SOA Expire in Name Servers

Yesterday, all IT people in our department were very angry. We found that our seven domains hosted in the name servers of the ISP were having SOA Expire set as 3600. A dump is below :

The setting of SOA Expire in the name server was problematic. If secondary servers can not contact a primary server due to network outages or whatever reasons, and after 3600 seconds, the information contained in the secondary servers is considered no longer authoritative. Once SOA expiry is reached, the secondary servers will not respond to any query. IETF suggests a  minimum of 1 week and the maximum is 4 weeks.

This was a big mistake. There are cases of power interruption, landslides and cable cut in which the damages last for several hours. Though the serving ISP can claim itself very technically capable to restore server problem within 1 hour, the cases of power lines breaking down, landslides and cable damages due to road digging are outside the control of the serving ISPs. We therefore have to bear the risk  of people not able to reach our various websites due to the ISP’s secondary nameservers not responding which could be other source of failure outside the ISP’s control for more than 1 hour.

We escalated our complaint to the highest level and the problem was rectified. We also learnt a lesson. In future, in case of moves and changes in domain name records, apart from checking the changes are carried out, we must  check the SOA serial numbers which reflect the changes made on a certain day and the SOA Expire is not inadvertently amended.

6in4 or 6to4 tunnel, that's the question

I have been invited by the Internet Society Hong Kong (ISOC-HK) as a guest speaker for the "Kickstart IPv6! Seminar on World IPv6 Day (8 Jun)” which will be held in Cyberport on World IPv6 Day. I will share about my experience of deploying IPv6 in our department, from interim tunneling arrangement to native IPv6 connection. Hey, I don’t mind telling the audiences that I made a big mistake in selecting solution for our interim IPv6 web server. In Jan 2010, I had to decided to use 6in4 or 6to4 tunnel for the web server. 6in4 is offered free by a tunnel broker service provider. It requires login account name and password to set up the tunnel and on Windows server, there must be a start up script to fire up the v6 interface whenever bootup. 6to4 is easier and everything is automatic. If anyone has to choose between 6in4 and 6to4, 6to4 is definitely attractive. One thing that I hate is that Mircrosoft uses a risky 6to4 address format which maps the IPv4 address 202.81.93.74 to 2002:ca51:5d4a::ca51:5d4a (202 dec= ca hex). The 3rd – 6th octets matching 13th – 16th octets tells people that we are using Microsoft OS and hackers can then initiate attacks targeted at Windows OS and IIS. We had to change the 13th – 16th octets to other arbitrary hexadecimal number like 2002:ca51:5d4a::aaaa:ffff.

Everything seemed ok and it was a pretty smart choice at a first glance. Eventually, I discovered that I was wrong to use 6to4 address. It is because web server with 6to4 address can not attract traffic from dual-stack hosts with native IPv6 connection. Over 95 % of visiting addresses were 6to4 addresses and obviously they were Windows 7 hosts running PPPoE or Metro-Ethernet without NAT and their 6to4 tunnels were automatically set up. In that scenario, 6to4 hosts will visit 6to4 servers as they are on the same 6to4 network. However, dual-stack hosts will only use native IPv4 if a web server has native IPv4 address and 6to4 address. 6to4 path will be abandoned while native IPv4 path is selected because 6to4 is less reliable than native 6to4. I applaud that Microsoft do the right thing.

The addresses of 6in4 come from a native IPv6 service providers. All OSes can not tell if these addresses are native IPv6 or 6in4. Hence, if we had use 6in4 in the first place, our interim web server should have attracted a high traffic. Though we discovered that weakness, we did not want to switch back to 6in4 as we will use native IPv6 connection very soon.

This is a painful experience. I hope other network administrators will take my advice to use 6in4 tunnel as opposed to 6to4 tunnel when considering interim IPv6 solution.

Equivalent of link-local address fe80::/64 in IPv4

Some days ago, my friends asked me what is the equivalent of IPv6 link-local address fe80::/64 in  IPv4.  Link-local address is auto-configured in the absence of router or DHCPv6 server.  In IPv4, we have 169.254.0.0/16 random addresses assigned to a NIC if it can not find any DHCP server.  Most importantly, hosts with 169.254.X.Y can communicate with each other since they are in the same /16 subnet.

However, there should be one difference, only Windows and Mac stations support 169.254.0.0/16.  While in IPv6, all OSes must support the link-local address and this should include iPhone OS and Android.

Server up for 600 days without reboot

My server running Fedora Core has been up and running for 600 days without reboot. This is amazing.  Can anyone expect the same for Windows 2003 and Windows 2008 Server.  I also need to thank the data center for providing a very stable power supply.  Obviously, there has not been any power interruption.

