- db-wg - mailman.ripe.net

Announcement: RIPE NCC Training Courses
by Training Mailbox 23 Aug '11

23 Aug '11

[Apologies for duplicate e-mails] Dear Colleagues, The RIPE NCC invites you to register for one of our upcoming training courses: - The LIR Training Course This course teaches LIRs how to request Internet number resources and interact with the RIPE NCC. A course outline is available at: http://www.ripe.net/lir-services/training/courses/lir/outline/ - The Routing Registry Training Course This course teaches LIRs how to use the RIPE Database for routing. A course outline is available at: http://www.ripe.net/lir-services/training/courses/rr/ - The IPv6 Training Course This course teaches LIRs about the need for IPv6 and includes basic information on how to plan your deployment. A course outline is available at: http://www.ripe.net/training/ipv6/outline.html To see the location of upcoming courses and to register, please use the LIR Portal or complete the registration form on our website at: RIPE NCC Upcoming Courses List & Registration https://lirportal.ripe.net/lirportal/training/course-list.html If you have any questions, please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Spratley-Kanis Training Services Manager RIPE NCC

1 0

Announcement: New E-Learning videos for the RIPE Database
by Sandra Bras 17 Aug '11

17 Aug '11

[Apologies for duplicate emails] Dear colleagues, The RIPE NCC is pleased to announce the launch of five new RIPE Database videos as part of our E-Learning service. The videos cover the following topics: - The New Organisation Startup Form: Create your organisation's first PERSON and MAINTAINER objects - Create an additional PERSON object using webupdates - Create a MAINTAINER using webupdates - Add a MAINTAINER to an object using webupdates - Delete an object using webupdates These videos can be viewed at: http://www.ripe.net/lir-services/training/e-learning/ripe-database In the coming months, we will be releasing modules focused on the following topics: - RIPE Database - RIPE Policy development Process - DNSSEC (Module 3) RIPE NCC E-Learning modules are provided as a free service that is available to everyone. If you have any questions, please feel free to contact us at: e-learning(a)ripe.net. Happy learning, Sandra Brás Trainer/E-Learning Coordinator RIPE NCC

1 0

Authentication Methods Used in the RIPE Database
by Mirjam Kuehne 15 Aug '11

15 Aug '11

Dear colleagues, As a follow-up to the recent discussion on this list, we published an article on RIPE Labs showing which authentication methods are used by how many MNTNER objects in the RIPE Database. As suggested, we also looked at how many resources are covered by MNTNER objects. Please read on RIPE Labs: http://labs.ripe.net/Members/kranjbar/authentication-methods-used-in-the-ri… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Deployment of New RIPE Database Web Forms
by matisov＠rascom.ru 10 Aug '11

10 Aug '11

Hello. Possible the new form is better then old and you did do it to give the some new features that were absent in the old. But Before I could copy/past the url of search result and in this string was my request and all keys. Now it's not possible. Before I saw all keys in one look on page. Now I must open your several bookmarks (4) and check I put or not the tick in some check-boxes. It's not very well. Sincerely, Ivan Matisov, Russia, S.-Peterburg, Rascom, +7(812)303-91-70, +7(964)342-36-61, +7(495)956-00-80, fax+7(812)303-91-71

2 1

Deployment of New RIPE Database Web Forms
by Denis Walker 10 Aug '11

10 Aug '11

[Apologies for duplicate emails] Dear colleagues, The RIPE NCC Database Group are pleased to inform you that, after a successful trial period, the new and improved set of web forms for accessing the RIPE Database is now fully in production. The old Query CGI is no longer available. Details of the new services are contained in the recent announcement to the Database Working Group: http://www.ripe.net/ripe/maillists/archives/db-wg/2011/msg00170.html Regards, Denis Walker Business Analyst RIPE NCC Database Group

