- NLNOG - NLNOG

Root Zone DNSSEC Deployment Technical Status Update
by joe.abley＠icann.org 03 May '10

03 May '10

Root Zone DNSSEC Deployment Technical Status Update 2010-05-03 This is the fifth of a series of technical status updates intended to inform a technical audience on progress in signing the root zone of the DNS. ** The final transition to the DURZ will take place on ** J-Root, on 2010-05-05 between 1700--1900 UTC. ** ** After that maintenance all root servers will be serving the ** DURZ, and will generate larger responses to DNS ** queries that request DNSSEC information. ** ** If you experience technical problems or need to contact ** technical project staff, please send e-mail to rootsign at icann.org ** or call the ICANN DNS NOC at +1 310 301 5817, e-mail preferred ** if possible. ** ** See below for more details. RESOURCES Details of the project, including documentation published to date, can be found at <http://www.root-dnssec.org/>. We'd like to hear from you. If you have feedback for us, please send it to rootsign at icann.org. DEPLOYMENT STATUS The incremental deployment of DNSSEC in the Root Zone is being carried out first by serving a Deliberately Unvalidatable Root Zone (DURZ), and subsequently by a conventionally signed root zone. Discussion of the approach can be found in the document "DNSSEC Deployment for the Root Zone", as well as in the technical presentations delivered at RIPE, NANOG, IETF and ICANN meetings. Twelve of the thirteen root servers have already made the transition to the DURZ. No harmful effects have been identified. The final root server to make the transition, J-Root, will start serving the DURZ in a maintenance window scheduled for 1700--1900 UTC on 2010-05-05. Initial observations relating to this transition will be presented and discussed at the DNS Working Group meeting at the RIPE meeting in Prague on 2010-05-06. PLANNED DEPLOYMENT SCHEDULE Already completed: 2010-01-27: L starts to serve DURZ 2010-02-10: A starts to serve DURZ 2010-03-03: M, I start to serve DURZ 2010-03-24: D, K, E start to serve DURZ 2010-04-14: B, H, C, G, F start to serve DURZ To come: 2010-05-05: J starts to serve DURZ 2010-07-01: Distribution of validatable, production, signed root zone; publication of root zone trust anchor (Please note that this schedule is tentative and subject to change based on testing results or other unforeseen factors.) A more detailed DURZ transition timetable with maintenance windows can be found in the document "DNSSEC Deployment for the Root Zone", the most recent draft of which can be found on the project web page at <http://www.root-dnssec.org/>.

1 0

DNSSEC Deployment in ARPA Children
by joe.abley＠icann.org 28 Apr '10

28 Apr '10

Colleagues, ICANN plans to begin a test deployment of DNSSEC in various zones starting on 2010-04-29: IN-ADDR-SERVERS.ARPA IP6.ARPA IP6-SERVERS.ARPA IRIS.ARPA URI.ARPA URN.ARPA These zones will be signed using RSASHA256 and NSEC with 2048-bit KSKs and 1024-bit ZSKs. Given DNSSEC deployment experience to date, ICANN does not expect the signing of these zones to cause any operational problems. However, should you have any concerns please feel free to contact us at ticket at dns.icann.org or phone +1 310 301 5810 (e-mail/ticket preferred). At the end of the test period, given no observed or reported harmful effects, ICANN will arrange for trust anchors for these zones to be included in ARPA as DS RRSets and will invite the five RIRs to submit DS RRSet add/delete requests in IP6.ARPA when they are ready. We anticipate the testing period to last at least two weeks. Regards, Joe Abley Director DNS Operations, ICANN

1 0

Posten op NLNOG
by erik＠bais.name 24 Apr '10

24 Apr '10

Hi, Ik heb begrepen van Ramses dat hij nog niet is approved op de posting lijst van NLNOG. Dat is opzich wel lekker rustig, maar wellicht is het een optie om hem na 9 jr beheer van AS20953 toch een keer op de lijst toe te laten. Mvg, Erik Bais

1 0

Root Zone DNSSEC Deployment Technical Status Update
by joe.abley＠icann.org 14 Apr '10

