May 2011 - Test - lists.nanog.org

IRRd Add New Maintainer (irr_rpsl_submit ?)
by Eduardo Meyer 18 May '11

18 May '11

Hello, I have installed IRRd and I am trying to set it up, just for study purposes. I have successfully mirrored some DBs but I cant handle to make my very first maintainer creation. irrd-user.pdf seems to be the only documentation around and it says nothing about "How the admin creates a maintainer" it only says that the password used in irrd.conf is the one. Here's what I am trying: # cat /tmp/step-1 mntner: MAINT-AS65500 descr: Test Inc admin-c: Dudu M tech-c: Dudu M upd-to: eduardo.meyer(a)gmail.com mnt-nfy: eduardo.meyer(a)gmail.com mnt-by: MAINT-AS65500 auth: MAIL-FROM eduardo.meyer(a)gmail.com changed: eduardo.meyer(a)gmail.com 20110518 source: SAMPLEDB And the command: # cat /tmp/step-1 | /usr/local/sbin/irr_rpsl_submit -x -D -v -E "db-admin(a)testing123.net" -c "23AWrNgTooc32" I always get the following error: May 18 04:23:16 [18267] #ERROR: New maintainers must be added by a DB administrator. May 18 04:23:16 [18267] Forwarding new request to db-admin(a)testing123.net Can someone please help me? I know it seems very simple but I have no idea how to do that. Thank you. -- =========== pessoal: dudu.meyer(a)gmail.com profissional: ddm.farmaciap(a)saude.gov.br

1 1

Re: user-relative names - was:[Re: Yahoo and IPv6]
by Scott Weeks 18 May '11

18 May '11

--- joelja(a)bogus.com wrote: From: Joel Jaeggli <joelja(a)bogus.com> > if you put something in the dns you do so because you want to discovered. scoping the nameservers such that they only express certain certain resource records to queriers in a particular scope is fairly straight forward. > -------------------------------------------------------- > > > The article was not about DNS. It was about "Persistent Personal Names for Globally Connected Mobile Devices" where "Users normally create personal names by introducing devices locally, on a common WiFi network for example. Once created, these names remain persistently bound to their targets as devices move. Personal names are intended to supplement and not replace global DNS names." you mean like mac addresses? those have a tendency to follow you around in ipv6... ----------------------------------------- <disclaimer> Still an IPv6 wussie... :-) </disclaimer> Only if you design your network that way. EUI-64 isn't required. scott

4 3

Re: user-relative names - was:[Re: Yahoo and IPv6]
by Scott Weeks 17 May '11

17 May '11

--- scott.brim(a)gmail.com wrote: From: Scott Brim <scott.brim(a)gmail.com> Yes indeed. <http://www.ietf.org/proceedings/79/slides/intarea-3.pdf> --------------------------------------------- Hm, that's a funny correlation to what I have been thinking and talking about lately. I'll have to read the draft-brim-mobility-and-privacy-00 paper as the pdf-bullet-point-syndrome has overtaken my info absorption abilities. I looked at the pdf, but bullet points make me have the deer-in-the-headlights look. ;-) scott

1 0

IPv6 gateway, was: Re: IPv6 foot-dragging
by Jeroen van Aart 17 May '11

17 May '11

Thanks all for the helpful suggestions. It looks like I solved the problem by adjusting my forward chain. I have a the local network on eth0 and the external network on eth1 and my forward chain looked like: -I FORWARD -i eth0 -o eth1 -s 2001:db8::/64 -j ACCEPT -I FORWARD -i eth1 -o eth0 -d 2001:db8::/64 -j ACCEPT Changing it to the following made it work: -I FORWARD -s 2001:470:85cd::/64 -j ACCEPT -I FORWARD -d 2001:470:85cd::/64 -j ACCEPT I am not sure if it'd be less secure to not make it specific to the interfaces. How would I change the first set of rules, using the -i parameter and still make it work? I also have a 6in4 interface for the IPv6 tunnel. -- http://goldmark.org/jeff/stupid-disclaimers/ http://linuxmafia.com/~rick/faq/plural-of-virus.html

