APNIC

PING

A Tech News , News and Technology podcast

#106 in Tech News · 🇧🇷 #146 in Tech News · 🇿🇦

About the show

PING is a podcast for people who want to look behind the scenes into the workings of the Internet. Each fortnight we will chat with people who have built and are improving the health of the Internet. The views expressed by the featured speakers are their own and do not necessarily reflect the views of APNIC.

Newest episodes

Submarine Cable resilience and economics

Nov 11, 2026 57 min

In this episode of PING, APNIC Chief Scientist Geoff Huston and I discuss the economics and risks of the worldwide undersea fibre network. Cables between countries have a long history, right back to the foundations of electronic signalling when the first cables were laid between Britain and the Continent, and Britain and Ireland in the early 1850s. The big leap was to bridge the Atlantic in 1858, made possible by improvements in steel manufacture, insulation, and the availability of large ships capable of carrying and laying the cable. These early systems were crude, initially horrendously unreliable, and slow: it could take hours to reliably receive a message over the long link between The Americas and Britain, but compared to the weeks of delay sailing across, this was lightning fast. (at least until it broke) Rolling forward into the present time, FIbre optical cables are complex but highly reliable systems which use Erbium doped fibre "pumps" to re-energize the signal deep under the ocean, and span the globe in a mesh of over 600 discrete systems. They've become fundamental to how we manage the petabyes of information flows between hosts on the Internet. Much of this data is of course destined for data centers and content distribution network (CDN) Caches, but none the less the reliance on connectivity for uncacheable content such as the domain name system, live communications, inter-economy traffic is immense. Almost any economy worldwide with a sea border is now at the mercy of accidental cable cut by boat anchor, trawler, or the more insidious state actor attacks on infrastructure. Plate tectonics means that significant points of cable crossing like the Luzon straight, can be come a structural weakness many systems share. The economics of these cable systems is another dimension of concern. Much of the modern system was paid for by an older world of telecommunications companies, as a public utility function. But, those telecommunications companies no long...

Quad 9 – Measurement in the privacy-preserving public DNS service

Oct 28, 2026 32 min

In this episode of PING, we’re hearing from Darren Kara, who is a principal engineer at Quad 9. If you haven’t heard of Quad 9 It’s one of the oldest public DNS services, over 10 years old. An initiative of Packet Clearning House (PCH), IBM, The Global Cyber Alliance (GCA) and Switch Telecom in Switzerland. Quad9 now operates as a public-benefit not-for-profit foundation and is headquartered in Switzerland. Amongst the choices of public DNS from other providers like Google and Cloudflare, Quad 9 has two principal points: They focus on privacy of users, with a very strong prevention of information leakage from out of any given location they operate in, and they offer protection against Malware and Phishing. The first design goal means for measurement, they have a completely different model to the one we’re mostly used to, where packet samples or entire captures (as in the DNS OARC Day-in-the-life or DITL collection) are available for analysis: Nothing leaves the room which identifies the individual user. Only aggregates, and with changes to anonymise the source address. The second goal of protecting the user is the result of a collaboration with threat intelligence sources operating worldwide. Quad 9 is able to reflect on their feeds, and ensure DNS queries which pass through them don’t send people to known sources of attack, and is also able to feed back to the sources information which helps them refine their signal, and understand risks in different parts of the world. This too demands data anonymisation to ensure nothing about the end user leaks, and that the different intelligence feeds don’t get signals intended for another, with Quad 9 as the intermediary. Darren discusses their architecture, and how things work from a management and measurement perspective. He’d love to hear from sources of threat analysis in the Asia-Pacific region, to improve collaboration and coverage for the community at large. Why not get in touch at the Quad 9 contact page?

The [dismal] economics of AI

Oct 14, 2026 51 min

In this episode of PING, APNIC Chief Scientist Geoff Huston reflects on the tremendous economic consequences of the surge in capital investment in Artificial Intelligence (AI) and the associated Data Center (DC) build out. This not involves so much money, it represents a tenth or more of the US annual Gross Domestic Product (GDP) and has significance outside of the application of AI to problems in the world. As technology consumers we’re already used to the idea the cost of basic inputs like RAM, storage devices, the GPU cards which we need to run high speed gaming computers are both in short supply and gone up in price significantly. But the economic effects of the surge in AI go beyond the IT sector. They affect all of us fundamentally. Having a speculative activity like this represent so much of any economies activity means that as it ebbs and flows, or even worse crashes, the same amount of economic activity is removed from other productive investment. Some of the AI money is hypothetical, set into the future on the premise the investments being made now play out, but some of it therefore is highly risky, money which won’t actually exist when the time comes, but the debt side, the cost of raising all this money, spending all this money and time and effort building out the DC. That debt will exist, and will either be recovered in a fire sale of assets, or be distributed around as pain in the pockets of investors who put their money into the proposal. A problem for almost all of us, is that the investment decisions here have been taken out of our hands: Although our apetite for risk may vary, the decision around investment is made mostly on our behalf, by the banks, the investment companies, the “institutional investors” which may seem remote, but when you consider the Australian Superannuation sector represents $4.5 trillion Australian Dollars, and is the fourth largest investment pool in the world, for a nation of only 27 million people, our exposure to this...

Similar podcasts

Podcast Canaltech Canaltech

Futuramente CBN

WSJ Tech News Briefing The Wall Street Journal

Segurança Legal Guilherme Goulart e Vinícius Serafim

MIT Technology Review Brasil Unknown

Giro Bitcoin Paulo Aragao

Bloomberg Tech Bloomberg

Segue o Fio Núcleo Jornalismo

All episodes

Submarine Cable resilience and economics

Nov 11, 2026 57 min

Quad 9 – Measurement in the privacy-preserving public DNS service

Oct 28, 2026 32 min

The [dismal] economics of AI

Oct 14, 2026 51 min

The October 2026 Root KSK roll

Sep 30, 2026 27 min

In this episode of PING we’re hearing from Duane Wessels, a fellow from Verisign who researches DNS and who we’ve had on PING before. This time Duane is discussing the history of changes of top level Key Signing Key (KSK) called “roll-over” of the KSK at the root of the DNS. This month on the 11th of October, we will complete deployment of the 3rd KSK, in the second rollover. It’s a multi-year process. This second key roll was delayed from the first rollover in 2017 by some unexpected circumstances in 2020 and 2023. The initial KSK was deployed in 2011. In October, the new key pair will enter service for the first time. The old key pair will no longer be used to sign, but will remain visible in the root until early 2027. Duane discusses some recent DNS research work by himself and Roy Arendts from ICANN, about the observations of resolver behaviour across a root KSK roll-over. Their most recent blog article “The 2024-2026 Root Zone KSK Rollover: Updates and Observations” from July 2026 is a follow-up to their original article “The 2024-2026 Root Zone KSK Rollover: Initial Observations and Early Trends” from March 2025. It’s worth reading both articles to see how experience gained in the initial observations of the key rollover have informed subsequent research. The DNS KSK at the root is the fundamental trust source for all subsequent DNSSSEC signed data in the global DNS. The processes around management of the private keys of this public-private key pair are described by IANA at their DNSSEC webpage and Verisign play several critical roles in the production, maintenance, distribution and use of the keying materials which come from this activity. Duane monitors this closely, both as a participant in the key ceremonies held under the auspices of ICANN/IANA, and from the vantage points Verisign has into global DNS from operations of the “J” root server anycast cloud. Duane and Roy had the opportunity of re-analysing the behaviour of resolver systems under the key r...

"Just say no" isn't as simple as you think

Sep 16, 2026 57 min

In this episode of PING, APNIC Chief Scientist Geoff Huston and I continue a discussion about the repeat queries Geoff sees on the APNIC Labs experiment. Across time this number has changed, as DNS protocol usage has changed. We now have DNS records which didn't exist when the problem was first seen, and we therefore have multiple queries about multiple things. Geoff has been exploring two facets of the DNS. Firstly, Exploring the effects how you answer "NO" has on the amount of queries you see, as well as the amount of work that has to be done by authoritative server, intermediate resolvers in the chain and the client. There are some surprising outcomes in the various choices of how to say no, including simply not answering. Secondly, what impact would adoption of alternative DNS transports have on the repeats and query load, which may be a function of the UDP protocol and it's behaviours. Many people believe the overhead of maintaining TCP and related protocols in terms of state on the server was a reason to avoid it, but with the volume of uneccessary repeats rising, it is possible there is less work end-to-end, maintaining state for a protocol like TCP.

