>
<para>Note: Anycast addresses cannot be used as source addresses, they are only used as destination addresses.</para><sect3>
<title>Subnet-router anycast address</title>
<para>A simple example for an anycast address is the subnet-router anycast address. Assuming that a node has the following global assigned IPv6 address:</para><screen>
<para>For auto-configuration and mobility issues, it was decided to use the lower 64 bits as the host part of the address in most of the current address types. Therefore each single subnet can hold a large amount of addresses.</para>
<para>This host part can be inspected differently: </para><sect2>
<title>Automatically computed (also known as stateless)</title>
<para>With auto-configuration, the host part of the address is computed by converting the MAC address of an interface (if available), with the EUI-64 method, to a unique IPv6 address. If no MAC address is available for this device (happens e.g. on virtual devices), something else (like the IPv4 address or the MAC address of a physical interface) is used instead.</para>
<para>E.g. a NIC has following MAC address (48 bit):</para><screen>
<![CDATA[00:10:A4:E3:95:66
]]></screen><para>This would be expanded according to the<ulink url="http://standards.ieee.org/regauth/oui/tutorials/EUI64.html">IEEE-Tutorial EUI-64</ulink> design for EUI-48 identifiers to the 64 bit interface identifier:</para><screen>
<![CDATA[0210:a4ff:fee3:9566
]]></screen><para>With a given prefix, the result is the IPv6 address shown in example above:</para><screen>
<title>Privacy problem with automatically computed addresses and a solution</title>
<para>Because the "automatically computed" host part is globally unique (except when a vendor of a NIC uses the same MAC address on more than one NIC), client tracking is possible on the host when not using a proxy of any kind.</para>
<para>This is a known problem, and a solution was defined: privacy extension, defined in <ulink url="http://www.faqs.org/rfcs/rfc3041.html">RFC 3041 / Privacy Extensions for Stateless Address Autoconfiguration in IPv6</ulink> (there is also already a newer draft available: <ulink url="http://www.ietf.org/ids.by.wg/ipv6.html">draft-ietf-ipv6-privacy-addrs-v2-*</ulink>). Using a random and a static value a new suffix is generated from time to time. Note: this is only reasonable for outgoing client connections and isn't really useful for well-known servers.</para></sect3></sect2><sect2>
<para>For servers, it's probably easier to remember simpler addresses, this can also be accommodated. It is possible to assign an additional IPv6 address to an interface, e.g. </para><screen>
]]></screen><para>For manual suffixes like “::1” shown in the above example, it's required that the 7th most significant bit is set to 0 (the universal/local bit of the automatically generated identifier). Also some other (otherwise unchosen ) bit combinations are reserved for anycast addresses, too.</para></sect2></sect1><sect1>
<para>In the early design phase it was planned to use a fully hierarchical routing approach to reduce the size of the routing tables maximally. The reasons behind this approach were the number of current IPv4 routing entries in core routers (> 104 thousand in May 2001), reducing the need of memory in hardware routers (ASIC “Application Specified Integrated Circuit” driven) to hold the routing table and increase speed (fewer entries hopefully result in faster lookups).</para>
<para>Todays view is that routing will be mostly hierarchically designed for networks with only one service provider. With more than one ISP connections, this is not possible, and subject to an issue named multi-homing (infos on multi-homing: <ulink url="http://www.ietf.org/ids.by.wg/multi6.html">drafts-ietf-multi6-*</ulink>,<ulink url="http://arneill-py.sacramento.ca.us/ipv6mh/">IPv6 Multihoming Solutions</ulink>).</para><sect2>
<title>Prefix lengths (also known as "netmasks")</title>
<para>Similar to IPv4, the routable network path for routing to take place. Because standard netmask notation for 128 bits doesn't look nice, designers employed the IPv4 Classless Inter Domain Routing (CIDR, <ulink url="http://www.faqs.org/rfcs/rfc1519.html">RFC 1519 / Classless Inter-Domain Routing</ulink>) scheme, which specifies the number of bits of the IP address to be used for routing. It is also called the "slash" notation.</para>
<para>Under normal circumstances (no QoS), a lookup in a routing table results in the route with the most significant number of address bits being selected. In other words, the route with the biggest prefix length matches first.</para>
<para>Before you can start using IPv6 on a Linux host, you have to test, whether your system is IPv6-ready. You may have to do some work to enable it first.</para><sect1 id='systemcheck-kernel' >
<para>Modern Linux distributions already contain IPv6-ready kernels, the IPv6 capability is generally compiled as a module, but it's possible that this module is not loaded automatically on startup.</para>
<para>Note: you shouldn't anymore use kernel series 2.2.x, because it's not IPv6-up-to-date anymore. Also the IPv6 support in series 2.4.x is no longer improved according to definitions in latest RFCs. It's recommend to use series 2.6.x now.</para><sect2>
<title>Check for IPv6 support in the current running kernel</title>
<para>To check, whether your current running kernel supports IPv6, take a look into your /proc-file-system. Following entry must exists: </para><screen>
]]></screen><para>And the check shown above should now run successfully.</para>
<para>Note: unloading the module is currently not supported and can result, under some circumstances, in a kernel crash.</para><sect3>
<title>Automatically loading of module</title>
<para>Its possible to automatically load the IPv6 module on demand. You only have to add following line in the configuration file of the kernel module loader (normally /etc/modules.conf or /etc/conf.modules):</para><screen>
]]></screen><para>Additional note: in kernels series 2.6.x, the module loader mechanism was changed. The new configuration file has to be named /etc/modprobe.conf instead of /etc/modules.conf.</para></sect3></sect2><sect2>
<title>Compile kernel with IPv6 capabilities</title>
<para>If both above shown results were negative and your kernel has no IP6 support, than you have the following options:</para><itemizedlist>
<listitem><para>Update your distribution to a current one which supports IPv6 out-of-the-box (recommended for newbies)</para></listitem><listitem><para>Compile a new vanilla kernel (easy, if you know which options you needed)</para></listitem><listitem><para>Recompile kernel sources given by your Linux distribution (sometimes not so easy)</para></listitem><listitem><para>Compile a kernel with USAGI extensions</para></listitem></itemizedlist><para>If you decide to compile a kernel, you should have previous experience in kernel compiling and read the <ulink url="http://www.tldp.org/HOWTO/Kernel-HOWTO.html">Linux Kernel HOWTO</ulink>.</para>
<para>A comparison between vanilla and USAGI extended kernels is available on <ulink url="http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-kernel.html">IPv6+Linux-Status-Kernel</ulink>.</para><sect3>
<para>More detailed hints about compiling an IPv6-enabled kernel can be found e.g. on <ulink url="http://www.bieringer.de/linux/IPv6/IPv6-HOWTO/IPv6-HOWTO-2.html#kernel">IPv6-HOWTO-2#kernel</ulink>.</para>
<para>Note: you should use whenever possible kernel series 2.6.x or above, because the IPv6 support in series 2.4.x only will no longer get backported features from 2.6.x and IPv6 support in series 2.2.x is hopeless outdated.</para></sect3><sect3>
<title>Compiling a kernel with USAGI extensions</title>
<para>Same as for vanilla kernel, only recommend for advanced users, which are already familiar with IPv6 and kernel compilation. See also <ulink url="http://www.linux-ipv6.org/faq.html">USAGI project / FAQ</ulink> and <ulink url="http://www.deepspace6.net/docs/best_ipv6_support.html">Obtaining the best IPv6 support with Linux (Article)</ulink> (<ulink url="http://mirrors.bieringer.de/www.deepspace6.net/docs/best_ipv6_support.html">Mirror</ulink>).</para></sect3></sect2><sect2>
<title>IPv6-ready network devices</title>
<para>Not all existing network devices have already (or ever) the capability to transport IPv6 packets. A current status can be found at <ulink url="http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-kernel.html#transport">IPv6+Linux-status-kernel.html#transport</ulink>.</para>
<para>A major issue is that because of the network layer structure of kernel implementation an IPv6 packet isn't really recognized by it's IP header number (6 instead of 4). It's recognized by the protocol number of the Layer 2 transport protocol. Therefore any transport protocol which doesn't use such protocol number cannot dispatch IPv6 packets. Note: the packet is still transported over the link, but on receivers side, the dispatching won't work (you can see this e.g. using tcpdump).</para><sect3>
<listitem><para>Serial Line IP (SLIP, <ulink url="http://www.faqs.org/rfcs/rfc1055.html">RFC 1055 / SLIP</ulink>), should be better called now to SLIPv4, device named: slX</para></listitem><listitem><para>Parallel Line IP (PLIP), same like SLIP, device names: plipX</para></listitem><listitem><para>ISDN with encapsulation <emphasis>rawip</emphasis>, device names: isdnX</para></listitem></itemizedlist></sect3><sect3>
<listitem><para>ISDN with encapsulation <emphasis>syncppp</emphasis>, device names: ipppX (design issue of the ipppd, will be merged into more general PPP layer in kernel series 2.5.x)</para></listitem></itemizedlist></sect3></sect2></sect1><sect1>
<para>You wont get very far, if you are running an IPv6-ready kernel, but have no tools to configure IPv6. There are several packages in existence which can configure IPv6.</para><sect2>
<title>net-tools package</title>
<para>The net-tool package includes some tools like ifconfig and route, which helps you to configure IPv6 on an interface. Look at the output of ifconfig -? or route -?, if something is shown like IPv6 or inet6, then the tool is IPv6-ready.</para>
<para>Alexey N. Kuznetsov (current a maintainer of the Linux networking code) created a tool-set which configures networks through the netlink device. Using this tool-set you have more functionality than net-tools provides, but its not very well documented and isn't for the faint of heart. </para><screen>
<listitem><para>You can get it from your Linux distribution (if contained)</para></listitem><listitem><para>You're able to look for a proper RPM package at <ulink url="http://rpmfind.net/linux/rpm2html/search.php?query=iproute">RPMfind/iproute</ulink> (sometimes rebuilding of a SRPMS package is recommended)</para></listitem></itemizedlist></sect2></sect1><sect1>
<para>After you have prepared your system for IPv6, you now want to use IPv6 for network communications. First you should learn how to examine IPv6 packets with a sniffer program. This is strongly recommended because for debugging/troubleshooting issues this can aide in providing a diagnosis very quickly.</para><sect2 id='program-ping6.' >
<para>This program is normally included in package <emphasis>iputils</emphasis>. It is designed for simple transport tests sending ICMPv6 echo-request packets and wait for ICMPv6 echo-reply packets.</para>
64 bytes from ::1: icmp_seq=0 hops=64 time=292 usec
--- ::1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/mdev = 0.292/0.292/0.292/0.000 ms
]]></screen><para>Hint: ping6 needs raw access to socket and therefore root permissions. So if non-root users cannot use ping6 then there are two possible problems:</para><orderedlist>
<listitem><para>ping6 is not in users path (probably, because ping6 is generally stored in /usr/sbin -> add path (not really recommended)</para></listitem><listitem><para>ping6 doesn't execute properly, generally because of missing root permissions -> chmod u+s /usr/sbin/ping6</para></listitem></orderedlist><sect3>
<title>Specifying interface for IPv6 ping</title>
<para>Using link-local addresses for an IPv6 ping, the kernel does not know through which (physically or virtual) device it must send the packet - each device has a link-local address. A try will result in following error message:</para><screen>
]]></screen><para>Unlike in IPv4, where replies to a ping on the broadcast address can be disabled, in IPv6 currently this behavior cannot be disable except by local IPv6 firewalling.</para></sect3></sect2><sect2 id='program-traceroute6.' >
<para>This program is normally included in package <emphasis>iputils</emphasis>. It's a program similar to IPv4 traceroute. Below you will see an example:</para><screen>
]]></screen><para>Note: unlike some modern versions of IPv4 traceroute, which can use ICMPv4 echo-request packets as well as UDP packets (default), current IPv6-traceroute is only able to send UDP packets. As you perhaps already know, ICMP echo-request packets are more accepted by firewalls or ACLs on routers inbetween than UDP packets. </para></sect2><sect2 id='program-tracepath6.' >
<para>This program is normally included in package <emphasis>iputils</emphasis>. It's a program like traceroute6 and traces the path to a given destination discovering the MTU along this path. Below you will see an example:</para><screen>
<para>On Linux, tcpdump is the major tool for packet capturing. Below you find some examples. IPv6 support is normally built-in in current releases of version 3.6.</para>
<para>tcpdump uses expressions for filtering packets to minimize the noise:</para><itemizedlist>
<listitem><para>icmp6: filters native ICMPv6 traffic</para></listitem><listitem><para>ip6: filters native IPv6 traffic (including ICMPv6)</para></listitem><listitem><para>proto ipv6: filters tunneled IPv6-in-IPv4 traffic</para></listitem><listitem><para>not port ssh: to suppress displaying SSH packets for running tcpdump in a remote SSH session</para></listitem></itemizedlist><para>Also some command line options are very useful to catch and print more information in a packet, mostly interesting for digging into ICMPv6 packets:</para><itemizedlist>
<listitem><para>“-s 512”: increase the snap length during capturing of a packet to 512 bytes</para></listitem><listitem><para>“-vv”: really verbose output</para></listitem><listitem><para>“-n”: don't resolve addresses to names, useful if reverse DNS resolving isn't working proper</para></listitem></itemizedlist><sect3>
<para>Current distributions already contain the most needed IPv6 enabled client and servers. See first on <ulink url="http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-distributions.html">IPv6+Linux-Status-Distribution</ulink>. If still not included, you can check <ulink url="http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-apps.html">IPv6 & Linux - Current Status - Applications</ulink> whether the program is already ported to IPv6 and usable with Linux. For common used programs there are some hints available at <ulink url="http://www.bieringer.de/linux/IPv6/IPv6-HOWTO/IPv6-HOWTO-3.html">IPv6 & Linux - HowTo - Part 3</ulink> and <ulink url="http://www.bieringer.de/linux/IPv6/IPv6-HOWTO/IPv6-HOWTO-4.html">IPv6 & Linux - HowTo - Part 4</ulink>.</para></sect1><sect1>
<para>To run the following shown tests, it's required that your system is IPv6 enabled, and some examples show addresses which only can be reached if a connection to the 6bone is available.</para><sect2>
<title>Checking DNS for resolving IPv6 addresses</title>
<para>Because of security updates in the last years every Domain Name System (DNS) server should run newer software which already understands the (intermediate) IPv6 address-type AAAA (the newer one named A6 isn't still common at the moment because only supported using BIND9 and newer and also the non-existent support of root domain IP6.ARPA). A simple test whether the used system can resolve IPv6 addresses is</para><screen>
]]></screen><para>If the telnet client don't understand the IPv6 address and says something like “cannot resolve hostname”, then it's not IPv6-enabled.</para></sect2><sect2>
<para>Current versions of openssh are IPv6-ready. Depending on configuring before compiling it has two behavior.</para><itemizedlist>
<listitem><para>--without-ipv4-default: the client tries an IPv6 connect first automatically and fall back to IPv4 if not working</para></listitem><listitem><para>--with-ipv4-default: default connection is IPv4, IPv6 connection must be force like following example shows</para></listitem></itemizedlist><screen>
]]></screen><para>If your ssh client doesn't understand the option “-6” then it's not IPv6-enabled, like most ssh version 1 packages.</para></sect3><sect3>
<para>SSH.com's SSH client and server is also IPv6 aware now and is free for all Linux and FreeBSD machine regardless if used for personal or commercial use.</para></sect3></sect2><sect2>
<title>IPv6-ready web browsers</title>
<para>A current status of IPv6 enabled web browsers is available at <ulink url="http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-apps.html#HTTP">IPv6+Linux-status-apps.html#HTTP</ulink>.</para>
<para>Most of them have unresolved problems at the moment</para><orderedlist>
<listitem><para>If using an IPv4 only proxy in the settings, IPv6 requests will be sent to the proxy, but the proxy will fail to understand the request and the request fails. Solution: update proxy software (see later).</para></listitem><listitem><para>Automatic proxy settings (*.pac) cannot be extended to handle IPv6 requests differently (e.g. don't use proxy) because of their nature (written in Java-script and well hard coded in source like to be seen in Maxilla source code).</para></listitem></orderedlist><para>Also older versions don't understand an URL with IPv6 encoded addresses like <ulink url="http://[2001:a60:9002:1::190:1]/">http://[2001:a60:9002:1::190:1]/</ulink> (this given URL only works with an IPv6-enabled browser!).</para>
<para>A short test is to try shown URL with a given browser and using no proxy.</para><sect3>
<title>URLs for testing</title>
<para>A good starting point for browsing using IPv6 is <ulink url="http://www.kame.net/">http://www.kame.net/</ulink>. If the turtle on this page is animated, the connection is via IPv6, otherwise the turtle is static.</para></sect3></sect2></sect1><sect1>
<para>In this part of this HOWTO, more client specific issues are mentioned. Therefore hints for IPv6-ready servers like sshd, httpd, telnetd, etc. are shown below in <link linkend="chapter-hints-daemons">Hints for IPv6-enabled daemons</link>.</para></sect1><sect1 id='faq-ipv6-ready-system-check' >
<para>Kernel doesn't know, which physical or virtual link you want to use to send such ICMPv6 packets. Therefore it displays this error message.</para>
<para>Error message: “<emphasis>icmp socket: Operation not permitted</emphasis>”</para>
<para>These utilities create special ICMPv6 packets and send them out. This is done by using raw sockets in the kernel. But raw sockets can only be used by the “root” user. Therefore normal users get such error message.</para>
<para>Solution: If it's really needed that all users should be able to use these utilities, you can add the “suid” bit using ”chmod u+s /path/to/program”, see also <link linkend="program-ping6.">program ping6 usage</link>. If not all users should be able to, you can change the group of the program to e.g. “wheel”, add these power users to this group and remove the execution bit for other users using “chmod o-rwx /path/to/program”. Or configure “sudo” to enable your security policy. </para></sect3></sect2></sect1></chapter><chapter id='chapter-configuration-interface' >
<para>On a node, there exist different network devices. They can be collected in classes</para><itemizedlist>
<listitem><para>Physically bounded, like eth0, tr0</para></listitem><listitem><para>Virtually existing, like ppp0, tun0, tap0, sit0, isdn0, ippp0</para></listitem></itemizedlist><sect2>
<title>Physically bounded</title>
<para>Physically bounded interfaces like Ethernet or Token-Ring are normal ones and need no special treatment.</para></sect2><sect2>
<title>Virtually bounded</title>
<para>Virtually bounded interfaces always need special support</para><sect3>
<title>IPv6-in-IPv4 tunnel interfaces</title>
<para>These interfaces are normally named sit<emphasis>x</emphasis>. The name <emphasis>sit</emphasis> is a shortcut for Simple Internet Transition. This device has the capability to encapsulate IPv6 packets into IPv4 ones and tunnel them to a foreign endpoint.</para>
<para>sit0 has a special meaning and cannot be used for dedicated tunnels.</para></sect3><sect3>
<title>PPP interfaces</title>
<para>PPP interfaces get their IPv6 capability from an IPv6 enabled PPP daemon.</para></sect3><sect3>
<title>ISDN HDLC interfaces</title>
<para>IPv6 capability for HDLC with encapsulation ip is already built-in in the kernel</para></sect3><sect3>
<title>ISDN PPP interfaces </title>
<para>ISDN PPP interfaces (ippp) aren't IPv6 enabled by kernel. Also there are also no plans to do that because in kernel 2.5.+ they will be replaced by a more generic ppp interface layer.</para></sect3><sect3>
<title>SLIP + PLIP</title>
<para>Like mentioned earlier, this interfaces don't support IPv6 transport (sending is OK, but dispatching on receiving don't work).</para></sect3><sect3>
