Subject: Re: [dnsop] Re: Root Anycast (fwd)

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 4 Oct 2004 23:01:41 +0200

On 2-okt-04, at 18:25, Paul Vixie wrote:

> nycast has worked very well.  both inter-AS and intra-AS.  the fact 
> that
> a not-clueful-enough engineer *could* build a non-working topology 
> using
> anycast and PPLB as ingredients, does not mean that anycast or PPLB are
> bad.  it means you have to be clueful-enough before you use either 
> tool.
> (and remember kids, all power tools can kill.)

It's not as simple as that. It's possible for bad things to happen if:

1. some DNS server is anycast (TLD servers are worse than roots because 
the root zone is so small)
2. fragmented UDP packets or TCP are used as a transport
3. a network is built such that packets entering it through router X 
may prefer a different external link towards a certain destination than 
packet entering it through router Y
4. a customer of this network is connected to two different routers
5. the customer enables per packet load balancing

All of these steps happen in the real world, and are in and of 
themselves not examples of bad engineering. However, the end result can 
be reduced connectivity to one or more anycasted DNS servers under some 
circumstances.

(See my message to dnsop from yesterday 
http://darkwing.uoregon.edu/~llynch/dnsop/msg03105.html for more info, 
reformat using a non proportional font if necessary.)

Now the question is: how do we deal with this? I don't think removing 
anycast wholesale makes sense and/or is feasible. Same thing for 
declaring per packet load balancing an evil practice. A better solution 
would be to give network operators something that enables them to make 
sure load balancing doesn't happen for anycasted destinations. A good 
way to do this would be having an "anycast" or "don't load balance" 
community in BGP, or publication of a list of ASes and/or prefixes that 
shouldn't be load balanced because the destinations are anycast.

> and they would know that PPLB is basically a link bundling technology 
> used
> when all members of the PPLB group start and end in the same 
> router-pair;

It doesn't make much sense to have multiple links terminate on the same 
router on both ends as then both these routers become single points of 
failure. Often, the end sending out most traffic will have the links 
terminate on one router (so load balancing is possible) while the other 
ends of the links terminate on two or more routers.

.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Tue, 5 Oct 2004 10:01:43 +0200

[ietf list stripped]

On Mon, 4 Oct 2004 23:01:41 +0200

>  the root zone is so small)

I do not understand this praticular point (the "are worse because 
of size" that is)

The duration and size of the transaction are, except for AXFR queries,
independend on the size of the zone. Can you ellaborate?

> A good way to do this would be having an "anycast" or "don't load
> balance" community in BGP, or publication of a list of ASes and/or
> prefixes that shouldn't be load balanced because the destinations
> are anycast.

Sounds like a very sensible approach.

-- Olaf

---------------------------------| Olaf M. Kolkman
---------------------------------| RIPE NCC

.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 5 Oct 2004 13:06:15 +0200

> independend on the size of the zone. Can you ellaborate?

Well, TLD servers get much more (legitimate) queries than the roots 
because there is only so much you can ask the roots before the entire 
root zone is in your cache. This is slightly harder with .com, for 
instance.  :-)

.