May 2001 - NANOG - lists.nanog.org

noc list fixed
by Jared Mauch 14 May '01

14 May '01

as a number of people may have noticed the noc listing that i provide at http://puck.nether.net/netops/ has been broken since yesterday. it's now back up. I'm also wondering if it would be useful to have something to search the list as it's getting quite long these days. please provide feedback on that and other items related to the page(s) and content to me directly. apologies for it being down for so long. forgot to uncomment the correct line in the httpd.conf after an upgrade :( - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

Anybody from gblx here ?
by Clemens Zauner 14 May '01

14 May '01

We have a problem reaching Hosts where packtes traverse AS3549 (GBLX.NET) for instance a hosting in .au [202.174.228.90] bgp AS path to destination: 8918 3549 4648 2764 9240 is *not* reachable here - looks like there is some kind of filter active (problem started 5 days ago) vienna->australia ... 7 gigabitethernet1-0.lon-ixr-01.carrier1.net (212.4.193.42) 31 ms 32 8 fe3-0-0.ar1.lon2.gblx.net (195.66.224.112) 30 ms 34 ms 32 ms 9 pos5-0-622M.cr1.LON3.gblx.net (208.49.136.53) 35 ms 37 ms 34 ms 10 * * * Case # at Carrier1 is: 49908 Sorry for bothering the whole list, but as I cant reach the gblx Mailexchangers and the contact phone number given by whois is only an 0800 (*please* US NOCs ... there are other parts of the world too and US 0800's are not valid phone numbers here, thank you for paying attention) cu Clemens. -- /"\ / The race to maintain an up-to-date \ / ASCII RIBBON CAMPAIGN / system is long and, in the end, it's X AGAINST HTML MAIL / only with yourself. / \ AND POSTINGS / (Ben(a)lspace.org)

2 1

Re: People who purchase unproven technologies to support their Business, and whine about it. RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by Hunter Pine 14 May '01

14 May '01

You really need to do your math. - 768x2 = 1536. DSL is full duplex. And yes, DSL HAS been around for 20 years. The need for broadband at inexpensive prices to the public at large has not been necessary until now, and it's expensive to set up dslams at all these phone company CO's. Not to mention that the phone companies, until recently, had a monopoly on the industry, and weren't about to introduce an inexpensive broad band solution to the public when they could make a killing off of T1 loops. /H ----- Original Message ----- From: "Robert Gibson" <wa3pxx(a)pimmitrun.com> To: "Hunter Pine" <hunter(a)compuhelp.com> Sent: Monday, May 14, 2001 8:03 AM Subject: Re: People who purchase unproven technologies to support their Business, and whine about it. RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS > A T1 is capable of 1.55MB/s in each direction, so a dull 768DSL would only > do about 1/2 the data capablity. DSL has not been around for 20 years, so > that is not correct either. > Bob Gibson > > On Mon, 14 May 2001, Hunter Pine wrote: > > > > > You are aware that a good percentage of the T1's you purchase nowadays are > > just a pair of bonded 768 dsl lines, right? The phone companies have been > > doing that for over 20 years to save on copper. > > > > Hunter