Subject: Dynamic DNS at the 53rd IETF

From: Jakob Schlyter <[email-masked]>
Date: Wed, 27 Feb 2002 17:27:22 +0100 (CET)

At the 53rd IETF in Minneapolis, the network will be running with dynamic
updated reverse DNS.

If configured on your laptop and at your home name server, this will
enable you to get a dynamically allocated address which has your own
domain name both in the forward zone and in the reverse zone.

IETF participants that wish to take advantage of this feature may find
detailed instructions at the following URL:

  http://ops.ietf.org/dns/dynupd/secure-ddns-howto.html

Questions regarding setup can be sent to <[email-masked]>.

	jakob

---

From: Keith Moore <[email-masked]>
Date: Wed, 27 Feb 2002 12:42:09 -0500

> domain name both in the forward zone and in the reverse zone.

Fantastic.  My laptop's DNS name is lust.indecency.org.  Please arrange 
for the records for that zone to be dynamically updated every time you 
assign it a new IP address.

Keith

---

From: [email-masked]
Date: Wed, 27 Feb 2002 13:00:23 -0500

> assign it a new IP address.

What? No DNSSEC? ;)

---

From: Randy Bush <[email-masked]>
Date: Wed, 27 Feb 2002 10:29:19 -0800

> assign it a new IP address.

if you read the web page, you will see that YOU are the one who needs to
do configuration, on your laptop's dhcp client and your forward domain's
dns primary.

what jakob's message was saying is that the in-addr.arpa and ip6.arpa
zones will be correctly configured to work with the ietf net's correctly
configured dhcp server.

randy

---

From: Randy Bush <[email-masked]>
Date: Wed, 27 Feb 2002 10:33:08 -0800

> What? No DNSSEC? ;)

if you *read* the web page, you will find a setion labeled "Updating
Signed Zones" in the "5. Limitations and Possible Complications" section.

this stuff is not yet made simple.  it's been enough fun to make it work
reliably.  folk will probably actually have to read the doc.

randy

---

From: [email-masked]
Date: Wed, 27 Feb 2002 13:45:28 -0500

> Signed Zones" in the "5. Limitations and Possible Complications" section.

Yeah - I just wanted to make sure people understood it's *not* as simple
as Keith's note made it sound...

> reliably.  folk will probably actually have to read the doc.

Been there, done that.  Am using dynamic updates for the forward pointer
for my home machine, still trying to get a good solution for the PTR
entries (getting something to detect that my host's modem has hung up
and make the PTR go away is the challenge).

/Valdis

---

From: Keith Moore <[email-masked]>
Date: Wed, 27 Feb 2002 13:49:45 -0500

> zones will be correctly configured to work with the ietf net's correctly

Thanks for the clarification.

I appreciate the effort that has been made to set this up, and I'll 
look forward to seeing whether it really does make a useful difference.

Keith

---

From: Randy Bush <[email-masked]>
Date: Wed, 27 Feb 2002 10:57:40 -0800

> look forward to seeing whether it really does make a useful difference.

you may remember that, in summer '95 stockholm, my laptop was the dhcp
server in order to demonstrate dhcp worked and was useful.  a year or two
later, we were annoyed when we landed in a new location and dhcp was not
working.  we are hoping that this exercise will do the same for dynamic dns
update with dhcp.  (and in this case, i do not plan to donate my laptop:-).

the key to playing successfully at minneapolis is to configure your home
forward dns server now, before you fly.  and if you need help (*after*
reading <http://ops.ietf.org/dns/dynupd/secure-ddns-howto.html>) whine at
<[email-masked]>.

note, folk not running unix or linux will not be able to play.  we still
need a hack to make the windows dhcp client wiggle.

randy

---

From: Keith Moore <[email-masked]>
Date: Wed, 27 Feb 2002 14:00:52 -0500

>  we are hoping that this exercise will do the same for dynamic dns
> update with dhcp.

I guess my question is how valuable this is.  As far as I can tell,
stable DNS names are of limited utility unless the underlying IP 
address(es) are also stable.  But the best way to find out is to
try it, and I'm glad to have the opportunity to do so.

Keith

---

From: Pekka Savola <[email-masked]>
Date: Wed, 27 Feb 2002 21:59:07 +0200 (EET)

> need a hack to make the windows dhcp client wiggle.

