6 ms·

BGP on Windows Desktop

42 points by GSGBen 4y ago

count 4y ago
At first I thought this was going to just be a go program handling BGP data. And then I saw they injected the routes into the local windows FIB. Somewhere a CCIE is crying silently, and doesn't know why. I get that it works, but something about this feels...deeply wrong :)
- kazen44 4y ago
  Running BGP on servers is incredibly useful though, especially on things like proxies and loadbalancers. For instance, running services on loopback/dummy interfaces and announcing those IP's with BGP to the core network makes implementing anycast really, really easy.
  - eqvinox 4y ago
    You don't need FIB install for that. For any amount of reasonable distinction of "servers" and "routers", you should never need a FIB install on a server. There are good reasons to keep these functions separate (most prominently, address ownership/binding issues with services that are frequently not designed to deal with multiple interfaces/route choices.) NB: this is not about physical devices. VMs/containers on your host are frequently "servers" while the hypervisor is a "router".
    - elij 4y ago
      route on host (rfc5549) is the best strategy for host mobility if your fabric is designed around that idea and you embrace ECMP, stateless networking and bipartite topologies. You need to track state to do that without changing the FIB.
zamadatix 4y ago
I wonder if Windows can take a full table without tipping over internally.
- tptacek 4y ago
  This is just snark, right? Full tables aren't even close to the largest databases handled casually by Windows servers.
  - vbitz 4y ago
    The question is if the routing table implementation in Windows (I assume inside the kernel) can handle it.
    - tptacek 4y ago
      Oh, that makes more sense. It can, I'm pretty sure? But sure, reasonable question.
      - eqvinox 4y ago
        I see no reason for it to be able to do so, in fact I would expect it to be optimized for the exact opposite - a routing table with less than a hundred routes. Stuffing a DFZ table into a Windows box is… not something you do. Neither Microsoft nor Windows admins would really even consider it a viable idea. The real question is: how does it fail? In the best case, it just drops a little bit of networking performance due to lookups taking a tiny amount of time on each packet. In the worst case, not only do the lookups take forever, but it might also cause overall lockups and "hard" degradation due to cascade effects from the network stack spinning to its death on each single packet. But considering Windows servers are used as VPN endpoints, and those need to support at least some 4-digit route table sizes, it can't be entirely bad. My expectation would be just mediocre network performance without huge overall disruption.
        tptacek 4y ago
        I said I was pretty sure because I looked it up and saw evidence that it can, but I haven't tried it.
        4y ago
mike_d 4y ago
Every day we stray further from God's light.
pm2222 4y ago
BGP on desktop is the same as ipv6 for home in terms of usefulness and practicality.

42 points by GSGBen 4y ago

At first I thought this was going to just be a go program handling BGP data. And then I saw they injected the routes into the local windows FIB. Somewhere a CCIE is crying silently, and doesn't know why. I get that it works, but something about this feels...deeply wrong :)

kazen44 4y ago
Running BGP on servers is incredibly useful though, especially on things like proxies and loadbalancers. For instance, running services on loopback/dummy interfaces and announcing those IP's with BGP to the core network makes implementing anycast really, really easy.
- eqvinox 4y ago
  You don't need FIB install for that. For any amount of reasonable distinction of "servers" and "routers", you should never need a FIB install on a server. There are good reasons to keep these functions separate (most prominently, address ownership/binding issues with services that are frequently not designed to deal with multiple interfaces/route choices.) NB: this is not about physical devices. VMs/containers on your host are frequently "servers" while the hypervisor is a "router".
  - elij 4y ago
    route on host (rfc5549) is the best strategy for host mobility if your fabric is designed around that idea and you embrace ECMP, stateless networking and bipartite topologies. You need to track state to do that without changing the FIB.

zamadatix 4y ago

I wonder if Windows can take a full table without tipping over internally.

tptacek 4y ago
This is just snark, right? Full tables aren't even close to the largest databases handled casually by Windows servers.
- vbitz 4y ago
  The question is if the routing table implementation in Windows (I assume inside the kernel) can handle it.
  - tptacek 4y ago
    Oh, that makes more sense. It can, I'm pretty sure? But sure, reasonable question.
    - eqvinox 4y ago
      I see no reason for it to be able to do so, in fact I would expect it to be optimized for the exact opposite - a routing table with less than a hundred routes. Stuffing a DFZ table into a Windows box is… not something you do. Neither Microsoft nor Windows admins would really even consider it a viable idea. The real question is: how does it fail? In the best case, it just drops a little bit of networking performance due to lookups taking a tiny amount of time on each packet. In the worst case, not only do the lookups take forever, but it might also cause overall lockups and "hard" degradation due to cascade effects from the network stack spinning to its death on each single packet. But considering Windows servers are used as VPN endpoints, and those need to support at least some 4-digit route table sizes, it can't be entirely bad. My expectation would be just mediocre network performance without huge overall disruption.
      - tptacek 4y ago
        I said I was pretty sure because I looked it up and saw evidence that it can, but I haven't tried it.
        4y ago

mike_d 4y ago

Every day we stray further from God's light.

pm2222 4y ago

BGP on desktop is the same as ipv6 for home in terms of usefulness and practicality.