<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Calibri Light";
panose-1:2 15 3 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Cuerpo en alfa";
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
h1
{mso-style-priority:9;
mso-style-link:"Título 1 Car";
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:24.0pt;
font-family:"Calibri",sans-serif;
font-weight:bold;}
h2
{mso-style-priority:9;
mso-style-link:"Título 2 Car";
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:18.0pt;
font-family:"Calibri",sans-serif;
font-weight:bold;}
h3
{mso-style-priority:9;
mso-style-link:"Título 3 Car";
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:13.5pt;
font-family:"Calibri",sans-serif;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.Ttulo1Car
{mso-style-name:"Título 1 Car";
mso-style-priority:9;
mso-style-link:"Título 1";
font-family:"Calibri Light",sans-serif;
color:#2F5496;}
span.Ttulo2Car
{mso-style-name:"Título 2 Car";
mso-style-priority:9;
mso-style-link:"Título 2";
font-family:"Calibri Light",sans-serif;
color:#2F5496;}
span.Ttulo3Car
{mso-style-name:"Título 3 Car";
mso-style-priority:9;
mso-style-link:"Título 3";
font-family:"Calibri Light",sans-serif;
color:#1F3763;}
p.Ttulo1, li.Ttulo1, div.Ttulo1
{mso-style-name:"T?tulo 1";
mso-style-link:"T?tulo 1 Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.Ttulo1Car0
{mso-style-name:"T?tulo 1 Car";
mso-style-priority:9;
mso-style-link:"T?tulo 1";
font-family:"Calibri Light",sans-serif;
color:#2F5496;}
p.Ttulo2, li.Ttulo2, div.Ttulo2
{mso-style-name:"T?tulo 2";
mso-style-link:"T?tulo 2 Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.Ttulo2Car0
{mso-style-name:"T?tulo 2 Car";
mso-style-priority:9;
mso-style-link:"T?tulo 2";
font-family:"Calibri Light",sans-serif;
color:#2F5496;}
p.Ttulo3, li.Ttulo3, div.Ttulo3
{mso-style-name:"T?tulo 3";
mso-style-link:"T?tulo 3 Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.Ttulo3Car0
{mso-style-name:"T?tulo 3 Car";
mso-style-priority:9;
mso-style-link:"T?tulo 3";
font-family:"Calibri Light",sans-serif;
color:#1F3763;}
span.EstiloCorreo27
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EstiloCorreo29
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=ES link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>I know. In my first post I clearly stated the difference between the 6to4 and the anycast.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>The problem is that some folks are saying “filter 6to4”, so I was trying to make clear the difference.<o:p></o:p></span></p><div><p class=MsoNormal><span lang=EN-US style='font-size:10.5pt;color:black'><br>Regards,<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US style='font-size:10.5pt;color:black;mso-fareast-language:EN-US'>Jordi<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US style='font-size:10.5pt;color:black;mso-fareast-language:EN-US'><o:p> </o:p></span></p></div><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div><p class=MsoNormal style='margin-left:35.4pt'>El 14/5/19 18:22, "Amos Rosenboim" <<a href="mailto:ipv6-ops-bounces+jordi.palet=consulintel.es@lists.cluenet.de">ipv6-ops-bounces+jordi.palet=consulintel.es@lists.cluenet.de</a> en nombre de <a href="mailto:amos@oasis-tech.net">amos@oasis-tech.net</a>> escribió:<o:p></o:p></p></div></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><p class=MsoNormal style='margin-left:35.4pt'>Let me just clarify few points: <o:p></o:p></p><div><p class=MsoNormal style='margin-left:35.4pt'>The suggested filter is not for the protocol, but for the 2002::/16 address space.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>Also the traffic I am seeing is between addresses within this prefix to addresses of our native IPv6 users.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:35.4pt'>As for policy - we tend to be as permissive as we can, and we certainly wouldn’t like to restrict what is left from p2p apps.<o:p></o:p></p><div id=AppleMailSignature><p class=MsoNormal style='margin-left:35.4pt'>Amos<o:p></o:p></p><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><p class=MsoNormal style='margin-left:35.4pt'>Sent from my iPhone<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:35.4pt'><br>On 14 May 2019, at 18:50, JORDI PALET MARTINEZ <<a href="mailto:jordi.palet@consulintel.es">jordi.palet@consulintel.es</a>> wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>Hi Marc,</span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'> </span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>I don’t agree. There are many users with tunnel brokers that use 6in4. If you filter 6to4 as a protocol, you’re also filtering all those users’ traffic.