Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's assume I have setup a pair of anycasted DNS servers on my internal network using bird and they're just talking OSPF to my core routers. I've found this on the internet and made it happen.

If I setup one to have a higher cost path than the other, sweet, I've just made a cute way to do fail-over without causing my clients any timeouts when switching from one host in their resolv.conf to the other resolver in their resolv.conf.

But that's not good enough for me. I want to distribute my load between my DNS servers. So I set the cost for both to be the same, so the routers now should be doing ECMP and sending 50% of the requests to one and 50% of the requests to the other.

But it turns out my enterprise uses TCP for a large fraction of our DNS -- let's say we've got enormous SRV records and we use DNSSEC because we're awesome.

Now, how do I setup my clever anycast setup to cope with the fact that the TCP requests need 3 or 4 packets to get a request done and now one of those 3 packets is always going to go to the wrong router and getting the tcp connection reset.

share|improve this question
You really need connection tracking/state. A firewall can do that sort of load balancing. Is there budget for a proper load balancer? – NickW Apr 3 '13 at 11:43
up vote 2 down vote accepted

Well, in such a scheme you can just block RST responses for invalid session, can't you? :) or (what is even better), don't pass it into service:

— invalid state?

— no that way, try another!

P. S. Yes, I really like presentation "TCP Anycast - Don't believe the FUD - nanog" by the link I gave you in comments. ;)

share|improve this answer
Ah, so the connection tracking is the key -- -- each node runs a firewall that knows the state of each other firewall and forwards traffic to the proper firewall if it happens to receive traffic "for my ip but not for me". – chris Apr 3 '13 at 12:05

Just use per-flow OSPF ECMP instead of per-packet and you'll be fine, just like the NANOG presentation says.

Anycast for TCP is only a potential problem for long-lived TCP sessions, and almost every DNS implementation I know of only uses very short-lived TCP sessions.

share|improve this answer
Which OSPF implementations offer per-flow ECMP instead of a per-packet ECMP? In a perfect world I'd just get the ECMP to chose a path based on a hash of (source IP / source port). – chris Apr 7 '13 at 17:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.