Subject: [RRG] TRRP implementation path concerns

From: Brian Dickson <[email-masked]>
Date: Thu, 21 Feb 2008 20:30:12 -0500

William Herrin wrote:
>
> The long version is at
> http://bill.herrin.us/network/trrp-implementation.html . If you have
> comments along the lines of, "Where did X come from that you first
> mentioned here," or "What advantage does this individual get from
> doing the action you state there?" I'd like to hear them. If there is
> any step which doesn't represent a realistic possibility given the
> ones before then I need to do more work on it.
>   
There's a few big gotchas, for sure:

Phase 5 stick - many/most TLD DNS servers are anycast in IPv6, with PI 
/48's. (I know because it is my day job :-))
So, filtering *those* is going to be a non-starter. Circular 
dependencies are bad, especially if they are DNS.

The requirement on DNS involving UDP might not fly - what about servers 
doing TCP only, or those with large RR sets?
What about EDNS0? DNSSEC? All of these are non-trivial, if TRRP relies 
on DNS.

Then there is the big question about the "first" ITR. Who gets that 
contract, and what are the terms?
What happens if that party turns out to be another SCO? Or gets bought 
by MS or one of their stooges?

Remember, for the first while, the ITR operator will be a monopoly, and 
how they behave has a huge impact
on the long-term success of TRRP, as well as possibly the ability for 
other parties to operate ITRs.

Brian

--
to unsubscribe send a message to [email-masked] with the
word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/rrg/> & ftp://psg.com/pub/lists/rrg

---

From: "William Herrin" <[email-masked]>
Date: Thu, 21 Feb 2008 23:03:22 -0500

>  dependencies are bad, especially if they are DNS.

Hi Brian,

I believe that's true of f-root's IPv4 /24 as well. This topic is
addressed elsewhere in the TRRP documentation but it bears repeating
there: address space supporting DNS servers in the trrp hierarchy must
remain in the BGP table, in what TRRP calls "Globally Routeable (GR)
space." In fact, the ITR specifically deals with the case where it is
asked to find an ETR for a DNS request in the TRRP hierarchy.

This means that as other /24's and /48's are withdrawn, those specific
ones must remain.

>  doing TCP only

Only a recursive request from an ITR to an external resolver is
required to use UDP but the use of only UDP throughout is *strongly*
encouraged. TCP answers are slower coming and anycast TCP is not
stable.

>  or those with large RR sets?

The TRRP TXT result set is constrained to fit within a 512 byte
payload and the ITR has specific instructions for how to interpret a
truncated result. Since this allows at least 15 ETR entries for a
given EID I don't see it as a serious problem. Surely by the time
there are 15 ways in to your network, you can justify a place in the
BGP table?

>  What about EDNS0?

Optional.

> DNSSEC?

Optional.

>  contract, and what are the terms?

Anybody who wants to bid on it. If no one else bids, I will and I'll
throw a box in a data center on some Cogent bandwidth. That's the
beauty of starting small.

The terms are that the space is registered to the end-users, not to
the contractor, and that a basic minimum throughput must be honored
regardless of whether the space's registrant subscribes. The latter
can be considered the entry fee for the bidding process.

>  by MS or one of their stooges?

1. Contract renewals. The space isn't allocated to that company; they
just provide a service related to it, one that can be transferred to a
new contractor and than any other AS can internally preempt with their
own ITR.

2. The contract doesn't preclude similar contracts covering other
network space should there be sufficient demand.

3. The contract doesn't preclude some savvy ISP setting up a
competitive service using space that is in fact allocated to them.

>  other parties to operate ITRs.

Too true. But then wise stewardship is ARIN's job and overall they've
done well. At some point I'll have to wander over to PPML and seek
more detailed comment on whether this is something they can reasonably
do for us. I briefly chatted up one of the board members about it back
at ARIN XX. I didn't go into any detail but I got a generally positive
response.

Regards,
Bill Herrin

-- 
William D. Herrin [email-masked] [email-masked]
3005 Crane Dr. Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004