- ripe-atlas - mailman.ripe.net

Enabling Data Compression in RIPE Atlas
by Vesna Manojlovic 19 Jun '15

19 Jun '15

Dear colleagues, We’d like to enable gzip compression on all of RIPE Atlas' measurement API calls — but thanks to the BREACH vulnerability, doing so could mean that some enterprising individual with an obscene amount of time on their hands might be able read the contents of the responses. This means measurement results as well as metadata for measurements — including the small number of measurements not marked as “public”. We believe the drawbacks are negligible, but we’re looking for community support. Find out more in this RIPE Labs article: https://labs.ripe.net/Members/daniel_quinn_39/enabling-data-compression-in-… Regards, Vesna Manojlovic

1 0

atlas anchor DANE records
by Bjørn Mork 17 Jun '15

17 Jun '15

Hello, I just noticed "We also generate a DANE record for each anchor" in the docs and became instantly curious. There aren't that many DANE records out there in the wild :) The records seem to be pointing to a self signed certificate (as documented), but with 'usage' = 1 instead of 3 as expected. At least the two records I looked at had this - I assume they are all created the same way. Is this intentional? It makes 'normal' verification fail: bjorn@canardo:~$ tlsa --debug --verify nl-ams-as3333.anchors.atlas.ripe.net Received the following record for name _443._tcp.nl-ams-as3333.anchors.atlas.ripe.net.: Usage: 1 (End-Entity Constraint + chain to CA) Selector: 0 (Certificate) Matching Type: 1 (SHA-256) Certificate for Association: 88422d55424ca8f6f74e165016851cb195fc0919f82f8762574a4d71868964e9 This record is valid (well-formed). Attempting to verify the record with the TLS service... Got the following IP: 193.0.19.107 FAIL (Usage 1): Certificate offered by the server matches the one mentioned in the TLSA record but the following error was raised during PKIX validation: X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT The matched certificate has Subject: /C=nl/ST=ams/L=ams/O=as3333/CN=nl-ams-as3333.anchors.atlas.ripe.net Got the following IP: 2001:67c:2e8:11::c100:136b FAIL (Usage 1): Certificate offered by the server matches the one mentioned in the TLSA record but the following error was raised during PKIX validation: X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT The matched certificate has Subject: /C=nl/ST=ams/L=ams/O=as3333/CN=nl-ams-as3333.anchors.atlas.ripe.net bjorn@canardo:~$ tlsa --debug --verify se-sto-as8674.anchors.atlas.ripe.net Received the following record for name _443._tcp.se-sto-as8674.anchors.atlas.ripe.net.: Usage: 1 (End-Entity Constraint + chain to CA) Selector: 0 (Certificate) Matching Type: 1 (SHA-256) Certificate for Association: 2d92e341d2181011c520ad92229155e1350fc4f7b9e628198be1f9589ec7a53f This record is valid (well-formed). Attempting to verify the record with the TLS service... Got the following IP: 185.42.136.158 FAIL (Usage 1): Certificate offered by the server matches the one mentioned in the TLSA record but the following error was raised during PKIX validation: X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT The matched certificate has Subject: /O=AS8674/L=STO/C=SE/CN=se-sto-as8674.anchors.atlas.ripe.net Got the following IP: 2a01:3f0:0:60::5 FAIL (Usage 1): Certificate offered by the server matches the one mentioned in the TLSA record but the following error was raised during PKIX validation: X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT The matched certificate has Subject: /O=AS8674/L=STO/C=SE/CN=se-sto-as8674.anchors.atlas.ripe.net What is the intended use of these records? And why doesn't https://atlas.ripe.net/ have a DANE record as well? :) Bjørn

1 0

HTTP Measurements with RIPE Atlas
by Vesna Manojlovic 17 Jun '15

17 Jun '15

Dear colleagues, After a discussion with the community about HTTP measurements, RIPE NCC will start implementing this as a publicly available measurement type. Please find some more information on RIPE Labs: https://labs.ripe.net/Members/kistel/http-measurements-with-ripe-atlas Kind regards, Vesna Manojlovic RIPE NCC

