January 2005 - Test - lists.nanog.org

RE: Please Check Filters - BOGON Filtering IP Space 72.14.128.0/19
by James Laszko 21 Jan '05

21 Jan '05

> > Whats so bad about decent secure defaults? > I don't consider a configuration that disenfranchises part of the > internet as "decent [...] defaults." :) The big problem that we're experiencing here is that the big telco ISP's, network providers and managed service providers that should have something better than a 'network monkey' running their routers are having BOGON filtering problems. We diagnosed a problem getting to east cost government sites and in working with SAVVIS, we corrected problems in a matter of hours. This has been the only positive progress we've made in unblackholing out network segment. We're going on day number 4 trying to get SBC to fix 'managed' local government routers. To tell you the truth, the little leaf nodes that have a corporation without world-accessible resources behind their router are unconsequential to us -- let them filter on old BOGON lists -- our customers need to be able to get to the resources that are behind the huge networks that are maintained by companies much larger than ours that are running out of date filters. Why more people don't use resources like what Cymru offer is beyond me... James Laszko Pipeline Communications, Inc. james(a)pcipros.com

3 2

RE: Gtld transfer process
by Bruce Tonkin 21 Jan '05

21 Jan '05

Hello Mark, > That's what happened last weekend: Martin Hannigan and I got > the ball rolling on Sunday morning about 1000 EST. Our 24x7 > customer service department contacted Dotster and Melbourne > IT. Melbourne IT changed the panix.com name servers back to > their original settings and transferred the domain back to Dotster. > I can confirm that Verisign did get in touch with our Production Manager (Peter Berry) around 1pm Sunday (New York time), and our Reseller Program Manager (Steve Karabatsos) around 4:30pm Sunday (New York time). We were contacted previously by Panix around 5pm Saturday (New York time). I believe that Verisign complied with all their obligations with respect to the ICANN transfer policy, and Verisign was very cooperative in assisting us with the issue. Regards, Bruce

2 1

RE: Gtld transfer process
by Bruce Tonkin 20 Jan '05

20 Jan '05

Hello Thor, > > > > (5) The registry will send a message to the losing registrar > > confirming that a transfer has been initiated. > > Can you confirm or deny whether this actually happened in the > case of the panix.com transfer? I don't have any direct visibility over this. I have asked Verisign and Dotster if they can confirm. My personal view is that I think it unlikely that this part of the system failed. Note however that Verisign would send the message via email to Dotster. Verisign could prove that they sent the email, but it is possible that it was not delivered. > > The other problem I see in this area is that the RRP > specification (if that is in fact the protocol that was used) It was. > seems to claim that this message is out-of-band and thus > beyond the scope of the protocol: so it does not (can not) > specify an ACK. If an attacker found a way to prevent this > message from being received, even if generated... > > A strictly enforced technical requirement for an ACK here > might work wonders (perhaps it would have to be enforced by > duping both the confirmation and the ACK to the "System", as > RRP so quaintly calls it, and denying future transfers > initiated by parties with too many outstanding ACKs). Not an > approval, just an ACK. Rather than further work on the RRP protocol, it would be better for Verisign to implement the EPP protocol which has gone through the IETF process. Regards, Bruce

2 1

RE: improving the registrar transfer process
by Bruce Tonkin 20 Jan '05

20 Jan '05

> > > > Accountability. Responsibility. > > I agree with you on this 100%. ICANN needs to enforce there > current policies. I agree too. > Look at totalnic/pacnames. They have been > refusing transfer requests years now until very very recent. > What has ICANN done about all those complaints and violations > that has been well documented? > nothing! > > ICANN needs to stop just accepting money and start enforcing > policies... > Interestingly, the ICANN equivalent in Australia (auDA), does pro-actively enforce policies, and even took Capital Networks to court on the basis that they could be de-accredited as a registrar for .au, if they continued not to allow transfers for .com. See: http://www.austlii.edu.au/au/cases/cth/FCAFC/2004/324.html The original judgment is at: http://www.austlii.edu.au/au/cases/cth/federal_ct/2004/808.html

2 1

Ability to use and monitor LOCK status
by Bruce Tonkin 20 Jan '05

20 Jan '05

> However, that still looks to me like "Users can only ask that > domains be locked." Unless you are claiming that users can > send the lock request directly to the registry, and monitor > its status. Only a registrar can send commands directly the registry. Different registrars offer different services. Most are now offering the ability for customer to put a name on Lock, and remove a name from lock using the normal online maintenance tools. The status of LOCK is published in the Registry WHOIS service, although this display is not in real-time (ie believe it is updated once a day). Registrars have real-time access to the lock status of a name under their management. Regards, Bruce

1 0

Re: Graphing Peering
by andrew matthews 20 Jan '05

20 Jan '05

no i mean graph bgp sessions... it's a single interface, and i want to graph every bgp session so i can see how much traffic i'm doing between each peer. On Wed, 19 Jan 2005 22:25:37 +0000 (GMT), Stephen J. Wilcox <steve(a)telecomplete.co.uk> wrote: > On Wed, 19 Jan 2005, andrew matthews wrote: > > > Anyone have any suggestions on graphing peering on a cisco router? I'm > > using mrtg and i did mac address accounting but the numbers are off. > > do you mean how to graph traffic to each host on a lan..? > > what platform do you have? > > Steve > >

5 5

Re: Please Check Filters - BOGON Filtering IP Space 72.14.128.0/19
by Fergie (Paul Ferguson) 20 Jan '05

20 Jan '05

...and it's not like ARIN, etc., does not announce to the Internet community when it allocates from address space which may have previously been listed in various operational places as "bogon" or "unalloacted" -- they do. I recall seeing similar announcements on the list from time to time, suggesting due diligence on ARIN's behalf to notifying people to modify their filtering. *plonk* Scanning the archives, an example: http://www.merit.edu/mail.archives/nanog/2004-01/msg00374.html - ferg -- Jared Mauch <jared(a)puck.nether.net> wrote: This hurts Ciscos reputation that they are causing pockets of the internet to not work. Next subnets to get allocated will increase the size of those pockets and so on. Then the internet will become less reliable as an end-to-end transport medium, hurting *everyone*. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

3 2

Router-switch-router "peering module"
by Howard C. Berkowitz 20 Jan '05

20 Jan '05

I'm hunting for some presentations or papers on what I've seen called a "peering module", using a router, a L2 switch, and a router in series, rather than a single router. Unfortunately, I can't remember where I saw the detailed description, and I haven't been able to find it in the NANOG archives. IIRC, the rationale was to spread filtering and rate limiting over a set of processors, also to keep the configuations more manageable. Does anyone have any pointers to detail? I've seen the topology, but not a detailed discussion, in a couple of Cisco presentations.

1 0

Graphing Peering
by andrew matthews 20 Jan '05

20 Jan '05

Anyone have any suggestions on graphing peering on a cisco router? I'm using mrtg and i did mac address accounting but the numbers are off. Thank i appreciate it in advance. Andrew

4 3

Regarding registrar LOCK for panix.com
by Bruce Tonkin 20 Jan '05

20 Jan '05

> > On Wed, 19 Jan 2005, Darrell Greenwood wrote: > > customers' domains. Panix.com says its domain name was locked, and > > that despite this, it was still transferred. (r) > > I seem to recall someone saying it wasnt locked, now theyre > saying it was? The information we have so far, indicates that it was not on Registrar LOCK at the registry at the time of the transfer. Regards, Bruce Tonkin

7 6