From wmaton at ottix.net  Mon Dec  1 20:04:33 2014
From: wmaton at ottix.net (William F. Maton Sotomayor)
Date: Mon, 1 Dec 2014 15:04:33 -0500 (EST)
Subject: [as112-ops] AS112 nameservers as NS for parked domains
Message-ID: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>


Hi all,

 	I recall seeing a posting either here in this list or in another 
list about someone registering or parking a domain by using the AS112 
anycast addresses as their nameservers.

 	Can anyone think of reasons why this is or isn't a good idea both 
from the perspective of the domain name operator and the AS112 operator?

wfms

From warren at kumari.net  Mon Dec  1 21:22:57 2014
From: warren at kumari.net (Warren Kumari)
Date: Mon, 1 Dec 2014 16:22:57 -0500
Subject: [as112-ops] AS112 nameservers as NS for parked domains
In-Reply-To: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
References: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
Message-ID: <CAHw9_iKiy9KyGojWiEKY0may2_jyKdWMy37kg_frnc7Ukqu+bA@mail.gmail.com>

On Mon, Dec 1, 2014 at 3:04 PM, William F. Maton Sotomayor
<wmaton at ottix.net> wrote:
>
> Hi all,
>
>         I recall seeing a posting either here in this list or in another
> list about someone registering or parking a domain by using the AS112
> anycast addresses as their nameservers.
>
>         Can anyone think of reasons why this is or isn't a good idea both
> from the perspective of the domain name operator and the AS112 operator?

>From the AS112 ops perspective -- simply a bit more traffic, that the
AS112 operator might not have been expecting.
Not saying one or two folk, but if this became *really* common. Not a
good or bad idea, just something to keep in mind for scaling...

"Can you imagine fifty people a day, I said fifty people a day walking
in, changing their NS to be AS112 and walking out. And friends they
may thinks it's a movement."
W
P.S: *This* is why I shouldn't send mail while listening to music...




>
> wfms
> _______________________________________________
> as112-ops mailing list
> as112-ops at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/as112-ops



-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

From jonathan.stewart at gmail.com  Mon Dec  1 22:19:06 2014
From: jonathan.stewart at gmail.com (Jonathan Stewart)
Date: Mon, 1 Dec 2014 16:19:06 -0600
Subject: [as112-ops] AS112 nameservers as NS for parked domains
In-Reply-To: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
References: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
Message-ID: <CA+K1SUy87LXGRgd=eoxTDZGaj8EEoo40JU+6dYamB2W8eVHJvw@mail.gmail.com>

I assume that the motivation for this is because somebody will check if a
valid DNS server is present at that IP address, even though the check is
not to see if it's authoritative for the zone?

Why not just use 1.1.1.1 as your nameserver, if you want to provide a fake
IP address?  Or ns1.google.com if it need a domain name?

I can't really see why anyone would do this.

On Mon, Dec 1, 2014 at 2:04 PM, William F. Maton Sotomayor <wmaton at ottix.net
> wrote:

>
> Hi all,
>
>         I recall seeing a posting either here in this list or in another
> list about someone registering or parking a domain by using the AS112
> anycast addresses as their nameservers.
>
>         Can anyone think of reasons why this is or isn't a good idea both
> from the perspective of the domain name operator and the AS112 operator?
>
> wfms
> _______________________________________________
> as112-ops mailing list
> as112-ops at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/as112-ops
>



-- 
     Jonathan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.dns-oarc.net/pipermail/as112-ops/attachments/20141201/b59c0b3a/attachment.html>

From warren at kumari.net  Mon Dec  1 23:09:42 2014
From: warren at kumari.net (Warren Kumari)
Date: Mon, 1 Dec 2014 18:09:42 -0500
Subject: [as112-ops] AS112 nameservers as NS for parked domains
In-Reply-To: <CA+K1SUy87LXGRgd=eoxTDZGaj8EEoo40JU+6dYamB2W8eVHJvw@mail.gmail.com>
References: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
 <CA+K1SUy87LXGRgd=eoxTDZGaj8EEoo40JU+6dYamB2W8eVHJvw@mail.gmail.com>
Message-ID: <CAHw9_iLeX3W1n6TVk6gJTvn-RX9mEOZ=csS6D15HNZbqbzD8GQ@mail.gmail.com>