14 Apr '10

This is the fourth of a series of technical status updates intended to inform a technical audience on progress in signing the root zone of the DNS. RESOURCES Details of the project, including documentation published to date, can be found at http://www.root-dnssec.org/. We'd like to hear from you. If you have feedback for us, please send it to rootsign at icann.org. DOCUMENTATION The following draft document was recently published: - Resolver Testing with a DURZ - TCR - Proposed Approach to Root Key Management ICANN has begun the process of formally soliciting expressions of interest for volunteers from the technical community to act as Trusted Community Representatives. These volunteers will witness cryptographic key ceremonies and also carry out various important roles relating to KSK key management. For more information, see: http://www.icann.org/en/announcements/announcement-12apr10-en.htm Expressions of interest can be submitted here: http://www.root-dnssec.org/tcr/ DEPLOYMENT STATUS KSR exchanges continue between production platforms at VeriSign and ICANN. Build-out of KSK Key Ceremony facilities at ICANN continues, and both facilities (east- and west-coast USA) are expected to be ready on schedule. The incremental deployment of DNSSEC in the Root Zone is being carried out first by serving a Deliberately Unvalidatable Root Zone (DURZ), and subsequently by a conventionally signed root zone. Discussion of the approach can be found in the document "DNSSEC Deployment for the Root Zone", as well as in the technical presentations delivered at RIPE, NANOG, IETF and ICANN meetings. Twelve of the thirteen root servers have now made the transition to the DURZ. No harmful effects have been identified. Some early analysis of packet captures from many root servers surrounding each event was recently presented at the IETF meeting in Anaheim, CA, USA and can be found with other presentation materials at <http://www.root-dnssec.org/presentations/>. PLANNED DEPLOYMENT SCHEDULE Already completed: 2010-01-27: L starts to serve DURZ 2010-02-10: A starts to serve DURZ 2010-03-03: M, I start to serve DURZ 2010-03-24: D, K, E start to serve DURZ 2010-04-14: B, H, C, G, F start to serve DURZ To come: 2010-05-05: J starts to serve DURZ 2010-07-01: Distribution of validatable, production, signed root zone; publication of root zone trust anchor (Please note that this schedule is tentative and subject to change based on testing results or other unforeseen factors.) A more detailed DURZ transition timetable with maintenance windows can be found in the document "DNSSEC Deployment for the Root Zone", the most recent draft of which can be found on the project web page at <http://www.root-dnssec.org/>.

1 0

14/8 and 223/8 allocated to APNIC
by leo.vegoda＠icann.org 13 Apr '10

13 Apr '10

Hi, The IANA IPv4 registry has been updated to reflect the allocation of two /8 IPv4 blocks to APNIC in April 2010: 14/8 and 223/8. You can find the IANA IPv4 registry at: http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.txt Please update your filters as appropriate. The IANA free pool contains 20 unallocated unicast IPv4 /8s. Regards, Leo Vegoda Number Resources Manager, IANA ICANN

1 0

Trusted Community Representatives
by joe.abley＠icann.org 13 Apr '10

13 Apr '10

Colleagues, ICANN and VeriSign, with the support of the US Department of Commerce, continue to work towards DNSSEC deployment in the root zone of the DNS. ICANN is looking for Trusted Community Representatives (TCRs) to help us carry out various technical security operations. An announcement can be found here: <http://www.icann.org/en/announcements/announcement-12apr10-en.htm> You can submit an expression of interest here: <http://www.root-dnssec.org/tcr/> DNSSEC key ceremonies are carried out in English. TCRs must therefore have a good understanding of written and spoken English. Regards, Joe

1 0

[dave@aalderingict.nl: RE: Breedband Nederland / AS 5524 Maintenance]
by sabri＠cluecentral.net 06 Apr '10

06 Apr '10

For the record... In 15 jaar heb ik nog nooit een full table gelekt. Helaas helaas helaas voel ik me nu een beetje Theo de Raadt: Only one route-leak in a heck of a long time. Het was niet Dave z'n schuld. Ik heb verzaakt. Niet goed opgelet. U mag mij nu allemaal uitlachen. *buig* Groeten, Sabri ----- Forwarded message from Dave Aaldering <dave at aalderingict.nl> ----- Date: Fri, 2 Apr 2010 18:03:11 +0200 From: Dave Aaldering <dave(a)aalderingict.nl> To: "tech-l at ams-ix.net" <tech-l at ams-ix.net> Subject: RE: Breedband Nederland / AS 5524 Maintenance Hi Peers, So I guess we are not the Easter Bunny after all.... We had trouble with migrating to the new equipment and leaked a full table while we were at it. We did a rollback and are rescheduling maintenance. Sorry for the inconvenience this may have caused. We also caused some max-prefix limits to be tripped. Please clear your sessions if needed. For now, a great Easter weekend to all of you. I do hope you will find some eggs elsewhere ;-) Regards, Dave Aaldering -----Oorspronkelijk bericht----- Van: Raymond Dijkxhoorn [mailto:raymond at prolocation.net] Verzonden: vrijdag 2 april 2010 17:40 Aan: Dave Aaldering CC: tech-l at ams-ix.net Onderwerp: Re: Breedband Nederland / AS 5524 Maintenance Hi Dave, > Breedband Nederland (AS5524, AMS-IX ip 195.69.145.104) will be > migrating its AMS-IX connection to a different router shortly. > > This might cause a BGP flap in the progress. Please be advised. Did you plan to insert some easter eggs? You not only 'might cause' route flaps, but you also 'might cause' some routing leaks :-) You were sending a full table. Please next time be sure you are able to handle the traffic before doing so... Grin. Happy easter! Bye, Raymond. _______________________________________________ tech-l mailing list tech-l at ams-ix.net http://melix.ams-ix.net/mailman/listinfo/tech-l ----- End forwarded message ----- -- Sabri

