- NANOG - lists.nanog.org

Re: root server update
by NSSI_2＠nssi_2.frontier.com 19 Feb '97

19 Feb '97

The root name servers each take between 500 and 1000 queries per second. So testing them from time to time isn't going to hurt much. However, we don't need to test them from very many places, since we would just overload the trouble reporting system, which tends to be biologically limited. How about if each root name server just implements RFC 2010 and does their own monitoring, and InterNIC does the fallback monitoring, and we stop arguing about global issues on a north american mailing list?

1 0

MAE West - Can anyone help
by Paul King ＠work 19 Feb '97

19 Feb '97

Can anyone help me? I'm trying to find out names and contact details for Telco's who can provide me with an incoming only PSTN line into MAE West for dial-up access onto our router there. Any suggestions? Apologies if this is an inappropriate list for this request. Thanks in advance. Paul K... --------- Paul King, Engineering Manager - Network Tel: +44 1483 251 773 Telewest Data Services / Cable Internet Mailto:pking@cableinet.net Fax: +44 1483 251 810

1 0

Re: Just got on this thing (perhaps very belatedly) - root server trouble? (fwd)
by Paul A Vixie 19 Feb '97

19 Feb '97

Someone asked me privately: > Hey, in case you /dev/null Karl: The 5ms at 1200 req/s criteria in > RFC2010 refers to the latency of a request from the local network, right? > The RFC doesn't make that clear, and in fact would make it sound like it's > supposed to be able to do 5ms over wider areas. RFC2010 did not intend to amend the universal constant "C".

2 1

Just got on this thing (perhaps very belatedly) - root server trouble?
by Karl Denninger 19 Feb '97

19 Feb '97

Hi folks, Just joined over here.... probably rather belatedly... What's this about root server problems? For what its worth, I haven't seen any. Then again, I don't run here with the IANA roots -- I run eDNS. Perhaps those who are unhappy with the stability of the IANA roots these days should try them... http://www.edns.net has a rather simple way to do this (yeah, it doesn't win any artistic design awards, but the information is there.... the page is brand new, just put up this afternoon) We've been running on eDNS now for something like seven months, and have had ZERO operational incidents recorded by our NOC which have been related to root server failures or problems. Now .COM servers -- that's another story. We had the problem with the bad data a couple of months ago like everyone else. But this wasn't a root server problem (and never was traced to the roots)..... Give it a shot folks. I know lots of you have political dislikes for the eDNS concept and implementation, but if your nameservice is unreliable now, having trouble, and you can *FIX IT* for your customers by using eDNS instead, isn't finding and using a better mousetrap what your customers all pay for you? Think about it! -- -- Karl Denninger (karl(a)MCS.Net)| MCSNet - The Finest Internet Connectivity http://www.mcs.net/~karl | T1's from $600 monthly to FULL DS-3 Service | 99 Analog numbers, 77 ISDN, Web servers $75/mo Voice: [+1 312 803-MCS1 x219]| Email to "info(a)mcs.net" WWW: http://www.mcs.net/ Fax: [+1 312 803-4929] | 2 FULL DS-3 Internet links; 400Mbps B/W Internal

7 14

Re: Just got on this thing (perhaps very belatedly) - root server trouble?
by crusso＠alink.net 19 Feb '97

19 Feb '97

At 5:23 PM 2/18/97, Karl Denninger wrote: [...] >What do you think happens to the nameservers on the net when they're asked >for a domain that doesn't have functional servers, and they sit and churn >trying to resolve the names? > >BTW, churn is the right word. Its taking anywhere from 5-10 *seconds* to >come back as NXDOMAIN on each request for those that fail to resolve, and >this is from the IANA roots. > >This IS a functional problem - and worse, all those non-existant zones and >the VM churn they generate on the COM TLD servers is probably the REASON >that we're looking at this kind of horrid performance! Churn shmurn. Those domains are probably ones that have been paid for (to the InterNIC), but aren't yet being used. Who's accessing those unused domains and doing all this needless churning? We should find 'em and string 'em up. Seems like most of the churning would be caused by spammers and testers like yourself. I'd be interested in seeing actual machine statistics on how much performance degredation can be attributed to lack of responses. Without those statistics, I can't see how the InterNIC fees aren't covering this scenario. As was mentioned before, you shouldn't have to pay an ISP to have a domain name reserved. Chris Russo ------------------------------------------------------------------ A-Link Network Services (408) 720-6161 http://www.alink.net This space for rent. ------------------------------------------------------------------

6 5

RE: Just got on this thing (perhaps very belatedly) - root server trouble?
by Jim Fleming 19 Feb '97