On Monday, December 1, 2014, Jonathan Stewart <jonathan.stewart at gmail.com>
wrote:

> I assume that the motivation for this is because somebody will check if a
> valid DNS server is present at that IP address, even though the check is
> not to see if it's authoritative for the zone?
>
> Why not just use 1.1.1.1 as your nameserver, if you want to provide a fake
> IP address?  Or ns1.google.com if it need a domain name?
>
>
Because that's *really* impolite.

Simply choosing an IP at random and using it as a bit bucket is similar to
dropping your chewing gum on the ground because doing the right thing was
too hard.
Just because a bunch of people use 1.1.1.0/24 (and 1.2.3/24) as garbage
destinations doesn't make it right - see
http://www.potaroo.net/studies/1slash8/1slash8.html (Geoff Huston from
APNIC report on this).
Believe me, Google also doesn't really want random stuff pointed at ns[1-4].
google.com - sure it will get lost in the noise, but doesn't mean it's
right...

W

I can't really see why anyone would do this.
>
> On Mon, Dec 1, 2014 at 2:04 PM, William F. Maton Sotomayor <
> wmaton at ottix.net> wrote:
>
>>
>> Hi all,
>>
>>         I recall seeing a posting either here in this list or in another
>> list about someone registering or parking a domain by using the AS112
>> anycast addresses as their nameservers.
>>
>>         Can anyone think of reasons why this is or isn't a good idea both
>> from the perspective of the domain name operator and the AS112 operator?
>>
>> wfms
>> _______________________________________________
>> as112-ops mailing list
>> as112-ops at lists.dns-oarc.net
>> https://lists.dns-oarc.net/mailman/listinfo/as112-ops
>>
>
>
>
> --
>      Jonathan
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.dns-oarc.net/pipermail/as112-ops/attachments/20141201/155a358a/attachment.html>

From as112-ops at trex.fi  Mon Dec  1 23:26:42 2014
From: as112-ops at trex.fi (Aleksi Suhonen)
Date: Tue, 02 Dec 2014 01:26:42 +0200
Subject: [as112-ops] AS112 nameservers as NS for parked domains
In-Reply-To: <CAHw9_iKiy9KyGojWiEKY0may2_jyKdWMy37kg_frnc7Ukqu+bA@mail.gmail.com>
References: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
 <CAHw9_iKiy9KyGojWiEKY0may2_jyKdWMy37kg_frnc7Ukqu+bA@mail.gmail.com>
Message-ID: <547CF932.80405@trex.fi>

Hi,

William wrote:
>> I recall seeing a posting either here in this list or in another
>> list about someone registering or parking a domain by using the
>> AS112 anycast addresses as their nameservers.
>>
>> Can anyone think of reasons why this is or isn't a good idea both
>> from the perspective of the domain name operator and the AS112
>> operator?

I don't think it really matters. The whole purpose of AS112 is to be the 
sink for unwanted DNS traffic. It shouldn't matter *why* said DNS 
traffic is unwanted.

That being said, we run an AS112 node at an IXP, where we have virtually 
unlimited bandwidth for it. I'm sure someone who's announcing AS112 to 
their paid transits might see the issue differently.

I think one goal should be to get AS112 nodes peered with tier1 
operators too, thus abolishing the need for transit... ;-)


Warren Kumari wrote:
> "Can you imagine fifty people a day, I said fifty people a day walking
> in, changing their NS to be AS112 and walking out. And friends they
> may thinks it's a movement."

> P.S: *This* is why I shouldn't send mail while listening to music...

I wish we could hear the same noises as you do. :)

-- 
	+358 44 9756548 / http://www.trex.fi/
	Aleksi Suhonen / TREX Regional Exchanges Oy

	You say "potato", I say "closest-exit."

