Subject: [DNSOP] Anycast and DNS questions

From: Toerless Eckert <[email-masked]>
Date: Wed, 6 Aug 2014 04:47:59 -0700

Sorry, haven't been following this group for a long time, so
please excuse if answers to these questions have been discussed in before:

a) What documents beside RFC3258  are describing any uses/procedures
   for having DNS servers use an anycast address to receive and respond to
   requests ?

b) How common are deployments in which the information returned by different
   anycast member DNS servers for the same query would be different,
   aka: to "localize" lookup results, such as pointing to
   local CDN caches or the like ? What would be the most well known examples
   of such deployed instances ?  Any IETF documents describing this ? Any
   rules to follow ?

c) Any example in which the DNS servers utilizing a single shared
   IP address (anycast address) are run by different operators ? Any
   documents describing this ? (RFC3258 seems to focus on single operator
   anycast group of DNS servers.

Thanks
    Toerless

---

From: "Patrick W. Gilmore" <[email-masked]>
Date: Wed, 6 Aug 2014 08:10:19 -0400

Composed on a virtual keyboard, please forgive typos. 

>   for having DNS servers use an anycast address to receive and respond to

Dunno, but something tells me a quick BING search would return millions of answers. 

>   of such deployed instances ?  Any IETF documents describing this ? Any

Common? Ridiculously so, for at least 20 years.

Well known examples?  CDNs, as you already mentioned. E.g. LLNW. 

>   anycast group of DNS servers.

How about the root servers?

-- 
TTFN,
patrick

---

From: Toerless Eckert <[email-masked]>
Date: Wed, 6 Aug 2014 05:32:05 -0700

Thanks, Patrick, inline

> Dunno, but something tells me a quick BING search would return millions of answers. 

I carefully read the first 999,999 hits (;-) and they all where about
what i would call commercial DNS/zone services that run their own anycast cluster
of DNS server. I was wondering about variations on the scheme.

But a followup question coming to mind: 

Is it fair to say that DNS would be the prime reason for anycast addresses
injected into the global BGP routing table ?  Has anyone tried to stat that ?
Eg: counting how many global  BGP prefixes are "anycast" due to their properties,
such as availability at widely disperse nework locations without actual transit
indication in the AS path attributes (or the like, i am not a BGP expert, i am
just guessing how they could be recognized).

> Well known examples?  CDNs, as you already mentioned. E.g. LLNW. 

Thanks for the example. Any non-CDN examples  for localized information ?

> How about the root servers?

The way i read RFC3258 it sounded as if every individual root server could
use its own anycast address across its own set of disperse DNS servers. But
i could see no indication that specific anycast addresses where assigned to be
used by root servers run in different organizations. If that is actually whats
done today, that would be good information.

One of the reasons of asking is trying to understand if there is a combination
of b) and c) in deployment. Eg: If some organization has some authoritative DNS data,
its easy to say: Here, i also have an IP prefix that i permit anybody to use
as the anycast for DNS serving secondaries of that. And be happy about anybody who
seconds that zone with that anycast address. Thats just performance/reliability/load-sharing.

Once you start leaving out the consistency of the served information AND
you allow the same anycast address to be used by different organizations,
it becomes a lot harder for any individual organization to asses whether
a client is getting the right localized information because it can come from
different organziations. Of course, i think this scheme can work if there
are specific agreements about the policies of localization across the participating
organizations, but i am not sure if this is being done, and if so, what
examples there are.

Thanks
    Toerless

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Wed, 6 Aug 2014 09:01:00 -0400 (EDT)

> just guessing how they could be recognized).

It may be on the global Internet, but there miight be other uses.

> Thanks for the example. Any non-CDN examples  for localized information ?

An early paper:

https://www.usenix.org/legacy/event/lisa03/tech/full_papers/miller/miller_html/

>> How about the root servers?

Plus ISC has a tech note:

http://ftp.isc.org/isc/pubs/tn/isc-tn-2003-1.html

There might be something @ DNS-OARC that covers thisin their back catalog 
of presentations.

wfms

---

From: Tony Finch <[email-masked]>
Date: Wed, 6 Aug 2014 14:09:18 +0100

Toerless Eckert <[email-masked]> wrote:
>    of such deployed instances ?

