David Clark: Rebuild the Internet

boarder8925 writes "David Clark, who led the development of the internet in the 1970s, is working with the National Science Foundation on a plan for a whole new infrastructure to replace today's global network. The NSF aims to put out a request for proposals in the fall for plans and designs that could lead to what Clark called a 'clean slate' internet architecture. Those designs, Clark said, could be tested on the National LambdaRail, the nationwide optical network that researchers are using to experiment with new networking technologies and applications."

Comments

Wont happend

[Bruj0]

"A whole new infraestructure" you say?.
We cant even start using the new ipv6 protocol. I dont think we are there yet. Try in 10 or so years.

Re:Wont happend

[RLiegh]

I think it's more like "ok, no one's buying our ipv6 idea; let's see what else we can come up with".

Re:Wont happend

[drmerope]

Might be because we realized that the IPV6 protocol was unnecessary.

Once people were forced to NAT, it suddently dawned on the great mass of people that workstations shouldn't be getting public IPs for security and management reasons.

Nor for that matter should these up and coming embedded devices be placed on the public internet either. It just isn't appropriate.

Remember: The Internet was supposed to be a network of networks NOT _THE NETWORK_.

Most of the remaining IP allocation problems result from certain lingering gross misallocations such as the Class A block assigned to MIT.

Re:Wont happend

[Alien Being]

"Remember: The Internet was supposed to be a network of networks NOT _THE NETWORK_."

You're misusing terms here. "Network of networks" means "routable ip networks". From an IP point of view, boxes behind a NAT are irrelevant. Nobody ever claimed that every machine should be connected to the Internet, but hosts on the Internet *were* intended to be routable.

The management and security benefits you alluded to are separate issues and can be achieved with less drastic measures than NAT.

Re:Wont happend

[drmerope]

I suggest you re-examine the history of electronic mail and then re-evaluate your understanding of what it means to be a network of networks...

It does not in fact merely mean routable ip networks. The internet was meant to bridge many networks that did not use IP by means of a gateway hosts that did speak IP.

I agree that no one specifically was thinking of NAT as we know it when network of networks was coined, but it is a simple extension of the principle.

Re:Wont happend

[Anonymous Coward]

NAT is the greatest evil to befall the Internet.
Want to run a webserver behind NAT? Forward the port through NAT. Want to run *two* webservers behind NAT? Say goodbye to half of your visitors behind stupid proxies that only relay requests to port 80.

NAT is bad because it is a complex layer of translation software, NOT a firewall. Its job is to try to fit packets through places where they shouldn't be going, not the other way around. A stateful firewall is a much better solution. Even Windows XP SP2 gets it right in that regard.

Unless you *like* translation gateways everywhere, the idea of a network of networks is a silly idea. MITM attacks and the general waste of resources are the two biggest problems with that concept.

Embedded devices like, say, a PDA shouldn't be on the Internet to receive phone calls or send email? What do you have against the Internet that a stateful firewall and a well written network stack wouldn't fix?

Re:Wont happend

[J. Random Luser]

... certain lingering gross misallocations ...


6.0.0.0/8 DoD Network Information Center
7.0.0.0/8 Defense Information Systems Agency
8.0.0.0/8 Level 3 Communications, Inc
9.0.0.0/8 IBM Corporation
11.0.0.0/8 DoD Intel Information Systems
12.0.0.0/8 AT&T WorldNet Services
13.0.0.0/8 Xerox Palo Alto Research Center
15, 16.0.0.0/8 Hewlett-Packard Company
17.0.0.0/8 Apple Computer, Inc.
18.0.0.0/8 Massachusetts Institute of Technology
19.0.0.0/8 Ford Motor Company
20.0.0.0/8 Computer Sciences Corporation
21, 22.0.0.0/8 DoD Network Information Center
25.0.0.0/8 Royal Signals and Radar Establishment
26, 28, 29, 30.0.0.0/8 DoD Network Information Center
32.0.0.0/8 AT&T Global Network Services
33.0.0.0/8 DoD Network Information Center
34.0.0.0/8 Halliburton Company
35.0.0.0/8 Merit Network Inc.
38.0.0.0/8 Performance Systems International Inc.
40.0.0.0/8 Eli Lilly and Company
41.0.0.0/8 African Network Information Center
44.0.0.0/8 Amateur Radio Digital Communications
45.0.0.0/8 Interop Show Network
47.0.0.0/8 Bell-Northern Research
48.0.0.0/8 Prudential Securities Inc.
51.0.0.0/8 Department of Social Security of UK
52.0.0.0/8 E.I. du Pont de Nemours and Co., Inc.
53.0.0.0/8 cap debis ccs (c/o Mercedes Benz AG
54.0.0.0/8 Merck and Co., Inc.
55.0.0.0/8 DoD Network Information Center
56.0.0.0/8 U.S. Postal Service
57.0.0.0/8 SITA-Societe Internationale de Telecommunications Aeronautiques
1,2,3,4,5,14, 23, 27, 31, 36, 37, 39, 42, 46, 49, 50 are reserved to IANA

It would be tempting to say: Nothing to see here people... please move along..., but amongst all the squatters is one new allocation, a single class A net allocated this year for the entire African continent. It works too, I've already had two 419s from it ;-)

Re:Wont happend

[Anonymous Coward]

NAT is a horrible solution. When I see someone actively _advocating_ more NAT I know that either they're selling a NAT product ("Cutting your face off is a great idea, and with new faceCutOff DX we guarantee only a few weeks of agony!") or they haven't looked very hard at the problem.

The Internet is a Peer-to-Peer network. Yesterday's big application, the "web app" didn't need this feature, but tomorrows potential big applications almost all do. If you disable them by using NAT, you're back where businesses were in 1996 when they started to realise that they should be on the web but had no clue how. Oops.

Seen all those annoying worms that choose random IPv4 Internet addresses and attack them? If a hundred of those worms hit one address per second they'll hit most machines in a year. With a thousand infected machines they'll take a month, But with IPv6 they don't stand a chance. A million worms, trying 10 IPv6 addresses per second, won't find more than a tiny fraction of vulnerable machines in a year. Even inside your much smaller corporate network "guessing" IPv6 addresses isn't feasible.

