February 1997 - NANOG - lists.nanog.org

RE: Just got on this thing (perhaps very belatedly) - root server trouble?
by Jim Fleming 19 Feb '97

19 Feb '97

On Tuesday, February 18, 1997 11:18 AM, Michael Dillon[SMTP:michael@memra.com] wrote: @ On Tue, 18 Feb 1997, Karl Denninger wrote: @ @ > Folks, we run the network (this *IS* NANOG, right? :-) Let's start actually @ > running it for a change... DNS is one of those things that we ought to be @ > able to do right, and do in an open and competitive format. @ @ Seems to me that we on NANOG are concerned with mostly issues that fall at @ layers 2-4. You are talking about things like competition that really are @ only marginally related to most people on NANOG. @ @ Michael Dillon - Internet & ISP Consulting @ Memra Software Inc. - Fax: +1-250-546-3049 @ http://www.memra.com - E-mail: michael(a)memra.com @ @ @ I can not wait until the day comes when we see our friend from Canada, Mr. Michael Dillon, trying to invade the floor of the United States Senate or the House of Representatives to tell those folks what they are allowed to discuss. Something tells me that they will not really care that you are on the Board of Directors of the ISP/C Mr. Dillon. Of course, you are welcome to prove me wrong. -- Jim Fleming Unir Corporation e-mail: JimFleming(a)unety.net JimFleming(a)unety.s0.g0 (EDNS/IPv8)

