- Test - lists.nanog.org

Re: [arin-announce] ARIN Resource Certification Update
by Osterweil, Eric 28 Jan '11

28 Jan '11

Sorry to be Johnny-come-lately to this... On 1/24/11 6:31 PM, "Randy Bush" <randy(a)psg.com> wrote: >> Right, I've heard the circular dependency arguments. So, are you >> suggesting the RPKI isn't going to rely on DNS at all? > > correct. it need not. Maybe I am misunderstand something here... Are (for example) the rsync processes going to use hard coded IPs? Are the SIAs and AIAs referenced by IP? > >> I'm of the belief RPKI should NOT be on the critical path, but instead >> focus on Internet number resource certification - are you suggesting >> otherwise? > > <channeling steve kent> > see the word 'certification'? guess where that leads. pki. add > resources and stir. Sounds like a loose definition of pki. Does DNSSEC count as such a loosely defined pki? :-P > >>> if the latter, then you have the problem that the dns trust model is >>> not congruent with the routing and address trust model. >> That could be easily fixed with trivial tweaks and transitive trust/ >> delegation graphs that are, I suspect. > > not bloody likely. the folk who sign dns zones are not even in the same > building as the folk who deal with address space. in large isps, not > even in the same town. Why does this stop the whole thing short? I think the people who run any as-yet-to-be-developed-and-deployed system don't sit in any building at all... Yet, right? :) Tbqh, I think I might be missing something important (so, please forgive my ignorance), but I don't see how (for example) admins of the SMTP infrastructure have trouble getting their MX records right in DNS zones... How are getting certs in there so much worse? Eric

1 0

RE: Clearwire/Clear for branch office connectivity?
by Jason Roysdon - NANOG 28 Jan '11

