Subject: RE: DSTM Considered Harmful [Re: (ngtrans) final ngtransagendaforIETF-53 in Minneapolis]

From: "Christian Huitema" <[email-masked]>
Date: Tue, 19 Mar 2002 10:44:41 -0800

> On a deployment viewpoint, a MS implementation would be very useful,
> given we have good v6 app support in Linux and BSD.   Can any of the
MS
> people comment on their own plans here?

I am personally not convinced of the urgency of implementing and
deploying DSTM. The stated goal of DSTM is to let users of an IPv6 only
network gain IPv4 connectivity. Think about it: IPv6 only networks. Does
not look like a year 2002 problem to me. I would rather concentrate on
making sure that users in an IPv4 only network can get some IPv6
connectivity.

I am also not convinced that DSTM is the right solution to the stated
problem. It goes to great length to assure that the IPv6 only nodes can
get a global IPv4 address, but it is very unclear that we will have
enough available IPv4 addresses to allow that. DSTM attempts to reduce
IPv4 address consumption by "time sharing" the address, but we have
experience and theory that tells us that time sharing does not work
well: in short, all nodes tend to need addresses at the same time.

If you remove the "global address" property, then DSTM is in fact an
inferior solution, compared to NAT-PT (provided we remove the DNS ALG
from NAT-PT.) At least, with NAT-PT, I don't even need an IPv4 stack in
the IPv6 only nodes, and I also don't need any address allocation
protocol between the v6 only node and the server.

-- Christian Huitema

---

From: Octavio Medina <[email-masked]>
Date: Tue, 19 Mar 2002 20:10:55 +0100

> making sure that users in an IPv4 only network can get some IPv6

If we can offer a reliable method to assure IPv4 connectivy inside an
IPv6 only domain, people would have the choice between setting up IPv4
private addresses + NAT (and all the associated problems) or IPv6 +
DSTM. People are using private addresses + NAT today, in 2002.

> well: in short, all nodes tend to need addresses at the same time.

That's what the ports option is all about, to offer that port sharing
possibility (with its limits) and reduce the number of required
addresses.

> protocol between the v6 only node and the server.

In NAT-PT you assume you have IPv6-ready applications, capable to send
IPv6 packets. That is not the case for most applications (specially for
Microsoft's). For NAT-PT to be useful, we would need a big number of
applications becoming IPv6 aware, which is not the case in 2002. 

-Octavio

---

From: Pekka Savola <[email-masked]>
Date: Tue, 19 Mar 2002 21:11:19 +0200 (EET)

> making sure that users in an IPv4 only network can get some IPv6

I kind of argree myself: DSTM is an interesting concept valid for test 
networks which want to try their feet with (mostly) IPv6-only though.
 
> well: in short, all nodes tend to need addresses at the same time.

I'm sceptical as well.
 
> from NAT-PT.) 

Note: I don't think we'll ever be able to eliminate all the negative 
aspects of NAT-PT wrt. DNS.. because that's how it works..

But still, I think NATv4 is better: then we don't have to specify any 
NAT-like mechanisms in _IPv6_: people who use NATv4, use NATv4 -- none of 
IPv6 working groups' concern.

> At least, with NAT-PT, I don't even need an IPv4 stack in
> the IPv6 only nodes, 

This is not a problem for some time yet: this is only a significant
difference (application IPv4/IPv6 support aside) if there is _no_ IPv4
support in the system, and the system needs to be able to talk to IPv4
nodes.  Desktop/Server systems are very unlikely to remove IPv4 support
any time soon, so I think this worry only applies to LCNA-style
micro-implementations: and these don't (probably)  need to talk with IPv4
nodes.

> and I also don't need any address allocation

This is my criticism as well, as per the message on Mar 17 (no replies yet 
:-).

I think the address allocation stuff and everything should be killed from
the draft, or alternatively all the generic stuff moved to "DSTM
architecture" document.

DSTM concept is interesting even without address allocation.  There may 
not even be need for an implementation if 4over6 tunneling is supported in 
the system :-).

