Re: NXDomain remapping, DNSSEC, Layer 9, and you.

2012-05-29 Thread bmanning
On Tue, May 29, 2012 at 12:38:23PM +1000, Mark Andrews wrote: Putting it another way, the ISP doesn't want to be fooled even if it is fooling its customers. don't lie to us, but we lie to our customers. and you don't see a problem with this? /bill

Re: DNS anycasting - multiple DNS servers on same subnet Vs registrar/registry policies

2012-05-29 Thread Randy Bush
It is more important that a domain registrar not refuse to register a domain, or erroneously declare a valid listing invalid. The purpose of using a registrar is to establish DNS delegation, not to validate your site's redundancy meets the absolute best possible practices for fault

Re: NXDomain remapping, DNSSEC, Layer 9, and you.

2012-05-29 Thread Mark Andrews
In message 20120529055919.ga23...@vacation.karoshi.com., bmann...@vacation.ka roshi.com writes: On Tue, May 29, 2012 at 12:38:23PM +1000, Mark Andrews wrote: Putting it another way, the ISP doesn't want to be fooled even if it is fooling its customers. don't lie to us, but we

Re: NXDomain remapping, DNSSEC, Layer 9, and you.

2012-05-29 Thread George Herbert
On May 28, 2012, at 22:59, bmann...@vacation.karoshi.com wrote: On Tue, May 29, 2012 at 12:38:23PM +1000, Mark Andrews wrote: Putting it another way, the ISP doesn't want to be fooled even if it is fooling its customers. don't lie to us, but we lie to our customers. and you

Re: NXDomain remapping, DNSSEC, Layer 9, and you.

2012-05-29 Thread Tony Finch
Randy Bush ra...@psg.com wrote: When your browers supports DANE and a billion home nats support dnssec :( I expect there will be a depressingly large amount of DNS-over-TLS in the future in order to bypass broken ALGs. Tony. -- f.anthony.n.finch d...@dotat.at http://dotat.at/ Malin:

Re: NXDomain remapping, DNSSEC, Layer 9, and you.

2012-05-29 Thread Randy Bush
I expect there will be a depressingly large amount of DNS-over-TLS in the future in order to bypass broken ALGs. there may be a lot of foo-over-https to bypass broken nats in the core, and the edge, and whatever restrictive middleboxes political disfunction creates. because of st00pidity, we

Re: rpki vs. secure dns?

2012-05-29 Thread Stephane Bortzmeyer
On Mon, May 28, 2012 at 10:01:59PM +, paul vixie vi...@isc.org wrote a message of 37 lines which said: i can tell more than that. rover is a system that only works at all when everything everywhere is working well, and when changes always come in perfect time-order, Exactly like

Re: rpki vs. secure dns?

2012-05-29 Thread Stephane Bortzmeyer
On Mon, May 28, 2012 at 08:59:28PM +, Paul Vixie vi...@isc.org wrote a message of 43 lines which said: ROVER expects that we will query for policy at the instant of need. that's nuts for a lot of reasons, one of which is its potentially and unmanageably circular dependency on the

Re: DNS anycasting - multiple DNS servers on same subnet Vs registrar/registry policies

2012-05-29 Thread Stephane Bortzmeyer
On Mon, May 28, 2012 at 06:56:29PM -0500, Brett Frankenberger rbf+na...@panix.com wrote a message of 15 lines which said: How does your employer know if two nameservers (two IP addresses) are on the same subnet? The current heuristic for IPv4 is belongs in the same /28 (and /64 for IPv6).

Re: rpki vs. secure dns?

