Transcom.uk catch issue / question on the new system

[Transcom ISP]

So, we found that within the list there are some names that have precisely the same drop time..

Onto nominet -

1. You can have 10 x IP's per TAG and therefore 10 x concurrent sessions,
(with 6 x EPP sockets per session IP)

2. As per policy, and as a company / individual you can only have one main TAG , but you can have many sub TAG's under the same company / account, but they share resources.

3. When we asked about those that 'alegedly' have multiple TAG's under different names as per the old DAC process, they sent me the policy abuse link.

4. When we said that the exploit with multiple TAG's hasnt chaned, because a multi tagger can now have 10 x EPP sessions x TAG's , they sent me the link again..

So in reality, its no diff from before.. chat window exited..

Any comments on this ?

 

[diablo]

The issue has always been about the enforcement of rules by Nominet. Changing the system makes no difference if policy abuses go unpunished.

 

[Transcom ISP]

agreed, and certainly seems to be the case again, both logical and the fact that Nominet wouldnt answer directly but just kept sending the policy links..

If the reason for the change was to rid of those that exploited the DAC system, it certainly is not the case, and makes you wonder how such a simple evaluation of the obvious exploits would go un noticed, its not rocket science..

 

[super-whois]

1. You can have 10 x IP's per TAG and therefore 10 x concurrent sessions,
(with 6 x EPP sockets per session IP)

That's not what the acceptable use policy says:

Simultaneous connections

Each tag is limited to six simultaneous connections to the EPP service. The IP addresses used by each tag must be set in advance through our online service. If more than six connections are opened, then the oldest connection will be forcibly closed.

Where is this link from Nominet that says otherwise?

 

[webber]

1. You can have 10 x IP's per TAG and therefore 10 x concurrent sessions,
(with 6 x EPP sockets per session IP)

You can only have 6 concurrent epp connections per tag.
You can apply for as many tags as you want as long as you can justify the need to Nominet

2. As per policy, and as a company / individual you can only have one main TAG , but you can have many sub TAG's under the same company / account, but they share resources.

There is no "main tag" or "sub tag", each tag is a subordinate of the account and does not have different priority or importance. Resources are shared at account level.

3. When we asked about those that 'alegedly' have multiple TAG's under different names as per the old DAC process, they sent me the policy abuse link.

Registrar accounts that are found to be connected as defined in the AUP, are linked in terms of limits/quotas.
Whether this policy is properly applied or not is another issue, but arguably this is no longer a meaningful advantage when it comes to dropcatching.

4. When we said that the exploit with multiple TAG's hasnt chaned, because a multi tagger can now have 10 x EPP sessions x TAG's , they sent me the link again..

It is perfectly legitimate to have multiple tags under one account. For example I have three tags, some have more. Some are perfectly happy and successful with just one. As mentioned before each tag grants you 6 concurrent epp connections but the AUP limits are shared between all tags.

 

[super-whois]

Where is this link from Nominet that says otherwise?

I've just double checked, and I can confirm, that sessions from multiple IP addresses are limited to 6. However, I wouldn't be surprised if there was a way to trick Nominet around this!

 

[Transcom ISP]

Nominet explicity said on chat with Sharon today (I have a copy), that 10 system sessions are allowed as they allocate 10 IP address's for EPP accounts. so you can, apparently, have 10 servers on one TAG, all sharing the same resources, whatever they may be (1000 EPP writes in 24hrs ?)

Under each IP account, you can have 6 concurrent sockets open, weve been using this with the old DAC method since the DAC came out.. Also, from experience, and on the notes given when we made our software eons ago, if you open 7 EPP scokets, the first one you opened closes down, check on any linux box with ss.

The issue with multiple tags on the same TAG is not the concern, we all know you can have as many as you like under one account, which of course share resources (wouldnt it be nice if they didnt.) between them.

The remaining 'thoughts' are that those that allegedly had / have multipe TAGS' under DIFFERENT company names, have the same advantage they had with the DAC, ie, TAG's x EPP servers(10) x Sockets(6) x Writes(1000)

This, as always of course, maybe as clear as mud when asking Nominet...

 

[Transcom ISP]

That's not what the acceptable use policy says:
Where is this link from Nominet that says otherwise?

