CircleID

Dan Kaminsky countered Paul's FUD:

"First, while there are indeed a couple underprovisioned name servers, there's far more that have lots and lots of slack capacity. You need slack capacity to deal with shock load. The networks that would fail because of Vista's release, would fail because of a three day weekend.

Second, Vista's not getting deployed all at once. This is no service pack that's deployed to a hundred million desktops via Windows Update! Mockapetris is correct in that there will be a noticable increase in DNS traffic, but that increase will be spread out over the course of a couple years. Slow increases like this tend not to cause the sort of catastrophic failure that Mockapetris refers to.

Finally, and most importantly (in the sense that Mockapetris should know better): Most of the work done to service the IPv6 request, is cached and available to service the IPv4. To complete a DNS lookup, you have to locate a particular server, known as the authoritative server for a domain. The same authoritative server that hosts the IPv6 (AAAA) record also hosts the IPv4 (A) record. So even if Vista sends twice the traffic, the upstream nameserver is certainly not experiencing twice the load."

http://www.doxpara.com/?q=node/1136

Roy

I also pointed out much of the same; To argue it doubles traffic is misleading at best.

I have long since learned to trust Paul M. on matters DNS.

And I have observed actual degredation due to IPv6.

The degredation has a large component and a small component.

The small component is that on occassion the list of name server and address records that come back, particularly in the "additional" part of the response, overflows the ancient 512 byte limit on DNS UDP packets.  As I said, the effect of this seems relatively small (unless the query has to be retried via TCP) and often cured by data already in the DNS cache.

The larger component seems to occur when the local resolver gets it into its head that it can actually reach a remote name server via IPv6 and attempts to use IPv6, awaiting timeouts due to unreachability, and then finally tries IPv4.

With Linux and other systems now having IPv6 on by default this sitatuation is a real possibility.

Now, a smart resolver could know that it has no usable IPv6 path beyond its local subnet.  And I would suspect that Bind is among the smart ones.  But I've seen a lot of bad internet code over the last 30+ years on the net and it never surprises me how badly some folks, particularly in embedded systems, cut corners in ways that transform their shortcuts into burdens on the systems of third parties.  (An example of such behaviour: overzealous network management tools often ignore ICMP unreachables, thus continuing to send useless queries, disturbing machines even though no answer will ever be forthcoming.)

In addition from the traffic I see in my log files and when I sniff the wires, I can see that there are a lot of worthless DNS queries hitting my servers asking for IPv6 information that is totally worthless without my servers being reachable from the net via IPv6.  (The queries are packaged in IPv4 packets but they ask for IPv6 information.)

The point of this really isn't whether Paul is correct or not, but rather is this:  ICANN has made a great pretext of how it is imposing all kinds of rules on DNS businesses in order to protect the "stability" of DNS.  Now, if it such business regulation is needed, then it stands to reason that it is even more important to know, in advance, the effects of technical changes products, such as "Vista", that are going to appear in large numbers fairly quickly.