- Test - lists.nanog.org

BGP Looking glass and monitoring
by Bret Palsson 08 Feb '11

08 Feb '11

I'm interested to know what tools everyone uses for the following: Looking Glass server. BGP Monitoring BGP Management, ie. cost/preferred path management. Does anyone use tools to make changes to configurations? For example svn. How do you push changes? Manually, approval process, scripts? Currently the only thing we use is subversion to track changes in configurations. Now that we are up to around 20 routers and growing we are looking for better methods to manage our infrastructure. Thanks guys! -Bret

2 1

And so it ends...
by Scott Howard 08 Feb '11

08 Feb '11

102/8 AfriNIC 2011-02 whois.afrinic.net ALLOCATED 103/8 APNIC 2011-02 whois.apnic.net ALLOCATED 104/8 ARIN 2011-02 whois.arin.net ALLOCATED 179/8 LACNIC 2011-02 whois.lacnic.net ALLOCATED 185/8 RIPE NCC 2011-02 whois.ripe.net ALLOCATED

39 87

Membership model
by Owen DeLong 07 Feb '11

07 Feb '11

I'll happily join Newnog/NANOG and pay my dues when I can reach the web site to do so on IPv6 rather than legacy IPv4. Owen

7 8

Web Server and Firewall Hellp
by Joshua William Klubi 07 Feb '11

07 Feb '11

Hi, I run a web-server based on ubuntu server and the LAMP stack. I used Ubuntu's UFW firewall model and have enabled only Web and SSH ports. Namely port 80 and port 22 only. Unfortunately once a while some guys get to inject some content onto our web pages. Now managements are looking at getting a well proven infrastructure to counter that. But I also think i can fall on this community to help me get the right stuff done. Where i can protect the server from such attack. I want to know what measure i can do on the server to get it protected which mysql protection I should implement. since i can see that it might be a php or mysql injection that is been used. Currently I run these security measures on it. Ubuntu UFW Fail2ban PHP model security Apache security Joshua

4 3

Root Zone DNSSEC KSK Ceremony 4 (UTC correction)
by Joe Abley 07 Feb '11

07 Feb '11

> KSK CEREMONY 4 > > The fourth KSK ceremony for the root zone will take place in El > Segundo, CA, USA on Monday 2011-02-07. The ceremony is scheduled > to begin at 1300 local time (1700 UTC) and is expected to end by > 1900 local time (2300 UTC). Apologies for the time zone miscalculation. El Segundo is in the Pacific time zone, UTC-8. The ceremony is scheduled to begin at 1300 local time (2100 UTC) and is expected to end by 1900 local time (2011-02-08 0300 UTC). Joe

1 0

Root Zone DNSSEC KSK Ceremony 4
by Joe Abley 07 Feb '11

07 Feb '11

KSK CEREMONY 4 The fourth KSK ceremony for the root zone will take place in El Segundo, CA, USA on Monday 2011-02-07. The ceremony is scheduled to begin at 1300 local time (1700 UTC) and is expected to end by 1900 local time (2300 UTC). Video from Ceremony 4 will be recorded for audit purposes. Video and associated audit materials will be published 1 to 2 weeks after the ceremony, and will be available as usual by following the "KSK Ceremony Materials" link at <https://www.iana.org/dnssec/>. ICANN will operate a separate camera whose video will not be retained for audit purposes, but which will instead be streamed live in order to provide remote observers an opportunity to watch the ceremony. The live stream will be provided on a best-effort basis. The live video stream will be available at <http://dns.icann.org/ksk/stream/>. Ceremony 4 will include processing of a Key Signing Request (KSR) generated by VeriSign, and the resulting Signed Key Response (SKR) will contain signatures for Q2 2011, for use in the root zone between 2011-04-01 and 2011-07-05. CONTACT INFORMATION We'd like to hear from you. If you have feedback for us, please send it to rootsign(a)icann.org.

