IPv8: The Draft of a New Internet

Update (July 20, 2026): This read-through took the draft seriously on its engineering merits and left the deployment question open. The follow-up closes it: Why IPv8 Will Never Work (and the Ideas Worth Stealing).

• The IPv6 Paradox: Winning the Stat, Losing the War
• What IPv8 Actually Proposes
• The Zone Server: Your Whole Network Stack in One Pair of Boxes
• A Home Network Under IPv8
• How Big Does a Zone Server Have to Be?
• Where It Gets Expensive
• The Skeptic’s Section
• Why We’re Watching

In April, an Internet-Draft landed with the least modest title possible: Internet Protocol Version 8 (draft-thain-ipv8-00, J. Thain, One Limited, 14 April 2026). It is an individual submission — not adopted by any IETF working group, intended status Standards Track, expires in October. Most drafts like this sink without a ripple.

This one is worth your time anyway, for two reasons. First, its diagnosis of why IPv6 stalled is the most honest one I’ve seen written down in an IETF document. Second, it proposes something genuinely different — not a bigger address, but a managed network protocol, where DHCP, DNS, NTP, telemetry, authentication, and egress policy are one integrated system instead of six products that have never heard of each other. The centerpiece is a thing called a Zone Server, and the first question every operator should ask about it is the one this post tries to answer: what does that box have to be, and when does running it get expensive?

The IPv6 Paradox: Winning the Stat, Losing the War

Let’s be fair to IPv6 before we bury it. On March 28, 2026 — about two weeks before this draft was published — native IPv6 crossed 50% of traffic to Google for the first time: 50.10%, eighteen years after World IPv6 Day was supposed to kick things off. France sits around 86%, Germany and India in the mid-70s. The draft’s claim that IPv6 “carries a minority of global internet traffic” was, strictly speaking, out of date the day it was posted.

So why does every network engineer reading this still spend their day in RFC 1918 space?

Because the headline number measures the easy half of the problem. Mobile carriers and eyeball ISPs deployed IPv6 where it was one vendor decision applied to millions of subscribers. The other half — enterprise internal networks, the place where you and I actually work — barely moved. The campus is v4. The data center underlay is v4. The management network is definitely v4. And the transition model that was supposed to fix this made a promise nobody priced: dual-stack, which is not a migration but a commitment to run two networks, two addressing plans, two firewall policies, and two sets of failure modes, indefinitely, for zero operational reward.

That’s the draft’s real critique, and it’s the part that lands:

“The operational cost of the dual-stack transition model, combined with the absence of management improvement, proved commercially unacceptable.”

IPv6 gave us more addresses and nothing else. No better DHCP. No unified identity. No answer to the fact that DHCP, DNS, NTP, syslog, SNMP, and authentication were “specified independently over four decades, share no common identity model, no common authentication mechanism, and no common telemetry format” — that’s the draft again, and it’s just true. After 25 years, the incentive to endure dual-stack pain in exchange for only bigger addresses turned out to be approximately zero. The 50% milestone doesn’t refute that; it confirms it. We got half an internet upgraded — the half where one throat could be choked — and a permanent tax on everyone else.

What IPv8 Actually Proposes

The draft’s answer is a 64-bit address with a structure a network engineer can read at a glance:

r.r.r.r.n.n.n.n
└──┬───┘└──┬───┘
   │       └── 32-bit host address — IPv4 semantics, unchanged
   └────────── 32-bit ASN routing prefix

Your ASN is your prefix. AS64496’s address space is 64496.n.n.n.n — the draft defines an ASN dot notation so 64496.192.0.2.1 is a legal way to write an address. Every ASN holder gets 2³² hosts. A few consequences fall out of that one decision:

