- NANOG - lists.nanog.org

Re: India cites security concerns, blocks Huawei bid to expand their indian ops
by Brandon Butterworth 17 Aug '05

17 Aug '05

> The Huawei probe illustrates the uneasy relationship between China and > India. They don't have much choice who to trust when India owns most of the fibre and China supplies most of the kit brandon

1 0

Fixing .com DNS glue records - who to contact?
by Matthew Elvey 17 Aug '05

17 Aug '05

A glue record for a .com domain (nextbus.com) is wrong, and I'm running into a brick wall trying to get it fixed. Do I need to switch to a more clueful registrar than GoDaddy**? Contact Network Solutions? Have I screwed up the domain's bind config? Everything looks right when I _dig_ around the authoritative NS*... I futzed with the record (deleted and re-added ns.nextbus.com as an authoritative NS (nameserver(s))), and the glue became correct for several days (dnsreport.com even reported all was well) AND THEN WENT BACK TO BEING BROKEN AGAIN. http://www.dnsreport.com/tools/dnsreport.ch?domain=nextbus.com currently says: ns.nextbus.com.: Parent server (f.gtld-servers.net) says A record is 64.164.28.194, but authoritative DNS server (209.204.159.20) says it is 64.142.39.200 ns.nextbus.com.: Parent server (f.gtld-servers.net) says A record is 64.164.28.194, but authoritative DNS server (64.142.88.72) says it is 64.142.39.200 ns.nextbus.com.: Parent server (f.gtld-servers.net) says A record is 64.164.28.194, but authoritative DNS server (69.9.186.104) says it is 64.142.39.200 ALSO: Since 3 of the 4 NS don't have the wrong glue, and 4 of the 4 NS are answering appropriately, and there's no NS at the IP indicated by the wrong glue, this problem shouldn't have any user-visible impact, right? I think there are many ISPs (I've found Earthlink and SBC to be guilty of this in the past) who have broken their resolver configurations so that they sometimes don't work if one, but not all of a domain's NS don't answer. Anyway, I'm getting complaints (from a gov't agency) of mail bouncing with '450 Client host rejected: cannot find your hostname' errors. TIA. This is my first post here; please be gentle. Oh, and if I do need a new registrar, I'm taking suggestions here or here: http://wiki.fastmail.fm/index.php/GoodRegistrarSearch *dig nextbus.com MX dig nextbus.com MX @ns.nextbus.com. dig nextbus.com MX @a.auth-ns.sonic.net. dig nextbus.com MX @b.auth-ns.sonic.net. dig nextbus.com MX @c.auth-ns.sonic.net. **edited to conform to normal attribution. WARNING: C&C. Subject: [Fwd: Please fix this Mismatched glue problem for domain nextbus.com [Incident: 050729-000962]] Me: > Go Daddy: >> Me: >>> Please fix this Mismatched glue problem for domain nextbus.com: >>> >>> ERROR: Your nameservers report glue that is different from what the >>> parent servers report. This will cause DNS servers to get confused; >>> some >>> may go to the IP provided by the parent servers, while others may >>> get to >>> the ones provided by your authoritative DNS servers. Problem >>> record(s) are: >>> >>> ns.nextbus.com.: >>> Parent server (m.gtld-servers.net) says A record is 64.164.28.194, but >>> authoritative DNS server (208.201.224.11) says it is 64.142.39.200 >>> ns.nextbus.com.: >>> Parent server (m.gtld-servers.net) says A record is 64.164.28.194, but >>> authoritative DNS server (208.201.224.33) says it is 64.142.39.200 >>> >>> The glue in the parent servers is wrong. >> >> Thank you for contacting customer support. >> >> I have tested your site and everything is resolving properly. This >> error message you are getting is not on our end. >> >> Please let us know if we can help you in any other way. >> >> <Advertisement for GoDaddy services removed> >> >> Sincerely, >> >> Beth P. >> GoDaddy.com >> Customer Service Representative > > Please have this issue reviewed by someone technical - someone who knows > what DNS glue is, so they can understand the error in my initial email. > See > http://www.menandmice.com/online_docs_and_faq/glossary/glossarytoc.htm?glue… > > or http://www.centralnic.com/support/glossary > > http://www.dnsreport.com/tools/dnsreport.ch?domain=nextbus.com > shows quite clearly IN RED that there is something seriously wrong. > The problem exists. It is NOT my imagination. > Just because you're able to bring up www.nextbus.com does NOT mean > there's nothing wrong. Thank you for contacting customer support. I have looked into this situation and found that the domain name in question is not hosted with us. This being the case you may wish to speak with your hosting provider regarding the "glue" situation. Please let us know if we can help you in any other way. <Advertisement for GoDaddy services removed> <https://www.godaddy.com/gdshop/hosting/landing.asp?isc=webxpf> Sincerely, Kade P. -- Matthew http://wiki.fastmail.fm/index.php/MrElvey

6 7

Facing problem useing v.92 modem with As5300 access server
by Md. Kamal Hossain 17 Aug '05

17 Aug '05

Dear all we are using a As5350 access router.Everything is running well with old modem like v.90 or v.34 but with v.92 modem it is not working well.When we using v.92 modem its connect speed is verry slow and the connection disconnect every 5 min.If any one who have idea pls advice me how i will solve the problem. Thanks in advance Md. Kamal Hossain System Administrator -- This message has been scanned for viruses and dangerous content, and is believed to be clean.

