Re: DNSSEC deployment testing and awareness (Was: Re: IPv4 ANYCAST setup)

2010-03-30 Thread Robert Kisteleki
I must observe that these are not really the links you'd want to give your 
end users to check out. Their audience is very different. While the article 
on RIPE Labs comes close, they don't really answer the does it work or does 
it not? question with a green/red light, and they don't provide a good 
explanation to the audience Randy is referring to.


Robert


On 2010.03.30. 11:29, Phil Regnauld wrote:

Randy Bush (randy) writes:


i.e. what can we do to maximize the odds that the victim will quickly
find the perp, as opposed to calling our our tech support lines?


Ah yes, there was the second good reason for actually helping netops
and security officers :)

Tools:

https://www.dns-oarc.net/oarc/services/replysizetest

https://www.dnssec-deployment.org/wiki/index.php/Tools_and_Resources,
under troubleshooting:

http://labs.ripe.net/content/testing-your-resolver-dns-reply-size-issues
http://secspider.cs.ucla.edu/

Info sheets:


http://www.afnic.fr/actu/nouvelles/240/l-afnic-invite-les-responsables-techniques-reseaux-a-se-preparer-a-la-signature-de-la-racine-dns-en-mai-2010
(click English, top right)

... plenty of links there too.

Cheers,
Phil






Re: DNSSEC deployment testing and awareness (Was: Re: IPv4 ANYCAST setup)

2010-03-30 Thread Phil Regnauld
Robert Kisteleki (robert) writes:
 I must observe that these are not really the links you'd want to
 give your end users to check out. Their audience is very different.
 While the article on RIPE Labs comes close, they don't really answer
 the does it work or does it not? question with a green/red light,
 and they don't provide a good explanation to the audience Randy is
 referring to.

Fair enough.  Some simple check your DNS reply size test [what is this 
?]
page ought to be set up, with a simple explanagtion.
checkmydns.org is available.  If I get 5 minutes... :)