Elsewhere in this thread someone has observed that ordinary customers don't switch at the point of least pain. They wait, and wait, until they can't tolerate any more pain and then switch. Then they say "Oh, that was better than I expected" and maybe write an article for their trade magazine, "Why switching was actually a pretty good idea".

The point of least pain came when more than one network hardware vendor had IPv6 native. That was several years ago. Anyone buying new kit after that point should have been negotiating for IPv6 and either getting it, or getting a discount to "do without" it for a few more years. Otherwise you're a sucker.

Re:Wont happend

[ajs318]

The solution is to get equally aggressive, demanding that any patents they obtain be struck down; either as "obvious to an expert in the field" {because hey, you thought of the same idea when you read the description}, "not novel" {because there is some prior art} or "not capable of industrial application" {because they're just some petty minded thing that doesn't deserve to be patented}.

If you have money, flout disputed patents right, left and centre. Your legal defence, should you require one, is that you believe the "patent" is without merit. Settle any bullying demands for royalties with a rubber cheque. Claim expenses for everything you possibly can. Maybe try to patent the exact same thing in your own name and, if you succeed, formally dedicate the "duplicate" patent to the Public Domain.

I really think that copyright and patent law needs to be updated. Unless you licence your invention BSD-style -- allowing anyone to use it, requiring only attribution -- or dedicate it formally to the Public Domain, then you should have to pay a tax on it. After all, if you own land, you have to pay rates -- and in certain circumstances, e.g. if it is needed for construction of a new road, the government can take it off you by force. Rates pay for local services. Copyright and patent taxes could be used to pay for enforcement {which would be considerably less expensive under an open licence}. If they want to call it "intellectual property" and treat it like property, then they should not object to it being subject to Compulsory Purchase Order, nor to paying property taxes on it!

I predict some opposition from GPL supporters, but it must be remembered that the GPL is a stopgap measure that would not be needed if it were not for abuse of copyright. However, I do not think that the addition of a clause explicitly requiring distribution of source code would be particularly onerous. Rather, it would be a simple reaffirmation of the Common Law Property Right wherein we are privy to any secret embodied in any article we rightfully own.

Re:Wont happend

[James Youngman]

Might be because we realized that the IPV6 protocol was unnecessary. Once people were forced to NAT, it suddently dawned on the great mass of people that workstations shouldn't be getting public IPs for security and management reasons.

You're confusing addressability with reachability. It's right that workstations should not in general be directly reachable from random other points on the internet, but that doesn't mean that this should be done only via NAT. Normal firewalling is the right way to limit reachability.

NAT imposes a number of design constraints and generally makes a lot of complex things even more difficult than they need to be.

For example, I once had to diagnose problems with an FTP transfer between two machines. This would have been easy if it were not for the fact that there were three layers of NAT (two of which translated both source and destination addresses) between the two. These NAT layers were translating the source address of the original DNS query twice, the destination address of the DNS query (three times), the source address of the DNS response packet (three times), the destination address of the DNS response packet (twice), the contents of the DNS response itself (twice), the source (twice) and destination (thrice) addresses of the resulting TCP connection for the FTP control channel, modifying the PORT commands passing over the control channel (twice, I think), and the source (three times) and destination (twice) addresses of the FTP data connection.

Suffice to say that when the FTP transfers weren't working, diagnosing where the problem lay was rather complex, especially as more than one organisation was involved (two of the NAT layers were in one organisation, and the third was in another).

You can't implement NAT fully without performing data changes at the application-level protocol layer (for example FTP PORT commands), and that's evil (in the hackish sense of the word).

Re:Wont happend

[Sique]

And yes, cell phones and PDAs should *NOT* be exposed to the internet.

And yes, cell phones and PDAs *will be* exposed to the Internet. This is what conversion is about. Especially cell phones need to be reached independently of each other. Currently you do it with the phone number, and the difference to an IP address is the limitation of services that work with phone numbers as targets.

Mobile Phone (GSM) providers allow sending of SMS and MMS via SMTP to the target phones. This is (from a protocol stack point of view) an extension of the address space within a high level protocol: The phone number is just the user name in the email. There is no reason why this couldn't or shouldn't be done on the IP level itself. Malicously malformed MMS and SMS can corrupt a buggy phone operating system independently of the address space used to get them there. Look at the phreaks and their ways to hack into telephone equiment.

Any addressable system with an incorretly implemented service is attackable from remote. That is completely independent from the method of addressing. And phones have to be addressable to make sense to most people. (The limitation to 'most people' is necessary to block the uebercorrect who might be pointing out that there are people who never get a phone call anyway...)

Re:Wont happend

[amper]

How in the hell did this get modded up to "5, Insightful"? The parent poster clearly has "-5, No Fucking Clue About Network Design".

What the AC is describing is not, in fact, Network Address Translation, but Port Address Translation, which is only a subset of NAT. I have absolutely no problems running multiple hosts behind NAT using the one-to-one address translation, which generally reduces the need for publicly-valid IP addresses to the number of hosts that need to be publicly-available, plus one for a PAT channel for internal hosts to get outside. That number can be even further reduced by using PAT in combination.

There is no reason for every host attached to the Internet to have a publicly-valid IP address, thanks to the magic of NAT, which is an extremely valuable security tool in the hands of a competent network designer. I have personally (and practically single-handedly) built Metropolitan Area Networks servicing thousands of users that did not need to use more than a handful of public addresses, with no loss of service to the end users, or the public, for that matter.

The big problem with NAT is that practically every manufacturer of routing or firewall gear uses different terminology and different implementation methodology, such that knowledge gained on one platform is frequently not transferable to others. Compounding this is the tendency for manufacturers of affordable routers to leave out vast swaths of NAT/PAT functionality in order to get you to buy more expensive routers, not to mention the tendency for ISPs to assume cluelessness on the part of the end user. There's also no good reason why routers and firewall devices that support NAT properly continue to cost such large amounts of money, other than manufacturer greed.