1 0

Questions about network routing
by Zygimantas Surgailis 08 Aug '11

08 Aug '11

Hello, Hope someone can help me. For few months now I've noticed the increased responce time from some of my servers in German datacenters (Lithuania -> Germany) from one Internet provider (this problem doesnt occur when using other providers). Also, the problem occurs only with servers collocated in Hetzner DC. For example traffic to hetzner.de goes through Russia: Tracing route to hetzner.de [213.133.107.227] over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms DD-WRT [192.168.1.1] 2 <1 ms <1 ms <1 ms XXXXX.meganet.lt [XXXXXX] 3 <1 ms <1 ms <1 ms 88.223.0.254 4 1 ms 1 ms 2 ms 88.223.0.157 5 <1 ms <1 ms <1 ms 80.232.131.233 6 5 ms 5 ms 4 ms 87.110.223.237 7 6 ms 7 ms 7 ms 195.122.0.133 8 7 ms 7 ms 7 ms 195.122.0.121 9 21 ms 21 ms 21 ms 92.50.199.29 10 98 ms 111 ms 98 ms xe-1-0-0.frkt-ar2.intl.ip.rostelecom.ru [87.226.133.110] 11 76 ms 76 ms 76 ms decix2-gw.hetzner.de [80.81.193.164] 12 83 ms 84 ms 84 ms hos-bb1.juniper2.fs.hetzner.de [213.239.240.243] 13 81 ms 82 ms 81 ms hos-tr3.ms-ex3k1.rz11.hetzner.de [213.239.236.99] 14 81 ms 80 ms 80 ms www.hetzner.de [213.133.107.227] Trace complete. But traffic to e-shelter.de goes directly to Germany: Tracing route to e-shelter.de [91.208.160.80] over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms DD-WRT [192.168.1.1] 2 <1 ms <1 ms <1 ms XXXXXXX.meganet.lt [XXXXX] 3 <1 ms <1 ms <1 ms 88.223.0.254 4 * 1 ms 1 ms 88.223.0.157 5 <1 ms <1 ms <1 ms 80.232.131.233 6 5 ms 5 ms 5 ms 87.110.223.78 7 13 ms 13 ms 13 ms xe-0-2-0-301.stk30.ip4.tinet.net [77.67.66.133] 8 78 ms 44 ms 44 ms xe-0-0-0.fra60.ip4.tinet.net [89.149.185.105] 9 46 ms 46 ms 46 ms ge-0-1-0.pr1.k90.fra.de.eurotransit.net [213.200.86.50] 10 39 ms 39 ms 39 ms adacor.demarc.eurotransit.net [82.96.89.182] 11 39 ms 39 ms 39 ms 91-208-160-80.static.ip.adacor.net [91.208.160.80] 12 45 ms 40 ms 39 ms 91-208-160-80.static.ip.adacor.net [91.208.160.80] Trace complete. I've contacted Latvian telecom ant here is their answer: "Path via Rpstelecom is shortest by AS-Path lenght. Router: az8-crs Command: show bgp 213.133.107.227 Mon Jul 25 09:06:29.824 EEST BGP routing table entry for 213.133.96.0/19 Versions: Process bRIB/RIB SendTblVer Speaker 132081071 132081071 Last Modified: Jul 5 00:42:25.785 for 2w6d Paths: (5 available, best #3) Advertised to update-groups (with more than one peer): 0.5 0.14 0.17 Advertised to peers (in unique update groups): 195.122.0.5 Path #1: Received by speaker 0 Not advertised to any peer 3216 13030 24940, (aggregated by 24940 213.133.96.7) 62.231.5.217 from 62.231.5.217 (194.67.0.95) Origin IGP, localpref 90, weight 40, valid, external, group-best Received Path ID 0, Local Path ID 0, version 0 Community: 12578:100 12578:3216 Path #2: Received by speaker 0 Not advertised to any peer 3257 13030 24940, (aggregated by 24940 213.133.96.7) 77.67.67.89 from 77.67.67.89 (213.200.87.15) Origin IGP, metric 170, localpref 100, weight 40, valid, external, group-best Received Path ID 0, Local Path ID 0, version 0 Community: 12578:100 12578:3257 Path #3: Received by speaker 0 Advertised to update-groups (with more than one peer): 0.5 0.14 0.17 Advertised to peers (in unique update groups): 195.122.0.5 12389 24940, (aggregated by 24940 213.133.96.10) 92.50.199.29 from 92.50.199.29 (87.226.134.132) Origin IGP, localpref 110, weight 40, valid, external, best, group-best Received Path ID 0, Local Path ID 1, version 132081071 Community: 12578:300 12578:12389 24940:24940 Path #4: Received by speaker 0 Not advertised to any peer 3249 13030 24940, (aggregated by 24940 213.133.96.7) 195.250.170.49 from 195.250.170.49 (84.50.255.90) Origin IGP, localpref 100, weight 40, valid, external, group-best Received Path ID 0, Local Path ID 0, version 0 Community: 12578:100 12578:3249 Path #5: Received by speaker 0 Not advertised to any peer 3320 3320 3320 24940 24940, (aggregated by 24940 213.133.96.10) 217.243.219.117 from 217.243.219.117 (194.25.5.230) Origin IGP, localpref 100, weight 40, valid, external, group-best Received Path ID 0, Local Path ID 0, version 0 Community: 12578:100 12578:3320 My knowledge is limited, so I'm not sure what should I do next, whom should I contact? Thank You for any help in advance.