Measuring the impact of locally served root zone

Sep 2, 2026 27 min

In this episode of PING, we talk with Willem Toorop from NLNet Labs and Ilyas Rahimi who recently completed a masters in Security and Network Engineering at the University of Amsterdam (UvA). They’ve been looking at the effects of local root serving. Ilyas was on a masters programme called “OS3” at UvA (from the triplet of Open Standards, Open Software and Open Security). NLNet labs is on the campus of UvA and Willem has been working with the masters programme for some time, pursuing research in DNS and DNSSEC with the students doing their masters thesis component. They conduct 2 1-month original research activities in the masters course, and write the second one up as their masters thesis. Locally served root is a model of operating a DNS resolver where it “pre-fetches” the state of the root zone, the apex of the entire DNS naming model. By fetching this data the idea is that both early termination of unresolvable domain names (names where the final terminal label can be seen not to exist under the root of the DNS) and a degree of privacy in fetching resolvable names can be gained, by looking in the local copy. There is a current proposal in the IETF to make this a “best current practice” or BCP. Ilyas looked at 3 different public code-bases (bind, unbound and the knot DNS resolver) and a total of 4 configurations, exploring both in-band and HTTPS bound fetch of the root zone. As well as identifying a bug in the model unbound used, which accounted for a spike in traffic, Ilyas has been able to show that under the update cycle typically seen for the root there is a surprising increase in apparent network traffic fetching the zone, compared to the many but far smaller events asking for uncached data from the roots. There is more work to do in this space, and with the OS3 masters thesis component now given more time in the degree program, there is hope that Willem can continue to work with UvA students, and carry forward the measurements. WIllem has been explorin...

DNS Cold Start

Aug 19, 2026 42 min

In this episode of PING, APNIC Chief Scientist Geoff Huston and I discuss the behaviour of the DNS system when you have to come up from nothing: the “cold start” where no data exists from prior queries in your “cache”. This stems from a talk given by Ondřej Surý, that Geoff saw at the recent RIPE-92 Meeting held in Edinburgh, in the DNS working group. Cache, is the things you hold on to, from prior work done. It’s a fundamental technique in computer science to avoid the massive disparity in speed between parts of the systems, keeping things you use a lot in “fast” memory close to the CPU, and avoiding having to go to “slow” memory or even worse disk or tape files, to find the data. The size of your cache and it’s speed can have a huge influence on the speed of your program. Comparing CPU performance with and without prior cached data can be very instructive to it’s benefits! -In the DNS, Cache is how you avoid having to wait for a remote system to answer over the network (with all the round-trip delay of question and answer) because you know parts of your answer from the prior queries and answers you hung onto. “Cold Start” is a well known problem in large distributed systems. The problem is not just that industrial systems like coal plants and gas turbines need time to warm up and get sufficient energy to drive the generator, in the so-called “black start” there is the problem of energising the magnetic coils associated with generation of electricity. It’s distinct DC energy, used to make the generator enter the state where the rotational force from the turbine actually makes power. Without a source of power, you cannot make the coils “excite” and so the spinning generator won’t actually make any electrical power. Typically, this DC voltage comes from an independent source like a small diesel generator, or a source of electrical power which hasn’t been affected by the outage. If you contract to supply this contingency power, failure to be available is a major iss...

Canonical Cache Representation

Aug 5, 2026 35 min

In this episode of PING, we talk with Job Snijders about secure Internet routing again, focusing on an approach to preserving the state of RPKI as a longterm historical record for research and analysis. Job was last on PING to discuss the “Erik” protocol. Job has been running an archive of RPKI state for some time, as a volunteer activity but an exercise which was feasible when BGP speakers producing ROA objects was measured in the hundreds to low thousands is significantly more expensive when the population of ROA producers is a more realistic percentage of the around 80,000 AS holders worldwide. Because Public Key Cryptography depends on a regular re-signing, and re-cataloging (as another signed object, the RPKI “Manifest” file) even when there is no substantive change in the state of signed information, a large amount of “churn” can be seen in the data, and even a compressed form of this state in turn incurs a huge overhead in storage of hard-to-compress data. Job reached the limits of his free activity, and started to explore a more compact and useful representation. This has emerged in the IETF standards process as two related activities. The Canonical Cache Representation or CCR, and the aggregation over this for data represented as the RPKI Spool data model for “materialising” the state of RPKI objects. Along with his fellow IETF draft authors Bart Bakker , Tim Bruijnzeels, Theo Buehler and Fedor Vompe Job has managed to define a remarkably compact, highly compressible representation of RPKI validated objects, and the cryptographic payloads. These systems have been designed to leverage well known UNIX and other techniques for data management such as the “tar” format for spooled data, ASN.1 for binary encoding, Merkle Trees to hold compact hash state, and data compression using the zstd encoding. It’s a nice approach to solving the scaling problem.

DNS Query Duplication

Jul 22, 2026 39 min

In this episode of PING, APNIC Chief Scientist Geoff Huston and I discuss a traffic behaviour in the DNS which Geoff has noticed in the labs advertising based experimental data capture. Virtually every DNS query Geoff sees, he sees twice (or more). For a cohort of about 150 million unique DNS labels on a given day, The Labs system is collecting 270 million incoming DNS queries. Thats a lot of duplication. What's going on? The advertising data collection depends on issuing unique DNS queries, which in turn generate unique web page serves. This allows measurement of internet-wide behaviour on about 30 million browsers, games, devices every day. Not to say that these names and web URLs are not routinely seen by more than one entity, intermediary systems such as caches and proxies as well as re-visiting old open website tabs on a browser can cause this. The point is that after the "first" fetch, the subsequent fetches can usually be held to be re-presentations of the same experiment and can therefore often be discarded (in the case of the web). But, for the DNS which has always had an element of unreliable transport, and which in turn invites measurement of features like DNSSEC which cause SERVFAIL messages, and demand repeated attempts to "find the DNS name-to-address mapping, re-fetching is itself something under test. How many resolvers lie behind a given users systems? How many kinds of resolver (DNSSEC enabled, or not) does the user depend on? Finding that almost all DNS queries are repeated, and it turns out repeated very quickly invited Geoff to have a look at what's going on "under the covers". There are some patterns behind what's being seen which Geoff explored in the APNIC Labs Blog.

Testing RSSAC 028 DNS root server name choices

Jul 8, 2026 40 min

In this episode of PING, we talk with Willem Toorop about a measurement of 6 choices for naming the root servers of the global DNS. This measurement was motivated by RSSAC 028, a 2017 technical analysis for ICANN of the naming scheme used by the root DNS servers. Root name servers are part of the global DNS system, and they provide basic bootstrapping for every other DNS resolver and authoritative name server worldwide. This is their primary role, but they also handle query load relating to the global DNS system all day and every day. There are 13 distinctly named root servers, each one identified by a letter from A to M under the domain root-servers.net. Although there are only 13 distinct "labels" there are in fact thousands of machines providing this service as independently operated clusters behind each of these letters, using the BGP "anycast" method we have discussed on PING before. The special zone, root servers.net was instantiated in 1995. It's delegated as normal under the .net zone, which in turn delegates from the root "dot" zone. If you are bootstrapping a new resolver, to find a root server you appear to need to know about the delegation of .net in order to find root servers.net, to find the given server. This is a circular dependency because you don't know how to find .net until you have asked a root server instance. The circular dependency is resolved by the contents of an initial "priming" response. This response provides the additional "glue" information to seed direct knowledge of how to find each of these named root servers as is, without all the intermediate logic of the circular dependency. This glue is inherently not signed in DNSSEC. It's insecure. The priming response is very carefully curated for both its size and the content but it would be good to give it some content security and increase trust in the message. RSSAC 028 explored the impact of applying DNSSEC over this domain, which in turn would add DNSSEC signatures to the priming re...

What ‘name-based routing’ really means

Jun 24, 2026 49 min

In recent PING episodes, APNIC Chief Scientist Geoff Huston has asserted that Internet routing has shifted away from traditional IP packet forwarding. Instead, it is increasingly driven by processes that map names to addresses. It’s no longer just about your IP address or the specific endpoint you think you’re connecting to, it’s about your location and which intermediary services can most effectively handle your request. How does this actually work in practice? What processes determine where your request is served from, and who makes those decisions? In the latest episode of PING, we explore this topic. Of course, IP-level routing hasn’t disappeared. For optimizing content delivery using a ‘closest’ node model, anycast remains a critical technique, using BGP to direct traffic to the nearest available server, and it is widely deployed at scale. However, this approach is increasingly supplemented by name-based mechanisms, particularly those driven by DNS, to more precisely determine where requests should be directed. The way endpoints are identified in an Internet protocol exchange is changing, and this shift has broader implications for the nature of the network. As a result, we are seeing some trends emerge: Control over routing decisions for application content has shifted away from ISPs operating at the BGP layer and towards higher-level logistics functions in the stack. These decisions are now typically made by service providers offering optimized content delivery as a managed service. Provision of this optimization is typically carried out through DNS-based mechanisms. As a result, organizations often delegate their DNS to the same content delivery provider, allowing it to control request routing. This gives the intermediary significant influence over how and where traffic for a domain is directed. Together, these trends are likely to reinforce the growth of ‘walled garden’ vertical markets. Application-specific delivery methods are increasingly positione...

