ARIN Nearing IPv4 Depletion, For Real

We've heard about it for so long that it's been easy to be complacent: The Internet is running out of IPv4 addresses. But now the American Registry for Internet Numbers (ARIN) says we truly will run out of IPv4 addresses this summer.

That's when ARIN expects to no longer be able to fulfill requests for IPv4 addresses and activate its waiting list for unmet IPv4 requests. There's a total of 4.3 billion IPv4 addresses available, but many are reserved; ARIN is down to its last 3.25 million IPv4 addresses; said John Curran, president and CEO of ARIN, one of five Regional Internet Registries that dole out IPv4 addresses.

"It's a finite pool and we're getting to the bottom of that pool... At this point we're still issuing addresses, mostly to hosting providers and Internet service providers. But it's recognized that at some point there won't be resources available," he said in a interview. "All we'll be able to do is put them on a waiting list."

Curran said ARIN will activate the list the first time it receives an IPv4 request it can't satisfy; he estimated that could happen in the next 30 to 60 days.

IPv4 market

Those put on ARIN's waiting list have options, Curran said. They can consider deploying the new Internet protocol that offers IP addresses galore, IPv6, or look to the IPv4 transfer market and buy IPv4 addresses from parties that don't need them anymore. Companies with unneeded IPv4 addresses can transfer their addresses to qualified parties, and ARIN updates the records to reflect the new address holder.

The transfer market for IPv4 addresses is a pretty healthy one, with a number of brokers in the US, such as IPv4 Market Group and Avenue4. Gary Audin, president of Delphi, detailed the process involved in selling and buying IPv4 addresses in a blog post on NoJitter.com earlier this month.

There have been reports of an IPv4 black market that transfers IPv4 addresses outside of ARIN's approval, but Curran's said most people would not want to take that risk.

"We require the recipient is actually a party who has operational needs and will actually make use of the address space and they have to verify that, so it's not possible for a party that isn't a network operator or to use it. They can't just buy address space and hold it.

IPv6 migration

Of course, organizations could consider ARIN's IPv4 depletion as a catalyst to IPv6 deployment. IPv6 adoption is actually growing much faster than most people realize, Curran said, pointing to Google statistics showing rapidly growing adoption of IPv6 among US Google users (now at 16%).

According to the Internet Society, which organized the IPv6 World Launch, Verizon Wireless has reached nearly 70% IPv6 deployment, as measured by connections from users to five major websites that use IPv6 (Google, Facebook, Akamai, LinkedIn, and Yahoo). AT&T showed 52% IPv6 deployment.

"While you don't see it, the Internet is changing out from under you," Curran said. "We're literally re-plumbing the Internet on a distributed basis globally."

Enterprises need to consider that many people will be accessing their publicly-facing websites with devices using IPv6, especially if they're using mobile devices, Curran said. Websites that haven't added IPv6 will perform more slowly when accessed by IPv6-enabled phones than those with IPv6 because the traffic will need to translated by a mobile phone operator, he said.

"No one is saying you have to upgrade your internal infrastructure. But since the public Internet is going to IPv6, a smart network engineer will look to move their public-facing web servers to also have IPv6 connectivity," Curran said.

Jeff Carrell, a consultant at Network Conversions and an IPv6 expert, said the place enterprises should start implementing IPv6 is in their forward-facing systems, including their web servers, load balancers, and firewalls.

"It's a very finite set of devices, device types, and operating systems as compared to the inside of a network -- your user networks, guest networks, DMZs. All those potentially have not only a great quantity of devices, but also a larger operating system environment," he said in an interview. "That's going to be the hard part of the job."

That's not to say that implementing IPv6 on forward-facing content is a trivial matter, though, Carrell noted.  The first thing enterprises need to do is get some training and hands-on experience with IPv6, he said. At Interop Las Vegas, Carrell led a session on building an IPv6 lab.

More core infrastructure applications are requiring IPv6, and at some point, major applications will stop supporting IPv4, he said. IPv6 has been enabled now for about six years in most operating systems, and there are potential network design gains an enterprise can realize with IPv6 simply because of the new address size. "From an internal aspect, there's almost no reason not to start," he said.