Slashdot Mirror
Is the Internet Shutting Out Independent Players?
"ISPs aren't advertizing routes for competing ISPs, and since IP blocks are heavily filtered upstream, this won't do much good anyway. The reasons for this are clear (Routing table growth was getting way out of hand), hence the introduction of CIDR ? , and the allocation of IPs to ISPs, with a resulting lockout on availability of routable IP space to individuals or smaller groups.
With the availabilty of IPv6, and the cost of RAM, I find it somewhat hard to believe that either IP address blocks are scarce, or that the size of routing tables are unmanageable any more. This might have been true with an 8MB Cisco 10 years ago, but surely it would be a negligible cost to put 1-2GB of RAM on even a reasonably budget router at todays prices.
Obviously, IPV6 isn't really here yet, but i would like to think that when (if) it arrives, we will see a more open routing system.
Is anybody working on returning some kind of equal standing to 'the little guys' when it comes to internet routing infrastructure, and how a more 'open' system could work in practice on tomorrow's (or today's) internet?"
At least in the states - my employer (AT&T) offers multi-homed and backup connections at T1 speed and above. (Routing is via BGP4.) You need to accept IPs from one ISP or another, so they're not really "yours," but it still works. I presume Aussie ISPs do the same thing, but I may be wrong.
sulli
RTFJ.
Here - 217.53.98.174 - doesn't seem to be responding; use that one.
The person that wrote this has 0 clue of what's involed with routing. He needs to go read books before submitting stuff like this.
/.
"just add a gig or two of ram to a cisco router"
hahahaha
Also, IPv4 is running out of IP's. Plain and simple. Therefore, these IP's need to be given to people that have a clue what to do with them and not piss them away. I work for a major webhosting company and we have to fight for our ips everytime we need more. It's getting harder and harder for us. Luckily we own our entire Class B now, but I know soon a time will come when we dont... heh
Research before whining to
Having a multi-homed network is extremely stressful on the rest of the Internet, and you're going to have to pay for the privilege.
Yes, routers have gotten a lot more advanced, but if every Tom, Dick, and Harry wants to have their own APNIC-assigned IP block, it is going to cost a lot of money for the backbone providers and everybody else to accomodate the routing tables. Unless you're big enough to make a reasonably large dent in their bottom lines, they aren't going to care about making you happy because it's just too damn expensive. (And guess who would wind up paying for your pleasure? Every user of consumer-grade connections, that's who.)
You should be quite satisfied that you can even get high-speed connectivity (not to mention, connectivity from multiple providers at once) where you're at. Here in the USA, the most technologically advanced society in the world, it's difficult if not impossible to get *any* high speed service outside a major metropolitan area. Before my cable monopoly upgraded its network, I couldn't get any service at all that wasn't long distance dialup.
My advice to you: count your blessings, and find a different way to solve the problem.
Just my 2c.
~wally
Vintage computer games and RPG books available. Email me if you're interested.
These methods and models of doling out IP addresses leave some of our internet data centres hopelessly inadequate at providing something as trivial as fault-tolerant links thru two or more ISPs within the same country as each ISP would refuse to route blocks belonging to other ISPs.
However, I dont think that arguing the increased RAM capacities of routers being capable of storing the huge routing tables is the answer.
CIDR and its ilk was developed to partly address huge routing tables, but the key point it addresses is propogation of new route changes which need to be sent to more routers and thus generating more traffic instead of being confined to just the edge (in context) routers as used now.
If the propogation of new and changed routes could be addressed without generating additional traffic, and believe me when I say bandwidth isnt cheap in Asia, then I would agree with utilizing larger RAM in routers to store these tables.
Incidentally, I was a couple of minutes short of FP. :)
You don't want every Tom, Dick, & Harry setting up networks like Loose Cannons. And Domain names, Darn-It! There are no more left, except of course www.clownpenis.fart.
Even the in new Routers from Cisco you can't put 1 to 2 Gigabytes of RAM in them, most top out at 256 or 512MB. RAM for PC's might be cheap but most of the RAM for routers and such have not come down in price like the RAM for PC's.
/19 level. ARIN's minimum block size is /20 or for Multi-homed ISP's that qualify for a /21 also get a /20. But if you want you routes (and IP's) to be globaly distributed with no problems, then you need a /19 or bigger.
Here in the US there is similar requirments, BackBone providers often filter routes at a
Let's pretend you're APNIC. Now let's pretend you've got 100 million geeks clamoring for IP's. How much of your resources do you spend on customer-service and hand-holding before you throw up your hands in despair and start setting some limits?
Perzackly.
Now, consider the fact the Joe and Jane Geek have to have a connection to use those nice shiny new IP addresses. And you soon see why we have the present hierarchy of telco's and ISP's.
Not be to be blunt or anything, but hasn't it occured to you that eventually we will end up with a few major ISPs? We watched for years as small ISPs struggled and went out of business, while the large players sucked up the business.
Nope, I sure as hell not suprised we're going down this road. All this new policy will do is speed up the natural selection of companies until a few monster ISPs (probably run by an existing monster like AOL/Time Warner/Nullsoft) run everything.
An idea that I had been toying with was to buy 2 internet connections, say DSL and cable modem, then use NAT to use them both simultaniously. In a simple scenario, seems like it could be accomplished by picking up 2 of those cheap home gateways and setting up a non routeable network. Internally the machines would be set to use one of the gateways by default, if that connection went down you could switch to the other one. Externally multiple DNS records could be used to distribute the traffic among multiple ips, all of which point back at the non routable network.
Even though I concieved this idea for a low end home network, the basic idea should be applicable to a business that really wants a redundant connection. Just buy multiple connections from multiple sources, keep your machines in a non routeable network, then use some fancy equipment (a Cisco PIX for example) to make everything work. Bit of a kludge, but I think it's a viable solution.
Unfortunately, the very reasons you're eagerly awaiting IPv6 are probably the reasons that you won't ever see it, and you probably already know those reasons.
The Internet stopped being about information about five years ago (Or at least that wasn't the point anymore) and it's now all about eCommerce and BS like that. The very same companies that got on the Internet in the first place to deliver information are now delivering information only from their marketing departments, and not from engineers or researchers. Commerical interests have all but drowned out its original spirit, and are also partially the reason for the inception of Abilene (Internet2). Of course, it probably won't be long before that new promised land gets pillaged and raped. The Internet as we know it seems to be in an eternal state of loss of innocence, I'm afraid. I don't think the solution is to supplant or supercede the original 'net, but to just have a user-maintained network...kinda like what the network-area neighborhoods are designed to accomplish, except on a much grander scale. When the corporate interests don't exist, then the public can do with it as they see fit.
"Mod, mod, mod...and another troll bites the dust."
One real problem is that IPv6 is still not ready
for prime time.
There are many high-end routers that cannot deal
with IPv6 and will not be able to without a hardware upgrade, as they use ASICs to store tables of IP addresses and those ASICS expect four bytes.
yes, but I believe the solution rests with a layer on top of the internet - namely something like peer to peer systems of today where nodes can shift more easily, appear and disapear without hurting the overall network.
the real problem is with NAT (network address translation). How to two peers behind such a NAT firewall anounce their presence to each other and then communicate without the assistance of a 3rd peer with a proper IP address and place on the internet. if anyone knows the answer to this quiestion, I'd love to hear it!
really, how do you announce a service behind a firewall? that seems to be the question of the day.
Insightful? This story has absolutely nothing to do with Jon Katz.