The Erik protocol: improving RPKI data fetch

Jun 10, 2026 38 min

In this episode of PING we’re hearing about secure Internet Routing and its data distribution problem from Job Snijders who has been on PING before talking about his measurements in BGP and RPKI. We caught up at IETF125 in Shenzhen where Job presented to the SIDROPS working group on a new protocol he’s been designing, called Erik. The Erik protocol was named in honour of Erik Bais who died in May 2024. Erik was a stalwart of the RIPE routing community. He was a chair of the Address policy working group, and active in the Dutch cloud community and the data center association. RPKI, the principal mechanism for determining secure inter domain routing intent (hence SIDR) depends on every relying party (or RP) validating the data collecting all the signed statements from all the publication points, worldwide. This is a time consuming process which inherently serialises behind the sequence of bytes fetched to form a given repository state at a publication point, and how the protocol works out whats changed since the last fetch by this user, and what to send. It’s not very efficient and it’s not scaling as well as we’d like as the amount of data rises, and the number of validators or RPs are fetching the data. Job’s “Erik” protocol is designed to improve significantly on the two mechanisms defined at present, the RSYNC protocol, originally designed in the mid 1990s for filesystem synchronisation, and RRDP, a SIDR specific delta protocol which was designed to improve on rsync, using experience gained from the NRTM mechanism used to copy data in the RIR WHOIS databases. Job has been able to find why RPKI fetch is slow, and design a protocol using the Merkle Tree mechanism which can significantly improve the collection delay, as well as allow for intermediaries such as CDN providers to host services in the cloud.

About Time

May 27, 2026 36 min

In this episode of PING, APNIC Chief Scientist Geoff Huston and I discuss Network Time Protocol or NTP. NTP is one of the older systems we depend on, designed and implemented by Dave Mills who died in 2024. Dave had been working on time synchronisation from the mid 1970s, and cared deeply about synchronising the emerging ARPAnet and the Internet, with the pre-existing worldwide collaborative framework which regulates our sense of time, and how it relates to the world of science, astronomy and civil society. Geoff has been musing about NTP, moves to secure NTP, and the many dependencies in the modern world on the underlying concepts of a coordinated sense of time. This dependency in the modern world on highly synchronised clocks cannot be overstated, it creeps into every sector of daily life from aircraft and space navigation, to finance systems, and event scheduling of all kinds. But our model of time is fundamentally based on the rotation of the earth, and the length of the second, and unfortunately while we now define the length of the second to astonishingly accurate levels, the rotation of the earth isn't as stable as we'd like. our model of time therefore has to make some adjustments To make matters worse, our model of time has been coded over the years to varying models of a start date known as an "epoch", and how we represent time inside the machines, systems and services isn't one unified model any more. It's all coming a bit un-stuck.

The socialised cost of online abuse

May 13, 2026 45 min

This time on PING I'm talking to Alban Kwan from the Trusted Notifier Network (TNN). I caught up with Alban at the APRICOT/APNIC61 meeting held recently in Jakarta, where Alban was attending the policy and governance sessions with a particular interest in the problem of online abuse mitigation. Alban is interested in bridging the gap between the business and technical communities in this problem space. When it comes to crafting a response, business tends to focus on brand integrity and the real world cost of mitigation when their products and services are abused, used for spam or fraud or suffer inbound attacks against them. The technical community tends to be focused on things like network traffic level views of problems, found in deep packet inspection, running honey nets, looking at firewall logs and in turn, tends to drive security activities in network technology. It's a very real cultural divide. We've discussed the more technical, packet-level distributed threats on previous episodes of ping. We've talked with Adli Wahid from APNIC and with Leslie Daigle from Global Cyber Alliance, discussing honey nets which present as low barrier attack targets and can measure the levels of abuse coming to unprotected websites and online services and help pinpoint where they come from. In addition, Leslie has raised her concern that we need a conversation in wider civil society about the governance issues to address this problem because technology alone can't solve what's clearly a societal problem. TNN is part of that civil society response to online abuse, albeit in a slightly different form, focussed on communication between the involved parties and a concept of a higher trust channel, a better signal-to-noise ratio which reduces real world cost and preserves business reputation. Alban has an interesting analytical model of how to think about the problem and I think it's interesting to look at his engagement with business process and how people build mutuality and...

CIDR inside

Apr 29, 2026 49 min

In this episode of PING, APNIC Chief Scientist Geoff Huston discusses the tortuous history of The CIDR report Classless Inter-Domain Routing or CIDR, is a mechanism defined in the 90s, to replace the former model of fixed sized networks defined in RFC791 called class-A class-B or class-C (there were actually class-D and class-E but for now we can ignore them) -the "Classless" part means no longer obeying the fixed bit-pattern at the "top" of the address (in the top 3 bits) which defined which class you were in, the classes defining how many addresses were in that block: a Class-A was 17 million, a Class B was 65,000 and a Class C was 256. This worked fine for the early life of the Internet, but under the stresses of exponential growth in the 1990s a new method for allocating addresses was defined, which exploited this "classless" model and allowed people to be given sizes between 17 million and 65,000 or between 65,000 and 256. -Which in turn fixed two problems: access to addresses into the future (through the Regional Internet Registry model of justified need for addressing) and the scaling problems of the routing mechanism. Routing has roots which reach back into the 1950s when a class of methods for describing how to exchange information about paths in a system called "Bellman Ford" was defined. This mechanism came all the way into the future alongside the growth of the Internet and replaced other models of routing which had emerged in networks such as DECnet from Digital Equipment corperation, and we now know as the ubiquitous BGP4 for Border Gateway Protocol, version 4 (a very good name, for the 4th version of something which was modified from the equally well named BGP3, to add in CIDR models of prefixes. The CIDR report grew out of the need to understand who was causing the stress inside BGP, a public commons of everyones routing assertions, where if you did what was entirely rational for you to engineer better routes by announcing more of them, you made...

IP Networking in Deep Space

Apr 15, 2026 49 min

This episode of PING is an interview with Marc Blanchet from Viagenie in Quebec, Canada. Marc has been active in Internet Procotols and the IETF for decades, most recently focussed on Internet Protocol communications in deep space. Marc presented at the recent APRICOT/APNIC61 meeting held in Jakarta. We've got used to the idea of IP working in Low Earth Orbit, with the rise of Starlink as a high speed service which in many cases out-performs terrestrial services available in rural and remote locations. And, we've had IP services mediated via GeoSynchronous orbit satellites like DirecTV, which are now significantly less popular because of one overriding problem: the very long end-to-end delay. People find the half-second of round-trip time to a GEO satellite unacceptable. But, in space, things get much worse. Marc's work looks at space contexts which go far beyond these orbital "shells" around earth, into the distances to the Moon, to the Asteroid belt, and beyond to other planets. The delay component in these networks isn't just an inconvenience, it has very real implications for rount-trip-time effects on a protocol like TCP, which demands a stream of "ACK" signals to manage the sender and receivers models of bandwidth and delay and retransmission. Marc has been working on how to simulate the effects of these very long delays using earth bound Virtual Hosts and code, using the Linux TUN device, and TC-NETM along with code developed by his team. This allows them to programatically define an experiment in delay, loss, re-ordering terms, which can span hours of packet-in-flight time, and look at how switches and routers, intermediate elements of an end-to-end IP exchange can work. Code patches to these systems to represent delay as a 64 bit quantity now mean it's theoretically possible to test IP out to the edge of the galaxy, if you had a way to keep machines running that long. If we look at what we actually want from IP networks in deep space, TCP isn't the rig...

What does “BCP” really mean?

Apr 1, 2026 27 min

In this episode of PING, APNIC Chief Scientist Geoff Huston discusses an emerging concern about how the IETF interprets the concept of ‘Best Current Practice‘ (BCP). In his previous episode, Geoff explored emerging questions around DNS provisioning over IPv6, including experimental observations on its performance characteristics. Towards the end of the discussion, we turned to how the Internet Engineering Task Force documents standards and protocols through Best Current Practice (BCP) publications. In the traditional view, BCPs are intended to provide clear, implementation-focused guidance that remains neutral across different operational contexts. This includes networks of all scales — from home environments to enterprise, national, and international infrastructure. These systems rely on a shared understanding of protocol behaviour, and BCPs help define the set of practical, interoperable choices available for deployment today. To be designated as a BCP, an IETF RFC undergoes additional review and scrutiny. This is similar to the ‘Standard’ (STD) designation, which elevates an RFC beyond a general publication and gives it greater weight in operational and procurement contexts. While RFCs are not legally binding, they are frequently referenced in national regulations, procurement frameworks, and service specifications. In contrast, Experimental and Informational RFCs explicitly indicate that they are not intended for such use. BCPs, along with Proposed Standards and Standards, carry greater normative weight due to the more rigorous processes required for their approval, making them more suitable as references for real-world deployment and decision-making. An emerging perspective suggests that BCPs may be treated as aspirational as well as definitional — potentially describing behaviours that are not yet widely deployed, or in some cases not deployed at all. This represents a subtle shift from the traditional view of BCPs as documenting established, operational...

bgproutes.io: A next-generation BGP data collection platform

Mar 18, 2026 27 min

This episode of PING features Thomas Alfroy and Thomas Holterbach from the University of Strasbourg, talking about bgproutes.io - A new approach to BGP data collection and analysis. We've featured bgproutes.io on PING before, when we discussed GILL and DFOH with Professor Cristal Pelsser from Louvain University. At that stage, the project was in an early stage and we focussed on the machine learning and approaches to selecting the "Most valuable Vantage Point" or MVP in the data sources available. This time, the two Thomases discuss the operational deployment of the service, and how they have designed the system to provide fast visibility to data in a 3 month window, and an API for selection of prefixes and origin-AS of interest, to show the BGP transactions seen in the wild. They've been designing "dashboards" to show both the data and a sense of what logic determined the inferences made about the data. bgproutes.io has been written to process the newer BGP Monitoring protocol (BMP) which provides visibility of the discrete states of the individual BGP speakers who peer at the BMP collection point. So, considering an IX this means that a single feed can supply 50 or more distinct views of BGP. This has permitted the project to grow to over 300 points of view worldwide. The service is complementary to those from University of Oregon routeviews or the RIPE RIS project, and includes data from these sources along with PCH and CGTF Thomas Alfroy presented at the Sydney SIGCOMM meeting where the system was described in the 2024 SIGCOMM ‘best paper’ award-winning research: “The Next Generation of BGP Data Collection Platforms“. Thomas Holterbach is no stranger to the APNIC community having spend time at the IIJ Research Laboratory in Tokyo.

