- NANOG - lists.nanog.org

Re: Underscores in host names
by MARLON BORBA 19 May '05

19 May '05

Hmm, they've always teached to me that . (dot) at the end of hostnames indicates the (hidden) Root domain: blah.domain.com.[Root] And my teachers always said that we don't need to write the final . because every domain belongs to the Root domain. As for DNS servers for the Root domain, they are the reason for putting that "hint" files into our /var/named directory, "non"? Regards, Marlon Borba, CISSP Abraços, Marlon Borba, CISSP. "Por que 100? Bastaria um se eu estivesse errado!" --Albert Einstein, sobre o livro dos nazistas "100 cientistas contra Einstein". >>> "Peter & Karin Dambier" <peter(a)peter-dambier.de> 05/19/05 9:00 AM >>> [...] Because programmes like check_soa from the O'Reilly book "DNS and BIND" or sendmail believe it makes sense to force a dot at the end of every name they look up. There are nameservers in the root zone file that DNS will not find. /etc/hosts is the only way to get them. Dont forget to have both names with and without dot.

3 2

Cisco Vulnerability in a Variant of the TCP Timestamps Option
by Fergie (Paul Ferguson) 19 May '05

19 May '05

Cisco yesterday reported a vulnerability with some implementations of the Transmission Control Protocol (TCP) Timestamps option (RFC1323) are vulnerable to a Denial of Service (DoS) attack from specifically crafted packets. Cisco also states that only certain implementations of the TCP Timestamps option are vulnerable. The entire security alert can be found here: http://www.cisco.com/warp/public/707/cisco-sn-20050518-tcpts.shtml - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Underscores in host names
by Peter & Karin Dambier 19 May '05

19 May '05

> --- original message --- > from: Mark Andrews <Mark_Andrews(a)isc.org> > to: nanog(a)merit.edu > Re: Underscores in host names > Datum: Thu, 19 May 2005 10:40:32 +1000 (EST) > > Hostnames can't have a dot at the end either. The dot at the > end is a local resolver indication to not use the search list. > /etc/hosts: 217.29.76.4 IT2.MIX-IT.NET IT2.MIX-IT.NET. Why? Because programmes like check_soa from the O'Reilly book "DNS and BIND" or sendmail believe it makes sense to force a dot at the end of every name they look up. There are nameservers in the root zone file that DNS will not find. /etc/hosts is the only way to get them. Dont forget to have both names with and without dot. That is horrible, but I have to live with it Regards, Peter and Karin Dambier -- Peter und Karin Dambier Graeffstrasse 14 D-64646 Heppenheim +49-6252-671788 (Telekom) +49-6252-599091 (O2 Genion) +1-360-226-6583-9738 (INAIC) peter(a)peter-dambier.de peter(a)mail.inaic http://iason.site.voila.fr peter-dambier.site.voila.fr

1 0

Reback SMS / DSL packet loss issue.
by Stephen Fulton 19 May '05

19 May '05

Hi all, Hope the last NANOG was good, I was supposed to go, but alas business got in the way. I've got a question about an issue I'm seeing with some DSL clients. It may not be limited to Redback's SMS, but that's the platform being used, so I won't speak in generalities. Occasionaly clients connected via ATM PVC's experience packet loss after reconnecting due to power loss. The line sync is fine, but packet loss of between 40 - 60% occurs. Only once I've used "clear sub <subscriber>" to disconnect the session does the packet loss stop. Anyone know why that would be? I'd appreciate any insight or a push in the right direction regarding this, thanks. -- Stephen Fulton | We can be quick-witted Systems Administrator | or very intelligent Toronto, Canada | but not both. http://www.esoteric.ca/ | -- Stephen Hawking.

