Subject: RE: You saw this, right?

From: "Eastlake III Donald-LDE008" <[email-masked]>
Date: Mon, 26 Jun 2006 12:44:53 -0400

Hi,

Sorry if this wasn't clear. It was a first draft.

What I was thinking was, assume you have N anycast hosts who are DNS
servers and all receive DNS queries sent to IP address ADDR-0. If they
really all think they are just a host at address ADDR-0 and any of these
host sends out a DNS query, presumably the anycast nature of their
address would mean that the response to that query could come back to a
different one than the host which originated the query. So, given this
assumption, I would think they wouldn't work very well as recursive
servers.

But maybe that assumption is wrong and these anycast hosts would each
use a distinct unicast IP address (ADDR-1, ADDR-2, ..., ADDR-N) for
outgoing queries so the responses would come back to them and could be
matched up with queries.

In any case, I don't think this point is very important. Multiple NATed
resolvers are more likely to be under different management and/or
contain some subverted machines while multiple anycasted servers are
more likely to be under common management an be relatively secure.

Donald

-----Original Message-----
From: Bill Woodcock [mailto:[email-masked]] 
Sent: Monday, June 26, 2006 12:14 PM
To: Eastlake III Donald-LDE008; David Ulevitch
Cc: [email-masked]
Subject: Re: You saw this, right?

    >    Anycast accessed servers are
    >    unlikely to be recursive servers or otherwise act as resolvers
due to
    >    the confusion that would result in getting responses to their
queries
    >    back to the right machine.

Hi, Donald.  

We're having king of  hard time figuring out what you're getting at
here.  
Care to clarify it?

                                -Bill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Joe Abley <[email-masked]>
Date: Fri, 30 Jun 2006 09:59:30 -0400

I'm not seeing any of Woody's responses to your mail, for some reason.

But in any case, I think a small amount of additional clarity might  
be useful here:

> assumption, I would think they wouldn't work very well as recursive

If a client sends a request to a service address which is anycast,  
then the response from whichever node receives the request will be  
sourced from the anycast address. Since the destination address of  
the response is unambiguous, however, there is no problem reaching  
the right client.

Many people have successfully distributed DNS service using anycast,  
including both authority and recursive servers.

If a host which is providing some anycast service originates a  
request of its own for something (e.g. an anycast DNS server wants to  
do a zone transfer) it will normally be originated from a globally- 
unique (non-anycast) unicast address, in order to ensure that the  
response to the request is routed back to the right node.

There is at least one document example of deployed servers where  
requests from an anycast node are sourced from the anycast service  
address in order to accommodate address-based filters. Such requests  
(in the example I'm thinking of) are made with the foreknowledge that  
many of them will fail. For more on this particular example, see  
<http://www.isc.org/pubs/tn/isc-tn-2004-1.txt> section 5.2.

Joe