February 2005 - db-wg - mailman.ripe.net

<auto-dbm@ripe.net> is slow this afternoon.
by RIPE Database Administration 16 May '18

16 May '18

Dear Colleagues, Because of a very high level of use this afternoon, the response time of <auto-dbm(a)ripe.net> is longer than normal. I have made contact with those who are responsible and I expect the situation to improve as the machine works through the queue. Please be patient. Obviously we at the RIPE NCC Database Group are continuously working to make the performance of the database as good as possible. However, we cannot make improvements in zero time. We thank you for your co-operation up to now and we ask for your continued co-operation so that everyone receives the best possible service. If you have anymore questions, please contact <ripe-dbm(a)ripe.net>. Regards, Ambrose Magee ____________________________ RIPE Database Administration.

2 2

Deprecation of the NONE Authentication Scheme
by Ziya Suzen 08 Nov '05

08 Nov '05

Dear Colleagues, As announced at RIPE 47 the NONE authentication scheme will be deprecated. After 26 April 2004 the RIPE Whois Database will not accept updates using the NONE authentication scheme. If you have objects protected by a MNTNER object which has the NONE authentication scheme, please assign another authentication scheme or create another MNTNER object to protect these objects. If you are a RIPE NCC member you can create new MNTNER objects through the LIR Portal or send your update to <auto-dbm(a)ripe.net>. History and details: -------------------- 1. Motivation The RIPE Database protects data from unauthorised modification through the use of references to maintainer objects. The maintainer objects contain an "auth:" attribute which specifiy how a user is authenticated during updates to the database. One of the allowed authentication schemes is "NONE", which is actually not an authentication at all, but rather specifies that no authentication is necessary. NONE is intended to be used consciously, as a notification facility or as a means to tag objects. In April 2003, a proposal was sent to the Database Working Group by Hank Nussbacher: It has come lately to the attention in the Internet security realm that spammers as well as crackers are hijacking IP address space. One easy way to "steal" IP address space is via those that have auth=NONE on their objects. It is likely that in many cases NONE is used simply because it is easy. Currently approximately 500 maintainers use NONE - about 5% of all maintainers. 2. Plan Normally with a database cleanup effort, an announcement is sent to the appropriate mailing lists, posted to the RIPE web page, and also sent to the specific users affected. A period of time for cleanup is given. Finally, if the users have not fixed the data then it is modified. However, for the NONE deprecation, it is inadvisable to do this as it means announcing what is in effect a security vulnerability. Also, our operational experience with past cleanups shows that most users do not really participate through the phases of the effort. Therefore, the plan for MNTNER objects with the NONE authentication scheme is: o Announcement only to db-wg mailing list. (This announcement) o Remove "auth: NONE" attributes from all MNTNER objects, by changing them to a "remarks:" attribute with a URL explaining the change. o If that is the only authentication scheme, update the mntner objects, adding MD5-PW with a generated password. o E-mail the "admin-c:" and "tech-c:" of the objects, and the e-mail addresses listed in the "upd-to:" and "mnt-nfy:" attributes of the objects, explaining the change and including the new password if one is added. o Passwords can be requested via an e-mail to <ripe-dbm(a)ripe.net>. The reply with the password will be sent to the same contacts. After a certain period of time the service will be discontinued. Users wishing to use these maintainers may contact <ripe-dbm(a)ripe.net> for assistance. 3. RIPE-NCC-NONE-MNT A maintainer with NONE authentication, RIPE-NCC-NONE-MNT, was added to objects without any maintainer when the database was converted from RIPE-181 format to RPSL format in April 2001. There is a remark in these objects which includes the following: remarks: The RIPE NCC will never use this maintainer object to remarks: enforce any sort of control over user's objects. It is possible this could have been interpreted to mean that no restriction would ever be added to the object. One use of the RIPE-NCC-NONE-MNT has been to allow the creation of objects representing routing policy for resources not allocated or assigned by the RIPE NCC. This is done by using "mnt-routes: RIPE-NCC-NONE-MNT" or "mnt-lower: RIPE-NCC-NONE-MNT" as appropriate. A new maintainer object will be created for these cases, with a well- known password, published in the object: mntner: RIPE-NCC-RPSL-MNT descr: This maintainer may be used to create objects to represent descr: routing policy in the RIPE Database for number resources not descr: allocated or assigned from the RIPE NCC. admin-c: RD132-RIPE upd-to: ripe-dbm-notify(a)ripe.net auth: MD5-PW $1$GUExyzzy$XQtbZHGVqy9GW8BiAckBV1 remarks: ******************************************************* remarks: * The password for this object is 'RPSL', without the * remarks: * quotes. * remarks: ******************************************************* mnt-by: RIPE-DBM-MNT referral-by: RIPE-DBM-MNT changed: ripe-dbm(a)ripe.net 20040301 source: RIPE The main use of this maintainer is for INETNUM objects. There are approximately 60000 such objects - about 6% of the inetnums. Updates for objects with RIPE-NCC-NONE-MNT are rare, less than 2% of all updates. For objects using RIPE-NCC-NONE-MNT: o If there are other "mnt-by:" attributes it will be changed to a "remarks:" attribute. o Otherwise, the "mnt-by:" will be changed to RIPE-NCC-LOCKED-MNT, which has a locked password (or PGP key). o A "remarks:" attribute will be added explaining how to generate a maintainer. o An e-mail will be sent to the "admin-c:" and "tech-c:" of the objects, and the e-mail addresses listed in the "notify:" attributes of the objects, explaining the change and giving a URL which will help to generate a new maintainer or assign another existing maintainer. o At the URL, the object will be automatically updated to have a new maintainer. o After a certain period of time the service will be discontinued. Users wishing to use these maintainers may contact ripe-dbm(a)ripe.net for assistance. 4. Other maintainers with "auth: NONE" The RIPE-NCC-PN-NONE-MNT was used to mark PERSON objects not to be deleted in the 2001 person cleanup. It can be removed and the maintainer deleted. The LIM-MNT is used for limericks. It will have a well-known password similar to the RPSL maintainer. It will also be maintained by another maintainer (not itself, as currently). -- Ziya Suzen RIPE NCC

