December 2002 - NANOG - lists.nanog.org

OT holiday humor: Nasty smell
by Christopher J. Wolff 22 Dec '02

22 Dec '02

I almost fell out of my chair on this kind note from the folks at Daito Communication Apparatus Co. Ltd. I found this funny, perhaps you will too. ---- Note 1: The power supply capacity should be more than the fusing current. If the power capacity is less than the fusing current, the fuse may not blow for a short time, and then nasty smell, smoking and so on may occur. ---- I read this as follows: If my power source drains to the point where the power supply can not power the device at a current higher than the fusing current, the device has a built in "low battery alarm" that consists of blasting the user in the face with a "nasty smell" followed by "and so on" that will occur. I'm concerned about the "and so on" part. I can imagine several so ons including but not limited to: conversion into dark matter, a tear in the space-time-continuum... Happy holidays, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

1 0

RE: AOL & Cogent
by Ringdahl, Dwight (WebUseNet) 21 Dec '02

21 Dec '02

If I were Level3, I'd give them (cogent) a bigger peering pipe, and take the money from the larger, more stable company AOL... Might not be common peering sense, but damn good business sense.... >> Further, if L3/Cogent are settlement-free and both parties are interested >> in growing the size of their peering connections, wouldn't it make better >> sense

2 1

RE: Yahoogroups
by Daryl G. Jurbala 21 Dec '02

21 Dec '02

Yes, 172.16 actually IS RFC1918. Where are you getting that lookup from? I don't seem to be seeing it. And I don't see how router mismanagement would cause a bad name resolution, but maybe I'm not understanding the situation fully. Daryl G. Jurbala WorldNet Technology Consultants, Inc. Sr. Network Engineer Tel: +1.610.288.6200 FAX: +1.508.526.8500 http://www.wtci.net -----Original Message----- From: blitz [mailto:blitz@macronet.net] Sent: Saturday, December 21, 2002 7:33 AM To: nanog(a)merit.edu Subject: Yahoogroups Mail to yahoogroups for two days is giving some strange responses. Mail is attempting to go to 172.16.3.10 when sent to a yahoogroup. This looks real strange....that block is reserved I believe? Wondering why theyre resolving to that address? Router mismanagement? Poisoning? I dont know...but its causing some grief here... Yahoo is real lax in giving some human contact addy, perhaps the esteemed group here can shed some light... Thanks..

1 0

RE: 18.0.0.0/8 RFC1918
by Daryl G. Jurbala 21 Dec '02

21 Dec '02

Oh...must have been caused by a massive power drain from printing out copies of RFC1918. Now it all makes sense. Daryl G. Jurbala WorldNet Technology Consultants, Inc. Sr. Network Engineer Tel: +1.610.288.6200 FAX: +1.508.526.8500 http://www.wtci.net -----Original Message----- From: Matt Braun [mailto:matt@MIT.EDU] Sent: Friday, December 20, 2002 1:28 PM To: jcvaraillon Cc: nanog list Subject: Re: 18.0.0.0/8 A large utility outage followed by failures in secondary systems caused power problems in MIT's POP. My understanding is service has been restored. Matt From: "jcvaraillon" <jcvaraillon(a)dolnet.gr> Date: Fri, 20 Dec 2002 20:02:40 +0200 Errors-To: owner-nanog-outgoing(a)merit.edu Hi, Today the network 18.0.0.0/8 disappeared from the Internet, it is now = reachable. I went to different looking glass (MAE East, LINX, GRnet) and 18.0.0.0/8 = was not in their routing table. Is it related to a major problem? Regards, Christophe

1 0

misbehaving DNS resolvers
by Peter van Dijk 21 Dec '02

21 Dec '02

Hi, over the last week I have been seeing more and more resolvers (all that I know about are BIND but I'm not drawing conclusions yet) send my nameservers more and more *identical* queries, a *lot* of them. Just to keep it short: take a look at http://www.dataloss.nl/dnsoffenders/ and http://www.dataloss.nl/dnsoffenders2/ If you notice any of your boxes in those lists with a high query count (dnsoffenders is measured over about 60-80 minutes, dnsoffenders2 is more like 30 minutes) please contact me. Thank you. Greetz, Peter -- peter(a)dataloss.nl | http://www.dataloss.nl/ | Undernet:#clue http://www.blinkenlights.nl/party/ - birthday party (page in Dutch) all geeks invited - send mail to party(a)blinkenlights.nl for more info

