January 1999 - NANOG - lists.nanog.org

RE: Incompetance abounds at the InterNIC
by Chris Mauritz 19 Jan '99

19 Jan '99

This isn't a bad idea. Imposing a "pay up front" policy on domains that are not first time registrants or renewals of domains that have paid in the past seems like a pretty good way to deter the hoarding that we're seeing now. If the Internic isn't going to change their policy to squelch the problem, they need to improve the performance of their existing process. The current system is completely substandard and is only encouraging those folks that would see the entire process regulated by the gummint. C Chris Mauritz Director, Systems Administration Rare Medium, Inc. chrism(a)raremedium.com -----Original Message----- From: Rich Sena [mailto:ras@poppa.thick.net] Sent: Tuesday, January 19, 1999 10:37 AM To: John M. Brown Cc: Edward S. Marshall; Daniel Senie; Phil Howard; John Fraizer; nanog(a)merit.edu Subject: Re: Incompetance abounds at the InterNIC My take would be register them as the billing contact and remain as the adminstrative contacts - the NIC should then have a page set up that the custoemr can go with a confirmation number to add their credit card info directly - they could afford them a 3 day window to do so - or the domain would be deleted. They could also tag a domain that has been reregistered a 2nd time and demand payment up front before it is registered this time - that gives the customer 1 bite at convenience - and then hve to put up in order to ever actually get that particular domain. On Tue, 19 Jan 1999, John M. Brown wrote: > My only problem with Pay Up Front is that some customers are going > to be dead beat about paying us. I would want to make sure that > there was some recourse to collecting our money or having the > domain placed on hold until fees are paid. The only way that > I can see doing that now is to register the domain under our name > and then transfer it later once we get paid. Way to much work. <snip> -- I am nothing if not net-Q! - ras(a)poppa.thick.net

1 0

NANOG 15 Registration Reminder
by Pam Ciesla 19 Jan '99

19 Jan '99

NANOG 15 Resgistration ends on Friday, 1/22. Cancellations after 1/22 will be charged $35 and registration will be $285 (space allowing). Information for registering can be found on the NANOG webpage http://www.nanog.org. Any questions please contact me. Thanks Pam Pam Ciesla Merit Network,Inc. 734-936-0172 - phone 4251 Plymouth Road 734-647-3185 Bldg.I, Suite C pam(a)merit.edu Ann Arbor, MI 48107

1 0

quick question about mae-la
by hhui＠arcfour.com 19 Jan '99

19 Jan '99

what fibre carriers are available to one wilshire or 4676 admiralty? any contacts on either the isi or mfs side? (mae-la-request(a)isi.edu seems to get me to a defunct mailing-list, and my wcom reps are clueless, as usual.. "what's mae-la? is that a person?") sorry, this should probably be in the faq :( please reply privately, so as not to clutter the list. thanks much, -h

2 1

Re: source filtering
by Tony Tauber 17 Jan '99

17 Jan '99

On Jan 16, 3:04pm, Jay R. Ashworth wrote: > Subject: Re: source filtering > On Wed, Jan 13, 1999 at 10:37:55PM -0500, Tony Tauber wrote: > > On Jan 13, 3:41pm, Scott McGrath wrote: > > > Subject: RE: source filtering > > > GTE and ATT both filter via access lists on the customers CPE routers IF > > > they provide the routers to the customer > > > > It'd be nice if this information came from one of the entities > > named above. Here's a refinement for our part. > > > > GTE does not impose mandatory source address filtering via > > access-lists on customers' CPE routers. However, we have recently > > implemented Cisco's "ip verify unicast reverse-path". > > I think perhaps we have an acronym collision here. I read Scott's > comment to mean "Customer Premises Equipment", since that was the only > parsing that didn't introduce a conflict. > > However, I read Tony's reply as "Customer Provided Equipment", since > that's my usual parsing of that acronym. > > In this case, it makes quite a difference. Clarification? > > Better: why not, Tony? > My meaning, and the one in common use around GTE Internetworking, is "Customer Premises Equipment" which can be supplied by us or the customer. The phrase "customers' CPE" above, would probably have been a tad clearer as just "CPE", especially since most CPE that we manage are in fact supplied and owned by us. Many customers choose to supply and manage their own CPE which means filtering or lack thereof is up to them. Clear? Tony

1 0

Re: What does the NIC in InterNIC mean? "Network IncompetenceCon
by Brian Wallingford 17 Jan '99

