The ISP Column
An occasional column on things Internet
Still RIPE @ 62
I have just attended the 62nd RIPE meeting in a classic spring week in Amsterdam, and I'd like to share my impressions of that meeting.
I've also had the opportunity to attend the ARIN North American and Caribbean Regional Registry meeting a couple of weeks ago, and certainly there is a distinct difference in the way these two communities meet. Unlike ARIN meetings, where the substantive part of the meeting concentrates relatively exclusively on discussion of current address policy proposals being considered by that community, the RIPE community have directed much of the minutiae of the group discussion of policy proposals to their address policy mailing list, so the meeting has more scope for plenary presentations and in those presentations the individuals preparing the program have considerable scope to consider the broader set of current topics in the Internet. For me that broader scope makes for a stimulating and interesting meeting!
So the first aspect of this meeting that I should note is that it's now commonly understood by this community that its highly likely that by the time of the next RIPE meeting at end of October the RIPE NCC will have handed out all of it's remaining pools of IPv4 addresses. In some ways there was an air of fin de siècle at this meeting.
This meeting, not unsurprisingly, much of the plenary presentation material was devoted to IPv6. There were a number of areas of focus within this topic, including dual stack transitional technologies, CPE dual stack devices, and the forthcoming World IPv6 Day.
Much of this material would be very familiar to anyone who has been following this topic in recent months, and, in general there was nothing presented at this meeting that one could claim was truly breaking news to any active following of the progress of IPv6. Although, having said that, I really have to note Gert Döring's regular report on the IPv6 routing table. He invariably manages to find truly fascinating artefacts about IPv6 in the BGP routing data! (http://ripe62.ripe.net/presentations/45-R62-v6-table.pdf)
The various perspectives on World IPv6 Day were especially interesting to hear. From the perspective of content providers there is an emerging sense of both frustration and concern. So far on the Internet content providers have enjoyed a direct relationship with their customers without mediation, filtering or overt interference from carriage providers. There have been some hiccups along the way, as the various "network neutrality" debates show, but it appears that the lines of demarcation between carriage and content were generally well understood. But in the context of IPv6 transition some tensions and some mutual suspicions are emerging.
Content providers have been reluctant to provision their content with IPv6 access, and they cite the scant deployment of 'native' IPv6 by service providers, and the abysmally poor performance of auto-tunnel techniques that attempt to "hop over" local IPv4 infrastructure, as the reasons why they are stalled in their plans for IPv6 deployment. From the carriage side comes a similar argument that goes along the lines that without user demand, and this implies without compelling content or user services in IPv6, the business case to deploy IPv6 remains weak. Both sides suspiciously eye off the other while neither makes any major move to break the progressive impasse over IPv6!
But as IPv4 exhaustion nears, there are now deeper suspicions emerging here. Content providers fear that address exhaustion will be used as the reason for carriage providers to hide their users behind application level gateways and private walled gardens, and thereby be in a unique position to mediate their users and content, and exploit this position financially. Content providers may be forced to pay carriage providers in order to gain access to the carriage provider's customers. From the perspective of the content industry there is a strong need for open neutral carriage networks, and they now have an urgent case to pressure the carriage providers to get moving with IPv6, given that the future of IPv4 with intensive use of Carrier Grade NATs and Application level gateways and similar mediated services looks rather bleak from the perspective of a continued vibrant and innovative content industry. It is no surprise that the major push here in World IPv6 Day is not for service providers to "turn on" dual stack in their access and transit networks, but for content providers to "turn on" dual stack services at the content level. I have heard it said that this is "World IPv6 Content Day."
I have also heard at RIPE 62 that in some places, particularly parts of the Japanese Internet carriage provider environment, there will active blocking of DNS IPv6 address records on that day in order to minimise the potential disruption to the many customers who have been provisioned over that particular carriage network! In the same vein, a comment was made at the RIPE 62 meeting in the panel session on is topic from a major carriage provider that this entire IPv6 Day exercise constituted a "denial of service attack on their customers!" While that was couched in perhaps an extreme form, in some ways there is some substance to this view. When content switches to dual stack some end users will be impacted. Not many, but a few. Some users, albeit a small number, will experience a far slower Internet, while others, again hopefully small in number, will see their usual web pages disappear and become unreachable. Now these users are unlikely to contact the content provider (indeed the inability to reach the content is the very problem they will be experiencing!), and they will contact their service providers with their connectivity issues. One way of phrasing this is that the content providers are deliberately generating helpdesk calls at the service provider!
In many ways this underlying tension over a single day that I noted at this meeting is a small reflection of the emerging larger set of tensions that are at play in the Internet today. Address exhaustion is disruptive to the existing alignments of various industry actors, and, as always during such disruptive times, every sector tries to exploit the opportunity to improve their relative position of influence and control. The content providers see the slow response from the access providers to provision IPv6 as being indicative of an overall reluctance to continue down the path of open neutral carriage networks, and are suspicious that this delay betrays an intent by the carriage providers of using the excuse of address exhaustion to construct a new set of toll booths and walled gardens on today's IPv4 Internet The carriage providers see the content providers as being part of a larger program of asset stripping the carriage industry, and turning the sector into a bare utility industry that is unable to sustain itself and deliver services into a consumer population that continues to demonstrate an insatiable appetite for bits and bandwidth. There is the view, rather impolitely voiced some years ago in the US, that the content folk are free-riding on top of the carriage industry's infrastructure investments (http://www.potaroo.net/ispcol/2006-03/content.html). The need to make further investment to provision dual stack support in the carriage sector only exacerbates these concerns.
