- NANOG - lists.nanog.org

RPKI Mgmt Changes at ARIN (was: Fwd: [arin-announce] Upcoming Changes to ARIN’s Resource Public Key Infrastructure (RPKI))
by John Curran 15 Apr '23

15 Apr '23

Operators - Some important information regarding forthcoming RPKI management changes at ARIN. FYI , /John John Curran President and CEO American Registry for Internet Numbers Begin forwarded message: From: ARIN <info(a)arin.net> Date: April 13, 2023 at 1:27:19 PM EDT To: arin-announce(a)arin.net Subject: [arin-announce] Upcoming Changes to ARIN’s Resource Public Key Infrastructure (RPKI) The upcoming May software release will include multiple improvements to ARIN’s Resource Public Key Infrastructure (RPKI) services that will impact customers who utilize Hosted RPKI. These improvements will comprise a new, streamlined process for Route Origin Authorization (ROA) creation and maintenance, the introduction of auto-renewal for ROAs, and automation of previously ticketed processes for a more efficient RPKI experience. **ROA Creation** Customers will no longer need a ROA request signing key to register for Hosted RPKI services. Because customers will no longer need to create a private key, the ARIN Online user interface will feature streamlined and simplified ROA creation forms. For customers who utilize ARIN’s API, there will be a new RESTful endpoint to create ROAs that will provide parity with the user interface improvements. For the foreseeable future, ARIN will continue supporting the existing (now referred to as legacy) RESTful provisioning endpoint for organizations with their own internal signing requirements. **ROA Auto-renewal** After the May software release, any ROA created via ARIN Online or the new RESTful provisioning endpoint will be automatically renewed, meaning all newly created ROAs will persist indefinitely until they are manually deleted. ARIN will also apply the auto-renew feature to any existing ROAs when we deploy this new functionality. Please note: Any new ROAs created with the legacy RESTful endpoint will not be auto-renewed. If you would like your ROAs to be auto-renewed, you will need to use ARIN Online or the new RESTful provisioning endpoint. ARIN will be contacting customers who have created ROAs in both ARIN Online and REST to determine how they prefer to manage their existing ROAs. **More Efficient Processes** ARIN will automate resource certificate requests for users who hold Internet number resources under a Registration Services Agreement or Legacy Registration Services Agreement with ARIN. We are also improving the user interface for ROA generation. After successfully creating a ROA, you will see a confirmation notice before returning to your list of ROAs, which puts you one click away from creating your next ROA if necessary. We hope these changes will make signing up for RPKI services much easier for our customers. ARIN will inform the community when the software deployments are completed in May. In the meantime, visit the ARIN Blog in the coming weeks for additional details on these improvements. Regards, Brad Gorman Senior Product Owner, ARIN Routing Security American Registry for Internet Numbers (ARIN) …

3 3

RPKI in Lacnic?
by Hank Nussbacher 15 Apr '23

15 Apr '23

Just got this: Possible TA malfunction or incomplete VRP file: 100.00% of the ROAs disappeared from lacnic DETAILS: ------------------------------------------------------ Event type: rpki-diff When event started: 2023-04-15 17:17:30 UTC Last event: 2023-04-15 17:17:30 UTC Only us or everyone? Thanks, Hank

