October 2010 - Test - lists.nanog.org

.com/.net DNSSEC operational message
by Matt Larson 29 Oct '10

29 Oct '10

Over the next several months, VeriSign will deploy DNSSEC in the .net and .com zones. This message contains operational information related to the deployment that might be of interest to the Internet operational community. The .net DNSSEC deployment consists of the following major milestones: September 25, 2010: The .net registry system was upgraded to allow ICANN-accredited registrars to submit DS records for domains under .net. These DS records will not be published in the .net zone until the .net zone is actually signed. Each registrar will implement support for DNSSEC on its own schedule, and some registrars might be accepting DS records for .net domains now. October 29, 2010: A deliberately unvalidatable .net zone will be published. Following the successful use of this technique with the root DNSSEC deployment, VeriSign will publish a signed .net zone with the key material deliberately obscured so that it cannot be used for validation. Any DS records for .net domains that have been submitted by registrars will be published in the deliberately unvalidatable zone. December 9, 2010: The .net key material will be unobscured and the .net zone will be usable for DNSSEC validation. DS records for .net will appear in the root zone shortly thereafter. The .com DNSSEC deployment will occur in the first quarter of 2011 and will consist of the following major milestones: February, 2011: The .com registry system will be upgraded to allow ICANN-accredited registrars to submit DS records for domains under .com. These DS records will not be published in the .com zone until the .com zone is actually signed. March, 2011: A deliberately unvalidatable .com zone will be published. Any DS records for .com that have been submitted by registrars will be published in the deliberately unvalidatable zone. March, 2011: The .com key material will be unobscured and the .com zone will be usable for DNSSEC validation. DS records for .com will appear in the root zone shortly thereafter. If you have any questions or comments, please send email to info(a)verisign-grs.com or reply to this message.

1 0

Re: Interesting IPv6 viral video
by Scott Weeks 28 Oct '10

28 Oct '10

--- zaid(a)zaidali.com wrote: Wait till CNN/FOX etc makes this a big issue and claim the internet is going to come to an end --------------------------------------------- http://www.argee.net/chickenlittleagenda/CLA%2072.jpg scott

3 2

Interesting IPv6 viral video
by Zaid Ali 28 Oct '10

28 Oct '10

Not quite accurate and a bit too dramatic on the panic side but the approach is interesting to put C-Level folks in the hot seat about v6. Would be interesting also to see if folks here get asked by C-Level folks bout IPv6. http://www.youtube.com/watch?v=eYffYT2y-Iw Zaid

9 11

Odd cableone traceroute with 0.0.0.0 in path
by Brielle Bruns 28 Oct '10

28 Oct '10

Okay, so this has my head hurting a bit just trying to figure out just how this is possible and what kind of equipment would pull this stunt. Tracing from here (cableone cable modem) to the outside world, I end up with the following at the beginning of my traceroute. 1 192.168.1.1 (192.168.1.1) 2.759 ms 0.803 ms 0.769 ms 2 0.0.0.0 (0.0.0.0) 10.462 ms 9.543 ms 8.043 ms 3 192.168.32.65 (192.168.32.65) 9.984 ms 9.654 ms 9.570 ms 4 te-4-4.car2.seattle1.level3.net (4.53.146.117) 25.960 ms 21.798 ms 24.144 ms .... etc 0.0.0.0 as one of the hops. So, I pulled out LFT to make sure traceroute isn't going nuts. Layer Four Traceroute (LFT) version 3.1 Using device en1, 192.168.1.101:53 TTL LFT trace to 207.70.17.213:80/tcp 1 192.168.1.1 0.9/0.9ms 2 /9.8/10.3ms 3 192.168.32.65 9.7/8.3ms 4 10.255.255.1 9.1/8.4ms 5 te-4-4.car2.seattle1.level3.net (4.53.146.117) 29.0/20.2ms Fun, no entry for hop 2, plus there's an extra hop at #4. Lets use verbose. Layer Four Traceroute (LFT) version 3.1 ... (verbosity level 2) Using device en1, 192.168.1.101:53 SENT TCP TTL=1 SEQ=648736948 FLAGS=0x2 ( SYN ) SENT TCP TTL=2 SEQ=648736949 FLAGS=0x2 ( SYN ) RCVD ICMP SEQ=648736948 SRC=192.168.1.1 PTTL=1 PSEQ=648736948 SENT TCP TTL=3 SEQ=648736950 FLAGS=0x2 ( SYN ) SENT TCP TTL=4 SEQ=648736951 FLAGS=0x2 ( SYN ) SENT TCP TTL=5 SEQ=648736952 FLAGS=0x2 ( SYN ) SENT TCP TTL=6 SEQ=648736953 FLAGS=0x2 ( SYN ) RCVD ICMP SEQ=648736949 SRC=0.0.0.0 PTTL=2 PSEQ=648736949 SENT TCP TTL=7 SEQ=648736954 FLAGS=0x2 ( SYN ) RCVD ICMP SEQ=648736950 SRC=192.168.32.65 PTTL=3 PSEQ=648736950 RCVD ICMP SEQ=648736951 SRC=10.255.255.1 PTTL=4 PSEQ=648736951 RCVD ICMP SEQ=648736953 SRC=4.68.105.30 PTTL=6 PSEQ=648736953 Am I going nuts, or is something really messed up somewhere upstream from the cable modem? To quote someone from IRC who's just as confused, "the null route just talked to me". -- Brielle Bruns The Summit Open Source Development Group http://www.sosdg.org / http://www.ahbl.org

