On Wed, 13 Apr 2005, Peter John Hill wrote:

Let me inform you of an exciting new concept... Anycast DNS... It is not difficult... Get with the freaking program...

I attempted to get DNS deployed under anycast when I worked there. As you can see, I don't work there any more. Draw your own conclusions. -- Brandon Ross AIM: BrandonNRoss Director, Network Engineering ICQ: 2269442 Internap Yahoo: BrandonNRoss

...

Let me inform you of an exciting new concept... Anycast DNS... It is not difficult... Get with the freaking program...

* Michael.Dillon@radianz.com (Michael.Dillon@radianz.com) [Thu 14 Apr 2005, 12:03 CEST]:

Are you suggesting that network operators should supply their customers with recursive DNS services by operating DNS servers on their network which share the same anycast addresses as the recursive DNS servers on other networks?

Or are you suggesting that a network operator should set up anycast internal to their network so that all of their recursive DNS servers share the same IP address?

I'd like to hear some more detail on this.

Michael, put down the crackpipe already, will you? *Of course* the previous (unattributed) poster was not talking about hijacking other people's address space, but suggested that it's a good idea to not make your entire customer base reliant on two puny servers somewhere. I find this obvious. -- Niels. -- The idle mind is the devil's playground

On Thu, 14 Apr 2005 Michael.Dillon@radianz.com wrote:

So, the question remains, does the poster think that network operators should band together and operate shared anycast recursive DNS services? Or does the poster think that network operators should operate many recursive DNS servers throughout their infrastructure and tie them together using anycast?

I don't know what the other poster(s) were referring to, but I was not suggesting that network operators try to run some unified DNS infrastructure. It is an intriguing idea, however.

If anycast is a good idea for recursive DNS service, then there is a 3rd party business opportunity here to operate global recursive DNS services so that network operators can focus on running the network, not on providing services like DNS resolution.

Perhaps even more interesting is being able to sell anycasted reverse DNS service directly to users that are connected to incompetent providers. ;-) Seriously, though, some benefits can be imagined, like being able to use the same DNS server on my laptop no matter where in the world I plug in. -- Brandon Ross AIM: BrandonNRoss Director, Network Engineering ICQ: 2269442 Internap Yahoo: BrandonNRoss

On Thu, 14 Apr 2005, Christopher L. Morrow wrote:

On Thu, 14 Apr 2005, Brandon Ross wrote:

...

;-) Seriously, though, some benefits can be imagined, like being able to use the same DNS server on my laptop no matter where in the world I plug in.

people do that today.... unforunately they do it with 198.6.1.1 :(

Its called DHCP/PPP, both will auto-magically configure the correct DNS for your current network connection. If your laptop changes IP addresses, it should get new network configuration details for the current network.

At 02:00 PM 4/14/2005, Peter John Hill wrote:

I have completely given up on relying on Comcast for dns service... For now I will continue to use them for "transit"

If they are unwilling to implement anycast dns then I cannot trust them...

It's unclear why anycast would be required. Most or all of their customers use DHCP to obtain address information, including DNS information. It would be just as reasonable for them to install a few small DNS servers along-side the router at the cable head-end at every town. Now it might be simpler for them to manage if they placed those same servers but used Anycast, but the effect should be the same. The point is, anycast is not the issue. Reliable service is the issue. DNS isn't their only issue, of course (that they're single-homed to AT&T adds to their unreliability, not that they can fix that at present). Dan

On Apr 14, 2005, at 11:59 AM, Jim Popovitch wrote:

When Comcast goes down at home I hop in the car or walk a few blocks to one of many wifi outlets (some even free). Yes, that does make it difficult to check email or pay bills at 6am in my bath robe, but it works.

Would I *like* to see Comcast 100% bulletproof? Sure. Do I *need* to see Comcast 100% bulletproof? No.

