IPv6 Day

[Snowhog]

BTW, this URL: http://v6.testmyipv6.com/ipv6_prefixes.html reveals some very interesting capabilities of your IPv6 connection.

From their http://v6.testmyipv6.com/ and clicking on the IPv6-only Test link, I get:

Congratulations, you have connected to a server that will display your method of connectivity, either IPv6 (preferred) or IPv4 (old and crusty). This page is fairly plain and non-flashy for a reason -- decreased bandwidth for testing applications and devices that are using limited-bandwidth connectivity and/or limited support for advanced HTML/XHTML features.

Excellent! You are successfully using IPv6 to connect to this server! Your IPv6 address is 2001:0:53aa:64c:3813:52b9:b7dc:9d94.

But clicking on the Dual-Stack (IPv6 & IPv4) Test I get:

You are connecting to this server via IPv4, your address being 72.35.98.107. It's time to step up to IPv6! If you can't get native IPv6 transport from your ISP, please check into using a tunnel broker. Click here to find a list of tunnel brokers.

f your browser is able to connect to the IPv6-only Test, yet using the Dual-Stack Test returns a page with a red box stating that you are using IPv4, then your browser and/or IP stack in your machine are preferring IPv4 over IPv6, which is undesired/broken behavior.

The Dual-Stack Test is meant to test whether your client is choosing IPv6 over IPv4 when making a connection to the server since it is known on the Internet with both IPv6 and IPv4 addresses. The proper behavior of your client, assuming that the IPv6-only test works for you, is that the Dual-Stack Test would have an identical result to the IPv6-only test and confirming that you are preferring IPv6 over IPv4 when connecting to a dual-stack destination. If the result is a page with a red box stating that you are using IPv4, then your browser and/or IP stack are preferring IPv4 over IPv6, which is undesired/broken behavior.

Okay, so I can connect via IPv6 or IPv4, but my client (Chromium ?) is using IPv4 over IPv6. Is this something I can change?

Found this, but I would like an "expert" opinion on what it will actually do: Configure your Ubuntu box as a IPv6 router

[Teunis]

This is what it looks like when like me on native ipv6:


When both protocols are available, your browser uses
IPv6

Your internet connection is IPv6 capable
2001:980:5615:1:98ec:edd3:7c1b:2e53
XS4ALL Networking

Address type isGlobal Unicast / Native IPv6


Your internet connection is IPv4 capable
83.163.250.221
a83-163-250-221.adsl.xs4all.nlDemon-int


http://test-ipv6.com/ is at the moment down so I can't show any other info.

I've got ipv6 because my provider (xs4all.nl) is dual stack and my Fritz!box 7340 modem can handle it as well.
Originally I set a bunch of bookmarks to ipv6 enabled sites like http://ipv6.cnn.com/ but as I use a laptop that becomes a nuisance when travelling

For those interested in a decent binaries news server you can still access newszilla6.xs4all.nl for free.:cool:

[vinnywright]

@GreyGeek
yes mine is erratic as well but stays close to the IPv4 results ...........laughably slow at around 118-114 Kbytes/s (cheapest windstream $35.00 a month)

VINNY

[GreyGeek]

I spoke too soon. I ran the speed test again and got these results:

IPv4
Earthlink
24.223.250.93

9.53 Mbit/s
1.19 Mbytes/s



IPv6
Your.org
2001:4978:f:580::2

11.1 Mbit/s
1.39 Mbytes/s

IPv6 won in this test, so it's speed seems to be highly variable.

[GreyGeek]

The speed test on the second test URL you listed, VINNY (the bar graph didn't copy):

Your speed test results
IPv4

Earthlink
24.223.250.93

11.8 Mbit/s
1.47 Mbytes/s



IPv6
Your.org
2001:4978:f:580::2

3.92 Mbit/s
502 Kbytes/s

I repeated the test several times and the best speed I got was slightly less than my IPv4 speed.

[GreyGeek]

I think that's what the tcp6 means, VINNY.