2012-05-29 Thread paul vixie
On 5/29/2012 10:27 AM, Stephane Bortzmeyer wrote: On Mon, May 28, 2012 at 10:01:59PM +, paul vixie vi...@isc.org wrote a message of 37 lines which said: i can tell more than that. rover is a system that only works at all when everything everywhere is working well, and when changes

Search Link between changzhou (china) and Singapore

2012-05-29 Thread Olivier CALVANO
Hi I am search a operator for a Layer 2 Link (if possible) between: Changzhou (china) Equinix Singapore anyone know operators for this ? thanks olivier

Re: NANOG Digest, Vol 52, Issue 67

2012-05-29 Thread carl gough [mobsource]
Does anyone have any intel on bandwidth trading in the usa? [carl gough] founder and CEO +61 425 266 764 mobsource .com defined by benefits not by technology Skype ­ mobsource Follow @mobsource Facebook ­ mobsource On 29/05/12 7:52 PM, nanog-requ...@nanog.org

RE: NANOG Digest, Vol 52, Issue 67

2012-05-29 Thread Nabil Sharma
Mr Karl: We use number of these service to improve delivery of our content to end users. Which service or services do you seek info for? Sincerely, Nabil Date: Tue, 29 May 2012 22:21:39 +1000 Subject: Re: NANOG Digest, Vol 52, Issue 67 From: c...@mobsource.com To: nanog@nanog.org Does

Re: DNS anycasting - multiple DNS servers on same subnet Vs registrar/registry policies

2012-05-29 Thread David Conrad
Jimmy, On May 28, 2012, at 9:58 PM, Jimmy Hess wrote: The purpose of using a registrar is to establish DNS delegation, not to validate your site's redundancy meets the absolute best possible practices for fault tolerance. Terminology nit: the purpose of a registrar is to allow folks the

Re: Comcast Service for Non-Cap Bandwidth

2012-05-29 Thread Livingood, Jason
http://news.cnet.com/8301-1023_3-57436489-93/comcast-ditches-250gb-data-cap-tests-tiered-pricing/ The cap is [recently] suspended for most subscribers and if it comes back it looks like it may be under a different policy going forward Correct - the 250GB limit is suspended while alternatives are

Re: Comcast Service for Non-Cap Bandwidth

2012-05-29 Thread Livingood, Jason
I generate http test stream with DSCP code point 5 to match the Xbox service, however Comcast is rewriting the packets as CS 1, even when serving out a server at Soft Layer (paid peer). This is why I ask for name of service Microsoft is using, it is not the regular paid peering. Yeah, that

Re: rpki vs. secure dns?

2012-05-29 Thread David Conrad
On May 29, 2012, at 4:02 AM, paul vixie wrote: i can tell more than that. rover is a system that only works at all when everything everywhere is working well, and when changes always come in perfect time-order, Exactly like DNSSEC. no. dnssec for a response only needs that response's

Re: Video streaming over IPv6

2012-05-29 Thread Carlos Martinez-Cagnazzo
As a followup on this question, I have had good success with Wowza Media Server. Thanks to those who pointed it out to me. If someone is interested in testing the IPv6 stream, drop me a note over private. Warm regards Carlos On 5/15/12 2:55 PM, Carlos Martinez-Cagnazzo wrote: Hello, Can

Re: Comcast Service for Non-Cap Bandwidth

2012-05-29 Thread Livingood, Jason
Mail formatting issue with my mail client again… Note that the 1st paragraph was quoted from Nabil... I generate http test stream with DSCP code point 5 to match the Xbox service, however Comcast is rewriting the packets as CS 1, even when serving out a server at Soft Layer (paid peer). This

Re: rpki vs. secure dns?

2012-05-29 Thread Alex Band
On 29 May 2012, at 16:21, David Conrad wrote: On May 29, 2012, at 4:02 AM, paul vixie wrote: i can tell more than that. rover is a system that only works at all when everything everywhere is working well, and when changes always come in perfect time-order, Exactly like DNSSEC. no. dnssec

Re: Comcast Service for Non-Cap Bandwidth

2012-05-29 Thread PC
Hi Nabil, DSCP tagging on inter-domain internet traffic is not expected to work (I wouldn't expect this to work at any ISP, quite frankly, absent some very special arrangements). From reading the article in the link below, it sounds like they are using DSCP to ensure when a user has maxed their

Re: rpki vs. secure dns?

