Will Vista Overload the DNS?

Jamie Northern writes, "Thanks to new directory software, Windows Vista could put a greater load on Internet DNS servers. But experts disagree over whether we're headed for a prime-time traffic jam or an insignificant slowdown. Paul Mockapetris,inventor of DNS, believes Vista's introduction will cause a surge in DNS traffic because the operating system supports two versions of the Internet Protocol (IPv4 and IPv6). David Ulevitch, chief executive at OpenDNS, a provider of free DNS services, said Vista's use of IPv6 will not disrupt the Internet at large. 'DNS can be improved, but predicting its collapse is just spreading FUD.'"

Comments

But without FUD...

[arthurpaliden]

There would be no news....

Re:But without FUD...

[IAmTheDave]

Man, if this isn't the most insightful comment on /. this week, I just don't know what is. Being that I have no mod points, consider this my kudos.

Re:But without FUD...

[Anonymous Coward]

Can't they just use something like bittorrent to have everyone mirroring the files?

Re:But without FUD...

[diersing]

OK Mr. Smarty Pants, take all the FUD out of the news and then what? Huh? There'd be nothing for us to post on, and then what? Huh? Work? Are you freaking serious?

Although I must concede your point and would have modded it up if it wasn't already a +5.

Re:But without FUD...

[interval1066]

Less news than the Y2K issue, if anyone remembers that. With probably about the same amount of impact. I'm not Mockapetris, but I do a lot of DNS configuring and client programming, and my hunch is that; as hideous as any M$ product is to me, the impact of Vista's DNS/Bind client impl will not even be noticable.

Re:But without FUD...

[Mister Whirly]

Yep, time to buy portable generators, bottled water, and 50,000 rounds of ammunition in sealed drums. Oh wait, I guess all that stuff is still in my Y2K bomb shelter, I'm set!

Re:But without FUD...

[dargon]

Sure, and have an update process just like WoW ;)

Re:But without FUD...

[bcattwoo]

It is considered insightful to remark that you consider someone else's comment insightful? Without even expounding the slightest on how it was so?

If that is the case, I must say that your pointing out the insightfulness of the GP was in itself quite insightful.

Please mod me up.

Re:But without FUD...

[Bob Cat - NYMPHS]

I don't have any mod points, but perhaps one day soon I shall have the opportunity to metamod some mod's overrated mod of your comment as unfair.

modmodmodmodmod...

Re:But without FUD...

[tolkienfan]

Maybe he was refering to his own post.
Plus I disagree. This is the most insightful comment.

Re:But without FUD...

[Anonymous Coward]

However, what a fuxored up summary! The feared DNS slowdown is not anything about Vista, it's about the introduction of IPv6. Save the Microsoft blaming for the real and justified occasions, please.

And perhaps not everybody, even at Slashdot, immediately remembers what "DNS" stands for, you might expand it out frigging *once* in the summary. (I know this acronym from at least three different fields.)

(On a lighter note, can we start calling IPv6 "Internet 2.0"? Or is "Intarweb 2.0" more appropriate...)

one solution comes to mind

[Tjebbe]

just friggin deploy ipv6

Re:one solution comes to mind

[hpavc]

So what if Vista supports ipv4 and ipv6, that doesn't mean its going to have ipv6 flipped on. Didn't win98 support ipv6 with some sort of install from MS to network control panel?

Re:one solution comes to mind

[gkhan1]

XP does ipv6 perfectly, you just have to turn it on (WinKey+R -> "cmd" -> "ipv6 install"). If Vista just "had it", there would be no difference, would there? No, Vista will support ipv6 natively and it will by default be turned on.

Re:one solution comes to mind

[jimmypw]

The internet will need IPv6 eventually but for the moment, Since the development of NAT (its not amazing but it does the job), Hundreds of thousands if not millions of IP addresses have been freed. Over time devices will be upgraded to support IPv6 addresses and then older devices replaced at the end of their upgrade cycle. Then isp's will start issueing IPv6 addresses to their clients as more IPv6 routes become available. So you cant just deploy it without people being ready as it will just create a mess of the internet with incompatible networks all over the place. My prediction for total phase out of IPv4 is somwhere between 2020-2025.

Re:one solution comes to mind

[Martin Blank]

IPv6 is going to be forced along by the US Dept of Defense, which is pushing to get its networks on IPv6 within the next couple of years. This will cause much of the rest of the federal government to do the same starting with those agencies that work most closely with the military (such as DHS), which in turn have close working relationships with other agencies and will drag them along. States will be pulled into it as a result of their ties with the federal government, and then local governments will be forced to come along for the ride eventually. With all of these ties in place, more ISPs will start directly supporting IPv6.

Incidentally, IPv6 support has only just been added to the DOCSIS standards with the release of 3.0. However, even by 2011, barely more than half of the nationwide cablemodem infrastructure will be DOCSIS 3.0-compliant under current estimates, and that doesn't mean that the cablemodems themselves will be compliant, as DOCSIS 3.0 is backwards-compatible. I'd go for it now if I could, but somehow I suspect that Time-Warner isn't going to have things ready next month.

Re:one solution comes to mind

[Zeinfeld]

I think we are missing the bigger point here. If Vista is implementing the IPv6 spec correctly then any problem here is due to the spec being incorrectly written, not Microsoft.

The underlying problem here is that the people who wrote IPv6 had not got a clue about how they were going to deploy it and most still don't. They still treat NAT as if it was the cause of the problem rather than relizing the potential to use NAT as a means of achiving the necessary transition.

I have yet to see anyone write a coherent document that explains how an IPv6 connected machine can do anything usefull with their IPv6 address. Who is going to be putting up IPv6 sites to visit? To be on the Internet you are going to need an IPv4 address for a very long time.

Another clueless issue in the IPv6 spec is the assumption that there will be no NAT and that everyone will be happy to broadcast their MAC addresses to the rest of the world. Not a chance. Enterprises will still be NATed and Firewalled. So will home networks if users have a clue.

Re:one solution comes to mind

[Schraegstrichpunkt]

Regarding DOCSIS, we realistically won't have to wait that long. People will be able to use RFC 1918 addresses to connect a tunnel between their on-site router and their ISP's router. Or, they should be able to use PPPoE to accomplish the same thing. Obviously, these are inefficient hacks, but they'll work well enough until the infrastructure is upgraded.

Re:one solution comes to mind

[Martin Blank]

Those will cause more trouble than they're worth for the cable companies. As has been mentioned elsewhere, we're going to be dealing with IPv4 for at least the next 10-20 years, and there is not a significant rush aside from the desire of a large proportion of geeks to see the move.

Why any different than Linux or MacOS X?

[Midnight Thunder]

Linux and MacOS X are both capable of having both IPv6 and IPv4 stacks, and in many cases this is active by default. Why would Vista cause any more problems?

If you have a good setup then you will have a lookup cache on your local machine storing both IPv6 and IPv4 addresses for each site. Therefore only one lookup should need to be done.

Re:Why any different than Linux or MacOS X?

[rob1980]

Why would Vista cause any more problems?

Because Vista is going to be used by about a couple hundred million more people than Linux/OSX. Even if there is no real threat, it's worth it just to investigate and make sure.

Re:Why any different than Linux or MacOS X?

[DingerX]

Maybe because nobody believes that a major portion of the PCs connected to the internet next year will suddenly start running MacOS X or Linux?

Nor does anyone believe, for that matter, that many PCs currently running Linux or MacOS will be "upgraded" to Vista.

Re:Why any different than Linux or MacOS X?

[with_him]

User base as a result of deployment. There are a lot of business users that as they are strongarmed by micro$oft sales reps to the latest version of windows. If I where betting I would say that the business user base that migrates in the first year is larger than the current linux and OSX combined.

Re:Why any different than Linux or MacOS X?

[Midnight Thunder]

Because Vista is going to be used by about a couple hundred million more people than Linux/OSX. Even if there is no real threat, it's worth it just to investigate and make sure.

Maybe I should ask the question differently: why would there be any more requests than there are now with Windows? After all a single DNS lookup should easily get the AAAA and A address in one shot, unless I am misunderstanding the protocol.

Re:Why any different than Linux or MacOS X?

[Tweekster]

A couple hundred million more? You act as if suddenly everyone with XP will instantly have Vista. It will take years to replace even half the machines running XP.

Re:Why any different than Linux or MacOS X?

[Danga]

You act as if suddenly everyone with XP will instantly have Vista. It will take years to replace even half the machines running XP.

The OP never said it wouldn't take years either, he said "Because Vista is going to be used by about a couple hundred million more people than Linux/OSX."

I don't know if his figure of 100's of millions will ever surface, but definitely 10's of millions is feasable.

Re:Why any different than Linux or MacOS X?

[NSIM]

> Linux and MacOS X are both capable of having both IPv6 and IPv4 stacks, and in many cases
> this is active by default. Why would Vista cause any more problems?

Just a wild guess here, but if (and that's a big if) Vista causes a problem it will be because millions of systems will be using it, vs. much, much, much smaller numbers for LINUX and OSX combined.

Re:Why any different than Linux or MacOS X?

[Tweekster]

Well there are already 10's of millions of Linux and MacOSX machines 10's of millions of each.

Re:Why any different than Linux or MacOS X?

[Danga]

There are also already 100's of millions of Windows users, so what is your point?

Re:Why any different than Linux or MacOS X?

[Antique Geekmeister]

Linux and MacOS tend to be a lot saner about caching behavior, and are often properly configured with a local caching DNS server in more sane setups than the millions of Vista machines expected to be built when Vista is finally released. And as corporate environments switch hundreds or thousands of updated or new machines to Vista, the load on upstream DNS servers, especially the root servers, can be expected to climb quite drastically at some very odd times.

The DNS for Microsoft itself is one of the most vulnerable possibilities: if that goes down for an hour or so, as all the Internet Explorer servers and mis-programmed default Internet Explorer search settings hit microsoft.com for their default web page, those servers are going to take very large loads. And spreading out the load for such hits on the root servers for .com is not a small task: they may have to get services from Akamai to survive the hits.

I'm sure that Microsoft also *hates* having to use Akamai servers for anything, due to Akamai's understandable reliance on Linux for core services.

Re:Why any different than Linux or MacOS X?

[azuretek]

I'm pretty sure that was his point, there are 100s of millions of users with ipv6 already and it's not causing issues.

Re:Why any different than Linux or MacOS X?

[kickdown]

> why would there be any more requests than there are now with Windows? After all a single DNS lookup should easily get the AAAA and A address in one shot, unless I am misunderstanding the protocol.

I think you are: you can only request one record type at a time. So you ask either A or AAAA; and given that the rule of thumb is to prefer IPv6 if present, first goes your AAAA and then your A question.
What you _could_ do is ask for the type ANY, which will make the server return everything it happens to know. But then you have no guarantee the info is exhaustive: the server will only give back those records that it already has in its cache; it will not ask the authoritative name server. So then you might miss something.