1 0

RE: zotob - blocking tcp/445
by Church, Chuck 17 Aug '05

17 Aug '05

On Mon, 15 Aug 2005, Church, Chuck wrote: > > > >'enterprise security folks' are probably not the issue... The fact > remains > >that lots of folks DO do this :( There are quite a few folks between > >'consumer' and 'enterprise' that do all manner of dumb things on the > >Internet (where 'dumb' is equivalent to running smb shares across the > >public network minus encryption/ipsec). It's their choice to do that, > and > >their network providers are expected/demanded to pass those packets for > >them. > > >-Chris > > Surely the ratio of 'useful' traffic compared to 'junk' for a particular > protocol must be considered. What percentage of netbios entering a on your piece of the network you can consider the ratio of pigs to birds, or good to bad traffic or phases of the moon, it's your network do what you will. I can say that if you have a vocal enough customer the blocks won't last very long, or the customer will find another network to connect to... *** Rules are going to be different for residential vs. business customers. Business customers who aren't on crack probably know better to block netbios in and out. But residential customers, I think you'll win more customers than lose by taking some proactive blocking measures. > service provider's edge is intentional? 1%? 0.1%? I'm guessing much > less than that. If 5 or 6 nines worth of a particular protocol entering > or leaving an ISP's network is unintentional, and highly susceptible to > viral activity, isn't it in our best interest to block it? With proper your best interest might be to do that sure... 'your network, your call'. > notification to subscribers and instructions on setting up host-to-host > PPTP/whatever, blocking netbios can solve a large bunch of issues.... > please send my instructions for host-to-host pptp that my grandmother can follow without help of techsupport. *** Well, if you grandmother is already familiar with mapping drives and modifying her lmhosts file.... :)

4 3

Looking for TM.NET.MY Contact
by Jim Jagielski 17 Aug '05

17 Aug '05

Since they peer with others at Equinix, I am looking for someone from tm.net.my to contact me. They are advertising bogus routes for my ip space (209.133.192.0/19), causing traffic which passes through Equinix to (a lot of the time) get diverted to their network and drop and die when the packets hit their AT&T connection. EG: 8 a1-00-00-00.p0.lax91.adelphiacom.net (66.109.3.130) 58.736 ms 58.770 ms 58.804 ms 9 LAX-GE1.tm.net.my (206.223.123.94) 58.727 ms 58.603 ms 58.737 ms 10 219.93.168.233 (219.93.168.233) 283.962 ms 284.899 ms 284.316 ms 11 vlan550-brf-sw03.tm.net.my (219.93.151.209) 284.225 ms 284.144 ms 284.773 ms 12 219.93.174.145 (219.93.174.145) 284.491 ms 337.796 ms 378.834 ms 13 210.187.142.5 (210.187.142.5) 284.120 ms 219.93.151.97 (219.93.151.97) 285.450 ms 219.93.151.103 (219.93.151.103) 284.776 ms 14 210.187.15.254 (210.187.15.254) 285.943 ms 203.106.230.134 (203.106.230.134) 286.894 ms 210.187.15.254 (210.187.1 5.254) 288.102 ms 15 202.188.126.132 (202.188.126.132) 286.384 ms 286.476 ms 287.241 ms 16 219.93.173.37 (219.93.173.37) 277.918 ms 219.93.173.133 (219.93.173.133) 277.521 ms 219.93.173.37 (219.93.173.37) 277.503 ms 17 219.93.153.150 (219.93.153.150) 277.848 ms 277.295 ms 277.519 ms 18 12.119.139.37 (12.119.139.37) 276.814 ms !X * 276.567 ms !X When using http://www.myloca.net/cgi-bin/trace/index.pl, all AT&T traffic appears to be misdirected as well. -- ======================================================================= Jim Jagielski [|] jim(a)jaguNET.com [|] +1-410-420-0140 (Cell: +1-443-324-8390)

