September 2000 - NANOG - lists.nanog.org

RE: IPv6 allocatin (was Re: ARIN Policy on IP-based Web Hosting)
by Morgan Dollard 03 Sep '00

03 Sep '00

I disagree, IPv6 is already significantly being deployed in the Inernet2. So far though that is only used by University and research orgs, kinda like Arpanet was in teh begining. Significant new applications are being deployed for it specifically, and great innovations are taking place. Eventually, that will replace the Internet as we know it today, and IPv6 will be implemented, unless someone comes up with anything better, which isnt that unlikely. Morgan -----Original Message----- From: smd(a)clock.org [mailto:smd@clock.org] Sent: Friday, September 01, 2000 15:56 To: David.Conrad(a)nominum.com; mohta(a)necom830.hpcl.titech.ac.jp Cc: nanog(a)merit.edu; ted(a)mirror-image.net Subject: Re: IPv6 allocatin (was Re: ARIN Policy on IP-based Web Hosting) | When, do you think, will IPv6 come someywhere close to being | significantly deployed? When pigs fly and the devil invests in snow-removal equipment. Sean. Disclaimer ---------- This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. This communication represents the originator's personal views and opinions, which do not necessarily reflect those of the NSC Group. If you are not the original recipient or the person responsible for delivering the email to the intended recipient, be advised that you have received this email in error, and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. If you received this email in error, please immediately notify administrator(a)nscglobal.com.

7 8

FW: (ngtrans) IAB/IESG Recommendations on IPv6 Address Delegation
by Gregory Soo 02 Sep '00