Pine > > Vice President, Network Operations > > hunter(a)compuhelp.com > > > > ----- Original Message ----- > > From: "Joe Marr" <jmarr(a)twmaine.com> > > To: "'John Palmer (NANOG Acct)'" <nanog(a)adns.net> > > Cc: <nanog(a)nanog.org> > > Sent: Sunday, May 13, 2001 9:31 PM > > Subject: People who purchase unproven technologies to support their > > Business, and whine about it. RE: To CAIS Engineers - WAKE UP AND TAKE CARE > > OF YOUR CUSTOMERS > > > > > > > > > > Why would anyone purchase dsl to run their business on. Let me guess, the > > > price was right. > > > > > > > > > -----Original Message----- > > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > > > Alex Rubenstein > > > Sent: Sunday, May 13, 2001 9:03 PM > > > To: John Palmer (NANOG Acct) > > > Cc: nanog(a)nanog.org > > > Subject: Re: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS > > > > > > > > > > > > Welp, you are the one who picked xDSL for your business... > > > > > > > > > > > > On Sun, 13 May 2001, John Palmer (NANOG Acct) wrote: > > > > > > > > > > > <FLAME ON> > > > > > > > > It has been a trying time at CAIS in the last few days, I'm sure. > > > > > > > > PSINet dumped all of their DSL customers onto CAIS. Covad is the > > backhaul > > > > provider for them both. Need I say more? > > > > > > > > Bottom line, I dont know how many thousands of people were without > > service > > > > for more than a day because the whole transfer was botched. > > > > > > > > We have a situation where we had a DSL connection from PSI and were > > using > > > > our own IP addresses. Problem is that no one changed the > > > > routing tables and the packets dead-ended at PSI. > > > > > > > > Getting CAIS to fix this problem has been a nightmare. At first, PSI > > didnt > > > > stop announcing the routes and now that they have, it seems that > > > > CAIS will not announce the routes till Monday becuase "no one at our NOC > > > > knows how to do this and the one guy (ONE GUY IN THE WHOLE > > > > COMPANY - AND THEY ARE A NATIONWIDE PROVIDER????) who knows how doesn't > > > work > > > > weekends." > > > > > > > > Bottom line from CAIS:" S***W the customers, we dont work weekends. We > > > don't > > > > care that your entire business has been dead in the water since > > > > Wednesday, you can go to H**L, we'll get to it Monday, if we feel like > > > it." > > > > > > > > Our lawyers are looking at what actions we can take against them. It may > > > be > > > > trickey, but we will try. > > > > > > > > Needless to say, we will be moving our connection. I have some choice > > > words > > > > for them when they send us our first monthly bill, which I'm certain, > > they > > > > will do on weekends just fine. > > > > > > > > IF SOMEONE IS THERE AT CAIS - GET OFF OF YOUR LAZY A** AND PUT THOSE > > > > ANNOUNCEMENTS INTO YOUR BGP4 > > > > TABLES TODAY (NOT MONDAY, NOT LATER IN THE WEEK)- THERE ARE ABOUT 6 OF > > > YOUR > > > > CUSTOMERS (NOT JUST US) > > > > WHO ARE DEAD IN THE WATER BECAUSE YOU ARE TOO LAZY TO DO A 20 SECOND > > JOB. > > > > > > > > <flame off - sorry to the list for being so loud> > > > > John > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >

3 2

Re: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by John Palmer (NANOG Acct) 14 May '01

14 May '01

>* Roeland Meyer <rmeyer(a)mhsc.com> [20010513 13:45]: >> >> None of the DSL ISPs can do larger than /27 anymore, even when they're >> ILECs. >What does being an ILEC have to do with layer 3 routing? > >'sides there are plenty of DSL ISPs that offer larger than a /27. Heck, I >count some of them among my clients who consist primarily of smaller >regional players. If you are looking for more major player examples that >offer larger IP blocks: Actually we have a /23 block that PSINet was routing just fine. A lot of people complain about the DSL technology itself, but I don't think the technology is the problem, but the competence (or lack of it) amongst the major players. All of our problems have not been related to the DSL technology itself, but rather the screwups of the providers. John

3 4

RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by Roeland Meyer 14 May '01

14 May '01

> From: John Murphy [mailto:nanog@mail.murfnet.com] > Sent: Sunday, May 13, 2001 8:07 PM > > I'm sorry Roeland, but your statement about SWIP'ing anything > less than a > /24 is just inaccurate. We SWIP /29s and /30s daily, for > both our Frame > and our DSL customers. Tell it to SpeakEasy.

2 1

RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by Roeland Meyer 14 May '01

14 May '01

> From: Adam McKenna [mailto:adam@flounder.net] > Sent: Monday, May 14, 2001 1:23 AM > > On Mon, May 14, 2001 at 12:42:54AM -0700, Roeland Meyer wrote: > > > > Oracle (try and build a DB without reverse working right. > > > Net8 stops you > > > > dead in your tracks). > > > > > > Sorry, but this is just 100% wrong. I've set up Oracle on > > > many boxes and you > > > don't need any DNS at all to set up an oracle DB. In fact, I > > > tell our DBA's > > > to use IP addresses in their TNSNAMES.ORA files because I > > > don't want the DB > > > depending on DNS. > > > > Let's see, I don't want to make my DBs dependent on DNS, so > I use IP addrs. > > Yet, I can't depend on IP addrs because my upstream might have to be > > changed... damn, I shouldn't have depended on my scumbag > DSL upstream, eh? > > I believe we've been through this discussion before. Yeah, you and I keep dancing around the same bush. My point is that, nothing is real good by you. One day, names are no good and later, addrs are no good. That's a flip-flop worthy of Bill Clinton. Looking at each specific case, you come up with answers, which may be absolutely the best answer for that case, which may also absolutely contradict another specific case. But, since the two of them are invariably conjoined, you have two contradictory and mutually exclusive answers... for the same thing. Therein, lays my frustration. > > Gee, maybe I should have had a names based system after > all? Either way, I > > wind up having to rebuild Oracle boxen and application > servers, every time > > somebody farts. Just what in blue hell are we supposed to do? > > Maybe you should get a clue, or hire someone who has one. Tried both, it appears non-soluble, at the moment. > > BTW, the last I checked SSL certs are usually names based. > Pretty slack > > security, eh? > > Yes. See > http://cr.yp.to/djbdns/bugtraq/19991114052453-12962-qmail@cr-yp-to > and http://cr.yp.to/djbdns/forgery.html Read the caveats.

2 1

RE: PSI, CAIS, etc..
by Murphy, Brennan 14 May '01

14 May '01

To support what Lee said, I got a notice today from Internap: Internap has determined that PSINet does not meet the service and quality requirements for Internap Service Point connectivity providers. For this reason, Internap will be removing PSINet from our border fabric. PSINet will be accessible via our Service Points over our other connectivity providers. Internap network engineers will be removing PSINet from our border fabric on Monday, May 14 after 22:00 local time. Impact to customers connected to the service point will be limited to a brief period of route reconvergence. Please direct general questions regarding PSINet's removal from Internap's border fabric to your Internap sales account manager. Please continue to direct questions of a technical nature to the Internap NOC. Regards, Krista ---------------------------------------------------------------------------- Krista Horstman EMAIL: noc(a)internap.com Senior Manager, Network Operations NOC: (206) 256-9500 / Internap Network Services (877) THE-INOC Two Union Building OFFICE: (206) 441-8800 -----Original Message----- From: Lee Watterworth [mailto:lwatterworth@rim.net] Sent: Monday, May 14, 2001 8:29 AM To: 'nanog(a)nanog.org' Subject: PSI, CAIS, etc.. The impending doom of PSI has been a foul stench in the air for quite some time now -- how many of you still rely on PSI as your primary (or only) uplink provider? Whether your connection is a T1 or a xDSL, you will likely run into problems similar to what mr Palmer did -- botched cutovers, etc. Maybe its time for the few of you to look for a new uplink provider. I was almost a PSI customer. -Lee ---------------------------- Lee Watterworth, lee(a)rim.net Data Network Specialist Research In Motion 519-888-7465 x 2610 ---------------------------- Tent, Beer, Sleeping Bag, Firewood, Blackberry

1 0

RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by Roeland Meyer 14 May '01

