From wfms at ottix.net  Mon May  2 16:56:01 2016
From: wfms at ottix.net (William Sotomayor)
Date: Mon, 2 May 2016 12:56:01 -0400 (EDT)
Subject: [as112-ops] [gii-ops] Advice requested on a proposal to
 delegate .local to AS112
In-Reply-To: <etPan.57198c63.d3f4861.ced9@scallop.hopcount.ca>
References: <alpine.DEB.2.20.1604211552350.3587@iskra.ottix.net>
 <etPan.57198c63.d3f4861.ced9@scallop.hopcount.ca>
Message-ID: <alpine.DEB.2.20.1605021251430.11017@iskra.ottix.net>



On Thu, 21 Apr 2016, Joe Abley wrote:

> On 21 April 2016 at 20:24:10, William Sotomayor (wfms at ottix.net) wrote:
> 
> >*) How well deployed is RFC7535 (and the corresponding implementation?
> >guidance in RFC7534)??
> 
> I've not yet done a table survey to see how well RFC7534, but it's close?
> to time to get doing it. But last I saw, it wasn't well deployed.?
> 
> How did you measure it?

Good timing!

I'm in the porocess of doing a table survey now, although I need to find a 
more diverse - and functional - set of looking glasses I can interrogate 
automatically.

I also just finished a separate survey of open resolvers to find out where 
the AS112 nodes are, although it's not completely scientific.

I think at some point, using RIPE Atlas might be the best bet and using 
the milions of credits I seem to have accumulated might be a good use of 
them.  But other things press....

> When you say it's not well-deployed, are you talking about the number of nodes supporting
> blackhole.as112.arpa, or the number of nodes supporting v6 transport for prisoner, blackhole-1
> and blackhole-2, or something else?

The former, blackhole.as112.arpa.  But as I said, need more mesaurements 
to see if the routes from the original and blackhole.as112.arpa are now 
1:1.

I had not considered IPv6 yet, but it's in the works for a table survey - 
actually I see I captured that data previously, just not looked at it. 
Good time to compare.

>       As for DNAME, I don't see much in that regard either.?
> 
> Do you mean you aren't seeing any queries for empty.as112.arpa? Or you're not aware of anybody
> having installed a DNAME to empty.as112.arpa?

The latter.

wfms

From cpetrie at ripe.net  Tue May  3 12:14:49 2016
From: cpetrie at ripe.net (Colin Petrie)
Date: Tue, 3 May 2016 14:14:49 +0200
Subject: [as112-ops] [gii-ops] Advice requested on a proposal to
 delegate .local to AS112
In-Reply-To: <alpine.DEB.2.20.1605021251430.11017@iskra.ottix.net>
References: <alpine.DEB.2.20.1604211552350.3587@iskra.ottix.net>
 <etPan.57198c63.d3f4861.ced9@scallop.hopcount.ca>
 <alpine.DEB.2.20.1605021251430.11017@iskra.ottix.net>
Message-ID: <ea0f864b-8002-d595-f568-afacdfd9ded0@ripe.net>

On 02/05/16 18:56, William Sotomayor wrote:
> I think at some point, using RIPE Atlas might be the best bet and using
> the milions of credits I seem to have accumulated might be a good use of
> them.  

I had the same accumulation of credits :) So I thought I'd give it a
quick try when I was bored a week ago.

I asked Atlas to give me 500 probes world-wide, and queried for TXT
hostname.as112.arpa @192.31.196.1.
Then, from the same  500 probes, querying for TXT hostname.as112.net
@192.175.48.6

The results were something like this:
(the count is the number of Atlas probes hitting this AS112 node)

AS112 DNAME:
      1     AS112 at voipGATE S.A. (AS51405), Leudelange, Luxembourg, Europe
      1     Espanix. Spain's IX
      4     ICANN DNS Engineering, lax
      5     WIDE Project Osaka, Japan
      6     INEX - Internet Neutral Exchange Association Limited
      6     Toronto Internet Exchange Toronto, Canada
     16     Individual Network Berlin e.V.
     17     IT.Gate S.p.A. TRN, IT
     19     NIX.SK
     32     ICANN DNS Engineering, iad
    159     Hivane Networks
    168     RIPE NCC, Amsterdam, The Netherlands

