disrupt免费dns

1464XLAT:BreakingFreeofIPv4Cameron.
Byrne@T-Mobile.
comAPRICOT2014BackgroundT-MobileUSisaGSM/UMTS/LTEproviderintheUSAwith45+MillionsubscribersIn2008,T-MobilelaunchedthefirstAndroidphone.
Thisdramaticallychangedthemobiledatadynamics–moredevices,connectedforalongertime,allneedingIPaddressesT-MobileembracedtheconceptofIPv6-only,sincedual-stackrequiredIPv4thatwasnotavailableNAT64/DNS64wasagoodsolutionthatdidnotrequireIPv4oneachclient,butsomeapplicationsfailedtoworkonIPv6-onlynetworks.
ItisnotacceptabletobreakSkypeorNetflix,applicationsthatrequireIPv4T-Mobile,inpartnershipwithNECandJPIX,documented464XLATintheIETFasRFC6877toovercomethelimitationsofNAT64byaddingaNAT46intotheclient(CLAT)Android4.
3introducedsupportfor464XLATinOctober20132ResultsAreImportantT-MobileUSlaunched5Androidphoneswith464XLATasthedefaultinthelast5months,allAndroid4.
3+phoneswillbe464XLATinthefutureatT-MobileUS3.
6millionuniqueIPv6subscribersinthefirst5monthsareactiveonthenetworkhttp://www.
worldipv6launch.
org/measurements/measurementsshow15.
76%ofallT-MobileconnectionsarenowIPv6,asofFebruary21,2014Over50%ofIPv6-usertrafficisend-to-endIPv6(notranslationneeded)Thissavesmoneyandmakesthenetworksimpler315.
76ofT-MobileUSConnectionsuse464XLAT4Default464XLATPhonesatT-MobileUS5SamsungNote3Google/LGNexus5SamsungMega464XLATPhones6SonyZ1sGalaxyLight464XLATallowsforfullfunctionalityonIPv6-onlynetworksDual-stackdoesnotsolvetheIPv4numberscarcityissueIPv6-only+NAT64/DNS64isverygood,butnotgoodenoughforfullIPv4replacement(webandemailwork,butSkypedoesnotwork)IPv6-only+464XLATSolvesIPv4numberingissuebynotassigningIPv4toclientsDecouplesedgegrowthfromIPv4availabilityIPv4-onlyapplicationslikeSkypeworkonanIPv6-onlynetworkbecause464XLATtranslatesIPv4onthephonetoIPv6onthenetwork7IPv6deploymentiseasyachievableT-MobileUSAdidnotspendanyCapExonIPv6Onlyintroduce464XLATonnewphones,sowedonotdisruptanyexistingservicesInnovativethinkinghelpsreducedeploymentcosts(hash128bitnumbersinto32bitfieldsinbillingrecords)IPv6willsavemoneyinyournetwork(lessNAT/CGN,noneedtobuyIPv4addresses,…)8Infact,withroaming,wecanshowChunghwainTaiwanandMYMAXISinMalaysiasupportIPv6todayintheRadioAccessNetwork(RAN)9WhichPlatformsSupports464XLATTodayYESAndroid4.
3+NOBlackberryAppleWindowsPhone()10IMPORTANT!
AnythingthatisnativelyIPv6enableddoesnotrequireanysortoftranslation,464XLATisidleandtransparentforanyIPv6end-to-endflowIPv6end-to-endjustworks!
464XLATisonlyforserviceandapplicationsthatareusingLEGACYIPV4AsmoreandmoreservicestransitiontoIPv6,464XLATisengagedlessandless464XLATisanIPv4EXITSTRATEGY11THETECHNICALDETAILS12464XLATisjustasetofbuildingblocksStatelessNAT64(RFC6145)ClientsidetranslationCLATStatefullNAT64(RFC6146)ProvidersitetranslationPLATDNS64(RFC6147)WhentheFQDNdoesnothaveaAAAArecord,DNS64dynamicallycreatesonethatallowstheclienttouseIPv6andthenetworktranslatesfromIPv6toIPv4attheNAT64Prefix64Discovery(RFC7050)Queriesforthewell-knownFQDNipv4only.
arpa,whichisbydefinitionIPv4-only.
IfthereisaAAAAresponseprovided,thenitisknownthataDNS64isinthepath133Scenariosin464XLAT1.
End-to-endIPv6:Facebook,Google,Wikipedia,Yahoo,Youtube…IPv6->IPv62.
ApplicationsupportsIPv6(webbrowser)buttheserverisonlyIPv4(www.
amazon.
com,www.
myspace.
com,…),soDNS64/NAT64translatesIPv6->IPv43.
ApplicationdoesnotsupportIPv6(Skype,Whatsapp,…),theclientmustprovideastatelessNAT46totheapplicationandstatefulNAT64mustbeinthenetwork:IPv4->IPv6->IPv414HowdoesStatelessNAT64workAlgorithmicallymapIPv4addressestoIPv6addresses,bidirectional,1to1NotdynamicDeterministicMapsallofIPv4's32bitsintoanIPv6/96(orlargerprefix)DefinedinRFC6145Example2001:db8::10.