From jonathan.stewart at gmail.com  Mon Dec  1 23:53:33 2014
From: jonathan.stewart at gmail.com (Jonathan Stewart)
Date: Mon, 1 Dec 2014 17:53:33 -0600
Subject: [as112-ops] AS112 nameservers as NS for parked domains
In-Reply-To: <547CF932.80405@trex.fi>
References: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
 <CAHw9_iKiy9KyGojWiEKY0may2_jyKdWMy37kg_frnc7Ukqu+bA@mail.gmail.com>
 <547CF932.80405@trex.fi>
Message-ID: <CA+K1SUyMPX_XXxnZgZPFJgrPD=C+zy68H9THeTkuQgaUX4pn0Q@mail.gmail.com>

On Mon, Dec 1, 2014 at 5:26 PM, Aleksi Suhonen <as112-ops at trex.fi> wrote:

> Hi,
>
> William wrote:
>
>> I recall seeing a posting either here in this list or in another
>>> list about someone registering or parking a domain by using the
>>> AS112 anycast addresses as their nameservers.
>>>
>>> Can anyone think of reasons why this is or isn't a good idea both
>>> from the perspective of the domain name operator and the AS112
>>> operator?
>>>
>>
> I don't think it really matters. The whole purpose of AS112 is to be the
> sink for unwanted DNS traffic. It shouldn't matter *why* said DNS traffic
> is unwanted.
>
I suppose that's true.  If AS112 takes unwanted DNS traffic, then even
valid domain name queries could hit the node, and a rational response would
be served.


> That being said, we run an AS112 node at an IXP, where we have virtually
> unlimited bandwidth for it. I'm sure someone who's announcing AS112 to
> their paid transits might see the issue differently.
>
Same here, lots of traffic doesn't bother me at all.

>
> I think one goal should be to get AS112 nodes peered with tier1 operators
> too, thus abolishing the need for transit... ;-)
>
Now that would be clever. ;-)  But it also makes me think i could announce
our AS112 node to our transit providers--currently we're announcing only to
the IX.



-- 
     Jonathan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.dns-oarc.net/pipermail/as112-ops/attachments/20141201/c1eb8ea6/attachment.html>

From as112-ops at trex.fi  Tue Dec  2 00:45:36 2014
From: as112-ops at trex.fi (Aleksi Suhonen)
Date: Tue, 02 Dec 2014 02:45:36 +0200
Subject: [as112-ops] AS112 nameservers as NS for parked domains
In-Reply-To: <CA+K1SUyMPX_XXxnZgZPFJgrPD=C+zy68H9THeTkuQgaUX4pn0Q@mail.gmail.com>
References: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
 <CAHw9_iKiy9KyGojWiEKY0may2_jyKdWMy37kg_frnc7Ukqu+bA@mail.gmail.com>
 <547CF932.80405@trex.fi>
 <CA+K1SUyMPX_XXxnZgZPFJgrPD=C+zy68H9THeTkuQgaUX4pn0Q@mail.gmail.com>
Message-ID: <547D0BB0.4090404@trex.fi>

Hello,

On 12/02/2014 01:53 AM, Jonathan Stewart wrote:
>> I think one goal should be to get AS112 nodes peered with tier1 operators
>> too, thus abolishing the need for transit... ;-)

> Now that would be clever. ;-)  But it also makes me think i could announce
> our AS112 node to our transit providers--currently we're announcing only to
> the IX.

To be honest, we also already announce it to our transit, but tagged 
with communities that limit its global visibility. If there's ever any 
problem due to that, we'll just limit it further.

If you are going to announce it to your transits, I'd like to hear about 
the developments. We might be interested in sharing the global load as well.

The biggest reason I haven't wanted to announce the route to our 
transit's transits is that I fear I might be dragging some Australian, 
Peruvian, South African and Swiss traffic to Finland and I'm not sure if 
that's better than the status quo. If I knew that we would only catch 
tier1 traffic from near by, I might go ahead and do it.

Cheers,

-- 
	+358 44 9756548 / http://www.trex.fi/
	Aleksi Suhonen / TREX Regional Exchanges Oy

	You say "potato", I say "closest-exit."