1 0

Re: "Leasing" of space via non-connectivity providers
by Peter Maccauley 07 Feb '11

07 Feb '11

All this talk of ARIN's power and rights versus others is rather despairing. I will now explain what we, a 'non-connectivity' ISP, are providing as useful service. Many of customers value anonymity/pseudonymity. We can provide these things. Sure, there is a great potential for abuse, but we take steps to prevent this, such as careful control over port 25. Our customers can appear on the net from one of several IPv4 addresses in various places, which can be used for testing location-based services. Yes, this could be abused. We can aggregate broadband connections at our router, or provide instant switchover. This is useful for various people and organizations which have to use low-grade broadband (consumer quality, or often consumer quality relabeled 'business' and sold at a higher price). We find a way for people to use their legacy space. A few hobbyist types with their legacy Class Cs are customers. We've managed to get around some censorship blocks. Private http proxies to facebook/youtube and other less-known sites have an IP in some of our space. This is not saying these named organizations are our customers (nor am I saying they are not). We remain quiet at the moment because we do not have the infrastructure in place to handle any more traffic than the people who have found out about us by word-of-mouth. Maintaining a low profile also allows us to escape being added to lists of those censors of one type or another. It has allowed us to avoid spammers, thieves and crackers as customers I hope that many of you will see our use of IP space as a legitimate one. Like many of the rest of you, we provide services which may be valuable to spammers/crackers, but this doesn't mean we're in bed with them. If ARIN/RIPE etc ever decide to edit their databases in a way that interferes with our valuable services, I hope that some of you will raise an alarm in our defense.

1 0

New IPv4 block allocated to RIPE NCC
by Andrea Cima 07 Feb '11

07 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [Apologies for duplicate mails] Dear Colleagues, The RIPE NCC has received the IPv4 address range 185/8 from the IANA. This is the final allocation of IPv4 address space that the RIPE NCC will receive from the IANA as stated in ripe-436, "Global Policy for the Allocation of the Remaining IPv4 Address Space". The minimum allocation size for this /8 has been set at /22. You may wish to adjust any filters you have in place accordingly. More information on the IP address space administered by the RIPE NCC can be found on our website at: https://www.ripe.net/ripe/docs/ripe-ncc-managed-address-space.html Additionally, please note that three "pilot" prefixes will be announced from this /8. The prefixes are: 185.0.0.0/16 185.1.0.0/21 185.1.24.0/24 They all originate in AS12654. The pingable addresses will be: 185.0.0.1 185.1.0.1 185.1.24.1 More information on this activity is available in the document "De-Bogonising New Address Blocks", which can be found at: http://www.ripe.net/ripe/docs/ripe-351.html Kind regards, Andrea Cima Registration Services Manager RIPE NCC -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.11 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAk1Pu9kACgkQXOgsmPkFrjM9FgCgsaT8cFxK0YKTFUFzj41L0PQT N1AAoIgmL1zUY8JjkCSa05xt0t8oppgP =woX5 -----END PGP SIGNATURE-----