Measuring The Use Of DNS Over IPv6

Mar 4, 2026 52 min

In this episode of PING, APNIC Chief Scientist Geoff Huston discusses running advertising-based experiments and a problem of interest in the modern DNS. DNS fundamentally requires end users, their chosen resolver provider, and the authoritative servers for the names they query to cooperate in a coordinated exchange over IP protocols to answer DNS questions. The specifics of how these queries are encoded and transmitted become complex very quickly, but a particular issue is emerging in how we define, in normative and strongly binding terms, the way the protocol is expected to behave. This will shape future deployment decisions, implementation choices, and operational dependencies. The question centres on the use of IPv6 within the DNS ecosystem as a whole. Can we yet say that IPv6-only DNS can be relied upon in operational practice? And if so, should that position be written into the guidance an RFC may define, were it to be elevated to the status of a Best Current Practice (BCP) or BCP document? Geoff is exploring how to measure this by exploiting a DNS model known as ‘glueless’. In this approach, the additional ‘glue’ records that are typically passed around behind the scenes to keep DNS resolution working are not provided by the authoritative server to the resolver. As a result, the resolver is forced to issue further queries, which can in turn be constrained to use IPv6 only. These queries are conducted without many of the usual measurement artefacts — such as error introduced when users close a browser session prematurely, or when attention drifts away from the web page that triggered an advertisement-based test. Some interesting variances are emerging when you look at this data by geographic region and origin-AS. DNS fundamentally requires all of the end users, their chosen resolver provider and the authoritative servers of the names they ask about, to cooperate in a dance over IP protocols to answer DNS questions. The specifics of how these questions enco...

Internet measurement in Thailand

Feb 18, 2026 21 min

This episode of PING features two members of the Thai academic and research community and was recorded last year at IETF 122 in Bangkok. With a population of more than 70 million, Thailand has around 80 publicly funded universities and a further 70 or more private institutions, and undertakes substantial research in telecommunications and computing. A leading example is the Asian Institute of Technology (AIT), which has run the AINTEC conference across the Asia Pacific. Both of our guests on this episode are associated with AINTEC. First, we hear from Sukumal Kitisin of Kasetsart University, a state-funded institution. She has been working on an Internet measurement programme for the Thai Consumer Council (TCC). The project leverages well-known tools such as Ookla Speedtest and OpenSignal to capture end-user experiences of mobile Internet services in Thailand. These measurements support modelling of broadband speeds and service quality, which the TCC can then use to present consumer evidence to the national telecommunications regulator, the National Broadcasting and Telecommunications Commission (NBTC). While we are often accustomed to discussing measurement using Atlas probes and other ‘insider’ approaches, this work represents a consumer-friendly, simple, and defensible method for capturing the lived experience of real-world users. Secondly, we hear from Adisorn Lertsinsrubtavee, Director of the Internet Education and Research Laboratory (InterLab) at AIT. Adisorn describes a decade-long measurement effort known as HAZEMON, which focuses on low-bandwidth Internet of Things (IoT) devices used to measure suspended particulate matter such as smoke and fumes from diesel and charcoal fires, as well as carbon monoxide and carbon dioxide. Thailand sits at the heart of a South East Asian climate system that is heavily affected by forest fires and persistent smog, with serious health implications. PM2.5 particles can penetrate deep into the lungs and cause lasting resp...

BGP in review for 2025

Feb 4, 2026 57 min

In this episode of PING, APNIC Chief Scientist Geoff Huston returns with his annual review of BGP, reflecting on developments across 2025. Geoff has been publishing this year-in-review analysis of BGP dynamics for more than a decade, and this time he has uncovered some genuinely surprising shifts. His 2025 analysis has been published in two parts on the APNIC Blog. Border Gateway Protocol (BGP) is the mechanism by which network operators announce their Internet address space to the rest of the world and, in turn, learn about the addresses announced by others. Operators participating in the global default-free zone receive all publicly announced routes, each expressed as an IP prefix and associated with its originating Autonomous System Number (ASN). Every BGP speaker has a unique ASN, and all routing information is exchanged and interpreted through this fundamental identifier. In effect, the ASN is the basic unit of interdomain routing. BGP also carries path information that describes how routing announcements traverse the network. This data informs routing policy decisions — which paths to prefer, and through which commercial or technical relationships. While the protocol itself is well understood, the system as a whole is anything but simple. When more than 100,000 ASes are continuously exchanging routing information, complexity is unavoidable. Speaking BGP is about telling things and learning things, but it’s also about deciding what to do with what has been learned. This is the work behind a router, and involves holding all the information and performing routing decisions on it, so the ‘size’ of the information shared and learned has a direct impact on the ‘cost’ of operating as a BGP speaker (cost here ultimately means memory and CPU). For most of the Internet’s history, BGP growth has been relentless, forcing operators to continually ask whether their current routing infrastructure can accommodate future growth. All technology adoption has a life cycle, an...

NITK Students at IETF: Fresh Minds for standards development

Jan 21, 2026 30 min

Welcome back to PING for 2026 and season 6. This time on PING, we have a pair of interviews with students from the National Institute of Technology Karnataka, Surathkal (NITK), recorded last year at IETF 122. This is the second time we've heard from students from NITK. We previously heard from Vanessa Fernandes and Kavya Bhat when they attended IETF 119 in 2024. NITK is a large, technically focused university located on India’s south-western coast in the state of Karnataka. The state is home to major technology hubs, such as Bengaluru and Mangaluru, alongside institutions like NITK, which play a key role in developing technical talent. Against this backdrop, it is unsurprising that NITK students show a strong interest in network technologies and Internet protocol development. Dr Mohit Tahiliani, Associate Professor at NITK, has led a multi-year program involving undergraduate, postgraduate, and postdoctoral researchers to engage with emerging Internet standards. Through this program, participants explore new ideas, contribute code, and take part in IETF hackathons and Working Group activities. This work has been supported in part by the APNIC Foundation. Last time with Vanessa and Kavya, we explored NITK’s multi-year campus IPv6 deployment, which has been underway for some time. That work has included direct engagement with the IETF, with Dr Mohit Tahiliani’s students attending alongside Nalini Eklins, who is involved both in the IPv6 deployment at NITK and in IPv6 standards work within the IETF. Since then, both students have gone on to work in networking roles or to pursue further study, reflecting the longer-term impact of sustained involvement in operational and standards-based Internet engineering. This time, we've got two different projects and NINE students to hear from. The first group is Rati Preethi Subramanian, Shriya Anil, Mahati Kalale, Anuhya Murki and Supradha Bhat, who explored fair queuing disciplines, FQ_Codel, a derivative FQ_Codel++ and a...

Going Dark: measurement when the Internet hides the detail

Dec 10, 2025 54 min

In the final podcast for 2025, APNIC Chief Scientist Geoff Huston discusses the problem of independent measurement in an Internet which is increasingly “going dark”. Communications has always included a risk of snooping, and a matching component of work to enhance privacy, from the simplest ciphers used in ancient times, techniques of hiding and discovering messages, attempts to prevent and detect intrusion of the mail, to adoption of telegraph codes, the cutting of telegraph wires in wartime (to force messages into radio where they could be listened to) and the development of modern encryption algorithms typically using the public-private keypair model. There has always been a story of “attack” and “response” in how we communicate privately. Aside from matters of state security, banking and finance at large depend on a degree of privacy and now require it under legislation to enable use of creditcard information online. Many other contexts have an assumption of privacy, and use technology to try and preserve it. Fundamentally, individuals in their use of the Internet are entitled to expect a level of privacy where the state permits it. The publication of RFC7258 “Pervasive Monitoring Is an Attack in 2014 formalised a belief that the intrusion of third parties into a communication between two ends demanded a technology response to exclude them, where possible. Protocol designers and Internet Engineers took up the challenge. This position led over time to a marked increase in the adoption of privacy enhancing protocol features. For example, the web moved from HTTP: denoted URLs to HTTPS: where the content is protected by the Transport Layer Security (TLS) encryption protocol, which now overwhelmingly predominates in the at large. However, significant aspects of Internet communications “leak” information to third parties. Between an individual and a web service lies their provider, unknown numbers of intermediate providers, typically a content distribution system...

