Anonymous ICANNwatch Messages Considered Harmful?

* Subject: Re: Root Anycast
* From: Paul Vixie
* Date: Tue, 18 May 2004 18:56:54 +0000
*

> Paul, and other rootserveroperators (good scrabble word :), what would
> your answer/problem/arguments/... be if an ISP would decide to inject
> routes to the root-servers into their local network and point these
> request to a local dns cache(s), which would have the correct routes to
> the the global rootservers of course.

if someone injects 192.5.5.241 (or any route which covers it) anywhere
that a dns client will see it whose owner has not explicitly agreed to
have their f-root service modified in this way, and then modifies the
service (which means does something with the queries other than forward
them to an ISC-owned server) then we would of course file a lawsuit of
some kind, even if it meant opening an ISC office in some new place in
order to have "standing."

> Or another thought that have been raised recently on the 6bone list:
> Would it be an idea to have 2+ independent globaly routable prefixes,
> thus in IPv4 2x at least /24 and in IPv6 2x /32 which are allowed to be
> anycasted by anyone, just like the 6to4 stuff currently. So that ISP's
> could point these prefixes to their local dns caches, similar to the
> above but: documented which prefixes those are and no evil hijacking.
> This could also allow for DNS-client to have hardcoded addresses of
> these caching DNS prefixes lightening the load on the root servers as
> with anycast you will always get an answer from the closest one, if all
> is well and murphy is on his day off of course ;)

as far as i know, this would have to be done by iana rather than by ietf,
and the risk/reward tradeoff is such that it's not likely to see daylight.
last time i heard it discussed, the final determination was "better the
evil that we already know."

AS112 uses unowned anycast and it works well, but then, if wrong answers
were sent back by an AS112 server, it wouldn't exactly hurt anybody.
root name service seems more sensitive, to my eye.

[ Reply to This | Parent ]

Re:a local instance of the f-root server address? by Anonymous

1 reply beneath your current threshold.

Privacy Policy: We will not knowingly give out your personal data -- other than identifying your postings in the way you direct by setting your configuration options -- without a court order. All logos and trademarks in this site are property of their respective owner. The comments are property of their posters, all the rest © 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 by ICANNWatch.Org. This web site was made with Slashcode, a web portal system written in perl. Slashcode is Free Software released under the GNU/GPL license.
You can syndicate our headlines in .rdf, .rss, or .xml. Domain registration services donated by DomainRegistry.com