- NANOG - lists.nanog.org

Mail contact needed at CenturyLink.com
by Jay Ashworth 30 May '13

30 May '13

The Outages list is receiving hard bounces from *some* email address hosted at Qwest/Centurylink. Alas, the bounce message comes from "qwestrsp(a)centurylink.com", and neither the headers nor the message body *identifies the invalid address*. This does not seem to conform with best practices. :-) If you're in responsible charge of that mail service, could you please contact me off-list, that we might track down who it is, and maybe modify your bouncer to properly include the bounced address? (Side note: what error messages are generate by *code you've written*, folks, that don't include parameters because "they should be obvious to the sender"?) All replies off list, please, this is cross-posted[1]. Cheers, -- jra [1] Why? Because I'm not trying to fix only my own problem. -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

1 1

why does dail-up or pppoe access always has session-timeout ?
by Joe 30 May '13

30 May '13

hi. a question obsessed me for a long time. "why my pppoe connection to internet has a max session time, even if every thing goes ok? " In our DSL access network , max session timeout is set to 4 days, this parameter is sent to BAS by radius server after finishing authenticating procedure. As I know, beside us some other service providers also applied this parameter to pppoe session, the parameter varies from 48 hours to 96 hours. Reading documents of BAS, we found this is default value for session-time on BAS, that means even if radius server does not response BAS with session-timeout attribute BAS will cut pppoe session after sometime. so , why does those BAS designer or protocol designer set such a parameter for pppoe access ? should anyone do me a favor on explaining this ? regards Joe

6 5

Fwd: ICANN News Alert -- Security Studies on the Use of Non-Delegated TLDs, and Dotless Names
by Joly MacFie 29 May '13

29 May '13

FYI, since this has been a topic here. ---------- Forwarded message ---------- http://www.icann.org/en/news/announcements/announcement-28may13-en.htm ________________________________ Security Studies on the Use of Non-Delegated TLDs, and Dotless Names 28 May 2013 ICANN's mission and core values call to preserve and enhance the operational stability, reliability, security, and global interoperability of the Internet. In pursuing these goals and following the direction of its Board of Directors as well as the advice of the Security and Stability Advisory Committee, ICANN is announcing two studies regarding: 1) the use of non-delegated TLDs and 2) potential risks related to dotless domain names. On 31 January 2013, ICANN security team received the SAC 057: SSAC Advisory on Internal Name Certificates. On 18 May, the ICANN Board directed staff to commission a study on the use of TLDs that are not currently delegated at the root level of the public DNS in enterprises. Today, ICANN is announcing that a study has been commissioned on the potential security impacts of the applied-for new-gTLD strings in relation to namespace collisions with non-delegated TLDs that may be in use in private namespaces including their use in X.509 digital certificates. As part of this study, the expert study team will develop a framework for assessing the risk level and classify the risk level for the strings as identified in the study. The report will also provide options for ICANN as to how to mitigate the various risks and will describe the pros and cons of the options. On 23 February 2012, the SSAC published the SAC 053: SSAC Report on Dotless Domains. A domain name that consists of a single label is referred to as a "dotless domain name". Use of dotless names could provide potential innovations to the domain name industry and new gTLD applicants, but their use also raises usability, functionality, security and stability concerns as described in the SSAC report. On 23 June 2012, the ICANN Board directed staff to consult with the relevant communities regarding implementation of the recommendations in SAC 053 and to provide a briefing paper for the Board, detailing the issues and options available to mitigate such issues. During the period of August to September 2012, a public comment period was held regarding the SAC 053 report. The public comment period made clear that dotless domain names are a subject of active discussion in the ICANN community, that no clear conclusion could be drawn, and that a greater effort to identify and explore solutions to the concerns raised before implementing SAC 053 recommendations could be useful. Today, ICANN is announcing that it has commissioned a study on the potential risks related to dotless domain names based on SAC 053 report. The study report will identify and describe the potential risks that dotless names raise with particular focus on those related to security and stability. The report will also provide options for ICANN as to how to mitigate the various risks and will describe the pros and cons of the options. In both cases ICANN intends to deliver the study teams findings before the ICANN 47th meeting in Durban, South Africa. -- --------------------------------------------------------------- Joly MacFie 218 565 9365 Skype:punkcast WWWhatsup NYC - http://wwwhatsup.com http://pinstand.com - http://punkcast.com VP (Admin) - ISOC-NY - http://isoc-ny.org -------------------------------------------------------------- -

