RIPE Database. Training Course

Transcription

1 RIPE Database Training Course January 2018

2 Schedule 09:00-09:30 Coffee, Tea 11:00-11:15 Break 13:00-14:00 Lunch 15:30-15:45 Break 17:30 End!2

3 Introductions Name Number on the list Experience with: - Being an LIR - The RIPE Database Goals!3

4 Overview What is the RIPE Database? How does it work? How to update it? Delegating address space to others RIPE Routing Registry Reverse DNS More RIPE Database Inverse Lookups, Full Text Search, Notifications, RIPE Database Working Group!4

5 Prepare Yourself! Get your laptop up and running Make sure you have an Internet connection - and a RIPE NCC Access account! Open your browser and go to the TEST Database: Open several tabs in the browser, if you want!5

6 Take out the exercise booklet When you see the green square in the title, there is an acitivity for you to do! = Activity time! Get ready to type a lot! Don t forget to take notes in the notebook ;-)!6

7 The Story Your colleague Jean Blue opened an LIR account - Requested IPv4, IPv6 and ASN - There are s from the RIPE NCC in booklet Jean Blue already did some things in the Database You were requested to take over some tasks Your boss sent you to this training course!!7

8 The RIPE Database What is it?

9 Your LIR Account Was Activated 1. Read the 1 - from the RIPE NCC Customer Services department 2. In the web browser, go to: Search for the person object from the !9

10 What Do You See? What do you get as a result? Which lines are not easy to understand?!10

11 What You Are Seeing A person object has data that can be used to contact a real person Name Address Phone Other person This is how you can contact me!11

12 The RIPE Database Public Internet resource and routing registry database Ask Pedro to remake this concept.!12

13 Purpose of the RIPE Database Registry of WHO holds IPs and ASNs Keep contact information - For troubleshooting, notifying of outages, etc. Publishing routing policies Provisioning reverse DNS!13

14 RIPE Database Objects inetnum IPs and ASNs inet6num Contact Information organisation person aut-num role Routing route route6 Reverse DNS domain Object Protection mntner!14

15 Looking Up Object Templates 1. Open a browser and go to: Search for the following: -t person!15

16 What Do You See? What do you get as a result? What is not easy to understand?!16

17 Object Templates person: [mandatory] [single] [lookup key] address: [mandatory] [multiple] [ ] phone: [mandatory] [multiple] [ ] fax-no: [optional] [multiple] [ ] [optional] [multiple] [lookup key] org: [optional] [multiple] [inverse key] nic-hdl: [mandatory] [single] [primary/lookup key] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] abus box: [optional] [multiple] [inverse key] [mandatory] [multiple] [inverse key] created: [generated] [single] [ ] last-modified: [generated] [single] [ ] source: [mandatory] [single] [ ]!17

18 Anatomy of an Object person: Jean Blue address: Long Street 123 address: Big City Attributes nic-hdl: JB0123-RIPE SECURITY-MNT Values created: (date & time) last-modified: (date & time) source: RIPE!18

19 Primary Key Every object has one Primary Key It makes the object unique - Different from other objects of the same type inetnum organisation inet6num aut-num Primary Key person nic-hdl role nic-hdl!19

20 Lookup Keys person: Jean Blue address: Long Street 123 address: nic-hdl: created: last-modified: source: Big City JB0123-RIPE SECURITY-MNT (date & time) (date & time) RIPE!20

21 Search For Your Organisation 1. Read the 1 again 2. Open a browser and go to: Search for the organisation object!21

22 What Do You See? What does the organisation object represent? Notice the admin-c: and tech-c: attributes What are their values?!22

23 What You Are Seeing An organisation object has data about a company, institution or any other kind of organisation that has IP addresses and AS Numbers Name People Address Phone Other organisation This is how you can contact ORG and who is responsible!23

24 Objects Are Linked To Each Other org: IP Range organisation contact: contact: person org:!24

25 admin-c Appears in most types of objects Name of administrative contact person(s) This is someone who will be contacted about administrative questions such as network registration, etc.!25

26 tech-c Appears in most types of objects Name of technical contact person(s) This is someone to be contacted for technical problems such as routing, (mis)behavior of hosts on the net, etc.!26

27 Search For Your Role Object 1. Read the 1 again 2. Open a browser and go to: Search for the role object!27

28 What Do You See? Notice the admin-c: and tech-c: attributes What are their values? Do you see any attribute that catches the eye?!28

29 Two Functions for the Role Object Group of Persons Abuse Contact ROLE admin-c: tech-c: abus box:!29

30 Role Object: Abuse Contact The role object contains the abus box: Objects reference the role in abuse-c: RIPE Database shows the abuse contact in WHOIS query results role: Abuse Reports abuse-c: AR0555-RIPE nic-hdl: AR0555-RIPE abus box:

