February 2011 - Test - lists.nanog.org

A top-down RPKI model a threat to human freedom? (was Re: Level 3's IRR Database)
by Martin Millnert 01 Feb '11

01 Feb '11

Here be dragons, On Sun, Jan 30, 2011 at 12:39 PM, Carlos Martinez-Cagnazzo <carlosm3011(a)gmail.com> wrote: > The solution to this problem (theoretical at least) already exist in > the form of RPKI. Any top-down RPKI model is intrinsically flawed. Deploying an overlay of single-point(s) of failure on top of a well-functional distributed system such as the Internet does not seem like a solution to much. The Internet works reasonably well only because it is reasonably distributed. I acknowledge that: 1) there are occasionally routing problems, 2) that IPv4 will deteriorate further very rapidly as it runs out and second-hand markets pick up, 3) that spammers run BGP and abuse, seemingly primarily, the non-RIR IRR-dbs. The answer to these issues is not by default RPKI IMO. For example, how about: 1, fix them - are there any problems that hasn't been fixed or were seriously hard to fix? Enumerate and let's go specific; let's not deploy a tank to push in a screw. 2, IPv6? 3, improve/remove non-RIR IRR-dbs It should be fairly obvious, by most recently what's going on in Egypt, why allowing a government to control the Internet is a Really Bad Idea. While it is true that governments are more or less in control of the *geographic area* they govern, as is evident in Egypt, there is a serious and big difference between the ease of removing a prefix from the Internet today in a country and how easy it will be in the fully network-deployed RPKI case, because of the hierarchical model (send your tanks to the RIR office(s) instead of every single country). Yes, governments exploit capabilities given to them by technological means ("we do it just because we can" is a standing motto). A top-down RPKI model would be a severely negative development of the resilience of the Internet, especially for freedom-aspiring people (approximately equal to humankind?), who need to avert government suppression. If we are to go down this path, at the very least it must stay architecturally/technologically *impossible* for a entity from country A to via-the-hierarchical-trust-model block a prefix assigned to some entity in country B, that is assigned by B's RIR and in full accordance with the RIR policies and in no breach of any contract. If not, we're doing humanity a disservice. One that I have no doubt would simply spawn/grow further overlay-networks to counter the problem. Cheers, Martin > > On Sun, Jan 30, 2011 at 6:23 AM, Andrew Alston <aa(a)tenet.ac.za> wrote: >> Hi All, >> >> I've just noticed that Level 3 is allowing people to register space in its IRR database that A.) is not assigned to the people registering it and B.) is not assigned via/to Level 3. >> >> So, I have two queries >> >> A.) Are only customers of Level 3 allowed to use this database >> B.) Can someone from Level 3 please clarify if there are any plans to lock this down slightly >> >> At this point, it would seem that if you are a customer of level 3's, you can register any space you feel like in there, and announce anything you feel like once the filters propagate, which in my opinion completely nullifies the point of IRR in the first place. >> >> Though I think this also raises the question about IRR databases in general. Would it not be far more sane to have each RIR run a single instance each which talk to each other, which can be verified against IP address assignments, and scrap the distributed IRR systems that allow for issues like this to occur? >> >> (In the mean time I've emailed the relevant people to try and get the entries falsely registered in that database removed, and will wait and see if I get a response). >> >> >> Andrew Alston >> TENET - Chief Technology Officer >> Phone: +27 21 763 7181 >> >> > > > > -- > -- > ========================= > Carlos M. Martinez-Cagnazzo > http://www.labs.lacnic.net > ========================= > >

12 30

Re: ipv4's last graph
by Scott Weeks 01 Feb '11

01 Feb '11

--- townsley(a)cisco.com wrote: From: Mark Townsley <townsley(a)cisco.com> On Feb 1, 2011, at 9:11 PM, Geoff Huston wrote: > On 01/02/2011, at 7:02 PM, Randy Bush wrote: >> graphs any more. might we have one last one for the turnstiles? :-)/2 >> >> and would you mind doing the curves now for each of the five rirs? >> gotta give us all something to repeat endlessly on lists and in presos. > > but of course. > > http://www.potaroo.net/tools/ipv4/rir.jpg I can almost hear the cutting and pasting going on across the globe with this. ------------------------------------------------------- Yes... :-) I did my share of cut-n-paste over here in an effort to pull folks' head out of their...uhhh...the sand. scott

1 0

Re: A top-down RPKI model a threat to human freedom? (was Re: Level 3's IRR Database)
by Brandon Butterworth 01 Feb '11

01 Feb '11

So a possible road to ruin I was thinking of when I mentioned my unease is, to state the obvious, - Some large ISPs do RPKI as it's secure and their government contract says they have to be secure, keep the terrists out, so all directly attached ISP have to do it too kicking off a domino Other large customers will see the government lead and choose the same to meet the corporate governance rules so smaller ISP they use start to fall in line. It'll escalate like the MD5 frenzy, goes global and at some point hits critical mass where some ISP decide the unsigned routes are a risk and they can afford to drop them, like some do with deaggregates now. You get to the state of either you sign or your upstream signs (like L3 IRR proxy entries just a bit harder) or you don't exist. Some other event, like with UK anti CP filters, will happen where it becomes a legal requirement to let someone fiddle and make a kill switch to be used in certain circumstances. Later it gets used in unintended circumstances Our trade of control for security has given us neither. Of course more likely the key renewal will get spam filtered and I'll not notice until we fall off the net, or we forget to pay the RIR invoice on time and get cut off, causing a long outage that I can't fix as quickly as rolling back a router config change. I also wonder about emergency use, post a katrina have we made something that's too hard to bootstrap quickly. Drive slow. brandon

