Under Attack? Call (844) END.DDoS

Who Put the IPv6 in my Internet?

About this time last year, we released a study on the state of IPv6 deployment in the Internet. Our August 2008 paper found diminishingly small traces of IPv6 — less than one hundredth of 1% of Internet traffic.

This year?

In a dramatic reversal of long-term IPv6 stagnation, global IPv6 traffic globally grew more than 1,400% in the last 12 months. Even more remarkable, this growth is due primarily to one application and one ISP.

We’ll explain in a moment, but first some background: Both our 2008 work and this IPv6 study used traffic statistics from 110 ISPs participating in the Internet Observatory. Though the Observatory is capable of collecting native (i.e. not tunneled) IPv6 traffic statistics, only six ISPs out of the 110 in the study currently have routers and collection infrastructure with native IPv6 enabled. As a result, our data generally includes only IPv6 traffic through Teredo and 6to4 tunnels. Further, since only a handful of Observatory participants use monitoring infrastructure with payload visibility, our study sees only the UDP Teredo control traffic (i.e. not the data portion).

The above technical limitations and our somewhat dismal 2008 assessment of IPv6 deployment engendered a bit of criticism. The main critique (such as this posting) seems to be that we significantly under counted IPv6. In particular, many pointed to the Amsterdam Internet Exchange (AMS-IX) switch statistics which show a Gigabit or more of IPv6 traffic (far more than we found in our study). Others pointed to the high rate of IPv6 address allocations as evidence of broader IPv6 deployment.

From the perspective of a year later, we stand by our 2008 IPv6 findings. A July 2009 news server outage confirmed suspicions that AMS-IX IPv6 traffic mainly consisted of file sharing through the free AMS-IX based IPv6 news servers. And a PAM paper earlier this year found both minuscule levels of IPv6 traffic in a tier1 network and confirmed that registry allocations provide a poor indicator of IPv6 usage. As a side note, the PAM paper also found that the small amount of tier1 IPv6 traffic consisted mainly of DNS and ICMP (i.e. test traffic and not real IPv6 usage).

So in August of 2008 real IPv6 Internet traffic was mostly non-existent.

And then things changed…
The above graph shows IPv6 traffic (Teredo and 6to4) as a normalized weighted average percentage of all Internet traffic between July 2007 and July 2009. In July of 2007, IPv6 represented less than 0.002% of Internet traffic. Beginning in August of 2008, tunneled IPv6 traffic begin to grow dramatically followed by an abrupt and even larger jump in April of 2009 (the E. Karpilovsky et al. PAM paper also observed this first 2008 jump in traffic but did not speculate as to the causality).

What happened?

This stark August 19, 2008 warning to the NANOG mailing list by Nathan Ward provides a strong clue:

Sit up and pay attention, even if you don't now run IPv6, or even if you don't ever intend to run IPv6.
Your off-net bandwidth is going to increase, unless you put some relays in.
As a friend of mine just said to me: "Welcome to your v6-enabled transit network, whether you like it or not ;-)".
uTorrent 1.8 is out, as of Aug 9.

Nathan was mostly right. While uTorrent never generated the expected flood of new traffic (at least by IPv4 standards), the introduction of IPv6 P2P succeeded where most previous IPv6 inducement efforts had failed (i.e. liberal peering, high quality IPv6 porn, IPv6 ASCII animation of Star Wars, etc.). In the space of ten months uTorrent helped drive IPv6 traffic from .002% to .03% of all Internet traffic (a dramatic 15x jump).

But the more interesting (and from an infrastructure perspective, far more important) IPv6 traffic increase came on April 21, 2009 with Hurricane Electric’s turn up of a global anycast’ed Teredo relay service. Hurricane Electric enabled 14 Teredo relays in Seattle, Fremont, Los Angeles, Chicago, Dallas, Toronto, New York, Ashburn, Miami, London, Paris, Amsterdam, Frankfurt and Hong Kong.

More details of Hurricane Electric’s infrastructure is available in this May 2009 LACNIC presentation.

Historically, IPv6 connectivity across the Internet has been, well, abysmal. Inefficient routing, multiple IPv6 tunnel encapsulations and overall lack of coordination between Teredo and 6to4 relay providers added latency, loss and played havoc with jitter (i.e. mangling VoIP). Frequently, a traceroute between two providers at the same exchange could traverse multiple countries or continents en route. For added background, see this 2009 Google IPv6 Conference presentation, this 2008 RIPE study and related 2007 study.

By all accounts, Hurricane Electric’s Teredo service significantly improved the IPv6 goodput for the average Internet end user over night. In particular, Microsoft Windows users got a big boost. Though Windows has shipped with a Teredo client (on by default) since XP, Microsoft never provided a public relay service. teredo.ipv6.microsoft.com now uses Hurricane’s 6to4 relays. And the dramatic improvement in Teredo and 6to4 relays seems to have lead to a corresponding jump in IPv6 traffic.

This is good news.

Finally, in the below graph, you can see the impact of both uTorrent and Hurricane’s relay deployment by region. We again show IPv6 tunneled traffic as a weighted normalized percentage of all Internet traffic. The most important take away is that the IPv6 growth after August 2008 is a global phenomena (with Asia at the forefront follow by Europe).
We look forward to revisiting IPv6 traffic in another year as relays improve, meaningful IPv6 content becomes available and more providers offer native IPv6 service.

Editor’s Note: This blog is the fourth in a series of weekly posts leading up to the publication of the joint University of Michigan, Merit Network and Arbor Networks “2009 Internet Observatory Report”. The full technical report goes into detail on the evolving Internet topology, commercial ecosystem and traffic patterns — available this October. Next week: “How Big is Google?”


Reblog this post [with Zemanta]

Tags: , ,