dnssec-signzone.html revision 89da2a56413ba6294315bdde04f7547b9d71b062
75f5c2db254c0167a0e396254460de09b775d203trawick - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
75f5c2db254c0167a0e396254460de09b775d203trawick - Copyright (C) 2001-2003 Internet Software Consortium.
75f5c2db254c0167a0e396254460de09b775d203trawick - Permission to use, copy, modify, and distribute this software for any
75f5c2db254c0167a0e396254460de09b775d203trawick - purpose with or without fee is hereby granted, provided that the above
75f5c2db254c0167a0e396254460de09b775d203trawick - copyright notice and this permission notice appear in all copies.
75f5c2db254c0167a0e396254460de09b775d203trawick - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
75f5c2db254c0167a0e396254460de09b775d203trawick - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
75f5c2db254c0167a0e396254460de09b775d203trawick - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
75f5c2db254c0167a0e396254460de09b775d203trawick - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
75f5c2db254c0167a0e396254460de09b775d203trawick - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
75f5c2db254c0167a0e396254460de09b775d203trawick - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
75f5c2db254c0167a0e396254460de09b775d203trawick - PERFORMANCE OF THIS SOFTWARE.
75f5c2db254c0167a0e396254460de09b775d203trawick<!-- $Id: dnssec-signzone.html,v 1.16 2005/04/03 03:31:32 marka Exp $ -->
75f5c2db254c0167a0e396254460de09b775d203trawick<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
75f5c2db254c0167a0e396254460de09b775d203trawick>dnssec-signzone</TITLE
75f5c2db254c0167a0e396254460de09b775d203trawickNAME="GENERATOR"
75f5c2db254c0167a0e396254460de09b775d203trawickCONTENT="Modular DocBook HTML Stylesheet Version 1.79"></HEAD
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REFENTRY"
75f5c2db254c0167a0e396254460de09b775d203trawickBGCOLOR="#FFFFFF"
75f5c2db254c0167a0e396254460de09b775d203trawickTEXT="#000000"
75f5c2db254c0167a0e396254460de09b775d203trawickLINK="#0000FF"
75f5c2db254c0167a0e396254460de09b775d203trawickVLINK="#840084"
75f5c2db254c0167a0e396254460de09b775d203trawickALINK="#0000FF"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="APPLICATION"
75f5c2db254c0167a0e396254460de09b775d203trawick>dnssec-signzone</SPAN
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REFNAMEDIV"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="APPLICATION"
75f5c2db254c0167a0e396254460de09b775d203trawick>dnssec-signzone</SPAN
75f5c2db254c0167a0e396254460de09b775d203trawick> -- DNSSEC zone signing tool</DIV
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REFSYNOPSISDIV"
75f5c2db254c0167a0e396254460de09b775d203trawickNAME="AEN13"
75f5c2db254c0167a0e396254460de09b775d203trawick>Synopsis</H2
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="COMMAND"
75f5c2db254c0167a0e396254460de09b775d203trawick>dnssec-signzone</B
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>directory</I
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>end-time</I
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>output-file</I
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>interval</I
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>nthreads</I
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
a7452f0ad4045af1d42dce45cc25854e7bf3cac4trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>randomdev</I
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>start-time</I
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawick>] {zonefile} [key...]</P
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REFSECT1"
75f5c2db254c0167a0e396254460de09b775d203trawickNAME="AEN69"
75f5c2db254c0167a0e396254460de09b775d203trawick>DESCRIPTION</H2
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="COMMAND"
75f5c2db254c0167a0e396254460de09b775d203trawick>dnssec-signzone</B
75f5c2db254c0167a0e396254460de09b775d203trawick> signs a zone. It generates
75f5c2db254c0167a0e396254460de09b775d203trawick NSEC and RRSIG records and produces a signed version of the
75f5c2db254c0167a0e396254460de09b775d203trawick zone. The security status of delegations from the signed zone
a7452f0ad4045af1d42dce45cc25854e7bf3cac4trawick (that is, whether the child zones are secure or not) is
75f5c2db254c0167a0e396254460de09b775d203trawick determined by the presence or absence of a
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="FILENAME"
75f5c2db254c0167a0e396254460de09b775d203trawick> file for each child zone.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REFSECT1"
75f5c2db254c0167a0e396254460de09b775d203trawickNAME="AEN74"
75f5c2db254c0167a0e396254460de09b775d203trawick>OPTIONS</H2
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="VARIABLELIST"
75f5c2db254c0167a0e396254460de09b775d203trawick> Verify all generated signatures.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick> Specifies the DNS class of the zone.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick> Treat specified key as a key signing key ignoring any
75f5c2db254c0167a0e396254460de09b775d203trawick key flags. This option may be specified multiple times.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick> Generate a DLV set in addition to the key (DNSKEY) and DS sets.
