The Hook: Why We Built This

A few weeks ago, an Internet-Draft titled Internet Protocol Version 8 (IPv8) — draft-thain-ipv8-02 caught our eye.

The draft makes some extraordinary claims:

• Zero Address Exhaustion: Every ASN holder automatically receives 4,294,967,296 host addresses ($2^{32}$).
• 100% Backward Compatibility: "IPv4 is a proper subset of IPv8... There is no flag day and no forced migration."
• Total Network Management: Every packet is validated against DNS8 and WHOIS8; all elements are authorized via OAuth2 JWT tokens; and all core services (DHCP, DNS, NTP, Syslog, WHOIS, NAT, ACLs) are bundled into a single "Zone Server".

Most network engineers would laugh this off as an April Fools RFC written by an enterprise architect on buzzword overdrive. But instead of just arguing on mailing lists, the team at goonhost.rocks decided to actually build the entire specification from scratch and test what happens when you deploy it across a distributed multi-AS network.

What We Built (Open Source Repositories)

We implemented the complete IPv8 stack from ring-0 kernel code up to user-space applications:

1. Linux Kernel 6.6 (GitLab Repo):
   • Implemented native AF_INET8 (address family 46) supporting SOCK_STREAM (TCP8), SOCK_DGRAM (UDP8), and SOCK_RAW (RAW8).
   • 28-byte IPv8 header parsing, 64-bit routing table lookups, and sysctl boundary drop rules (filter_internal_zones, filter_rine, filter_interior_links).
2. Musl Libc (GitLab Repo):
   • Added sockaddr_in8, inet_pton8, inet_ntop8, getaddrinfo(), and getnameinfo() for 64496.10.0.0.1 format addresses.
3. iproute2 (GitLab Repo):
   • Native ip -8 route and ip -8 addr management commands.
4. FRRouting (FRR) (GitLab Repo):
   • BGP8 daemon with Multi-Protocol Extensions (AFI/SAFI) for peering and exchanging IPv8 routes.
5. IPv8 Zone Server Platform in Go (GitLab Repo):
   • Implemented all 10 RFC sub-protocols: DHCP8 (options 224–230), DNS8 (TYPE_A8 88), SNTP Stratum-1, NetLog8 (UDP 514 telemetry), OAuth8 JWT server, WHOIS8 TCP 43/REST, ACL8, and XLATE8 stateful NAT.
6. Nginx & cURL (Nginx Repo | cURL Repo):
   • Serving and requesting HTTP over 64-bit IPv8 endpoints (http://64497.20.0.0.254:80/).
7. 10-Node QEMU Multi-AS Testbed:
   • 4 Autonomous Systems (AS 64496, AS 64497, AS 64498, AS 64499) connected across multicast WAN/LAN segments, loaded with 112,000+ active FIB routes and continuous client traffic generation (trafficgen8).

The Results: The Good, The Bad, and The Catastrophic

The Good (In a Lab Environment)

In an isolated sandbox, the protocol works surprisingly smoothly:

• curl -i http://64497.20.0.0.254/ returns HTTP/1.1 200 OK from Nginx across an inter-AS WAN mesh.
• dhcp8c boots on an unconfigured interface, receives a dual-gateway lease (.254 Even / .253 Odd), and syncs its clock via NTP8 in 2.27 ms.
• The Linux kernel fib_trie handled 112,117 active routes with sub-millisecond lookup latency under continuous traffic.

The Bad: Why It Breaks in the Real World

1. Path MTU (PMTUD) & Silent MSS Blackholing

IPv8 addresses add 4 bytes to source and 4 bytes to destination, expanding the IP header from 20 to 28 bytes.

• On a standard 1500-byte MTU Ethernet link, standard IPv4 TCP packets (1460-byte payload + 20-byte TCP + 28-byte IPv8 = 1508 bytes) exceed the MTU.
• Because thousands of legacy middleboxes drop oversized packets without sending ICMP Fragmentation Needed messages, TLS handshakes and large file transfers hang indefinitely.
• Fix: Every router and host on earth must enforce TCP MSS Clamping to 1452 bytes (or 1432 for 8to4 tunnels).

2. Multi-Homing & Asymmetric uRPF (BCP 38) Drops

In IPv8, your IP address is hard-coded to your primary ASN (64496.10.0.1). If you multihome with two upstream transit providers (Provider A and Provider B) and send outbound packets via Provider B:

• Provider B’s ingress filters (strict uRPF / BCP 38) check if Provider B is the shortest path to AS 64496.
• Since Provider A is the primary route, Provider B silently drops all your outbound traffic as spoofed packets.

3. Legacy Switch ASICs Punt to CPU Slow-Path

Fixed-function switch chips (Broadcom Tomahawk/Trident, Cisco Silicon One) in modern data centers have TCAM microcode hardwired for 32-bit IPv4 (0x0800) and 128-bit IPv6 (0x86DD). They do not know what EtherType 0x88B8 is.

• Packets cannot be switched at line rate (400Gbps/800Gbps) in hardware.
• Switches punt IPv8 frames to the control-plane CPU exception queue, causing massive packet loss and throughput dropping from 400Gbps to <10Gbps.

4. The Monolithic Zone Server DDoS Target

Putting DHCP, DNS, NTP, Syslog, OAuth2 auth, and NAT into one "Zone Server" gateway creates the ultimate single point of failure. A simple UDP reflection attack against port 8080 or port 53 simultaneously knocks out time synchronization, dynamic addressing, token verification, and Internet egress for the entire company.

The Catastrophic: Economic Collapse for RIRs and Tier-1 Upstreams

1. RIRs (ARIN, RIPE, APNIC) Go Financially Bankrupt

• RIRs are non-profits funded by tiered annual fees based on the volume of IP space held.
• Under IPv8, registering a single 32-bit ASN ($100–$500/yr) gives you 4.3 billion routable IP addresses.
• Address volume is decoupled from fees, collapsing RIR operational revenues by 75% to 90%.
• The multi-billion dollar secondary IPv4 transfer market ($40–$55 per IP) is wiped out overnight.

2. The Speculative "Run on 32-bit ASNs"

Because 1 ASN = 4.3 Billion IPs, domain squatters and spammers will rush to hoard thousands of 32-bit ASNs, depleting the global ASN registry within years.

3. Tier-1 Transit Margin Destruction & Core TCAM Explosion

• DFZ Route Explosion: Today's global BGP table has ~1.15M routes. In IPv8, with 115,000+ ASNs announcing Tier-1 and Tier-2 subnets, the Default-Free Zone expands to 3,000,000 to 5,000,000+ active routes, forcing billions of dollars in linecard replacements across global backbones.
• RINE Peering Revenue Loss: IPv8's RINE mandate (100.0.0.0/8) forces zero-cost regional peering, depriving Tier-1 transit providers (Lumen, Arelion, NTT) of their high-margin transit commit revenue that funds transoceanic subsea cables.

Read the Full Whitepaper

We compiled our full data, test methodology, and protocol dissection into a comprehensive research paper:

Let us know what you think in the comments!

— goonhost.rocks Research Team