• IPv4 is a proper subset, not a peer. An IPv8 address with r.r.r.r = 0.0.0.0 is an IPv4 address, processed by standard IPv4 rules. No dual stack, no flag day, no translation for legacy traffic — an IPv4-only device or application just keeps working, unmodified. This is the draft’s answer to the incentive problem that killed IPv6 adoption: you don’t migrate to IPv8, you get absorbed by it.
• The global routing table becomes structurally bounded. One entry per ASN — about 175,000 today — instead of BGP4’s 900,000+ prefixes and counting. A /16 minimum injectable prefix rule kills deaggregation at AS boundaries, and every BGP8 advertisement must validate against a WHOIS8 route registry before installation. Bogon filtering stops being a manually maintained list and becomes a protocol property.
• Routing gets a telemetry-driven metric. A 32-bit Cost Factor accumulates across hops, derived from measured RTT, loss, congestion state, stability, capacity, policy — with a “physics floor”: no path may claim to be faster than the speed of light over the great-circle distance, and one that does is flagged as an anomaly. Anycast stops being a special address class and becomes an emergent property of the metric.
• Deployment is a software update. The header is IPv4’s with the two address fields widened — 8 octets longer in total. Existing sockets code runs through a compatibility shim; new code gets AF_INET8. Islands of IPv8 cross IPv4-only transit through 8to4 tunneling (HTTPS-encapsulated, auto-configured from a BGP8 attribute), and the Cost Factor quietly punishes those tunneled paths with honest latency numbers — an economic nudge for transit ASNs to upgrade, instead of a mandate.

Internally, organizations get 127.x.x.x zone prefixes — 2⁵⁶ of internal address space that can never conflict between zones, never route externally, and never collide when two companies interconnect (a reserved 127.127.0.0 DMZ prefix plus paired translators handles that without either side seeing the other’s internals).

All of it is coherent, opinionated, and — I want to be clear about this — an enormous amount of surface area for a -00 individual draft. Which brings us to the box that has to make all of it real.

The Zone Server: Your Whole Network Stack in One Pair of Boxes

The Zone Server is where IPv8 stops being an addressing proposal and becomes an operational philosophy. It’s a mandatory active/active pair per zone that runs, on one platform: DHCP8 (address assignment), DNS8 (resolution), NTP8 (time), NetLog8 (telemetry collection), OAuth8 (a local JWT validation cache — every manageable element authenticates with OAuth2 tokens, validated locally with no round trip to an identity provider), a WHOIS8 resolver (route validation), ACL8 (access control), and XLATE8 (IPv4/IPv8 translation).

It is not a quiet participant. In the draft’s design:

• The pair are the default gateways for every VLAN (.254 primary, .253 secondary) and the spanning-tree roots (even VLANs on one, odd on the other).
• Every end device maintains a persistent TCP/443 connection to the Zone Server — that’s a Tier 1 compliance requirement, alongside NetLog8 and client-side ACL8 enforcement.
• Egress is deny-by-default in a way no firewall vendor ever quite shipped: an outbound connection requires a corresponding DNS8 lookup — no lookup, no XLATE8 state entry, no connection — and the destination ASN must validate against the WHOIS8 registry. The draft’s stated goal: “eliminate the primary malware command-and-control channel: connection to hardcoded IP addresses without DNS resolution.”
• Even the NICs report to it: certified firmware enforces hardware rate limits (10 broadcasts/sec; unauthenticated users capped at 10 packets/sec) and only the Zone Server can raise them.

And for everyone whose next question is so do my VLANs go away? — no, they get demoted from policy to plumbing. 802.1Q and per-VLAN spanning tree are mandatory on every compliant L2 device, and the Zone Server pair are the PVRST roots (primary roots the even VLANs, secondary the odd — that’s how the active/active pair splits the L2 load). What changes is what membership means: switch-port OAuth2 binding is a MUST, so a port’s VLAN follows the authenticated identity — 802.1X dynamic VLANs made mandatory, keyed to the same JWT everything else uses — and the 127.x zones ride on top as the L3 identity of each segment. Isolation is enforced at three layers (NIC firmware ACL8, the Zone Server gateway, hardware VLAN enforcement at the port), and the default between zones is the strongest kind of deny: no route exists at all. Letting 127.1.x.x talk to 127.2.x.x is precisely what an ACL8 grant at the Zone Server gateway does — and because the zone prefix is the segment identity, the rule finally reads the way engineers think: zone 1 to zone 2, this service, allow. One catch worth flagging: ACL8’s policy grammar lives in a companion spec that hasn’t been published yet. The architecture is clear; the syntax is vapor.

If you’ve operated networks for a living, you can feel both halves of this. The attraction: DHCP, DNS, NAC, egress filtering, logging, and NTP as one system with one identity model — the thing every “single pane of glass” vendor has promised and never delivered, specified as protocol instead of product. The dread: that’s a lot of your network in one pair of boxes.

A Home Network Under IPv8

The first question anyone raised on IPv6 asks: with 2⁶⁴ addresses, does every device in my house finally get a unique, globally routable address?

