- dns-wg - mailman.ripe.net

Call for joining RSSAC Caucus
by Tripti Sinha 25 Jun '14

25 Jun '14

Dear colleagues, This is a friendly reminder to apply for RSSAC Caucus membership. The cut-off date for first round of membership is end of June, so please kindly submit your statement of interest before 1st of July<x-apple-data-detectors://0> to rssac-membership(a)icann.org<mailto:rssac-membership@icann.org>. On Monday 23rd of June RSSAC had its public session at ICANN 50 and it was announced that the first face to face caucus meeting will be held during IETF 90 in Toronto. Kind regards, Tripti Sinha on behalf of RSSAC Caucus membership committee

1 0

Call for joining RSSAC Caucus
by Tripti Sinha 18 Jun '14

18 Jun '14

Greetings, If you are interested in participating at ICANN's Root Server System Advisory Committee (https://www.icann.org/resources/pages/charter-2013-07-14-en) as a Caucus member, please kindly read the relevant information and Caucus document published at https://www.icann.org/resources/pages/rssac-caucus-2014-05-06-en and submit your statement of interest to rssac-membership(a)icann.org<mailto:rssac-membership@icann.org>. The RSSAC executive is working on publishing the final version of "Procedures documents" and at the moment is establishing the Caucus with a few work items ready to be discussed by the Caucus. If you would like to volunteer please kindly indicate those intentions known by sending an email to rssac-membership(a)icann.org<mailto:rssac-membership@icann.org>. Kind Regards, Kaveh Ranjbar, RSSAC Membership Committee Chair Tripti Sinha, RSSAC Membership Committee Member Paul Vixie, RSSAC Membership Committee Member

1 0

DNSMON changes
by Jim Reid 06 Jun '14

06 Jun '14

Although the WG's response to the NCC's proposal has been disappointing, there have been three statements of support (one with qualifications) and none against. It had been stated that silence implied consent. Since no objections have been raised, the WG has reached a decision that has lightweight consensus. Though not a formal consensus as would be understood in the context of the PDP. Which is OK as this issue is not in PDP territory anyway. Therefore the NCC should proceed as planned and published at: https://labs.ripe.net/Members/romeo_zwart/copy_of_proposed-time-lines-for-p… The points made by Peter and Daniel are worth further discussion and I encourage you all to do that. On one hand, there could be some benefit in providing "backwards compatibility" for visualising old data. OTOH, this may put an unreasonable burden on the NCC by creating an open-ended commitment to support legacy cruft and result in users who can't/won't migrate to the current platform. It would be good for WG members to express their opinions about this. My personal view is somewhere inbetween: provide some way of visualising the old data if that can be done with minimal effort/resources from the NCC on a best efforts, unsupported basis. If that facility later dies, it dies and that's the end of the matter. YMMV.

3 2

indulgence satiated
by manning bill 05 Jun '14

05 Jun '14

Thanks All for taking the time to prod 2001:500:84::b Looks like it is reachable from many places… enough that we will proceed to augment the “B” root server with perhaps the last in a long line of IPv6 addresses that it has had over the last 15 years. Splay will increase over time. /bill /bill Neca eos omnes. Deus suos agnoscet.

4 7

WG comment on DNSMON changes
by Jim Reid 03 Jun '14

03 Jun '14

Colleagues, you might recall that last month the NCC announced a time-line for some changes to the DNSMON service. This was discussed when the WG met in Warsaw last week. In outline, the old service is based on TTM boxes which are due to be retired at the end of June. These are already beyond their anticipated life-span. The new version of DNSMON uses the Atlas probes and is already operational. It is possible some users of DNSMON may need to change their internal tools and processes when transitioning to the new platform if these depend on the data gathering done by the soon-to-die TTM boxes. If this affects you, please speak up now! I would be grateful if you could express your approval or rejection of the NCC's approach and proposed time-line. Details are at https://labs.ripe.net/Members/romeo_zwart/copy_of_proposed-time-lines-for-p…. There was little to no response by the WG to the earlier announcement. This makes both your WG Co-chairs and the NCC staff uncomfortable. After the WG co-chairs and NCC's DNSMON team discussed this last week, we agreed to set the end of this month as the final date for comments. Although we can work on the operating principle that silence implies consent, it would be better for all concerned if there were positive messages of support (or even ones of objection) on the list. Please respond. I'd appreciate it if you can comment on the list to indicate that you approve (or disapprove) of the current proposal and/or time-line. thanks in advance

7 6

crave your indulgence
by manning bill 28 May '14

28 May '14

If you wouldn’t mind a quick tracerooute - Can you confirm reachability to the following: 2001:500:84::b Thanks in advance. /bill Neca eos omnes. Deus suos agnoscet.