Here's the technical output of that test on my box:

Test with IPv4 DNS record		ok (0.894s) using ipv4
Test with IPv6 DNS record		ok (0.851s) using ipv6 uschi02.sixxs.net yourorg
Test with Dual Stack DNS record		ok (0.836s) using ipv6 uschi02.sixxs.net yourorg
Test for Dual Stack DNS and large packet		ok (0.729s) using ipv6 uschi02.sixxs.net yourorg
Test IPv4 without DNS		ok (0.229s) using ipv4
Test IPv6 without DNS		timeout (15.014s)
Test IPv6 large packet		ok (0.777s) using ipv6 uschi02.sixxs.net yourorg
Test if your ISP's DNS server uses IPv6		bad (1.980s)

It gave me a 9/10.

The other test gave me:

When both protocols are available, your browser usesIPv6

Your internet connection is IPv6 capable
2001:4978:f:580::2
cl-1409.chi-02.us.sixxs.netYour.org

Address type isGlobal Unicast / Native IPv6


Your internet connection is IPv4 capable
24.223.250.93
user-0cdvuit.cable.mindspring.comEarthlink

The last test gave me:

Excellent! You are successfully using IPv6 to connect to this server! Your IPv6 address is 2001:4978:f:580::2.

The ::2 address is the PoP SixXS supplied to me. My IPv6 IP is the same address except that it ends in ::1.

So, the thing I need to do is grab a hold of some IPv6 DNS numbers.


BTW, this URL: http://v6.testmyipv6.com/ipv6_prefixes.html reveals some very interesting capabilities of your IPv6 connection.

[vinnywright]

Well, VINNY, I got my SixXS tunnel set up awhile ago and have been playing with it.


The big question is how reliable and fast is SixXS compared to teredo-debian.remlab.net (an alias for teredo.remlab.net), which miredo uses?

wow sounds like a pain compared to miredo.
are their any advantages to using SixXS over miredo?

incidentally I cant ping either my IPv4 or my IPv6 address

but I guess the IPv6 is working as I get this as soon as I start firefox

vinny@Vinnys-HP-G62:~$ sudo netstat -tuanp
[sudo] password for vinny:
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 855/rpcbind
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 3475/dnsmasq
tcp 0 0 0.0.0.0:36789 0.0.0.0:* LISTEN 1027/rpc.statd
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1241/cupsd
tcp 0 0 127.0.0.1:2628 0.0.0.0:* LISTEN 1257/0
tcp 0 0 192.168.2.3:58661 199.7.52.72:80 TIME_WAIT -
tcp 0 0 192.168.2.3:44825 173.255.193.141:80 TIME_WAIT -
tcp 0 0 192.168.2.3:46493 74.125.137.17:443 TIME_WAIT -
tcp6 0 0 :::111 :::* LISTEN 855/rpcbind
tcp6 0 0 ::1:631 :::* LISTEN 1241/cupsd
tcp6 0 0 :::53504 :::* LISTEN 1027/rpc.statd
tcp6 0 0 2001:0:53aa:64c:3:50008 2607:f8b0:4002:802::443 ESTABLISHED 9305/firefox
udp 0 0 127.0.0.1:53 0.0.0.0:* 3475/dnsmasq
udp 0 0 0.0.0.0:68 0.0.0.0:* 3471/dhclient
udp 0 0 0.0.0.0:111 0.0.0.0:* 855/rpcbind
udp 0 0 0.0.0.0:45329 0.0.0.0:* 1278/avahi-daemon:
udp 0 0 0.0.0.0:45382 0.0.0.0:* 1027/rpc.statd
udp 0 0 0.0.0.0:603 0.0.0.0:* 855/rpcbind
udp 0 0 127.0.0.1:779 0.0.0.0:* 1027/rpc.statd
udp 0 0 0.0.0.0:5353 0.0.0.0:* 1278/avahi-daemon:
udp 0 0 0.0.0.0:44424 0.0.0.0:* 3580/miredo
udp6 0 0 :::111 :::* 855/rpcbind
udp6 0 0 :::59545 :::* 1278/avahi-daemon:
udp6 0 0 :::45301 :::* 1027/rpc.statd
udp6 0 0 :::603 :::* 855/rpcbind
udp6 0 0 :::5353 :::* 1278/avahi-daemon:

the tcp6 line with firefox in it means it's an IPv6 connection .......doesn't it?