I just don't want my wife to complain to me that she could not check her email because "the Internet was broken" :-)

Do you understand anycast? Do you understand how different operating systems react to failures of configured dns servers? You really need to look into anycast and see why it is used. Perhaps the comcast people are as naive as you about dns... Check out: http://www.net.cmu.edu/pres/anycast/ or my favorite: http://www.net.cmu.edu/pres/lisa03/ This excellent presentation will help you with your understanding: "In configuring multiple hosts to respond to the same address, stateless protocols such as DNS can be easily scaled. Servers can be located in closer proximity to clients, providing faster responses to queries. In the event of a single host failure, routes can quickly be withdrawn and servers in other locations handle the request traffic, all without any changes to client configurations. Recursive DNS clients built into many of today's operating systems deal rather poorly with a failure of their primary recursive server. Of eight operating systems evaluated in a recent survey, seven kept no history of failed servers, trying each DNS query against the first server and waiting for a response before moving to secondary servers. Using anycast, service is maintained even in the face of a single or multiple host failure. This substantially reduces resolution delays due to server failure." Peter Hill On Apr 14, 2005, at 11:24 AM, Daniel Senie wrote:

At 02:00 PM 4/14/2005, Peter John Hill wrote:

...

I have completely given up on relying on Comcast for dns service... For now I will continue to use them for "transit"

If they are unwilling to implement anycast dns then I cannot trust them...

It's unclear why anycast would be required. Most or all of their customers use DHCP to obtain address information, including DNS information. It would be just as reasonable for them to install a few small DNS servers along-side the router at the cable head-end at every town. Now it might be simpler for them to manage if they placed those same servers but used Anycast, but the effect should be the same.

The point is, anycast is not the issue. Reliable service is the issue. DNS isn't their only issue, of course (that they're single-homed to AT&T adds to their unreliability, not that they can fix that at present).

Dan

On Thu, 14 Apr 2005 19:17:26 -0000, "Christopher L. Morrow" said:

Perhaps it's not even appropriate for comcast's network/design/pop/hub/area/infrastructure... Don't get me, or I think Daniel, wrong, anycast is fun, but it's not for everyone. The main goal for comcast should be stability, regardless of how they implement that, eh?

No, they want to maximize the pricepoint/stability function (which has multiple maxima/minima corresponding to various market niches). They want to pay as little as possible for sufficient stability to not torque off the customer base into migrating to another provider. In fact, I'd not even be surprised if the answer is different for different market regions - the needed stability in areas they're a near-monopoly at their price range is probably a lot lower than what they need in areas where there's lots of competitors. 5 nines impresses everybody on this list. 4 nines will probably cover most business customers. 3 nines for most consumers, and I bet you can make a living selling 2 nines to Joe Sixpack for $9.95/mo.... But you can't make a living selling to the 2-nines crowd at the 2-nines price with a 5-nines infrastructure (Anybody who can, drop me a note if you've got a POP near me ;)

On Thu, 14 Apr 2005, Alexander Kiwerski wrote:

But Comcast sure makes a great profit by charging a 2 or 3-nine's price for a 1.5-nine service ;-)

What's really funny here is that they are spending at a 5 9's level, they just don't implement in a 5 9's architecture. -- Brandon Ross AIM: BrandonNRoss Director, Network Engineering ICQ: 2269442 Internap Yahoo: BrandonNRoss

On Apr 14, 2005, at 3:03 PM, Peter John Hill wrote:

Do you understand anycast? Do you understand how different operating systems react to failures of configured dns servers?

Do you? Relying 100% on anycast is MUCH worse than not deploying anycast at all. Spend some time thinking about various failure modes. (*sigh* just read NANOG archives if you want the short cut) There is more than one solution to every problem. Don't fixate on anycast purely because your university hosts a couple of web pages on it.

On Thu, 14 Apr 2005, Daniel Senie wrote:

It's unclear why anycast would be required.

Well, DDoS attacks tend to be less effective when they are spread over a large number of anycasted hosts. That was the main reason I attempted to get anycasted DNS servers online there when I worked there. -- Brandon Ross AIM: BrandonNRoss Director, Network Engineering ICQ: 2269442 Internap Yahoo: BrandonNRoss

Brandon Ross wrote:

On Thu, 14 Apr 2005, Sean Donelan wrote:

...

Its called DHCP/PPP, both will auto-magically configure the correct DNS Which doesn't work very well when your provider cannot keep a DNS server up for 10 minutes at a time. See the beginning of this thread.

Run bind locally on your laptop. There's a Win32 version available if you're not running some sort of Unix or Linux on there. It's what I do as my ISP's DNS is wonky at times, as is $ork's as they choose to use Active Directory for DNS. Setup different named.conf files for home/work/travel/etc, and a trivial batch file or shell script to copy the relevant named.conf file into play and run rndc reload, and you're good to go.

On Apr 15, 2005, at 1:13 AM, Jerry Pasker wrote:

Jeff Cole wrote:

...