28 Jan '11

As a Clear customer, some things that I would inform you of: Using RFC1918 in their backbone: Traceroute from my internal network out: $ traceroute 8.8.8.8 traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 40 byte packets 1 10.12.250.49 (10.12.250.49) 1.671 ms 1.467 ms 3.214 ms - my network 2 10.12.249.1 (10.12.249.1) 15.594 ms 15.530 ms 17.015 ms - my network 3 192.168.15.1 (192.168.15.1) 17.957 ms 17.882 ms 18.978 ms - Clear CPE router device 4 * * * 5 10.41.229.197 (10.41.229.197) 82.081 ms 83.805 ms 52.455 ms 6 (71.22.8.161) 72.237 ms 72.105 ms 73.546 ms 7 (71.22.8.253) 75.988 ms 75.915 ms 76.095 ms 8 xe-10-3-0.bar1.SanFrancisco1.Level3.net (4.53.132.13) 73.130 ms 75.894 ms 75.801 ms 9 ae-0-11.bar2.SanFrancisco1.Level3.net (4.69.140.146) 79.860 ms 79.785 ms 76.723 ms 10 ae-6-6.ebr2.SanJose1.Level3.net (4.69.140.154) 79.558 ms 86.145 ms 86.056 ms 11 ae-92-92.csw4.SanJose1.Level3.net (4.69.134.222) 88.848 ms ae-72-72.csw2.SanJose1.Level3.net (4.69.134.214) 79.919 ms ae-92-92.csw4.SanJose1.Level3.net (4.69.134.222) 87.548 ms 12 ae-2-79.edge2.SanJose1.Level3.net (4.68.18.79) 77.322 ms ae-1-69.edge2.SanJose1.Level3.net (4.68.18.15) 78.785 ms ae-4-99.edge2.SanJose1.Level3.net (4.68.18.207) 77.568 ms 13 YOU-TUBE-IN.edge2.SanJose1.Level3.net (4.79.40.178) 80.985 ms 79.992 ms 81.634 ms 14 72.14.232.138 (72.14.232.138) 77.333 ms 72.14.232.136 (72.14.232.136) 81.425 ms 72.14.232.138 (72.14.232.138) 81.579 ms 15 216.239.47.186 (216.239.47.186) 102.799 ms 216.239.49.198 (216.239.49.198) 98.672 ms 107.898 ms 16 216.239.43.228 (216.239.43.228) 99.203 ms 99.134 ms 101.426 ms 17 216.239.48.165 (216.239.48.165) 101.391 ms 216.239.48.137 (216.239.48.137) 101.234 ms 216.239.48.165 (216.239.48.165) 110.738 ms 18 209.85.254.150 (209.85.254.150) 103.835 ms 104.921 ms 209.85.254.146 (209.85.254.146) 110.847 ms 19 google-public-dns-a.google.com (8.8.8.8) 90.106 ms 97.549 ms 93.919 ms Hops 1-3 are mine. Hops 4-7 is Clear's backbone. Clear doesn't use PTR records all the time, see hops 6 & 7. Traceroute back to my Clear IP on my CPE router device: $ traceroute (address removed) traceroute to (address removed), 30 hops max, 60 byte packets 1 removed 1.812 ms 2.173 ms 2.087 ms 2 public IP, removed 2.731 ms 2.635 ms 2.591 ms 3 public IP, removed 2.549 ms 2.520 ms 2.467 ms 4 0.ge-2-0-1.xt1.sac1.alter.net (152.63.51.81) 5.194 ms 5.170 ms 5.384 ms 5 0.so-5-2-0.xl3.sjc7.alter.net (152.63.48.6) 50.991 ms 49.159 ms 49.088 ms 6 0.ae3.br1.sjc7.alter.net (152.63.51.38) 9.644 ms 0.ae3.br3.sjc7.alter.net (152.63.50.5) 9.394 ms 9.352 ms 7 xe-9-2-0.edge1.sanjose3.level3.net (4.68.62.109) 10.201 ms 10.146 ms 10.107 ms 8 vlan69.csw1.sanjose1.level3.net (4.68.18.62) 18.609 ms vlan99.csw4.SanJose1.Level3.net (4.68.18.254) 13.095 ms vlan89.csw3.SanJose1.Level3.net (4.68.18.190) 12.120 ms 9 ae-82-82.ebr2.sanjose1.level3.net (4.69.134.217) 10.507 ms ae-62-62.ebr2.sanjose1.level3.net (4.69.134.209) 9.397 ms 9.344 ms 10 ae-1-6.bar2.sanfrancisco1.level3.net (4.69.140.153) 10.429 ms 9.605 ms 9.767 ms 11 ae-0-11.bar1.sanfrancisco1.level3.net (4.69.140.145) 9.741 ms 10.291 ms 10.172 ms 12 clearwire-c.bar1.sanfrancisco1.level3.net (4.53.132.14) 11.604 ms 11.598 ms 11.523 ms 13 71.22.8.254 (71.22.8.254) 10.122 ms 10.046 ms 10.038 ms 14 71.22.8.162 (71.22.8.162) 12.713 ms 10.839 ms 11.142 ms 15 * * * 16 * * * 17 * * * Traceroute back to my Clear CPE router's default gateway: $ traceroute 50.8.128.1 traceroute to 50.8.128.1 (50.8.128.1), 30 hops max, 60 byte packets 1 removed 1.812 ms 2.173 ms 2.087 ms 2 public IP, removed 2.731 ms 2.635 ms 2.591 ms 3 public IP, removed 2.549 ms 2.520 ms 2.467 ms 4 0.ge-2-0-1.xt1.sac1.alter.net (152.63.51.81) 21.532 ms 21.529 ms 21.510 ms 5 0.so-5-2-0.xl3.sjc7.alter.net (152.63.48.6) 30.556 ms 32.337 ms 32.309 ms 6 0.ae3.br1.sjc7.alter.net (152.63.51.38) 32.298 ms 0.ae3.br3.sjc7.alter.net (152.63.50.5) 38.977 ms 0.ae3.br1.sjc7.alter.net (152.63.51.38) 40.915 ms 7 xe-8-1-0.edge1.sanjose3.level3.net (4.68.110.249) 27.102 ms 13.003 ms 21.180 ms 8 vlan79.csw2.SanJose1.Level3.net (4.68.18.126) 21.157 ms 18.735 ms vlan89.csw3.sanjose1.level3.net (4.68.18.190) 29.614 ms 9 ae-62-62.ebr2.sanjose1.level3.net (4.69.134.209) 29.598 ms 22.253 ms ae-72-72.ebr2.SanJose1.Level3.net (4.69.134.213) 34.313 ms 10 ae-1-6.bar2.sanfrancisco1.level3.net (4.69.140.153) 22.176 ms 22.859 ms 27.192 ms 11 ae-0-11.bar1.sanfrancisco1.level3.net (4.69.140.145) 27.140 ms 25.919 ms 25.114 ms 12 clearwire-c.bar1.sanfrancisco1.level3.net (4.53.132.14) 26.566 ms 26.525 ms 26.465 ms 13 71.22.8.254 (71.22.8.254) 24.857 ms 26.655 ms 26.201 ms 14 71.22.8.162 (71.22.8.162) 15.488 ms 17.219 ms 17.212 ms 15 50-8-128-1.sfo.clearwire-wmx.net (50.8.128.1) 17.194 ms 11.126 ms 11.075 ms Clear's new WiMax routers do not allow you to bridge or use your public IP address directly. They force the router to NAT. However, you can turn off all firewalling and do a one-to-one NAT to a single device (as I've done to my Linux router). It does pass protocols such as 41 (for IPv6 tunneling over IPv4). You can get a "static" IP on the CPE router by paying more (something in the range of $5 or $10/month). I've not had my non-static IP change yet (Using dynamic dns to remote back in). Think of Clear's tech support as lower than your home DSL provider's support levels. About all they can do is have you reboot your computer and reset your CPE router. Examples of less-than-helpful tech support: "If you log into your router - we don't support that and you cannot make any changes" (this is requires for the above disabling of their firewall and one-to-one NAT setup which is totally unsupported - or just to see the exact signal strength or get the MAC address to report to them so you don't have to move the device). "Our router is not grounded, so you must plug it directly into the [mains] otherwise it builds up static" (in response that it is never a power loss that has caused me problems, as I have it on a surge-protecting UPS with my home Linux router which never has a problem). Having to manually aim your CPE router means you'd want to have a professional do it and make sure it is not going to move. There are a number of places that sell outside mounting/housing equipment so you can aim and get the best signal. This is a low-end solution for low-end costs (think MetroPCS/Cricket from the pay-as-you-go cell phone market - except with a 2 year contract). I think it's a good backup solution for the SOHO because sometimes DSL/Cable does have issues, but I would not use it for a business primary solution. I'd been a relatively happy customer of Clear for the last year for the price ($29/mo) I pay. My experience of the last week is not so happy. I have a direct line of sight to their tower from my two story house (once you get through one sheet of drywall and the roof). Their tower is less than a mile away and I have 4-5 bars of service. Suddenly my service was horrible this last week, with constant loss of Internet access. Ping monitoring to their default gateway will continue to work, but not beyond. Ping monitoring to their default gateway from co-located hosts doesn't have problems at this time. Resetting CPE router device fixes it, but problems can resume within as little as 20 minutes. Current solution which has worked for the last 24 hours was to use their online map to find the next best tower: I have repositioned the CPE router to point at a different tower and now that tower is the only one my CPE router detects (previously my CPE router could see 3-4 towers as there are a few a few more miles away to the left and right of the tower I was using). Again I get a consistent 4-5 bars with this other tower, but now no more problems. My guess is that there is some sort of malfunction at the other tower. Originally I thought my CPE router was having a problem (which is leased from Clear and they were sending a new one, not to arrive for another 3-4 days), as the problem would not fix itself without resetting the CPE router and was instantly fixed after resetting it. However, as of now I've had 24+ hours without problems so I believe the problem is with the tower or was with Clear's network and not the CPE router (the CPE router had been getting reset 10+ times per day as the household has been having issues the last 7 days, and the only change yesterday was pointing to a new tower and not a power cycle). Check their online maps, service is very spotting with many holes. My residence shows as not getting service (showing signal is blocked 2-3 blocks away by other buildings), but as I have a two story and have it mounted at the top of my house it has a clear line of sight. Look at their support pages on how they say to move it all around your house to find the best room to install it in for signal. According to their support site, don't install it too close to anything (Wifi, or any other electrical device) as that will block service as well (this is not true as far as I have observed while monitoring signal strength with numbers from the CPE device). I'd never consider using their mobile service as it would be so unreliable as to where you could get service. They tried to get my local PD to switch from AT&T's wireless data service in the cars to Clear a few years back and the trails were so bad and spotty. I'd never consider using their VoIP service (even if it was free) as their latency jitter just doesn't cut it. Jason Roysdon > Since I'm not with Clearwire anymore (end of contract) I can say that > there are people in the core networking that do follow and respond the > this list. > > I can say that their backbone is solid and the people there really do > care about the network. > > If you have serious a backbone issue with Clearwire a message on this > list will result in a response.. > > -- > Joe Hamelin, W7COM, Tulalip, WA, 360-474-7474

