- Test - lists.nanog.org

Re: ATTBI refuses to do reverse DNS?
by Lou Katz 19 Jun '02

19 Jun '02

Thanks for all the hints. I did not mean to trigger a flame war. ----- Forwarded message from "Robert A. Hayden" <rhayden(a)geek.net> ----- Date: Tue, 18 Jun 2002 16:13:07 -0500 (CDT) From: "Robert A. Hayden" <rhayden(a)geek.net> Subject: Re: ATTBI refuses to do reverse DNS? To: Lou Katz <lou(a)metron.com> Cc: <nanog(a)merit.edu> GAH! Sorry, bad typo. On Tue, 18 Jun 2002, Robert A. Hayden wrote: > > Most providers provide some kind for forward/reverse mapping, including > ATTBI. Often, however, they do provide customized reverse mapping (ie, ^^ do not > myhost.mydomain.com) That may be where the disconnect. > > I believe that ATTBI has a script that auto-generates forward/reverse > mappings on a regular basis. You client may be just in a waiting period > before the problem corrects itselft. I <naively?> hope that your suggestion turns out to be the case. In any event, I can do stuff which absolutely does not scale. My client needs ftp access to his website, and I do not allow anonymous ftp. I just set up a local DNS to give (consistent) local forward and reverse mapping for his IP-de-jour, and he was then able to get in. If his DHCP lease changes, I will just make another entry for him. Requiring working reverse DNS in this case (the Paranoid setting in ftpaccess) keeps down the noise level from the automatic door knob twisters. I (obviously?) do not block SMTP or HTTP access for no reverse lookup. YMMV ----- End forwarded message ----- -- -=[L]=-

1 0

ICANN requirement for "information refreshing"?
by Howard C. Berkowitz 19 Jun '02

19 Jun '02

I just received an email from Verisign customer service requesting I "refresh my information:" on an active domain that doesn't expire until 2004. My concern is that the request specifically stated ICANN required them to do this. On searching the ICANN-Verisign contract at the ICANN site, I could find no requirement for refreshing. I'm concerned this may be a covert marketing activity, since the web page for "refreshing" very easily could have led me into buying services from Verisign. This seems to be of operational interest to service providers hosting domains, if Verisign/Netsol can confuse people into shifting their service to them. Am I completely off base here? Is there some ICANN requirement I've missed?

13 16

RE: remember the "diameter of the internet"?
by Martin, Christian 19 Jun '02

19 Jun '02

>> When ANY router becomes as reliable as a dumb TDM device, then maybe >> we can begin collapsing the POP topology. However, the very >nature of >> the Internet almost prevents this reliability from being achieved >> (having a shared control and data plane seems to be the primary >> culprit). > >Uhm. Actually, control & data planes are rather separate >inside modern routers. What is flaky is router software. >That's what you get when your router vendor sells you 1001 way >of screwing up your routing :) Router hardware can be pretty flaky as well... ;) I was more referring to the nature of IP. With the exception of IS-IS, all IP control plane protocols are subject to abuse/attack by the same data plane that they are intending to control. > >> There are routers out there today that can single-handedly replace >> entire POPs at a fraction of the rack, power, and operational cost. >> Hasn't happened, tho. > >I know two boxes like that - one is broken-as-designed, with copper >distributed fabric; another (courtesy of VCs who managed to >lose nearly >entire engineering team mid-way but hired a bunch of marketers >long before >there was anything to ship) is still in beta. Ouch. >> I don't like wasting ports for redundant n^2 or log(n^2) >interconnect >> either, but router and reliability mix like oil and water... > >Actually, not. A router is a hell of a lot simpler than a >Class-5 switch, >particularly if you don't do ATM, FR, X.25, MPLS, QoS, >multicast, IPv6, >blah, blah, blah. There are opponents to this assertion. I haven't seen enough of what's in the sausage to make a firm statement either way. What I do know is that the class-5 switch is designed to save lives. A router is designed to fill vendor wallets. That, coupled with experience in the field suggests, coupled with dogma and the high-level of sensitivty to being burned repeatedly, suggests that the trend for chassis redundancy requiring massive amounts of wasted space, unnecessary hierarchy, and added complexity to continue. Ces't la Vie! >Demonstrably (proof by existence), those switches can be made >reasonably reliable. So can be routers. It's the fabled >computer tech culture of "be crappy, ship fast, pile features >sky high, test after you ship" aka OFRV's Micro$oft envy, >which is the root evil. Yep! -chris > >--vadim >