<para>Ether-tap devices are IPv6-enabled and also stateless configured. For use, the module “ethertap” has to be loaded before.</para></sect3><sect3>
<para>There are different ways to configure an IPv6 address on an interface. You can use use "ifconfig" or "ip".</para><sect1>
<title>Displaying existing IPv6 addresses</title>
<para>First you should check, whether and which IPv6 addresses are already configured (perhaps auto-magically during stateless auto-configuration).</para><sect2>
]]></screen><para>Example (output filtered with grep to display only IPv6 addresses). Here you see different IPv6 addresses with different scopes.</para><screen>
<title><!-- anchor id="chapter-configuration-route" -->Configuring normal IPv6 routes</title>
<para>If you want to leave your link and want to send packets in the world wide IPv6-Internet, you need routing. If there is already an IPv6 enabled router on your link, it's possible enough to add IPv6 routes.</para><sect1>
<title>Displaying existing IPv6 routes</title>
<para>First you should check, whether and which IPv6 addresses are already configured (perhaps auto-magically during auto-configuration).</para><sect2>
]]></screen><para>Example (output is filtered for interface eth0). Here you see different IPv6 routes for different addresses on a single interface.</para><screen>
]]></screen><para>Metric “1” is used here to be compatible with the metric used by route, because the default metric on using “ip” is “1024”.</para></sect2><sect2>
<para>Client can setup a default route like prefix “::/0”, they also learn such route on autoconfiguration e.g. using radvd on the link like following example shows:</para><screen>
<para>Older Linux kernel (at least <= 2.4.17) don't support default routes. You can set them up, but the route lookup fails when a packet should be forwarded (normal intention of a router). If you're still using such older kernel, “default routing” can be setup using the currently used global address prefix “2000::/3”.</para>
<para>Note: take care about default routing without address filtering on edge routers. Otherwise unwanted multicast or site-local traffic can leave the edge.</para></sect3></sect2></sect1></chapter><chapter id='chapter-Neighbor-Discovery' >
<para>Neighbor discovery was the IPv6 successor for the ARP (Address Resolution Protocol) in IPv4. You can retrieve information about the current neighbors, in addition you can set and delete entries. The kernel keeps tracking of successful neighbor detection (like ARP in IPv4). You can dig into the learnt table using “ip”.</para><sect1>
<title>Displaying neighbors using “ip”</title>
]]></screen><para>Looks like some options are only for IPv4...if you can contribute information about flags and advanced usage, pls. send.</para></sect2></sect1></chapter><chapter id='chapter-configuring-ipv6-in-ipv4-tunnels' >
<para>If you want to leave your link you have no IPv6 capable network around you, you need IPv6-in-IPv4 tunneling to reach the world wide IPv6-Internet.</para>
<para>There are some kind of tunnel mechanism and also some possibilities to setup tunnels.</para><sect1>
<title>Types of tunnels</title>
<para>There are more than one possibility to tunnel IPv6 packets over IPv4-only links.</para><sect2>
<para>A point-to-point tunnel is a dedicated tunnel to an endpoint, which knows about your IPv6 network (for backward routing) and the IPv4 address of your tunnel endpoint and defined in <ulink url="http://www.faqs.org/rfcs/rfc2893.html">RFC 2893 / Transition Mechanisms for IPv6 Hosts and Routers</ulink>. Requirements:</para><itemizedlist>
<listitem><para>IPv4 address of your local tunnel endpoint must be static, global unique and reachable from the foreign tunnel endpoint</para></listitem><listitem><para>A global IPv6 prefix assigned to you (see 6bone registry)</para></listitem><listitem><para>A foreign tunnel endpoint which is capable to route your IPv6 prefix to your local tunnel endpoint (mostly remote manual configuration required)</para></listitem></itemizedlist></sect2><sect2>
<para>Automatic tunneling occurs, when a node directly connects another node gotten the IPv4 address of the other node before.</para></sect2><sect2 id='tunneling-6to4.' >
<para>6to4 tunneling (<ulink url="http://www.faqs.org/rfcs/rfc3056.html">RFC 3056 / Connection of IPv6 Domains via IPv4 Clouds</ulink>) uses a simple mechanism to create automatic tunnels. Each node with a global unique IPv4 address is able to be a 6to4 tunnel endpoint (if no IPv4 firewall prohibits traffic). 6to4 tunneling is mostly not a one-to-one tunnel. This case of tunneling can be divided into upstream and downstream tunneling. Also, a special IPv6 address indicates that this node will use 6to4 tunneling for connecting the world-wide IPv6 network</para><sect3>
<title>Generation of 6to4 prefix</title>
<para>The 6to4 address is defined like following (schema is taken from <ulink url="http://www.faqs.org/rfcs/rfc3056.html">RFC 3056 / Connection of IPv6 Domains via IPv4 Clouds</ulink>):</para><screen>
]]></screen><para>FP and TLA together (16 bits) have the value 0x2002. V4ADDR is the node's global unique IPv4 address (in hexadecimal notation). SLA is the subnet identifier (65536 local subnets possible) and are usable to represent your local network structure.</para>
<para>For gateways, such prefix is generated by normally using SLA “0000” and suffix “::1” (not a must, can be an arbitrary one with local-scope) and assigned to the 6to4 tunnel interface. Note that Microsoft Windows uses V4ADDR also for suffix.</para></sect3><sect3>
<para>The node has to know to which foreign tunnel endpoint its in IPv4 packed IPv6 packets should be send to. In “early” days of 6to4 tunneling, dedicated upstream accepting routers were defined. See <ulink url="http://www.kfu.com/~nsayer/6to4/">NSayer's 6to4 information</ulink> for a list of routers.</para>
<para>Nowadays, 6to4 upstream routers can be found auto-magically using the anycast address 192.88.99.1. In the background routing protocols handle this, see <ulink url="http://www.faqs.org/rfcs/rfc3068.html">RFC 3068 / An Anycast Prefix for 6to4 Relay Routers</ulink> for details. </para></sect3><sect3>
<title>6to4 downstream tunneling</title>
<para>The downstream (6bone -> your 6to4 enabled node) is not really fix and can vary from foreign host which originated packets were send to. There exist two possibilities:</para><itemizedlist>
<listitem><para>Foreign host uses 6to4 and sends packet direct back to your node (see below)</para></listitem><listitem><para>Foreign host sends packets back to the world-wide IPv6 network and depending on the dynamic routing a relay router create a automatic tunnel back to your node.</para></listitem></itemizedlist></sect3><sect3>
<title>Possible 6to4 traffic</title>
<itemizedlist>
<listitem><para>from 6to4 to 6to4: is normally directly tunneled between the both 6to4 enabled hosts</para></listitem><listitem><para>from 6to4 to non-6to4: is sent via upstream tunneling</para></listitem><listitem><para>non-6to4 to 6to4: is sent via downstream tunneling</para></listitem></itemizedlist></sect3></sect2></sect1><sect1>
<para>A good additional information about tunnel setup using “ip” is <ulink url="http://www.deepspace6.net/docs/iproute2tunnel-en.html">Configuring tunnels with iproute2 (article)</ulink> (<ulink url="http://mirrors.bieringer.de/www.deepspace6.net/docs/iproute2tunnel-en.html">Mirror</ulink>).</para><sect2>
# /sbin/ip -6 route add <prefixtoroute3> dev sit3 metric 1
]]></screen></sect3><sect3>
<title>Using "ifconfig" and "route" (deprecated)</title>
<para>This not very recommended way to add a tunnel because it's a little bit strange. No problem if adding only one, but if you setup more than one, you cannot easy shutdown the first ones and leave the others running.</para>
<para>Usage (generic example for three tunnels):</para><screen>
# /sbin/route -A inet6 add <prefixtoroute3> dev sit3
]]></screen><para>Important: DON'T USE THIS, because this setup implicit enable "automatic tunneling" from anywhere in the Internet, this is a risk, and it should not be advocated.</para></sect3><sect3>
<title>Using "route" only</title>
<para>It's also possible to setup tunnels in Non Broadcast Multiple Access (NBMA) style, it's a easy way to add many tunnels at once. But none of the tunnel can be numbered (which is a not required feature).</para>
<para>Usage (generic example for three tunnels):</para><screen>
]]></screen><para>Important: DON'T USE THIS, because this setup implicit enable "automatic tunneling" from anywhere in the Internet, this is a risk, and it should not be advocated.</para></sect3></sect2><sect2>
<title>Removing point-to-point tunnels</title>
<para>Manually not so often needed, but used by scripts for clean shutdown or restart of IPv6 configuration.</para><sect3>
<title>Using "ip"</title>
<para>Usage for removing a tunnel device:</para><screen>
<title>Using "ifconfig" and "route" (deprecated because not very funny)</title>
<para>Not only the creation is strange, the shutdown also...you have to remove the tunnels in backorder, means the latest created must be removed first.</para>
<para>Usage (generic example for three tunnels):</para><screen>
<para>Sometimes it's needed to configure a point-to-point tunnel with IPv6 addresses like in IPv4 today. This is only possible with the first (ifconfig+route - deprecated) and third (ip+route) tunnel setup. In such cases, you can add the IPv6 address to the tunnel interface like shown on interface configuration. </para></sect2></sect1><sect1 id='configuring-ipv6to4-tunnels' >
<title><!-- anchor id="configuring-ipv6to4-tunnels" -->Setup of 6to4 tunnels</title>
<para>Pay attention that the support of 6to4 tunnels currently lacks on vanilla kernel series 2.2.x (see <link linkend="systemcheck-kernel">systemcheck/kernel</link> for more information). Also note that that the prefix length for a 6to4 address is 16 because of from network point of view, all other 6to4 enabled hosts are on the same layer 2.</para><sect2>
<title>Add a 6to4 tunnel</title>
<para>First, you have to calculate your 6to4 prefix using your local assigned global routable IPv4 address (if your host has no global routable IPv4 address, in special cases NAT on border gateways is possible):</para>
<para>Assuming your IPv4 address is </para><screen>
]]></screen><para>Local 6to4 gateways should (but it's not a must, you can choose an arbitrary suffix with local-scope, if you feel better) always assigned the suffix “::1”, therefore your local 6to4 address will be</para><screen>
]]></screen><para>It was reported that some versions of “ip” (e.g. SuSE Linux 9.0) don't support IPv4-compatible IPv6 addresses for gateways, in this case the related IPv6 address has to be used:</para><screen>
<para>This will be filled in the future. At the moment, such tunnels are more used in test environments but it looks like that support is missing currently for Linux (03/2004).</para>
<para>More information in the meantime: <ulink url="http://www.faqs.org/rfcs/rfc2473.html">RFC 2473 / Generic Packet Tunneling in IPv6 Specification</ulink></para></chapter><chapter id='chapter-kernel-settings' >
<para id='proc-filesystem' ><!-- anchor id="proc-filesystem" -->Note: the source of this section is mostly the file “ip-sysctl.txt” which is included in current kernel sources in directory “Documentation/networking”. Credits to Pekka Savola for maintaining the IPv6-related part in this file. Also some text is more or less copied & pasted into this document.</para><sect1>
<title>Using “cat” and “echo”</title>
<para>Using “cat” and “echo” is the simplest way to access the /proc filesystem, but some requirements are needed for that</para><itemizedlist>
<listitem><para>The /proc-filesystem had to be enabled in kernel, means on compiling following switch has to be set</para></listitem></itemizedlist><screen>
<listitem><para>You need read and sometimes also write access (normally root only) to the /proc-filesystem</para></listitem></itemizedlist><para>Normally, only entries in /proc/sys/* are writable, the others are readonly and for information retrieving only.</para><sect3>
<para>Using the “sysctl” program to access the kernel switches is a modern method today. You can use it also, if the /proc-filesystem isn't mounted. But you have only access to /proc/sys/*!</para>
<para>The program “sysctl” is included in package “procps” (on Red Hat Linux systems).</para><itemizedlist>
<listitem><para>The sysctl-interface had to be enabled in kernel, means on compiling following switch has to be set</para></listitem></itemizedlist><screen>
]]></screen><para>Note: Don't use spaces around the “=” on setting values. Also on multiple values per line, quote them like e.g.</para><screen>
<para>Hint: for digging fast into the settings, use the option “-a” (display all entries) in conjunction with “grep”.</para></sect3></sect2><sect2>
<listitem><para>BOOLEAN: simple a “0” (false) or a “1” (true)</para></listitem><listitem><para>INTEGER: an integer value, can be unsigned, too</para></listitem><listitem><para>more sophisticated lines with several values: sometimes a header line is displayed also, if not, have a look into the kernel source to retrieve information about the meaning of each value...</para></listitem></itemizedlist></sect2></sect1><sect1 id='proc-sys-net-ipv6.' >
<listitem><para>Type: BOOLEAN</para></listitem></itemizedlist><para>This enables global IPv6 forwarding between all interfaces.</para>
<para>In IPv6 you can't control forwarding per device, forwarding control has to be done using IPv6-netfilter (controlled with ip6tables) rulesets and specify input and output devices (see <link linkend="firewalling-netfilter6.">Firewalling/Netfilter6</link> for more). This is different to IPv4, where you are able to control forwarding per device (decision is made on interface where packet came in).</para>
<para>This also sets all interfaces' Host/Router setting 'forwarding' to the specified value. See below for details. This referred to as global forwarding.</para>
<para>If this value is 0, no IPv6 forwarding is enabled, packets never leave another interface, neither physical nor logical like e.g. tunnels.</para></sect3></sect2><sect2>
<title>conf/interface/*</title>
<para>Change special settings per interface.</para>
<para>The functional behaviour for certain settings is different depending on whether local forwarding is enabled or not.</para><sect3>
<title>accept_ra</title>
<itemizedlist>
<listitem><para>Type: BOOLEAN</para></listitem><listitem><para>Functional default: enabled if local forwarding is disabled. disabled if local forwarding is enabled.</para></listitem></itemizedlist><para>Accept Router Advertisements, and autoconfigure this interface with received data.</para></sect3><sect3>
<title>accept_redirects</title>
<itemizedlist>
<listitem><para>Type: BOOLEAN</para></listitem><listitem><para>Functional default: enabled if local forwarding is disabled. disabled if local forwarding is enabled.</para></listitem></itemizedlist><para>Accept Redirects sent by an IPv6 router.</para></sect3><sect3>
<listitem><para>Type: BOOLEAN</para></listitem><listitem><para>Functional default: enabled if accept_ra_pinfo is enabled. disabled if accept_ra_pinfo is disabled.</para></listitem></itemizedlist><para>Autoconfigure addresses using prefix information from router advertisements.</para></sect3><sect3>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 1</para></listitem></itemizedlist><para>The amount of Duplicate Address Detection probes to send.</para></sect3><sect3>
<title>forwarding</title>
<itemizedlist>
<listitem><para>Type: BOOLEAN</para></listitem><listitem><para>Default: FALSE if global forwarding is disabled (default), otherwise TRUE</para></listitem></itemizedlist><para>Configure interface-specific Host/Router behaviour.</para>
<para>Note: It is recommended to have the same setting on all interfaces; mixed router/host scenarios are rather uncommon.</para><itemizedlist>
<listitem><para>Value FALSE: By default, Host behaviour is assumed. This means:</para></listitem></itemizedlist><orderedlist>
<listitem><para>IsRouter flag is not set in Neighbour Advertisements.</para></listitem><listitem><para>Router Solicitations are being sent when necessary.</para></listitem><listitem><para>If accept_ra is TRUE (default), accept Router Advertisements (and do autoconfiguration).</para></listitem><listitem><para>If accept_redirects is TRUE (default), accept Redirects.</para></listitem></orderedlist><itemizedlist>
<listitem><para>Value TRUE: If local forwarding is enabled, Router behaviour is assumed. This means exactly the reverse from the above:</para></listitem></itemizedlist><orderedlist>
<listitem><para>IsRouter flag is set in Neighbour Advertisements.</para></listitem><listitem><para>Router Solicitations are not sent.</para></listitem><listitem><para>Router Advertisements are ignored.</para></listitem><listitem><para>Redirects are ignored.</para></listitem></orderedlist></sect3><sect3>
<title>hop_limit</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 64</para></listitem></itemizedlist><para>Default Hop Limit to set.</para></sect3><sect3>
<title>mtu</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 1280 (IPv6 required minimum)</para></listitem></itemizedlist><para>Default Maximum Transfer Unit</para></sect3><sect3>
<title>router_solicitation_delay</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 1</para></listitem></itemizedlist><para>Number of seconds to wait after interface is brought up before sending Router Solicitations.</para></sect3><sect3>
<title>router_solicitation_interval</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 4</para></listitem></itemizedlist><para>Number of seconds to wait between Router Solicitations. </para></sect3><sect3>
<title>router_solicitations</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 3</para></listitem></itemizedlist><para>Number of Router Solicitations to send until assuming no routers are present.</para></sect3></sect2><sect2>
<title>neigh/default/*</title>
<para>Change default settings for neighbor detection and some special global interval and threshold values:</para><sect3>
<title>gc_thresh1</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 128</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>gc_thresh2</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 512</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>gc_thresh3</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 1024</para></listitem></itemizedlist><para>Tuning parameter for neighbour table size.</para>
<para>Increase this value if you have a lot of interfaces and problem with routes start to act mysteriously and fail. Or if a running <ulink url="http://www.zebra.org/">Zebra (routing daemon)</ulink> reports:</para><screen>
<![CDATA[ZEBRA: netlink-listen error: No buffer space available, type=RTM_NEWROUTE(24), seq=426, pid=0
]]></screen></sect3><sect3>
<title>gc_interval</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 30</para></listitem></itemizedlist><para>More to be filled.</para></sect3></sect2><sect2>
<title>neigh/interface/*</title>
<para>Change special settings per interface for neighbor detection.</para><sect3>
<title>anycast_delay</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 100</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>gc_stale_time</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 60</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>proxy_qlen</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 64</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>unres_qlen</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 3</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>app_solicit</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 0</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>locktime</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 0</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>retrans_time</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 100</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>base_reachable_time</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 30</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>mcast_solicit</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 3</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>ucast_solicit</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 3</para></listitem></itemizedlist><para>More to be filled</para></sect3><sect3>
<title>delay_first_probe_time</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 5</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>proxy_delay</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 80</para></listitem></itemizedlist><para>More to be filled.</para></sect3></sect2><sect2>
<title>route/*</title>
<para>Change global settings for routing.</para><sect3>
<title>flush</title>
<para>Removed in newer kernel releases - more to be filled.</para></sect3><sect3>
<title>gc_interval</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 30</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>gc_thresh</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 1024</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>mtu_expires</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 600</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>gc_elasticity</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 0</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>gc_min_interval</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 5</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>gc_timeout</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 60</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<title>min_adv_mss</title>