Open sockets and logged in EPP (IP) sessions are not the same..thing.

You can open 6 EPP sockets on each IP on EACH single EPP login (session)

The multiple IP question came up because if you look as the daily list, many drops are at exactly the same time to the second.

So, Nominet said just open another EPP session on one of the available 10 IP's, where, of course, you can open max 6 sockets..

It would be odd if on nominets advice, you had 10 servers one on each of the 10 IP's, but can only have 6 sockets across tham all ?

nah..... its 6 socokets per EPP login per IP, just tested it, and, if you open 7 sockets (on one IP), the first one closes

 

[webber]

its 6 socokets per EPP login per IP

It should be 6 epp sessions per tag. The ip list is just a whitelist – IPs from which you are allowed to connect.
I haven't tested whether a different ip gets another 6 connections, but if it's the case then I would consider it a bug (there used to be a similar bug with the DAC) and that's not how I interpret the documentation:

Simultaneous connections

Each tag is limited to six simultaneous connections to the EPP service. The IP addresses used by each tag must be set in advance through our online service. If more than six connections are opened, then the oldest connection will be forcibly closed.​

Cip clear your inbox would ya

Sorry, sorted

 

[webber]

I wish...

 

[Systreg]

Have I got this right, if someone has 5 legitimate tags, they can connect each tag to a drop catching script, but instead of having the 1,000 create commands that they would have on a single tag, those 1,000 create commands are shared between their 5 tags at 200 per tag?

If that's the case, and that's how it appears to me, then anyone with multiple tags clearly has an advantage over someone with only 1 tag.

 

[lazarus]

Have I got this right, if someone has 5 legitimate tags, they can connect each tag to a drop catching script, but instead of having the 1,000 create commands that they would have on a single tag, those 1,000 create commands are shared between their 5 tags at 200 per tag?

If that's the case, and that's how it appears to me, then anyone with multiple tags clearly has an advantage over someone with only 1 tag.

You can still only ever have a maximum of 6 live connections with a maximum of 1000 creates / 24Hrs shared between all of your TAGS.
Not sure where the advantage would be by using multiple TAGs. The quota is the same.

 

[Transcom ISP]

your spot on from my understanding... this is exactly what I asked Nominet, they just referred me to policy...
You can have unlimited tags on your account but they share the resources.

and, as you point out, those with phantom tags, obviously have a distinct advantage as the resource isnt shared in this case.

same as the DAC scenario, and pointed out by hundreds... Nominet just refer your to policy but seemingly take no action.

This is when they also said that you can run 10 servers on 10 IP's (each tog gets this), each one can logon once to EPP, and open 6 sockets each, you DONT need a seperate session to open multiple sockets, but dont open more than 6.

Remember to refresh the socket every 59 minutes, and if you use 6 sockets, you need to refresh eah one !

 

[Systreg]

On a different subject, anyway of getting the old who-is back, I don't like the new lookup and I miss the availability checker?

Agree, the new whois is clunky, it looked much better how it used to be, and more user friendly with being able to check the availability of other extensions.

 

[webber]

I agree – Nominet's Lookup tool (a custom rdap client) is not clean enough, lacks a simple structure and is difficult to scan through at a glance. It's even worse on mobile.

I've set up rdap.uk a while ago with that exact purpose in mind – to be easy to read through, highlight unusual statuses or dates, and dig deeper if needed. It's far from perfect and I have further plans to improve it.

I'm also working on a public whois as well

 

[lazarus]

So, I have my own TAG, I give money to 5 friends around the country, they setup their own TAG`s but for me and I use them.
I now have multiple TAG`s and an advantage.

(I don't by the way)

As far as I can see that's the problem and always has been or am I wrong?

The only way I can see to totally irradicate it would be to offer a dedicated catching TAG.
The Catching TAG would have a 100k create quota and a maximum of 100 connections with everything dropping at 14:00.

Logistically the Catching TAG would operate on a separate "Catching EPP" similar to what the ROR had.
The Catching TAG connections could also be made to only accept create commands between 13:59 - 14:01

Then there would be absolutely no point in having multiple TAGs. Job Done

 

[Transcom ISP]

agreed, Im still using the old whois for parsing expiry dates, works fine