1 0

Re: 39/8 ?
by Andre Chapuis 19 Jun '02

19 Jun '02

Steve, I do not have 39/8 in my routing-table... (AS3303) André At 17:10 19.06.2002 +0100, Stephen J. Wilcox wrote: >Argh replying to my own post! :) > >Sorry, I can find AS4554 I typo'd my whois request. > >Query still applies tho .. why is there a /8 being routed from seemingly >IANA reserved space? > >Steve > >On Wed, 19 Jun 2002, Stephen J. Wilcox wrote: > >> I'm receiving routes for 39.0.0.0/8 which is odd as IANA states this is a >> reserved block, as does arin but theres a route in radb .. >> >> I cant find AS4554 either and the rDNS doesnt exist in in-addr.arpa >> >> Whats this all about then? >> >> Steve >> >> >> *>i39.0.0.0 62.24.192.1 7765 100 0 6461 4554 ? >> >> >> [whois.radb.net] >> route: 39.0.0.0/8 >> descr: Exchange Point Networks >> PO 12317 >> Marina del Rey, CA. 90295 >> US >> origin: AS4554 >> mnt-by: MNT-EPNET >> changed: bmanning(a)karoshi.com 20020401 >> source: ARIN >> >> [whois.arin.net] >> IANA (RESERVED-39A) >> Internet Assigned Numbers Authority >> 4676 Admiralty Way, Suite 330 >> Marina del Rey, CA 90292-6695 >> US >> >> Netname: RESERVED-39A >> Netblock: 39.0.0.0 - 39.255.255.255 >> >> Coordinator: >> Internet Corporation for Assigned Names and Numbers >> (IANA-ARIN) res-ip(a)iana.org >> (310) 823-9358 >> >> Domain System inverse mapping provided by: >> >> FLAG.EP.NET 198.32.4.13 >> DOT.EP.NET 198.32.2.10 >> >> --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 ---------------------

3 2

RE: 39/8 ?
by Kris Foster 19 Jun '02

19 Jun '02

I'm not seeing 39/8 in my tables due to proper filtering.. however: route-views.oregon-ix.net>sh ip bgp 39.0.0.0 BGP routing table entry for 39.0.0.0/8, version 5664884 Paths: (5 available, best #5) Advertised to non peer-group peers: 64.166.72.140 16150 8434 8918 6461 6461 4554 217.75.96.60 from 217.75.96.60 (217.75.96.60) Origin incomplete, localpref 100, valid, external 7500 2516 4554 202.249.2.86 from 202.249.2.86 (210.173.176.242) Origin incomplete, localpref 100, valid, external 3333 12859 6461 4554 193.0.0.56 from 193.0.0.56 (193.0.0.56) Origin incomplete, localpref 100, valid, external 1668 6461 4554 66.185.128.48 from 66.185.128.48 (66.185.128.48) Origin incomplete, localpref 100, valid, external 6461 4554 207.126.96.1 from 207.126.96.1 (207.126.96.1) Origin incomplete, metric 353, localpref 100, valid, external, best Community: 6461:5997 route-views.oregon-ix.net> > -----Original Message----- > From: John Palmer [mailto:nanog@adns.net] > Sent: Wednesday, June 19, 2002 12:42 PM > To: nanog(a)nanog.org > Subject: Re: 39/8 ? > > > > Perhaps there is a BOGON filter between you and AS4554. > > ----- Original Message ----- > From: "Andre Chapuis" <chapuis(a)ip-plus.net> > To: "Stephen J. Wilcox" <steve(a)opaltelecom.co.uk>; <nanog(a)merit.edu> > Sent: Wednesday, June 19, 2002 11:14 AM > Subject: Re: 39/8 ? > > > > Steve, > I do not have 39/8 in my routing-table... > (AS3303) > André > > At 17:10 19.06.2002 +0100, Stephen J. Wilcox wrote: > > >Argh replying to my own post! :) > > > >Sorry, I can find AS4554 I typo'd my whois request. > > > >Query still applies tho .. why is there a /8 being routed > from seemingly > >IANA reserved space? > > > >Steve > > > >On Wed, 19 Jun 2002, Stephen J. Wilcox wrote: > > > >> I'm receiving routes for 39.0.0.0/8 which is odd as IANA > states this is a > >> reserved block, as does arin but theres a route in radb .. > >> > >> I cant find AS4554 either and the rDNS doesnt exist in in-addr.arpa > >> > >> Whats this all about then? > >> > >> Steve > >> > >> > >> *>i39.0.0.0 62.24.192.1 7765 100 > 0 6461 4554 ? > >> > >> > >> [whois.radb.net] > >> route: 39.0.0.0/8 > >> descr: Exchange Point Networks > >> PO 12317 > >> Marina del Rey, CA. 90295 > >> US > >> origin: AS4554 > >> mnt-by: MNT-EPNET > >> changed: bmanning(a)karoshi.com 20020401 > >> source: ARIN > >> > >> [whois.arin.net] > >> IANA (RESERVED-39A) > >> Internet Assigned Numbers Authority > >> 4676 Admiralty Way, Suite 330 > >> Marina del Rey, CA 90292-6695 > >> US > >> > >> Netname: RESERVED-39A > >> Netblock: 39.0.0.0 - 39.255.255.255 > >> > >> Coordinator: > >> Internet Corporation for Assigned Names and Numbers > >> (IANA-ARIN) res-ip(a)iana.org > >> (310) 823-9358 > >> > >> Domain System inverse mapping provided by: > >> > >> FLAG.EP.NET 198.32.4.13 > >> DOT.EP.NET 198.32.2.10 > >> > >> > > --------------------- > Andre Chapuis > IP+ Engineering > Swisscom Ltd > Genfergasse 14 > 3050 Bern > +41 31 893 89 61 > chapuis(a)ip-plus.net > CCIE #6023 > --------------------- > > > >

