Dynamic IP's vs Static IP's

[Valerion]

I first wanted to put this in another thread, but then realized it would derail it too much

There's 2 sides to dynamic IP's:

User: You can do semi-legal / illegal / "I think it's legal but the *AA disagrees" things with your DSL account, or even some legal but "against the Telkom Acceptable Use Policy" (eg. if I am my company's network administrator, and I run a controlled intrusion into that network, it is still illegal for me to do, even though my company will give me written permission).

AFAIK the only way to trace an IP back to you is to actually go through the relevant RADIUS server logs for that period, then find out which line connects to the specific DSLAM port. Therefore it gives you more anonymity, because it's harder to link your IP to you, chances are Telkom and the various self-authenticating ISP's will only go to this level of effort with a clear court order.

Telkom and ISPs: For them this is a definate plus, because according to Telkom it is "impossible" to host a service on your DSL line. This means that the average netizen would need to either get a Diginet line or go with an ISP that will host the services for him, instead of using cheap (compared to Diginet) ADSL. This may also be a motivator for the lack of an SLA.


Now that I've said all that, I still want my static IP ... then I can easily host a small mail and web server on my Linux box ... without worrying that someone else will get my old IP and give out nice "Relaying Denied" messages ...

ISDSL assigns you 5 static IP's IIRC, which means it's clearly intended to host a fairly large LAN. For a single machine, you don't need more than 1 IP routed to you. Therefore IS, at least, believes that ADSL is a diginet alternative for SMMEs.

What do you think?

Edit: Ok, in hindsight, dynamic IP's will use up less IP's than a static solution. Axxess gives me 4 concurrent logins, of which I only use 1. Therefore I would be wasting 3 IP's if they had to allocate 1 for each possible connection.

 

[krycor]

why not use dynamic dns and get a domain ? its not like the ip changes that often unless you reconnect alot.

 

[Karnaugh]

you should't use a dynamic IP if you want to host your own mail server or DNS.

[2005 Aug 20 20:51:44]< mithrandi> Karnaugh: explain to me why they don't give out static IPs on ADSL?
[2005 Aug 20 20:51:55]< mithrandi> Karnaugh: I mean, I've had like 3 different dynamic IPs this month in total
[2005 Aug 20 20:52:10]< mithrandi> Karnaugh: and I can't imagine many people on ADSL don't stay connected 24/7 (or as near as possible)
[2005 Aug 20 20:53:11]< mithrandi> Karnaugh: I mean, is there any real reason to do it? or is it just a case of not wanting to change how things work?
[2005 Aug 20 20:57:34]< Karnaugh> mithrandi: easier routing
[2005 Aug 20 20:57:54]< Karnaugh> mithrandi: the RADIUS can just select from an IP pool rather than having IP's assigned to each account
[2005 Aug 20 20:58:14]< Karnaugh> mithrandi: especialy with all the different accounts people register
[2005 Aug 20 21:00:53]< mithrandi> Karnaugh: does it really make that much of a difference?
[2005 Aug 20 21:01:41]< Karnaugh> well, its less admin
[2005 Aug 20 21:02:19]< Karnaugh> it means they can setup the RADIUS servers with less effort
[2005 Aug 20 21:02:24]< mithrandi> ok
[2005 Aug 20 21:02:26]< Karnaugh> however thats limited reasoning
[2005 Aug 20 21:02:35]< Karnaugh> since they already pull the auth detail
[2005 Aug 20 21:02:37]< Karnaugh> and the capped status
[2005 Aug 20 21:02:41]< mithrandi> so it's more of a "we're too lazy to make a little more effort to make it leet"
[2005 Aug 20 21:02:42]< Karnaugh> they could just as well pull an IP
[2005 Aug 20 21:02:49]< Karnaugh> mithrandi: basicly
[2005 Aug 20 21:03:05]< Karnaugh> also they have cleaner routes
[2005 Aug 20 21:03:09]< mithrandi> but not a "we feel like making your life more difficult for absolutely no reason, HAHA LOLZ"
[2005 Aug 20 21:03:29]< Karnaugh> if you had static IP's and people were logging on from all sorts of places
[2005 Aug 20 21:03:37]< Karnaugh> then you'd have static routes moving around all the time
[2005 Aug 20 21:03:48]< Karnaugh> and massive ****ing routing tables on al the ESR's
[2005 Aug 20 21:03:55]< mithrandi> uhm
[2005 Aug 20 21:03:59]< Karnaugh> and we know how stable those are as it is
[2005 Aug 20 21:04:02]< mithrandi> mmm
[2005 Aug 20 21:04:12]< mithrandi> I suppose that is a point
[2005 Aug 20 21:04:17]< Karnaugh> at least, thats how my knowledge understands it

 

[Valerion]

why not use dynamic dns and get a domain ? its not like the ip changes that often unless you reconnect alot.

That works, yes, but I would actually prefer a static IP. The problem I get is that sometimes you run into a situation where your line is offline (Telkom pulled it out / the BRAS can't authenticate you / City Power decided to cut my power off / I am busy working on my firewall machine). Someone else gets my old IP, and my mail now gets forwarded to him, since my DNS entries still point there. If he doesn't run a mailserver, it's all good and well, anyone sending me mail gets a "Connection refused" and thet spool until I can come online. However, if that person also happens to run a mailserver with proper relaying, he will (quite rightly) reject all my mail with a "Relaying Denied" message.

As long as few people host services on DSL, it won't affect you TOO much, but once more people do this, the risk of false rejects becomes higher. If I had a static IP, and I go offline, then I am simply unreachable, which remote mail servers will handle properly. The scenario becomes even more interesting when you involve web pages and all the proxies along the way ...

[2005 Aug 20 21:03:29]< Karnaugh> if you had static IP's and people were logging on from all sorts of places
[2005 Aug 20 21:03:37]< Karnaugh> then you'd have static routes moving around all the time
[2005 Aug 20 21:03:48]< Karnaugh> and massive ****ing routing tables on al the ESR's
[2005 Aug 20 21:03:55]< mithrandi> uhm
[2005 Aug 20 21:03:59]< Karnaugh> and we know how stable those are as it is
[2005 Aug 20 21:04:02]< mithrandi> mmm
[2005 Aug 20 21:04:12]< mithrandi> I suppose that is a point
[2005 Aug 20 21:04:17]< Karnaugh> at least, thats how my knowledge understands it

Yes, you made an interesting point there. I never considered the routing tables. You will have to do some fancy internal footwork if people move around.

One solution would be to link IP ranges to locations, like they do now. For example, if you are on the RNDF exchange you get an IP between xxx.xxx.xxx.xxx and yyy.yyy.yyy.yyy, and you keep that IP as long as your location is the same, ie. only allow you to authenticate from a certain DSLAM port, and when you file a change-of-address, you get assigned a IP in your new exchange's range. For people on the move, you can still offer a cheaper dynamic package.

This means a lot of admin work, though, as the technicians can't just move connections between ports on a DSLAM without updating the RADIUS server. On the positive side, the ISP can claim that no-one else can steal your bandwidth, even if he knows your username/password, since you are locked to a certain port.