1 0

RE: F means filtered ?
by Jim Fleming 19 Feb '97

19 Feb '97

On Monday, February 17, 1997 6:50 AM, Tim Salo[SMTP:salo@msc.edu] wrote: @ > From: Jim Fleming <JimFleming(a)unety.net> @ > Subject: RE: F means filtered ? @ > Date: Mon, 17 Feb 1997 11:58:07 -0600 @ > [...] <snip> @ @ In my opinion, the U.S. Government and the NSF have far more important @ things to do. Many of these more important things will continue to @ develop and strengthen the Internet infrastructure. @ @ It is also worth noting that every U.S. Government or NSF research contract @ I have read contains explicit language about the ideas generated through @ the grant are not endorsed by the funding agency. @ @ -tjs @ @ Tim, You may have missed the following.... The United States of America is a great nation that has been one of the primary leaders in the development of information technology. The Internet is largely derived from government funded projects and without the security, stability, and staying power of the U.S. Government, the large number of Internet users around the world would not be jumping on board the Information Superhighway. Many people and companies have placed trust in the U.S. Government. The U.S. Government places trust in God. (According to the back of a one dollar bill). Despite the fact that many people on the Internet place trust in the IANA, the IETF, the IAHC, the IAB, the IESG and other I* organizations, the fact remains that the U.S. Government backs the Internet. (and the U.S. dollar) Within the U.S. Government various agencies and organizations have helped to move the Internet forward and to provide the representative government needed on the Internet for people to safely make investments in time and money with the knowledge that a democractic and capitalistic group of people are in control. One of the primary agencies helping to fund the Internet has been the U.S. Government funded National Science Foundation (NSF). <http://www.nsf.gov> The NSF has been the primary agency helping to fund and provide the clout for the cooperative acitivity commonly called the InterNIC. The InterNIC was originally made up of three companies, General Atomics, AT&T, and Network Solutions, Inc. These three companies were supposed to work together in various capacities to provide a variety of services including the important clerical duties commonly called "registrations". In the original plan, General Atomics was supposed to be the NIC of NICs and coordinate the activities of the other two companies. The NSF was supposed to oversee the entire activity. If managed properly, many NICs would have been developed through education programs and the Internet Infrastructure would have been expanded beyond the State of Virginia and the few companies originally contracted to be part of the cooperative agreement. That has not occurred. The history of the evolution of the InterNIC has been well-documented and is very clear. In their original proposal to the NSF, Network Solutions, Inc. suggested that they should do the entire job. Jon Postel and Joyce Reynolds of the IANA, are listed on the original Network Solutions, Inc. bid as subcontractors to Network Solutions, Inc. As history has shown, the IANA, working in conjunction with the "InterNIC" (Network Solutions, Inc.) has helped to continue to promote Network Solutions, Inc. to a point where most people consider NSI to be the InterNIC. Throughout the evolution of the InterNIC from a three-company cooperative to a one company monopoly, the NSF has apparently been caught like a deer in the headlights of a car, frozen in indecision but providing mass when needed to allow a few individuals and companies to leverage themselves into positions of great wealth. The NSF has been skillfully used to provide the U.S. Government seal of approval, while policies are enacted by private parties who openly claim that the NSF is "backing" their agendas. Many companies operating within the United States under Federal and State laws, have been shocked over the past few years at how their tax dollars are used to fund the NSF which in turn funds Internet infrastructure with apparently no control over the outcome. Furthermore, despite repeated efforts by other companies to participate in and make investments in the Internet infrastructure, the NSF has stood by and allowed plans and systems to be developed which lock certain companies out while others are given a free pass and in some cases millions of dollars to jump start their business. The recent IAHC <http://www.iahc.org> activity is an excellent example of how a private company (ISOC) <http://www.isoc.org>, with less members than many ISPs, is provided an NSF representative, Dr. George Strawn, <http://www.cise.nsf.gov/ncri/Georgehome.html> for credibility, while they develop a plan to sell what amounts to Internet Domain Registration Franchises to companies willing to pay large fees to fund the private ISOC. Another example is the recently proposed ARIN <http://www.arin.net> organization which claims to have strong support from the NSF to charge fees for IP addresses. The proposed Board of Direcors of ARIN are mostly people funded directly, or indirectly, by the National Science Foundation. <http://www.arin.net/arin_board.html> @@@@@ <http://www.arin.net/arin_faq.html> @@@@@@@@@ "Network Solutions is leading the ARIN proposal based on a mandate from the Internet community reached in rough consensus with strong support from the National Science Foundation and the Internet Assigned Numbers Authority (IANA)." @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Fortunately, the U.S. Government had the wisdom to set up an agency within the NSF to provide some of the checks and balances needed to regulate the NSF. That agency is the Office of Inspector General (OIG) <http://www.nsf.gov/oig/oig.htm>. OIG is headed by the Inspector General (IG), who reports directly to the President (via the NSB) and to Congress. ---- Inspector General ------- name: Sundro, Linda G. email: lsundro(a)nsf.gov directorate: Office of Inspector General phone: (703)306-2100 office_phone: (703) fax: (703)306-0649 address: 4201 Wilson Blvd., Room 1135S : Arlington, VA 22230 -------------------------------------- In a recent discussion with Ms. Sundro, she indicated that the NSF Office of Inspector General has been investigating the matters surrounding the InterNIC and a Report to the Deputy Director is about to be published. Ms. Sundro indicated that Ms. Clara Kuehn, a physicist AND ATTORNEY, has been assigned to handle the investigations and can provide information on the status of the report. -------------------------------------- name: Kuehn, Clara email: ckuehn(a)nsf.gov directorate: Office of Inspector General phone: (703)306-2001 office_phone: (703)306-2001 x 1505 fax: (703)306-0649 address: 4201 Wilson Blvd., Room 1135S : Arlington, VA 22230 ------------------------------------------ Ms. Sundro also noted that the e-mail address (oig(a)nsf.gov) listed on the Office of Inspector General web site as an "Electonic Mail Hotline" is not useful in contacting her office. She indicated that Ms. Kuehn will welcome input from people on all topics related to these matters and that the above e-mail address (ckuehn(a)nsf.gov) should be used. In summary, I think that U.S. citizens should be proud that their great country developed much of the technology and infrastructure for the Internet. I also think that the world population should be aware that the hundreds of years of government development in the U.S. has resulted in a system that has the proper agencies to not only help to foster increased growth of the Internet but also to help ensure that citizens around the world are able to compete in this marvelous advancement on a playing field that is fair and level. -- Jim Fleming Unir Corporation e-mail: JimFleming(a)unety.net JimFleming(a)unety.s0.g0 (EDNS/IPv8)