1 0

BGP communities usage for route origin, entry point
by Thomas Kernen 19 Jun '02

19 Jun '02

This started off as me being curious as to why a UUNet engineer I was talking to told me he could not understand why a network would support a feature such as BGP communities for identifying the origin of a route/network entry point. I tried to explain to him the advantage of being able to quickly identify where a route originates from (geographically), type of interconnect, type of "peer" (in this case I use peer for any BGP peer, customer or transit). I explained that it could be usefull for debugging and gaining more background info (route analysis is one of my favorite tasks) and some of the major and minor networks do provide such a feature/service. Still the engineer could not understand why and only saw this as a security issue, well I guess when you work for a network that does not provide any public looking glass or route server it's not really a surprise </rant> This triggered a thought, do many people actually use BGP communities to pinpoint a route origination point/type, and if so for what purpose (debugging, analysis, other) Thomas PS: If UUNet do actually support this feature please tell me who I should contact.

5 4

RE: ATTBI refuses to do reverse DNS?
by Rowland, Alan D 19 Jun '02

19 Jun '02

As an ATTBI customer in this exact situation, Yeah! Also remember, we're talking legacy cable (monopolist) mindset in most cases. I've already long-ago voted with DirecTV and an analog antenna in my attic, but DirecWay is only competitive (price and latency) if the only other option is dialup or less. Best, -Al BTW, the TV system is HDTV/Surround. How many cable systems support that? -----Original Message----- From: Chris Woodfield [mailto:rekoil@semihuman.com] Sent: Wednesday, June 19, 2002 7:38 AM To: North America Network Operators Group Mailing List Subject: Re: ATTBI refuses to do reverse DNS? If the people who "vote with their wallets" here are the ATTBI customers, don't forget that if you're not served by DSL, cable broadband is really the only good option for broadband access (I'm not counting satellite, with >1s ping times, or wireless, which is still in its infancy as a residential solution). And rarely will you find a home anywhere in the US served by more than one cable company. Makes it kinda kard to vote with your wallet when the vendor has de facto monopoly power. -C > The people who are supposedly hurt here are those who ultimately have > the most influence. In the end they can vote with their wallets even if > they can't edit the appropriate zone files directly. (And the whole > idea behind DNS trust really revolves around having two different > parties agree on the mapping, not in simply allowing the user to edit > their own reverse DNS!) > > > Just as > > Network Address Translation is not a security solution, neither is checking > > INADDR. > > I don't think anyone has said that DNS consistency is a security > solution. You keep confusing these concepts I think. It's only one > tiny part of the picture. Fully consistent DNS only increases the level > of trust you can have in the hostnames used. Since hostnames are > supposed to be more stable than IP addresses, you _want_ to have more > trust in the hostnames, but with current protocols you cannot unless > there is full consistency between forward and reverse lookups. > > > Now if you check INADDR over Secure DNS, you might start having > > some level of information to trust. > > We can only hope, but I'll believe it when I see it. > > -- > Greg A. Woods > > +1 416 218-0098; <gwoods(a)acm.org>; <g.a.woods(a)ieee.org>; <woods(a)robohack.ca> > Planix, Inc. <woods(a)planix.com>; VE3TCP; Secrets of the Weird <woods(a)weird.com>