Adjusting for data source bias in Internet Measurements

Nov 26, 2025 38 min

This time PING features Emile Aben from the RIPE NCC R&D Department. Emile is a Senior Research Engineer, and for over a decade and a half has been looking at Internet Measurement at RIPE in the Atlas system, and in the RIPE RIS BGP data collection. Emile and a collaborator Romain Fontugne from IIJ Labs in Tokyo have been exploring a model of the influence and effect on global connectivity in BGP for different AS, based on the impact they have on other AS’s transit choices. They call this “AS Hegemony” and Emile has been using it to adjust for sample bias in the data being collected in RIPE RIS and in the Atlas network. This approach to re-balancing the sources helps Emile to understand changes in network topology and routing under rapid shocks like cable cuts and he’s been applying this to the recent spate of cable outages in the Baltic, around Africa, and the power outage on the Iberian Peninsula. Emile has also been looking at new ways of holding data, and visualising data. His RIPE colleague Ties de Kok has explored use of “Parquet” as a data abstraction tool and this has allowed Emile to perform rapid analysis and experiment in new data visualisations in 3D, rendered in-browser.

the Realpolitik of undersea cables

Nov 12, 2025 52 min

In this episode of PING, APNIC Chief Scientist Geoff Huston explores the complex landscape of undersea cables. They have always had a component of strategic interest, communications and snooping on communications has been a constant since writing was invented, and the act of connecting two independent nation states by a telegraph wire invokes questions of ownership and jurisdiction right from the start. After the initial physics of running a long distance wire to make an electric circuit was worked out, telegraph services became a vital part of a states economic and information gathering processes. This is why at the beginning of world war 1 and again in world war 2 the submarine cables linking europe out into the world were cut by the British Navy: forcing the communications flows into radio meant it was possible to listen in, and with luck (and some smart people) decode the signals. Modern day fibre optic communications are no different in this regard. Many incidents of cable cutting have simple explanations, not all paths the subsea cables run through are especially deep and in shallow waters near landfall with lots of fish, trawlers cause a lot of damage. But there is now good reason to believe state actors are also disrupting fiber communications by breaking links, and a strong trend now to direct which sources of equipment (from the physical fibre up to the active routing systems) are used for a landfall into any given economy. This in turn is influencing the flow of capital, and the paths taken by subsea fibre systems, as a result of the competing pressures.

Greasing the wheels

Oct 29, 2025 36 min

In this episode of PING, Shumon Huque from Salesforce discusses how protocols with extensible flag fields can benefit from regular testing of the values possible in the packet structure. This technique is known as "greasing" and has a strong metaphorical meaning of "greasing the wheels" to ensure future uses aren't blocked by mistaken beliefs about the possible values. Intermediate systems (so-called "middleboxes") have to try and determine "risky" packetflows, and one of the mechanisms they use is to consider unexpected values in the known packetflows as possibly dangerous. This is an over-simplistic approach, and risks "ossifying" a protocol into the range of values which are actively in use now. Protocols usually include extra potential values for flag-fields, settings, options and the like, and these frequently have a large range of "reserved" values which are held in trust in an IANA registry, for future use. Greasing is a proposed mechanism to test out some of these values, and see what happens "on the wire" for the protocol in question. Shumon and his co-author and collaborator Mark Andrews from ISC have been applying the greasing model to the DNS, and we talked about it's history in other protocols, and how in practice greasing can be applied on the global internet.

Geolocation and Starlink

Oct 15, 2025 50 min

In this episode of PING, APNIC Chief Scientist Geoff Huston discusses a problem which cropped up recently with the location tagging of IP addresses seen in the APNIC Labs measurement system. For compiling national/economic and regional statistics, and to understand the experimental distribution into each market segment, Labs relies on the freely available geolocation databases from maxmind.com, and IPinfo.io -which in turn are constructed from a variety of sources such as BGP data, the RIR compiled resource distribution reports, Whois and RDAP declarations and the self-asserted RFC8805 format resource distribution statements that ISPs self publish. At best this mechanism is an approximation, and with increasing mobility of IP addresses worldwide it has become harder to be confident in the specific location of an IP address you see in the source of an internet dataflow, not the least because of the increasing use of Virtual Private Networks (VPN) and address cloaking methods such as Apple Private Relay, or Cloudflare Warp (although as Geoff notes, these systems do the best they can to account for the geographic distribution of their users in a coarse grained “privacy preserving” manner). Geoff was contacted by Ben Roberts of Digital Economy Kenya, a new boardmember of AFRINIC and long-time industry analyst and technical advisor. He’d noticed anomolies with the reporting of Internet statistics from Yemen, which simply could not be squared away with the realities of that segment of the Internet Economy. This in turn has lead Geoff to examine in detail the impact of Starlink on distribution of internet traffic, and make adjustments to his measurement Geolocation practices, which will become visible in the labs statistics as the smoothing functions work through the changes. Low Earth Orbit (LEO) Space delivery of Internet has had rapid and sometimes surprising effects on the visibility of Internet worldwide. The orbital mechanics mean that virtually the entire surface...

Measuring RSSAC047 Conformance

Oct 1, 2025 31 min

RSSAC047 - a document from the Root Server System Advisory Committee proposed a set of metrics to measure DNS root servers, and the DNS root server system as a whole. the document was approved in 2020, and ICANN worked on an implementation of the metrics as code, and a deployment into 20 points of measurement distributed worldwide. ISC and Verisign, two of the root server operators proposed a review of this measurement and retained SIDN Labs (who are part of the Dutch body operating .NL as a CountryCode Top-Level Domain or ccTLD) to look into how well the measurement was performing. In this episode of PING, Moritz Mullër from SIDN Labs and Duane Wessels from Verisign respectively, discuss this "measurement of the measurement" exercise, what they found out, and what it may mean for the future of metrics at the DNS Root. It's an interesting "meta conversation" about measuring things which themselves are measurements. We see this all the time in the real world, for example diagnostic imaging machines designed to measure bone density (for osteoporosis checks) require calibration, and when you want to compare a baseline over time that calibration and the specific machine become questions the clinician may want to check, assessing the results. Change machine, you get different sensitivity. So how do you line up the data? Moritz's investigations show that in some respects, the ICANN implementation of RSSAC047 was incomplete, and didn't tell an entirely accurate story about the state of the DNS Root Server System. Also, there are questions of scale and location which means a re-implementation or future improvement is worth discussing.

Faster Network design with simpler hardware: TCP Flow control and ECN.

Sep 17, 2025 52 min

In this episode of PING, APNIC Chief Scientist Geoff Huston shares a story from the recent AusNOG in Melbourne and connects it to measurement work at APNIC Labs, exploring how modern IP flow control manages ‘fair shares’ of the network. At AusNOG 2025, Geoff attended a talk by Lincoln Dale of Amazon AWS titled “No Packet Left Behind: AWS’s Approach to Building and Operating Reliable Networks”. The presentation examined how AWS scales its data centre networks, highlighting massive investments in high-speed routers and switches to support both global internet services and the vast flows of traffic between servers and other Amazon resources. What AWS doesn’t do is rely on highly complex protocols like Segment Routing over IPv6 (SRv6), Resource Reservation Protocol (RSVP), or other modern traffic engineering techniques unless absolutely necessary. Instead, they use a radically simplified, on-chip model of data management, pushing as much processing as possible into a single VLSI circuit and minimizing the amount of ‘smart’ work in the network. The question is: How can simplifying the IP stack to this extent actually work? Geoff has long been sceptical of higher-layer protocols that try to manage bandwidth reservation and shaping. He recalls an earlier attempt by Digital Equipment Corporation (DEC) to signal congestion with Explicit Congestion Notification (ECN), a mechanism that still exists in the protocol stack and now underpins new bandwidth management approaches such as Apple and Comcast’s ‘L4S’. APNIC Labs has measured how the wider Internet responds to ECN signals using an advertising-based model, and the results suggest this approach struggles outside tightly controlled, ‘walled garden’ networks. He contrasts this with advances in flow control through Google’s BBR, now in its third version, which refines the aggressive, bandwidth-seeking behaviour of TCP window management.

Whats going on in bad traffic in 2025

Sep 3, 2025 27 min

In this episode of PING, Adli Wahid, APNIC's Security Specialist discusses the APNIC honeypot network, an investment in over 400 collectors distributed throughout the Asia Pacific, collecting data on who is trying to break into systems online and use them for malware, destributed denial of service, and command-and-control systems in the bad traffic economy. Adli discusses how APNIC Members can get access to the results of honeynet traffic capture coming from their network address ranges, and originated from their AS in BGP using the DASH system. and explores some work planned for the APNIC Honeynet systems to extend their systems coverage. As well as publishing reports on APNIC's Blog and presenting at NOG meetings and conferences, Adli has coordinated information sharing from this collector network with a range of international partners such as the Shadow Server Foundation. He continues to offer training and technical assistance in security to the APNIC community and works with the CERT, CSIRT and FIRST community at large.

