- Test - lists.nanog.org

Re: DHCPv6, was: Re: IPv6 Finally gets off the ground
by Fred Heutte 17 Apr '07

17 Apr '07

If you turn on IPv6 on an XP machine (or have it turned on for you by a "helpful" application or MCP-enabled IT staff) be aware that there can be unexpected consequences. In my case it was discovering the nooks and crannies of Teredo, Microsoft's IPv6 tunnelling protocol. http://en.wikipedia.org/wiki/Teredo_tunneling I spent a couple hours in a hotel recently trying to untangle why using the DSL system I could see the net but couldn't get to any sites other than a few I tried at random like the BBC, Yahoo and Google. That's because they are among the few that apparently have IPv6 enabled web systems. Once the reason became apparent, I found another terminal and figured out how to disable Teredo and IPv6 on my laptop and all was well for the duration. Lesson learned. I was once, circa 1995 or so, fairly enamored of IPv6. Now it makes me wonder just exactly what problem it is good at solving. Don't get me wrong -- it's not the fault of IPv6 and its designers and advocates, it's that the world has moved on and other methods have been found for the questions it was designed to address. There is certainly room for concern about how well those work, but the conversion effort to IPv6 -- well, the market has voted with its pocketbook, or not. Present company included. fh ----------------- >On Mon, Apr 16, 2007 at 01:59:36PM +1200, Perry Lorier wrote: >> >When you can plug your computer in, and automatically (with no >> >clicking) get an IPv6 address, >> >> Router Advertisements let you automatically configure as many IPv6 >> addresses as you feel like. > >Remember that in XP, which Iljitsch recently cited to support his >claim of "years of operating system support," you must click IPv6 >into your configuration. It probably wants your XP install disc, >or something like that. > >In my point of view, this does not cut the mustard for such words. > > >Let's be clear: > >"There has been router and operating system support for years" is >a statement which predicates that the World has no technical excuse >for not running IPv6 globally edge-to-edge already. > >I think such a statement is fundamentally flawed. > > >> This could be a fairly simple defacto standard if network operators >> start using it. This is an obvious weak link in the chain at this point >> tho. > >Does this represent "years of router and operating system support?" > >My answer is "no." > >> once you have DNS you can use the WPAD proxy auto discovery thingamabob. > >...if you also had your domain suffix (unless you are suggesting >that there have been WPAD records at the root for "years"?). > >RTADV won't help you here (tho they keep talking about putting >domain-search and nameservers in it), and neither will DHCPv6 >as it turns out (it carries a domain-search list, but not "your >domain suffix" which is more what WPAD should really want). > >This is not "years of operating system support." > >What has had "years of operating system support," is the >unfortunate practice of acquiring option code 252 in DHCPv4. > >> >and solve your dynamic dns problems (as IPv4 set top boxes do today), >> >> Updating your forward/reverse dns via DNS Update messages isn't that >> uncommon today. > >On Enterprise networks using GSS-TSIG, sure. > >On ISP networks, I think the only time end-hosts try to update >their reverse DNS directly is when they're participating in a >rather unfortunate, and unintentional, distributed DoS against >the root servers. > >Which, oddly enough, you mention next. > >Actual reverse dns updates for end hosts (and not their NAT >gateways) is relatively uncommon, owing to the fact that such >end hosts generally are on RFC1918 addresses. > >> http://www.caida.org/publications/presentations/ietf0112/dns.damage.html >> >> where hosts are trying to update the root zone with their new names. > >I'm confused by what you're trying to argue. Are you suggesting >that AS112 represents "years of operating system support for >IPv6"? > >> So you can get from A to D without requiring DHCPv6. > >...I hope you see that this is only so long as you require some >clicking instead. > >This is all well and good for those of us who have sufficient >growth (or equivalent feminine metaphor) on our chins, which we >enjoy stroking thoughtfully while determining what all these >"correct configurations" are. > >But I don't think "it works for bearded geeks" is setting the >bar high enough when we use lofty words like "supported by >routers and operating systems for years." > >-- >David W. Hankins "If you don't do it right the first time, >Software Engineer you'll just have to do it again." >Internet Systems Consortium, Inc. -- Jack T. Hankins >

10 13

Re: [ok] Re: DHCPv6, was: Re: IPv6 Finally gets off the ground
by Fred Heutte 17 Apr '07