2 1

Re: Just got on this thing (perhaps very belatedly) - root server trouble?
by John Todd 19 Feb '97

19 Feb '97

[data about ~30% of .com zones not backed by SOA records removed] <sthaug(a)nethelp.no> on 02/18/97 23:09 said: > > Karl Denninger <karl(a)Mcs.Net> on 02/18/97 18:59 said: > > > > This is a direct result of NSI accepting applications for domains, and > > listing them, without checking for authoritative SOA records before issuing > > the records in the COM zone! > > > > I'm apalled at these numbers. > > For once we agree. NSI should have stopped this practice long ago. You'll > be pleased to hear that there are other name registries (for instance the > one serving the "no" (Norway) TLD that actually perform this check. > > Note that checking when an application is received isn't really enough. > In Norway we run regular (monthly) checks of all the second-level domains > under "no", and we always find a number of name servers which have ceased > being authoritative in the time since last check. > > Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no I couldn't agree more. There are any number of both political and technical reasons that the SOA should be checked on zones before they appear in any root nameservers, and it doesn't seem that large a task to prevent bogus zones from making it into the root nameservers. Why non-SOA zones shouldn't make it into the root nameservers: - lame zones are inherently broken; why allow brokeness to exist? - if it's not in the nameserver, the "owner" of the nameserver hasn't given explicit permission for it to be there (see below under "lawsuits") - filling the root nameservers with bad NS pointers only wastes time with timeout queries that stick around too long (not a big deal with people who have no data at all in either server, but what about zones that one of the nameservers is lame? That would cause the 5-10 second lag time for a "valid" zone when the "invalid" nameserver was asked abouft it.) - people who point secondary at non-SOA nameservers without telling the secondary that this is expected break not only themselves, but bring complaints against the innocent "secondary" provider who has complaints that "Your nameserver is broken!" How to prevent bogus SOA's: - before propogating the name into the roots, check for SOA - if SOA fails, then list the name in some sort of "Reserved" status, just like names that are pending payment, but make it possible for a name to remain in "Reserved" status forever (see "lawsuits-2" below) - if initial SOA test fails, check SOA every X number of days until valid. - every X number of months, check to ensure SOA is still present in listed nameservers. - If invalid, wait another Y days, and try again. After Z iterations of failures, pull the NS pointers and list the zone as "Reserved" for XX number of days or until someone calls in and whines, at which point check SOA by hand. Diatribe: There have been occasions where persons have sent in top-level domain registrations with nameservers listed as secondary that had _nothing_ to do with the primary, and had never even heard of the primary. If foo.com wanted to point their secondary at any particular nameserver (or even a random IP address!) there is nothing that anyone can do to prevent them. Suddenly, an innocent bystanding nameserver admin starts getting flames from SPAM victims and other sundry folk simply because their name happens to be in the NS list for that zone. I also hate trying to dig around (no pun intended) to find if there is any information at all that is valid for a zone, if the old ISP is still in business, if that network just isn't visible from where I am, etc. I am involved with a lot of transfers, and I'd rather know that the old nameservers are just non-existant rather than trying to sleuth things down. Lawsuits: Imagine that the domain "humongouscompany.com" is registered with ns.bigprovider.com and ns2.bigprovider.com. Recently angered by the current sale of routers in China by Humongouscompany, and _equally_ angered at the recent banning of his IP address from smallprovider.com's IRC server, a clever hacker spoofs an email message from the admin contact at humongouscompany.com and requests that the nameservice be moved from [ns,ns2].bigprovider.com and pointed at [ns,ns2].smallprovider.com. The next root nameserver reboot, humongouscompany.com is out of luck, as there are no records in place for that zone in [ns,ns2].smallprovider.com's nameservers. Smallprovider is completely innocent here, but guess who gets slammed in that morning's TechWizDaily? Lawsuits-2: Well, a good argument has been made that "if an SOA is required, then there is criteria for getting added to the root nameserver, and the NIC has to be impartial and take all comers who have the $100 to register." OK, no problem. Just register the name, make it impossible for anyone else to take that particular combination of letters/numbers, but don't point the zone anywhere. Summary: These ideas have been floated past some of the registration managment at the InterNIC, and hopefully they'll take this into consideration. This would prevent the 30% attrition that Karl reports that he's discovered. Any comments? Does anyone else feel that the NIC should go back to checking SOA's with the addition of an additional "no-SOA" or "Reserved" status? JT --- John Todd jtodd(a)fox-den.com