02 Sep '00

-----Original Message----- From: Steve Deering [SMTP:deering@cisco.com] Sent: Friday, September 01, 2000 7:02 PM To: ipng(a)sunroof.eng.sun.com Cc: ngtrans(a)sunroof.eng.sun.com; Bob Hinden Subject: (ngtrans) Fwd: IAB/IESG Recommendations on IPv6 Address Delegation Appended below is the message that was sent today to the RIRs from the IAB and IESG, regarding IPv6 address allocation policy. It contains most of the material that was in the draft I forwarded here on Sunday, but reorganized into a more coherent document. Steve >-----Original Message----- >Date: Fri, 01 Sep 2000 12:40:48 -0700 >To: lir-wg(a)ripe.net (RIPE), policy(a)arin.net (ARIN), > apnic-talk(a)apnic.net (APNIC) >From: Fred Baker <chair(a)ietf.org> >Subject:IAB/IESG Recommendations on IPv6 Address Delegation >Cc: ipv6-directorate(a)sunroof.eng.sun.com, iesg(a)ietf.org, iab(a)ISI.EDU, > ipv6-wg(a)ripe.net (RIPE), sig-ipv6(a)lists.apnic.net (APNIC) > >Folks: > >The RIR community asked the IETF community for advice regarding the >assignment of IPv6 prefixes to service providers and edge networks, both >with a view to topological address assignment and to multihomed networks. >The IPv6 Directorate prepared a statement, which the IESG and IAB have >reviewed and approved. This is attached. > >I trust that this answers the questions you asked, and serves as a basis for >IPv6 deployment in the near term. If you have questions or issues concerning >it, I would suggest that you address them to the IPv6 Directorate copying >the IESG and IAB. > >We intend to publish an Informational RFC in the near future documenting the >contents of this note. > >Fred Baker > >----------------------------------------------------------------------- > > IAB/IESG Recommendations on IPv6 Address Allocations > September 1, 2000 > >Introduction > >During a discussion between IETF and RIR experts at the Adelaide IETF, >a suggestion was made that it might be appropriate to allocate /56 >prefixes instead of /48 for homes and small businesses. However, >subsequent analysis has revealed significant advantages in using /48 >uniformly. This note is an update following further discussions at >the Pittsburgh IETF. > >This document was developed by the IPv6 Directorate, IAB and IESG, and >is a recommendation from the IAB and IESG to the RIRs. > >Background > >The technical principles that apply to address allocation seek to >balance healthy conservation practices and wisdom with a certain ease >of access. On the one hand, when managing the use of a potentially >limited resource, one must conserve wisely to prevent exhaustion >within an expected lifetime. On the other hand, the IPv6 address >space is in no sense as precious a resource as the IPv4 address space, >and unwarranted conservatism acts as a disincentive in a marketplace >already dampened by other factors. So from a market development >perspective, we would like to see it be very easy for a user or an ISP >to obtain as many IPv6 addresses as they really need without a >prospect of immediate renumbering or of scaling inefficiencies. > >The IETF makes no comment on business issues or relationships. >However, in general, we observe that technical delegation policy can >have strong business impacts. A strong requirement of the address >delegation plan is that it not be predicated on or unduly bias >business relationships or models. > >The IPv6 address, as currently defined, consists of 64 bits of >"network number" and 64 bits of "host number". The technical reasons >for this are several. The requirements for IPv6 agreed to in 1993 >included a plan to be able to address approximately 2^40 networks and >2^50 hosts; the 64/64 split effectively accomplishes this. Procedures >used in host address assignment, such as the router advertisement of a >network's prefix to hosts [RFC 2462], which in turn place a locally >unique number in the host portion, depend on this split. Examples of >obvious choices of host number (IEEE Mac Address, E.164 number, E.214 >IMSI, etc) suggest that no assumption should be made that bits may be >stolen from that range for subnet numbering; current generation MAC >layers and E.164 numbers specify up to 64 bit objects. Therefore, >subnet numbers must be assumed to come from the network part. This is >not to preclude routing protocols such as IS-IS level 1 (intra-area) >routing, which routes individual host addresses, but says that it may >not be depended upon in the world outside that zone. > >The IETF has also gone to a great deal of effort to minimize the >impacts of network renumbering. None-the-less, renumbering of IPv6 >networks is neither invisible nor completely painless. Therefore, >renumbering should be considered an acceptable event, but to be >avoided if reasonably avoidable. > >The IETF's IPNG working group has recommended that the address block >given to a single edge network which may be recursively subnetted be a > >48 bit prefix. This gives each such network 2^16 subnet numbers to >use in routing, and a very large number of unique host numbers within >each network. This is deemed to be large enough for most enterprises, >and to leave plenty of room for delegation of address blocks to >aggregating entities. > >It is not obvious, however, that all edge networks are likely to be >recursively subnetted; an individual PC in a home, or a single cell in >a mobile telephone network, for example, may or may not be further >subnetted (depending whether they are acting as, e.g., gateways to >personal, home, or vehicular networks). When a network number is >delegated to a place that will not require subnetting, therefore, it >might be acceptable for an ISP to give a single 64 bit prefix - >perhaps shared among the dial-in connections to the same ISP router. >However this decision may be taken in the knowledge that there is >objectively no shortage of /48s, and the expectation