From wmaton at ottix.net  Wed Dec  3 22:45:00 2014
From: wmaton at ottix.net (William F. Maton Sotomayor)
Date: Wed, 3 Dec 2014 17:45:00 -0500 (EST)
Subject: [as112-ops] AS112 nameservers as NS for parked domains
In-Reply-To: <547D0BB0.4090404@trex.fi>
References: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
 <CAHw9_iKiy9KyGojWiEKY0may2_jyKdWMy37kg_frnc7Ukqu+bA@mail.gmail.com>
 <547CF932.80405@trex.fi>
 <CA+K1SUyMPX_XXxnZgZPFJgrPD=C+zy68H9THeTkuQgaUX4pn0Q@mail.gmail.com>
 <547D0BB0.4090404@trex.fi>
Message-ID: <alpine.DEB.2.03.1412031737230.771@iskra.ottix.net>

On Tue, 2 Dec 2014, Aleksi Suhonen wrote:

> The biggest reason I haven't wanted to announce the route to our transit's 
> transits is that I fear I might be dragging some Australian, Peruvian, South 
> African and Swiss traffic to Finland and I'm not sure if that's better than 
> the status quo. If I knew that we would only catch tier1 traffic from near 
> by, I might go ahead and do it.

Admittedly this is a concern for more than a few people.  Still, I've been 
compiling quite a bit of data using open resolvers to try and glean where 
AS112 nodes are located (as opposed to the list found on the website). 
results are interesting.  Ultimately I'd like to visualise that as 
compared to this:

 	http://www.wfms.org/map.html

(Once I can figure out how I can get this to work under SSL it will move).

Ideally, more AS112 nodes in South America and Africa would be helpful, 
especially so at any IXP's there.  I thought I saw a similar map of IXPs - 
would be nice to compare that with the above and the data results.

wfms

From wmaton at ottix.net  Wed Dec  3 22:48:39 2014
From: wmaton at ottix.net (William F. Maton Sotomayor)
Date: Wed, 3 Dec 2014 17:48:39 -0500 (EST)
Subject: [as112-ops] AS112 nameservers as NS for parked domains
In-Reply-To: <547CF932.80405@trex.fi>
References: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
 <CAHw9_iKiy9KyGojWiEKY0may2_jyKdWMy37kg_frnc7Ukqu+bA@mail.gmail.com>
 <547CF932.80405@trex.fi>
Message-ID: <alpine.DEB.2.03.1412031747270.771@iskra.ottix.net>

On Tue, 2 Dec 2014, Aleksi Suhonen wrote:

> Hi,
>
> William wrote:
>>> I recall seeing a posting either here in this list or in another
>>> list about someone registering or parking a domain by using the
>>> AS112 anycast addresses as their nameservers.
>>> 
>>> Can anyone think of reasons why this is or isn't a good idea both
>>> from the perspective of the domain name operator and the AS112
>>> operator?
>
> I don't think it really matters. The whole purpose of AS112 is to be the sink 
> for unwanted DNS traffic. It shouldn't matter *why* said DNS traffic is 
> unwanted.

OK cool thanks for that.  I was thinking of adding some kind of statement 
to rfc6304bis to the effect that it's rude not to tell people (especially 
if it's to off load a DDOS attack), but with many AS112 nodes, the 
mitigation might still be effective.

> That being said, we run an AS112 node at an IXP, where we have virtually 
> unlimited bandwidth for it. I'm sure someone who's announcing AS112 to their 
> paid transits might see the issue differently.
>
> I think one goal should be to get AS112 nodes peered with tier1 operators 
> too, thus abolishing the need for transit... ;-)
>
>
> Warren Kumari wrote:
>> "Can you imagine fifty people a day, I said fifty people a day walking
>> in, changing their NS to be AS112 and walking out. And friends they
>> may thinks it's a movement."
>
>> P.S: *This* is why I shouldn't send mail while listening to music...
>
> I wish we could hear the same noises as you do. :)
>
> --
> 	+358 44 9756548 / http://www.trex.fi/
> 	Aleksi Suhonen / TREX Regional Exchanges Oy
>
> 	You say "potato", I say "closest-exit."
> _______________________________________________
> as112-ops mailing list
> as112-ops at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/as112-ops
>