<itemizedlist>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 12</para></listitem></itemizedlist><para>More to be filled.</para></sect3><sect3>
<listitem><para>Type: INTEGER</para></listitem><listitem><para>Default: 4096</para></listitem></itemizedlist><para>More to be filled.</para></sect3></sect2></sect1><sect1 id='proc-sys-net-ipv4.' >
<title><!-- anchor id="proc-sys-net-ipv4." -->IPv6-related entries in /proc/sys/net/ipv4/</title>
<para>At the moment (and this will be until IPv4 is completly converted to an independend kernel module) some switches are also used here for IPv6.</para><sect2>
<title>ip_*</title>
<sect3>
<title>ip_local_port_range</title>
<para>This control setting is used by IPv6 also.</para></sect3></sect2><sect2>
<title>tcp_*</title>
<para>This control settings are used by IPv6 also.</para></sect2><sect2>
<title>icmp_*</title>
<para>This control settings are not used by IPv6. To enable ICMPv6 rate limiting (which is very recommended because of the capability of ICMPv6 storms) netfilter-v6 rules must be used.</para></sect2><sect2>
<para>In /proc/net there are several read-only entries available. You cannot retrieve information using “sysctl” here, so use e.g. “cat”.</para><sect2>
<listitem><para>Type: One line per addresss containing multiple values</para></listitem></itemizedlist><para>Here all configured IPv6 addresses are shown in a special format. The example displays for loopback interface only. The meaning is shown below (see “net/ipv6/addrconf.c” for more).</para><screen>
<listitem><para>IPv6 address displayed in 32 hexadecimal chars without colons as separator</para></listitem><listitem><para>Netlink device number (interface index) in hexadecimal (see “ip addr” , too)</para></listitem><listitem><para>Prefix length in hexadecimal</para></listitem><listitem><para>Scope value (see kernel source “ include/net/ipv6.h” and “net/ipv6/addrconf.c” for more)</para></listitem><listitem><para>Interface flags (see “include/linux/rtnetlink.h” and “net/ipv6/addrconf.c” for more)</para></listitem><listitem><para>Device name</para></listitem></orderedlist></sect2><sect2>
<listitem><para>Type: One line per route containing multiple values</para></listitem></itemizedlist><para>Here all configured IPv6 routes are shown in a special format. The example displays for loopback interface only. The meaning is shown below (see “net/ipv6/route.c” for more).</para><screen>
<listitem><para>IPv6 destination network displayed in 32 hexadecimal chars without colons as separator</para></listitem><listitem><para>IPv6 destination prefix length in hexadecimal</para></listitem><listitem><para>IPv6 source network displayed in 32 hexadecimal chars without colons as separator</para></listitem><listitem><para>IPv6 source prefix length in hexadecimal</para></listitem><listitem><para>IPv6 next hop displayed in 32 hexadecimal chars without colons as separator</para></listitem><listitem><para>Metric in hexadecimal</para></listitem><listitem><para>Reference counter</para></listitem><listitem><para>Use counter</para></listitem><listitem><para>Flags</para></listitem><listitem><para>Device name</para></listitem></orderedlist></sect2><sect2>
<title>sockstat6</title>
<itemizedlist>
<listitem><para>Type: One line per protocol with description and value</para></listitem></itemizedlist><para>Statistics about used IPv6 sockets. Example:</para><screen>
<![CDATA[# cat /proc/net/sockstat6
TCP6: inuse 7
UDP6: inuse 2
RAW6: inuse 1
FRAG6: inuse 0 memory 0
]]></screen></sect2><sect2>
<title>tcp6</title>
<para>To be filled.</para></sect2><sect2>
<title>udp6</title>
<para>To be filled.</para></sect2><sect2>
<title>igmp6</title>
<para>To be filled.</para></sect2><sect2>
<title>raw6</title>
<para>To be filled.</para></sect2><sect2>
<title>ip6_flowlabel</title>
<para>To be filled.</para></sect2><sect2>
<title>rt6_stats</title>
<para>To be filled.</para></sect2><sect2>
<title>snmp6</title>
<itemizedlist>
<listitem><para>Type: One line per SNMP description and value</para></listitem></itemizedlist><para>SNMP statistics, can be retrieved via SNMP server and related MIB table by network management software.</para></sect2><sect2>
<title>Using “netstat” for server socket binding check</title>
<para>It's always interesting which server sockets are currently active on a node. Using “netstat” is a short way to get such information: </para>
]]></screen><para>Router with link-local address “fe80::212:34ff:fe12:3450” send an advertisement to the all-node-on-link multicast address “ff02::1” containing two prefixes “2002:0102:0304:1::/64” (lifetime 30 s) and “2001:0db8:0:1::/64” (lifetime 2592000 s) including its own layer 2 MAC address “0:12:34:12:34:50”.</para></sect3><sect3>
]]></screen><para>Node with link-local address “fe80::212:34ff:fe12:3456” and layer 2 MAC address “0:12:34:12:34:56” is looking for a router on-link, therefore sending this solicitation to the all-router-on-link multicast address “ff02::2”.</para></sect3></sect2><sect2>
<para>Following packets are sent by a node with layer 2 MAC address “0:12:34:12:34:56” during autoconfiguration to check whether a potential address is already used by another node on the link sending this to the solicited-node link-local multicast address.</para><itemizedlist>
<listitem><para>Node wants to configure its link-local address “fe80::212:34ff:fe12:3456”, checks for duplicate now</para></listitem></itemizedlist><screen>
<listitem><para>Node wants to configure its global address “2002:0102:0304:1:212:34ff:fe12:3456” (after receiving advertisement shown above), checks for duplicate now</para></listitem></itemizedlist><screen>
<listitem><para>Node wants to configure its global address “2001:0db8:0:1:212:34ff:fe12:3456” (after receiving advertisement shown above), checks for duplicate now</para></listitem></itemizedlist><screen>
<listitem><para>Node wants to send packages to “2001:0db8:0:1::10” but has no layer 2 MAC address to send packet, so send solicitation now</para></listitem></itemizedlist><screen>
<title><!-- anchor id="chapter-support-persistent-configuration" -->Support for persistent IPv6 configuration in Linux distributions</title>
<para>Some Linux distribution contain already support of a persistent IPv6 configuration using existing or new configuration and script files and some hook in the IPv4 script files.</para><sect1>
<para>Since starting writing the <ulink url="http://www.bieringer.de/linux/IPv6/">IPv6 & Linux - HowTo</ulink> it was my intention to enable a persistent IPv6 configuration which catch most of the wished cases like host-only, router-only, dual-homed-host, router with second stub network, normal tunnels, 6to4 tunnels, and so on. Nowadays there exists a set of configuration and script files which do the job very well (never heard about real problems, but I don't know how many use the set). Because this configuration and script files are extended from time to time, they got their own homepage: <ulink url="http://www.deepspace6.net/projects/initscripts-ipv6.html">initscripts-ipv6 homepage</ulink> (<ulink url="http://mirrors.bieringer.de/www.deepspace6.net/projects/initscripts-ipv6.html">Mirror</ulink>). Because I began my IPv6 experience using a Red Hat Linux 5.0 clone, my IPv6 development systems are mostly Red Hat Linux based now, it's kind a logic that the scripts are developed for this kind of distribution (so called <emphasis>historic issue</emphasis>). Also it was very easy to extend some configuration files, create new ones and create some simple hook for calling IPv6 setup during IPv4 setup.</para>
<para>Fortunately, in Red Hat Linux since 7.1 a snapshot of my IPv6 scripts is included, this was and is still further on assisted by Pekka Savola.</para>
<para>Mandrake since version 8.0 also includes an IPv6-enabled initscript package, but a minor bug still prevents usage (“ifconfig” misses “inet6” before “add”).</para><sect2>
<title>Test for IPv6 support of network configuration scripts</title>
<para>You can test, whether your Linux distribution contain support for persistent IPv6 configuration using my set. Following script library should exist:</para><screen>
]]></screen><para>The version of the library is important if you miss some features. You can get it executing following (or easier look at the top of the file):</para><screen>
]]></screen><para>In shown example, the used version is 20011124. Check this against latest information on <ulink url="http://www.deepspace6.net/projects/initscripts-ipv6.html">initscripts-ipv6 homepage</ulink> (<ulink url="http://mirrors.bieringer.de/www.deepspace6.net/projects/initscripts-ipv6.html">Mirror</ulink>) to see what has been changed. You will find there also a change-log.</para></sect2><sect2>
<title>Short hint for enabling IPv6 on current RHL 7.1, 7.2, 7.3, ...</title>
<itemizedlist>
<listitem><para>Check whether running system has already IPv6 module loaded</para></listitem></itemizedlist><screen>
<listitem><para>If result is “off”, then enable IPv6 networking by editing /etc/sysconfig/network, add following new line</para></listitem></itemizedlist><screen>
<listitem><para>Reboot or restart networking using</para></listitem></itemizedlist><screen>
<![CDATA[# service network restart
]]></screen><itemizedlist>
<listitem><para>Now IPv6 module should be loaded</para></listitem></itemizedlist><screen>
<![CDATA[# modprobe -c | grep ipv6
alias net-pf-10 ipv6
]]></screen><para>If your system is on a link which provides router advertisement, autoconfiguration will be done automatically. For more information which settings are supported see /usr/share/doc/initscripts-$version/sysconfig.txt.</para></sect2></sect1><sect1>
<title>SuSE Linux</title>
<para>In newer 7.x versions there is a really rudimentary support available, see /etc/rc.config for details.</para>
<para>Because of the really different configuration and script file structure it is hard (or impossible) to use the set for Red Hat Linux and clones with this distribution.
In versions 8.x they completly change their configuration setup. </para><sect2>
<title>SuSE Linux 7.3</title>
<itemizedlist>
<listitem><para><ulink url="http://www.feyrer.de/IPv6/SuSE73-IPv6+6to4-setup.html">How to setup 6to4 IPv6 with SuSE 7.3</ulink></para></listitem></itemizedlist></sect2><sect2>
<title>SuSE Linux 8.0</title>
<sect3>
<title>IPv6 address configuration</title>
<para>Edit file /etc/sysconfig/network/ifcfg-<Interface-Name> and setup following value</para><screen>
<listitem><para>Be sure that IPv6 is loaded, either because it is compiled into the kernel or because the module is loaded. For the latest, three solutions, adding it to /etc/modules, using the pre-up trick shown later or using kmod (not detailed here).</para></listitem><listitem><para>Configure your interface. Here we assume eth0 and address (2001:0db8:1234:5::1:1). Edit /etc/network/interfaces:</para></listitem></orderedlist><screen>
<para>After a long time discussing issues, finally <ulink url="http://www.faqs.org/rfcs/rfc3315.html">RFC 3315 / Dynamic Host Configuration Protocol for IPv6 (DHCPv6)</ulink> was finished. At time updating this part (10/2005) currently two implementations are available:</para><itemizedlist>
<listitem><para><ulink url="http://klub.com.pl/dhcpv6/">Dibbler</ulink> by Tomasz Mrugalski <thomson at klub dot com dot pl></para></listitem><listitem><para><ulink url="http://dhcpv6.sourceforge.net/">DHCPv6 on Sourceforge</ulink> (<link linkend="hints-daemons-dhcpv6.">Hints for configuration</link>)</para></listitem></itemizedlist></sect1></chapter><chapter id='chapter-mobility' >
<para>Support for IPv6 mobility can be enabled in Linux by installing the MIPL2 implementation found at: <ulink url="http://www.mobile-ipv6.org/">http://www.mobile-ipv6.org/</ulink></para>
<para>This implementation is compliant with RFC 3775. It is composed of a kernel patch and a mobility daemon called mip6d. Version 2.0.1 applies on Linux kernel 2.6.15.</para>
<para>Installation and setup are described in the <ulink url="http://tldp.org/HOWTO/Mobile-IPv6-HOWTO/">Linux Mobile IPv6 HOWTO</ulink>.</para></sect2><sect2>
<para>There also exists an implementation of network mobility for Linux, it is called NEPL and is based on MIPL. It can also be downloaded from: <ulink url="http://www.mobile-ipv6.org/">http://www.mobile-ipv6.org/</ulink>.</para>
<para>The HOWTO document describing setup and configuration is available at: <ulink url="http://www.nautilus6.org/doc/nepl-howto/">http://www.nautilus6.org/doc/nepl-howto/</ulink>.</para></sect2><sect2>
<listitem><para>Mobile IPv6 for Linux (MIPL) project: <ulink url="http://www.mobile-ipv6.org/">http://www.mobile-ipv6.org/</ulink></para></listitem><listitem><para>Nautilus6 working group: <ulink url="http://nautilus6.org/">http://nautilus6.org/</ulink></para></listitem><listitem><para>Fast Handovers for Mobile IPv6 for Linux project: <ulink url="http://www.fmipv6.org/">http://www.fmipv6.org/</ulink></para></listitem><listitem><para><ulink url="http://www.faqs.org/rfcs/rfc3775.html">RFC 3775 / Mobility Support in IPv6</ulink></para></listitem><listitem><para><ulink url="http://www.faqs.org/rfcs/rfc3776.html">RFC 3776 / Using IPsec to Protect Mobile IPv6 Signaling Between Mobile Nodes and Home Agents</ulink></para></listitem><listitem><para><ulink url="http://www.faqs.org/rfcs/rfc3963.html">RFC 3963 / Network Mobility (NEMO)</ulink></para></listitem><listitem><para><ulink url="http://www.faqs.org/rfcs/rfc4068.html">RFC 4068 / Fast Handovers for Mobile IPv6</ulink></para></listitem><listitem><para><ulink url="http://www.faqs.org/rfcs/rfc4423.html">RFC 4423 / Host Identity Protocol (HIP) Architecture</ulink></para></listitem><listitem><para><ulink url="http://www.faqs.org/rfcs/rfc5201.html">RFC 5201 / Host Identity Protocol</ulink></para></listitem><listitem><para>HIP implementations: <ulink url="http://infrahip.hiit.fi/">http://infrahip.hiit.fi/</ulink>, <ulink url="http://hip4inter.net/">http://hip4inter.net/</ulink>, <ulink url="http://www.openhip.org/">http://www.openhip.org/</ulink></para></listitem></itemizedlist></sect2></sect1></chapter><chapter id='chapter-firewalling-security' >
<para>IPv6 firewalling is important, especially if using IPv6 on internal networks with global IPv6 addresses. Because unlike at IPv4 networks where in common internal hosts are protected automatically using private IPv4 addresses like <ulink url="http://www.faqs.org/rfcs/rfc1918.html">RFC 1918 / Address Allocation for Private Internets</ulink> or Automatic Private IP Addressing (APIPA)<ulink url="http://www.google.com/search?q=apipa+microsoft">Google search for Microsoft + APIPA</ulink>, in IPv6 normally global addresses are used and someone with IPv6 connectivity can reach all internal IPv6 enabled nodes.</para><sect1 id='firewalling-netfilter6.' >
<para>This step is only needed if distributed kernel and netfilter doesn't fit your requirements and new features are available but still not built-in.</para><sect2>
<![CDATA[# make pending-patches KERNEL_DIR=/path/to/src/linux-version-iptables-version/
]]></screen><para>Apply additional IPv6 related patches (still not in the vanilla kernel included) </para><screen>
<![CDATA[# make patch-o-matic KERNEL_DIR=/path/to/src/linux-version-iptables-version/
]]></screen><para>Say yes at following options (iptables-1.2.2) </para><itemizedlist>
<listitem><para>ah-esp.patch </para></listitem><listitem><para>masq-dynaddr.patch (only needed for systems with dynamic IP assigned WAN connections like PPP or PPPoE) </para></listitem><listitem><para>ipv6-agr.patch.ipv6 </para></listitem><listitem><para>ipv6-ports.patch.ipv6 </para></listitem><listitem><para>LOG.patch.ipv6 </para></listitem><listitem><para>REJECT.patch.ipv6 </para></listitem></itemizedlist><para>Check IPv6 extensions </para><screen>
<listitem><para>On RH 6.2 systems, normally, no kernel 2.4.x is installed, therefore the requirements don't fit. Use "--nodeps" to install it </para></listitem></itemizedlist><screen>
<para>Since kernel version 2.6.20 IPv6 connection tracking is well supported and should be used instead of using stateless filter rules.</para><screen>
<![CDATA[# ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
<para>Using older kernels (unpatched kernel 2.4.5 and iptables-1.2.2) no type can be specified</para><itemizedlist>
<listitem><para>Accept incoming ICMPv6 through tunnels </para></listitem></itemizedlist><screen>
<![CDATA[# ip6tables -A INPUT -i sit+ -p icmpv6 -j ACCEPT
]]></screen><itemizedlist>
<listitem><para>Allow outgoing ICMPv6 through tunnels </para></listitem></itemizedlist><screen>
<![CDATA[# ip6tables -A OUTPUT -o sit+ -p icmpv6 -j ACCEPT
]]></screen><para>Newer kernels allow specifying of ICMPv6 types:</para><screen>
<![CDATA[# ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
]]></screen></sect3><sect3>
<title>Rate-limiting</title>
<para>Because it can happen (author already saw it to times) that an ICMPv6 storm will raise up, you should use available rate limiting for at least ICMPv6 ruleset. In addition logging rules should also get rate limiting to prevent DoS attacks against syslog and storage of log file partition. An example for a rate limited ICMPv6 looks like:</para><screen>
<![CDATA[# ip6tables -A INPUT --protocol icmpv6 --icmpv6-type echo-request
<para>To accept tunneled IPv6-in-IPv4 packets, you have to insert rules in your IPv4 firewall setup relating to such packets, for example </para><itemizedlist>
<listitem><para>Accept incoming IPv6-in-IPv4 on interface ppp0 </para></listitem></itemizedlist><screen>
<![CDATA[# iptables -A INPUT -i ppp0 -p ipv6 -j ACCEPT
]]></screen><itemizedlist>
<listitem><para>Allow outgoing IPv6-in-IPv4 to interface ppp0 </para></listitem></itemizedlist><screen>
<![CDATA[# iptables -A OUTPUT -o ppp0 -p ipv6 -j ACCEPT
]]></screen><para>If you have only a static tunnel, you can specify the IPv4 addresses, too, like </para><itemizedlist>
<title>Protection against incoming TCP connection requests</title>
<para>VERY RECOMMENDED! For security issues you should really insert a rule which blocks incoming TCP connection requests. Adapt "-i" option, if other interface names are in use! </para><itemizedlist>
<listitem><para>Block incoming TCP connection requests to this host </para></listitem></itemizedlist><screen>
]]></screen><para>Perhaps the rules have to be placed below others, but that is work you have to think about it. Best way is to create a script and execute rules in a specified way. </para></sect3><sect3>
<title>Protection against incoming UDP connection requests</title>
<para>ALSO RECOMMENDED! Like mentioned on my firewall information it's possible to control the ports on outgoing UDP/TCP sessions. So if all of your local IPv6 systems are using local ports e.g. from 32768 to 60999 you are able to filter UDP connections also (until connection tracking works) like: </para><itemizedlist>
<listitem><para>Block incoming UDP packets which cannot be responses of outgoing requests of this host </para></listitem></itemizedlist><screen>
<listitem><para>Block incoming UDP packets which cannot be responses of forwarded requests of hosts behind this router </para></listitem></itemizedlist><screen>
<para>Following lines show a simple firewall configuration for Fedora 6 (since kernel version 2.6.20). It was modfied from the default one (generated by system-config-firewall) for supporting connection tracking and return the proper ICMPv6 code for rejects. Incoming SSH (port 22) connections are allowed.</para><screen>
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited
COMMIT
]]></screen><para>For completeness also the IPv4 configuration is shown here:</para><screen>
<![CDATA[File: /etc/sysconfig/iptables
*filter :INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
]]></screen><para>Usage:</para><itemizedlist>
<listitem><para>Create/modify the configuration files</para></listitem><listitem><para>Activate IPv4 & IPv6 firewalling</para></listitem></itemizedlist><screen>
<![CDATA[# service iptables start
# service ip6tables start
]]></screen><itemizedlist>
<listitem><para>Enable automatic start after reboot</para></listitem></itemizedlist><screen>
<![CDATA[# chkconfig iptables on
# chkconfig ip6tables on
]]></screen></sect3><sect3>
<title>Sophisticated example</title>
<para>Following lines show a more sophisticated but still stateless filter setup as an example. Happy netfilter6 ruleset creation.... </para><screen>
<para>It's very recommended to apply all available patches and disable all not necessary services. Also bind services to the needed IPv4/IPv6 addresses only and install local firewalling.</para>
<para>More to be filled...</para></sect1><sect1>
<title>Access limitations</title>
<para>Many services uses the tcp_wrapper library for access control. Below is described the <link linkend="hints-daemons-tcpwrapper">use of tcp_wrapper</link>.</para>
<para>Currently there are no comfortable tools out which are able to check a system over network for IPv6 security issues. Neither <ulink url="http://www.nessus.org/">Nessus</ulink> nor any commercial security scanner is as far as I know able to scan IPv6 addresses.</para><sect2>
<title>Legal issues</title>
<para>ATTENTION: always take care that you only scan your own systems or after receiving a written order, otherwise legal issues are able to come up to you.
