ken@gvax.cs.cornell.edu (Ken Birman) (02/07/90)
>From: Debashish Chatterjee <chatterj@cs.unc.edu> >Subject: If network fails... > I was wondering if network fails and hosts running ISIS gets partitioned, > then would each partition consider the group view to be the hosts among > its partition or would one arbitrary partition be the only sites on which > ISIS processes may execute? > The document mentions that if a site is unresponsive it would be considered > dead and brought up with new incarnation #.But what if the above scenario > occurs?I haven't been able to test it as I can't partition our net without > stormy objections from facilities. Although we are moving ISIS towards a limited type of partition tolerance, the present system and release V2.0 will both behave in the latter way: the partition that happens to have the majority of the sites will keep running while everyone else commits Hari-Kari (you get a message about being in a "possible minority partition"). The theoretical problem that forces this on us relates to the inability to achieve multicast atomicity in non-blocking protocols when partitions may occur. If you are really confronted with this sort of a network, you would be best off using the long-haul facility of the spooler to interconnect servers running, independently, on each side -- and treat each side as a separate ISIS system. This isn't as bad as it sounds -- we are writing a paper now on the programming style this suggests, and it turns out to be quite powerful. (This is the same approach you would use to link ISIS systems across the Atlantic). Ken