4 7

Re: user-relative names - was:[Re: Yahoo and IPv6]
by Scott Weeks 17 May '11

17 May '11

--- Valdis.Kletnieks(a)vt.edu wrote: From: Valdis.Kletnieks(a)vt.edu > Why give the corpment (corporate/government contraction) an easy time at it? > Just like the early days, security and privacy do not seem to be in folk's mind > when things are being designed. But more importantly, who has more/better lobbyists, you or the people who want things like COICA and ACTA? You're going to have to fix *that* problem before trying to address it at the protocol level will do any real, lasting good. Either that or we need a *lot* more TOR relays (while those are still legal). ----------------------------------------------------------- It's a multi-layered problem and designers at all layers need to keep privacy in mind. You can't solve the multi-layered privacy problem with a design at one layer. -------------------------------------------- Oh, and an article that coincidentally popped up since I hit 'send' on the previous mail: http://radar.oreilly.com/2011/05/anonymize-data-limits.html Designing things to evade good data mining is a *lot* harder than it looks. -------------------------------------------- This article doesn't really address what we're discussing. It looks at the 'upper' layer only. I'm just saying that we don't need an ID that follows us everywhere like, I believe, LOC/ID split and "Unmanaged Internet Architecture" (from the "Persistent Personal Names for Globally Connected Mobile Devices" paper) apparently does (I haven't read their paper thoroughly enough to comment in an authoritative manner, though). There has got to be another way. RINA (http://www.cs.bu.edu/fac/matta/Papers/rina-security.pdf) addresses privacy/security, but the nanog show-me-the-code folks were unimpressed with the existing code when I asked the list about it in the past. scott

2 1

Re: Experience with Open Source load balancers?
by jkrejci＠usinternet.com 17 May '11

17 May '11

In response to your query on dnssec in the browser, I use this. https://addons.mozilla.org/en-us/firefox/addon/dnssec-validator/ ------Original Message------ From: Jimmy Hess To: Mark Andrews Cc: Welch, Bryan Cc: nanog(a)nanog.org Subject: Re: Experience with Open Source load balancers? Sent: May 17, 2011 7:07 PM On Tue, May 17, 2011 at 6:23 PM, Mark Andrews <marka(a)isc.org> wrote: [snip] > > Better still would be for them to return AAAA records but until one > is ready to do that the negative responses need to be correct. Hm... better would be for load balancers operate transparently at Layer 3 and not tamper with the contents of answers from proper DNS servers. Eating traffic based on application content, or turning NOERROR, 0 matches into NXDOMAIN is seriously f***'ed up. I look forward to more domains having DS records published by TLDs w/ signed zones... and possibly browsers displaying warnings trying to visit HTTPS domains without a signed zone. perhaps load balancers/middle box manufacturers will start to become a little bit more honest in what they do with DNS traffic :) -- -JH Sent via BlackBerry from T-Mobile

1 0

Re: user-relative names - was:[Re: Yahoo and IPv6]
by Scott Weeks 17 May '11

17 May '11

------- Valdis.Kletnieks(a)vt.edu wrote: --------- From: <Valdis.Kletnieks(a)vt.edu> On Tue, 17 May 2011 15:04:19 PDT, Scott Weeks said: > What about privacy concerns "Privacy is dead. Get used to it." -- Scott McNeely -------------------------------------------------- It doesn't have to be that way. We can design these things any way we want. Why give the corpment (corporate/government contraction) an easy time at it? Just like the early days, security and privacy do not seem to be in folk's mind when things are being designed. scott

2 1

user-relative names - was:[Re: Yahoo and IPv6]
by Scott Weeks 17 May '11

17 May '11

--- dot(a)dotat.at wrote: Or perhaps user-relative names. http://www.brynosaurus.com/pub/net/uia-osdi.pdf -------------------------------------------------- What about privacy concerns; stopping your every move being tracked through the personal name attached to all of your devices? Did I miss something in the paper? scott

4 3

RE: Experience with Open Source load balancers?
by Welch, Bryan 16 May '11

16 May '11

Ø I have had great success with ha proxy http://haproxy.1wt.eu/ -Randy Can you elaborate on your config? On Mon, May 16, 2011 at 7:15 PM, Welch, Bryan <Bryan.Welch(a)arrisi.com<mailto:Bryan.Welch@arrisi.com>> wrote: Greetings all. I've been tasked with comparing the use of open source load balancing software against commercially available off the shelf hardware such as F5, which is what we currently use. We use the load balancers for traditional load balancing, full proxy for http/ssl traffic, ssl termination and certificate management, ssl and http header manipulation, nat, high availability of the physical hardware and stateful failover of the tcp sessions. These units will be placed at the customer prem supporting our applications and services and we'll need to support them accordingly. Now my "knee jerk" reaction to this is that it's a really bad idea. It is the heart and soul of our data center network after all. However, once I started to think about it I realized that I hadn't had any real experience with this solution beyond tinkering with it at home and reading about it in years past. Can anyone offer any operational insight and real world experiences with these solutions? TIA, replies off list are welcomed. Regards, Bryan

1 0

1000BaseT Ethernet keepalives (Ethertype 0x9000)
by Manu Chao 16 May '11

16 May '11

I am curious to understand how copper Ethernet keepalive are used and work between a host or router and a switch? Cisco default keepalive is 10 seconds with 3 or 5 retries, does this mean 30s or 50s to detect copper link failure?? I may miss something, thanks for your help. The link failure detection doesn't occur with optical links because hardware detection (Rx < Rx_min) is much more real time than keepalive timeout expiration. R/ Manu

1 0