1 1

Fw: Re: White House to Propose System for Wide Monitoring of Internet (fwd)
by Fred Heutte 21 Dec '02

21 Dec '02

I have restrained from saying this so far but... "I told you so." When I attended the Oakland NANOG in October 2001, I had just returned from Washington DC. The trip originally was for my brother's wedding but I extended it for some personal lobbying on the so-called USA PATRIOT bill as it rushed through the process, having not one single public hearing in either the House or Senate. During that time I was continually in contact with the very knowledgeable staff at CDT, EFF and an attorney who is a recognized expert on Fourth Amendment search and seizure law and the 1996 AEDPA anti-terrorism law that laid the groundwork for "Patriot". As a USENIX member and NANOG participant, I had more insight into the practical effect of the sweeping proposals in "Patriot" on actual net operations than the attorneys did. I realized that the "Patriot" law, when passed, would sooner or later entangle network operators in crucial decisions affecting the ability of ordinary users to traverse the net freely as we have always done. I did my best to alert my Oregon congressional delegation to these issues, in personal meetings with their staff on Capitol Hill the first week of October. I've got a lot of background in lobbying but found this very hard to do. Bridging the gap between communications and security policy and operational reality is a difficult matter at best. But still, we have to try. At the Oakland NANOG, following meeting procedure, I sent an email query requesting some discussion of the implications of the "Patriot" bill, which ended up passing late in the month, and received a polite but firm reply from Susan Harris: this was beyond the scope of NANOG. I begged to differ then, and now I suggest that we all give serious thought to the implications that increasing and direct government intervention in the operation of the Net is starting to have. We all want security, but security without liberty runs contrary to the founding principles of the United States. And as Bruce Schneier has emphatically pointed out, security is a process not a product, whether it's a firewall or Total Information Awareness. Avi Rubin observes the issue is not that the potential already exists to do great damage with the Internet. With the advent of ever more potent attacks, from ordinary worms and viruses to Code Red and Nimda to root server DDOS and beyond, that is not disputed. The question is why this capability is not used more often. The restraint from using technology for its maximum destructive potential is the social bonds that we have as human beings. The great benefit of the Internet is that it helps strengthen those bonds, improve our planetary communications, and at its best help us collectively address the issues our societies face. If we do not have the maximum freedom to use the net for those purposes, free of government interference and arbitrary control wherever possible, but consistent with *reasoned and reasonable* security measures, our security will instead be undermined in the long run. That is why the approach and attitude of network operators makes a difference. It mattered at the time of the Oakland NANOG, and it matters now. Perhaps NANOG is not the organizational locale to work these issues out, although I could see it being so. But a coherent response to increasing intrusion of governmental policy on network operations needs to happen, one way or another. You might say, "it's not my job to make policy." And that may be true. It's not a branch librarian or circulation manager's job to make policy either, but they all belong to the American Library Association, which has emerged as an effective champion of real security and real freedom on the Internet, because they are committed to the principle that their primary obligation is to the users of library services. I believe network operators should, and do, take very seriously their primary obligation to the users of Internet services. So I ask my friends in this organization NANOG whose purpose and work I, a mere net user, greatly admire, to consider this question with the greatest thoroughness. When the government (whichever one, not just the US) comes knocking and asking you to do something that restricts the freedom of net users, what will you do? When those in your organization who set policy come asking what it will cost and what it will mean to users to do what the government wants, what will you say? I don't mean to place the entire burden on the shoulders of NANOG and its members. But I do think it's important to consider the obligations that all of us, who have some in-depth knowledge of how the Internet *really* works, have to the users of the Internet, which will ultimately be every last one of us on the planet. thanks, Fred ------ mail forwarded, original message follows ------ From: Valdis.Kletnieks(a)vt.edu <> Subject: Re: White House to Propose System for Wide Monitoring of Internet (fwd) Date: Fri, 20 Dec 2002 14:31:39 -0500 On Fri, 20 Dec 2002 11:31:39 MST, "Wayne E. Bouchard" said: > > On Fri, Dec 20, 2002 at 11:12:43AM -0500, David Lesher wrote: > > > > [This just jumped into the operational arena. Are you prepared > > with the router port for John Poindexter's vacuum? What changes > > will you need to make? What will they cost? Who will pay?] > Heard about this on the news this morning and you know, I am so not > worried about it. > > IMO, it's so completely unfeasable at every level as to be actually > funny. All the same, I suggest you forward the rest of your quite well-reasoned comments to your congresscritter and/or the White House. Remember that the idea was probably propsed by people who have little or no clue of what the actual impact would be - and the final decision will likely be made by somebody with even less technical edge. The truly scary part is that it could actually be approved....

