Every packet leaving an IPv6 network that isn't NATed has an effective node ID in the packet. No need to guess just look at the packets.

Most devices support privacy extensions (temporary v6 addresses) for this exact reason. https://www.rfc-editor.org/rfc/rfc4941

Those IPv6 privacy extensions still reveal when the same node connects to a sequence of destinations within the address change interval, though. E.g. observers can see a single device connects to Facebook, OnlyFans, Pornhub and PayPal in that order.

Behind a NAT, observers can only make that connection (using only addresses) for the network as a whole, instead of an individual device on the network. So the privacy extensions are weaker than NAT

(If the IPv6 privacy extensions used a different address for each connection, they would be more like NAT in this regard.)

That said, other observable clues still allow connections from a single device to be associated, NAT or not. There's TCP OS fingerprinting for example, and the close timing of related connections.

That requires someone who has the ability to monitor all your traffic - ie the government, your ISP, or a hacker who has infiltrated one of those two.

In this scenario it's a lot more work trying to map out your infrastructure than to try performing a MITM connection against some of your outbound traffic.

This helps mitigate correlations over time but doesn't do anything to mask the identity of the node within a given refresh interval (default one day).

Your machines could change their IPs for every second of every day and you wouldn't come close to exhausting your /64 subnet for the next billion years.

The limit of changing addresses once every N seconds as N approaches 0 is equal to offline.

With any usable N, a clever observer would still easily work out what you were doing and still map out your infrastructure.

What kind of observer is 1. able to listen to the entirety of your network's outside communications, 2. interested at all in it, 3. harm you only on the condition that they "map out" your internal infrastructure? This isn't a novel, the goal is not to solve intricate security non-problems.

Your ISP, "mapping your network" means being able to take data that was previously an amalgam of a household and reliably split it into the individual members and devices for better targeting.

Take a moment and learn about Nokia’s Deepfield or Kintec.

The ISPs have the ability to see what is on your network by IPv4 egress. They have been able to do this for a decade.

Worrying that an IPv6 address divulges the network forgets that IPv4 devices betray their existence through DNS, their destinations and other network behavior.

The ISPs know.

Unless you're part of the tiny percent of people who run their own router, your ISP can just monitor what goes through your ISP-provided router.

With the home router+wifi market estimated to be USD 2070.43 million in 2022, I wouldn't say it's a tiny percentage of people, just people you know.

Most people don't buy their own router, the ISPs bulk buy thousands of routers at a time. The ISPs make up most of the market.

Many of these routers are managed by the ISP using protocols such as TR-069, several ISPs have already been found to not only manage the devices but also monitor certain data including what devices are present.

This is pure anecdata, but almost everyone I know, include the people who aren't particularly computer-savvy, owns their own router and cable modem so that they don't have to pay a rental fee to their ISP.

I don't think charging rent for consumer broadband equipment is common in many countries, at least not in Europe.

1. Where does this stat come from?

2. You can't say anything about the percentage with just the absolute market value. At the very least you need something else to compare it too.

Please, be serious.

A reader who's actually interested in getting the source, might try Googling for "2070.43", or even "2070.43 million wifi". I must admit, I wasn't serious enough about my comment to spend $3,250 on the whole report, and had to go off of the public preview. Since you seem to be more serious, maybe you could pay the $4,400 for a multi-user licensed copy of the report and share the PDF with me? I'd love to read more of the analysis.

So, I mean, I dunno, 2 billion dollars seems serious to me, but maybe we just have different barometers for what counts as "serious amounts of money". Especially considering these devices that are like $300.

Finally, might I remind you of the guidelines? in particular:

> When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."

https://news.ycombinator.com/newsguidelines.html

"The network is secure" is a common fallacy.

"Those who don't know what to say quote adages" is a common saying.

??

There is a whole industry built around network traffic analysis.

What makes you think it doesn't happen on the internet?

A common saying that ... invalidates itself?

Why would changing N seconds break network? It would presumably keep active addresses until connections finish. IPv6 requires supporting multiple addresses per interface.

More reasonable is to use new address for each connection. Then nobody can tell if 10 addresses and 10 connections are one device or ten.

This looks like NAT pushed down to the endpoint itself.

You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME.

What are valid values in the scenario you are proposing? The defaults are 1 week / 1 day, so 7X. If you chose to rotate each second, and say allowed addresses to only be valid for say 20 minutes, this still appears to be a ~1200X blowup in routing overheads.

> You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME.

They have not?

The global routing table size for ipv6 at max is a /32 (if i remember correctly) every customer gets a /56 prefix to use in their network, so the routing table entry would still be the same, no matter how many addresses you use to cycle through in your /64.

ARP caches do not exist in IPv6, and Neighbour discovery does not have the same "cache" mechanism as ARP does, it uses an entirely different mechanism for neighbour discovery. (which is also far more lightweight considering it is using multicast, compared to the broadcast of ARP).

I don't understand what you mean. Neighbor Discovery Caches certainly are a thing.