Yes, I know that this can be done with a host machine, but I prefer dedicated hardware devices with a minimum of moving parts for my network gear.

To paraphrase, what do have against NAT that a well-written, full implementation wouldn't fix?

And BTW, NAT is not a replacement for a proper stateful firewall, but all on it's own can provide a large amount of security for an organization. If nothing else, it can remove a large amount of the load from said firewall.

Re:Wont happend

[abb3w]

44.0.0.0/8 Amateur Radio Digital Communications

Of all of the ones you point out, this is the only one I would argue that the allocation might be deserved. Ham Radio is bloody useful under emergency conditions, and it's operators should be encouraged even outside emergencies.

Re:Wont happend

[Paul Carver]

Ok, the posts by other folks above clearly explain it, but I'll take a swing at it since people are still missing it.

NAT meant translating an IP address to another IP address.

PAT means translating a TCP (or I suppose UDP) port to another TCP (or UDP) port.

You can do one, the other, or both, depending on the capabilities of the software doing the translating. Obviously the cababilities of a sub $100 home router may not be the same as a custom configured Linux/BSD/Windows firewall/routing stack or a dedicated $10000+ firewall or load balancer.

If you want two web servers behind a NAT device to both run on port 80 then you need two public IPs ... duh! That's hardly a showstopper. Some consumer/home ISPs won't provide multiple IPs, but some will and absolutely all business class ISPs will provide multiple IPs. You may have to pay extra for the extra IPs.

Any halfway decent firewall or router will have absolutely no difficulty translating 2 or 20 or 200 registered IP addresses into 2, 20, or 200 unregistered addresses of servers on your privately addressed network.

Need more power? Load balancers (available as both software and dedicated hardware) will take incoming requests to a single virtual IP and dole them out to hundreds of machines with private IPs and they use NAT to do it.

I can even distribute requests to servers based on any portion of the URL if I want to. Not just hostname, but any pattern anywhere within the full URL can be used to distribute requests to different servers.

I can put a dozen different machines on a dozen different IP addresses while simultaneously having half of them plus a separate bunch of fifty other machines all appear as a single high capacity server on a single other IP address. On top of that I can allow all of them to run their web server on a high numbered port so that the httpd doesn't need to run as root (great security enhancement) while appearing to the public Internet that all my servers are running on port 80 or any other port I choose. Nobody will ever know or care that all those machines have 10.0.0.0/8 addresses unless some developer is stupid enough to embed the machine's IP address in dynamically generated content. Any developer who does that needs to rethink the design because there's never any real need to do that; there's always a better alternative.

There is nothing wrong with NAT or PAT. You're just upset about the limitations of consumer grade hardware and consumer ISP service levels.

Re:Wont happend

[seffala]

I think you're missing his point...All these guys are squatters from waaay back, except this one new allocation. The whole continent of Africa has to make do with half as many addresses as HP, or a quarter as many as the DoD NIC.

And the important question is

[ShatteredDream]

What will the powers that be put in there to make it easy to track and control everything we do with it?

Re:And the important question is

[surprise_audit]

Remember that famous quote about the Internet treating a nuclear strike as routing errors and simply routing around it?? The same applies here - if US control of the root DNS becomes a problem to the rest of the world, expect the rest of the world to set up their own root servers and then the US-controlled Internet becomes an Intranet that may or may not have visibility to the rest of the world.

Re:And the important question is

[Deathprong]

They both did.

The real question is...

[AKAImBatman]

...is this project going to actually provide revolutionary designs to ease or eliminate the problems we face today, or is this just a matter of reinventing the wheel?

I realize that it's quite tempting for computer developers to want to clean up a system after it's done, but such work only ever works if you have a clear understanding of the problems faced under the current codebase as well as an absolute need to fix the issues with the current system. Simply saying, "it'll be better/cooler/faster" just doesn't cut it. Those things can be obtained from evolutionary development. Revolutionary means that you are uprooting all the existing users. The payoff MUST be tremendous or they ignore it!

Re:The real question is...

[AKAImBatman]

I think the time is now... look at all this dynamic javascript applications...just a band-aid on a bad system.

Actually, that's not true. Putting aside your confusion of the Web vs. The Internet, JavaScript Applications fullfill a design that was started nearly 20 years ago by James Gosling. The design I'm referring to is NeWS. The concept behind NeWS was that a Postscript renderer would be modified to allow for true Object Oriented Programming, and client/server communication. This half-document/half-program Postscript would then be downloaded to a client (potentially over EMail no less!) where it would execute and obtain remote data from its server.

Having the application at this level meant that only absolutely necessary data was transferred over the network. The application was loaded once, then only updates and file accesses would occur remotely. This design was far more powerful than X-Windows because it transferred far less data, could run over any network, and could render complex primitives from standard vector drawing programs. No other windowing system up until NeXT could do that!

It's amazing how the more things change, the more they stay the same. :-)

Re:The real question is...

[AKAImBatman]

see that is laughable - you can't draw a curve and you are calling this the graphics drawing level

More correctly, this is a document drawing level. No one ever expected HTML/CSS to go beyond simply displaying textual data to users. As a result, it still needs some beefing up. But for regular use, the lack of things like curved objects is not a show-stopper. The fact that the document elements are solid objects is actually kind of nice, because you're *not* redrawing the screen every time. You just shift your elements around and the web browser figures the rest out.

Also, as I said before, SVG provides a nice solution to the lack of curved objects and rotation. The advantages to SVG are:

1. The image can be built in memory, then displayed.

2. Modifications can be made by walking the XML DOM Tree.

3. SVG is a good intermediary or long term format for storing drawing data.

Point #3 is rather important. Consider the case of a DHTML SpreadSheet application. If you wanted to create a Pie Chart, you can either have the server generate you an image (slow) or create an SVG on the fly (fast). Since you created the image as an SVG, you can then shunt the raw XML data back to the server for optional translation and long term storage. The server could even take the spreadsheet data and generate you an Excel file to email your coworkers.

