[NANOG-announce] Update: NANOG 49 CFP

[Tom Daly]

Hello Fellow NANOG'ers,

TLDR: The PC is still looking for great content for NANOG 49. Go upload 
abstracts and tutorials at https://pc.nanog.org.

Just a quick note on behalf of the NANOG Program Committee that our next PC 
call will be next Tuesday, May 11th. Shortly after this meeting, we hope to 
post a draft agenda for NANOG 49, but we need your help - we still need a bit 
more content! For those of you that have submitted abstracts, now is a great 
time to upload your slides into the PC tool at https://pc.nanog.org, and for 
those who might want to give a talk to upload their abstracts and slides into 
the tool, again at https://pc.nanog.org.

And while you're at it, take the time to go register for the conference at 
https://nanog.merit.edu/registration/, the Early Bird rate is still open.

Thanks, and looking forward to seeing you all in San Francisco!

Tom Daly, for the NANOG PC.

-- 
Tom Daly
CTO, Dynamic Network Services, Inc.
http://dyn.com/



signature.asc
Description: Digital signature
___
NANOG-announce mailing list
nanog-annou...@nanog.org
https://mailman.nanog.org/mailman/listinfo/nanog-announce

Root Zone DNSSEC Deployment Technical Status Update

[Joe Abley]

Root Zone DNSSEC Deployment
Technical Status Update 2010-05-05

This is the sixth of a series of technical status updates intended
to inform a technical audience on progress in signing the root zone
of the DNS.


**  The final transition to a signed root zone took place today
**  on J-Root, between 1700--1900 UTC.
**
**  All root servers are now serving a signed root zone.
**
**  All root servers will now generate larger responses to DNS
**  queries that request DNSSEC information.
**
**  If you experience technical problems or need to contact
**  technical project staff, please send e-mail to roots...@icann.org
**  or call the ICANN DNS NOC at +1 310 301 5817, e-mail preferred
**  if possible.
**
**  See below for more details.


RESOURCES

Details of the project, including documentation published to date,
can be found at .

We'd like to hear from you. If you have feedback for us, please
send it to roots...@icann.org.


DEPLOYMENT STATUS

The incremental deployment of DNSSEC in the Root Zone is being
carried out first by serving a Deliberately Unvalidatable Root Zone
(DURZ), and subsequently by a conventionally signed root zone.
Discussion of the approach can be found in the document "DNSSEC
Deployment for the Root Zone", as well as in the technical presentations
delivered at RIPE, NANOG, IETF and ICANN meetings.

All of the thirteen root servers have now made the transition to
the to the DURZ.  No harmful effects have been identified.

The final root server to make the transition, J-Root, started serving
the DURZ in a maintenance window between 1700--1900 UTC on 2010-05-05.

Initial observations relating to this transition will be presented
and discussed at the DNS Working Group meeting at RIPE 60 in Prague
on 2010-05-06.


PLANNED DEPLOYMENT SCHEDULE

Already completed:

  2010-01-27: L starts to serve DURZ

  2010-02-10: A starts to serve DURZ

  2010-03-03: M, I start to serve DURZ

  2010-03-24: D, K, E start to serve DURZ

  2010-04-14: B, H, C, G, F start to serve DURZ

  2010-05-05: J starts to serve DURZ

To come:

  2010-07-01: Distribution of validatable, production, signed root
zone; publication of root zone trust anchor

  (Please note that this schedule is tentative and subject to change
  based on testing results or other unforeseen factors.)

Re: DNS performance...

[Donald Eastlake]

On Wed, May 5, 2010 at 1:45 PM, Mark Scholten  wrote:
>> -Original Message-
>> From: Donald Eastlake [mailto:d3e...@gmail.com]
>> Sent: Wednesday, May 05, 2010 4:41 PM
>> ...
>>
>> Hi,
>>
>> There are a large number of DNS servers available. See for example
>> http://en.wikipedia.org/wiki/Comparison_of_DNS_server_software
>>
>> Does anyone know of good performance comparisons, especially for high
>> end applications with lots of data/zones and/or high query/update
>> rates?
>>
> One of the links below should have information about this:
> - http://tin2.nixcartel.org/~devdas/presentation/dns-scalability.pdf
> - http://tin2.nixcartel.org/~devdas/presentation/dnsdb.pdf

Thanks for these pointers.

For others who may be interested, the dns-scalability.pdf presentation
appears to be a superset of the dnsdb.pdf presentation.

Donald

> Please note this reports are not created by me.
>
> Regards, Mark
>
>> Thanks,
>> Donald
>> =
>>  Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
>>  155 Beaver Street
>>  Milford, MA 01757 USA
>>  d3e...@gmail.com

Re: DNS performance...

[Geoffrey Sisson]

richard.bar...@gmail.com (Richard Barnes) wrote:

> OARC did a performance study of a few name servers in the context of
> root zone scaling, but it should be generalizable:
> 

Note this study compares BIND and NSD only, and under a very specific set
of conditions only, namely, serving a single large zone.

