Subject: RE: Multihoming Issues

From: "Christian Huitema" <[email-masked]>
Date: Tue, 3 Sep 2002 17:28:05 -0700

> The relationship is that DNS is acting as an index service
> for IPv6 addresses. In doing so it treats them as simple
> hierarchical  addresses, i.e. like fat IPv4 addresses.
> 
> The question as to whether that is the correct handling of
> IPv6 addresses is a valid one. This thread started with
> exactly such a question being raised, but the rationale on
> how DNS *could* be optimized for IPV6 was not spelled out.

There is no IPv6 service that guarantees that the identifiers are
actually world-wide unique. In fact, there is ample evidence that they
often will not be. Poorly configured interface cards are known to have
phony IEEE-802 addresses; privacy addresses are random numbers that are
only statistically unique; configured addresses may use user assigned
values. In all these cases, local collisions can be detected, global
collisions cannot be. 

There is also no requirement that a given multi-homed hosts combines the
same identifier with different prefixes. Privacy advocates will no doubt
argue that a multi-homed host should associate different identifiers
with different provider prefixes, so it cannot be tracked by
big-brother.

-- Christian Huitema

---

From: Caitlin Bestler <[email-masked]>
Date: Tue, 3 Sep 2002 20:07:38 -0500

On 9/3/02, Christian Huitema wrote:

>> The relationship is that DNS is acting as an index
>> service for IPv6 addresses. In doing so it treats them
>> as simple hierarchical  addresses, i.e. like fat IPv4
>> addresses.
>> 
>> The question as to whether that is the correct handling
>> of IPv6 addresses is a valid one. This thread started
>> with exactly such a question being raised, but the
>> rationale on how DNS *could* be optimized for IPV6 was
>> not spelled out.
>
>There is no IPv6 service that guarantees that the
>identifiers are actually world-wide unique. In fact, there
>is ample evidence that they often will not be. Poorly
>configured interface cards are known to have phony
>IEEE-802 addresses; privacy addresses are random numbers
>that are only statistically unique; configured addresses
>may use user assigned values. In all these cases, local
>collisions can be detected, global collisions cannot be. 
>

By "no IPv6 service" do you mean there is no active protocol
and/or entity that will detect a spoofed EUI-64 address? If
so, I agree with you. The fact that the interface ID must be
EUI-64 compliant is abundantly clear in the RFC, however.

Link-local interface IDs MUST be unique for the local
network, although the mechanism for ensuring this is not
specified.

RFC2464 is specific on the handling of emulation MAC
addresses: "A different MAC address set manually or by
software should not be used to derive the Interface
Identifier.  If such a MAC address mustbe used, its global
uniqueness property should be reflected in the value of the
U/L bit."

As for local Interface IDs. RFC2373 specifies in Appendix A:
"If there is no global interface identifier available for
use on the link the implementation needs to create a local
scope interface identifier.  The only requirement is that it
be unique on the link."

>There is also no requirement that a given multi-homed
>hosts combines the same identifier with different
>prefixes. Privacy advocates will no doubt argue that a
>multi-homed host should associate different identifiers
>with different provider prefixes, so it cannot be tracked
>by big-brother.

It can also be argued that a given link should have exactly
one Interface ID. It is specified as an attribute of the
Interface. Although obviously there would be little to
prevent someone from spoofing that. The question would be
whether it was permissiable to declare the same port on the
same NIC to be two different "NICs".

In full privacy paranoia mode, "how many ports I really have
is none of your business" is a predictable and perhaps
defendable response. However, in such a mode, the hostmaster
would not have declared these two 'totally seperate'
intrfaces to have the same name.

Lastly, I am NOT advocating any change. I merely responded
to an implication that there was no justification for
handling DNS for IPV6 differently than for IPv4. There are
differences. It was not a nonsensical question, as it was
being treated. However, there is far from enough
justification for handling IPv6 differently.