3 2

Atlas Anchors and LogJam
by Ben O'Hara 15 Jun '15

15 Jun '15

Hi, We host an Atlas Anchor, but our network monitoring still shows it being vulnerable to Logjam. Can you please let us know when this will be upgraded to fix the vulnerability? Cheers BEN O'HARA Senior Network and Systems Engineer P +61 9866 3710 [Bombora Technologies Logo]<http://www.bomboratech.com.au/> www.bomboratech.com.au<http://www.bomboratech.com.au/> Follow us on Twitter<https://twitter.com/BomboraTech> The Bombora Technologies group of companies includes AusRegistry, ARI Registry Services, AusRegistry International and ZOAK Solutions. The information contained in this communication is intended for the named recipients only. It is subject to copyright and may contain legally privileged and confidential information and if you are not an intended recipient you must not use, copy, distribute or take any action in reliance on it. If you have received this communication in error, please delete all copies from your system and notify us immediately.

2 1

Notifications for unreachable probes
by Peter Eckel 10 Jun '15

10 Jun '15

Hi, I have set up a notification if my probe 10293 is down for more than 15 minutes. Since my main mail address is located on a server likely to be unavailable if the probe is down, the notification was set to a different mail address not in the same network. Unfortunately it seems that the notification address is ignored, and the notification is sent to the reporting address instead. Does anyone else see that problem as well? Regards, Peter.

2 1

ADP, Saint-Denis, France has joined RIPE Atlas anchors
by Eamonn Lane 08 Jun '15

08 Jun '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called fr-ysd-as201958 and is hosted by : ADP, Saint-Denis, in France. Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ Thank you for participating in RIPE Atlas! Kind regards, RIPE Atlas Team RIPE NCC atlas(a)ripe.net

1 0

Conova Communications GmbH, Salzburg, Austria has joined RIPE Atlas anchors
by Eamonn Lane 08 Jun '15

08 Jun '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called at-szg-as5404 and is hosted by : Conova Communications GmbH in Salzburg, Austria . Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ Thank you for participating in RIPE Atlas! Kind regards, RIPE Atlas Team RIPE NCC atlas(a)ripe.net

1 0

ASTI (Philippines) has joined RIPE Atlas anchors
by Michela Galante 04 Jun '15

04 Jun '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called ph-qzt-as9821 and it is hosted by ASTI in Quezon City, Philippines, and sponsored by APNIC. Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ Thank you for participating in RIPE Atlas! Kind Regards, RIPE Atlas Team atlas(a)ripe.net

1 0

COMSATS Internet Services (Pakistan) has joined RIPE Atlas anchors
by Michela Galante 04 Jun '15

04 Jun '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called pk-isb-as7590 and it is hosted by COMSATS Internet Services in Islamabad, Pakistan, and sponsored by APNIC. Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ Thank you for participating in RIPE Atlas! Kind Regards, RIPE Atlas Team atlas(a)ripe.net

2 1

Matrix DATA (NL) has joined RIPE Atlas Anchors
by Alastair Strachan 28 May '15

28 May '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called nl-hrd-as34612 and it is hosted by Matrix DATA in Harderwijk (NL) Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ <https://atlas.ripe.net/anchors/list/> Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ <https://atlas.ripe.net/about/anchors/> Thank you for participating in RIPE Atlas! Kind Regards, RIPE Atlas Team

1 0

ICANN (US) has joined RIPE Atlas Anchors
by Alastair Strachan 28 May '15

28 May '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called us-rtv-as16876 and it is hosted by ICANN in Reston (US) Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ <https://atlas.ripe.net/anchors/list/> Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ <https://atlas.ripe.net/about/anchors/> Thank you for participating in RIPE Atlas! Kind Regards, RIPE Atlas Team

1 0

Atlas and TLSA RR's?
by Rose, Scott W. 26 May '15

26 May '15

Hello, We have a TLSA test tool called DANELaw (https://www.had-pilot.com/dane/danelaw.html) The tool basically check for a TLSA RR for a given domain name and makes sure it matches the presented TLS certificate. Over the last few days we noticed a large volume of tests for TLSA RR's ending in "anchor.atlas.ripe.net". This isn't a big deal (except for our crude logging system), just wondering if this is a self-check, or some test. Also, our tool isn't really a production service, so if it goes down - will it effect anything? Scott =================================== Scott Rose NIST scott.rose(a)nist.gov +1 301-975-8439 Google Voice: +1 571-249-3671 http://www.dnsops.gov/ https://www.had-pilot.com/ ===================================

