Subject: RE: Removing features

From: "Michel Py" <[email-masked]>
Date: Fri, 10 Oct 2003 23:59:24 -0700

> Leif Johansson wrote:
> Tell that to the root zone operators and brace for the reaction.

Root zone operators, meaning like Verisign?

Michel.

---

From: Leif Johansson <[email-masked]>
Date: Sat, 11 Oct 2003 09:40:04 +0200

Michel Py wrote:
|>Leif Johansson wrote:
|>Tell that to the root zone operators and brace for the reaction.
|
|
| Root zone operators, meaning like Verisign?
|
| Michel.
|

Yes. I recently sat in on a presentation from the operators of
I.root-servers.net. Currently 8-10% of queries are from rfc1918
addrs and 3.6% of queries are for rfc1918 .in-addr.arpa records.
That is not an insignifficant number of queries.

	Cheers Leif

PS I changed the subject and trimmed the cc. It is sometimes
difficult to keep up when you are in a different timezone. I
appologize for the email you replied to which spilled over to
a thread where it did not belong. DS

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Sat, 11 Oct 2003 10:46:27 +0200

On zaterdag, okt 11, 2003, at 09:40 Europe/Amsterdam, Leif Johansson 

> That is not an insignifficant number of queries.

My argument was (is) that having RFC 1918 routes or packets escape 
doesn't add additional problems on top of the fundamental problem that 
routes or packets with the wrong addresses get out. Letting out wrong 
(non-RFC 1918) addresses hurts the legitimate holder of those 
addresses. With RFC 1918 addresses this isn't a problem.

I don't think another 10% load on the root nameservers is a huge deal, 
so I wouldn't use the word "harmful" but I guess this is a special case 
as a resolving nameserver that uses an RFC 1918 address isn't going to 
receive a reply for its queries to the root, so it will keep repeating 
those queries over and over again.

I read a report that only 2% of the hits on the root servers is both 
legitimate and useful anyway.

---

From: Leif Johansson <[email-masked]>
Date: Sat, 11 Oct 2003 11:24:24 +0200

Iljitsch van Beijnum wrote:

<snip>

|
| My argument was (is) that having RFC 1918 routes or packets escape
| doesn't add additional problems on top of the fundamental problem that
| routes or packets with the wrong addresses get out. Letting out wrong
| (non-RFC 1918) addresses hurts the legitimate holder of those addresses.
| With RFC 1918 addresses this isn't a problem.

In the DNS case this is incorrect. What happens is that you get a udp
packet with a return addr of 10.0.0.1 and not only don't you know what
to do with it so you have to throw it away but you can be sure of
getting the *same* query again, and again, and again, presumably from
the *same* client who can't figure out why the reply isn't coming back.

This happens in many protocols which are (contrary to popular belief)
deployed on the Internet today.

|
| I don't think another 10% load on the root nameservers is a huge deal,
| so I wouldn't use the word "harmful" but I guess this is a special case

Again. You'll have to ask the operators of the root-zone if they
consider 11-14% a big deal. Maybe some of them are listening....

| I read a report that only 2% of the hits on the root servers is both
| legitimate and useful anyway.

~From the presentation I refer to which unfortunately is in Swedish but
you can probably read the numbers anyway... :

http://www.iis.se/Internetdagarna/2003/23-robust-dns/id03-23-lars-johanliman.pdf

this is clearly not the case. The rfc1918-queries consistute the bulk
of bad queries ("DUMMA frågor" on page 4 of the presentation). I must
however confess ignorance as to what queries are 'useful'. Presumably
even the rfc1918-queries were deemed useful for someone since they
were sent in the first place.

	Cheers Leif

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Sat, 11 Oct 2003 14:14:36 +0200

> consider 11-14% a big deal. Maybe some of them are listening....

Well we as root-server operator will have to take the costs of  
upgrading to handle the total query volume....10-15% is then quite a  
lot.

> were sent in the first place.

The 2% figure I think was from an analysis of f.root-servers.net.  
i.root-servers.net seems to be seeing more "valid" queries than f. I  
guess these figures are different from each server. I think Liman said  
that we where seeing 25% garbage in total. I think queries from and  
about RFC1918 addresses was around 20% of those. It would be fun to see  
what percentage of the Ipv6 related queries that are for site-local  
addresses...

- - kurtis -