November 2005 - NZNOG - lists.nznog.org

DNS Servers and peering
by Webmaster 04 Nov '05

04 Nov '05

A naive question: With the limiting of recursion (which appears to be a Good Thing) does it make it more (or less) important to have good network diversity (hint:peering) ? Or does it not matter? Richard >>> "Simon Allard" <simon.allard(a)staff.ihug.co.nz> 11/04/05 8:00 PM >>> Rob is correct (as always, Hi Rob!) There has been a plee on the ISP jungle drum network, to limit recursive DNS servers to protect the internet from evil doers. IHUG will be following very shortly, will post on here and give some notice before limiting the use of 203.109.252.42/43. Cheers, Simon Allard IHUG > -----Original Message----- > From: Rob Thomas [mailto:robt(a)cymru.com] > Sent: Friday, 4 November 2005 7:39 p.m. > To: NZNOG List > Subject: Re: [nznog] Inspire Net name servers > > Hi, team. > > ] http://www.theregister.co.uk/2005/10/24/dns_security_survey/ > > Might I also suggest: > > <http://www.dyndns.com/about/company/notify/archives/the_dangers_of_open _r > ecursive_dns.html> > > Thanks, > Rob. > -- > Rob Thomas > Team Cymru > http://www.cymru.com/ > ASSERT(coffee != empty); > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

4 4

Google Oddness
by Mark Foster 04 Nov '05

04 Nov '05

; <<>> DiG 9.2.1 <<>> www.google.com A ;; global options: printcmd ;; connection timed out; no servers could be reached ns1.google.com through ns4.google.com are as follows: ns1.google.com. IN A 216.239.32.10 ns2.google.com. IN A 216.239.34.10 ns3.google.com. IN A 216.239.36.10 ns4.google.com. IN A 216.239.38.10 I can't get to any of those. Wonder if 216.239/16 has dissapeared off the net? traceroute to 216.239.32.10 (216.239.32.10), 30 hops max, 38 byte packets 1 akl-colo1.helix.net.nz (202.50.176.78) 42.880 ms 0.222 ms 0.171 ms 2 202-49-59-254.level48.net (202.49.59.254) 0.450 ms 0.354 ms 0.324 ms 3 qsi2.ape.net.nz (192.203.154.29) 2.005 ms 0.662 ms 0.853 ms 4 gateway3-acc-skyt.qsi.net.nz (202.89.128.91) 26.475 ms * 4.674 ms 5 Mercury-Quicksilver-FE-1-0-0-402-ar1.akl1.gblx.net (203.192.179.9) 4.059 ms 3.245 ms 3.954 ms 6 po0-0.gw2.sjc1.asianetcom.net (202.147.50.130) 156.300 ms 155.490 ms 158.930 ms 7 72.14.197.37 (72.14.197.37) 156.797 ms 159.034 ms 158.760 ms 8 * * * Problem exists from both QSI and GGI... Mark.

4 3

Inspire Net name servers
by Mark Seward 03 Nov '05

03 Nov '05

ns1.inspire.net.nz (203.114.128.1), and ns2.inspire.net.nz (203.114.128.2) now accept recursive and cached queries from Inspire Net customers only. Queries for domains that ns1 and ns2 are authoritative for are unaffected. Mark Seward Inspire Net Ltd.

7 9

Re: [nznog] Inspire Net name servers
by Simon Allard 03 Nov '05

03 Nov '05

Rob is correct (as always, Hi Rob!) There has been a plee on the ISP jungle drum network, to limit recursive DNS servers to protect the internet from evil doers. IHUG will be following very shortly, will post on here and give some notice before limiting the use of 203.109.252.42/43. Cheers, Simon Allard IHUG > -----Original Message----- > From: Rob Thomas [mailto:robt(a)cymru.com] > Sent: Friday, 4 November 2005 7:39 p.m. > To: NZNOG List > Subject: Re: [nznog] Inspire Net name servers > > Hi, team. > > ] http://www.theregister.co.uk/2005/10/24/dns_security_survey/ > > Might I also suggest: > > <http://www.dyndns.com/about/company/notify/archives/the_dangers_of_open _r > ecursive_dns.html> > > Thanks, > Rob. > -- > Rob Thomas > Team Cymru > http://www.cymru.com/ > ASSERT(coffee != empty); > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Re: [nznog] Google Oddness
by Lesley Walker 02 Nov '05

02 Nov '05

> Google Groups has fallen over now. And it's back. LW.

1 0

Re: [nznog] Google Oddness
by Lesley Walker 02 Nov '05

02 Nov '05

Google Groups has fallen over now. ----- Original Message Follows ----- > On 03/11/05, Mark Foster <blakjak(a)blakjak.net> wrote: > > > > I can't get to any of those. Wonder if 216.239/16 has > > dissapeared off the net? > > > Seems to be a widespread problem at google - gmail was > down as well but coming up now.... > -- > Ian McDonald > http://wand.net.nz/~iam4 > WAND Network Research Group > University of Waikato > New Zealand > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Update to Telecom Xtra DNS servers
by Ted Grenfell 02 Nov '05

