July 2005 - Test - lists.nanog.org

Anyone from GLBX noc monitoring?
by Drew Weaver 18 Jul '05

18 Jul '05

Thanks, -Drew

1 0

RE: IPv6 push doesn't have much pull in U.S
by Kuhtz, Christian 18 Jul '05

18 Jul '05

:) True, but, there's actually another angle to consider. If there is pressure to adopt IPv6 rapidly in a given region, and that given region also happens to drive broadband technology evolution, and North America ends up being dependent on cheap equipment primarily driven by overseas standards.. It is conceivable that North America will have a substantial economic argument for adopting IPv6 on the trailing edge, maybe just past the leading edge if you have additional factors playing into the decision. Or one may just be oblivious to the emergence of IPv6 like it has been to up to this point, and sustain that without any harm whatsoever. The key questions are When will who you want to talk to speak IPv6? When will we have a need (and be willing to pay for) addressing every device individually and directly without intermediary? When will we have a need (and be willing to pay for) pervasive crypto & "identity"? Each person/carrier/user/whatever will answer these differently, and it has a lot to do with how you work, who you do business with, and what economic pressures may apply, and whether or not you can cope with an intermediary or non-native setup. There is no globally correct answer. Or that's at least my view. Flame away. Thanks, Christian > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Iljitsch van Beijnum > Sent: Saturday, July 16, 2005 5:33 AM > To: Fergie (Paul Ferguson) > Cc: nanog(a)merit.edu > Subject: Re: IPv6 push doesn't have much pull in U.S > > > > On 16-jul-2005, at 1:57, Fergie (Paul Ferguson) wrote: > > > Someone's been listening: > > Listening to what, exactly? Still nonsense about address space > distribution. > > And I'm sure Sprint and Verio (MCI/Worldcom/UUNET too? I have a > tunnel from them in the Netherlands, not sure what they do in > the US) > are happy to hear that they're not "major U.S. service provider[s]" > since none of those offers IPv6, right? > > Also, I mostly disagree with their conclusion: > > Currently only a handful of U.S. technologists need to worry about > IPv6--those that work in the federal government, carriers, > researchers and networking vendors. If you're not in one of those > categories, the IPv6 bug won't reach you for years to come. > > Software vendors need to look at IPv6. The OS and router > vendors have > their stuff in place. The networks will follow when the time is > right, but none of it means anything if applications can't work over > IPv6. > > I'm not saying everyone has to love IPv6, but please get those pesky > facts straight... > ***** The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. 162

2 1

Re: Non-English Domain Names Likely Delayed
by Fergie (Paul Ferguson) 18 Jul '05

18 Jul '05

Forwarded Message from Neil Harris <neil(a)tonal.clara.co.uk> --- Fergie (Paul Ferguson) wrote: >...sez Vint...due to the prevalence of phishing: > >http://www.msnbc.msn.com/id/8586332/ > >- ferg > > Paul, I'm not registered as a poster on the Nanog list, so I thought I'd let you know that this problem is already well under control. After extensive analysis and discussion, the Mozilla community and Opera have already produced a fix for this, based on only displaying Unicode IDN labels where the registry publishes and enforces well-defined anti-homograph policies, and displaying the Punycode equivalent otherwise. All that is needed is a couple of lines of code in the Punycode -> Unicode translation code in the application, and a whitelist of TLDs. See http://www.mozilla.org/projects/security/tld-idn-policy-list.html for more details. This delegates the responsibility of catching homographs to the registries, rather than trying to catch them using ad-hoc heuristics at the browser end. In many cases, this can be as simple as restricting labels within a TLD to use a small set of non-confusable characters. In others, with wider character sets, techniques such as bundling and blocking sets of confusable labels using homograph tables can be used. RFC 3743 is a case in point. For an excellent summary of the technical details, which is intended to help anyone attempting to eliminate homographs from a naming system, see the latest, much-expanded, version of Unicode TR #36, which also links to machine-readable confusables tables. http://www.unicode.org/reports/tr36/ Already, some 21 TLDs are whitelisted, including .cn, .tw, a number of European ccTLDs, .museum, and .info. Any other registrars who want to be supported can simply E-mail Gerv at the Mozilla Foundation, or his Opera counterpart, and give them a pointer to their anti-spoofing rules. You might want to summarize to the list. -- Neil