31 Role Object: Group of Persons person: John Smith nic-hdl: JS123-RIPE address: Sesame Street 1 phone: john@example.org LIR-MNT role: LIR Admin nic-hdl: LA789-RIPE tech-c: JS123-RIPE admin-c: JS123-RIPE tech-c: SB436-RIPE admin-c: SB436-RIPE LIR-MNT person: Sue Baker nic-hdl: SB436-RIPE address: Sesame Street 1 phone: sue@example.org LIR-MNT IP Range tech-c: LA789-RIPE admin-c: LA789-RIPE IP Range tech-c: LA789-RIPE admin-c: LA789-RIPE IP Range tech-c: LA789-RIPE admin-c: LA789-RIPE IP Range tech-c: LA789-RIPE admin-c: LA789-RIPE IP Range tech-c: LA789-RIPE admin-c: LA789-RIPE!31

32 Questions

33 How Does It Work? Looking for data in the Database

34 Search For Your Allocations 1. Read s 2 and 3 - from the Registration Services department 2. Open a browser and go to: Search for the inetnum and inet6num objects - Open two tabs or windows if needed! - Use the text in the inetnum: and inet6num: lines - i.e. 10.XX XX i.e. 2002:ffXX::/32!34

35 What Do You See? Look at the first object in the results What do you see? How many objects did you get?!35

36 Network Objects (1) IPv4 = inetnum IPv6 = inet6num inetnum: inet6num: 2001:db8::/32 netname: NL-NETWORK netname: NL-NETWORK country: NL country: NL org: ORG-EE2-RIPE org: ORG-EE2-RIPE admin-c: DV789-RIPE admin-c: DV789-RIPE tech-c: JS123-RIPE tech-c: JS123-RIPE status: ALLOCATED PA status: ALLOCATED-BY-RIR RIPE-NCC-HM-MNT RIPE-NCC-HM-MNT DEFAULT-LIR-MNT DEFAULT-LIR-MNT source: RIPE source: RIPE!36

37 Network Objects (2) Same object structure for IPv4 and IPv6 Network Contact information Type of address space Protection of object inetnum: inet6num: netname: country: org: admin-c: tech-c: status: source: IPv4 RANGE IPv6 PREFIX NETWORK-NAME ZZ ORG-ZZ123-RIPE AD321-RIPE TE123-RIPE ALLOC-ASSIGN RIPE-NCC-HM-MNT DEFAULT-LIR-MNT RIPE!37

38 Hierarchical Distribution IANA RIR LIR End User Allocation PA Assignment PI Assignment!38

39 Object Status Hierarchy IPv4 RIR LIR ALLOCATED UNSPECIFIED ALLOCATED PA End User ASSIGNED PA SUB-ALLOCATED PA ASSIGNED PA ASSIGNED PI IPv6 RIR ALLOCATED-BY-RIR LIR ALLOCATED-BY-RIR End User ASSIGNED AGGREGATED-BY-LIR ALLOCATED-BY-LIR ASSIGNED AGGREGATED-BY-LIR ASSIGNED PI!39

40 Default Query Results When you query for an IP address Least Specific Most Specific!40

41 Default Query Results When you query for simple text PERSON something ORGANISATION PERSON ROLE ROLE PERSON INET6NUM INETNUM!41

42 Making Better Queries Reduce the amount of objects returned Use options and flags to optimise the results Avoid getting blocked!!42

43 Results With Related Objects Search term: role: RIPE NCC Operations inetnum: tech-c: OPS4-RIPE admin-c: BRD-RIPE admin-c: admin-c: tech-c: tech-c: tech-c: tech-c: nic-hdl: JDR-RIPE person: Brian Riddle BRD-RIPE address: Stationsplein 11 GL7321-RIPE address: MENN1-RIPE RCO-RIPE CNAG-RIPE OPS4-RIPE 1012 AB Amsterdam phone: nic-hdl: BRD-RIPE route: /21 origin: AS2121!43

44 Results Without Related Objects Search term: -r inetnum: tech-c: OPS4-RIPE route: /21 admin-c: BRD-RIPE origin: AS2121!44

45 Selecting Object Types Choose the types of objects you want to see This results in fewer objects to process Using a flag: -T inetnum!45

46 Search For Your Allocations Again 1. In the previous query windows, turn on Do not retrieve related objects - or add the -r flag to the search term - i.e. -r 10.XX XX i.e. -r 2002:ffXX::/32 2. Search again for the inetnum and inet6num objects!46

47 What Do You See? Look at all the objects in the results How many objects did you get now? Which objects are not in the results?!47

48 Navigating the Hierarchy Using flags, you can find what is under or above an inet(6)num object - Under = More Specific - Above = Less Specific The flags: -m, -M, -l, -L Also in the Hierarchy Flags tab!48