2 1

Marist College (US) has joined RIPE Atlas Anchors
by Alastair Strachan 22 May '15

22 May '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called us-pou-as6124 and it is hosted by Marist College in Poughkeepsie, US. Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ <https://atlas.ripe.net/anchors/list/> Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ <https://atlas.ripe.net/about/anchors/> Thank you for participating in RIPE Atlas! Kind Regards, RIPE Atlas Team

1 0

Big latency change
by Daniel Baeza (Red y Sistemas TVT) 21 May '15

21 May '15

Hi folks, How can I check what happened at 13:00 (Dont know if the time in my probe is UTC or UTC+2) of today in the a.root-servers.net? My latency with the a-root changed from 117 to 45ms and Im curious of what happened. I've took a look in the RIPEstat routing for the IP Address of the root server, and at the same time the BGP had changes, but there are too many AS involved I cant follow it. Thanks in advance! -- Daniel Baeza

4 4

ALTUSHOST B.V. in Dronten (NL) has joined RIPE Atlas Anchors
by Alastair Strachan 21 May '15

21 May '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called nl-dro-as51430 and it is hosted by ALTUSHOST B.V. in Dronten (NL). Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ <https://atlas.ripe.net/anchors/list/> Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ <https://atlas.ripe.net/about/anchors/> Thank you for participating in RIPE Atlas! Kind Regards, RIPE Atlas Team

1 0

ICANN in El Segundo (US) has joined RIPE Atlas Anchors
by Alastair Strachan 21 May '15

21 May '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called us-els-as40528 and it is hosted by ICANN in El Sugundo. Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ <https://atlas.ripe.net/anchors/list/> Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ <https://atlas.ripe.net/about/anchors/> Thank you for participating in RIPE Atlas! Kind Regards, RIPE Atlas Team

1 0

University Carlos III of Madrid, Leganes, Spain has joined RIPE Atlas anchors
by Eamonn Lane 15 May '15

15 May '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called es-leg-as766 and is hosted by University Carlos III of Madrid, Leganes, Spain. Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ Thank you for participating in RIPE Atlas! Kind regards, RIPE Atlas Team RIPE NCC atlas(a)ripe.net

1 0

Invalid JSON because of DNS TXT records
by Stephane Bortzmeyer 15 May '15

15 May '15

The DNS, as we know, is a jungle. People put anything in their TXT records, even control characters. Atlas faithfully returns this content in the JSON files (see measurement #2004707). Then they are no longer legal JSON (RFC 7159, section 7) and crash the JSON libraries. Who should fix it? My first guess is that Atlas should not produce illegal JSON files and therefore should escape such texts.

2 1

New on RIPE Labs: AMS-IX Outage during RIPE70 as Seen with RIPE Atlas
by Vesna Manojlovic 14 May '15

14 May '15

FYI -------- Forwarded Message -------- Subject: [mat-wg] New on RIPE Labs: AMS-IX Outage during RIPE 70 as Seen with RIPE Atlas Date: Thu, 14 May 2015 17:20:21 +0200 From: Mirjam Kuehne <mir(a)ripe.net> To: mat-wg(a)ripe.net Dear colleagues, Please find this new article on RIPE Labs including some visualisations of yesterday's AMS-IX network outage: https://labs.ripe.net/Members/kistel/the-ams-ix-outage-as-seen-with-ripe-at… Kind regards, Mirjam Kuehne RIPE NCCC

1 0

M-net Telekommunikations GmbH in Munich has joined RIPE Atlas Anchors
by Alastair Strachan 14 May '15

14 May '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called de-muc-as8767 and it is hosted by M-net Telekommunikations GmbH in Munich Germany Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ <https://atlas.ripe.net/anchors/list/> Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ <https://atlas.ripe.net/about/anchors/> Thank you for participating in RIPE Atlas! Kind Regards, RIPE Atlas Team

1 0

Wikia in San Jose, USA has joined RIPE Atlas Anchors
by Alastair Strachan 06 May '15