3 2

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 14 Apr '23

14 Apr '23

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 15 Apr, 2023 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 918516 Prefixes after maximum aggregation (per Origin AS): 348679 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 448419 Total ASes present in the Internet Routing Table: 74329 Prefixes per ASN: 12.36 Origin-only ASes present in the Internet Routing Table: 63774 Origin ASes announcing only one prefix: 26207 Transit ASes present in the Internet Routing Table: 10555 Transit-only ASes present in the Internet Routing Table: 432 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 55 Max AS path prepend of ASN (265020) 50 Prefixes from unregistered ASNs in the Routing Table: 1397 Number of instances of unregistered ASNs: 1397 Number of 32-bit ASNs allocated by the RIRs: 41657 Number of 32-bit ASNs visible in the Routing Table: 34469 Prefixes from 32-bit ASNs in the Routing Table: 170077 Number of bogon 32-bit ASNs visible in the Routing Table: 12 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 934 Number of addresses announced to Internet: 3061998848 Equivalent to 182 /8s, 130 /16s and 101 /24s Percentage of available address space announced: 82.7 Percentage of allocated address space announced: 82.7 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 307006 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 242257 Total APNIC prefixes after maximum aggregation: 69283 APNIC Deaggregation factor: 3.50 Prefixes being announced from the APNIC address blocks: 236590 Unique aggregates announced from the APNIC address blocks: 97749 APNIC Region origin ASes present in the Internet Routing Table: 13397 APNIC Prefixes per ASN: 17.66 APNIC Region origin ASes announcing only one prefix: 3932 APNIC Region transit ASes present in the Internet Routing Table: 1805 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 26 Number of APNIC region 32-bit ASNs visible in the Routing Table: 8686 Number of APNIC addresses announced to Internet: 773666688 Equivalent to 46 /8s, 29 /16s and 55 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-151865 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 268730 Total ARIN prefixes after maximum aggregation: 122356 ARIN Deaggregation factor: 2.20 Prefixes being announced from the ARIN address blocks: 271182 Unique aggregates announced from the ARIN address blocks: 130874 ARIN Region origin ASes present in the Internet Routing Table: 19082 ARIN Prefixes per ASN: 14.21 ARIN Region origin ASes announcing only one prefix: 6964 ARIN Region transit ASes present in the Internet Routing Table: 1963 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 24 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4788 Number of ARIN addresses announced to Internet: 1285271808 Equivalent to 76 /8s, 155 /16s and 177 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 259027 Total RIPE prefixes after maximum aggregation: 121950 RIPE Deaggregation factor: 2.12 Prefixes being announced from the RIPE address blocks: 255085 Unique aggregates announced from the RIPE address blocks: 157646 RIPE Region origin ASes present in the Internet Routing Table: 28296 RIPE Prefixes per ASN: 9.01 RIPE Region origin ASes announcing only one prefix: 12040 RIPE Region transit ASes present in the Internet Routing Table: 3962 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 31 Number of RIPE region 32-bit ASNs visible in the Routing Table: 11132 Number of RIPE addresses announced to Internet: 717840512 Equivalent to 42 /8s, 201 /16s and 96 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 117757 Total LACNIC prefixes after maximum aggregation: 28461 LACNIC Deaggregation factor: 4.14 Prefixes being announced from the LACNIC address blocks: 117044 Unique aggregates announced from the LACNIC address blocks: 49186 LACNIC Region origin ASes present