O and I am on wireless...............

VINNY

O 1 more incidentally this test http://test-ipv6.com/ gives me 7/10 on both IPv4 &IPv6
this one gives me a IPv6 prefer d by your browser http://ipv6-test.com/
and this one gives me an excellent http://ds.testmyipv6.com/
Excellent!

Excellent!

Excellent!

[GreyGeek]

Well, VINNY, I got my SixXS tunnel set up awhile ago and have been playing with it.

The test gives me the same readings, 9/10. I suspect that I don't have a 10 because I don't have an IPv6 DNS sets.


Setting up the SixXS tunnel requires:
1) Create an account. They require complete name and address info and a reason why you want a tunnel. After you submit your application you wait until you get an email from them. It will either be a rejection, or it will contain your account name and password.

2) If accepted, you are given a URL to go to where you select your PoP. Any PoP you select MUST give you an access time of under 100ms. Mine pinged out at 28ms. Then you apply for a tunnel for the PoP you selected, also stating why you selected it. I said it was closest to my home town and it pinged well under 100ms.

3) IF your tunnel request is accepted then open Muon and install "aiccu". During installation the aiccu package will ask for your SixXS account name and password. After you enter those two items the package sets up your IPv6 tap. It will have a label of "sixxs".

That's it. Works just like the miredo package except you don't have to go through the application process. There is another thing with SixXS, ISK. These are "credits" which are explained here: https://www.sixxs.net/faq/account/?faq=credits

...
When the credit count is 15 ISK or lower, you will not be able to request new tunnels, subnets or NS entries. This is the so called lower credit threshold/boundary. Note that users with very low credits will automatically be disabled by our robot.
...

My initial credit setting was 10 ISK, so I cannot ask for a subnet or another tunnel, not that I'd need one. But, on the other hand, since I have a dynamic tunnel type I can't loose credits.

Dynamic Tunnels

As dynamic (AYIYA and heartbeat) tunnels won't be up all the time it will only receive a 5 ISK bonus after it has been created for one week. After that uptime credits will be given every two weeks when the tunnel is alive.


One can't lose any credits with a dynamic tunnel but the tunnel must be up if you want to receive credits.
Cost Table

The current default cost table is:

Action		Cost
Adding a reverse DNS server	debits	1
Approving a subnet request	debits	4
Approving a tunnel request	debits	5
Deleting a subnet	debits	50
Deletion of a tunnel	debits	25
Moving a tunnel's endpoint / Change Tunnel Type	debits	15
Removing a reverse DNS server	debits	1
Requesting a subnet	debits	10
Requesting a tunnel	debits	10
Static tunnel IPv6 endpoint didn't ping for a day	debits	5
Static tunnel IPv6 endpoint didn't ping for a week (autodisable)	debits	50
The host pinged yet another week	credits	5

The "must be up" phrase means that it must respond to a ping.

SixXS IPv6 : 2001:yourtunnel::1/64
Your IPv6 : 2001:yourtunnel::2/64

You can ping6 the PoP tunnel: "ping6 2001:yourtunnel::1" and if you get a packet listing their end of your tunnel is working.

My approval email listed my tunnel type as "Tunnel Type: Dynamic (ayiya)", which means that I can't loose credits for not being up 100% of the time. BUT, you must use NTP timing to maintain your system time at difference of less than 120 seconds from atomic time or your connection attempt will be refused.

For wireless router users SixXS is somewhat of a pain, having to get approval twice (and explaining your reasons why), but once you get your second email notifying you that your tunnel has been set up, then you can install aiccu and fill in your account id and password. After that it appears to behave exactly like miredo and gives the same test scores to me. The tunnel server for miredo is also free and the miredo process is entirely transparent. No id or password is necessary. From my Chromium point of view the performances are the same.

The big question is how reliable and fast is SixXS compared to teredo-debian.remlab.net (an alias for teredo.remlab.net), which miredo uses?

[GreyGeek]

mmm... looks like your IPv6 connection is filtered, VINNY!

[vinnywright]

@GreyGeek all editing the /etc/gai.config dose is get your addresses sorted to prefer IPv6 ....I think!!