I used to bulls-eye womp-rats in my pants
This is true with most tier1 providers. Is this just an .au thing?
No replies made to AC posts. Please log in.
It's true, you can't get portable IPs of your own anymore. The advent of CIDR and the segregation of netblocks were in an effort to reduce global routing tables.
Putting in 1-2Gb of memory in a router is still incredibly prohibitive. It just can't be done in the mainstream (common) routers.
You can still be multi-homed with netblocks from one ISP to be received by another. This happens this way in the US, and I'm sure it happens with APNIC and RIPE-issued blocks. You get the same effect, without all of the hassles of truly having your own blocks. At least we don't have the /19 barrier for advertising that used to be prevalent in larger ISPs. There is some give and take. The give on that is that the larger ISPs have gone to regional aggregates.
For instance, I don't want to have to pay for my addresses in the US now thanks to ARIN. (Don't get me started.) My ISP takes care of that. The justification process of getting addresses isn't fun, but it's a lot better than the Inquisition your provider has to go through. I'm not saying that economy is bad, but it's a fact of life with IPv4.
It's possible that controls will be loosened in an IPv6 world, but I don't think so. We've been down that path before. With tiny fragmented blocks of IPv6, we're creating a nightmare of routing tables the likes of which we've only imagined with IPv4. Aggregation is here to stay, and I beleive the days of the portable netblock are long gone.
Of course, if you can justify your need for your own blocks, you can go directly to your registry. If not, isn't it enough to have your networks SWIPed to you?
The days for "vanity" addresses are long gone. Maybe you should think up a clever .com domain name instead while you still can.
I think the constoriums are worried that when countries go online like china that it will spark to much demand more than it can handle. I think they are trying to conserve and reserve as much as possible.
I'm sure that the reason that this is so is because we're running out of IPv4 IP addresses. After all, ARPANET started out as a defense project--it was never expected that some private party in New Zealand would ever need his own set of IP addresses! It will also free the rest of us from the need to use NAT's. -jj
WTF is it ? Solves all of these problems, increases security, increases reliability adds predictability to networking.
Its been trialed and used on long haul cables and backbones. Most decent OSes support it. IPv4 would still work over IPv6.
Isn't it time to flick the switch ?
An Eye for an Eye will make the whole world blind - Gandhi
Someone tried selling me on a box that did that, except it would take several high speed connections (like 4 or 8 ethernet ports on the box, you supply the other end) and then via NAT and then intelligently load balance the traffic across those connections. I think it had the ability to transparently redirect traffic based on protocol to these presumably cheap broadband connections.
The idea was that instead of buying another expensive T1 because everyone's reloading Slashdot all the time, you buy cheapie DSL connectivity as needed and run your "unimportant" traffic out this box and the business-critical gets more of the T1.
It's a neat idea.
Does this put control of the entire internet further and further into the hands of large corporate players,
Well duh, yes !
and and is anyone particularly interested in changing this situation?"
I hope so.
True, but bashing Katz is always insightful. The true test of one's intelligence is in whether or not they agree with Katz.
Bite my yammer.
Just use the KatzFilter.
Sure, you can STORE lots of routes in that much RAM, but how are you going to search that many routes to find the *right* one, in real-time, to route millions (or billions) of packets per second?
If I understand your needs correctly,
Why waist an entire set of IPs when you can NAT off your network and pay the local phone company o connect bothe sites over a leased line then you can have access to the 10.x.y.z reserved IPs. then you can have as big a network as yuou want. you could also put another NAT at the other end so as not to over load the first.
I am the Alpha and the Omega-3
"But surely it would be a negligible cost to put 1-2GB of RAM on even a reasonably budget router at todays prices." This person is definately showing they have no clue what they're talking about. YOu can't just put cheap 100$ 512 SDRAM.... or there goes your Cisco warranty. 1 gig of CIsco RAM will cost tens of thousands of dollars. Most routers that can handle that much RAM are not 'reasonably priced', unless you consider hundreds of thousands reasonable (IE: 7500 with RSP8 card). It's a shame that ISPs and NAPs in New Zealand don't offer BGP advertisements for multihoming. I work for a NAP in North America, and advertising another provider's classes for multihoming purposes is not something unusual; it's common practice.
It's better to burn out than to fade away
I'm not sure why you want to go multihomed, with all the attendant problems that it brings. If this is a corporate connection, that's not got services (other than mail) being provided to the outside world, then I don't really see the point. I think you can provide the redundancy in other ways - here are some ideas, using 2 ISPs (and PA IP addresses allocated by each of them).
Put a mail server on each connection (or map an IP address from each connection through your firewall to the mail server). MX records will do your load balancing and redundancy for you.
Use NAT/PAT for users to connect to the Internet. If one conenction goes down, remove the internal routing to that connection - all your sessions will now go out of the other connection. I find that this is quicker than waiting for BGP to reroute connections via a backup/alternate path. It also gives you more flexibility in internal network numbering, and to move ISPs.
Host services with colocation providers - not internally. Colo service providers have already solved most of the service provision problems, and are well connected to the Internet - I don't think it's worth trying to do this in house.
you probably don't.
Are you really sure that competing ISPs over there are not advertising others routes?
I've just had some first-hand experience of this with Worldcom, ESpire and AT&T. Worldcom were more than happy to allocate us a 'class C' so we could run BGP without getting filtered upstream. (This appears to be the smallest block that gets routed these days.)
Each and every one of these ISPs sold us dedicated connections boasting how many peering arrangements they had with each other and when it came time to route, no problem.
Maybe that's the cutthroat ISP biz in the US, I'm quite surprised that it's not the case in NZ.
The size of routing tables is quite big. In fact you generally require the entire use of a T1 just to manage the updates of a full table. That's why it's typically ISPs that do this kind of thing.
One other solution they all put forward was to purchase connectivity from each of them and let them do the BGP over the lines. I thought this was quite cooperative of them, to send your traffic via another provider if their link went down.
Hmmm.
How many computers do you have on this lan? Why do you think you need to 'own' the IP addresses? First off, you don't even need to own ANY ip addressed to do multihoming. You could NAT all of you LAN boxes up into the single /30 advertisement that your ISP(s) are going to give you for the serial interface on your router, and then have the ISP advertise that out to the 'net, and voila, you have multihoming. When one provider goes down, you can use your IGP to route across the other, OR, if you wanted to go a litte more high-class, you could buy a large router, and take full BGP tables from both providers, and differentiate intelligently based on the preferences sent on the routes. Now, if you don't want to do NAT, and there are a whole slew of good reasons you wouldn't, why are you hung up on ownership of these IP addresses? Why won't you let the IP-allocation process work like it's supposed to? If APNIC had to allocate IPs to every small business in the region it's responsible for, it would take 3 years to get IPs from them. Buy a block of IPs from your ISP(s), and if you transition to another ISP, re-number your network. Or, if you don't wanna go the cheap way, you CAN buy portable IP space from providers. Many of them buy whole Class As just for this purpose, it's just that you're going to have to pay more for these IPs than you would otherwise, as you should, since the ISP's netblocks can become non-contiguous if you leave. As far as your questions about IPv6 and router memory, the internet routing table is well up above 100k routes already, and there are many routers out there that are already having problems dealing with tables of this size. Many Cisco boxes will die in the near future if not upgraded, as their old routing engines run out of memory, and despite the fact that PC memory is cheap, router memory often is not. Especially when you have to install it on the tens of thousands of routers any decently sized ISP will have. IPv6 isn't really even a factor yet.. and when it is, many routers are going to need heavy upgrading (software, hardware, etc) to deal with it, which is why so many ISPs aren't rushing out to do it. So buy some portable IP space, get yourself multihomed, and go buy a good BGP book.