No — and the draft means it. Section 3.11 says the quiet part in plain text: “Most devices on most networks use 127.x.x.x internal addressing. Public ASN addresses are used only for explicitly public-facing services.” IPv8 looks at IPv6’s every-toaster-gets-a-global-address model and rejects it on purpose. And the arithmetic backs the philosophy: global space is carved per ASN, and each ASN holds exactly 2³² hosts — an IPv4-sized pool per ISP. A national eyeball network that handed every subscriber device a global address would be rationing a 32-bit pool again inside a decade, which is the precise disease this protocol exists to cure. So homes don’t hold ASNs, homes don’t get global space, and nothing in your house is reachable from the internet unless you explicitly publish it.

Here’s the whole story in one picture:

                     IPv8 internet
                          │
           ┌──────────────┴───────────────┐
           │         ISP — AS 64496       │
           │   owns 64496.n.n.n.n — a     │
           │   32-bit pool, IPv4-sized    │
           └──────────────┬───────────────┘
                          │  DHCP8 WAN lease — the home's ONE
                          │  external address:
                          │      64496.203.0.113.9
           ┌──────────────┴───────────────┐
           │  HOME ROUTER  =  ZONE SERVER │
           │      (local authority mode)  │
           │  DHCP8 DNS8 NTP8 OAuth8      │
           │  NetLog8 ACL8 XLATE8 · .254  │
           └──────────────┬───────────────┘
                          │  internal zones (127.x — never routed)
        ┌─────────────────┼─────────────────┐
        │                 │                 │
   zone 1: trusted   zone 2: IoT       zone 3: guest
   laptop            lightbulb         visitor phone
   127.1.0.0.        127.2.0.0.        127.3.0.0.
     192.168.1.50      192.168.1.50      192.168.1.50

     same host bits in all three zones — no conflict, no
     renumbering, and no route between zones unless ACL8 says so

  laptop → example.com
    1. DNS8 lookup (required, logged)              ✓
    2. XLATE8:  127.1.0.0.192.168.1.50
                → 64496.203.0.113.9                ✓
    3. WHOIS8:  destination ASN registered?        ✓  routed

  lightbulb → hardcoded 198.51.100.7 (no DNS lookup first)
    ✗  no DNS8 state → no XLATE8 entry → dropped + logged

Walk the life of the network: your router — which is the Zone Server, in what the draft calls “local authority mode” — takes one DHCP8 lease from the ISP and becomes the home’s single external address. Every device inside gets its address, DNS, NTP, log target, auth token, and access policy from one DHCP8 response — there is no second setup step. Devices land in internal zones (127.1 trusted, 127.2 IoT, 127.3 guest), which can reuse identical host bits without conflict and can’t reach each other unless policy says so — VLAN-grade segmentation as the default in a house. Outbound, everything funnels through the router’s XLATE8 onto that one WAN address, and the DNS-first rule applies to your smart bulb the same as to a datacenter: firmware that phones home to a hardcoded IP gets dropped and logged, out of the box, on grandma’s router. That’s the trade IPv8 offers the home: you give up the IPv6 dream of end-to-end per-device reachability — inbound hosting is back to explicit published mappings, which will annoy the P2P and self-hosting crowd — and in exchange the default posture of a consumer network becomes deny-by-default egress with an audit trail, enforced by protocol instead of by a security product nobody’s grandmother will ever buy.

Old NAT as new doctrine, in other words. IPv6 spent twenty-five years calling translation a sin to be abolished; IPv8 promotes the translator to the policy point and writes it into the spec. Whether you find that liberating or heretical is a reliable test of how long you’ve been running networks.

Is it PAT? At the home edge, functionally yes — many hosts behind one external address leaves L4 ports as the only flow discriminator, so that XLATE8 table is doing what your NAT router does tonight, just DNS-gated, identity-bound, and logged. But where there’s address room, the 64-bit split changes the mechanics: between non-overlapping zone prefixes (enterprise zones, the inter-company DMZ), XLATE8 can swap the r.r.r.r prefix and carry n.n.n.n through untouched — one-to-one prefix rewriting, NPTv6-style, no port multiplexing. That’s the only reading under which the draft’s “no NAT complexity” claim holds: IPv4 NAT’s pain was never translation, it was cramming many hosts through too few bits, and the ASN prefix gives the bits back. (XLATE8’s wire mechanics live in an unpublished companion spec, so mark that paragraph as inference from the address arithmetic — but the arithmetic doesn’t leave many alternatives.)

