RE: multi-homing fixes

From: Steve Noble [mailto:snoble@sonn.com]
Sent: Friday, August 24, 2001 5:16 PM

> > Now on the other hand by saying "and if it's smaller
then a /20 you will
> > be filtered" you cause undue pressure on people to
"spin" their designs in
> > ways to show that they can use a /20 and get the
allocation from ARIN
> > directly.
>
> you mean not use nat? should i be broken-hearted?

NAT?!? You are obviously not understanding the point I was
attempting
to make.

The point was that companies may not need more then a /24 to
put their
entire site on, yet may be pushed to say they have more in order to
acquire a /20 from ARIN, just to be globally visable.

and randy's point is that the easiest way to do that, without lying through
your teeth, is to *not* use NAT, thereby increasing your visible foot-print
by the size of your NAT'd space.

If you were in a position where you did NOT have your own
previously allocated
swamp/b/a space, you wanted to multihome to a few different providers
in such a way that you were globally reachable no matter who
went offline
and you only needed a /24 or less, what would you do?

Avoid *any* technology that makes more efficient use of my address space.
Then I'd generate additional redundant services (legitimate and opertional,
just not used much) to fatten up the foot-print. About 25 Linux boxen,
implemented on BookPCs, ought to do the trick for a /19. Personally, I have
yet to be pushed to such a solution, but I've thought about it and I'm not
the only one. If the rules are set such that I have to do something like
that, or fold the company, I would do it in a heart-beat. There is a limit
to what I will sacrifice on the alter of "community spirit".

Why not just configure 25 secondary IPs on a single box?

-C

Why not just configure 25 secondary IPs on a single box?

Because /19 is 8K IP addresses ?
Using something like Labrea[1] you could get at least a /24 per box
25 boxes should give you roughly 80% of a /19

Of course I don't recommend tricking anyone except "Code Red" type
attacks(or any kind of port scanner) this way
(In particular _not_ an Internet Registry )

- Rafi

[1] Labrea - <http://www.threenorth.com/LaBrea/>