- Test - lists.nanog.org

DNS Recursive Operators: Please enable QNAME minimization (RFC7816) for the enhanced privacy of your users
by Jeroen Massar 12 Mar '20

12 Mar '20

Hi Folks, While in the US soon all Firefox users will *NOT* use your DNS Recursives configured using DHCP anymore (NXDOMAIN use-application-dns.net to avoid that[1]). Next to that, it seems some of the root operators are now creating instances in the same networks that offer these kind of services for globally figuring out what queries are being made. For those that thus either opt-out or otherwise want to use their own system resolvers, I suggest that all that run DNS Recursive setups enable "QNAME minimization" as defined in (experimental) RFC7816 [2] For pdns "qname-minimization=yes" [6] For unbound "qname-minimisation: yes" [5] For BIND "qname-minimization" option [3] and [4] Of course, do also provider your users with the option of using DoT or even DoH on your recursors... Noting that DoH operators are supposed to enable RFC7816 also [7], guess they do not want others to see all the details they get... Some more details in DNS Privacy Wiki [8]... Discuss! :) Greets, Jeroen [1] https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-… [2] https://tools.ietf.org/html/rfc7816 [3] https://www.isc.org/blogs/qname-minimization-and-privacy/ [4] https://gitlab.isc.org/isc-projects/bind9/issues/16 [5] https://netlabs.nl/downloads/presentations/unbound_qnamemin_oarc24.pdf [6] https://github.com/PowerDNS/pdns/issues/2311 [7] https://wiki.mozilla.org/Security/DOH-resolver-policy [8] https://dnsprivacy.org/wiki/

11 13

Re: DNS Recursive Operators: Please enable QNAME minimization (RFC7816) for the enhanced privacy of your users
by Scott Weeks 12 Mar '20

12 Mar '20

--- owen(a)delong.com wrote: From: Owen DeLong <owen(a)delong.com> For anyone considering enabling DOH, I seriously recommend reviewing Paul Vixie’s keynote at SCaLE 18x Saturday morning. https://www.youtube.com/watch?v=artLJOwToVY It contains a great deal of food for thought on a variety of forms of giving control over to corporations over things you probably don’t really want corporations controlling in your life. --------------------------------------------------- Definitely informative. I had no idea. As well Paul Vixie always sees things from a uniqus PoV. Thanks for sharing! I add a +1 that folks should watch this. scott

1 0

Honeypot type services from cloud flare or other security groups?
by Brielle 11 Mar '20

11 Mar '20

Hi all, Sorry for formatting errors, on my iPad while I have this thought in my mind. Does anyone know if any of the security groups or CDNs like Cloudflare have honeypots out there that can be used for analysis of unusual attacks? As in, change the DNS temp for a host and let the honey pot take the brunt of it and hopefully get useful data (even for the benefit of the security company). Got a situation where I’ve got an abnormally high amount of legit looking GET requests to a HTTPS git server, but are too high amount to actually be legit end users or people cloning the repos. The sources are worldwide, distributed, but with the bulk coming from China, Russia, Brazil, and Egypt. I have some theories and observations that I’d be open to sharing, but preferably not on an open mailing list until I’ve had a change to have them reviewed by someone with more experience and background. Thx! Sent from my iPad

2 2

Re: Anyone from EDGECASTCDN / Verizon Media on the list?
by Dmitry Sherman 11 Mar '20

11 Mar '20

Hello Chriztoffer thanks for following up! Yes, thanks, we resolved the issue. Best regards, Dmitry Sherman Interhost Networks [X] On 11 Mar 2020, at 18:54, Chriztoffer Hansen <chriztoffer.hansen(a)de-cix.net> wrote: Hello Dmitry Sherman, Did your attempt at getting in touch with EDGECASTCDN / Verizon Media succeed? Best regards, Chriztoffer -- Chriztoffer Hansen Network Service Engineer ------------------------------ DE-CIX Management GmbH Lindleystr. 12, 60314 Frankfurt (Germany) phone: +49 69 1730902 11 fax: +49 69 4056 2716 e-mail: support(a)de-cix.net web: www.de-cix.net ------------------------------ DE-CIX Management GmbH Executive Directors: Harald A. Summa and Sebastian Seifert Trade registry: District court (Amtsgericht) Cologne, HRB 51135 Registered office: Lichtstr. 43i, 50825 Cologne | -----Ursprüngliche Nachricht----- | Von: NANOG <nanog-bounces(a)nanog.org> Im Auftrag von Dmitry Sherman | Gesendet: lørdag den 7. marts 2020 13:31 | An: NANOG list <nanog(a)nanog.org> | Betreff: Anyone from EDGECASTCDN / Verizon Media on the list? | | Hello, | Anyone from EDGECASTCDN / Verizon Media on the list? | We are facing network reachability issues from EDGECASTCDN to our | network. Please contact off-list if possible. | | Thanks. | | -- | Dmitry Sherman | Interhost Networks Ltd |