The Inevitability of Centrality

Aug 20, 2025 1 hr 0 min

In this episode of PING, APNIC’s Chief Scientist, Geoff Huston, discusses the economic inevitability of centrality, in the modern Internet. Despite our best intentions, and a lot of long standing belief amongst the IETF technologists, no amount of open standards and end-to-end protocol design prevents large players at all levels of the network (from the physical infrastructure right up to the applications and the data centres which house them) from seeking to acquire smaller competitors, and avoid sharing the space with anyone else. Some of this is a consequence of the drive for efficiency. A part has been fuelled by the effects of Moore’s law, and the cost of capital investment against the time available to recover the costs. In an unexpected outcome, networking has become (to all intents and purposes) “free” and instead of end-to-end, we now routinely expect to get data through highly localised, replicated sources. The main cost these days is land, electric power and air-conditioning. This causes a tendency to concentration, and networks and protocols play very little part in the decision about who acquires these assets, and operates them. The network still exists of course, but increasingly data flows over private links, and is not subject to open protocol design imperatives. A quote from Peter Thiel highlights how the modern Venture Capitalist in our space does not actively seek to operate in a competitive market. As Peter says: “competition is for losers” – It can be hard to avoid the “good” and “bad” labels talking about this, but Geoff is clear he isn’t here to argue what is right or wrong, simply to observe the behaviour and the consequences. Geoff presented on centrality to the Decentralised Internet Research Group or DINRG at the recent IETF meeting held in Madrid, and as he observes, “distributed” is not the same as “decentralised” -we’ve managed to achieve the first one, but the second eludes us.

Rob Kisteleki on RIPE Atlas

Aug 6, 2025 40 min

In this episode of PING, Robert Kisteleki from the RIPE NCC discusses the RIPE Atlas system -a network of over 13,000 measurement devices deployed worldwide in homes, exchange points, stub and transit AS, densely connected regions and sparse island states. Atlas began with a vision of the world at night -a powerful metaphor for where people are, and where technology reaches. Could a measurement system achieve sufficient density to "light up the internet" in a similar manner? Could network measurement be "democratized" to include internet citizens at large? From it's launch at the RIPE 61 meeting held in Rome Italy. with 500 probes based on a small ucLinux device designed as an ethernet converter, to 5 generations of probe hardware and now a soft probe design which can be installed on linux, and an "anchor" device which not only sends tests but can receive them, Atlas has become core technology for network monitoring, measurement and research. Rob discusses the history, design, methodology and futures of this system. A wonderful contribution from the RIPE NCC for the community at large.

A Day in the Life of BGP

Jul 23, 2025 1 hr 1 min

In this episode of PING, APNIC’s Chief Scientist, Geoff Huston, discusses "a day in the life of BGP" -Not an extraordinary day, not a special day, just the 8th of May. What happens inside the BGP system, from the point of view of AS4608, one ordinary BGP speaker on the edge of the network? What kinds of things are seen, and why are they seen? Geoff has been measuring BGP for almost it's entire life as the internet routing protocol, but this time looks at the dynamics at a more "micro" level than usual. In particular there are some things about the rate of messages and changes which points to the problems BGP faces. A small number of BGP speakers produce the vast majority of change, and overall the network information BGP speakers have to deal with as a persisting view of the world increases more slowly. Both kinds of message dynamics have to be dealt with. Can we fix this? Is there even anything worth fixing here, or is BGP just doing fine?

Kentik's view of Secure BGP in 2025

Jul 9, 2025 29 min

In this episode of PING, Doug Madory from Kentik discusses his rundown of the state of play in secure BGP across 2024 and 2025. Kentik has it’s own internal measurements of BGP behaviour and flow data across the surface of the internet, which combined with the Oregon University curated routeviews archive means Doug can analyse both the publicly visible state of BGP from archives, and Kentik’s own view of the dynamics of BGP change, along side other systems like the worldwide RPKI model, and the Internet Routing Registry systems. Doug has written about this before on the APNIC Blog in May of 2024. RPKI demands two outcomes, Firstly that the asset holders who control a given range of Internet Address sign an intent regarding who originates it the ROA, and secondly that the BGP speakers worldwide implement validation of the routing they see, known as Route Origin Validation or ROV. ROA signing is easy, and increases very simply if the delegate uses an RIR hosted system to make the signed objects. ROV is not always simple and has to be deployed carefully so has a slower rate of deployment, and more consequence in costs to the BGP speaker. Doug has been tracking both independently, as well as looking at known routing incidents in the default free zone, and therefore the impact on RPKI active networks, and everywhere else.

Downloading the root

Jun 25, 2025 57 min

In this episode of PING, APNIC’s Chief Scientist, Geoff Huston, discusses the root zone of the DNS, and some emerging concerns in how much it costs to service query load at the root. In the absence of cacheing, all queries in the DNS (except ones the DNS system you ask is locally authoritative for anyway) have to be sent through the root of the DNS, to find the right nameserver to ask for the specific information. Thanks to cacheing, this system doesn't drown in the load of every worldwide query, all the time, going through the root. But, even taking cacheing into account there is an astronomical amount of query seen at the root, and it has two interesting qualities Firstly, its growing significantly faster than the normal rate of growth of the Internet. We're basically at small incremental growth overall in new users, but query load at the root increases significantly faster, even after some more unexpected loads have been reduced. Secondly, almost all of the queries demand the answer "No, that doesn't exist" and the fact most traffic to the root hunts the answer NO means that the nature of distributed DNS cacheing of negative answers isn't addressing the fundamental burden here. Geoff thinks we may be ignoring some recent developments in proving the contents of a zone, the ZONEMD record which is a DNSSEC signed check on the entire zone contents, and emerging systems to download the root zone, and localise all the queries sent onwards into a copy of the root held in the resolver. Basically, "can we do better" -And Geoff thinks, we very probably can.

Global Cyber Alliance and measuring the bad traffic

Jun 11, 2025 34 min

In this episode of PING, We’re talking to Leslie Daigle from the Global Cyber Alliance (GCA) again, discussing GCA’s honeynet project. Leslie spoke with PING back in January 2024, and in this episode we re-visit things. Honeynets (or Honey farms) are deliberately weakly protected systems put online, to see what kinds of bad traffic exist out in the global Internet, where they come from and what kinds of attack they are mounting. In the intervening period GCA has continued to develop its honeyfarm, building out it’s own systems images, and can now capture more kinds of bad traffic. They have also bedded in the MANRS community, which is now supported by GCA worldwide. In this episode, Leslie is actually asking more questions than providing answers. If we accept that there is now a persisting problem at scale, what kinds of approaches do we need to take to “get on top” of bad traffic? It used to be we thought of this in terms of technical solutions but increasingly Leslie feels we now need to broaden the conversation and take this into Public policy and governance communities, to understand what kinds of social cost we can bear, and what socially driven objectives we want to drive to. The problem is, this is one of the tasks technologists are often the least equipped to do: Talk to people. GCA is showcasing the AIDE system, reachable at https://gcaaide.org/ as a way of opening up the conversation with national strategic policy makers, and the wider community. It’s a simple economy & region model summarising the state of honeynet detected bad traffic levels worldwide, and helps to set an agenda with which the individual ISPs and routing-active community can engage, for their locus of control.

DELEG: Changing the DNS engine in flight again

May 28, 2025 59 min

In this episode of PING, APNIC’s Chief Scientist, Geoff Huston, revisits changes underway in how the Domain Name System (DNS) delegates authority over a given zone and how resolvers discover the new authoritative sources. We last explored this in March 2024. In DNS, the word ‘domain’ refers to a scope of authority. Within a domain, everything is governed by its delegated authority. While that authority may only directly manage its immediate subdomains (children), its control implicitly extends to all subordinate levels (grandchildren and beyond). If a parent domain withdraws delegation from a child, everything beneath that child disappears. Think of it like a Venn diagram of nested circles — being a subdomain means being entirely within the parent’s scope. The issue lies in how this delegation is handled. It’s by way of nameserver (NS) records. These are both part of the child zone (where they are defined) and the parent zone (which must reference them). This becomes especially tricky with DNSSEC. The parent can’t authoritatively sign the child’s NS records because they are technically owned by the child. But if the child signs them, it breaks the trust chain from the parent. Another complication is the emergence of third parties to the delegate, who actually operate the machinery of the DNS. We need mechanisms to give them permission to make changes to operational aspects of delegation, but not to hold all the keys a delegate has regarding their domain name. A new activity has been spun up in the IETF to discuss how to alter this delegation problem by creating a new kind of DNS record, the DELEG record. This is proposed to follow the Service Binding model defined in RFC 9460. Exactly how this works and what it means for the DNS is still up in the air. DELEG could fundamentally change how authoritative answers are discovered, how DNS messages are transported, and how intermediaries interact with the DNS ecosystem. In the future, significant portions of DNS tra...

DFOH,MVP & GILL: New ways of looking at BGP

May 14, 2025 37 min

In this episode of PING, Professor Cristel Pelsser who holds the chair of critical embedded systems at UCLouvain Discusses her work measuring BGP and in particular the system described in the 2024 SIGCOMM “best paper” award winning research: “The Next Generation of BGP Data Collection Platforms” Cristel and her collaborators Thomas Alfroy, Thomas Holterbach, Thomas Krenc and K. C. Claffy have built a system they call GILL, available on the web at https://bgproutes.io This work also features a new service called MVP, to help find the “most valuable vantage point” in the BGP collection system for your particular needs. GILL has been designed for scale, and will be capable of encompassing thousands of peerings. it also has an innovative approach to holding BGP data, focussed on the removal of demonstrably redundant information, and therefore significantly higher compression of the data stream compared to e.g. holding MRT files. The MVP system exploits machine learning methods to aide in the selection of the most advantageous data collection point reflecting a researchers specific needs. Application of ML methods here permits a significant amount of data to be managed and change reflected in the selection of vantage points. Their system has already been able to support DFOH, an approach to finding forged origin attacks from peering relationships seen online in BGP, as opposed to the peering expected both from location, and declarations of intent inside systems like peeringDB.

