DNSSEC-aware resolvers

I noticed that  the biggest ISPs in US  (Comcast, AT&T, Sprint, Verizon etc) have made  their resolvers DNSSEC-aware.  This is in response to FCC recommendation  to protect their customers.  The task is easy, just add the root trust anchor in resolvers and enable DNSSEC in configuration file.

In other countries, if ISPs do not want to validate DNSSEC, they should leave this job to corporate users or end users.  In that case, they should not block DNSSEC traffic in their network with UDP larger than 512 bytes.  Not just don’t block, they should set their firewalls in an appropriate way to allow large UDP  payload to go through.  In fact, this requirement is not just for DNSSEC, it is also for IPv6.   When a resolver ask for the name servers of .com from the root zone, 13 name servers, 13 IPv4 addresses and 13 IPv6 addresses will be provided.  The UDP size could be larger than 512 bytes.

Europe ran out of IPv4 addresses

Europe has run out of IPv4 addresses, that was announced by RIPE on 14 September 2012.  That is a good news.  In the lack of IPv4 addresses, ISPs, mobile operators and large corporations will think seriously about  IPv6 deployment in order to sustain their future business plans.  This will drive the growth of IPv6.

In fact, in Asia Pacific region, we have no more IPv4 addresses since 15 April 2011.

I am a keen supporter of IPv6.  All my emails to gmail users are sent over IPv6 channel everyday.

rescuing mail server

The Hong Kong National Education Centre (HKNEC) has been under DDoS attack by Anonymous since last Saturday and the attack is going on.  Both web access and email service can not respond.  From DNS records, I note that there are some actions taking place to rescue the mail service:

hknec.org.              3600    IN      MX      90 218.103.29.37.

hknec.org.              3600    IN      MX      10 mail.hknec.org.

HKNEC wants to use the backup mail server to rescue in case the main can not respond.  However MX can not point to an IP address.  "218.103.29.37. " is wrong with a full stop after 37.  For host name, the last full stop is required.

Another thing wrong is that the backup mail server (218.103.29.37)  and the main server (218.103.29.36) are on the same network segment and the network segment is now under heavy DDoS traffic.  An IP address outside the network segment should be used for mail backup.

Don't laugh...  I have learnt a lot from the rescue operation of HKNEC.

NSEC3+OptOut

In my past four previous talks about DNSSEC in Hong Kong, I told audiences about weakness of NSEC in zone walking and NSEC3 can prevent this by providing hashed names to give signed proof of non-exsitence records. However, I have not touched on NSEC3+OptOut which aims at TLD. Here it is. 

With “NSEC3 Opt-Out”, only child zones that are themselves DNSSEC signed and having DS suibmitted to TLD will be signed by the TLD operator. An example is that if  a TLD operator has 500,000 names in its zone of which 1% of all child zones have DS already submitted, under the opt-out scheme, the final TLD zone will contain about 5,000 signed DS  (instead of 500,000 signed DS records, of  which 495,000 do not require NSEC3 hashed names). Opt-Out will reduce zone file size while serving DNSSEC optimally at TLD. 

If all child zones in a TLD have DS submitted, the effect of Opt-out will be nullified.

Future career plan

My son is applying for Sir Edward Youde Memorial Scholarship for subsidy of studying Economics in university next year.  In the application form, there is a box called "Future Career Plan" for him to fill in.  He sought my help and I came with the following:

"I plan to be an economic consultant providing professional advices and consulting services on economic, financial, and business strategies to large corporations and government agencies. Through my knowledge across multiple industries, I will develop state-of-the-art analyses and insights for our clients on complex business issues."

It is hard to predict the future. I just put down something from my basic instinct.

Apology from godaddy

I received an apology from CEO of godaddy about the service interruption on this Monday.  I have been a loyal customer of godaddy.com for over 12 years, and I can recall that there has been no service outage in the past 12 years except the one happened on Monday.   No worry, I will stay with godaddy, the number one registrar in the world.

Dear warren kwok,

We owe you a big apology for the intermittent service outages we experienced on September 10 that may have impacted your website, your email and other Go Daddy services.

We let you down and we know it. We take our responsibilities — and the trust you place in us — very seriously. I cannot express how sorry I am to those of you who were inconvenienced.

The service outage was due to a series of internal network events that corrupted router data tables. Once the issues were identified, we took corrective actions to restore services for our customers and GoDaddy.com. We have implemented a series of immediate measures to fix the problem.

At no time was any sensitive customer information, including credit card data, passwords or names and addresses, compromised.

Throughout our history, we have provided 99.999% uptime in our DNS infrastructure. This is the level of performance we expect from ourselves. Monday, we fell short of these expectations. We have learned from this event and will use it to drive improvement in our services.

As a result of this disruption, you will receive 30% off any new product or renewal.* This offer will be available to you for the next 7 days. Simply place source code Apology4a in your cart or mention the code when you call 480-505-8877.

It's an honor to serve you. As always, please call us 24/7 at 480-505-8877 — anytime, for any reason. 