AS112 Delegation:
      1     Greek Research & Technology Network Athens, Greece
      1     Liquid Telecommunications Kenya
      1     M-net Telekommunikations GmbH Munich, Germany
      1     NaMeX, Nautilus Mediterranean eXchange
      1     NIX.SK
      1     WIDE Project Osaka, Japan
      2     Internet Solutions, Johannesburg, South Africa
      2     ORG:University of Sofia, Bulgaria
      4     Ottawa Internet Exchange, Ottawa, Canada.
      5     ICANN DNS Engineering, lax
      5     ORGANIZATION: SOFIA UNIVERSITY 'ST. KLIMENT OHRIDSKI'
      5     Toronto Internet Exchange Toronto, Canada
      5     TREX Regional Exchanges Oy, FINLAND
      6     FASTWEB Internal AS112
      6     INEX - Internet Neutral Exchange Association Limited
      6     IT.Gate S.p.A. TRN, IT
     11     VeriSign Global Registry Services RFC 1918 blackhole servers
     12     ICANN DNS Engineering, iad
     12     Phyxia Networks
     15     NIX.CZ, Neutral Internet eXchange of Czech Republic
     16     Individual Network Berlin e.V.
     16     NIC.br - Sao Paulo, Brazil
     19     GNC-Alfa CJSC
     21     Widgets, Pty Ltd KK GmbH LLC Inc
     25     Goscomb Technologies Limited
     26     Qwest.net
     31     ClueTrust (AS16668)
     39     Afilias Global Registry Services
     52     Hivane Networks
     72     RIPE NCC, Amsterdam, The Netherlands

So there is most definitely a large discrepancy in the number of visible
nodes supporting DNAME vs Delegation.

Cheers,
Colin


-- 
Colin Petrie
Systems Engineer
RIPE NCC

From aprado at topnet.it  Mon May 16 19:16:41 2016
From: aprado at topnet.it (Antonio Prado)
Date: Mon, 16 May 2016 21:16:41 +0200
Subject: [as112-ops] auth ns for as112.net
Message-ID: <1dd45f3e-8a57-7b75-bf24-92edc1ce95e2@topnet.it>

hi,

there is something wrong with auth nameserver listed @ godaddy.

this is what I get when querying for www.as112.net IN A

PUCK.NETHER.NET 	status: REFUSED
NS.DNS-OARC.NET 	status: NOERROR	64.191.0.198
SEC2.AUTHDNS.RIPE.NET 	status: NOERROR	149.20.58.198
SNS-PB.ISC.ORG 		status: NOERROR	149.20.58.198
AUTHNS2.NET.UMD.EDU	connection timed out
ISKRA.OTTIX.NET		status: NOERROR	149.20.58.198

somewhere the website is not reachable
--
antonio


From jonathan.stewart at gmail.com  Mon May 16 22:21:27 2016
From: jonathan.stewart at gmail.com (Jonathan Stewart)
Date: Mon, 16 May 2016 17:21:27 -0500
Subject: [as112-ops] auth ns for as112.net
In-Reply-To: <1dd45f3e-8a57-7b75-bf24-92edc1ce95e2@topnet.it>
References: <1dd45f3e-8a57-7b75-bf24-92edc1ce95e2@topnet.it>
Message-ID: <CA+K1SUzhoWdnch9-DN+bTyV13J2=+oKH0YsphqMm+UnrYj4ZFA@mail.gmail.com>

I can confirm that DNS doesn't resolve, as Antonio describes.

Is this website supposed to be working?

Jonathan

On Mon, May 16, 2016 at 2:16 PM, Antonio Prado <aprado at topnet.it> wrote:

> hi,
>
> there is something wrong with auth nameserver listed @ godaddy.
>
> this is what I get when querying for www.as112.net IN A
>
> PUCK.NETHER.NET         status: REFUSED
> NS.DNS-OARC.NET         status: NOERROR 64.191.0.198
> SEC2.AUTHDNS.RIPE.NET   status: NOERROR 149.20.58.198
> SNS-PB.ISC.ORG          status: NOERROR 149.20.58.198
> AUTHNS2.NET.UMD.EDU     connection timed out
> ISKRA.OTTIX.NET         status: NOERROR 149.20.58.198
>
> somewhere the website is not reachable
> --
> antonio
>
> _______________________________________________
> as112-ops mailing list
> as112-ops at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/as112-ops
>



-- 
     Jonathan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/mailman/private/as112-ops/attachments/20160516/ffad8127/attachment.html>

