- Test - lists.nanog.org

FW: .mil DNSSEC operational message
by Cassell, James D CIV DISA NS233 07 Sep '11

07 Sep '11

The United States Department of Defense (DoD) has authorized the DoD Network Information Center (NIC) to sign the .mil zone using DNSSEC. The DoD NIC will sign the .mil zone using a phased implementation plan that will span a three (3) month period. The first phase will consist of signing the .mil zone with an unvalidatable key, similar to the method used to initially sign several other gTLDs, as well as the root zone. During the second phase, the .mil zone will be signed using a validatable key. However, this key will not be released to IANA for inclusion in the root zone until an operational test and assessment have been completed. Essentially, the .mil domain will remain an island (for DNSSEC purposes) during this phase. The third and final phase will consist of submitting the .mil key to IANA for publication in the Internet root zone to allow Internet-wide validation of .mil DNS responses. Tentative timeline to a signed .mil zone: Sep 14-Sep 18 .mil zone signed with an unvalidatable key Sep 19-Dec 11 .mil zone signed with an unpublished, validatable key Dec 12 .mil zone signed, and its DS record is included in the root zone This rollout is expected to be transparent to the Internet user community, however, if there are issues during this period, please contact the DoD NIC at 1-800-365-3642; +1 614-692-2708. Thank you, DoD NIC Administration

1 0

iCloud - Is it going to hurt access providers?
by Skeeve Stevens 07 Sep '11

07 Sep '11

Hey all, I've been thinking about the impact that iCloud (by Apple) will have on the Internet. My guess is that 99% of consumer internet access is Asymmetrical (DSL, Cable, wireless, etc) and iCloud when launched will 'upload' obscene amounts of gigs of music, tv, backups, email, photos, documents/data and so on to their data centres. Now, don't misunderstand me, I love the concept of iCloud, as I do DropBox, but from an Access Providers perspective, I'm thinking this might be a 'bad thing'. >From what I can see there are some key issues: * Users with plans that count upload and download together. * The speed of Asymmetric tail technology such as DSL * The design of access provider backhaul (from DSLAM to core) metrics * The design of some transit metrics So basically the potential issue is that a large residential provider could have thousands of users connect to iCloud, their connections slowed because of uploading data, burning their included bandwidth caps, slowing down the backhaul segment of the network, and as residential providers are mostly download, some purchase transit from their upstreams in an symmetric fashion. This post is really just to prompt discussion if people think there is anything to actually worry about, or there are other implications that I've not really thought of yet. …Skeeve -- Skeeve Stevens, CEO - eintellego Pty Ltd - The Networking Specialists skeeve(a)eintellego.net<mailto:skeeve@eintellego.net> ; www.eintellego.net Phone: 1300 753 383 ; Fax: (+612) 8572 9954 Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellego or eintellego(a)facebook.com<mailto:eintellego@facebook.com> twitter.com/networkceoau ; www.linkedin.com/in/skeeve PO Box 7726, Baulkham Hills, NSW 1755 Australia -- eintellego - The Experts that the Experts call - Juniper - HP Networking - Cisco - Brocade

23 33

NANOGers home data centers - What's in your closet?
by Charles N Wyble 07 Sep '11

07 Sep '11

Hey all, I'm curious what other NANOGers have in their home compute centers? On the extreme end of course we have mr morris :) with his uber lab: http://smorris.uber-geek.net/lab.htm I've got the following: Production rack (4 post AV rack) >From top down: Current primary internet connection, soon to be out of band internet connection (Wimax from Clearwire) Ubiquity Networks Nanostation2 based AP (MeshPotato via the VillageTelco project) << serving up 3 SSID (bridge to main vlan, guest, honeypot) Linksys WRT54G T-mobile version << not doing anything at the moment 3 dell optiplex 745s PFSense router (WAN to clearwire, LAN to Cisco 3550) AlientVault server (amazing software package) Proxmox server (another great software package) I have also considered turning all 3 machines into Proxmox boxes and run everything in a virtual machine. I like the Dell Optiplex machines, they sip power. APC UPS (considering a rack mount UPS and will probably buy one this weekend from the local Goodwill computer works store) PS3 << gotta get my parallel hacking on Avocent Cyclades PDU (unused currently as my apartment wiring won't support it) Cisco 3550 Distribution Switch Cisco 2950 Access Switch Dell PowerEge 1800 Dell PowerEdge 2800 I've got a network lab rack (skeletek) as well. This hosts a 6509 and other fun things (cisco routers/switches). Pretty sure I can do any CCNA/CCNP/CCIE(R&S) lab scenario). So what's in NANOGers home networks/compute centers? :)