//Phizzy
"Most European technology just isn't worth our stealing," -- Former CIA chief James Woolsey, referring to Echelon
Give me a break - isn't this why 'virtual' hosting was introduced ?
Next thing you'll be saying you want your own strip of highway to put outside your house, linking your ass to every asshole in history.
A slashdotting - you get the stick first and then the carrot !
First of all, RAM on a router is not the issue anymore. The issue is bandwidth. If your router has to maintain 100,000,000 routers instead of 100,000, you have a 1,000 fold increase in routing table updates in network bandwidth.
:-)
Second, IPv6 will solve this, at least for a while. Despite IPv6 having enough addresses for all the particles in the universe, I'm sure we'll run out again in a few years
Finally, how many companies actually need their own IPs? Small ISPs just get their IP range from a larger player, who is providing them with bandwidth. Under normal circumstances, a mom & pop ISP doesn't need an OC-192 - they're probably happy with a T-3. It's cheaper for them to sublet a fraction of a big player's bandwidth then to go at it alone.
Use it or lose it for IP addresses - I like this idea a lot.
No, but the usual crappy Katz bashing has been replaced by a more directed assault on his journalistic integrity (or lack of) Did you read that Afghanistan article? If you had you would realise just why Katz needs to be slapped.
Really, that story was made up bollocks from the start.
Oh, I'm not denying that the post should be marked off-topic, but you really should read the Catz article in question (sorry, no link) and then you'll realise why somebody gave it Insightful. And the Troll mod was totally unjustified.
I'm off to dig up the ZX Spectrum I left buried and install the SETI client while cracking MD5 hashes. Oh, sorry, I thought I lived in Afghanistan for a moment.
Moderators: This post is off-topic, not troll, flamebait, or overrated. Please moderate accordingly.
In my experience working for the US government I have never seen them use a private IP range. They would have Class B subnets and use only a fraction of the available IP's. The rest are pretty much wasted. So if you can't beat them, join them. Become a government agency and you'll have all the IP's you could want.
Oh so many answers, so little time.
First of all, one should note that IPv6, while supported in newer versions of Cisco IOS, has the slight problem that in BFRs, the hardware accelerated routing hardware has four times more work to do to look up a 128 bit IP address making performance somewhat of a problem. Add to the fact that a lot of the routers out there simply can not be upgraded past 128 MB of RAM and you run into a slight problem when you go to make your $150k router IPv6 capable.
Then there is the little problem of client operating systems and the "migration" to IPv6. As there are only a handful of people on this planet who use IPv6 exclusively, routers will have to support both until all the client software of the world moves over. Now, it is bad enough getting full IPv4 BGP updates, but getting them *AND* IPv6 updates?
Of course, next comes all the little hardware out there. From the terminal servers people dial up to, to the layer 4 load balancers, there is a lot of hardware that doesn't support IPv6.
So, as a large network service provider, one would have to justify the costs associated with IPv6 against the benefits. The benefits are pretty slim right now unfortunately. Ideas like a single roaming IP (pipe dream if you ask me), mandatory multicast/anycast support, fixed sized headers and IP level security are all fine and dandy, but when you are talking about replacing (or at least suplementing) millions of dollars in infrastructure to allow a handful of people to use IPv6 for years until the REST of the world follows, it starts becoming hard to justify.
Don't get me wrong, IPv6 has some lovely attributes, but until Cisco enables IPv6 by default on all the hardware they make, everyone upgrades their copies of Windows and MacOS to support it and all of a sudden the terminal servers of the world (remember dialup still exists) all start learning how to route IPv6 packets, it is an uphill battle.
So the question really becomes, how long will it all take? IPv6 really needs a killer application to the general public aware that they *need* it and ask their providers to provide it. Once enough demand is generated, ISPs will start asking their upstreams for it and the ball will start rolling.
The same problems have plagued multicast for some time and still, very few providers support it and even fewer have customers who use it.
Of course, that's just my opinion, I could be wrong.
The world is neither black nor white nor good nor evil, only many shades of CowboyNeal.
I am a the network admin for a small school. We have a Cisco 2500 series router with a T1 interface and ISDN BRI. Using a "floating static" route, our 2500 series router dials out on the ISDN circuit if our T1 fails. This isn't really multi-homed since we are dialing into the same ISP and recieving the same IP block we usually get. It does, however, provide us with an emergency (slow) connection if our T1 goes down. The PIX 506 firewall provides NAT/PAT services. This setup works quite well.
-ted
Here's how we solved the multi-home problem despite CIDR. We wanted to make a web service (Citrix ALE) available over our T-1, or over our DSL (from a different provider) if the T-1 fails. The solution was to get a cheap Web hosting service that will use our (already registered) domain name to host a couple of static pages that point to our servers by IP address. One set of pages points to the address we got from the T-1 provider, the other points to the DSL address.
When Big Brother thinks the main connection is down, we ftp over the backup connection to the off-site web host, make the other set of pages the default, and our users now come in on the other circuit. We change the Alternate Address on the Citrix servers, and we're back in business.
-- Spring: Forces, coiled again!
Gutenbergs press, governments tried to control it, and use it for control.
radio, controlled by governments, ran by business, almost no small player.Those small player that our left are being pushed out by regulations backed by corporations.
TV is controlled mush like Radio.
all these mediums are used to tell you what to think, eat, read.
why should the Internet be any different?
People who want to control, and power, don't go into Politics anymore, its too heavily watched. They become corporate players.
The Kruger Dunning explains most post on
for those of you who are confused about the nature of multihoming :
multihoming involves connecting to 2 or more isps and BGP publishing your ip space through both of them. this (ideally) involves having your own ARIN assigned ip space & AS number.
the point of multihoming is to address redunancy for inbound as well as outbound connections. you can use 2 isps + nat + creative outbound routing to handle outbound traffic, but that does nothing for a potential web server you're trying give multiple inbound paths to.
read the multihoming faq :
http://www.netaxs.com/~freedman/multi.html
one of these days, IP6 will happen...
then there won't be issues like this anymore.
This is a TROLL message, not a FUNNY one, Mr. (stoned) moderator
Same with mom-and-pop providers. No small players left.
That's the price to pay when you involve big money.
Duh!
Truly an American icon.
Except, wasn't he originally from Britain?
Not really, and no I'm not.
The Internet already is, always has been, and must be, run by large players. You cannot have an interconnecting network that spans the world and has that many users without someone very big to put the infrastructure (hardware and software) in place, and to maintain it afterwards. The only people capable of doing that are major corporations, and a few very large not-so-commercial bodies (the academic community, for example).
I'm sorry, but if keeping things efficient and practical for these essential big players means you can't play with precious IP address space, then that's the price you're going to have to pay. There just isn't space for everyone to play with their own blocks of IPs any more, and there isn't time for everyone further up the chain to account for them even if the space was there.
Yes, it's unfortunate that some of these big players have a monopoly, which is rarely a good thing. Yes, it's unfortunate that little fish get eaten by big fish. But unless you have a better suggestion, there are only two choices: (a) leave the big fish alone, accept that for now there will be issues, and have an Internet, or (b) get on your high horse about monopoly abuse, civil liberties, and any other subject of pontification you can find, and kill the Internet. Me, I think that's a pretty easy choice.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
ever hear of computer science?
here
...