1 0

Re: Fixing .com DNS glue records - who to contact?
by Matthew Elvey 16 Aug '05

16 Aug '05

//Hi, William! william(at)elan.net wrote on Aug 16 : > ------------------------------------------------------------------------ > On Tue, 16 Aug 2005, Matthew Elvey wrote: > > > > A glue record for a .com domain (nextbus.com) is wrong, and I'm > running into a brick wall trying to get it fixed. > Do I need to switch to a more clueful registrar than GoDaddy**? > Contact Network Solutions? > Have I screwed up the domain's bind config? Everything looks right > when I _dig_ around the authoritative NS*.. > I futzed with the record (deleted and re-added ns.nextbus.com as > an authoritative NS (nameserver(s))), and the glue became correct > for several days (dnsreport.com even reported all was well) AND > THEN WENT BACK TO BEING BROKEN AGAIN. > <digs showing correct results from my server and the wrong results from a gTLD server snipped> Yup, just as I kept saying to GoDaddy: The glue in the parent servers is wrong. > > So the answer is that you need to make sure your own dns server "A" > record for "ns.nextbus.com" matches glue record entered with registrar. Right, but the registrar wasn't being cooperative. I've changed glue records with other registrars before (self-service - just fill in the IP next to the name). I even remember emailing changes to NSI, back when that was the procedure), but changing one with GoDaddy has proven, erm, difficult. > As far as what is going to be used by global dns, it would be glue > record that you set with registrar (ok - its supposed to, but its > not always true depending how caching dns server is written). > > BTW - when doing check make certain to use "+norecurse" Ok... I'd be surprised if a gTLD server did a recursive query if asked. > > I have tested your site and everything is resolving > properly. This error message you are getting is not on our > end. > > If the record you wanted for glue is 64.142.39.200 and godaddy did not > fix it, then I suggest you find more cluefull registrar support person. > Ok, third time is a charm, I hope. You'd think even the level 1 folks would be trained to use dnsreport.com or something like it. (Boy, thanks to the folks providing it!) Note that I did specifically ask: "Please have this issue reviewed by someone technical - someone who knows what DNS glue is" and even included links to a definition, dnsreport.com,... > > > Thank you for contacting customer support. I have looked into this > situation and found that the domain name in question is not hosted > with us. This being the case you may wish to speak with your > hosting provider regarding the "glue" situation. > > The above is a red flag that the godaddy's "customer service representative" > has no idea what "glue" means. Escalate to the real tech support. Yup. I did get a good laugh out of the comment. ======= Boy, the results, which Jim posted, of "host 64.164.28.194" sure are odd, though I get the same thing. (That IP is in space no longer ours.) 194.192.28.164.64.in-addr.arpa??? That's got 5 octets, not 4. Not that I care what SBC does with rDNS for our old IP space... But in general, I believe there's no need for a NS to have valid reverse DNS. (But it's still a good idea, and is usually needed for mail servers...) There's nothing keeping someone from setting up reverse DNS for any IP delegated to them to be, say www.whitehouse.gov...

1 0

CNN: Worm strikes down Windows 2000 systems at multiple news organizat
by Fergie (Paul Ferguson) 16 Aug '05

16 Aug '05

Via CNN. [snip] A computer worm shut down computer systems running the Windows 2000 operating system across the United States on Tuesday, hitting computers at CNN, ABC and The New York Times. Around 5 p.m. computers began crashing at CNN facilities in New York and Atlanta. ABC said its problems began in New York about 1:30 p.m. The Caterpillar Co. in Peoria, Illinois also was reportedly affected. David Perry of Trend Micro said that the attack seems to have been triggered by a new worm, called worm--rbot.ebq. He said the symptoms -- computers repeatedly shutting down and rebooting -- was consistent with that virus. Johannes Ullrich, director of the Sans Institute, a network security firm in Jacksonville, Florida, said the outage also may have been caused by the Zotob worm, which was released last weekend. "It will connect to a control server to ask for instructions. It scans network neighborhoods and tries to infect them, as well," Ullrich said. Several versions of the worm have been released, some as late as Tuesday, he said. [snip] http://www.cnn.com/2005/TECH/internet/08/16/computer.worm/index.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

DACS Equipment
by sjk 16 Aug '05

16 Aug '05

I have a number of mux DS-3s coming in - right now they drop straight into aggregation routers. What I like to do is drop them into a local DACS and comb them out to DS-1s and then re-mux them back on to internal DS-3s. This will let me move circuits around digitally inside our equipment. Does anyone know what vendors I should speak to about such an application? Or maybe know of a cost-effective solution? TIA -- Steve

2 1

Open Proxy list / DR discussion list.
by Alice Stamping 16 Aug '05

16 Aug '05

Hey guys Either I'm clean out of google-foo, or there's little or nothing out there to be found, to help me with my current two projects. - Is anyone maintaing a real-time list of known open web-proxies? I run a small network hosting several forum sites, and I want to build something I can query regularly (say, hourly or daily) that will let me string something together in perl to build access-lists to throttle or block them altogether at our border. - Is there a good, practical discussion list for disaster recovery practicioners to discuss techniques, theory, news? Hoping someone can help, I remain obliged to you all, BR AS

2 1

Re: zotob - blocking tcp/445
by MARLON BORBA 16 Aug '05

16 Aug '05

Jiri, Rommon's site does not state clearly if the product is a network appliance (as it appears to be since its interface is web-based) or a software-only product. Abraços, Marlon Borba, CISSP. -- Nova campanha: Centro de Resposta a Incidentes de Segurança da Justiça Federal - Vamos criar! -- >>> "Sane Jiri" <Jiri.Sane(a)elisa.fi> 08/16/05 8:49 AM >>> [...] We have been using rommon for years now and are quite happy with it. It has radically decreased workload of our abuse-handling crew and zotob-infected customers for example got blocked with no extra configuration needed.

1 0