ARIN Update. Summer 2011 ESCC/Internet2 Joint Techs Mark Kosters Chief Technology Officer

Transcription

1 ARIN Update Summer 2011 ESCC/Internet2 Joint Techs Mark Kosters Chief Technology Officer

2 Agenda A Brief Overview of ARIN IPv4 and IPv6 Stats Call to Action Technology Initiatives 2 of 23

3 About ARIN Regional Internet Registry (RIR) Established December 1997 by Internet community 100% community funded ARIN s region includes Canada, many Caribbean and North Atlantic islands, US Minor Outlying Islands, and the United States.

4 Number Resource Distribution

5 What ARIN Does... ARIN is one of five Regional Internet Registries (RIRs) in the world. Like the other RIRs, ARIN: Allocates and assigns Internet number resources Provides services related to the technical coordination and management of Internet number resources, e.g. Whois, ip6.arpa, in-addr.arpa (aka Reverse DNS) and soon RPKI Facilitates policy development Participates in the international Internet community Is a nonprofit, community-based organization governed by a member-elected executive board

6 Getting IP Addresses Generally you should obtain them from your service provider ARIN will assign resources directly to end users if you qualify under current community based policy Multiple service provider (Multihomed) Meet a certain utilization (size) Experimental / Critical Infrastructure Similarly, ARIN will allocate resources to ISPs consistent with policies (many)

7 ARIN Policy Process Documented decisions that determine the management of Internet number resources in the ARIN region Anyone can participate Guided by our documented Policy Development Process Shepherded by elected Advisory Council of volunteers Participation via two annual public policy meetings and mailing list must subscribe) Details:

8 IPv4 Depletion and IPv6 Uptake

9 IPv4 Address Space Utilization *as of 3 February 2011

10 IANA Available IPv4 Space in /8s

11 IPv4 Depletion Situation Report Each RIR received its last /8 IPv4 address block from IANA on 3 February While each RIR currently has IPv4 addresses to allocate, it is impossible to predict when each RIR will run out. Current Estimate to ARIN depletion January 2012 (?) ARIN publishes an inventory of available IPv4 addresses, updated daily, at

12 IPv4 ADDRESS SPACE What is the status of each of the 256 /8s? March 2011 Internet Number Resource Report

13 Current ARIN IPv4 Inventory (as of 31 Mar 2011) 5.16 /8 equivalents in the pool of available addresses 9.22 /16 equivalents in the returned bucket (voluntarily returned) 1.80 /16 equivalents in the revoked bucket (revoked due to non-payment of fees) /16 equivalents in the held bucket (de-registered from Whois, but still routed) 254 /16s are Interop, the remaining 8.08 /16s are held (because still routed)

14

15

16 IPv6 Requests Received Jan- 09 Feb- 09 Mar- 09 Apr- 09 May- 09 Jun- 09 Jul- 09 Aug- 09 Sep- 09 Oct- 09 Nov- 09 Dec- 09 Jan- 10 Feb- 10 Mar- 10 Apr- 10 May- 10 Jun- 10 Jul- 10 Aug- 10 Sep- 10 Oct- 10 Nov- 10 Dec- 10 Jan- 11 Feb- 11 Mar- 11 Apr- 11

17 Number of ARIN IPv6 Allocations Issued to ISPs

18 Number of ARIN IPv6 Assignments Issued to End-users

19 IPv4 vs IPv6 Subscribers 3,578 IPv4 ISP subscribers today 2,502 (70%) do not have IPv6 allocations, yet (30%) do!

20 IPv4 ADDRESS SPACE ISSUED (RIRs TO CUSTOMERS) In terms of /8s, how much space did each RIR issue by year? March 2011 Internet Number Resource Report

21 IPv6 ADDRESS SPACE How much has been allocated to the RIRs? March 2011 Internet Number Resource Report

22 IPv6 Allocations RIRs to LIRs/ISPs How many allocations have been made by each RIR by year? March 2011 Internet Number Resource Report

23 IPV6 ASSIGNMENTS RIRs to End-Users March 2011 Internet Number Resource Report

24 IPv6 ALLOCATIONS RIRs to LIRs/ISPs (Jan 1999 Mar 2011) How many total allocations have been made by each RIR? In terms of /32s, how much total space has each RIR allocated? March 2011 Internet Number Resource Report

25 ARIN Call to Action

26 IPv4 & IPv6 - The Bottom Line We re running out of IPv4 address space. IPv6 must be adopted for continued Internet growth. IPv6 is not backwards compatible with IPv4. We must maintain IPv4 and IPv6 simultaneously for many years. IPv6 deployment has begun.