Geoff (co-author of the study)

> On Wed, May 5, 2010 at 4:41 PM, Donald Eastlake  wrote:
> > Hi,
> >
> > There are a large number of DNS servers available. See for example
> > http://en.wikipedia.org/wiki/Comparison_of_DNS_server_software
> >
> > Does anyone know of good performance comparisons, especially for high
> > end applications with lots of data/zones and/or high query/update
> > rates?> From nanog@nanog.org
> From: nanog@nanog.org
> Subject: Re: DNS performance...
> Date: 5 May 10 14:48:12 GMT
>
> OARC did a performance study of a few name servers in the context of
> root zone scaling, but it should be generalizable:
> 
>
> On Wed, May 5, 2010 at 4:41 PM, Donald Eastlake  wrote:
> > Hi,
> >
> > There are a large number of DNS servers available. See for example
> > http://en.wikipedia.org/wiki/Comparison_of_DNS_server_software
> >
> > Does anyone know of good performance comparisons, especially for high
> > end applications with lots of data/zones and/or high query/update
> > rates?

Re: Internationalized domain names in the root

[Jorge Amodio]

Great progress and interesting addition to the root, only issue is
that after all the work with IDNs you land on a page written in
english (web browser lang does not matter, name resolves to the same
IP as the original URL). Hope they soon take advantage of the new name
...

Cheers
Jorge

On Wed, May 5, 2010 at 11:34 AM, David Conrad  wrote:
> Perhaps a bit off-topic, but some folks might get support calls...
>
> http://وزارة-الأتصالات.مصر/
>
> (that's Arabic for .)
>
> Regards,
> -drc

RE: DNS performance...

[Mark Scholten]

> -Original Message-
> From: Donald Eastlake [mailto:d3e...@gmail.com]
> Sent: Wednesday, May 05, 2010 4:41 PM
> To: nanog@nanog.org
> Subject: DNS performance...
> 
> Hi,
> 
> There are a large number of DNS servers available. See for example
> http://en.wikipedia.org/wiki/Comparison_of_DNS_server_software
> 
> Does anyone know of good performance comparisons, especially for high
> end applications with lots of data/zones and/or high query/update
> rates?
> 
One of the links below should have information about this:
- http://tin2.nixcartel.org/~devdas/presentation/dns-scalability.pdf
- http://tin2.nixcartel.org/~devdas/presentation/dnsdb.pdf

Please note this reports are not created by me.

Regards, Mark

> Thanks,
> Donald
> =
>  Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
>  155 Beaver Street
>  Milford, MA 01757 USA
>  d3e...@gmail.com

Internationalized domain names in the root

[David Conrad]

Perhaps a bit off-topic, but some folks might get support calls...

http://وزارة-الأتصالات.مصر/

(that's Arabic for .)

Regards,
-drc

Re: Thailand Internet firewall?

[Christopher Morrow]

On Wed, May 5, 2010 at 5:39 AM, Mikael Abrahamsson  wrote:
> On Wed, 5 May 2010, Randy Bush wrote:
>
>>> Does anyone know how to contact whoever is responsible for this firewall
>>> system to find out at the very least why this block is in place?
>>
>> read your newspaper
>
> It's not only now, they've been blocking badtalking the king for quite a
> while. I was also under the impression that it wasn't by IP but that they
> could block specific youtube videos etc.

wccp

boo on regimes that block internetz

-chris

Re: DNS performance...

[Richard Barnes]

... and here's the direct link to the full report:


On Wed, May 5, 2010 at 4:48 PM, Richard Barnes  wrote:
> OARC did a performance study of a few name servers in the context of
> root zone scaling, but it should be generalizable:
> 
>
>
>
> On Wed, May 5, 2010 at 4:41 PM, Donald Eastlake  wrote:
>> Hi,
>>
>> There are a large number of DNS servers available. See for example
>> http://en.wikipedia.org/wiki/Comparison_of_DNS_server_software
>>
>> Does anyone know of good performance comparisons, especially for high
>> end applications with lots of data/zones and/or high query/update
>> rates?
>>
>> Thanks,
>> Donald
>> =
>>  Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
>>  155 Beaver Street
>>  Milford, MA 01757 USA
>>  d3e...@gmail.com
>>
>>
>

Re: DNS performance...

[Donald Eastlake]

On Wed, May 5, 2010 at 10:48 AM, Simon Perreault
 wrote:
> On 2010-05-05 10:41, Donald Eastlake wrote:
>>
>> Does anyone know of good performance comparisons, especially for high
>> end applications with lots of data/zones and/or high query/update
>> rates?
>
> Recursive or authoritative?

I'm actually interested in both. Thanks for the pointer!

Donald

> For recursive, there are pretty good graphs here:
> http://unbound.net/documentation/ripe56_unbound_02.pdf
>
> Simon
> --
> NAT64/DNS64 open-source --> http://ecdysis.viagenie.ca
> STUN/TURN server        --> http://numb.viagenie.ca
> vCard 4.0               --> http://www.vcarddav.org

Re: DNS performance...

