Re: IPv6 Anycast has been killed by LINUX patch in 2016 - who cares?

Theodore Ts'o <tytso@mit.edu> Sun, 08 August 2021 22:40 UTC

Return-Path: <tytso@mit.edu>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C067A3A1B29; Sun, 8 Aug 2021 15:40:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.499
X-Spam-Level:
X-Spam-Status: No, score=-1.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.399, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IM6bue8lK2uo; Sun, 8 Aug 2021 15:40:45 -0700 (PDT)
Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84C283A1B27; Sun, 8 Aug 2021 15:40:45 -0700 (PDT)
Received: from cwcc.thunk.org (pool-72-74-133-215.bstnma.fios.verizon.net [72.74.133.215]) (authenticated bits=0) (User authenticated as tytso@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 178Mec69008293 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 8 Aug 2021 18:40:39 -0400
Received: by cwcc.thunk.org (Postfix, from userid 15806) id A143915C3E25; Sun, 8 Aug 2021 18:40:38 -0400 (EDT)
Date: Sun, 08 Aug 2021 18:40:38 -0400
From: Theodore Ts'o <tytso@mit.edu>
To: Töma Gavrichenkov <ximaera@gmail.com>
Cc: Tom Herbert <tom@herbertland.com>, 6man WG <ipv6@ietf.org>, IETF discussion list <ietf@ietf.org>
Subject: Re: IPv6 Anycast has been killed by LINUX patch in 2016 - who cares?
Message-ID: <YRBdZrKV+MrrhUCG@mit.edu>
References: <CALx6S36pbw2angEmDpu5DnX2nix9KgxFs7ExU17x+JXQFs23TA@mail.gmail.com> <CALZ3u+Yt2X3faSVW7K0eaxmaQy6iA6p4=f0c4E_F4CP0tfjHYw@mail.gmail.com> <CALx6S343sL0=5wUTRSXMnhSamjTTZU=DzA9Y+dbJ4NRTu0_83w@mail.gmail.com> <CALZ3u+ad6Cecp4T+wfuKVJ4ZmnQvaCSX2njFPCN8DuctrU6uew@mail.gmail.com> <CALx6S37u=y1wX8+6d8aX-6=N1MFEqO9RwxQN5zhZnS4DLM8DcA@mail.gmail.com> <CALZ3u+bHbsdzQsHOHx-6nEe6yQBbHMDhH9_PWB=WHTchB8tj5w@mail.gmail.com> <CALx6S36MpCOh2mR+cfM__ASTdn9c4CuhxUrCnUgEv1WhORLyRg@mail.gmail.com> <CALZ3u+ZyQKUJc__HWu6drNyLSCJJ8bOsLfg1B18xwB9+HMe8GA@mail.gmail.com> <CALx6S366bXkCsyEkWCONBX5kcB9JzHU=aNF9hd+wT9FcTdShFw@mail.gmail.com> <CALZ3u+aP=v_1=w1xqfEKof7Cc6Ba3pwOYV3O=0b=NxS4hRWhiA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CALZ3u+aP=v_1=w1xqfEKof7Cc6Ba3pwOYV3O=0b=NxS4hRWhiA@mail.gmail.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipv6/DOCgGGpBXbF2WpKccgfGKqBI8UY>
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipv6/>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 08 Aug 2021 22:40:47 -0000

On Sun, Aug 08, 2021 at 06:12:07PM +0300, Töma Gavrichenkov wrote:
> > And yet these have techniques have been successfully deployed for many
> > years. Not every address seen on the Internet is anycast.
> 
> Not every address ever gets attacked, and when there's an attack, it isn't
> _always_ complicated.
> 
> And there's no incentive now for the criminals to do research in that
> matter because with TCP working fine over anycast, it's too complicated to
> overcome the traffic engineering obstacles.
> 
> Take anycast out of the game, the situation would change.

Which of the top 5, 10, 100 sites on the Internet use anycast?

If Facebook, Amazon, Google, Wikipedia, etc., are using standard IPv4
and IPv6 endpoints and are *not* using anycast, and they have
successly fielded defenses against DDOS's without using anycast,
wouldn't that tend to blow a gigantic, gaping hole in your assertion?

Cheers,

						- Ted