- Test - lists.nanog.org

RE: Gtld transfer process
by Bruce Tonkin 21 Jan '05

21 Jan '05

Hello Thor, > > > > (5) The registry will send a message to the losing registrar > > confirming that a transfer has been initiated. > > Can you confirm or deny whether this actually happened in the > case of the panix.com transfer? I don't have any direct visibility over this. I have asked Verisign and Dotster if they can confirm. My personal view is that I think it unlikely that this part of the system failed. Note however that Verisign would send the message via email to Dotster. Verisign could prove that they sent the email, but it is possible that it was not delivered. > > The other problem I see in this area is that the RRP > specification (if that is in fact the protocol that was used) It was. > seems to claim that this message is out-of-band and thus > beyond the scope of the protocol: so it does not (can not) > specify an ACK. If an attacker found a way to prevent this > message from being received, even if generated... > > A strictly enforced technical requirement for an ACK here > might work wonders (perhaps it would have to be enforced by > duping both the confirmation and the ACK to the "System", as > RRP so quaintly calls it, and denying future transfers > initiated by parties with too many outstanding ACKs). Not an > approval, just an ACK. Rather than further work on the RRP protocol, it would be better for Verisign to implement the EPP protocol which has gone through the IETF process. Regards, Bruce

2 1

RE: improving the registrar transfer process
by Bruce Tonkin 20 Jan '05

20 Jan '05

> > > > Accountability. Responsibility. > > I agree with you on this 100%. ICANN needs to enforce there > current policies. I agree too. > Look at totalnic/pacnames. They have been > refusing transfer requests years now until very very recent. > What has ICANN done about all those complaints and violations > that has been well documented? > nothing! > > ICANN needs to stop just accepting money and start enforcing > policies... > Interestingly, the ICANN equivalent in Australia (auDA), does pro-actively enforce policies, and even took Capital Networks to court on the basis that they could be de-accredited as a registrar for .au, if they continued not to allow transfers for .com. See: http://www.austlii.edu.au/au/cases/cth/FCAFC/2004/324.html The original judgment is at: http://www.austlii.edu.au/au/cases/cth/federal_ct/2004/808.html

2 1

Ability to use and monitor LOCK status
by Bruce Tonkin 20 Jan '05

20 Jan '05

> However, that still looks to me like "Users can only ask that > domains be locked." Unless you are claiming that users can > send the lock request directly to the registry, and monitor > its status. Only a registrar can send commands directly the registry. Different registrars offer different services. Most are now offering the ability for customer to put a name on Lock, and remove a name from lock using the normal online maintenance tools. The status of LOCK is published in the Registry WHOIS service, although this display is not in real-time (ie believe it is updated once a day). Registrars have real-time access to the lock status of a name under their management. Regards, Bruce

1 0

Re: Graphing Peering
by andrew matthews 20 Jan '05

20 Jan '05

no i mean graph bgp sessions... it's a single interface, and i want to graph every bgp session so i can see how much traffic i'm doing between each peer. On Wed, 19 Jan 2005 22:25:37 +0000 (GMT), Stephen J. Wilcox <steve(a)telecomplete.co.uk> wrote: > On Wed, 19 Jan 2005, andrew matthews wrote: > > > Anyone have any suggestions on graphing peering on a cisco router? I'm > > using mrtg and i did mac address accounting but the numbers are off. > > do you mean how to graph traffic to each host on a lan..? > > what platform do you have? > > Steve > >

5 5

Re: Please Check Filters - BOGON Filtering IP Space 72.14.128.0/19
by Fergie (Paul Ferguson) 20 Jan '05

20 Jan '05

...and it's not like ARIN, etc., does not announce to the Internet community when it allocates from address space which may have previously been listed in various operational places as "bogon" or "unalloacted" -- they do. I recall seeing similar announcements on the list from time to time, suggesting due diligence on ARIN's behalf to notifying people to modify their filtering. *plonk* Scanning the archives, an example: http://www.merit.edu/mail.archives/nanog/2004-01/msg00374.html - ferg -- Jared Mauch <jared(a)puck.nether.net> wrote: This hurts Ciscos reputation that they are causing pockets of the internet to not work. Next subnets to get allocated will increase the size of those pockets and so on. Then the internet will become less reliable as an end-to-end transport medium, hurting *everyone*. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