49 More Specific inetnums: -m -m / /21 /24 /26 /25!49

50 More Specific inetnums: -M -M / /21 /24 /26 /25 /26!50

51 Less Specific inetnums: -l -l / / /24!51

52 Less Specific inetnums: -L -L /24 0/0 193/ / /24!52

53 Search For Your Allocations Again 1. In the previous query windows, add -m to the search text - i.e. -m 10.XX XX i.e. -m 2002:ffXX::/32 2. Search again for the inetnum and inet6num objects!53

54 What Do You See? Look at the objects in the results How many objects did you get now? Different from what you got before? - Notice the status: attribute!54

55 What You Are Seeing IPv4 LIR ALLOCATED PA /22 End User ASSIGNED PA /26 IPv6 LIR End User ASSIGNED ALLOCATED-BY-RIR /40 /32!55

56 Questions

57 How To Update It? Updating the RIPE Database Part 1

58 Updating: What You Need To update the RIPE Database you must have: - a RIPE NCC Access account - a maintainer object - the need to create, update or delete an object!!58

59 Search for LIR Maintainer Object 1. Read the 5 - from your colleague Jean Blue 2. Open a browser and go to: Search for the maintainer object - i.e. SMXX-MNT!59

60 What Do You See? Look at the attribute What is the value? Look at the auth: attribute What is the value?!60

61 Maintainers: Protecting Objects person: John Smith address: My Street 9876 address: Office phone: nic-hdl: JS123-RIPE LIR-MNT mntner: admin-c: notify: upd-to: auth: auth: auth: LIR-MNT JS123-RIPE MD5-PW $1$crypto-stuff SSO PGP-KEY-<key ID> LIR-MNT!61

62 Maintainers: Authentication SSO - default authentication mechanism - uses RIPE NCC Access account - to authenticate: login on RIPE NCC website PGP - uses PGP key pair - to authenticate: sign updates with private PGP key MD5-PW - uses a MD5 hashed password - to authenticate: provide clear text password!62

63 Maintainers: Associating an Account Your LIR maintainer has a MD5 password You want to add your Access as an auth: line mntner: admin-c: tech-c: upd-to: auth: auth: SMXX-MNT JBXX-TEST JBXX-TEST j.blue@example.com SMXX-MNT MD5-PW $1$crypto-stuff SSO @domain.com Your Access account is now associated!!63

64 Maintainers: Associating an Account You can easily associate your Access account - if the maintainer is using MD5-PW authentication 1.Try to update the maintainer object - Log in to your Access account! 2.You will be asked to provide the password 3.Authorise your RIPE NCC Access account for this maintainer!64

65 Multiple Maintainers mntner: ONE-MNT admin-c: LA789-RIPE tech-c: LA789-RIPE ONE-MNT person: John Smith auth: auth: SSO PGPKEY-AE6FBTI7 nic-hdl: address: JS123-RIPE Sesame Street 1 phone: john@example.org mntner: admin-c: TWO-MNT XY456-RIPE ONE-MNT TWO-MNT tech-c: XY455-RIPE TWO-MNT auth: MD5-PW $76$ytE7!65

66 Default Maintainer for LIRs Allows partial control over Allocation and ORG Can be selected in the LIR Account Details Automatically reflected in the RIPE Database IP Address Allocation RIPE-NCC-HM-MNT mntner: DEFAULT-LIR-MNT DEFAULT-LIR-MNT auth: auth: MD5-PW $1$abC789#1 SSO DEFAULT-LIR-MNT LIR Organisation RIPE-NCC-HM-MNT DEFAULT-LIR-MNT!66

67 Personal vs Shared LIR objects, shared maintainer IP Address Allocation RIPE-NCC-HM-MNT mntner: DEFAULT-LIR-MNT DEFAULT-LIR-MNT auth: auth: auth: MD5-PW $1$abC789#1 SSO SSO LIR Organisation RIPE-NCC-HM-MNT DEFAULT-LIR-MNT Your person, your maintainer mntner: PERSONAL-MNT Person auth: SSO PERSONAL-MNT!67

68 Maintainer and Person person: John Smith nic-hdl: JS123-RIPE address: Sesame Street 1 phone: john@example.org RED-MNT mntner: admin-c: descr: upd-to: auth: RED-MNT JS123-RIPE Startup maintainer RED-MNT john@example.org SSO john@example.org!68

69 Creating Your Person/Mntner Pair 1. Read again the 5 - from your colleague Jean Blue 2. Open a browser and go to: On the left side, click on Create an object 4. Choose person and maintainer pair 5. Click on [Create]!69

70 What Do You See? Which attributes do you see in the empty template? Which lines are not easy to understand? Fill in the template and click on [Submit] Write down the nic-hdl and the mntner!70

71 What You Are Seeing Congratulations! You just created your first objects in the RIPE (TEST) Database! You now have your own person object and your own personal maintainer +!71

72 Creating a Role Object (1) It s a good habit to use a role for the admin-c and tech-c attributes of LIR objects 1.Open a browser and go to: On the left side, click on Create an object 3.Choose role and click on [Create]!72