How Big Does a Zone Server Have to Be?

The draft doesn’t say — no sizing appendix, no reference hardware. So let’s do what we’d do for any stateful middlebox and derive it. A Zone Server’s load scales on three mostly independent axes:

Axis 1 — devices (cheap). Per device you hold: a DHCP8 lease (~hundreds of bytes), a cached OAuth2 JWT (a few KB), sticky-MAC/port bindings (trivial), and that persistent TLS connection — realistically ~30–50 KB of kernel buffers and session state each. Ten thousand devices costs you well under 1 GB of connection state and a few thousand TLS handshakes at cold boot. A million devices is ~30–50 GB and a file-descriptor tuning exercise — unpleasant, not exotic. Device count alone never makes this box expensive.

Axis 2 — flows (the CPU story). Every egress connection creates validated XLATE8 state: check that a DNS8 lookup preceded it, evaluate ACL8 policy, validate the destination ASN against WHOIS8 (a lookup against ~175K entries — cache-resident, cheap), insert state, and — because the pair is active/active — synchronize that state to the peer. Concurrent flow state is trivial (an enterprise endpoint averages tens of flows; even 10K devices is only a few hundred MB). The cost is setup rate: a 10K-device campus idles at maybe 2–10K new flows/sec and bursts far higher — say a patch window, or everyone’s laptop opening 60 connections to a SaaS app at 9:00 AM. Stateful setup with peer sync at 50K+/sec is precisely the number where firewall vendors start quoting you their bigger appliance.

Axis 3 — bits and events (the money story). Two sub-items:

• Data plane. In the default posture the Zone Server pair is the gateway — all north-south traffic, and any inter-VLAN east-west, transits it and its translation/policy engines. Software forwarding with per-flow NAT-class state and ACL evaluation on commodity hardware is a solved-but-not-free problem: figure a well-tuned box moves 10–40 Gbps of this workload comfortably, more with kernel-bypass heroics or SmartNIC offload. The draft leaves an escape hatch — Tier 3 edge devices must implement XLATE8 too, so large shops can push the data plane into hardware and keep the Zone Server as control plane. That single deployment choice is the biggest fork in the cost curve.
• Telemetry. NetLog8 makes the Zone Server your log aggregator — every device, switch, NIC violation, DHCP event, auth event, and flow record lands here. Assume a modest 0.2–1 events/sec/device at a few hundred bytes each: a 10K-device zone produces roughly 50–350 GB/day raw, call it 5–40 GB/day compressed — 0.5–3.5 TB a quarter, before you’ve decided how long you’re legally required to keep it. Storage is the line item that grows linearly forever while everything else in this list is a one-time box purchase.

Put the axes together and the tiers fall out:

Zone size	Shape	What the pair looks like	Rough cost
Home, ≤50 devices	Firmware feature	The router you already own (the draft explicitly contemplates a “home router in local authority mode”)	~$0
Small office, ~500	Two small VMs or 1U boxes	4–8 cores, 16–32 GB, 1 GbE, ~1 TB of log retention a quarter	Low thousands, or a couple hundred a month hosted
Campus, ~5–10K	Pair of serious stateful gateways	32–64 cores, 64+ GB, 25–100 GbE, NVMe for logs; or modest control-plane boxes + XLATE8 offloaded to the edge	$30–80K for the pair, plus log infrastructure
One giant zone, ≥50–100K	Don’t.	100 GbE+ fleet, state-sync engineering, 10–100 TB of logs a quarter — you have rebuilt carrier CGNAT plus an IDS plus a SIEM	Seven figures a year, all-in

Where It Gets Expensive

The knee in the curve is sharper than it looks, and it’s worth naming the three thresholds because crossing any one of them moves you out of commodity hardware:

1. ~10 Gbps sustained egress through the pair — past this, software forwarding with per-flow validation wants either kernel-bypass engineering or hardware offload, and both cost real money and real expertise.
2. ~10–50K new flows/sec with active/active state sync — replicated stateful setup is the classic HA scaling wall; it’s why datacenter firewalls cost what they cost.
3. ~10K devices’ worth of always-on telemetry — not because ingest is hard, but because retention is a treadmill. The boxes are capex; the logs are a subscription you pay forever.

