Identifying IPv6 Network Problems in the Dual-Stack World

Transcription

1 Identifying IPv6 Network Problems in the Dual-Stack World -- The First French Asian Workshop on Next Generation Internet -- Kenjiro Cho (IIJ/WIDE) Matthew Luckie (U.Waikato/NLANR/CAIDA) Bradley Huffaker (CAIDA/SDSC/UCSD) September 22, 24

2 motivation it s time to care about the quality of IPv6 network - the IPv6 Internet needs to be better than IPv4 for adoption - in reality, IPv6 performance is much worse one of the major hurdles in IPv6 deployment dilemma: casual IPv6 connectivity to promote IPv6 tends to increase poorly managed IPv6 sites transparent design of IPv6: automatically falls back to IPv4 - IPv6 network problems are often overlooked possible causes for poor IPv6 performance - low-quality operations, lack of peering, poor tunneling we need to understand the real situation: - is IPv6 network so bad? - is it caused by a small number of bad ones? if so, we can improve IPv6 network by fixing them

3 ideas most of the existing management tools for IPv6 are - simple replacements of the tools developed for IPv4 IPv6 is deployed via tunnels over, or in parallel (native) with IPv4 - we can make use of the availability of 2 protocols develop techniques specifically designed for dual-stack network - take measurements for both IPv4 and IPv6 at the same time - compare IPv6 results to IPv4 results - extract problems which exist only in IPv6

4 methodology dual-stack node discovery - monitor DNS replies for AAAA records - create a list of dual-stack nodes in real use dual-stack ping - run ping/ping6 to target dual-stack nodes - select a few representative nodes per site (/48) based on IPv6:IPv4 rtt ratios dual-stack traceroute - run traceroute/traceroute6 to the selected nodes with Path MTU discovery - visualize results for comparative path analysis by juxtaposing IPv4/IPv6 paths to neighbor sites

5 dual-stack node discovery a challenge in creating a dual-stack node list - reasonable coverage of dual-stack nodes in the world - automated method needed to periodically update the list most studies select targets semi-manually from larger sets e.g., a client list obtained from server access logs dual-stack node discovery - monitor DNS replies for AAAA obtain IPv6 address and hostname pairs DNS lookups for A and AAAA by hostname extract nodes with valid IPv4/IPv6 addresses our dual-stack targets are nodes with both A and AAAA - IPv6 can be auto-configured having an IPv6 address does not mean services over IPv6 - when AAAA is registered in DNS, it is for some IPv6 services

6 dual-stack ping select up to 2 nodes per site (/48) based on IPv4/IPv6 RTTs - a site: an organizational unit in a single geographical location representative node selection rules for each site - (1) when there are nodes reachable by both IPv4 and IPv6 classify the nodes into 3 groups by IPv4/IPv6 RTT ratios Lagrge (ratio > 1.25): select one with largest ratio Small (ratio <.8): select one with smallest ratio Equal (.8 <= ratio <= 1.25): select one with shortest string string length: concatenated numeric-address and hostname to select a representative (e.g., <prefix>::1, ns.example.com) - (2) if none is reachable by IPv6 but some are reachable by IPv4 select one with shortest string limitations - ICMP-based RTT measurement is not accurate - ICMP packets are often filtered at firewalls - but good enough for our purpose!

7 dual-stack taceroute identify specific problems by comparative path analysis - roundabout routes lack of peering, paths poorly configured tunnels - routing loops, vanishing routes scamper: successor of skitter - parallel dual-stack traceroute with Path MTU discovery visualization - create graphs visualizing traceroute outputs to neighbor sites

8 results from 3 measurement points in June, 24 - WIDE (Tokyo, Japan): research network - IIJ (Tokyo, Japan): ISP providing commercial IPv6 services - ES (Madrid, Spain): Consulintel directly connected to Euro6IX

9 # ( ( -,. -, -, *.. & ' # % &% $# ) * ) + ' dual-stack node discovery results IPv6 addresses captured within the WIDE network "! ( ' * -, *. + / + / 1 " ,347 addresses for 21::/16 and 3ffe::/16 - only global unicast addresses are of interest 4,711 pairs have valid A and AAAA 4,86 after removing duplicates

10 distribution of dual-stack targets by country code match IPv6 addresses againt RIR database - country code for allocated IPv6 prefixes - 47 countries are found based on their IPv6 addresses

11 # dual-stack ping results number of unreachable and reachable nodes - by dual-stack ping from WIDE (similar results from the other 2) - 15%: unreachable by IPv6, OK by IPv4 even with AAAA in DNS "!! # #!