What generates a lot more DNS traffic than AAAA records is the fact that the world has forgotten that URLs terminate with a trailing dot. If you leave it out, it's a _relative_ URL and the resolver on your machine has to trial-and-error if you perhaps meant it with a dot.

Example: you type www.foo.com in your browser. Your resolver is configured to append bar.org. to relative URLs. Then you'll generate a completely useless request for www.foo.com.bar.org. just to find out it doesn't exist, and then guess the domain www.foo.com. is meant. That depends on your search order and cleverness of your resolver of course, you might as well be lucky and it works out.

Re:Why any different than Linux or MacOS X?

[Danga]

No, that was not his point. He responded to me after I responded to his comment: You act as if suddenly everyone with XP will instantly have Vista. It will take years to replace even half the machines running XP."

So the issue we were talking about was not about the current amount of ipv6 users, it was how many and how fast people will switch over to Vista.

Re:Why any different than Linux or MacOS X?

[Anonymous Coward]

thats the people that don't buy it - how much of the world uses_pirated_versions of winxp? aside from if they know it sucks, whats to say they wont pirate vista - instantly increasing the count of vista users...

Re:Why any different than Linux or MacOS X?

[MrWa]

Linux and MacOS X are both capable of having both IPv6 and IPv4 stacks, and in many cases this is active by default. Why would Vista cause any more problems?

How many Linux and MacOS X installations are currently active? What is market share of Windows? How many Windows Vista installations will there be 1, 2, 5 years from release? If having both stacks could cause a problem, doing that in Windows could have a much greater impact, right?

Re:Why any different than Linux or MacOS X?

[Ryan Amos]

It will take corporate customers 3 to 5 years to make the transition. Many companies have just recently phased out all their Windows 2000 boxes.

Re:Why any different than Linux or MacOS X?

[Breakfast Pants]

"Why any different than Linux or MacOS X?"

I can think of several hundred million reasons (hmm, for some reason this number is right up there with MS's userbase...).

Re:Why any different than Linux or MacOS X?

[EnderGT]

First of all, you can request more than one record at a time - the specification explicitly allows for more than one Question in the message. Second, the server will frequently return other records that it thinks will be helpful or will be requested shortly. For example, if the original request maps to a CNAME, the mapping could be followed and the correct A record returned (this is called additional section processing). In fact, the AAAA spec requires that queries that trigger additional section processing (e.g. query for NS or MX records) must look for AAAA as well as A records.

The response packets may be larger, but I don't think there will be more of them.

Re:Why any different than Linux or MacOS X?

[Tim C]

are often properly configured with a local caching DNS server

I don't know about Vista, but one of the services that runs by default in XP is the "DNS Client" service. This is actually rather poorly named, as it is in fact a DNS caching service.

So, while I can't speak for Vista, XP definitely ships with a DNS caching service enabled by default in both Home and Pro; I can't imagine that Vista would be any different.

Re:Why any different than Linux or MacOS X?

[cmburns69]

The DNS for Microsoft itself is one of the most vulnerable possibilities: if that goes down for an hour or so, as all the Internet Explorer servers and mis-programmed default Internet Explorer search settings hit microsoft.com for their default web page, those servers are going to take very large loads. And spreading out the load for such hits on the root servers for .com is not a small task: they may have to get services from Akamai to survive the hits.

If DNS is down, the vista users browsers won't be able to lookup the "microsoft.com" domain either.

No lookup --> no hit --> no load spike on the MS servers.

Problem solved!

Re:Why any different than Linux or MacOS X?

[rabbit994]

Most Corporate networks will run their own DNS servers and cache results so the increase in traffic will happen but it won't be the disaster the article is predicting. DNS packets are pretty small.

Re:Why any different than Linux or MacOS X?

[interval1066]

> ...as corporate environments switch hundreds or thousands of updated or new machines to Vista Will they? I suppose many will, but remember the woeful update rate for XP? Seems to me like I remember it taking for ever (and Microsoft complained about this, how I remember) for corporates to upgrade to XP.

Re:Why any different than Linux or MacOS X?

[Anonymous Coward]

hat generates a lot more DNS traffic than AAAA records is the fact that the world has forgotten that URLs terminate with a trailing dot. If you leave it out, it's a _relative_ URL and the resolver on your machine has to trial-and-error if you perhaps meant it with a dot.

Apparently, things don't work like this, because if they did, the internet would be broken at work. In our office, all computers are in the office.example.com domain, search that one first, and there is a wildcard entry that maps *.office.example.com to a webserver where all employees can have a web page at <employeename>.office.example.com, and more at <project>.<employee>.office.example.com. Obviously, when a browser would actually try slashdot.org.office.example.com first, it would hit our internal webserver and just show our beautiful 404 error page, but in reality, this only happens with nonexistent domains.

Re:Why any different than Linux or MacOS X?

[routerguy666]

Any MS environment built in this decade is most likely running Active Directory and, thus, internal DNS. All workstations are pointing at an internal dns server(s), and that internal DNS box is the only machine configured to point to an upstream (hopefully) or the roots to make queries.

Re:Why any different than Linux or MacOS X?

[kickdown]

> First of all, you can request more than one record at a time - the specification explicitly allows for more than one Question in the message. Not exactly. You are right that the SPEC (RFC1035) allows more than one query in a packet. But there's the "show me the code" problem: I just tried it out, none of the standard DNS resolution tools offer this, and when I built the packet with a lib and sent it, Wireshark showed that I sent a correct query with two questions in it, but the name server simply sent back a "format error" - it doesn't support this feature. And that was a BIND server - the king of all name servers. If that one doesn't support it, you're lost. > Second, the server will frequently return other records that it thinks will be helpful or will be requested shortly. For example, if the original request maps to a CNAME, the mapping could be followed and the correct A record returned (this is called additional section processing). In fact, the AAAA spec requires that queries that trigger additional section processing (e.g. query for NS or MX records) must look for AAAA as well as A records. It returns additional packets that are needed to get the job done. But if you ask for an A, no sane name server will chatter "AYou, BTW, I also know a AAAA for this host, am I not cool?". What you get in the additional section is there for a reason, for example required glue if a domain's name server resides in that domain itself - then you get it's A and AAAA delivered because otherwise, name resolution wouldn't work at all. The AAAA spec you mentioned demands the lookup for those queries _require_ additional processing - asking A for a domain does _not_ require that.

Re:Why any different than Linux or MacOS X?

[kickdown]

That's why I said in my post that it depends on your resolver's configuration what will actually happen. Luckily, most resolvers have a rule like:

more than two dots in the relative URL ? try literal question first : try appending domain suffix first

But there's no guarantee for that - I've seen lots of ill-formed domain queries with strange domain suffixes. I work at a ccTLD registry.

Re:Why any different than Linux or MacOS X?

[Anonymous Coward]

That's why I said in my post that it depends on your resolver's configuration what will actually happen. Luckily, most resolvers have a rule like:

more than two dots in the relative URL ? try literal question first : try appending domain suffix first

That would not work.

Two possibilities: Try the literal question. Get a reply. Use it, without caring that there was actually a local domain with the same name -> user goes to the wrong site, local domain may be unacessible (web server configured to only answer the partial one, and not the fully qualified).

Or you try the literal question first, remember the result while querying for the local one. This method would give the correct result when both domains exist, but requires sending two questions every time, thus an increase in traffic instead of a decrease.

Re:Why any different than Linux or MacOS X?

[the_womble]

Because they cannot be bothered. I know people who are still running Windows 98. This is in a country where priated copies of Windows (and a lot else) are openly sold - not in obscure places but on every high street and in every shopping mall.

Re:Why any different than Linux or MacOS X?

[Schraegstrichpunkt]

First of all, you can request more than one record at a time - the specification explicitly allows for more than one Question in the message.

If you're a server, what do you set RCODE to if one of the requests returns NXDOMAIN and the other returns a record? What if, instead of NXDOMAIN, you get SERVFAIL?

Having QDCOUNT>1 is ambiguous, and is basically a bug in the RFC. The author of MaraDNS did some research a while ago, and determined that no DNS server really supports it. I quote from doc/en/misc/multiple.qdcount in the MaraDNS distribution:

Neither DjbDNS, BIND, nor MSDNS support queries where QDCOUNT > 1. DjbDNS ignores queries where QDCOUNT > 1. Microsoft DNS server replies with a "format error", and the qdcount is set to the number of questions sent to the server. BIND 8 replies with a "format error", and QDCOUNT is set to zero.

Realistically, DNS servers should probably reply with "not implemented" instead of "format error".

Some discussion of the fact that QDCOUNT > 1 queries are not handled by modern-day DNS servers:

http://www.ietf.org/proceedings/98aug/I-D/draft-ie tf-dnsind-edns-03.txt
http://www.vpnc.org/ietf-ipsec/96.ipsec/msg00779.h tml
http://www.wcug.wwu.edu/lists/ipng/200005/msg00080 .html

In summary, the nitty gritty implementation details of handling multiple question queries in a single packet make this difficult to correctly handle.

I'm making the handling of multiple QDCOUNT queries a low priority in MaraDNS.

Of course, it would be possible to update the standards---and every existing DNS implementation---to support QDCOUNT>1 in some specific way, for this purpose, but by the time it's deployed, we probably won't care much about IPv4 compatibility any longer.

Re:Why any different than Linux or MacOS X?

[cornjones]

I'm sure that Microsoft also *hates* having to use Akamai servers for anything, due to Akamai's understandable reliance on Linux for core services.

You don't research before you post do you? I dunno about all but many msn sites use either savvis or akamai for content caching. putting heavy objects near the client speeds page load times and that is more important than not using a service that might have linux underpinnings.

also, as others point out, any corp is going to be using internal dns. same is true for any ISPs. Truthfully i don't see this being that big of an issue. at worst, traffic will double to the root servers as we have to request a ipv4 and a v6. But it isn't going to happen overnight, there may be a budgetting issue but adding the capacity to a datacenter farm like that should be fairly simple.

Re:Why any different than Linux or MacOS X?

[Antique Geekmeister]

This has actually happened, a few years ago when Microsoft's core DNS servers got re-routed by a backhoe without warning and without a good off-site failover. Every Microsoft dependent desktop idiot in the world starting doing ping and nslookup and webpage refreshes to try and access the site, and the servers had serious problems coming back up under the massive load. People worldwide trying to check security patches, look up Microsoft product information, or open their default Microsoft webpages kept re-trying.

And for the person who said "I don't research", this exact scenario and the problems of fixing it, and the suggestion of "Use Akamai!" and Microsoft's quiet protest of "but they use Linux, we don't consider that reliable" was a serious point of contention in the meeting with Microsoft sales and technical staff. It became quite clear they were unwilling to consider it: they use Akamai and Akamai's Linux servers when they have to, but they obviously hate doing it and would love to woo Akamai away from Linux. I'd *love* to be a fly on the wall at *those* meetings.

