Subject: placement of secondary name servers for .uk.

From: Peter Gradwell <[email-masked]>
Date: Tue, 21 Nov 2000 08:50:08 +0000

Hi,

Nominet is the .uk. Domain name Registry and I am part of it's policy advisory
group. A bunch of people who attempt to say wise things when asked difficult
questions. We have recently been asked by Nominet to give advice on the 
placement
of the secondary name servers for the .uk domain name.

- Currently this is done on a "traditional" and "cooperative" basis. The 
question
is whether it needs to be formalised (the lawyers probably think so) and if so
who should be asked to tender.

Currently, I'm seeking advice on the following points, and should be grateful
for your views:

a)      What is the traffic profile for DNS queries? For example, should we put
         servers in asia? What weighting in terms of numbers of servers should
         we give to the UK/Europe/East Coast/West Coast/Mid US ?

- I notice that CAIDA made a report to the RSSAC, in October 1999
http://www.caida.org/tools/measurement/skitter/RSSAC/

- Does anyone know if they made any subsequent reports?

b)      Should DNS servers be placed on the transit LANS of Exchange Points,
         or should they be hosted at the premises of ISPs? Can they be "one 
hop"
         from an EP, but at an ISP's datacentre (for ease of management). What
         if that ISP doesn't have an open peering policy? Or if they block 
some
         traffic (RBL) ?

I understand that the root server advisory committee is asking similar 
questions
for ICANN. I assume that other registries may be doing the same. If anyone
else is currently considering these issues, please let me know  - perhaps we
can pool brains and produce a combined strategy?

thanks

peter

--
peter gradwell; online @ http://www.gradwell.com/peter/

---

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Tue, 21 Nov 2000 09:45:46 -0500

I'd be sure to think about rates of growth in different parts of the
Internet rather than worrying about exact current levels of traffic.
Even if, for example, asian traffic is currently low, it seems like an
area that will grow very rapidly.  In fact, I don't see that you could
go that far wrong by using one server per continent as a starting
point and adjusting from there with a few extra is the US and Europe.
It would also seem generaly a waste to put any in places that are
blocked from a significant part of the Internet.

Thanks,
Donald

From:  Peter Gradwell <[email-masked]>
Message-Id:  <[email-masked]>
Date:  Tue, 21 Nov 2000 08:50:08 +0000
To:  [email-masked]

---

From: Jaap Akkerhuis <[email-masked]>
Date: Tue, 21 Nov 2000 16:20:33 +0100

Peter,
    
    - Currently this is done on a "traditional" and "cooperative"
    basis. The question is whether it needs to be formalised (the
    lawyers probably think so) and if so who should be asked to
    tender.

Well, we are also wondering whether we need to change this. The
current opinion seems to be that, since there is such a lot at
stake (read commercial value) on a proper working DNS, one needs
to control the ``slave'' servers as well or at least to have an
SLA with the slave server operator.

There is in CENTR an ad-hoc working group trying to come up with
what they call a shared nameserver. In this model, one registry
will run a system which will also host nameservers for others. The
operation of the hosted nameserevers can be done by the registries
themselves. The hosting registry takes only care of its own zonefile.
There is a mailing list out on this subject:

  CENTR SSS-WG mailing list <[email-masked]>
  This is a closed list for the CENTR Shared Secondary Servers Working Group.
  For more information please contact <[email-masked]>.

although there hardly seems to be any traffic on it.

    Currently, I'm seeking advice on the following points, and
    should be grateful for your views:
    
    a)      What is the traffic profile for DNS queries? For example,
	     should we put servers in asia? What weighting in terms
	     of numbers of servers should we give to the UK/Europe/East
	     Coast/West Coast/Mid US?

We (.nl) have currently only Europe & US covered. I assume you
could measure the traffic pattern by switching on query logging
(although this will effct perfdormance) or by sniffing. The might
give a clue. But then, the slave server operator might not like
it.