4 5

RE: [db-wg] Proposed changes for abuse
by Titley, Nigel 28 Feb '05

28 Feb '05

Sorry about the delay in response, I'm in Kyoto at the moment, 9 hours ahead (or 15 hours behind in email terms). Niall O'Reilly wrote: > Shane, > > Good stuff. > > I believe that what you describe matches the consensus we reached. > > On 16 Feb 2005, at 16:44, Shane Kerr wrote: > >> The changes we propose are: >> >> o To hide attributes that contain e-mail addresses in the default >> output of queries. We will also provide an option to disable this >> feature, > > Fine. Yes, we agreed this. > >> o To add a new "abuse-mailbox:" attribute to PERSON, ROLE, IRT, >> MNTNER, ORGANISATION, INETNUM, and INET6NUM objects, > > Fine. We did *not* agree this. We agreed to add the abuse-mailbox attribute to IRT, PERSON and ROLE objects. We specifically decided not to add it to the INETNUM and INET6NUM objects (although this wasn't minuted) and we didn't mention ORGANISATION objects at all. See AP49.4. > >> o To provide an option to display only key attributes and abuse >> contacts, > > Fine. Nice idea. > >> o To change the IRT object template so that the "signature:" and >> "encryption:" attributes are no longer mandatory, > > Fine. Fine > >> o To change the behaviour of the '-c' switch in whois queries. > > No opinion, but that's my fault. 8-) Fine > Best regards, > > Niall O'Reilly > University College Dublin Computing Services > > PGP key ID: AE995ED9 (see www.pgp.net) > Fingerprint: 23DC C6DE 8874 2432 2BE0 3905 7987 E48D AE99 5ED9 -- Nigel Titley Peering Coordinator, FLAG Telecom +44 20 8564 5812 ********************************************************************** This e-mail message is confidential and is intended only for the use of the individual or entity named above and contains information which is or may be confidential, non-public or legally privileged. Any dissemination or distribution of this message other than to its intended recipient is strictly prohibited. You should not copy it or use it for any purpose nor disclose the contents to any other person. If you have received this message in error, please notify us by email to postmaster(a)flagtelecom.com immediately and delete the original message and all copies from all locations in your computer systems. This e-mail has been swept by Mailsweeper TM for viruses. However, FLAG Telecom cannot accept liability for any damage which you may sustain as a result of software viruses. ********************************************************************** This message has been scanned for viruses by MailControl - www.mailcontrol.com