The multiple ways to do multiple paths

Apr 30, 2025 45 min

In this episode of PING, APNIC’s Chief Scientist, Geoff Huston, discusses the history and emerging future of how Internet protocols get more than the apparent link bandwidth by using multiple links and multiple paths. Initially, the model was quite simple, capable of handling up to four links of equal cost and delay reasonably well, typically to connect two points together. At the time, the Internet was built on telecommunications services originally designed for voice networks, with cabling laid between exchanges, from exchanges to customers, or across continents. This straightforward technique allowed the Internet to expand along available cable or fibre paths between two points. However, as the system became more complex, new path options emerged, and bandwidth demands grew beyond the capacity of individual or even equal-cost links, increasingly sophisticated methods for managing these connections had to be developed. An interesting development at the end of this process is the impact of a fully encrypted transport layer on the intervening infrastructure’s ability to manage traffic distribution across multiple links. With encryption obscuring the contents of the dataflow, traditional methods for intelligently splitting traffic become less effective. Randomly distributing data can often worsen performance, as modern techniques rely on protocols like TCP to sustain high-speed flows by avoiding data misordering and packet loss. This episode of PING explores how Internet protocols boost bandwidth by using multiple links and paths, and how secure transport layers affect this process.

Pulse Internet Measurement Forum at APRICOT 2025: Part 2

Apr 16, 2025 40 min

Last month, during APRICOT 2025 / APNIC 59, the Internet Society hosted its first Pulse Internet Measurement Forum (PIMF). PIMF brings together people interested in Internet measurement from a wide range of perspectives — from technical details to policy, governance, and social issues. The goal is to create a space for open discussion, uniting both technologists and policy experts. In this second special episode of PING, we continue our break from the usual one-on-one podcast format and present a recap of why the PIMF forum was held, and the last 3 short interviews from the workshop. First we hear a repeat of Amreesh Phokeer's presentation. Amreesh is from the Internet Society and discusses his role in managing the Pulse activity within ISOC. Alongside Robbie Mitchell, Amreesh helped organize the forum, aiming to foster collaboration between measurement experts and policy professionals. Next we hear from Beau Gieskens, a Senior Software Engineer from APNIC Information Products. Beau has been working on the DASH system and discusses his PIMF presentation on a re-design to an event-sourcing model which reduced database query load and improved speed and scaling of the service. We then have Doug Madory from Kentik who presented to PIMF on a quirk in how Internet Routing Registries or IRR are being used, which can cause massive costs in BGP filter configuration and is related to some recent route leaks being seen at large in the default free zone of BGP. Finally, we hear from Lia Hestina from the RIPE NCC Atlas project. Lia is the community Development officer, and focusses on Asia Pacific and Africa for the Atlas project. Lia discusses the Atlas system and how it underpins measurements worldwide, including ones discussed in the PIMF meeting. For more insights from PIMF, be sure to check out the PULSE Forum recording on the Internet Society YouTube feed

DNS Computer says "NO"

Apr 2, 2025 44 min

In this episode of PING, APNIC’s Chief Scientist, Geoff Huston, discusses the surprisingly vexed question of how to say ‘no’ in the DNS. This conversation follows a presentation by Shumon Huque at the recent DNS OARC meeting, who will be on PING in a future episode talking about another aspect of the DNS protocol. You would hope this is a simple, straightforward answer to a question, but as usual with the DNS, there are more complexities under the surface. The DNS must indicate whether the labels in the requested name do not exist, whether the specific record type is missing, or both. Sometimes, it needs to state both pieces of information, while other times, it only needs to state one. The problem is made worse by the constraints of signing answers with DNSSEC. There needs to be a way to say ‘no’ authoritatively, and minimize the risk of leaking any other information. NSEC3 records are designed to limit this exposure by making it harder to enumerate an entire zone. Instead of explicitly listing ‘before’ and ‘after’ labels in a signed response denying a label’s existence, NSEC3 uses hashed values to obscure them. In contrast, the simpler NSEC model reveals adjacent labels, allowing an attacker to systematically map out all existing names — a serious risk for domain registries that depend on name confidentiality. This is documented in RFC 7129. Saying ‘no’ with authority also raises the question of where signing occurs — at the zone’s centre (by the zone holder) or at the edge (by the zone server). These approaches lead to different solutions, each with its own costs and consequences. In this episode of PING, Geoff explores the differences between a non-standard, vendor-explored solution, and the emergence of a draft standard in how to say ‘no’ properly.

Pulse Internet Measurement Forum at APRICOT Pt 1

Mar 19, 2025 36 min

At the APRICOT/APNIC59 meeting held in Petaling Jaya in Malaysia last month, The internet society held it's first PIMF meeting. PIMF, or the Pulse Internet Measurement Forum is a gathering of people interested in Internet measurement in the widest possible sense, from technical information all the way to policy, governance and social questions. ISOC is interested in creating a space for the discussion to take place amongst the community, and bring both technologists and policy specialists into the same room. This time on PING, instead of the usual one-on-one format of podcast we've got 5 interviews from this meeting, and after the next episode from Geoff Huston at APNIC Labs we'll play a second part, with 3 more of the presenters from this session. First up we have Amreesh Phokeer from the Internet Society who manages the PULSE activity in ISOC, and along with Robbie Mitchell set up the meeting. Then we hear from Christoph Visser from IIJ Labs in Tokyo, who presented on his measurements of the "Steam" Game distribution platform used by Valve Software to share games. It's a complex system of application-specific source selection, using multiple Content Distribution Networks (CDN) to scale across the world, and allows Christoph to see into the link quality from a public API. No extra measurements required, for an insight into the gamer community and their experience of the Internet. The third interview is with Anand Raje, from AIORI-IMN, India’s Indigenous Internet Measurement System. Anand leads a team which has built out a national measurement system using IoT "orchestration" methods to manage probes and anchors, in a virtual-environment which permits them to run multiple independent measurement systems hosted inside their platform. After this there's an interview with Andre Robachevsky from Global Cyber Alliance (GCA). Andre established the MANRS system, it's platform and nurtured the organisation into being inside ISOC. MANRS has now moved into the care of GC...

Night of the BGP Zombies

Mar 5, 2025 58 min

In this episode of PING, APNIC’s Chief Scientist, Geoff Huston explores bgp "Zombies" which are routes which should have been removed, but are still there. They're the living dead of routes. How does this happen? Back in the early 2000s Gert Döring in the RIPE NCC region was collating a state of BGP for IPv6 report, and knew each of the 300 or so IPv6 announcements directly. He understood what should be seen, and what was not being routed. He discovered in this early stage of IPv6 that some routes he knew had been withdrawn in BGP still existed when he looked into the repositories of known routing state. This is some of the first evidence of a failure mode in BGP where withdrawal of information fails to propagate, and some number of BGP speakers do not learn a route has been taken down. They hang on to it. Because BGP is a protocol which only sends differences to the current routing state as and when they emerge (if you start afresh you get a LOT of differences, because it has to send everything from ground state of nothing. But after that, you're only told when new things come and old things go away) it can go a long time without saying anything about a particular route: if its stable and up, nothing to say, and if it was withdrawn, you don't have it, to tell people it's gone, once you passed that on. So if somehow in the middle of this conversation a BGP speaker misses something is gone, as long as it doesn't have to tell anyone it exists, nobody is going to know it missed the news. In more recent times, there has been a concern this may be caused by a problem in how BGP sits inside TCP messages and this has even led to an RFC in the IETF process to define a new way to close things out. Geoff isn't convinced this diagnosis is actually correct or that the remediation proposed is the right one. From a recent NANOG presentation Geoff has been thinking about the problem, and what to do. He has a simpler approach which may work better.

RPKi Views: The archive of RPKI state

Feb 19, 2025 49 min

In this episode, Job Snijders discusses RPKIViews, his long term project to collect the "views" of RPKI state every day, and maintain an archive of BGP route validation states. The project is named to reflect route views, the long-standing archive of BGP state maintained by the University of Oregon, which has been discussed on PING. Job is based in the Netherlands, and has worked in BGP routing for large international ISPs and content distribution networks as well as being a board member of the RIPE NCC. He is known for his work producing the Open-Source rpki-client RPKI Validator, implemented in C and distributed widely through the OpenBSD project. RPKI is the Resource PKI, Resource meaning the Internet Number Resources, the IPv4, IPv6 and Autonomous System (AS) numbers which are used to implement routing in the global internet. The PKI provides cryptographic proofs of delegation of these resources and allows the delegates to sign over their intentions originating specific prefixes in BGP, and the relationships between the AS which speak BGP to each other. Why rpkiviews? Job explains that there's a necessary conversation between people involved in the operational deployment of secure BGP, and the standards development and research community: How many of the worlds BGP routes are being protected? How many places are producing Route Origin Attestations (ROA) which are the primary cryptographic object used to perform Route Origin Validation (ROV) and how many objects are made? Whats the error rate in production, the rate of growth, a myriad of introspective "meta" questions need to be asked in deploying this kind of system at scale, and one of the best tools to use, is an archive of state, updated frequently, and as for route views collected from a diverse range of places worldwide, to understand the dynamics of the system. Job is using the archive to produce his annual "RPKI Year in review" report, which was published this year on the APNIC blog (it's posted to...