It's quite an amazing paradigm shift.

P.S. There is some existing work demonstrating the use of dynamically generated images. The game at the link I've provided creates a new XBM image for every frame. (Info) While I don't recommend using HTML for Wolf3D, this method works perfectly for business applications.

Summary

[mikeophile]

Clark said he would like to see two things addressed in any replacement for the current internet. The first is a coherent security architecture. The second is a healthy economic infrastructure for network service providers, who will need a bigger piece of the pie in the new internet than the one they are getting now if they are going to help pay for building it.

I read this as users having no anonymity and paying through the nose for it.

Can I just keep the old internet?

Re:Summary

[femto]

Or to put it another way: the corporatised Internet.

No independence, as you're then a tame pawn for a corrupt Haliburton lookalike.

Wasn't IPv6 supposed to replace the current?

[pg110404]

The internet might have its problems, but it's here now and everybody is on it. Unless they add a backward compatibility layer (doubtful if they are designing a 'clean slate' architecture), it becomes a chicken and the egg phenomenon, no matter how much better the technology might be. Nobody will want to use this architecture until enough people adopt it, and enough people will need to adopt it before joe average uses it. All the while the existing internet is there.

Let's rebuild it with

[Man in Spandex]

PHP and MySQL which can do anything!

Re:Let's rebuild it with

[glwtta]

*shudder* Don't even joke about that!

Obligatory.

[ImaLamer]

Obligatory

Reminds me of old habits

[fmwap]

"Fuck it! I'll rewrite it from scratch."

That approach is always more fun

Re:Reminds me of old habits

[scotty777]

from the original article:

"Anything you can do all at once, you could do with incremental changes," said Robert Kahn, who helped design the architecture for Arpanet, the precursor to the internet.

Kahn agrees with you, you both are against a clean sheet redesign, right?.

The thing is, although incremental improvements are easier to stomach, the question is always this: just where do we want to be? A clean sheet redesign gives us a target for successive inremental improvements, and allows a very direct cost/benefit analysis.

The question I have for you: What's the harm? Are you against digital video simply because it was a clean break from analog video?

Not gonna happen

[btgreat]

"A super-high-speed internet could even allow people a world apart to collaborate inside elaborate 3-D virtual arenas, a process called tele-immersion."

I believe the technical term for this is MMORPG. It appears to work pretty well with our current internet.

All joking aside, I don't think anything will change any time in the near future. IPv6 is probably the most radical change the internet will see for possibly decades to come, and that can't even catch on. People are simply not going to pay to have the internet re-architected when it is working well enough as it is; why reinvent the wheel while its still rolling. Things along these lines have been proposed before, and I'm sure will be proposed again, and I'm sure that one day, the internet will eventually be rewired. However, this is still far ahead of its time.

Cars still ride on wheels, power still goes out with storms, and cell phones still lose service underground. What makes anyone think the internet is going to be any different.

Not a bad idea...

[evilviper]

I'll agree with him that Internet2 hasn't lived-up to what it should have been, and trying something completely different would be a very good idea.

However, I don't agree that the current internet is in-need of replacement. Creating TCP/IP packets requires significant processing power, and a simpler protocol would mean more devices being online, but by the time anything new becomes accepted, a $1 chip will be able to do it all.

If you want to improve the internet, put explicit congestion notification back into all TCP stacks, as it was before the BSD stack left it out... Goodbye massive packet loss due to minor congestion. Require all vendors to support jumbo frames... And many more small changes (to the existing internet).

Re:Not a bad idea...

[jd]

ECN would be an excellent idea, probably a derivative of RED/GREEN/BLUE/BLACK (yes, all of those really do exist) as well, and edge-level ISPs should really use some additional QoS to prevent any given user (as opposed to any given stream) overloading the network. It would also allow throttling of ISP connections, when an ISP in general is too noisy.

As one of the other replies noted, DEFINITELY DEFINITELY have multicast. Anycasting (multicast from user, unicast from server) would be good, too, for informational content such as DNS requests. PIM-2 (sparse, dense or bi-directional) is at the point where if it isn't in use, it damn well should be. There is sufficient Internet Radio, webcasting and other pseudo-broadcasting over Point-to-Point protocols to justify multicasting on the bandwidth it would save.

I wrote a number of scathing articles on Internet 2 for the Guardian newspaper and I think it was the Sunday Telegraph - I forget the exact details, it was about 8-9 years ago now. I didn't believe it would be useful, I thought the naming was largely an illusion (the Internet is a federation of networks, so adding another network to that federation isn't really building anything new, no matter how fancy the gateway), most of the benefits were provided by IPv6 anyway and not the network - and those could have been had by putting IPv6 on the existing Internet instead, and most of the security was from IPSec and the same logic applies.

As for processing power, yes, TCP/IP is a hog on the processor. Not enough, on its own, to make offloading onto an I/O processor worthwhile as that is often done over a common bus not a local bus, so the extra bus traffic ewats most of the gains.

However, a local bus would be doable, or - because networking is now the norm rather than the exception - it would be possible to build network layers 1, 2 and 3 either into the CPU or into a co-processor. If you did that, you'd better have either a VERY comprehensive stack, or some damn good support for uploadable microcode, but I don't see any technical objections to it - provided you don't run through the main bus more than present and preferably less.

More likely to be useful would be hardware packet filters in the network device. Something like the packet filter from OpenBSD, in hardware, on the transciever itself, would likely speed things up a lot.

Encryption is another biggie on the CPU, and encryption hardware certainly exists. Having network devices do IPSec and SSL/TLS in hardware would likely make a big difference for secure sites and secure connections. If it became cheap enough (which would happen if used enough, as higher quantity makes for lower costs per unit) it would likely improve network security overall, as people would feel they could use it without impacting performance.

Like Admiral Ackbar says...

[Dinosaur Jr.]

"It's a trap!"

IPv6

[scoove]

We cant even start using the new ipv6 protocol. I dont think we are there yet.