in the Internet Routing Table: 10985 LACNIC Prefixes per ASN: 10.65 LACNIC Region origin ASes announcing only one prefix: 2661 LACNIC Region transit ASes present in the Internet Routing Table: 2286 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 55 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8780 Number of LACNIC addresses announced to Internet: 176708352 Equivalent to 10 /8s, 136 /16s and 91 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 29348 Total AfriNIC prefixes after maximum aggregation: 5795 AfriNIC Deaggregation factor: 5.06 Prefixes being announced from the AfriNIC address blocks: 37681 Unique aggregates announced from the AfriNIC address blocks: 12293 AfriNIC Region origin ASes present in the Internet Routing Table: 1738 AfriNIC Prefixes per ASN: 21.68 AfriNIC Region origin ASes announcing only one prefix: 610 AfriNIC Region transit ASes present in the Internet Routing Table: 335 Average AfriNIC Region AS path length visible: 4.9 Max AfriNIC Region AS path length visible: 30 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1083 Number of AfriNIC addresses announced to Internet: 107792384 Equivalent to 6 /8s, 108 /16s and 200 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9480 8705 39 CHINAMOBILE-CN China Mobile Communicati 7545 5728 786 689 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4865 4192 75 ERX-CERNET-BKB China Education and Rese 7552 3552 1331 21 VIETEL-AS-AP Viettel Group, VN 7713 3545 1043 65 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 3388 1872 93 VNPT-AS-VN VNPT Corp, VN 9498 2932 491 237 BBIL-AP BHARTI Airtel Ltd., IN 4766 2551 11252 591 KIXS-AS-KR Korea Telecom, KR 24560 2375 836 442 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd 45090 2184 1438 79 TENCENT-NET-AP Shenzhen Tencent Compute Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 8240 10779 2906 AMAZON-02, US 11492 4541 301 607 CABLEONE, US 7155 3967 279 48 VIASAT-SP-BACKBONE, US 22773 3600 3056 280 ASN-CXA-ALL-CCI-22773-RDC, US 6327 3514 1320 64 SHAW, CA 16625 3165 1590 2343 AKAMAI-AS, US 749 3055 50540 2322 DNIC-AS-00749, US 396982 2630 3590 362 GOOGLE-CLOUD-PLATFORM, US 7018 2566 24116 1563 ATT-INTERNET4, US 30036 2493 360 505 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7237 1705 149 UNI2-AS, ES 39891 4833 286 59 ALJAWWALSTC-AS, SA 20940 4066 3399 164 AKAMAI-ASN1, NL 8551 3889 370 37 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12389 2949 2292 909 ROSTELECOM-AS, RU 9009 2659 249 1390 M247, RO 34984 2271 359 611 TELLCOM-AS, TR 6849 2017 307 18 UKRTELNET, UA 58224 1850 950 543 TCI, IR 13188 1606 100 26 TRIOLAN, UA Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11234 3343 579 Uninet S.A. de C.V., MX 10620 3500 507 851 Telmex Colombia S.A., CO 13999 2317 355 615 Mega Cable, S.A. de C.V., MX 11830 2262 369 64 Instituto Costarricense de Electricidad 28573 1332 2324 240 Claro NXT Telecomunicacoes Ltda, BR 6503 1299 339 514 Axtel, S.A.B. de C.V., MX 3816 1293 760 170 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6147 1133 370 22 Telefonica del Peru S.A.A., PE 11664 1103 180 447 Techtel LMDS Comunicaciones Interactiva 26615 1028 2498 45 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1578 393 19 LINKdotNET-AS, EG 24835 1541 533 30 RAYA-AS, EG 36992 1338 1518 275 ETISALAT-MISR, EG 36903 1242 550 99 MT-MPLS, MA 29571 1023 67 48 ORANGE-COTE-IVOIRE, CI 36935 875 520 42 Vodafone-, EG 6713 550 1861 34 IAM-AS, MA 15399 535 54 47 WANANCHI-, KE 37342 493 32 1 MOVITEL, MZ 24757 488 73 5 EthioNet-AS, ET Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11234 3343 579 Uninet S.A. de C.V., MX 9808 9480 8705 39 CHINAMOBILE-CN China Mobile Communicati 16509 8240 10779 2906 AMAZON-02, US 12479 7237 1705 149 UNI2-AS, ES 7545 5728 786 689 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4865 4192 75 ERX-CERNET-BKB China Education and Rese 39891 4833 286 59 ALJAWWALSTC-AS, SA 11492 4541 301 