Talking about influence and control, there was another topic that emerged on the meeting that centred around perspectives of influence and control, and that was the consideration of address certification and it's potential role in securing the inter-domain routing environment. Much of the work on resource certification tools, and their use in BGP, is being funded by the US Department of Homeland Security, and there is some concern being voiced that this represents yet another attempt on the part of governments to increase their capability to "censor" the Internet. The concern, as I understand it, is that the outcome of this certification work will have as a side-effect the increased ability for governments to exercise direct control over Internet content and connectivity through the ability to direct the top levels of the certificate hierarchy to revoke or amend resource certificates.
As always, such suspicions tend to cast a wide net, and some fear that this will empower and embolden various directives from the European Union, while others fear that this certification places the US government in a unique position of unilateral control over the Internet by virtue of the US Government contract for IANA services. Others fear that this would empower the judicial system in some countries to create legally binding outcomes that impact on the Internet in other countries. As can be seen, once the spectre of imposed control enters the discussion, there are many ways in which it can be expressed. However, it's not clear to me that such fears are well founded. Indeed given that any such manipulation of a public certificate system would be immediately obvious to all, its not clear that such a method of attempted imposed control would be effective if it deviated in any way from the underlying address registry information.
There is the view that we need more effective routing security mechanisms than what we have at present. Our existing routing security tool set is a woefully inadequate defence against determined attack, and the discussions at RIPE 62 cited the massive impact of recent routing events to point out the extent to which the network remains highly vulnerable to attack, whether through misadventure or malign intent.
The address certification work, and its application to secure BGP is a deliberate effort to replace various untested forms of assertions, rumours, and at times institutionalised forms of lying in the routing system that we have today with an interlocking set of testable attestations. The scope for deliberate malfeasance or accidental misadventure in routing is intended to be significantly curtailed, and most likely limited to various forms of self-inflicted damage rather than the current vulnerability to widespread routing attack at a distance. To achieve this we need to strengthen the underlying security framework, and the most effective way to achieve this across the entire routing fabric is by underpinning attestations about addresses and their use in routing with a certification framework that permits all parties to verify such attestations.
I'm sure that we have not heard the last word on this topic and I suspect that the discussion at the RIPE meeting was more of an opportunity to rehearse positions in anticipation of future engagements in an extended debate about the desirability for an effective security capability and any associated introduced vulnerability to the imposition of further points of common control in the network.
Another topic that I felt was worthy of note was the measurement and tools part of the week. This particular part of the meeting, the Measurement and Tools Working Group meeting, attracted a large amount of interest.
The RIPE community has been involved in various forms of active and passive network measurement for many years. The very finely tuned one-way delay measurement network, the Test Traffic Measurement (TTM) network is one such example, and, more recently, the efforts to integrate a number of information sources into an aggregate view through the RIPEstat toolset is another such interesting initiative.
I must admit that I find these efforts really very valuable. In a world where information had become a jealously guarded corporate secret, we now find that basic statistics about the Internet that we need to drive effective policy are largely guesses! How widely is IPv6 deployed? How many clients fail to successfully negotiate with a dual stack content server? How stable is the routing system? Can we really sustain an Internet with many times more attached devices than we have today? All these questions are best addressed with solid current data about the network.
One recent initiative that has me intrigued is the RIPE ATLAS project. The intent is to populate the edges of the Internet with thousands of small measurement systems, each one being no larger than a single chip, and each one continuously "looking" outward and collecting measurements as to how it sees other parts of the network. It's early days yet for ATLAS, and the deployment of probes numbers in the hundreds so far, but it seems to me that this is a relatively unique way of looking at the network and a particularly relevant way as well.
Rather than the conventional approach of instrumenting in the core of the network and making guesses from the network's behaviour about what users may be experiencing, this approach has the potential to directly measure the network from the same position as the user, and to share the same end-to-end experience as the user. The other exciting aspect of the ATLAS project is that this work is still very much formative work, and there is the opportunity to get involved in shaping it and directing the evolution of this network of probes into useful measurements about the network.
And finally, at the end of the meeting there was also the report of the Secret Working Group. I'd like to report on it, but I really can't. It's a secret!
RIPE at 62 was an illustration of an active and very engaged community at work.
While so much of the Internet has disappeared behind rather grey corporate facades where everyone is just a customer, the level of engagement at these meetings still allows me to believe that there is still an important part of the Internet that is still a very relevant exercise in collaboration, and where there is still much to be done in working together.
I hope to continue the stimulating and at times challenging conversation with this community at RIPE 63. See you there!
The above views do not necessarily represent the views of the Asia Pacific Network Information Centre.
GEOFF HUSTON is the Chief Scientist at APNIC, the Regional Internet Registry serving the Asia Pacific region.