// HACKER NEWS — CYBERSECURITY
Show HN: We Implemented the IPv8 Internet-Draft in Linux, Libc, and BGP
A few weeks ago, an Internet-Draft titled Internet Protocol Version 8 (IPv8) — draft-thain-ipv8-02 caught our eye.
Most network engineers would laugh this off as an April Fools RFC written by an enterprise architect on buzzword overdrive. But instead of just arguing on mailing lists, the team at goonhost.rocks decided to actually build the entire specification from scratch and test what happens when you deploy it across a distributed multi-AS network.
We implemented the complete IPv8 stack from ring-0 kernel code up to user-space applications:
In an isolated sandbox, the protocol works surprisingly smoothly:
IPv8 addresses add 4 bytes to source and 4 bytes to destination, expanding the IP header from 20 to 28 bytes.
In IPv8, your IP address is hard-coded to your primary ASN (64496.10.0.1). If you multihome with two upstream transit providers (Provider A and Provider B) and send outbound packets via Provider B:
Fixed-function switch chips (Broadcom Tomahawk/Trident, Cisco Silicon One) in modern data centers have TCAM microcode hardwired for 32-bit IPv4 (0x0800) and 128-bit IPv6 (0x86DD). They do not know what EtherType 0x88B8 is.
Putting DHCP, DNS, NTP, Syslog, OAuth2 auth, and NAT into one "Zone Server" gateway creates the ultimate single point of failure. A simple UDP reflection attack against port 8080 or port 53 simultaneously knocks out time synchronization, dynamic addressing, token verification, and Internet egress for the entire company.
Because 1 ASN = 4.3 Billion IPs, domain squatters and spammers will rush to hoard thousands of 32-bit ASNs, depleting the global ASN registry within years.
We compiled our full data, test methodology, and protocol dissection into a comprehensive research paper: