- NANOG - lists.nanog.org

AAAAs in the Root and /48 Filtering
by Scalzo, Frank 05 Feb '08

05 Feb '08

All, As you may be aware, the DNS root zone will be updated on Monday, February 4, with AAAA resource records for six of the root servers. (Please see http://iana.org/reports/root-aaaa-announcement.html for IANA's official announcement.) In preparation for this change, we have noticed that some sites seem to be having reachability problems to the new root server IPv6 addresses that are located in critical infrastructure Micro-allocations (/47s or /48s), but not to the root servers located in /32s. Further testing has shown that we can ping these sites experiencing reachability problems when sourcing the provider allocated (PA) space on our links that aggregates up to a /32, but not when sourcing from the provider independent (PI) /48s of our root servers. With the AAAA RRs going into the root zone on Monday, now is a good time to check your IPv6 route filters. To prevent reachability problems, network operators should update IPv6 route filters to permit up to at least /48s from the appropriate RIR Micro-allocation blocks. I tried to gather as many of these blocks as I could find from the RIRs. Notably, I wasn't able to identify anything from AfriNIC -- hopefully someone on the list will be able to fill in that gap. This list is not meant to be complete nor authoritative, but it does cover all of the root server IPv6 addresses that are going live on Monday (that we are aware of) and that are in blocks allocated as /47s or 48s. That being said, please accept at least /48s from these blocks ASAP, or your network may experience reachability problems to the IPv6 root servers. ARIN (http://www.arin.net/reference/micro_allocations.html, http://www.arin.net/policy/nrpm.html#six10) 2001:0500::/30 RIPE (https://www.ripe.net/ripe/docs/ripe-ncc-managed-address-space.html) 2001:7F8::/29 APNIC (http://www.apnic.net/db/min-alloc.html) 2001:0C00:/23 2001:07FA:/32 LACNIC (http://lacnic.net/en/registro/index.html) 2001:12f8:0000::/35 2001:12f8:4000::/35 If you are having IPv6 reachability problems to the V6 IP addresses for a.root-servers.net and j.root-servers.net (2001:503:BA3e::2:30 and 2001:503:C27::2:30) please feel free to contact us. We may be able to assist in getting filters updated or working around any connectivity issues. Thank you, Frank Scalzo VeriSign

3 3

FW: [menog] FLAG Cable Cut - Update
by Barry Greene (bgreene) 05 Feb '08

05 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [Reposted with author's permission.] + Notice that there are more issues than what is reported in the popular press. + Notice that there are issues with more submarine systems (APCN), but they are not "news." As has been pointed out before, there are always issues with submarine systems. That is why we have so many repair ships in the global fleet: http://www.iscpc.org/information/Cableships_1.htm http://www.iscpc.org/information/Cableships_2.htm ==================================== http://www.flagtelecom.com/media/PDF_files/Submarine%20Cable%20Cut%20U pdate% 20Bulletin%20Release%20050208.pdf - -----Original Message----- From: menog-bounces(a)menog.net [mailto:menog-bounces@menog.net] On Behalf Of Sanghani, Bijal Sent: Tuesday, February 05, 2008 1:26 AM To: menog(a)menog.net Subject: [menog] FLAG Cable Cut - Update Dear All, Thought I'd give you all an update on where we (FLAG) are with the cable cuts - FEA Segment D - The Cable ship CS Certamen is now expected to arrive at the Alexandria repair ground on Wednesday 6th February. A Permit for the repair is currently being expedited with the Egyptian authorities. FEA Segment M - The cable ship CS Asean Restorer has been booked for this repair. It is currently out on an APCN repair and with current plan will be ready to start any work on our cable on or after 11th Feb. We have the OTDR traces from Penang and see that the fault is around 28km out from the station. FALCON Segment 7b (Bandra Abbas - Al Seeb) - E-Marine continues to await the permit to enter the Iranian waters and current forecast for the ship to start a work is around 19th February. FALCON Segment 2 - Fault 1st February 41km from repeater, which is between the first two repeaters out of Dubai toward Muscat (Al Seeb). The ship has left Abu Dhabi and is on route to the repair ground. The repair is expected to start in the next 12 hours (weather permitting). FALCON Segment 7a - Fault 1st February between BND (Bandar Abbas, Iran) and KWI (Kuwait), we are waiting for ship to go out and it maybe fixed before going out the fault on 7b - to be confirmed. I hope this helps, Regards, Bijal Sanghani Sr. IP Technical Support Engineer Technical Services Group FLAG Telecom Tel. +442 082 821 564 www.flagtelecom.com -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBR6hEeb/UEA/xivvmEQL5YgCg9tX2lZmq937MhRd65qm0wk9EYPUAniED VAxSCsr92aysSkrs6dGspaVm =45sb -----END PGP SIGNATURE-----