CHECK destination IPv6 addresses TWICE before starting a scan.</para></sect2><sect2>
<title>Security auditing using IPv6-enabled netcat</title>
<para>With the IPv6-enabled netcat (see <ulink url="http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-apps.html#security-auditing">IPv6+Linux-status-apps/security-auditing</ulink> for more) you can run a portscan by wrapping a script around which run through a port range, grab banners and so on. Usage example:</para><screen>
<![CDATA[# nc6 ::1 daytime
13 JUL 2002 11:22:22 CEST
]]></screen></sect2><sect2>
<title>Security auditing using IPv6-enabled nmap</title>
<para><ulink url="http://www.insecure.org/nmap/">NMap</ulink>, one of the best portscaner around the world, supports IPv6 since version 3.10ALPHA1. Usage example:</para><screen>
<![CDATA[# nmap -6 -sT ::1
Starting nmap V. 3.10ALPHA3 ( www.insecure.org/nmap/ )
Interesting ports on localhost6 (::1):
(The 1600 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
53/tcp open domain
515/tcp open printer
2401/tcp open cvspserver
Nmap run completed -- 1 IP address (1 host up) scanned in 0.525 seconds
]]></screen></sect2><sect2>
<title>Security auditing using IPv6-enabled strobe</title>
<para>Strobe is a (compared to NMap) more a low budget portscanner, but there is an IPv6-enabling patch available (see <ulink url="http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-apps.html#security-auditing">IPv6+Linux-status-apps/security-auditing</ulink> for more). Usage example:</para><screen>
]]></screen><para>Note: strobe isn't really developed further on, the shown version number isn't the right one.</para></sect2><sect2>
<title>Audit results</title>
<para>If the result of an audit mismatch your IPv6 security policy, use IPv6 firewalling to close the holes, e.g. using netfilter6 (see <link linkend="firewalling-netfilter6.">Firewalling/Netfilter6</link> for more).</para>
<para>Info: More detailed information concerning IPv6 Security can be found here: </para><itemizedlist>
<title><!-- anchor id="chapter-encryption-authentication" -->Encryption and Authentication</title>
<para>Unlike in IPv4, encryption and authentication is a mandatory feature of IPv6. Those features are normally implemented using IPsec (which can be also used by IPv4).</para><sect1>
<title>Modes of using encryption and authentication</title>
<para>Two modes of encryption and authentication of a connection are possible:</para><sect2>
<title>Transport mode</title>
<para>Transport mode is a real end-to-end connection mode. Here, only the payload (usually ICMP, TCP or UDP) is encrypted with their particular header, while the IP header is not encrypted (but usually included in authentication).</para>
<para>Using AES-128 for encryption and SHA1 for authentication, this mode decreases the MTU by 42 octets.</para></sect2><sect2>
<title>Tunnel mode</title>
<para>Tunnel mode can be used either for end-to-end or for gateway-to-gateway connection modes. Here, the complete IP packet is being encrypted and gets a new IP header prepended, all together constituing a new IP packet (this mechanism is also known as "encapsulation")</para>
<para>This mode usually decreases the MTU by 40 octets from the MTU of transport mode. I.e. using AES-128 for encryption and SHA1 for authentication 82 octets less than the normal MTU.</para></sect2></sect1><sect1>
<title>Support in kernel (ESP and AH)</title>
<sect2>
<title>Support in vanilla Linux kernel 2.4.x</title>
<para>At the time of writing missing in vanilla up to 2.4.28. There was an issue about keeping the Linux kernel source free of export/import-control-laws regarding encryption code. This is also one case why <ulink url="http://www.freeswan.org/">FreeS/WAN project</ulink> wasn't included in vanilla source. Perhaps a backport from 2.6.x will be done in the future.</para></sect2><sect2>
<title>Support in vanilla Linux kernel 2.6.x</title>
<para>Current versions (as time of writing 2.6.9 and upper) support native IPsec for IPv4 and IPv6.</para>
<para>Implementation was helped by the USAGI project.</para></sect2></sect1><sect1>
<para>IPsec requires a key exchange of a secret. This is mostly done automatically by so called IKE daemons. They also handle the authentication of the peers, either by a common known secret (so called “pre-shared secret”) or by RSA keys (which can also be used from X.509 certificates).</para>
<para>I prefer “pluto” from the *S/WAN implementation because of the easier and one-config-only setup.</para><sect2>
<title>IKE daemon “racoon”</title>
<para>The IKE daemon “racoon” is taken from the KAME project and ported to Linux. Modern Linux distributions contain this daemon in the package “ipsec-tools”. Two executables are required for a proper IPsec setup. Take a look on <ulink url="http://lartc.org/howto/lartc.ipsec.html">Linux Advanced Routing & Traffic Control HOWTO / IPSEC</ulink>, too.</para><sect3>
<title>Manipulation of the IPsec SA/SP database with the tool “setkey”</title>
<para>“setkey” is important to define the security policy (SP) for the kernel.</para>
]]></screen><para>For the other peer, you have to replace “in” with “out”.</para></sect3><sect3>
<title>Configuration of the IKE daemon “racoon”</title>
<para>“racoon” requires a configuration file for proper execution. It includes the related settings to the security policy, which should be set up previously using “setkey”.</para>
<para>At least the daemon needs to be started. For the first time, use debug and foreground mode. The following example shows a successful IKE phase 1 (ISAKMP-SA) and 2 (IPsec-SA) negotiation:</para><screen>
]]></screen><para>Each direction got its own IPsec-SA (like defined in the IPsec standard). With “tcpdump” on the related interface, you will see as result of an IPv6 ping:</para><screen>
<para>The IKE daemon “pluto” is included in distributions of the *S/WAN projects. *S/WAN project starts at the beginning as <ulink url="http://www.freeswan.org/">FreeS/WAN</ulink>. Unfortunately, the FreeS/WAN project stopped further development in 2004. Because of the slow pace of development in the past, two spin-offs started: <ulink url="http://www.strongswan.org/">strongSwan</ulink> and <ulink url="http://www.openswan.org/">Openswan</ulink>. Today, readily installable packages are available for at least Openswan (included in Fedora Core 3).</para>
<para>A major difference to “racoon”, only one configuration file is required. Also, an initscript exists for automatic setup after booting.</para><sect3>
<title>Configuration of the IKE daemon “pluto”</title>
]]></screen><para>Afterwards, start this connection on one peer. If you saw the line “IPsec SA established”, all worked fine.</para><screen>
]]></screen><para>Because *S/WAN and setkey/racoon do use the same IPsec implementation in Linux 2.6.x kernel, “setkey” can be used here too to show current active parameters:</para><screen>
<para>IPv6 supports QoS with use of Flow Labels and Traffic Classes. This can be controlled using “tc” (contained in package “iproute”).</para>
<para>IPv6 is supported since version 9. Always use newest available version. At least version 9.1.3 must be used, older versions can contain remote exploitable security holes.</para><sect2>
<title>Listening on IPv6 addresses</title>
<para>Note: unlike in IPv4 current versions doesn't allow to bind a server socket to dedicated IPv6 addresses, so only <emphasis>any</emphasis> or <emphasis>none</emphasis> are valid. Because this can be a security issue, check the Access Control List (ACL) section below, too!</para><sect3>
<title>Enable BIND named for listening on IPv6 address</title>
<para>To enable IPv6 for listening, following options are requested to change</para><screen>
<![CDATA[options {
# sure other options here, too
listen-on-v6 { any; };
};
]]></screen><para>This should result after restart in e.g.</para><screen>
]]></screen><para>This ACLs can be used e.g. for queries of clients and transfer zones to secondary name-servers. This prevents also your caching name-server to be used from outside using IPv6.</para><screen>
<![CDATA[options {
# sure other options here, too
listen-on-v6 { none; };
allow-query { internal-net; };
allow-transfer { ns-internal-net; };
};
]]></screen><para>It's also possible to set the <emphasis>allow-query </emphasis>and <emphasis>allow-transfer</emphasis> option for most of single zone definitions, too.</para></sect2><sect2>
<title>Sending queries with dedicated IPv6 address</title>
<para>This option is not required, but perhaps needed:</para><screen>
<![CDATA[query-source-v6 address <ipv6address|*> port <port|*>;
]]></screen></sect2><sect2>
<title>Per zone defined dedicated IPv6 addresses</title>
<para>It's also possible to define per zone some IPv6 addresses.</para><sect3>
<title>Transfer source address </title>
<para>Transfer source address is used for outgoing zone transfers:</para><screen>
<para>Some information can be also found at <ulink url="http://www.isi.edu/~bmanning/v6DNS.html">IPv6 DNS Setup Information (article)</ulink>. Perhaps also helpful is the <ulink url="http://tools.fpsn.net/ipv6-inaddr/">IPv6 Reverse DNS zone builder for BIND 8/9 (webtool)</ulink>.</para></sect2><sect2>
<title>Serving IPv6 related DNS data</title>
<para>For IPv6 new types and root zones for reverse lookups are defined:</para><itemizedlist>
<listitem><para>AAAA and reverse IP6.INT: specified in <ulink url="http://www.faqs.org/rfcs/rfc1886.html">RFC 1886 / DNS Extensions to support IP version 6</ulink>, usable since BIND version 4.9.6</para></listitem><listitem><para>A6, DNAME (DEPRECATED NOW!) and reverse IP6.ARPA: specified in <ulink url="http://www.faqs.org/rfcs/rfc2874.html">RFC 2874 / DNS Extensions to Support IPv6 Address Aggregation and Renumbering</ulink>, usable since BIND 9, but see also an information about the current state at <ulink url="http://www.ietf.org/ids.by.wg/dnsext.html">Domain Name System Extension (dnsext)</ulink></para></listitem></itemizedlist><para>Perhaps filled later more content, for the meantime take a look at given RFCs and</para><itemizedlist>
<listitem><para>AAAA and reverse IP6.INT: <ulink url="http://www.isi.edu/~bmanning/v6DNS.html">IPv6 DNS Setup Information</ulink></para></listitem><listitem><para>A6, DNAME (DEPRECATED NOW!) and reverse IP6.ARPA: take a look into chapter 4 and 6 of the BIND 9 Administrator Reference Manual (ARM) distributed with the bind-package or get this here: <ulink url="http://www.isc.org/sw/bind/arm93/">BIND manual version 9.3</ulink></para></listitem></itemizedlist><para>Because IP6.INT is deprecated (but still in use), a DNS server which will support IPv6 information has to serve both reverse zones.</para><sect3>
<listitem><para>Reverse nibble format for zone ip6.int (FOR BACKWARD COMPATIBILITY)</para></listitem><listitem><para>Reverse nibble format for zone ip6.arpa (RECOMMENDED)</para></listitem></itemizedlist></sect3></sect2><sect2>
]]></screen><para>If you see such entries in the log, check whether requests from this client should be allowed and perhaps review your ACL configuration.</para></sect3><sect3>
<title>Successful IPv6 connect</title>
<para>A successful IPv6 connect looks like following:</para><screen>
<title><!-- anchor id="hints-daemons-xinetd" -->Internet super daemon (xinetd)</title>
<para>IPv6 is supported since <ulink url="http://www.xinetd.org/">xinetd</ulink> version around 1.8.9. Always use newest available version. At least version 2.3.3 must be used, older versions can contain remote exploitable security holes.</para>
<para>Some Linux distribution contain an extra package for the IPv6 enabled xinetd, some others start the IPv6-enabled xinetd if following variable is set: NETWORKING_IPV6="yes", mostly done by /etc/sysconfig/network (only valid for Red Hat like distributions). In newer releases, one binary supports IPv4 and IPv6.</para>
<para>If you enable a built-in service like e.g. daytime by modifying the configuration file in /etc/xinetd.d/daytime like</para><screen>
<para>Note: earlier versions had a problem that an IPv4-only xinetd won't start on an IPv6-enabled node and also the IPv6-enabled xinetd won't start on an IPv4-only node. This is known to be fixed in later versions, at least version 2.3.11.</para></sect1><sect1 id='hints-daemons-apache2.' >
<para>Apache web server supports IPv6 native by maintainers since 2.0.14. Available patches for the older 1.3.x series are not current and shouldn't be used in public environment, but available at <ulink url="ftp://ftp.kame.net/pub/kame/misc/">KAME / Misc</ulink>.</para><sect2>
<title>Listening on IPv6 addresses</title>
<para>Note: virtual hosts on IPv6 addresses are broken in versions until 2.0.28 (a patch is available for 2.0.28). But always try latest available version first because earlier versions had some security issues.</para><sect3>
<title>Virtual host listen on an IPv6 address only</title>
<listitem><para>Apache2 supports a method called “sendfile” to speedup serving data. Some NIC drivers also support offline checksumming. In some cases, this can lead to connection problems and invalid TCP checksums. In this cases, disable “sendfile” either by recompiling using configure option “--without-sendfile” or by using the "EnableSendfile off" directive in configuration file.</para></listitem></itemizedlist></sect3></sect2></sect1><sect1 id='hints-daemons-radvd' >
<para>The router advertisement daemon is very useful on a LAN, if clients should be auto-configured. The daemon itself should run on the Linux default IPv6 gateway router (it's not required that this is also the default IPv4 gateway, so pay attention who on your LAN is sending router advertisements). </para>
<para>You can specify some information and flags which should be contained in the advertisement. Common used are</para><itemizedlist>
<listitem><para>Prefix (needed)</para></listitem><listitem><para>Lifetime of the prefix</para></listitem><listitem><para>Frequency of sending advertisements (optional)</para></listitem></itemizedlist><para>After a proper configuration, the daemon sends advertisements through specified interfaces and clients are hopefully receive them and auto-magically configure addresses with received prefix and the default route.</para><sect2>