What about people who have zero intention to run either IPv4 or DHCP?

(no I didn't read the document except to check it didn't mention ip6 :-)

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Randy Bush <[email-masked]>
Date: Wed, 27 Feb 2002 12:21:08 -0800

> What about people who have zero intention to run either IPv4 or DHCP?

sorry, if you READ THE DOCUMENT, you will see that this is a dhcp-dns
experiment.  if you don't run dhcp, or don't run dns, sorry.

randy

---

From: Jakob Schlyter <[email-masked]>
Date: Thu, 28 Feb 2002 01:16:34 +0100 (CET)

> What about people who have zero intention to run either IPv4 or DHCP?

the part of the document that describes how to update the forward zone may
be applied to IPv6 as well as IPv4 (although the actual scripting needed
is left as an exercise for the reader).

updating the IPv6 reverse zone for people using autoconfigured addresses
is another problem as we have no local server doing the update. let us
solve one problem at a time, ok?

	jakob

---

From: Michael Richardson <[email-masked]>
Date: Wed, 27 Feb 2002 18:53:34 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Keith" == Keith Moore <[email-masked]> writes:

    Keith> I guess my question is how valuable this is.  As far as I can tell,
    Keith> stable DNS names are of limited utility unless the underlying IP 
    Keith> address(es) are also stable.  But the best way to find out is to
    Keith> try it, and I'm glad to have the opportunity to do so.

  Again, we've had this discussion again and again - definitions of stable
vary from anything less than a month is useless, to 20 minutes is enough. 

  They key thing for me, if we can convince broadband operators that they
want to do this is that ordinary users will have control over their reverse
maps.  While PTR records might not be that sexy, KEY and KX records are!

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy");  [

---

From: Keith Moore <[email-masked]>
Date: Wed, 27 Feb 2002 21:18:58 -0500

> vary from anything less than a month is useless, to 20 minutes is enough.

What's this "we" stuff?    

I don't ever recall anybody bothering to ask application developers whether 
it was okay for DHCP servers (much less NATs) to break open connections.

Keith

---

From: Bill Manning <[email-masked]>
Date: Thu, 28 Feb 2002 02:55:50 -0800 (PST)

will there be the capability to support dyn update for 6bone delegations?

-- 
--bill

---

From: Pete Resnick <[email-masked]>
Date: Thu, 28 Feb 2002 12:35:13 -0600

On 2/27/02 at 2:00 PM -0500, Keith Moore wrote:

>address(es) are also stable.

I can think of several uses:

1. I'm in a place with lousy or expensive connectivity; maybe I'm 
running an installation at the south pole. My connection to the 
outside world is to an ISP with a limited number of IP addresses that 
are allocated as people connect up. I run an SMTP server for multiple 
users. I have an MX for my machine that points to a machine at my ISP 
that is on the net full time. Every so often, I dial up, connect my 
server to the net and give it the correct domain name, send an ETRN 
to my MX server and have all the mail dumped to my server. Then I can 
disconnect and all of my internal users can connect up by POP or IMAP 
to my server.

2. I want to have an instant message session with you. Instead of all 
of this rendezvous protocol stuff we're doing now, I just give you a 
domain name. It doesn't matter where I connect from; my domain name 
is dynamically updated. You find me by querying my domain name.

And I assume there are lots of variants of the above. A widely 
deployed dynamic DNS makes a good deal of service location protocol 
unnecessary. Seems like a good thing to me.

pr
-- 
Pete Resnick <mailto:[email-masked]>
QUALCOMM Incorporated - Direct phone: (858)651-4478, Fax: (858)651-1102

---

From: Randy Bush <[email-masked]>
Date: Thu, 28 Feb 2002 10:38:30 -0800

i use it so that hosts at home can run scripts such as

   scp foo laptop:

randy

---

From: Keith Moore <[email-masked]>
Date: Thu, 28 Feb 2002 14:02:51 -0500

> A widely deployed dynamic DNS makes a good deal of service location protocol

I don't have the slightest doubt that dynamic DNS is useful for some 
things, and I'm sorry that my earlier messages gave that impression.  
It's quite clear to me that, when a stable IP address is not available, 
having a stable DNS name is better than nothing.  