73 Creating a Role Object (2) 3.Choose which maintainer will protect the new object 4.Click on the X to remove a maintainer Please enter the maintainers you would like to use as mnt-by LIR-MNT x PERSONAL-MNT x = Associated with your Access account!73

74 Creating a Role Object (3) 5.Fill in the template with data - Use your LIR maintainer (SMXX-MNT) - Use role: Tech Team - Leave nic-hdl as it is: AUTO-1 6.Click on the [ + ] button next to - Choose admin-c from the drop-down list - Click on [ Add ] - You now have an empty admin-c attribute 7.Do the same steps in 6) and add a tech-c!74

75 Creating a Role Object (4) 8.Fill in the admin-c and tech-c with data - admin-c: JBXX-TEST - tech-c: YOUR PERSON OBJECT 9.Click on the [Submit] button If all was correctly filled in, you have a role object! Write down the nic-hdl of the object!75

76 What You Just Did person: Jean Blue nic-hdl: JBXX-TEST address: Long Street 123 phone: SMXX-MNT role: Tech Team nic-hdl: TT321-TEST admin-c: JBXX-TEST tech-c: YOUR NIC-HDL SMXX-MNT person: Your Name nic-hdl: YOUR NIC-HDL address: Your Address phone: Your phone number Your address YOUR-PERSONAL-MNT!76

77 Questions

78 How To Update It? Updating the RIPE Database Part 2

79 Registering IPv4 and IPv6 1. Let s go back to the 5 - from your colleague Jean Blue 2. Open a browser and go to: On the left side, click on Create an object 4. Choose inetnum or inet6num 5. Click on [Create]!79

80 What Do You See? Which attributes do you see in the template? Notice the first line () How many maintainers appear here? Which lines are not easy to understand?!80

81 Registering Assignments (1) 10.XX :ffXX::/32 TEST-NCC-HM-MNT TEST-NCC-HM-MNT SMXX-MNT SMXX-MNT status: ALLOCATED PA status: ALLOCATED-BY-RIR 10.XX XX :ffXX:1001::/48 SMXX-MNT SMXX-MNT status: ASSIGNED PA status: ASSIGNED!81

82 Registering Assignments (2) To create an assignment, you must have authorisation from the allocation Here, has control over the allocation object and the space under the object IP Address Allocation RIPE-NCC-HM-MNT DEFAULT-LIR-MNT ASSIGNMENT ASSIGNMENT ASSIGNMENT DEFAULT-LIR-MNT DEFAULT-LIR-MNT DEFAULT-LIR-MNT status: ASSIGNMENT status: ASSIGNMENT status: ASSIGNMENT!82

83 Registering Assignments (3) If mnt-lower: is present, then it has permission to create objects in the space under the object - but it cannot update the allocation! () IP Address Allocation mnt-lower: RIPE-NCC-HM-MNT DEFAULT-LIR-MNT ANOTHER-MNT ASSIGNMENT ASSIGNMENT ASSIGNMENT ANOTHER-MNT ANOTHER-MNT ANOTHER-MNT status: ASSIGNMENT status: ASSIGNMENT status: ASSIGNMENT!83

84 Filling In The Template (1) Choose which maintainer will protect the new object Click on the X to remove a maintainer Please enter the maintainers you would like to use as mnt-by LIR-MNT x PERSONAL-MNT x = Associated with your Access account!84

85 Filling In The Template (2) Same object structure for IPv4 and IPv6 Address space and Network name Country and Contact information Type of address space inetnum: inet6num: netname: country: admin-c: tech-c: status: IPv4 RANGE IPv6 PREFIX NETWORK-NAME ZZ AD321-RIPE TE123-RIPE ASSIGNMENT source: DEFAULT-LIR-MNT RIPE!85

86 Object Creation Success If the values in the object template are correct, then the RIPE Database will create the object inetnum: inet6num: 2002:ff30:1001::/48 netname: LAIKA-NET-01 netname: LAIKA-NET-01 country: ZZ country: ZZ admin-c: MB54321-TEST admin-c: MB54321-TEST tech-c: ROLE-NIC-HDL tech-c: ROLE-NIC-HDL status: ASSIGNED PA SMXX-MNT status: ASSIGNED SMXX-MNT!86

87 Deleting Objects (1) 1. Let s go back to the 5 - from your colleague Jean Blue 2. Open a browser and go to: Search for all the assignments: - i.e. -m 10.XX XX i.e. -m 2002:ffXX::/32!87

88 Deleting Objects (2) 4. You should see Jean Blue s assignments and your newly registered assignments 5. Look for the wrong objects in the results 6. Click on [Update object] 7. Click on the [Delete this object] button 8. Provide a reason and click on [Confirm delete] Assignment SMXX-MNT!88