How Many DNS Nameservers is enough?

Feb 5, 2025 59 min

In his first episode of PING for 2025, APNIC’s Chief Scientist, Geoff Huston returns to the Domain Name System (DNS) and explores the many faces of name servers behind domains. Up at the root, (the very top of the namespace, where all top-level domains like .gov or .au or .com are defined to exist) there is a well established principle of 13 root nameservers. Does this mean only 13 hosts worldwide service this space? Nothing could be farther from the truth! literally thousands of hosts act as one of those 13 root server labels, in a highly distributed worldwide mesh known as "anycast" which works through BGP routing. The thing is, exactly how the number of nameservers for any given domain is chosen, and how resolvers (the querying side of the DNS, the things which ask questions of authoritative nameservers) decide which one of those servers to use isn't as well defined as you might think. The packet sizes, the order of data in the packet, how it's encoded is all very well defined, but "which one should I use from now on, to answer this kind of question" is really not well defined at all. Geoff has been using the Labs measurement system to test behaviour here, and looking at basic numbers for the delegated domains at the root. The number of servers he sees, their diversity, the nature of their deployment technology in routing is quite variable. But even more interestingly, the diversity of "which one gets used" on the resolver side suggests some very old, out of date and over-simplistic methods are still being used almost everywhere, to decide what to do.

RISKY BIZ-ness

Jan 22, 2025 44 min

Welcome back to PING, at the start of 2025. In this episode, Gautam Akiwate, (now with Apple, but at the time of recording with Stanford University) talks about the 2021 Advanced Network Research Prize winning paper, co-authored with Stefan Savage, Geoffrey Voelker and Kimberly Claffy which was titled "Risky BIZness: Risks Derived from Registrar Name Management". The paper explores a situation which emerged inside the supply chain behind DNS name delegation, in the use of an IETF protocol called Extensible Provisioning Protocol or EPP. EPP is implemented in XML over the SOAP mechanism, and is how registry-registrar communications take place, on behalf of a given domain name holder (the delegate) to record which DNS nameservers have the authority to publish the delegated zone. The problem doesn't lie in the DNS itself, but in the operational practices which emerged in some registrars, to remove dangling dependencies in the systems when domain names were de-registered. In effect they used an EPP feature to rename the dependency, so they could move on with selling the domain name to somebody else. The problem is that feature created valid names, which could themselves then be purchased. For some number of DNS consumers, those new valid nameservers would then be permitted to serve the domain, and enable attacks on the integrity of the DNS and the web. Gautam and his co-authors explored a very interesting quirk of the back end systems and in the process helped improve the security of the DNS and identified weaknesses in a long-standing "daily dump" process to provide audit and historical data.

Post-Quantum Cryptography

Dec 11, 2024 1 hr 5 min

In the last episode of PING for 2024, APNIC’s Chief Scientist Geoff Huston discusses the shift from existing public-private key cryptography using the RSA and ECC algorithms to the world of ‘Post Quantum Cryptography. These new algorithms are designed to withstand potential attacks from large-scale quantum computers and are capable of implementing Shor’s algorithm, a theoretical approach for using quantum computing to break the cryptographic keys of RSA and ECC. Standards agencies like NIST are pushing to develop algorithms that are both efficient on modern hardware and resistant to the potential threats posed by Shor’s Algorithm in future quantum computers. This urgency stems from the need to ensure ‘perfect forward secrecy’ for sensitive data — meaning that information encrypted today remains secure and undecipherable even decades into the future. To date, maintaining security has been achieved by increasing the recommended key length as computing power improved under Moore’s Law, with faster processors and greater parallelism. However, quantum computing operates differently and will be capable of breaking the encryption of current public-private key methods, regardless of the key length. Public-private keys are not used to encrypt entire messages or datasets. Instead, they encrypt a temporary ‘ephemeral’ key, which is then used by a symmetric algorithm to secure the data. Symmetric key algorithms (where the same key is used for encryption and decryption) are not vulnerable to Shor’s Algorithm. However, if the symmetric key is exchanged using RSA or ECC — common in protocols like TLS and QUIC when parties lack a pre-established way to share keys — quantum computing could render the protection ineffective. A quantum computer could intercept and decrypt the symmetric key, compromising the entire communication. Geoff raises concerns that while post-quantum cryptography is essential for managing risks in many online activities — especially for protecting highly se...

Measuring DNSSEC keying "drift" between parent and child

Nov 27, 2024 36 min

This time on PING, Peter Thomassen from SSE and DEsec.io discusses his analysis of the failure modes of CDS and CDNSKEY records between parent and child in the DNS. These records are used to provide in-band signalling of the DS record, fundamental to the maintenance of a secure path from the trust anchor to the delegation through all the intermediate parent and grandparent domains. Many people use out-of-band methods to update this DS information, but the CDS and the CDNSKEY records are designed to signal this critical information inside the DNS, avoiding many of the pitfalls of passing through a registry-registrar web service. The problem is, as Peter has discovered, the information across the various nameservers (denoted by the NS record in the DNS) of the child domain can get out of alignment, and the tests a parent zone need to do checking CDS and CDNSKEY information aren't sufficiently specified to wire down this risk. Peter performed a "meta analysis" inside a far larger cohort of DNS data captured by Florian Steurer and Tobias Fiebig at the Max Planck Institute and discovered a low but persisting error rate, a drift in the critical keying information between a zones NS and the parent. Some of these related to transitional states in the DNS (such as when you move registry or DNS provider) but by no means all, and this has motivated Peter and his co-authors to look at improved recommendations for managing CDS/CDNSKEY data, to minimise the risk of inconsistency, and the consequent loss of secure entry path to a domain name.

The IPv6 Transition

Nov 13, 2024 59 min

In his regular monthly spot on PING, APNIC’s Chief Scientist Geoff Huston discusses the slowdown in worldwide IPv6 uptake. Although within the Asia-Pacific footprint we have some truly remarkable national statistics, such as India which is now over 80% IPv6 enabled by APNIC Labs measurements, And Vietnam which is not far behind on 70% the problem is that worldwide, adjusted for population and considering levels of internet penetration in the developed economies, the pace of uptake overall has not improved and has been essentially linear since 2016. In some economies like the US, a natural peak of around 50% capability was reached in 2017 and since then uptake has been essentially flat: There is no sign of closure to a global deployment in the US, and many other economies. Geoff takes a high level view of the logisitic supply curve with the early adopters, early and late majority, and laggards, and sees no clear signal that there is a visible endpoint, where a transition to IPv6 will be "done". Instead we're facing a continual dual-stack operation of both IPv4 (increasingly behind Carrier Grade Nats (CGN) deployed inside the ISP) and IPv6. There are success stories in mobile (such as seen in India) and in broadband with central management of the customer router. But, it seems that with the shift in the criticality of routing and numbering to a more name-based steering mechanism and the continued rise of content distribution networks, the pace of IPv6 uptake worldwide has not followed the pattern we had planned for.

A student-led IPv6 deployment at NITK Karnataka

Oct 30, 2024 27 min

In this episode of PING, Vanessa Fernandez and Kavya Bhat, two students from the National Institute of Technology Karnataka (NITK) discuss the student led, multi-year project to deploy IPv6 at their campus. Kavya & Vanessa have just graduated, and are moving into their next stages of work and study in computer sciences and network engineering. Across 2023 and 2024 they were able to attend IETF118 and IETF119 and present on their project and it’s experiences to the IPv6 working groups and off-Working Group meetings, in part funded by the APNIC ISIF Project and the APNIC Foundation. This multi-year project is supervised by the NITK Centre for Open-source Software and Hardware (COSH) and has outside review from Dhruv Dhody (ISOC) and Nalini Elkins (Inside Products inc). Former students have also acted as alumni and remain involved in the project as it progresses. We often focus on IPv6 deployment at scale in the telco sector, or experiences with small deployments in labs, but another side of the IPv6 experience is the large campus network, in scale equivalent to a significant factory or government department deployment but in this case undertaken by volunteer staff, with little or no prior experience of networking technology. Vanessa and Kavya talk about their time on the project, and what they got to present at IETF.

–

0 ratings from members

Rate this podcast

No reviews yet — be the first member to rate "PING".

This podcast, its content and its artwork are not owned by, affiliated with, or endorsed by Castquire.

Submarine Cable resilience and economics

Share this podcast

Live Chart rankings

Chart history

🇧🇷 Tech News Best #106

Holding at #106 — the line fills in as this chart moves.

🇿🇦 Tech News Best #146

Holding at #146 — the line fills in as this chart moves.

Podcast details

Created by: APNIC
Status: Active
Latest episode: Nov 11, 2026
Episodes: 50
Release period: Every two weeks
Avg. episode length: 43 min
Explicit: No
Language: English

Links

Official website ↗ Apple Podcasts ↗ RSS feed ↗

Is this your podcast?

Claim it to show it on your profile. Using the email from your RSS feed approves it instantly.

Keep listening

Discover more podcasts like this.

Browse podcasts See the charts