that personal, >home and vehicle networks will become the norm. Indeed, it is widely >expected that all IPv6 subscribers, whether domestic (homes), mobile >(vehicles or individuals), or enterprises of any size, will eventually >possess multiple always-on hosts, at least one subnet with the >potential for additional subnetting, and therefore some internal >routing capability. Note that in the mobile environment, the device >connecting a mobile site to the network may in fact be a third >generation cellular telephone. In other words the subscriber >allocation unit is not always a host; it is always potentially a site. > >Address Delegation Recommendations > >The RIR communities, with the IAB, have determined that reasonable >address prefixes delegated to service providers for initial >allocations should be on the order of 29 to 35 bits in length, giving >individual delegations support for 2^13 (8K) to 2^19 (512K) subscriber >networks. Allocations are to be given in a manner such that an >initial prefix may be subsumed by subsequent larger allocations >without forcing existing subscriber networks to renumber. We concur >that this meets the technical requirement for manageable and scalable >backbone routing while simultaneously allowing for managed growth of >individual delegations. > >The same type of rule could be used in the allocation of addresses in >edge networks; if there is doubt whether an edge network will in turn >be subnetted, the edge network might be encouraged to allocate the >first 64 bit prefix out of a block of 8..256, preserving room for >growth of that allocation without renumbering up to a point. However, >for the reasons described below, we recommend use of a fixed boundary >at /48 for all subscribers except the very largest (who could receive >multiple /48's), and those clearly transient or otherwise have no >interest in subnetting (who could receive a /64). Note that there >seems to be little benefit in not giving a /48 if future growth is >anticipated. In the following, we give the arguments for a uniform >use of /48 and then demonstrate that it is entirely compatible with >responsible stewardship of the total IPv6 address space. > >The arguments for the fixed boundary are: > > - only by having an ISP-independent boundary can we guarantee that a > change of ISP will not require a costly internal restructuring or > consolidation of subnets. > > - to enable straightforward site renumbering, i.e., when a site > renumbers from one prefix to another, the whole process, including > parallel running of the two prefixes, would be greatly complicated > if the prefixes had different lengths (depending of course on the > size and complexity of the site). > > - there are various possible approaches to multihoming for IPv6 > sites, including the techniques already used for IPv4 multihoming. > The main open issue is finding solutions that scale massively > without unduly damaging route aggregation and/or optimal route > selection. Much more work remains to be done in this area, but it > seems likely that several approaches will be deployed in practice, > each with their own advantages and disadvantages. Some (but not > all) will work better with a fixed prefix boundary. (Multihoming > is discussed in more detail below.) > > - to allow easy growth of the subscribers' networks-no need to > keep going back to ISPs for more space (except for that relatively > small number of subscribers for which a /48 is not enough). > > - remove the burden from the ISPs and registries of judging sites' > needs for address space, unless the site requests more space than a > /48, with several advantages: > > - ISPs no longer need to ask for details of their customers' > network architecture and growth plans > - ISPs and registries no longer have to judge rates of address > consumption by customer type > - registry operations will be made more efficient by reducing the > need for evaluations and judgements > - address space will no longer be a precious resource for > customers, removing the major incentive for subscribers to > install v6/v6 NATs, which would defeat the ability of IPv6 to > restore address transparency. > > - to allow the site to maintain a single reverse-DNS zone covering > all prefixes. > > - If and only if a site can use the same subnetting structure under > each of its prefixes, then it can use the same zone file for the > address-to-name mapping of all of them. And, using the > conventions of RFC 2874, it can roll the reverse mapping data > into the "forward" (name-keyed) zone. > >Specific advantages of the fixed boundary being at /48 include > > - to leave open the technical option of retro-fitting the GSE > (Global, Site and End-System Designator, a.k.a "8+8") proposal for > separating locators and identifiers, which assumes a fixed boundary > between global and site addressing at /48. Although the GSE > technique was deferred a couple of years ago, it still has strong > proponents. Also, the IRTF Namespace Research Group is actively > looking into topics closely related to GSE. It is still possible > that GSE or a derivative of GSE will be used with IPv6 in the > future. > > - since the site local prefix is fec0::/48, global site prefixes of > /48 will allow sites to easily maintain a simple 1 to 1 mapping > between the global topology and the site local topology in the SLA > field. > > - similarly, if the 6to4 proposal is standardized, migration from a > 6to4 prefix, which is /48 by construction, to a native IPv6 prefix > will be simplified if the native prefix is /48. > >Note that none of these reasons imply an expectation that homes, >vehicles, etc. will intrinsically require 16 bits of subnet space. > >Conservation of Address Space > >The question naturally arises whether giving a /48 to every subscriber >represents a profligate waste of address space. Objective analysis >shows that this is not the case. A /48 prefix under the Aggregatable >Global Unicast Address (TLA) format prefix actually contains 45 >variable bits, i.e., the number of available prefixes is 2**45 or about >35 trillion (35,184,372,088,832). If we take the limiting case of >assigning one prefix per human, then the utilization of the TLA space >appears to be limited to approximately 0.03% on reasonable >assumptions. > >More precisely, > > - RFC 1715 defines an "H ratio" based on experience in address space > assignment in various networks. Applied to a 45 bit address space, > and projecting a world population of 10.7 billion by 2050 (see > http://www.popin.org/pop1998/) the required assignment efficiency > is log_10(1.07*10^10) / 45 = 0.22. This is less than the > efficiencies of telephone numbers and DECnetIV or IPv4 addresses > shown in RFC 1715, i.e., gives no grounds for concern. > > - We are highly confident in the validity of this analysis, based on > experience with IPv4 and several other address spaces, and on > extremely ambitious scaling goals for the Internet amounting to an > 80 bit address space *per person*. Even so, being acutely aware of > the history of under-estimating demand, we have reserved more than > 85% of the address space (i.e., the bulk of the space not under the > Aggregatable Global Unicast Address (TLA) format prefix). > Therefore, if the analysis does one day turn out to be wrong, our > successors will still have the option of imposing much more > restrictive allocation policies on the remaining 85%. > > - For transient use by non-routing hosts (e.g., for stand-alone > dial-up users who prefer transient addresses for privacy reasons), > a prefix of /64 might be OK. But a subscriber who wants "static" > IPv6 address space, or who has or plans to have multiple subnets, > ought to be provided with a /48, for the reasons given above, even > if it is a transiently provided /48. > >To summarize, we argue that although careful stewardship of IPv6 >address space is essential, this is completely compatible with the >convenience and simplicity of a uniform prefix size for IPv6 sites of >any size. The numbers are such that there seems to be no objective >risk of running out of space, giving an unfair amount of space to >early customers, or of getting back into the over-constrained IPv4 >situation where address conservation and route aggregation damage each >other. > >Multihoming Issues > >In the realm of multi-homed networks, the techniques used in IPv4 can >all be applied, but they have known scaling problems. Specifically, >if the same prefix is advertised by multiple ISPs, the routing tables >will grow as a function of the number of multihomed sites. To go >beyond this for IPv6, we only have initial proposals on the table at >this time, and active work is under way in the IETF IPNG working >group. Until existing or new proposals become more fully developed, >existing techniques known to work in IPv4 will continue to be used in >IPv6. > >Key characteristics of an ideal multi-homing proposal include (at >minimum) that it provides routing connectivity to any multi-homed >network globally, conserves address space, produces high quality >routes at least as well as the single-homed host case previously >discussed via any of the network's providers, enables a multi-homed >network to connect to multiple ISPs, does not inherently bias routing >to use any proper subset of those networks, does not unduly damage >route aggregation, and scales to very large numbers of multi-homed >networks. > >One class of solution being considered amounts to permanent parallel >running of two (or more) prefixes per site. In the absence of a fixed >prefix boundary, such a site might be required to have multiple >different internal subnet numbering strategies, (one for each prefix >length) or, if it only wanted one, be forced to use the most >restrictive one as defined by the longest prefix it received from any >of its ISPs. In this approach, a multi-homed network would have an >address block from each of its upstream providers. Each host would >either have exactly one address picked from the set of upstream >providers, or one address per host from each of the upstream >providers. The first case is essentially a variant on RFC 2260, with >known scaling limits. > >In the second case (multiple addresses per host), if two multi-homed >networks communicate, having respectively m and n upstream providers, >then the one initiating the connection will select one address pair >from the n*m potential address pairs to connect from and to, and in so >doing will select the providers, and therefore the applicable route, >for the life of the connection. Given that each path will have a >different ambient bit rate, loss rate, and delay, if neither host is >in possession of any routing or metric information, the initiating >host has only a 1/(m*n) probability of selecting the optimal address >pair. Work on better-than-random address selection is in progress in >the IETF, but is incomplete. > >An existence proof exists in the existing IPv4 Internet that a network >whose address is distinct from and globally advertised to all upstream >providers permits the routing network to select a reasonably good path >within the applicable policy. Present-day routing policies are not >QoS policies but reachability policies, which means that they will not >necessarily select the optimal delay, bit rate, or loss rate, but the >route will be the best within the metrics that are indeed in use. One >may therefore conclude that this would work correctly for IPv6 >networks as well, apart from scaling issues. >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >Fred Baker | 519 Lado Drive >IETF Chair | Santa Barbara California 93111 >www.ietf.org | Desk: +1-408-526-4257 > | Mobile: +1-805-886-3873 > | FAX: +1-413-473-2403