Run bind locally on your laptop. There's a Win32 version available if you're not running some sort of Unix or Linux on there. It's what I do as my ISP's DNS is wonky at times, as is $ork's as they choose to use Active Directory for DNS.

For the sake of the root servers, I hope everyone doesn't start doing this.

Well configured laptops will not put that much pressure on the roots. A single misconfigured / broken recursive name server puts a lot more pressure on the roots than lots of well-configured laptops. I guess one could argue that the chance of misconfiguration go up as the number of systems goes up. -- TTFN, patrick

On Apr 15, 2005, at 1:38 AM, Sean Donelan wrote:

On Fri, 15 Apr 2005, Patrick W Gilmore wrote:

...

Well configured laptops will not put that much pressure on the roots. A single misconfigured / broken recursive name server puts a lot more pressure on the roots than lots of well-configured laptops.

I guess one could argue that the chance of misconfiguration go up as the number of systems goes up.

http://www.zdnet.com.au/news/security/0,2000061744,39188319,00.htm

Disconnecting six compromised personal computers on Tuesday evening eased the difficulties caused by bogus requests which clogged BigPond's domain name servers (DNS), slowing customer e-mail and Web site access, Telstra said.

Precisely my point. The problem is not number of well behaved systems, but the misbehaving ones. Again, you could argue that the quantity / chance of misconfiguration goes up with the quantity of systems being configured, but the end result still depends a great deal more on how many are misbehaving than how many there are in total. -- TTFN, patrick

On Apr 15, 2005, at 1:13 AM, Jerry Pasker wrote:

...

Jeff Cole wrote:

...

Run bind locally on your laptop. There's a Win32 version available if you're not running some sort of Unix or Linux on there. It's what I do as my ISP's DNS is wonky at times, as is $ork's as they choose to use Active Directory for DNS.

For the sake of the root servers, I hope everyone doesn't start doing this.

Well configured laptops will not put that much pressure on the roots. A single misconfigured / broken recursive name server puts a lot more pressure on the roots than lots of well-configured laptops.

I guess one could argue that the chance of misconfiguration go up as the number of systems goes up.

-- TTFN, patrick

I didn't say "I hope a few cluefull people don't do this." I said "I hope _everyone_ doesn't start doing this." Big difference. For the sake of the net, I hope no one, not even a semi popular OS venduh, gets the idea to build a dns server in to their next OS some day.

On Fri, Apr 15, 2005, Daniel Golding wrote:

I also wonder how long it will be before home routers have DNS servers built-in, with a switch to let users select between iterative queries of their upstream's DNS and a normal recursive query. Has anyone seen this in the consumer market?

My netcomm NB1300 ADSL modem/router already has a built-in DNS server. -- Adrian Chadd "When you're a fantasy artist, <adrian@creative.net.au> everything needs breasts." - Lisaera, Lusternia

I'm not complaining about it - heck, I use it. I just wanted to point out that desktop DNS servers are a reality. Right now, few folks use them. If ISP DNS server quality gets worse or there are a few big outages, we may see desktop DNS usage climb. This may have deleterious effects on the roots and TLD servers. It might be interesting to pull query data on a root server and correlate it with known dynamic IP address pools to spot a trend. - Dan On 4/15/05 9:54 AM, "Patrick W Gilmore" <patrick@ianai.net> wrote:

On Apr 15, 2005, at 8:59 AM, Daniel Golding wrote:

...

Too late. Every Mac ships with a working version of BIND. Its not enabled by default, but it can be turned on with a few keystrokes.

Name a flavor of unix which doesn't?

And even if you can, name a flavor of unix which can't get it installed "with a few keystrokes [or mouse clicks]."

We want people to use unix, stop complaining when they do. :-)

Besides, the OSX named is well behaved in its default configuration (in my limited personal experience on my own laptops).

On Thu, 14 Apr 2005, Jeff Cole wrote:

Brandon Ross wrote:

...

On Thu, 14 Apr 2005, Sean Donelan wrote:

...

Its called DHCP/PPP, both will auto-magically configure the correct DNS Which doesn't work very well when your provider cannot keep a DNS server up for 10 minutes at a time. See the beginning of this thread.

Run bind locally on your laptop.

I already do that. I wasn't referring to myself, I was referring to other users who might not have the skills or interest in running their own DNS daemons. -- Brandon Ross AIM: BrandonNRoss Director, Network Engineering ICQ: 2269442 Internap Yahoo: BrandonNRoss