<title>Configuring radvd</title>
<sect3>
<title>Simple configuration</title>
<para>Radvd's config file is normally /etc/radvd.conf. An simple example looks like following:</para><screen>
]]></screen><para>Because no lifetime was defined, a very high value was used.</para></sect3><sect3>
<title>Special 6to4 configuration</title>
<para>Version since 0.6.2pl3 support the automatic (re)-generation of the prefix depending on an IPv4 address of a specified interface. This can be used to distribute advertisements in a LAN after the 6to4 tunneling has changed. Mostly used behind a dynamic dial-on-demand Linux router. Because of the sure shorter lifetime of such prefix (after each dial-up, another prefix is valid), the lifetime configured to minimal values:</para><screen>
<![CDATA[interface eth0 {
AdvSendAdvert on;
MinRtrAdvInterval 3;
MaxRtrAdvInterval 10;
prefix 0:0:0:f101::/64 {
AdvOnLink off;
AdvAutonomous on;
AdvRouterAddr on;
Base6to4Interface ppp0;
AdvPreferredLifetime 20;
AdvValidLifetime 30;
};
};
]]></screen><para>This results on client side in (assuming, ppp0 has currently 1.2.3.4 as local IPv4 address):</para><screen>
<![CDATA[# /sbin/ip -6 addr show eth0
3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
]]> inet6 2002:0102:0304:f101:2e0:12ff:fe34:1234/64 scope global dynamic
<![CDATA[ valid_lft 22sec preferred_lft 12sec
inet6 fe80::2e0:12ff:fe34:1234/10 scope link
]]></screen><para>Because a small lifetime was defined, such prefix will be thrown away quickly, if no related advertisement was received.</para>
<para>Additional note: if you do not used special 6to4 support in initscripts, you have to setup a special route on the internal interface on the router, otherwise you will get some backrouting problems. for the example showh here:</para><screen>
<![CDATA[]]># /sbin/ip -6 route add 2002:0102:0304:f101::/64 dev eth0 metric 1
<![CDATA[]]></screen><para>This route needs to be replaced every time the prefix changes, which is the case after a new IPv4 address was assigned to the dial-up interface.</para></sect3></sect2><sect2>
]]></screen><para>Output shows you each advertisement package in readable format. You should see your configured values here again, if not, perhaps it's not your radvd which sends the advertisement...look for another router on the link (and take the LLAddress, which is the MAC address for tracing).</para></sect2></sect1><sect1 id='hints-daemons-dhcpv6.' >
<para>tcp_wrapper is a library which can help you to protect service against misuse.</para><sect2>
<title>Filtering capabilities</title>
<para>You can use tcp_wrapper for</para><itemizedlist>
<listitem><para>Filtering against source addresses (IPv4 or IPv6)</para></listitem><listitem><para>Filtering against users (requires a running ident daemon on the client)</para></listitem></itemizedlist></sect2><sect2>
<title>Which program uses tcp_wrapper</title>
<para>Following are known:</para><itemizedlist>
<listitem><para>Each service which is called by xinetd (if xinetd is compiled using tcp_wrapper library)</para></listitem><listitem><para>sshd (if compiled using tcp_wrapper)</para></listitem></itemizedlist></sect2><sect2>
<title>Usage</title>
<para>tcp_wrapper is controlled by two files name /etc/hosts.allow and /etc/hosts.deny. For more information see</para><screen>
<![CDATA[$ man hosts.allow
]]></screen><sect3>
<title>Example for /etc/hosts.allow</title>
<para>In this file, each service which should be positive filtered (means connects are accepted) need a line.</para><screen>
]]></screen><para>Note: there are broken implementations around, which uses following broken IPv6 network description: [2001:0db8:100:200::/64]. Hopefully, such versions will be fixed soon.</para></sect3><sect3>
<para>This file contains all negative filter entries and should normally deny the rest using</para><screen>
<![CDATA[ALL: ALL
]]></screen><para>If this node is a more sensible one you can replace the standard line above with this one, but this can cause a DoS attack (load of mailer and spool directory), if too many connects were made in short time. Perhaps a logwatch is better for such issues.</para><screen>
<![CDATA[ALL: ALL: spawn (echo "Attempt from %h %a to %d at `date`"
| tee -a /var/log/tcp.deny.log | mail root@localhost)
]]></screen></sect3></sect2><sect2>
<title>Logging</title>
<para>Depending on the entry in the syslog daemon configuration file /etc/syslog.conf the tcp_wrapper logs normally into /var/log/secure.</para><sect3>
<title>Refused connection</title>
<para>A refused connection via IPv4 to an xinetd covered daytime service produces a line like following example</para><screen>
<para>Nowadays it's mostly simple, look for either a command line option or a configuration value to enable IPv6 listening. See manual page of the daemon or check related FAQs. It can happen that you can bind a daemon only to the IPv6-“any”-address (::) and not to bind to a dedicated IPv6 address, because the lack of support (depends on that what the programmer has implemented so far...).</para></sect1></chapter><chapter id='chapter-programming' >
<title><!-- anchor id="chapter-section-using-API" --><!-- anchor id="chapter-programming-using-API" -->Programming using C-API</title>
<para>Related RFCs:</para><itemizedlist>
<listitem><para><ulink url="http://www.faqs.org/rfcs/rfc3493.html">RFC 3493 / Basic Socket Interface Extensions for IPv6</ulink></para></listitem><listitem><para><ulink url="http://www.faqs.org/rfcs/rfc3542.html">RFC 3542 / Advanced Sockets Application Program Interface (API) for IPv6</ulink></para></listitem></itemizedlist><para>Following contents of this section is contributed by John Wenker, Sr. Software Engineer Performance Technologies San Diego, CA USA <ulink url="http://www.pt.com/">http://www.pt.com/</ulink>.</para>
<para>This section describes how to write IPv6 client-server applications under the Linux operating system. First thing's first, and credit must be given where it is due. The information contained in this section is derived from Chapters 2 through 4 of IPv6 Network Programming by Jun-ichiro itojun Hagino (ISBN 1-55558-318-0). The reader is encouraged to consult that book for more detailed information. It describes how to convert IPv4 applications to be IPv6 compatible in a protocol-independent way, and describes some of the common problems encountered during the conversion along with suggested solutions. At the time of this writing, this is the only book of which the author is aware that specifically addresses how to program IPv6 applications [since writing this section, the author has also become aware of the Porting applications to IPv6 HowTo by Eva M. Castro at <ulink url="http://jungla.dit.upm.es/~ecastro/IPv6-web/ipv6.html">http://jungla.dit.upm.es/~ecastro/IPv6-web/ipv6.html</ulink>]. Unfortunately, of the almost 360 pages in the book, maybe 60 are actually useful (the chapters mentioned). Nevertheless, without the guidance of that book, the author would have been unable to perform his job duties or compose this HowTo. While most (but certainly not all) of the information in the Hagino book is available via the Linux 'man' pages, application programmers will save a significant amount of time and frustration by reading the indicated chapters of the book rather than searching through the 'man' pages and online documentation.</para>
<para>Other than the Hagino book, any other information presented in this HowTo was obtained through trial and error. Some items or explanations may not be entirely “correct” in the grand IPv6 scheme, but seem to work in practical application.</para>
<para>The discussion that follows assumes the reader is already experienced with the traditional TCP/IP socket API. For more information on traditional socket programming, the Internetworking with TCP/IP series of textbooks by Comer & Stevens is hard to beat, specifically Volume III: Client-Server Programming and Applications, Linux/POSIX Sockets Version (ISBN 0-13-032071-4). This HowTo also assumes that the reader has had at least a bare basic introduction to IPv6 and in particular the addressing scheme for network addresses (see Section 2.3).</para><sect2>
<title>Address Structures</title>
<para>This section provides a brief overview of the structures provided in the socket API to represent network addresses (or more specifically transport endpoints) when using the Internet protocols in a client-server application.</para><sect3>
<title>IPv4 sockaddr_in</title>
<para>In IPv4, network addresses are 32 bits long and define a network node. Addresses are written in dotted decimal notation, such as 192.0.2.1, where each number represents eight bits of the address. Such an IPv4 address is represented by the struct sockaddr_in data type, which is defined in <netinet/in.h>.</para><screen>
<![CDATA[struct sockaddr_in
{
sa_family_t sin_family;
in_port_t sin_port;
struct in_addr sin_addr;
/* Plus some padding for alignment */
};
]]></screen><para>The sin_family component indicates the address family. For IPv4 addresses, this is always set to AF_INET. The sin_addr field contains the 32-bit network address (in network byte order). Finally, the sin_port component represents the transport layer port number (in network byte order). Readers should already be familiar with this structure, as this is the standard IPv4 address structure.</para></sect3><sect3>
<title>IPv6 sockaddr_in6</title>
<para>The biggest feature of IPv6 is its increased address space. Instead of 32-bit network addresses, IPv6 allots 128 bits to an address. Addresses are written in colon-hex notation of the form fe80::2c0:8cff:fe01:2345, where each hex number separated by colons represents 16 bits of the address. Two consecutive colons indicate a string of consecutive zeros for brevity, and at most only one double-colon may appear in the address. IPv6 addresses are represented by the struct sockaddr_in6 data type, also defined in <netinet/in.h>.</para><screen>
<![CDATA[struct sockaddr_in6
{
sa_family_t sin6_family;
in_port_t sin6_port;
uint32_t sin6_flowinfo;
struct in6_addr sin6_addr;
uint32_t sin6_scope_id;
};
]]></screen><para>The sin6_family, sin6_port, and sin6_addr components of the structure have the same meaning as the corresponding fields in the sockaddr_in structure. However, the sin6_family member is set to AF_INET6 for IPv6 addresses, and the sin6_addr field holds a 128-bit address instead of only 32 bits.</para>
<para>The sin6_flowinfo field is used for flow control, but is not yet standardized and can be ignored.</para>
<para>The sin6_scope_id field has an odd use, and it seems (at least to this na<6E>ve author) that the IPv6 designers took a huge step backwards when devising this. Apparently, 128-bit IPv6 network addresses are not unique. For example, it is possible to have two hosts, on separate networks, with the same link-local address (see Figure 1). In order to pass information to a specific host, more than just the network address is required; the scope identifier must also be specified. In Linux, the network interface name is used for the scope identifier (e.g. “eth0”) [be warned that the scope identifier is implementation dependent!]. Use the ifconfig(1M) command to display a list of active network interfaces.</para>
<para>A colon-hex network address can be augmented with the scope identifier to produce a "scoped address”. The percent sign ('%') is used to delimit the network address from the scope identifier. For example, fe80::1%eth0 is a scoped IPv6 address where fe80::1 represents the 128-bit network address and eth0 is the network interface (i.e. the scope identifier). Thus, if a host resides on two networks, such as Host B in example below, the user now has to know which path to take in order to get to a particular host. In Figure 1, Host B addresses Host A using the scoped address fe80::1%eth0, while Host C is addressed with fe80::1%eth1.</para><screen>
<![CDATA[Host A (fe80::1) ---- eth0 ---- Host B ---- eth1 ---- Host C (fe80::1)
]]></screen><para>Getting back to the sockaddr_in6 structure, its sin6_scope_id field contains the index of the network interface on which a host may be found. Server applications will have this field set automatically by the socket API when they accept a connection or receive a datagram. For client applications, if a scoped address is passed as the node parameter to getaddrinfo(3) (described later in this HowTo), then the sin6_scope_id field will be filled in correctly by the system upon return from the function; if a scoped address is not supplied, then the sin6_scope_id field must be explicitly set by the client software prior to attempting to communicate with the remote server. The if_nametoindex(3) function is used to translate a network interface name into its corresponding index. It is declared in <net/if.h>.</para></sect3><sect3>
<title>Generic Addresses</title>
<para>As any programmer familiar with the traditional TCP/IP socket API knows, several socket functions deal with "generic" pointers. For example, a pointer to a generic struct sockaddr data type is passed as a parameter to some socket functions (such as connect(2) or bind(2)) rather than a pointer to a specific address type. Be careful... the sockaddr_in6 structure is larger than the generic sockaddr structure! Thus, if your program receives a generic address whose actual type is unknown (e.g. it could be an IPv4 address structure or an IPv6 address structure), you must supply sufficient storage to hold the entire address. The struct sockaddr_storage data type is defined in <bits/socket.h> for this purpose [do not #include this file directly within an application; use <sys/socket.h> as usual, and <bits/socket.h> will be implicitly included].</para>
<para>For example, consider the recvfrom(2) system call, which is used to receive a message from a remote peer. Its function prototype is:</para><screen>
<![CDATA[ssize_t recvfrom( int s,
void *buf,
size_t len,
int flags,
struct sockaddr *from,
socklen_t *fromlen );
]]></screen><para>The from parameter points to a generic sockaddr structure. If data can be received from an IPv6 peer on the socket referenced by s, then from should point to a data type of struct sockaddr_storage, as in the following dummy example:</para><screen>