1 0

Any Singtel AU APAC observed
by Van Dyk, Donovan 11 Mar '20

11 Mar '20

Hi all, Over the past two weeks we have been noticed a lot of transit issues with packet loss for all our carriers connections into singtel APAC going to Australia specifically. Anyone aware of any congestion issues going on? If anyone has a Singtel contact to forward that would be awesome aswell. Thanks -- Donovan Van Dyk Platform Operations Engineer, Senior Fort Lauderdale, FL USA [signature_465954491] The information contained in this electronic mail transmission and its attachments may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient (or an individual responsible for delivery of the message to such person), you are strictly prohibited from copying, disseminating or distributing this communication. If you have received this communication in error, please notify the sender immediately and destroy all electronic, paper or other versions.

1 0

Spectrum Network Engineer (Legacy TWC/RR) ?
by Gabriel Kuri 11 Mar '20

11 Mar '20

Any Spectrum/Legacy TWC engineers on the list that could contact me off list in regards to a network issue in the Los Angeles area that first tier support is clueless about and unwilling to escalate? To quickly summarize, it appears port 5060 (SIP traffic) is blocked at very specific nodes within the Los Angeles area. Yes, SIP ALG is turned off in the router and cable modem, Techs have been out multiple times to put in different cable modems to no avail. Swapping the same location over to a fiber or DSL connection with an alternate provider makes the issue go away. It feels like there is a piece of equipment beyond the cable modem that is either mangling or blocking SIP traffic. The issue is not everywhere in the Los Angeles area on Spectrum/TWC, only a few sites from what we've seen. I can provide specifics if someone would kindly contact me off list. We'd like to get this resolved and first tier support says they have no way to escalate. Thanks ...

1 0

akamai yesterday - what in the world was that
by Aaron Gould 11 Mar '20

11 Mar '20

My gosh, what in the word was that coming out of my local Akamai aanp servers yesterday !? starting at about 12:00 noon central time lasting several hours ? -Aaron

73 180

Chairman Pai Proposes Mandating STIR/SHAKEN To Combat Robocalls
by Sean Donelan 10 Mar '20

10 Mar '20

https://www.fcc.gov/document/chairman-pai-proposes-mandating-stirshaken-com… Federal Communications Commission Chairman Ajit Pai today proposed a major step forward to further the FCC’s efforts to protect consumers against spoofed robocalls: new rules requiring implementation of caller ID authentication using socalled “STIR/SHAKEN” technological standards. STIR/SHAKEN enables phone companies to verify the accuracy of caller ID information that is transmitted with a call. Industry-wide implementation would reduce the effectiveness of illegal spoofing, allow law enforcement to identify bad actors more easily, and help phone companies identify calls with illegally spoofed caller ID information before those calls reach their subscribers. The FCC will vote on these new rules during its Open Meeting on March 31.

17 33

GTT Contact
by Nikolas Geyer 09 Mar '20

09 Mar '20

Hello. Can someone on list from GTT contact me? You are advertising prefixes that do not belong to you and have no authority to do so. Have spent weeks with INOC including a “tier 2” escalation with no resolution. Thanks, Nik.

2 1

Hi-Rise Building Fiber Suggestions
by Norman Jester 09 Mar '20

09 Mar '20

I’m in the process of choosing hardware for a 30 story building. If anyone has experience with this I’d appreciate any tips. There are two fiber pairs running up the building riser. I need to put a POE switch on each floor using this fiber. The idea is to cut the fiber at each floor and insert a switch and daisy chain the switches together using one pair, and using the other pair as the failover side of the ring going back to the source so if one device fails it doesn’t take the whole string down. The problem here is how many switches can be strung together and I would not try more than 3 to 5. This is not something I typically do (stacking switches). I have fears of STP and/or RSTP issue stacking past Ethernet switch to switch limits (if they still exist??) Is there a device with a similar protocol as the old 3com (now HP IDF) stacking capability via fiber? I’d like to use something inexpensive as its to power ubiquiti wifi on each floor. Ideally if you know something I don’t about ubiquiti switches that can do this I’d appreciate knowing. Norman

24 44