From aprado at topnet.it  Tue May 17 10:39:44 2016
From: aprado at topnet.it (Antonio Prado)
Date: Tue, 17 May 2016 12:39:44 +0200
Subject: [as112-ops] as112.net dnssec
Message-ID: <510c2caa-2e37-f0dd-9161-519d8d999064@topnet.it>

hi,

dnssec validator fails (expired signature):

http://dnsviz.net/d/as112.net/dnssec/

--
antonio

From as112-ops at trex.fi  Wed May 18 05:51:44 2016
From: as112-ops at trex.fi (Aleksi Suhonen)
Date: Wed, 18 May 2016 08:51:44 +0300
Subject: [as112-ops] auth ns for as112.net
In-Reply-To: <1dd45f3e-8a57-7b75-bf24-92edc1ce95e2@topnet.it>
References: <1dd45f3e-8a57-7b75-bf24-92edc1ce95e2@topnet.it>
Message-ID: <573C02F0.1020400@trex.fi>

Hi,

On 05/16/2016 10:16 PM, Antonio Prado wrote:
> there is something wrong with auth nameserver listed @ godaddy.
> this is what I get when querying for www.as112.net IN A

> PUCK.NETHER.NET 	status: REFUSED
> NS.DNS-OARC.NET 	status: NOERROR	64.191.0.198
> SEC2.AUTHDNS.RIPE.NET 	status: NOERROR	149.20.58.198
> SNS-PB.ISC.ORG 		status: NOERROR	149.20.58.198
> AUTHNS2.NET.UMD.EDU	connection timed out
> ISKRA.OTTIX.NET		status: NOERROR	149.20.58.198

This reminds me, I would be interested to provide a secondary for the 
zone(s) at ns.trex.fi and/or ns.axu.tm. It seems to already have a nice 
number of secondaries, but I just wanted to let you know.

As to the above problem: this sounds like either the master or the list 
of secondaries for the zone have been changed without updating the 
upstream delegation and now the old secondaries can't get a zone transfer.

-- 
	+358 44 9756548 / http://www.trex.fi/
	Aleksi Suhonen / TREX Regional Exchanges Oy

	You say "potato", I say "closest-exit."

From keith at dns-oarc.net  Wed May 18 17:20:25 2016
From: keith at dns-oarc.net (Keith Mitchell)
Date: Wed, 18 May 2016 13:20:25 -0400
Subject: [as112-ops] auth ns for as112.net
In-Reply-To: <CA+K1SUzhoWdnch9-DN+bTyV13J2=+oKH0YsphqMm+UnrYj4ZFA@mail.gmail.com>
References: <1dd45f3e-8a57-7b75-bf24-92edc1ce95e2@topnet.it>
 <CA+K1SUzhoWdnch9-DN+bTyV13J2=+oKH0YsphqMm+UnrYj4ZFA@mail.gmail.com>
Message-ID: <573CA459.2080103@dns-oarc.net>

On 05/16/2016 06:21 PM, Jonathan Stewart wrote:
> I can confirm that DNS doesn't resolve, as Antonio describes.
> 
> Is this website supposed to be working?

The as112.net website is hosted by DNS-OARC. Over the past few days
we've been migrating our primary infrastructure site - see:

	https://www.dns-oarc.net/node/357

which has included changing the IP address of the as112 website and auth
name servers from 149.20.58.198 to 64.191.0.198. So the outages you were
seeing were a side-effect of this migration and associated maintenance
downtime.

Looks like the website is now safely back up and running along with all
our other infrastructure, but please contact <admin at dns-oarc.net> if you
are still experiencing any problems.

(One benefit of this move is that OARC is now up and running for
 peering at the SFMIX exchange in the San Francisco Bay area, and we'll
 be getting an AS112 instance up and running there shortly :-)

Keith




> On Mon, May 16, 2016 at 2:16 PM, Antonio Prado <aprado at topnet.it
> <mailto:aprado at topnet.it>> wrote:

>     there is something wrong with auth nameserver listed @ godaddy.
> 
>     this is what I get when querying for www.as112.net
>     <http://www.as112.net> IN A
> 
>     PUCK.NETHER.NET <http://PUCK.NETHER.NET>         status: REFUSED
>     NS.DNS-OARC.NET <http://NS.DNS-OARC.NET>         status: NOERROR
>     64.191.0.198
>     SEC2.AUTHDNS.RIPE.NET <http://SEC2.AUTHDNS.RIPE.NET>   status:
>     NOERROR 149.20.58.198
>     SNS-PB.ISC.ORG <http://SNS-PB.ISC.ORG>          status: NOERROR
>     149.20.58.198
>     AUTHNS2.NET.UMD.EDU <http://AUTHNS2.NET.UMD.EDU>     connection
>     timed out
>     ISKRA.OTTIX.NET <http://ISKRA.OTTIX.NET>         status: NOERROR
>     149.20.58.198
> 
>     somewhere the website is not reachable