3 2

Can't find a lot of IPs in the DB
by Thomas Unternaehrer 25 Feb '05

25 Feb '05

Dear list, a part of a small research project includes to analyze our servers log-file. I need to find out a bit more from the IP entries (reverse look-up) like the name of the company and the country. To do so, I was downloading the WhoIs-DB "ripe.db.inetnum.gz" from ftp://ftp.ripe.net/ripe/dbase/split/ but a lot of the IPs can't be resolved. E.g. I have the IP of my uni 160.85.0.0 that I can't find in the above DB. But if I try it in a shell with the whois command "whois -h whois.ripe.net 160.85.0.0" it gives me all what I need. What do I missunderstand here? Is it the wrong DB? My skills in such things are not really good, so sorry, if my question is to basic. thanks for any hints Thomas <ftp://ftp.ripe.net/ripe/dbase/split/ripe.db.inetnum.gz> Content Security by MailMarshal

2 2

Re: NCC#2005023954 [local-ir@ripe.net]AfriNIC Transition Completed
by RIPE NCC Hostmaster 24 Feb '05

24 Feb '05

Dear Gbebga Olubisi, The AfriNIC has put processes in place for providing services via e-mail, request forms etc. Like the RIPE NCC did before the lir-portal came into being. Lets take this discussion off list and I can direct you to more detailed information. Regards, ------------------- Timothy Lowe RIPE NCC IPRA ------------------- AfriNIC developments -----> http://www.afrinic.net On Wed, 23 Feb 2005 15:25:12 +0100, Gbenga Olubisi wrote: > hi Timothy Lowe, > > From the mail i have been receiving from RIPE, it is stated that the > LIR portal on RIPE will no more be available to LIRs that falls under > the geographical space of AFriNIC whihc my LIR (ng.briscoetel) falls. > Without access to the LIR on AfriNIC, how do i manage our IP address > whihc has been allocated to us already since late last year. > > Regards > > gbenga olubisi > > On Wed, 23 Feb 2005 14:16:41 +0100, RIPE NCC Hostmaster > <hm-africa(a)ripe.net> wrote: > > Dear Gbenga Olubisi, > > > > AfriNIC does not have an lir-portal like web interface at > > this time. One is planned. AfriNIC request forms and other > > documents can be found here: > > > > http://www.afrinic.net/documentation.htm#templates > > > > For further information please > > contact hostmaster(a)afrinic.net > > > > Regards, > > > > ------------------- > > Timothy Lowe > > RIPE NCC Hostmaster > > ------------------- > > > > AfriNIC developments -----> http://www.afrinic.net > > > > On Wed, 23 Feb 2005 12:23:42 +0100, Gbenga Olubisi wrote: > > > ng.briscoetel > > > > > > Hi , > > > > > > I can no longer access the LIR portal on www.ripe.net and i can't see > > > any link to the portal either on the AfriNIC website. Please help. > > > > > > Regards > > > > > > Gbenga Olubisi > > > ng.briscoetel > > > > > > On Wed, 23 Feb 2005 10:25:19 +0100, Axel Pawlik <ncc(a)ripe.net> wrote: > > > > > > > > Dear Colleagues, > > > > > > > > AfriNIC is the emerging Regional Internet Registry (RIR) for the African > > > > and Indian Ocean region. In preparation for its final recognition expected > > > > in April by ICANN, AfriNIC began operating as a fully functional RIR for > > > > the African region on 21 February 2005. LIRs in the AfriNIC service region > > > > can now request IP address space, AS Numbers and reverse delegation from > > > > AfriNIC and enter objects in the AfriNIC Whois Database. > > > > > > > > Details of the RIPE NCC to AfriNIC transition can be found at: > > > > > > > > http://www.ripe.net/info/resource-admin/afrinic/ > > > > > > > > If you have questions regarding the transition to AfriNIC, please contacts > > > > us at <afritrans(a)ripe.net>. > > > > > > > > Regards, > > > > > > > > Axel Pawlik > > > > RIPE NCC > > > > > > > > > > > > > > > > > -- > > > Gbenga Olubisi > > > Plot 267 Etim Inyang Crescent > > > Victoria Island , Lagos. > > > > > > > > > -- > Gbenga Olubisi > Plot 267 Etim Inyang Crescent > Victoria Island , Lagos.