1 0

2011.02.01 NANOG51 day 2 afternoon session notes
by Matthew Petach 01 Feb '11

01 Feb '11

I've posted the afternoon notes from today's session at http://kestrel3.netflight.com/2011.02.01-NANOG51-afternoon-notes.txt Definitely not as happy with the flash video stream as I was with the hi-def VLC video stream that was provided at NANOG49. :( Lots of player problems and audio stuttering/loss on the flash stream for me. Any chance of the hi-def VLC stream coming back for future NANOGs, or was the bandwidth requirement too high to be feasible? Thanks! Matt

1 0

Re: Using IPv6 with prefixes shorter than a /64 on a LAN
by Tim Franklin 01 Feb '11

01 Feb '11

> I think ULA is still useful for home networks. If the home router guys > properly generate the ULA dynamically, it should stop conflicts within > home networking. There's something to be said for internal services > which ULA can be useful for, even when you do fall off the net. I really, *really* expect my CPE router *not* to remove global addresses from the LAN interface(s) when the link to the Internet goes down. My internal services should go on working with their global addresses. This is how my tunneled IPv6 works today. Am I being an unreasonable engineer in this respect? Regards, Tim.

3 2

Akamai - Timouts (TCP Stalls) at the SIX
by Wade Peacock 01 Feb '11

01 Feb '11

We've been experiencing issue with content coming from Akamai servers located in Seattle since Thursday January 27, 2011. Our upstream peers directly with Akamai as the SIX (Seattle Internet Exchange). We've been seeing timeouts/partial loads for sites with content delivered from IP block 96.17.8.0/24. Known impacted site for our customers: www.cbc.ca www.ebay.ca www.westjet.ca(redirect to www.westjet.com) We've opened tickets with our upstream and Akamai, but we are curious if others are experiencing the same issues. Wade Peacock Network Administrator Sun Country Cablevision Ltd Sunwave Internet Department Tel: (250) 832-9711 or (250) 546-9667 Dir: (250) 832-5123 x 220 Web: http://www.sunwave.net Email: wade.peacock(a)sunwave.net Support Email: support(a)sunwave.net

2 1

2011.02.01 NANOG51 day2 morning session notes posted
by Matthew Petach 01 Feb '11

01 Feb '11

(sorry about the delay, had to hop on a vendor call right as lunch break started) Morning session notes have been posted to http://kestrel3.netflight.com/2011.02.01-NANOG51-morning-notes.txt for those following along remotely. Very nice handoff and signing ceremony this morning by Steve Feldman and Don Welch--congratulations, newNOG, new owners of the NANOG name! Matt

1 0

OT: Anyone have PDF Manual for Nortel/BayStack 425-24T Switch
by kmedcalf＠dessus.com 01 Feb '11

01 Feb '11

Does anyone happen to have PDF Manuals (not the sales literature, but the switch software command references) for this switch? We have one in a production network and know nothing about it nor how to manage it. Nortel does not make any of the manuals available anymore, at least not in the interwebs (that I can find) nor does googling turn up anything very useful. Any help would be appreciated. If nothing can be found this will probably be discarded and replaced with appropriately supported product. Now, back to your regularly scheduled programming ... ---- #include <shrinkwrap-disclaimer.h>

2 2

2010 Worldwide Infrastructure Security Report available for download.
by Roland Dobbins 01 Feb '11

01 Feb '11

[Apologies for any duplication if you've seen this notification on other lists.] We've just posted the 2010 Worldwide Infrastructure Security Report for download at this URL: <http://www.arbornetworks.com/report> This year's WWISR contains responses and data from the broadest cross-section of SPs to date, including mobile operators and IDC operators in all major geographical regions. The WWISR is based upon input from the global operational community, and as such, is unique in its focus on the operational security aspects of public-facing networks. Many of you contributed to the survey which forms the foundation of the report; as always, we're grateful for your insight and participation, and welcome your feedback and comments. Thanks much! ------------------------------------------------------------------------ Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks.com>

1 0

good night v4
by Scott Weeks 01 Feb '11

01 Feb '11

I know there're a gazillion counters out there, but one many have watched for a long time is potaroo's (http://www.potaroo.net/tools/ipv4) I was having fun watching it run out tonight. Here's a snapshot with only 1090 routes left: http://mauigateway.com/~surfer/goodnight-v4.png It turns out to be a timer counting down to midnight on the selected day, so everyone saw it goto zero at different times. However, since Hawaii is the last major population in "the world's day" (last one before the International date line) and the counter here hit zero does that mean I will wake up tomorrow to a shiny new internet? scott apologies, it's late and I just couldn't help it... >:-) -- evil grin

2 1