May 2004 - NANOG - lists.nanog.org

Re: Spring time fiber cuts (was Re: fiber cut 19 May/PM -> 20 May /AM)
by David Lesher 24 May '04

24 May '04

Speaking on Deep Background, the Press Secretary whispered: > > > > It's worth noting that just because you have a working protect > doesn't mean it isn't wdmed or muxed onto the same fiber. If it is > supposed to be a widely divergant path, latency can provide a clue, > but in the majority of cases as the customer you can't really tell if > they've given you the protect you asked for or not. WhatHeSaid. A friend runs an important netverk for Uncle Sam. They spend [BIG $$$] every ?year? forcing this issue with Ma's Bastard Kids and other Usual Suspects. It's a Royal PITA to do so, but they do the deed. (One way is contract language requiring that diversity, then demanding actual trunk # data... and pointing out the defn of "fraud"... In case anyone thinks otherwise, let me say you do NOT want to commit provable fraud against Mr. Suspenders. You can well go Up The River and I don't mean for visiting day. Not likely you say? That depends on who you do it to, and how serious the issue is.) -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

Roadrunner network human contact?
by Alan Sparks 24 May '04

24 May '04

Can anyone tell me the best way to contact a real network person at Roadrunner? I need to talk to someone about a problem with their DNS servers, but trying to get a real person via hostmaster, postmaster, or abuse addresses seems futile. Get autoresponders and no human responses for last two weeks. Thanks. -Alan -- Alan Sparks, Sr. UNIX Administrator asparks(a)quris.com Quris, Inc. (720) 836-2058

1 0

RE: Lots of big web sites broken...SPOF
by netadm 24 May '04

24 May '04

Just got off the phone with their NOC. It is a system-wide problem that "looks like it may be a DOS attack". They have no ETA as to a resolution yet. -----Original Message----- From: Joseph Nuara [mailto:joe@moorecap.com] Sent: Monday, May 24, 2004 9:09 AM To: nanog(a)merit.edu Subject: Re: Lots of big web sites broken...SPOF Any idea on the cause or the ETA to restoration of service? On Mon, 24 May 2004, Jon Lewis wrote: > > Ok...who turned off Akamai? :) > > Sites that use Akamai for serving their images all seem to be pretty > much broken this morning. From here, I'm seeing multiple Akamai > servers on multiple networks just not responding to HTTP. They accept > connections (some after much delay), but don't reply to requests. > > ---------------------------------------------------------------------- > Jon Lewis *jlewis(a)lewis.org*| I route > Senior Network Engineer | therefore you are > Atlantic Net | > _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________ >

1 0

ntp config tech note
by Randy Bush 24 May '04

24 May '04

sorry to take you away from discussing spam with an actual tech note, but twice this morning i have hit incidents where much needed ntp clients were blown. so, as i was gonna have to write it up, i figured i would bore you all with it. --- ntp config hint 2004.05.20 ntpd will not work if your clock is off my a few minutes. it just sits there forever with its finger in its ear. so, at boot, before you start ntpd, use ntpdate to whack your system's time from a friendly low-numbered strat chimer. do not background ntpdate with -b, because, if it is slow to complete, ntpd can't get the port when you try to start it next in the boot sequence. if ntpdate takes a minute and thus adds to your boot time, then something is wrong anyway; fix it. in case your dns resolver is slow, servers are in trouble, etc. have an entry for your ntpdate chimer in /etc/hosts. yes, i too hate /etc/hosts; but i have been bitten without this hack; named is even more fragile than ntpd. once ntpdate has run, then and only then, start your ntpd. and read all the usual advice on configuration, selection and solicitation of chimers with which to peer, ... and then, if having accurate time on this host is critical, cron a script which runs `ntpq -c peers` and pipes it to a hack which looks to be sure that one of the chimers has a splat in front of it. run this script hourly, and scream bloody hell via email if it finds problems. --- now back to your regular spam discussion. /* yes, spam is an important issue. but, if your local organization, this mailing list, ... gets swamped with discussions of spam, then the spammers have won. you have to compartmentalize it, in your organization and in the general net culture. that's why there are separate mailing lists for spam, ddos, and other net crap with which we have to deal. that's why we have more than one mailing list in the world, to compartmentalize so we can focus. */ randy

23 35

RE: Spring time fiber cuts (was Re: fiber cut 19 May/PM -> 20 May /AM) (fwd)
by Hannigan, Martin 24 May '04

24 May '04

..and you can deploy SONET without a protect. -M -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Stephen J. Wilcox Sent: Sunday, May 23, 2004 4:48 PM To: nanog(a)merit.edu Subject: Spring time fiber cuts (was Re: fiber cut 19 May/PM -> 20 May/AM) (fwd) On Thu, 20 May 2004, Dan Armstrong wrote: > Forgive me, but > > Isn't Sonet usually deployed in a ring? Why the heck would a fiber this > important not be? Fibre != Sonet (L1 vs L2) Fibre is deployed in strands Steve

3 2

RE: Spring time fiber cuts (was Re: fiber cut 19 May/PM -> 20 May/AM) (fwd)
by McBurnett, Jim 24 May '04

24 May '04

> ..and you can deploy SONET without a protect. -and telcos usually do. but they almost always tell you it's protected. -force them to test, or pull one side yourself. and repeat the test every -quarter. -randy And if you find it is on a fiber mux-- DDM 1000, good luck.. a few years ago I spent at least 20-30 hours trouble shooting 4 t-1's to customers on a "redundant mux" going to an older but large business park. They seem to all drop within 5 minutes of each other. Bell claimed it to be us. long story short-- the protect was broken and we found out it had been so for months. all the data circuits (22 of em) seemed to experience 4-5 seconds are strangness daily... and the 1 voice customer on that OC-3 went to POTS because of the problems..... Moral of the story-- Having a SONET ring, a protect, and all manner of things, may not really help.... Unless it really and truly does work.... J

1 0

Misplaced laptop
by Susan Harris 24 May '04

24 May '04

A Dell Latitude that was left briefly in the terminal room late this afternoon has gone missing. Any info about its whereabouts would be appreciated - please send mail to me or to nanog-support(a)nanog.org.

