- NANOG - lists.nanog.org

Re: Signing of the ARPA zone
by Joe Abley 17 Mar '10

17 Mar '10

Colleagues, This is a follow-up to the operational announcement regarding changes to the ARPA top-level domain that was sent on 2010-03-10. Apologies in advance for duplicates received through different mailing lists. As of 2010-03-17 1630 UTC all the authoritative servers for ARPA are serving a signed ARPA zone. We would like to solicit feedback from the technical community to allow us to identify any operational ill-effects that this change has caused. We will monitor this mailing list for feedback, and I will also distribute any feedback sent to me personally so that it can be considered. If no harmful effects have been identified by 2010-03-21 the trust anchor for the ARPA zone will be published through the IANA ITAR at <https://itar.iana.org/>. Regards, Joe Begin forwarded message: > From: Joe Abley <joe.abley(a)icann.org> > Date: 10 March 2010 16:13:46 EST > To: Joe Abley <joe.abley(a)icann.org> > Subject: Signing of the ARPA zone > > Colleagues, > > This is a technical, operational announcement regarding changes to the ARPA top-level domain. Apologies in advance for duplicates received through different mailing lists. > > No specific action is requested of operators. This message is for your information only. > > The ARPA zone is about to be signed using DNSSEC. The technical parameters by which ARPA will be signed are as follows: > > KSK Algorithm and Size: 2048 bit RSA > KSK Rollover: every 2-5 years, scheduled rollover to follow RFC 5011 > KSK Signature Algorithm: SHA-256 > Validity period for signatures made with KSK: 15 days; new signatures published every 10 days > ZSK Algorithm and Size: 1024 bit RSA > ZSK Rollover: every 3 months > ZSK Signature Algorithm: SHA-256 > Authenticated proof of non-existence: NSEC > Validity period for signatures made with ZSK: 7 days; zone generated and re-signed twice per day > > The twelve root server operators [1] will begin to serve a signed ARPA zone instead of the (current) unsigned ARPA zone during a maintenance window which will open at 2010-03-15 0001 UTC and close at 2010-03-17 2359 UTC. Individual root server operators will carry out their maintenance at times within that window according to their own operational preference. > > The trust anchor for the ARPA zone will be published in the ITAR [2], and in the root zone in the form of a DS record once the root zone is signed. > > If you have any concerns or require further information, please let me know. > > Regards, > > > Joe Abley > Director DNS Operations, ICANN > > [1] <http://www.root-servers.org/> > [2] <https://itar.iana.org/>

1 0

Re: IPv6 in Education Question
by Timothy Shortall 17 Mar '10

17 Mar '10

Jens Link <lists(a)quux.de> wrote: Todd Christell <tchristell(a)springnet.net> writes: > So Im giving an introductory talk on IPv6 for a state wide conference > for tech coordinators for education. I have the usual catechism of > reasons/advantages from the network side but was wondering if there were > any good education specific applications of v6. My major goal is to > help them understand the situation so that they can make use of the base > of educators in our state to help spread the work about IPv6. It's not a question of if but when IPv6 will be used on large scale in the interned. So, form the educational side it's beneficial if students learn about IPv6. So much for the theory I did quite a number of presentations on IPv6 some of them in at university in Germany (not as some official talk but some user group / some students asked me too). Some quotes: "We don't' have time for this." "Well our network equipment is 14 years old, we don't have a budget for new stuff." "We'll implement IPv6 in 13 years, it's when my colleague retires." /me: "Cool. You have IPv6." Professor: "I configured the tunnel myself. Our network people don't this the topic." Jens -- ------------------------------------------------------------------------- | Foelderichstr. 40 | 13595 Berlin, Germany | +49-151-18721264 | | http://www.quux.de | http://blog.quux.de | jabber: jenslink(a)guug.de | -------------------------------------------------------------------------

1 0

Re: Intermittent Google issues in Austin area
by Timothy Shortall 17 Mar '10

17 Mar '10

Jorge Amodio <jmamodio(a)gmail.com> wrote: No issues 60 miles south (SATX) On Wed, Mar 17, 2010 at 1:29 PM, Alex Thurlow <alex(a)blastro.com> wrote: > Anyone else having intermittent issues connecting to google servers from the > Austin area? I first noticed google.com/jsapi loading slowly to slow down my > website from loading, and I've since seen other sites loading from their > ajaxapis and even www.google.com's search results taking upwards of 30 > seconds to load. Many times it loads fine, and then it won't. I couldn't > find a place to submit this to them, so I thought I'd check with you guys. > > -Alex

1 0

Re: Intermittent Google issues in Austin area
by Timothy Shortall 17 Mar '10

17 Mar '10

Alex Thurlow <alex(a)blastro.com> wrote: Anyone else having intermittent issues connecting to google servers from the Austin area? I first noticed google.com/jsapi loading slowly to slow down my website from loading, and I've since seen other sites loading from their ajaxapis and even www.google.com's search results taking upwards of 30 seconds to load. Many times it loads fine, and then it won't. I couldn't find a place to submit this to them, so I thought I'd check with you guys. -Alex