17 Apr '07

I may well not have fully figured out what was going on in this particular situation. Mostly because I got tired of trying to sort out the endless mysteries of IPv6 running under XP Service Pack 2. Teredo may or may not have been at issue. I saw some analyses indicating this might have been the case. In any event, after backing it and IPv6 out, all was well. fh ----------------- >[hmmmm how come I didn't parse any operational content in this post...] > >Fred Heutte wrote: >[..] >> I spent a couple hours in a hotel recently trying to untangle why >> using the DSL system I could see the net but couldn't get to any >> sites other than a few I tried at random like the BBC, Yahoo >> and Google. >> >> That's because they are among the few that apparently have >> IPv6 enabled web systems. > >They don't have "IPv6 enabled web systems", a lot of people wished that >they did. What your problem most likely was, was a broken DNS server, >which, when queried for an AAAA simply doesn't respond. > >Most Network Operators (to keep it a bit on topic for this mailinglist) >can't do anything about broken DNS servers at End User sites. > >Note that this has *nothing* to do with Teredo, which even doesn't >activate itself when it can't get packets to be relayed. You can't thus >blame Microsoft for this. The DNS server is broken, not them. I know it >is always fun to blame M$ but really it isn't true. > >Note also that the BBC once did have a AAAA related DNS problem, that >was in 2002 though and was quickly resolved: >http://www.merit.edu/mail.archives/nanog/2002-04/msg00559.html >These had another kind of problem, they returned NXDOMAIN, so that it >looked like the requested label was not there; much better still than >the simple ignore and forget of the End User DNS problems. > > >> I was once, circa 1995 or so, fairly enamored of IPv6. Now it >> makes me wonder just exactly what problem it is good at solving. > >Primarily only one: a *lot* more address space. Enough to provide our >children's children children and the rest of the world with unique >addressable address space. Nothing more nothing less. > >> Don't get me wrong -- it's not the fault of IPv6 and its designers >> and advocates, it's that the world has moved on and other >> methods have been found for the questions it was designed to >> address. > >As it primarily resolves the address space problem and it solves this >perfectly well, how exactly did your world move on by staying limited to >32bits and only 4 million addresses while there are many more people on >this planet, not even thinking of subnets or having multiple addresses >per person? > >Greets, > Jeroen > >

1 0

RE: Question on 7.0.0.0/8
by Ted Hardie 16 Apr '07

16 Apr '07

At 11:51 AM +0100 4/16/07, <michael.dillon(a)bt.com> wrote: > >In the 21st century, you look at what is available on the shelf and >widely in use on the net and adopt that. Most often this turns out to be >a RESTful API that doesn't even need XML, although something like >XML-RPC still fits the bill. I still wonder why the widely used LDAP >protocol can't be adopted for whois lookups since it is used everywhere >in the corporate world. The answer seems to be Not-Invented-Here or >"we're netheads and LDAP smells of bellheads", both of which are >ridiculous arguments in the today's world. > The CRISP working group considered both an LDAP-based proposal and IRIS during its initial development. If you check the archives, you'll see the extensive discussions of the pros and cons of each approach (http://www1.ietf.org/mail-archive/web/crisp/index.html) At the time of that discussion, the RIRs were not interested in using CRISP, so that decision was made based on domain name registry requirements. The RIRs interest in re-using the work of CRISP came after IRIS had already been chosen. The decision might have been different in both were being decided concurrently, but that's not my personal impression. You may also wish to recall that LDAP was standardized in the IETF and had active working groups in the Apps Area as recently as last year (LDAPBIS; LDAPEXT closed earlier, as did LDUP). I don't think it was rejection of external forces that drove the decision. Full disclosure: I was chair of CRISP at the time of the decision discussed above and later AD for both CRISP and the LDAP working groups. That probably makes me a biased observer. Your mileage may vary, and past performance is no guarantee of future results. Ted

1 0

Thoughts on increasing MTUs on the internet
by Iljitsch van Beijnum 15 Apr '07

15 Apr '07

Dear NANOGers, It irks me that today, the effective MTU of the internet is 1500 bytes, while more and more equipment can handle bigger packets. What do you guys think about a mechanism that allows hosts and routers on a subnet to automatically discover the MTU they can use towards other systems on the same subnet, so that: 1. It's no longer necessary to limit the subnet MTU to that of the least capable system 2. It's no longer necessary to manage 1500 byte+ MTUs manually Any additional issues that such a mechanism would have to address?