06 May '15

Dear RIPE Atlas users, We're happy to announce that another RIPE Atlas anchor has joined the network and is now available as a target for probe hosts conducting their own user-defined measurements. The new anchor is called us-sjc-as22300 and it is hosted by Wikia in San Jose (USA) Anchoring measurements (ping, ping6, traceroute and traceroute6) are scheduled towards this anchor from all the other anchors as well as several hundred probes, providing a continual overview of regional reachability. Results of these measurements are available as raw data in JSON format, and visualised on the map and "seismograph" with many configurable features. You can access the anchoring measurements for all anchors at: https://atlas.ripe.net/anchors/list/ <https://atlas.ripe.net/anchors/list/> Learn more about RIPE Atlas anchors at: https://atlas.ripe.net/about/anchors/ <https://atlas.ripe.net/about/anchors/> Thank you for participating in RIPE Atlas! Kind Regards, RIPE Atlas Team

1 0

Geographic Selection of Probe
by Graham Beneke 28 Apr '15

28 Apr '15

Hi All Due to the huge number of probes in Europe there is always a heavy bias when selecting "whole world" for UDMs. In the past I could get around this by requesting numbers of probes from each region/continent. I can't figure out how to do this on the new interface. Using the wizard there does not seem to be a way to request a random subset of probes within the area selected. When using the manual probe selection I can't find what area codes I can use besides "WW" Am I missing something? -- Graham Beneke graham(a)apolix.co.za

2 1

New on RIPE Labs: Measuring Countries and IXPs in the SEE Region
by Vesna Manojlovic 24 Apr '15

24 Apr '15

Dear all, In this post we look at 10 countries in South East Europe and see how we can use RIPE Atlas to get a sense of routing and the interconnectedness of networks in these countries: https://labs.ripe.net/Members/emileaben/measuring-countries-and-ixps-in-the… Two prototype tools used here can benefit from your feedback & involvement: IXP-Jedi & OpenIPMap. Please take some time to play with the interactive grid (IXP-Jedi), e.g. for Romania: http://sg-pub.ripe.net/emile/ixp-country-jedi/RO-2015-04/ixpcountry/ Code: https://github.com/emileaben/ixp-country-jedi/ Or join the OpenIPMap to crowdsource geolocation of IP infrastructure: https://github.com/RIPE-Atlas-Community/openipmap Kind regards, Vesna

1 0

IPv6 auto-tagging failure?
by Bjørn Mork 21 Apr '15

21 Apr '15

Hello, I'm wondering a bit about the IPv6 auto-tagging. I recently reveived a v3 probe and connected it to a dual-stack enabled network. The probe was initially tagged as 2015-04-16 20:23 UTC Probe auto-tagged Your probe #22894 was automatically tagged as "system: IPv6 Capable" but then (on the next batch run?, after a couple of quick firmware upgrades (3.3.8 => 4650 => 4680): 2015-04-17 08:23 UTC Probe auto-untagged Your probe #22894 was automatically untagged as "system: IPv6 Capable" and there it has been since. This wouldn't worry me too much if it otherwise worked, but I noticed that the probe isn't listed with an "ASN v6" either. So I assume the missing tag prevents it from being used for v6 probing? AFAICS, the probe does take the announced prefix, and is actually *using* the provided IPv6 connectivity. The "Connection History" shows that it consistently uses its SLAAC address to connect to the controller. So why isn't it tagged as IPv6 capable/works etc? In desperation I tried different netwrok settings, static address, adding v6 DNS, and fiddling with the managed/other flags along with matching DHCPv6 config. Made no difference of course. If I understood correctly, the probe firmware won't currently do any DHCPv6, and v6 DNS is optional as long as there is a working v4 resolver available. Bjørn

3 2

RIPE Atlas accounting system renewal
by Robert Kisteleki 20 Apr '15

20 Apr '15

Dear Users, Today we're renewing our internal accounting system in RIPE Atlas. This change is almost exclusively internal, it hardly shows up on the public pages. If you see discrepancies regarding your credits tomorrow, then please let us know at atlas(a)ripe.net (ie. NOT this mailing list) so we can check. We'll privately contact the few users where we expect a more visible change. Regards, Robert & Johan & the rest of the team

1 0