From aprado at topnet.it  Wed May 18 21:11:33 2016
From: aprado at topnet.it (Antonio Prado)
Date: Wed, 18 May 2016 23:11:33 +0200
Subject: [as112-ops] auth ns for as112.net
In-Reply-To: <573CA459.2080103@dns-oarc.net>
References: <1dd45f3e-8a57-7b75-bf24-92edc1ce95e2@topnet.it>
 <CA+K1SUzhoWdnch9-DN+bTyV13J2=+oKH0YsphqMm+UnrYj4ZFA@mail.gmail.com>
 <573CA459.2080103@dns-oarc.net>
Message-ID: <c7dfc7b1-99a0-a1cf-462f-0f1c9830ee71@topnet.it>

On 5/18/16 7:20 PM, Keith Mitchell wrote:
> Looks like the website is now safely back up and running along with all
> our other infrastructure, but please contact <admin at dns-oarc.net> if you
> are still experiencing any problems.

hi keith,

what I previously reported is still there:

@PUCK.NETHER.NET as112.net IN A
status: REFUSED

@AUTHNS2.NET.UMD.EDU as112.net IN A
status: SERVFAIL


besides, dnssec warnings are still there as well:

http://dnsviz.net/d/as112.net/dnssec/

thank you
--
antonio

From keith at dns-oarc.net  Thu May 19 17:56:08 2016
From: keith at dns-oarc.net (Keith Mitchell)
Date: Thu, 19 May 2016 13:56:08 -0400
Subject: [as112-ops] auth ns for as112.net
In-Reply-To: <c7dfc7b1-99a0-a1cf-462f-0f1c9830ee71@topnet.it>
References: <1dd45f3e-8a57-7b75-bf24-92edc1ce95e2@topnet.it>
 <CA+K1SUzhoWdnch9-DN+bTyV13J2=+oKH0YsphqMm+UnrYj4ZFA@mail.gmail.com>
 <573CA459.2080103@dns-oarc.net>
 <c7dfc7b1-99a0-a1cf-462f-0f1c9830ee71@topnet.it>
Message-ID: <573DFE38.3030304@dns-oarc.net>

On 05/18/2016 05:11 PM, Antonio Prado wrote:

>> Looks like the website is now safely back up and running along with all
>> our other infrastructure, but please contact <admin at dns-oarc.net> if you
>> are still experiencing any problems.
> 
> hi keith,
> 
> what I previously reported is still there:
> 
> @PUCK.NETHER.NET as112.net IN A
> status: REFUSED
> 
> @AUTHNS2.NET.UMD.EDU as112.net IN A
> status: SERVFAIL

Looks like the secondary servers for this zone need to change where they
are slaving it from, this should be the new addresses for

	ns.dns-oarc.net.	64.191.0.65 	2620:ff:c000:1::65

We'll reach out to them, but if any are reading this here it would
really helpful if they could update this as soon as convenient.

Keith


From as112-ops at trex.fi  Tue May 31 13:43:09 2016
From: as112-ops at trex.fi (Aleksi Suhonen)
Date: Tue, 31 May 2016 16:43:09 +0300
Subject: [as112-ops] Advice requested on a proposal to delegate .local
 to AS112
In-Reply-To: <20160421185006.GA5455@laperouse.bortzmeyer.org>
References: <20160421185006.GA5455@laperouse.bortzmeyer.org>
Message-ID: <574D94ED.5010309@trex.fi>

Hello,

On 04/21/2016 09:50 PM, Stephane Bortzmeyer wrote:
> In the Internet-Draft "Using DNAME in the root for the delegation of
> special-use TLDs" there is a proposal to delegate heavy-use
> non-existing TLD like .local to the new AS 112. Obviously, the advice
> of operators of the new AS 112 is very important. So, please, if you
> approve or disapprove this idea, speak now.

I think this is the very thing AS112 was created for, and I don't 
therefore see anything wrong with it. If someone finds their AS112 node 
is getting too much traffic, I'm sure they will just take it down 
without fuss.