1 0

Re: When IPv6 ... if ever?
by Richard A. Steenbergen 02 Sep '00

02 Sep '00

On Sat, 2 Sep 2000, Roeland M.J. Meyer wrote: > 3) Conservatively, every recent linux node has IPv6 kernel support and > every Windoze box can do IPv6 (not to mention what we have just heard > from the BSD camp <g>). This is over 50% of the leaves out there > (conservatively). At what point is there sufficient market penetration > of the technology to consider rolling IPv4/IPv6 > interoperability/capability on the core routers and switches (something > short of 100%, I would hope)? > > 4) Is it maybe that Sun, HP, Intel, Cisco, IBM, and the telco's, aren't > all quite ready yet? There are two key problems which are preventing the widespread use of IPv6, IP Allocation, and network vendor support. Support for all hosts is actually one of the least of the problems. Think of it this way, major networks want to deploy IPv6... How do they do it? They certainly can't do it on their primary backbone links and routers, the support from vendors is simply not there. Even if there was working code, they wouldn't dare deploy it on their production network, the code is too unstable (especially IPv6 routing protocols), and they risk looking unreliable in comparison to those who don't even make the attempt to support IPv6. So what do they do? Without the network there is not the demand for high traffic IPv6, and without the demand there is little desire to build the network. Should they buy seperate routers, try desperately to make IPv6 work well on a spare 7200, and hope not to get a black eye from customers who expect the same level of routine-ness we are experienced with in IPv4? Should they provision more circuits because of this? Build a parallel network supporting IPv6, without a current customer demand? Or do they say, "we'll wait until the vendors get it right"? Even if you get past all that, there is still the very obvious fact that for certain vendors, the levels of performance we expect today are because of extensive tuning for IPv4 speed, and we know we won't be seeing this level of performance right off the bat from IPv6. And while they wait, there is no usable IPv6 infastructure, less interest and development from vendors who don't really see a "need", and less demand from users who know there is no point when they can't find a network infastructure to support them. The other problem is IP allocation. ARIN and others are used to their comfortable role as IP Nazi ("No IP for you, come back, one year!"), they have happy extortion-scheme pricing on it, and they're not about to give it up voluntarily any more then NetSol would have without being forced... If you doubt this, go look at the current policies for obtaining IPv6 space. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Re: When IPv6 ... if ever?
by smd＠clock.org 02 Sep '00

02 Sep '00

| At some point, when ARIN just stops issueing IPv4 address space, | I would say it would be in a {I,N}SPs best intrest to switch. This is not "soon". | As an ASP, if my uplinks offered ipv6 address space/routing, | I'd get it and start working with it _now_ rather then later. How much extra are you willing to pay? Sean.

1 0

When IPv6 ... if ever?
by Roeland M.J. Meyer 02 Sep '00

02 Sep '00

> From: Nathan Lane [mailto:nathan@terminus.com] > Sent: Friday, September 01, 2000 3:54 PM > > "Roeland M.J. Meyer" wrote: > > > > The real issue is getting all those routers and switches > deployed. We > > can then turn up the clients and servers as needed. > > The need for v6, at least for me, is in the deployment of mass > quantities of end nodes. That I can nearly support today > with existing > infrastructure. I see little compelling need to upgrade my existing > routers to v6 now; I do see a need for 4000 wireless end nodes at each > of our sites - those could be serviced with a few app servers in the > home office that knew v6 and v4-v6 tunnels [yes, technically > these would be "routers"] at the remote sites. > At six to eight weeks for each > router software release for the bug scrub and six months to roll out > said code, we only have time to do it twice a year. Adding a new > protocol would be formiddable unless tunelling were used to virtualize > the infrastructure. 1) if one is using tunneling, then we really haven't gone over to IPv6. 2) if one is using tunneling, for leaf-nodes, then how is the core going to know those leaves are using IPv6? 3) Conservatively, every recent linux node has IPv6 kernel support and every Windoze box can do IPv6 (not to mention what we have just heard from the BSD camp <g>). This is over 50% of the leaves out there (conservatively). At what point is there sufficient market penetration of the technology to consider rolling IPv4/IPv6 interoperability/capability on the core routers and switches (something short of 100%, I would hope)? 4) Is it maybe that Sun, HP, Intel, Cisco, IBM, and the telco's, aren't all quite ready yet? 5) Admittedly, I haven't had the bandwidth to follow IPv6 all that closely. But, IPv6 has been pregnent quite a long time.