If this cleanup work is not done, I think I'll create a draft which will 
outline this kind of scenario.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 19 Mar 2002 20:33:04 +0100

I've always assumed that DSTM would only be useful in the very late 
stages of IPv6 rollout. Also, I believe that BIA is just as useful 
for the interesting scenario (IPv6 clients using IPv4-only apps on an 
IPv6 server). But BIA is much simpler to implement and deploy,
and it doesn't consume real IPv4 addresses.

So my opinion is that DSTM could safely be put on ice for a couple
of years, for future review. Certainly, we should wait until the NGTRANS
scenarios have been defined, as discussed in the meeting yesterday.

   Brian

---

From: Laurent Toutain <[email-masked]>
Date: Tue, 19 Mar 2002 20:36:02 +0100

>making sure that users in an IPv4 only network can get some IPv6

I don't understand the argumentation. Do we have to wait until the problem
happens to find the solution? DSTM solves problems more ahead than giving
IPv6 access to IPv4 hosts, but is it a reason to delay the standardisation ?

>well: in short, all nodes tend to need addresses at the same time.

In current Internet, lot of hosts get a temporary address. DSTM require
less v4 address than dual stack. With dual stack you keep the v4 all the 
time. With DSTM you need a v4 address only when you want to communicate
with a v4 equipment. Combined with ALG for http, mail you reduce the need 
for a temporary address in the transition period.

In the draft-richier-dstm-vpn we also present a solution where the
temporary address can be private. In that case, there is no problem 
related to a lack of v4 addresses.

>protocol between the v6 only node and the server.

In the scenario described in draft-richier-dstm-vpn if you use only NAT-PT
you cannot authenticate easily the source. With DSTM you must authenticate your
host before obtaining the IPv4 address. Then a context is installed in the TEP
to limit the use of the tunnel to the authenticated host. You also don't break 
the end-to-end paradigm for IPv4 packets.

---

From: Pekka Savola <[email-masked]>
Date: Tue, 19 Mar 2002 21:44:03 +0200 (EET)

> for a temporary address in the transition period.

The amount of used v4 addresses is IMO not explicitly an useful metric for 
seeing whether a mechanism is useful or not.

D. Knuth said, "premature optimization is the root of all evil".  
Temporarity especially with ports option may be exactly that.

---

From: Francis Dupont <[email-masked]>
Date: Tue, 19 Mar 2002 21:03:59 +0100

In your previous mail you wrote:

=> I agree for the "is useful or not" but not for "is usable or not"
because I don't believe global IPv4 addresses will stay affordable.
In fact in some places they are already impossible to get.

=> DSTM has many other advantages, for instance it removes the burden
to manage both IPv4 and IPv6 infrastructures, something which is not
related to global/private IPv4 addressing.

Regards

[email-masked]

PS: I live in a different universe than some of you, in mine when I ask
for a /24 my ISP doesn't matter to even send the request form to me.
But I have three /48 in IPv6 and can get more in less than one day.
PPS: we should make the IETF meeting network IPv6 only in order to
touch the pros & cons of NAT-PT, DSTM and others.

---

From: Michael Richardson <[email-masked]>
Date: Wed, 20 Mar 2002 00:40:17 -0600

>>>>> "Christian" == Christian Huitema <[email-masked]> writes:
    Christian> I am personally not convinced of the urgency of implementing and
    Christian> deploying DSTM. The stated goal of DSTM is to let users of an IPv6 only
    Christian> network gain IPv4 connectivity. Think about it: IPv6 only networks. Does
    Christian> not look like a year 2002 problem to me. I would rather concentrate on
    Christian> making sure that users in an IPv4 only network can get some IPv6
    Christian> connectivity.

  I would strongly agree.
  I think that DSTM is an interesting problem, but generally a distraction.

  I would live IPv6 only if I could get IPv6 everywhere I go - I assure
myself that I can do that with 6to4, and I look forward to Teredo. But, in
both cases, I can do IPv4 in some fashion.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy");  [