1 0

Re: Intermittent Google issues in Austin area
by Timothy Shortall 17 Mar '10

17 Mar '10

Alex Thurlow <alex(a)blastro.com> wrote: Anyone else having intermittent issues connecting to google servers from the Austin area? I first noticed google.com/jsapi loading slowly to slow down my website from loading, and I've since seen other sites loading from their ajaxapis and even www.google.com's search results taking upwards of 30 seconds to load. Many times it loads fine, and then it won't. I couldn't find a place to submit this to them, so I thought I'd check with you guys. -Alex

1 0

Intermittent Google issues in Austin area
by Alex Thurlow 17 Mar '10

17 Mar '10

Anyone else having intermittent issues connecting to google servers from the Austin area? I first noticed google.com/jsapi loading slowly to slow down my website from loading, and I've since seen other sites loading from their ajaxapis and even www.google.com's search results taking upwards of 30 seconds to load. Many times it loads fine, and then it won't. I couldn't find a place to submit this to them, so I thought I'd check with you guys. -Alex

4 3

AS36561 to announce 27.128.0.0/12
by Nathan Hickson 17 Mar '10

17 Mar '10

Similar to the 1.0.0.0/8 experiment... YouTube (only AS36561) will be announcing 27.128.0.0/12 to allow APNIC to study backscatter/traffic to this unallocated space in ipv4 land. We'll start in the next 24 hours. This range is obviously less interesting than 1.x, but figured I'd let you all know anyway. :) Cheers. -- Nathan Hickson AS36561 - YouTube AS15169 - Google

1 0

AARNet AS7575 announcing 1.0.0.0/24, 1.1.1.0/24 and 1.2.3.0/24 soon
by George Michaelson 17 Mar '10

17 Mar '10

As part of the ongoing measurement of traffic in 1.0.0.0/8 three /24s from the range are shortly going to be announced by AARNet, via AS7575: 1.0.0.0/24 1.1.1.0/24 1.2.3.0/24 This will be happening over the next week or so. cheers -George

5 4

Re: anti-ddos test solutions ?
by Guillaume FORTAINE 17 Mar '10

17 Mar '10

Dear jul, I would advise Breaking Point : -News : http://www.breakingpointsystems.com/news/press-releases/breakingpoint-distr… -Methodology http://www.breakingpointsystems.com/resources/testmethodologies/breakingpoi… -Documentation : http://docs.google.com/viewer?url=http://www.breakingpointsystems.com/resou… Best Regards, Guillaume FORTAINE On 03/17/2010 07:45 AM, jul wrote: > Hello nanogers, > > Following the multiple thread on ddos attack, I was asking myself how > someone could test chosen solutions. > In most cases, you can't load your Internet access in the same way > attackers will (does someone have a botners with ten thousands computers > or more :) ?) > But a solution to test basic attack (synflood, slowloris, socktress, > ...) with 10 to hundred computers would be interesting, so not a tool > but more a service. > > Found only Parabon [1] on Google > > Does someone know something similar ? > > Thanks > Best regards, > > Jul > > Note: Please, don't forget this kind of public tests have some serious > legal impact and you need to have an agreement with your ISP/operators > to do it in most countries. > Note2: Google has a lot of answers. Most of them are about tool and > methodology, so not sure for a live test. I'm not looking for a lab > solution but real one with business acceptation (and a wise choice on > the hours of the test so front-end can be switch to "maintenance mode") > > [1] New grid service simulates DDoS attacks, May 2009 > http://www.computerworlduk.com/technology/security-products/business-contin… > > > >

8 8

OBESEUS - A new type of DDOS protector
by Guillaume FORTAINE 17 Mar '10

17 Mar '10

Misters, Let me introduce myself : Guillaume FORTAINE, Engineer in Computer Science. I am currently working on High-Speed Network Security Solutions. DDoS is considered as "The Mother of All Cyber Threats" [1] therefore I have intensively studied this topic. By the way, I have read with interest the NANOG mails [2] [3] [4] and the Linkedin groups [5] [6] on this subject. Being an FPGA engineer, I approached this concern from an algorithmic point of view and that's why I would greatly appreciate to have your comments on this project, if possible, please : "OBESEUS - A new type of DDOS protector" [7] http://www.loud-fat-bloke.co.uk/obeseus2.pdf For a better overview of the background of the project, please see the following document : "INQUIRY INTO EU POLICY ON PROTECTING EUROPE FROM LARGE SCALE CYBER-ATTACKS" http://www.parliament.uk/documents/upload/F012Interoute121109.pdf I look forward to your answer, Best Regards, [1] http://events.linkedin.com/Webcast-DDoS-Mother-All-Cyber-Threats/pub/171074 [2] http://mailman.nanog.org/pipermail/nanog/2009-November/014963.html [3] http://mailman.nanog.org/pipermail/nanog/2010-January/016675.html [4] http://mailman.nanog.org/pipermail/nanog/2010-January/017604.html [5] http://www.linkedin.com/groups?home=&gid=2040519 [6] http://www.linkedin.com/groups?home=&gid=2632190 [7] http://www.loud-fat-bloke.co.uk/obeseus.html Guillaume FORTAINE Tel : +33(0)631092519

11 23