607 CABLEONE, US 20940 4066 3399 164 AKAMAI-ASN1, NL 7155 3967 279 48 VIASAT-SP-BACKBONE, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9480 9441 CHINAMOBILE-CN China Mobile Communications Grou 12479 7237 7088 UNI2-AS, ES 16509 8240 5334 AMAZON-02, US 7545 5728 5039 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4865 4790 ERX-CERNET-BKB China Education and Research Net 39891 4833 4774 ALJAWWALSTC-AS, SA 11492 4541 3934 CABLEONE, US 7155 3967 3919 VIASAT-SP-BACKBONE, US 20940 4066 3902 AKAMAI-ASN1, NL 8551 3889 3852 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 3507 UNALLOCATED 5.105.166.0/24 213035 AS-SERVERION Serverion B.V., 398083 UNALLOCATED 5.133.124.0/24 399587 UT, US 33492 UNALLOCATED 8.6.184.0/23 33650 COMCAST-33650, US 33123 UNALLOCATED 8.10.69.0/24 11168 SCC, US 12169 UNALLOCATED 8.15.207.0/24 3356 LEVEL3, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 396894 UNALLOCATED 8.28.201.0/24 46887 LIGHTOWER, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.131.185.0/24 Origin: 174 COGENT-174, US 23.131.185.0/24 Transit: 2516 KDDI KDDI CORPORATION, JP 23.131.186.0/24 Origin: 174 COGENT-174, US 23.131.186.0/24 Transit: 2516 KDDI KDDI CORPORATION, JP 23.131.187.0/24 Origin: 174 COGENT-174, US 23.131.187.0/24 Transit: 2516 KDDI KDDI CORPORATION, JP 23.131.188.0/24 Origin: 174 COGENT-174, US 23.131.188.0/24 Transit: 2516 KDDI KDDI CORPORATION, JP 23.136.112.0/24 Origin: 54835 UNASSIGNED 23.136.112.0/24 Transit: 21559 OSNET, PR Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:39 /11:103 /12:299 /13:578 /14:1198 /15:2034 /16:13480 /17:8257 /18:13837 /19:25149 /20:44265 /21:51412 /22:109764 /23:97735 /24:549596 /25:741 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6297 7237 UNI2-AS, ES 8151 5196 11234 Uninet S.A. de C.V., MX 39891 3632 4833 ALJAWWALSTC-AS, SA 11492 3450 4541 CABLEONE, US 8551 3361 3889 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 6327 3323 3514 SHAW, CA 7155 3039 3967 VIASAT-SP-BACKBONE, US 22773 2668 3600 ASN-CXA-ALL-CCI-22773-RDC, US 30036 2150 2493 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2054 3500 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1703 2:1239 3:173 4:5 5:4490 6:128 7:6 8:1549 9:1 11:172 12:1548 13:391 14:2319 15:299 16:183 17:372 18:415 20:255 21:4 22:188 23:6227 24:2586 25:6 27:2489 29:19 31:2522 32:89 34:10 35:107 36:1932 37:4652 38:4438 39:811 40:151 41:3973 42:988 43:2351 44:308 45:16557 46:4265 47:363 49:1757 50:1838 51:571 52:1589 54:389 55:858 56:8 57:112 58:1757 59:1127 60:972 61:2447 62:2655 63:1923 64:5676 65:2320 66:4941 67:3016 68:1367 69:4162 70:1252 71:671 72:2968 74:2626 75:1466 76:610 77:2435 78:1864 79:3170 80:2095 81:1750 82:1486 83:1279 84:1533 85:2995 86:759 87:1986 88:1245 89:3613 90:612 91:7699 92:2064 93:2624 94:3592 95:4000 96:1328 97:336 98:1157 99:744 100:72 101:1071 102:2672 103:31271 104:4652 105:484 106:905 107:2526 108:1028 109:4425 110:2080 111:3234 112:2061 113:1565 114:1649 115:2022 116:1936 117:2557 118:2280 119:2020 120:1795 121:1115 122:2610 123:2160 124:1616 125:2524 128:1312 129:1060 130:1016 131:1984 132:811 133:422 134:1902 135:304 136:878 137:944 138:2550 139:1573 140:1232 141:1460 142:1436 143:1493 144:1164 145:347 146:1940 147:1574 148:2350 149:2092 150:871 151:1152 152:1844 153:488 154:4398 155:1435 156:1797 157:1309 158:1055 159:2287 160:2531 161:1518 162:3515 163:1516 164:1624 165:1711 166:1021 167:1723 168:3883 169:937 170:4616 171:886 172:3557 173:2940 174:1072 175:1153 176:3677 177:4583 178:3585 179:2132 180:2422 181:3424 182:3376 183:1930 184:2356 185:20185 186:4742 187:3966 188:4106 189:3546 190:9120 191:1435 192:10929 193:8865 194:7310 195:5157 196:3094 197:2395 198:5956 199:6099 200:8016 201:5852 202:10664 203:10223 204:4601 205:3555 206:4148 207:3459 208:4077 209:4867 210:4428 211:2487 212:4113 213:3576 214:1083 215:59 216:6633 217:2694 218:1295 219:577 220:2016 221:971 222:887 223:2184 End of report

