Subject: Re: even one reason why provably unique SL is needed?

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 25 Nov 2002 14:33:03 -0500

In message <[email-masked]>, Pekka Savola 
writes:
>On Mon, 25 Nov 2002, Steven M. Bellovin wrote:
>> You run into the birthday paradox here.  In a space of 2^38 address 
>> blocks, with 2^19 "allocations" there's a 50% chance of at least one 
>> collision.  Given how many home networks will be using this stuff, 
>> we'll have far more than 2^19.  
>> 
>> But that's not the interesting question.  The interesting question is 
>> what the odds are of two users of the space "colliding", and that in 
>> turn depends on the average connectivity.  On that I have insufficient 
>> data.
>
>The requirement for birthday paradox to be valid is when those networks 
>are totally interconnected; for that, the number is like 2^19.
>
>I fail to see valid scenarios where even 2^5 site-local networks would be
>interconnected.
>
>I'm still assuming the site-locals, are, well, site locals.
>
>So valid interconnections would be:
> 1) sites connecting (e.g. two physical locations of one organization)
> 2) site-local address info leaking though some ways outside of sites 
>where there is site-local connectivity
>
>1) is which seems to be critical, but I still fail to see a huge need for 
>interconnection.
>
>2) should not be relevant in the case that collisions are extremely rare, 
>as the connections will fail anyway (the question is only _how_).
>

Don't forget mergers and private interconnects.  The latter are *very* 
common, even without counting telecommuters.  One shouldn't use 
site-local there, but it's a path that often bypasses firewalls and 
other official demarcation points.

If interconnections never occur, we don't need to worry about the 
problems that can happen.  My fear is that they occur all too often.
(What percentage of queries to the root name servers come from 1918 
addresses?)

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com ("Firewalls" book)

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Michael Thomas <[email-masked]>
Date: Tue, 26 Nov 2002 10:36:23 -0800 (PST)

> (What percentage of queries to the root name servers come from 1918 

Am I the only one that finds the term "private
interconnect" somewhat specious? As in, if people
make larger x-realm internets by plumbing their
own wires instead of through an ISP, why should
that be thought of differently than the Internet?
Maybe that's why this entire concept is so
unsettling to me.

		Mike

---

From: Keith Moore <[email-masked]>
Date: Tue, 26 Nov 2002 15:03:35 -0500

> that be thought of differently than the Internet?

even though filtering and policy exists on links in both portions 
of the network, in the public world the intention is to provide 
(near) complete interconnection (though some may get better links
than others), whereas between private networks the intention is
to permit interconnection only between some sets of addresses
and prevent it in others. 

anyway, it seems useful to recognize that the difference exists, 
and to have shorthand terms to distinguish the different kinds
of IP networks.  whether such private networks are part of the 
"Internet" is an ancient debate, and probably not worth 
revisiting.  pragmatically we expect the same IP routers, hosts
and applications to run in both kinds of network.

Keith

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 27 Nov 2002 17:52:24 +0100

> Maybe that's why this entire concept is so

The question is, at what scale does route aggregation
begin to matter? The sort of VPN-based or merger-and-
acquisition based networks we are talking about don't seem
to be anywhere near that scale; we know that flat routing
of thousands of prefixes is possible. So it may be
philosophically unsettling, but I don't think it is
operationally unsettling.

   Brian