3 2

DSL (or other similar) Connection in Singapore
by Skeeve Stevens 28 Oct '10

28 Oct '10

Hey all, I have an urgent (today/tomorrow) requirement for how to deliver a normal internet service in Singapore... most likely the downtown area. Has anyone got any contacts or links to pricing - also maybe someone who can install a router configured in Australia. I'm looking for a good download limit includes, or flat rate, with static IP a must. Please reply off-list. PS.. I realise this is NANog, but I assume people on this list may service international offices for their organisations. ...Skeeve -- Skeeve Stevens, CEO eintellego Pty Ltd - The Networking Specialists skeeve(a)eintellego.net / www.eintellego.net Phone: 1300 753 383, Fax: (+612) 8572 9954 Cell +61 (0)414 753 383 / skype://skeeve www.linkedin.com/in/skeeve ; facebook.com/eintellego -- eintellego - The Experts that the Experts call - Juniper - HP Networking - Cisco - Arista - Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.

3 2

Re: NSF.gov Unavailable
by Uri Joskovitch 28 Oct '10

28 Oct '10

Ernie Rubi <ernesto(a)cs.fiu.edu> ðëúá òì éãé: Um, down for everyone reports it as down for everyone. Any news as to what may be causing it? Ernesto M. Rubi Sr. Network Engineer AMPATH/CIARA Florida International Univ, Miami Reply-to: ernesto(a)cs.fiu.edu Cell: 786-282-6783

1 0

NSF.gov Unavailable
by Ernie Rubi 28 Oct '10

28 Oct '10

Um, down for everyone reports it as down for everyone. Any news as to what may be causing it? Ernesto M. Rubi Sr. Network Engineer AMPATH/CIARA Florida International Univ, Miami Reply-to: ernesto(a)cs.fiu.edu Cell: 786-282-6783

5 4

Tools for teaching users online safety
by Alex Thurlow 27 Oct '10

27 Oct '10

I'm trying to find out if there are currently any resources available for teaching people how to be safe online. As in, how to not get a virus, how to pick out phishing emails, how to recognize scams. I'm sure everyone on this list knows these things, but a lot of end users don't. I'm trying to find a way to teach these things to people who aren't too technically savvy. It seems to me that the fewer end users that have issues, the easier our lives will be. So what I'm trying to figure out is, is there a good site or set of sites for this stuff, or is there anyone out there interested in helping to build a unified list of instructions, videos, etc. for all this? -- Alex Thurlow Blastro Networks http://www.blastro.com http://www.roxwel.com http://www.yallwire.com

12 11

NTP Server
by Brandon Kim 26 Oct '10

26 Oct '10

Hey guys: I wanted to open up this question regarding NTP server. I recalled someone had created a posting of this quite awhile back. >From a service provider/ISP standpoint, does anyone think that having a local NTP server is really necessary? I've asked some of my fellow engineers at work and many of them gives me the same response, "Can't we just use free ones out on the internet?" 1) How necessary do you believe in local NTP servers? Do you really need the logs to be perfectly accurate? 2) If you do have a local NTP server, is it only for local internal use, or do you provide this NTP server to your clients as an added service? 3) If you do have a local NTP server, do you have a standby local NTP server or do you use the internet as your standby server? Thoughts? Thanks in advance, and this list is such a valuable wealth of resource.... Brandon

29 43

DDOS attack via as702 87.118.210.122
by Serg Shubenkov 26 Oct '10

26 Oct '10

Hello, list. Please send me off-list abuse contact for as702. -- Serg Shubenkov, MAcomnet, Internet Dept., Head of Inet Department phone: +7 495 7969392/9079, +7 916 5316625, mailto:serg@macomnet.net icq uin: 101964103, Skype: serg.v.shubenkov

9 9