<![CDATA[/*
** Read a message from a remote peer, and return a buffer pointer to
** the caller.
**
** 's' is the file descriptor for the socket.
*/
char *rcvMsg( int s )
{
static char bfr[ 1025 ]; /* Where the msg is stored. */
ssize_t count;
struct sockaddr_storage ss; /* Where the peer adr goes. */
socklen_t sslen;
sslen = sizeof( ss );
count = recvfrom( s,
bfr,
sizeof( bfr ) - 1,
0,
(struct sockaddr*) &ss,
&sslen );
bfr[ count ] = '\0'; /* Null-terminates the message. */
return bfr;
} /* End rcvMsg() */
]]></screen><para>As seen in the above example, ss (a struct sockaddr_storage data object) is used to receive the peer address information, but it's address is typecast to a generic struct sockaddr* pointer in the call to recvfrom(2). </para></sect3></sect2><sect2>
<title>Lookup Functions</title>
<para>Traditionally, hostname and service name resolution were performed by functions such as gethostbyname(3) and getservbyname(3). These traditional lookup functions are still available, but they are not forward compatible to IPv6. Instead, the IPv6 socket API provides new lookup functions that consolidate the functionality of several traditional functions. These new lookup functions are also backward compatible with IPv4, so a programmer can use the same translation algorithm in an application for both the IPv4 and IPv6 protocols. This is an important feature, because obviously a global IPv6 infrastructure isn't going to be put in place overnight. Thus, during the transition period from IPv4 to IPv6, client-server applications should be designed with the flexibility to handle both protocols simultaneously. The example programs at the end of this chapter do just that.</para>
<para>The primary lookup function in the new socket API is getaddrinfo(3). Its prototype is as follows. </para><screen>
<![CDATA[int getaddrinfo( const char *node,
const char *service,
const struct addrinfo *hints,
struct addrinfo **res );
]]></screen><para>The node parameter is a pointer to the hostname or IP address being translated. The referenced string can be a hostname, IPv4 dotted decimal address, or IPv6 colon-hex address (possibly scoped). The service parameter is a pointer to the transport layer's service name or port number. It can be specified as a name found in /etc/services or a decimal number. getaddrinfo(3) resolves the host/service combination and returns a list of address records; a pointer to the list is placed in the location pointed at by res. For example, suppose a host can be identified by both an IPv4 and IPv6 address, and that the indicated service has both a TCP entry and UDP entry in /etc/services. In such a scenario, it is not inconceivable that four address records are returned; one for TCP/IPv6, one for UDP/IPv6, one for TCP/IPv4, and one for UDP/IPv4.</para>
<para>The definition for struct addrinfo is found in <netdb.h> (as is the declaration for getaddrinfo(3) and the other functions described in this section). The structure has the following format:</para><screen>
<![CDATA[struct addrinfo
{
int ai_flags;
int ai_family;
int ai_socktype;
int ai_protocol;
socklen_t ai_addrlen;
struct sockaddr *ai_addr;
char *ai_canonname;
struct addrinfo *ai_next;
};
]]></screen><para>Consult the 'man' page for getaddrinfo(3) for detailed information about the various fields; this HowTo only describes a subset of them, and only to the extent necessary for normal IPv6 programming.</para>
<para>The ai_family, ai_socktype, and ai_protocol fields have the exact same meaning as the parameters to the socket(2) system call. The ai_family field indicates the protocol family (not the address family) associated with the record, and will be PF_INET6 for IPv6 or PF_INET for IPv4. The ai_socktype parameter indicates the type of socket to which the record corresponds; SOCK_STREAM for a reliable connection-oriented byte-stream or SOCK_DGRAM for connectionless communication. The ai_protocol field specifies the underlying transport protocol for the record.</para>
<para>The ai_addr field points to a generic struct sockaddr object. Depending on the value in the ai_family field, it will point to either a struct sockaddr_in (PF_INET) or a struct sockaddr_in6 (PF_INET6). The ai_addrlen field contains the size of the object pointed at by the ai_addr field.</para>
<para>As mentioned, getaddrinfo(3) returns a list of address records. The ai_next field points to the next record in the list.</para>
<para>The hints parameter to getaddrinfo(3) is also of type struct addrinfo and acts as a filter for the address records returned in res. If hints is NULL, all matching records are returned; but if hints is non-NULL, the referenced structure gives "hints" to getaddrinfo(3) about which records to return. Only the ai_flags, ai_family, ai_socktype, and ai_protocol fields are significant in the hints structure, and all other fields should be set to zero.</para>
<para>Programs can use hints->ai_family to specify the protocol family. For example, if it is set to PF_INET6, then only IPv6 address records are returned. Likewise, setting hints->ai_family to PF_INET results in only IPv4 address records being returned. If an application wants both IPv4 and IPv6 records, the field should be set to PF_UNSPEC.</para>
<para>The hints->socktype field can be set to SOCK_STREAM to return only records that correspond to connection-oriented byte streams, SOCK_DGRAM to return only records corresponding to connectionless communication, or 0 to return both.</para>
<para>For the Internet protocols, there is only one protocol associated with connection-oriented sockets (TCP) and one protocol associated with connectionless sockets (UDP), so setting hints->ai_socktype to SOCK_STREAM or SOCK_DGRAM is the same as saying, "Give me only TCP records," or "Give me only UDP records," respectively. With that in mind, the hints->ai_protocol field isn't really that important with the Internet protocols, and pretty much mirrors the hints->ai_socktype field. Nevertheless, hints->ai_protocol can be set to IPPROTO_TCP to return only TCP records, IPPROTO_UDP to return only UDP records, or 0 for both.</para>
<para>The node or service parameter to gethostbyname(3) can be NULL, but not both. If node is NULL, then the ai_flags field of the hints parameter specifies how the network address in a returned record is set (i.e. the sin_addr or sin6_addr field of the object pointed at by the ai_addr component in a returned record). If the AI_PASSIVE flag is set in hints, then the returned network addresses are left unresolved (all zeros). This is how server applications would use getaddrinfo(3). If the flag is not set, then the address is set to the local loopback address (::1 for IPv6 or 127.0.0.1 for IPv4). This is one way a client application can specify that the target server is running on the same machine as the client. If the service parameter is NULL, the port number in the returned address records remains unresolved.</para>
<para>The getaddrinfo(3) function returns zero on success, or an error code. In the case of an error, the gai_strerror(3) function is used to obtain a character pointer to an error message corresponding to the error code, just like strerror(3) does in the standard 'C' library.</para>
<para>Once the address list is no longer needed, it must be freed by the application. This is done with the freeaddrinfo(3) function.</para>
<para>The last function that will be mentioned in this section is getnameinfo(3). This function is the inverse of getaddrinfo(3); it is used to create a string representation of the hostname and service from a generic struct sockaddr data object. It has the following prototype. </para><screen>
]]></screen><para>The sa parameter points to the address structure in question, and salen contains its size. The host parameter points to a buffer where the null-terminated hostname string is placed, and the hostlen parameter is the size of that buffer. If there is no hostname that corresponds to the address, then the network address (dotted decimal or colon-hex) is placed in host. Likewise, the serv parameter points to a buffer where the null-terminated service name string (or port number) is placed, and the servlen parameter is the size of that buffer. The flags parameter modifies the function's behavior; in particular, the NI_NUMERICHOST flag indicates that the converted hostname should always be formatted in numeric form (i.e. dotted decimal or colon-hex), and the NI_NUMERICSERV flag indicates that the converted service should always be in numeric form (i.e. the port number).</para>
<para>The symbols NI_MAXHOST and NI_MAXSERV are available to applications and represent the maximum size of any converted hostname or service name, respectively. Use these when declaring output buffers for getnameinfo(3).</para></sect2><sect2>
<title>Quirks Encountered</title>
<para>Before jumping into the programming examples, there are several quirks in IPv6 of which the reader should be aware. The more significant ones (in addition to the non-uniqueness of IPv6 network addresses already discussed) are described in the paragraphs below. </para><sect3>
<title>IPv4 Mapped Addresses</title>
<para>For security reasons that this author won't pretend to understand, "IPv4 mapped addresses" should not be allowed in IPv6-capable server applications. To put it in terms that everyone can understand, this simply means that a server should not accept IPv4 traffic on an IPv6 socket (an otherwise legal operation). An IPv4 mapped address is a mixed-format address of the form:</para><screen>
<![CDATA[::ffff:192.0.2.1
]]></screen><para>where the first portion is in IPv6 colon-hex format and the last portion is in IPv4 dotted decimal notation. The dotted decimal IPv4 address is the actual network address, but it is being mapped into an IPv6 compatible format.</para>
<para>To prevent IPv4 mapped addresses from being accepted on an IPv6 socket, server applications must explicitly set the IPV6_V6ONLY socket option on all IPv6 sockets created [the Hagino book implies that this is only a concern with server applications. However, it has been observed during testing that if a client application uses an IPv4 mapped address to specify the target server, and the target server has IPv4 mapped addresses disabled, the connection still completes regardless. On the server side, the connection endpoint is an IPv4 socket as desired; but on the client side, the connection endpoint is an IPv6 socket. Setting the IPV6_V6ONLY socket option on the client side as well as the server side prevents any connection from being established at all.]. There's only one problem. Apparently, IPV6_V6ONLY isn't defined on all systems [or at least it wasn't in 2005 when the Hagino book was written]. The server example at the end of this chapter provides a method for handling this problem.</para>
<para>If IPv4 traffic cannot be handled on IPv6 sockets, then that implies that server applications must open both an IPv4 and IPv6 socket for a particular network service if it wants to handle requests from either protocol. This goes back to the flexibility issue mentioned earlier. If getaddrinfo(3) returns multiple address records, then server applications should traverse the list and open a passive socket for each address provided. </para></sect3><sect3>
<title>Cannot Specify the Scope Identifier in /etc/hosts</title>
<para>It is possible to assign a hostname to an IPv6 network address in /etc/hosts. For example, the following is an excerpt from the /etc/hosts file on the author's development system. </para><screen>
<![CDATA[ ::1 localhost
127.0.0.1 localhost
fe80::2c0:8cff:fe01:2345 pt141
192.0.2.1 pt141
]]></screen><para>The "localhost" and "pt141" hostnames can be translated to either an IPv4 or IPv6 network address. So, for example, if "pt141" is passed as the node parameter to getaddrinfo(3), the function returns both an IPv4 and IPv6 address record for the host (assuming the behavior hasn't been modified by the hints parameter). Unfortunately, a scoped address cannot be used in /etc/hosts. Doing so results in getaddrinfo(3) returning only the IPv4 record.</para></sect3><sect3>
<title>Client & Server Residing on the Same Machine</title>
<para>Suppose a machine has the IPv4 address 192.0.2.1. A client application running on that machine can connect to a server application on the same machine by using either the local loopback address (127.0.0.1) or the network address (192.0.2.1) as the target server. Much to this author's surprise (and dismay), it turns out that an IPv6 client application cannot connect to a server application on the same machine if it uses the network address of that machine as the target; it must use the local loopback address (::1). </para></sect3></sect2><sect2>
<title>Putting It All Together (A Client-Server Programming Example)</title>
<para>Now it's time to put everything discussed thus far together into a sample client-server application. The remainder of this section is devoted to a remote time-of-day application (the 'daytime' Internet service) [I noticed that Ms. Castro used a 'daytime' example in her <emphasis>Porting applications to IPv6 HowTo</emphasis>. For the record, the source code presented here is original, developed from scratch, and any similarity between it and any other publicly available 'daytime' example is purely coincidental.]. The source code presented in this section was developed and tested on a RedHat Linux release using the 2.6 kernel (2.6.9 to be specific). Readers may use the source code freely, so long as proper credit is attributed; but of course the standard disclaimer must be given first: </para><blockquote>
<para>Although the sample source code is believed to be free of errors, the author makes no guarantees as to its reliability, especially considering that some error paths were intentionally omitted for brevity. Use it at your own risk!</para>
</blockquote><para>When you get right down to it, there really aren't that many differences between IPv4 and IPv6 applications. The trick is to code IPv6 applications in a protocol-independent manner, such that they can handle both IPv4 and IPv6 simultaneously and transparently. This sample application does just that. The only protocol-dependent code in the example occurs when printing network addresses in verbose mode; but only after the ai_family field in the addrinfo structure has been checked, so the programs know exactly what type of address they're handling at the time.</para><sect3>
<title>'Daytime' Server Code</title>
<para>The server code is found in file tod6d.c (time-of-day IPv6 daemon). Once built, the server may be started using the following command syntax (assuming tod6d is the executable file):</para><screen>
<varlistentry><term>service</term><listitem><para>The service (or well-known port) on which to listen. Default is "daytime".</para></listitem></varlistentry></variablelist><para>OPTIONS:</para><variablelist>
<varlistentry><term>-v</term><listitem><para>Turn on verbose mode.</para></listitem></varlistentry></variablelist><para>The server handles both TCP and UDP requests on the network. The server source code contained in tod6d.c follows:</para><screen>
default: /* Can never get here, but for completeness. */
{
fprintf( stderr,
"%s (line %d): ERROR - Unknown address "
"family (%d).\n",
pgmName,
__LINE__,
sadr->sa_family );
break;
} /* End DEFAULT case (unknown address family). */
} /* End SWITCH on address family. */
} /* End IF verbose mode. */
/*
** Send the time-of-day to the client.
*/
wBytes = timeLen;
while ( wBytes > 0 )
{
do
{
count = sendto( desc[ idx ].fd,
timeStr,
wBytes,
0,
sadr, /* Address & address length */
sadrLen ); /* received in recvfrom(). */
} while ( ( count < 0 ) && ( errno == EINTR ) );
CHK( count ); /* Check for a bona fide error. */
wBytes -= count;
} /* End WHILE there is data to send. */
} /* End ELSE a UDP datagram is available. */
desc[ idx ].revents = 0; /* Clear the returned poll events. */
} /* End FOR each socket descriptor. */
} /* End WHILE forever. */
} /* End tod() */
]]></screen></sect3><sect3>
<title>'Daytime' TCP Client Code</title>
<para>The TCP client code is found in file tod6tc.c (time-of-day IPv6 TCP client). Once built, the TCP client may be started using the following command syntax (assuming tod6tc is the executable file):</para><screen>
<varlistentry><term>host</term><listitem><para>The hostname or IP address (dotted decimal or colon-hex) of the remote host providing the service. Default is "localhost".</para></listitem></varlistentry><varlistentry><term>service</term><listitem><para>The TCP service (or well-known port number) to which a connection attempt is made. Default is "daytime".</para></listitem></varlistentry></variablelist><para>OPTIONS:</para><variablelist>
<varlistentry><term>-s</term><listitem><para>This option is only meaningful for IPv6 addresses, and is used to set the scope identifier (i.e. the network interface on which to establish the connection). Default is "eth0". If host is a scoped address, this option is ignored.</para></listitem></varlistentry><varlistentry><term>-v</term><listitem><para>Turn on verbose mode.</para></listitem></varlistentry></variablelist><para>The TCP client source code contained in tod6tc.c follows:</para><screen>
<para>The UDP client code is found in file tod6uc.c (time-of-day IPv6 UDP client). It is almost an exact duplicate of the TCP client (and in fact was derived from it), but is included in this HowTo for completeness. Once built, the UDP client may be started using the following command syntax (assuming tod6uc is the executable file):</para><screen>
<varlistentry><term>host</term><listitem><para>The hostname or IP address (dotted decimal or colon-hex) of the remote host providing the service. Default is "localhost".</para></listitem></varlistentry><varlistentry><term>service</term><listitem><para>The UDP service (or well-known port number) to which datagrams are sent. Default is "daytime".</para></listitem></varlistentry></variablelist><para>OPTIONS:</para><variablelist>
<varlistentry><term>-s</term><listitem><para>This option is only meaningful for IPv6 addresses, and is used to set the scope identifier (i.e. the network interface on which to exchange datagrams). Default is "eth0". If host is a scoped address, this option is ignored.</para></listitem></varlistentry><varlistentry><term>-v</term><listitem><para>Turn on verbose mode.</para></listitem></varlistentry></variablelist><para>The UDP client source code contained in tod6uc.c follows:</para><screen>
<para>Sun Java versions since 1.4 are IPv6 enabled, see e.g. <ulink url="http://java.sun.com/j2se/1.5.0/docs/api/java/net/Inet6Address.html">Inet6Address (1.5/5.0)</ulink> class. Hints are available in the <emphasis>Networking IPv6 User Guide for JDK/JRE</emphasis> <ulink url="http://java.sun.com/j2se/1.4.2/docs/guide/net/ipv6_guide/index.html">1.4</ulink> and <ulink url="http://java.sun.com/j2se/1.5.0/docs/guide/net/ipv6_guide/index.html">1.5 (5.0)</ulink>.</para></sect2><sect2>
<title>Perl</title>
<para>As of May 2007 it's not known that the Perl core itself already supports IPv6. It can be added by using following modules:</para><itemizedlist>
<listitem><para><ulink url="http://search.cpan.org/~umemoto/Socket6/">Socket6</ulink></para></listitem></itemizedlist><para>Anyway, some other modules exist for/with IPv6 support (e.g. Net::IP), search for “IPv6” on <ulink url="http://search.cpan.org/">http://search.cpan.org/</ulink>.</para></sect2></sect1></chapter><chapter id='chapter-interoperability' >
<para>The <ulink url="http://www.tahi.org/">TAHI Project</ulink> checks the interoperability of different operating systems regarding the implementation of IPv6 features. Linux kernel already got the <ulink url="http://www.linux-ipv6.org/v6ready/">IPv6 Ready Logo Phase 1</ulink>. </para></chapter><chapter id='chapter-information' >
<listitem><para>Cisco Self-Study: Implementing IPv6 Networks (IPV6) by Regis Desmeules. Cisco Press; ISBN 1587050862; 500 pages; 1st edition (April 11, 2003).
Note: This item will be published on April 11, 2003.</para></listitem><listitem><para>Configuring IPv6 with Cisco IOS by Sam Brown, Sam Browne, Neal Chen, Robbie Harrell, Edgar, Jr. Parenti (Editor), Eric Knipp (Editor), Paul Fong (Editor)362 pages; Syngress Media Inc; ISBN 1928994849; (July 12, 2002).</para></listitem></itemizedlist></sect3><sect3>
<listitem><para><ulink url="http://www.benedikt-stockebrand.de/books_e.html#ipv6-in-practice">IPv6 in Practice: A Unixer's Guide to the Next Generation Internet</ulink> von Benedikt Stockebrand, November 2006; ISBN 3-540-24524-3</para></listitem><listitem><para><ulink url="http://www.sunny.ch/publications/f_ipv6.htm">IPv6 Essentials</ulink> by Silvia Hagen, 2nd Edition, May 2006; ISBN 0-5961-0058-2
<ulink url="http://www.oreilly.com/catalog/ipv6ess/">ToC, Index, Sample Chapter etc.</ulink>; <ulink url="http://press.oreilly.com/ipv6ess.html">O'Reilly Pressrelease</ulink></para></listitem><listitem><para>IPv6: The New Internet Protocol. By Christian Huitema; Published by Prentice-Hall; ISBN 0138505055.
Description: This book, written by Christian Huitema - a member of the InternetArchitecture Board, gives an excellent description of IPv6, how it differs from IPv4, and the hows and whys of it's development.
Source: <ulink url="http://www.cs.uu.nl/wais/html/na-dir/internet/tcp-ip/resource-list.html">http://www.cs.uu.nl/wais/html/na-dir/internet/tcp-ip/resource-list.html</ulink></para></listitem><listitem><para><ulink url="http://www.epinions.com/book_mu-3402412/display_~full_specs">IPv6 Networks</ulink> by Niles, Kitty; (ISBN 0070248079); 550 pages; Date Published 05/01/1998.</para></listitem><listitem><para>Implementing IPV6. Supporting the Next Generation Internet Protocols by P. E. Miller, Mark A. Miller; Publisher: John Wiley & Sons; ISBN 0764545892; 2nd edition (March 15, 2000); 402 pages.</para></listitem><listitem><para>Big Book of Ipv6 Addressing Rfcs by Peter H. Salus (Compiler), Morgan Kaufmann Publishers, April 2000, 450 pages ISBN 0126167702. </para></listitem><listitem><para><ulink url="http://www.epinions.com/book_mu-3922588/display_~full_specs">Understanding IPV6</ulink> by Davies, Joseph; ISBN 0735612455; Date Published 05/01/2001; Number of Pages: 350.
