August 1997 - NANOG - lists.nanog.org

Sunday in Tallahassee
by Bob Broedel 03 Aug '97

03 Aug '97

Dear NANOG Folk ... Haven't seen anything on nanog or the outage lists about this, but things are looking pretty bad from Tallahassee. Any idea what is happening with connectivity this weekend? (Sunday evening) Sincerely, Bob Broedel Meteorology Dept. Florida State University, Tallahassee ============================ huey.bro> date Sun Aug 3 19:00:38 EDT 1997 huey.bro> check21 //// a ping to BBN ... ----198.102.72.10 PING Statistics---- 4 packets transmitted, 0 packets received, 100% packet loss //// a ping to CENTEL ... ----198.102.72.25 PING Statistics---- 4 packets transmitted, 0 packets received, 100% packet loss //// a ping to AADS ... ----198.32.130.12 PING Statistics---- 4 packets transmitted, 0 packets received, 100% packet loss //// a ping to MAE-East ... ----192.41.177.181 PING Statistics---- 4 packets transmitted, 1 packets received, 75% packet loss /// a ping to MAE-West ... ----198.32.136.14 PING Statistics---- 4 packets transmitted, 2 packets received, 50% packet loss /// a ping to PacBell ... ----206.13.28.11 PING Statistics---- 4 packets transmitted, 1 packets received, 75% packet loss /// a ping to Sprint ... ----192.157.69.11 PING Statistics---- 4 packets transmitted, 0 packets received, 100% packet loss /// a ping to DivCom ... ----199.250.21.20 PING Statistics---- 4 packets transmitted, 0 packets received, 100% packet loss /// a ping to FIRN ... ----198.102.72.20 PING Statistics---- 4 packets transmitted, 1 packets received, 75% packet loss ======================= ========================== Bob Broedel, Engineer = Strike Out ALS ! = Meteorology / 404 Love Building = (Lou Gehrig's Disease) = FLORIDA STATE UNIVERSITY = List Owner: = Tallahassee, Florida 32306-4520 USA = ALS INTEREST GROUP = ================================================================ TEL: 850-644-6840 (work, answering machine), 850-576-4906 (home) FAX: 850-644-9642 ATTN:BROEDEL E-mail: bro(a)huey.met.fsu.edu TELEX (AT&T EasyLink): 5106014520 (TALLY-KRAS FL) ================================================================ 24 hour active hand-held cellular phone 904(soon 850)-556-4286 ================================================================

1 0

Internet Building topology
by Stephen Balbach 03 Aug '97

03 Aug '97

Hi, I am designing an "Internet Building" concept using ethernet. Below is a model using 2 cisco Catalyst 1912's (12 port ethernet switch) and a cisco 2501. Switch 2 is on the 2nd floor and Switch 1 is in 1st floor. Does this look like a viable topology? Are there other/better ways to approach this for scaleability? Thanks for any ideas/experiences. x.x.x.0 /26 (Customer 2nd floor) | | x.x.x.64 /26 (Customer 2nd floor) | | | | Switch 2 (2nd floor) A | B | C VLAN 1 = A+C | VLAN 2 = B+C | | | (cable drop between 1st and 2nd floor) | | | Switch 1 (first floor) A | B | C VLAN 1 = B + C | | cisco (first floor) ip secondary x.x.x.0 /26 ip secondary x.x.x.64 /26 | | | T1 to Internet | |

1 0

Re: how to protect name servers against cache corruption
by smd＠clock.org 03 Aug '97

03 Aug '97

"William Allen Simpson" <wsimpson(a)greendragon.com> writes: > The Ferguson quote was on the NANOG list, and seemed > very mild Hahhahahahahahahhaha, well most quotes would to you, Bill. Sean. (yet another rude asshole bastard)

1 0

Re: Summary of ANTI-spam techniques now available
by Bill Woodcock 03 Aug '97

03 Aug '97

> Can i deduce from this that you have blocked PSI We did. Cut the spam attempts here by about 75%, and I haven't had any complaints from customers. We subsequently switched over to Sendmail 8.8.6 with filtering, of course, but I don't think we've bothered to remove the PSI filter from our router... :-) Bad attitude, I know, and now I'll probably have to go remove it, so I can feel like I'm still one of hte good guys, promoting connectivity and trust, etc. -Bill

1 0

Re: Summary of ANTI-spam techniques now available
by David Stoddard 02 Aug '97

02 Aug '97

FWIW, we have an anti-spam list on our site that is used by a lot of other ISPs on the net. It contains all of the known Cyberpromo domains and IP address blocks, and a ton of other stuff. You can get our active list anytime by sending an email message to: spamlist(a)us.net The list is ready to load into sendmail 8.8.6 using the filter rules available at: http://www.informatik.uni-kiel.de/%7Eca/email/chk-newmap.html BTW, we will remove any entry in the file as long as the spammer agrees to sign and notarize a contract that establishes damages at $10,000 per incident if it happens again (and we WILL enforce the contract). If they are ISPs, I want to talk personally to the owner of the company. We don't put entries into the list lightly, and we don't remove them lightly either. Dave Stoddard US Net Incorporated 301-572-5926 dgs(a)us.net