A good non-commercial example is http://www.pool.ntp.org

>    IP address (anycast address) are run by different operators ?

See https://www.as112.net (but unfortunately its X.509 certificate has
expired).

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Trafalgar: Mainly northerly or northwesterly 5 or 6 in southeast, otherwise
variable 3 or 4. Slight or moderate. Fair. Good.

---

From: Tony Finch <[email-masked]>
Date: Wed, 6 Aug 2014 14:18:11 +0100

Toerless Eckert <[email-masked]> wrote:
> injected into the global BGP routing table ?

There is also a lot of anycast for HTTP servers. I don't know what its
relative popularity is compared to DNS.

Another example is 6to4, though it isn't a shining success story.

> used by root servers run in different organizations.

Correct. The closest it gets is the fairly liberal co-location done by
L-root.

As I understand it, CommunityDNS does a similar thing, and they provide
secondary service to a number of TLDs.
http://www.communitydns.eu/pdf/Slave_Server_Spec.pdf

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Irish Sea: West or southwest, veering northwest for a time, 4 or 5,
occasionally 6 at first. Slight or moderate. Showers. Moderate or good.

---

From: Toerless Eckert <[email-masked]>
Date: Wed, 6 Aug 2014 06:20:38 -0700

Hah! i am using that NTP one, but it didn't come to mind when asking the question.
Have to read up on that AS112. Thanks

Thanks!

-- 
---
Toerless Eckert, [email-masked]
Cisco NSSTG Systems & Technology Architecture
SDN: Let me play with the network, mommy!

---

From: Joe Abley <[email-masked]>
Date: Wed, 6 Aug 2014 10:15:24 -0400

On 6 August 2014 at 8:10:25, Patrick W. Gilmore ([email-masked]) wrote:

> On Aug 6, 2014, at 7:47, Toerless Eckert wrote:
> >

I've written some stuff:

RFC 4786 has some general advice
ISC-TN-2003-1 and ISC-TN-2004-1 were mainly written with F-Root in mind
https://www.usenix.org/legacy/publications/login/2008-02/openpdfs/abley.pdf
https://www.nanog.org/meetings/nanog34/presentations/abley.nameservers.pdf

> Well known examples? CDNs, as you already mentioned. E.g. LLNW.

Various commercial DNS services do this (e.g. Dyn does this). I'm not aware of any documentation produced in the IETF beyond the base DNS specification (which doesn't talk about anycast, but does talk about the loose coherence between sibling authority servers and between caching resolvers and authority servers).

It's not obvious to me whether pool.ntp.org does this. I think the geo focus there is pulled in the QNAME, and the RRSets in the response are near-consistent across the authority set at query time (but the response sets vary with time, according to performance of the target NTP servers). But you could ask Ask. I bet he never gets tired of people saying that.

> How about the root servers?

Root servers are not an example of that: each letter is run by a single organisation and each letter has a set of service addresses that are unique to that letter.

AS112 is a better example (see RFC 6304, http://www.as112.net/).

Joe

---

From: "Patrick W. Gilmore" <[email-masked]>
Date: Wed, 6 Aug 2014 10:53:46 -0400

>> injected into the global BGP routing table ?

I would -guess- there are more DNS anycast than HTTP anycast nodes. But looking at the global table to figure that out is not likely to yield useful results.

> relative popularity is compared to DNS.

CDNs use HTTP anycast, such as Cloudflare & Cachefly. Cloudflare alone is supposedly 5% of "the web", so a non-trivial amount of HTTP is done on anycast.

In fact, one could argue that any HTTP anycast implementation is a CDN. There are companies that use HTTP anycast for their own web properties, for performance, to game metrics companies, as a method of redundancy, etc.

-- 
TTFN,
patrick

---

From: David Conrad <[email-masked]>
Date: Wed, 6 Aug 2014 18:16:23 -0700

> How about the root servers?

Err, no.

Each of the IP addresses of the DNS servers serving the root have a single operator (not different operators).  