This site is losing all credibility quickly.
Stories about people in Afganistan who dig up commodores and then download / watch divx movies have killed off every last shred of believability this haven for anti-ms zealots ever had.
It is time to get rid of katz
If you don't know that it was orignially:
Mae Ling Mak, Naked and Petrified
You really don't belong here.
Thank you.
Right now, I'm still experimenting with liberating the DNS system. Give me another 12 months, and we'll see about the internet as a whole. I mean, lots of improvements we could make right from the start... ipv6 from scratch, etc.
*grin*
Actually, in a demented way, I'm quite serious.
There's a good article at onlamp that talks about where all the IP's went and why things have gotten so stingy. A sad story about misallocation in the early days of the net (do companies like GE or Xerox really need 16 million addresses?)
The reason RAM for PC's is so amazingly cheap is based on two reasons that don't really apply to things like Cisco routers. The first is that the supply is huge and the demand has been relatively low. The second is that because of the vastness of the PC market, the components are more readily made in bulk and thus can be made for cheaper. If you look at RAM for just about anything else, the price for what you get has fallen a little over time but has stayed pretty consistent. That is, if it cost you $200 to have an adequate amount of RAM before, it still costs you $200 to have an adequate amount of RAM.
Now, I'm not a network engineer, but another factor to possibly consider is the specifications required for router memory. Does it require a higher level of performance, error correction, etc, than the average PC? If it does, then that will also raise the cost.
This sig has been temporarily disconnected or is no longer in service
...'Providerless' IP addresses...
...sound like open season for the DOS attack of the week. That's Denial of Service, not Disk Operating System.
Security and usability are two ideas in continuous tension. While providereless addresses would probably be a great thing for the Responsible Majority, the threat of Just One Jackass (JOJ) seems a little high here.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
I'm moving my company over to a pair of T-1s multihomed right now. We're doing it through Bellsouth and having the T-1s go to seperate POPs and our router will run BGP. Sure, we still rely on Bellsouth but it's very unlikely ALL of Bellsouth will go down at once. Doing this between major telcos would be a real issue I don't think we can afford.
The dual-homing aspect of this didn't cost us any extra. We're just paying for two seperate T-1s. To do this you need a somewhat sizeable router. They suggest a Cisco 3640 with 128MB, which is exactly what I'm implementing.
No, you can't do this at home, but why would you? It's not that unreasonable for a business. We're looking at like $2K-2.5K/month for everything and a one time charge for the router unless we lease it.
This was an extremely oversimplified view, more like "I think I need to have bar want to do foo, but I'm clueless what anything else".
/20 (Sprint and Verio are two notable cases). (Thus, if you have an IP range IP_A from ISP A and IP range IP_B from ISP B, and both ISPs advertise both ranges, you can still run into problems when one of htem goes down). Fortunately, lately, the wind started to change, and I think sprint already relaxed their requirement to /24.
There are many issues at work:
a) Assignment of PI (Provider-Independent) addresses:
Back in '94, as an end user, you were able to get a netblock directly from ARIN. Then, this block could be advertised (by BGP4) by your upstream[s], and thus you got connectivity. The problem here lays that these IP addresses were nonaggregatable and led to exponential growth in routing table size. (see http://www.telstra.net/ops/bgptable.html up to 1994). Thus, CIDR was born, and hierarchical assignment became the rule. Your upstream (call it foo) gets the IPs from their upstream (call it bar), and the whole internet sees needs only one routing table entry to reach all of bar's customers.
b) ingress filtering (filtering of traffic from customers to make sure only the source IP that are assigned to them are used). Yes, most ISPs do ingress filtering now, and it is now considered a BCP (best current practice) to do this (there's an RFC on that). Again, this is for a damn good reason: Without filtering, DoS attacks cannot be traced to their source, if one is spoofing the source addresses. With filtering, at least you know that the source IP address is likely to be the one attack is launched from (or one of 0wned machines attacking you).
Its well known that ingress filtering makes multihoming harder, as your upstream has to open up their ingress filter for the IPs that are assigned to you by entities OTHER than your upstream (say, your other upstream).
Since apparently you intend to advertise your network via BGP4, all ISPs who will talk BGP4 to you will have no problem relaxing their ingress filters. If all you have is a DSL line, you'll have fat chance of getting your upstream to talk BGP4 in the first place. See below for strategies to do this without BGP.
c) Even if you managed to get your upstreams to turn off ingress filtering and advertise your network via BGP4, you still may run into problems because many ISPs do not listen to network announcements less than
Bottom line is: if you want to have your "own" IP address range, you must advertise it via BGP4. If you can get your upstream to do that, you can get them to relax their ingress filters, thus your original complaint is silly.
Now, if all you have is two DSL lines and no cooperation with your upstream you can do the following (sometimes called DNS-based multihoming), _for inbound traffic_:
You set up two nameservers (A and B), one on each of the IP ranges that you have (range_a and range_b). Make all of the entries given out by nameservers have TTL of 5 minutes.
Make each nameserver have a DIFFERENT zone, containing only IP addresses on that range. (Ex, nameserver A will have an entry for www pointing to an IP from range_a, nameserver B will point to an IP from range_b.(both nameservers can actually run on same machine, bound to different interfaces).
Then, whenever someone tries to reach www.yourdomain.com, they'll hit one of the nameservers. If the one they hit first is down, they'll hit the other one, and get an IP address from the _working_ network. Voila, you are still reachable when one connection goes down.
Then, if you don't want your servers to actually have two IP addresses (one on each net), you can do some trickery with iptables/ipchains to redirect traffic to a single IP (probably on private network).
For the outbound traffic: All you have to do is to NAT your traffic to the correct interface/IP range (the one that's currently working). That is not very hard to do with a bit of shell scripting.
Actually, things are a bit more complicated because of this: Your machine (main firewall or whatever) that contains all these interfaces, normally has one routing table. Choosing of the correct interface is done by lookup of DESTINATION IP. Now, assume a packet comes over to IP_B. You _must_ make sure that it will go out BACK on interface B (if you send a return packet with an IP_B source address over ISP_A, it'll discard it because of ingress filtering). This is hard: again, remember, routing does not depend on your _source_ address, it depends only on destination address.
So, how do you solve it?
Luckily, Linux has policy routing, which allows you to have multiple routing tables and choose between them based on some criteria, in your case, it will be source IP. You'll set up two routing tables, one with default route pointing to ISP A, one to ISP B, and a rule saying "If a packet has a source on IP_A, use routing table A, if not, use routing table B"
(see iproute2 documentation for details)
Well, I think I should write a HOWTO on that...I glossed over quite a lot of details here.
I've given that idea quite a bit of thought, actually. You have 100 machines on a private network, using one internet ip to get what they need.
That's the idea of NAT. You get stuff with it rather than put stuff.
So, if you want to make a setup where you can provide services from behind firewalls, which would essentially reduce the required number of IPs by an exponential amount, you'd need a redirector. It would be very easy to rip up a socks style proxy to allow binding of external ports. It would also be easy to make an rpc style reference chart on a static port on the external ip.
You follow?
Machine 78 on the private network wants to open a web server. It registers that it wants an open port and that the service will be http.
When that machine was turned on and is located behind a firewall, the dns is updated to direct everyone there.
The web server on the outside poke at that machine and find that their target is sitting on port 40382 and opens the http connection.
Another possibility is to build the domain name in the requests, like in http. With such a service, you can have as many domains hosted on a server as you want, because it includes the domain in the request.