02 Nov '05

As part of our ongoing DNS service improvements, Telecom is making some changes to it's DNS servers which will affect some non-Telecom customers. The following Xtra name servers will in future only accept queries from Non-Telecom customers for domains that the name servers are authoritative for. Recursive queries for other domains (e.g. www.google.com) will no longer work. * dnsh1.xtra.co.nz ( 202.27.184.3 ) also known as alien.xtra.co.nz * dnsh2.xtra.co.nz ( 202.27.184.5 ) also known as terminator.xtra.co.nz We will be phasing in these changes from November 15th over a period of several weeks and you may wish to alert your help desks to check the DNS settings of users having problems after that. Currently Xtra operates the following recursive DNS services: * dnsc1.xtra.co.nz ( 202.27.158.40 ) * dnsc2.xtra.co.nz ( 202.27.156.72 ) We are happy for external people to query those IP's for DNS troubleshooting and similar purposes but they should not be directly configured into machines. Please note these IP's may change from time to time and external access may be limited or withdrawn without prior warning (especially in cases of abuse). Regards, -- Ted Grenfell, ISP Performance Manager, IS Online Services, Telecom NZ Ltd Mob: +64 274 435 455; DDI: +64 9359 5854; Fax: +64 9377 0781; Pager: +64 2611 1445 ICQ: 191891; MSN Messenger: cameleon @ xtra.co.nz Level 11, 8 Hereford St, Private Bag 92028, Auckland CBD, New Zealand "today was so quiet, you could hear a packet drop" - Tom Liston, ISC Handler's Diary This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.

9 11

Re: [nznog] Update to Telecom Xtra DNS servers
by Ted Grenfell 01 Nov '05

01 Nov '05

There are stats but we do not have a view on the exact numbers of people who have configured alien and terminator as their DNS. There will be some and they will be impacted in some way from recursion being disabled. Hence the heads up. Regards, Ted Grenfell ISP Performance Manager IS Online Services T 09 359 5854 F 09 377 0781 M 0274 435 455 E ted.grenfell(a)telecom.co.nz W www.telecom.co.nz Level 11, Telecom House, 8 Hereford St, Private Bag 92028, Auckland, New Zealand ________________________________ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." -----Original Message----- From: Brian Gibbons [mailto:brian(a)outersite.co.nz] Sent: Wednesday, 2 November 2005 1:46 p.m. To: Joe Abley Cc: Ted Grenfell; NZNOG Subject: Re: [nznog] Update to Telecom Xtra DNS servers >From: "Joe Abley" <jabley(a)isc.org> > Unless Xtra's planned configuration is particularly unusual, >I would imagine they would return answers from the cache >where they exist, return authoritative answers in the case of >queries that they have authoritative data for, and otherwise >return a referral to the root. "no answers" is the usual "not here" reply (like ns1.ihug.co.nz) And therein lies the problem. For a non Xtra user, that has Xtra DNS servers hard coded, 90% of DNS requests will probably work because Xtra's servers have much of the nz internet namespace in their cache, (or the servers are authorititive) The IP address 202.27.184.3 is a virus, it seems have spread into the configurations of many NZ computers, I think it is one of those "it just works" scenarios and computer technicians have used it as a default fix for many "wierd" DNS issues. Once Xtra disable recursion for non Xtra customers, those same techncians will be challenged with trying to diagnose a very intermittent "page can not be displayed" fault. Ted, if we assume this change is being made because there are a significant number of requests (relative to the size of your user base) coming from non Xtra IP addresses, then we would have to assume that a significant number of users (that have dumb client resolvers) are going to be affected. Are there any statistics available from your name servers on the scale of this issue (Like is it 10% non Xtra requests?) Cheers BG

1 0

Re: [nznog] Update to Telecom Xtra DNS servers
by Ted Grenfell 01 Nov '05

01 Nov '05

All IP's mentioned in my previous email are still accepting queries. Nothing has yet been implemented as we wanted to ensure advance notice was given so I'm not sure why you were getting 440's sorry. Regards, Ted Grenfell ISP Performance Manager IS Online Services T 09 359 5854 F 09 377 0781 M 0274 435 455 E ted.grenfell(a)telecom.co.nz W www.telecom.co.nz Level 11, Telecom House, 8 Hereford St, Private Bag 92028, Auckland, New Zealand ________________________________ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." -----Original Message----- From: Regan Murphy [mailto:regan.murphy(a)oasystems.co.nz] Sent: Wednesday, 2 November 2005 10:19 a.m. To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Update to Telecom Xtra DNS servers >>What action will those servers take when they receive a request from a non Xtra IP? I forgot to switch the forwarded on one of my dns servers away from xtra when I changed ISPs and last week (or the previous week?) I couldn't resolve any non-xtra/telecom queries.. I just got request denied (440?) errors. I have since fixed my forwarder entry but I would suggest that the change was already made (or maybe the change was made and it was subsequently rolled back in favour of a public notice) -- Regan _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

Re: [nznog] Update to Telecom Xtra DNS servers
by Regan Murphy 01 Nov '05

01 Nov '05

>>What action will those servers take when they receive a request from a non Xtra IP? I forgot to switch the forwarded on one of my dns servers away from xtra when I changed ISPs and last week (or the previous week?) I couldn't resolve any non-xtra/telecom queries.. I just got request denied (440?) errors. I have since fixed my forwarder entry but I would suggest that the change was already made (or maybe the change was made and it was subsequently rolled back in favour of a public notice) -- Regan

1 0