1 0

AfriNIC Transition Completed
by Axel Pawlik 23 Feb '05

23 Feb '05

Dear Colleagues, AfriNIC is the emerging Regional Internet Registry (RIR) for the African and Indian Ocean region. In preparation for its final recognition expected in April by ICANN, AfriNIC began operating as a fully functional RIR for the African region on 21 February 2005. LIRs in the AfriNIC service region can now request IP address space, AS Numbers and reverse delegation from AfriNIC and enter objects in the AfriNIC Whois Database. Details of the RIPE NCC to AfriNIC transition can be found at: http://www.ripe.net/info/resource-admin/afrinic/ If you have questions regarding the transition to AfriNIC, please contacts us at <afritrans(a)ripe.net>. Regards, Axel Pawlik RIPE NCC

4 3

Proposed changes for abuse
by Shane Kerr 23 Feb '05

23 Feb '05

Dear Colleagues, We've gone over the changes discussed and agreed on for improving the ability to find abuse information in the RIPE database, and have come up with the following modifications. Please have a look. We will be making announcements once final agreement is done, and adding a URL to the banner and dbupdate messages. Two things did not make it into this proposal from our side. One is that we find the name "IRT" somewhat confusing, but we have no specific proposal to change it. The second is a proposal to change the order of objects in query results, which will be sent as a separate proposal, since it is not very related and might cause controversy. -- Shane Kerr Software Manager RIPE NCC Following discussions in the Database Working Group at RIPE 49, we have prepared a proposal to make changes to the whois server software. The changes we propose are: o To hide attributes that contain e-mail addresses in the default output of queries. We will also provide an option to disable this feature, o To add a new "abuse-mailbox:" attribute to PERSON, ROLE, IRT, MNTNER, ORGANISATION, INETNUM, and INET6NUM objects, o To provide an option to display only key attributes and abuse contacts, o To change the IRT object template so that the "signature:" and "encryption:" attributes are no longer mandatory, o To change the behaviour of the '-c' switch in whois queries. We will announce the changes on our website. We will also contact any third-party software developers who rely on the RIPE Database for abuse contact information. You can read the minutes from the Database Working Group discussion at: http://www.ripe.net/ripe/maillists/archives/db-wg/2004/msg00469.html (1) Adding the "abuse-mailbox:" Attribute We will add a new attribute to the following object types: INETNUM INET6NUM PERSON ROLE IRT ORGANISATION MNTNER This optional attribute will contain at least one e-mail address. It will tell users where to send abuse complaints or queries. (The proposed templates for the above objects are at the end of this document.) The description of the new attribute will be the same in all objects: abuse-mailbox: Specifies the e-mail address to which abuse complaints should be sent. An e-mail address as defined in RFC 2822. There is currently a "trouble:" attribute in ROLE objects, which contains free text. We will update ROLE objects, so that any ROLE object that has a "trouble:" attribute that is an e-mail address as defined in RFC 2822, will be copied to the "abuse-mailbox:" attribute. Any other "trouble:" attributes will be converted to "remarks:". As an example, see the following: role: Example Role address: Example Address phone: +11 22 33445 fax-no: +11 22 33445 e-mail: info@localhost admin-c: TEST1-RIPE tech-c: TEST1-RIPE trouble: Please contact trouble: abuse@localhost trouble: for abuse reports, not info@localhost nic-hdl: TESTROLE1-RIPE changed: info@localhost 20050101 source: RIPE We will replace this with: role: Example Role address: Example Address phone: +11 22 33445 fax-no: +11 22 33445 e-mail: info@localhost admin-c: TEST1-RIPE tech-c: TEST1-RIPE remarks: "trouble:" converted on 2005mmdd remarks: Please contact abuse-mailbox: abuse@localhost remarks: for abuse reports nic-hdl: TESTROLE1-RIPE changed: info@localhost 20050101 source: RIPE (2) Hiding Attributes That Contain E-Mail Addresses Finding the right e-mail address for abuse reports can be confusing. There is currently no easy way to find this information in the RIPE Database. Users often send mail to every e-mail address they see in a query result. To avoid this, we will hide all attributes that contain e-mail addresses from the default output of a whois query for an address. When a user looks up an address, the results may include the following objects: INETNUM INET6NUM ROUTE ROUTE6 ORGANISATION PERSON ROLE By default, MNTNER objects are not shown, but they are often also queried to get contact information. For each of the object types, the following attributes contain e-mail addresses: INETNUM: notify, changed INET6NUM: notify, changed ROUTE: notify, changed ROUTE6: notify, changed ORGANISATION: e-mail, notify, changed PERSON: e-mail, notify, changed ROLE: e-mail, trouble, notify, changed For each address range returned, if