The first example is much more flexible, but also uses extra ports, which could be used up pretty quickly.
Whatever it is, it doesn't really matter, because the majority of clients are windows and microsoft wouldn't ever let that happen without putting its dirty finger in the pie.
However, most people are thinking like this and want to bleed as much as they can out of the current setup until they hit an iron wall and can't bleed any more.
Router memory is cheap, UNLESS you buy it from Cisco. Viking and Kingston both make excellent memory for Cisco routers at a *MUCH* cheaper cost than Cisco. It's not like Cisco memory is anything amazing, it's just OEM memory.
should be the same way for domain registrations :o)
I hear this sometimes. Cisco can *NOT* void your warranty by using 3rd party RAM. It's part of the Magnuson-Moss Act. As long as the memory meets Cisco specs you are allowed to use it. Cisco won't warranty it. If the memory fries and takes the router with it, Cisco won't warranty th router then..but they can't just void your warranty simply because you used it.
Many people that modify their cars know this act. Dealers like to claim a warranty is void when a performance part is put on a car. But as this act states, if the part didn't cause the failure you CAN NOT void the warranty claim.
Yes IPv4 space is running low.
But a bigger problem is closer on the horizon. AS numbers, which are used to uniquely identify large sections of the Internet in BGP are running low. Once these run out, the IPv4 limitation doesn't matter because you won't be able to route to the new IPs anyway.
I think they are trying to fix this with confederated BGP and forcing major ISPs into using internal-only AS numbers (similar to 10/8, 172.16/18 192.168/16 IP addresses) but I think it is causing more headaches than IPv4 is.
It's not an issue of route table size. With the route aggregation that takes place these days, 512M is more than enough RAM for route tables. Here's the BGP summary info from one of my routers that gets "full" BGP routes from one of my upstream providers:
This particular router happens to be advertising only a 22 bit summary to it's BGP neighbors, so that's it's not being used as a transit device by any of the three different ISP's to which it's connected.
103595 network entries and 103629 paths using 13779359 bytes of memory
18103 BGP path attribute entries using 943332 bytes of memory
15624 BGP AS-PATH entries using 404444 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP activity 12591567/28215562 prefixes, 16206716/16103087 paths, scan interval
15 secs
As you can see, even 128M is more than enough for route tables using a basic BGP configuration such as the one on this router.
However, route table size can be an issue, especially with slower routers. A router can only hold a packet in queue for so long before it has to drop the packet from the queue. During this packet hold time, the router must find the destination address in the packet, match that against the longest prefix in the routing table, apply any policy routing decisions, decide which interface to forward the packet to, then forward the packet out of the router to the next hop.
Obviously, the longer this process takes, the fewer packets make it through the router in any given time period, decreasing overall performance.
The simplest way of building heirarcy into the network is to have provider-dependant addressing, which can be aggregated by the provider. For local regions, you can advertise your prefix through multiple providers, but expect that to also be aggregated when it hits the first expensive (eg, trans-oceanic) link.
I understand that the IPv6 group looked at geography-based heirarcical routing. I'm not sure why this was dropped (although one could guess), but it had two interesting side effects: First, it put small providers on more even ground than big providers; and second, it also made the senders of traffic pay for the long-haul / backbone bandwidth (as opposed to traffic usually finding the backbone closest to the reciever of the traffic).
Here's my solution:
- Get a box or a rack in a good datacenter with mutlihomed connections. (AT&T has datacenter all over the world)
- Get all the ips you need. It's way easier getting ips for your colo uses. They take care of routing through several network.
- Get 2 or more consumer grade connection to the internet
- Make ppp or vpn connections to the coloed boxes
- Route packets from coloed boxes to your local network
- Voila you got multi-homed local network for your business.
Now this waste some bandwith, but it sometimes can be cheaper this way. It's funny how a cable modem link, a adsl and a microwave link can be 10 time cheaper than a t1 and provide more bandwith and more reliability.
All you need is two, one set for the external IP address and the other set as internal, then run NAT and DHCP on the internal network. Put the internal over to a hub or wireles access point for multiple internal connections. You can still config NAT or IPFW to access internal boxes from outside. With a DSL or Cable Modem provider, you only use 1 IP addy, plus you have firewalled your network. Linux works well but I prefer FreeBSD.
wait, let me get this straight: a finite resource that's in high demand has become scarce?!
HOLY COW! alert the news! UFOs must be involved.
-k
older companies and organizations have been camped on huge amounts of ip addresses for the last 10-15 years. if arin bit the bullet and forced these internet first-comers (and heavy wallets) to relinquish ip space we would see the 'ipv4 crisis' go away.
I'll say...
arachne:ckloote {101} whois -a 40.0.0.0
Eli Lilly and Company (NET-LILLY-NET)
Lilly Corporate Center
Indianapolis, Indiana 46285
US
Netname: LILLY-NET
Netblock: 40.0.0.0 - 40.255.255.255
Coordinator:
Eli Lilly and Company (ZE16-ARIN) hostmaster@lilly.com
317-277-7000
Domain System inverse mapping provided by:
DNS1I.XH1.LILLY.COM 40.255.22.1
NS1.IQUEST.NET 198.70.36.70
AUTH40.NS.UU.NET 198.6.1.18
AUTH62.NS.UU.NET 198.6.1.19
Record last updated on 17-Jul-2001.
Database last updated on 29-Nov-2001 19:56:47 EDT.
Yeah, Eli-Lilly is a big company, but please tell me why they need their own class A? They don't, but they managed to get it back in the early days, and won't give it up. I'm sure there are many more cases like this.
By the way, I miss K5. I always enjoy your often bizarre but interesting diaries. And lastly, just for a lark, guess who I am?
In a word, Freenet. :-)
I just wanted to voice my support for MacOS X when it comes to multihoming. It automatically detects the fastest connection available from the different ones set up in the Network System Pref. This is great when an Airport (802.11b) network becomes available, or one of your providers goes down at any time. It will even trigger a dialup connection if the broadband goes down, or switch broadband providers if you're lucky enough to have several. This truly works very well, and for laptop owners, it's a crucial capability.
"I like systems, their application excepted", George Sand (French)
With the exception of @home (are they finally dead yet?), it seems that all the major spam domains are now located in Asia, including:
Kornet.net
Dreamx.net/cjdream.net/thrunet.net
Chinanet.net
Hinet.net (though they MIGHT be improving; I haven't seen anything in my box in almost a week)
Moreover, it always seems to be impossible to reach someone in these domains (we're talking 50 or more LARTs to every valid contact address I can find), and sometimes the contact addresses in APNIC's database have been invalid for weeks, if not months.
Anyone else have these problems?
Lawrence Person (lawrencepersonh@gmailh.com (remove all "h"s to mail)
http://www.lawrenceperson.com/
The senior admin for an ISP I used to work for owned his own class C. Said he got it back in the day when just anyone could go to ARIN and ask. All he had to demonstrait was that he had the competancy to set it up properly.
IPv6 could allow easy access to multihoming. (Actually, IPv6 could actually solve a problem but doesn't do that either).
There are organizations (ARIN in North America) that handle IP alloations. Their policies have been created with one stated goal: keep the number of routes down so that routers don't blow up. With IPv6, they seem to be following the same policies.
How do you keep the number of routes low? You make it really hard to get IP addresses. That's what they do and they do it fairly well. Personally, I'm not convinced that keeping the number of routes down actually helps anyone. The routers that carry full routing tables are all large and expensive and if they don't have the capacity for much larger routing tables already then it's because the router manufacturers knew that the number of routes was being kept low.