17 Jan '99

*please* folks, enough with the crossposting. Pick your forum and post accordingly. Regards, Brian

1 0

Re: What does the NIC in InterNIC mean? "Network Incompetence Consortium"
by danderson＠lycos.com 17 Jan '99

17 Jan '99

Now come on, give these guys a break. You have to understand that they run one of the largest services on the internet, and arguably the most important. Yes, their billing procedures have been bad, registration is slow, its often difficult to get someone on the phone to solve a problem, etc. etc.. But they have to run a service that services everyone on the internet, quite literally. Lycos is one of the largest companies on the web right now and our service is extremely large. Let me tell you, its not like we don't have disks fill, machines blow, modules in routers die, and on and on. In comparison, I know what I have to go though to make Lycos work, plus the efforts of hundreds of other employees. Combine that and you can't even compare it to what InterNIC handles. Every single domain lookup goes though root servers that they keep master ns records for. EVERY ONE! Its easy for us to sit around and say that they suck, they stink, and they are incompetent. Its because they are so important that their mistakes are so noticeable. Think about running your service, you know that stuff happens regardless of how redundant you attempt to make it. As a whole, I think their service runs pretty damn well for the most part. Their accounting and billing departments I can't say the same for, but that's not the issue. And lets not forget that they had to pioneer the whole thing. Its not like they had a business model of another company to compare to when they started up. So have a little respect for them and don't whine about how much they suck in the list unless its going to be productive, please. later- Devin Anderson Network Engineer Lycos, Inc. John Fraizer <John.Fraizer(a)EnterZone.Net> on 01/16/99 08:15:59 AM To: nanog(a)merit.edu cc: markk(a)NETSOL.COM, ema(a)merit.edu, action(a)ISI.EDU, report(a)drudge.com, headline.news(a)cnn.com, isp-colo(a)isp-colo.com, isp-consulting(a)isp-consulting.com, isp-linux(a)isp-linux.com, isp-tech(a)isp-tech.com, isp-webhosting(a)isp-webhosting.com, comments(a)foxnews.com, abcsuggestions-L(a)starwave.com, TechNews(a)MSNBC.com, World(a)MSNBC.com, Internight(a)MSNBC.com, Imus(a)MSNBC.com (bcc: Devin Anderson/Lycos) Subject: Re: What does the NIC in InterNIC mean? "Network Incompetence Consortium" I would like to thank the anonymous party who sent the email below. It confirms the rumors I had heard related to the cause of the latest InterNIC SNAFU. >Subject: What does the NIC in InterNIC mean? "Network Incompetence Consortium" (fwd) >To: John.Fraizer(a)EnterZone.Net > > >The service from InterNIC has been really poor for the last couple of >weeks, and they finally admitted what the problem is, but only to their >Premier Partners, and only after making up lots of other stories to cover >it up first. > >Please keep me anonymous, don't use my name. > >InterNIC admitted that they are being massively flooded by domain >speculators trying to register domains that are On Hold. It's happened >before, but this time it's far and away worse than ever before. They said >they expect to have it resolved in a few days, which I believe means that >they're seeking legal injunctions against one or more offenders. From what >I've heard, these speculators are sending registration templates for >hundreds of domains every second, going far beyond their capacity. It seems that the Network Solutions/The InterNIC is following the lead of the politicians. Lie about it until you're caught and then refuse to talk about it. ------------------------------------------------------------------ ML.ORG is gone. Check out http://www.EZ-IP.Net - It's *FREE* ------------------------------------------------------------------ Get your *FREE* Parked Domain account at http://www.EZ-Hosting.Com ------------------------------------------------------------------ John Fraizer | __ _ | The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation PGP Key fingerprint = 7DB6 1CA2 DAA6 43DA 3AAF 44CD 258C 3D7E B425 81A8

6 6

Re: source filtering
by Tony Tauber 16 Jan '99

16 Jan '99

On Jan 13, 3:41pm, Scott McGrath wrote: > Subject: RE: source filtering > GTE and ATT both filter via access lists on the customers CPE routers IF > they provide the routers to the customer > It'd be nice if this information came from one of the entities named above. Here's a refinement for our part. GTE does not impose mandatory source address filtering via access-lists on customers' CPE routers. However, we have recently implemented Cisco's "ip verify unicast reverse-path". Tony Tauber GTE Network Engineering