47 84

Re: iCloud - Is it going to hurt access providers?
by Scott Weeks 07 Sep '11

07 Sep '11

--- v.jones(a)networkingunlimited.com wrote: From: Vincent C Jones <v.jones(a)networkingunlimited.com> > --- Bryan(a)bryanfields.net wrote: > From: Bryan Fields <Bryan(a)bryanfields.net> > > I would love a world where engineering was consulted by marketing :( > --------------------------------------------- > > WAKE UP!!!! You're dreaming out loud... >;-) Not necessarily...I've been in computer networking going on 40 years and I've only had one employer where engineering was NOT consulted by marketing, and that was the military, which did not have marketing :-) Of course, my case may be a few sigma away from normal, because I've only had two other employers since then-- Hewlett Packard back when they were still a techie company and myself. As an independent consultant, I am marketing, so I can only blame myself if marketing does not consult engineering :-D ----------------------------------------------- How about (yelling again...) WAKE UP!!!! You're Rumpelstiltskining :-) scott

1 0

Re: iCloud - Is it going to hurt access providers?
by Scott Weeks 07 Sep '11

07 Sep '11

--- Bryan(a)bryanfields.net wrote: From: Bryan Fields <Bryan(a)bryanfields.net> I would love a world where engineering was consulted by marketing :( --------------------------------------------- WAKE UP!!!! You're dreaming out loud... >;-) scott

2 1

RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days
by Frank Bulk 06 Sep '11

06 Sep '11

...and the AAAA's are back! And port 80 responds. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Thursday, September 01, 2011 5:03 PM To: 'nanog(a)nanog.org' Subject: RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days Charter.com has also remove the quad-A's for www.charter.com. My monitoring system alerted me this afternoon that it couldn't get to the v6 version of their website. Because of DNS caching, I don't know how many hours or days ago it was removed. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Friday, August 19, 2011 11:59 AM To: nanog(a)nanog.org Subject: RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days I just noticed that the quad-A records for both those two hosts are now gone. DNS being what it is, I'm not sure when that happened, but our monitoring system couldn't get the AAAA for www.qwest.com about half an hour ago. Hopefully CenturyLink is actively working towards IPv6-enabling their sites again. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Thursday, August 18, 2011 11:14 PM To: nanog(a)nanog.org Subject: RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days FYI, the issue is not resolved and I've not heard from either of the companies suggesting that they're working on it. Note their commitment to IPv6 in these releases: http://www.prnewswire.com/news-releases/centurylink-joins-internet-community -in-world-ipv6-day-123089908.html http://news.centurylink.com/index.php?s=43&item=2129 Frank -----Original Message----- From: Matthew Moyle-Croft [mailto:mmc@internode.com.au] Sent: Thursday, August 18, 2011 7:08 PM To: Owen DeLong Cc: nanog(a)nanog.org Subject: Re: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days On 19/08/2011, at 4:18 AM, Owen DeLong wrote: It'd really suck for end users to start actively avoiding IPv6 connectivity because it keeps breaking and for organisations that have active AAAA records to break peoples connectivity to their resources. +1 -- I'm all for publishing AAAA records as everyone knows, but, if you publish AAAA records for a consumer facing service, please support and monitor that service with a similar level to what you do for your IPv4 versions of the service. The coming years are going to be difficult enough for end-users without adding unnecessary anti-IPv6 sentiments to the mix. Owen +1 to Owen's comment. I'd also add some more comments: A lot of eyeballs that have v6 right now are the people with a lot of clue. Do you want these people, who'll often be buying or recommending your services to rate your ability to deliver as a fail? Our experience with IPv6 consumer broadband has been that the early adopters are the people who, well, goto IETF meetings, follow standards and ask the bloody hard questions. Even given the Happy Eyeballs (Did Hurricane PAY for it to be abbrievated as HE?? :-) ) most end users prefer IPv6 over IPv4. Deeply this means there is a tendency for v6 traffic to grow and be more important to connectivity than you may imagine. The tipping point for IPv6 traffic being dominant I suspect is going to be a lower threshold of take up than people might expect. Consider this when thinking about the level of thought you give to IPv6 infrastructure and PPS rates. MMC