Sincerely,

Scott Wagner
CEO
GoDaddy.com

Kaspersky AV sucks

I did not use my notebook for almost a week.  When I opened it last night, Kaspersky AV prompted me to update AV database.  Oh shit, the accumulated new AV signatures took up a file size of 9534KB and my notebook was downloading at 22KB/sec.  It would take me 433 seconds to complete the process. I have used Trend Micro Tatanium and such trouble does not exist.

We are now living in a cloud-based computing era.  By now, AV protection should all be cloud-based and there is no need for users to regularly download AV signatures.  I have decided to uninstall Kaspersky.

Dying for a Job

Who dare to write such a letter for a job?

Dear Sir,

Application for Employment

I refer to the recent death of the Technical Manager at your Company and hereby apply for the replacement  of the deceased Manager.

Each time I apply for a job, I get a reply that there is no vacancy but in this case I have caught you red-handed and you have no excuse because I even attended the funeral to be sure that he was truly dead and buried before applying.

Attached to this letter is a copy of my CV and his death certificate.

Yours faithfully,

(xxx yyy zzzz) 

Portable IPv6 Address Blocks need not be multi-homed

I almost forgot to mention one important IPv6 development in the Asia Pacific Region.  APNIC 34 made a decision to allow portable IPv6 address (Provider Indepedent) blocks be allocated to applicants without using multi-homed configuration.  Many companies can have their own /48 address block and they need not change their network configurations when changing serving ISP.  There is an argument that such arrangement would result in a large number of fragmented /48 blocks in the global routing table.  The design of IPv6 is to have routes in terms of  /32.  Hey, routers' performance are not really affected  by large routing table.  Who care ? We should consider the benefits to end users instead of giving less loading to equipment.

APNIC is the only RIR that waives the requirement of multi-homing in allocation of Provider Independent IPv6 address block.   Seems that the Asia Pacific region is moving faster than other regions.

Greylisting in v6 SMTP servers

I have observed that many v6 SMTP servers are using greylisting.  I am not quite happy with greylisting because of the extra delay time in delivering a legitimate email. If some messages are urgent, you expect the recipient can get shortly after you click the send button.  But for IPv6, can we prove that greylisting can really help since as of today there is no IPv6-based DNSRBL?

Chrome browser must not be used for speedtest

I have a 1000Mbps GPON FTTH installed at home.  Using Chrome browser for speedtest, I can only have download speeds around 350 Mbps while upload speeds are always below 250 Mbps.  But when I change to IE browser, things are quite different.  Download speeds are boosted to 800 Mbps and upload speeds around 600 Mbps.   I recalled that I had not seen such discrepancies in 100 Mbps broadband services.  I will attach screen dumps to show what I have experienced later on.  I really like to know what is wrong with Chrome.

IPv6 Statistics

Last week, I heard about the number of IPv6 users in US climbed up to 3.3 million which makes US the country having the largest number of IPv6 users.  How comes this figure !! It is from :

 http://resources.potaroo.net/iso3166/v6dcc.html

I think the above is provided by Geoff Huston or APNIC.  They use advertized /64 prefixes to estimate the number of IPv6 users.  Sounds pretty logical but I have no idea of the underlying methodology. Good work, anyway.  

IPv6 Prefix Delegation

This is the best and most useful description of IPv6 Prefix Delegation I have ever come across:


Prefix delegation (PD) is a mechanism developed to provide automated delegation of IP address blocks. The delegation is done from an ISP to its customer. The ISP does not require any knowledge of the customer's internal network topology. The DHCP-PD protocol runs between a Customer Edge (CE) and a Provider Edge (PE) router, the CE is called a Requesting Router (RR) and the PE router a Delegating Router (DR). The RR acts as the DHCP client, and requests prefixes from the DR (DHCP server). The DR injects a route into the provider's routing system for the delegated prefix on behalf of the RR. That way, a dynamic routing protocol between the RR and the DR is not needed; however, the RR and the DR must be  directly connected. 

Prefix Delegation requires the use of AAA Server for authentication.  I grab an illustrative diagram above. 

octocheck app

I mentioned about Octocheck in my last blog post.  I have now captured a picture and post it here.

Apps for checking the balance of Octopus

I finally found the best app of the year.  It is the Octocheck (Octopus Card NFC Reader), an app for checking the balance of Octopus Card with the  last 10 trading date, time, nature of the transaction and the amount of information.  

It is available from Google Play at :

https://play.google.com/store/apps/details?id=com.octopuscards.nfc_reader

The smartphones and tablets must have NFC functionality.  My son's smartphone Xperia Ion has this feature so one installation should be sufficient for the whole family.

There are 13 million Octopus Cards actively used by consumers every day.  This app comes a bit late.  Anyway, still need to say thanks to Octopus Cards Limited for developing an useful app.  This might be the first large scale application of NFC in smartphones for Hong Kong people.

