- NANOG - lists.nanog.org

IPv6 and RDNS
by Rodolfo (kix) 19 May '11

19 May '11

Hi! what is the status of the reverse DNS in IPv6? The draft "http://tools.ietf.org/html/draft-howard-isp-ip6rdns-04" is expired. What are the network operators doing? Regards, kix -- Rodolfo García "kix" http://www.kix.es/ ham: EA4ERH @ IN80ER

3 2

Re: Yahoo and IPv6
by Paul Vixie 19 May '11

19 May '11

Matthew Kaufman <matthew(a)matthew.at> writes: >> My Desktop is not able to make any IPv4 socket connections anymore. I get >> "Protocol not supported". So there are IPv6-only users, already bitten by >> no AAAA. So that's -1 from me. > > Sounds to me like you're not on The Internet any more. in <http://www.merit.edu/mail.archives/nanog/2001-04/msg00294.html> we see: (*2) Q: But what IS the Internet? A: "It's the largest equivalence class in the reflexive, transitive, symmetric, closure of the relationship 'can be reached by an IP packet from'". Seth Breidbart by which definition, matthew's observation would be correct. folks who want to run V6 only and still be "on the internet" will need proxies for a long while. folks who want to run V6 only *today* and not have any proxies *today* are sort of on their own -- the industry will not cater to market non-forces. -- Paul Vixie KI6YSY

20 32

Re: user-relative names - was:[Re: Yahoo and IPv6]
by Scott Weeks 18 May '11

18 May '11

--- joelja(a)bogus.com wrote: From: Joel Jaeggli <joelja(a)bogus.com> On May 17, 2011, at 4:30 PM, Scott Brim wrote: > On May 17, 2011 6:26 PM, <Valdis.Kletnieks(a)vt.edu> wrote: >> On Tue, 17 May 2011 15:04:19 PDT, Scott Weeks said: >> >>> What about privacy concerns >> >> "Privacy is dead. Get used to it." -- Scott McNeely > > Forget that attitude, Valdis. Just because privacy is blown at one level > doesn't mean you give it away at every other one. We establish the framework > for recovering privacy and make progress step by step, wherever we can. > Someday we'll get it all back under control. if you put something in the dns you do so because you want to discovered. scoping the nameservers such that they only express certain certain resource records to queriers in a particular scope is fairly straight forward. -------------------------------------------------------- The article was not about DNS. It was about "Persistent Personal Names for Globally Connected Mobile Devices" where "Users normally create personal names by introducing devices locally, on a common WiFi network for example. Once created, these names remain persistently bound to their targets as devices move. Personal names are intended to supplement and not replace global DNS names." I see a lot of folks on lists designing future networks where an identifier follows you everywhere and we as operators will have to deal with a public hostile to the idea of being followed. It's happening now. Just read all the articles on privacy lost. It's not going to go away. People like their privacy whether they're doing bad things or not. scott

3 2

IRRd Add New Maintainer (irr_rpsl_submit ?)
by Eduardo Meyer 18 May '11

18 May '11

Hello, I have installed IRRd and I am trying to set it up, just for study purposes. I have successfully mirrored some DBs but I cant handle to make my very first maintainer creation. irrd-user.pdf seems to be the only documentation around and it says nothing about "How the admin creates a maintainer" it only says that the password used in irrd.conf is the one. Here's what I am trying: # cat /tmp/step-1 mntner: MAINT-AS65500 descr: Test Inc admin-c: Dudu M tech-c: Dudu M upd-to: eduardo.meyer(a)gmail.com mnt-nfy: eduardo.meyer(a)gmail.com mnt-by: MAINT-AS65500 auth: MAIL-FROM eduardo.meyer(a)gmail.com changed: eduardo.meyer(a)gmail.com 20110518 source: SAMPLEDB And the command: # cat /tmp/step-1 | /usr/local/sbin/irr_rpsl_submit -x -D -v -E "db-admin(a)testing123.net" -c "23AWrNgTooc32" I always get the following error: May 18 04:23:16 [18267] #ERROR: New maintainers must be added by a DB administrator. May 18 04:23:16 [18267] Forwarding new request to db-admin(a)testing123.net Can someone please help me? I know it seems very simple but I have no idea how to do that. Thank you. -- =========== pessoal: dudu.meyer(a)gmail.com profissional: ddm.farmaciap(a)saude.gov.br

1 1

Re: user-relative names - was:[Re: Yahoo and IPv6]
by Scott Weeks 18 May '11

18 May '11

--- joelja(a)bogus.com wrote: From: Joel Jaeggli <joelja(a)bogus.com> > if you put something in the dns you do so because you want to discovered. scoping the nameservers such that they only express certain certain resource records to queriers in a particular scope is fairly straight forward. > -------------------------------------------------------- > > > The article was not about DNS. It was about "Persistent Personal Names for Globally Connected Mobile Devices" where "Users normally create personal names by introducing devices locally, on a common WiFi network for example. Once created, these names remain persistently bound to their targets as devices move. Personal names are intended to supplement and not replace global DNS names." you mean like mac addresses? those have a tendency to follow you around in ipv6... ----------------------------------------- <disclaimer> Still an IPv6 wussie... :-) </disclaimer> Only if you design your network that way. EUI-64 isn't required. scott

