Hacker News new | ask | show | jobs
by hhw 4178 days ago
That article completely ignores NDP exhaustion attacks. As autoconfiguration has no place in a server environment anyway, which is the protocol that breaks, there's absolutely no need to assign a /64. The more important goal is to avoid fragmentation; it makes more sense to allocate a single larger subnet than multiple smaller ones so as not to fill up routing tables. Externally to your network, you'd aggregate anyway, but it helps to keep routing tables lean on layer 3 switches which aren't capable of as many routes. Also, some vendors' IPv6 implementations have FIBs that use /64's, and may need buckets for multiple subnets within, which can be inefficient. A good compromise is to reserve a /64, but only assign something more reasonable like a /121, with 123-125 usable IPv6 addresses being more than enough in most cases.