I've been to IPv6 summits. I've also served as the senior technology officer for several telecom companies (one of which was a very first CIX-W router connected ISP and frustration to Paul Vixie in our rather unique connection to the early Santa Clara peer point).

Through my experience, I've advocated IPv6, yet I've found significant resistance from nearly all sectors of business (except from South Korean and South American investors - go figure). Some of the problems IPv6 plans (and this "new infrastructure" pipe dream) face include:

• zero customer demand: dot-com was great for us geeks pushing ideas before their time. Fortunately or not, its demise meant a return to financial foundations. If customers don't demand it, there's no reason to work on it today. If it's the next great thing, then get customers understanding it! (Thought: How do we do this for IPv6? I can think of a thousand technical explanations for why this is. My customers would tell me they expect me to do these things already at no additional cost to them. Absent additional capital, it ain't happening in today's telecom market). Lacking a killer ap that only works in IPv6 land, the finance people won't back any infrastructure upgrade. Here's the rule: either make money or save money. IPv6... well, it adds features without really making or saving money. Guess what the CFO will decide? New features don't quite present well in any capital budget analysis (and rightfully so).
  
  
• State of the consumer market: Let's be honest for a second. While we dream of IPv6 efficiencies, the world out there is clinging onto Windows 98, first edition. They're stuck in the IP dark ages (hell, I had a discussion today with a Fortune 500 senior manager who thought dialup optimization was the same thing as broadband. *sigh* It's the Dilbert PHB "etch and sketch" laptop all over again!). These are people that can't understand their kids P2P and the five trojans pushing out spam are why their broadband is slow. These are the people that refuse to use antivirus, personal firewalls and spyware detection. Do you expect them to understand the nuances of better IP networks? QoS? Mobile IP? Dream on...
  
  
• We've forgotten our dirty bastard heritage: Don't forget, TCP/IP was the the dark horse protocol. OSI was the committees pick, yet nasty old ad hoc IP ended up winning out. NSFNET and the Baby Bell NAP plan connected by ANS was Al Gore's dream for a monopoly-powered Internet, which also flopped. A brutish commercial ISP network launched by the early CIX won out. Rarely does the committee solution prevail. Technology is one of the few areas where natural selection tends to ignore the best intentions of the wealthy and powerful elites.
  

Don't think I'm not wild about IPv6. I geek out and run it over AX.25 amateur networks for fun (what better way to learn a protocol). Yet the days of getting capital markets worked up in a frenzy, ready to throw hundreds of millions at network replacement are gone. Unless this latest dream is based on new tax revenues from all of us (which only creates messes like the original unaccountable NSFNET regionals), it won't go anywhere.

*scoove*

Hashes of public keys as ip addresses?

[pizzarobot]

I don't remember who's idea it was, but if we have all future internet devices use encryption (like IPSec and IPv6), then if we have a portion of the ip address be a crypto hash of the devices public key, then it would make spoofing harder. Of course part of the ip address would still have to be reserved for routing purposes for efficiency.

The age old wisdom..

[BigZaphod]

Don't fix what ain't broken.

Sure, there's almost always better ways to do things that are only illuminated by hindsight, but that doesn't mean that the old way should just be tossed out and replaced.

Besides, the Internet is one of those amazing flukes of history. It's a very open, public, and free world unlike anything before it. Does anyone really think that something designed now in the age of terrorism, by committee, using government money (NSF) would be carefully designed to protect those initial design elements that make the Internet what it is today?

Re:The age old wisdom..

[Midnight Thunder]

At the moment these guys aren't trying to fix anything. What they are trying to do is see if something alternative could work better. See this like a prototype of a car: in order to be able to test new technologies properly you need to build it as if there were no restrictions. While this new technology might not replace anything, aspects of it might be incorporated if it proves there is a better way of getting things done.

I was going to carp and complain ...

[DrJimbo]

... but while composing that post, it occurred to me that this is actually a very good idea and should be explored.

The premise of the existing Internet was benign cooperation. The previous /. story on the 12 minute Windows heist clearly demonstrates that that model is no longer valid.

I think it is a good time to take a look at all of the layers and see if something better is possible. I am not suggesting that Clark et. al. be given Carte Blanche to build a new Internet. The naysayers may well be right that any significant change would be practically impossible. But I do think it is a very good idea to investigate what changes are possible and what benefits those changes could provide. I'd hope that practical concerns of getting from here to there would also be explored.

I don't know what this new Internet will look like

[MichaelCrawford]

But I am as confident as I am that the Sun will rise tomorrow that it will be safe from terrorists. After all, we have the children to think about.

If one is able to find any privacy or anonymity in this new Internet, it will be because of some undiscovered security hole, which will be quickly repaired, rather than any kind of conscious design decision. Probably one reason they are accepting proposals before rolling it out is to avoid the sort of accidental security holes that enable pr0n, peer-to-peer filesharing and left-wing political activism.

Microsoft, a leading contributor both to this nation's technology base and to the campaign coffers of its leaders, will embrace this new technology and extend it in such a way that the development and dissemination of Open Source software will be, if not mathematically and physically impossible, at least as difficult as factoring a 2048-bit public key.

Imagine, if you will, Trusted Computing implemented at the router level, in such a way that any packets that go farther than one hop are certified not only to support protocols whose patent licenses are fully paid-up and on file with the legal department in Redmond, but whose content is compliant with the Windows standard. The faintest whisp of a Public License, GNU or otherwise, will result in the dropping not only of the individual packet, not only in the cancellation of the entire file transmission, but, within microseconds, the physical location of the offending server. The identities of its rogue administrators will be fetched instantly from the database maintained by the Homeland Security Department. (You will have to submit fingerprints and DNA samples to obtain a Windows server license, as after all, Internet servers can be used to disseminate explosives recipes or the formulas for nerve gases.) The supercomputers that constantly monitor the cameras mounted on every lampost in the United States of (God Bless It!) America will be ordered to recognize the criminals' faces, and when they are spotted trying to flee to the Amazon jungle, orbiting lasers will vaporize their bodies, leaving nary but a whisp of smoke.

