- Test - lists.nanog.org

Re: Alternative to BGP-4 for multihoming?
by Andrew Bender 15 Mar '00

15 Mar '00

Marc Slemko wrote: > This will normally be a caching nameserver that may or may > not be the same as the nameservers for the domain. In theory, > it should be "close" to the client network wise for other > reasons. Is it always? No. But it is a more reasonable > metric. Have any substantive empirical studies been perfromed that validate this assumption? The degree to which it is true seems to be the gating factor for the effectiveness of this method... Andrew Bender tns-inc.com

1 0

Remove
by Charles E. Yow 15 Mar '00

15 Mar '00

Remove

1 0

Re: Alternative to BGP-4 for multihoming?
by Paul Vixie 15 Mar '00

15 Mar '00

> They sit on /28's and smaller in some cases. I'm certainly not going to > be successful in acquiring ASN's for these people to do proper load > balancing between multiple ISP's and most major ISP's see little benefit > in modifying route tables to include our small netblock. Right on man! > Its these cases I'm concerned with. In my mind, irrespective of the > comments on the functionality of DNS for this purpose, I see little other > choice. DNS is not the droid you're looking for. Using DNS response times to predict likely TCP performance is silly for at least as many reasons as using BGP aspath lengths to predict likely TCP performance is silly. > That being said, if anyone has better ideas on how to provide for high > availability to millions of web sites worldwide, please let me know. TCP performance is affected by congestion symmetry, since TCP uses the spacing of ACK packets to control the spacing of data packets. While there's no way to guarantee congestion symmetry, one of the leading indicators of whether you will have congestion symmetry is "whether you have path symmetry." Furthermore, the leading indicator of whether you have path symmetry is "whether the outbound flow's first hop is the same as the incoming flow's last hop." Thus http://www.vix.com/pub/vixie/ifdefault/. Try it. If you don't know how to apply patches to your kernel, then have a consultant do it. I wrote this for a pornography distributor whose pageviews-per-second went up by a factor of 1.7 peak and 1.25 average just as a result of using "interface defaults" rather than speaking BGP and trying to run defaultless.

8 10

Hi, we're from the government and we're here to help
by Sean Donelan 15 Mar '00

15 Mar '00

Operational, only in the sense it disrupts our operations http://www.usatoday.com/life/cyber/tech/cth523.htm An interesting article which reviews some of the history and some perspective on the government response to the denial of service attacks. Unfortunately, its even worse. Before the FBI created the NIPC, the NTIA/Department of Commerce was tasked with Internet protection. I went to one of the meetings at DOC. It felt like a cold war contractor unemployment office. The NTIA eventually appointed three groups to represent the interests of the Internet in cyber-security. Anyone know/remember who those groups were? Earlier, the government created the Critical Infrastructure Assurance Office. Before that there was a commission, but the Internet wasn't really considered an "interesting" infrastructure at that time. The US Government as been amazingly pro-active in this area, or at least some small groups have been. They've also consistently said the government can't protect the Internet. The infrastructure is owned by private companies and individuals; and industry has to work together to protect it. The question is does industry think its worthwhile to work together? After several major disruptions received at lot of media attention, IOPS was formed. Later members like UUNET dropped out. After the DOS attacks, several providers announced their Gold Ribbon initiative. Have any providers actually taking concrete steps to change their networks? The IESG has a last call for a Best Common Practice on Internet security. Will any provider actually follow it? There is a barely used $50 million center in Washington we can probably buy real cheap if folks think we'll ever need an emergency response coordination center in the future.

7 12

Re: San Jose Telephone Problems 3/10-3/17
by Dan Bustillos - Datalink Computer Services 14 Mar '00

14 Mar '00

Sean/list, I was watching the news this morning re: This issue. A Pacbell spokesman was talking to a reporter and here is what he had to say ( My memory is a bit foggy) " Pac bell is also the victim here. We did not cause this. It was a private contractor that caused this ACCIDENT" At the point he said accident it sounded like he was getting ready to start yelling at the reporter. I just thought you all might find this funny.. Please no flames! PS: I am going to Vancouver BC on Thursday for a week. Anyone know anything fun to do in the area? Sean Donelan allegedly stated on 3/13/00 19:28: > >I'm sure this has absolutely nothing to do with me moving to >the San Jose area :-) > >On friday a contractor cut four major Pacific Bell cables. About >11,000 circuits were affected. The affected area is roughly bordered >by Interstate Highways 880 and 680 and Trimble and Berryessa roads. >Pacific Bell estimates it won't have the cables repaired until Friday >March 17. > >One cable I can understand. Two cables, ok you didn't realize the first >strange noise was a cable. Three cables, accidents come in threes. Four >cables? > > > Thank you, Dan Bustillos Datalink Computer Services (530) 897-6400 (888) 327-4638 ******************* "First rule of Government Spending: Why build one when you can build two at twice the price"

