- NANOG - lists.nanog.org

Survey on IPv4 Scarcity, IPv6 Adoption, Carrier-Grade NAT Deployment
by Philipp Richter 17 Dec '15

17 Dec '15

Dear NANOG readers, we are a team of researchers from ICSI Berkeley, TU Berlin, TU Munich, Internet Initiative Japan and UC Berkeley jointly working on a project to assess the effects of IPv4 address exhaustion. As part of our research, we conduct a survey among network operators. The goal of this survey is to better understand the degree of IPv4 scarcity that ISPs face and which measures are taken to combat it (IPv4 Carrier-Grade NAT deployment, IPv4 address markets, and IPv6 transition mechanisms). If you work for an ISP that connects end-users to the Internet, we would greatly appreciate your response. To participate, please visit http://natsurvey.icsi.berkeley.edu/ (answering should take about 5 minutes, all questions are explicitly optional). We will make anonymized results of this survey available to the public in early 2016. Thank you very much for your support! If you have questions or concerns, please feel free to contact me directly at prichter AT icsi DOT berkeley DOT edu. -- Philipp Richter Research Assistant / PhD Student TU Berlin / ICSI

1 1

IPV6 availability
by Roy 17 Dec '15

17 Dec '15

Anyone know what the IPV6 availability is on Cable One or Charter networks? Last I heard from Charter was that they were in beta. Its been in that state for years. I can't find anything on Cable One

3 3

DNSSEC and ISPs faking DNS responses
by Jean-Francois Mezei 17 Dec '15

17 Dec '15

The Québec government is wanting to pass a law that will force ISPs to block and/or redirect certain sites it doesn't like. (namely sites that offer on-line gambling that compete against its own Loto Québec). In order to make a good submission to government, once has to boil it donw to simple enough arguments that clueless politicians can understand. And for me to do that, I want to make sure I understand this correctly. I have tried to research DNSSEC and while I understand how a proper DNS server can validate the chain from the - root server - TLD server - authoritative DNS server for that domain I remain in dark with regartds to clients, namely clients who cannot trust the DNS server supplied as part of DHCP/IPCP/PPPoE responses. Say a consumer wants to connect to lottery.com, which, from the world outside the ISP, would result in a signed, verifiable response. Can't the ISP's DNS server just pretend it is authoritative for lottery.com and return to client a non-DNSSEC response that points to a fake IP address ? If the client gets an unsigned response for lottery.com from its ISP's DNS server, how can it know it is a fake response, how can it know that lottery.com should have generated a signed DNSSEC response ? It seems to me that unless each client goes to the tld servers (they already have root signatures), get signature of the tld server and signed response of where "lotery.com" can be found, they have no way to know whether lottery.com should be signed or not, and whether the answer they got from their ISP is good or not. Is that a proper understanding ? So far, I have seen good explanations of what happens between DNS servers and the servers that are authoritative for domain, TLD and root. But I have seen nothing about clients who only have a resolver that talks to a DNS server. And while I am at it: when a client gets a legit response from ISP's DNS server with RRSIG records, how does the client obtain the public key against which to run the record to ensure its calculated signature matches that provided in RRSIG ? or do DNS servers return the full chain of records so that a request for lottery.com returns not only record for lottery.com but also .com,s reply on where lottery.com is and root's reply of where .com is ? Hopefully, I am only missing a small bit that would explain everything that happens at the client side. But as long as I am told that the client only talks to the ISP's DNS server, I am at a loss. Any help appreciated. (I just watched an hour long youtube on subject which didn't deal with client much).

27 74

Re: Nat
by Josh Reynolds 17 Dec '15

17 Dec '15

Publicly shame them by listing the ones who don't fully support IPv6. List them here, so we know to choose their competition. On Dec 16, 2015 8:39 PM, "Berry Mobley" <berry(a)gadsdenst.org> wrote: > At 08:22 PM 12/16/2015, Randy Bush wrote: > >> > We need to put some pain onto everyone that is IPv4 only. >> >> this is the oppress the workers so they will revolt theory. load of >> crap. >> >> make ipv6 easier to deploy, especially in enterprise. repeat the >> previous sentence 42 times. >> > > This. I'm in an enterprise with some stubborn vendors, and none of them > are even talking about ipv6. It won't help me to move (and it won't help > you to get well if you're here) if my users can't get to their stuff. > > Berry >