1 0

Real and Multicast broadcast information.
by Joel Jaeggli 23 May '04

23 May '04

For information on the Real broadcast see: http://www.nanog.org/mtg-0405/network.html#real Multicast: Nanog 31 will be multicast live from San Fransisco. We're changing the stream for this meeting, in that it will be an ISMA MPEG-4 standard multicast stream using the AAC audio codec at 250Kb/s. The stream should be of similar visual quality to the 1Mb/s MPEG-1 stream! Recommended free clients are Quicktime for Windows or Macintosh and MPlayer on Linux or *BSD. The VideoLAN client is able to play back the video on all platforms but the AAC audio properly on only a few of them. The multicast sources are: MPEG-4 (ISMA MPEG-4 250kb/s) http://videolab.uoregon.edu/nanog31.sdp * Video IP Address: 224.2.174.81 * Video UDP Port: 51314 * Audio IP Address: 224.2.174.82 * Audio UDP Port: 28256 Please send feedback or questions about the multicast session to nanog-support(a)nanog.org , multicast(a)lists.uoregon.edu. -- -------------------------------------------------------------------------- Joel Jaeggli Unix Consulting joelja(a)darkwing.uoregon.edu GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F 56B2

1 0

Spring time fiber cuts (was Re: fiber cut 19 May/PM -> 20 May/AM) (fwd)
by Stephen J. Wilcox 23 May '04

23 May '04

On Thu, 20 May 2004, Dan Armstrong wrote: > Forgive me, but > > Isn't Sonet usually deployed in a ring? Why the heck would a fiber this > important not be? Fibre != Sonet (L1 vs L2) Fibre is deployed in strands Steve

1 0

66.164.232.0/24 HI-JACKED, I need some help
by P.Schroebel 23 May '04

23 May '04

Hello Folks, I have tried everything but keep running into walls, someone has hi-jacked a block 66.164.232.0/24 and is routing it out of Ga. They come online, we catch heck, they go offline and so it goes. I have called everyone and can't seem to get anyone to take the route out of their session. Can anyone in Nanog help out here, please. Sincerely, Peter BGP routing table entry for , version 46510837 Paths: (4 available, best #2, table Default-IP-Routing-Table) Not advertised to any peer 209 19262 6350 30174 <-----------------OK THIS IS US ;-) 165.117.201.58 from 165.117.201.58 (205.171.0.124) Origin IGP, metric 100, localpref 100, valid, external Community: 2548:666 701 6389 6197 (HI-JACKED BLOCK 66.164.232.0/24) <------- BAD NEWS 204.255.169.61 (metric 342) from 165.117.162.200 (165.117.162.200) Origin IGP, metric 100, localpref 100, valid, internal, best Community: 2548:666 Originator: 165.117.162.10, Cluster list: 165.117.162.200 701 6389 6197(HI JACKED OUR IPS) 204.255.169.61 (metric 342) from 165.117.162.201 (165.117.162.201) Origin IGP, metric 100, localpref 100, valid, internal Community: 2548:666 Originator: 165.117.162.10, Cluster list: 165.117.162.201 701 6389 6197 (HI JACKED OUR IPS) 204.255.169.61 (metric 342) from 165.117.162.202 (165.117.162.202) Origin IGP, metric 100, localpref 100, valid, internal Community: 2548:666 Originator: 165.117.162.10, Cluster list: 165.117.162.202, 165.117.162.200 AS6197 -------------------------------------------------------------| \/ OrgName: BellSouth Network Solutions, Inc OrgID: BNS-14 Address: 1100 Ashwood Parkway, Suite 200 City: StateProv: GA PostalCode: Country: US ASNumber: 6197 ASName: BATI-ATL ASHandle: AS6197 Comment: RegDate: Updated: 1996-01-04 TechHandle: WD14-ARIN TechName: Dawson, Willard TechPhone: +1-770-814-5099 TechEmail: willard.dawson(a)sbs.siemens.com **There is a old timer that answers the phone and has no idea what is going on; he mops the floors in the switch gear room. AS6389. http://ws.arin.net/cgi-bin/whois.pl No match found for AS6389 !! However . . ASNumber: 6380 - 6389 ASName: BELLSOUTH-NET-BLK ASHandle: AS6380 Comment: RegDate: 1996-03-28 Updated: 2001-01-03 TechHandle: DR791-ARIN TechName: Ringen, Deron TechPhone: +1-678-441-7919 TechEmail: bgpadmin(a)corp.bellsouth.net OrgAbuseHandle: ABUSE81-ARINOrgAbuseName: Abuse Group OrgAbusePhone: +1-404-499-5224OrgAbuseEmail: abuse(a)bellsouth.net OrgTechHandle: JG726-ARIN OrgTechName: Geurin, Joe OrgTechPhone: +1-404-499-5240 OrgTechEmail: ipoperations(a)bellsouth.net

3 2