1 0

Re: NANOG Digest, Vol 37, Issue 93
by Rudolph Daniel 06 Feb '11

06 Feb '11

Is anyone on this list aware of any IPv6 ready networks in the English speaking caribbean? Rudi Daniel On Sun, Feb 6, 2011 at 2:19 PM, <nanog-request(a)nanog.org> wrote: > Send NANOG mailing list submissions to > nanog(a)nanog.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://mailman.nanog.org/mailman/listinfo/nanog > or, via email, send a message with subject or body 'help' to > nanog-request(a)nanog.org > > You can reach the person managing the list at > nanog-owner(a)nanog.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of NANOG digest..." > > > Today's Topics: > > 1. Re: quietly.... (Owen DeLong) > 2. Re: Top webhosters offering v6 too? (Simon Leinen) > 3. Re: Top webhosters offering v6 too? (Fred Richards) > 4. Re: What's really needed is a routing slot market (Joel Jaeggli) > 5. Re: Top webhosters offering v6 too? (Cameron Byrne) > 6. Re: What's really needed is a routing slot market (John Curran) > 7. Re: quietly.... (Roland Perry) > 8. Re: What's really needed is a routing slot market (Joel Jaeggli) > 9. Re: quietly.... (Roland Perry) > 10. Re: quietly.... (Owen DeLong) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 6 Feb 2011 08:22:55 -0800 > From: Owen DeLong <owen(a)delong.com> > Subject: Re: quietly.... > To: "Lee Howard" <lee(a)asgard.org> > Cc: nanog(a)nanog.org > Message-ID: <BE9E6EDB-4C0B-4313-BA18-D38F8C881970(a)delong.com> > Content-Type: text/plain; charset=us-ascii > > > > > Firewalls merely constrict it. Not that I advocate against the use of > > firewalls; > > in fact, I think I'm agreeing with you, and extending the argument a > little > > further, > > that we should move from NAT to firewalls, then from stateful firewalls > to > > secure hosts and network security appliances. > > > > Lee > > > > > I would be fine with that. However, in terms of the art of the possible > with the tools available today, IPv6 has no need of NAT, but, firewalls > cannot yet be safely removed from the equation. > > Owen > > > > > ------------------------------ > > Message: 2 > Date: Sun, 06 Feb 2011 17:43:04 +0100 > From: Simon Leinen <simon.leinen(a)switch.ch> > Subject: Re: Top webhosters offering v6 too? > To: Tim Chown <tjc(a)ecs.soton.ac.uk> > Cc: NANOG list <nanog(a)nanog.org> > Message-ID: <aatyghjeqv.fsf(a)macsl.switch.ch> > Content-Type: text/plain; charset=us-ascii > > Tim Chown writes: > > Which of the big boys are doing it? > > Google - although there don't call themselves a web hoster, they can be > used for hosting web sites using services such as Sites or App Engine. > Both support IPv6, either using the opt-in mechanism or by using an > alternate CNAME (ghs46 instead of ghs.google.com) That's what I use. > > None of the other large "cloud" providers seems to support IPv6 for > their users yet. In particular, neither Amazon's AWS not Microsoft > Azure have much visible activity in this direction. Rackspace have > announced IPv6 support for the first half of 2011. > > Concerning the more traditional webhosting offerings, I have no idea > about the "big boys". Here in Switzerland, a few smaller hosters > support IPv6. And I saw IPv6 mentioned in ads for some German server > hosting offering. Germany is interesting because it has a > well-developed hosting ecosystem with some really big players. > -- > Simon. > > > > ------------------------------ > > Message: 3 > Date: Sun, 6 Feb 2011 11:49:06 -0500 > From: Fred Richards <fredr(a)geexology.org> > Subject: Re: Top webhosters offering v6 too? > To: NANOG list <nanog(a)nanog.org> > Message-ID: > <AANLkTiksv84+tSm80AjyXg-XZDfX3NGJz1FJM0KQ64Hp(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > I ran across this link a while back, it shows, of the top 100k > websites (according to Alexa), which ones are IPv6 enabled: > > > http://www.atoomnet.net/ipv6_enabled_popular_websites.php?complete_list=true > > > > On Sun, Feb 6, 2011 at 11:43 AM, Simon Leinen <simon.leinen(a)switch.ch> > wrote: > > Tim Chown writes: > >> Which of the big boys are doing it? > > > > Google - although there don't call themselves a web hoster, they can be > > used for hosting web sites using services such as Sites or App Engine. > > Both support IPv6, either using the opt-in mechanism or by using an > > alternate CNAME (ghs46 instead of ghs.google.com) ?That's what I use. > > > > None of the other large "cloud" providers seems to support IPv6 for > > their users yet. ?In particular, neither Amazon's AWS not Microsoft > > Azure have much visible activity in this direction. ?Rackspace have > > announced IPv6 support for the first half of 2011. > > > > Concerning the more traditional webhosting offerings, I have no idea > > about the "big boys". ?Here in Switzerland, a few smaller hosters > > support IPv6. ?And I saw IPv6 mentioned in ads for some German server > > hosting offering. ?Germany is interesting because it has a > > well-developed hosting ecosystem with some really big players. > > -- > > Simon. > > > > > > > > -- > ? ? ? ? ? ? ? ? ? ? ? Fred > > > > ------------------------------ > > Message: 4 > Date: Sun, 06 Feb 2011 09:15:09 -0800 > From: Joel Jaeggli <joelja(a)bogus.com> > Subject: Re: What's really needed is a routing slot market > To: John Curran <jcurran(a)istaff.org> > Cc: NANOG list <nanog(a)nanog.org> > Message-ID: <4D4ED71D.7020104(a)bogus.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On 2/6/11 8:00 AM, John Curran wrote: > > On Feb 5, 2011, at 9:40 PM, Mark Andrews wrote: > > > >> What's really needed is seperate the routing slot market from the > >> address allocation market. > > > > Bingo! In fact, having an efficient market for obtaining routing of a > > given prefix, combined with IPv6 vast identifier space, could actually > > satisfy the primary goals that we hold for a long-term scalable address > > architecture, and enable doing it in a highly distributed, automatable > > fashion: > > So assuming this operates on a pollution model the victims of routing > table bloat are compensated by the routing table pollutors for the use > of the slots which they have to carry. so I take the marginal cost of > the slots that I need subtract the royalities I recieve from the other > participants and if I'm close to the mean number of slots per > participant then it nets out to zero. > > Routing table growth continues but with some illusion of fairness and > the cost of maintaining an elaborate system which no-one needs. > > Yay? > > > > Aggregation would be encouraged, since use of non-aggregatable address > > space would entail addition costs. These costs might be seen as minimal > > for some organizations that desire addressing autonomy, but others might > > decide treating their address space portable and routable results in > > higher cost than is desired. Decisions about changing prefixes with > > ISPs can be made based on a rational tradeoff of costs, rather than in > > a thicket of ISP and registry policies. > > > > Conservation would actually be greatly improved, since address space > > would only be sought after because of the need for additional unique > > identifiers, rather than obtaining an address block of a given size > > to warrant implied routability. In light of IPv6's vast address > > space, it actually would be possible to provide minimally-sized but > > assured unique prefixes automatically via nearly any mechanism (i.e. > > let your local user or trade association be a registry if they want) > > > > With a significantly reduced policy framework, Registration could be > > fully automated, with issuance being as simple as assurance the right > > level of verification of requester identity (You might even get rid > > of this, if you can assure that ISPs obtain clear identity of clients > > before serving them but that would preclude any form of reputation > > systems based on IP address prefix such as we have in use today...) > > > > Just think: the savings in storage costs alone (from the reduction in > > address policy-related email on all our mailing lists) could probably > > fund the system. :-) > > > > Oh well, one project at a time... > > /John > > > > > > > > > ------------------------------ > > Message: 5 > Date: Sun, 6 Feb 2011 09:27:58 -0800 > From: Cameron Byrne <cb.list6(a)gmail.com> > Subject: Re: Top webhosters offering v6 too? > To: fredr(a)geexology.org > Cc: NANOG list <nanog(a)nanog.org> > Message-ID: > <AANLkTikjc1e_YoUt7ntFHtdSneMH44-TBZ-ZJ8VLTNA9(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > I have used both softlayer and arpnetworks. Both have v6 by default, but > only softlayer can be considered a big boy... multiple sites. Cloud and > dedicated servers ... softlayer is a class act with v6 added for free > > > ------------------------------ > > Message: 6 > Date: Sun, 6 Feb 2011 