---

From: Keith Moore <[email-masked]>
Date: Tue, 03 Sep 2002 21:53:24 -0400

> However, in such a mode, the hostmaster

why not?  it's done all the time in v4, in order to distribute load
across several servers.

---

From: Robert Elz <[email-masked]>
Date: Wed, 04 Sep 2002 14:15:59 +0700

Date:        Tue,  3 Sep 2002 20:07:38 -0500
    From:        Caitlin Bestler <[email-masked]>
    Message-ID:  <r01050300-1015-B4A10826BFA211D6B973003065D48EE0@[192.168.0.2]>

  | The fact that the interface ID must be
  | EUI-64 compliant is abundantly clear in the RFC, however.

No, go and read it again.   That's only an option.

  | Link-local interface IDs MUST be unique for the local
  | network, although the mechanism for ensuring this is not
  | specified.

That's DAD, and though "ensure" might be a bit much, it will
generally work.   But what LL addresses do, and what others do,
are pretty much irrelevant, "1" as an interface ID might be
just fine on its link, but it certainly isn't going to be unique
anywhere else.

  | RFC2464 is specific on the handling of emulation MAC
  | addresses: "A different MAC address set manually or by
  | software should not be used to derive the Interface
  | Identifier.  If such a MAC address mustbe used, its global
  | uniqueness property should be reflected in the value of the
  | U/L bit."

Yes, it says that.   And it shouldn't.   That's a completely bogus and
unimplementable requirement.   Nor is it useful for anything.

To show unimplementable, note that on many systems, the way (or at least,
a way) to change the MAC address, is via the boot prom, when no OS (or
network stack) yet exists.   When the OS, and its net stack is booted,
all it sees is a MAC address in a flash, or eeprom, or something, with
no knowledge at all of how it got there, or who put the thing there.

There's no way that the software implementing IPv6 can possibly know that
this particular MAC address was set "manually" and avoid using it, or even
alter the U/L bit.

Nor does anything try.

  | It can also be argued that a given link should have exactly
  | one Interface ID.

Almost anything can be argued, but there's no rational reason for that.
And lots of reasons for not imposing any such requirement.   Aside from
rfc3041 type addresses, there's also the case where a node is running as
a "hot standby" for another.   When the other node crashes, the standby
takes over all of the crashed node's functions - which includes all its
addresses and interface ID's (in addition to its own).

  | In full privacy paranoia mode, "how many ports I really have
  | is none of your business" is a predictable and perhaps
  | defendable response. However, in such a mode, the hostmaster
  | would not have declared these two 'totally seperate'
  | intrfaces to have the same name.

But in the situation above, often the two nodes will have had the
same name, they're both "www.whatever".   The DNS returns 2 addresses
(the primary, and the standby) and the client picks one at random and
used it, so the load gets split.   Then one of the nodes goes down,
and the other takes over both addresses.   So, they're two totally
separate interfaces (sometimes), two totally separate IIDs (always)
and the same name.

  | Lastly, I am NOT advocating any change. I merely responded
  | to an implication that there was no justification for
  | handling DNS for IPV6 differently than for IPv4.

There should have been, we should be doing A6 for IPv6, that would
have made lots of sense.

Nothing you're suggesting seems to be useful though.

kre

---

From: "Jim Fleming" <[email-masked]>
Date: Wed, 4 Sep 2002 03:41:31 -0500

----- Original Message ----- 
From: "Robert Elz" <[email-masked]>
> There should have been, we should be doing A6 for IPv6, that would

IPv6 and A6 go together....they were made for each other...
...you might want to check with the ICANN Board or the .AU people for more info...

AAAA is for 128-bit DNS users, and does not imply IPv6...
...as an example....2002:* AAAA records cause IPv4 packets to be produced...