1 0

Handicapped Supporting ISP's -- Was Re: NANOG Digest, Vol 44, Issue 21
by Everett Batey 06 Sep '11

06 Sep '11

If you can offer any lead(s) to service providers who may subsidize / partially subsidize adult handicapped for internet service in LA County CA, please, advise me on or off net. Thank you -- R/ Everett Batey / Skype: wa6cre-10 / efbatey(a)gmail.com or efbarc(a)cotdazr.org or lioneverett(a)gmail.com / CrisisLinks http://bit.ly/cw95Um (805) 616-2471 / G-Talk/Twitter: efbatey On Tue, Sep 6, 2011 at 11:19 AM, <nanog-request(a)nanog.org> wrote: > Send NANOG mailing list submissions to > nanog(a)nanog.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://mailman.nanog.org/mailman/listinfo/nanog > or, via email, send a message with subject or body 'help' to > > End of NANOG Digest, Vol 44, Issue 21 > ************************************* >

2 1

Point to MultiPoint VPN w/qos
by Positively Optimistic 06 Sep '11

06 Sep '11

Greetings We have acquired a new client that has 98 remote endpoints. At each site there is a need for 4 ip telephones and two vpn tunnels back to two separate datacenters. (1 voice, 1 citrix farm). The sites don't talk to each other, just to the two data centers. Does anyone have a suggestion for a single piece of hardware that would support 8 or less Ethernet interfaces and the two vpn tunnels ? Thanks -Optimistic

10 12

Do Not Complicate Routing Security with Voodoo Economics
by Randy Bush 06 Sep '11

06 Sep '11

[ http://archive.psg.com/110904.broadside.html ] Do Not Complicate Routing Security with Voodoo Economics a broadside A recent NANOG presentation and SIGCOMM paper by Gill, Schapira, and Goldberg[1] drew a lot of 'discussion' from the floor. But that discussion missed significant problems with this work. I raise this because of fear that uncritical acceptance of this work will be used as the basis for others' work, or worse, misguided public policy. o The ISP economic and incentive model is overly naive to the point of being misleading, o The security threat model is unrealistic and misguided, and o The simulations are questionable. Basic ISP economics are quite different from those described by the authors. Above the tail links to paying customers, the expenses of inter-provider traffic are often higher than the income, thanks to the telcos' race to the bottom. In this counter-intuitive world, transit can often be cheaper than peering. I.e. history shows that in the rare cases where providers have been inclined to such games, they usually shed traffic not stole it, the opposite of what the paper presumes. The paper also completely ignores the rise of the content providers as described so well in SIGCOMM 2010 by Labovitz et alia[2] It is not clear how to ‘fix’ the economic model, especially as[3] says you can not do so with rigor. Once one starts, e.g. the paper may lack Tier-N peering richness which is believed to be at the edges, we have bought into the game for which there is no clear end. But this is irrelevant, what will motivate deployment of BGP security is not provider traffic-shifting. BGP security is, as its name indicates, about security, preventing data stealing (think banking transactions[4]), keeping miscreants from originating address space of others (think YouTube incident) or as attack/spam sources, etc. The largest obstacle to deployment of BGP security is that the technology being deployed, RPKI-based origin validation and later BGPsec, are based on an X.509 certificate hierarchy, the RPKI. This radically changes the current inter-ISP web of trust model to one having ISPs' routing at the mercy of the Regional Internet Registries (RIRs). Will the benefits of security - no more YouTube incidents, etc. - be perceived as worth having one's routing at the whim of an non-operational administrative monopoly? Perhaps this is the real economic game here, and will cause a change in the relationship between the operators and the RIR cartel. The paper's simulations really should be shown not to rely on the popular but highly problematic3 Gao-Rexford model of inter-provider relationships, that providers prefer customers over peers (in fact, a number of global Tier-1 providers have preferred peers for decades), and that relationships are valley free, which also has significant exceptions. Yet these invalid assumptions may underpin the simulation results. --- Randy Bush <randy(a)psg.com> Dubrovnik, 2011.9.4 [1] P. Gill, M. Schapira, and S. Goldberg, Let the Market Drive Deployment: A Strategy for Transitioning to BGP Security, SIGCOMM 2011, August 2011. http://conferences.sigcomm.org/sigcomm/2011/papers/sigcomm/p14.pdf [2] [1] C. Labovitz, S. Iekel-Johnson, D. McPherson, J. Oberheide, and F. Jahanian, “Internet inter-domain traffic,” in SIGCOMM '10: Proceedings of the ACM SIGCOMM 2010 conference on SIGCOMM, 2010. [3] M. Roughan, W. Willinger, O. Maennel, D. Perouli, and R. Bush, 10 Lessons from 10 Years of Measuring and Modeling the Internet's Autonomous Systems, IEEE Journal on Selected Areas in Communications, Vol. 29, No. 9, pp. 1-12, Oct. 2011. https://archive.psg.com/111000.TenLessons.pdf [4] A. Pilosov, T. Kapela. Stealing The Internet An Internet-Scale Man In The Middle Attack, Defcon 16, August, 2008. http://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-pilosov…

