March 2001 - Test - lists.nanog.org

Re: Loose Source Routing
by smd＠clock.org 07 Mar '01

07 Mar '01

Jared Mauch writes: | The reason to permit this is to verify peering policy. This | allows people to traceroute to verify packet path. Example: | I announce 172.16.0.0/16 only. I want to verify that you are not | pointing default at me, so I can do a loose source | traceroute to 10.0.0.0 via the peering point. Yes, this is one use of LSRR, but this can be accomplished through a standard looking-glass, also, which in my opinion is a much better requirement of one's potential peers (and suppliers). The major cost to LSRR is not in security (LSRR doesn't open any new attacks, it just makes some that require handshaking easier, when IP addresses are used as "authentication"), but rather in slow-path performance in some types of router/software combinations. LSRR is a phenomenally useful feature that simply was never popularized at the client level; few people used the "telnet @gateway1@gateway2:destination" syntax in those telnets that supported LSRR, and nearly no other clients offered any way to construct LSRR, pace traceroute and some pings. As a result, barely any effort goes into LSRR support in intermediate systems (routers, gateways, NATs, you name it) -- vicious circle. SSRR is even less well known/supported in the network. On the other hand, haha, that's what we have MPLS for (puke puke puke). There is an important lesson here for people who suggest that route optimization policy should be done on hosts rather than in the network. Sean.

4 3

Loose Source Routing
by David McGaugh 07 Mar '01

07 Mar '01

What are people's feelings on loose source routing? The general sentiment around here is that it is a very evil thing. The reason I ask is that there is a certain network out there (who will remain nameless) who refuses to peer unless loose source routing is enabled. I can somewhat understand their reasoning (they can reroute traffic on OUR network as necessary) but the security implications far out way the benefits. Not only this I'm not comfortable with an outside source having control over routing on our network anyway. -Dave -- +------------------------------+ Dave McGaugh, CCNA Peering & IP Backbone Engineer Electric Lightwave, Inc. E-mail: dmcgaugh(a)eli.net Direct Dial: 360.816.3718 Fax: 360.816.3522 +------------------------------+

7 7

Call for Whitepapers / Research
by Kevin Facinelli 07 Mar '01

07 Mar '01

I am asking the NANOG group of industry experts to submit relevant white papers, articles or information regarding: Bandwidth, Colocation Selection, Computer Hardware Selection, Network Operations Centers, Legal Issues SLA's/QOS, Peering and Interconnection, Power Systems, and Service Models. This information is available free of charge from the web resource www.colosource.com. Since first publishing information a couple of months ago many papers have been downloaded over 1000 times. If you know of information that is not your own but have deemed it of value to the industry, send me the url and I will contact the publisher and attempt to get it listed. If you have ideas on how to improve content let me know and we will make every consideration to implement your ideas. Please feel free to email me directly information that you may have for publish that can help educate our community of users. Thank You, Kevin Facinelli www.colosource.com webmaster(a)colosource.com ===== Kevin Facinelli www.colosource.com webmaster(a)colosource.com __________________________________________________ Do You Yahoo!? Get email at your own domain with Yahoo! Mail. http://personal.mail.yahoo.com/

1 0

RE: An example of reverse-hijack (was: new.net: yet another dns n ames pace overlay play)
by Doane, Andrew 07 Mar '01

