Subject: Re: You saw this, right?

From: Joe Abley <[email-masked]>
Date: Fri, 30 Jun 2006 09:59:30 -0400

I'm not seeing any of Woody's responses to your mail, for some reason.

But in any case, I think a small amount of additional clarity might  
be useful here:

On 26-Jun-2006, at 12:44, Eastlake III Donald-LDE008 wrote:

> What I was thinking was, assume you have N anycast hosts who are DNS
> servers and all receive DNS queries sent to IP address ADDR-0. If they
> really all think they are just a host at address ADDR-0 and any of  
> these
> host sends out a DNS query, presumably the anycast nature of their
> address would mean that the response to that query could come back  
> to a
> different one than the host which originated the query. So, given this
> assumption, I would think they wouldn't work very well as recursive
> servers.

If a client sends a request to a service address which is anycast,  
then the response from whichever node receives the request will be  
sourced from the anycast address. Since the destination address of  
the response is unambiguous, however, there is no problem reaching  
the right client.

Many people have successfully distributed DNS service using anycast,  
including both authority and recursive servers.

If a host which is providing some anycast service originates a  
request of its own for something (e.g. an anycast DNS server wants to  
do a zone transfer) it will normally be originated from a globally- 
unique (non-anycast) unicast address, in order to ensure that the  
response to the request is routed back to the right node.

There is at least one document example of deployed servers where  
requests from an anycast node are sourced from the anycast service  
address in order to accommodate address-based filters. Such requests  
(in the example I'm thinking of) are made with the foreknowledge that  
many of them will fail. For more on this particular example, see  
<http://www.isc.org/pubs/tn/isc-tn-2004-1.txt> section 5.2.

Joe

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Bill Woodcock <[email-masked]>
Date: Mon, 26 Jun 2006 10:05:01 -0700 (PDT)

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

    > servers and all receive DNS queries sent to IP address ADDR-0.

All are capable of receiving, but only one actually receives any specific 
query...

    > If they really all think they are just a host at address ADDR-0 and 
    > any of these host sends out a DNS query, presumably the anycast 
    > nature of their address would mean that the response to that query 
    > could come back to a different one than the host which originated 
    > the query.

Ah, I see what you were getting at.  In practice, one never originates a 
transaction with the anycast address as source.  One only originates 
transactions from the host's unique address.  In practice, the anycast 
service addresses are loopbacks internal to the host, while the actual 
physical interfaces which are used to originate transactions use the 
host's unique addresses.

So this is never actually a problem.  I suppose in the interests of 
thoroughness, it wouldn't hurt to explain why, so new people don't have to 
stub their toes on that same corner-case.

                                -Bill