Re:Why any different than Linux or MacOS X?

[Antique Geekmeister]

True. Expect it to happen as new office sites are built or as companies move, as a lot of new hardware will come with Vista pre-installed. And expect it to happen as antique desktops and servers with Windows 2000 fall off the support list: forced upgrades to use new products from Microsoft and from their partners will help drive migrations to Visat.

Re:Why any different than Linux or MacOS X?

[EnderGT]

I'm only going to respond to one of the responses to my post, and I choose this one because it has more to say than the other (even though this one is so much harder to read and does not include specific references - good job to the other post).

Both of you are absolutely correct that no DNS server in use today supports QDCount > 1. I had a comment to this effect in my original post, but editing somehow removed it.

It returns additional packets that are needed to get the job done

It's been a while since I worked on this portion of my implementation, but I don't recall any mechanism by which a server will return more that one packet in response to a query. The addition records are placed in the additional section of the message, which is of course subject to size restrictions. If the size limit is exceeded, well, that's too bad - additional section records may be truncated as needed.

What you get in the additional section is there for a reason, for example required glue if a domain's name server resides in that domain itself - then you get it's A and AAAA delivered because otherwise, name resolution wouldn't work at all.

Name resolution would still work, it would just require more queries from the resolver - i.e. the resolver would have to form a seperate query for the delegation name server's address. Additional section is there to reduce the number of queries and save the resolver some effort.

I agree that no sane server would respond with AAAA when only A is requested. However, this raises the idea of a new query type... maybe ALLA - return any and all addressing information (A, AAAA, A6, future scheme, etc) for the given hostname?

Insignificant

[BlahMatt]

Well...It should be set to use either ipv4 OR ipv6 correct? Or is it set to use both depending on what network it is interacting with? The amount of traffic will increase but it shouldn't increase to the point of dns servers crashing constantly. The fact that ipv6 is implemented at all is great, because it's time to move forward, but I can't see this putting an excessive load on dns servers.

Re:Insignificant

[Intron]

It probes for ipv6 first, then falls back to ipv4. This is the default setting for many unix systems as well. You usually find your system running slowly, then find a setting for this and turn it off to eliminate the timeout delay.

As for how big a spike it can cause, see this for the effect of Windows' active directory update scheme on the root servers.

Re:Insignificant

[TCM]

If your system "runs slowly" because of an enabled but not-connected IPv6 stack, it plain sucks. If you have no IPv6 connectivity, don't set a default route for it. The fallback is instant and nothing runs slowly on a proper system.

This is ridiculous

[eln]

For a guy who "invented DNS," he sure doesn't seem to have much of a grasp of how the current DNS infrastructure works.

First off, most DNS servers are very lightly loaded. DNS in general doesn't take a whole lot of traffic (relative to other protocols), and most DNS servers are way overpowered for what they need to do.

Secondly, as the article states, Vista is not going to just blindly do two queries, one IPv4 and the other IPv6, for every request. It is a little more intelligent than that (shocking, I know). For systems that don't have an IPv6 address (which will be virtually all of them given the current adoption rate of IPv6), no IPv6 DNS queries will be done at all.

Linux and other Unix-like OSes have supported IPv6 for years, and they haven't managed to kill DNS yet. Most Vista installations, like most Linux installations these days, are going to have IPv6 disabled anyway, so this is not going to have any real impact at all.

Re:This is ridiculous

[LnxAddct]

He works for a company that sells DNS solutions, so obviously he's just trying to scare up some more business.
Regards,
Steve

Re:This is ridiculous

[weeble]

I expect that Windows will have the IPv6 link local address enabled.

Thus just as Linux currently has an IPv6 interface enabled by default - even if it is not connected to any other machines over IPv6 it will still do AAAA lookups just as Linux does.

The host that it might be looking for may be itself on the IPv6 loopback interface.

Re:This is ridiculous

[porkThreeWays]

Very true. But even if it did two blind queries, DNS uses almost no bandwidth. I'm fairly certain a DNS query and response each only use a single UDP packet. That's NOTHING. Our DNS bandwidth accounts for less than 1% total usage. Even if it were to double, we'd still be at less than 1% bandwidth usage.

Re:This is ridiculous

[Anonymous Coward]

Thus just as Linux currently has an IPv6 interface enabled by default - even if it is not connected to any other machines over IPv6 it will still do AAAA lookups just as Linux does.

Linux does the AAAA lookup anyway. Calling getaddrinfo() causes an AAAA lookup to be done first. Even if there is no IPv6 interface configured. There is no way to turn off the AAAA lookup.

Re:This is ridiculous

[Randolpho]

I think you are exactly right. Note how the original article points to an article where Mockapetris claims that DNS servers are going to slow down broadband because they're operating near capacity. Oh, and happily, Nominum (the company he chairs) will provide new, bigger, faster, more scalable DNS solutions for a nominal fee. I wonder if Nominum has had better than nominal business lately. Maybe we can nominate somebody to check into it?

Re:This is ridiculous

[Vaakku]

True. But what was REALLY intresting is that other article told that he's working for comppany which sells DNS solutions. =)

Re:This is ridiculous

[Shadowlore]

I agree with you generally. However:

Linux and other Unix-like OSes have supported IPv6 for years, and they haven't managed to kill DNS yet. Most Vista installations, like most Linux installations these days, are going to have IPv6 disabled anyway, so this is not going to have any real impact at all.

Is innacurate and incomplete thinking.

Let us say the traffic increase per machine was 20% regardless of OS. Which will cause more load assuming equal uptimes:
100,000,000 Vista machines or 10,000,000 Linux machines?

Re:This is ridiculous

[rapidweather]

This is ridiculous too:

Also sounds like something that could be "rounded off" by joe sixpack, to say that Vista will "stop up the internet" for the rest of us. Not everyone will go out and buy a machine with Vista on it. The rich already have Mac's, and the poor have old boxen with an easily-infected OS on it. Now we have this "stop up the internet" thing.
Any joe sixpacks reading this, nevermind, Oh look, there's a Beer Truck that just overturned on the interstate, and the cops are begging for help in somehow preventing an environmental disaster by carting off all the dented cans of beer.

OK, now that I have said that, and are being watched by Microsoft, I want my free copy of Vista sent to me as soon as it's released, in it's final form.
Oh yes, put that in a new computer, so Microsoft gets by cheap rewarding me by just having to pay for a OEM install.

--Rapidweather

Re:This is ridiculous

[Schraegstrichpunkt]

I think Slashdot (and possibly TFA, if I had bothered to read it) are putting words into his mouth. Typically, when people talk about overloading "the DNS", they mean that important authoritative name servers (such as the root servers or the gTLD servers) will be overloaded. However, authoritative name servers can normally manage the amount of traffic they receive by controlling the (DNS) TTL values in the records they return, so it's really not a big issue.

The issue here is that requests between stub resolvers (whatever is the Windows-equivalent of libresolv) and caching nameservers, rather than between caching nameservers and authoritative nameservers. I suspect that Mockapetris is simply saying that some ISPs who are running their caching nameservers near capacity are well-advised to increase their capacity before Vista is released. That much is true.

FUD

[NickyDaFish]

Only unless the majority of the computing world switches over to Vista in a major hurry - I doubt that even in 2 years the majority of the Windows based pc's will have migrated....

Of course it won't cause an overload

[A beautiful mind]

When Vista comes out, it will be introduced gradually compared to the millions of installed Win98/NT/XP systems.

It will take years until/if it reaches considerable marketshare. ISPs have plenty of time to upgrade in the meantime.

Useless to blame this on Vista

[casualsax3]

This has to do with the necessary gradual migration from IPV4 to IPV6, and has nothing to do with Vista. Besides, only routers that support IPv6 will even route the DNS requests to DNS servers. If we want to switch to IPV6, every OS out there is going to have support both in tandem like this. You can't bitch about the slow adoption of IPV6, and then turn around and bitch again when there are insignificant consequences related to the transition.

Re:Useless to blame this on Vista

[Anonymous Coward]

You realize you can encapsulate an IPV6 DNS request into IPV4 right?

Re:Useless to blame this on Vista

[Midnight Thunder]

Besides, only routers that support IPv6 will even route the DNS requests to DNS servers.

Exactly, and:
  - people behind corporate routers usually use an internal DNS server
  - people with home routers, using NAT, can't actually get to a DNS server unless they are using IPv4. The only effective transition technology that supports NAT is Teredo ( implementation here: http://www.simphalempin.com/dev/miredo/ )
  - if home users aren't using NAT or are using a router that does support IPv6 (few to none available), then the ISP should really be thinking long term.
  - worst case scenario is that the DNS server just won't return an AAAA address

Re:Useless to blame this on Vista

[TCM]

Besides, only routers that support IPv6 will even route the DNS requests to DNS servers.

This has nothing to do with IPv6 transport but rather IPv6 records (AAAA).

Moo

[Chacham]

I'm sure Microsoft will have a tool in the Network Setting applet, to upgrade DNS servers to be Vista compatable. If MS has a hand in the DNS servers, it will greatly improve interoperability.

Re:Moo

[jacksonj04]

It was damn easy to update my network's servers (Active Directory, Gateway, DHCP, local and cached DNS etc.) to IPv6, and that was with the tech preview tool. I see no reason for Vista to cause any headaches, and updating an entire corporate network along with every server on it is a simple sweep of a group policy from what I can remember.

Re:Moo

[ScrewMaster]

If MS has a hand in the DNS servers, it will greatly improve interoperability ...

... with Windows, which is precisely why nobody wants Microsoft's hand in anything to do with Internet/Web standards.

Ahh...

[prothid]

... so that's what FUD stands for! ;)

Re:Ahh...

[Anonymous Coward]

... so that's what FUD stands for!
                                                    _
Isn't it a long "U" sound? I thought FUD was the trademarked name for an artificial food product.
                                        _
(Pardon me while I have a BER)

Re:Ahh...

[fm6]

Yeah, I always thought it was a reference to Elmer.

Re:Ahh...

[mh101]

Füd is probably what you buy at the Ikea cafeteria. :)

Complicated mumbo jumbo

[Asrynachs]

That's just a bunch of meaningless technical jargain. They seem to forget that DNS overhead was down by 34% since last year and it's projected to drop by another 20% midway through 2007. So any 'slow downs' as they call them would be soaked up by the rent left from the overhead surplus. yingers

Re:Complicated mumbo jumbo

[geekoid]

why is it declining?

Re:Complicated mumbo jumbo

[Asrynachs]

Strangely enough it's largely due to the number of viruses today. So many people are filtering everything they view through firewalls and virus scanners it's decreasing the load on the DNS.

Huh?