1 0

Comcast carrier sales
by Mike 17 Dec '15

17 Dec '15

Hi, Im trying to establish connectivity with comcast and their normal sales channel doesn't seem to be equipped to deal with a facilities based carrier who wishes to establish some kind of meet-me arrangement on fiber. Does anyone know or can a comcast carrer sales rep contact me? I want to give you money.... Mike-

2 1

Re: Nat
by Larry Sheldon 17 Dec '15

17 Dec '15

On 12/16/2015 19:22, Randy Bush wrote: >> We need to put some pain onto everyone that is IPv4 only. > > this is the oppress the workers so they will revolt theory. load of > crap. > > make ipv6 easier to deploy, especially in enterprise. repeat the > previous sentence 42 times. > > what keeps the cows in the pasture is the quality of the grass not > the height of the fence. Have you considered national politics? The world needs you. -- sed quis custodiet ipsos custodes? (Juvenal)

1 0

Call for Presentations - DNS-OARC Spring Workshop, March/April 2016
by Wessels, Duane 16 Dec '15

16 Dec '15

The 24th DNS-OARC Workshop will take place in Buenos Aires, Argentina between March 31st and April 1st 2016, Thursday and Friday before IETF95. This will be the first time DNS-OARC is held in the Southern Hemisphere. To attract the best DNS minds and local audience, DNS-OARC is requesting proposals for presentations, with a preference for Operational Practices Reports, and "How we solved this problem" presentations. This workshop intends to build from previous strong DNS-OARC workshops, where both operational content and research are welcome. Presentations from DNS operators are particularly desired, as well as from DNS researchers. All DNS-related subjects are accepted. If you are an OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. A timeslot will be available for lightning talks (5-10 minutes) on April 1st, for which submissions will be accepted during March 31st on a first-come first-served basis. Workshop Milestones • 30th November 2015, Call for Presentations posted and open for submissions • 29th January 2016, Deadline for submission • 16th February 2016, Final Program published • 28th March 2016, Final deadline for slideset submission Details for abstract submission are published here: https://indico.dns-oarc.net/event/22/call-for-abstracts/ The workshop presentations will be organized by common themes, depending on the topics and the timing of each presentation. There are 30-minute and 15-minute slots, let us know your preference in your submission. To ensure the quality of the workshop, submissions including draft slides will get extra points during evaluation. You can contact the Programme Committee (https://www.dns-oarc.net/oarc/programme) via <submissions(a)dns-oarc.net> if you have questions or concerns. OARC is also seeking sponsorship for this workshop, please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) Duane Wessels, on behalf of the OARC Program Committee

1 0

Re: reliably detecting the presence of a bridge?
by Carsten Bormann 16 Dec '15

16 Dec '15

[Dave asked me to repost this to the list -- not sure how useful this little lead is; haven't worked on this for more than half a decade.] I don't have a good platform to test this on today, but one way to detect a wireless bridge a couple of years ago was to send a SNAP packet (actually anything with an Ethernet length -- as opposed to ethertype -- in it) that is shorter than Ethernet minimum length (14 + 46), and then see whether the padding you put in on one end survives over to the other end. That of course only works with bridges that actually optimize this case (plus you can detect those that completely mess up this case -- there are quite a few of those). Hope that helps; would need to do experiments with real hardware to say anything more substantive. Grüße, Carsten PS.: In case you wonder what the work was that led to this observation: https://tools.ietf.org/html/draft-bormann-rohc-over-802-02

1 0

John McAfee: Massive DDoS attack on the internet was from smartphone botnet on popular app
by Jay Ashworth 15 Dec '15

15 Dec '15

Is McAfee just talking to dry his teeth here? This isn't actually practical, is it? Carriers would notice, right? http://www.ibtimes.co.uk/john-mcafee-massive-ddos-attack-internet-was-smart… -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

12 11

Opinions on Cologix data centers?
by David H 15 Dec '15

15 Dec '15

Hello; was curious if anyone has opinions on Cologix? Any aspect would be of interest; management, financials, colo quality (power, a/c, etc). The specific facility I'm looking at is their Lakeland FL building which began life under a company called Colo 5 that they purchased; it's only two years old. They seem to have been on a buying spree recently with other colo buildings. Thanks, David

4 3