6 5

Re: Alternative to BGP-4 for multihoming?
by Gary E. Miller 14 Mar '00

14 Mar '00

Yo Joe! On Tue, 14 Mar 2000, Joe Loiacono wrote: > >Checking the path to my DNS servers tells you NOTHING about the > >path to my hosts. > > Right. But your situation is not the one being looked at, as you don't have > geograpically distributed web servers. But of course I DO (and that is a different question again... :-) > I believe for that situation 3DNS, > et. al., can work. Once the client's DNS request has worked its way over to > the primary DNS for the distributed web-servers, 3DNS has each of the other > 3DNS boxes (located adjacent to the other distributed servers) ping the > *clients* primary DNS. 3DNS then returns the URL for the web-server whose > 3DNS machine is 'closest' (fewest hops) to the clients DNS machine. Thus, > for example, clients in Asia can get to a server in Asia. > > I think that's the gist of it, if not the specifics... Let us take a client example. I manage a DNS with clients (users) in Singapore, California, New York and UK. DNS servers in Singapore and California and mirrored Web servers in Singapore in California. The DNS servers in Singapore do forward, and reverse for all zones in use (except ISP roaming) AND cacheing for ALL hosts in use. All hosts worldwide use our in house master DNS servers and not the local ISP servers. This allows the users to get DNS access for hostnames that are behind our firewalls on private addresses. It also allows inhouse tech support to more easily troubleshoot PCs remotely. I have seen this setup in use by many companies with firewalls. All laptops given to employees are shipped preset to use the 2 main corporate DNS servers for their DNS cacheing servers. Now let us say that a user (client) in UK connects to one of our corporate DNS cacheing server in Singapore or California. That DNS server connects to the 3DNS in New York. Now how does the 3DNS in New York decide the nearest web server to UK by checking DNS servers in California or Singapore? And I sure hope that HOP count is not used, Singapore has a mixture of very fast and very slow links to foreign countries so hop count is a useless measure of "closeness". Now it gets worse. Our users in Singapore take their laptops home but still use the DNS cacheing from the office servers. At home they are on a local ISP network that connects to the US by a very different path! Some ISPs in Singapore connect directly from Singapore to LA, some directly to Palo Alto and some to Japan and then Seattle. When our user goes home all that changes about his configuration is his IP address and reverse DNS. But his connectivity to the US is totally changed. Some ISPs connect directly to Malaysia and some need to go to LA and back. Picking the server based on DNS could add a second of extra round trip time! I have a few other clients with totally different configurations that also break the 3DNS, but that is another discussion... RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 20340 Empire Ave, Suite E-3, Bend, OR 97701 gem(a)rellim.com Tel:+1(541)382-8588 Fax: +1(541)382-8676

1 0

Re: Alternative to BGP-4 for multihoming?
by Patrick Evans 14 Mar '00

14 Mar '00

On Tue, 14 Mar 2000, Pete Templin wrote: > On Tue, 14 Mar 2000, Marc Slemko wrote: > > > Saying "the clients's primary DNS" is misleading. There is no way to know > > what the "primary" DNS server is for a zone, and there may not even be > > what is typically known as a primary. > > What if it's a UUNet resold modem to a client of iAmerica - what server > gets used then? We know that UUNet's DNS servers are likely to not be > located close (in net terms) to the client, and how do we know what DNS > servers are being assigned to the client? > User's machine contacts caching nameserver x to do a lookup. Nameserver x contacts authoritative nameserver y, which then works out where x is before returning an RR that's good for wherever x is. If n isn't net.near to the user's machine, then something's a bit weird. If part of a dialup ISP's internal network falls over, you hardly want every single user's resolvers to fail! > Or what if my clients get assigned dns servers in 192.168.254/24? Sounds > to me like it's not a valid geographic identifier. > I'd hope that nameserver would talk to the world with a real source address, which y would then use to do a proximity test, rather than a 1918 address - at least it should if it actually wants to get a response. What address the client-side interface uses is neither here nor there. -- Patrick Evans - Sysadmin, bran addict and couch potato pre at pre dot org www.pre.org/pre

1 0

Re: Alternative to BGP-4 for multihoming?
by Randy Bush 14 Mar '00

14 Mar '00

> Once the client's DNS request has worked its way over to the primary DNS > for the distributed web-servers, 3DNS has each of the other 3DNS boxes > (located adjacent to the other distributed servers) ping the *clients* > primary DNS. 3DNS then returns the URL for the web-server whose 3DNS > machine is 'closest' (fewest hops) to the clients DNS machine. you may want to seriously reread the previous sender's message. the point is that in the modern post-2182 world, many of the client's nameservers are vastly net.distant from the client. psg.com nameserver = DNS.LIBRARY.UCLA.EDU psg.com nameserver = RAIN.PSG.COM psg.com nameserver = ARIZONA.EDU it is best common practice. randy

3 2

Re: Alternative to BGP-4 for multihoming?
by brandon＠rd.bbc.co.uk 14 Mar '00

14 Mar '00

> you may want to seriously reread the previous sender's message. the point > is that in the modern post-2182 world, many of the client's nameservers are > vastly net.distant from the client. > > psg.com nameserver = DNS.LIBRARY.UCLA.EDU > psg.com nameserver = RAIN.PSG.COM > psg.com nameserver = ARIZONA.EDU sure but which one are they most likely to be using for their resolver (in firewalled environments it may be none of those)? Lots will use one fairly local to them for resolution and that could be the one making the request of the hosting providors server (assumptions about which ones would recurse etc.). There will always be a few that use one a continent away but nobody is expecting 100% on this are they? brandon

3 2

Re: Alternative to BGP-4 for multihoming?
by Joe Loiacono 14 Mar '00

14 Mar '00

> >Checking the path to my DNS servers tells you NOTHING about the >path to my hosts. Right. But your situation is not the one being looked at, as you don't have geograpically distributed web servers. I believe for that situation 3DNS, et. al., can work. Once the client's DNS request has worked its way over to the primary DNS for the distributed web-servers, 3DNS has each of the other 3DNS boxes (located adjacent to the other distributed servers) ping the *clients* primary DNS. 3DNS then returns the URL for the web-server whose 3DNS machine is 'closest' (fewest hops) to the clients DNS machine. Thus, for example, clients in Asia can get to a server in Asia. I think that's the gist of it, if not the specifics... Joe Joe Loiacono Phone: (301) 794-2509 Computer Sciences Corporation Fax: (301) 794-9480

1 0