1 0

Call for paper - AusNOG 2023 Conference
by Mark 14 Apr '23

14 Apr '23

Hi all, AusNOG 2023 will be held at the Sea World Conference Centre on the Gold Coast, Queensland (Yes this is not a typo, it is not in Sydney or Melbourne this year) on the 7th & 8th of September, 2023. That’s Aussie Spring time, a great time of year to make some side-trips to our beautiful beaches, hike the hinterlands and explore our Sunshine state! The Program Committee is seeking submissions from people wishing to present at the conference. Please note that AusNOG 2023 is a technical conference so presentations must be of a technical nature (i.e. no sales or marketing presentations). Preference will be given to presentations that result in actual operational outcomes. We plan on recording presentations for release after the event for those who are unable to attend, please don’t let that deter you from submitting, if your presentation can not be published let us know and we will ensure to not record it. For further information, details of important dates, or to make a submission please see the website at the URL https://www.ausnog.net/events/ausnog-2023 Lastly, feel free to reach out to our PC committee with any questions; Jocelyn Bateman (Program Chair), Belynda Pagram, Mark Duffell and Phil Mawson.

1 0

Call for Participation -- ICANN DNSSEC and Security Workshop for ICANN77 Policy Forum
by Jacques Latour 13 Apr '23

13 Apr '23

Call for Participation -- ICANN DNSSEC and Security Workshop for ICANN77 Policy Forum In cooperation with the ICANN Security and Stability Advisory Committee (SSAC), we are planning a DNSSEC and Security Workshop for the ICANN77 Policy Forum being held in Washington, DC and as a hybrid meeting from 12-15 June 2023 in the Eastern Time Zone (UTC -4). This workshop date will be determined once ICANN creates a block schedule for us to follow; then we will be able to request a day and time. The DNSSEC and Security Workshop has been a part of ICANN meetings for several years and has provided a forum for both experienced and new people to meet, present and discuss current and future DNSSEC deployments. For reference, the most recent session was held at the ICANN76 Community Forum on Wednesday, 15 March 2023. The presentations and transcripts are available at: https://icann76.sched.com/event/1J2JA/dnssec-and-security-workshop-1-of-3, https://icann76.sched.com/event/1J2JD/dnssec-and-security-workshop-2-of-3 and https://icann76.sched.com/event/1J2JE/dnssec-and-security-workshop-3-of-3. The DNSSEC Workshop Program Committee is developing a program for the upcoming meeting. Proposals will be considered for the following topic areas and included if space permits. In addition, we welcome suggestions for additional topics either for inclusion in the ICANN77 workshop, or for consideration for future workshops. 1. Global DNSSEC Activities Panel For this panel, we are seeking participation from those who have been involved in DNSSEC deployment as well as from those who have not deployed DNSSEC but who have a keen interest in the challenges and benefits of deployment, including Root Key Signing Key (KSK) Rollover activities and plans. 2. DNSSEC Best Practice Now that DNSSEC has become an operational norm for many registries, registrars, and ISPs, what have we learned about how we manage DNSSEC? * Do you still submit/accept DS records with Digest Type 1? * What is the best practice around key roll-overs? * What about Algorithm roll-overs? * Do you use and support DNSKEY Algorithms 13-16? * How often do you review your disaster recovery procedures? * Is there operational familiarity within your customer support teams? * What operational statistics have been gathered about DNSSEC? * Are there experiences being documented in the form of best practices, or something similar, for transfer of signed zones? Activities and issues related to DNSSEC in the DNS Root Zone are also desired. 3. DNSSEC Deployment Challenges The program committee is seeking input from those that are interested in implementation of DNSSEC but have general or particular concerns with DNSSEC. In particular, we are seeking input from individuals that would be willing to participate in a panel that would discuss questions of the following nature: * Are there any policies directly or indirectly impeding your DNSSEC deployment? (RRR model, CDS/CDNSKEY automation) * What are your most significant concerns with DNSSEC, e.g., complexity, training, implementation, operation or something else? * What do you expect DNSSEC to do for you and what doesn't it do? * What do you see as the most important trade-offs with respect to doing or not doing DNSSEC? 4. Security Panel The program committee is looking for presentations on DNS, DNSSEC, routing and other topics that could impact the security and/or stability of the Internet. We are looking for presentations that cover implementation issues, challenges, opportunities and best practices for: * Emerging threats that could impact the security and/or stability of the Internet * DoH and DoT * RPKI (Resource Public Key Infrastructure) * BGP routing & secure implementations * MANRS ( Mutually Agreed Norms for Routing Security) * Browser security - DNS, DNSSEC, DoH * EMAIL & DNS related security - DMARC, DKIM, TLSA, etc... If you are interested in participating, please send a brief (1-3 sentence) description of your proposed presentation to dnssec-security-workshop(a)icann.org<mailto:dnssec-security-workshop@icann.org> by Friday, 12 May 2023. Thank you, Jacques On behalf of the DNSSEC Workshop Program Committee: Steve Crocker, Shinkuro Mark Elkins, DNS/ZACR Jacques Latour, .CA Russ Mundy, Parsons Ondrej Filip, CZ.NIC Yoshiro Yoneya, JPRS Fred Baker, ISC Dan York, Internet Society