I did some nmaping on my IP and THINK I'm ok even without ufw but I would like someone that knows better than me to chime in hear ........like @SteveRiley (you are a security man arnt ya )

hear are the scans I ran

vinny@Vinnys-HP-G62:~$ nmap -A -P0 209.102.243.176

Starting Nmap 5.21 ( http://nmap.org ) at 2012-06-08 14:35 EDT
Nmap scan report for docsis-cbm-4-176.nclxtn.lexcominc.net (209.102.243.176)
Host is up.
All 1000 scanned ports on docsis-cbm-4-176.nclxtn.lexcominc.net (209.102.243.176) are filtered

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 201.72 seconds

and the IPv6

vinny@Vinnys-HP-G62:~$ nmap -A -P0 -6 2001:0:53aa:64c:1c7d:560e:2e99:c4f

Starting Nmap 5.21 ( http://nmap.org ) at 2012-06-08 14:40 EDT
Nmap scan report for 2001:0:53aa:64c:1c7d:560e:2e99:c4f
Host is up (1.00s latency).
All 1000 scanned ports on 2001:0:53aa:64c:1c7d:560e:2e99:c4f are filtered

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 30.32 seconds

VINNY

[GreyGeek]

Well, this time, I only installed miredo. It gave me this IPv6 address:
2001:0:53aa:64c:2891:59a0:e720:5a2
and my previous miredo setup gave me this:
2001:0:53aa:64c:20e4:4586:e720:5a2

The differences are highlighted. The prefix and suffix are the same. I'm going to search for what they mean.

Anyway, to summarize:

All I needed to do to get a semblance of IPv6 capability is to install miredo. That's it.
Modprobing ip6tables just produced browser hangs. Miredo itself didn't install any ipv6 kernel modules.
Changing /etc/gai.conf didn't seem to affect anything that I could notice.
Turning on the ufw and enabling IPv6 in it didn't appear to do anything either, but that's may be because it always works in the background.
Miredo uses a tunnel server at 83.170.6.76.

Miredo can be turned off using "sudo miredo stop" and turned on using "sudo miredo start".

[GreyGeek]

Disaster! :eek:

I booted up this morning, anticipating a smooth login. What happened instead is that I got the KDE log in recycle.
It seems that something in my ~/.kde folder was corrupted. Checking the logs I saw an HD bad block error. Don't know if that was the culprit or if it was something I did yesterday re-installing miredo to work with VINNY and compare notes.

So, I booted into the recovery mode with a network connection and disabled ufw, commented out "IPV6=yes", reversed the gai.conf settings, and uninstalled miredo. I renamed ~/.kde to ~/.kde_old and rebooted.

I was presented with a very nice panel and system tray. In fact, much nicer than the one I had been carrying along since I installed Precise Alpha on Jan 3rd of this year. It took about 15 minutes to restore a semblance of what I had before. In fact, it looks better. I never installed the yaWP weather app in the system tray before, and it looks nice there, but I think I'll move it back out onto the desktop to keep the system tray more tidy. Then I'll reinstall miredo and see what happens when I don't do anything else but that.

P.S. -- On a whim I decided to check my desktop settings. Effects were still active. On the advanced tab the "xrender" was replaced by "OpenGL" and the method was "Accurate" instead of "Crisp". OpenGL seems about 10% slower than xrender according to the FPS in Stellarium, but 55fps isn't shabby and I'll stay with OpenGL for a while to see how it works.

[vinnywright]

Neat!
Is your ISP IPv6 ready?

I've also activated ufw and turned on IPv6 firewalling.
The following two videos are about IPv6 security:
http://hak5.org/episodes/episode-810
http://hak5.org/episodes/episode-812

how exactly do you set up that ufw ?
I'v never used it

VINNY

[Snowhog]

Your DNS server (possibly run by your ISP) appears to have IPv6 Internet access.

Seems so.

[GreyGeek]

Neat!
Is your ISP IPv6 ready?

I've also activated ufw and turned on IPv6 firewalling.
The following two videos are about IPv6 security:
http://hak5.org/episodes/episode-810
http://hak5.org/episodes/episode-812