RIPE Labs

It varies; for direct peering/connections where a link goes down (and fast failover protocol is used), usually 5 seconds or so. Global propagation takes in the order of 5 minutes or less: https://labs.ripe.net/author/vastur/the-shape-of-a-bgp-update/

In addition to monitoring your own network, you might want to monitor your ISP's and share the results for research - a software RIPE Atlas probe is a great method for that: https://labs.ripe.net/Members/alun_davies/ripe-atlas-software-probes

Looking for a quick mitigation technique before patches start rolling out... Would it be wise to limit responses to 512 bytes so the payload cannot be loaded? Configuring BIND to use a specific buffer size (only for BIND 9.3.2 and newer): Add the following line to the "options" section of your named.conf file: edns-udp-size: n Configuring Unbound to use a specific buffer size: Add the following line to the "server" section of your unbound.conf file: edns-buffer-size: n source: https://labs.ripe.net/Members/anandb/content-testing-your-resolver-dns…

> My company has just turned off all ip6 connectivity for its corporate laptops because it’s considered a security risk. If your corporate laptops are running Windows, then you're going against the officially supported configuration of the vendor (Microsoft): > Internet Protocol version 6 (IPv6) is a mandatory part of Windows Vista and Windows Server 2008 and newer versions. > We don't recommend that you disable IPv6 or IPv6 components or unbind IPv6 from interfaces. If you do, some Windows components might not function. * https://learn.microsoft.com/en-us/troubleshoot/windows-server/networki… > Cg nat does everything that’s needed […] Except for making it convenient for end-user to, say, play P2P video games, or host Mindcraft servers, etc. > […] and 6 alone sadly still doesn’t work reliably. It's so unreliable that half of all Internet traffic uses it. It's so unreliable that Microsoft has been going IPv6-only in their corporate networks (a decade ago): * https://labs.ripe.net/author/mirjam/ipv6-only-at-microsoft/ It's so unreliable that Google is now 99% IPv6-only/mostly on their corporate networks: * https://www.youtube.com/watch?v=UTRsi6mbAWM

> VPN providers shouldn't be allowed to claim that VPNs protect you from malware or that they do a better job at protecting data in transit than vanilla SSL. That's... not exactly true, given what definition of "protecting" you follow. VPNs definitely can protect against some forms of attacks that plain old HTTPS can't: - malicious QoS/routing policies at the ISP (or a public WiFi operator) that, say, down-prioritise or throttle stuff like YouTube, or route it through backed-up links (German Telekom was infamous for bad peering towards high traffic sites including Youtube [1] or where they all but extorted money from "double paid traffic" from server owners [2]) - ISPs hijacking DNS for a myriad of reasons (NXDOMAIN ad-hijacks, government-ordered censorship, thinking they can offer "improved" DNS service by simply answering all requests going out on UDP53 with their own servers [3], ...) - ISPs and WiFi operators listening on DNS requests or doing traffic analysis to sell to advertisers [4] - other devices on the network attacking your machine (e.g. in a coworking space) - proper VPN software like Cisco will "cut off" all communication with the outside with the exception of the remote VPN endpoint IP and DHCP. The part about malware is more sketchy, but in case the VPN operator uses something like PiHole and other shared lists of malware domains and IPs to blacklist common-known vectors and C&C sites, it is a valid statement. [1]…

IMO it's easy to have an opinion on either side of the fence - based on what you've done (or not done). Cloudflare, for example, committed to RPKI very publicly in 2018 [0]. This article, by ThousandEyes, does a nice job of visualizing the problem [1], published in July of 2019. As I read the parent article to this thread it strikes me as a bit defensive - which smells of a lie of omission (not exactly the whole truth, but conveniently cherry picked). They do very little in the article to state two missing arguments: 1) their timeline to implement RPKI (they only state: "At this stage we are looking in to this. We want to be sure we take the right approach, some of which will involved asking our transit providers what they are doing about it.") and 2) the rationale for not being further along of protecting customers with regard to the topic of RPKI. They also grab Coronovirus as a rationale for doing nothing right now: "Since this has now happened a few times, we felt it worth giving some more information that may be useful to customers and others who've seen these tweets (either directed at us, or at other ISPs), explaining a bit about what BGP is and how RPKI can extend it, and also our feelings about Cloudflare attempting to build support in this manner, especially now, during the Corona Virus situation." If you look at this NANOG thread [2] nobody is complaining about ATT announcing they have implemented RPKI. So is there a negative downside? No. Has CloudFlare…