4 4

Announcing BGP troubleshooting work for ISPs
by Z. Morley Mao 18 May '05

18 May '05

Dear all, We (jointly with AT&T Research Lab) have recently developed a real-time troubleshooting tool that identifies significant and actionable BGP routing events (on the order of a few dozen) from millions of BGP updates from border routers of a given ISP network. The goal is for an ISP's network operators to identify locally observed BGP events that are important (e.g., affect a large number of prefixes, shift a lot of traffic, etc.) Our paper is published at NSDI: http://www.eecs.umich.edu/~zmao/Papers/nsdi05-jian.pdf The talk slides are at: http://www.eecs.umich.edu/~zmao/talks/nsdi2005.ppt http://www.eecs.umich.edu/~zmao/talks/nsdi2005.pdf We have several interesting findings when we applied our tool for the AT&T data: -We found more than 15% of the updates are due to persistently flapping prefixes even when flap damping was enabled. The reason is that flap damping is session-based. When a session is reset, the damping history is not retained. Moreover, damping is not implemented for iBGP sessions. There are three main causes for persistent flapping: (1) Conservative damping parameters (2) Protocol oscillations due to MED (3) Unstable interfaces or BGP sessions -We found eBGP session resets and hot potato changes contribute to many routing disturbances, and most of the routing events that have major impact on traffic shift are also due to session resets and hot potato events. Please let us know if you have any comments/feedback. Unfortunately, the tool is not yet available, but the detailed information of how the tool works is available in the paper. Thanks! -Z. Morley Mao, Jian Wu, Jennifer Rexford, Jia Wang

1 0

Experiences with 911 calls and SIP
by Dan Lockwood 18 May '05

18 May '05

Hi all, I'm having a discussion with one of my vendors about the 911 capabilities of their SIP VoIP phone system. The vendor says that if we use an Enhanced 911 service that their phone system will transmit location information to the PSAP at the time of the call in addition to the ANI. I was under the impression that this functionality was not possible, hence all the problems that Vonage is having. Can anyone help clarify this for me? Thanks, Dan

5 4

Engineers in the Miami area
by J. Oquendo 18 May '05

18 May '05

Hey all, Anyone in the Miami (South Beach) area willing to contact me offlist. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x0D99C05C http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0D99C05C To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

1 0

Two items: Honeynet 'Phishing" paper & Honeywall CDROM 'Roo'
by Fergie (Paul Ferguson) 18 May '05

18 May '05

Of emminent interest to NANOG'ers: The good folks over at the Honeynet Project and Research Alliance have published an excellent paper, "Know Your Enemy: Phishing; Behind the Scenes of Phishing Attacks" -- http://www.honeynet.org/papers/phishing/ Definately worth a read. Also, they have also have released a new Honeywall CDROM "Roo" -- "The purpose of the new CDROM is to make honeynets easier to deploy, maintain, and analyze. This new version has been redesigned rom the ground up and represents the latest in our GenIII (third generation) technologies." More info: http://www.honeynet.org/papers/cdrom/ http://www.honeynet.org/tools/cdrom/ Cheers, - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Malicious DNS request?
by Joe Shen 18 May '05

18 May '05

Paul, I'm sorry if this is JUST to BIND or some other specific software. But, IMHO this is just a sample that requests which only generate NXDOMAIN responds. According to someone's presentation on NANOG ("DNS anomailies and their impact on DNS Cache Server" ), such record may be type of attack. If we only rely on cacheing to remove paient of CPU time, cache server load will be increased. So, what I'm tryting to ask is , is there some mechanism proposed to deal with such problem? BIND is just a sample. joe --- Paul Vixie <vixie(a)vix.com> wrote: > > joe_hznm(a)yahoo.com.sg (Joe Shen) writes: > > > I'm using BIND9.2.5 & BIND9.3.1 on two Solaris > box, > > each box has two CPUs installed. it's found > BIND8.4.6 > > running on one CPU could reach the throughput of > > BIND9.*.* running on two CPUs. > > > > Could we improve server throughput or lower lower > the > > effect of those requests on NXDOMAIN? > > yes. but "we" isn't nanog. can you take your > bind-specific questions > to a bind-related mailing list or newsgroup? > www.isc.org has pointers. > -- > Paul Vixie > __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

2 1

FCC set to require 911 for VoIP as early as Thursday...
by Fergie (Paul Ferguson) 17 May '05

17 May '05

Things just seem to coalesce sometimes. http://www.reuters.com/newsArticle.jhtml?type=topNews&storyID=8521222 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com

1 0