When a close family friend tries to comfort one of the grieving mothers for the loss of her son, she will desperately proclaim "No, I have no children! You must have mistaken me for someone else. Please leave me alone!" before she scurries rapidly away.

National firewalls such as those employed by The People's Republic of China are expensive and difficult to maintain. They are notoriously leaky, and easy to circumvent by anyone determined enough to find out how. But worse, they impede the economic potential of emerging economies such as China, which necessarily bottleneck technical data and eCommerce in order to have a single chokepoint for the Four Horsemen of the Infocalypse (Taiwan, Tibet, Hong Kong and Pornography).

Imagine, if you will, the potential of our New Internet: not only by technical design, but by international treaty (enforced by the threat of military intervention on the part of the UN Security Council), each nation will have a national firewall which is as transparent to the air to fully-licensed Windows Media Video files of Barney the Dinosaur and paid-up Wal-Mart orders, yet absolutely impenetrable to content not sanctioned by Homeland Security, the Republican Party, the 700 Club and the Boy Scouts.

I, for one, am weary of our present Internet, cesspool that it is of moral depravity and copyright infringement. I long for the days of yore, when men were men, women wore hoopskirts, and racial minorities were separate but equal. And so, I raise my right hand and shout with an enthusiastic "Heil!":

I welcome my new Internet overlords!

Copyright © 2005 Michael David Crawford.

This work is licensed under the Creative Commons Attribution-NoDerivs License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nd/2.5/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA.

Who? Me?

[dcclark]

Holy crap, I go offline for 12 hours and you guys are giving me this kind of jobs?? I quit! Nothing like signing on to /. and seeing your name in the top headline. -- David Clark

Uhh... Mister...?

[grcumb]

When you're done with the old Internet, can we have it?

Hugs,

The Developing World.

NAT isn't a permanent solution

[jfengel]

NAT doesn't seem to completely solve the addressing problem. According to this report by Cisco to Congress (warning: pdf), we're going to run out of addresses for real somewhere between 2015 and 2025.

Yeah, I know they're a vendor, but this is a really reasonable report. They counter a lot of the hype, but they say we're going to need IPv6 eventually, so let's start now, before the Japanese and Koreans have built all the infrastructure and Americans are left to buy from them.

Re:NAT isn't a permanent solution

[drmerope]

Agreed. NAT isn't a permanent solution. I disagree that sooner is better though. As with anything, the most cost effective transition will begin on its own when the time is right.

I don't know what you mean by buying infrastrcture. We're not losing out on any technology or experience really. If any important services become IPv6 only... well then we'd have a little catch-up--but that is precisely what will deliver the consumer demand.

CISCO is right in their problem prediction but they want to accelerate the timing so as to make money now, not later. Money now == more valuable.

Re:NAT isn't a permanent solution

[GeekBoy]

>As with anything, the most cost effective transition will begin on its own when the time is right.

I disagree. I work for Canada's largest IT consulting company and in my experience the transition will begin when people become forced to transition, cost effective or not.

Re:NAT isn't a permanent solution

[jfengel]

The concern is that if the Koreans and Japanese have converted their infrastructure to IPv6, then they'll be buying their routers from Korean and Japanese countries. When it becomes a crisis in the US, we'll end up buying our infrastructure from them, because it will have been built, installed, and tested.

Right now the US has dominance in these markets. If we let the Koreans and Japanese get their first, we'll be letting competitors get there first.

At least, those are the concerns I've heard. I'm not sure I buy it; shouldn't Cisco et al be selling IPv6 routers to the Koreans right now? I'm hearing it from trade experts, not technology experts, so I'm still trying to figure out my opinion.

Yeah, thanks a lot NAT

[ashpool7]

Thanks for making "secure by default" less important.

Thanks for retarding IPv6 development.

Thanks for necessitating the invention of UPnP.

Thanks for screwing up peer to peer connections for legitimate things like videoconferencing and file transfers.

Thanks for continuing to allow ISPs to treat IP addresses like some sort of rare element.

Thanks for mangling things like FTP.

Re:Yeah, thanks a lot NAT

[Anonymous Coward]

Oh..you said it.

Couple of more thanks from me too...

Thanks for making business to business integration so difficult.
Thanks for making any server installation so difficult, if designing to give access to authentic users

Re:Yeah, thanks a lot NAT

[drsmithy]

Thanks for mangling things like FTP.

FTP is a fucked up protocol to start with. If NAT causes its demise, I know I personally will be nothing but smiles.

Re:Yeah, thanks a lot NAT

[snorklewacker]

FTP actually predates TCP/IP, back when connections were made on IMPs that didn't do things like multiplex streams. FTP as it is now is a port of the older protocol, when third-party FTP was more common. Mail was originally implemented with FTP.

Re:Yeah, thanks a lot NAT

[binarybum]

FTP is a fucked up protocol to start with. If NAT causes its demise, I know I personally will be nothing but smiles.

fascinating.

Does that scare you? Since FTP is nearly dead as it is, are you partially smiles now? Does it work like that, or do you turn into smiles all at once? Does it hurt/tickle?

Ok. some proposals for you.

[jd]

Either use IPv6 or one of the predecessor protocols. (One early suggestion for "IP-ng" was a protocol with adjustable-length addressing. Thus, the backbone would have very short addresses, and machines close to the edge would have longer ones. This was originally rejected as routers simply weren't advanced enough to cope with a routing system like that -and- handle IPv4, but this is a couple of decades later, and a "clean-slate" would mean you don't need to worry so much about compatibility issues.)

Second, absolutely mandate IPSec. Don't just "mandate" it and then ignore it, as happened with IPv6, but make it a pre-requisite for all users. That gives e-commerce a lot more assurance on secure transactions and authentication, which seems to meet one of their requirements.

Third, mnandate QoS. QoS not only guarantees network quality, which would interest a LOT of corporate users, but also provides a mechanism for increasing profit. Simply offer different levels of guaranteed quality at different prices. This meets another requirement.