1 0

RE: D.C. area based ISP's unite
by Mark Segal 19 Jun '02

19 Jun '02

For those of you in BroadNet, we have a similar thing in Canada, works quite well.. Check out CAIP http://www.caip.ca, However, fighting the ILECs is just one of its mandates.. Mark -- Mark Segal Director, Data Services Futureway Communications Inc. Tel: (905)326-1570 > -----Original Message----- > From: Irwin Lazar [mailto:ILazar@burtongroup.com] > Sent: June 18, 2002 10:22 PM > To: 'nanog(a)merit.edu' > Subject: D.C. area based ISP's unite > > > > FYI: > > o ISPs Form DC-based Organization To Battle Large Telecom > Firms Washington, DC -- About 200 Internet service providers > (ISPs) from around the country have formed a new organization > based in Washington DC that will battle against what they > call "monopolistic local telephone companies" regarding the > future deployment of broadband. The new DC-based > organization, called The BroadNet Alliance, plans to lobby > the federal government on behalf of smaller ISPs. "How > America chooses to deploy broadband is one of the most > central policy issues of our time. Though there are many > voices on the traditional long distance, cable and local > telephone sides, the country's independent broadband > providers have lacked a clear voice in the debate," said > Maura Colleton, Executive Director of BroadNet. http://www.newsalert.com/bin/story?StoryId=Cpq6WqbWbrenuvtaYoq&FQ

1 0

v6
by Randy Bush 19 Jun '02

19 Jun '02

so i have a local address # ifconfig wi0 wi0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 inet6 fe80::260:1dff:fe23:c352%wi0 prefixlen 64 scopeid 0x6 inet 192.35.167.202 netmask 0xfffffc00 broadcast 192.35.167.255 ether 00:60:1d:23:c3:52 media: IEEE 802.11 Wireless Ethernet autoselect (DS/11Mbps) status: associated ssid nanog 1:"" stationname roam.psg.com channel 11 authmode OPEN powersavemode OFF powersavesleep 100 wepmode OFF weptxkey 1 and can ping the local exit # ping6 fe80::208:a3ff:fe8b:b5c2%wi0 PING6(56=40+8+8 bytes) fe80::260:1dff:fe23:c352%wi0 --> fe80::208:a3ff:fe8b:b5c2%wi0 16 bytes from fe80::208:a3ff:fe8b:b5c2%wi0, icmp_seq=0 hlim=64 time=55.512 ms 16 bytes from fe80::208:a3ff:fe8b:b5c2%wi0, icmp_seq=1 hlim=64 time=3.012 ms though the rtt is a bit scary but i am not getting a global address randy