19 Feb '97

On Tuesday, February 18, 1997 11:18 AM, Michael Dillon[SMTP:michael@memra.com] wrote: @ On Tue, 18 Feb 1997, Karl Denninger wrote: @ @ > Folks, we run the network (this *IS* NANOG, right? :-) Let's start actually @ > running it for a change... DNS is one of those things that we ought to be @ > able to do right, and do in an open and competitive format. @ @ Seems to me that we on NANOG are concerned with mostly issues that fall at @ layers 2-4. You are talking about things like competition that really are @ only marginally related to most people on NANOG. @ @ Michael Dillon - Internet & ISP Consulting @ Memra Software Inc. - Fax: +1-250-546-3049 @ http://www.memra.com - E-mail: michael(a)memra.com @ @ @ I can not wait until the day comes when we see our friend from Canada, Mr. Michael Dillon, trying to invade the floor of the United States Senate or the House of Representatives to tell those folks what they are allowed to discuss. Something tells me that they will not really care that you are on the Board of Directors of the ISP/C Mr. Dillon. Of course, you are welcome to prove me wrong. -- Jim Fleming Unir Corporation e-mail: JimFleming(a)unety.net JimFleming(a)unety.s0.g0 (EDNS/IPv8)

1 0

RE: F means filtered ?
by Jim Fleming 19 Feb '97

19 Feb '97

On Monday, February 17, 1997 6:50 AM, Tim Salo[SMTP:salo@msc.edu] wrote: @ > From: Jim Fleming <JimFleming(a)unety.net> @ > Subject: RE: F means filtered ? @ > Date: Mon, 17 Feb 1997 11:58:07 -0600 @ > [...] <snip> @ @ In my opinion, the U.S. Government and the NSF have far more important @ things to do. Many of these more important things will continue to @ develop and strengthen the Internet infrastructure. @ @ It is also worth noting that every U.S. Government or NSF research contract @ I have read contains explicit language about the ideas generated through @ the grant are not endorsed by the funding agency. @ @ -tjs @ @ Tim, You may have missed the following.... The United States of America is a great nation that has been one of the primary leaders in the development of information technology. The Internet is largely derived from government funded projects and without the security, stability, and staying power of the U.S. Government, the large number of Internet users around the world would not be jumping on board the Information Superhighway. Many people and companies have placed trust in the U.S. Government. The U.S. Government places trust in God. (According to the back of a one dollar bill). Despite the fact that many people on the Internet place trust in the IANA, the IETF, the IAHC, the IAB, the IESG and other I* organizations, the fact remains that the U.S. Government backs the Internet. (and the U.S. dollar) Within the U.S. Government various agencies and organizations have helped to move the Internet forward and to provide the representative government needed on the Internet for people to safely make investments in time and money with the knowledge that a democractic and capitalistic group of people are in control. One of the primary agencies helping to fund the Internet has been the U.S. Government funded National Science Foundation (NSF). <http://www.nsf.gov> The NSF has been the primary agency helping to fund and provide the clout for the cooperative acitivity commonly called the InterNIC. The InterNIC was originally made up of three companies, General Atomics, AT&T, and Network Solutions, Inc. These three companies were supposed to work together in various capacities to provide a variety of services including the important clerical duties commonly called "registrations". In the original plan, General Atomics was supposed to be the NIC of NICs and coordinate the activities of the other two companies. The NSF was supposed to oversee the entire activity. If managed properly, many NICs would have been developed through education programs and the Internet Infrastructure would have been expanded beyond the State of Virginia and the few companies originally contracted to be part of the cooperative agreement. That has not occurred. The history of the evolution of the InterNIC has been well-documented and is very clear. In their original proposal to the NSF, Network Solutions, Inc. suggested that they should do the entire job. Jon Postel and Joyce Reynolds of the IANA, are listed on the original Network Solutions, Inc. bid as subcontractors to Network Solutions, Inc. As history has shown, the IANA, working in conjunction with the "InterNIC" (Network Solutions, Inc.) has helped to continue to promote Network Solutions, Inc. to