2 1

Re: White House to Propose System for Wide Monitoring of Internet (fwd)
by blitz 20 Dec '02

20 Dec '02

Methinks they'll try the Russian SORM model. Since this country is hell bent on establishing a police-state, this seems logical. Why not use the one thats been developed? http://www.libertarium.ru/eng/sorm/ > > > > :[This just jumped into the operational arena. Are you prepared > > :with the router port for John Poindexter's vacuum? What changes > > :will you need to make? What will they cost? Who will pay?]

1 0

Re: White House to Propose System for Wide Monitoring of Internet
by batz 20 Dec '02

20 Dec '02

On Fri, 20 Dec 2002, Ted Hardie wrote: :"exchange point routing tables" seems to assume that the exchange :point operator is operating at Layer 3. The most popular exchanges at :the moment (PAIX, LINX, EQIX) seem to be layer 2 (GigE) or layer 1 :(fiber strung from cage to cage, you run what you want over same). My mistake, but I was just using routing tables as an example of how the redirection could be done on layer 3. It's important that the layer 3 traffic be redirected so that full sessions can be captured, instead of simply sniffing a span port and hoping that you get everything. >From the perspective of gathering evidence, they just record enough to get a warrant to sieze the machine of the suspect, and all the physical evidence will be there. For example, IDS logs have varying levels of reliability, but their value is that they pinpoint and coroberate the source of physical evidence in the event of an incident. Asymmetric routes cause problems for IDS's that just watch a span port or use a tap, as sessions get lost and alerts can't be correlated as easily. The idea being that a sensor sees a trigger, it alerts, and either the source gets staticly routed to a tunnel interface, or, depending on capacity and where the sensor is located, it just routes the traffics source network through the monitoring network. It's like diverting part of a stream. From what we have been seeing in the papers, it isn't the data collection that is the difficult part anyway, it's the administrative overhead and knowledge management that needs all the resources. When people criticize these plans, they tend to attack the challenges of data collection. I think the technical challenges that data collection poses are overblown and serve as kind of a red herring that diverts attention from the larger ethical (non-operational) problems of data aggregation and response. -- batz

1 0

18.0.0.0/8
by jcvaraillon 20 Dec '02

20 Dec '02

Hi, Today the network 18.0.0.0/8 disappeared from the Internet, it is now reachable. I went to different looking glass (MAE East, LINX, GRnet) and 18.0.0.0/8 was not in their routing table. Is it related to a major problem? Regards, Christophe

3 3

Re: White House to Propose System for Wide Monitoring of Internet (fwd)
by Richard Irving 20 Dec '02

20 Dec '02

Freud, your slip is showing ? :P "Robert E. Seastrom" wrote: > Richard Irving <rirving(a)onecall.net> writes: > > In analogy: We can adjust the flows of the Hoover > > (remember him ?) Damn, we cannot however stop to count > "damn" is an expletive, "dam" is a noun. :) > ---rob

1 0