- NLNOG - mailman3.nlnog.net

RPKI certification & BGPMON add-in
by alexb＠ripe.net 20 Apr '11

20 Apr '11

Doorgestuurd op verzoek van Mark Meijerink. -----Original Message----- From: Mark Meijerink Sent: Wednesday, April 20, 2011 1:26 PM To: 'Erik Bais'; NLNOG at nlnog.net Cc: Andree at bgpmon.net; Alex Band Subject: RE: RPKI certification & BGPMON add-in Erik, Binnen het Research On Networks(RON) project van SURFnet heb ik hier vanuit SARA naar gekeken en heb ik ook deel genomen aan aan de RIPE Certification Task Force. In die tijd ook zelf de ROA's aangemaakt voor onze eigen prefixen en de portal getest. Dit werkte op zich allemaal redelijk eenvoudig inderdaad. Ik ben op dit moment echter niet meer actief betrokken bij de RIPE Certification Task Force maar volg de ontwikkelingen nog wel. De implementatie van Andree is een eerste aanzet voor het kunnen verifi?ren van de route origin. En zeker bruikbaar voor een eerste handmatige controle van prefixes. Het het is nu wachten op een implementatie in de routeing software van routers. Wij zouden het denk ik in eerste instantie gaan gebruiken voor het verifi?ren van de BGP prefixes van onze IP transit klanten. Hoe het daarna precies verder ingezet zal gaan worden is nog niet geheel duidelijk. Mvg, Mark -----Original Message----- From: nlnog-bounces at nlnog.net [mailto:nlnog-bounces@nlnog.net] On Behalf Of Erik Bais Sent: Wednesday, April 20, 2011 11:10 AM To: NLNOG at nlnog.net Cc: Andree at bgpmon.net; Alex Band Subject: [Nlnog] RPKI certification & BGPMON add-in Hoi, Ik heb gisteren even zitten te twitteren met Andree Tonk van BGPMon.net, nadat ik gelezen had dat hij druk bezig is met het implementeren van RPKI route validation. Voorbeeld : whois -h bgpmon.net 46.244.0.0/17| grep RPKI De RPKI certification is iets wat je via de RIPE LIR portal kan instellen voor je eigen PA prefixes. Dat kost je een kleine 5 tot 10 minuten omdat even in te regelen. Meer info : http://ripe.net/certification/ Mijn vragen hier: * Heb je al eens naar Resource certification gekeken ? * Heb je je eigen prefixes al via de LIR portal onder een ROA gezet ? * Ben je op de hoogte dat er een RIPE policy proposal mbt RPKI momenteel ter goedkeuring ligt bij de address-policy-wg @ RIPE ? (http://www.ripe.net/ripe/policies/proposals/2008-08 ) o Wat is je mening hierover ? En ben je op de komende RIPE meeting (mei 2011 - Amsterdam) aanwezig waar dit verder besproken gaat worden ? * Denk je dat je zelf dit systeem zou gaan gebruiken om: o Routes van klanten te checken voordat je transit voor ze gaat verzorgen. o Routes van je peers / transits te checken. Persoonlijk zou ik zelf graag zien dat RPKI zsm in een RIPE policy wordt overgenomen, om daarna zsm ook PI te gaan ondersteunen, aangezien de kans groter is dat iemand met rare prefixes aankomt zetten die geen PA zijn. Mvg, Erik Bais Ps. Ik heb zowel Alex Band (de product manager mbt RPKI bij RIPE) en Andree Toonk (BGPMon.net) in cc gezet. Ik weet niet of ze ook via de maillijst kunnen mailen. _______________________________________________ NLNOG mailing list NLNOG at nlnog.net http://mailman.nlnog.net/mailman/listinfo/nlnog