1 0

Re: Unsubstantiated Rumor - this is not simply about RBOC ISP Tariff
by salo＠msc.edu 18 Feb '97

18 Feb '97

> Date: Mon, 17 Feb 1997 23:13:21 -0800 (PST) > From: David Holub <david(a)hooked.net> > To: Tim Salo <salo(a)msc.edu> > Cc: nanog(a)merit.edu > Subject: Re: Unsubstantiated Rumor - this is not simply about RBOC ISP Tariff > [...] > I'm very aware of what a "telecommunications carrier" is and without boring > you with the details I'm also very secure in Whole Earth Networks ability to > fall under that definition. ... One interesting attribute of telecommunications carriers is that they all seem to have big legal departments. Be careful what you wish for... -tjs [By the way, given the number of people who want someone to regulate some aspect of the Internet, I suspect that we will see the day when all ISPs have lawyers. On the other hand, it doesn't make much sense to me to try to hasten the arrival of this era.]

1 0

Re: Just got on this thing (perhaps very belatedly) - root server trouble?
by salo＠msc.edu 18 Feb '97

18 Feb '97

From: Karl Denninger <karl(a)Mcs.Net> Date: Tue, 18 Feb 1997 15:29:33 -0600 (CST) > About 30% of the nameservers which supposedly > are authoritative for .COM domains are either: > 1) Non-existant (they don't resolve to an IP address) > 2) Unreachable > or 3) Don't know what "." is (!) This might say more about the status of Internet reachability at a particular point time and/or from a particular place in the Internet. This exercise doesn't seem like particularly good science... -tjs

2 1

URLs presented in the talks at NANOG9
by Stan Barber 18 Feb '97

18 Feb '97

Here are the various URLs I have collected as a result of the talks at NANOG 9. If you were a speaker and you don't see a URL listed here, then I don't have it. Please send it to me as soon as you can. I also have hard copy from Steve Feldman, Bill Manning and WeeSan Lee, but if you folks have URLs for me, that would be great. Alternatively, you can mime-mail me your slides. I accept most anything including PowerPoint and Postscript. Thanks Steve Corbato - http://weber.u.washington.edu/~corbato/nanog-sf Dave Meyer - http://ns.oregon.edu/~meyer/I2 Mark Kosters - http://rs.internic.net/presentations/marrk/nanog9702.html Randy Bush - http://psg.com/~randy/970210.nanog Curtis Villamizar - ftp://engr.ans.net/pub/slides/nanog/feb-1997/tcp*.ps

2 1

lbnamed
by Jim Fleming 18 Feb '97

18 Feb '97

By the way, if NANOG people are interested in learning more about building your own name servers you might want to go to Yahoo and type "lbnamed". That stands for load balancing "named". You will probably locate a reference to... http://www-leland.stanford.edu/~schemers/docs/lbnamed/lbnamed.html With that code, you should be able to build your own TRUE Root Name Server in a day or two. Have fun... -- Jim Fleming Unir Corporation e-mail: JimFleming(a)unety.net JimFleming(a)unety.s0.g0 (EDNS/IPv8)