2012-05-29 Thread Richard Barnes
i can tell more than that. rover is a system that only works at all when everything everywhere is working well, and when changes always come in perfect time-order, Exactly like DNSSEC. no. dnssec for a response only needs that response's delegation and signing path to work, not everything

Re: rpki vs. secure dns?

2012-05-29 Thread Alex Band
On 29 May 2012, at 18:33, Richard Barnes wrote: i can tell more than that. rover is a system that only works at all when everything everywhere is working well, and when changes always come in perfect time-order, Exactly like DNSSEC. no. dnssec for a response only needs that response's

Re: rpki vs. secure dns?

2012-05-29 Thread Richard Barnes
So in RPKI, partial data – so you failed to fetch one of the ROAs in the set – can make something 'invalid' or 'unknown' that should actually be 'valid'. http://tools.ietf.org/html/rfc6483#page-3 I wouldn't read that as saying that the RPKI requires you to have full data in order to

Re: rpki vs. secure dns?

2012-05-29 Thread David Conrad
On May 29, 2012, at 8:23 AM, Alex Band wrote: RPKI needs the full data set to determine if a BGP prefix has the status 'valid', 'invalid' or 'unknown'. It can't work with partial data. I think I now understand concerns about scaling... :-) Regards, -drc

Re: Comcast Service for Non-Cap Bandwidth

2012-05-29 Thread Chris Adams
Once upon a time, Nabil Sharma nabilsha...@hotmail.com said: I generate http test stream with DSCP code point 5 to match the Xbox service, however Comcast is rewriting the packets as CS 1, even when serving out a server at Soft Layer (paid peer). This is why I ask for name of service

[NANOG-announce] A note to all NANOG Colleagues

2012-05-29 Thread Sylvie LaPerriere
*NANOG Colleagues: Just a year ago, NewNOG, prepared for the launch of NANOG 52 under a new leadership. The journey has been filled with challenges, but also with GREAT success. We delivered on our promise to ‘not break anything’ and preserve your user experience during the transition. Mission

Re: Bogon list update for prefix for 5.1.0.0/19

2012-05-29 Thread Paul Cupis
On 28/05/12 22:19, Seth Mattinen wrote: On 5/28/12 6:31 AM, Evgeniy Aikashev wrote: We are AS21219 - PJSC Datagroup and owner of 5.1.0.0/19 block. Our customers have no access to some part of Internet if they use these IPs. Could you please update your bogon filters to permit this range. Do

Re: ISPs and full packet inspection

2012-05-29 Thread Keith McCallion
On Thu, May 24, 2012 7:36 pm, Jay Ashworth wrote: - Original Message - From: Justin M. Streiner strei...@cluebyfour.org Aside from all of the business and legal sticking points that others have mentioned, there are also the technical aspects of capturing, storing, transporting,

Re: Bogon list update for prefix for 5.1.0.0/19

2012-05-29 Thread valdis . kletnieks
On Tue, 29 May 2012 20:45:51 +0100, Paul Cupis said: On 28/05/12 22:19, Seth Mattinen wrote: On 5/28/12 6:31 AM, Evgeniy Aikashev wrote: We are AS21219 - PJSC Datagroup and owner of 5.1.0.0/19 block. Our customers have no access to some part of Internet if they use these IPs. Could you

Re: Bogon list update for prefix for 5.1.0.0/19

2012-05-29 Thread Grant Ridder
I did a tracert from my school's network on TWC: ~ Tracing route to 5-1-1-1-dynamic.retail.datagroup.ua [5.1.1.1] over a maximum of 30 hops: 5 1 ms 1 ms 1 ms esc033.escriptconnect.com [64.132.85.33] 6 4 ms 4 ms 4 ms