14 May '01

> From: John Fraizer [mailto:nanog@Overkill.EnterZone.Net] > Sent: Monday, May 14, 2001 1:33 AM > On Mon, 14 May 2001, Roeland Meyer: > > Yet, I can't depend on IP addrs because my upstream might have to be > > changed... damn, I shouldn't have depended on my scumbag > DSL upstream, eh? > > Gee, maybe I should have had a names based system after > all? Either way, I > > wind up having to rebuild Oracle boxen and application > servers, every time > > somebody farts. Just what in blue hell are we supposed to do? > > Um, lets see...how about this. You use NAT. That'll be > $180.00 please. > I'll send you an invoice. Good luck, some critical stuff can't NAT. Send it, I'll file it in the appropriate receptacle. > > BTW, the last I checked SSL certs are usually names based. > Pretty slack security, eh? > > Slack, no. You're comparing apples to oranges here and > HOPEFULLY, you know > it. Basing security on IN-ADDR is absolutely idiotic. Agreed, but some code requires it. Which was my point. I'm talking smaller vendors, like Oracle. BTW, how do I fake in-addr.arpa responses for NAT'd space? My Oracle 8i server keeps checking the reverse addr every time I try to create a DB. It's really annoying. Funny thing, my DB2 servers do the same thing ... > Basing security on IP addresses on the other hand is while > not a complete > security solution, MUCH MORE SOUND than IN-ADDR. You can at least build > ACLs in your router(s) that don't allow spoofed traffic to enter your > network. Then, why bother with DNS? This becomes a real problem with non-portable IP blocks. My point remains, names are more portable than IP addrs. > Now, about the SSL security thing. SSL > certification is designed > to certify the identity of the server and that identity is > based on the > FQDN. SSL CERTs are around for the PRECISE reason that it is > too easy to spoof IN-ADDR, etc. I agree, and always have, that reverse is easy to spoof. However, breaking reverse is guaranteed to make some things fail. Some of those things are proprietary code, owned by someone else, that I don't have sources for (and which I paid a lot of money for). No, I don't have any clout with Oracle (any more than you do, with Bill Gates). > > This is right on up there with: > > > > 1) You idiot DSL monkey, you deserve your Inet death > because you didn't > > multi-home. > > 2) No, you can't advertise less than a /20. > > 3) No, you don't deserve larger than a /32. > > 4) Yes, we know that makes multi-homing impossible for > those that need it > > the most. > > 5) No, we don't care, you idiot DSL monkeys deserve Inet death. > > > > Yeah, the message you send out is real clear. > > ... and one wonders why the Internet has an implosion problem... > > And that's right up there with "<plonk!> me please! I'm an idiot DSL > monkey! WAAAAAAAAAA! My DSL provider went tits-up and I > hadn't built any > contengency plan. I'm going to go bankrupt! WAAAAAAAAA!" I'm glad you enjoyed that, it was supposed to be funny. BTW, DSLnetworks is still in business...how (if they're so bad)? But, that wasn't the point. The point is that many of us, on the end-points, are being hung out there without recourse. How do we multi-home to different providers when routing gets munged as a guaranteed side-effect? > If your business depends (depended) on stable and reliable internet > connectivity with your own (or at least non-changing) address > space, might > I suggest that you should have gone to ARIN for a microblock > of address > space and established a contengency plan with some other > provider(s) in > the event that the sky fell? I've been trying to do that for years. Minor technical difficulties keep getting in the way, like routability. I can get the /24, already have the ASN, but can't get it routed. If it's so easy, how come you haven't done it yet?

3 2

RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by Roeland Meyer 14 May '01

14 May '01

> From: Frank Rizzo [mailto:rizzo@drunkagain.org] > Sent: Sunday, May 13, 2001 3:09 PM > > On Sun, May 13, 2001 at 02:20:28PM -0700, Roeland Meyer wrote: > > > > I've had similar problem at SpeakEasy. They still don't > have a reverse-DNS clue. > > > > http://www.mhsc.com/recovery.htm > > > > None of the DSL ISPs can do larger than /27 anymore, even > when they're > > ILECs. Anything less than a /24 can't be SWIP'd and if you > don't control > > your in-addr.arpa entries you don't control your domain and have no > > security. > > wow, relying on dns for security is pretty freaking ignorant, > and so are you appearantly. that's okay, i'll shut up now because i'll be > busy playing with my reverse dns to get your hosts to trust me! Gee, I wish you knew what you were talking about. Basic security starts with reverse, see tcp_wrappers, SSH, Oracle (try and build a DB without reverse working right. Net8 stops you dead in your tracks). Half of my ACLs don't work right because reverse isn't correct. > ps - 32/27.0.168.192.in-addr.arpa., learn it, love it, live it. Thu May 10 22:59:09 [root:2]#> ps - 32/27.0.168.192.in-addr.arpa. ERROR: Garbage option.

3 2

PSI, CAIS, etc..
by Lee Watterworth 14 May '01

14 May '01

The impending doom of PSI has been a foul stench in the air for quite some time now -- how many of you still rely on PSI as your primary (or only) uplink provider? Whether your connection is a T1 or a xDSL, you will likely run into problems similar to what mr Palmer did -- botched cutovers, etc. Maybe its time for the few of you to look for a new uplink provider. I was almost a PSI customer. -Lee ---------------------------- Lee Watterworth, lee(a)rim.net Data Network Specialist Research In Motion 519-888-7465 x 2610 ---------------------------- Tent, Beer, Sleeping Bag, Firewood, Blackberry

1 0