3 2

Router-switch-router "peering module"
by Howard C. Berkowitz 20 Jan '05

20 Jan '05

I'm hunting for some presentations or papers on what I've seen called a "peering module", using a router, a L2 switch, and a router in series, rather than a single router. Unfortunately, I can't remember where I saw the detailed description, and I haven't been able to find it in the NANOG archives. IIRC, the rationale was to spread filtering and rate limiting over a set of processors, also to keep the configuations more manageable. Does anyone have any pointers to detail? I've seen the topology, but not a detailed discussion, in a couple of Cisco presentations.

1 0

Graphing Peering
by andrew matthews 20 Jan '05

20 Jan '05

Anyone have any suggestions on graphing peering on a cisco router? I'm using mrtg and i did mac address accounting but the numbers are off. Thank i appreciate it in advance. Andrew

4 3

Regarding registrar LOCK for panix.com
by Bruce Tonkin 20 Jan '05

20 Jan '05

> > On Wed, 19 Jan 2005, Darrell Greenwood wrote: > > customers' domains. Panix.com says its domain name was locked, and > > that despite this, it was still transferred. (r) > > I seem to recall someone saying it wasnt locked, now theyre > saying it was? The information we have so far, indicates that it was not on Registrar LOCK at the registry at the time of the transfer. Regards, Bruce Tonkin

7 6

Confirmation of receipt of the transfer request at Verisign for panix.com
by Bruce Tonkin 20 Jan '05

20 Jan '05

When a registrar sends a transfer request to the registry operator (and the name is not on Registrar LOCK), the registry operator sends a confirmation email to both the losing and gaining registrar. Here is the copy of the email Melbourne IT received. Regards, Bruce Tonkin From hostmaster(a)verisign-grs.com Sun Jan 9 12:40:35 2005 Return-Path: <hostmaster(a)verisign-grs.com> Received: from verisign-grs.org (snoopy.verisign-grs.net [192.153.247.4]) by galahad.inww.com (8.12.9/8.12.9) with SMTP id j091eYgt003545 for <>; Sun, 9 Jan 2005 12:40:35 +1100 (EST) Date: Sat, 8 Jan 2005 20:40:34 -0500 From: hostmaster(a)verisign-grs.com Message-Id: <200501090140.j091eXp7019959(a)verisign-grs.org> To: Melbourne IT Reply-to: hostmaster(a)verisign-grs.com Subject: Receipt of Transfer Request: PANIX.COM Transfer Request for: Domain Name: PANIX.COM Requesting Registrar: Melbourne IT, Ltd. d/b/a Internet Names Worldwide Current Registrar: Dotster, Inc. The VeriSign Global Registry Services has received your request to modify the domain name record for PANIX.COM to reflect the fact that the registrant has selected you to be its Registrar. By submitting the request using the "Transfer" command in the RRP, you have represented to the VeriSign Global Registry Services and the Current Registrar that (1) you have obtained the requisite authorization from the domain name registrant listed in the database of the Current Registrar, and (2) you have retained a copy of reliable evidence of the authorization. Pursuant to established procedures, the VeriSign Global Registry Services has notified the Current Registrar of your request. If we receive an Affirmative response to our notice within five (5) calendar days, we will make the change to the domain name record. If we receive a negative response to our notice within five (5) calendar days we will decline to transfer the domain name. If the Current Registrar takes no action within five (5) calendar days, we will make the change to the record. Sincerely, VeriSign Global Registry Services www.verisign-grs.com info(a)verisign-grs.com

4 3

Rép. : 85.68.0.0/19 Please Check Filters - BOGON Filtering IP Space
by RAMAHEFASON David FTC 20 Jan '05

20 Jan '05

oh my bad: 85.68/15 sorry for the mistake. >>> RAMAHEFASON David FTC <david.ramahefason(a)francetelecom.com> 01/20 10:44 >>> Hi, we're AS34033 and have been assigned the 85.68/19 address space from the RIPE on October 2004. But we still have some network reachability issues, due often to the use "old" BOGON filters, can you check that this supernet is not part of your bogon filters anymore. Thanks a lot David Ramahefason

1 0