12:32:17 -0500 > From: John Curran <jcurran(a)istaff.org> > Subject: Re: What's really needed is a routing slot market > To: Joel Jaeggli <joelja(a)bogus.com> > Cc: NANOG list <nanog(a)nanog.org> > Message-ID: <83EF5AB0-741E-4FB2-A348-00477482A848(a)istaff.org> > Content-Type: text/plain; charset=us-ascii > > On Feb 6, 2011, at 12:15 PM, Joel Jaeggli wrote: > > > > So assuming this operates on a pollution model the victims of routing > > table bloat are compensated by the routing table pollutors for the use > > of the slots which they have to carry. so I take the marginal cost of > > the slots that I need subtract the royalities I recieve from the other > > participants and if I'm close to the mean number of slots per > > participant then it nets out to zero. > > > > Routing table growth continues but with some illusion of fairness and > > the cost of maintaining an elaborate system which no-one needs. > > One hopes that the costs of consuming routing table slots creates > backpressure to discourage needless use, and that the royalities > receive offset the costs of carrying any additional routing table > slots. > > Note that our present system lacks both consistent backpressure on > consumption of routing table slots and compensation for carrying > additional routes. > > /John > > p.s. While I do believe there would be a net benefit, it also > should be noted that there is no apparent way to transition > to such a model in any case, i.e., it could have been done > that way from the beginning, but a large scale economic > reengineering effort at this point might be impossible. > > > > ------------------------------ > > Message: 7 > Date: Sun, 6 Feb 2011 17:45:46 +0000 > From: Roland Perry <lists(a)internetpolicyagency.com> > Subject: Re: quietly.... > To: nanog(a)nanog.org > Message-ID: <uCKSinaK5tTNFATH(a)perry.co.uk> > Content-Type: text/plain;charset=us-ascii;format=flowed > > In article <85D304BA-6C4E-4B86-9717-2ADB542B8606(a)delong.com>, Owen > DeLong <owen(a)delong.com> writes > > >> Part of the problem is knowing in advance what ISPs will and won't > >>do. It's all very well saying one shouldn't patronise an ISP that > >>blocks port 25, for example, but where is that documented before you buy? > >> > >If they don't document partial internet access blockage in the contract > >and the contract says they are providing internet access, then, they > >are in breach and you are free to depart without a termination fee and > >in most cases, demand a refund for service to date. > > You may be right about enforcing that in the USA (is it an FCC thing?), > but it won't fly in most other places. > > >Admittedly, I'm not over-fussed about email on my phone and I don't use > >a tether device at this point. > > The 3G I'm discussing is a dongle intended for general access. > > >I mostly expect 3G and 4G networks to be broken internet anyway. I was > >more speaking in terms of land-line providers. > > Apparently there are something like three times as many people with > mobile phones in the world, as with Internet access. And a lot of > network expansion is expected to be based on mobile connectivity as a > result. > -- > Roland Perry > > > > ------------------------------ > > Message: 8 > Date: Sun, 06 Feb 2011 09:49:12 -0800 > From: Joel Jaeggli <joelja(a)bogus.com> > Subject: Re: What's really needed is a routing slot market > To: John Curran <jcurran(a)istaff.org> > Cc: NANOG list <nanog(a)nanog.org> > Message-ID: <4D4EDF18.3000207(a)bogus.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On 2/6/11 9:32 AM, John Curran wrote: > > One hopes that the costs of consuming routing table slots creates > > backpressure to discourage needless use, and that the royalities > > receive offset the costs of carrying any additional routing table > > slots. > > > > Note that our present system lacks both consistent backpressure on > > consumption of routing table slots and compensation for carrying > > additional routes. > > The costs of carrying routes is unevenly distributed. when I have to > carry 2 million routes in my fib on few hundred 120Gb/s line cards it's > a bit different than someone with a software router who just has to make > sure they have 4GB of ram... > > That has very attractive properties along some dimensions. e.g. the cost > at the margin of connecting a new participant to the internet is rather > low. > > > > > ------------------------------ > > Message: 9 > Date: Sun, 6 Feb 2011 17:49:28 +0000 > From: Roland Perry <lists(a)internetpolicyagency.com> > Subject: Re: quietly.... > To: nanog(a)nanog.org > Message-ID: <5iyXqtbo8tTNFAyd(a)perry.co.uk> > Content-Type: text/plain;charset=us-ascii;format=flowed > > In article <20110205131510.BE13E9B5167(a)drugs.dv.isc.org>, Mark Andrews > <marka(a)isc.org> writes > >> And when my vendor is Sipura, or Sony[1], how does an individual small > >> enterprise attract their attention and get the features added? > > > >You return the equipment as not suitable for the advertised purpose > >and demand your money back. Renumbering is expected to occur with > >IPv6, part of renumbering is getting the name to address mappings > >right. With DHCP the DHCP server normally does it. With SLAAC the > >host has to do it as there is no other choice. > > > >Here in Australia it is Repair/Replace/Refund if the product purchased > >is faulty. That applies to all products. If the milk is off when > >we get home we go back and get it replaced and if the store is out > >of stock we get a refund. I've returned and had replaced plenty > >of stuff over the years. > > I think you are just confirming my view that moving from IPv4 to IPv6 > will involve more than the ISP doing some magic that's transparent to > the majority of users. And good luck returning a 3 year old PS/3 for a > refund on the basis it doesn't support IPv6. > -- > Roland Perry > > > > ------------------------------ > > Message: 10 > Date: Sun, 6 Feb 2011 10:17:00 -0800 > From: Owen DeLong <owen(a)delong.com> > Subject: Re: quietly.... > To: Roland Perry <lists(a)internetpolicyagency.com> > Cc: nanog(a)nanog.org > Message-ID: <BC37A5F0-78DE-4881-B649-0D42610BE7BF(a)delong.com> > Content-Type: text/plain; charset=us-ascii > > > On Feb 6, 2011, at 9:49 AM, Roland Perry wrote: > > > In article <20110205131510.BE13E9B5167(a)drugs.dv.isc.org>, Mark Andrews < > marka(a)isc.org> writes > >>> And when my vendor is Sipura, or Sony[1], how does an individual small > >>> enterprise attract their attention and get the features added? > >> > >> You return the equipment as not suitable for the advertised purpose > >> and demand your money back. Renumbering is expected to occur with > >> IPv6, part of renumbering is getting the name to address mappings > >> right. With DHCP the DHCP server normally does it. With SLAAC the > >> host has to do it as there is no other choice. > >> > >> Here in Australia it is Repair/Replace/Refund if the product purchased > >> is faulty. That applies to all products. If the milk is off when > >> we get home we go back and get it replaced and if the store is out > >> of stock we get a refund. I've returned and had replaced plenty > >> of stuff over the years. > > > > I think you are just confirming my view that moving from IPv4 to IPv6 > will involve more than the ISP doing some magic that's transparent to the > majority of users. And good luck returning a 3 year old PS/3 for a refund on > the basis it doesn't support IPv6. > > -- > > Roland Perry > > I'm pretty sure the PS3 will get resolved through a software update. > > Yes, there will be user-visible disruptions in this transition. > > No, it can't be 100% magic on the part of the service provider. > > It still has to happen. There is no viable alternative. > > Owen > > > > > ------------------------------ > > _______________________________________________ > NANOG mailing list > NANOG(a)nanog.org > https://mailman.nanog.org/mailman/listinfo/nanog > > End of NANOG Digest, Vol 37, Issue 93 > ************************************* > -- Rudi Daniel *danielcharles consulting<http://www.facebook.com/pages/Kingstown-Saint-Vincent-and-the-Grenadines/Da…> **1-784 498 8277<http://www.facebook.com/pages/Kingstown-Saint-Vincent-and-the-Grenadines/Da…> * * *

1 0

802.11g with WPA-PSK
by Atticus 06 Feb '11

06 Feb '11

Im not familiar with wpa_supplicant, but you can preface external commands to execute in ifconfig.* with ! On Feb 6, 2011 1:08 PM, "Andrew Ball" <aball(a)students.prairiestate.edu> wrote: Hello, I have a NetBSD host that I would like to connect to an existing wireless LAN using a rum(4) interface (Belkin F5D7050B USB 802.11g adaptor). I have tried configuring wpa_supplicant via rc.conf but it does not seem to start and I don't know why. Is there some other way to launch wpa_supplicant, perhaps via ifconfig.rum0? - Andy Ball

2 1