1 0

ARIN Policy on IP-based Web Hosting
by sigma＠pair.com 02 Sep '00

02 Sep '00

Gentle readers who might happen to be using unique IP addresses for your Web hosting customers, or for other virtualized services such as FTP, POP3/IMAP, SSL, etc, you need to be aware of ARIN's recent policy change. Basically, they won't give you addresses anymore. They're accepting comments. A lively discussion has begun, as usual. Kevin >Date: Tue, 29 Aug 2000 14:46:37 -0400 (EDT) >From: Member Services <memsvcs(a)arin.net> >To: arin-announce(a)arin.net, ppml(a)arin.net >Subject: ARIN Web Hosting Policy >Message-ID: <Pine.SOL.4.05.10008291437410.19186-100000(a)ops.arin.net> >Sender: owner-arin-announce(a)arin.net > >ARIN's new web hosting policy has recently been under discussion on the >ARIN IP allocations policy mailing list. >See http://www.arin.net/members/mailing.htm. > >The policy is described at > > http://www.arin.net/announcements/policy_changes.html > >Some individuals have expressed their disagreement with this new policy. >Should the ARIN web hosting policy be changed? > >ARIN would like your feedback on this issue. Please post your comments >and suggestions to the public policy mailing list (ppml(a)arin.net) Your >feedback will be included in the discussions at the upcoming public >policy meeting. > >Information about the meeting can be found at >http://www.arin.net/announcements/memmeet.html

37 68

predicted customer support conversation
by smd＠clock.org 02 Sep '00

02 Sep '00

<ring ring> Operator: Hello, networknet NOC, can I help you? Customer: Yes, I'm having trouble surfing microsoft.com. Operator: Oh, dear. Are you using IPv4 or IPv6? Customer: Huh? What? Sean.

3 2

RE: IPv6 allocatin (was Re: ARIN Policy on IP-based Web Hosting)
by smd＠clock.org 02 Sep '00

02 Sep '00

A converted bell-shaped-head writes: | HMM. Change is good. Otherwise evolution and innovation is not possible. Yes, and IPv6 is an evolutionary dead-end, and is about as useful as polyploidy is to a happily diploid organism whose growth is constrained by its external surface area. What is out-evolving IPv6? NAT, probably eventually leaning towards CATNIP. Hint: lots of change is happening in that space too, and you don't have to quadruple the amount of genes your poor transcriptase-like proteins have to deal with. Sean.

1 0

Re: IPv6 allocatin (was Re: ARIN Policy on IP-based Web Hosting)
by Michael Shields 02 Sep '00

02 Sep '00

In article <39B0343B.7FECFB0E(a)nominum.com>, "David R. Conrad" <David.Conrad(a)nominum.com> wrote: > Christian, > > > The point was a NAT'ed (masqueraded) network attempting to > > communicate with another NAT'ed (masqueraded) network. That > > does NOT work for the vast majority of people on the Internet. > > Hmmm. If you never try something, can it be said to not work? > > Until such a scenario becomes _far_ more commonplace that it is today, I > doubt anyone (other than end-to-end purists and the folks who have been > bitten) will care. It is a basic principle often used in both protocol design and ethics that one cannot endorse a course of action that, if all were to follow it, causes undesirable consequences. If NAT is really the future, we must prepare for a world where NAT is carried to its logical conclusion; all sites use NAT. If that ultimate future is undesirable, then we should not even start down the road; we must conclude that NAT is not the future. It can, then, be at best an expedient hack. If we accept that peer-to-peer communication is a design goal of the Internet, then to make a convincing argument that NAT is the future, you must outline how two sites behind a NAT can communicate with each other conveniently. Otherwise: "That does not scale." -- Shields.

1 0

Re: ARIN Policy on IP-based Web Hosting
by Alec H. Peterson 02 Sep '00

02 Sep '00

"John A. Tamplin" wrote: > > Well, if the policy is that you have to use name-based hosting everywhere > feasible and do something different for those customers that need > something different, that can be quite a hardship on existing setups. > For example, re-engineering all the tools to create and maintain vdom > services, changing existing customer setups, etc. It is certainly easier > to treat all hosting customers alike, rather than have completely > separate setups and then have to change a customer from one to the other > when they add or delete services (including downtime). That was also brought up at the meeting, however it was generally agreed that the address savings were worth the work. > > Another issue nobody has mentioned is security between virtual servers. > Under name-based hosting, they all run as the same user-id and thus to get > the same security you have with separate IP-based servers you have to put > all the access conrol checks in all the tools that can be used. This can be > hard if not impossible to do when you allow full shell access to the files > used by the server. Not if you chroot() the user into their file space. That may not be ideal, but there are ways to deal with it. Alec -- Alec H. Peterson - ahp(a)hilander.com Staff Scientist CenterGate Research Group - http://www.centergate.com "Technology so advanced, even _we_ don't understand it!"

22 42