RE: Bogon list update for prefix for 5.1.0.0/19

2012-05-29 Thread STARNES, CURTIS
No problems tracing from AS19945. Robex.com shows 5.1.0.0/19 belonging to AS21219 Ran traceroute, mtr, and windows pathping. No problems with any of them. # traceroute -A 5.1.1.1 traceroute to 5.1.1.1 (5.1.1.1), 30 hops max, 60 byte packets 1st 3 hops snipped 4 cr83.dlstx.ip.att.net

trading bandwidth

2012-05-29 Thread carl gough [mobsource]
Thanks Nabil, Bandwidth Trading is not a new concept, but to make it work effectively it will have to address a couple of prerequisites to be successful. A network of buyers and sellers has to be created, contracted and connected for instant pricing, inventory management and delivery of a defined

RE: trading bandwidth

2012-05-29 Thread Lorell Hathcock
If you ever want a run down on how Enron did it (or didn't do it), there are several on this list who can tell you all about it. -Original Message- From: carl gough [mobsource] [mailto:c...@mobsource.com] Sent: Tuesday, May 29, 2012 4:50 PM To: Nabil Sharma; nanog@nanog.org Subject:

Re: trading bandwidth

2012-05-29 Thread Owen DeLong
IIRC, the concept was first introduced by MCI and Enron to great fanfare and subsequent graphic demonstrations of the destructive power of unregulated markets controlled by people of limited moral fortitude. Owen On May 29, 2012, at 2:50 PM, carl gough [mobsource] wrote: Thanks Nabil,

Re: trading bandwidth

2012-05-29 Thread Carlos Alcantar
Doesn't Arbinet have some sort of trading system like this currently? Carlos Alcantar Race Communications / Race Team Member 101 Haskins Way, So. San Francisco, CA. 94080 Phone: +1 415 376 3314 / car...@race.com / http://www.race.com -Original Message- From: Lorell Hathcock

Re: trading bandwidth

2012-05-29 Thread Brett Watson
On May 29, 2012, at 3:10 PM, Owen DeLong wrote: IIRC, the concept was first introduced by MCI and Enron to great fanfare and subsequent graphic demonstrations of the destructive power of unregulated markets controlled by people of limited moral fortitude. Not ALL of us were of limited moral

Re: ISPs and full packet inspection

2012-05-29 Thread Randy Bush
I am a little surprised no one has referenced Wired's recent article about Libya's Internet Surveillance systems: http://www.wired.com/threatlevel/2012/05/ff_libya/all/1 and that of ATT doing the same, alledgedly illegally, for the USG. randy

RE: Comcast Service for Non-Cap Bandwidth

2012-05-29 Thread Nabil Sharma
Mr. Jason: Thank u for the reply, very informative URL. Understood on the cap, but how long it will remain not enforced is a good guess! What I am trying to is have Comcast mark our IP ranges with QoS, so downloads or congestion inside the household will not degrade performance. You can see at

RE: Comcast Service for Non-Cap Bandwidth

2012-05-29 Thread Nabil Sharma
Adams: I would like to understand how this works. I see the Comcast VOD servers for San Francisco are in Seattle, higher round trip and route mile than our servers at Soft Layer in San Jose. We are costing Comcast less money than their own content. Signed, Nabil Date: Tue, 29 May 2012

RE: Comcast Service for Non-Cap Bandwidth

2012-05-29 Thread Nabil Sharma
PC: I also wish to know how much the Comcast Paid Peering service costs, and if this is an option that can get us the delivery we require. Could you please help me to understand why it is protected by NDA? Is there anyone on the NANOG list who can share this pricing with me in private?

Need (to acquire or sell) IPv4? Come to SpaceMarket.