The fact that it can be trivially blocked by anyone on the network path does not make it "much better". Of course anyone on the "network path" can block almost any protocol; DoT isn’t unique in that regard. The concern is many large businesses block port 853 but that's because prior to the development of DoT, there was no reason for IT departments to configure firewalls to enable it. Most organizations only have a handful of ports available, including 443, which is what HTTPS uses and therefore DoH works as a result. I've been running DNS over TLS using the Unbound [1] resolver for my home LAN on a spare laptop for a few weeks now and it’s been great. Given the privacy trade-offs between privacy and security, many IT departments would opt to make port 853 available for DoT rather than increasing the ability for their users to be tracked. As I mentioned elsewhere in this thread, the article Centralised DoH is bad for Privacy, in 2019 and beyond [2] clearly describes the issues with DoH: DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy. DNS over HTTPS however neatly separates…

I seem to remember a paper a few years ago that (IIRC) tested this by setting a very low TTL (like 60), changing the value, and seeing how long they continued to receive requests at the old value... and most updated within the TTL, but there were some that took up to (I want to say) an hour. I'm probably getting bits of this wrong though.. I did find this paper: https://labs.ripe.net/Members/giovane_moura/dns-ttl-violations-in-the-… The violations in that paper that are important are those that have increased the TTL. Reducing the TTL increases costs for the DNS provider, but isn't important here. The slowest update was about 2 hours (with the TTL set to 333). Of those that violated the TTL, we don't know what portion of those would function correctly with a different TTL (increasing the TTL indicates they're already not following spec). So I wouldn't assume that increasing the TTL would get them to abide by your requested TTL. They're following their own rules, and those could by anything. Considering how common low TTLs are... you're worrying about a DNS server that's already potentially causing errors for major well known websites.

I admit vague ignorance here. The article links to two test sites, https://www.dns-oarc.net/oarc/services/replysizetest and http://labs.ripe.net/content/testing-your-resolver-dns-reply-size-issu… The dig test on the first site times out. The second site has a downloadable java test which I didn't use. Instead I adapted the first site's dig test to the second site: $ dig +short test.rs.ripe.net txt rst.x477.rs.ripe.net. rst.x481.x477.rs.ripe.net. rst.x486.x481.x477.rs.ripe.net. "68.87.85.100 DNS reply size limit is at least 486 bytes" "68.87.85.100 lacks EDNS, defaults to 512" "68.87.85.100 summary bs=512,rs=486,edns=0,do=0" 68.87.85.100 is comcast, my ISP. The first test site, dns-oarc.net, shows expected results (which I don't have here), and for the above error it says I should "investigate further." I'm running ubuntu 10.04 LTS (uptime about 10 hours :) on a laptop behind my WRT54GL and did nothing specific to configure the network. $ cat /etc/resolv.conf # Generated by NetworkManager domain hsd1.co.comcast.net search hsd1.co.comcast.net nameserver 68.87.85.102 nameserver 68.87.69.150 The basic question is, should I be looking at my router's configuration (WRT54GL) or should I be asking comcast what's up? And what should I be reading to understand this issue. I'm afraid of traveling down a rabbit hole following semi-random RFCs.

Same here (well, 25-ish years). And while self-hosted email may be declining, it apparently still outnumbers any single email provider: https://labs.ripe.net/images/r_uuIdAmmdbhI1R9Der6slvvH5U=/10070/width-…

You can configure it statically but there used to be the anycast address 192.88.99.1 and the idea was that you'll get routed to the nearest one by magic of BGP. It was retired once native IPv6 deployment took off. Apparently the practical problems were related to people haplessly firewalling it out (ref. https://labs.ripe.net/author/emileaben/6to4-why-is-it-so-bad/)

The result of the cable cut was essentially meaningless. I doubt there was intent to cut these specific cables. https://labs.ripe.net/author/emileaben/does-the-internet-route-around-…

Analysis regarding latencies and packet loss due to cut cables: https://labs.ripe.net/author/emileaben/does-the-internet-route-around-…

For BGP there’s [1] which is quite new and I wanted to check out, haven’t had the time yet. There are some older guides e.g. by Cisco as well. I think in general more of the documentation and information is in blog posts and RFCs, so I’d start there, e.g. [2] is quite nice. 1: BGP (Border Gateway Protocol): from theory to practice - https://amzn.eu/d/i6EUYGj 2: https://labs.ripe.net/author/samir_jafferali/build-your-own-anycast-ne…

I did some research on TXT records a little while back, that might be of interest: https://labs.ripe.net/author/pgl/the-joy-of-txt/

Ripe Atlas probe coupled with Prometheus: https://labs.ripe.net/author/daniel_czerwonk/using-ripe-atlas-measurem… I get an alert for an internet outage (I use Grafana Cloud so the outage isn't preventing me from being alerted). I also have the side benefit of historical information on the health of the connection.