36 67

RE: Question on 7.0.0.0/8
by william(at)elan.net 15 Apr '07

15 Apr '07

On Sun, 15 Apr 2007, Huizinga, Rene wrote: > BTW, on the same line what's going on with 180.190.0.0/16 actually ? > It's within the 176.0.0.0/5 registered as Bogon. > Is it a typo (thai-po ? :P ) from an Asian guy (AS24003 originated) or did I > miss something lately...? :P I already dealt with 180.190.0.0/16. Here is response: | Date: Sat, 14 Apr 2007 11:51:43 +0530 | Subject: Re: bgp bogon announcements if iana space from AS24003 | | I'll check who is doing this annoucement and get it turned off fastest. | | Thanks | Samod Babu | Sr. Manager-IT ... | > 180.190.0.0/16 ## AS24003 : : | > 180.0.0.0 - 180.255.255.255 ## Bogon (unallocated) ip range | | Would you guys mind turning it off or if not explaining on nanog and | other mail lists why you're doing it. Thanks. -- William Leibzon Elan Networks william(a)elan.net

1 0

Re: Question on 7.0.0.0/8
by Florian Weimer 14 Apr '07

14 Apr '07

* Rene Huizinga: > Well, at least is is still somehow with the same party... Not quite. The organization formerly known as "debis" is now called "T-Systems". > Arin states 'Mercedes Benz AG', RIPE 'Daimler Chrysler'... One would > think this would/should actually be just the other way around, but > never mind :) "Daimler Benz AG" would have been more appropriate. Mercedes Benz was just the car manufacturer--but I'm not sure if the split was there in 1992. Until about a year ago, T-Systems actually used parts of the netblock for some hosted servers (Deutsche Post, for instance). But in the meantime, they've got non-legacy address space and are no longer in the "extra-small" category as far as their RIPE membership is concerned.

1 0

Re: Abuse procedures... Reality Checks
by Fergie 13 Apr '07

13 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Rich Kulawiec <rsk(a)gsp.org> wrote: 1. There's nothing "indiscriminate" about it. >I often block /24's and larger because I'm holding the *network* operators >responsible for what comes out of their operation. If they can't hold >the outbound abuse down to a minimum, then I guess I'll have to make >up for their negligence on my end. I don't care why it happens -- they >should have thought through all this BEFORE plugging themselves in >and planned accordingly. ("Never build something you can't control.") I would have to respectfully disagree with you. When network operators do due diligence and SWIP their sub-allocations, they (the sub-allocations) should be authoritative in regards to things like RBLs. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGGBIlq1pz9mNUZTMRAkLuAJ4sjBnZ1IF4FBjFvMn4NlgK7lZysgCg3gT2 8e9PswhChgNhDHnCsY+Yf9M= =oJaW -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

7 10

RE: AOL Postmaster?
by David Hubbard 13 Apr '07

13 Apr '07

From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > > > >Anybody from AOL on this list? Could you please send me an email > >offlist? I need some help. > > Have you pursued every avenue of contact listed at: > <http://postmaster.info.aol.com/>? > > I've found them to be GENERALLY pretty responsive on those channels, > as have many others. > > --chuck I'm still getting feedback on netblocks we haven't been associated with in several years and I've tried about 20 times to get them to stop it but cannot. If you call they just tell you to email, if you email you get nowhere. David

3 2

RE: Abuse procedures... Reality Checks
by Frank Bulk 13 Apr '07

13 Apr '07

It truly is a wonder that Comcast doesn't apply DOCSIS config file filters on their consumer accounts, leaving just the IPs of their email servers open. Yes, it would take an education campaign on their part for all the consumers that do use alternate SMTP servers, but imagine how much work it would save their abuse department in the long run. Frank -----Original Message----- From: Frank Bulk Sent: Wednesday, April 11, 2007 5:10 PM To: 'nanog(a)merit.edu' Subject: Re: Abuse procedures... Reality Checks On Tue, Apr 10, 2007 at 07:44:59AM -0500, Frank Bulk wrote: > Comcast is known to emit lots of abuse -- are you blocking all their > networks today? All? No. But I shouldn't find it necessary to block ANY, and wouldn't, if Comcast wasn't so appallingly negligent. ( I'm blocking huge swaths of Comcast space from port 25. This shouldn't really surprise anyone; Comcast runs what may well be the most prolific spam-spewing network in the world. I saw attempts from 80,000+ distinct IP addresses during January 2007 alone -- to a *test* mail server. I should have seen zero. The mitigation techniques for making that happen are well-known, have been well-known for years, and can be implemented easily by any competent organization.) This, by the way, should not be taken as indicative of either what I've done in the past or may do in the future. Nor should it be taken as indicative of what decisions I've made in re other networks. ---Rsk

9 8

Anyone around from Sprint's e-mail administration?
by Drew Weaver 13 Apr '07

13 Apr '07

Please contact me off-list. Thanks, Drew

1 0