a point where most people consider NSI to be the InterNIC. Throughout the evolution of the InterNIC from a three-company cooperative to a one company monopoly, the NSF has apparently been caught like a deer in the headlights of a car, frozen in indecision but providing mass when needed to allow a few individuals and companies to leverage themselves into positions of great wealth. The NSF has been skillfully used to provide the U.S. Government seal of approval, while policies are enacted by private parties who openly claim that the NSF is "backing" their agendas. Many companies operating within the United States under Federal and State laws, have been shocked over the past few years at how their tax dollars are used to fund the NSF which in turn funds Internet infrastructure with apparently no control over the outcome. Furthermore, despite repeated efforts by other companies to participate in and make investments in the Internet infrastructure, the NSF has stood by and allowed plans and systems to be developed which lock certain companies out while others are given a free pass and in some cases millions of dollars to jump start their business. The recent IAHC <http://www.iahc.org> activity is an excellent example of how a private company (ISOC) <http://www.isoc.org>, with less members than many ISPs, is provided an NSF representative, Dr. George Strawn, <http://www.cise.nsf.gov/ncri/Georgehome.html> for credibility, while they develop a plan to sell what amounts to Internet Domain Registration Franchises to companies willing to pay large fees to fund the private ISOC. Another example is the recently proposed ARIN <http://www.arin.net> organization which claims to have strong support from the NSF to charge fees for IP addresses. The proposed Board of Direcors of ARIN are mostly people funded directly, or indirectly, by the National Science Foundation. <http://www.arin.net/arin_board.html> @@@@@ <http://www.arin.net/arin_faq.html> @@@@@@@@@ "Network Solutions is leading the ARIN proposal based on a mandate from the Internet community reached in rough consensus with strong support from the National Science Foundation and the Internet Assigned Numbers Authority (IANA)." @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Fortunately, the U.S. Government had the wisdom to set up an agency within the NSF to provide some of the checks and balances needed to regulate the NSF. That agency is the Office of Inspector General (OIG) <http://www.nsf.gov/oig/oig.htm>. OIG is headed by the Inspector General (IG), who reports directly to the President (via the NSB) and to Congress. ---- Inspector General ------- name: Sundro, Linda G. email: lsundro(a)nsf.gov directorate: Office of Inspector General phone: (703)306-2100 office_phone: (703) fax: (703)306-0649 address: 4201 Wilson Blvd., Room 1135S : Arlington, VA 22230 -------------------------------------- In a recent discussion with Ms. Sundro, she indicated that the NSF Office of Inspector General has been investigating the matters surrounding the InterNIC and a Report to the Deputy Director is about to be published. Ms. Sundro indicated that Ms. Clara Kuehn, a physicist AND ATTORNEY, has been assigned to handle the investigations and can provide information on the status of the report. -------------------------------------- name: Kuehn, Clara email: ckuehn(a)nsf.gov directorate: Office of Inspector General phone: (703)306-2001 office_phone: (703)306-2001 x 1505 fax: (703)306-0649 address: 4201 Wilson Blvd., Room 1135S : Arlington, VA 22230 ------------------------------------------ Ms. Sundro also noted that the e-mail address (oig(a)nsf.gov) listed on the Office of Inspector General web site as an "Electonic Mail Hotline" is not useful in contacting her office. She indicated that Ms. Kuehn will welcome input from people on all topics related to these matters and that the above e-mail address (ckuehn(a)nsf.gov) should be used. In summary, I think that U.S. citizens should be proud that their great country developed much of the technology and infrastructure for the Internet. I also think that the world population should be aware that the hundreds of years of government development in the U.S. has resulted in a system that has the proper agencies to not only help to foster increased growth of the Internet but also to help ensure that citizens around the world are able to compete in this marvelous advancement on a playing field that is fair and level. -- Jim Fleming Unir Corporation e-mail: JimFleming(a)unety.net JimFleming(a)unety.s0.g0 (EDNS/IPv8)