3 2

Deployment of New RIPE Database Web Forms
by Denis Walker 04 Aug '11

04 Aug '11

Dear Colleagues The Database Group is pleased to announce the deployment of a new and improved set of web forms for accessing the RIPE Database. These forms allow users to: - Query the RIPE and TEST Databases - Query a set of global Internet resource databases, excluding personal data - Perform a Full text search on the contents of the RIPE Database, excluding personal data - Find Abuse contacts for an Internet resource The new forms are available now at: https://apps.db.ripe.net/search/query.html https://apps.db.ripe.net/search/full-text.html https://apps.db.ripe.net/search/abuse-finder.html The current Query CGI and text search (using Glimpse) were some of the first tools the Database Group wrote for accessing Version 3 of the RIPE Database. These are now almost ten years old. The new forms use up-to-date technology and makes use of the RIPE Database API. The Query form queries the RIPE and TEST Databases providing the same usable features as the old advanced Query CGI. Alternatively it can be used to query the Global Resource Service databases (GRS). The Full text search allows searches over the plain text content of RIPE Database objects, without regard for any relationships. We re-index the text of RIPE Database objects every night. The indexed data is taken from the RIPE-GRS source database, and includes all the operational data but none of the personal data. The Abuse Finder accepts an Internet resource identifier and returns any abuse details found for that resource. This includes "abuse-mailbox:" email addresses, IRT objects and pointers to related objects that include a "remarks:" attribute that contains text that 'looks like' possible abuse contacts. The global Internet resource databases are a set of databases covering the operational resource data from the RIRs and some major routing registries. This Global Resource Service is currently in beta release. All these forms have been available for a while on RIPE Labs. They are now all available as production services. The RIPE Database Search form on the home page of the ripe.net website, will still be linked to the old Query CGI until Wednesday, 10 August. After this date all web queries will use the new form. If you have any issues or find any bugs in the new web forms, please report them to ripe-dbm(a)ripe.net. We will assess any reports quickly and report back with an estimate of time for fixing the problem or an explanation of why it works this way. Some issues may be added to a feature request list and processed after any urgent bug fixes. Regards, Denis Walker Business Analyst RIPE NCC Database Group

