November 2000 - NANOG - lists.nanog.org

PSINet outage?
by max_smetannikov＠ziffdavis.com 15 Nov '00

15 Nov '00

Is anybody else hearing about PSINet having a major outage that is affecting Internet and e-mail traffic all along eastern seaboard? MS

5 5

unexpected generousity
by Randy Bush 15 Nov '00

15 Nov '00

what am i misunderstanding here route-views.oregon-ix.net>sh ip bg 48.0.0.0 BGP routing table entry for 0.0.0.0/0, version 27074 Paths: (1 available, best #1) Not advertised to any peer 3333 5597 193.0.0.56 from 193.0.0.56 (193.0.0.56) Origin IGP, localpref 100, valid, external, best

3 2

QWEST New York City Outage
by Rishi Singh 15 Nov '00

15 Nov '00

QWEST Major Outage in New York City. Time of outage: 10:20 a.m. Master Ticket #: 113023 Carrier contact #: 800-524-5249 Type of outage: Unknown Two of our T1s went down to remote offices in other parts of the country. _________________ Rishi M. Singh IP Security Engineer Tradescape New York 135 East 57th. Street New York, NY 10004 646-521-4300

2 1

Re: unexpected generousity
by Jeff Weisberg 15 Nov '00

15 Nov '00

| what am i misunderstanding here how to create and apply a simple filter, apparently. --j

3 2

Trusting BGP sessions
by Sean Donelan 15 Nov '00

15 Nov '00

On Mon, 13 November 2000, David Diaz wrote: > The cabal makes jokes "Officially there is no cabal." > In reality the fact is that peering is a trust event. You are Peering is a business decision. It is not an engineering decision nor a trust event. Technically, can a peer BGP session do any more or less damage to your network than a customer BGP session? The protocol is identical.

2 2

MCI WORLDCOM TO PAY $3.5 MILLION
by Sean Donelan 15 Nov '00

15 Nov '00

Is it time for the FCC to start actions against Internet Service Providers who improperly announce IP address blocks without proper authorization, such as they do for long-distance slamming complaints? http://www.fcc.gov/Bureaus/Enforcement/News_Releases/2000/nren0009.html Is this the only thing which will get major carrier's attention. It would be great if carriers could be trusted to correctly verify IP addresses before announcing them. But as we've seen in the long-distance world, too many carriers act as if they can get an extra buck, they'll do what every they need to do. When will we see the headline XXXX ISP to pay $NNN million for Internet route hijacking?

11 10

Re: Operational impact of filtering SMB/NETBIOS traffic?
by William S. Duncanson 15 Nov '00

15 Nov '00

Being on the customer side of things, I filter 137-139 at my borders. If people need to get in from outside, that's what VPN's are for. I can think of no person who should legitimately be sending SMB traffic over the capital I Internet. On the subject of backbone providers, backbone providers IMHO should never filter transit, period, end of discussion. They can filter on customer borders if the customer requests it, and they can (and should) filter their dialup modem pools (hello, UUNet, PSI, etc.) The only conceivable case in which a backbone should filter transit is if the traffic in question is clearly an attack, and filtering is requested by a customer or peer, or if the amount of attack traffic is noticeably affecting performance. We need to stop foisting security onto the backbones, and start being responsible for it ourselves. If someone is foolish enough to allow SMB traffic over the Internet, then they deserve what's coming to them. As it has for eternity, it all boils down to educating the customer. Maybe it's time to start doing it with a clue-by-four. At 22:06 11/14/2000 +0000, Paul Thornton wrote: >On Tue, 14 Nov 2000, Scott Call wrote: > > > Because this traffic is IP traffic, I wanted to ask others on this list > > how they treat SMB traffic on their backbones? > >One of the things I considered doing was filtering 137-139 in our data >centres to reduce risk to customers' poorly (usually through knowing no >better, so no offence intended here) configured NT boxes. It does seem, >however, that people do want truly unrestricted NetBIOS over IP connectivity >into their boxes "So we can browse the server from the office" being a >familiar cry. As a result of this, we didn't go ahead with the intended >filtering. > >Experience has taught me that people (a) do this, and do it a lot >(certainly in Europe, YMMV elsewhere); and (b) a good number of them are >happy to have a server with little external filtering/firewalling/protection >doing it. I find this particularly scary... > >-- >Paul > >Not speaking for my employer, in case you know who they are... -- William S. Duncanson caesar(a)starkreality.com The driving force behind the NC is the belief that the companies who brought us things like Unix, relational databases, and Windows can make an appliance that is inexpensive and easy to use if they choose to do that. -- Scott Adams