6 8

WSJ: Information Security Where the Dangers Are
by Sean Donelan 18 Jul '05

18 Jul '05

Both Steve Bellovin and Craig Labovitz show up in today's technology section of the Wall Street Journal. Information Security Where the Dangers Are By DAVID BANK and RIVA RICHMOND Staff Reporters of THE WALL STREET JOURNAL July 18, 2005; Page R1 In the world of cybercrime, the bad guys are getting smarter -- and more ambitious. In recent months, hackers have carried out a flurry of increasingly sophisticated attacks, highlighting the vulnerability of key computer networks around the world.

1 0

Phoenix
by Louisa.Coughlan＠cox.com 17 Jul '05

17 Jul '05

Is there any interest in peering in Phoenix?

3 2

RE: ICANN warns world of domain hijacking
by Bruce Tonkin 17 Jul '05

17 Jul '05

> > Is ICANN actually going to come up with a set of guidelines > ..... ? Yes - the report has some guidelines. The plan is to make these guidelines easily available to suppliers that provide domain name services. Making them enforceable will take longer, and will be done if the guidelines are not successful in getting change. Regards, Bruce

2 1

ICANN, VeriSign Will Consider Changes on .net Agreement
by Fergie (Paul Ferguson) 17 Jul '05

17 Jul '05

Via Netcraft: [snip] ICANN and VeriSign will consider changes to the new .net registry agreement in response to a mass protest by major domain name registrars, who said the deal represented a "breach of trust" between ICANN and the registrar community. In response to a joint protest by more than 30 registrars at a Luxembourg meeting, ICANN chairman Vint Cerf announced today that VeriSign and ICANN will re-examine a provision in the agreement that lifts restrictions on the price VeriSign can charge registrars for each .net domain they sell. [snip] http://news.netcraft.com/archives/2005/07/14/icann_verisign_will_consider_c… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

Not exactly a policy issue, more of a technical issue.
by Drew Weaver 17 Jul '05

17 Jul '05

I'm having a problem with a catalyst 6500 series switch, wherein certain users connected to said switch report that high numbered UDP ports 27015, etc are unreachable even though there are no access-lists anywhere in my network preventing these ports from being available. I recently took the advice of many on this list and got the cat, we're switching from the Extremes over to the Cisco models slowly, and I'm sure this could possibly be something I'm doing wrong, but I'm not too certain as to what could cause it to "firewall" certain UDP ports unless there is some sort of advanced security setting I accidentally enabled when I was reading through cymru's template (although the only things I adopted were NTP, logging and a few other things like MAC address security [ thanks by the way for the great document]). None of the nmap port scans show the high number ports listening. By the way, if I take that same server and connect it to one of the Black Diamond's that is connected to the same upstream router (the switches are all hanging off of a 12000.) The port seems to be available, so the problem seems localized to just that 6500. Sorry if this is off-topic, but I wasn't entirely sure if it was or not. Thanks, -Drew

2 1

Non-English Domain Names Likely Delayed
by Fergie (Paul Ferguson) 16 Jul '05

16 Jul '05

...sez Vint...due to the prevalence of phishing: http://www.msnbc.msn.com/id/8586332/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: IPv6 push doesn't have much pull in U.S
by Fergie (Paul Ferguson) 15 Jul '05

15 Jul '05

Perhaps, but it is at least accurate as to the ignorance. I just said "someone's been listening". Now multiply that by X... - ferg -- Daniel Roesen <dr(a)cluenet.de> wrote: > Someone's been listening: > > http://www.eetimes.com/showArticle.jhtml?articleID=165702734 The only interesting bit in this article is the complete ignorance regarding Europe. Regards, Daniel -- CLUE-RIPE -- Jabber: dr(a)cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0 -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0