2012-05-29 Thread The SpaceMarket
IPv4 is not going away as quickly as many would like. Most realistic observations show IPv4 will still be the numbering scheme most widely deployed and utilized for the next decade. This due mainly to peers and providers whom have not deployed IPv6 and ISP end-users, which continue to use,

Re: trading bandwidth

2012-05-29 Thread John Kristoff
On Tue, 29 May 2012 15:10:04 -0700 Owen DeLong o...@delong.com wrote: IIRC, the concept was first introduced by MCI and Enron to great fanfare and subsequent graphic demonstrations of the destructive power of unregulated markets controlled by people of limited moral fortitude. I thought

RE: isc - a good business

2012-05-29 Thread Nabil Sharma
Paul: Where can we read details about the services ISC provided to the FBI, and how they were compensated? As Mahatma Gandhi says: it is difficult, but not impossible, to conduct strictly honest business. Sincerely, Nabil Date: Mon, 28 May 2012 20:52:07 +0900 From: ra...@psg.com To:

Re: trading bandwidth

2012-05-29 Thread Mark Andrews
If you are going to top post ***trim*** the post especially if it is a response to a digest. The whole digest isn't needed. [600 lines trimmed] -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET:

Re: Need (to acquire or sell) IPv4? Come to SpaceMarket.

2012-05-29 Thread Timothy McGinnis
Dear Unnamed person at The SpaceMarket, This list has an Acceptable Use Policy at: http://www.nanog.org/mailinglist/ Acceptable Use Policy 1. Discussion will focus on Internet operational and technical issues as described in the charter of NANOG.

Re: Need (to acquire or sell) IPv4? Come to SpaceMarket.

2012-05-29 Thread Owen DeLong
Likely transfers made in this way may not be recordable with the applicable RIRs and may violate the RIR policies. If you care about your addresses being properly registered in whois to avoid unnecessary hassles around being able to route them, I highly recommend making sure that you are

Re: Need (to acquire or sell) IPv4? Come to SpaceMarket.

2012-05-29 Thread Ameen Pishdadi
Of all the people you pick to spam you picked NANOG, maybe you should hit up bugtraq next On May 29, 2012, at 7:16 PM, Timothy McGinnis mc...@isc.org wrote: Dear Unnamed person at The SpaceMarket, This list has an Acceptable Use Policy at: http://www.nanog.org/mailinglist/ Acceptable

Re: Need (to acquire or sell) IPv4? Come to SpaceMarket.

2012-05-29 Thread Cameron Byrne
On Tue, May 29, 2012 at 6:22 PM, Owen DeLong o...@delong.com wrote: Likely transfers made in this way may not be recordable with the applicable RIRs and may violate the RIR policies. If you care about your addresses being properly registered in whois to avoid unnecessary hassles around

the report from the spambox front

2012-05-29 Thread Randy Bush
as part of daily maint, where i read midnight logs from 20+ systems etc, i scan my spambox to make sure nothing falls through, and indeed catch one or two daily. but the spam is a source of great amusement. the internet is an wondrous place. the number of messages offering help for the serious

Re: the report from the spambox front

2012-05-29 Thread Lyle Giese
On 05/29/12 21:19, Randy Bush wrote: as part of daily maint, where i read midnight logs from 20+ systems etc, i scan my spambox to make sure nothing falls through, and indeed catch one or two daily. but the spam is a source of great amusement. the internet is an wondrous place. the number of

Re: rpki vs. secure dns?

2012-05-29 Thread Paul Vixie
On 2012-05-29 5:37 PM, Richard Barnes wrote: I agree with the person higher up the thread that ROVER seems like just another distribution mechanism for what is essentially RPKI data. noting, that up-thread person also said i havn't studied this in detail so i'm probably wrong. But does that

Re: rpki vs. secure dns?

2012-05-29 Thread Randy Bush
http://www.cafepress.com/nxdomain/8592477 randy, who will be wearing his at nanog

Re: Need (to acquire or sell) IPv4? Come to SpaceMarket.