[RAMMS EIN]

Why would Vista overload the DNS system? slashdot.org is already in my local DNS cache anyway...

Re:huh?

[Feyr]

Shouldn't it be as easy as checking which protocol is being used before sending a request?

in short, no. unless your system supports ipv6 but has no ipv6 address allocated (like most of the vista installs i'd say)

dns is what will tell you what you should speak to the remote system. but as others pointed out, this FUD is just that, FUD. dns requests are small enough to not impact the servers much

Re:huh?

[Octorian]

Heck, even Windows XP supports IPv6. (it just isn't enabled by default)

Re:Huh?

[griffjon]

Good point. Really, if /. cared about the net community, it would balance this increased load on the DNS servers by pointing the article links directly to their IP addresses. As the geeks who surf slashdot hopefully outnumber the dweebs who'll be "upgrading" to Vista, it should more than balance out the problems.

Brownouts. Right. Egads.

[postbigbang]

Double the DNS queries are going to do: nothing.

IPV6 is among the most insipid and stupid inventions of all time, allocating a specific address for each atom in the universe (ok, not quite, but close) and does make things ugly. But even with its too-many-octet queries, it's not going to do much damage. Most queries are for LOCAL NETWORK information only. The rest get cached before a demarc point or a tie point.

So, this is much ado about nothing. And Vista isn't a culprit in any event (although I wish I could say it was)-- instead, it's the TWITS THAT BELIEVE THAT IPV6 is a savior.

Ok, I'm better now.

Re:Brownouts. Right. Egads.

[Tweekster]

It is called "Scaling" you obviously are not familiar with it...
If it were your choice you probably would just say. "Just add another digit, that will take care of the problem" (for a couple of years)

Re:Brownouts. Right. Egads.

[Anonymous Coward]

for once, someone with a brain on this shithole.

Below is the most truthful line ever written about IPV6.

IPV6 WILL NEVER BE DEPLOYED IN THE UNITED STATES. EVER.

Re:Brownouts. Right. Egads.

[Anonymous Coward]

i'll bet he'll have the same attitude when there are no more ipv4 addresses left and his isp will not have one(ipv4 address) left for him... try connecting then without IPv6

Re:Brownouts. Right. Egads.

[postbigbang]

And that time will happen in the year 19202 if expansion parallels population growth.

Really. DO THE MATH. IPV6 IS INSANE!!!!

Re:Brownouts. Right. Egads.

[TCM]

Ah yes, the fear of the uninformed.

IPv6 makes routing much easier because most of those addresses won't be allocated to anything. They serve to keep the address space non-fragmented, so routers will have much smaller routing tables. Also, routing IPv6 is much easier because of a reduced set of options and a streamlined packet format, reducing the processing required by routers.

If anything, IPv6 makes things nicer and cleaner. If you wanna know about ugly, look at NAT and CIDR and the hack it brought to reverse resolution.

Re:Brownouts. Right. Egads.

[Anonymous Coward]

Really. DO THE MATH. IPV6 IS INSANE!!!!

He's just mad because he'll have to recertify his Network+ so he can get the 25 cent/hr raise from Geek Squad (useless twats). It took him 3 tries to pass the last one.

Re:Brownouts. Right. Egads.

[vadim_t]

I'm guessing you haven't been using computers for very long.

Remember the mess with hard disk size limits? First it was 528MB limit, because some moron had to be clever and pack data as tightly as possible using ridiculously little space for the CHS addressing mode. Of course, they didn't learn their lesson, so through various hacks we then went through 2GB, 3GB, 4GB, 8GB, 30GB and 128GB limits, plus some filesystem size related ones. *Finally*, with LBA48 the limit was upgraded enough not to be reached in the near future, and all sane filesystems have maximum sizes that shouldn't be reached any time soon as well.

But here you go, finally somebody gets it and allocates so much space that we should never ever run out of it, and morons come out of the woodwork and complain that 128 bit addressing is overkill, completely forgetting the huge mess there was with hard disks, with the associated crap like the Ontrack disk manager.

Re:Brownouts. Right. Egads.

[Schraegstrichpunkt]

But even with its too-many-octet queries, it's not going to do much damage. Most queries are for LOCAL NETWORK information only. The rest get cached before a demarc point or a tie point.

Please define "demarc point" and "tie point", justify your statement that "most queries are for LOCAL NETWORK information only", and give us some indication that have any idea what an IP network is.

My guess is that you're either a troll, a child, or a telecomm-industry "expert" who thinks he knows the Internet.

Quite right...

[GillBates0]

Microsoft needs to understand that the Internets are not something you just dump something on. They're not luck big trucks.

They're like series of tubes. And if they don't understand those tubes can be filled and if they are filled, when you put your message in, it gets in line and it's going to be delayed by anyone that puts into that tube enormous amounts of material, enormous amounts of material.

Re:Quite right...

[msormune]

And maybe, by using the same logic, many Linux distributions that use IPv6 by default should learn the same thing?

Re:Quite right...

[Anonymous Coward]

Redundant? This one should be +5 Illiterate.

Re:Quite right...

[Anonymous Coward]

Looks like none of the mods got it. The internet is a Series of Tubes!

Re:Quite right...

[Anonymous Coward]

Guess you didn't get it .

Mistake in assumption.

[jellomizer]

Fact not everyone is going to upgrade to Vista overnight. Heck there are still people with 3.1 out there. Or 95 on Brand New Computers. Even if it does put a load on the DNS Server it would rise gradually over time, As people get Vista one at a time. By the time it would be considered a problem the DNS Server will probably just need an upgrade, and it will probably happen when the DNS upgrade is due. Vista is due after the Back To School and Holoday season so all the people who would rush to get the new OS will not as much as they are well trenched in their daily lives. Most mature and "smart" companies will handle the migration slowly to make sure there are no major problems with Vista and many will wait for SR2. Most users will continue using whatever OS they have on their computer until they buy a new one. So this sudden jump in traffice will not happen.

Remove the need for NAT?

[IHawkMike]

From TFA:

As current IPv4 addresses are becoming scarce, IPv6 will provide easier connectivity across the Internet and remove the need for IPv4-addressing schemes such as network address translation, which can require additional management burdens and cause application incompatibilities.

While IPv6 will certainly give us all the IP addresses we'll ever need (until every nanomachine gets one), do we really want to do away with NAT? I've always considering NAT to be a blessing regardless of the scarcity of IP addresses. Not giving every user a public IP is a good idea, and as long as protocols don't try to do something silly like putting the IP address in the Application layer (seriously H323... why?) then NAT should always function as intended. Of course, IPv6 address are 4 times larger (bitwise) so I can see some increase in overhead, but not much.

Re:Remove the need for NAT?

[cortana]

When you say NAT you really mean firewall. Dropping NAT will not improve security.

Re:Remove the need for NAT?

[IHawkMike]

When I say NAT, I don't mean firewall, I mean Network Address Translation. True, its function is usually performed by a firewall or gateway, but I'm not talking about stateful inspection or anything like that. NAT simply replaces the source and destination addresses in IP packet headers to allow multiple private IPs to use a single public IP (keeping track of conversations and such). More importantly for security, however, NAT prevents uninitiated outside connections from reaching devices inside the private network unless specifically configured as a server. What this means is that even without a firewall, a worm exploiting some neat new Vista "feature" will not be able to penetrate NAT to access ports on the not-yet-patched computers inside.

Re:Remove the need for NAT?

[profplump]

How is "prevents uninitiated outside connections from reaching devices inside the private network unless specifically configured as a server" any different than what a firewall does?

I agree with the parent -- you don't mean NAT, you meant stateful packet inspection and blocking of inbound traffic that isn't related to previous outbound traffic.

Re:Remove the need for NAT?

[whoever57]

Dropping NAT will not improve security.

NAT is a two-edged sword regarding security. On the one hand it provides a means by which incoming packets will be dropped if they don't match an existing connection. On the other hand, NAT breaks some end-to-end security measures and has resulted in ugly hacks to get these some protocols to work (for example, IPSEC and NAT-T). Essentially, NAT makes man-in-the-middle attacks more likely.

Re:Remove the need for NAT?

[cortana]

When I say NAT, I don't mean firewall, I mean Network Address Translation. True, its function is usually performed by a firewall or gateway, but I'm not talking about stateful inspection or anything like that.

Neither do I!

NAT simply replaces the source and destination addresses in IP packet headers to allow multiple private IPs to use a single public IP (keeping track of conversations and such).

True enough so far...

More importantly for security, however, NAT prevents uninitiated outside connections from reaching devices inside the private network unless specifically configured as a server

No, this is the job of a firewall.

If you have a device on your network that *only* performed NAT and routing, then it will happily pass on any packets it recieves, even if they are destined for your "private" network. Now, I can't send you such a packet, but only because my ISP, and the providers in between them and your ISP won't route the packets. But if your ISP decided to poke around the "private" network then the device wouldn't stop them.

So in practice your NAT device also provides the functionality of a firewall. And so in the IPv6 world, where there is no NAT, you are no less secure. Things will not be very different to how they are now: you will still buy a £30 black box from Scan which you hook your private network up to, and it will still act as a basic firewall, dropping any packets which you do not want to pass from the Internet to your private network, and vice-versa.

Re:Remove the need for NAT?

[IHawkMike]

It's not necessarily different at all from what a firewall "does", it just achieves it in a different way. My point is that NAT alone can improve security. If your point is that it can not, then you are simply wrong.

Re:Remove the need for NAT?

[cortana]

Whoops. I meant, dropping NAT will not decrease security! :)

Re:Remove the need for NAT?

[cortana]

You do seem to understand my point... but in your original post you implied that dropping NAT would decrease security, which is not the case.

We have to get rid of NAT as soon as possible. In some countries users are already behind as many as five levels of NAT!

Re:Remove the need for NAT?

[Octorian]

And people who have become "comfortable with NAT" because they don't understand firewalls and routers (neither of which implies NAT) are probably going to be one of the more annoying hurdles to IPv6 adoption. Evil things like NAT totally break the end-to-end connectivity paradigm of the Internet, and make it only useful for client-server interactions.

Re:Remove the need for NAT?

[IHawkMike]

You are absolutely right. I was never trying to say NAT should be used as a firewall, only that it's function provides a little more security to those who simply do not have a firewall. I was mostly considering home users when I made my original point. Of course most newer devices that support NAT have limited firewall capabilites that won't allow private IP ranges from the WAN side, but I digress.

Re:Remove the need for NAT?

[jbeaupre]

I've wondered if IPv6 can provide some accidental security, giving some equivalence to NAT. With IPv4, you could probe a bunch of systems by just incrementing through all the addresses you cared to try. You were almost guaranteed to find somebody at each address. IPv6 has so many possible addresses it's far less likely to stumble upon something connected at each one. Especially if addresses are handed out non-sequentially. Now you have to have a list of potential victims before you can start polling.

