- NANOG - lists.nanog.org

RE: DNS records for routers
by Cutler, James R 03 Mar '03

03 Mar '03

Pete, <passion>Since I do NOT believe in "Security through Obscurity" as effective</passion>, I name every address and publish both A and PTR views of this relationship. This applies to all network-addressable entities. CNAME records may be added to taste. Naming should facilitate maintenance of good network operation. So, it depends on how you like to operate. In addition, most automated IP management systems provide both A and PTR entries without extra work, so it becomes a question of "Why not?" for the A records. Round-robin does not seem (to me) to provide any particular business value. - James R. Cutler, EDS 800 Tower Drive, Troy, MI 48098 1 248 265 7514 james.cutler(a)eds.com -----Original Message----- From: Pete Kruckenberg [mailto:pete@kruckenberg.com] Sent: 2003-03-01, Saturday 2:05 PM To: nanog(a)nanog.org Subject: DNS records for routers Any passionate opinions about DNS record conventions for routers? Or recommendations? I'm not particularly concerned about device naming conventions (we have that down), I'm more interested in what makes sense for public-viewable DNS names (so I can put those beautiful fully-compliant names where people can see them). Some traces show individual interface names, some just show device names. Any particular reason to go one way or the other for PTR records (doing a single device name for every interface seems easier and less-likely to screw up to me)? What about A records? A matching one per PTR, or just one A per device? Or no A records in the public DNS? Would round-robin A records (an A record for every interface address, all using the same device name) break anything (like performance measurement tools or network management tools)? Thanks. Pete.

1 0

Have address space? You too can make policy.
by Leo Bicknell 02 Mar '03

02 Mar '03

After running into some frustration trying to move forward some issues in ARIN, it has come to my attention that many IP space holders to not know they can participate in the process. To that end, if you have IP space, but have not followed ARIN issues before I invite you to read online or subscribe to their Public Policy Mailing List (PPML): http://www.arin.net/mailing_lists/index.html#ppml Many issues that affect smaller ISPs are being decided by the large ISPs, only because they often are the only ones with people participating in the process. Don't let that happen! -- Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

2 1

Re: anti-spam vs network abuse
by Michael Lamoureux 02 Mar '03

02 Mar '03

"andy" == Andy Dills <andy(a)xecu.net> writes: andy> On 1 Mar 2003, Michael Lamoureux wrote: andy> If you do a good job with your network, probing will have zero andy> affect on you. All the person probing can do (regardless of andy> their intent) is say "Gee, I guess there aren't any andy> vulnerabilities with this network." >> >> This is a completely naive statement. There are 0 networks that I'm >> willing to believe have 0 vulnerabilities on them. There may be 0 >> that you know about, but that doesn't mean there aren't more >> vulnerabilities which aren't public knowledge lurking in sendmail or >> bind or ssh or ssl or apache or any number of other services you have >> running. andy> My statement is as naive as yours is ridiculous. andy> You're telling me your IDS systems tell you when there is a new andy> vulnerabilitiy, before you see it on bugtraq? I've read my statement quite a few times, and I can't see where I even implied that. andy> So, since I'm so naive, No no no...I never said that YOU were naive. I said the statement that if you've done a good job, all the prober can do is say that there aren't any vulnerabilities on your network was naive. Your own argument supports what I said. My whole point was that no matter how good a job you do, you probably are still vulnerable to something. andy> You realize that scanning happens after exploits get published, andy> not before. I don't even make the assumption that all exploits ever get published. andy> My network is as secure as it can be, which IS NOT the same as andy> "My network is invulnerable". Exactly. andy> Don't put words into my mouth simply so you can call them naive. I'm not 100% sure where I did this, but I completely apologize if I have. IMHO, Michael

1 0

DNS records for routers
by Pete Kruckenberg 01 Mar '03

01 Mar '03

Any passionate opinions about DNS record conventions for routers? Or recommendations? I'm not particularly concerned about device naming conventions (we have that down), I'm more interested in what makes sense for public-viewable DNS names (so I can put those beautiful fully-compliant names where people can see them). Some traces show individual interface names, some just show device names. Any particular reason to go one way or the other for PTR records (doing a single device name for every interface seems easier and less-likely to screw up to me)? What about A records? A matching one per PTR, or just one A per device? Or no A records in the public DNS? Would round-robin A records (an A record for every interface address, all using the same device name) break anything (like performance measurement tools or network management tools)? Thanks. Pete.