2012-05-29 Thread Randy
Nice Tuesday-Evening humor! ...an escrow-agent..and 150k addresses..note Currently(as of this writing) No doubt the next post will have 250k free. ./Randy To: nanog@nanog.org, nanog-annou...@nanog.org Date: Tuesday, May 29, 2012, 5:43 PM IPv4 is not going away as quickly as many would like. 

Re: rpki vs. secure dns?

2012-05-29 Thread Randy Bush
http://www.cafepress.com/nxdomain/8592477 randy, who will be wearing his at nanog oops! should acknowledge that it was a gracious gift from geoff, to whom i had introduced http://sugru.com/ the hacker's playdough randy

Re: the report from the spambox front

2012-05-29 Thread Suresh Ramasubramanian
These three are the same spammer (who is hitting my traps as well, heavily and regularly) He gets so many subnets from one provider after the other, and dumps them when they're blocked (within a day or two), that I wonder whether v4 is actually running out at all .. At least multiple /28s is a

Re: NANOG Digest, Vol 52, Issue 74

2012-05-29 Thread carl gough [mobsource]
John, I think we have cross wires, without meaning to advertise or tout for business, the bandx solution and the enron solutions totally missed the mark in terms of timing. Every revolution, wether electricity, steam, automotive or telecoms, goes through a boom, then a bust, then a golden age

Re: rpki vs. secure dns?

2012-05-29 Thread Shane Amante
Alex, First, I would note that there is a talk specifically on this subject coming up at NANOG 55, which is scheduled for Tuesday afternoon from 2:30 - 3 PM. (Note, I'm not giving the talk, just pointing out that your questions may best be followed up face-to-face then). Anyway, see below.

Re: Need (to acquire or sell) IPv4? Come to SpaceMarket.

2012-05-29 Thread Owen DeLong
On May 29, 2012, at 6:38 PM, Cameron Byrne wrote: On Tue, May 29, 2012 at 6:22 PM, Owen DeLong o...@delong.com wrote: Likely transfers made in this way may not be recordable with the applicable RIRs and may violate the RIR policies. If you care about your addresses being properly

Re: Need (to acquire or sell) IPv4? Come to SpaceMarket.

2012-05-29 Thread Scott Howard
On Tue, May 29, 2012 at 5:16 PM, Timothy McGinnis mc...@isc.org wrote: Dear Unnamed person at The SpaceMarket, He appears to not be unnamed. Gmail links the user to the Google+ profile https://plus.google.com/116655492141266828122 under the name Dan Cooper, and with a photo of another Dan

Re: rpki vs. secure dns?

2012-05-29 Thread Shane Amante
Paul, On May 29, 2012, at 8:44 PM, Paul Vixie wrote: On 2012-05-29 5:37 PM, Richard Barnes wrote: I agree with the person higher up the thread that ROVER seems like just another distribution mechanism for what is essentially RPKI data. noting, that up-thread person also said i havn't

Re: rpki vs. secure dns?

2012-05-29 Thread Paul Vixie
ah, the force is strong in this one. On 2012-05-30 3:52 AM, Shane Amante wrote: On May 29, 2012, at 9:23 AM, Alex Band wrote: ... As far as I know, ROVER doesn't work like that. You can make a positive statement about a Prefix+AS combination, but that doesn't mark the origination from

Re: Comcast Service for Non-Cap Bandwidth

2012-05-29 Thread PC
Just e-mail them if you want to know. I'm sure it wouldn't take much actual effort to obtain a price from sales. Go here, and there's instructions. *www.comcast.com/peering/* ** Having said that, bandwidth from your host (softlayer) has direct comcast private peering (back in 2008, anyways --

Re: Comcast Service for Non-Cap Bandwidth

2012-05-29 Thread Mark Tinka
On Wednesday, May 30, 2012 02:34:06 AM Nabil Sharma wrote: Mr. Jason: Thank u for the reply, very informative URL. Understood on the cap, but how long it will remain not enforced is a good guess! What I am trying to is have Comcast mark our IP ranges with QoS, so downloads or congestion