Is there someone here whose node is getting >10Mbps right now under 
normal running conditions? >100Mbps?

My 2 cents,

-- 
	+358 44 9756548 / http://www.trex.fi/
	Aleksi Suhonen / TREX Regional Exchanges Oy

	You say "potato", I say "closest-exit."

From clement at cavadore.net  Tue May 31 16:55:44 2016
From: clement at cavadore.net (Clement Cavadore)
Date: Tue, 31 May 2016 18:55:44 +0200
Subject: [as112-ops] Advice requested on a proposal to delegate .local
 to AS112
In-Reply-To: <574D94ED.5010309@trex.fi>
References: <20160421185006.GA5455@laperouse.bortzmeyer.org>
 <574D94ED.5010309@trex.fi>
Message-ID: <1464713744.2192.43.camel@puisard.hivane.net>

On Tue, 2016-05-31 at 16:43 +0300, Aleksi Suhonen wrote:
> Is there someone here whose node is getting >10Mbps right now under 
> normal running conditions? >100Mbps?

I (Hivane Paris node) get around 5 to 6Mbit/s under normal conditions,
and sometimes 12-13Mbit/s for small periods of time (I guess when there
are routing problems towards other nodes, or maintenance windows). 

I don't think having more delegations may be a big issue, at least for
my node. Go ahead, thats AS112's objectives :)

-- 
Cl?ment Cavadore


From bortzmeyer at nic.fr  Tue May 31 18:50:31 2016
From: bortzmeyer at nic.fr (Stephane Bortzmeyer)
Date: Tue, 31 May 2016 20:50:31 +0200
Subject: [as112-ops] Advice requested on a proposal to delegate .local
 to AS112
In-Reply-To: <1464713744.2192.43.camel@puisard.hivane.net>
References: <20160421185006.GA5455@laperouse.bortzmeyer.org>
 <574D94ED.5010309@trex.fi>
 <1464713744.2192.43.camel@puisard.hivane.net>
Message-ID: <20160531185031.GA23821@sources.org>

On Tue, May 31, 2016 at 06:55:44PM +0200,
 Clement Cavadore <clement at cavadore.net> wrote 
 a message of 13 lines which said:

> I don't think having more delegations may be a big issue, at least
> for my node. Go ahead, thats AS112's objectives :)

THere are currently two obstacles to do it:

1) The DNS root zone is managed by a big pile of slow bureaucracies
(ICANN and the US governement). Any change takes years (because it is
something new: there are no DNAMEs in the root today).

2) The IETF is worried about the privacy risks of "transmitting" these
queries to random AS112 operators.

From jabley at hopcount.ca  Tue May 31 19:22:15 2016
From: jabley at hopcount.ca (Joe Abley)
Date: Tue, 31 May 2016 21:22:15 +0200
Subject: [as112-ops] Advice requested on a proposal to delegate .local
	to AS112
In-Reply-To: <20160531185031.GA23821@sources.org>
References: <20160421185006.GA5455@laperouse.bortzmeyer.org>
 <574D94ED.5010309@trex.fi> <1464713744.2192.43.camel@puisard.hivane.net>
 <20160531185031.GA23821@sources.org>
Message-ID: <75E3D9CB-705C-4A10-929D-EA8BEF0ECB8C@hopcount.ca>

Hi St?phane,

On 31 May 2016, at 20:50, Stephane Bortzmeyer <bortzmeyer at nic.fr> wrote:

> On Tue, May 31, 2016 at 06:55:44PM +0200,
> Clement Cavadore <clement at cavadore.net> wrote 
> a message of 13 lines which said:
> 
>> I don't think having more delegations may be a big issue, at least
>> for my node. Go ahead, thats AS112's objectives :)
> 
> THere are currently two obstacles to do it:
> 
> 1) The DNS root zone is managed by a big pile of slow bureaucracies
> (ICANN and the US governement). Any change takes years (because it is
> something new: there are no DNAMEs in the root today).

In particular, any change to root zone management procedures is going to run up against the ongoing process of changing the nature of the IANA Functions from a government contract to something new.

> 2) The IETF is worried about the privacy risks of "transmitting" these
> queries to random AS112 operators.

Just curious, who is more concerned about queries under .LOCAL being sent to AS112 operators than they are about queries for RFC1918 nets being sent to the same place?


Joe