1 0

Iemand van easynet wakker ?
by marcoh＠marcoh.net 05 Mar '10

05 Mar '10

Jullie RT doos staat al een tijdje te loopen op die blunder van eurofiber: > Subject: RE: [Easynet Benelux #70712] AutoReply: Re: [iunxi.eu #748] Re: Einde vorstverlet - Update > Date: 4 maart 2010 11:30:24 GMT+01:00 > Reply-To: support at nl.easynet.net > Return-Path: <root at easynet.nl> > Received: from smtp2.mail.be.easynet.net (smtp2.mail.be.easynet.net [212.100.160.76]) by mxdrop137.xs4all.nl (8.13.8/8.13.8) with ESMTP id o25MAQkS061826; Fri, 5 Mar 2010 23:10:27 +0100 (CET) (envelope-from root at easynet.nl) > Received: from [213.201.129.84] (helo=SRDC-MAIL-01.easynet.nl.local) by smtp2.mail.be.easynet.net with esmtp (Exim 4.71) (envelope-from <root at easynet.nl>) id 1Nnfip-0005Ai-Rk; Fri, 05 Mar 2010 23:10:15 +0100 > Received: from rtnext-prod.easynet.nl.local ([10.41.0.57]) by SRDC-MAIL-01.easynet.nl.local with Microsoft SMTPSVC(6.0.3790.1830); Thu, 4 Mar 2010 11:30:26 +0100 > Received: from www-data by rtnext-prod.easynet.nl.local with local (Exim 4.69) (envelope-from <root at easynet.nl>) id 1Nn8K0-0006Ih-M2; Thu, 04 Mar 2010 11:30:26 +0100 > In-Reply-To: <B342AC87AFFE8142B7F98C93AB619BEF1D28A616 at ESESSCMS0357.eemea.ericsson.se> > References: <RT-Ticket-70712 at nl.easynet.net> <F779066B75D13647B30FA8B4EEEC7DED010E3ABF at KL1221TC.cs.ad.klmcorp.net> <rt-3.8.1-21896-1267646050-861.70712-167-0 at nl.easynet.net> <92A4FD9CA118FF44A1033ABD29F5DDB001C44906 at hilvsmail01.eu.thmulti.com> <rt-3.8.1-21896-1267698173-1350.70712-167-0 at nl.easynet.net> <B342AC87AFFE8142B7F98C93AB619BEF1D28A616 at ESESSCMS0357.eemea.ericsson.se> > Message-Id: <rt-3.8.1-21917-1267698609-781.70712-167-0 at nl.easynet.net> Met als gevolg dat jullie niet zo heel ver meer af zitten van een static naar null0, hoop dat er niet te veel klanten in die /17 zitten. MarcoH

