- NANOG - lists.nanog.org

Worldnic does TCP-before-UDP DNS tricks, breaking powerdns recursor and those w/o TCP connectivity
by bert hubert 06 Jul '05

06 Jul '05

Hi Nanog people, The PowerDNS recursor has hit a snag resolving www.kde-look.org. It appears Worldnic has implemented 'TCP-before-UDP' on ns{9,10}.worldnic.com, whereby it sends out answers with the truncated bit set, and without an actual answer. Once the client has re-asked the query over TCP, it from then on allows UDP queries. This is possibly done to prevent DoS attacks. This hits those people who've been running the pdns recursor w/o heeding the warning on http://doc.powerdns.com/built-in-recursor.html stating our inadequacies regarding truncated packets. But is also hits everybody who only allows UDP port 53, which generally works fine, except now! Recall the AOL huge packet event from way back. So make sure your resolvers have TCP connectivity! And yes, my message may read a bit like djb's back in the time AOL started to use > 512 byte packets :-) The problem is solved in SVN luckily. Apologies. But just a heads up that if you suddenly have non-working Worldnic domains, you now know two possible causes. A quick solution for PowerDNS recursor users is to run 'dig www.kde-look.org @ns9.worldnic.com' periodically. Or upgrade to the SVN snapshot mentioned below, but do note that it is experimental. Wiki: http://wiki.powerdns.com/projects/trac/ Message: http://mailman.powerdns.com/pipermail/pdns-users/2005-July/002414.html SVN snapshot solving the problem: http://ds9a.nl/pdns/pdns-2.9.18-svn.tar.gz -- http://www.PowerDNS.com Open source, database driven DNS Software http://netherlabs.nl Open and Closed source services

1 0

Re: OT? /dev/null 5.1.1 email
by Valdis.Kletnieks＠vt.edu 06 Jul '05

06 Jul '05

On Tue, 05 Jul 2005 21:27:23 PDT, Justin Mason said: > BTW, someone (possibly Randal L. Schwartz) came up with a neat related > trick to the above -- set up an interface alias on *the same machine* as > the primary MX, list that as the last MX in the list, and (assuming that > the software side of the primary MX is reliable) you're then assured that > any SMTP traffic that arrives on that IP's port 25 is spam, since when > the primary MX's hardware goes down, this MX will, too. That's got the same failure mode - if I take a 30-second hit and can't reach the first MX, then the link comes up before I try the last MX, I hit the "bad" one. And since the link burp is at *my* end, you don't even know about it, unless you hook it into a full BGP feed with Zebra or something and see AS1312's routes flap (and even then, it's dicy - a very short burp may not cause the routes to be withdrawn)....

1 0

Please update filters for 58/8
by John Tran 06 Jul '05

06 Jul '05

Dear colleagues In May 2005, IANA's delegation of the following address block to APNIC was widely broadcast to the operational and RIR mailing lists: 58.0.0.0/8 However, since that time, APNIC has received widespread reports of difficulties routing address space within this range. If you haven't already done so, please update your network configurations specifically for this range. IANA maintains a list of reserved and delegated IPv4 address ranges at: http://www.iana.org/assignments/ipv4-address-space Regards Son __________________________________________________________________________ Resources Services Manager <Son(a)apnic.net> Asia Pacific Network Information Centre phone: +61 7 3858 3100 http://www.apnic.net fax: +61 7 3858 3199 Helpdesk phone: +61 7 3858 3188 email: helpdesk@apnic$ Please send Internet Resource Requests to <hostmaster(a)apnic.net> __________________________________________________________________________

3 2

OT: Stupid vendor tricks.
by Bill Nash 06 Jul '05

06 Jul '05

Co-workers from past lives will recognize this as a subject near and dear to my little black heart: CISCO-SLB-MIB::slbServerFarmBindId.4."10.0.0.10" = Gauge32: 0 CISCO-SLB-MIB::slbServerFarmBindId.4."10.0.0.11" = Gauge32: 0 CISCO-SLB-MIB::slbServerFarmBindId.4."10.0.0.12" = Gauge32: 0 CISCO-SLB-MIB::slbServerFarmBindId.4."10.0.0.13" = Gauge32: 0 The pure numerics are even worse, right down to the polling response behavior. - billn

1 0

Re: source for GIS-correlated fiber conduit data
by Gregory Hicks 05 Jul '05

05 Jul '05

> Date: Tue, 05 Jul 2005 20:09:39 +0000 (GMT) > From: "Christopher L. Morrow" <christopher.morrow(a)mci.com> > > On Tue, 5 Jul 2005, Justin M. Streiner wrote: > > > On Mon, 4 Jul 2005, Sam Crooks wrote: > > > > > Can anyone point me in the direction of a source for fiber cable > > > installations correlated to GIS data? > > > > You will probably have difficulty in getting this from your carriers of > > choice. Chances are, if they provide anything at all, it would be done > > under NDA. > > Didn't Sean Doran do this out of GMU about 2 years ago? and get slapped > with some silly classification by the us-gov for it? (or am I thinking of > another sean?) Someone did but it was not limited to fiber but included utilities... And did get slapped down for putting together publicly available info into a usable form... --------------------------------------------------------------------- I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

3 2

Net traffic explodes for NASA'S comet collision
by Fergie (Paul Ferguson) 05 Jul '05