There's "Privacy Extension" for that, from https://labs.ripe.net/author/johanna_ullrich/ipv6-addresses-security-a… > The IPv6 Privacy Extension is defined in RFC 4941. It is a format defining temporary addresses that change in regular time intervals; successive addresses appear unrelated to each other for outsiders and are a means of protection against address correlation. Their regular change is independent from the network prefix; this way, they protect against tracking of movement as well as against temporal correlation.

Looking at the records via command line whois -h whois.ripe.net 5.153.128.0 It shows it assigned to timernet.ru and record was last updated on 2022-08-04T05:37:14Z. That was almost two months ago, that's a long time for an error to persist. EDIT: Reading some more of the Twitter threads and some other documents on the RIPE website, it seems this is normal practice as far as RIPE considers it, unless timernet.ru were an EU sanctioned entity. https://labs.ripe.net/author/athina/eu-sanctions-and-our-russian-membe…

They're definitely not, that's just what their IP lookup would have you believe. There are in fact tons of root servers located all over the world leveraging anycast. https://www.cloudflare.com/learning/dns/what-is-anycast-dns/ https://labs.ripe.net/author/emileaben/dns-root-server-transparency-k-…

More information: https://labs.ripe.net/author/cteusche/bgp-meets-cat/

Ripe did some testing in 2017 that showed that most places (~94%) are doing the right thing. Somewhere around 6% of the DNS servers were either making the TTL last too long, or too short. There's a downloadable zip file there where you could probably figure out who the offenders were. Ripe did say that it was a mix of both ISPs and Cloud providers. https://labs.ripe.net/author/giovane_moura/dns-ttl-violations-in-the-w… Edit: There are also probably some corporate MITM type "content filtering" caches that are screwing things up too, by caching web pages longer than they should.

I was searching for some (no-anecdotal) evidence and found this study: https://labs.ripe.net/author/giovane_moura/dns-ttl-violations-in-the-w… Seems that increased TTL in resolvers is still a thing in 2021 but it's a bit over-estimated. IMO it should not be considered when changing DNS. May their customers complain about the broken DNS every time a change is not "propagated" (sic!) there.

> draft-schoen-intarea-unicast-lowest-address-00 Just as a heads up, zero in the last octet results in general reachability problems. We used x.y.z.0 as a vip at Facebook^WMeta for a while, but learned the hard way that some people can't reach those ips. Some additional info from RIPE: https://labs.ripe.net/author/stephane_bortzmeyer/all-ip-addresses-are-…

It is kinda funny, right before this whole Facebook thing happened I started trying to explore BGP more. I actually found a really cool guide(https://labs.ripe.net/author/samir_jafferali/build-your-own-anycast-ne… from RIPE that walks you through setting up an AS to do anycast. I have been doing some pretty heavy networking stuff for years, but I finally got an AS number and IPv6 block assigned to me. My thought is that if it is cheaper to just do something to learn it rather than taking a class you should just do it.

Interesting RIPE labs article about a more foundational change that could be made: https://labs.ripe.net/author/hausheer/scion-a-novel-internet-architect…

These are usually called 'BGP Zombies', and here's a good summary of their prevalence and usual causes: https://labs.ripe.net/Members/romain_fontugne/bgp-zombies In this case however, it seems to be an L3/CL-specific bug.

Companies and organizations are de-aggregating larger space into multiple /24 (most often) to extend the usage of their v4 IP address space, as nicely covered in this article: https://labs.ripe.net/Members/stephen_strowes/visibility-of-prefix-len…

ICANN controls the non technical administrative/political portion of DNS, but the actual DNS root servers are extremely widely distributed. https://labs.ripe.net/Members/emileaben/dns-root-server-transparency https://labs.ripe.net/Members/emileaben/screen-shot-2017-01-11-at-14-4…

The old key was hosted inside a proprietary appliance and can't be extracted. https://labs.ripe.net/Members/anandb/the-future-of-dnssec-at-the-ripe-… https://labs.ripe.net/Members/anandb/dnssec-signer-migration """Our old Secure64 signers do not export their private keys. This means that in order to migrate to the new signers, we will have to perform a KSK roll-over."""