1 0

Re: An end to spam through Graphnet
by Bill Woodcock 02 Aug '97

02 Aug '97

Jon taught J.D. to suck eggs thusly: > I just implemented the check_* stuff on my server...it works > great and was fairly easy to do... I noticed that the LocalIP stuff wasn't actually working, but haven't had a chance to check into why yet... Anybody actually seen that one in action? -Bill ______________________________________________________________________________ bill woodcock woody(a)zocalo.net woody(a)nowhere.loopback.edu user(a)host.domain.com

3 2

Re: how to protect name servers against cache corruption
by Francois Beauregard 02 Aug '97

02 Aug '97

Another thing people tend to forget is the legacy systems that still need to be maintained... It's extremely easy to say "let's scrap BIND and build a better DNS system", but hey guys, you still need to support ALL PLATFORMs... Until you find me the GOD that will do this all in one shot, I'll prefer to go with Vixie's code... he got pretty good at it over time :-) And I think that Paul can confirm that like everybody else, he only have 24 hours in a day and only one head and one set of arms... Considering that, he is doing a VERY good job, give him some time and he will come up with the solution to those security issue, no one better then him knows the holes in the code/system... So unless there is some specific attacks GOING ON CURRENTLY on the net, can we get back to the main topic of discussion... At 16:09 97-08-01 -0700, Dave Crocker wrote: >Ben, > >At 10:30 PM 7/29/97 -0400, Ben Black wrote: >>so a statement from paul that the internet is effectively broken until >>DNSSEC is acceptable to you even if there are known ways to combat known >>attacks? >> >>stop worshipping long enough to think about the ramifications of this. > > Reponsible participation in public discussion is a difficult challenge for >even the most capable contributor. For others, the challenge is quite >basic. They must listen carefully. They must consider carefully. They >must stay on the topic. They must use professional language and avoid ad >hominem distractions. > > The fact that the security on your house is not optimal, it does not mean >that your house has no security. The fact that there are attacks which are >still feasible on the DNS does not mean that the DNS doesn't work. >("Broken" means doesn't work, in case there is confusion about your use of >language.) > > So please note that your response to this thread reduce it to an >inaccurate assessment. Given the importance of the DNS and the difficulty >which the general public has dealing with network security issues, it would >be highly irresponsible to propagate inaccurate statements like the one above. > >d/ >-------------------- >Dave Crocker >Internet Mail Consortium +1 408 246 8253 >675 Spruce Dr. fax: +1 408 249 6205 >Sunnyvale, CA 94086 USA info(a)imc.org , http://www.imc.org Sincerely ---------------------------------- Francois Beauregard FBorg(a)fbli.com FBLI.COM We love feedbacks and live by them Sales : Sales(a)fbli.com 1 (888) FBLI.COM Tech support : Support(a)fbli.com 1 (514) 349-0455 Internet Web : http://www.fbli.com ICQ : 1907537 Montreal, Canada ----------------------------------

1 0

Re: how to protect name servers against cache corruption
by William Allen Simpson 02 Aug '97

02 Aug '97

The Ferguson quote was on the NANOG list, and seemed very mild, but I don't understand where the other quotes came from. Am I experiencing mail loss? > From: craig(a)ishiboo.com > Can we please get back to the more adult discussion of the issues and > leave the childish attacks on peoples intelligence, heritage, personal > habits and the like to a more proper forum? this list is begining to > remind me of a bad Beavis and Butthead nightmare. It would be most > enjoyable to not have to see the following in the future. > > For example: > > From: "Perry E. Metzger" <perry(a)piermont.com> > From: Paul A Vixie <vixie(a)vix.com> > From: Paul Ferguson <pferguso(a)cisco.com> > ---------------- > Craig Nottingham > craig(a)mil.net > WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32 BSimpson(a)MorningStar.com Key fingerprint = 2E 07 23 03 C5 62 70 D3 59 B1 4F 5E 1D C2 C1 A2

1 0

Re: An end to spam through Graphnet
by Jon Stevens 01 Aug '97

01 Aug '97

"J.D. Falk" <jdfalk(a)priori.net> said the following at 8/1/97 2:36 PM: > The /best/ idea is to have them use a local SMTP server. If > they can't or won't do that, there are a few recipes floating > around that let you exempt messages from specific sources; I > haven't investigated those much, but they're out there. I just implemented the check_* stuff on my server...it works great and was fairly easy to do... <http://www.informatik.uni-kiel.de/%7Eca/email/check.html> It has already stopped quite a bit of spam and I'm being very good about keeping my junk database up to date... -jon stevens

1 0

DNS Root server updating auth zone
by Wayne Hall 01 Aug '97

01 Aug '97

I have been asked to take over the DNS/Sendmail services at my company and in looking over the system I noticed several messages in the logs that look like the following: named[85]: [192.5.5.241].53 attempted update to auth zone "vie.com" (VIE.com) Because the IPs are all from the root DNS servers and the db.cache was out of date, I updated it with the most current and restarted in.named. A day later and I am still receiving the errors. Everything looks to be correct when compared to my DNS and Bind manual. Is this a normal message or any ideas what might be wrong? We are running SunOS 4.1.3 with the native BIND. Thanks Wayne Hall Network Manager VIE PS - I apologize if this is the wrong area to post this type of question.

1 0