Deep Dive into
IPv6 Extension Header
Testing Across the Internet
IEPG: IETF115
Nalini Elkins, Mike Ackermann: Industry Network Technology Council
Dhruv Dhody, Praneet Kaur: India Internet Engineering Society
Dr. Mohit Tahiliani: NITK Surathkal
Dr. Priyanka Sinha: Zenatix Solutions
Ameya Deshpande: Google
Dr. Ana Custura: University of Aberdeen

Can IPv6 Extension Headers Be Used on theInternet?
• Controversy for many years• A number of studies showing that IPv6 extension headers “don’t work”• Studies (by and large) sent “fake” IPv6 extension headers to Alexa top nsites• If this is true, our work on our IPv6 Extension Header Destination Option
Performance and Diagnostic Metrics (PDM) is really for naught

Brief explanation of PDM• RFC8250: IPv6 Performance and Diagnostic Metrics (PDM)
Destination Option• To assess performance problems, this document describes optionalheaders embedded in each packet that provide sequence numbers
and timing information as a basis for measurements. Suchmeasurements may be interpreted in real time or after the fact. This
document specifies the Performance and Diagnostic Metrics (PDM)
Destination Options header.

IAB Workshop: Encrypted Mgmt Techniques• How to manage encrypted networks a big problem• Our proposal to use PDMv2 (encrypted Dest. Options IPv6 ExtensionHeader) accepted to IAB workshop• As soon as we have a stable implementation, will try to collocate atvarious points in the Internet• Crucial that EH works

What we did last time
• Used a small hosting service (not one of the “brand-name” ones)• Locations throughout the world
1. PDM-Warsaw
2. PDM-Toronto
3. PDM-Seattle
4. PDM-Mumbai
5. PDM-Melbourne
6. PDM-Frankfurt

All machines are FreeBSD
with a modification tothe kernel to send PDM
IPv6 Destination option
with every packet

Thanks to…

In particular, Dr. Mohit Tahiliani
and his undergraduate students:
Balajinaidu V, Chinmaya
Sharma, and Amogh UmeshTested large FTP: Toronto to Mumbai (withPDM)• Connected to2401:c080:2400:1179:5400:04ff:fe0f:804a.
• 220---------- Welcome to Pure-FTPd[privsep] [TLS] ---------• 220-You are user number 1 of 50 allowed.
• 220-Local time is now 15:12. Server port:21.
• 220 You will be disconnected after 15
minutes of inactivity.
• 331 User PDMuser OK. Password required• 230 OK. Current directory is /• Remote system type is UNIX.
• Using binary mode to transfer files.

• 229 Extended Passive mode OK (|||3353|)• 150-Accepted data connection• 150 27872.0 kbytes to download• 100%|****************************************************************************************************************| 27872 KiB 222.31 KiB/s 00:00 ETA• 226-File successfully transferred• 226 125.107 seconds (measured here), 222.78
Kbytes per second• 28540928 bytes received in 02:05 (222.31KiB/s)• 221-Goodbye. You uploaded 0 anddownloaded 27872 kbytes.
• 221 Logout.

From PDM IPv6 DOH

Bottom line
1. PDM-FTP Toronto to Warsaw - worked
2. PDM-FTP Toronto to Seattle - worked
3. PDM-FTP Toronto to Mumbai - worked
4. PDM-FTP Toronto to Melbourne - worked
5. PDM-FTP Toronto to Frankfurt - worked

Traces available for all tolook at.

Deep Dive: Why?
• Find out what is the ACTUAL situation -- do EHs really work?
• If not, then why?
• Is it blocked:• At the source?
• At the destination?
• In a transit network?
• Then• Is it intentional?

Why CDNs?
• Will talk more about standalone client – server testing atside meeting (Thursday)• Started focusing on CDNs
• Many high volume sites on the internet use CDNs

Let’s look at topologies• Client – Internet – Server• Client – Internet – CDN Cache Server – CDN network – Origin Server• (Internal to CDN may have multiple more complex topologies)• Client – Internet – Edge of Cloud Provider – Origin server hosted bycloud provider

Simplest: Client – Internet -- ServerClientInternetServerMove Server Behind CDN• Our server has a domain name: MyEHServer• Our server also has an IPv6 address (also IPv4probably)• Let’s say: 2001::1 and 201.1.1.1 (MyEHServer
resolves to these)• To move behind a CDN, you have to give the CDN
authority to resolve MyEHServer• Let’s give the CDN IPv6 addresses starting with
2CD0::/64 ( 2CD0::1, 2CD0::2, etc)
• After CDN move, MyEHServer will resolve to some
CDN cache server address (2CD0::1 for example)

We will now refer to ourserver as the “OriginServer”

With CDN Topology
https://MyEHServer.com

ClientInternet

CDN Cache
Server
2CD0::1Origin
Server2001::1

So, first …
• What is the CDN actually resolving to?
• Remember: To move behind a CDN, you have to give the CDN
authority to resolve MyEHServer• We *assume* it is resolving to the IPv6 address. Of course, why
wouldn’t we think that? We are IETFers…
• So, I took a trace on both sides (my client machine which is also
EH enabled and the origin server behind the CDN which Icontrol)From our Extension
HeaderFrom Client Side
• I see that packets with EH are getting through• But, I only see my EH data on the CLIENT side.
• Why not the server side?
• So, I look at the server traceFirst shock, why am I only
seeing IPv4? What did I dowrong?

No… it isforwarded
fromIPv6!!!!!

From CDN Provider #1 Documentation

But, CDN
provider #1 isbetter than …

Email from CDN Provider #2

Hi Nalini,Thank you for the quick conversation on the phone, I was able to find somecurrent documentation on how we support IPv6 - but as it turns out you
were correct in that we do not support it at the origin. This is something
we have on the product roadmap for Fastly but there is no current
timetable on implementation.

CDN Provider #3• Very cooperative• Having trouble navigating how to actually get behind the CDN!
(Will have results next time.)• They indicate that IPv6 to origin is supported but EH to origin
not supported• We hope to work with them to support EH to origin

More Breaking News as it Happens …
• Will continue testing• Working on cloud providers• Thoughts?
• Questions?

Side meeting on EH testing:Thursday! Join us.

Ana’s Portion!