1 0

IN-ADDR.ARPA Nameserver Change Complete
by joe.abley＠icann.org 24 Mar '11

24 Mar '11

IN-ADDR.ARPA NAMESERVER CHANGE COMPLETE This is a courtesy notification of the completion of a change to the nameserver set for the IN-ADDR.ARPA zone. There is no expected impact on the functional operation of the DNS due to this change. There are no actions required by DNS server operators or end users. For more information about this work, please see <http://in-addr-transition.icann.org/>. DETAIL The IN-ADDR.ARPA zone is used to provide reverse mapping (number to name) for IPv4. The servers which now provide authoritative DNS service for the IN-ADDR.ARPA zone are as follows: A.IN-ADDR-SERVERS.ARPA (operated by ARIN) B.IN-ADDR-SERVERS.ARPA (operated by ICANN) C.IN-ADDR-SERVERS.ARPA (operated by AfriNIC) D.IN-ADDR-SERVERS.ARPA (operated by LACNIC) E.IN-ADDR-SERVERS.ARPA (operated by APNIC) F.IN-ADDR-SERVERS.ARPA (operated by RIPE NCC) All root servers dropped the IN-ADDR.ARPA zone according to the schedule posted earlier, and all root servers now respond to queries under IN-ADDR.ARPA with an appropriate referral. Note that as part of this transition, the IN-ADDR.ARPA zone is now signed with DNSSEC and a complete chain of trust now exists from the root zone to the IN-ADDR.ARPA zone. IP6.ARPA, the corresponnding zone for IPv6 reverse mapping, was signed similarly some time ago. Regards, Joe Abley Director DNS Operations ICANN

1 0

Dell PE 1950 railkits gezocht
by arjan＠vanderoest.net 17 Feb '11

17 Feb '11

Hoi, Heeft er iemand nog oude PE 1950 railkits liggen die eigenlijk naar de stort zouden moeten? Ik heb hier een paar van die machines, heb zelf een stapel railkits maar niet geschikt voor de PE1950. Er zijn diverse modellen (fixed, rapid, sliding) maar ze hebben allemaal hetzelfde concept bij de 1950 (en anderen, bv de R3x0): drie gaten in de rails links en rechts waar de server in 'valt'. Op de server zelf zitten alleen drie nokken aan elke kant. Ik zoek 4 kitjes, maar elk aantal is welkom. Replies mogen buiten de lijst om. Arjan

1 0

Root Zone DNSSEC KSK Ceremony 4 Completed
by joe.abley＠icann.org 08 Feb '11

08 Feb '11

KSK CEREMONY 4 The fourth KSK ceremony for the root zone took place in El Segundo, CA, USA on Monday 2011-02-07. The Ceremony Administrator was Mehmet Akcin. The ceremony was completed successfully. Video from Ceremony 4 was recorded for audit purposes. Video and associated audit materials will be published in 1 to 2 weeks, and will be available as usual by following the "KSK Ceremony Materials" link at <https://www.iana.org/dnssec/>. Ceremony 4 included processing of a Key Signing Request (KSR) generated by VeriSign, and the resulting Signed Key Response (SKR) contained signatures for Q2 2011, for use in the root zone between 2011-04-01 and 2011-07-05. CONTACT INFORMATION We'd like to hear from you. If you have feedback for us, please send it to rootsign at icann.org.

1 0

Root Zone DNSSEC KSK Ceremony 4 (UTC correction)
by joe.abley＠icann.org 07 Feb '11

07 Feb '11

> KSK CEREMONY 4 > > The fourth KSK ceremony for the root zone will take place in El > Segundo, CA, USA on Monday 2011-02-07. The ceremony is scheduled > to begin at 1300 local time (1700 UTC) and is expected to end by > 1900 local time (2300 UTC). Apologies for the time zone miscalculation. El Segundo is in the Pacific time zone, UTC-8. The ceremony is scheduled to begin at 1300 local time (2100 UTC) and is expected to end by 1900 local time (2011-02-08 0300 UTC). Joe

1 0

Root Zone DNSSEC KSK Ceremony 4
by joe.abley＠icann.org 07 Feb '11

07 Feb '11

KSK CEREMONY 4 The fourth KSK ceremony for the root zone will take place in El Segundo, CA, USA on Monday 2011-02-07. The ceremony is scheduled to begin at 1300 local time (1700 UTC) and is expected to end by 1900 local time (2300 UTC). Video from Ceremony 4 will be recorded for audit purposes. Video and associated audit materials will be published 1 to 2 weeks after the ceremony, and will be available as usual by following the "KSK Ceremony Materials" link at <https://www.iana.org/dnssec/>. ICANN will operate a separate camera whose video will not be retained for audit purposes, but which will instead be streamed live in order to provide remote observers an opportunity to watch the ceremony. The live stream will be provided on a best-effort basis. The live video stream will be available at <http://dns.icann.org/ksk/stream/>. Ceremony 4 will include processing of a Key Signing Request (KSR) generated by VeriSign, and the resulting Signed Key Response (SKR) will contain signatures for Q2 2011, for use in the root zone between 2011-04-01 and 2011-07-05. CONTACT INFORMATION We'd like to hear from you. If you have feedback for us, please send it to rootsign at icann.org.