Not a cure, since the DNS effectively has this list. But at least an inconvenience to any worm.

Re:Remove the need for NAT?

[TCM]

NAT. Has. Nothing. To. Do. With. Security. Period.

With plain NAT and no filter, someone on your outer segment (malicious ISP, hacked ISP, other customers of some cable ISPs, ...) can simply set a route to your LAN via your external gateway. The only thing that helps security is a packet filter - which will work just fine with or without NAT.

Get rid of NAT now, the sooner the better.

Re:Remove the need for NAT?

[cortana]

Right, but my point is that they do have a firewall, they just don't know it. And with IPv6 and the death of NAT this won't change--your average home user will buy a small box that 'shares' their network connection (in reality acts as a router and a firewall) just as they do now. :)

Re:Remove the need for NAT?

[jafiwam]

Like what?

What the is it that you expect the average NAT user to be doing that matters with the "end to end paradigm of the internet"?

I am a geeky person, and know what? My NAT-ing Linksys router has never failed to meet my needs for my home internet/home network. In fact, it has a bunch of stuff that I am never likely to use. Ever.

Why are you putting any value on "end to end" when one of those legs is nothing but a threat to the average user (unsolicited inbound).

If it is NOT a threat and you want the inbound traffic, you got a full blown firewall and a DMZ and NAT and know how to configure it, and guess what! Still not a problem!

People like you annoy the piss out of me.

"NAT is not a firewall" (no, it's not, but for the purposes of why an average person that buys them thye sure as fuck are, and WAAYY better than any software solution running on Windows.)

"End to end" Eh? half of that is NOT WANTED. Grandma Joe does not FUCKING WANT any inbound traffic PERIOD. None. Get it? So her "paradigim" is sufficiently fulfilled by "End to".

Re:Remove the need for NAT?

[profplump]

That's exactly my point, and I'm not wrong. Even if we limit the discussion here to onemany NAT and not manymany NAT, which doesn't do anything like what you claim, the parts that you like are the stateful firewall parts, not the address translation parts.

For example, a onemany NAT gateway can be configured to forward all incoming connections to a host (or even several hosts for that matter) on the internal network. All the traffic that comes through the gateway will go through address translation, but none of it will be dropped. In this setup (which is available even on many home NAT routers as the DMZ setting) none of the "security" you claim NAT provides is present.

Dropping packets is what a firewall does. NATting is what happens after the firewall acts to ensure that IP connections work correctly across the discontinuous address space. The fact that they often happen together is not proof that they are inseparable, nor that one provides the functions of the other.

Re:Remove the need for NAT?

[drig]

There's plenty an end-to-end connection is good for. Sharing files through a P2P connection, for instance. SIP-based VoIP is a lot easier with a public IP (yes, I know about STUN, but it's just another thing to go wrong). Running game servers, web servers, etc. Yeah, that's not something your Grandmother wants, but there are enough people out there who know how to run Gnutella, but not how to configure their linksys router.

Though, I have to say I agree with your point about the firewall aspects. Yeah, a simple dumb $40US NAT firewall is going to be tons better security than a software firewall. I agree with your point, but I wonder if it could be phrased nicer.

I don't really have a solution to this, though. Perhaps it'd be best if we continue to use NAT-based firewalls, like my linksys wifi router, even with IPV6 and allow the gurus to do what the gurus will do.

Re:Remove the need for NAT?

[Octorian]

You don't need NAT for a firewall that blocks inbound connections. There is no reason that Linksys, etc, couldn't make a "firewall" that just bridges networks and blocks inbound connections.

Re:Remove the need for NAT?

[TCM]

If you call it "accidental" yourself, it's not security in the first place. That's like "hiding" a flawed service on a non-standard port and calling it secure.

Re:Remove the need for NAT?

[cortana]

So you agree that it would be an effective additional/auxillary thing you can do to secure a machine? :)

Re:Remove the need for NAT?

[Schraegstrichpunkt]

NAT. Has. Nothing. To. Do. With. Security. Period.

Not quite. NAT leads to more complex systems being built to work around NAT. More complex systems are more likely to have security holes. Ergo, NAT has a net-negative security impact.

NAT breaks the end-to-end operation of the Internet. It needs to go away.

Re:Remove the need for NAT?

[TCM]

Not quite. NAT leads to more complex systems being built to work around NAT. More complex systems are more likely to have security holes. Ergo, NAT has a net-negative security impact.

Touché. :)

Re:Remove the need for NAT?

[Schraegstrichpunkt]

What the is it that you expect the average NAT user to be doing that matters with the "end to end paradigm of the internet"?

Voice-over-IP, Mobile IP, IPSEC, VNC, gaming...

And then there's the fact that polling and/or bouncing all your traffic off proxy servers (which is what you have to do in order to do anything except HTTP in a NAT encironment) is a terrible waste of network resources: ISPs (especially ones with defaultless routing tables) don't want NAT.

And then there's the fact that writing any sort of new software takes 3 times longer and requires a monthly subscription (or adware) to what is essentially a big centralized error-prone proxy server in order to support NAT: Developers don't want NAT.

People who are about reliability and security also don't want NAT, for much the same reasons.

In the end, end users end up paying more for NAT, even if they're too ignorant to see why.

(An interesting case study is the relatively expensive Copilot service, which offers nothing except VNC-over-NAT via a centralized proxy. Every one of their customers could have easily used VNC for free if it weren't for NAT making things complicated.)

Re:Remove the need for NAT?

[Schraegstrichpunkt]

Yes, IPv6 provides increased security against attackers who simply try random addresses, since the IPv6 address space is sparser. Of course, the security is pretty much limited to that specific attack.

huh?

[MyDixieWrecked]

Now, I'm all for M$ bashing, and I realize that they've made some dumb mistakes in the past, but I mean, seriously... Vista isn't the first OS to support both IPv4 and IPv6... OSX does. Linux does.

I can't imagine microsoft making such a horrible design mistake such as this. Shouldn't it be as easy as checking which protocol is being used before sending a request?

talk about FUD.

yet another reason to get rid of IPv6

[Anonymous Coward]

Can we please get rid of this geek circle-jerk? IPv4 isn't ever going away, therefore, we will never transition to IPv6. (And please, tunnelling IPv6 over IPv4 is not a transition in any shape size or form. Wanna see my fidonet-over-IPv4 tunnel?)

Of course, Microsoft could ship an OS WITHOUT ANY IPv4 capability, then probably we'd see IPv6 deployed. Other than that, it's just another checkbox to fill.

Stupid

[infolib]

So, many Internet providers have handled 1000% growths over the last few years, but they can't handle a doubling of DNS load over the time it will take everyone to upgrade to Vista?

Yeah right.

The knee in the curve, mentioned by Paul

[davecb]

When working with response time instead of %CPU, the curve is quite different from what one normally sees.

It starts off level, at some number of milliseconds (mostly the round-trip time) and stays that way until the load hits 100%, then increases rapidly and without bound.

For example, if a lookup takes 1/10 second, it will continue to take 1/10 second until there are 10 requests per cpu per second.

After that a queue builds up, and the requests are delayed. Brutally. At a mere 100 requests/second, the delay is 10 seconds, instead of one tenth.

Now imagine that at the huge loads the DNS servers typically handle.

When someone says "they've hit the knee of the curve", he really means "they're about to fall in the toilet" (;-))

--dave

Re:The knee in the curve, mentioned by Paul

[LinuxDon]

Quote: "For example, if a lookup takes 1/10 second, it will continue to take 1/10 second until there are 10 requests per cpu per second."

The amount of time a DNS lookup will take, is just a few nano seconds. Almost all of the delay in a DNS lookup is in the round trip (the time it takes to transfer the UDP package over the internet forth and back). An average home computer can process thousands of lookups in 1 second (if it would be a DNS server).

So in contrast to what you are saying, DNS servers usually have a very small load.
For every web page you view (100KB), generates as much bandwidth as 500 DNS lookups.
And since DNS zones are often not that large, this is a very simple task for even the oldest server.

Even if the DNS loads would double, this would only cause problems in VERY RARE cases.

Also, take in mind that the typical user does not have an IPV6 router, in which case Windows will not do the extra lookup.
And for the root DNS servers it doesn't even matter! Since all of the information is cached anyway with the first request.
While the DNS server responsible for the domainname ns1.slashdot.org (example) is only very lightly loaded anyway (see calculation above).

Therefore there isn't a real issue anyway, since the DNS load will only increase with a *very small* fraction of the total DNS server capacity.

Re:The knee in the curve, mentioned by Paul

[davecb]

The example was just that, an example to explain what Paul was saying. 1/10 of a second is an easy value to do back-of-the-envelope calculations with (;-))

Paul has found that numerous root and .com servers have reached the knee in the curve, and are therefor substantially slowed by overloads. Instead of taking mere milliseconds, they can be arbitrarily slow under load.

This means that they need to engage in some capacity planning to discover what additional hardware they neeed. This is good for me, as I'm a capacity planner (;-))

--dave c-b

Beats the Linux resolver

[Anonymous Coward]

FTFA:

For example, Microsoft designed Vista so PCs will query in the address of the type assigned to the system, the company said. Computers that don't have an IPv6 address will not do IPv6 queries, the company said. Also, when a machine does do an IPv6 query, it will do so only to a DNS server that responded to its initial IPv4 query, the company said. "Name errors are not repeated, so the Net traffic will less than double," it said.

I wish the resolver in Linux distros was as intelligent. It's a pain to keep the resolver, even with ipv6 disabled, from sending a quad A request to the dns server because some application has ipv6 support built in. It's probably the number one cause of the complaint of slow internet access among new linux users.

Overload

[Kamineko]

Toaster: "Well lets just hope you don't get an overload..."
Holly: "What if I do get an overload..."
Toaster: "You'll explode!"

So, to summarize things....

[Anonymous Coward]

It just to be that the Internet would bring down Windows.

Now Windows will bring down the Internet.

I guess revenge is sweet.

Windows IPv6 support

[shani]

If memory serves, Microsoft had an IPv6 stack for Windows 2000 that you could download from Microsoft's research site. In XP, IPv6 is included, but is disabled by default. A single command enables it. My understanding is that in Vista, IPv6 will be enabled by default.

Honestly, we're going to run out of new IPv4 addresses to hand out in a few years. We need IPv6, and I think Microsoft would be foolish not to enable it by default in Vista.

Re:Windows IPv6 support

[A5un]

Yes, you can install IPv6 stack for WinXP with a single command. However, the stack does not support DNS query in IPv6 (not AAAA query via IPv4), which kind of destroy the hope of deploying pure IPv6 network.

Re:Windows IPv6 support

[shani]

However, the stack does not support DNS query in IPv6 (not AAAA query via IPv4), which kind of destroy the hope of deploying pure IPv6 network.