At the ICANN was again a report about the root servers. The link
is burried in the minutes (scribe notes).

    b)      Should DNS servers be placed on the transit LANS of
	     Exchange Points, or should they be hosted at the
	     premises of ISPs? Can they be "one hop" from an EP,
	     but at an ISP's datacentre (for ease of management).
	     What if that ISP doesn't have an open peering policy?
	     Or if they block some traffic (RBL) ?

I personal prefer an exchange point. Apart from the things you
refer to, you also avoid the sily discussion that by having it in
an ISP you would givr advanta
ge to that ISP.
    
    I understand that the root server advisory committee is asking
    similar questions for ICANN. I assume that other registries
    may be doing the same. If anyone else is currently considering
    these issues, please let me know  - perhaps we can pool brains
    and produce a combined strategy?

As said before, the centr ad-hoc workgroup is trying such a combined
strategy. And we would be happy to pool brains as well.

	jaap

---

From: Randy Bush <[email-masked]>
Date: Tue, 21 Nov 2000 08:43:25 -0800

rip.psg.com:/usr/home/randy> traceroute NS0.JA.NET
traceroute to NS0.JA.NET (128.86.1.20), 30 hops max, 40 byte packets
 1  psg0 (147.28.0.58)  0.545 ms  0.432 ms  0.412 ms
 2  d1-3-0c2.o00.sttlwa01.us.bb.verio.net (129.250.16.237)  33.913 ms  30.704 ms
 3  ge-6-0.r02.sttlwa01.us.bb.verio.net (129.250.31.129)  14.179 ms  57.142 ms  
 4  p4-1-0-0.r03.sttlwa01.us.bb.verio.net (129.250.2.230)  40.077 ms  48.643 ms 
 5  p4-5-0-0.r06.plalca01.us.bb.verio.net (129.250.3.89)  145.478 ms  154.401 ms
 6  if-4-9.core1.PaloAlto.Teleglobe.net (207.45.222.101)  149.098 ms  229.987 ms
 7  if-6-2.core1.LosAngeles.Teleglobe.net (207.45.222.181)  241.593 ms  298.702 
 8  if-2-3.core1.NewYork.Teleglobe.net (207.45.223.61)  580.639 ms  612.999 ms  
 9  ix-8-2.core1.NewYork.Teleglobe.net (207.45.196.142)  722.100 ms *  525.081 m
10  us-gw2.ja.net (193.62.157.9)  670.937 ms  682.574 ms  722.923 ms
11  ns0.ja.net (193.63.94.20)  721.478 ms *  579.941 ms

---

From: Randy Bush <[email-masked]>
Date: Tue, 21 Nov 2000 08:54:03 -0800

> SLA with the slave server operator.

this seems to me rather like the classic telcos trying to figure out
the internet and wanting to make circuits, mpls, ,,, to make it like
the telco network so that they think that they can control and
understand it.  and underneath it is still datagrams, but we try not
to disturb them by rubbing their noses in it. :-)

> themselves. The hosting registry takes only care of its own zonefile.

this seems a reasonable middle ground.

randy

---

From: Peter Gradwell <[email-masked]>
Date: Tue, 21 Nov 2000 19:08:27 +0000

Hi,

Thanks all for your feedback. I shall follow up some of the leads and
CENTR mailing list bits.

The original idea given to us by the Nominet Executive management
(Willy Black et al) was that Nominet wanted to place "sealed box"
servers at these locations and so was simply interested in finding
a "heat and light" locations which would be responsible for providing
transit, electricity and the odd bit of remote hands reboot for when it
all when wrong.

Thus, I think they would want to do the "planning and ops" bit "in house".