89 LIR Keeps Control LIR Default Maintainer has control over the whole address space Use Force Delete to remove lost objects Allocation RIPE-NCC-HM-MNT DEFAULT-LIR-MNT Assignment Assignment ANOTHER-MNT SOME-OTHER-MNT!89

90 When You Cannot Delete If an object is referenced in another object, you must first remove the reference This object cannot be deleted You can only delete unreferenced objects. Please remove the references from these objects first: mntner - SM30-MNT inetnum inet6num :ff30::/32 organisation - ORG-IC30-TEST aut-num - AS65530 Return to object!90

91 Summary You have now updated the RIPE Database: - Associated your Access with the LIR maintainer - Created your own person/maintainer pair - Created a role object for the LIR - Registered assignments by creating inet(6)num objects - Deleted the wrong inet(6)num objects!91

92 Questions

93 Delegating To Others Giving control to someone else

94 Register a IPv6 Sub-Allocation (1) 1. Open a browser and go to: On the left side, click on Create an object 3. Choose inet6num and click on [Create]!94

95 Register a IPv6 Sub-Allocation (2) 4. Fill in the template: - inet6num: 2002:ffXX:a000::/36 - netname: SUBALLOCATION - country: your neighbor s country - Use your person object as admin-c: - Use your neighbor s person object as tech-c:!95

96 Register a IPv6 Sub-Allocation (3) 5. Add a mnt-lower: attribute - Use your neighbor s maintainer as value 6. Choose the status ALLOCATED-BY-LIR 7. Click on [Submit]!96

97 Sub-Allocations Block for a downstream customer Branch office or department Large ISP Head Office Downstream ISP Customers Branch Office 1 Branch Office 2!97

98 Delegating Control mnt-lower: attribute gives permission to create more specific objects Allocation RIPE-NCC-HM-MNT DEFAULT-LIR-MNT Sub-Allocation mnt-lower: DEFAULT-LIR-MNT BRANCH-MNT Assignment BRANCH-MNT!98

99 Registering Sub-Allocations Use the appropriate status: - IPv4 = SUB-ALLOCATED PA - IPv6 = ALLOCATED-BY-LIR inetnum: inet6num: 2002:ff30:a000::/36 netname: country: admin-c: tech-c: status: mnt-lower: Branch-office-1 NL LA789-RIPE LA789-RIPE SUB-ALLOCATED PA LIR-MNT BRANCH-MNT netname: country: admin-c: tech-c: status: mnt-lower: Branch-office-1 NL LA789-RIPE LA789-RIPE ALLOCATED-BY-LIR LIR-MNT BRANCH-MNT!99

100 Create an Assignment 1. Open a browser and go to: On the left side, click on Create an object 3. Choose inet6num and click on [Create] 4. Fill in the template: - inet6num: 2002:ffzz:a000::/48 - zz = number of your neighbor - status: ASSIGNED 5. You know how to do the rest! ;-)!100

101 What You Just Did Allocation: 2002:ff30::/32 TEST-NCC-HM-MNT SM30-MNT Sub-Allocation: 2002:ff30:a000::/36 mnt-lower: SM30-MNT SM15-MNT Assignment: 2002:ff30:a000::/48 SM15-MNT!101

102 Questions

103 RIPE Routing Registry aut-num, route and route6 objects

104 Search For Your aut-num Object 1. Read the Open a browser and go to: Search for AS655XX!104

105 What Do You See? What does this object represent? Which attributes call your attention?!105

106 Autnomous Number Objects Known as aut-num objects Register who holds an AS Number and the routing policy for that AS aut-num: as-name: org: import: export: import: export: admin-c: tech-c: status: mnt-routes: source: AS12345 YOUR-AS-NAME ORG-EE2-RIPE from AS1010 accept ANY to AS1010 announce AS12345 from AS987 accept ANY to AS987 announce AS12345 DV789-RIPE JS123-RIPE ASSIGNED RIPE-NCC-END-MNT DEFAULT-LIR-MNT DEFAULT-LIR-MNT RIPE!106

107 Routing Policy INTERNET TRANSIT AS2 PEER AS4 CUSTOMER AS1 AS3 YOU aut-num: AS1 import: from AS2 accept ANY export: to AS2 announce AS1 AS3 import: from AS3 accept AS3 export: to AS3 announce ANY import: from AS4 accept AS4 export: to AS4 announce AS1 AS3!107

108 Building An aut-num Object INTERNET AS2 AS1 AS3 aut-num: AS2 import: from AS1 accept AS1 export: to AS1 announce AS2 aut-num: AS1 export: to AS2 announce AS1 import: from AS2 accept AS2 import: from AS3 accept ANY export: to AS3 announce AS1 aut-num: AS3 export: to AS1 announce ANY import: from AS1 accept AS1!108

109 Search For route(6) Objects 1. Read the Open a browser and go to: Search for the route(6) objects - Use the -T flag to show the route(6) objects - i.e. -T route 10.xx.0.0/22 - i.e. -T route6 2002:ffxx::/32!109

