Subject: root server load and dynamic updates.

From: Bruce Campbell <[email-masked]>
Date: Sun, 23 Apr 2000 13:53:00 +1000 (EST)

Forward as requested by Randy.  Note that I was considering this a problem
that people were already aware of, however the recent NANOG thread has
shown otherwise (well, its one of the reasons for the increase in hits to
our nameservers).

Regards,

-- 
  Bruce Campbell <[email-masked]>                +61-7-3367-0490
                      Systems Administrator     Regional Internet Registry
    Asia Pacific Network Information Centre    For the Asia Pacific Region

---------- Forwarded message ----------
: Date: Sun, 23 Apr 2000 12:50:04 +1000 (EST)
: From: Bruce Campbell <[email-masked]>
: To: "Forrest W. Christian" <[email-masked]>
: Cc: Nick Patience <[email-masked]>, [email-masked]
: Subject: Re: Question about strain on the A root server

On Sat, 22 Apr 2000, Forrest W. Christian wrote:

> On Sat, 22 Apr 2000, Nick Patience wrote:
> 
> > NSI seems slightly unsure as to the main reason for the increase in hits,
> 
> I have heard from a source that Windows 2000 is sending a whole bunch of
> "interesting" packets towards the root servers.  I don't know if this is
> true or not, but if it is, this seems to coincide timing wise.   The
> person I talked to referred to the packets as "update notifications" or
> something like that.  Maybe NOTIFY implemented weirdly?

Dynamic Updates on a 'orrible scale.  It appears to be that if a windows
2000 machine cannot find its forward and reverse name to resolve
correctly, it will send a dynamic update for the name to the nearest found
parent. 

Logically, this should *not* be the root nameservers.  Well, logically,
yes.  If the logical (listed) parents are not found, then I think it walks
back down the chain, and (possibly) to the roots. 

As our[1] nameservers are authoritative for a few reverses[2], we tend to
see an awful lot of these dynamic updates, which show up as 'Unauthorised
update' etc etc.

Its the equivilant of a new-born baby waking up during its first night,
and immediately bawling down the phone to the deed poll office to change
their name.  Annoying, but it does save the parents the tramua of naming
the babe.

--==--
Bruce.

[1] APNIC.  Std-disclaimer applies.
[2] {61,202,203,210,211}.in-addr.arpa .

---

From: "Cricket Liu" <[email-masked]>
Date: Sat, 22 Apr 2000 23:03:08 -0600

> back down the chain, and (possibly) to the roots.

Yup.  This is basically standard behavior for dynamic
update routines, whether Microsoft's or the ISC's:  find
the enclosing zone, locate its name servers and send
the dynamic update.

> their name.  Annoying, but it does save the parents the tramua of naming

I've also heard rumors that these particular dynamic
updates are coming in over TCP, which would help
explain why they're so hard on name servers.  Can
anyone verify that?

cricket

---

From: "D. J. Bernstein" <[email-masked]>
Date: 23 Apr 2000 08:24:17 -0000

Why are people blaming the .com overloads on Windows 2000 brainlessness?
Why couldn't the real problem be BIND's server selection strategy
(search for 2000-03-12 in http://cr.yp.to/dnscache/namedroppers.html and
follow the link), or increasing use of out-of-zone NS records, or lower
TTLs at some extremely popular sites, or a poor attempt at resource
exhaustion, or some confused piece of software other than Windows 2000,
or simply the continuing growth of the Internet?

Bad .com performance bothers me, but it doesn't bother me as much as
uninformed speculation. I'd like to see some measurements of how the
.com servers are actually spending their resources.

---Dan

---

From: "Eric A. Hall" <[email-masked]>
Date: Sun, 23 Apr 2000 10:58:46 -0700

> .com servers are actually spending their resources.

I'd have to agree with this sentiment. Let's get some statistical data
before we stone them.

There's plenty of reasons why it could be Win2K but lots of reasons why
it wouldn't be responsible for a doubling of the load, which was the
original statement. MS says they've sold between 1-2 million units. Even
if they were all misconfigured, that wouldn't double the load.

I know that a lot of these systems are going into environments that are
not terribly well planned. The way the directory/domain model works with
Win2k, it is sometimes hard to get the desired results even when you
know what you're doing. In both cases, people will have private TLDs
which do not exist, or where the root is considered the "local" domain
for the directory, and so forth. This could easily cause a significant
amount of unnecessary traffic going to the TLD or root servers (requests
to create certain SRV records in the root, for example). But it wouldn't
double the traffic.

In short, I'd be inclined to believe that the traffic doubled from an
increase in the use of ICQ or spam rather than Win2k. Most likely it is
all of the above and more.

What do the stats show? Are we seeing waves of increased hits during
North American business hours (Win2k's principle market for the past
couple of months)? What kinds of queries? etc.

-- 
Eric A. Hall                                            [email-masked]
+1-650-685-0557                                    http://www.ehsco.com

---

From: "David R. Conrad" <[email-masked]>
Date: Sun, 23 Apr 2000 11:28:53 -0700

Dan,

> Why couldn't the real problem be BIND's server selection strategy
...

Don't suppose it would be because nothing changed at a.root-server.net and the
increase started showing up around Feb 18 or so?

Nah, you're right.  Much easier to blame BIND.
 
Rgds,
-drc