1.
1.
110.
1.
1.
12001:db8::10.
2.
2.
210.
2.
2.
22001:db8::www.
example.
comipv4www.
example.
com15HowdoesStatefulNAT64work16DynamicallytranslateIPv6packetstoIPv4packetsDynamicNotdeterministic(translationbasedonavailableIPv4pool)Translationstateisshort-livedandbasedonsessioncreationandterminationDefinedinRFC6146ExampleBeforetranslationTCPsource2001:db8:abcd::ffffport555#clientaddressTCPdestination2001:db8:1234::10.
1.
1.
1port80#NAT64addressAftertranslationTCPsource192.
168.
1.
1port555#192.
168.
1.
1availablefromNAT64poolTCPdestination10.
1.
1.
1port80#Last32bitsofIPv6destinationHowdoesDNS64workWhenanFQDNdoesnothaveaAAAArecord,theDNS64willsyntheticallycreateonebasedonanetworkdefinedPref64Thepref64isaprefixhostedontheNAT64fortranslationExamplewithoutDNS64Query=aandaaaaforwww.
example.
comAnswer=a=10.
1.
1.
1,aaaa=NOERRORExamplewithDNS64Query=aandaaaaforwww.
example.
comAnswer=a=10.
1.
1.
1ANDaaaa=2001:db8::10.
1.
1.
117HowisthePref64discoveredontheclientPref64istopologicallylocatedontheNAT64TheDNS64forcesclientstosendtraffictotheNAT64fortranslationfromIPv6toIPv4AutomaticdiscoveryofPref64isdefinedinRFC7050Theclientwilllookupthewell-knownFQDNipv4only.
arpa.
IfaAAAArecordispresentedforthiswell-knowIPv4-onlyFQDN,theclientcanparsetheresponsetofindthePref64usedwithinthisnetwork18Pref64ConfigurationInformationFlow19HowtomakeEVERYTHINGworkonIPv6-only20ZoomOut:Whatdoesthislooklikeinthecontextof3GPPGSM/UMTS/LTE21HighLevelViewofIPv6deployment:Phone,HLRprofile,GGSN,NAT64,IPv6ISP2223ImpacttoNetworkEntitiesImpacttoNetworkEntitiesZoomin:WhatdoesthedefaultAndroidconfigurationlooklike:clatd.
conf24Zoomin:Whatdoesthephoneconfigurationlooklike:APNSettings25InAndroid4.
3,"APNProtocolIPv6"forthe"APNTypedefault"triggerstheuseof464XLATbydefaultIPv6=464XLATTIMEFORWIRESHARK26Likemostthings,westartwithDNSTheclientisIPv6-onlytowardsthenetwork,butthehostOSthinksitisdual-stacksinceithasanIPv4CLATinterfaceandanativeIPv6radiointerfaceSo,theclientdoesaqueryforDNS"A"and"AAAA"recordsTheDNS64respondswithasynthesizedAAAAandtherealAThesynthesizedAAAA=Pref64+realIPv427QuickCheckDoesthesynthesizedAAAAmatchthepref64+realA28pref64RealIPv4Next,theUEselectstheIPv6DNSresponse,andstartsTCPFromtheclientperspective,thisisanativeIPv6end-to-endflowBut,weknowthattheDNSisasynthesizedAAAAandtheclientisactuallysendingitspacketstotheNAT64forIPv6->IPv4statefultranslationThisisjustDNS64/NAT64,noclient-sidetranslationneededforthisscenario29Thefullcaseof464XLATdoubletranslation:WhatsApp30SYNissentfromtheCLATaddress31Remember,wesettheclatd.
conftousetheIIDof::464forCLATtranslationsTheMMSsituationTheAndroidMMSfunctioncommunicatesdirectlytothemodemandby-passesthenormalOSnetworkingstackFrequentlyMMSisitsownAPNThismeans464XLATisbypassed,464XLATonlyworksonthedefaultAPN,notspecialAPNslikeSUPLandMMSSolutionsUseanFQDN,DNS64stillworksfineIfyoucannotuseanFQDN,manuallyuseaNAT64literalinsteadoftheIPv4literal(pref64+ipv4literal)32Security:FollowtheruleofleastprivilegeFilteraccesstotheDNSseverFilteraccesstothePref64ontheNAT64UsingULAPref64willNOTworkwellsinceAndroidprefersIPv4overIPv6ULA.
Thisresultsin100%CLATtranslationsforIPv4resources33SummaryIPv4doesnotfitthebusinessneedstogrowtheedgeofournetworksfueledbygrowthfrominternetofthingsandcloudIPv6workstodayandisdeployedonsomeofthelargestedgenetworks464XLATallowsnetworkstogrowwithoutmanypublicIPv4addressesIPv6deploymentin3GPPGSM/UMTS/LTEisachievabletoday34BigPicture:WemustavoidtheInternet'slargestgrowthengine(mobile)frombeingindefinitelytiedtoscarceIPv4andfragilestatefulNAT44.