[Alex Kamiru]

Not sure of any comparison but I know BIND is widely used in the ISP
space and they tend to have lots of zones as expected. 

-Original Message-
From: Donald Eastlake 
To: nanog@nanog.org
Subject: DNS performance...
Date: Wed, 5 May 2010 10:41:24 -0400


Hi,

There are a large number of DNS servers available. See for example
http://en.wikipedia.org/wiki/Comparison_of_DNS_server_software

Does anyone know of good performance comparisons, especially for high
end applications with lots of data/zones and/or high query/update
rates?

Thanks,
Donald
=
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street
 Milford, MA 01757 USA
 d3e...@gmail.com

Re: DNS performance...

[Simon Perreault]

On 2010-05-05 10:41, Donald Eastlake wrote:

Does anyone know of good performance comparisons, especially for high
end applications with lots of data/zones and/or high query/update
rates?


Recursive or authoritative?

For recursive, there are pretty good graphs here:
http://unbound.net/documentation/ripe56_unbound_02.pdf

Simon
--
NAT64/DNS64 open-source --> http://ecdysis.viagenie.ca
STUN/TURN server--> http://numb.viagenie.ca
vCard 4.0   --> http://www.vcarddav.org

Re: DNS performance...

[Richard Barnes]

OARC did a performance study of a few name servers in the context of
root zone scaling, but it should be generalizable:




On Wed, May 5, 2010 at 4:41 PM, Donald Eastlake  wrote:
> Hi,
>
> There are a large number of DNS servers available. See for example
> http://en.wikipedia.org/wiki/Comparison_of_DNS_server_software
>
> Does anyone know of good performance comparisons, especially for high
> end applications with lots of data/zones and/or high query/update
> rates?
>
> Thanks,
> Donald
> =
>  Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
>  155 Beaver Street
>  Milford, MA 01757 USA
>  d3e...@gmail.com
>
>

DNS performance...

[Donald Eastlake]

Hi,

There are a large number of DNS servers available. See for example
http://en.wikipedia.org/wiki/Comparison_of_DNS_server_software

Does anyone know of good performance comparisons, especially for high
end applications with lots of data/zones and/or high query/update
rates?

Thanks,
Donald
=
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street
 Milford, MA 01757 USA
 d3e...@gmail.com

Re: Interesting combination of SPAM + Phishing + stupidity

[Valdis . Kletnieks]

On Tue, 04 May 2010 19:38:15 CDT, Jorge Amodio said:

> Are spammers getting smarter ? or users getting dumber ?

http://uxmag.com/short-news/these-are-your-users-read-and-be-horrified

Remember that statistically speaking, roughly half of all people are below
average on the IQ bell curve.  A stupefyingly high percentage of your users are
either illiterate, innumerate, or both, or severely lacking in critical
thinking skills.  In addition, keep in mind that the spammers and other
miscreants probably come from the ends of that same bell curve - some brilliant
guys who think they can do better than the average office job, and some bozos
who can't get an average office job.

A few years ago, I was watching CNN, and they had a segment on Yellowstone Park
installing new bear-proof trash containers. They basically had a complex latch
that was too complicated for bears.  Unfortunately, a lot of tourists would
be stumped (or not bother) and dumped their garbage outside the dumpster, and
the bears would come along and get into the garbage.  The take-away line of
the segment was from a ranger at the park:

"There appears to be significant overlap in intelligence between the smartest
bear and the dumbest tourist".

Re: Thailand Internet firewall?

[Dobbins, Roland]

On May 5, 2010, at 4:39 PM, Mikael Abrahamsson wrote:

>  I was also under the impression that it wasn't by IP but that they could 
> block specific youtube videos etc.

They use a combination of IP blocking, DNS poisoning, and transparent HTTP 
proxy-based URL filtering.

---
Roland Dobbins  // 

Injustice is relatively easy to bear; what stings is justice.

-- H.L. Mencken

Re: Thailand Internet firewall?

[Mikael Abrahamsson]

On Wed, 5 May 2010, Randy Bush wrote:

Does anyone know how to contact whoever is responsible for this 
firewall system to find out at the very least why this block is in 
place?


read your newspaper


It's not only now, they've been blocking badtalking the king for quite a 
while. I was also under the impression that it wasn't by IP but that they 
could block specific youtube videos etc.


--
Mikael Abrahamssonemail: swm...@swm.pp.se

Re: Thailand Internet firewall?

[Randy Bush]

> Is anyone aware whether or not Thailand has a centralized firewall on
> Internet access?

think of it as more like a monopoly telco with ties to the government

> We've had reports from several folks in Thailand that they are unable
> to get to some IP addresses in our network (this problem is
> reproducible on the traceroute.org Thailand sites as well).

yes, sites are being blocked.

> It seems to only be from Thailand, and only certain IPs on our network

yes, it is by specific ip addresses

> Does anyone know how to contact whoever is responsible for this
> firewall system to find out at the very least why this block is in
> place?

read your newspaper

randy