You don't need a "pure IPv6 network".

You can give private IP addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to users' computers for talking with your recursive DNS servers.

They can use IPv4 to talk to your DNS server, and IPv6 to talk to the Internet (or anyplace else they need a globally unique IP address).

Of course, you'd need to use non-Microsoft software on your recursive DNS servers. But BIND runs on Windows, so it's not a huge problem. :)

Re:Windows IPv6 support

[TubeSteak]

we're going to run out of new IPv4 addresses to hand out in a few years.

I agree with you that it'll happen in the long term.

BUT, in the short term, (w/c)ouldn't the shortage be helped by redistributing some of the address floating around unused on Class A & B networks?

It's funny, because some of the arguments made by Class A holders against giving back their block, is that they don't want to spend the time & money and/or go through the hassle of renumbering their networks if the arrival of IPv6 is going to moot the issue.

And of course, nobody wants to spend the money to implement IPv6 unless they have to.

Re:Windows IPv6 support

[StormReaver]

"Honestly, we're going to run out of new IPv4 addresses to hand out in a few years."

It's certainly hard to see a crisis looming when AT&T is handing out static IP addresses like they're candy. I recently had the desire to host my own Internet presence, so I called AT&T to get a static IP address for my DSL. The cost was only $20/month above what my dynamic DSL account was costing. When the technician came over to reset my modem (AT&T policy, despite the simplicity of the procedure), he handed me a card with my addresses -- all 8 of them. That was a great day.

Re:Windows IPv6 support

[cyborch]

The cost was only $20/month above what my dynamic DSL account was costing

$20 extra for a static ip? That's hardly cheap. Here in Denmark I pay a whopping approx. $1 extra for a static ip. But then again 20Mbit connection is merely approx. $100 a month, if you want it.

Re:Windows IPv6 support

[hswerdfe]

dyndns.org

Re:Windows IPv6 support

[peterpi]

We've been running out of IP4 addresses for years now.

Has anybody got the equivalent of one of those scary 'peak oil' graphs that'll tell us when it's genuinely going to start becoming a problem?

Re:Windows IPv6 support

[TDRighteo]

What you're missing is that the cost of that static address is administration (and pure profit), not rarity. Dynamic IPs on ADSL don't save ISPs all that much IP space. Most people have always-on routers these days, not USB modems, so 80%+ users are always connected. Your dynamic IP isn't NATed, so you might be using up as much as a 1/5th of an IP by buying a static one. Big deal, when that same IP could have been used up by somebody on a cheap entry-level plan that costs only slightly more than your $20/month.

The problem comes with ADSL is that you have to have the IPs to be in the game. You need static IPs for everybody (not because you couldn't NAT, but because users expect a REAL IP) which means a /16 only buys you about 65024 customers. (Some networks don't like you handing out IPs that look like broadcast or network addresses in a /24, so you'd be lucky to use the full 65536 IPs.)

So, even with migration from dialup, usage is going up, and if current trends continue then IP space is going to get rather tight from all the ADSL users.

Re:Windows IPv6 support

[Anonymous Coward]

Honestly, we're going to run out of new IPv4 addresses to hand out in a few years.
 

Didn't NAT mostly solve this problem in the late 90s?

Re:Windows IPv6 support

[nevesis]

Actually, that's pretty much FUD. We won't be running out of IPv4 addresses anytime soon, even with our current allocations. ARIN has about 12% free, RIPE 4%, APNIC 7%. Current routing utilization ratio is high with ARIN, but I digress.

Here is my point, a simple reallocation would solve many of our problems. For example, there are a number of /8s which are simply UNUSED. We could also reallocate and force some people to use NAT but that is another story.

Below are some of the most interesting numbers for various /8 blocks:

IANA /8 blocks that are listed as allocated, but that are not routed at all:
      9/8 - IBM
      11/8 - US DoD
      19/8 - Ford
      21/8 - DDN-RVN (US DoD)
      22/8 - DISA (ARPANET; US DoD)
      26/8 - DISA (ARPANET; US DoD)
      28/8 - DISA (ARPANET; US DoD)
      29/8 - DISA (ARPANET; US DoD)
      30/8 - DISA (ARPANET; US DoD)
      46/8 - BBN (now L3)
      46/8 - Prudential
      51/8 - UK Department of Social Security
      54/8 - Merck
 
/8 blocks with least amount of routed space (but at least some):
      6/8 (US-DOD) - 2% routed
      25/8 (UK Royal Signals and Radar Establishment) - 1% routed
      60/8 (APNIC) - 1% routed (one /20)
      34/8 (Haliburton) - 1% routed (one /16)
      43/8 (V6NIC.NET) - 4% routed
      52/8 (DuPont) - 1% routed (320 /24 blocks)
      56/8 (US Postal Service) - 1% routed (160 /24 blocks)
      154/8 (Internic Legacy) - 4% routed
      188/8 (Internic Legacy) - 1% routed (one /16)
      201/8 (LACNIC) - 1% routed
      222/8 (APNIC current) - 4% routed

Re:Windows IPv6 support

[squiggleslash]

We already did run out of IP addresses years ago. Most computers connected to the Internet don't even have "real" IP addresses, most of us are using NAT.

For most of us, only the machine or machines that directly communicate with the ISP, plus some outside facing servers, have real IP addresses. NAT has proven to be a great hack that's got us by for a while, but with the rise in VoIP and other applications that are having difficulty "just working" when they can't just hook up to a network and expect to be addressable, this problematic and far from ideal hack is showing its flaws.

Re:Windows IPv6 support

[Achromatic1978]

A couple of years when I was with BigPond Direct (designed for permanent connections), they'd give you up to 64 IP addresses without justification, even on a dialup connection. Them were the days.

Re:Windows IPv6 support

[Anonymous Coward]

Even that's not cheap. I got a /28 for a one-time fee of 20 EUR which they even neglected to collect. No monthly costs.

Re:Windows IPv6 support

[Anonymous Coward]

60/8 (APNIC) - 1% routed (one /20)

Looks like old data you're posting. That /8 has been very much populated since.

Re:Windows IPv6 support

[pe1chl]

Here in the Netherlands a static IP is standard for almost all DSL lines, and the dynamic addresses used on cable are almost always "fixed".

It is convenient for the provider and law enforcement, because they can easily track a subscriber's behaviour by his fixed address.
Also, it would not be possible to save addresses by using dynamic assignment, as these services are always-on. Usually the modem/router keeps the connection, even when the connected PC is off. So you would have to reserve an address for every subscriber anyway.

Re:Windows IPv6 support

[Anonymous Coward]

Exept, sadly, today I found out about the 'fixedness' of my IP address. For 4 years it seemed static. Today it got changed...

Re:Windows IPv6 support

[Douglas Goodall]

Interesting who got the /8's... Haliburton, Merck This could use some review

Re:Windows IPv6 support

[Schraegstrichpunkt]

Honestly, we're going to run out of new IPv4 addresses to hand out in a few years.

We have already run out of IPv6 addresses. That's why we have NAT, which completely breaks the end-to-end model of the Internet.

Once IPv6 deployment is widespread, we'll finally be able to quit pretending that HTTP is a transport-level protocol.

Re:Free Rides

[heatdeath]

Microsoft should pay the existing, independent DNS server operators to subsidize scaling for the traffic their products create. MS is making $BILLIONS off the Internet; they should reinvest more in its infrastructure.

Senator Stevens, is that you?

Likely set to both

[jd]

Hey, I'd love it if Microsoft's Vista was going to take out the Internet - it would discredit Microsoft on a near-permanent basis. However, even if that were to happen, it won't happen because of DNS or IPv6. IPv6 is not going to put any kind of significant load on anything. Now, it might put a teensy little bit of strain on ISC's BIND, because the reverse DNS record is written in a really crappy format, with a dot between each hex digit. That means that there's going to be a little more text processing involved in converting an address into a name. Forward searches - which are the bulk of them - act exactly as normal.

Sure, you might get a little extra latency, as the servers parse an IPv4 request prior to an IPv6 one, where the record type required is explicit. Such searches could double the time it takes to get a result. However, doubling a secong gives you two seconds, so I don't feel this is going to prove too stressful.

A bigger problem will be badly-written software that tries to open all connections over IPv4 and waits for a timeout before trying IPv6. This will hang the machine, though, not the Internet. No other user is going to notice or care.

There is one - and only one - way that there could be a problem, and that would be if Vista's IPv6 implementation is broken such that it assumes an absurdly small timeout and therefore floods whatever it is trying to talk with in an unintended DoS attack. Even then, most routers are designed to squelch over-active sources, so the impact of such a flood would be negligable.

Vista doesn't do harm....

[mtmra70]

Vista doesn't overload DNS servers....people overload DNS servers.

A few more comments...

[davidu]

It's also worth pointing out that while Vista might come out on a single day it won't be rolled out in a single day -- it'll take months to years to rollout.

So even if there is an increase in DNS load because of the AAAA before A DNS requests it won't cause rolling blackouts or major network failures.

FWIW, we see about 20% of our requests as AAAA requests. I don't have the number of those that are retried as A requests but I'd guess it's pretty high since we aren't (yet) listening on IPv6 interfaces. We do support AAAA dns requests, of course.

-david

Re:A few more comments...

[jamesh]

I don't think DNS is really the problem. It's more likely that the internet will come to a standstill as everyone fires up their bittorrent clients and starts downloading a copy!

So... i predict the end of the internet... you heard it first here :)

I have a solution

[Quiet_Desperation]

Take the average and use IPv5. :-) IPv5 don't get no love.

I saw this

[Anonymous Coward]

YESTERDAY!!!!!!!

sorry, but its old news.

DNS Overloads

[Anonymous Coward]

I for one welcome our new DNS overloads.

Mac users sigh.

[DoctorDyna]

Although Vista will more likely be widespread, I hope everybody realises that IPv6 was implemented in OSX quite some time ago. Or is Vista's implementation different somehow?

Re:Mac users sigh.

[geekoid]

As I understands it there are a couple more Wintel machines then Mactel* machines.

Personally I think it's a non-issue, but that's the only reason I can see for a difference.

*you heard me, Mactel.

Re:Mac users sigh.

[SEMW]

Ah, but you misunderstand the point. When Apple implemented it, they were making their software more compatible, more forward looking, and more future-standards compliant. Microsoft, despite doing exactly the same thing, are clearly doing so in order to maliciously slow the entire internet down to a crawl. Isn't it obvious?

Re:Free Rides

[Doc Ruby]

You spelled "Ed Whitacre" wrong.

Wanting MS to pay for the load it creates when it makes money isn't the same as forcing it to do so, as AT&T/Verizon/backboneISPs want. It's simple economics, said by a private individual not wielding either a telecom cartel or the Senate.

complete rubbish

[atarione]

i did wonder why my win2k DNS server went down right after installing Vista RC1?????...... oh wait no it didn't

the FUD to Reality ratio of this story is very high indeed... actually 99% FUD.