07 Mar '01

After reviewing my post, I must admit, that this thread was ICANN decisions, not NS/the Courts. Of course ICANN was involved in the legislation, so the content of my previous email is at least partially valid. I could bring up that I applied for the use of ".BIZ" in 1995 and that somehow all these other registrars now have the rights to it, despite the fact they applied for that right several years later. Alas, that's a different topic for another day. Cheers all. -Andrew -----Original Message----- From: Doane, Andrew Sent: Wednesday, March 07, 2001 9:19 AM To: 'Scott Gifford' Cc: 'nanog(a)merit.edu' Subject: An example of reverse-hijack (was: new.net: yet another dns names pace overlay play) Scott, I registered "aol.org" in 1995. It stood for "Andy On-Line" (my name). I used it for almost five years without any problems from America Online, mainly for email and to ftp back into my home network, etc. I did not have a website up. America Online sued and won a judgment without even my being present. They stated that it violated their trademark of "AOL", as they had used it first in commerce. They used the fact that I had no web site at www.aol.org to justify this claim, ignoring the fact that their was an MX record and some other A records. A few "interesting facts": 1. In 1995, even if America On-Line wanted to registered .org they couldn't. Back then the rules were followed, and .org was for "private organizations and individuals". I registered it as an individual for non-commerce use. So their argument that they used it in commerce first is moot - as a .org domain you weren't supposed to. 2. America Online just recently acquired the right to protect "AOL" from the courts. Traditionally speaking, initials cannot be trademarked. If a company reaches "household word" status then they can get protection. IBM and GM would be examples. In 1995 when I registered aol.org, America Online did NOT have this protection. 3. Network solutions suspended the domain without warning by request of America On-Line. My phone calls to network solutions resulted in "call this person", which turned out to be America On-Line's attorneys. NS did this before America Online had received a judgment from the court. 4. Network Solutions and America Online claim they tried to reach me. They didn't. The address on WHOIS was wrong, however the email addresses and phone numbers were valid. Very convenient for them. However, the automatically generated renewal notice that I needed to pay my $35/year fee from NS made it to me. Funny, eh? 5. I hired an attorney to fight it, not because I wanted cash out on America Online (in fact, I didn't ask for this - I just wanted my personal domain back that I had been using for almost 5 years without issue). The net result was it would have cost me a mint to fight it against a multi-billion dollar company with endless resources. I caved and just let them have it. To date, they have not used it. They blackholed the domain. Someone explain the point in that. Obviously they felt people could confuse "aol.com" and "aol.org". So much so that they pointed www.aol.org to www.aol.com? No. So much that they put in MX records so email accidentally sent to joeuser(a)aol.org got delivered or at least a response back to the person who sent the email that they have the email address wrong? No. Big business wins against the individual by manipulating our government to draft legislation in their favor and then using it after the fact. There's your example. -Andrew NOT andy(a)aol.org -----Original Message----- From: Scott Gifford [mailto:sgifford@tir.com] Sent: Wednesday, March 07, 2001 3:16 AM To: William Allen Simpson Cc: nanog(a)merit.edu Subject: Re: new.net: yet another dns namespace overlay play William Allen Simpson <wsimpson(a)greendragon.com> writes: > Patrick Greenwell wrote: > > > > On Tue, 6 Mar 2001, Paul A Vixie wrote: > > > ICANN's prospective failure is evidently in the mind of the beholder. > > > > Besides producing a UDRP that allows trademark interests to convienently > > reverse-hijack domains > > Awhile back, somebody made a similar accusation. So, I spent the > better part of a weekend reviewing a selection of UDRP decisions. > Quite frankly, I didn't find a single one that seemed badly reasoned. > > Could someone point to a "reverse-hijacked" domain decision? Assuming that I'm correctly understanding what is meant by "reverse-hijacked", the most notorious case I'm aware of is "walmartsucks.com". This domain was taken from an owner serving up criticism of Wal-Mart, and given to Wal-Mart. Wal-Mart apparently claimed that this domain name was so similar to their actual trademark, customers could be confused into visiting the wrong site, and ICANN somehow agreed. I don't know where the official ICANN ruling is on this, but I recall seeing it discussed in a number of places at the time. Let me know if you can't find a reference, and I'll see if I can dig one up. -----ScottG.