75f5c2db254c0167a0e396254460de09b775d203trawick The domain is appended to the name of the records.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>directory</I
75f5c2db254c0167a0e396254460de09b775d203trawick> Look for <TT
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="FILENAME"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawick>directory</CODE
75f5c2db254c0167a0e396254460de09b775d203trawick> as the directory
75f5c2db254c0167a0e396254460de09b775d203trawick> Generate DS records for child zones from keyset files.
75f5c2db254c0167a0e396254460de09b775d203trawick Existing DS records will be removed.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>start-time</I
75f5c2db254c0167a0e396254460de09b775d203trawick> Specify the date and time when the generated RRSIG records
75f5c2db254c0167a0e396254460de09b775d203trawick become valid. This can be either an absolute or relative
75f5c2db254c0167a0e396254460de09b775d203trawick time. An absolute start time is indicated by a number
75f5c2db254c0167a0e396254460de09b775d203trawick in YYYYMMDDHHMMSS notation; 20000530144500 denotes
75f5c2db254c0167a0e396254460de09b775d203trawick 14:45:00 UTC on May 30th, 2000. A relative start time is
75f5c2db254c0167a0e396254460de09b775d203trawick indicated by +N, which is N seconds from the current time.
75f5c2db254c0167a0e396254460de09b775d203trawick If no <CODE
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawick>start-time</CODE
75f5c2db254c0167a0e396254460de09b775d203trawick> is specified, the current
75f5c2db254c0167a0e396254460de09b775d203trawick time minus 1 hour (to allow for clock skew) is used.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>end-time</I
75f5c2db254c0167a0e396254460de09b775d203trawick> Specify the date and time when the generated RRSIG records
75f5c2db254c0167a0e396254460de09b775d203trawick expire. As with <CODE
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawick>start-time</CODE
a7452f0ad4045af1d42dce45cc25854e7bf3cac4trawick>, an absolute
75f5c2db254c0167a0e396254460de09b775d203trawick time is indicated in YYYYMMDDHHMMSS notation. A time relative
75f5c2db254c0167a0e396254460de09b775d203trawick to the start time is indicated with +N, which is N seconds from
75f5c2db254c0167a0e396254460de09b775d203trawick the start time. A time relative to the current time is
75f5c2db254c0167a0e396254460de09b775d203trawick indicated with now+N. If no <CODE
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawick>end-time</CODE
75f5c2db254c0167a0e396254460de09b775d203trawick specified, 30 days from the start time is used as a default.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>output-file</I
75f5c2db254c0167a0e396254460de09b775d203trawick> The name of the output file containing the signed zone. The
75f5c2db254c0167a0e396254460de09b775d203trawick default is to append <TT
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="FILENAME"
75f5c2db254c0167a0e396254460de09b775d203trawick>.signed</TT
75f5c2db254c0167a0e396254460de09b775d203trawick input file.