5 5

Provisional agenda for RIPE 68
by Jim Reid 07 May '14

07 May '14

Colleagues, my apologies for the delay in getting the agenda prepared and distributed for next week. At long last, here it is. Please note one or two items have not get been confirmed, so there may be some changes between now and next Wednesday. Although I don't expect there will be any, it would be unwise to make life-changing decisions on the assumption that the V1.4 agenda remains unchanged. Hope to see most of you in Warsaw next week. # # $Id: agenda,v 1.4 2014/05/07 11:00:29 jim Exp $ # PROVISIONAL AGENDA: RUNNING ORDER, TIMES & EVEN CONTENT MAY CHANGE [0] Usual Administrivia 5 mins Agenda bashing Minutes of previous meeting Review of Action Items [1] NCC Report 15 mins Stuckee, RIPE NCC [2] DDoS Forensics 25 mins Curon Davies, JISC RSC Wales As a result of daily attacks against a Further Education College in Wales, a connection was noticed between changing DNS entries and the attacked IP address. Using innovative DNS responses inspired by GeoDNS and logging all requests to the authoritative server, it has been possible to trace the source of DDoS and spoofed flood attacks. [3] Measuring DNSSEC validation deployment 15 mins Nicolas Canceill, NLnet Labs We have executed a research in which the RIPE Atlas measurement network was utilized to quantify the amount/percentage of resolvers that do DNSSEC validation. We were not only able to identify which resolvers do DNSSEC validation, but also which resolvers are security-aware (and to which level). Moreover, during the research some particular cases have been found: the existence of insecure fallbacks in case of missing signatures, and a troublesome issue with secure wildcard records. [4] Measuring DNSSEC from the end user perspective 30 mins Geoff Huston, APNIC The presentation explores the technique of measuring the characteristics of the DNS and its performance by posing a set of DNS questions to end users and observing the queries that occur at the authoritative servers in response. Using online advertising channels the tests can be undertaken at a level of high volume and broad spread across the Internet. The presentation will describe the use of this technique in measuring DNSSEC validation, DNS over TCP, DNS performance and similar. LUNCH [5] Report from Ad-hoc ccTLD group 10 mins Peter Koch, DENIC [6] Registry Infrastructure Transformation 20 mins Michael Daly, Nominet In the past 24 months Nominet the UK Registry have completely transformed the infrastructure that is used to deliver the UK Registry services. The infrastructure has been moved to be much more agile and highly available. This presentation will detail some of the choices we made and methods we used to deploy and manage our infrastructure. [7] Google DNS hijacking in Turkey 30 mins Stephane Bortzmeyer, AFNIC In March 2013, the Turkish government decided to prevent access to Twitter. It used some well-known techniques but also one which have not been documented in the real world before: using routing to hijack DNS resolvers such as Google Public DNS. What exactly happened and what could be done to prevent that? [8] DNSMON Developments 10 mins Stuckee, RIPE NCC [9] DNS Monitoring Common Practices/APIs Panel Session 15 mins To be confirmed [10] AOB 5 mins

2 1

Program in Warsaw?
by Stephane Bortzmeyer 05 May '14

05 May '14

I find nothing on this list, or on <https://ripe68.ripe.net/programme/meeting-plan/> (note the menu has all the WGs but DNS) The group was shut down while I looked elsewhere?

3 3

Timeline for Phasing Out the Old TTM-based DNSMON
by Romeo Zwart 23 Apr '14

23 Apr '14

Dear colleagues, A new article is available on RIPELabs, the "Timeline for Phasing Out the Old TTM-based DNSMON": https://labs.ripe.net/Members/romeo_zwart/copy_of_proposed-time-lines-for-p… We invite your feedback about our planning before Tuesday, 15 April, to the DNS Working Group Mailing List <dns-wg(a)ripe.net> or to myself directly <romeo.zwart(a)ripe.net>. After the deadline has passed, the responses received will be summarised to the DNS Working Group Mailing List, along with a decision based on the feedback provided. Romeo Zwart GII Services Manager RIPE NCC

2 1

[Dnsmon-test] DNSMON beta update
by Massimo Candela 10 Apr '14

10 Apr '14

Hi all, We reached another great amount of improvements on the new DNSMON, especially for stability and user interaction. Some of them are reported in the following lines: - a full screen mode has been introduced; - we continued to improve the time navigation and time perception (e.g. by hovering the “get last data” button a sliding menu allows you to select the last 5 hours, 1 day, 1 week, and 1 month); - the embed code is now more flexible (e.g. the exact widget dimensions can be specified, alternatively the widget will automatically optimise them); - some improvements in the user interaction (e.g. the selection of cells is now more intuitive and precise and the flickering during interaction has been removed); - improved the quality and readability of the JSON. Regards, Massimo

1 0