Show HN: Implementing the IPv8 Internet-Draft in Linux, Libc, and BGP

Posted by TurboRigby • August 14, 2026 • 6 min read

The Hook: Why We Embarked on This Journey

A few weeks ago, our team stumbled upon an intriguing Internet-Draft: draft-thain-ipv8-02, which outlines a proposal for Internet Protocol Version 8 (IPv8).

The specifications within the draft make some truly bold assertions:

Zero Address Exhaustion: Every single ASN holder is automatically granted $2^{32}$ (4,294,967,296) host addresses.

Total Backward Compatibility: IPv4 is treated as a proper subset of the IPv8 space.

Unified Network Management: A "Zone Server" bundles all critical services (DHCP, DNS, NTP, Syslog, WHOIS, NAT, and ACLs). Furthermore, every packet is validated via DNS8/WHOIS8 and authorized using OAuth2 JWT tokens.

To most seasoned network engineers, this reads like a satirical "April Fools" RFC written by someone obsessed with corporate buzzwords. However, rather than simply arguing the merits on a mailing list, the team at goonhost.rocks decided to actually build the specification to see how it would behave in a distributed, multi-AS environment.

---

The Engineering Phase: What We Built

We developed a full-stack implementation of IPv8, spanning from the lowest levels of the kernel to high-level user-space applications.

Implementation Checklist

• Linux Kernel 6.6 Integration
• Musl Libc Extensions
• iproute2 Tooling
• FRRouting (BGP8)
• Go-based Zone Server
• Nginx & cURL Support
• 10-Node QEMU Testbed

Technical Component Breakdown

Network Architecture

We deployed a 10-node QEMU environment simulating 4 Autonomous Systems: AS 64496, AS 64497, AS 64498, and AS 64499. This testbed handled over 112,000 active FIB routes using a custom trafficgen8 tool.

---

The Results: The Good, The Bad, and The Catastrophic

The Good (Lab Success)

In a controlled sandbox, the protocol actually functions:

• Connectivity: Running curl -i http://64497.20.0.0.254/ successfully returns an HTTP/1.1 200 OK from Nginx across the WAN mesh.
• Bootstrapping: dhcp8c successfully acquires dual-gateway leases (.254 for even, .253 for odd) and syncs time via NTP8 in $\approx 2.27\text{ ms}$.
• Performance: The kernel's fib_trie managed 112,117 routes with sub-millisecond latency.

# Example successful request
$ curl -i http://64497.20.0.0.254/
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 154

<html><body><h1>Welcome to IPv8 Node 254</h1></body></html>

The Bad (Technical Friction)

1. Path MTU and "Silent Blackholing"

IPv8 increases the header size from 20 bytes to 28 bytes (adding 4 bytes to both source and destination).

• The Math: $\text{1460 (Payload)} + \text{20 (TCP)} + \text{28 (IPv8)} = 1508\text{ bytes}$.
• The Problem: This exceeds the standard 1500-byte Ethernet MTU. Legacy middleboxes often drop these packets without sending ICMP "Fragmentation Needed" messages.
• The Fix: Global enforcement of TCP MSS Clamping to 1452 bytes (or 1432 for 8to4 tunnels).

2. Asymmetric uRPF Drops

Since IPv8 addresses are hard-coded to a primary ASN (e.g., 64496.10.0.1), multi-homing becomes a nightmare. If you send traffic via "Provider B" but your primary route is "Provider A," Provider B's ingress filters (BCP 38) will flag the packet as spoofed and drop it.

3. Hardware "Slow-Path" Punting

Modern ASICs (like Cisco Silicon One or Broadcom Tomahawk) are hardwired for IPv4 (0x0800) and IPv6 (0x86DD). Because they don't recognize IPv8, they punt frames to the control-plane CPU.

• Result: Throughput collapses from 400Gbps $\rightarrow$ 10Gbps.

4. The Zone Server Vulnerability

Consolidating DHCP, DNS, NTP, and Auth into one "Zone Server" creates a massive single point of failure. A single UDP reflection attack on port 8080 could simultaneously kill a company's time sync, IP addressing, and internet access.

---

The Catastrophic: Economic and Global Fallout

If IPv8 were actually adopted, the systemic shocks would be devastating:

1. RIR Bankruptcy: Regional Internet Registries (ARIN, RIPE, etc.) rely on fees based on IP volume. If one 32-bit ASN provides 4.3 billion IPs for a flat fee, RIR revenues would plummet by 75% to 90%.
2. Market Crash: The secondary IPv4 transfer market ($40–$55 per IP) would be annihilated instantly.
3. ASN Hoarding: A speculative gold rush for 32-bit ASNs would occur, as spammers and squatters hoard them to control billions of IPs.
4. BGP Table Explosion: The Default-Free Zone (DFZ) would buckle. With 115,000+ ASNs announcing massive subnets, the global BGP table would expand far beyond current hardware capacities.