It's also quite clear to me that stable DNS names are not an adequate 
substitute for stable IP addresses, and that the existence of a service 
that can be used to update DNS names when IP addresses change should not 
be taken as an indication (for example) that it's okay for providers to 
change IP addresses at a whim, or that there's no need for platforms
to support mobile IP.  

(There's also a difference between what works for one individual and
what works for everyone.  You might find that dynamic DNS is perfectly
sufficient to patch up the lack of a stable address for your host and
for the applications that you run on that host, but this doesn't mean 
that it's suitable as a general-purpose mechanism.)

But I didn't see the folks who are putting up Dynamic DNS in Minneapolis 
making any claims to the effect that it was suitable for every purpose.  
They are just providing us with the opportunity to try this technology, 
which is entirely commendable.

Keith

---

From: Randy Bush <[email-masked]>
Date: Thu, 28 Feb 2002 11:14:28 -0800

> change IP addresses at a whim, or that there's no need for platforms

we eagerly look forward to you providing this technology, and maybe
even having an isp lynching or effigy burning at yokohama.  or do we
need to be more patient?

randy

---

From: Keith Moore <[email-masked]>
Date: Thu, 28 Feb 2002 14:20:12 -0500

> even having an isp lynching or effigy burning at yokohama.  or do we

patience helps.  one person can only do so much.

Keith

---

From: Randy Bush <[email-masked]>
Date: Thu, 28 Feb 2002 11:26:42 -0800

> patience helps.  one person can only do so much.

i figured i would help, probably be the lynchee.

randy

---

From: Keith Moore <[email-masked]>
Date: Thu, 28 Feb 2002 14:44:54 -0500

> i figured i would help, probably be the lynchee.

entertainment for the social event?  nah, I never attend such things anyway.

I'm far more interested in fixing problems than finding people to blame.
it's just that you can't fix problems while people are still in denial
that the problems exist.

Keith

---

From: Pete Resnick <[email-masked]>
Date: Thu, 28 Feb 2002 14:12:45 -0600

On 2/28/02 at 2:02 PM -0500, Keith Moore wrote:

>It's also quite clear to me that stable DNS names are not an 
>adequate substitute for stable IP addresses , and that the existence 
>of a service that can be used to update DNS names when IP addresses 
>change should not be taken as an indication (for example) that it's 
>okay for providers to change IP addresses at a whim...

I'm not sure I understand this. For most of the application layer 
protocols that I deal with everyday (SMTP, POP, IMAP, HTTP) , and a 
large class of similar protocols, a stable DNS name is perfectly 
reasonable substitute for a stable IP address. Do you think that 
there is not a huge class of protocols that can reasonably use 
dynamic DNS, or do you simply think that there are a significant 
number of problems for which a stable IP address is required?

>...or that there's no need for platforms to support mobile IP.

Now, there is no question that anyone who thinks it's reasonable to 
change an IP address when there exists an active connection to that 
IP address is just being loopy. This is an issue for mobile IP 
(leaving aside whether the current crop of mobile IP protocols is a 
good solution for that problem), but I don't see that as the problem 
that dynamic DNS is trying to solve.

pr

---

From: Keith Moore <[email-masked]>
Date: Thu, 28 Feb 2002 15:39:35 -0500

> number of problems for which a stable IP address is required?

Several popular protocols that meet certain criteria - the connection 
durations are short, etc - can indeed do okay with relatively unstable 
addresses as long as the name-to-address binding is kept current.
But this doesn't generalize to all or even most protocols, or even to 
all uses of the protocols you've mentioned.  

For instance, if you need to transfer large files over a slow/busy link 
via HTTP (or FTP) such that a file might require several hours to 
transfer, you may find that the connections break too often for dynamic 
DNS to solve the problem.  The same would be true for long email messages 
over SMTP.

Again, it's not that I have an inherent beef with Dynamic DNS. 
I just disagree that DNS names are suitable as a general substitute 
for stable IP addresses.

Keith

---

From: Theodore Tso <[email-masked]>
Date: Thu, 28 Feb 2002 15:45:25 -0500

> change IP addresses at a whim, or that there's no need for platforms

Perhaps.  Certainly stable IP address is preferable to being
constantly and needlessly renumbered all the time (although if the
practice became more prevelant, the silver lining is that it would
likely put an end to that abomination known as IP-address dependent
license keys).  So for static installations such as Cable Modems and
DSL lines, I agree with you, and I wish network providers would
provide stable IP addresses.

