Self-termination Mechanism for Anycast DNS Service
draft-shin-dnsop-self-termination-00

Status of this Memo

This Internet-Draft is submitted to IETF in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work in progress.”

The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt.

The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html.

This Internet-Draft will expire on April 19, 2010.

Copyright Notice

Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents in effect on the date of publication of this document (http://trustee.ietf.org/license-info). Please review these documents carefully, as they describe your rights and restrictions with respect to this document.

Abstract

Anycast has in recent years become popular for DNS servers and widely applied to several root nams servers and to other commercial name servers. For Anycast-based DNS service reliability, this documents describes the use of self-termination mechanism in Anycast-based DNS service operation when the service becomes unavailable due to events such as hardware failures

Table of Contents

1.  Introduction
2.  Self-termination Mechanism
3.  Security Considerations
4.  IANA Considerations
5.  References
    5.1.  Normative References
    5.2.  Informative References
§  Authors' Addresses

1.  Introduction

DNS service is one of the most important factors in Internet infrastructures. Anycast-based[1] DNS service [2] has been discussed within related areas for providing stable service to the users for many years.

Anycast-based DNS service has generally various advantages such as effective dealing with DDoS attack, overcoming the limit of authoritative name server's physical numbers and improving service stability and performance through a distribution of DNS traffic. More good points are described in other related documents.

For that reason, the number of DNS nodes (e.g., Root DNS, TLD DNS and sub-level authoritative DNS) which ancyast-based DNS architecture applied has been increased greatly.

In spite of these merits, one of the problems is that Anycast DNS service system would keep advertising of its normal condition even when it becomes unavailable. Particularly, Anycast DNS service with no self-monitoring system may not be able to respond to queries regionally for some time.

In order to solve this problem, this documents describes self- termination mechanism of interfaces on hosts making queries go out to other mirror sites automatically.

2.  Self-termination Mechanism

As the DNS Server has a trouble in responding to queries, it can be self-monitored by using a simple script like the following. This script monitors the behavior of the DNS for 5 times and continuously alerts the DNS Administrator.

The Self-termination process by using OSPF Link State Advertisements(LSAs), The DNS server itself could be Self-terminated by simply setting down network interfaces(e.g lo0).

Then queries from the Anycast DNS would be bypassed to the shortest alternate Anycast DNS and the DNS Service would be reliable.

#!/bin/ksh

ExitProcess ()
{
RETURN_STATUS=$1
exit $RETURN_STATUS
}

dig @127.0.0.1 soa kr
if [ $? -ne 0 ];then
date > /tmp/link_down.txt
echo "DNS Mirror Site OUT OF SERVICE!! - 1 time" >> /tmp/link_down.txt
sleep 120
dig @127.0.0.1 soa kr
if [ $? -ne 0 ];then
date >> /tmp/link_down.txt
echo "DNS Mirror Site OUT OF SERVICE!! - 2 time" >> /tmp/link_down.txt
sleep 120
dig @127.0.0.1 soa kr
if [ $? -ne 0 ];then
date >> /tmp/link_down.txt
echo "DNS Mirror Site OUT OF SERVICE!! - 3 time" >> /tmp/link_down.txt
sleep 120
dig @127.0.0.1 soa kr
if [ $? -ne 0 ];then
date >> /tmp/link_down.txt
echo "DNS Mirror Site OUT OF SERVICE!! - 4 time" >> /tmp/link_down.txt
sleep 120
dig @127.0.0.1 soa kr
if [ $? -ne 0 ];then
date >> /tmp/link_down.txt
echo "DNS Mirror Site OUT OF SERVICE!! - 5 time" >> /tmp/link_down.txt
echo "Check the BIND Service!!" >> /tmp/link_down.txt
echo "It will be down the Interface lo0." >> /tmp/link_down.txt
echo "You will be follow after coming up the Server." >> /tmp/link_down.txt
echo " === ifconfig lo0 up ===" >> /tmp/link_down.txt
/bin/mailx -s "DNS Mirror Site OUT OF SERVICE!!" admin@dns.kr < /tmp/link_down.txt
/usr/sbin/ifconfig lo0 down
/usr/sbin/ifconfig -a >> /tmp/link_down.txt
ExitProcess 1
else
date
echo "DNS Mirror Site Runs Normally"
fi
else
date
echo "DNS Mirror Site Runs Normally"
fi
else
date
echo "DNS Mirror Site Runs Normally"
fi
else
date
echo "DNS Mirror Site Runs Normally"
fi
else
date
echo "DNS Mirror Site Runs Normally"
fi

3.  Security Considerations

This document describes a mechanism for self-termination of Anycast DNS service on the Internet that can be used to cope with DDoS attack.

4.  IANA Considerations

This document is only advisory, and does not have any IANA considerations.

5.  References

5.1. Normative References

5.2. Informative References

Authors' Addresses