110 What Do You See? Did you get any objects in the results? No? Then there are no route(6) objects yet!!110

111 What Are route(6) Objects? route(6) objects register which IPv4/IPv6 prefix will be announced by which AS number Used for creating BGP filters RIPE Database Router configuration BGP Filters route: origin: IPv4 prefix AS Number From AS Number accept: IPv4 prefix IPv6 prefix route6: IPv6 prefix origin: AS Number!111

112 How To Create route(6) Objects You need permission from: 1. aut-num 2. inetnum or inet6num 3. route or route6 ALLOCATION aut-num: AS RIPE-NCC-HM-MNT DEFAULT-LIR-MNT mnt-routes: ONE-MNT TWO-MNT 1 mnt-routes: ANOTHER-MNT mnt-routes: ANOTHER-MNT route(6) origin: AS12345 ANOTHER-MNT 3!112

113 Registering IPv4 Routes inetnum: /22 aut-num: AS65530 TEST-NCC-HM-MNT as-name: BLUELIGHT30 SM30-MNT SM30-MNT route: /22 origin: AS65530 SM30-MNT!113

114 Registering IPv6 Routes inet6num: 2002:ff30::/32 aut-num: AS65530 TEST-NCC-HM-MNT as-name: BLUELIGHT30 SM30-MNT SM30-MNT route6: 2002:ff30::/32 origin: AS65530 SM30-MNT!114

115 Create route(6) Objects 1. Open a browser and go to: On the left side, click on Create an object 3. Choose route or route6 and click on [Create] 4. Fill in the template: - route: 10.XX.0.0/22 - route6: 2002:ffXX::/32 - origin: AS655XX!115

116 Questions

117 Reverse DNS Setting up reverse delegation

118 Looking For Domain Objects 1. Read the Open a browser and go to: Search for your IPv4 allocation 4. Use the flags -r -m -d in the query - -d flag includes domain objects in results - i.e. -r -m -d 10.XX.0.0/22 5. You can try this with your own real allocation!!118

119 What Do You See? Do you see any domain objects in the results? No? Then Reverse Delegation is not set up yet!!119

120 DNS Tree Structure At the top is the root (.) Then the cctlds and gtlds Each domain/sub-domain is stored in a DNS zone!120

121 What is Reverse DNS? Mapping of IP addresses to host names :67c:2e8:22::c100:68b

122 Purpose of Reverse DNS Reverse DNS is used for: - Identifying Spam - Network Diagnostics - Controlling Access to a Network DNS Server You shall not pass! From: example.com Re e s r ve w Mail Server X IP Address D 1 S N o b. ww? g ne. s u t Your Mail Server!122

123 How does Reverse DNS Work? in-addr.arpa? ask.in-addr.arpa DNS in-addr.arpa? <<. >> (root).in-addr.arpa ask.193 DNS in-addr.arpa? RIPE NCC.193 zone ask DNS Which host is pointing to ? etc in-addr.arpa? CLIENT in-addr.arpa? RECURSIVE RESOLVER Name Servers

124 Reverse Delegation Basics IPv4 - in-addr.arpa zone - /24 or /16 blocks only IPv6 - ip6.arpa zone - Blocks multiple of 4 bits (/28, /32, /36, /40, /44, /48)!124

125 Setting up Reverse Delegation Configure your DNS servers - at least two name servers in different subnets - create a zone file on each for each chunk Check your zones:

126 Domain Objects Create records on RIPE NCC DNS servers They point to name servers that will be authoritative for the zone domain RIPE NCC Name Servers For this zone, go to these DNS servers: nserver1 nserver2 nserver1 nserver2!126

127 Reverse DNS for IPv / in-addr.arpa / in-addr.arpa /8 192.in-addr.arpa!127

128 IPv4 and Domain Objects IPv4 prefix: /24 Domain object: domain: descr: admin-c: tech-c: zone-c: nserver: nserver: ds-rdata: created: last-modified: source: in-addr.arpa rdns for my IPv4 network NOC12-RIPE NOC12-RIPE NOC12-RIPE pri.example.net sns.company.org d9acbf3d3fec11b6d6 EXAMPLE-LIR MNT T13:52:29Z T15:09:46Z RIPE!128

129 Reverse DNS for IPv6 2001:0db8:003e:ef11:0000:0000:c100:004d /48 /44 /40 /36 e b.d ip6.arpa b.d ip6.arpa b.d ip6.arpa 0.8.b.d ip6.arpa /28 /32 8.b.d ip6.arpa b.d ip6.arpa!129

130 IPv6 and Domain Objects IPv6 prefix: 2001:db8::/32 Domain object: domain: descr: admin-c: tech-c: zone-c: nserver: nserver: ds-rdata: created: last-modified: source: 8.b.d ip6.arpa rdns for my IPv6 network NOC12-RIPE NOC12-RIPE NOC12-RIPE pri.example.net sns.company.org d9acbf3d3fec11b6d6 EXAMPLE-LIR MNT T13:52:29Z T15:09:46Z RIPE!130