1 0

RE: Just got on this thing (perhaps very belatedly) - root server trouble?
by Jim Fleming 18 Feb '97

18 Feb '97

On Tuesday, February 18, 1997 3:09 PM, Jeffrey C. Ollie[SMTP:jeff@ollie.clive.ia.us] wrote: @ -----BEGIN PGP SIGNED MESSAGE----- @ @ On Tue, 18 Feb 1997 13:01:06 -0600 (CST), karl(a)mcs.net writes: @ > @ >In fact, our solution has you *SECONDARYING* ".", which means that in @ >general, other than the requirement for you to be able to reach a source for @ >that file on a every-few-days basis (to check the SOA record) you no longer @ >NEED connectivity to the root domain. @ > @ >This is demonstrably superior; you no longer need to make that query for @ >".", as you already know who is authoritative for all the TLDs under ".". @ @ Yiiii... Having everyone secondary "." sounds demonstrably inferior to @ me. Just think what would happen if every nameserver that is @ authoritative for a .com domain started secondarying ".". There are @ approximately 50,000 name servers that are authoritative for .com @ (according to the .com zone file from the InterNIC). That would mean @ that the system ROOT-NS.MCS.NET would waste around 5 queries per @ second because those 50,000 name servers would be trying to check the @ SOA (at the time that I write this, the eDNS servers list a 3 *hour* @ refresh interval for the root zone with a 15 *minute* retry @ interval). Just think what will happen to poor ROOT-NS.MCS.NET when @ the serial number changes! @ There are really two approaches being used. Actually three if you include the current InterNIC approach of allowing some TLDs (like .COM, .NET, etc.) to be served from the Root Name Server. The two approaches could be called: 1. Secondarying 2. TRUE Root In both approaches you might want to keep in mind that the objective is to create a Root Name Server (i.e. a server for servers) as opposed to a standard ISP Name Server or a TLD Name Server that might be found in a TLD registry operation. In the first approach, Secondarying, a Root Name Server is created by taking a rather standard ISP Name Server and pulling in (via the secodarying of ".") a rather static base of information about the location of the TLD Name Servers. There are several benefits to this approach: 1. People can easily reconfigure an existing server to do this as well as other name services. 2. The zone transfer features can be used to make the update of "." easy from some central coordinator. 3. As Karl has pointed out, you mostly run with better performance because you have pulled a view of the entire TLD world in and periodically get it updated. The disadvantages are mostly philosophical in that this type of Root Name Server can end up being a jack of all trades and a master of too much or none depending on how you view it. Keep in mind that as a Root Name Server it still can be used to serve ISP Name Servers which was the objective. The second approach (TRUE Root) takes a purists view of a Root Name Server and only TLD Name Server referral information is hosted on the machine. Queries that make their way to this type of server are easily handled. A query about a .COM domain name is answered with only information on where the .COM TLD Name Servers can be found. There are several benefits to this approach: 1. The software for this type of name server is trivial and can be made to be very efficient. The role of this server is very bounded and therefore cumbersome "named" software with years of whistles and bells is not required. We have written two versions of "named" for such a server and each took little effort. One is in Perl and the other is in C. The flag-ship version will of course be in C+@. 2. The administration and operations can be made to be more robust again because the server plays a limited role and therefore there is no way that an administrator can turn this type of server into a complex multi-role server as seen today on the legacy Root Name Servers. 3. This type of server can be easily scaled and generally has very little load because it serves ISP Name Servers and they rarely need to relocate the high runner TLD Name Servers that do not move that often, especially .COM, .NET, etc. The major disadvantage of this type of server is the added cost and the fact that it makes the most sense isolated on a bullet-proof machine. Many ISPs do not have the luxury of having spare machines to throw at such problems as an experiment. The InterNIC of course just deployed 4 such machines but they have $8,000,000 per month in domain registrations to help pay for gear. In my opinion, it is good for NANOG members to understand all of the ins and out of the DNS and the various ways to configure name servers. It is not productive for people to continue to tell people that only certain individuals can understand what really amounts to a protocol and a data base and some rather trivial software to make it all work. I hope these notes help NANOG members as well as other people experimenting with the AlterNIC, Root 64, Root 128, or even the new IANA TRUE Root Name Servers....:-) -- Jim Fleming Unir Corporation e-mail: JimFleming(a)unety.net JimFleming(a)unety.s0.g0 (EDNS/IPv8)