<ulink url="http://www.microsoft.com/MSPress/books/4883.asp">Understanding IPV6</ulink> by Davies, Joseph; ISBN 0735612455; Date Published 13/11/2002; Number of Pages 544. </para></listitem><listitem><para>Migrating to IPv6 - IPv6 in Practice by Marc Blanchet Publisher: John Wiley & Sons; ISBN 0471498920; 1st edition (November 2002); 368 pages.</para></listitem><listitem><para>Ipv6 Network Programming by Jun-ichiro Hagino; ISBN 1555583180</para></listitem><listitem><para><ulink url="http://www.nwfusion.com/news/2000/1023ipv6.html">Wireless boosting IPv6</ulink> by Carolyn Duffy Marsan, 10/23/2000.</para></listitem><listitem><para><ulink url="http://www.oreillynet.com/search/index.ncsp?sp-q=IPv6">O'reilly Network search for keyword IPv6</ulink> results in 29 hits (28. January 2002)</para></listitem></itemizedlist></sect3></sect2><sect2>
<listitem><para><ulink url="http://www.onlamp.com/pub/a/onlamp/2001/06/01/ipv6_tutorial.html">Getting Connected with 6to4</ulink> by Huber Feyrer, 06/01/2001</para></listitem><listitem><para>Transient Addressing for Related Processes: Improved Firewalling by Using IPv6 and Multiple Addresses per Host; written by Peter M. Gleiz, Steven M. Bellovin (<ulink url="http://www.securiteinfo.com/ebooks/pdf/tarp.pdf">PC-PDF-Version</ulink>; <ulink url="http://www.securiteinfo.com/ebooks/palm/tarp.pdf">Palm-PDF-Version</ulink>; <ulink url="http://www.securiteinfo.com/ebooks/pdb/tarp.pdb">PDB-Version</ulink>)</para></listitem><listitem><para><ulink url="http://www.ip6.com/index.html">Internetworking IPv6 with Cisco Routers</ulink> by Silvano Gai, McGrawHill Italia, 1997. The 13 chapters and appendix A-D are downloadable as PDF-documents.</para></listitem><listitem><para><ulink url="http://www.csc.fi/~psavola/residential.html">Migration and Co-existence of IPv4 and IPv6 in Residential Networks</ulink> by Pekka Savola, CSC/FUNET, 2002</para></listitem></itemizedlist></sect2><sect2 id='information-sciencepublication' >
<para>See following URL for more: <ulink url="http://www.switch.ch/lan/ipv6/references.html">SWITCH IPv6 Pilot / References</ulink></para></sect2></sect1><sect1 id='information-conferences' >
<para>Note: A list of available Tunnel broker can be found in the section <link linkend="information-Tunnelbroker">Tunnel broker</link> below. </para><itemizedlist>
<listitem><para>Former IPng. Tunnelbroker and IPv6 resources, now migrated to the <ulink url="http://www.sixxs.net/main/">SixXs System</ulink>.</para></listitem><listitem><para>Eckes' <ulink url="http://sites.inka.de/lina/linux/ipv6.html">IPv6-with-Linux</ulink> Page.</para></listitem><listitem><para>tunnelc - a perl based tunnel client script:
<listitem><para><ulink url="http://www.estoile.com/links/ipv6">Lot of URLs to others documents</ulink> by Anil Edathara</para></listitem><listitem><para><ulink url="http://www.go6.net/">go6 - The IPv6 Portal</ulink>: an IPv6 online portal with a wiki-based IPv6 knowledge center, an IPv6 discussion forum, an up-to-date collection of IPv6 Events and News, free IPv6 access and services, IPv6 software applications, and much more</para></listitem></itemizedlist></sect2><sect2>
<title>IPv6-related Request For Comments (RFCs)</title>
<para>Publishing the list of IPv6-related RFCs is beyond the scope of this document, but given URLs will lead you to such lists:</para><itemizedlist>
<listitem><para>List sorted by <ulink url="http://playground.sun.com/pub/ipng/html/specs/standards.html">IPng Standardization Status</ulink> or <ulink url="http://playground.sun.com/pub/ipng/html/specs/specifications.html">IPng Current Specifications</ulink> by Robert Hinden</para></listitem><listitem><para><ulink url="http://www.ipv6.org/specs.html">IPv6 Related Specifications</ulink> on IPv6.org</para></listitem></itemizedlist></sect3><sect3>
<title>Current drafts of working groups</title>
<para>Current (also) IPv6-related drafts can be found here:</para><itemizedlist>
<listitem><para><ulink url="http://www.ietf.org/ids.by.wg/ipv6.html">IP Version 6 (ipv6)</ulink></para></listitem><listitem><para><ulink url="http://www.ietf.org/ids.by.wg/ngtrans.html">Next Generation Transition (ngtrans)</ulink></para></listitem><listitem><para><ulink url="http://www.ietf.org/ids.by.wg/dhc.html">Dynamic Host Configuration (dhc)</ulink></para></listitem><listitem><para><ulink url="http://www.ietf.org/ids.by.wg/dnsext.html">Domain Name System Extension (dnsext)</ulink></para></listitem><listitem><para><ulink url="http://www.ietf.org/ids.by.wg/v6ops.html">IPv6 Operations (v6ops)</ulink></para></listitem><listitem><para><ulink url="http://www.ietf.org/ids.by.wg/mobileip.html">Mobile IP (mobileip)</ulink></para></listitem><listitem><para><ulink url="http://playground.sun.com/pub/ipng/html/ipng-main.html">Get any information about IPv6, from overviews, through RFCs & drafts, to implementations</ulink> (including availability of stacks on various platforms & source code for IPv6 stacks) </para></listitem></itemizedlist></sect3><sect3>
<listitem><para><ulink url="http://www.switch.ch/lan/ipv6/references.html">SWITCH IPv6 Pilot / References</ulink>, big list of IPv6 references maintained by Simon Leinen</para></listitem></itemizedlist></sect3></sect2><sect2>
<para><ulink url="http://www.deepspace6.net/sections/links.html">DeepSpace6 / more interesting links</ulink></para><sect3>
<title>Linux related</title>
<itemizedlist>
<listitem><para><ulink url="http://www.deepspace6.net/">DeepSpace6 / (Not only) Linux IPv6 Portal</ulink> - Italy (<ulink url="http://mirrors.bieringer.de/www.deepspace6.net/">Mirror</ulink>)</para></listitem><listitem><para><ulink url="http://www.bieringer.de/linux/IPv6/">IPv6-HowTo for Linux by Peter Bieringer</ulink> - Germany, and his <ulink url="ftp://ftp.bieringer.de/pub/linux/IPv6/">Bieringer / IPv6 - software archive</ulink></para></listitem><listitem><para><ulink url="http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status.html">Linux+IPv6 status by Peter Bieringer</ulink> - Germany (going obsolete)</para></listitem><listitem><para><ulink url="http://www.deepspace6.net/docs/ipv6_status_page_apps.html">DeepSpace6 / IPv6 Status Page</ulink> - Italy (<ulink url="http://mirrors.bieringer.de/www.deepspace6.net/docs/ipv6_status_page_apps.html">Mirror</ulink>) (will superseed upper one)</para></listitem><listitem><para><ulink url="http://www.linux-ipv6.org/">USAGI project</ulink> - Japan, and their <ulink url="ftp://ftp.linux-ipv6.org/pub/">USAGI project - software archive</ulink></para></listitem><listitem><para><ulink url="http://www.tldp.org/HOWTO/OLSR-IPv6-HOWTO/">Linux Optimized Link State Routing Protocol (OLSR) IPv6 HOWTO</ulink></para></listitem></itemizedlist></sect3><sect3>
<varlistentry><term>PLD</term><listitem><para><ulink url="http://www.pld-linux.org/">PLD Linux Distribution</ulink> (“market leader” in containing IPv6 enabled packages)</para></listitem></varlistentry><varlistentry><term>Red Hat</term><listitem><para><ulink url="http://www.redhat.com/">Red Hat Enterprise Linux</ulink>, <ulink url="http://www.netcore.fi/pekkas/linux/ipv6/"> Pekka Savola's IPv6 packages</ulink></para></listitem></varlistentry><varlistentry><term>Fedora</term><listitem><para><ulink url="http://www.fedora.redhat.com/">Fedora Core Linux</ulink></para></listitem></varlistentry><varlistentry><term>Debian</term><listitem><para><ulink url="http://www.debian.org/">Debian Linux</ulink>, <ulink url="http://ipv6.debian.net/">IPv6 with Debian Linux</ulink></para></listitem></varlistentry><varlistentry><term>Novell/SuSE</term><listitem><para><ulink url="http://www.novell.com/linux/suse/">Novell/SuSE Linux</ulink></para></listitem></varlistentry><varlistentry><term>Mandriva</term><listitem><para><ulink url="http://www.mandriva.com/">Mandriva</ulink></para></listitem></varlistentry></variablelist><para>For more see the <ulink url="http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-distributions.html">IPv6+Linux Status Distributions</ulink> page.</para></sect3><sect3>
<listitem><para><ulink url="http://www.ipv6.org/">IPv6.org</ulink></para></listitem><listitem><para><ulink url="http://www.6bone.net/">6bone</ulink></para></listitem><listitem><para><ulink url="http://www.cs-ipv6.lancs.ac.uk/">UK IPv6 Resource Centre</ulink> - UK</para></listitem><listitem><para><ulink url="http://www.v6.wide.ad.jp/">WIDE project</ulink> - Japan</para></listitem><listitem><para><ulink url="http://www.switch.ch/lan/ipv6/">SWITCH IPv6 Pilot</ulink> - Switzerland</para></listitem><listitem><para><ulink url="http://www.feyrer.de/IPv6/">IPv6 Corner of Hubert Feyrer</ulink> - Germany</para></listitem><listitem><para><ulink url="http://www.ipv6forum.com/">IPv6 Forum</ulink> - a world-wide consortium of leading Internet vendors, Research & Education Networks...</para></listitem><listitem><para><ulink url="http://playground.sun.com/pub/ipng/html/ipng-main.html">Playground.sun.com / IPv6 Info Page</ulink> - maintained by Robert Hinden, Nokia. Get any information about IPv6, from overviews, through RFCs & drafts, to implementations (including availability of stacks on various platforms & source code for IPv6 stacks).</para></listitem><listitem><para><ulink url="http://www.6init.com/">6INIT</ulink> - IPv6 Internet Initiative - an EU Fifth Framework Project under the IST Programme.</para></listitem><listitem><para><ulink url="http://www.ipv6-taskforce.org/">IPv6 Task Force (European Union)</ulink></para></listitem><listitem><para><ulink url="http://www.6init.org/">6init</ulink> - IPv6 INternet IniTiative </para></listitem><listitem><para><ulink url="http://www.isoc.org/HMP/PAPER/PT1/html/pt1.html.hinden">IP Next Generation Overview</ulink></para></listitem><listitem><para><ulink url="http://www.usenix.org/publications/library/proceedings/ana97/summaries/deering.html">IPv6: The New Version of the Internet Protocol</ulink>, by Steve Deering.</para></listitem><listitem><para><ulink url="http://www.garykessler.net/library/ipv6_exp.html">IPv6: The Next Generation Internet Protocol</ulink>, by Gary C. Kessler. </para></listitem><listitem><para><ulink url="http://www.3com.com/nsc/ipv6.html">IPv6: Next Generation Internet Protocol</ulink> - 3Com</para></listitem><listitem><para><ulink url="http://www.internet2.org/">internet || site</ulink> and <ulink url="http://ipv6.internet2.edu/">internet2 Working Group</ulink></para></listitem><listitem><para>NetworkWorldFusion: Search / Doc Finder: <ulink url="http://search.nwfusion.com/query.html?qt=IPv6&qp=&ch=cn&">searched for IPv6</ulink> (102 documents found 22.12.2002)</para></listitem><listitem><para><ulink url="http://www.theregister.co.uk/">The Register</ulink> (Search for IPv6 will result in 30 documents, 22.12.2002)</para></listitem><listitem><para><ulink url="http://zdnet.search.com/search?cat=279&q=IPv6">ZDNet Search for IPv6</ulink></para></listitem><listitem><para><ulink url="http://whatis.techtarget.com/wsearchResults/1,290214,sid9,00.html?query=IPv6">TechTarget Search for IPv6</ulink></para></listitem><listitem><para><ulink url="http://www.faqs.org/faqs/internet/tcp-ip/resource-list/index.html">IPv6 & TCP Resources List</ulink></para></listitem></itemizedlist><para>Something missing? Suggestions are welcome!</para></sect3><sect3 id='information-marketresearch' >
<listitem><para><ulink url="http://www.seminarinformation.com/wconnect/wc.dll?sis~details0~307~TSN">A Tale of Two Wireless Technology Trends: Processor Development Outsourcing and IPv6</ulink>Yankee Group - 4/1/2002 - 12 Pages - ID: YANL768881</para></listitem><listitem><para><ulink url="http://www.marketresearch.com/product/display.asp?SID=88602378-241489274-186851952&ProductID=803907">The World Atlas of the Internet: Americas</ulink>; IDATE - 2/1/2002 - 242 PAges - ID: IDT803907. Countries covered: Central America, North America, South America; List: Price: $ 3,500.00; excerpt: Panorama of Internet access markets across the globe. Market assessment and forecasts up to 2006 for 34 countries: market structure: main ISPs and market shares; number of subscribers, of ISPs.</para></listitem><listitem><para>Early Interest Rising for IPv6 by IDC (Author); List Price: $1,500.00; Edition: e-book (Acrobat Reader); Publisher: IDC; ISBN B000065T8E; (March 1, 2002) </para></listitem></itemizedlist></sect3><sect3 id='information-patents' >
<ulink url="http://www.delphion.com/details?pn=US06118784__">Communicating method between IPv4 terminal and IPv6 terminal and IPv4-IPv6 converting apparatus</ulink>
<ulink url="http://www.delphion.com/details?pn=US06038233__">Translator for IP networks, network system using the translator, and IP network coupling method therefor</ulink></para></listitem></itemizedlist></sect3></sect2><sect2>
<title>By countries</title>
<sect3>
<title>Europe</title>
<itemizedlist>
<listitem><para><ulink url="http://www.ist-ipv6.org/">www.ist-ipv6.org</ulink>: IST IPv6 Cluster, European IPv6 Research and Development Projects</para></listitem><listitem><para><ulink url="http://www.euro6ix.org/">Euro6IX</ulink>: European IPv6 Internet Exchanges Backbone</para></listitem></itemizedlist></sect3><sect3>
<title>Austria</title>
<itemizedlist>
<listitem><para><ulink url="http://www.ikn.tuwien.ac.at/~ipv6/">IPv6@IKNnet and MIPv6 Research Group</ulink>: TU Vienna, Austria (IPv6: project, publications, diploma / doctor thesis, Conference Proceedings etc.)</para></listitem></itemizedlist></sect3><sect3>
<title>Australia</title>
<itemizedlist>
<listitem><para><ulink url="http://oversteer.bl.echidna.id.au/IPv6/">Carl's Australian IPv6 Pages</ulink> (old content)</para></listitem></itemizedlist></sect3><sect3>
<listitem><para><ulink url="http://www.rtpro.yamaha.co.jp/RT/ipv6/">Yamaha IPv6</ulink> (sorry, all in japanese native ...)</para></listitem></itemizedlist></sect3><sect3>
<listitem><para><ulink url="http://www.krv6.net/">ETRI</ulink>: Electronics and Telecommunications Research Institut</para></listitem><listitem><para><ulink url="http://www.ipv6.or.kr/english/index.new.htm">IPv6 Forum Korea</ulink>: Korean IPv6 Deployment Project</para></listitem></itemizedlist></sect3><sect3>
<title>Mexico</title>
<itemizedlist>
<listitem><para><ulink url="http://www.ipv6.unam.mx/">IPv6 Mexico</ulink> (spain & english version): IPv6 Project Hompeage of The National Autonomous University of Mexico (UNAM)</para></listitem></itemizedlist></sect3><sect3>
<title>Netherland</title>
<itemizedlist>
<listitem><para><ulink url="http://www.ipv6.surfnet.nl/">SURFnet</ulink>: SURFnet IPv6 Backbone</para></listitem><listitem><para><ulink url="http://www.stack.nl/">STACK</ulink>, <ulink url="http://www.stack.nl/ipv6/">STACK (IPv6)</ulink>: Students' computer association of the Eindhoven University of Technology, Netherland</para></listitem><listitem><para><ulink url="http://www.ipng.nl/">IPng.nl</ulink>: collaboration between WiseGuys and Intouch</para></listitem></itemizedlist></sect3><sect3>
<listitem><para><ulink url="http://www.ipv6.ru/">IPv6 Forum for Russia</ulink>: Yaroslavl State University Internet Center</para></listitem></itemizedlist></sect3><sect3>
<listitem><para>Now that IBM's announced the availability of z/OS V1.4, <ulink url="http://search390.techtarget.com/ateQuestionNResponse/0,289625,sid10_cid486367_tax292523,00.html">what's new in this release?</ulink> This question was posed on 15 August 2002</para></listitem></itemizedlist></sect3><sect3>
<listitem><para><ulink url="http://www.microsoft.com/windows2000/technologies/communications/ipv6/default.asp">Microsoft Windows 2000 IPv6</ulink> </para></listitem><listitem><para><ulink url="http://www.research.microsoft.com/msripv6">MSRIPv6</ulink> - Microsoft Research Network - IPv6 Homepage </para></listitem><listitem><para><ulink url="http://support.microsoft.com/default.aspx?scid=kb;en-us;306203">Internet Connection Firewall Does Not Block Internet Protocol Version 6 Traffic</ulink> (6.11.2001)</para></listitem><listitem><para><ulink url="http://support.microsoft.com/default.aspx?scid=kb;en-us;289892">Internet Protocol Numbers</ulink> (8.10.2002)</para></listitem><listitem><para><ulink url="http://support.microsoft.com/default.aspx?scid=kb;en-us;273826">IPv6 Technology Preview Refresh</ulink> (16.10.2002)</para></listitem><listitem><para><ulink url="http://support.microsoft.com/default.aspx?scid=kb;en-us;325449">HOW TO: Install and Configure IP Version 6 in Windows .NET Enterprise Server</ulink> (26.10.2002)</para></listitem><listitem><para><ulink url="http://support.microsoft.com/default.aspx?scid=kb;en-us;329984">Windows .NET Server 6to4 Router Service Quits When You Advertise a 2002 Address on the Public Interface</ulink> (28.10.2002)</para></listitem><listitem><para><ulink url="http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wcetcpip/htm/cmconIPv6exe.asp">msdn - Microsoft Windows CE .NET - IPv6 commands</ulink></para></listitem></itemizedlist></sect3><sect3>
<listitem><para><ulink url="http://playground.sun.com/pub/ipng/html/ipng-implementations.html#Sumitomo">Sumitomo Electric has implemented IPv6 on Suminet 3700 family routers</ulink></para></listitem></itemizedlist></sect3><sect3>
<listitem><para>Internet Security Systems: Security Center, <ulink url="http://www.iss.net/security_center/search.php?type=3&type=3&pattern=IPv6">X-Force Database Search</ulink> (21.12.2002 - 6 topics found relating to IPv6)</para></listitem><listitem><para><ulink url="http://csrc.nist.gov/ipsec/">NIST IPsec Project</ulink> ( National Institute of Standards and Technology, NIST)</para></listitem><listitem><para><ulink url="http://www.infosecuritymag.com/index.shtml">Information Security</ulink></para></listitem><listitem><para><ulink url="http://neworder.box.sk/search.php3?srch=IPv6">NewOrder.box.sk (search for IPv6)</ulink> (Articles, exploits, files database etc.) </para></listitem></itemizedlist></sect2><sect2>