1 0

Auth0 geolocation?
by Tim Burke 13 Apr '23

13 Apr '23

Anyone know who Auth0 is using for geolocation services? Have a customer reporting that Auth0, Lowes, Bank of America, and some other sites are reporting their IP in the wrong location. Checked the usual suspects, BrothersWISP.com<http://BrothersWISP.com> geolocation providers list, etcetera and they’re all showing in the correct location. Thanks, Tim

3 6

TLS issues with Lumen (CenturyLink)
by Andrew Gray 12 Apr '23

12 Apr '23

Can someone from Lumen/CenturyLink contact me off-list? We are seeing issues with some traffic coming from customers inside AS209 (and only AS209) that appear to be hitting some sort of in-the-middle inspection that is causing TLS issues (showing that the certificates are invalid). Thanks!

1 0

N88 Sponsorships, Peering Forum, Final Call for Presentations + CaribNOG 25 Empowers Underserved Students + Inspires Community
by Nanog News 12 Apr '23

12 Apr '23

*Become a Sponsor of NANOG 88!* *Invest in the Strength of the Community We've Built * *Sponsorship Benefits: * • Showcase your newest technologies + solutions • Increase your brand’s visibility + reach • Amplify your organization’s message • Connect with industry influencers + decision makers • Empower people + inspire change *MORE INFO* <https://nanog.org/events/sponsorship/sponsorship-opportunities/> *Creating Global Connectivity by Connecting Globally* *CaribNOG 25 Empowers Underserved Students + Inspires Community* Network Engineer II at Akamai Technologies, Aaron Atac, is a part of the millennial community at NANOG and serves on the Outreach and Programming Committee. This was his first time attending CaribNOG, and "events like these" originally motivated him to get involved. Atac has a shared mission in helping these communities inspired by his dad, who grew up in Turkey with limited access to education. *READ NOW <https://nanog.org/stories/creating-global-connectivity-by-connecting-global…>* *Sign up for the NANOG 88 Peering Forum * *Meet + Greet Peers in this 90 Min Session * The Peering Coordination Forum applications will remain open until 20 applications have been received or until the deadline date of 05, June. The forum provides time for attendees to meet and network with others in the peering community present at NANOG. <https://nanog.org/events/nanog-88/> *MORE INFO* <https://nanog.org/events/nanog-88/> *Fundamentals of Designing and Deploying Computer Networks* *ISOC Presents Moderated Course with Instructor * This course will discuss the fundamentals of networking, Ethernet, and WIFI technologies. It will additionally teach the planning, design, and deployment of simple LANs and cover how to connect a LAN to the Internet. *MORE INFO <https://nanog.org/events/fundamentals-of-designing-and-deploying-computer-n…>* *Deadline for N88 Presentations is Approaching!* *Presentation Submission Deadline is Monday, 24 April* The NANOG PC is looking to schedule over 1,600 minutes of content between General Session and Breakout Rooms for NANOG 88 - so don’t wait! *MORE INFO * <https://nanog.org/program/call-presentations/>