there is at least one "abuse-mailbox:" attribute in any of the returned objects, the attributes mentioned above will be removed from the output. If there is no "abuse-mailbox:" attribute, only "notify:" and "changed:" attributes will be filtered out. If an attribute of an object is changed, a comment will be added, to avoid confusion. Users can turn off this suppression. To make this possible, we will implement a '-B' flag. As an example: $ whois 10.0.0.10 Might currently give the following result: inetnum: 10.0.0.0 - 10.0.0.255 netname: HOME-NETWORK descr: Home Network country: ZZ admin-c: ME1-RIPE tech-c: ME1-RIPE abuse-mailbox: ripe-dbm@localhost status: ALLOCATED PI mnt-by: I-MNT changed: ripe-dbm@localhost 20050101 source: RIPE person: Me Myself and I address: Home Alone phone: +11 22 33445 fax-no: +11 22 33445 e-mail: ripe-dbm@localhost nic-hdl: ME1-RIPE mnt-by: I-MNT changed: ripe-dbm@localhost 20050101 source: RIPE After the change, the result will be: % Note: this output has been filtered. inetnum: 10.0.0.0 - 10.0.0.255 netname: HOME-NETWORK descr: Home Network country: ZZ admin-c: ME1-RIPE tech-c: ME1-RIPE abuse-mailbox: ripe-dbm@localhost status: ALLOCATED PI mnt-by: I-MNT source: RIPE person: Me Myself and I address: Home Alone phone: +11 22 33445 fax-no: +11 22 33445 nic-hdl: ME1-RIPE mnt-by: I-MNT source: RIPE To see the unmodified result, users should type in: $ whois -B 10.0.0.10 (3) Adding 'abuse output' Option To help authors of tools or users who are only interested in the abuse contacts for IP addresses, we will implement a brief output mode. If a user types '-b' when querying the RIPE Database, they will only see the key attributes of address ranges and the "abuse-mailbox:" attribute. This switch will also imply '-c', which requests first level less specific INETNUM or INET6NUM objects with the "mnt-irt:" attribute. It will only work with address space related queries. Here is an example: $ whois 10.0.0.0 Returns: inetnum: 10.0.0.0 - 10.0.0.255 netname: HOME-NETWORK descr: Home Network country: ZZ admin-c: ME1-RIPE tech-c: ME1-RIPE abuse-mailbox: ripe-dbm@localhost status: ALLOCATED PI mnt-by: I-MNT changed: ripe-dbm@localhost 20050101 source: RIPE person: Me Myself and I address: Home Alone phone: +11 22 33445 fax-no: +11 22 33445 e-mail: ripe-dbm@localhost nic-hdl: ME1-RIPE mnt-by: I-MNT changed: ripe-dbm@localhost 20050101 abuse-mailbox: ripe-dbm-person@localhost source: RIPE So: $ whois -b 10.0.0.0 Will return: % Note: this output has been filtered. % Only primary keys and abuse contact will be visible. inetnum: 10.0.0.0 - 10.0.0.255 abuse-mailbox: ripe-dbm@localhost abuse-mailbox: ripe-dbm-person@localhost This output will not generate valid objects, and there will be no object separators. If two ranges are returned after making a query, an object separator will be inserted between groupings. Therefore, the output will look like this: inetnum: 10.0.0.0 - 10.0.0.255 abuse-mailbox: ripe-dbm@localhost abuse-mailbox: ripe-dbm-person@localhost (*) inetnum: 10.0.1.0 - 10.0.0.255 abuse-mailbox: ripe-dbm-person-2@localhost (*) Attributes marked by (*) are taken from the person object retrieved by a recursive lookup. (4) Modifications on the IRT Object We will change the template for the IRT object will be changed. You will no longer need a KEY-CERT object to create an IRT object. Currently, the template for the IRT object is: irt: [mandatory] [single] [primary/look-up key] address: [mandatory] [multiple] [ ] phone: [optional] [multiple] [ ] fax-no: [optional] [multiple] [ ] e-mail: [mandatory] [multiple] [lookup key] signature: [mandatory] [multiple] [ ] encryption: [mandatory] [multiple] [ ] org: [optional] [multiple] [inverse key] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] auth: [mandatory] [multiple] [inverse key] remarks: [optional] [multiple] [ ] irt-nfy: [optional] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] "signature:" and "encryption:" attributes need existing key-cert objects. The Anti-spam Working Group asked us to make these objects optional. You can read an archive of this discussion at: http://www.ripe.net/ripe/maillists/archives/db-wg/2004/msg00452.html The template for irt objects will be: irt: [mandatory] [single] [primary/look-up key] address: [mandatory] [multiple] [ ] phone: [optional] [multiple] [ ] fax-no: [optional] [multiple] [ ] e-mail: [mandatory] [multiple] [lookup key] signature: [optional] [multiple] [ ] encryption: [optional] [multiple] [ ] org: [optional] [multiple] [inverse key] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] auth: [mandatory] [multiple] [inverse key] remarks: [optional] [multiple] [ ] irt-nfy: [optional] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] Therefore, the object below would be valid: irt: irt-someorg-zz address: address for the irt phone: +11 22 3344556 fax-no: +11 22 3344556 e-mail: contact@localhost admin-c: CONTACT1-RIPE tech-c: CONTACT1-RIPE auth: CRYPT-PW XXXXXXXXXXXXX mnt-by: mnt-someorg changed: someone@localhost 20050505 source: RIPE We will automate this process, so that help from the