1 0

Website/Link in ERROR:201 whois output outdated?
by Sascha Lenz 03 Aug '11

03 Aug '11

Hi, i just realized that at least one of the URLs/links the RIPE-db software hands out seems to be outdated (since the RIPE website redesign?) Someone asked me about an error reply he received while trying to query the db and he found this in an ERROR:201 response : % Sorry, access from your host has been permanently % denied because of a repeated excessive querying. % Please see http://www.ripe.net/db/err201.html <---- % for more information. ...which is 404 Just a heads up. Probably there are more outdated links, we/the NCC might want to check that. I can't reproduce this since i have no blocked IP myself (that i know of), so there is a chance the other person is doing something wrong or got a weird whois client and this is not a problem in the database texts. . o O(and if i'm a total dork than those responses are hardcoded in the client) (P.S.: We're not sure why his IP(v6) address is blocked, but that's a different story) -- Mit freundlichen Grüßen / Kind Regards Sascha Lenz [SLZ-RIPE] Senior System- & Network Architect

1 0

Re: [db-wg] Analysis of MNTNER Authentication
by Denis Walker 28 Jul '11

28 Jul '11

Hi Peter We looked a little deeper into this. We noticed there are only 50 MNTNER objects in the database that do NOT have a password. They use a combination of PGP and/or X.509 only. So we looked at where these MNTNERs are used. There are probably many ways to look at this. The one we chose is how allocated address space is managed by LIRs. So we looked at the "mnt-lower:" on the allocation INETNUM objects. Some of these 50 MNTNERs are used in this way. The "mnt-lower:" allows assignments to be created. So this can be seen as a measure of control over the assigned address space. We calculated the cumulative size of the allocation blocks where one of these 50 MNTNERs is used as the "mnt-lower:" as a percentage of the total allocated address space. Cumulative total of allocations 4722688 using one of these 50 MNTNERS Total allocated address space 555648000 Percentage of address space 0.85% controlled by PGP/X.509 only (without any passwords) For the other 99.15% of address space, there may be a PGP or X.509 credential in the MNTNER object, but in addition to a password. Regards Denis Walker Business Analyst RIPE NCC Database Group On 21/06/11:26 7:14 PM, Peter Koch wrote: > Denis, > > thanks a lot for producing the numbers and information. > >> The next step was to look into the referenced MNTNER objects to see how >> many used password, PGP or X.509, and in what combination and numbers. >> >> MNTNER with one auth containing a password = 27,434 85% >> MNTNER with only password = 27,796 86% >> MNTNER with one auth containing a PGP = 952 3% >> MNTNER with only PGP = 1,507 5% >> MNTNER with one auth containing an X.509 = 16 <1% >> MNTNER with only X.509 = 21 <1% >> MNTNER with password plus either PGP or X.509 = 3,023 9% >> MNTNER with PGP plus X.509 (no password) = 50 <1% >> MNTNER with one password plus multiple PGP = 357 1% >> MNTNER with one PGP plus multiple password = 59 <1% > > in addition to what Shane suggested (which methods are actually _used_), I'd > be interested to learn how large of a percentage of the address space (as opposed to > the number of objects) is covered by "password" authentication. This is > to avoid artefacts by passwords being used for small chunks and PGP/X.509 > for the larger ones - or vice versa. > > Thanks, > Peter >

1 0

New Syncupdates service
by Denis Walker 21 Jul '11

21 Jul '11

Dear Colleagues, As part of the RIPE NCC Database Group's ongoing efforts to improve our infrastructure, we are pleased to announce the launch of a completely re-written Syncupdates service. This new Syncupdates is easier to maintain and improve than the old version, which was written almost ten years ago. The Syncupdates interface for users of the service is unchanged, so from a user viewpoint, nothing has changed. Any software or scripts written to access Syncupdates will continue to work without any need for modifications. A more detailed article will follow shortly on RIPE Labs with additional technical details about the new Webupdates and Syncupdates services. If you do have any problems with the new Syncupdates please contact <ripe-dbm(a)ripe.net>. Regards Denis Walker Business Analyst RIPE NCC Database Group

1 0