75f5c2db254c0167a0e396254460de09b775d203trawick> Prints a short summary of the options and arguments to
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="COMMAND"
75f5c2db254c0167a0e396254460de09b775d203trawick>dnssec-signzone</B
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>interval</I
3c9f245c1d1dc149ecb093016c9f4e867b7b028btrawick> When a previously signed zone is passed as input, records
3c9f245c1d1dc149ecb093016c9f4e867b7b028btrawick may be resigned. The <CODE
3c9f245c1d1dc149ecb093016c9f4e867b7b028btrawickCLASS="OPTION"
3c9f245c1d1dc149ecb093016c9f4e867b7b028btrawick>interval</CODE
3c9f245c1d1dc149ecb093016c9f4e867b7b028btrawick specifies the cycle interval as an offset from the current
3c9f245c1d1dc149ecb093016c9f4e867b7b028btrawick time (in seconds). If a RRSIG record expires after the
3c9f245c1d1dc149ecb093016c9f4e867b7b028btrawick cycle interval, it is retained. Otherwise, it is considered
75f5c2db254c0167a0e396254460de09b775d203trawick to be expiring soon, and it will be replaced.
a7452f0ad4045af1d42dce45cc25854e7bf3cac4trawick> The default cycle interval is one quarter of the difference
75f5c2db254c0167a0e396254460de09b775d203trawick between the signature end and start times. So if neither
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawick>end-time</CODE
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawick>start-time</CODE
75f5c2db254c0167a0e396254460de09b775d203trawick are specified, <B
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="COMMAND"
75f5c2db254c0167a0e396254460de09b775d203trawick>dnssec-signzone</B
75f5c2db254c0167a0e396254460de09b775d203trawick signatures that are valid for 30 days, with a cycle
75f5c2db254c0167a0e396254460de09b775d203trawick interval of 7.5 days. Therefore, if any existing RRSIG records
75f5c2db254c0167a0e396254460de09b775d203trawick are due to expire in less than 7.5 days, they would be
75f5c2db254c0167a0e396254460de09b775d203trawick> When signing a zone with a fixed signature lifetime, all
75f5c2db254c0167a0e396254460de09b775d203trawick RRSIG records issued at the time of signing expires
75f5c2db254c0167a0e396254460de09b775d203trawick simultaneously. If the zone is incrementally signed, i.e.
75f5c2db254c0167a0e396254460de09b775d203trawick a previously signed zone is passed as input to the signer,
75f5c2db254c0167a0e396254460de09b775d203trawick all expired signatures has to be regenerated at about the
75f5c2db254c0167a0e396254460de09b775d203trawick same time. The <CODE
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="OPTION"
75f5c2db254c0167a0e396254460de09b775d203trawick>jitter</CODE
75f5c2db254c0167a0e396254460de09b775d203trawick> option specifies a
75f5c2db254c0167a0e396254460de09b775d203trawick jitter window that will be used to randomize the signature
75f5c2db254c0167a0e396254460de09b775d203trawick expire time, thus spreading incremental signature
75f5c2db254c0167a0e396254460de09b775d203trawick regeneration over time.
75f5c2db254c0167a0e396254460de09b775d203trawick> Signature lifetime jitter also to some extent benefits
75f5c2db254c0167a0e396254460de09b775d203trawick validators and servers by spreading out cache expiration,
75f5c2db254c0167a0e396254460de09b775d203trawick i.e. if large numbers of RRSIGs don't expire at the same time
75f5c2db254c0167a0e396254460de09b775d203trawick from all caches there will be less congestion than if all
75f5c2db254c0167a0e396254460de09b775d203trawick validators need to refetch at mostly the same time.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick> Specifies the number of threads to use. By default, one
75f5c2db254c0167a0e396254460de09b775d203trawick thread is started for each detected CPU.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick> The zone origin. If not specified, the name of the zone file
75f5c2db254c0167a0e396254460de09b775d203trawick is assumed to be the origin.