4 3

Re: user-relative names - was:[Re: Yahoo and IPv6]
by Scott Weeks 18 May '11

18 May '11

--- scott.brim(a)gmail.com wrote: From: Scott Brim <scott.brim(a)gmail.com> Yes indeed. <http://www.ietf.org/proceedings/79/slides/intarea-3.pdf> --------------------------------------------- Hm, that's a funny correlation to what I have been thinking and talking about lately. I'll have to read the draft-brim-mobility-and-privacy-00 paper as the pdf-bullet-point-syndrome has overtaken my info absorption abilities. I looked at the pdf, but bullet points make me have the deer-in-the-headlights look. ;-) scott

1 0

IPv6 gateway, was: Re: IPv6 foot-dragging
by Jeroen van Aart 18 May '11

18 May '11

Thanks all for the helpful suggestions. It looks like I solved the problem by adjusting my forward chain. I have a the local network on eth0 and the external network on eth1 and my forward chain looked like: -I FORWARD -i eth0 -o eth1 -s 2001:db8::/64 -j ACCEPT -I FORWARD -i eth1 -o eth0 -d 2001:db8::/64 -j ACCEPT Changing it to the following made it work: -I FORWARD -s 2001:470:85cd::/64 -j ACCEPT -I FORWARD -d 2001:470:85cd::/64 -j ACCEPT I am not sure if it'd be less secure to not make it specific to the interfaces. How would I change the first set of rules, using the -i parameter and still make it work? I also have a 6in4 interface for the IPv6 tunnel. -- http://goldmark.org/jeff/stupid-disclaimers/ http://linuxmafia.com/~rick/faq/plural-of-virus.html

4 7

Re: user-relative names - was:[Re: Yahoo and IPv6]
by Scott Weeks 18 May '11

18 May '11

--- Valdis.Kletnieks(a)vt.edu wrote: From: Valdis.Kletnieks(a)vt.edu > Why give the corpment (corporate/government contraction) an easy time at it? > Just like the early days, security and privacy do not seem to be in folk's mind > when things are being designed. But more importantly, who has more/better lobbyists, you or the people who want things like COICA and ACTA? You're going to have to fix *that* problem before trying to address it at the protocol level will do any real, lasting good. Either that or we need a *lot* more TOR relays (while those are still legal). ----------------------------------------------------------- It's a multi-layered problem and designers at all layers need to keep privacy in mind. You can't solve the multi-layered privacy problem with a design at one layer. -------------------------------------------- Oh, and an article that coincidentally popped up since I hit 'send' on the previous mail: http://radar.oreilly.com/2011/05/anonymize-data-limits.html Designing things to evade good data mining is a *lot* harder than it looks. -------------------------------------------- This article doesn't really address what we're discussing. It looks at the 'upper' layer only. I'm just saying that we don't need an ID that follows us everywhere like, I believe, LOC/ID split and "Unmanaged Internet Architecture" (from the "Persistent Personal Names for Globally Connected Mobile Devices" paper) apparently does (I haven't read their paper thoroughly enough to comment in an authoritative manner, though). There has got to be another way. RINA (http://www.cs.bu.edu/fac/matta/Papers/rina-security.pdf) addresses privacy/security, but the nanog show-me-the-code folks were unimpressed with the existing code when I asked the list about it in the past. scott

2 1

Re: Experience with Open Source load balancers?
by jkrejci＠usinternet.com 18 May '11

18 May '11

In response to your query on dnssec in the browser, I use this. https://addons.mozilla.org/en-us/firefox/addon/dnssec-validator/ ------Original Message------ From: Jimmy Hess To: Mark Andrews Cc: Welch, Bryan Cc: nanog(a)nanog.org Subject: Re: Experience with Open Source load balancers? Sent: May 17, 2011 7:07 PM On Tue, May 17, 2011 at 6:23 PM, Mark Andrews <marka(a)isc.org> wrote: [snip] > > Better still would be for them to return AAAA records but until one > is ready to do that the negative responses need to be correct. Hm... better would be for load balancers operate transparently at Layer 3 and not tamper with the contents of answers from proper DNS servers. Eating traffic based on application content, or turning NOERROR, 0 matches into NXDOMAIN is seriously f***'ed up. I look forward to more domains having DS records published by TLDs w/ signed zones... and possibly browsers displaying warnings trying to visit HTTPS domains without a signed zone. perhaps load balancers/middle box manufacturers will start to become a little bit more honest in what they do with DNS traffic :) -- -JH Sent via BlackBerry from T-Mobile

1 0

Re: user-relative names - was:[Re: Yahoo and IPv6]
by Scott Weeks 17 May '11

17 May '11

------- Valdis.Kletnieks(a)vt.edu wrote: --------- From: <Valdis.Kletnieks(a)vt.edu> On Tue, 17 May 2011 15:04:19 PDT, Scott Weeks said: > What about privacy concerns "Privacy is dead. Get used to it." -- Scott McNeely -------------------------------------------------- It doesn't have to be that way. We can design these things any way we want. Why give the corpment (corporate/government contraction) an easy time at it? Just like the early days, security and privacy do not seem to be in folk's mind when things are being designed. scott

2 1