Obviously, the question of having a shared name servers is a very
interesting one. Do you think it would make more sense for the
RSSAC to operate, as a body, a globally distributed set of name
servers to which registries could out source their name server provision?
- Possibly a new business model for Versign-GRS ? :)

I'm also speaking to the people at CAIDA about their research. Currently
it seems that the US, Asia and Europe require equal amounts of "attention".
Their work is excellent and highly commended. But you knew that
already!

One final question. Randy posted a traceroute to ns0.ja.net. However,
for .uk. we have ns.uu.net and ns.eu.net, which might be "closer" to
randy (for this example). Which server would Randy prefer to use?
Do resolvers take the "closest?". AFAIK, from reading "DNS & BIND"
it's all rather random. Thoughts? Does this randomness affect the placement
of the servers?

thanks

peter

---

From: Randy Bush <[email-masked]>
Date: Tue, 21 Nov 2000 11:16:29 -0800

> Do you think it would make more sense for the RSSAC to operate, as a body,
> a globally distributed set of name servers to which registries could out
> source their name server provision?

the A in rssac stands for Advisory.  it should not operate anything.  hell,
it has enough problems giving good advice.

> One final question. Randy posted a traceroute to ns0.ja.net.

i did not mean to ruin your supper.  sorry.

randy

---

From: "Cricket Liu" <[email-masked]>
Date: Tue, 21 Nov 2000 12:49:12 -0700

> it's all rather random. Thoughts? Does this randomness affect the
placement

No, BIND name servers will tend to use the closest of a set of authoritative
name servers, as measured by roundtrip time.  (It's in the book.)

cricket

---

From: "Brian W. Spolarich" <[email-masked]>
Date: Tue, 21 Nov 2000 16:13:36 +0000 (GMT)

On Tue, 21 Nov 2000, Peter Gradwell wrote:

| I'm also speaking to the people at CAIDA about their research.
| Currently it seems that the US, Asia and Europe require equal amounts
| of "attention". Their work is excellent and highly commended. But you
| knew that already!

  Peter, let us know what you hear from CAIDA.  Their work is indeed
excellent (I used to work with some of these folks at ANS).

| One final question. Randy posted a traceroute to ns0.ja.net. However,
| for .uk. we have ns.uu.net and ns.eu.net, which might be "closer" to
| randy (for this example). Which server would Randy prefer to use? Do
| resolvers take the "closest?". AFAIK, from reading "DNS & BIND" it's
| all rather random. Thoughts? Does this randomness affect the placement
| of the servers?

  I recall BIND having a clever set of algorithms that would enable named
to return records with network latency in mind.  If multiple NS records
were found the caching nameserver would use a nice mechansim based on
network round-trip time and number of times that record was used to
determine which record to send.  The result was that servers that were
closer were queried more often than those that were far away.  A colleage
and I did some modeling of this behaviour a few years ago and wrote a
short whitepaper on it (which I can't find).  As I recall, the behaviour
was satisfactory for reasonable load-balancing as long as the number of
records in the rrset was relatively small (<5).

  In BIND8, bin/named/ns_resp.c seems to contain this code.  BIND9 is
reorganized enough that I couldn't find it quickly.

  Is this documented somewhere?  I've always thought it was cool but
didn't find much in the way of documentation on it in 1997, and haven't
looked since. :-)

  -bws

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 24 Nov 2000 13:33:26 +0100

>of the secondary name servers for the .uk domain name.

2 or so thoughts that don't seem to have surfaced yet:

- nameservers generally get selected on RTT.
   This means that the only benefit of 2 servers within a short RTT of each
   other is redundancy/load balancing.
- the US and EU are close together in RTT. EU and Asia are not.
   Neither is Eastern Europe terribly close to West Europe, for that matter.
- Placing servers *on* exchange LANs is an awful idea, because a cracked
   server there has entirely too much power. Think BGP session stealing.
   Placing one *next to* an exchange LAN is to my mind a Good Thing.

My thoughts....

--
Harald Tveit Alvestrand, [email-masked]
+47 41 44 29 94
Personal email: [email-masked]