16 29

RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days
by Frank Bulk 06 Sep '11

06 Sep '11

I just noticed that the quad-A records for both those two hosts are now gone. DNS being what it is, I'm not sure when that happened, but our monitoring system couldn't get the AAAA for www.qwest.com about half an hour ago. Hopefully CenturyLink is actively working towards IPv6-enabling their sites again. Frank -----Original Message----- From: Frank Bulk [mailto:frnkblk@iname.com] Sent: Thursday, August 18, 2011 11:14 PM To: nanog(a)nanog.org Subject: RE: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days FYI, the issue is not resolved and I've not heard from either of the companies suggesting that they're working on it. Note their commitment to IPv6 in these releases: http://www.prnewswire.com/news-releases/centurylink-joins-internet-community -in-world-ipv6-day-123089908.html http://news.centurylink.com/index.php?s=43&item=2129 Frank -----Original Message----- From: Matthew Moyle-Croft [mailto:mmc@internode.com.au] Sent: Thursday, August 18, 2011 7:08 PM To: Owen DeLong Cc: nanog(a)nanog.org Subject: Re: IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days On 19/08/2011, at 4:18 AM, Owen DeLong wrote: It'd really suck for end users to start actively avoiding IPv6 connectivity because it keeps breaking and for organisations that have active AAAA records to break peoples connectivity to their resources. +1 -- I'm all for publishing AAAA records as everyone knows, but, if you publish AAAA records for a consumer facing service, please support and monitor that service with a similar level to what you do for your IPv4 versions of the service. The coming years are going to be difficult enough for end-users without adding unnecessary anti-IPv6 sentiments to the mix. Owen +1 to Owen's comment. I'd also add some more comments: A lot of eyeballs that have v6 right now are the people with a lot of clue. Do you want these people, who'll often be buying or recommending your services to rate your ability to deliver as a fail? Our experience with IPv6 consumer broadband has been that the early adopters are the people who, well, goto IETF meetings, follow standards and ask the bloody hard questions. Even given the Happy Eyeballs (Did Hurricane PAY for it to be abbrievated as HE?? :-) ) most end users prefer IPv6 over IPv4. Deeply this means there is a tendency for v6 traffic to grow and be more important to connectivity than you may imagine. The tipping point for IPv6 traffic being dominant I suspect is going to be a lower threshold of take up than people might expect. Consider this when thinking about the level of thought you give to IPv6 infrastructure and PPS rates. MMC

6 8