Fourth, the biggest new market is in mobile devices and wireless networking. So support them! What is the point of the IETF churning out megabytes of specs on mobile IP and mobile networks, or of software developers supporting all these new protocols, if none of the ISPs or network engineers give a damn? It would also provide an additional service, therefore an additional revenue stream, therefore also meeting the profit requirement.

(Mobile networks are where all the wireless users are going to stay using the same router, but the router itself is moving through the network. If you were to have WAPs on aircraft or trains, where you are static relative to the vehicle, but the vehicle is moving between ground stations, this is probably the way you'd want to implement it.)

Fifth, it is possible to balance anonymity with accountability. Accountability merely requires that machines are who they claim they are and (where user identification is relevent) users are who they claim they are. It does NOT require that anyone actually posesses enough information to actually identify those machines or users, only that when a claim is made, it is verifiable in some way.

We already have Kerberos for authentication, so it would seem a fairly trivial extension to use that as your authentication mechanism. The token does not reveal your identity, but it can be verified with a Kerberos server in the heirarchy used for authentication by that user, to prove that the user did identify themselves correctly.

If that isn't good enough, use X.509 certificates at both host and user levels. Lots more money to be made there. It doesn't kill anonymity, as you can perfectly well have a certificate that doesn't say anything useful or self-incriminating. It would still be useful for accountability, though, as no two entities, no two machines and no two users should have identical certificates. At the very least, the key used to examine the certificate would be different, even if the content itself was identical.

This would be more than good enough to ensure that Joe Bank Manager's personal checking account could not be logged into by Sammy Script-Kiddy - there's your accountability - but would not require people in politically dangerous countries (such as the US) to reveal anything that would compromise their safety, meeting a lot of the anonymity requirement.

As for the "upgrades" cost - that's just because most providers (backbone or ISP) are too cheap to do it right the first time. Optic Fibre has been around a LONG time, and to upgrade an optic link just requires upgrading the transceivers at each end - so long as the fibre is of good enough quality. At present speeds, a single fibre can carry about 4-5 terabits per second, and typical bundles have about 20 or so fibres, giving you 100 terabits per second.

Lets say that, when the US Government was still runnin

I2

[Nasarius]

I'll agree with him that Internet2 hasn't lived-up to what it should have been

What the...? Are you confused by the name? I2 is just another semi-private backbone. That's all. It's occasionally a testbed, but mostly it's just a bunch of fast routers, nothing magical. It serves much the same purpose as the early Internet: connecting universities and a few large organizations.

Don't let legacy linger forever

[QuickFox]

Define, as part of the standards, that when certain standards have been upgraded in important ways, within five years all essential infrastructure software must be upgraded so that it understands the new version.

This should apply to essential infrastructure like routers, DNS servers, SMTP servers, and so on. If a server does not understand a protocol that has been around for five years, that's reason enough to refuse connection.

If this becomes part of the standards, we won't have to support ancient legacy forever. When countries with languages other than English want readable domain names, we won't have to live forever with kludges like punycode, such kludges will stay just for five years, after that real solutions can be used instead. If/when solutions to serious problems like spam and DDoS are found and standardised, we can count on the infrastructure to support the solutions within five years. Stuff like IPv6 could spread quickly and smoothly.

Of course, having to upgrade introduces some inconvenience and expenses. But having to support ancient legacy is also inconvenient and expensive. In spite of the upgrade inconvenience, in the long run this kind of limit should save lots of money for everyone.

Fixing it

[tempest69]

Ok NO amount of change is going to get rid of human mistakes. However there are some big changes that need to occur to prevent some of this junk.

#1 Change: User side one time only credit charges. The only way to do a transaction would be to use an encrypted transaction that would prevent fishing from being any good at all. This would be more of a banking change, and most people would hate it, but the whole CC# and Bank info phishing has to end, the transaction mechanism needs to change.

#2 Change: Add a decorator pattern to ALL explorer windows, making user that every popup has a BRIGHT ORANGE BORDER, turn off the ability to disable the X button. Pretty much make all popups automatically listed as unsecure. Tag all 3 party "unsigned" apps with a Bright RED BORDER, if it isnt trusted you should know, every time you run it.

#3 Change: Add a hardened Email System to the main email. Where hardened email can be flagged as less likely to be spam. The hardened email system would be unprofitable for spammers to use, Proof of work tolkens or a small monitary deposit required for emails that are "in play". This would leave the old email as functional, but would gradually replace it as old email wont be used by real people.

#4 Change: Reduce to number of auto-launched services, anything that it out of the "OS-normal" for launching would be in one big happy spot, where it could be removed. The operating system wouldnt have a "backdoor startup" or a way for the program to re-insrt itself into the system. and the OS would solidly isolate itself from getting nailed by a trojan.. keeping almost everything in a sandbox.

#5 Change: Prevent the system from being able to spy on you. yea, it gets rid of some legitamate monitoring applications, But make it an option in the control panel that is stupid obvious that no-one really wants to turn it on (except corporations that are monitoring their employees).

#6 Change: Have a nice big registry of "BAD Software" If people are online anyway, there should be a way to tag software as JUNK, or SPYWARE, or a dozen other bad bad things.. and when the software is being downloaded, it shoudl be checked against the big database and the user should be VERY appropraitly warned.

Ok that's six off the top of my head.. yea they are mostly focused on microsoft, but thats where most people are hosed anyway. The net isnt bad, but some SIMPLE changes would really make the experience much beter for everyone.

Storm

Now, with billing!

[Animats]

Clark said he would like to see two things addressed in any replacement for the current internet. The first is a coherent security architecture. The second is a healthy economic infrastructure for network service providers, who will need a bigger piece of the pie in the new internet than the one they are getting now if they are going to help pay for building it.

This guy must be getting support from a telco.

Telecommunications providers hate the Internet. Not only is the Internet too cheap, it's not set up for detailed billing. The US Internet backbone cost about $1bn to build, and costs about $100 million per year to run. For something that handles over 100 million users, that's nothing. All the intelligence is in the end nodes, so telcos don't get to add "value added services" for which they can overcharge.