Test the IPv6 readiness of a domain

I got a five stars pass when testing my domain i3way.net at the test site ip6.nl for IPv6 readiness.  The most difficult part to get 5 stars is the use of IPv6 glue record for the domain which means IPv6 only resolvers could still fetch the domain records.  I note that many domains have failed in this aspect.

"域"見未來

二零一二年六月十三日，互聯網名稱與數字地址分配機構 ( Internet Corporation for Assigned Names and Numbers， 簡稱ICANN ) 公佈了申請營運新通用頂級域名的名單，共有1930份申請，其中香港的企業共提交了42份申請，佔全球申請的百份之二，令香港的IT業界喜出望外。

互聯網現時除地區頂級域名以外 (如 「.hk」、 「.cn」 及「.tw」 等)，通用頂級域名共有22個，最為人熟識的有「.com」、 「.net」及 「 .org」 等。時至今日，互聯網服務巳函蓋每個行業，現有的22個通用頂級域名已不能滿足各行各業的需求，而且缺乏選擇。ICANN預期新增的通用頂級域名可以為互聯網締造更多的創新，選擇和競爭，最終能為用户提供更優質的服務。舉個例說，銀行業可申請使用 「.bank」，唱片業可用「.music」，酒店業可用「.hotel」等頂級域名。世界各地企業也可以公司的註冊名稱或品牌申請頂級域名，如 「.ibm」、 「.microsoft」、「.skype」和 「.android」 等。

申請新通用頂級域名所涉及的費用令人咋舌，申請人先要付出 18.5 萬美元 (約145萬港元) 一筆過申請費，日後每年還要繳交 2.5 萬美元 (約20萬港元) 的行政費。ICANN 在審批每個域名時還會考慮申請人的背景，包括技術支援、財政及營運能力，要有足夠實力才能獲批，保守估計，平均每個新通用頂級域名真正成本，可能會超過百萬美元。

香港的两家電訊服務商，分別是電訊盈科有限公司和中信國際電訊（信息技術）有限公司，合共申請了八個頂級域名作日後業務之用，包括「.pccw」、「.hkt」、「.電訊盈科」、「.香港電訊」、「.now」、「.nowtv」、「.中信」及 「.citic」。ICANN 的名單公佈後，筆者發現有多達六家公司申請「.now」，而只有電訊盈科有限公司申請「.nowtv」， 至此筆者不得不佩服該公司的部置和策略，他們早已估計 「.now」 會引發一場爭奪戰，一旦競投「.now」失手，還有「.nowtv」可即時補上。

在眾多申請當中，最觸目的是 「.app」 ，共有13間公司爭奪，包括亞馬遜 (Amazon) 和谷歌 (Google)。業界估計，谷歌對「.app」是志在必得的，谷歌會不惜動用過千萬美元，擊敗其他對手，最終奪得「.app」的擁有權。

開放通用頂級域名亦令各大城市希望擁有自己的數碼地標的夢想成真，世界各地的市政府都申請以城市為名的域名，例如「.nyc」、「.tokyo」、「.paris」、 「.广东」、「.广州」和「.佛山」 等。或許有人會問，為甚麽沒有香港機構申請「 .香港」，其實 「.香港」是地區域名的國際化名稱，因此，「.香港」在多年前已委派給香港互聯網註冊管理有限公司管理。

不得不提的是一些致為有趣的申請，足以令人拍案叫絕，例如 「.gay」、「.sex」「.eat」、「.dog」、「.我愛你」、「.八掛」等，ICANN 的審批專家團隊會否開放這些有趣的頂級域名，大家不妨拭目以待。

總的來說，這次盛事，是互聯網的一次重大改革，預期新一批通用頂級域名將在 2013 年中投入服務，屆時互聯網將會出現一番新景像。

do not zip pdf file

I was surprised to receive an email with a zipped attachment which contained a pdf file. Hey, pdf file is more or less an image type and it could hardly be compressed.  Further checking revealed that the original pdf file size was 4.278 MB and after zip compression, the size was 4.252 MB.  The compression ratio is less than 1 %.  It is just not worthwhile for both the sender and receiver wasting their time to compress and decompress the file.

speedtest mini

Finally, I got a copy of  licence free speedtest mini. Thanks to Ookla though no support is offered.  I have to  remind myself to amend /etc/php.ini to allow uploading large files by HTTP POST request.

Speedtest mini does not show up the IP address of the visiting client. I have added a script to display the IP address. A restart button is also added to enable another test without using the browser refresh.

Internet in IPv6 is 2000::/3, not ::/0

Some people think that routing to IPv6 Internet is ::/0 which means everything. This is not recommendable since not all prefixes of IPv6 are allocated to RIRs.

Internet in v6 should be 2000::/3 (reference RFC4291), but not ::/0. This is unlikely to change in the coming 30 years. Do not use ::/0 in making default route.

If I want to add a route to IPv6 world, then :

#/sbin/route -A inet6 add 200::./3 gw 2001:4625::7

Special attention must be paid to prefix 64:ff9b::/96 for DNS6 +NAT64.  There should be an additional  route to the NAT64 router serving 64:ff9b::/96.