<listitem><para><ulink url="http://www.wireshark.org/">Wireshark</ulink> (former known as <emphasis>Ethereal</emphasis>) is a free network protocol analyzer for Unix and Windows</para></listitem><listitem><para><ulink url="http://www.ip6.com/us/analyzer.htm">Radcom RC100-WL</ulink> - Download Radcom RC100-WL protocol analyzer version 3.20</para></listitem></itemizedlist></sect3><sect3>
<listitem><para><ulink url="http://www.6wind.com/">6wind</ulink> - solutions for IPv4/IPv6 Router, QoS, Multicast, Mobility, Security/VPN/Firewall. </para></listitem><listitem><para><ulink url="http://www.fefe.de/dns/">Fefe's patches for IPv6 with djbdns</ulink>Aug 2002 -- What is djbdns and why does it need IPv6? djbdns is a full blown DNS server which outperforms BIND in nearly all respects.</para></listitem><listitem><para><ulink url="http://www.ipinfusion.com/products/server/products_server.html">ZebOS Server Routing Suite </ulink></para></listitem><listitem><para><ulink url="http://download.com.com/3000-2165-10153543.html?tag=lst-0-21">SPA Mail Server 2.21 </ulink></para></listitem><listitem><para><ulink url="http://download.com.com/3000-2165-8202652.html?tag=lst-0-2">Inframail (Advantage Server Edition) 6.0 </ulink></para></listitem><listitem><para><ulink url="http://download.com.com/3000-2377-10149393.html?tag=lst-0-1">HTTrack Website Copier</ulink></para></listitem><listitem><para><ulink url="http://download.com.com/3000-2085-10132748.html?tag=lst-0-1">CommView 5.0</ulink></para></listitem><listitem><para><ulink url="http://download.com.com/3000-2104-10149750.html?tag=lst-0-1">Posadis 0.50.6</ulink></para></listitem></itemizedlist></sect3><sect3 id='information-snmp' >
<listitem><para><ulink url="http://www.cs.uu.nl/wais/html/na-dir/snmp-faq/part1.html">comp.protocpols.snmp SNMP FAQ Part 1 of 2</ulink></para></listitem></itemizedlist></sect3></sect2></sect1><sect1>
<listitem><para><ulink url="http://www.space.net/~gert/RIPE/">IPv6 routing table history</ulink> created by Gert D<>ring, <ulink url="http://www.space.net/">Space.Net</ulink></para></listitem><listitem><para><ulink url="http://6bone.informatik.uni-leipzig.de/ipv6/stats/stats.php3">Official 6bone Webserver list Statisic</ulink></para></listitem></itemizedlist></sect2><sect2>
<para>Another list of IPv6 Internet Exchanges can be found here: <ulink url="http://www.euro-ix.net/isp/choosing/search/matrix.php">IPv6 status of IXPs in Europe</ulink></para><sect3 id='information-ipv6exchanges-estonia' >
<listitem><para><ulink url="http://tix.estpak.ee/">TIX</ulink> (tallinn interneti exchange with ipv6 support)</para></listitem></itemizedlist></sect3><sect3 id='information-ipv6exchanges-europe' >
<listitem><para><ulink url="http://www.euro6ix.net/">Euro6IX</ulink>, European IPv6 Internet Exchange Backbone</para></listitem></itemizedlist></sect3><sect3 id='information-ipv6exchanges-france' >
FNIX6 provides a free and reliable high speed FastEthernet interconnection between ISP located in TeleCity Paris.</para></listitem></itemizedlist></sect3><sect3 id='information-ipv6exchanges-germany' >
<listitem><para><ulink url="http://www.inxs.de/">INXS</ulink>: (Cable & Wireless) Munich and Hamburg</para></listitem></itemizedlist></sect3><sect3 id='information-ipv6exchanges-japan' >
<listitem><para><ulink url="http://www.ipng.nl/">IPng Netherland</ulink> - Intouch, SurfNet, AMS-IX, UUNet, Cistron, RIPE NCC and AT&T are connected at the AMS-IX. It is possible (there are requirements...) to get an static tunnel.</para></listitem><listitem><para><ulink url="http://www.ipv6.surfnet.nl/">SURFnet Customers</ulink></para></listitem></itemizedlist></sect3><sect3 id='information-tunnelbroker-norway' >
<listitem><para><ulink url="http://www.uninett.no/testnett/index.en.html">UNINETT</ulink> - Pilot IPv6 Service (for Customers): tunnelbroker & address allocation
<listitem><para><ulink url="http://www.nttv6.net/">NTT</ulink>, United Kingdom - IPv6 Trial. IPv4 Tunnel and native IPv6 leased Line connections. POPs are located in London, UK Dusseldorf, Germany New Jersey, USA (East Coast) Cupertino, USA (West Coast) Tokyo, Japan</para></listitem></itemizedlist></sect3><sect3 id='information-tunnelbroker-usa' >
<listitem><para><ulink url="http://www.es.net/hypertext/welcome/pr/ipv6.html">ESnet</ulink>, USA - Energy Sciences Network: Tunnel Registry & Address Delegation for directly connected ESnet sites and ESnet collaborators.</para></listitem><listitem><para><ulink url="http://ipv6tb.he.net/">Hurricane Electric</ulink>, US backbone;
<ulink url="http://tunnelbroker.net/">Hurrican Electric Tunnelbroker</ulink> (also available under <ulink url="http://tunnelbroker.com/">http://tunnelbroker.com/</ulink>)
Press Release: <ulink url="http://www.he.net/releases/release6.html">Hurricane Electric Upgrades IPv6 Tunnel Broker</ulink>
<listitem><para><ulink url="http://www.ipv6.bieringer.de/">Peter Bieringer's Home of Linux IPv6 HOWTO </ulink></para></listitem></itemizedlist><para>Something missing? Suggestions are welcome!</para></sect3></sect2></sect1><sect1 id='information-maillists' >
<para>Lists of maillists are available at:</para><itemizedlist>
<listitem><para><ulink url="http://www.deepspace6.net/sections/lists.html">DeepSpace6 / Mailling Lists</ulink></para></listitem></itemizedlist><para>Major Mailinglists are listed in following table:</para>
Description: This is the group for the Student Awareness group of IPv6 in India</para></listitem><listitem><para><ulink url="http://groups.yahoo.com/group/sun-ipv6-users">sun-ipv6-users</ulink>
Description: This List will co-ordinate the working of Project Vertebrae.</para></listitem><listitem><para><ulink url="http://groups.yahoo.com/group/linux-bangalore-ipv6">linux-bangalore-ipv6</ulink>
Description: The IPv6 deployment list of the Bangalore Linux User Group</para></listitem><listitem><para><ulink url="http://groups.yahoo.com/group/packet-switching">packet-switching</ulink>
Description: This mailing list provides a forum for discussion of packet switching theory, technology, implementation and application in any relevant aspect including without limitation LAPB, X.25, SDLC, P802.1d, LLC, IP, IPv6, IPX, DECNET, APPLETALK, FR, PPP, IP Telephony, LAN PBX systems, management protocols like SNMP, e-mail, network transparent window systems, protocol implementation, protocol verification, conformance testing and tools used in maintaining or developing packet switching systems.</para></listitem><listitem><para>de.comm.protocols.tcp-ip
<listitem><para>ping, traceroute, tracepath, 6bone registry, DNS: <ulink url="http://www.join.uni-muenster.de/lab/testtools.html">JOIN / Testtools</ulink> (German language only, but should be no problem for non German speakers)</para></listitem><listitem><para>traceroute6, whois: <ulink url="http://www.ipng.nl/">IPng.nl</ulink></para></listitem><listitem><para>AAAA Lookup Checker <ulink url="http://www.cnri.dit.ie/cgi-bin/check_aaaa.pl">http://www.cnri.dit.ie/cgi-bin/check_aaaa.pl</ulink></para></listitem></itemizedlist></sect2><sect2>
<listitem><para><ulink url="http://www.ripe.net/ripencc/mem-services/registration/ipv6/ipv6allocs.html">List of worldwide all IPv6-aggregated IP-Blocks</ulink></para></listitem></itemizedlist></sect2><sect2>
<para>Versions x.y are published on the Internet.</para>
<para>Versions x.y.z are work-in-progress and published as LyX and SGML file on CVS. Because Deep Space 6 mirrors these SGML files and generate independend from TLDP public versions, this versions will show up there and also on its mirrors.</para><sect2>
<varlistentry><term>0.62</term><listitem><para>2008-11-09/PB: Adjust URL to Turkish howto, add some HIP related URLs, remove broken URLs</para></listitem></varlistentry><varlistentry><term>0.61.1</term><listitem><para>2007-11-11/PB: fix broken description of shortcut BIND</para></listitem></varlistentry><varlistentry><term>0.61</term><listitem><para>2007-10-06/PB: fix broken URLs to TLDP-CVS, minor URL update.</para></listitem></varlistentry><varlistentry><term>0.60.2</term><listitem><para>2007-10-03/PB: fix description of sysctl/autoconf (credits to Francois-Xavier Le Bail)</para></listitem></varlistentry><varlistentry><term>0.60.1</term><listitem><para>2007-06-16/PB: speling fixes (credits to Larry W. Burton)</para></listitem></varlistentry><varlistentry><term>0.60</term><listitem><para>2007-05-29/PB: import major contribution to Programming using C-API written by John Wenker, minor fixes</para></listitem></varlistentry><varlistentry><term>0.52</term><listitem><para>2007-05-23/PB: update firewalling chapter, improve document for proper SGML validation, minor bugfixes</para></listitem></varlistentry><varlistentry><term>0.51</term><listitem><para>2006-11-08/PB: remove broken URLs, add a new book (credits to Bryan Vukich)</para></listitem></varlistentry><varlistentry><term>0.50.2</term><listitem><para>2006-10-25/PB: fix typo in dhcp6 section (credits to Michele Ferritto)</para></listitem></varlistentry><varlistentry><term>0.50.1</term><listitem><para>2006-09-23/PB: add some URLs</para></listitem></varlistentry><varlistentry><term>0.50</term><listitem><para>2006-08-24/PB: check RFC URLs, fix URL to Chinese translation, finalize for publishing</para></listitem></varlistentry><varlistentry><term>0.49.5</term><listitem><para>2006-08-23/PB: fix/remove broken URLs</para></listitem></varlistentry><varlistentry><term>0.49.4</term><listitem><para>2006-08-21/PB: some review, update and enhancement of the content, replace old 6bone example addresses with the current defined ones.</para></listitem></varlistentry><varlistentry><term>0.49.3</term><listitem><para>2006-08-20/PB: fix bug in maillist entries, 'mobility' is now a separate chapter</para></listitem></varlistentry><varlistentry><term>0.49.2</term><listitem><para>2006-08-20/PB: update and cleanup of maillist entries</para></listitem></varlistentry><varlistentry><term>0.49.1</term><listitem><para>2006-06-13/PB: major update of mobility section (contributed by Benjamin Thery)</para></listitem></varlistentry><varlistentry><term>0.49</term><listitem><para>2005-10-03/PB: add configuration hints for DHCPv6, major broken URL cleanup (credits to Necdet Yucel)</para></listitem></varlistentry><varlistentry><term>0.48.1</term><listitem><para>2005-01-15/PB: minor fixes</para></listitem></varlistentry><varlistentry><term>0.48</term><listitem><para>2005-01-11/PB: grammar check and minor review of IPv6 IPsec section</para></listitem></varlistentry><varlistentry><term>0.47.1</term><listitem><para>2005-01-01/PB: add information and examples about IPv6 IPsec, add some URLs</para></listitem></varlistentry><varlistentry><term>0.47</term><listitem><para>2004-08-30/PB: add some notes about proftpd, vsftpd and other daemons, add some URLs, minor fixes, update status of Spanish translation</para></listitem></varlistentry><varlistentry><term>0.46.4</term><listitem><para>2004-07-19/PB: minor fixes</para></listitem></varlistentry><varlistentry><term>0.46.3</term><listitem><para>2004-06-23/PB: add note about started Greek translation, replace Taiwanese with Chinese for related translation</para></listitem></varlistentry><varlistentry><term>0.46.2</term><listitem><para>2004-05-22/PB: minor fixes</para></listitem></varlistentry><varlistentry><term>0.46.1</term><listitem><para>2004-04-18/PB: minor fixes</para></listitem></varlistentry><varlistentry><term>0.46</term><listitem><para>2004-03-04/PB: announce Italian translation, add information about DHCPv6, minor updates</para></listitem></varlistentry><varlistentry><term>0.45.1</term><listitem><para>2004-01-12/PB: add note about the official example address s
<para>If you want to do a major review, you can use the native LyX file (see <link linkend="general-original-source">original source</link>) and send diffs against it, because diffs against SGML don't help too much.</para><sect2 id='major-credits' >
<listitem><para>David Ranch <dranch at trinnet dot net>: For encouraging me to write this HOWTO, his editorial comments on the first few revisions, and his contributions to various IPv6 testing results on my IPv6 web site. Also for his major reviews and suggestions.</para></listitem><listitem><para>Pekka Savola <pekkas at netcore dot fi>: For major reviews, input and suggestions.</para></listitem><listitem><para>Martin F. Krafft <madduck at madduck dot net>: For grammar checks and general reviewing of the document.</para></listitem><listitem><para>John Ronan <j0n at tssg dot wit dot ie>: For grammar checks.</para></listitem><listitem><para>Georg K<>fer <gkaefer at gmx dot at>: For detection of no proper PDF creation (fixed now by LDP maintainer Greg Ferguson), input for German books, big list of URLs, checking all URLs, many more suggestions, corrections and contributions, and the German translation</para></listitem><listitem><para>Michel Boucey <mboucey at free dot fr>: Finding typos and some broken URLs, contribute some suggestions and URLs, and the French translation</para></listitem><listitem><para>Michele Ferritto <m dot ferritto at virgilio dot it>: Finding bugs and the Italian translation</para></listitem><listitem><para>Daniel Roesen <dr at cluenet dot de>: For grammar checks</para></listitem><listitem><para>Benjamin Thery <benjamin dot thery at bull dot net>: For contribution of updated mobility section</para></listitem><listitem><para>John Wenker <jjw at pt dot com>: major contribution to Programming using C-API</para></listitem></itemizedlist></sect2><sect2>
<para>Writing a LDP HOWTO as a newbie (in LyX and exporting this to DocBook to conform to SGML) isn't as easy as some people say. There are some strange pitfalls... Nevertheless, thanks to:</para><itemizedlist>
<listitem><para>Authors of the <ulink url="http://www.tldp.org/LDP/LDP-Author-Guide/">LDP Author Guide</ulink></para></listitem><listitem><para>B. Guillon: For his <ulink url="http://perso.libertysurf.fr/bgu/doc/db4lyx/">DocBook with LyX HOWTO</ulink></para></listitem></itemizedlist></sect3><sect3 id='content-related-credits' >
<listitem><para>S .P. Meenakshi <meena at cs dot iitm dot ernet dot in>: For a hint using a “send mail” shell program on tcp_wrapper/hosts.deny</para></listitem><listitem><para>Frank Dinies <FrankDinies at web dot de>: For a bugfix on IPv6 address explanation</para></listitem><listitem><para>John Freed <jfreed at linux-mag dot com>: For finding a bug in IPv6 multicast address explanation</para></listitem><listitem><para>Craig Rodrigues <crodrigu at bbn dot com>: For suggestion about RHL IPv6 setup</para></listitem><listitem><para>Fyodor <fyodor at insecure dot org>: Note me about outdated nmap information</para></listitem><listitem><para>Mauro Tortonesi <mauro at deepspace6 dot net>: For some suggestions</para></listitem><listitem><para>Tom Goodale <goodale at aei-potsdam dot mpg dot de>: For some suggestions</para></listitem><listitem><para>Martin Luemkemann <mluemkem at techfak dot uni-bielefeld dot de>: For a suggestion</para></listitem><listitem><para>Jean-Marc V. Liotier <jim at jipo dot com>: Finding a bug</para></listitem><listitem><para>Yaniv Kaul <ykaul at checkpoint dot com>: Finding a bug</para></listitem><listitem><para>Arnout Engelen <arnouten at bzzt dot net>: For sending note about a draft was adopted to RFC now</para></listitem><listitem><para>Stephane Bortzmeyer <bortzmeyer at nic dot fr>: Contributing persistent configuration on Debian</para></listitem><listitem><para>lithis von saturnsys <lithis at saturnsys dot com>: Reporting a misaddressed URL</para></listitem><listitem><para>Guy Hulbert <gwhulbert at rogers dot com>: Send a note that RFC1924 is probably an April fool's joke</para></listitem><listitem><para>Tero Pelander <tpeland at tkukoulu dot fi>: Reporting a broken URL</para></listitem><listitem><para>Walter Jontofsohn <wjontof at gmx dot de>: Hints for SuSE Linux 8.0/8.1</para></listitem><listitem><para>Benjamin Hofstetter <benjamin dot hofstetter at netlabs dot org>: Reporting a mispointing URL</para></listitem><listitem><para>J.P. Larocque <piranha at ely dot ath dot cx>: Reporting archive URL for maillist users at ipv6 dot org</para></listitem><listitem><para>Jorrit Kronjee <jorrit at wafel dot org>: Reporting broken URLs</para></listitem><listitem><para>Colm MacCarthaigh <colm dot maccarthaigh at heanet dot ie>: Hint for sendfile issue on Apache2</para></listitem><listitem><para>Tiago Camilo <tandre at ipg dot pt>: Contribute some URLs about Mobile IPv6</para></listitem><listitem><para>Harald Geiger: Reporting a bug in how described the bit counting of the universal/global bit</para></listitem><listitem><para>Bjoern Jacke <bjoern at j3e dot de>: Triggered me to fix some outdated information on xinetd</para></listitem><listitem><para>Christoph Egger <cegger at chrrr dot com>: Sending note about “ip” has problems with IPv4-compatible addresses on SuSE Linux 9.0 and trigger to add a hint on 6to4-radvd example</para></listitem><listitem><para>David Lee Haw Ling <hawling at singnet dot com dot sg>: Sending information about a tunnel broker</para></listitem><listitem><para>Michael H. Warfield <mhw at iss dot net>: Sending note about suffix for 6to4 routers</para></listitem><listitem><para>Tomasz Mrugalski <thomson at klub dot com dot pl>: Sending updates for DHCPv6 section</para></listitem><listitem><para>Jan Minar <jjminar at fastmail dot fm>: Reporting minor bugs</para></listitem><listitem><para>Kalin KOZHUHAROV <kalin at tar dot bz>: Fixing a not so well explanation</para></listitem><listitem><para>Roel van Dijk <rdvdijk at planet dot nl>: Reporting broken URLs</para></listitem><listitem><para>Catalin Muresan <catalin dot muresan at astral dot ro>: Reporting minor bugs</para></listitem><listitem><para>Dennis van Dok <dvandok at quicknet dot nl>: Reporting minor bugs</para></listitem><listitem><para>Necdet Yucel <nyucel at comu dot edu dot tr>: Reporting broken URLs</para></listite
<para>If you have any questions, subscribe to proper <link linkend="information-maillists">maillist</link> and describe your problem providing as much as information as possible.</para></sect1></chapter></book>