Here’s the part I find genuinely clever, though: the protocol’s own architecture is the escape valve. Those 127.x.x.x internal zone prefixes exist precisely so you can shard — 2²⁴ possible zones, each with its own Zone Server pair, each sized like the small rows of that table. The design quietly assumes many small zones rather than one heroic pair, the same way we learned to build many small failure domains instead of one giant L2. A Zone Server stays boring below roughly 5–20K devices and single-digit Gbps per zone. The draft never says “don’t build a 100K-device zone,” but every incentive in it points that way.

And note who’s actually paying: a home user pays nothing (it’s the router). An SMB pays less than they currently pay for their firewall + RMM agent + log tool separately. A large enterprise already owns firewalls, NAC, a SIEM, DHCP appliances, and an NTP infrastructure as separate line items — for them, the Zone Server isn’t new spend so much as forced consolidation of existing spend. Whether that consolidation is a dream or a single point of failure is, conveniently, the next section.

The Skeptic’s Section

Honesty about the other direction, because a draft this ambitious earns it:

• It’s a -00 individual submission. No working group has adopted it; the companion protocol specs it leans on (DHCP8, the routing documents, NetLog8) are referenced, not yet standardized. The distance between this document and running code on your campus is measured in years, if it ever closes.
• The Zone Server concentrates blast radius. The same box that hands out leases also decides whether your packets leave the building. The draft’s answer is the mandatory active/active pair and NIC-level fallbacks, but “my DHCP server is down” and “my entire network’s egress policy engine is down” are different pages in the incident runbook.
• DNS-gated egress will break real things. No DNS lookup, no connection kills hardcoded-IP C2 — and also direct-IP diagnostics, some VPN bootstraps, DoH clients that resolve outside DNS8’s view, and a long tail of legacy software that was never taught to behave. Every operator knows how exception lists like this end.
• Certification is a mountain. Hardware-enforced NIC rate limits, switch-port OAuth2 binding, mandatory VRFs on every device — this requires the entire vendor ecosystem to ship compliant silicon and firmware. The tier rules are blunt about it: every L3 network device MUST implement eBGP8, IBGP8, and OSPF8 — meaning your home router ships a BGP stack that will never peer with anything (homes don’t hold ASNs; the router just takes a DHCP8 default route), yet that dark code still has to be certified, patched, and attack-surface-audited forever. Hosts escape — Tier 1 end devices only MAY implement routing protocols — but the router mandate is exactly the kind of MUST that makes vendor test matrices explode. IPv6 only asked vendors for a bigger address field, and that took a decade.
• The politics of ASN-anchored addressing are unexplored. Two-to-the-thirty-two addresses per ASN holder is elegant if you hold an ASN. Consumers and small shops live inside their ISP’s prefix — structurally similar to today’s CGNAT reality, now with better management. The RIR-policy conversation hiding in this draft is enormous.
• And the uncomfortable mirror: IPv6 didn’t stall for technical reasons, so a technically superior successor isn’t automatically a deployed one. IPv8’s IPv4-subset trick is the most serious answer to the incentive problem anyone has proposed — deployment without migration — but “the incumbent protocol never has to die” cuts both ways.

Why We’re Watching

Strip away the version number and the draft is really a bet about operations: that the next protocol wins not by having more addresses but by making networks radically cheaper to run — one identity model, one telemetry stream, one place where policy lives, egress that’s explainable by construction.

Whatever happens to IPv8, that bet is already correct. And whichever protocol your gear speaks in 2030, the daily reality of network work won’t change: something will be broken, the answer will be on a device, and somebody will be reading show output at 2 AM trying to reconstruct what the network actually did — which is the problem we work on. Transit is an AI-native SSH client whose investigation-only agent reads your gear and proposes the next diagnostic command without ever being able to change anything. The terminal is free; the AI has a 14-day trial. If a Zone Server ever does eat your DHCP, DNS, and firewall, you’ll want a very good way to ask it questions.

Read the draft yourself: draft-thain-ipv8-00. IPv6 adoption numbers: Google IPv6 statistics, APNIC on the 50% crossing, Internet Society Pulse. Zone Server sizing in this post is our own back-of-envelope from the draft’s stated requirements — the draft itself publishes no sizing guidance; assumptions are stated inline and we’d love to be argued with.