ietf
[Top] [All Lists]

Re: national security

2003-12-04 18:01:58
On Fri, 2003-12-05 at 12:16, Suzanne Woolf wrote:

On Fri, Dec 05, 2003 at 10:44:00AM +1200, Franck Martin wrote:
There are now organisations installing root servers in all countries
that want one. If you are operating a ccTLD, you may want have sitting
next to your machines a root server, so if the national Internet link
goes down (something major but not impossible when many countries have
only one link to the Internet) the system still works for all the
national domain names...

We (ISC) are widely anycasting f.root-servers.net. Several of the
other operators of root nameservers have begun to anycast their
servers as well, or announced plans to do so.

Is this what you meant? If not, could you elaborate?


Yes this is what I mean


This is a not a very well known fact, and I stumbled upon it recently
after wanting to complain that root servers where only in developed
countries.

It's hard to quantify what "developed" means in this context. Our
anycast f-root systems, for example, do need some infrastructure
around them in order to be useful, but we have anycast clusters in
over a dozen locations, most outside of the G8. See
f.root-servers.org.

Well just use the LDS index of the UN if you are in doubt, but we are
not here in any contest... Outside the G8 is "something". Yes they do
need some infrastructure that you may not find in developing country...
but then see my last point...


Oh, btw to install a root server, any PC will do, it is not something
difficult as it carries only a couple of hundred records (200 countries
and a few gTLDs), not the millions of a .com.

Operationally, this is a dangerous half-truth. It may be the case that
you can run a nameserver that believes it is authoritative for the
root zone and will answer for it in this way. But under real world
conditions (significant numbers of queries, possibility of DDoS or
other attack, etc.) this is far from adequate.


This is not a dangerous half-truth, It has to be demystified. Let's take
the example of a country like Tonga. A simple PC will do for them
because the number of Internet Users there is may be about a 1000
people. With anycast properly set up only the packet of that country
will reach the local root-server (proximity), so it is unlikely to be
under heavy load with a 1000 of people on the Internet there...

Finally before a root-server is installed somewhere, someone will do an
assessment of the local conditions and taylor it adequately. I want
countries to request installation of root servers, and I know about 20
Pacific Islands countries that need root-servers in case their Internet
link goes dead.

cf www.picisoc.org if you want to join us...


thanks,
Suzanne


============
Suzanne Woolf                         +1-650-423-1333
Senior Programme Manager, ISC         

              ** Fortune favors the prepared mind **

----
Franck Martin
franck(_at_)sopac(_dot_)org
SOPAC, Fiji
GPG Key fingerprint = 44A4 8AE4 392A 3B92 FDF9  D9C6 BE79 9E60 81D9 1320
"Toute connaissance est une reponse a une question" G.Bachelard
<Prev in Thread] Current Thread [Next in Thread>