wfms

From warren at kumari.net  Wed Dec  3 22:49:14 2014
From: warren at kumari.net (Warren Kumari)
Date: Wed, 3 Dec 2014 17:49:14 -0500
Subject: [as112-ops] AS112 nameservers as NS for parked domains
In-Reply-To: <alpine.DEB.2.03.1412031737230.771@iskra.ottix.net>
References: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
 <CAHw9_iKiy9KyGojWiEKY0may2_jyKdWMy37kg_frnc7Ukqu+bA@mail.gmail.com>
 <547CF932.80405@trex.fi>
 <CA+K1SUyMPX_XXxnZgZPFJgrPD=C+zy68H9THeTkuQgaUX4pn0Q@mail.gmail.com>
 <547D0BB0.4090404@trex.fi>
 <alpine.DEB.2.03.1412031737230.771@iskra.ottix.net>
Message-ID: <CAHw9_i+tLgXGXGRWXZU5aMkSw-kDWLhwa2GaUdjd-whv23_B9g@mail.gmail.com>

On Wed, Dec 3, 2014 at 5:45 PM, William F. Maton Sotomayor
<wmaton at ottix.net> wrote:
> On Tue, 2 Dec 2014, Aleksi Suhonen wrote:
>
>> The biggest reason I haven't wanted to announce the route to our transit's
>> transits is that I fear I might be dragging some Australian, Peruvian, South
>> African and Swiss traffic to Finland and I'm not sure if that's better than
>> the status quo. If I knew that we would only catch tier1 traffic from near
>> by, I might go ahead and do it.
>
>
> Admittedly this is a concern for more than a few people.  Still, I've been
> compiling quite a bit of data using open resolvers to try and glean where
> AS112 nodes are located (as opposed to the list found on the website).
> results are interesting.  Ultimately I'd like to visualise that as compared
> to this:
>
>         http://www.wfms.org/map.html
>
> (Once I can figure out how I can get this to work under SSL it will move).

I hadn't seen that -- 'tis very cool...

W


>
> Ideally, more AS112 nodes in South America and Africa would be helpful,
> especially so at any IXP's there.  I thought I saw a similar map of IXPs -
> would be nice to compare that with the above and the data results.
>
> wfms
>
> _______________________________________________
> as112-ops mailing list
> as112-ops at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/as112-ops



-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

From wmaton at ottix.net  Wed Dec  3 23:01:38 2014
From: wmaton at ottix.net (William F. Maton Sotomayor)
Date: Wed, 3 Dec 2014 18:01:38 -0500 (EST)
Subject: [as112-ops] AS112 nameservers as NS for parked domains
In-Reply-To: <CAHw9_i+tLgXGXGRWXZU5aMkSw-kDWLhwa2GaUdjd-whv23_B9g@mail.gmail.com>
References: <alpine.DEB.2.03.1412010815010.13435@iskra.ottix.net>
 <CAHw9_iKiy9KyGojWiEKY0may2_jyKdWMy37kg_frnc7Ukqu+bA@mail.gmail.com>
 <547CF932.80405@trex.fi>
 <CA+K1SUyMPX_XXxnZgZPFJgrPD=C+zy68H9THeTkuQgaUX4pn0Q@mail.gmail.com>
 <547D0BB0.4090404@trex.fi>
 <alpine.DEB.2.03.1412031737230.771@iskra.ottix.net>
 <CAHw9_i+tLgXGXGRWXZU5aMkSw-kDWLhwa2GaUdjd-whv23_B9g@mail.gmail.com>
Message-ID: <alpine.DEB.2.03.1412031800240.771@iskra.ottix.net>

On Wed, 3 Dec 2014, Warren Kumari wrote:

>>         http://www.wfms.org/map.html
>>
>> (Once I can figure out how I can get this to work under SSL it will move).
>
> I hadn't seen that -- 'tis very cool...

Thanks!  The first iteration of this was done 2 years ago but needed to 
automate some other things first.  Then when tried under https/SSL... gee 
where did it go?  I'll take another stab at it at some point...

wfms