Vista will not even make IPv6 DNS requests unless you have an IPv6 address for the machine.

Non-news?

[CCFreak2K]

And there was one guy who said the introduction of Windows XP and its raw sockets API would allow programs to "generate the most damaging forms of Internet attacks." And we all know that the Internet fell apart because of that, right?

FUD.

Re:Non-news?

[Anonymous Coward]

Microsoft disabled raw socket support in XP SP2 to prevent exactly those types of attacks as outlined by the grc site.

http://www.microsoft.com/technet/prodtechnol/winxp pro/maintain/sp2netwk.mspx

"This change limits the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets, which are TCP/IP packets with a forged source IP address."

Not so FUD after all.

Re:Non-news?

[j79zlr]

Right, there wasn't an explosion of zombie bots after WinXP and the increase in availability of broadband. Oh wait, yes there was.

Re:Non-news?

[mgblst]

So what is your logic?

Once, somebody was wrong, therefore everybody is wrong?

Once, somebody talking about a new version of Windows was wrong, therefore everybody talking about a new version of windows is wrong?

Once, somebody warning about a problem with a new version of Windows was wrong, therefore everybody warning about a problem with a new version of Windows is wrong?

Sorry, can't make it work anyway you spin it.

You aren't an IT manager, are you?

Just scr|ptk|dd|3 advertisement

[Anonymous Coward]

Now, buy Windows Vista and help ur cr3w to overload teh |nnerw3b.... LEGAL!1

OMG, lolz WTF?!

No Content...

[Anonymous Coward]

...with slowing your personal computer to a crawl with useless services and features, M.S. expands its lethargy to the Internet.

Had 1st hand experience in brining down my LAN

[priyajeet]

http://www.dslreports.com/forum/remark,15701298?hi lite=vista My router just killed the entire network, after I was on Vista for like 10-20 minutes.

Ah yes, "scaling"

[postbigbang]

First, let's take a look at Vista uptake and adoption: not too fast.

Secondly, let's take a look at how many sites are IPV6 now: not too many, in fact, darn few at all.

Thirdly, let's see how many routers are enabled to do IPV6: gosh, nearly all of them. Jolly good, that.

Fourthly, let's see how DNS calls work, whether IPV4, or that gnarly IPV6 stuff: generally, calls are routed to a local segment DNS server. That silly little server actually does something called (yes, that's right!) cacheing addresses, only going upstream to get new stuff! Great! A little binary tree code goes in and looks things up for us; it's nice, really.

Let's say you're a consumer on an ISP network-- say Comcast. The old Comcast people will have to put up a little hardware to do the DNS work. Jolly nice of them, eh? Perhaps you're at a desk in a megacorp-- well you're likely using that Microsoft Stuff to do your DDNS work; in turn, it goes upstream, too. Perhaps you don't use that silly Active Directory stuff and you do BIND. Clever you-- you're already there and it's been working all along.

And IPV6 is simply insane, no matter how measured. Yet we can deal with it because some unbelievably stupid twit said that we can't NAT anymore. This person's place in hell is already reserved. The IETF..... oh, let's don't go there.

How IPv6 DNS works.

[mikeal]

Nobody seems to understand how IPv6 DNS works.

First off, when your box asks for any address from your dns server, the dns server hits the public internet root name servers and gets the Start of Authority (SOA). This tells your dns server (or you if you wanna set up one locally) where to get DNS information for that domain. None of that changes with IPv6.... NOTHING. It can still make all of those requests over IPv4 and it doesnt' matter and it will never duplicate the requests.

Now that your dns server knows where to get the zone file for that address it goes and gets it from the SOA. If both IPv6 and IPv4 are supported then you'll have a main A record and main AAAA record (quad A) in that zone. Which ever one comes first should be the one that is honored, this is so that the people who own the domain can specify if they prefer you to use IPv6 or IPv4 (Note: WindowsXP has a bug in which it ALWAYS uses the IPv4 address if one exists).

So the increase in traffic is only between you and your dns server if the dns server is configured to get the entire zone file and not just query for a single entry (this is the proper way to configure a dns server that intends on supporting IPv6 because if you don't get the entire zone file then you don't know which protocol to prefer, it's also just a good idea and you should be getting the zone's TTL and honoring at well -- I'm anal about this by the way). If your dns server is configured to query for each entry then the traffic is only between that dns server and the start of authority. So this will not increase the load on the world wide traffic to root name server AT ALL.

Re:How IPv6 DNS works.

[TCM]

if the dns server is configured to get the entire zone file and not just query for a single entry (this is the proper way to configure a dns server that intends on supporting IPv6 because if you don't get the entire zone file then you don't know which protocol to prefer

That's just plain wrong. Getting the whole zone file is done via AXFR requests and should only be allowed for slaves of the server. No client will ever do an AXFR to query a record.

The preference of IPv6 vs. IPv4 is done by the client only. If it wants IPv6 first, it will ask for an AAAA record first.

Your first sentence is true, I'm afraid.

Re:How IPv6 DNS works.

[thegameiam]

minor nitpick - the XP IPv6 stack bug isn't that it always uses IPv4, it's that it NEVER uses IPv6 for DNS queries. I verified this through lots of testing recently, and it totally cheesed me off... :(

And here I was so happy that they included the auto-config fec0:0:0:ffff::1 - 3 DNS server addresses, but XP won't send a request either to them or to a manually configured V6 server.

-David

Re:How IPv6 DNS works.

[mikeal]

You can make a request for a AAAA record over IPv4 though. So it's not a HUGE issue, just a big annoyance.

Oh noes...

[araemo]

So lets see if I'm understanding this right. Dude who sells DNS server software, is saying that an extra DNS query now and then is going to cause 'massive slowdowns'.

Maybe in user interaction. Perhaps, once IPv6 is used now and then, that second dns query will cause an extra 100 ms delay on top of the first 100 ms delay for the first dns query.. causing a human-noticeable slowdown after clicking a link.

This is a slowdown due to round trip times, not because of bandwidth or processing limits. More sequential round trips = more latency. Nothing new. And the second time you visit a given site? It's cached, no round trip at all. So yes, people might, maybe, kinda notice a difference.. on the first visit to a given website on a given reboot of their computer.

But I don't think an extra lookup will be a huge inconvenience even given the sorry state of ISP dns servers(Which, in my experience, aren't that bad unless they can't look up an address. Timeouts are are bad, mmkay? The correct response is nxdomain, not 'server did not respond' 'lets try the next!' 'server did not respond'.....

Re:Oh noes...

[LinuxDon]

Quote: "Maybe in user interaction. Perhaps, once IPv6 is used now and then, that second dns query will cause an extra 100 ms delay on top of the first 100 ms delay for the first dns query.. causing a human-noticeable slowdown after clicking a link."

I am using IPV6 here at home with Firefox on Linux.
I have not once noticed a slowdown, also because everything gets cached.

Having used "host -v -t aaaa www.sixxs.nl" I can see that a DNS lookup takes 53ms when it's not cached (first page), and it only takes 2ms when it's cached (following pages).

ipv6

[towsonu2003]

Ubuntu has ipV6 too (and it causes headaches for end-users). So what? Is it M$' fault that their OS is popular (more computers probing ipV6 stuff)? Would we see the same news if Ubuntu was the popular thing? I'm probably missing something crucial...

Article is stupid

[guice]

The author of the article is just finding an excuse to hit against Vista. I'm no where defending Vista, but we DO need to move into IPv6 and the only way to do that is to overcome this hump.

There is no fear. Really. IPV6 is still insane.

[postbigbang]

Let's see. You say:

"IPv6 makes routing much easier because most of those addresses won't be allocated to anything"

How droll. Do you realize what you've said in justification? Have you done router tables, ever?

Then, you say:

"They serve to keep the address space non-fragmented, so routers will have much smaller routing tables"

Sure. A lot smaller. The number of devices needing unique addresses will shrink and that's why IPV4 is "....about ugly, look at NAT and CIDR and the hack.." In fact, using NAT and CIDR blocks works charmingly-- any number of times, depending on custom and internal whimsy.

The Internet won't be glued together, address-wise, differently in IPV4 v. IPV6. For a while, there'll be nice and cute sorts of blocks doled. Then it will go to hell again, and tables will need to be done that cycle away dirty cache just as is done today. ARP works with both, and therefore can be messy with both (although admittedly, it's tougher to screw up in code w/IPV6).

"...things nicer and cleaner" comes with a beyond-exponential increase in the size of the addressing space. It is without a doubt in my mind, ludicrous. The special place in hell reserved for the numbskulls that wrote the spec will become historical.

Re:There is no fear. Really. IPV6 is still insane.

[TCM]

I realize there are always people afraid of change because they don't understand it. Luckily, they become obsolete while the rest moves on.

Have you done router tables, ever?

If you had and had understood what I wrote, you wouldn't be asking.

ARP works with both

There is no ARP with IPv6.

Why don't you go inform yourself before you go on crusades against things you don't understand?

Re:There is no fear. Really. IPV6 is still insane.

[Schraegstrichpunkt]

How droll. Do you realize what you've said in justification? Have you done router tables, ever?

This has got to be some of the most transparent, amateur trolling that I have ever seen. Have you ever "done router tables"?

Larger addresses mean that you can aggregate blocks of network addresses. My current small-ish ISP has several IPv4 netblocks. A cursory search brings up at least 4 netblocks, including: 65.x.x.0/19, 24.x.0.0/17, 24.x.128.0/20, and 204.x.x.0/24. That's 4 entries in every defaultless Internet routing table in the world! This happened because the ISP has been assigned various small address blocks as it grew.

Under IPv6, my ISP would have been assigned a huge netblock in the first place. As a result, there would be at least a four-fold decrease in the number of routing table entries needed worldwide to route packets to my ISP. Also, since my ISP's addresses might form a logical subnet of the addresses of one of its upstream providers, there would be a good number of sites on the Internet that don't need to have any routing table entries for my ISP at all, since the entry could be folded (presumably by the BGP server) into the upstream routing table entry.

Obligatory

[chord.wav]

I for one, welcome our new DNS overloads!

NAT will always be needed

[Anonymous Coward]

Even if everyone changed over to IPv6 tomorrow, ISPs like Comcast will still charge for extra IP addresses.

Never happy...

[4D6963]

Come on, it's about time Windows adopts IPv6. We would criticize Vista if it didn't, and as it does we criticize it for it anyways. I'm as pro-M$ as the next /.er but sometimes part of the geek crowd won't even let M$ a chance.

SlashFUD

[^_^x]

This just in: Windows Vista will eat your babies! When questioned about this controversial new "feature," the spokesman from Microsoft cackled nefariously while scheming how to bring and END TO COMPUTING AS WE KNOW IT!