2 1

Ecatel AS29073 - King host SBL79302
by r.eeden＠ecatel.net 22 Feb '10

22 Feb '10

Hi, Als het goed is zou het nu moeten werken en kan ik reageren op de nl-nog mailinglist :) De domeinen die je hebt gepost stonden inderdaad gehost in ons netwerk, nadat ik te horen kreeg van jouw bericht op nlnog hebben wij het ip adres direct geblokkeerd en de klant afgesloten. Het betreft hier een dedicated server. De domeinnamen zijn niet in ons beheer, ook hebben wij tot op heden 2 klachten over de server ontvangen (beide hebben wij deze avond gehad). De spamhaus listing is van oktober 2009, het betreft een oude listing die niets te maken heeft met de server die wij zojuist hebben geblokkeerd. Wij zullen contact opnemen met spamhaus om de listing te verwijderen, tevens zullen wij een juist record aanmaken bij RIPE waarin duidelijk word aangegeven dat het blok word gebruikt voor dedicated servers met een link naar ons abuse adres. Als wij een melding op ons abuse adres hadden gehad over deze server (abuse at ecatel.net) hadden wij hem ook direct afgesloten. Ons abuse adres word 24/7 gemonitord en bij duidelijke gevallen van spam sluiten wij gelijk af (deze dus oa.) zonder de klant tijd te geven om het probleem op te lossen. Ik denk dat deze websites nog niet lang op de server stonden, anders hadden we wel eerder wat abuse meldingen gehad. Waarschijnlijk heeft de eigenaar van de spam-advertised websites ook problemen bij zijn andere provider en zoekt hij nu een snelle/tijdelijke uitweg om toch online te zijn en de boel te verhuizen. Het is immers erg makkelijk om 'even snel' een dedicated server bij ons te huren aangezien het opleveringsprocess + installatie systeem volledig geautomatiseerd is. Een nieuwe klant kan dus binnen 30 minuten met een nieuwe server online zijn. Helaas zijn er ook lui die hier misbruik van maken, wat we dus ook proberen tegen te gaan. Het is inderdaad jammer dat deze server in ons netwerk stond, maar ik denk dat wij niet de enige provider zijn die last heeft van deze problemen. Natuurlijk begrijp ik dat we wat extra aandacht krijgen omdat er in het verleden ookal de website estdomains bij ons stond (die wij overigens ook direct hebben afgesloten nadat wij hiervan op de hoogte waren gesteld). Best regards, Reinier van Eeden ECATEL (NETHERLANDS) LIMITED. +31 (0) 70 220 4015 +31 (0) 6 34 203 105 r.eeden at ecatel.net http://www.ecatel.net --- This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

1 0

Ecatel AS29073 - King host SBL79302
by raymond＠prolocation.net 22 Feb '10

22 Feb '10

Hi! Voor de zoveelste keer vinden we op Ecatel een spamHaus listing. SBL79302 ("Cybercrime & spammer hosting hub: The King Host", 94.102.63.128/25, listed 09-Oct-2009) 94.102.63.148 --> AS29073 (Ecatel, NL) inetnum: 94.102.63.128 - 94.102.63.255 netname: KINGH-NET descr: The King Host country: NL admin-c: AW137-RIPE tech-c: AW137-RIPE status: ASSIGNED PA mnt-by: ECATEL-MNT mnt-lower: ECATEL-MNT mnt-routes: ECATEL-MNT source: RIPE # Filtered person: Andrew Willson address: Honderdland 112F, 2677LT Maasdijk phone: +31174712185 abuse-mailbox: ipadmin at thekinghost.biz nic-hdl: AW137-RIPE source: RIPE # Filtered % Information related to '94.102.48.0/20AS29073' route: 94.102.48.0/20 descr: AS29073 Route object origin: AS29073 mnt-by: ECATEL-MNT source: RIPE # Filtered Enige duizenden spamvertized sites aldaar. medicalbis7 .com medicalbis5 .com medicalbis8 .com medicalbis3 .com medicalbis12 .com medicalbis4 .com medicalbis14 .com medicalbis11 .com medicalbis20 .com medicalbis16 .com sbbsfdicedmost29 .com medicalbis28 .com medicalbis29 .com medicalbis24 .com medicalbis31 .com medicalbis27 .com medicalbis10 .com medicalbis33 .com medicalbis35 .com gomedicalonl7 .com gomedicalonl9 .com gomedicalonl5 .com gomedicalonl14 .com gomedicalonl13 .com gomedicalonl19 .com gomedicalonl20 .com gomedicalonl21 .com gomedicalonl22 .com gomedicalonl23 .com gomedicalonl24 .com ... Alleen vandaag al ~ 350 unieke domeinnamen. Ecatel is al diverse keren in het nieuws geweest : http://www.ispam.nl/archives/5242/nederlandse-ecatel-opvolger-van-atrivo-en… http://www.matchent.com/wpress/?q=node/421 En een oudere nl-nog thread : http://www.nlnog.net/pipermail/nlnog/2008-September/002135.html Ik vind het redelijk frustrerend dat juist in Nederland nu de nieuwe McColo opstaat. Suggesties? Bye, Raymond.

4 4