During the past 600 days, I applied patches and updates to some software packages.  The beauty of Linux is that there is no need to reboot server when new patcches are applied and new software packages are installed.

Caching period of NXDOMAIN

I have the wrong idea that only positive answers of name lookup will be cached with a period defined by the TTL while negative answers (NXDOMAIN) will not have the same function.  The fact is NXDOMAIN will also be cached in a resolver and the period is according to the “SOA Minimum” of the zone file.  Suppose if I interrogate xyz.cnn.com at a resolver, the name server will reply NXDOMAIN and the provide the SOA record which contains origin, mail address, serial, refresh, retry, expire and minimum. For this case, the SOA minimum is 3600.  If after 10 seconds, I ask xyz.cnn.com, the resolver will fetch the answer from the cache indicating the remaining time is 3590. 

Funs. This tells why hackers can inject fake NXDOMAIN to make a domain name inaccessible as a way of DOS attack.    

Windows 7 Router Advertisement DOS attack

The youtube video below demonstrates that rogue Router Advertizements can be a serious DOS attack, which can crash all IPv6 Windows systems in a local area network.

http://www.youtube.com/watch?v=GA_w87K_Iuo&feature=player_embedded

This has been reported to Microsoft for some time. As usual, Microsoft says there is is no fix at this moment.

This scenario will not happen to in our office as we know for sure autoconfiguration presents too many risks in a corporate network environment. We will use DHCPv6 for v6 address allocation and management. We can therefore turn off router discovery function in all Windows 7 machines.

Estimation of IPv6 brokenness

Eric Vyncke has been gathering live data for the estimation of  IPv6 broknenness  (http://vyncke.org/testv6/) since Oct 2010. As of today, his estimation derived from the gathered data reveals that there might be up to 0.7 % IPv6 brokenness. However, Yahoo estimates that the number of users affected by broken IPv6 is about 0.05 % of global Internet population (2 billion at present) or equal to 1  million. Yahoo's estimation is just  1/14 of Eric Vyncke's test data.



            (Please click to enlarge)

Which one should I believe more, why and how ???

If it turns out that IPv6 brokenness can be up to 0.7 %, then there is no chance Facebook, Yahoo and Google will activate their content on IPv6.

Anyway, the IPv6 World Day 24-hour test flight might provide some useful clues. I am eager to hear the announcement of  Facebook, Google and Yahoo after they have analyzed their  captured data on IPv6 World Day.

IPv6 speed test again

I mentioned about IPv6 speed test in my blog post yesterday.  To my surprise, the post was read by a visitor and he left comments to me that there is another speed test engine in Sweden, URL as http://ipv6.bredbandskollen.se which I have tested successfully.

Well, that's the power of blogging.  Through the blogosphere, people can share knowledge and experience and help each other.

IPv6 speed test

Up to now, I can only find one single working website which offers IPv6 speedtest. 

The test site is in France.  If I use the 6in4 tunnels offered by Hurricane Electric, the speed can be over 5 Mbps.  It is because Hurricane Electric has established IPv6 POP in France which has a fat pipe linking up with the POP in Hong Kong.

Another website is ipv6-speedtest.net.  However, I fail to perform succesful test with this site.

Using email address for login to some online services

Many service providers require users to use their email addresses to login. I like to say that when authenticating a user, there is no need to care the small or capital letters in domain part of  the email address.  In fact, there is no small or capital letter differentiation in a Fully Qualified Domain Name. However, some service providers impose restriction that the small and capital letters of the domain part must exactly matches the one when the user first created the account.

As an example, I have an account with isc.org with the login user as warren@i3way.net.  If I purposely type the user as warren@I3WAY.NET, it says the account does not exist. 

Facebook has considered this aspect carefully.  Equally I have the login user as warren@i3way.net.  If I type warren@I3WAY.NET. Facebook recognizes it as the same account as warren@i3way.net and it allows me to access.

The over-restriction mentioned above is not logical and not sensible if one considers the domain name convention.  For the programmers, it just involves a few more lines of codes which could make things work better.

Number of 6to4 gateway in the globe

I got a list of 33 ASNs that advertize the anycast Class C range 192.88.99.0/24 in their BGP routes:


AS59, AS559, AS680, AS1103, AS1239, AS1257, AS1299, AS1835, AS1930, AS2018, AS2116, AS4621, AS6939, AS7575, AS8359, AS8473, AS12573, AS12779, AS12871, AS15598, AS16150, AS19255, AS19782, AS20312, AS20640, AS25192, AS28917, AS35244, AS38646, AS39326, AS39556, AS44581, AS55374

Some people just wonder why I am interested in tracking the number of ASNs that handle 192.88.99.0/24.  It is because the anycast address 192.88.99.1 is assigned to 6to4 relay.  In other words, there are now 33 service providers that offer free 6to4 gateway service.  Well, this is a thriving development.  They are helping the transition to IPv6 for clients using 6to4 tunnels.