IPv6 could change all this. With 128 bits of address, one could allow real multi-homing without making huge routing tables. This could be accomplished by splitting of multiple sections of the IP address as Service Provider IDs (SPID). An actuall address would the contain multiple SPIDs and an end user address. To have a full routing table, you would need routes to all the service providers and to all of your own customers. Just an idea.
THIS IS NOT A TROLL. THIS GUY IS RIGHT. SHOW ME HOW TO FIT 2 GIGS OF RAM ON A CISCO ROUTER BEFORE YOU LABEL THIS A TROLL.
THE ONLY TROLL INVOLVED IN THIS POST IS THE MODERATOR.
Anonymous Chief Network Architect for a major ISP...
I'm Tech Director for a Caribbean ISP, so I know the problems in getting bandwidth AND multihoming.
To be multihomed correctly you will generally need:
-a decent router that can do BGP.
-more than one connection to providers who will talk BGP with you.
-your own AS number and an allocated block of IP addresses
The expensive part is not really "paying the fees" of (ARIN, RIPE, APNIC), or complying with their conditions, but in fact having someone tech enough that also understands the POLITICS (yes POLITICS) involved in running BGP, and the ongoing cost of keeping your network in fact running in this type of situation.
You are just looking at the tip of the iceberg and saying "wow that's expensive JUST for a block of IP's", which on the surface might look correct, however:
-just about anyone can say "gimme a block please" (cheap).
-checking on who can actually utilise them or not is expensive.
Memory in routers is easily scalable (it isn't but lets pretend it is), but the problem is not lack of memory, but actually wading through all those blocks of IP addresses.
Most of the main tier 1 providers have serious filters in place to avoid filling their routing tables up with junk due to mistakes or due to people who just haven't made a transit deal with them, so even if you were "given" a block of addresses, it wouldn't always be that easy for you to get it routed.
My advice: as you are "small" (compared to a Tier 1 provider), my guess is that there are ISPs down there that will do a better job than you for getting redundancy. Spend a bit more money on linking up to one of these, and backup your link to them somehow, and trust THEM for your link instead of trying to do it yourself. It will probably cost you just about the same, but your uptime will probably be HIGHER, because when you do BGP yourself, you are adding in extra weak spots that you may at this moment not be thinking of (your internal routing policies and how they get propagated, the people you will need to make sure this runs, etc...).
Just my own opinion. Add salt.
Routers will not be upgraded to IPv6 until people are forced to. We want more IP addresses and the US government wants a secure (private) internet. To me the answer is for the US government to switch over to IPv6 because it is more secure. It would force the upgrades, and perhaps the US government would save some money and drop the idea of building their own private network for all their computers. This would get the process of the switchover started.
Cool...where is this device? I would love one...
No need, most of the features provided by ISP multihoming can be provided by a linux box with balance http://sourceforge.net/projects/balance/
If in fact you are telling the truth it would be impossible to tell because faulty_dreamer is so schizophrenic as it was. No, I'm not Walter Bell, I'm not a good enough KWhore. I've currently only got a Karma of 11... though an older account has around 25 last I checked.
Yeah, and you'll enjoy full IP so much. There's more to the Internet than just Web, plenty of protocols can't be NATted easily, ftp and H323 (Netmeeting) come to mind.
What you are promoting is not Internet access, it's AOL for everyone. NAT is the problem, not the solution.
Yeah, like router obsolescence is not made even faster by bandwidth requirement increase than by routing table growth.
And show me an ISP with tens of thousands of border routers. You know than you run BGP only or border routers little wanabee ? You run OSPF inside your network and don't encounter the same set of problems at all.
I really hope that everyone will have the right to get its own IPv6 block.
When I did router support for IBM's (now defunct) Network Hardware Division, I had my very own /24 just for my office, which had all of a dozen boxes in it... Even though that isn't my job anymore, there are definately no address restrictions here...
Life is so very fine,
when your corp. is class A number nine.
SirWired
mod this up, it's a good cheap solution for multi-homing.
Has everyone not done the math with IPv6 and MAC addresses. IPv6 is a 128bit address space. MAC addresses are only 48bit. Which means unless MAC specs are updated as well, that 80Bit of address space is utterly useless. Which means an extra 80Bit of overhead on every packet that goes out. Kind of lame. IPv6 should be 48Bit, that is more than sufficient. I mean, this isnt linear growth, a 48bit address is enough for more then 281,474,976,710,656 IPs according to my calcs. 281 Trillion something, i dont think we are going to run out of that any time soon. You could give every object in the world an IP address probably. This is 65536 times as many IP address as you could have with IPv4. So for IPv6 to be any more then 48Bit is completely lame and a waste of packet space.
Jeff Knox
Most filter, but when they do its pretty intelligent -ie If arin is giving out /20s in a certain CIDR block, they will allow /20s to enter into their route table. Some (Verio is the famous example) filter such that if you are in historical class A space, you can only announce a /8 or they won't accept it.
Furthermore, most large ISPs will allow you to announce competitors blocks if you get both sides to agree. Its political, but its doable.
Still even today provides have problems on the backbone with routing tables. its better but still problematic
While I agree that the providerless ip blocks make routing tables more complex, you can still multihome without them. This is the easy way...
Get yourself a domain name. Simple enough. Get yourself two internet connections, with two separate banks of IP addresses (however many you need). Now, you have two separate networks, but with linux boxen, you can alias both those networks over the same physical hardware on all your machines. Simply configure a primary outgoing gateway machine to forward half its packets to one router and half the packets to another, this will loadbalance your upstream.
For the two nameserver IP addresses you provider your registrar, give one IP on one network, and the other IP address on the other. This will ensure that half the incoming connections will come in on each of the two networks. If one of your providers goes down, all your incoming connections will default to the working network.
-Restil
Play with my webcams and lights here
Sure we haven't. Getting a cell phone here with unlimited local calling time costs about 6 work-hours (at McDonalds' cook wages, after taxes). If there's lower cell phone penetration in the US, it's not for lack of opportunity, and certainly not for lack of technology. Mobile phones aren't rocket science.
What is "rocket science", on the other hand, is (wait for it...) rocket science! Put anyone in orbit lately?
Of course, that's straying from the consumer technology you seem to care about. How about these computers you're writing on? Which of these sentences sounds ridiculous: "My computer has no Norwegian parts.", or "My computer has no American parts."
Nice troll, though. I'd feel bad about responding, but it looks like you hooked a lot of people besides me.
As nice as it is to have Provider Independant IP Space, as you've found out it's virtually impossible to get without paying through the nose (you can just BS how many hosts you have, if you want to fork over the cash to pay US$2,500/year for a /20 block from ARIN here in the USA). Then there are less clueful orginizations that don't even know they have some, because the current IT staff didn't get along with their predecesor (for instance this block I found for my own local City).
/24 block from either traditional Class C space, or the 63/8 or 64/8 Class A blocks that were returned a bit ago. No one with a clue should be filtering a /24 from either location.
However, it's not required to multihome. Really what you require to multihome is an Autonomous System Number (ASN) and a
The biggest downside to using your upstream providers IP space is that it pins you to a single ISP as you must use their IP space, and leaving them requires renumbering (but can be done without downtime within a reasonable transition timeframe of a few days). What we did was pick the largest ISP out there (UUNET), and then one of the top 10 (Sprint) and use both IP space (although we could have chosen to only use UUNET's). We use both provider's IP space on any important box (email, mainly) so that if we were to disconnect from one ISP (not likely), we only have to remove their IPs from our DNS, and the other IPS's IPs are already there and live (plus it gets around odd local routing problems outside of our control, where one remote site can reach one ISP but not the other).
