On 11-Jul-2006, at 05:32, Dean Anderson wrote:
BTW, the IESG response implied that the allegations of scientific
fraud
were (somehow) not substantiated.
I haven't seen these specific complaints voiced with this clarity
before (maybe I overlooked some mail). Perhaps this is a good
opportunity to dispense some additional perspective.
[...]
What the full community may not know, [but ISC, RIPE, Joe Abley, David
Kessens, Brian Carpenter, and the IESG do know], is that the report
claiming that stateful anycast was stable was fabricated, and that no
stateful testing was performed by the DNSMON program. Contrary to
assurances given by Karrenberg, there is no data which supports the
notion that stateful DNS Anycast is safe, nor any data that disputes
data and assertions that show DNS Anycast is unsafe.
I don't believe the fact that DNSMON sends all its probe queries
using UDP transport is news to anybody. It's certainly not a secret,
as you have aptly illustrated by looking at the source code, which is
freely available.
I was in the meeting in Seattle where Daniel presented his analysis
of DNSMON and RIS data in an attempt to draw conclusions about the
stability of various nameservers which had been distributed using
anycast.
The approach Daniel took (which was analogous to earlier work
presented by Verisign and also the work done by Peter Booth at the
University of Oregon) was to look at measurements which had already
been made by the NCC's DNSMON project, and try to identify whether
individual DNSMON probes saw oscillations in node selection over time
and if so, with what frequency.
It is possible to identify oscillations in node selection from
individual probes without using TCP transport. (In fact, it seems to
me that it's easier to acquire unambiguous results using UDP
transport, since if there *are* node oscillations which would damage
TCP, measurements using TCP would simply indicate failure without
revealing the nature of the oscillation.)
However, from what I could tell from Daniel's presentation, the fact
that UDP transport was used by DNSMON was a simple result of the fact
that UDP measurement data is what was already stored, and hence that
was the data that was available for analysis.
I can find no example of Daniel (or anybody else) claiming that
DNSMON in general, or the data which formed the basis of Daniel's
NANOG presentation in particular, resulted from DNS queries made
using TCP transport. The only person suggesting otherwise is you.
Surely this whole issue is a red herring.
Now put this in context along with repeated assertions from Joe Abley
and others associated with ISC and RIPE that stateful anycast is safe
and even non-controversial. More history is found at
http://www.av8.net/IETF-watch/DNSRootAnycast/History.html
I fully support continued measurement of services which have been
distributed using anycast.
I make no claims that anycast is definitively safe for protocols and
services which don't involve trivial, stateless transactions. The
document draft-ietf-grow-anycast-04 goes to great lengths to describe
considerations in protocol/transaction and network characteristics
which should be well understood before anycast is chosen as a service
distribution mechanism.
Kurtis and my slides in the open ops area meeting this afternoon will
repeat the message that unicast is not a universally applicable
strategy.
However, I also don't presume to say that (for example) protocols
based on TCP are always unsafe for deployment using anycast in all
possible networks. For example, there are people using anycast to
distribute services using very long-held sessions (e.g. internet
radio, HTTP) with great success, and to ignore their experience and
success would be idiotic and arbitrary.
Joe
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/ietf