27 2011 Outreach Events Ongoing participation in various local, national and international forums. Focus on IPv4 depletion and IPv6 adoption. Events include: CES Pacific Telecom Conference Cable Labs Joint Techs / Internet2 ICT roadshow events TTVN IT Roadmap Game Developers Conference Enterprise Connect Satellite 2011 Rocky Mountain IPv6 Summit Interop CANTO FOSE HostingCON

28 ARIN Technology Initiatives

29 Recent Changes Specified Transfer Listing Service (STLS) DNSSEC RPKI Whois-RWS Directory Service In-addr.arpa transition

30 STLS Listers and Needers Facilitators have been added $100 annual fee for access Not much activity yet Some Press (Nortel)

31 Why are DNSSEC and RPKI Important? Two critical resources DNS Routing Hard to tell when it is compromised Focus of Government funding Department of Homeland Security

32 What is DNSSEC? DNS responses are not secure Easy to Spoof Examples of malicious attacks DNSSEC attaches signatures Validates responses Can not Spoof

33 Changes Required to make DNSSEC work Transfer of in-addr.arpa to ICANN Signing in-addr.arpa, ip6.arpa and delegations that ARIN manages Provisioning of DS Records ARIN Online RESTful Interface (mid-september) All completed by 4/27/2011

34 ARIN Online - Zone Management

35 RPKI Pilot Available since June ARIN-branded version of RIPE NCC software 45 organizations participating #2 (behind RIPE) on prefixes/roas

36 General Architecture Database ARIN Online RPKI Engine Persistence HSM Tight coupling between resource certificate / ROA entities and registration dataset at the database layer. Once certs/roas are created, they must be maintained if the registered dependents are changed.

37 Development before ARIN XXVI With a few finishing touches, ready to go Jan 1, 2011 with Hosted Model, Delegated Model to follow end of Q1. Highly influenced by RIPE NCC entities. ARIN Online Database RPKI Engine Persistence HSM RIPE NCC RPKI Engine with a few tweaks. Sun SCA 6000 Everything is Java, JBoss, Hibernate.

38 From ARIN XXVI RPKI Services - ARIN to sign (assert) directly assigned/allocated resources - Other related services such as storing signatures/ assertions for downstreams under review - Board of Trustees, along with ARIN General Counsel, are evaluating risks associated with these services - ARIN is seeking input from community regarding the these services

39 As a Result Completely new requirements for nonrepudiation in ROA generation for hosted CAs Completely new requirements to thwart Evil Mark (rogue employee) Further intense review of liabilities by legal team and Board of Trustees

40 Changes Underway In-browser ROA request signing via AJAX. Minor changes. Database Persistence ARIN Online RPKI Engine HSM Message driven engine which delegates to the HSM. Custom programming on IBM 4764 s to enable all DER encoding and crypto. HSM coding is in C as extensions to IBM CCA. Libtasn1 used for DER coding.

41 Updates within RPKI outside of ARIN The four other RIRs are in production with Hosted CA services Major routing vendor support being tested Announcement of public domain routing code support

42 ARIN RPKI Status Hosted CA anticipated by end of September at the earliest We intend to add up/down code for delegated model by the end of the year

43 Cumulative Per month Whois-RWS Statistics v6

44 Whois-RWS Statistics -v4 Whois Queries Queries Per Second Months

45 Cumulative Whois-RWS Traffic Port 43 Port 80 Queries Per Second RESTful Months

46 in-addr.arpa Transition in-addr.arpa generation moved from ARIN to ICANN on 2/16/11 in-addr.arpa moved from root servers to RIR/ICANN managed servers Servers moved off root in increments from 2/21/11 until 3/7/11 in-addr.arpa is now signed Plan to provision DSs to ICANN for /8 s under ARIN s control by 5/1/11 No need for trust anchors by that point

47 Traffic from a.in-addr-servers.arpa

48 Learn More and Get Involved Learn more about IPv Get Involved in ARIN Public Policy Mailing List Attend a Meeting

49 Next ARIN Meetings Remote participation Policy discussions Tutorials Social event Adjacent to NANOG Apply for the ARIN XXVIII Philadelphia fellowship from 11 July 26 August

50 Thank You