75f5c2db254c0167a0e396254460de09b775d203trawick> Use pseudo-random data when signing the zone. This is faster,
75f5c2db254c0167a0e396254460de09b775d203trawick but less secure, than using real random data. This option
75f5c2db254c0167a0e396254460de09b775d203trawick may be useful when signing large zones or when the entropy
75f5c2db254c0167a0e396254460de09b775d203trawick source is limited.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>randomdev</I
75f5c2db254c0167a0e396254460de09b775d203trawick> Specifies the source of randomness. If the operating
75f5c2db254c0167a0e396254460de09b775d203trawick system does not provide a <TT
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="FILENAME"
75f5c2db254c0167a0e396254460de09b775d203trawick or equivalent device, the default source of randomness
75f5c2db254c0167a0e396254460de09b775d203trawick is keyboard input. <TT
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="FILENAME"
75f5c2db254c0167a0e396254460de09b775d203trawick>randomdev</TT
75f5c2db254c0167a0e396254460de09b775d203trawick the name of a character device or file containing random
75f5c2db254c0167a0e396254460de09b775d203trawick data to be used instead of the default. The special value
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="FILENAME"
75f5c2db254c0167a0e396254460de09b775d203trawick>keyboard</TT
75f5c2db254c0167a0e396254460de09b775d203trawick> indicates that keyboard
75f5c2db254c0167a0e396254460de09b775d203trawick input should be used.
75f5c2db254c0167a0e396254460de09b775d203trawick> Print statistics at completion.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REPLACEABLE"
75f5c2db254c0167a0e396254460de09b775d203trawick> Sets the debugging level.
75f5c2db254c0167a0e396254460de09b775d203trawick> Ignore KSK flag on key when determining what to sign.
75f5c2db254c0167a0e396254460de09b775d203trawick>zonefile</DT
75f5c2db254c0167a0e396254460de09b775d203trawick> The file containing the zone to be signed.
75f5c2db254c0167a0e396254460de09b775d203trawick Sets the debugging level.
75f5c2db254c0167a0e396254460de09b775d203trawick> The keys used to sign the zone. If no keys are specified, the
75f5c2db254c0167a0e396254460de09b775d203trawick default all zone keys that have private key files in the
75f5c2db254c0167a0e396254460de09b775d203trawick current directory.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REFSECT1"
75f5c2db254c0167a0e396254460de09b775d203trawickNAME="AEN190"
75f5c2db254c0167a0e396254460de09b775d203trawick>EXAMPLE</H2
75f5c2db254c0167a0e396254460de09b775d203trawick> The following command signs the <KBD
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="USERINPUT"
75f5c2db254c0167a0e396254460de09b775d203trawick zone with the DSA key generated in the <B
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="COMMAND"
75f5c2db254c0167a0e396254460de09b775d203trawick>dnssec-keygen</B
75f5c2db254c0167a0e396254460de09b775d203trawick man page. The zone's keys must be in the zone. If there are
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="FILENAME"
75f5c2db254c0167a0e396254460de09b775d203trawick> files associated with child zones,
75f5c2db254c0167a0e396254460de09b775d203trawick they must be in the current directory.
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="USERINPUT"
75f5c2db254c0167a0e396254460de09b775d203trawick>, the following command would be
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="USERINPUT"
75f5c2db254c0167a0e396254460de09b775d203trawick>dnssec-signzone -o example.com db.example.com Kexample.com.+003+26160</KBD
75f5c2db254c0167a0e396254460de09b775d203trawick> The command would print a string of the form:
75f5c2db254c0167a0e396254460de09b775d203trawick> In this example, <B
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="COMMAND"
75f5c2db254c0167a0e396254460de09b775d203trawick>dnssec-signzone</B
75f5c2db254c0167a0e396254460de09b775d203trawick the file <TT
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="FILENAME"
75f5c2db254c0167a0e396254460de09b775d203trawick>. This file
75f5c2db254c0167a0e396254460de09b775d203trawick should be referenced in a zone statement in a
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="FILENAME"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REFSECT1"
75f5c2db254c0167a0e396254460de09b775d203trawickNAME="AEN204"
75f5c2db254c0167a0e396254460de09b775d203trawick>SEE ALSO</H2
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="CITEREFENTRY"
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REFENTRYTITLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>dnssec-keygen</SPAN
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="CITETITLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>BIND 9 Administrator Reference Manual</I
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="CITETITLE"
75f5c2db254c0167a0e396254460de09b775d203trawick>RFC 2535</I
75f5c2db254c0167a0e396254460de09b775d203trawickCLASS="REFSECT1"
75f5c2db254c0167a0e396254460de09b775d203trawickNAME="AEN212"
75f5c2db254c0167a0e396254460de09b775d203trawick> Internet Systems Consortium