12 distribution of IPv6/IPv4 RTTs from WIDE individual nodes far above the unity line: leaf issues clusters above the unity line: backbone issues majority of targets have IPv6 RTT comparable to IPv4 1 IPv6 response time (msec) jp apnic arin ripe IPv4 response time (msec)

13 distribution of IPv6/IPv4 RTTs from 3 locations 1 1 IPv6 response time (msec) jp apnic arin ripe IPv6 response time (msec) jp apnic arin ripe IPv4 response time (msec) IPv4 response time (msec) 1 IPv6 response time (msec) jp apnic arin ripe IPv4 response time (msec)

14 dual-stack traceroute results traceroute by scamper to 1,334 nodes - selected out of 4,86 nodes for 1,469 sites (/48) visualization - comparative analysis: IPv4/IPv6 paths to neighbor sites each graph contains 1 targets hops are mapped to AS (from routeview s BGP table) with Path MTU with ICMP error (e.g.,!x for administratively prohibited) example graphs from 3 locations to ABILENE to illustrate - native dual-stack paths - comparable paths for IPv4 and IPv6 - roundabout paths for IPv6

15 dual-stack traceroute to ABILENE from WIDE chinng-iplsng.abilene.ucaid.edu ( , 21:468:ff:f12::1) 32 * 32 * beaglems.rnet.missouri.edu ( , 21:468:1fc:4::3) ms 13 16ms ns2.ipv6.auburn.edu ( , 21:468:364:41b:52fa:5bff:fef2:66fa) ms 13 17ms ns4.indiana.edu ( , 21:468:42:4:23:baff:fe2b:5f2c) 12 16ms 13 16ms nyc-m2.nysernet.net ( , 21:468:9:1::1) ms ms ns-i2.nyser.net ( , 21:468:91:1:25:daff:fe2:5b3) ms ms route-views6.routeviews.org ( , 21:468:d1:3c::8df:3c6d) 1 127ms ms hpcfns1.hpcf.upr.edu ( , 21:468:13::1) 1 21ms ms ipv6.internet2.edu ( , 21:468:142::15) 12 17ms 32 * noc.gigapop.gen.tx.us ( , 21:468:1a::242) 9 138ms 1 138ms response time (msec) IPv4 to dst IPv6 to dst WIDE APAN-JP ABILENE GPN MORENET GEORGIA-TECH AUBURN INDIANAGIGAPOP INDIANA-AS NYSERNET3-AS NYSERNET3-AS-3 OWEN UONET AMPATH-AS UPRENET MICHNET-ASN TEXAS-GIGAPOP similar RTTs and hops for IPv4 and IPv6 naitive dual-stack paths

16 dual-stack traceroute to ABILENE from IIJ beaglems.rnet.missouri.edu ( , 21:468:1fc:4::3) ms ms MTU:128 ns2.ipv6.auburn.edu ( , 21:468:364:41b:52fa:5bff:fef2:66fa) ms ms MTU:128 ns4.indiana.edu ( , 21:468:42:4:23:baff:fe2b:5f2c) ms ms MTU:128 ns-i2.nyser.net ( , 21:468:91:1:25:daff:fe2:5b3) ms ms MTU:128 route-views6.routeviews.org ( , 21:468:d1:3c::8df:3c6d) ms ms MTU:128 hpcfns1.hpcf.upr.edu ( , 21:468:13::1) ms 15 22ms MTU:128 ipv6.internet2.edu ( , 21:468:142::15) ms 32 * noc.gigapop.gen.tx.us ( , 21:468:1a::242) ms 12 16ms MTU:128 IPv4 to dst IPv6 to dst IIJ Qwest MORENET response time (msec) EP-BLK-ASNBLOCK-5 ESNET-WEST293 ABILENE AUBURN Level3 INDIANAGIGAPOP INDIANA-AS NYSERNET3-AS-3 NERO-NET UONET VERIO INTEGRATED-SYSTEMS UPRENET COGENT MICHNET-ASN TEXAS-GIGAPOP similar RTTs but different paths for IPv4 and IPv6 more common in the current Internet

17 dual-stack traceroute to ABILENE from ES beaglems.rnet.missouri.edu ( , 21:468:1fc:4::3) ms 13 35ms MTU:128 ns4.indiana.edu ( , 21:468:42:4:23:baff:fe2b:5f2c) 2 17ms 11 35ms MTU:128 ns-i2.nyser.net ( , 21:468:91:1:25:daff:fe2:5b3) 2 171ms ms MTU:128 route-views6.routeviews.org ( , 21:468:d1:3c::8df:3c6d) 23 23ms ms MTU:128 hpcfns1.hpcf.upr.edu ( , 21:468:13::1) ms 11 49ms MTU:128 ipv6.internet2.edu ( , 21:468:142::15) ms ms MTU:128 noc.gigapop.gen.tx.us ( , 21:468:1a::242) 17!L 23ms!L 13 37ms MTU:128 IPv4 to dst IPv6 to dst ABRARED BT-CIN-AND-ADASTRAL BT response time (msec) SATEC CERN COGENT Qwest MORENET ABILENE Level3 INDIANAGIGAPOP INDIANA-AS NYSERNET3-AS-3 NERO-NET UONET VERIO INTEGRATED-SYSTEMS UPRENET MICHNET-ASN IPv6 RTT larger than IPv4 (roundabout tunnel) note: ES has better paths to other US sites

18 distribution of Path MTU size! " $ # % 1454:PPPoE 128,148:tunnels - WIDE stands out with 15 byte IPv6 PMTU

19 conclusion importance of IPv6 network quality for full-fledged IPv6 services - a hope to improve IPv6 quality by identifying and fixing a limited number of erroneous settings our 3-step approach - dual-stack node discovery to find dual-stack nodes in real use - dual-stack ping to select representative nodes per site - dual-stack traceroute for detailed comparative path analysis the results look effective to identify IPv6 network problems - most sites look OK but some have problems our tools are still under development, we want to - fully automate the procedure for regular measurement - increase measurement points for more infomation (latest results, tools)