1 0

GoDaddy contact?
by Yunhong Gu 28 May '13

28 May '13

Hello, I wonder if there is anyone from GoDaddy on this list. I am trying to debug a problem between Google Public DNS and some GoDaddy name servers. Please contact me directly at guu(a)google.com. Thanks, Yunhong

2 2

Paraguay International Connectivity Questions
by Dan Carlton 28 May '13

28 May '13

Looking for some information regarding international connectivity from Paraguay. We are looking to start up a new business down there and we were told that the international connections from Paraguay are not reliable and all of the only external connections from there have go through Argentina. I would assume this would apply to Public Internet as well as private networks (MPLS, etc.). - Is this true? - Does anyone have a map of the external connections from there, similar to the submarine map <http://www.submarinecablemap.com/>? - Or other data (BGP routing tables that would show traffic transiting via Brazil or Bolivia)? - Is the international connectivity really that bad down there?

1 0

Geoip lookup
by shawn wilson 27 May '13

27 May '13

What's the best way to find the networks in a country? I was thinking of writing some perl with Net::Whois::ARIN or some such module and loop through the block. But I think I'll have to be smarter than just a simple loop not to get blocked and I figure I'm not the first to want to do this. I've noticed some paid databases out there. They don't cost much but are they even worth what they charge? Ie, countryipblocks.net doesn't list quite a few addresses from a country I've looked at blocking. Isn't this information free from the different *NICs anyway? This is probably two questions: a program that smartly looks for country's blocks in a block and are GeoIP services worth anything?

13 23

Inventory and workflow management systems
by vijay gill 26 May '13

26 May '13

What software solution do people use for inventory management for things like riser/conduit drawdown, fiber inventory, physical topology store, CLR/DLR, x-connect, contracts, port inventory, etc. Any experiences in integrating workflow into those packages for work orders, modeling, drawdown levels, etc. /vijay

10 13

leasing/managed offices in London, UK with 10gbe carriers POPs?
by Andrius Kazimieras Kasparavičius 25 May '13

25 May '13

Hi, I was going through this database[1] looking for office facilities/buildings with 10gbe carriers POPs already present, but only datacentres are listed. My requirement is low cost 10gbe connectivity to any London datacentre where I could either get either low-cost few racks hosting+partial transit.. Well multiple 1gig links might be ok too. I am sure there are already large office blocks with multiple 10gbe carrier POPs or am I? Maybe it is possible to save costs and time by choosing office with built-in good connectivity rather than wait months and multiple permits to dig the road etc..? [1] https://www.peeringdb.com/private/facility_list.php Thanks,

2 1

Network Research
by James Bensley 25 May '13

25 May '13

Hello everyone, I am performing some research on networking at present and want the input of the community and industry at large. I have created a small on-line survey and would be very grateful to anyone that could give 3 minutes to fill it out. You will be benefiting networking research so I'm sure you are all wanting to participate; The survey is here: https://docs.google.com/forms/d/1lqigAHYHEgLLHr2kifiyBwgJ9Nw5AFS6d_XVXfhKkT… All results will be anonymised when published. If you want a copy of the anonymised results, or have any queries about the research or the survey, please email me off-list to save on-list noise. Kind regards, James P.S. Apologies if you are on multiple mailing lists and receive this email multiple times!

2 2

ADVANCE WARNING: Google moving to 2048-bit SSL and root keys
by Jay Ashworth 25 May '13

25 May '13

Via PRIVACY Forum: ----- Forwarded Message ----- > From: "PRIVACY Forum mailing list" <privacy(a)vortex.com> > Google moving to longer SSL keys > > http://j.mp/10YAWaC (Google Online Security Blog) > > "This encryption needs to be updated at times to make it even > stronger, so this year our SSL services will undergo a series of > certificate upgrades-specifically, all of our SSL certificates > will be upgraded to 2048-bit keys by the end of 2013. We will > begin switching to the new 2048-bit certificates on August 1st, to > ensure adequate time for a careful rollout before the end of the > year. We're also going to change the root certificate that signs > all of our SSL certificates because it has a 1024-bit key." > > - - - > > I will note, however, that given the fundamental weaknesses in the > PKI -- especially relating to certificate authorities in general -- > even longer keys will not solve intrinsic problems that must be faced. > > --Lauren-- > Lauren Weinstein (lauren(a)vortex.com) http://www.vortex.com/lauren > _______________________________________________ > privacy mailing list > http://lists.vortex.com/mailman/listinfo/privacy Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

3 2