1 0

F.ROOT-SERVERS.NET IPv6 address has changed.
by Mark Andrews 05 Feb '08

05 Feb '08

With the official deployment of IPv6 addresses for the root servers, F.ROOT-SERVERS.NET IPv6 address changed. The old address, 2001:500::1035, is no longer valid and will be turn off at some point. The new address is 2001:500:2f::f. This will only affect users that have deliberately overridden the responses returned by the root servers. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews(a)isc.org

1 0

Fourth cable damaged in Middle Eest (Qatar to UAE)
by Sean Donelan 05 Feb '08

05 Feb '08

A fourth submarine cable in the middle east was damaged Sunday between Haloul, Qatar and Das, United Arab Emirates. This is in addition to the damage affecting FLAG, SAE-ME-WE4, FALCON cables. Afer reviewing surveillance video of the area, Egypt's ministry of maritime transportation is reporting no ships were near the FLAG or SAE-ME-WE4 cables 12-hours before or after the cable damage near Alexanderia, Egypt. The reason for outage of the cables has not been identified yet.

19 23

Re: Fourth cable damaged in Middle Eest (Qatar to UAE)
by Frank Coluccio 04 Feb '08

04 Feb '08

This will be my only post on this subject after biting my tongue for several days:) Some members will appreciate this item I came across earlier, I'm sure. As always, caveat emptor. Where is the USS Jimmy Carter? By Dave | February 3, 2008 http://tinyurl.com/3y7zgu List members -- and lurking students, in particular, should NOT take much of what's been posted _on _this _topic _ too seriously or regard everything written as factual. This cautionary note applies equally to the article I've posted above, as well. 73s,

5 5

Aggregation for IPv4-compatible IPv6 address space
by snort bsd 04 Feb '08

04 Feb '08

Hi all: With IPv4-compatible IPv6 address space, could I aggregate the address space? say 192.168.0.0/16 become ::192.168/112? or It must be converted to native IPv6 address space? Just wondering, Get the name you always wanted with the new y7mail email address. www.yahoo7.com.au/y7mail

4 3

Jeanette Symons (1962-2008) a commerical Internet Pioneer
by John Lee 04 Feb '08

04 Feb '08

It was with great sadness that I read about the un-timely death of my friend and colleague Jeanette in a plane crash in Maine. Jeanette died flying, which was one of the activities she loved to do. I meet her before she started flying and when she moved back to California she took up flying. We would be talking on the phone and she would say that it was VFR and she needed to go. VFR - Visual Flight Rules for flying without instruments which was all she was rated for at the time. I meet Jeanette at Hayes Microcomputer Products where we were working on a project together. People would think that we were brother and sister since we both had curly back hair and looked alike. When she wanted to move back to California, which she missed, I introduced her to Rob Ryan the head of Haye's West coast operations. When she was in Georgia we would eat Chinese, made by my wife, at my place. When we were in California we would eat Sushi at several of her favorite places in Western San Francisco and Oakland. Jeanette, Rob, Jay Duncanson and Steve Speckenbach left Hayes to start Ascend Communications and developed the TNT central site dial up modem, ISDN and Ethernet switch that handled most of the dial up Internet traffic for years. Ascend was purchased by Lucent and she and Mori started Zhone Technologies. Her new venture was started because her children wanted to blog with their friends and she was worried about them being on line. Jeanette will be missed. John Lee

