Re: national security

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, 2003-12-05 at 12:16, Suzanne Woolf wrote:
On Fri, Dec 05, 2003 at 10:44:00AM +1200, Franck Martin wrote:
> There are now organisations installing root servers in all countries
> that want one. If you are operating a ccTLD, you may want have sitting
> next to your machines a root server, so if the national Internet link
> goes down (something major but not impossible when many countries have
> only one link to the Internet) the system still works for all the
> national domain names...

We (ISC) are widely anycasting f.root-servers.net. Several of the
other operators of root nameservers have begun to anycast their
servers as well, or announced plans to do so.

Is this what you meant? If not, could you elaborate?

Yes this is what I mean

> This is a not a very well known fact, and I stumbled upon it recently
> after wanting to complain that root servers where only in developed
> countries.

It's hard to quantify what "developed" means in this context. Our
anycast f-root systems, for example, do need some infrastructure
around them in order to be useful, but we have anycast clusters in
over a dozen locations, most outside of the G8. See
f.root-servers.org.
Well just use the LDS index of the UN if you are in doubt, but we are not here in any contest... Outside the G8 is "something". Yes they do need some infrastructure that you may not find in developing country... but then see my last point...

> Oh, btw to install a root server, any PC will do, it is not something
> difficult as it carries only a couple of hundred records (200 countries
> and a few gTLDs), not the millions of a .com.

Operationally, this is a dangerous half-truth. It may be the case that
you can run a nameserver that believes it is authoritative for the
root zone and will answer for it in this way. But under real world
conditions (significant numbers of queries, possibility of DDoS or
other attack, etc.) this is far from adequate.
This is not a dangerous half-truth, It has to be demystified. Let's take the example of a country like Tonga. A simple PC will do for them because the number of Internet Users there is may be about a 1000 people. With anycast properly set up only the packet of that country will reach the local root-server (proximity), so it is unlikely to be under heavy load with a 1000 of people on the Internet there...

Finally before a root-server is installed somewhere, someone will do an assessment of the local conditions and taylor it adequately. I want countries to request installation of root servers, and I know about 20 Pacific Islands countries that need root-servers in case their Internet link goes dead.

cf
www.picisoc.org if you want to join us...

thanks,
Suzanne


============
Suzanne Woolf				+1-650-423-1333
Senior Programme Manager, ISC		

		** Fortune favors the prepared mind **
----
Franck Martin
franck@xxxxxxxxx
SOPAC, Fiji
GPG Key fingerprint = 44A4 8AE4 392A 3B92 FDF9  D9C6 BE79 9E60 81D9 1320
"Toute connaissance est une reponse a une question" G.Bachelard

[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]