Stay tuned for our coverage of how to completely root Vista RC1 using only a TI-82 graphing calculator, and $500 of everyday electronic components.

Experts Agree: This is BS

[Effugas]

This is Dan Kaminsky, from the article.

Here's what I threw on my blog on this matter. Note, the fact that this got presented as even a debate annoyed me enough to start posting on my site again.

--

Paul Mockapetris says Vista is going to take down the Internet's DNS infrastructure. Paul is the inventor of DNS; I met him at Black Hat last year and was half starstruck, half relieved he didn't hate me for the things I'd done to his creation :) Paul knows DNS. It's his creation. But you'll note in this story that Joris Evers can't actually find anyone who agrees with Paul.

There's a reason.

First, while there are indeed a couple underprovisioned name servers, there's far more that have lots and lots of slack capacity. You need slack capacity to deal with shock load. The networks that would fail because of Vista's release, would fail because of a three day weekend.

Second, Vista's not getting deployed all at once. This is no service pack that's deployed to a hundred million desktops via Windows Update! Mockapetris is correct in that there will be a noticable increase in DNS traffic, but that increase will be spread out over the course of a couple years. Slow increases like this tend not to cause the sort of catastrophic failure that Mockapetris refers to.

Finally, and most importantly (in the sense that Mockapetris should know better): Most of the work done to service the IPv6 request, is cached and available to service the IPv4. To complete a DNS lookup, you have to locate a particular server, known as the authoritative server for a domain. The same authoritative server that hosts the IPv6 (AAAA) record also hosts the IPv4 (A) record. So even if Vista sends twice the traffic, the upstream nameserver is certainly not experiencing twice the load.

Full disclosure: Microsoft has had me looking at Vista for much of this year, as part of their "Blue Hat Hacker" external pen-testing squad. But then, Mockapetris has written a really impressive name server for his company, Nominum, that can handle about 4x the load of BIND. But this isn't about who we are; it's about what is or isn't going to collapse. There are things to worry about. This isn't one of them.

As rarely as I can say it...

[Belial6]

As rarely as I can say it, MS seems to be doing EXACTLY what should be done. In fact this could be the tipping point that moves us from IPv4 to IPv6. With 95% of the worlds desktops using IPv4 exclusivly, it made no sense worrying about IPv6 in the routers, and it would have been suicide to go to a pure IPv6 implementation. With Vista, most people will, in a few years, upgrade to Vista, switch to Linux or OSX, or be ready to accept being cut off from direct access to the internet. That means that 95% of the worlds desktops with be IPv6 first and formost, and ISPs can confidently move to an IPv6 backbone without fear of cutting off their customers.

Either way, I don't think that NAT is dead. It might change form a bit, but those in control of the numbers are not likely to just start giving them away, just because they have an over abundence of them any more than the Media Barons just give out music just because they have an over abundance of copies of that.

IPv6 + XP = Broken

[thegameiam]

I disagree that it's not a huge issue: it means that you can't actually deploy an IPv6-native (i.e. no IPv4) service where there are ANY Windows XP hosts, unless you want to distribute host files (brrrrr....) or have some god-awful tunnelling enabled.

-David

Remeber 2002

[SlOrbA]

Didn't we get this thing tested in 2002. Haven't we learned anything? or has it all been forgotten?

http://www.internetnews.com/dev-news/article.php/1 486981

Even when Vista comes out it won't have instant effect on the over all system, but the load will grow in time and the system will have to be customed for that.

So it SUPPORTS a standard, and that's bad?

[CFD339]

IPv6 has been waiting in the wings for how long? Why? More hardware, software, and routers need to support it. Now, MS comes along and supports it. This is reported as bad?

What can they do that won't get negative commentary on /.? I'm not a fan of MS overall, and prefer linux on my servers -- but c'mon people.

Re:So it SUPPORTS a standard, and that's bad?

[robertjw]

I don't think this particular issue is a conspiracy against Microsoft. IPv6 hasn't been implemented because no one is willing to take the plunge (and responsibility) and commit to it. Concerns like those expressed in this article are EXACTLY why IPv6 has been waiting in the wings.

If you want to chastise readers for something, chastise them for the negative commentary on IPv6.

Re:So it SUPPORTS a standard, and that's bad?

[Anonymous Coward]

Hopefully the makers of DSL routers will now support IPv6 as I have had a Dlink router fail to work with some linux apps because it does not support IPv6

At the risk of further insult....

[postbigbang]

Please see, as an example, http://www.technologyreview.com/read_article.aspx? id=13426&ch=infotech which was featured here at /., in early 2004. What you also didn't know is that I was building computers with discrete transistors forty-three years ago; I suspect you might have been in diapers at that time. And at least we agree about Ontrack, the greatest destroyer (IMHO) of data ever to grow in Minnesota. IPV6 allows highly discrete addressing. IN fact, unbelievable and untenable discrete addressing. No-UNFATHOMABLE addressing. Apologists think that we just have to swallow it. TFA implies that Vista will cause problems; nay I say to that. IPV6 is the tragedy here; Vista is small potatoes by comparison.

Re:At the risk of further insult....

[vadim_t]

Ok, then you're way too attached to the old times. Nobody I know gives a damn about a couple percent extra overhead in network traffic (especially when the available bandwidth keeps growing, and my ISP upgrades it for free once in a while), however, everybody loves the idea of getting rid of NAT, having a /48 for themselves, automatic address configuration, and lots of other nice things that come with IPv6. Probably also lower ping times, due to improved routing. I wish they also upgraded the port numbers to 32 bits, but ah well.

IPv6 means your TCP packets will get 20 bytes larger. That means that your downloads will take about 1.5% longer. Oh the horror!

Re:At the risk of further insult....

[Schraegstrichpunkt]

What you also didn't know is that I was building computers with discrete transistors forty-three years ago; I suspect you might have been in diapers at that time.

You realize that you've completely discredited yourself by writing that, right? You've shown that even though you really should should know better, you don't.

Pointing to an article that has somebody summarily dismissing IPv6 (which was a perfectly legitimate thing to do in 2004, but not anymore), when IPv6 is in fact being deployed, does not help your case. Using inappropriate terminology doesn't help either.

What does assembling now-obsolete computers have to do with IP networking, anyway? You might as well have said that you have a Ph.D. in Mathematics. While possibly impressive, it's irrelevant to the topic at hand. You're outside your field of expertise.

IPv6 is happening whether you like it or not. Yes, there might have been a better way to handle the transition (which clueful people like Dan Bernstein have already discussed), but it's happening and for good reasons.

Overload the DNS?

[eniacx]

Before freaking out. Look at their algorithm.

From TFA:
"""For example, Microsoft designed Vista so PCs will query in the address of the type assigned to the system, the company said.

Computers that don't have an IPv6 address will not do IPv6 queries, the company said.

Also, when a machine does do an IPv6 query, it will do so only to a DNS server that responded to its initial IPv4 query, the company said. "Name errors are not repeated, so the Net traffic will less than double," it said."""

IPv4 space exhaustion

[shani]

Why yes, Geoff Huston has analyzed the problem pretty thoroughly:

http://www.potaroo.net/tools/ipv4/

So, we're looking at just under 6 years.

BTW, Geoff Huston is a guru.

MSFT could return its 22,000,000 IPv4 addresses

[Anonymous Coward]

- i mean, they have how many addresses per employee?

Oh noooo

[lookatthesun]

Not the series of tubes, noooo!

I, for one...

[kantier]

... do not welcome our new MS overloads.

Not the real problem

[rs79]

A friend of mine sent this to me this morning when we were discussing this:

"I manage the operation of about 70% of the world's root DNS servers, and run authoritative TLD servers (mostly secondaries) for about 30% of the world's TLDs (mostly CCtlds). We measure carefully.

IPv6 isn't even 0.01% of the total, and doesn't matter.

The real load on name servers comes not from IPv6 but from Windows machines flooding the world with RFC1918 in-addr requests and with lookup requests in the .LOCAL TLD. The last time I looked, about 40% of the traffic to global name servers was this bogus windows shit. If Vista fixes that, then its release will be a net positive.

We started and sponsor the AS112 Project ( http://public.as112.net/ ) to try to mop up some of the Windows mess. No one believes that we'll need to extend it to IPv6, but we're paying attention."

He is of course right, the nonsense windows does has been a problem for years.

EVIL MICROSOFT.....MUHAHAHAHAH

[TiggertheMad]

I like how the article is worded to blame Microsoft, as if they had some control over the issue. MS isn't releasing anything that is orders of magnitude less efficient that say and open source solution to the IP4/IP6 problem, so why are they being painted as villians here? If LINXU was on 90% of all home systems and started migrating to IP6, would this rate the same sort of hatchet job? Yes, there may be increased loads generated for DNS servers by all the PEOPLE switching over, but this is hardly Microsoft's doing. Lets not waste time demonizing them for something that isn't their fault, when we can be blasting them for trying to take over the Internet by destroying Netscape with predatory monopolistic bisiness practices...

NAT no security?

[phooka.de]

Of course NAT has nothing to do with security. All those worms probing specific ports for known vulnerabilities are not stopped at all be the fact that NAT hides the unused but open ports to the outside world and redirects the others.

Bullshit.

NAT does help against a certain sort of attack. Maybe only against this sort of attack. Fortunately, against the propably most common sort of attack you can't do anything about. (You can to something about infected websites: use a different browser).

Security is not binary, it's relative. NAT adds yet another bit of security for your computer. Can you feel save with NAT only? Hell, no! Can you feel saver than without NAT? Ask my Windows-using friends that hook their machines up to the net directly how many times they had to reinstall windows untill they could download the security fix from MS faster before they were hit again. Can't remember which worm it was (it khad a bug in its implementation and kept rebooting the machines, you'll know which one I mean). I'm not running Windows, so I didn't care. But fior them NAT would have been a good protection at the time.

FUD about M$ for a change

[Douglas Goodall]

It is interesting that this particular FUD is pointed at Microsoft.

Deja vu

[cortana]

This reminds me of Steve Gibson's predictions that the 'Raw Sockets' capability of Windows XP would bring the Internet to a standstill.

question

[Anonymous Coward]

how can (a) dnserver(s) fail before (a) router(s) fail?

"weeee lets route the position information for
each atom in the universe and then start
giving them individual names"

NAT won't die. NAT is a blessing. NAT is like
a smart diode (and i'd say like a tubeless AC
to DC converter but i don't understand enough about that).

i have ipv6 installed on my network; BUT my dsl"router"
doesn't understand ipv6. im guessing my isps routers don't either.
trouble-shoting ipv6 connectivity is a b1tch.

ping fe80::226:54ff:...etc. anyone?
local DHCP and DNS are gonna come in real handy tho. (i can see the
exploits already; once joe-user maps a ipv6 address to something like
"192.168.0.1" t-hehehe...)