Subject: Re: Multiple TCP source addresses?

From: der Mouse <[email-masked]>
Date: Fri, 15 Dec 2000 13:03:22 -0500 (EST)

>> So I'd like to do something so that outgoing connections for which
>> the application has not specified a source address don't always try
>> with one source address and give up if that doesn't work;
>> conceptually, I'd like to try from all local addresses.  I was
>> thinking of sending out multiple SYNs, [...]

> The problem is what routing protocols were designed for.  When a
> destination subnet is unreachable, packets will be routed to the
> second provider (assuming that provider has a route to the
> destination and back to you).

I'm not sure what you mean; perhaps I didn't describe the problem in
enough detail.

Let's give a concrete example.  My home mailserver,
twig.rodents.montreal.qc.ca, is at 132.206.78.3 and 216.46.5.3.  The
off-LAN gateway is stone, 132.206.78.33 and 216.46.5.9.  Twig's default
route points to 216.46.5.9; if twig initiates a connection, it will
come from 216.46.5.3.

Something went wrong recently with a router on the path from the
outside world to 216.46.5.3 (packets can get out but can't get back in,
though for these purposes it might as well have fallen over entirely).
216.46.5.3 can reach anything on the near side of that router;
132.206.78.3 can reach anything else - but neither address can reach
any host the other one can.  (I've put a bug in the ear of the relevant
techies; it may have been fixed by the time you read this for all I
know.)  Incoming connections to 216.46.5.3 from beyond the dead router
time out, but 132.206.78.3 works; for hosts on the near side of it, the
converse is true.

How is a routing protocol supposed to deal with this?  Remember, my
house LAN doesn't have its own AS.

> Varying the source address, to force packets onto the second
> provider, is a solution.  But it doesn't scale

In what sense does it not scale?  Doesn't scale to a larger house LAN?
Doesn't scale to more than a few addresses per host?  Doesn't scale in
that it would be a disaster if every multihomed host did it?  What?

> I may have missed something in your solution, but I think you mean
> you'd only try one source address from the second subnet.

Yes.  (Actually, I would probably have the code try once per address
the machine has, which in my case has the same effect.)

> Sending multiple SYNs from multiple addresses on the same subnet
> won't help.

I'm not convinced; I've seen cases where one host is reachable and the
host next to it isn't.  (Not often, mind you.)

> I'd like to know why the block of addresses goes unreachable before
> proposing a solution.  Try some traceroutes from each subnet when
> this happens.  It could be network congestion, route flaps, crashes,
> etc. I've had providers mysteriously lose routes back to me at times.

Oh, I know what happened, in a functional sense: a router went wonky,
incorrectly returning host unreachables for inbound (ie, to my house
LAN) packets.  Perhaps it just lost a route; perhaps it broke more
seriously - I don't know details.

					der Mouse

			       [email-masked]
		     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Harald Koch <[email-masked]>
Date: Mon, 18 Dec 2000 12:34:56 -0500

Of all the gin joints in all the towns in all the world, der Mouse
> house LAN doesn't have its own AS.

In modern UNIX kernels, the TCP source address is chosen by doing a
routing table lookup, finding the *outgoing* interface, and using its
address.

If you run a dynamic routing protocol (even RIP will do with the right
configuration files), then you can set the default route based on which
gateway is up and/or primary.

If the primary gateway goes down, the default route will switch to the
other gateway. At that point, *new* connections will get the new source
IP address.

The details of "appropriate configuration files" are left as an exercise
to the reader; IIRC, both zebra and gated have a way to prefer one of
two equal-cost gateways; this would allow you to set the
primary/secondary gateway separately on each host on your LAN.

Now, if you wanted to still advertise one of your LAN address when its
gateway was down, *then* you'd need your own AS and a BGP connection to
each of your providers. For most situations, that's overkill; you can
handle it with multiple MX and IP address records in the DNS, for
example.

-- 
Harald Koch     <[email-masked]>

"It takes a child to raze a village."
		-Michael T. Fry

---

From: Joe Touch <[email-masked]>
Date: Tue, 19 Dec 2000 21:22:56 -0800

> primary/secondary gateway separately on each host on your LAN.

See the appendix of:

http://www.isi.edu/touch/pubs/icnp97/

---

From: Joe Touch <[email-masked]>
Date: Tue, 19 Dec 2000 21:26:58 -0800

> routing table lookup, finding the *outgoing* interface, and using its

Which is not always the best answer. Esp. if the interface has aliases.

See the appendix of:

"Dynamic Host Routing for Production Use of Developmental Networks"
J. Touch and T. Faber, Proc. ICNP '97, Atlanta, Oct. 1997, pp. 285-292. 
http://www.isi.edu/touch/pubs/icnp97/

> handle it with multiple MX and IP address records in the DNS, for

But in that case, there's no control over which IP address is used.

Joe

---

From: Lloyd Wood <[email-masked]>
Date: Wed, 20 Dec 2000 11:06:21 +0000 (GMT)

> http://www.isi.edu/touch/pubs/icnp97/

Not Found

The requested object does not exist on this server. The link you
followed is either outdated, inaccurate, or the server has been
instructed not to let you have it. Please inform the site
administrator of the referring page.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: Joe Touch <[email-masked]>
Date: Thu, 21 Dec 2000 10:53:31 -0800

> > http://www.isi.edu/touch/pubs/icnp97/

I thought there was something missing from the URL:

http://www.isi.edu/touch/pubs/icnp97/icnp97.ps

Joe