Subject: RE: You saw this, right?

From: "Eastlake III Donald-LDE008" <[email-masked]>
Date: Mon, 26 Jun 2006 12:44:53 -0400

Hi,

Sorry if this wasn't clear. It was a first draft.

What I was thinking was, assume you have N anycast hosts who are DNS
servers and all receive DNS queries sent to IP address ADDR-0. If they
really all think they are just a host at address ADDR-0 and any of these
host sends out a DNS query, presumably the anycast nature of their
address would mean that the response to that query could come back to a
different one than the host which originated the query. So, given this
assumption, I would think they wouldn't work very well as recursive
servers.

But maybe that assumption is wrong and these anycast hosts would each
use a distinct unicast IP address (ADDR-1, ADDR-2, ..., ADDR-N) for
outgoing queries so the responses would come back to them and could be
matched up with queries.

In any case, I don't think this point is very important. Multiple NATed
resolvers are more likely to be under different management and/or
contain some subverted machines while multiple anycasted servers are
more likely to be under common management an be relatively secure.

Donald

-----Original Message-----
From: Bill Woodcock [mailto:[email-masked]] 
Sent: Monday, June 26, 2006 12:14 PM
To: Eastlake III Donald-LDE008; David Ulevitch
Cc: [email-masked]
Subject: Re: You saw this, right?

    >    Anycast accessed servers are
    >    unlikely to be recursive servers or otherwise act as resolvers
due to
    >    the confusion that would result in getting responses to their
queries
    >    back to the right machine.

Hi, Donald.  

We're having king of  hard time figuring out what you're getting at
here.  
Care to clarify it?

                                -Bill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Eastlake III Donald-LDE008" <[email-masked]>
Date: Mon, 26 Jun 2006 13:29:34 -0400

See below at @@@ 

-----Original Message-----
From: Bill Woodcock [mailto:[email-masked]] 
Sent: Monday, June 26, 2006 1:05 PM
To: Eastlake III Donald-LDE008
Cc: David Ulevitch; [email-masked]
Subject: RE: You saw this, right?

    > servers and all receive DNS queries sent to IP address ADDR-0.

All are capable of receiving, but only one actually receives any
specific query...

@@@ Yes, sorry I didn't word that well. If they all received the query,
it would be multicast, not anycast.

    > If they really all think they are just a host at address ADDR-0
and 
    > any of these host sends out a DNS query, presumably the anycast 
    > nature of their address would mean that the response to that query

    > could come back to a different one than the host which originated 
    > the query.

Ah, I see what you were getting at.  In practice, one never originates a
transaction with the anycast address as source.  One only originates
transactions from the host's unique address.  In practice, the anycast
service addresses are loopbacks internal to the host, while the actual
physical interfaces which are used to originate transactions use the
host's unique addresses.

So this is never actually a problem.  I suppose in the interests of
thoroughness, it wouldn't hurt to explain why, so new people don't have
to stub their toes on that same corner-case.

@@@ OK, thanks,
@@@ Donald

                                -Bill

---

From: Bill Woodcock <[email-masked]>
Date: Mon, 26 Jun 2006 09:14:04 -0700 (PDT)

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

    >    unlikely to be recursive servers or otherwise act as resolvers due to
    >    the confusion that would result in getting responses to their queries

Hi, Donald.  

We're having king of  hard time figuring out what you're getting at here.  
Care to clarify it?

                                -Bill