RIPE Database Management will no longer be necessary create IRT objects. (5) Changing the behaviour of '-c' option in whois queries Currently, the -c option requests first level less specific INETNUM or INET6NUM objects with the "mnt-irt:" attribute. It does not return any related IRT objects. This will change, so that -c will treat IRT objects as contacts and do recursive lookups on related IRT objects. Here is an example: $ whois -c 10.0.0.0 Returns: inetnum: 10.0.0.0 - 10.0.0.255 netname: TEST-NET descr: Test Net country: ZZ admin-c: TEST1-RIPE tech-c: TEST1-RIPE status: ASSIGNED PA mnt-by: TEST-MNT mnt-irt: IRT-TEST changed: info@localhost 20050101 source: RIPE person: TEST1-RIPE . . After the change, the result will be: inetnum: 10.0.0.0 - 10.0.0.255 netname: TEST-NET descr: Test Net country: ZZ admin-c: TEST1-RIPE tech-c: TEST1-RIPE status: ASSIGNED PA mnt-by: TEST-MNT mnt-irt: IRT-TEST changed: info@localhost 20050101 source: RIPE person: TEST1-RIPE . . irt: IRT-TEST . . (6) Modified Templates inetnum: [mandatory] [single] [primary/look-up key] netname: [mandatory] [single] [lookup key] descr: [mandatory] [multiple] [ ] country: [mandatory] [multiple] [ ] org: [optional] [single] [inverse key] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] abuse-mailbox: [optional] [multiple] [ ] ** rev-srv: [optional] [multiple] [inverse key] status: [mandatory] [single] [ ] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] mnt-lower: [optional] [multiple] [inverse key] mnt-domains: [optional] [multiple] [inverse key] mnt-routes: [optional] [multiple] [inverse key] mnt-irt: [optional] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] inet6num: [mandatory] [single] [primary/look-up key] netname: [mandatory] [single] [lookup key] descr: [mandatory] [multiple] [ ] country: [mandatory] [multiple] [ ] org: [optional] [single] [inverse key] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] abuse-mailbox: [optional] [multiple] [ ] ** rev-srv: [optional] [multiple] [inverse key] status: [mandatory] [single] [ ] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] mnt-lower: [optional] [multiple] [inverse key] mnt-routes: [optional] [multiple] [inverse key] mnt-domains: [optional] [multiple] [inverse key] mnt-irt: [optional] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] person: [mandatory] [single] [lookup key] address: [mandatory] [multiple] [ ] phone: [mandatory] [multiple] [ ] fax-no: [optional] [multiple] [ ] e-mail: [optional] [multiple] [lookup key] abuse-mailbox: [optional] [multiple] [ ] ** org: [optional] [multiple] [inverse key] nic-hdl: [mandatory] [single] [primary/look-up key] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [optional] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] role: [mandatory] [single] [lookup key] address: [mandatory] [multiple] [ ] phone: [optional] [multiple] [ ] fax-no: [optional] [multiple] [ ] e-mail: [mandatory] [multiple] [lookup key] trouble: [optional] [multiple] [ ] abuse-mailbox: [optional] [multiple] [ ] ** org: [optional] [multiple] [inverse key] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] nic-hdl: [mandatory] [single] [primary/look-up key] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [optional] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] irt: [mandatory] [single] [primary/look-up key] address: [mandatory] [multiple] [ ] phone: [optional] [multiple] [ ] fax-no: [optional] [multiple] [ ] e-mail: [mandatory] [multiple] [lookup key] abuse-mailbox: [optional] [multiple] [ ] ** signature: [mandatory] [multiple] [ ] encryption: [mandatory] [multiple] [ ] org: [optional] [multiple] [inverse key] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] auth: [mandatory] [multiple] [inverse key] remarks: [optional] [multiple] [ ] irt-nfy: [optional] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] organisation: [mandatory] [single] [primary/look-up key] org-name: [mandatory] [single] [lookup key] org-type: [mandatory] [single] [ ] descr: [optional] [multiple] [ ] remarks: [optional] [multiple] [ ] address: [mandatory] [multiple] [ ] phone: [optional] [multiple] [ ] fax-no: [optional] [multiple] [ ] e-mail: [mandatory] [multiple] [lookup key] abuse-mailbox: [optional] [multiple] [ ] ** org: [optional] [multiple] [inverse key] admin-c: [optional] [multiple] [inverse key] tech-c: [optional] [multiple] [inverse key] ref-nfy: [optional] [multiple] [inverse key] mnt-ref: [mandatory] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] mntner: [mandatory] [single] [primary/look-up key] descr: [mandatory] [multiple] [ ] org: [optional] [multiple] [inverse key] admin-c: [mandatory] [multiple] [inverse key] tech-c: [optional] [multiple] [inverse key] abuse-mailbox: [optional] [multiple] [ ] ** upd-to: [mandatory] [multiple] [inverse key] mnt-nfy: [optional] [multiple] [inverse key] auth: [mandatory] [multiple] [inverse key] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] referral-by: [mandatory] [single] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ] Rows that are marked with '**' are additions to the templates.

