undefined | Better HN

0 pointsdirewolf2025d ago0 comments

It could be that they don't want to implement IP bans in IPv6.

0 comments

How does IP bans work in IPv6 case? One just blocks whole /64 or /56 address range?

I have not had a deal with this, but if I was going to, I would start at the /64 and move up by nibble (4-bit) boundaries: /64, /60, /56, /52, /48.

/56 is often recommended as the minimum as for a (residential) customer. /48 is considered a "site" address prefix, and is the smallest allocation that can be advertised in BGP:

* https://blog.apnic.net/2020/06/01/why-is-a-48-the-recommende...

* https://www.infoblox.com/blog/ipv6-coe/a-48-for-every-site-a...

You get 65k subnets with it, which is what you get with 10/8.

roryirvine24d ago

Yes, /64 is a reasonable starting point for blocking outright, but /48 is the right unit for scoring reputation.

GoblinSlayer24d ago

APNIC blog says /48 prefixes are for global routing, i.e. site=country there, not web server.

>/48 is the minimum prefix size that will be routed globally in the BGP.

Dagger224d ago

I'm not sure if I'm misreading you, but a /48 would never be an entire country's v6 allocation.

If we're talking home networks, you can reliably expect a /48 to a) not be announced in BGP itself, and b) cover one to a few hundred users of one ISP. (The containing /32 or similar will be announced.) A business might structure its network so that one of its /48s corresponds to a country, but in that case the /48 would be covering just that business, which would be a sensible unit for reputation tracking.

1 more reply

c0balt25d ago

Or the most likely more expensive rate limiting (computational wise)

michh25d ago

I mean, given how the site performs on average I don't think they've optimized so much that the extra cpu cycles of ANDing with the fixed constant of 2^64-1 and then looking up or hashing a 16 byte integer - whatever they do - rather than a 4 byte one would increase the load significantly. Let's be pessimistic and say it's 20 extra cpu cycles, that's not gonna be much of a problem if their load balancers were made in the past 20 years.

j / k navigate · click thread line to collapse