1 0

Five /8s allocated to RIRs - no unallocated IPv4 unicast /8s remain
by leo.vegoda＠icann.org 03 Feb '11

03 Feb '11

Hi, The IANA IPv4 registry has been updated to reflect the allocation of five /8 IPv4 blocks: one to each RIR, in February 2011. You can find the updated IANA IPv4 registry at: http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.txt Please update your filters as appropriate. There are no more unallocated unicast IPv4 /8s in the IANA IPv4 Address Space Registry. Kind regards, Leo Vegoda Number Resources Manager, IANA ICANN

1 0

39/8 and 106/8 allocated to APNIC
by leo.vegoda＠icann.org 01 Feb '11

01 Feb '11

Hi, The IANA IPv4 registry has been updated to reflect the allocation of two IPv4 /8 blocks to APNIC in January 2011: 39/8 and 106/8. 39/8 APNIC 2011-01 whois.apnic.net ALLOCATED 106/8 APNIC 2011-01 whois.apnic.net ALLOCATED You can find the IANA IPv4 registry at: http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.txt Please update your filters as appropriate. Only five unallocated unicast IPv4 /8s remain. Regards, Leo Vegoda Number Resources Manager, IANA ICANN

1 0

Planned IN-ADDR.ARPA Nameserver Change
by joe.abley＠icann.org 31 Jan '11

31 Jan '11

PLANNED IN-ADDR.ARPA NAMESERVER CHANGE This is a courtesy notification of an upcoming change to the nameserver set for the IN-ADDR.ARPA zone. There is no expected impact on the functional operation of the DNS due to this change. There are no actions required by DNS server operators or end users. For more information about this work, please see <http://in-addr-transition.icann.org/>. DETAIL The IN-ADDR.ARPA zone is used to provide reverse mapping (number to name) for IPv4. The servers which currently provide authoritative DNS service for the IN-ADDR.ARPA zone are as follows: A.ROOT-SERVERS.NET B.ROOT-SERVERS.NET C.ROOT-SERVERS.NET D.ROOT-SERVERS.NET E.ROOT-SERVERS.NET F.ROOT-SERVERS.NET G.ROOT-SERVERS.NET H.ROOT-SERVERS.NET I.ROOT-SERVERS.NET K.ROOT-SERVERS.NET L.ROOT-SERVERS.NET M.ROOT-SERVERS.NET On Wednesday 2010-02-16 processing will begin to change the nameserver set to the following, as described in RFC 5855: A.IN-ADDR-SERVERS.ARPA (operated by ARIN) B.IN-ADDR-SERVERS.ARPA (operated by ICANN) C.IN-ADDR-SERVERS.ARPA (operated by AfriNIC) D.IN-ADDR-SERVERS.ARPA (operated by LACNIC) E.IN-ADDR-SERVERS.ARPA (operated by APNIC) F.IN-ADDR-SERVERS.ARPA (operated by RIPE NCC) The usual IANA process for a change in the ARPA zone involves a series of technical checks and the gathering of various authorisations, and may take several days to complete. Following this, the IN-ADDR.ARPA zone will be dropped from root servers in two groups: 1. Week of 2011-02-21 -- 2011-02-25 B, C, E, G, I, M 2. Week of 2011-02-28 -- 2011-03-11 A, D, F, H, K, L Individual root server operators will choose a time for the maintenance within their respective window and follow their usual procedures to carry out the change. Courtesy notification will be sent to this list once this change has been fully implemented. Regards, Joe Abley Director DNS Operations ICANN

1 0

NLNOG RING Project
by job＠instituut.net 18 Jan '11

18 Jan '11

Beste mannen en vrouwen, Mij viel op dat veel Nederlandse network operators op vriendschappelijke basis met elkaar toegang tot servers uitwisselen om traceroutes en pings te kunnen uitvoeren vanaf 'buiten je netwerk'. Afgelopen december heb ik met een aantal mensen uit de community een concept opgezet genaamd "NLNOG RING". Het idee van deze ring is om op een georganiseerde manier shell access met elkaar uit te wisselen om netwerk problemen sneller te kunnen lokaliseren en op te lossen. De deal is simpel: "stel een machine beschikbaar aan de ring, en krijg toegang tot alle servers op de ring". Dit voorbeeld laat zien hoe ik de ring gebruik om een traceroute te doen vanaf tien verschillende autonomous systems: http://paste.pocoo.org/show/322928/ Meer informatie is te vinden op de website van het NLNOG RING Project: http://ring.nlnog.net/ Organisaties die ge?nteresseerd zijn kunnen met mij contact opnemen om te participeren. Met vriendelijke groeten, Job Snijders -- Snijders IT web: http://snijders-it.nl tel: +31 6 54942365 volg nu de zaak op http://twitter.com/SnijdersIT !

1 0