- Test - lists.nanog.org

RE: Procedure to Change Nameservers
by Joe Blanchard 18 Sep '08

18 Sep '08

Typical answer from an uneducated DNS expert. Jo Rhetts comments and experience are simplistic in nature and uselss at best. Given that your SOA DNS is one it would be quite simple to do so. If the Domains in question are SOA'd at many different sources than I would say you have a bit a work in front of you. You would have to contact each of the SOAs and change them. If your sourcing your own SOA than its simple. Contact me off list and we can discuss the details. Cheers, -Joe Blanchard > > > -----Original Message----- > > From: Jo Rhett [mailto:jrhett@netconsonance.com] > > Sent: Thursday, September 18, 2008 5:45 AM > > To: Crist Clark > > Cc: Nanog > > Subject: Re: Procedure to Change Nameservers > > > > On Sep 16, 2008, at 3:50 PM, Crist Clark wrote: > > > I want to change the nameservers for a bunch of domains > > > > Then ask the question on a list related to DNS. > > > > -- > > Jo Rhett > > Net Consonance : consonant endings by net philanthropy, open source > > and other randomness > > > >

1 0

[NANOG-announce] NANOG44 Updates
by Betty Burke 18 Sep '08

18 Sep '08

Hello Everyone:> As Philip Smith indicated... a few more update messages to the community will be coming, and here is one of them. First, Merit would like to draw your attention to the Hotel Reservation link http://nanog.org/meetings/nanog44/hotel.php An IMPORTANT NOTE to be aware of is, the Hotel room block rate EXPIRES on FRIDAY, Sept. 19! Merit has reserved rooms for the community, so please do reserve your room before the deadline. Just an easy click away. So now that you have reserved your room, you should check out the updated NANOG44 meeting agenda. http://nanog.org/meetings/nanog44/agenda.php Highlights include: Updated presentations and content information, along with meeting room assignments. Soon, Merit will also highlight which presentations will be broadcast and which will be encoded for future reference. For the first time while at NANOG, Merit will have a room assigned to view the Fall 2008 Internet2 Member Meeting netcast. There are evening events on Sunday, Monday and Tuesday!! And we have a very exciting joint session with ARIN on Wednesday morning. Lastly, the NANOG-Attendee(a)nanog.org email list will help you keep in touch with each other. It will also be the distribution method for sharing additional site and meeting specific information. Make sure if you are attending, you are subscribed!! Again, on behalf of Merit Network, the NANOG SC and PC, we encourage you to attend this exciting meeting. We are confident this is one meeting you will not want to miss !! Hope to see many of you in LA and as always, if you have any questions or concerns regarding the meeting venue or registration, please send a note to NANOG-Support(a)nanog.org. Sincerely, Betty Burke Merit/NANOG Project Manager Merit Network Inc. Merit/NANOG Project Manager _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Any group(s) discounts to NANOG in LA?
by Peter Serwe 18 Sep '08

18 Sep '08

I'm so close to it, not attending is not really an option.. Peter -- ピーター

2 2

Atrivo Update
by Paul Wall 17 Sep '08

17 Sep '08

I've been in touch with all of the upstream transit providers currently routing Atrivo/Intercage netblocks. Without naming any names, they are all aware, and working on getting them pulled in accordiance with their AUPs. Hats off particularly to NTT and AboveNet for going the extra mile here. (Unfortuantely, I understand sales and contractual pushback can sometimes put a damper on these things.) Gas is still expensive, so Drive Slow, Paul Wall

1 0

Today's Point-2Point WAN Options
by Chris Kleban 17 Sep '08

17 Sep '08

Hello Nanog, I'm currently looking into what are the options for enabling inter-datacenter communication. Our current solution is to use ipsec/gre tunnels traversing over the Internet. The specific needs the new solution must meet are: - The ability to run end-to-end QOS. - Dedicated bandwidth - Support 1gbps transfer rates - Enable communication between 3 locations The options I have looked into so far are: - Layer 2 Ethernet (Virtual Private Line): This service seems to be offered by a lot of ISPs using various networking techniques. The price point is attractive however packets are forwarded only at best effort across the ISP's network which means the quality of the service will directly reflect the ISP's network performance. - Traditional Leased Line (dsX/ocX): This service seems to be more expensive then wavelength services however meets my needs. - WaveLength Services (oc3-10gig): This service seems to be cheaper then traditional leased lines when comparing similar bandwidth. However, availability is limited to on-net buildings. This solution meets my needs. - MPLS based VPN solutions: Seems to be a good point to multipoint technology with QOS offerings. However, the price seems to be around the same as wavelength services for the amount of bandwidth we require. If the number of data centers we were looking to connect was larger then this option would be more attractive. This solution meets my needs. Based on my needs and what my options are I am leaning towards point to point wavelength services connecting my 3 locations in a loop like fashion. Are there any other options I should consider? Are my descriptions of the today's possible solutions inaccurate? Are there any thoughts on today's pricing that differs then my findings? Thanks Chris Kleban