3 2

Blackholes and IXs and Completing the Attack.
by Ben Butler 04 Feb '08

04 Feb '08

Hi, I have been working away on remote trigger blackholing and community based client initiated blackholing into transit ASes. It got me thinking that while this works great with a handful of upstream transit peers it does not really scale very well at an Internet Exchange with a high overhead configuring things for many peers. Plus if your IX connection is saturated that means legitimate traffic must be getting degraded - even if your router is coping and blackholing the interconnect is still flat lined. The only ways into an AS are via transit, public IX or private interconnects. If we want to extend the blackholing to secure IXs peers as well as into transits. So my idea.... Is to have an IX route reflector configured with ACLs locking it down to exclusively BGP with the IX peer IP of the member. The IX route reflector would be configured to have per peer prefix filters per peer auto generated from registered AS macro for each peer from the RIPE,ARIN,APNIC etc databases. This should mean the router will not accept announcements for any /32 that is not part of the routes announced by that AS (it would be even better to tie it down to a match on origin AS as well). Plus the router will only talk to IX peers - no global transit. This hopefully will ensure a relatively protected router that is only accessible from the edge routers we want and also secured to only accept filtered announcements for black holing and in consequence enable the system to be trusted similar to Team Cymaru. Then all a member AS of the exchange does is announce any /32 from their IP block that they would like other members to Null route in their AS to this reflector. There are people way smarter than me on this list and the above is not implemented at any of the IXs I am connected to, so why is the above a dumb idea / what have I missed that makes the above unworkable because it does seem kind of obvious now I have done some work with this. Kind Regards Ben Butler ++++++++++++++++++++++++++++++++++++++++++ C2 Internet Ltd Globe House, The Gullet, Nantwich, Cheshire, CW5 5RL E mailto:ben.butler@c2internet.net W http://www.c2internet.net/ B1 http://c2internet.blogspot.com/ B2 http://c2noc.blogspot.com/ T +44-(0)845-658-0020 F +44-(0)845-658-0070 All quotes & services from C2 are bound by our standard terms and conditions which are available on our website at: http://www.c2internet.net/legal/main.htm#tandc C2 Internet Limited is a company registered in England and Wales with company number 03910154 Our VAT Registration number is GB 752 7650 17

10 22

Re: Blackholes and IXs and Completing the Attack.
by Rick Astley 03 Feb '08

03 Feb '08

I see your point, but I think maintaining the box for the control session would also require a decent amount of work. Presumably, since you must all adhere to some quasi-standard to communicate with the control peer, you could probably also agree on creating a standard BGP community (ie. 64666:666 & no-export) to use and just skip the middle man. Granted, I am kind of new as well, and I assume if the solution were that simple more people would be using it. On Feb 2, 2008 9:07 PM, Ben Butler <ben.butler(a)c2internet.net> wrote: > Hi, > > Agreed, but when you have >100 peers that is still a fair bit of work. I > know technically how to do it and am doing this with transits but then there > are only seven of those. It is not a question of how or can, but should / > is it valuable / constructive? > > The starting point in the thought process having just done it for transits > was right ok, now how do we sensibly scale this to apply it at IXes without > everyone having to run round contacting everyone else and to see if there > was an easier way of doing things, hence the suggestion. Plus it keeps > things nice a separated, your IX peering sessions announce just the main > prefixes, the session to the "blackhole reflector" can be in a separate > peer-group and you only send the /32s to the reflector. You don't have to > worry about who uses which communities as each member that chooses to peer > with the reflector is able to apply an inbound routemaps of their own > choosing to any prefixes they receive from this reflector at each individual > IX. > > Given that an ISP has elected to Complete the attack on a host that is > being DoSed, for whatever reason, and they have chosen to send blackhole > announcements to transit the logical extension seems to be to automate the > sending of them to IXs to try to further cut down on traffic. This seems > like a easy way, internally you just community tag on the trigger box for > where you want the announcement to go, transit, internal, customers, IX > all,1 2 not 3 - whatever - and BGP sends it out. Easy, and a single system > to send out all updates when you choose to and easy to remove when you want > to take it out again. > > If you subscribe to completing the attack as a strategy, then the > suggestion seemed like an easy way of rolling it out to the next logical > point after transit. > > Kind Regards > > Ben > >

2 1

adsl line tester
by Ingo Flaschberger 03 Feb '08

03 Feb '08

Hi, I'm searching a good adsl2+ line tester. Can anynone recommend a good one? Kind regards, ingo flaschberger

3 2