131 Create Domain Objects Wizard domain: in-addr.arpa domain: in-addr.arpa EXAMPLE-MNT domain: nserver: tinny.arin.net nserver: EXAMPLE-MNT sec3.apnic.net domain: nserver: tinny.arin.net nserver: EXAMPLE-MNT sec3.apnic.net nserver: tinny.arin.net nserver: EXAMPLE-MNT sec3.apnic.net nserver: tinnie.arin.net in-addr.arpa in-addr.arpa nserver: sec3.apnic.net!131

132 Exercise How many domain objects?

133 Calculate How Many Objects You have the following address space: /22-2a00:38::/29 How many domain objects do you have to create? - Use the largest block size possible What are the first and last domain objects for each?!133

134 And For The Customer? What are the two domain objects for Marc Bromski s address space? - IPv4: 10.xx xx IPv6: 2002:ffxx:1001::/48!134

135 Questions

136 More RIPE Database Inverse Lookups, Free Text Search, Notifications, RIPE Database WG

137 Looking For References You want to replace the reference to Jean Blue s person object in all the LIR objects with your new LIR role object 1. Open a browser and go to: Search for -i person JBXX-TEST!137

138 What Do You See? Which objects are in the query results? Where do you see JBXX-TEST?!138

139 Inverse Lookups Finding all objects in which an object is referenced PERSON ALLOCATION ASSIGNMENT Ask Pedro to PRETTIFY ORGANISATION MAINTAINER!139

140 Inverse Lookup: admin-c inet6num: descr: org: admin-c: tech-c: 2001:db8::/32 my IPv6 range RIPE-NCC-HM-MNT ORG-BB2-RIPE JE777-RIPE JD1-RIPE aut-num: descr: org: admin-c: tech-c: AS64551 my AS number RIPE-NCC-HM-MNT ORG-BB2-RIPE JD1-RIPE LA789-RIPE -i admin-c JD1-RIPE mntner: RED1-MNT person: John Davies admin-c: tech-c: role: nic-hdl: admin-c: address: JD1-RIPE LA789-RIPE RED1-MNT Bluelight Staff BLS77-RIPE JD1-RIPE Sesame Street 1 staff@example.org nic-hdl: address: phone: JD1-RIPE Sesame Street john@example.org RED1-MNT!140

141 Inverse Lookup: person person: inet6num: descr: org: admin-c: tech-c: aut-num: descr: org: tech-c: tech-c: John Smith 2001:db8::/32 my IPv6 range RIPE-NCC-HM-MNT ORG-BB2-RIPE JE777-RIPE JD1-RIPE AS64551 my AS number RIPE-NCC-HM-MNT ORG-BB2-RIPE JD1-RIPE LA789-RIPE -i person JD1-RIPE mntner: RED1-MNT person: John Davies admin-c: tech-c: role: nic-hdl: admin-c: address: JD1-RIPE LA789-RIPE RED1-MNT Bluelight Staff BLS77-RIPE JD1-RIPE Sesame Street 1 staff@example.org nic-hdl: address: phone: JD1-RIPE Sesame Street john@example.org RED1-MNT!141

142 Inverse Lookup: organisation person: inet6num: descr: org: admin-c: tech-c: John Smith 2001:db8::/32 My IPv6 range ORG-BB2-RIPE JE777-RIPE JD1-RIPE inetnum: /21 descr: My v4 allocation org: ORG-BB2-RIPE admin-c: JE777-RIPE tech-c: JD1-RIPE inetnum: /21 descr: Other v4 allocation org: ORG-BB2-RIPE admin-c: JE777-RIPE tech-c: JD1-RIPE aut-num: AS64551 descr: my AS number org: ORG-BB2-RIPE admin-c: JE777-RIPE tech-c: JD1-RIPE -i org ORG-BB2-RIPE organisation: ORG-BB2-RIPE admin-c: JD1-RIPE tech-c: LA789-RIPE abuse-c: AR789-RIPE RED1-MNT!142

143 Inverse Lookup : mnt-by inet6num: descr: mnt-lower: admin-c: tech-c: 2001:db8::/36 my IPv6 range RIPE-NCC-HM-MNT RED1-MNT JE777-RIPE JD1-RIPE aut-num: descr: org: tech-c: AS64551 my AS number RIPE-NCC-END-MNT RED1-MNT ORG-BB2-RIPE LA789-RIPE -i mnt-by RED1-MNT person: John Davies mntner: RED1-MNT nic-hdl: JD1-RIPE john@example.org RED1-MNT admin-c: JD1-RIPE RED1-MNT role: nic-hdl: admin-c: Bluelight Staff BLS77-RIPE JD1-RIPE RED1-MNT staff@example.org!143