4 4

Re: Atrivo/Intercage: Now Only 1 Upstream
by hobbit＠avian.org 17 Sep '08

17 Sep '08

you expect them to apply a null route? Well, I *have* been talking somewhat idealistically here and there with this crop of questions, but frankly I thought in the 2 or 3 years I was ignoring the list that the NETWORK OPERATORS ostensibly in custody of the intertubes would have pulled things together a little better and grown enough of a pair to firmly state "this crap stops here and now" and make it happen. I do see pockets of good progress and research here and there and have gotten a lot of good feedback from people, but the big picture [as I watch my logs roll by] is pretty grim. Especially when the big players don't play at all. I've been around long enough to have a good idea of what *can* be done, but totally lost sight of any sensible reason why it *isn't*. Besides quarterly revenue, which is pretty short-sighted. Fortunately, I still have the luxury of being able to have my mailsystems tell cpe-*.rr.com and pool-*.verizon.net and c-24-*.comcast.net, along with large swaths of offshore IP space, to take a powder. Hundreds of times a day. But it's still their trash flying onto my tiny little lawn, and shouldn't be my job to sweep up. I mentally extend that picture to the millions of recipients who possibly aren't able to implement unusual and/or draconian filtering, and wonder how anybody ever gets any productive work done. _H*

2 1

Re: Atrivo/Intercage: Now Only 1 Upstream
by hobbit＠avian.org 17 Sep '08

17 Sep '08

So in cases like this where the community appears to agree that there's a consistently bad apple, what's preventing everyone from simply nullrouting the netblocks in question and imposing the death penalty? Sorry if this seems naive, but if no legitimate purpose is shown it seems like the obvious thing to do. Maybe they could still *send* packets, but nothing would ever get back to them. _H*

5 4

RE: LoA (Letter of Authorization) for Prefix Filter Modification?
by Skywing 17 Sep '08

17 Sep '08

It is only a good audit trail if the audit log can be trusted, though. Given how "secure" things like faxes are, well, that's a thing for another day, I suppose. Very few things out there in today's interconnected world really provide "hard" security, instead of security theatre/CYA/minor deterrants/"keeping honest people honest". That is not to say that these things have zero inherent value, at least in my mind, but they are not IMO to be confused with high security (as in military grade versus making a few clever [socially engineered] phone calls). Even so, much of the modern day business world relies on these things to some degree or another. - S -----Original Message----- From: Joe Greco <jgreco(a)ns.sol.net> Sent: Tuesday, September 16, 2008 11:15 To: Jon Lewis <jlewis(a)lewis.org> Cc: Rodriguez Mauricio <Mauricio.Rodriguez(a)fpl.com>; nanog(a)nanog.org <nanog(a)nanog.org> Subject: Re: LoA (Letter of Authorization) for Prefix Filter Modification? > On Tue, 16 Sep 2008, Christian Koch wrote: > > I dont mind, i think it is another good step towards 'good filtering' > > but...i think the PITA part is > > downstream 'clueless' customers, who may need an explanation on prefix > > hijacking and the state > > of the internet today, and that these are all just combined efforts to > > minimize the risk of accepting allocations > > that don't belong to you. > > IMO, it's just an illusion of added security and is really just CYA for > the provider. When I fax TWTelecom an LOA that a customer faxed to me, > how does TWTelecom verify the authenticity of that LOA? I doubt they try. > I suspect it's just filed, and will only be pulled out if the > advertisement is challenged by some 3rd party. How do you verify the authenticity of anything? This is a common problem in the Real World, and is hardly limited to LoA's. How do you prove that what was on Pages 1 to (N-1) of an N page contract contained the words you think they said? I knew a guy, back in the early days, who habitually changed the SLA's in his contracts so that he could cancel a contract for virtually no reason at all ... the folly of mailing around contracts as .doc files in e-mail. But even failing that, it's pretty trivial to reprint a document, so where do you stop, do you use special paper, special ink, watermarking of documents, initial each page, all of the above, etc? Look at what people are willing to go through with paper checks to increase the chances of authenticity. Google Abagnale. The real world already has ways of dealing with fraud and forgery, and while the paper is certainly CYA for the provider, it does provide an actual trail back that can probably be followed to some party. To refer to it as an "illusion" is only vaguely true. It is an illusion in that it will not prevent all cases of hijacking. Of course. However, it is another step that makes it significantly more difficult for someone to just start announcing random bits of IP space. It's just like physical security, in many ways. Given a sufficiently determined attacker, any door can be broken. Wood door? May require only my boot. Steel door? Prybar. Bank vault? Explosives. Etc. The thing is, as you increase the level of protection, the ease of countermeasures typically decreases (I wear my boots almost 100% of the time, I may have a prybar nearby, but I am unlikely to be carrying explosives at any time.) So let's not trivialize improvements such as LoA's which reduce the ease of hijackings, eh. ... JG -- Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net "We call it the 'one bite at the apple' rule. Give me one chance [and] then I won't contact you again." - Direct Marketing Ass'n position on e-mail spam(CNN) With 24 million small businesses in the US alone, that's way too many apples.

2 1

Creating a visual Map of a network?
by castellan2004-nsm＠yahoo.com 16 Sep '08

16 Sep '08

I am being tasked to map a network. In the past I have used nmap to find the systems on the local LAN and remote LANs (same enterprise). This time I want to create a visual map of the LAN. With cheops, I reasonably good results but cannot be documented for managers with certainty. What are some good tools now that will create visual maps of the networks? What is the best way to map a network when ICMP echo has been turned off? Thank you in advance for any help. Subba Rao

4 3

community real-time BGP hijack notification service
by Gadi Evron 16 Sep '08

16 Sep '08

Hi, WatchMy.Net is a new community service to alert you when your prefix has been hijacked, in real-time. Following the discussion on NANOG a couple of weeks ago on what to do if your prefix is hijacked, people mentioned that detection-wise, free services are limited (to certain communities or by not being real-time). The current fully public and free services will alert you with a few hours delay. Over labor day weekend we built a free real-time service. We invite people to try it out during our beta stage. Register for alerts at: http://www.watchmy.net/ We hope you find it useful, Avi Freedman, Andrew Fried && Gadi Evron.

13 27