We announce both blocks out both ISPs (to announce UUNET's blocks out Sprint and have them come back the shortest route, we had to get UUNET to "punch a hole" in their larger block and announce the smaller block we had so that both UUNET and Sprint would be announcing equally specific blocks for us... same is true of Sprint announcing their own assignment to us more specifically so they'll route to Sprint or UUNET, as if we only announcing the smaller block out UUNET, then all traffic would go that way unless our UUNET connection was down).
Anyway, not to write a HOW-TO (see Halibi's Internet Routing Architectures ISBN: 157870233X), but that's how to do it.
You don't need a huge router to be multihomed. Even a 2501 would work (as you just take default routes announcements from both ISPs, with the point being to advertise out your own blocks). If you want to take full routes from two ISPs, a 2650 with 128mb of RAM will work fine. If you want to take defaults + ISP-direct-customers, a 2610 with 64mb of RAM will work (it handles ISP-direct-customers from Sprint and UUNET just fine for us).
Lastly, never forget that site redundancy is just as important as internet redundancy. If a backhoe takes out the fiber or copper pairs going to your neck of the woods, more than likely it'll be both ISPs.
Normally I'd never mention my certs, but here they're relevent:
I'm a CCNP (next step past CCNA) and CCDP (next step past CCDA). I've been working for an IT Consulting/Integrater firm for 4 years (help desk positions 3 years before), and we also have our own little ISP on the side. I've worked with all the top 10 ISPs (and plenty of the Tier2/Tier3 folks), and set up a couple hundred of multihomed sites, so I'm not just quoting what I read in a book somewhere.
It IS hurting the Internet... most definately.
If we look back at the way things used to work...
Firstly, there was enough address space to go around.
Because of that, IP addresses were not a commodity. You didn't hoard them; you didn't have to, you could get them if you needed them without too much hassle.
And you did NOT have to be networked to anyone else to get IP addresses assigned to you; it was more like the assignment of MAC addresses... the whole concept was that you had unique address space, period, so if you wanted to internetwork one day, you could.
This has now gone out the window, becuase the Internet is the product unto itself... Things may be restored with IPV6, but I doubt it.. big business will carry the current policies over into the new address space, or at least, try to.
We attempted to do multi-homing in Europe... now, it IS possible to do, but it's hard to find information about how to do it. The IP assignment authority won't hand out a netblock to you.. no, you need the cooperation of your neighboring AS#'s to do it... but you can get an AS# assigned and some space allocated. THey just make it obscure.
I don't know about APNIC in particular.. but in general, it's getting harder and harder to get provider-independent IP space, and more importantly, the AS# to go with it, unless you are a big, huge provider yourself.
So.. what about some company that wants to set up a datacenter online. They NEED multi-homing, but they don't need thousands of addresses... they are basically shut out of the system. It's getting basically impossible for a small network to multi-home on the internet.
Many people are still talking about the "Scarcity" of IP addresses. A ip address is a 32bit number. Using the full range of the internet (255.255.255.255), you get 255*255*255*255 (4228250624) FOUR BILLION of course, the internet doesn't include 10.0.255.255, of 192.168.255.255, etc, but you still get about four billion. There are not 4 billion people using computers on the internet.
IMO, this is why IPv6 didn't catch on, we aren't near the technical limit. The backbone administrators just got lazy, and unorganized.
"And we have seen and do testify that the Father sent the Son to be the Savior of the World"
1 John 4:14
But another reason is that there is no incentive for changing the status quo. Letting the routers handle large tables means more work and more downtime and for what? Increased competition and less customer loyalty. It's not surprising that the people who could open it up don't have much interest in doing so. And I wouldn't expect that to change with IPv6.
It's time to stop goofing off and finalize / implement IPv6. The world is sick of having to deal with this crap.
Never mind...found it. Pretty neat, 2 WAN ports for DSL/Cable plus 8 port switch, for $399. Check it out http://www.nexland.com/product_spec/Nexland_Pro800 turbo_Data.pdf
A quick look today shows that:
c2650_1#show ip bgp summ
144.228.242.180 4 1239 290068 5592 841986 0 0 3d21h 103572
The last number indicates 103k of CIDR blocks are advertised from a major player - in this case its a peering connection to Sprint AS 1239.
There are quite a few more actually in use - many of them are aggregated at the borders of large ISPs.
This table overflowed the 64 meg mark a couple of years ago and its in danger of overflowing 128 meg before long.
I'd like to slap down the assertion that 'dram is cheap'. If you're an ISP running a Cisco 7206+NPE 150 with two DS3s, an ATM DS3 for DSL, and 24 T1 customers it is going to cost you a small fortune to upgrade that box to a 7206VXR to get away from the 128 meg limit on the NPE150.
Its been a long, long time since 'portable' IPs were issued and even if you get your hands on some and you manage to convince your top level providers to advertise the routes they're likely to get shot down all over the net by various aggressive filter policies.
IPv6 is even scarier - go read
http://www.ietf.org/rfc/rfc2772.txt
and understand what it means - if you get an IPv6 allocation you *can not* multihome even though there is BGP support for IPv6. This makes you, poor customer, the personal property of the carrier you first connect to and you'll *never* get rid of them, unless you're willing to renumber your whole network.
I am very easy to get along with, but I don't have time to waste being nice to people who are being stupid. -Theo
Actually, APNIC will assign nets for multihomed customers (soon, if not already), the issue was approved at the last meeting. The only thing is, there is no guarantee about the routability of the net. You can pony up for the ASN; you can register the net; you can pay for more than one connection, and you can announce yourself to your upstreams, however, there is no gaurantee that the whole world will listen to you.
d at e
http://www.apnic.net/news/index.html#meeting_up
Multihoming assignment address request form - text only (online version by 1 February 2002).
Be careful. You probably don't want to mess with the Egyptians unless you want Omar, Mamoud and Abad looking for ya (see below).
cjs@mauritius [552] 15:40:01 [~]-> whois -h whois.ripe.net 217.53.98.174
% This is the RIPE Whois server.
% The objects are in RPSL format.
% Please visit http://www.ripe.net/rpsl for more information.
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyr
inetnum: 217.52.0.0 - 217.55.255.255
netname: EG-NILEONLINE-20001016
descr: Nile Online
descr: Provider Local Internet Registry
country: EG
admin-c: IAM13-RIPE
tech-c: IAM13-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: M-OSAM
changed: hostmaster@ripe.net 20001016
source: RIPE
route: 217.52.0.0/14
descr: Nile Online
descr: For any abuse complain contact abuse@nile-online.com
origin: AS15475
notify: afahmy@nile-online.com
notify: abadreldin@nile-online.com
notify: omar@nile-online.com
mnt-by: O-MAHMOUD
changed: omar@nile-online.com 20001026
changed: omar@nile-online.com 20010118
source: RIPE
role: IP Address Management
address: 15 Mohamed Hafez St.,
address: Mohandessin
address: Giza
address: Egypt
phone: +202 7611153
phone: +202 7611123
fax-no: +202 3607656
e-mail: ipadmin@nile-online.com
admin-c: AF5451-RIPE
tech-c: AB5631-RIPE
tech-c: OM2093-RIPE
nic-hdl: IAM13-RIPE
notify: ipadmin@nile-online.com
notify: abadreldin@nile-online.com
notify: omar@nile-online.com
changed: omar@nile-online.com 20010808
source: RIPE
Toyota manufactures a lot of there cars in the states and canada. but it's still a not an american car.