144 Search For A Word You want to look for every object that has the word uplink in any of the attributes 1. Open a browser and go to: Click on the left menu on Full Text Search 3. Search for uplink!144

145 What Do You See? Do you get any objects in the results? How many objects do you get? Can you see the whole object?!145

146 Full Text Search!146

147 Full Text Search - Advanced!147

148 Think About This The RIPE Database is a public database Anybody can search in the database Who can make updates? How can you know if somebody updates your objects?!148

149 Notifications: notify: The RIPE Database has several ways to trigger notifications about updates notify: attribute - Can be used on any object - An is sent when the object is updated Person IP Address Block LIR Organisation notify: @example.com notify: noc-team@example.com notify: admin@example.com!149

150 Notifications: Maintainers Maintainers have special attributes mntner: upd-to: mnt-nfy: LIR-MNT upd-to: - For failed attempts to update objects mnt-nfy: - For succesful attempts to update objects!150

151 RIPE Database Working Group Influence the development of the RIPE Database software and operations Participate in the Database WG discussions! DB!151

152 More RIPE Database Resources The RIPE Database page on ripe.net - Other RIPE Database query methods - querying-the-ripe-database RIPE Database REST API -

153 Questions

154 Play Time! Practice What You Learned

155 Choose Your Own Adventure From the Play Time! list of tasks, choose the ones you would like to practice Review the course slides and your own notes Ask the trainers or other participants to assist, if you need help!155

156 Feedback!

157 RIPE NCC Academy Graduate to the next level!

158 Follow

159 Title Text Lõpp Fine The End! Einde Соңы Kрай Fí Liðugt Ende Finvezh Konec Kraj Ënn Fund Beigas הסוף Vége Son An Críoch Y Diwedd Finis Kiнець Kpaj Endir Sfârşit Fin Τέλος Конeц Slut Slutt Pabaiga Fim Amaia Loppu Tmiem Koniec!159

160 !160 Fin Ende Kpaj Konec Son Fine Pabaiga Einde Fim Finis Koniec Lõpp Kрай Sfârşit Конeц Kraj Vége Kiнець Slutt Loppu Τέλος Y Diwedd Amaia Tmiem Соңы Endir Slut Liðugt An Críoch Fund ףוסה Fí Ënn Finvezh The End! Beigas Канeц English Catalan Welsh Latin Ukrainian Armenian Kazakh Breton Portuguese Georgian Basque Maltese Norwegian Swedish, Danish French Greek Irish Hungarian Hebrew Arabic Persian Romanian Italian Dutch Russian Turkish German Finnish Estonian Polish, Slovak Lithuanian Latvian Croatian Serbian Czech Icelandic Bulgarian Belorussian Faroese Letzeburgisch(LUX) Albanian (An-Nahaya) (Kraj) (Payan) (Kinec)) (Dasasruli)) (Kanec)) (Telos)) (Ha-sof)) (Verj) (Kraj) (Konec))

161 Additional Info More ways to query

162 RIPE Database API Annex 1

163 RIPE Database RESTful API Allows REST-compliant systems to access the RIPE Database Data is returned in XML or JSON format Standard query limits apply Database Data Query CLIENT RESTful API RIPE Database Engine!163

164 WHOIS REST API Lookup Returns an object from the RIPE Database Method: GET URI Format: /{source}/{objecttype}/{key} - {source}: which database (RIPE / TEST) - {objecttype}: the type of object queried - {key}: Primary key of the object e.g.: /ripe/route/ /21as3333.json!164

165 WHOIS REST API Search To do a search in the RIPE Database Method: GET Format: /search?source={source}&querystring={query-string}... - {source}: which database (RIPE / TEST) - {query-string}: the search term!165

166 Example Output!166

167 Use Cases Create your own query interface Use scripting to parse the query results Automate your searches More info:

168 RIPE Database NTRM Annex 2

169 Near Real Time Mirroring (NTRM) Allows an authorised client to receive a stream of data from the RIPE Database In near real time Does not include any personal or private data Data stream RIPE Database NTRM Mirror!169

170 To Sign Up For NTRM You must be a member of the RIPE NCC Inform why you need the data Which IP address will receive the data stream - Only one IP address Inform if the data will be made available to third parties!170

171 Two Ways to Set Up a Mirror Using GRS import - The mirror database is updated once per day Using Bootstrap and NTRM - The mirror database is updated in near real time Requirements - A server with 16GB RAM, 8 GB swap, and 160GB disk space is recommended!171

172 Excluded Data Personal data (person and role objects) Organisation details (organisation object) Security data (mntner object) References to personal data (NIC Handles)!172

173 RIPE Database Snapshots Annex 3

174 Download a Snapshot Full database: - ftp://ftp.ripe.net/ripe/dbase/ripe.db.gz Split by object types - ftp://ftp.ripe.net/ripe/dbase/split They exclude the Private object types: - Person, Role, Organisation and Mntner.!174

175 Questions