2 1

Re: BGP to doom us all
by Avi Freedman 01 Mar '03

01 Mar '03

In article <10321.15111.31594(a)avi.netaxs.com> Vadim wrote: : Thank you very much, but no. : DNS (and DNSSEC) relies on working IP transport for its operation. Good point. However - Routers rely on having enough CPU and RAM to do transport as well, and router engineers rely on not running offboard boxes in strange configurations that are more likely to cause that which is the biggest of problems on the Internet - humans getting confused and stuffing things up. Problems abound with every approach. : Now you effectively propose to make routing (and so operation of IP : transport) dependent on DNS(SEC). : Am I the only one who sees the problem? Probably not, but lots of us see problems with S-BGP as constituted now. Lots of work has gone into something that is highly unlikely to be deployed in any major core network. : --vadim Rather than flame each other, maybe we can have a shoot-the-shit discussion of the underlying problem (lack of authentication of routing AND of packet sources), perhaps at IETF or NANOG, at the pre-draft stage. Maybe people will agree, but it might be productive. : PS. The only sane method for routing info validation I've seen so far is : the plain old public-key crypto signatures. Avi

1 0

Re: anti-spam vs network abuse
by Charlie Clemmer 01 Mar '03

01 Mar '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 02:07 PM 3/1/2003 -0500, jlewis(a)lewis.org wrote: >People speed, drive drunk, and run over pedestrians. Should we outlaw >cars? Maybe just in California? :) To use your analogy, you'd have to outlaw computers because they're used to bad things. That's not what's being discussed. Speeding can cause harm to others, thus it's against the law. Same with drunk and reckless driving. So, since probing is often used for malicious intent, should it not also be prohibited or at the very least limited? Since there's no way to tell if a probe is being done for precautionary or exploratory purposes, me being the security paranoid type that I am will always assume the worst and react accordingly. I don't think I'm alone here. -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPmENg6vEtUU05riwEQJp4ACfS9HoxmdPVMf0ugiUkjjAjvr7Jz0AnjvH RIYXLLs6Fm6N/s7ZJcfLLRQa =lMDX -----END PGP SIGNATURE-----

1 0

RIPE Down or DOSed ?
by Marshall Eubanks 01 Mar '03

01 Mar '03

Can anyone else get to ripe.net ? I cannot seem to access the whois or any other service (my ripe traffic goes through Sprint). When I ping peach.ripe.net, I get 90%+ missing packets + "destination host unreachable" from inside Sprint. Regards Marshall Eubanks

26 42

Re: Who uses RADB? [was BGP to doom us all]
by Danny McPherson 01 Mar '03

01 Mar '03

> You forgot the other one - expense. AFAIK all of the registries have fees > or require you to be a customer. If there is no operational value First problem, you see no "operational value". > for me why would I want to spend the money? Money changing hands no longer makes the IRR a dis-interested third party or research project, they now have a vested interested in object integrity and availability, and perhaps can afford resources to support these and other enhancements. > I realize most of you work for companies that consider a million dollars > chump change but that is not the case everywhere. If you can give me a > convincing reason to register my routes in a RADB I will - but at this > point I have yet to see it. When one of your peers starts filtering inter-provider based on IRR and your prefixes aren't permitted, or one of your peers advertises you more- specifics for your customers prefixes, or better yet, your routers are compromised and used to disrupt service to some now very unhappy multi- million dollar online enterprise that will seek reimbursement -- maybe that'll help convince you... > What does a RADB tell you about a non-transit network that you can't see > from BGP and WHOIS? There is no more security in RADB than there is in our > current method of notifying our peers of the netblocks we are announcing. You should read up on it, there's a bit more capability there than just a prefix and POC email address. -danny

1 0

Re: Who uses RADB? [was BGP to doom us all]
by Danny McPherson 01 Mar '03

01 Mar '03

> > > Who actually uses RADB to build filters other than Verio? While my > > experience with other providers is limited Verio is the only one (of the > > ones we have used) who used RADB entries for BGP peers. > > Level3 do atleast. Most European providers do. For customers, though not inter-provider. -danny

2 1

Alcatel Router experience, information
by Wayne Bogan 01 Mar '03

01 Mar '03

Hello Everyone, I'm looking for feedback related to Alcatel routers for core equipment. I'm comparing it's functionality to that of Juniper, Cisco, and Riverstone. Any help would be appreciate. Most of our experience is with Cisco, but looking at other avenues. Regards, Wayne Wayne Bogan 803-985-4706 (phone) 803-802-4700 (fax) www.infoave.net

1 0