`Multi homed' is much less specific than haviung more than one upstream provider. Its having any box which is accessible by more than one address - which might by the case if you've got 2 upstream providers, but is also the case on almost every IP based firewall, web servers with IP based virtual domains, or anything else where somebodies got multiple networking interfaces and or multiple addresses for those interfaces.
This `upstream provider' stuff is crap.
Seems like a dumb solution to the problem of redundancy. The purpose is to allow communication between two points even if one of two routes fail. The multihoming solution says that you give the endpoints each a single address, and let all the routers figure everything out on the fly. Seems a lot smarter to just have two sets of IP addresses, and negotiate which IP address to use at the connection startup (possibly through round robin DNS). Sure, you might drop a connection and have to bring it back up again, but this can easily be handled by the app layer.
Why would a corporate network need routeable IP addresses?
It would seem a small block of static IP's (some pooled some not) for machines needing to be accesible from the outside world is all that should be necessary. In fact, externally routeable IP's just let the rest of the world know what you're running, so you'd think from a security standpoint unrouteable(at least externally) IP's for most machines would work out pretty well.
Of course, IPv6 will release many of the pressures to subnet, if it ever comes about, but even with unlimited address space there are good reasons to have non-routeable subnets.
The short version: Only servers need externally routeable IP's, and those can even share at times.
Multihoming will cause BGP route advertisements to go
exponential, and it's an exponential growth that Moore's
law cannot keep up with. This is very worrisome. The
reason is because multihoming breaks heirarchical
addressing assumptions, especially the assumptions that
the last round of CIDR bandaids made. I don't know why
people keep bringing up IPv6. Its design wasn't intended
to deal with route table growth, and while some people
think it may be somewhat helpful since it will start with
CIDR from the get-go, it still expects a heirarchical
provider address space.
This is very old news though, and the source of lots of
flamage on the v6-haters list, including a lot of people
who think the IESG completely fucked up by solving
the wrong problem (address depletion vs. route explosion).
Do you have two upstreams? Will they both allow you to speak bgp4 with them? You can multihome! Congrads, anyone can do it, with a shity 2500 series cisco router, and no ip space allocated to you but that single class C UUNet loaned you. You didn't research this at all I think.
hmm.. comment hall of fame (or flame) might be a good idea. the option to include a comment should probably be up to the moderators, but it would still be pretty cool.
That's why we need IPv6 NOW!!!!! Join the crusade - Organise a one million geek march on the capitol demanding IPv6 NOW!!! :-)
I was looking at something similar with using two linux boxes as NATing firewalls and acting as DNS servers. I wonder if this would work for multi-homing with two providers.
What I was thinking on doing was having the two linux boxes setup the same way, having their primary default routes to the connected providers, and a secondary route as the internal address of the other firewall.
So that if their primary default route went down, they'd automatically switch to the other firewall and send all outgoing requests back through the internal network to the other firewall.
These two firewalls would be on completely different subnets and different providers. I wanted to set up my domain name to have the primary DNS on one firewall and the secondary DNS on the second firewall. The IP addresses for DNS lookups on the first firewall would match the IPs provided by the first Provider, and the second DNS for the IPs on the second firewall.
This is where my knowledge goes out the window. I think you can set the expire time for cashing name servers as low as 10 minutes. So the lookups should switch across for name address translation should happen automatically, after ten minutes when the primary link dies.
This doesn't help much with load balancing unfortuantely, though I suppose you could throttle back the DNS (so it doesn't respond) if the primary link is too loaded, or even have it set up to use the IP addresses from the second provider when the link gets saturated.
I don't think you need any support from the ISPs for this, and it should allow you the redundant links.
Software Engineer & Writer of Military Science Fiction and Fantasy Blog: petermwright.com Twitter: WrightPeterM
Several people have explained why the route tables are so big but they could be reduced if groups like APNIC started allocating shared space. They also allocate IP addresses for Australia and here we only have a few big ISPs. So the next time telstra wants more address space, APNIC should allocate them a block that is allocated to both them and another ISP such as Optus or Connect. This would keep the routing tables smaler and allow large ISP's to provide dual homeing to their customers but its not in their best ineterest to do so and its not going to happen unless the APNIC forces them to.
I have a cable and a DSL connection, and I'm currently using just the manner of setup you're talking about. All of my machines have an internal IP address, as do the LAN interfaces of my two gateway NAT devices. Traffic is load balanced across the two gateways, weighted by destination network and protocol. (No sense using my DSL to get news from an outsourced provider when I have one two hops away on my cable that provides much higher throughput).
I have to admit that it's mostly a cheap hack, but honestly I'm pretty happy with it, and the biggest cost was the time it took to educate my sorry ass to the point I could get it to do what I wanted.
The best solution I found is a product called "Linkproof" from Radware (no, I don't work for them).
Yes, it cost a bit, but it will let you have multiple links, balanced across multiple firewalls if you like. Best part is that it can load balance outbound AND inbound traffic evenly across links. All of this without BGP, your own IP address space, etc.
-- Opinions expressed are either that of my own, or someone else's.
the internet is based on freedom and equality.
why dont you just go burn jews in an oven?
the whole point of a peer to peer network is that everyone
is a peer. people like you are going to destroy
the internet and cast us back into the 80s with 50 different
proprietary networks, all 'teired' by 'cluefullness' as though
we hadnt learned anything from the past 20,000 years of history
FREEDOM
EQUALITY
DUH
Yeah, but he liked the US so much he died here.
Are personal IP blocks going to be doled out for individuals with IPv6? Or will they be available from a government organization? This could be a new land rush.
I prefer a void in conversation to a vacuous one.
Sorry, but you have no clue what you are talking about. No this isn't meant as a flame.
;) Try something in the range of 32-64 MB max for most machines.
You do not need PI space to be multihomed, you need your own AS. The RRs don't hand out PI space anymore because believe it or not, the IP space we have is getting more and more crowded and IPv6 isn't going to be in the mainstream for the next half dozen years.
And yes, routing tables ARE a problem and no cisco has 1-2 GB of ram. Maybe there are but no-one could afford them.
I suggest you buy a couple books on the issue and read the documents provided by your local registry. Attend one of their meetings: They cost a bunch (at least here in europe) but it's a GREAT way to meet people and ask questions. Plus, believe it or not: The registries may be a bit bureaucratic but the people working at RIPE for example are all totally cool folks.
Oh grow up you troll. Since when are server people (especially in the Unix world) not routing people?
Childish little anonymous troll.
Frank T. Lofaro Jr. writes:
We must forgive at some point, else we run the risk of becoming exactly like our Enemy.
I'm proud of my Northern Tibetian Heritage
Given enough RAM, finding a string in a set of strings is a function of the length of the string (or better), and not of the number of strings in the set. For IP addresses, it can be done in constant time.
For how to do it, see any algorithms 101 book.
-- Juanco
As far as I've seen "since the begining of time". Server people work with servers not routers. A Solaris box running routed does not make one a router person.
I can point out a half dozen "server people" at work who are next to useless in the arena of routing. (They are even less useful at switching.) However, they are more than proficient at their "server people" jobs.
You've used an obscure and uncommon definition of multihomed. You've excused yourself by trying to make another arbitrary distinction between the servers which route, and routers (which, er...serve routes).
:D
Good luck to you with that