1 0

ABQNOG -- May 4, 2023
by John Osmon 12 Apr '23

12 Apr '23

For folks that might be in the southwest US (and any that want to visit!), we're going to hold an operators group meeting on May 4, 2023 in Albuquerque, New Mexico. Come to the land of green chile chessburgers, and meet some of the local operators. This inaugural meeting is free. We hope to see you in May! http://abqnog.org

2 1

Your DNS Servers are not working correctly.
by Mark Andrews 12 Apr '23

12 Apr '23

I work for a DNS vendor and saw reports about DNS resolution errors when looking up names under dhhs.gov. It looks like your servers are not returning non-existence answers over UDP which breaks servers that are trying to do DNS QNAME minimisation (See RFC 7816). Below are three queries that the servers should be capable of answering if they are following the DNS protocol correctly. dhhs.gov is answered but foobar.dhhs.gov doesn’t return anything and I would expect a NXDOMAIN (Name Error) response. Additionally 355.dhhs.gov should be returning a NODATA/NOERROR response at a minimum as it part of your DNS servers names. If I ask the same questions over TCP instead of UDP I get answers. This really smells like a misconfigured firewall. Mark % dig dhhs.gov @158.74.30.99 ; <<>> DiG 9.19.11-dev <<>> dhhs.gov @158.74.30.99 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59012 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 7b8cd5530b5fa45190ac7ac264364fe858d1f83093c6da62 (good) ;; QUESTION SECTION: ;dhhs.gov. IN A ;; ANSWER SECTION: dhhs.gov. 9000 IN A 52.7.111.176 ;; Query time: 243 msec ;; SERVER: 158.74.30.99#53(158.74.30.99) (UDP) ;; WHEN: Wed Apr 12 16:30:00 AEST 2023 ;; MSG SIZE rcvd: 81 % dig foobar.dhhs.gov @158.74.30.99 ;; communications error to 158.74.30.99#53: timed out ;; communications error to 158.74.30.99#53: timed out ;; communications error to 158.74.30.99#53: timed out ; <<>> DiG 9.19.11-dev <<>> foobar.dhhs.gov @158.74.30.99 ;; global options: +cmd ;; no servers could be reached [ant-7641:~/git/bind9] marka% dig 355.dhhs.gov @158.74.30.99 ;; communications error to 158.74.30.99#53: timed out ;; communications error to 158.74.30.99#53: timed out ;; communications error to 158.74.30.99#53: timed out ; <<>> DiG 9.19.11-dev <<>> 355.dhhs.gov @158.74.30.99 ;; global options: +cmd ;; no servers could be reached % % dig dhhs.gov @158.74.30.99 +tcp ; <<>> DiG 9.19.11-dev <<>> dhhs.gov @158.74.30.99 +tcp ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18254 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 710a14c38e16a91fd4060d86643652ecca2dce18d21e3144 (good) ;; QUESTION SECTION: ;dhhs.gov. IN A ;; ANSWER SECTION: dhhs.gov. 9000 IN A 52.7.111.176 ;; Query time: 246 msec ;; SERVER: 158.74.30.99#53(158.74.30.99) (TCP) ;; WHEN: Wed Apr 12 16:42:52 AEST 2023 ;; MSG SIZE rcvd: 81 % dig 355.dhhs.gov @158.74.30.99 +tcp ; <<>> DiG 9.19.11-dev <<>> 355.dhhs.gov @158.74.30.99 +tcp ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56223 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: e10fe6bd8dccc0ed038bbff1643652fb582c8d51b5d3a25c (good) ;; QUESTION SECTION: ;355.dhhs.gov. IN A ;; AUTHORITY SECTION: dhhs.gov. 3600 IN SOA rh120ns1.368.dhhs.gov. hostmaster.psc.hhs.gov. 2023021759 1200 300 2419200 3600 ;; Query time: 246 msec ;; SERVER: 158.74.30.99#53(158.74.30.99) (TCP) ;; WHEN: Wed Apr 12 16:43:07 AEST 2023 ;; MSG SIZE rcvd: 137 % -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

1 0