12 23

Announcement Routing Registry Training Courses
by RIPE NCC Training 21 Feb '05

21 Feb '05

------- Dear Colleagues, [apologies for duplicate postings] As a service to its members the RIPE NCC offers the "Routing Registry Training Course". The main objective of the "Routing Registry Training Course" is to familiarise the LIRs with the features of the Routing Registry, while introducing the relevant tools and services of the RIPE NCC. The course also offers practical exercises. OVERVIEW OF TOPICS COVERED IN THE COURSE: - Routing Registry as a part of the RIPE Whois Database and the Internet Routing Registry (IRR) - Specifying routing policies using (RPSL) Routing Policy Specification Language and the RtConfig tool - IRRToolSet - Routing Information Service (RIS) - Routing Registry Consistency Check Project Please note that this is an advanced course. It will: - NOT teach the basics of routing - NOT teach the basics of RIPE Database operations, - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe how to operate a Local Internet Registry (LIR) The target audience of the course are technical staff of LIRs: e.g. network operators, engineers etc. This course is not intended for administrative or management staff (e.g. Hostmasters) . It is assumed that all attendees will be familiar with Border Gateway Protocol routing and with the RIPE Database (i.e. creating/modifying objects). This course is based on interactive exercises in a local network set-up. Please bring your laptops equipped with the following: - A working Ethernet card, - Three meters of Ethernet cable, - A secure connection client, - A web browser. Please be prepared to share your laptop (or at least allow another attendee to "look over your shoulder") if necessary. The Routing Registry Training Course is conducted in the English language and is free of charge, since it is covered by the membership fee. More information about the Routing Registry Training Course can be found at: http://www.ripe.net/training/rr/ REGISTRATION: You can register for a Routing Registry Training Course at the following URL: http://www.ripe.net/cgi-bin/trainingform.pl.cgi Or by completing the registration form at the end of this e-mail and replying to <training(a)ripe.net> . In order to register for a Routing Registry Training Course you must be an employee of an LIR and either: - be an LIR contact - be confirmed by an LIR contact LIR contacts are those employees of an LIR who are registered with RIPE NCC as authoritative contact persons. It is expected that most of those interested in the Routing Registry Training Course will not be an authoritative contact person for their LIR, and therefore will be, refused by the course registration "robot". In order to be admitted to the course, a confirmation e-mail must be sent to <training(a)ripe.net>. Please approach the LIR contacts from your organisation personally, since the identity of LIR contacts is confidential, and the RIPE NCC is unable to divulge contact persons for any given LIR. Kind Regards, Training Services RIPE NCC **************************************************************************** COURSE DATES AND VENUES ======================== Date: Wednesday 18 May 2005 Time: 0900 - 1700 Location: London, United Kingdom AND: Date: Friday 17 June 2005 Time: 0900 - 1700 Location: Paris, France ***************************************************************************** REGISTRATION: To register for this Course, please use the LIR Portal or complete the registration via our website on: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Training Services RIPE NCC