05 Jul '05

I hope many of you saw this near- real-time. It was awsome. Roy Mark writes for internetnews.com: [snip] Deep Impact's spectacular collision with the comet Tempel 1 resulted in an explosion of record traffic to the NASA Web site to see how it looked. The hyper-speed demise of the ship's probe, as it smashed into a comet half the size of Manhattan, generated approximately 80 million page views. "It's off the scale," Brian Dunbar, NASA's Internet Services Manager, told internetnews.com, noting the previous traffic record was 30 million page views for the Mars landing in 2004. "Hands down, it was a record day." [snip] http://www.internetnews.com/xSP/article.php/3517721 Pretty cool stuff. :-) - ferg ps. We should also be aware of how far AOL has come, too, since the 1996 Victoria's Secret fashion show. From every report, they pulled off streaming 7 simulateous video feeds of the Live 8 concerts this past weekend without any substantial problems whatsoever. http://news.yahoo.com/news?tmpl=story&u=/ap/20050705/ap_en_bu/internet_vide… Time they are a'changin'. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

U.S. Won't Cede Control of Net Computers
by Fergie (Paul Ferguson) 05 Jul '05

05 Jul '05

I've reached my post limit for the day after this one. http://news.yahoo.com/news?tmpl=story&u=/ap/20050630/ap_on_hi_te/internet_c… [snip] The U.S. government said Thursday it would indefinitely retain oversight of the Internet's main traffic-controlling computers, ignoring calls by some countries to turn the function over to an international body. The announcement marked a departure from previously stated U.S. policy. Michael D. Gallagher, assistant secretary for communications and information at the U.S. Commerce Department, shied away from terming the declaration a reversal, calling it instead "the foundation of U.S. policy going forward." The signals and words and intentions and policies need to be clear so all of us benefiting in the world from the Internet and in the U.S. economy can have confidence there will be continued stewardship," Gallagher said in an interview with The Associated Press. [snip] - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 5

RE: Enable BIND cache server to resolve chinese domain name?
by Hannigan, Martin 05 Jul '05

05 Jul '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Steve Gibbard > Sent: Monday, July 04, 2005 1:20 AM > To: nanog(a)nanog.org > Subject: Re: Enable BIND cache server to resolve chinese domain name? > > > > On Mon, 4 Jul 2005, Mark Andrews wrote: > [ SNIP ] > That doesn't mean a competing system wouldn't work, for those who are > using it. They'd just be limited in who they could talk to, and that > generally wouldn't be very appealing. Are you just making noise here, Steve? That doesn't really say anything outside of status quo. > That said, a big country implementing a new DNS root on a > national scale > may not have that problem. The telecom world is already full > of systems > that don't cross national borders. In the US case, think of > all the cell > phones that have international dialing turned off by default, That's a poor example. That's between the subscriber and their carrier, not a technical limitation. > and all the > 800 numbers whose owners probably aren't at all bothered by their > inability to receive calls from other countries. That's also a poor example since there are work arounds for this technical issue. > > A system that would limit my ability to talk to people in > other countries > doesn't sound very appealing to me. I know. I know. Don't feed the trolls. -M<

1 0

Re: The whole alternate-root ${STATE}horse (was Re: Enable BIND cache server to resolve chinese domain name?)
by Fergie (Paul Ferguson) 05 Jul '05

05 Jul '05

What? You mean that marketing spin doesn't convince you of how much a "killer app" something is? ;-) - ferg -- "Jay R. Ashworth" <jra(a)baylink.com> wrote: Yup. Killer apps are great. Hard to predict; *really* hard to invent. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Enable BIND cache server to resolve chinese domain name?
by Peter Dambier 05 Jul '05

05 Jul '05

william(at)elan.net wrote: > > > On Mon, 4 Jul 2005, Paul Vixie wrote: > >> for those excellent readers who didn't follow this, here's an excerpt >> from >> <http://european.de.orsn.net/faq.php#opmode>: > > [skip] > >> what this means is, it can't conflict with ICANN data other than that >> if ICANN deletes something it might not show up in ORSN. >> mathematically speaking that's a superset, but politically speaking >> it's not at all like an alternative root. > > > While I doubt ICANN would delete a TLD zone (and if that happened it would > presumably be for "dead" tld which no requests are expected to come to), > I'm concerned that their system might work in regards to to host glue > records which there are quite a number of in root zone. If some nameserver > is no longer used by TLD and and now it wants to change its ip address, > it would presumably request deletion of its glue record from root zone > and then be able to change ip with no effect on anyone on the net. But > if ORSN does not pick it up this would mean they will continue to use > old ip address and that would cause inconsistency (which I suspect will > not be easy to track either). check_soa from the O'Reilly book 'DNS and Bind' will do or dig XXX +nsserach > > What I don't understand why for their project they don't just go ahead > and copy ICANN root zone as-is. > Copyright reasons. But nevertheless those 261 zones are watched to be synchronous to the ICANN root. And there is another check that sees when suddenly a new zone appears like it did for '.eu' some month ago. Both Public-Root and ORSN had it the very same day. I have seen when ORNS and ICANN were out of sync ORSN hat the information from the zone file for 'at', '.de' and '.gr' while ICANN had stale information for a very long time. Same went for '.ke' and the Public-Root for a month or two. Regards, Peter and Karin Dambier -- Peter and Karin Dambier Public-Root Graeffstrasse 14 D-64646 Heppenheim +49-6252-671788 (Telekom) +49-179-108-3978 (O2 Genion) +49-6252-750308 (VoIP: sipgate.de) +1-360-448-1275 (VoIP: freeworldialup.com) +1-360-226-6583-9563 (INAIC) mail: peter(a)peter-dambier.de http://iason.site.voila.fr http://www.kokoom.com/iason

2 1