What telcos want is an environment they control, like cell phones. With charges for everything from ring tones to SMS messages. That's what Clark is talking about here.

The telcos tried this idea back in the 1980s, and it was called TP4, or "ISO 8073 COTP Connection-Oriented Transport Protocol - X.224" X.224 is very much like TCP, but without the adaptive retransmit machinery to work well over unreliable links. You're supposed to run X.224 over a reasonably reliable virtual circuit provided by a telco. For which you pay by the packet, like X.25 or ISDN. Bad idea. Windows NT4 actually had support for X.224, and some older Cisco routers understand it, but it's dead.

This is not a place we, as users, want to go.

What to consider

[floki]

I only hope they didn't forget to hire Al Gore or else this won't work.

But, that's not how it works, folks!

[mcrbids]

Guys, guys GUYS!

I see many posts here about how we need to "mandate" this and "require" that and blah blah blah...

But the Internet, by design, is lasse faire! There is no "mandating" ANYTHING! Anybody can hook up to their neighbor, who hooks up to some guy across town, who is hooked up to a couple other folks...

The Internet is DECENTRALIZED and OPEN. The closest it gets to mandating anything is the much-disputed RBLs. I, for example, block all email from most Asian countries - nothing personal, but it sure drops the SPAM load with virtually no complaints. But, I can't mandate what the Chinese or Koreans do with their network - I can only mandate what they do with respect to MY networks.

The Internet is merely a commonly agreed upon set of standards for communications across disparate networks, and it's performing the task of connecting networks the world over with grace and flair.

Don't tell me that just because Windows systems get infected in 12 minutes, that the Internet is broken. Sorry. The Internet is working fantastically. It's Windows that's broken. It's not up to the task of functioning on a globally accessable network.

So far, every significant "problem" I've heard with the Internet hasn't been with the Internet, but with the systems at its fringes. SPAM. zombies. Worms. Viruses. Exploits. All are simply side effects of a "zero friction network" as espoused by the all-knowing Bill Gates in his 90's book, "The Road Ahead", combined with systems not able to cope with the ramifications.

Bill Gates, Larry Ellison, Scott McNealy, Linus Torvalds, and all the others are learning now what that truly means, and over the next decade or so, we'll see major advances in developing the kind of security needed to handle this frictionless network.

In short: the Internet is doing just fine, people! It's the systems hooked up to it that have problems!

Gentlemen, we can rebuilt it ...

[Ihlosi]

.. better, stronger, faster.

Please

[baldass_newbie]

How in the world is this Offtopic?
pr0n and Sci-Fi are the backbone of the Internet. Name an advance in Internet technology that didn't come from the pr0n community first. I mean, what else do you use 'tabbed browsing' for? Business?

Missing the whole picture

[phalovic]

One of the key points in the article (that has been missed so far) is that the research for this is being done on the National Lambda Rail. One key technology that hasn't been mentioned yet is DWDM (Dense Wave Division Multiplexing). This runs 30-40 different wavelengths over a single fiber. Each wavelength (lambda) can currently carry 10 Gb/s of data, 40 Gb/s in some cases, and 100 Gb/s is on its way. That means that a single fiber can carry up to 4 Tb/sec of data in the real near future (right now in some labs). The next important technology is ROADMs (Reconfigurable Optical Add/Drop Multiplexers). These devices allow individual lambdas to be inserted, extracted, or tapped from a fiber. Next is GMPLS (Generalized Multiprotocol Label Switching). This a switching framework that ties together the ROADMs and optical switches to allow a single lambda to be routed through an optical mesh network. Actually it sets up a per use circuit through the mesh for any particular lambda. Also, anything that can be converted to an optical wavelength can be routed over this kind of network, not just ethernet. Fibre Channel, SONET, high defition video and ethernet can all be routed over this kind of network at the same time.

Want 2 Servers behind NAT: Use OpenBSD or Linux

[morgan_greywolf]

Load balancing can be also be done with iptables. See also this thread on the netfilter mailing list.

Re: FTP overhead versus HTTP

[cbreaker]

You just don't get what he's saying, and you're not making any sense.

"The only time FTP has less overhead than TCP is when you're retrieving several files."

I'm going to make a guess here and assume you mean HTTP, not TCP.

First, take a look at the FTP RFC.
http://www.freesoft.org/CIE/RFC/959/index.htm

Then, take a look at the HTTP 1.1 RFC:
ftp://ftp.isi.edu/in-notes/rfc2616.txt

You tell me which has more overhead? A notable part of the difference is the encoding; FTP can transfer data straight binary - no MIME types or special encoding to send the data over the channel.

"the overhead of FTP can be significantly higher than HTTP (logon banners)."

Are you kidding?

" For HTTP, you send the request and sit back and wait for the data. "

If browsers were as simple as an FTP client, this might be true. But don't forget about all the banners and lots of extra data that gets communicated between your average browser and HTTP server these days. Not to mention cookies.

"With FTP, you have to login (USER, PASS), which both require you to wait for confirmation before you can PORT and RETR."

All of this is is likely done in less then 100 bytes of data transferred.

"Not to mention the overhead of establishing another TCP socket to pass the data over."

Here's a quick run down of how a TCP connection is established:

1. Packet sent from initiating machine. Very small packet (bytes) with the SYN flag set.
2. Recieving machine gets packet with SYN. Sends packet back (bytes) with the SYN and ACK flags set.
3. Initiating machine sends back another small packet (bytes) with the ACK flag set.

The amount of data necessary to open a raw TCP connection is so miniscule that it's almost not worth mentioning.

"If you need to retrieve a tree structure of files, download several files from a single server, or need to upload files, FTP is the way to do it. If you need to download only one file, or several files in parallel (typical webbrowsing), then HTTP is your friend."

You're looking at this from a user perspective, not a technical one.

FTP is very low overhead (read: almost zero,) it's a very intelligent design, and it works great over slow and unreliable connections to boot.

Nobody is saying we should replace HTTP with the FTP protocol.