</span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'> </span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>Not everybody is lucky enough to have native IPv6 support from its ISP.</span><o:p></o:p></p><div><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:10.5pt;color:black'><br>Saludos,</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:35.4pt'><span lang=EN-US style='font-size:10.5pt;color:black;mso-fareast-language:EN-US'>Jordi</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:35.4pt'><span lang=EN-US style='font-size:10.5pt;color:black;mso-fareast-language:EN-US'> </span><o:p></o:p></p></div><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'> </span><o:p></o:p></p><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'> </span><o:p></o:p></p><div><div><p class=MsoNormal style='margin-left:70.8pt'>El 14/5/19 17:46, "Marc Blanchet" <<a href="mailto:ipv6-ops-bounces+jordi.palet=consulintel.es@lists.cluenet.de">ipv6-ops-bounces+jordi.palet=consulintel.es@lists.cluenet.de</a> en nombre de <a href="mailto:marc.blanchet@viagenie.ca">marc.blanchet@viagenie.ca</a>> escribió:<o:p></o:p></p></div></div><div><p class=MsoNormal style='margin-left:70.8pt'> <o:p></o:p></p></div><div><p style='margin-left:70.8pt'>6to4 has been a good transition technology to help deploy IPv6 in the early days. However, it has intrinsically bad latency issues as its routing is based on the underlying IPv4, which can be pretty bad for non 6to4 destinations (e.g. normal IPv6 addresses). Moreover, its IPv6 in IPv4 tunnelling technology is likely to be filtered by various intermediate devices in the path. My take is that we shall declare 6to4 over and dead, thank you very much for your service. So I would suggest to filter it. If not, users may get latency issues that will go into support calls unncessarily.<o:p></o:p></p><p style='margin-left:70.8pt'>Marc.<o:p></o:p></p><p style='margin-left:70.8pt'>On 14 May 2019, at 11:24, Amos Rosenboim wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #777777 1.5pt;padding:0cm 0cm 0cm 4.0pt;margin-left:0cm;margin-top:5.0pt;margin-right:0cm;margin-bottom:3.75pt'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>Hello,</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>As we are trying to tighten the security for IPv6 traffic in our network, I was looking for a reference IPv6 ingress filter.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>I came up with Job Snijders suggestion (thank you Job) that can be conveniently found at whois -h <a href="http://whois.ripe.net">whois.ripe.net</a> fltr-martian-v6</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>After applying the filter I noticed some traffic from 6to4 addresses (2002::/16) to our native IPv6 prefixes (residential users in this case).</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>The traffic is a mix of both UDP and TCP but all on high port numbers on both destination and source.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>It seems to me like some P2P traffic, but I really can’t tell.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>This got me thinking, why should we filter these addresses at all ?</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>I know 6to4 is mostly dead, but is it inherently bad ?</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>And if so, why is the prefix (2002::/16) still being routed ?</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>Thanks,</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>Amos Rosenboim</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'>-- </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span lang=EN-US style='color:#777777'> </span><o:p></o:p></p></div></div></blockquote><p class=MsoNormal style='mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:35.4pt'><br>**********************************************<br>IPv4 is over<br>Are you ready for the new Internet ?<br><a href="http://www.theipv6company.com">http://www.theipv6company.com</a><br>The IPv6 Company<br><br>This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.<o:p></o:p></p></div></blockquote></div></div><br>**********************************************<br>
IPv4 is over<br>
Are you ready for the new Internet ?<br>
http://www.theipv6company.com<br>
The IPv6 Company<br>
<br>
This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.<br>
<br>
</body></html>