Well, OK, there have been cases where more than one operator was announcing the same root server address (e.g., http://blog.icann.org/2008/05/ghosts-of-root-servers-past/, http://www.renesys.com/2010/06/two-strikes-i-root/), but those cases are considered abominations.

There have been multiple proposals to do the multiple operator on a single anycast IP address approach, but my impression has been that concerns about debugging those implementations have discouraged their use.

Regards,
-drc

---

From: Paul Vixie <[email-masked]>
Date: Wed, 06 Aug 2014 18:55:46 -0700

David Conrad wrote:
> ... There have been multiple proposals to do the multiple operator on
> a single anycast IP address approach, but my impression has been that
> concerns about debugging those implementations have discouraged their
> use....

AS112 was the grand experiment for unowned anycast, and we all felt
generally safe experimenting with the live network in this way at that
time since answers to 10.IN-ADDR.ARPA did not have to be particularly
reliable. what AS112 proved to my satisfaction is that debugging was
neither concerning nor discouraging.

that's why xiaodong, zhiwei, and i are proposing unowned anycast for the
root zone in

http://tools.ietf.org/html/draft-lee-dnsop-scalingroot-00

which is exactly the "multiple operator on a single anycast IP address
approach".

vixie

---

From: Davey Song <[email-masked]>
Date: Fri, 8 Aug 2014 13:00:16 +0800

On Wed, Aug 6, 2014 at 7:47 PM, Toerless Eckert <[email-masked]> wrote:

> I quite agree with Paul about the idea of Universal Anycast. His proposal
is very answer to your question.

As far as I understand, Universal Anycast is not particular approach to
expand the operator of root, but a way to massively distribute the key
services of Internet. You can refer to the discussion of ICANN ITI report :
https://www.icann.org/en/system/files/files/iti-report-15may14-en.pdf (
from page 26)

To your question, what I'm interested is that what's your requirement or
scenarios for this very use of Anycast.

> Thanks
>     Toerless
>
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: "Guangqing Deng" <[email-masked]>
Date: Wed, 27 Aug 2014 16:11:59 +0800

Just as Toerless said, the key issue of different organizations using the same anycast address is whether those organizations implement the same localization policy or not. Here, one interesting question  can be raised is what is the best localization policy for DNS? Should DNS clients visit the anycast server with the least network latency (which can be measured by RTT) or minimal AS hops or minimal router hops? In other words, the question is about what is the best assessment index for DNS system.

Guangqing Deng
CNNIC 
 
From: Toerless Eckert
Date: 2014-08-06 20:32
To: Patrick W. Gilmore
CC: [email-masked]
Subject: Re: [DNSOP] Anycast and DNS questions
Thanks, Patrick, inline

 

 

 

Thanks
    Toerless

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 27 Aug 2014 19:16:49 +0900

Toerless Eckert wrote:

>     documents describing this ?

   draft-ietf-dnsop-ohta-shared-root-server-00.txt

   This memo proposes a mechanism of policy based selection of a root
   server sharing an IP address (anycast IP address) with other root
   servers and discusses operational issues related to it.

   Because the selection is policy based, domain administrators  have
   some control over the selection of the best root server among root
   servers sharing an IP address.

   Note that operations similar to that described in this memo are
   possible today locally without global coordination by any operator
   who may be irritated by the lack of his control on (sufficiently
   many) root servers, which may be a source of some operational
   problems. This memo is an attempt to document the way to solve the
   problem in a least harmful manner.

> (RFC3258 seems to focus on single operator

Hardie insisted on his original proposal, even though I
gave a proof that it is not necessary.

					Masataka Ohta

---

From: David Conrad <[email-masked]>
Date: Wed, 27 Aug 2014 07:04:09 -0700

Hi,

On Aug 27, 2014, at 1:11 AM, Guangqing Deng <[email-masked]> wrote:
> Here, one interesting question  can be raised is what is the best localization policy for DNS? Should DNS clients visit the anycast server with the least network latency (which can be measured by RTT) or minimal AS hops or minimal router hops? In other words, the question is about what is the best assessment index for DNS system.

I suspect DNS clients care primarily about getting correct answers as quickly as possible.  I doubt they care about hops be they AS or router.

Regards,
-drc