1 0

RE: new.net: yet another dns namespace overlay play
by Mathew Butler 07 Mar '01

07 Mar '01

etoy.com versus etoys.com. -Mat Butler -----Original Message----- From: William Allen Simpson [mailto:wsimpson@greendragon.com] Sent: Tuesday, March 06, 2001 12:26 PM To: nanog(a)merit.edu Subject: Re: new.net: yet another dns namespace overlay play -----BEGIN PGP SIGNED MESSAGE----- Patrick Greenwell wrote: > > On Tue, 6 Mar 2001, Paul A Vixie wrote: > > ICANN's prospective failure is evidently in the mind of the beholder. > > Besides producing a UDRP that allows trademark interests to convienently > reverse-hijack domains Awhile back, somebody made a similar accusation. So, I spent the better part of a weekend reviewing a selection of UDRP decisions. Quite frankly, I didn't find a single one that seemed badly reasoned. Could someone point to a "reverse-hijacked" domain decision? > and the selection of a handful of lackluster > TLDs from a pool of applicants Here, I will agree. My observation is that they chose lackluster TLDs to avoid controversy on this, the first introduction of new TLDs in a dozen years. More will be forthcoming as operational experience is gained. And that's our area of expertise -- operational -- isn't it? > paying a non-refundable 50k fee in a The fee was always (and I'm going back to IETF, IAHC, and various other discussions) expected to be non-refundable. Pay as you go. Nobody else pays for your cost to operate. Very libertarian. Apparently, you've never optioned property.... Or supplied a performance bond. > completely arbitrary and capricious process, Really? In the legal sense? What proof do you offer? > perhaps you could point to > some of the many successes of ICANN as an organization? The public participation around the world has far outstripped anything I'd ever expected. On that basis alone, it's a success. Yes, I wish that things were moving faster. I wish that the fully envisioned board had been selected. I wish that there was more sunshine. But, I realise that not every citizen on the planet has the same adversarial bent in their civilization, and that some even consider collegial closed meetings more civilized! We've added some good people in the elections, and I have high hopes. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQCVAwUBOqVHh9m/qMj6R+sxAQGr8gQAgZC83rFcxOzQx13APCRlVmEXANHf/OMN rfiaAvZCW0Pq3mTt2/8roffizEZYQzN2cK/Y6pkyJj/9Le04t6FzFCbOdh8gdLjv E6XPu3AplDXbqNLZ38uN+A8lN9rnjhlkb7NuIvmGDF4zG6pj3YLrlhzEYQnxCyWW MIGSB9blde4= =QQ8G -----END PGP SIGNATURE-----

1 0

Re: Loose Source Routing
by smd＠clock.org 07 Mar '01

07 Mar '01

Uh is this "invent an acronym" day on NANOGame Street? | It makes sense to require peers to allow LSTR through their peer's | networks. LSRR is an IP option. So is SSRR. They stand, respectively, for Loose Source and Record Route and Strict Source and Record Route (RFC 791). All IP routers should DTRT with these options, even when disallowing the service. LSTR is something you made up which I guess means Loose Source Trace Route, which I guess refers to what you get from some traceroutes that take a -g (to specify one (of perhaps several) LSRR gateways). You probably _can_ allow something approaching only the traceroute application to use LSRR across your network, but basically that'd be done by something like filtering at the edge based on packet type if the LSRR option is set. Given that intermediate routers that are not LSRR gateways themselves have little to do with processing of an LSRR option, this seems, well, a suboptimal approach. Of course, if you're doing MPLS (barf barf barf) then digesting a new acronym hourly and doing tonnes of packet classifications at the edge is second nature anyway, so I guess I should shut up before someone calls me a curmudgeon. | Any badness that LSTR would allow seems to pale in comparison to A> | Peer's need to check policy compliance and operational troubleshooting, | and B> other nefarious things that can be done and not solved. Okay, I can't resist: if you have deployed MPLS strategically such that basically all traffic is going through multihop TE tunnels, what becomes of a packet with several LSRR or SSRR options flagged? (Extra credit for answers that let you be one of 2304290348209843 people listed in the Acknowledgements or Authors sections of a typical MPLS wg draft, or if you're a smarty pants who has already accomplished that, and still don't have a looking-glass in your network). Sean. - -- Sean Doran <smd+mean(a)ab.use.net>

2 1

Re: new.net: yet another dns namespace overlay play
by richb＠pioneer.ci.net 06 Mar '01

06 Mar '01

Shawn McMahon <smcmahon(a)eiv.com> wrote: > Wow; they wrote a program that transfers information, then redirects a > browser (via hooks already built in to the browser) to a new web page? > ... every Tom, Dick, and Harry will think he can just go off and > write that code. This one sums it up the best for me. About a year ago, I attended a talk by one of those 24-year-old megamillionaires who started out as a DJ in some remote New England hick town and then found himself in the Bay Area working at Oracle. At some point he decided to leave the nest, and had to choose between two opportunities: helping to start an Internet faxing company, or starting an online music-DJ service. He pondered this briefly: faxing? DJing? Which would I rather do? Well, of course he chose the more-fun DJ service, which landed him a 9-figure bank account and a job among the top ranks at AOL. May those who chose the glamorous career path as Internet registrar/root zone-grabber do quite so well. Sheesh. Yawn. And now let's return to our regularly scheduled discussion: how do you config your router for that? (A browser plugin?? Ugh.) -rich