1 0

Re: Future of the IPv6 CPE survey on RIPE Labs - Your Input Needed
by Scott Weeks 27 Jan '11

27 Jan '11

On 1/27/11 10:40 AM, Scott Weeks wrote: > --- frnkblk(a)iname.com wrote: > From: "Frank Bulk" <frnkblk(a)iname.com> > > Have you looked at D-Link's DIR-825? It has most of the things you're > ------------------------------------------- > > > > Ewww, yuck! "...this router utilizes dual active firewalls (SPI and NAT) to prevent potential attacks from across the Internet." > > ftp://ftp.dlink.com/Gateway/dir825/Manual/dir825_manual_110.zip --- joelja(a)bogus.com wrote: From: Joel Jaeggli <joelja(a)bogus.com> unlike a simpler device you can actually turn that off. in fact it has more knobs than you've likely seen in a consumer cpe... ----------------------------------- I just meant they were calling NAT an "active firewall" in the manual. I need a bath. I feel dirty now... >:-) scott

1 0

SP Sizing math?
by Thomas Magill 27 Jan '11

27 Jan '11

So keep in mind I don't have an SP background. I have a client who has this idea of getting into the SP business and I'm trying to help them realize, realistically, what kind of undertaking this will be. For a residential SP, what is a good reference for general guidelines on sizing. Such as, for 6,000 residential users, how bandwidth upstream would be required to be fairly assured your phone will not be blowing up with complaints? What amount of oversubscription is acceptable at what amount of bandwidth? Are customers just sold if you tell them 5 meg down, even though you have a 20:1 oversubscription? I have read in NANOG archives 100Mbps/1,000 users for a school campus environment; would residential be equivalent? Any input would be greatly appreciated. Thomas Magill Network Engineer Office: (858) 909-3777 Cell: (858) 869-9685 tmagill(a)providecommerce.com<mailto:tmagill@providecommerce.com> provide-commerce 4840 Eastgate Mall San Diego, CA 92121 ProFlowers<http://www.proflowers.com/> | redENVELOPE<http://www.redenvelope.com/> | Cherry Moon Farms<http://www.cherrymoonfarms.com/> | Shari's Berries<http://www.berries.com/>

1 0

Re: Future of the IPv6 CPE survey on RIPE Labs - Your Input Needed
by Brielle 27 Jan '11

27 Jan '11

On Thu, January 27, 2011 2:31 pm, Joel Jaeggli wrote: > On 1/27/11 10:01 AM, Jim Gettys wrote: >> For god's sake, stay away from the DIR-825(Rev A), which has been effectively abandoned by DLINK support and has no IPv6 support at all. > pretty sure you can't find those on the shelf... > The current model I bought on a lark for someone for christmas 2009 and have subsequently purchased several more, and not just becasue of the ipv6 support. The DIR-615 Rev C1 and higher are fairly decent, and both OpenWRT and DD-WRT capable. The TrendNet TEW623BRP and friends of that era are basically rebranded DIR-615 C1s. Both are fairly inexpensive and quite capable once you get rid of the stock software. -- Brielle Bruns http://www.sosdg.org / http://www.ahbl.org

1 0

RE: Future of the IPv6 CPE survey on RIPE Labs - Your Input Needed
by Scott Weeks 27 Jan '11

27 Jan '11

--- frnkblk(a)iname.com wrote: From: "Frank Bulk" <frnkblk(a)iname.com> Have you looked at D-Link's DIR-825? It has most of the things you're ------------------------------------------- Ewww, yuck! "...this router utilizes dual active firewalls (SPI and NAT) to prevent potential attacks from across the Internet." ftp://ftp.dlink.com/Gateway/dir825/Manual/dir825_manual_110.zip scott

2 1

Future of the IPv6 CPE survey on RIPE Labs - Your Input Needed
by Mirjam Kuehne 27 Jan '11