However, I much prefer DHCP plus DDNS to Mobile IP.  With Dynamic
DNS, the security model is well understood; I need only inform a
single host with whom which I have a trust relationship --- the DNS
server for thunk.org --- that the DNS address for my laptop should be
changed to 1.2.3.4.

With Mobile IP, the security model seems to be (in order to avoid
triangle routing), that I need to a secure messages to arbitrary
machines in the Internet, who then need to somehow magically know that
I am the person authorized to redirect traffic for 216.175.175.175 to
some other arbitrary point in the Internet.  (Amazon.com, buy.com,
yahoo.com, ietf.org, etc., etc., etc., etc. all needs to know that the
distinguished name in my X.509 certificate is authorized to speak for
216.175.175.175, and can redirect packets sent to that host to
far-flung places in the world like to Australia or Finland.  Yeah,
right.)

One is deployable (modulo a few minor bugs in the HOWTO document,
which I've been meaning to find time to write up and report, really I
have), and I've currently got it set up and working on my laptop
today.  The other, is as near as I can tell, completely and totally
hopeless as far as being practical or deployable.

						- Ted

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 28 Feb 2002 13:41:09 -0800

> far-flung places in the world like to Australia or Finland.  Yeah,

Actually, we hope to get it to work without requiring X.509.

I wonder what someone 30 years ago would have thought about the
statement "I can get my data to go anywhere in the world.  All
I need is to have the IP address of the destination and some
knowledgeable routers that I don't even know about will magically
redirect my packets to that address, without me even knowing where
it is."

Sure, that's different than Mobile IP -- I can hear the objection already!
But the main difference is that you already believe that IP routing
can work.  I also believe that IP redirection can work, and a lot
faster than DNS resolution redirection can work -- or, any other
application-oriented approach.

> hopeless as far as being practical or deployable.

The approach you favor would require resolution via DNS after
every movement.  That's going to be a disaster for smooth handovers,
I reckon.

Regards,
Charlie P.

---

From: Theodore Tso <[email-masked]>
Date: Thu, 28 Feb 2002 18:00:01 -0500

> Actually, we hope to get it to work without requiring X.509.

Heh.  I agree with you, I threw in X.509 just to make the problem seem
much more intractable.  :-)

I can think of making it the mobile IP problem more soluble, such as
informing an agent at my local ISP (with whom I have a trust
relationship), and if my local ISP then had trust relationships with
its routing peers, it could pass the message along, so that it would
vouch for the redirect request.  That solves the authorization problem
by reducing it to a previously solved problem. 

But then this makes it like multicast; I still won't be able to get
the benefits of Mobile IP unless not only a sigificant portion of the
routing core adopts it, but my local ISP is going to have to adopt it
is as well.  And if the deployment experience for mobile IP is
anything like multicast, I'm not going to hold my breath waiting for
my ISP to offer it to me as a service.

In contrast, DDNS is something I could set up on my own, since I
control my own domain server.  (Yeah, I know not everyone has this
luxury, but I strongly suspect it will be a lot easier to get your DNS
service handled by someone other than your ISP.)

> every movement.  That's going to be a disaster for smooth handovers,

It does require short TTL's on the DNS record, and it does assume that
in general there aren't long-lived TCP connections that need to
survive a rehoming operation.  On the other hand, for most operations
initiated on mobile hosts (i.e., initated TCP connections to the http,
https, imap, smtp, etc. ports), the other side will very likely not
care at all about the originating IP address, and no DNS resolution
would be required.  

I can certainly think of applications for which the handoffs wouldn't
be very smooth --- for example, if my laptop where an web server for a
very busy and frequently visited web site, and I wanted people to find
me whereever I set up my laptop, whether it's at a NordU 2002
conference in Finland or an IETF terminal room in Yokohama.  But is
that really a realistic scenario?  There will already be extremely
non-smooth handoffs caused by the fact that my laptop won't be on the
internet while it's travelling over the Atlantic or Pacific oceans.  

So for all of the applications I can think of today, where devices are
mobile, smooth handoffs and support for TCP connections that last
longer than a longer than a single terminal room session aren't what
I'd call even a remotely common case.  Maybe things will be different
in the future; but will there be enough mobile devices which will be
hosting high-traffic services, or which need to support very
long-lived TCP connections?  I don't see it, myself.

					- Ted