1 0

RE: new.net: yet another dns namespace overlay play
by Karyn Ulriksen 06 Mar '01

06 Mar '01

:: > The stub config is interesting, though. :: :: Will be interesting to see if it even works. :: :: If they are just stubs for the fakeTLD.newdotnet.net., then :: all client :: requests will have to be properly formatted on send, meaning :: that it will :: only work if the plugin is used. Stuff like ping won't work. Nasty. :: :: If they are supporting an alias function (assuming ISPs are able to :: control the DNS settings on their users systems), then the :: ISP partners' :: DNS servers will have to run fake roots in order catch the :: requests for :: fake.zone. If they do that, are they going to answer with fake.zone. :: RRsets? or are they going to DNAME/CNAME everything? :: :: Neither mechanisms are pretty, both are required, it'll never last. No. It appears that they have fully prepared TLD DNS service implemented for the .chat, .xxx, .book, etc., Just like I could prepare a .karyn. TLD and set it up on my name server. I checked it out, the stub config sets up a slave stub zone for the TLDs they are serving, the resulting db file generated is like: ; BIND version named 8.2.3-REL Wed Jan 31 09:45:01 PST 2001 ; BIND version root@dns-01-001.root-dns.com:/usr/local/src/bind-8.2.3/src/bin/named ; zone 'chat' first transfer ; from 204.69.234.253:53 (local 64.7.192.162) using AXFR at Tue Mar 6 09:29:16 2001 $ORIGIN .chat 7200 IN SOA ns0.newdotnet.net. hostmaster.new.net. ( 983865614 1200 300 3600000 600 ) 7200 IN NS udns1.newdotnet.net. 7200 IN NS udns2.newdotnet.net. Using the stub config, you don't have to alter your root.cache. If ICANN has the root servers start serving of .chat info, then you can just remove the zone config from the .conf file. It's not that complicated to manage. You can keep the whole stub config outside of your main configs and "include" it (I do this ALOT anyways). The result is that you have a simple NS record like you do for COM/NET/ORG/EDU, etc. Not to evil. However, it would be VERY evil if the plug-in thing got into broad use. What a load that would be. Technical support on it would be a nightmare for every single ISP on the Internet. Imagine troubleshooting Joe Users browser access when he isn't telling you he's using this thaang. Dark clouds of jumbled characters over every TS cube is what you'll get. Next thing you know, every inet app would have to have this layer to get anywhere (the POS layer). Also, it's pretty evil that the first course they are offering ISP is to replace their root.cache file with a file that just has their 3 dns servers. No thanx. I'd hate to see what I'd find out when I trace out their locations and connectivity. Hopefully, they are smarter than having it as Bob's ISP, but I (like most netops) have become very cyncial about the technical capabilities of startups and "new" technologies. I would be willing to use them for name service for these alternative TLDs until they are served on the root servers. BUT, I won't depend on them for access to the root servers themselves. Color me foolish. K

2 1

RE: new.net: yet another dns namespace overlay play
by brandon＠rd.bbc.co.uk 06 Mar '01

06 Mar '01

> and of course, mac, un*x and linux users would be right out, unless they > plan to serve that market with "patented technology" as well. Don't need to, most companies don't bother and we get by > whatever you may think of ICANN, this concept is still fairly brain > damaged. For a land grab you only need those windows users with a plug in or on ISPs that have bought in to it (could be lots of people), the others without are part of your grab, you get them to hassle their ISP "why can't we get to hot.xxx", some ISPs will add the new root, repeat until owned or laughed off the net. Failure to get critical mass is probably the main reason none of the other alternate roots have grown. There's ICANN frustration, if you deliver what people wanted from ICANN the public may adopt it. brandon

1 0

RE: new.net: yet another dns namespace overlay play
by Richard Welty 06 Mar '01

06 Mar '01

Charles Sprickman [mailto:spork@inch.com] wrote: > On Mon, 5 Mar 2001, Steve Rubin wrote: > > patent-pending technology? oh brother. > Actually, that would be the part of it that lets users get to > these new > domains even if their ISP does not cooperate. Read the release again > carefully. hint: browser plugin. ok, here's the problem: if we take the press release as written (dangerous to do), then the design is inherently flawed, as the browser will be able to see the domains, but a copy of Eudora or a traditional FTP client wouldn't be able to. if we assume the press release is in error, then the "patented technology" might consist of a different name resolver for windows -- but i don't know how hard that substitution is to actually do, not being a windows hacker type. and of course, mac, un*x and linux users would be right out, unless they plan to serve that market with "patented technology" as well. whatever you may think of ICANN, this concept is still fairly brain damaged. richard

1 0