Jim Fleming
2002:[IPv4]:000X:03DB:...IPv8 is closer than you think...
http://ipv8.dyndns.tv
http://ipv8.yi.org
http://ipv8.dyns.cx
http://ipv8.no-ip.com
http://ipv8.no-ip.org
http://ipv8.no-ip.biz
http://ipv8.no-ip.info
http://www.iana.org/assignments/ipv4-address-space
http://www.ntia.doc.gov/ntiahome/domainname/130dftmail/unir.txt

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 04 Sep 2002 13:03:13 +0200

Could we switch this thread to where it belongs (the multi6 WG)?

  Brian

-- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Brian E Carpenter 
Distinguished Engineer, Internet Standards & Technology, IBM 
On assignment at the IBM Zurich Laboratory, Switzerland

---

From: "Jim Fleming" <[email-masked]>
Date: Wed, 4 Sep 2002 08:19:07 -0500

From: "Brian E Carpenter" <[email-masked]>
> Could we switch this thread to where it belongs (the multi6 WG)?
=============================

Would it not be more appropriate on an IPv6-based network ?
Why would IPv4 users (here) care about A6 ?

AAAA DNS records work just fine for IPv4++....
People remain ONLINE and migrate from 32-bits to 128-bits...
0:203     ONLINE
http://www.adns.net/NEWS/2002070101.html
http://www.name-space.com

Jim Fleming

---

From: Caitlin Bestler <[email-masked]>
Date: Wed, 4 Sep 2002 16:39:55 -0500

>> Could we switch this thread to where it belongs (the

Does that mean that you believe "IPv8" should only be
discussed on "IPv8" networks?

---

From: "Jim Fleming" <[email-masked]>
Date: Wed, 4 Sep 2002 18:18:27 -0500

----- Original Message ----- 
From: "Caitlin Bestler" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, September 04, 2002 4:39 PM
Subject: Re: Multihoming Issues

> discussed on "IPv8" networks?

What do you mean by IPv8 ?
Are you familiar with how IPv16 works ?

Have you asked the C@t ?
http://www.ddj.com/articles/1993/9310/
http://maccentral.macworld.com/news/0208/25.jaguar.php

Jim Fleming

---

From: [email-masked]
Date: Thu, 05 Sep 2002 04:10:08 -0400

> What do you mean by IPv8 ?

We're not sure, Jim - maybe if there was an actual protocol spec, we'd know.
You might start by doing an RFC793-style packet header diagram.  Oh, and while
you're laying out header fields, make sure you understand subtleties like why
the IPv6 headers have fixed-length fields on doubleword boundaries (hint -
router manufacturers like ASICs)

> Are you familiar with how IPv16 works ?

The techniques outlined in the (recently expired) internet-draft
draft-terrell-math-quant-new-para-redefi-bin-math-04.txt have proven to be
quite challenging to implement in functional silicon or software.  Therefore,
you will have to find alternate means to deal with the 'version' field in the
datagram header.

Will the list management please consider doing something with Jim's posting
privileges until such time as he exhibits either an ability to write a
coherent paragraph on a network-related without mentioning IPv8, or sufficient
understanding(*) of protocol design to explain the previous paragraph? 
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

(*) it's not THAT challenging - most first graders have a sufficient grasp
of mathematics to understand the equivalent problem in decimal notation...

---

From: "Jim Fleming" <[email-masked]>
Date: Fri, 6 Sep 2002 01:28:30 -0500

----- Original Message -----
From: "Caitlin Bestler" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, September 04, 2002 4:39 PM
Subject: Re: Multihoming Issues

> discussed on "IPv8" networks?

IPv8 is just IPv4 in the hands of someone with a clue...

IPv6 is a good resume builder...look at all the money being wasted on it...
By the way....IPv6 continues to crash...
http://www.iht.com/articles/69229.html
PARIS Europe's bold hopes for third-generation mobile-phone services have come crashing down to earth. By one estimate, perhaps half
of the licenses that West European companies bought two years ago for fast networks will never be used - meaning $50 billion will
have been spent for nothing."
================================