Well-done !

Websites for testing if a resolver is DNSSEC-enabled

Normally, to test if a resolver is DNSSEC-enabled or not, IT people will  use "dig +dnssec"  followed by something and then verify that the message has the AD (Authenticated Data) set.  Instead of using such command line testing,  I am a bit lucky to find two webistes for performing the same task:

1.  http://dnssec-or-not.net/

2.  http://dnssectest.sidn.nl/

The screen dumps below are interesting.

Best view for websites

I found some websites still have the following footnote at the bottom of  a page:

"This site is best viewed at 1024x768 screen resolution with Internet Explorer 6.0 SP2 or above."

The above footnote is absolutely not necessary. Today, people are using 19 - 22 inches LCD with 16:9 aspect ratio.  Some larger monitors have 22:10 ratio.   1024 x 768 is considered as a poor resolution using the old traditional  4:3 aspect ratio.

Just take away the fucking advice and users will know how to adjust their monitors and video display to achieve the best viewing effect.

Congested NATed hosts

This is a funny picture.  It can be used to describe the congested scenario of NATed hosts in IPv4 Internet. The single train is the one and only one routable IPv4 address.  The linited seats (overall capacity) inside the train correponds to port numbers.   This traing will clash and no doubt you are killing yourself if continue to use NAT.

IPv6 Anti-spam nightmare

People are worried that IPv6 might create an anti-spam nightmare because IP-based blacklist systems will not be effective.  In IPv6 environment,  in a subnet, there are 2^64 IPv6 addresses to use.  Spammers can change their IPv6 addresses every single second or send out each spam mail with a different address.  With this uncertainty, some even say that there is no need to rush to implement IPv6 SMTP server as long as they have IPv4 SMTP servers to serve their corporate email communications.

This is a short-sighted view.  There are at least 2 methods I can think to circumvent IPv6 spamming hosts  which can change addresses frequently:

1.  Mandatory reverse lookup - unlike legitimate mail server, the random changing addresses of spamming hosts will not have proper reverse lookup records,

2.  Greylisting - spamming hosts will not queue up mail for subsequent retry but legitimate email servers perform this function.

Of course, above all, there is the solution of content filtering.  This method is more expensive as it requires the use of more CPU power, memory and a monthly subscription fee to obtain the database of spam signatures.

My expectation for IPv6 World Day

My expectation for IPv6 World Day – Gigantic content providers such as Facebook, Google and Yahoo notice that IPv6 brokenness is far insignificant (0.0000x %). They decide to put their content accessible by IPv6 once and forever !  

Am I dreaming ?  Of course not !

SHA-1 hash phased out

I remembered that last December, when I submitted the DS of my domain name i3way.net, it was in SHA-1 (160 bits) format and my registrar godaddy did not reject the submission.  In April 2011, I tried to submit the SHA-1 DS of another domain warrenkwok.com but this time, godaddy did not accept it.  As an alternative, I submitted the SHA-2 (256 bits) DS and it was accepted.

I should be aware that SHA-1 was phased out on 1 Jan 2011 as mandated by the US Government.  In fact, it should also be noted that SHA-1 is not cryptographically strong enough for today's online applications.  Verisign is the operator of .com and .net TLD nameservers and it is a US company.  It is logical for Verisign to mandate all DS for .com and .net domains in SHA-2 format.

Complicated password

This is the most complicated password I have ever set:

7oqZ3cT2i9#w

It is 12-character in length combining small and capital letter, numbers and symbols.  I don't want to guess the chance of successful cracking by brute force attacks as this is meaningless.  Do you think I can remember it without writing on a piece of paper or storing it in a phone's memory.
 
Shit, I make my  life so complicated and confusing.

IPv6 brokenness

Just completed the test on IPv6 brokenness through “test-ipv6.com”.  Results show that there is no brokenness from my home PC for access to Internet . With my IPv6 properly in place, on IPv6 World Day (8 June 2011),  I  will reach Google, Yahoo and Facebook by IPv6. Enjoy the great day and the great play.

Verizon LTE running IPv6

I just learnt that Verizon LTE, the fastest 4G mobile network which was  launched in mid March 2011, can fully support IPv6. One NATed IPv4 address and one public IPv6 address are assigned to each mobile terminal.  I have a screen dump of HTC Thunder Bolt handset running IPv6.

So finally, we see large scale IPv6 deployment in a commercial mobile network.