2 1

Re: Solution: Re: Huge smurf attack
by Harold Willison 16 Jan '99

16 Jan '99

Tracking down a smurf amplifier is not a problem. Getting the folks to fix it is a little harder than it should be now, as most of the folks left with open amplifiers have been notified and have to this point refused to fix or are unable to fix it. The real solution is to catch the person starting the attack. Until the 'kiddies' start seeing people paying a price for this, they aren;t going to stop. I could make sure every person on my network is configured so that noone within their network is able to spoof addresses and can't be used as an amplifier, but this will not protect me and my network from attacks aimed towards us. As long as there are networks that allow spoofed addresses, we will be vulnerable. To even consider the fact that every network will eliminate the ability to forge addresses it unrealistic. We can't get folks to stop being amplifiers, how are we going to get them to apply the spoof filters? The only solution that is realistic is to start catching and prosecuting the individuals doing this. This requires total cooperation between Tier 1 providers.. and the ability on all brands of routers to trace this. This is not the case at this time, and I really don't see it heading that way anytime soon. At 10:06 AM 1/14/99 -0600, you wrote: > >My only question is do any of you who've been under attack report these >incidents to the FBI and the other appropriate agencies? I understand >that a lot of these places are Universities and Govt. agencies where >finding someone to fix the problem is like running through water, but I >can only wonder if having the FBI get involved in these things would help. > >Two agents from the Houston office recently gave a presentation talking >about their new and expanding computer crimes divisions popping up around >the country. They kept harping on protecting the infrastructure of the >nations public networks, and I think helping track down smurf amplifiers >would fall under this. > >-- >Joseph Shaw - jshaw(a)insync.net >NetAdmin/Security - Insync Internet Services >Free UNIX advocate - "I hack, therefore I am." > >On Thu, 14 Jan 1999, Alex P. Rudnev wrote: > >> I am not sure about last smurf incident, but don't overestimate _dark >> minds_ caused this incident. I am 99.9% shure all (ALL) this incidents >> complained about in NANOG was the same _kidscripts_. >> >> This do not mean you should not prevent the possibility of >> _cyberterrorism_, and let's this _kid's plays_ help to pay attention to >> the security holes we have over the Internet. > > *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* | Harold Willison AGIS Network Engineering | * Senior Network Engineer 313-730-5151 * | noc(a)agis.net 313-730-1130 x-5649 | | harold(a)agis.net 24 hours a day, 7 days a week | | <bold><italic> <underline>http://www.agis.net</underline></italic></bold> |<bold><italic> </italic></bold>\*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*/

4 4

What does the NIC in InterNIC mean? "Network Incompetence Consortium"
by John Fraizer 16 Jan '99

