Because routers typically forward packets solely according to destination address, they cannot distinguish AUP-compliant traffic from other traffic. Under destination-based routing, all sites at one end of the link would take the shortest path to the other--which, in our case, would inevitably be over TransPAC, since its metric is shorter than that for the commercial Internet. When there are multiple paths from point "A" to point "B," destination-based IP routing has a hard time doing the "right thing," from a policy standpoint. This type of routing dilemma is commonly called the fish-routing problem (see "Bonus Points: A Fish Called WANda," below).

Fortunately, Cisco has a flexible set of knobs (user-controllable parameters), which it dubs route-maps, that allow the router to be configured to route packets based on both destination and source address, a process known as explicit routing. To implement this function, a table is constructed that identifies all the source-destination pairs that require special handling. Armed with the table, the router can make the appropriate routing decision.

But though route-maps provide a workable remedy, they're rather slow, and the longer the list of source-destination pairs, the slower the route-map. Suppose you have 50 Asian sites connecting with 100 vBNS sites. You'd end up with a route-map list of 5,000 lines. That's too long.

We pondered several possible solutions, ranging from dynamically updating the list of route-maps so that only currently in-use applications would be represented, to monitoring the link to determine the most-used route-map source-destination pairs and moving them to the top of the list (testing revealed that the router searched the list sequentially). We finally settled on a different approach: If we could keep the route-map list short, the problem would be manageable. Rather than define source-destination pairs, we used the route-map to identify packets coming from institutions permitted to use TransPAC, regardless of their destination. This trimmed the list to just one line per TransPAC authorized institution. Packets from these authorized institutions were routed to a second router. The second router had a different forwarding view of the network, one that used TransPAC for all packets destined for STAR TAP-connected sites in the United States.