27 Jan '11

[apologies for duplicates] Hello, Based on new information we received since the last publication, we updated the IPv6 CPE matrix: http://labs.ripe.net/Members/mirjam/ipv6-cpe-survey-updated-january-2011 In order to make this information more useful for a large user base, we are preparing a detailed survey to gather more structural feedback about the range of equipment that is currently in use. Not only would we like you to participate in this survey, but we also ask for your help in identifying the right survey questions. Please find a call for input on RIPE Labs: http://labs.ripe.net/Members/marco/future-of-the-ipv6-cpe-survey-more-input… Kind Regards, Mirjam Kuehne & Marco Hogewoning RIPE NCC

11 17

Re: [dnsext] Historical root keys: The Large Router Vendor Speaks
by Jay Ashworth 27 Jan '11

27 Jan '11

----- Original Message ----- > From: "John Bashinski" <jbash(a)cisco.com> > Well, this has generated some interesting messages, and apparently > some people think that the "large router vendor" in question should > speak for itself. Yay! > Realities > ========= > 5. Some of the people installing these products (frankly including some > of the professional network gear) will have no clue what DNSSEC is > or what cryptography is. > > 6. In the case of the consumer gear, the cost to us of helping the > customer deal with any DNSSEC failure will be greater than the entire profit > we make on the device. > > 7. Even for professional gear, customers don't want to pay their staff > to mess with this, and we don't want to pay our staff to support > them. > > 8. Lots of our products get drop-shipped to people's field offices, > get plugged in by a wire-plugger-inner who basically just checks > that the lights are on and goes on to the next task, and then > have to fend for themselves, at least enough to be able to talk > to the NOC and await further instructions. > > Implication B: As much as it possibly can, anything we do must work > without human intervention, and especially without very skilled > intervention. We know there will be problems, but we MUST minimize > them and minimize the amount of "touch" required to fix them. > > Implication C: Social engineering is almost always a bigger risk than > cryptographic failure, especially at the device end of the > communication chain. That block of (correct) observations, coupled with later ones which I've elided for space, suggests to me the following observation: There is a limit to the maximum practical security and trust which can be engineered into the Internet at Large, absent some investment by specific users/network operators who require more. That observation shouldn't apply to the people who actually have a reason to be on this list -- backbone operators and professional DNS zone server operators *should* make that investment, as a contribution to the Public Good... but you can't necessarily expect it at the edge. My experience, and the integration of all the things I've learned in doing this for 25 years, is that complexity reaches a tipping point; there's only so much of it you can allow and still have a stable system -- and the complexity "attack surface" is at least proportional to the size of the system itself; something the size of The Entire Internet has even more stringent limits in that regard than, say, an enterprise LAN/WAN. So while I applaud Cisco's (or, more properly, John's) evaluation of the situation, and statement of goals -- and I agree with nearly everything he says -- my personal opinion is that there's a practical limit as to how close to the edge you can push the event horizon without the whole thing falling over... and I don't think that number's 100%. Cheers, -- jra

1 0

Re: Found: Who is responsible for no more IP addresses
by Jay Ashworth 27 Jan '11

27 Jan '11

[ Sorry; forgot to address this to the list, earlier. ] ----- Original Message ----- > From: "Brian Johnson" <bjohnson(a)drtel.com> > I'm a bit torn on this issue. I haven't even heard any other > "main-stream" sources say anything on this topic. But Incorrect info > is bad too. > > I hope the viewers who watched this are getting the gist that > "Something wicked this way comes". :) Vint was quoted as saying this some months ago, I believe in a story linked from Slashdot on a reputable news outlet. Sure enough: https://encrypted.google.com/search?q=vint+cerf+IP+address Cheers, -- jra

1 0

Contact at Dynadot
by Christopher 27 Jan '11

27 Jan '11

I have been knocking down this Romanian IRC botnet since Thanksgiving and Dynadot has been dragging their feet. I even called and talked to someone in tech support, which was an Asian guy with a small grasp of English but that's another discussion, and still they say they are "investigating it" Does anyone have a personal contact at Dynadot to get this escalated? It's painfully obvious and needs no investigation because they can look at the past DNS records for this subdomains to see the constant changes and updates with totally random IP addresses - customer DSL IP addresses, Russia, China, EDU institutions worldwide, etc. Please contact me off list. Thank you

1 0