1 0

RE: F means filtered ?
by Jim Fleming 18 Feb '97

18 Feb '97

On Tuesday, February 18, 1997 7:07 AM, Karl Denninger[SMTP:karl@Mcs.Net] wrote: @ > @ > > I think actually the question that Jim was asking is whether Paul filters @ > > access to the root name server he runs based on his Spam Blacklist. It @ > > seems to be a valid question. @ @ Paul wrote: @ @ > Yes, I do. I have no opinion on whether spammers should or should not be @ > able to reach any given root name server, including "mine", but for the time @ > being I lack the hardware needed to firewall f.root-servers.net differently @ > than I do the rest of my network. @ @ Uh, that is a serious issue. @ @ If you filter the root server that you run according to your "spam list", @ then you are not providing a public service on equal footing to all comers. @ @ I dislike spam and UCE as much as the next person, but I find this kind of @ policy statement and implementation abhorrent when you're talking about a @ *public* resource. @ @ If you wish to do that its fine with me, but then F.root-servers.net needs @ to be replaced by a machine which is not subject to these filters. @ @ Root servers aren't private things, expecially when you hold them out to the @ public... @ @ -- @ -- @ Karl Denninger (karl(a)MCS.Net)| MCSNet - The Finest Internet Connectivity @ http://www.mcs.net/~karl | T1's from $600 monthly to FULL DS-3 Service @ | 99 Analog numbers, 77 ISDN, Web servers $75/mo @ Voice: [+1 312 803-MCS1 x219]| Email to "info(a)mcs.net" WWW: http://www.mcs.net/ @ Fax: [+1 312 803-4929] | 2 FULL DS-3 Internet links; 400Mbps B/W Internal @ @ Karl, Your points about private and public Root Name Servers are important for people to understand, even if they do not know how DNS works. As confirmed on this NANOG mailing list, the North American operators follow the U.S. Government's lead and use the list of Root Name Servers prepared and published by the National Science Foundation and distributed by the NSF's InterNIC. In the past, the NSF relied on volunteers to provide Root Name Servers. This is rapidly changing and Network Solutions, Inc. and the IANA recently installed 4 new TRUE Root Name Servers. The IANA and NSI are of course controlled by the NSF and there is still one year left on the NSF/NSI contract. If private individuals are allowed to make decisions about who obtains services and who does not, then the U.S. Government is responsible for those decisions if the government has endorsed (or paid) those private individuals to be the decision makers. Several people have assured me that all of these problems are being solved. I suggest that we let the proper agencies solve the problems. -- Jim Fleming Unir Corporation e-mail: JimFleming(a)unety.net JimFleming(a)unety.s0.g0 (EDNS/IPv8)

1 0

RE: New Root Name Servers
by Jim Fleming 18 Feb '97

18 Feb '97

On Monday, February 17, 1997 8:56 AM, Robert E. Seastrom[SMTP:rs@bifrost.seastrom.com] wrote: @ @ I have J and K in my named.ca file, but not L and M. It is reasonable @ to assume that they are not available for public use yet, as they are @ not listed in the currently-available named.root file available from @ the InterNIC. @ By the way, are you mixing TRUE Root Name Servers with legacy Root Name Servers in your root.cache ? Also, is it possible that the recent problems NANOG people have been discussing regarding Root Name Servers is really the result of these transitions to TRUE Root Name Servers ? -- Jim Fleming Unir Corporation e-mail: JimFleming(a)unety.net JimFleming(a)unety.s0.g0 (EDNS/IPv8)

5 4