1 0

UUNet Canada (AS701)
by Jason Lixfeld 15 Nov '00

15 Nov '00

Did 701 up north fart today at about 2:40pm EST this afternoon? I lost about 50MB/s of traffic for about 20 minutes. Anyone else notice anything odd in TO?

1 0

RE: Colo facilities @ 151 Front St, Toronto
by Jason Lixfeld 15 Nov '00

15 Nov '00

RACO is really good, when they have space. That's the problem now. They have been promising more space for 3 or 4 months now. > -----Original Message----- > From: David A. Snodgrass [mailto:dave@thedatasource.net] > Sent: November 14, 2000 4:43 PM > To: Jason Lixfeld; nanog(a)nanog.org > Subject: Re: Colo facilities @ 151 Front St, Toronto > > > > I've been trying to get colo-space for over a year at 151 > Front. ISP-Chat > bounces me from person to person who have even less and less clue. > Typical Telco behaviour :/ > > -dave > ----- Original Message ----- > From: "Jason Lixfeld" <jlixfeld(a)team.look.ca> > To: <nanog(a)nanog.org> > Sent: Tuesday, November 14, 2000 11:22 AM > Subject: Colo facilities @ 151 Front St, Toronto > > > > > > Does anyone know of, or work for a Company who can offer colocation > > facilities at 151 Front St. in Toronto? I need a cage > between ~15'x15' to > > ~20'x20'. RACO has been giving me and many more of it's > Toronto customers > > the runaround for the last 2 months on new space. Their > promises have > come > > up empty and I'm between a rock and a hard place right now > because I have > a > > few GSRs sitting in my warehouse but no place to install them. > > > > Thanks in Advance. > > > > Regards, > > -- > > Jason A. Lixfeld > > Senior Network Engineer > > Look Communications Inc. > > -- > > jlixfeld(a)team.look.ca > > > > > > > > -------------------------------------------------------------- > ----------- > This email server is running an evaluation copy of the > MailShield anti- > spam software. Please contact your email administrator if you have any > questions about this message. MailShield product info: www.mailshield.com

1 0

RE: Operational impact of filtering SMB/NETBIOS traffic?
by Sutantyo, Danny 15 Nov '00

15 Nov '00

How do you proxy Netbios? -----Original Message----- From: Joe Shaw [mailto:jshaw@insync.net] Sent: Tuesday, November 14, 2000 2:44 PM To: Scott Call Cc: nanog(a)nanog.org Subject: Re: Operational impact of filtering SMB/NETBIOS traffic? It may break some things your customers use, like Exchange mail with NT domain authentication. Also, be aware that Netbios now operates on higher porrts on Win2k and possibly WinME (445/TCP) as well as the 135-139 range. Netbios can also be proxied via 80/TCP now as well, though I think that may only be outbound. People who design protocols like this should be tarred, feathered, and then shot. -- Joseph W. Shaw Sr. Network Security Specialist for Big Company not to be named because I don't speak for them here. I have public opinions, and they don't. On Tue, 14 Nov 2000, Scott Call wrote: > Due to an increasing number of intrusions into windows-based machines > through unprotected shares, I've started filtering both incoming and > outgoing traffic for our customers on ports 138/139. > > So far this has caught a fair amount of traffic coming from customers, > but none have called to complain about a lack of connectivity. > > Because this traffic is IP traffic, I wanted to ask others on this list > how they treat SMB traffic on their backbones?

2 2