Rate limiting / banning IPs in IPv6

Question

Rate limiting is useful for situations like protecting a login system for failed attempts or limiting client resource usage per IP as an anti-abuse measure. It is also quite effective for IPv4 addresses, because only the guy with the thousand strong botnet will be able to circumvent it long enough to cause damage.

How do you achieve this in IPv6? I understand that dedicated hosts nowadays provide you with /64 blocks, which is around 18 quintillion addresses. What about residential ISPs? Is there a minimum and/or maximum block size that is used in IPv6 deployments? Is it even possible to employ an effective rate limiting scheme in IPv6?

Answer 1

A /64 roughly maps to an individual residential network -- much the same as a single IPv4 address maps to an individual residential network. Many providers allocate /60, /56, or /48 subnets to end-users (my ISP, Internode, allocates a static /56 to every residential and business username)

So if you do your rate-limiting based on the /64 (i.e. ignore the last 64 bits), you have a pretty good chance of accurately rate-limiting a single user.

One further point, operating systems like Windows Vista and above, Mac OS X v10.7 above, and Ubuntu 12.04 and above, use randomised host identifiers for outgoing connections. This means the last 64 bits of the IPv6 address you see are always going to be random (well, randomised each time they reboot), so you may as well ignore them. If you only view the first 64 bits, they are much more likely to be static (or, at the very least, long-lived).