2 1

Re: Just got on this thing (perhaps very belatedly) - root server trouble?
by John Todd 19 Feb '97

19 Feb '97

[data about ~30% of .com zones not backed by SOA records removed] <sthaug(a)nethelp.no> on 02/18/97 23:09 said: > > Karl Denninger <karl(a)Mcs.Net> on 02/18/97 18:59 said: > > > > This is a direct result of NSI accepting applications for domains, and > > listing them, without checking for authoritative SOA records before issuing > > the records in the COM zone! > > > > I'm apalled at these numbers. > > For once we agree. NSI should have stopped this practice long ago. You'll > be pleased to hear that there are other name registries (for instance the > one serving the "no" (Norway) TLD that actually perform this check. > > Note that checking when an application is received isn't really enough. > In Norway we run regular (monthly) checks of all the second-level domains > under "no", and we always find a number of name servers which have ceased > being authoritative in the time since last check. > > Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no I couldn't agree more. There are any number of both political and technical reasons that the SOA should be checked on zones before they appear in any root nameservers, and it doesn't seem that large a task to prevent bogus zones from making it into the root nameservers. Why non-SOA zones shouldn't make it into the root nameservers: - lame zones are inherently broken; why allow brokeness to exist? - if it's not in the nameserver, the "owner" of the nameserver hasn't given explicit permission for it to be there (see below under "lawsuits") - filling the root nameservers with bad NS pointers only wastes time with timeout queries that stick around too long (not a big deal with people who have no data at all in either server, but what about zones that one of the nameservers is lame? That would cause the 5-10 second lag time for a "valid" zone when the "invalid" nameserver was asked abouft it.) - people who point secondary at non-SOA nameservers without telling the secondary that this is expected break not only themselves, but bring complaints against the innocent "secondary" provider who has complaints that "Your nameserver is broken!" How to prevent bogus SOA's: - before propogating the name into the roots, check for SOA - if SOA fails, then list the name in some sort of "Reserved" status, just like names that are pending payment, but make it possible for a name to remain in "Reserved" status forever (see "lawsuits-2" below) - if initial SOA test fails, check SOA every X number of days until valid. - every X number of months, check to ensure SOA is still present in listed nameservers. - If invalid, wait another Y days, and try again. After Z iterations of failures, pull the NS pointers and list the zone as "Reserved" for XX number of days or until someone calls in and whines, at which point check SOA by hand. Diatribe: There have been occasions where persons have sent in top-level domain registrations with nameservers listed as secondary that had _nothing_ to do with the primary, and had never even heard of the primary. If foo.com wanted to point their secondary at any particular nameserver (or even a random IP address!) there is nothing that anyone can do to prevent them. Suddenly, an innocent bystanding nameserver admin starts getting flames from SPAM victims and other sundry folk simply because their name happens to be in the NS list for that zone. I also hate trying to dig around (no pun intended) to find if there is any information at all that is valid for a zone, if the old ISP is still in business, if that network just isn't visible from where I am, etc. I am involved with a lot of transfers, and I'd rather know that the old nameservers are just non-existant rather than trying to sleuth things down. Lawsuits: Imagine that the domain "humongouscompany.com" is registered with ns.bigprovider.com and ns2.bigprovider.com. Recently angered by the current sale of routers in China by Humongouscompany, and _equally_ angered at the recent banning of his IP address from smallprovider.com's IRC server, a clever hacker spoofs an email message from the admin contact at humongouscompany.com and requests that the nameservice be moved from [ns,ns2].bigprovider.com and pointed at [ns,ns2].smallprovider.com. The next root nameserver reboot, humongouscompany.com is out of luck, as there are no records in place for that zone in [ns,ns2].smallprovider.com's nameservers. Smallprovider is completely innocent here, but guess who gets slammed in that morning's TechWizDaily? Lawsuits-2: Well, a good argument has been made that "if an SOA is required, then there is criteria for getting added to the root nameserver, and the NIC has to be impartial and take all comers who have the $100 to register." OK, no problem. Just register the name, make it impossible for anyone else to take that particular combination of letters/numbers, but don't point the zone anywhere. Summary: These ideas have been floated past some of the registration managment at the InterNIC, and hopefully they'll take this into consideration. This would prevent the 30% attrition that Karl reports that he's discovered. Any comments? Does anyone else feel that the NIC should go back to checking SOA's with the addition of an additional "no-SOA" or "Reserved" status? JT --- John Todd jtodd(a)fox-den.com

1 0

Re: Unsubstantiated Rumor - this is not simply about RBOC ISP Tariff
by salo＠msc.edu 18 Feb '97

18 Feb '97

> Date: Mon, 17 Feb 1997 23:13:21 -0800 (PST) > From: David Holub <david(a)hooked.net> > To: Tim Salo <salo(a)msc.edu> > Cc: nanog(a)merit.edu > Subject: Re: Unsubstantiated Rumor - this is not simply about RBOC ISP Tariff > [...] > I'm very aware of what a "telecommunications carrier" is and without boring > you with the details I'm also very secure in Whole Earth Networks ability to > fall under that definition. ... One interesting attribute of telecommunications carriers is that they all seem to have big legal departments. Be careful what you wish for... -tjs [By the way, given the number of people who want someone to regulate some aspect of the Internet, I suspect that we will see the day when all ISPs have lawyers. On the other hand, it doesn't make much sense to me to try to hasten the arrival of this era.]

1 0

Re: Just got on this thing (perhaps very belatedly) - root server trouble?
by salo＠msc.edu 18 Feb '97

18 Feb '97

From: Karl Denninger <karl(a)Mcs.Net> Date: Tue, 18 Feb 1997 15:29:33 -0600 (CST) > About 30% of the nameservers which supposedly > are authoritative for .COM domains are either: > 1) Non-existant (they don't resolve to an IP address) > 2) Unreachable > or 3) Don't know what "." is (!) This might say more about the status of Internet reachability at a particular point time and/or from a particular place in the Internet. This exercise doesn't seem like particularly good science... -tjs

2 1