18 32

Re: ATTBI refuses to do reverse DNS?
by Jared Mauch 19 Jun '02

19 Jun '02

On Tue, Jun 18, 2002 at 06:20:44PM -0700, Patrick Thomas wrote: > Once again, thanks for imposing your conveniences on me, and for > ARBITRARILY _breaking the network_ when I choose not to participate. It > is arbitrary because you and I both know there is no technical reason to > discriminate against non-named hosts. Actually there is. statistically speaking these hosts tend to be less well maintained and more likely the source of spam, amongst other things. This is only used on smtp here. It's not like i'm running a dynamic bgp feed that injects a /32 null0 route for someone who has no reverse dns. This method was not reached arbitrarily. after many years of "hey, this host is an open-relay", attempting to contact the rfc2142 prescribed contacts as well as those stored at arin/ripe/apnic to resolve the issue. These people are either real rogue hosts, or people that don't understand why they need such fancy services as dns. I seriously think this has to do with clue dilution and the "diameter of the internet thread" as with the treatment of the internet as a comodity as it has become, there are less incentives to get it right rather than get the service on to bill the customer. There are some days I wish it was (yes, there were others, but..) back to the original few (ANS, uunet, SprintLink, internetMCI) as one could expect a particular level of service and competence out of ones provider. As for the original issue, i encourage ATTBI (as well as all providers) to provide some sort of reverse dns for their netblocks be it unknown.level3.net, or 1-2-3-4.rev.example.com. - Jared > > --PT > > On Tue, 18 Jun 2002, Jared Mauch wrote: > > > And it will continue to work that way. > > > > That is the quality work of the people who spend many > > man-hours putting together such a system that is robust enough > > that when i decide that when you send me e-mail (not via a list) > > from a host that has no reverse dns, i can easily flag that for > > further scrutiny. > > > > What you are missing here is that, while yes, you can > > send e-mail from root(a)[1.2.3.4] to people, they may say "hmm, e-mail > > from an ip address is not typical of the people that i communicate > > with", and therefore treat it differntly. just like policy-routing > > but for your mailbox. > > > > it is a good reflection of provider clue(tm). even if they > > have rev-192.168.0.1.example.com. as their reverse dns, it's slightly > > more responsible (imho) than nothing/nxdomain. > > > > - jared > > > > On Tue, Jun 18, 2002 at 05:48:29PM -0700, Patrick Thomas wrote: > > > > > > Hi - what if I don't _want_ a domain name ? Last time I checked all of > > > the standard Internet protocols worked just fine with just an IP - thank > > > you for imposing your own sense of expediency and "convenience" on me and > > > then arbitrarily breaking the network for me when I choose not to > > > participate. > > > > > > --PT > > > > > > On Tue, 18 Jun 2002, Jared Mauch wrote: > > > > > > > > > > > On Tue, Jun 18, 2002 at 04:54:54PM -0500, Stephen Sprunk wrote: > > > > > > > > > > Thus spake "Stephen Griffin" <stephen.griffin(a)rcn.com> > > > > > > The lack of clue tends to be on the providing in-addr side of > > > > > > things. I think it is a great thing to refuse connections from > > > > > > ips without in-addr, in the same way it is great to refuse mail > > > > > > from domains that don't provide postmaster addresses. > > > > > > > > > > On first reading, I thought that was sarcasm. Now I realize you're serious. > > > > > > > > I've found that filtering out mail from > > > > people that have no reverse dns tends to typically point to > > > > a) open-relays, b) spam, c) lack of working abuse/postmaster. > > > > > > > > > > It is a means through which one can influence the laziness of > > > > > > others. Simply disregarding what others do, only legitimizes > > > > > > the laziness, and continues us along the road of everyone > > > > > > doing the absolute minimum. > > > > > > ... > > > > > > You neglect to include the option of the customer changing > > > > > > to an ISP that provides in-addr. > > > > > > > > > > So, if you ran Amazon.com, you wouldn't accept money from customers of clueless > > > > > ISPs? > > > > > > > > You can't do it on the store side, but you can do it on the > > > > residental customer side, or at least give those messages a higher > > > > level of attention in any overall spam score for a message. > > > > > > > > > Sadly, even that level of coercion wouldn't be anywhere near enough to motivate > > > > > most ISPs. And your (non-)customers will be caught in the crossfire. > > > > > > > > Anyone that sends e-mail to me from a host/server with no reverse > > > > dns I will not see. It is not rejected w/ 400/500 series code > > > > as I know some people do. it goes to it's own 'spam' folder. > > > > > > > > I have found that some companies (american express) for > > > > example can not seem to make their systems have reverse dns, and > > > > they suffer from the lack of a working postmaster/hostmaster > > > > address too. > > > > > > > > It just means i read that folder once every few days and > > > > periodically send e-mail to people i know that have hit the filter > > > > or other legit folks. > > > > > > > > - jared > > > > > > > > -- > > > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > > > > > > > > > > -- > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0