16 Jan '99

For those of you who haven't noticed, Network Solutions has been demonstrating their complete and total lack of competence over the past 10 hours, AGAIN. At 18:33 -0500, I sent in a new domain template. At 22:36 -0500, I received the following from the mailer daemon: ----- The following addresses had transient non-fatal errors ----- <hostmaster(a)internic.net> ----- Transcript of session follows ----- ... while talking to rs.internic.net.: >>> DATA <<< 451 qq write error or disk full (#4.3.0) <hostmaster(a)internic.net>... Deferred: 451 qq write error or disk full (#4.3.0) Now, isn't that nice. They have tons of money to spend on television advertisements and banner ads on the search engines/indexes yet, they can't fork out any cash to keep their systems running? Hard drive space is dirt cheap! At 04:18 -0500, I received the following: The original message was received at Sat, 16 Jan 1999 04:17:47 -0500 (EST) from biprrs1.lb.internic.net [192.168.120.39] ----- The following addresses had permanent fatal errors ----- hostmaster(a)mail-hub-mgt.mgt.internic.net (expanded from: <hostmaster(a)internic.net>) ----- Transcript of session follows ----- ... while talking to mail-hub-mgt.mgt.internic.net.: >>> RCPT To:<hostmaster(a)mail-hub-mgt.mgt.internic.net> <<< 550 <hostmaster(a)mail-hub-mgt.mgt.internic.net>... Relaying denied 550 hostmaster(a)mail-hub-mgt.mgt.internic.net... User unknown Reporting-MTA: dns; opsmail.internic.net Received-From-MTA: DNS; biprrs1.lb.internic.net Arrival-Date: Sat, 16 Jan 1999 04:17:47 -0500 (EST) Final-Recipient: RFC822; <hostmaster(a)internic.net> X-Actual-Recipient: RFC822; hostmaster(a)mail-hub-mgt.mgt.internic.net Action: failed Status: 5.1.1 Remote-MTA: DNS; mail-hub-mgt.mgt.internic.net Diagnostic-Code: SMTP; 550 <hostmaster(a)mail-hub-mgt.mgt.internic.net>... Relaying denied Last-Attempt-Date: Sat, 16 Jan 1999 04:17:49 -0500 (EST) Relaying denied? So, their own mail hub won't accept mail for hostmaster(a)internic.net now? I don't care if they are "under heavy load resulting from domain speculators." What I care about is that they have been contracted to provide a service and they are failing miserably. Domain speculators are not a new thing and they are not going away any time soon. The internet community as a whole depends on the InterNIC to be reliable. Their inability to deliver reliable service has impacted the entire net multiple times in the very recent past. Now, they can not deal with simply accepting email for delivery to hostmaster(a)internic.net? Something needs to change and it needs to change NOW. I expect to see a full disclosure press release from Network Solutions concerning this matter. I want to know why there are not backup mail exchangers in place to at the very least queue email in the event of a failure. ; <<>> DiG 2.2 <<>> -t internic.net ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6 ;; flags: qr rd ra; Ques: 1, Ans: 1, Auth: 5, Addit: 6 ;; QUESTIONS: ;; internic.net, type = MX, class = IN ;; ANSWERS: internic.net. 44809 MX 100 rs.internic.net. ;; AUTHORITY RECORDS: internic.net. 75543 NS rs0.internic.net. internic.net. 75543 NS ns2.internic.net. internic.net. 75543 NS noc.cerf.net. internic.net. 75543 NS ns.isi.edu. internic.net. 75543 NS ns0.clt.internic.net. ;; ADDITIONAL RECORDS: rs.internic.net. 639 A 198.41.0.6 rs0.internic.net. 167818 A 198.41.0.5 ns2.internic.net. 119444 A 198.41.0.11 noc.cerf.net. 32356 A 192.153.156.22 ns.isi.edu. 102407 A 128.9.128.127 ns0.clt.internic.net. 138901 A 198.17.208.6 ;; Total query time: 18 msec ;; WHEN: Sat Jan 16 05:00:32 1999 ;; MSG SIZE sent: 30 rcvd: 253 Note the one, single mail exchanger? I want to know why there is not a monitoring and reporting system in place to let someone know when the mail exchanger is running low on drive space. If the above two systems are actually in place, I want to know who did not do their job and I want to see news footage of them in the unemployment line in Herndon, VA. I want to know why the performance of the InterNIC has deteriorated to such a point that they are the first thing I check in the event of erratic behavior of ANYTHING on the net and in most cases are at least partly to blame. ------------------------------------------------------------------ ML.ORG is gone. Check out http://www.EZ-IP.Net - It's *FREE* ------------------------------------------------------------------ Get your *FREE* Parked Domain account at http://www.EZ-Hosting.Com ------------------------------------------------------------------ John Fraizer | __ _ | The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation PGP Key fingerprint = 7DB6 1CA2 DAA6 43DA 3AAF 44CD 258C 3D7E B425 81A8

2 2

ATM Switch Interoperability
by Martin, Christian 16 Jan '99

16 Jan '99

All, Does anyone have an experience dealing with cell loss between LS1010s and Cascade/Ascend CBX 500s using VBRnrt? It appears that either the LS1010 or the CBX is performing UPC operations differently, as we are seeing between .1 and 2% packet loss at the AAL, and .1 to .5% at the cell level. By allowing flexibility in the policing, or by removing policing completely on the Cascade boxes, cell loss disappears. It appears that the LS may be sending cells too close together, but we are unsure and cannot truly test thi without an Analyzer, of which no one here has any experience using (even if we had one!). The parameters are as follows: 7513 w/AIP PCR 30000 SCR 15000 mbs 3 (*32) = 96 AAL5SNAP LS1010 CDVT 600 mbs 100 cell times PCR 30000 CLP0+1 SCR 15000 CLP0 Cascade (As far as I know) mbs 100 PCR 70754 cells/sec SCR 35377 cells/sec CDVT 600 I apologize for the vendor references, and I hope some don't view this as off-topic! Regards, Chris

2 1