1 0

Re: [db-wg] whois_rip feature request, multiple inverse attribute queries needed
by Wilfried Woeber, UniVie/ACOnet 17 Feb '05

17 Feb '05

>To: av(a)nethead.de >CC: db-wg(a)ripe.net >Subject: Re: [db-wg] whois_rip feature request, multiple inverse attribute > queries needed >From: Havard Eidnes <he(a)uninett.no> >Date: Fri, 07 Jan 2005 16:59:42 +0100 (CET) > >> would it be possible to enhance the RDB query in a way that >> multiple inverse queries are possible?! I would like to be able >> to query objects which match a certain set of inverse >> attributes with only one whois-query. > >If I understood the question correctly, that's already possible. > >You can list the multiple attribute names (admin-c, tech-c, etc.) >separated by comma as the argument to the -i query option. > >Regards, > >- Håvard Supplying a list of arguments actually results in a logical .OR. operation. But at 1st reading, my interpretation of the request was a .AND. operation. I think we need more details, please! _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

5 5

Proposed changes for object ordering
by Shane Kerr 16 Feb '05

16 Feb '05

Dear Colleagues, As mentioned in the posting with the subject "Proposed changes for abuse", here is the proposal to change object ordering. As always, please have a look and discuss it here. -- Shane Kerr Software Manager RIPE NCC This is a proposal to display output differently, making recursive lookup results clearer. Currently, the software has a grouping algorithm that sorts objects by type. For example, if a query finds two INETNUM objects, such as: inetnum: 10.0.0.0 - 10.0.0.127 . . admin-c: PERSON1-RIPE tech-c: PERSON1-RIPE . . inetnum: 10.0.0.128 - 10.0.0.255 . . admin-c: PERSON1-RIPE tech-c: PERSON2-RIPE . . For a query, such as: $ whois 10.0.0.0 - 10.0.0.0.255 Here, the related PERSON/ROLE/ORGANISATION objects will also be returned, after being grouped into types, ending duplication. Therefore, the actual result will contain: inetnum: 10.0.0.0 - 10.0.0.127 inetnum: 10.0.0.128 - 10.0.0.255 person: PERSON1-RIPE person: PERSON2-RIPE This kind of output may be misleading. The user needs to find contact details by looking first at the "admin-c:" and "tech-c:" attributes, and then look them up in the PERSON/ROLE objects shown at the end of the list. This becomes time consuming as the number of objects returned increases. We will change the default output format. We will group objects by relevance. This change will give the following result for the same query: % Information related to '10.0.0.0 - 10.0.0.127' inetnum: 10.0.0.0 - 10.0.0.127 person: PERSON1-RIPE % Information related to '10.0.0.128 - 10.0.0.255' inetnum: 10.0.0.128 - 10.0.0.255 person: PERSON1-RIPE person: PERSON2-RIPE The changes explained in the section 'Hiding Attributes That Contain E-Mail Addresses' in the abuse proposal will apply to each grouping in turn. If only PERSON2-RIPE contains an "abuse-mailbox:" attribute, PERSON1-RIPE will not be filtered when it first occurs in the output, but it will be filtered upon its second occurrence. The 'traditional' output format of the whois server will still be possible, by using the '-G' option. Note: Another proposal could be to present the reordered output if the '-G' option is passed, otherwise to use the current ordering. This would leave the average user with the confusing output, and give the more advanced users the intuitive output. Making it an option would avoid potential problems with tools breaking, but some of the abuse changes will break tools so this may be a good time to change the default.

1 0