- NANOG - lists.nanog.org

DNS Weather Report 2004-09-07
by Daniel Roesen 07 Sep '04

07 Sep '04

DNS WEATHER REPORT for selected infrastructure zones ==================================================== Issue 2004-09-07 Zones analyzed and their SOA contacts: - . - arpa. nstld(a)verisign-grs.com - int. noc(a)icann.org - in-addr.arpa bind(a)arin.net - ip6.arpa. hostmaster(a)icann.org - ip6.int. hostmaster(a)ep.net Operators: please let me know wether you do want a copy when there's no problem with your zone(s) or not. Don't want to annoy anyone unnecessarily! Some people have approached me wether it would be possible to receive personal copies of the report. Please let me know wether you are interested in such a service yourself. If there is enough interest, I will set up a distro list for that. Executive summary: * the IP6.ARPA problems regarding delegation NS RRset got fixed! * ns.isi.edu is _still_ out of sync for the INT zone. * ns.isi.edu is _still_ auth for IP6.INT where it shouldn't be. The state of the root zone =========================== fine! The state of the ARPA zone ========================== fine! The state of the INT zone ========================= - ns.isi.edu is not in sync with the other nameservers Current SOA serial of the INT TLD: 2004090400, ns.isi.edu has still 2002080104 and is publishing stale data (e.g. an old NS RRset for the zone). Problem exists since at least 2004-08-24 The state of the IN-ADDR.ARPA zone ================================== fine! The state of the IP6.ARPA zone ============================== fine! The state of the IP6.INT zone ============================= - ns.isi.edu (one of the INT TLD servers) feels authoritative for the IP6.INT zone, but is neither listed in the delegation NS RRset, nor in the in-zone NS RRset of IP6.INT. Luckily, ns.isi.edu carries ip6.int with the same SOA serial as the official servers, so induces no operational problems so far. Problem exists since at least 2004-08-24 Regards, Daniel

2 2

OT- need a new GSM provider
by Paul Vixie 07 Sep '04

07 Sep '04

Now that AT&T has followed T-Mobile's example by screwing the pooch on my cell phone billing, and I've flung yet another SIM-locked Motorola V600 out the window of yet another moving vehicle, and am about to enter into another year long "you violated the agreement first" small claims battle, I need a new GSM provider. I'm going to buy an unlocked tri-band GSM this time. Anybody had notable (good or bad) billing and/or customer service experiences with Voicestream or any other GSM provider with native coverage in the San Francisco Bay Area? (If you reply privately to me, I'll summarize back to the list.) -- Paul Vixie

15 20

Internet speed report...
by Deepak Jain 07 Sep '04

07 Sep '04

http://slashdot.org/article.pl?sid=04/09/03/0534206 6.63 Gbps The article ended with hardware specs 'S2io's Xframe 10 GbE server adapter, Cisco 7600 Series Routers, Newisys 4300 servers using AMD Opteron processors, Itanium servers and the 64-bit version of Windows Server 2003.'" Is there a 10GE OSM for the 7600s? Deepak

8 12

Transit and backhaul, San Jose CA
by Thomas 07 Sep '04

07 Sep '04

Greetings, I apologise profusely for the off-topic nature of my posting. I am not having much luck with responses from people I've been trying to reach more directly. I am looking for transit, colocation space, and backhaul from the Southern Cross landing facility in San Jose, CA. I would like to hear from providers who are able to provide one or more of these things - the focus being on the third item. Looking for STM-4 to GigE of capacity. I'd be particularly interested in anyone who can also provide similar services in Sydney, Australia. Naturally, I would prefer responses to be kept off-list. Cheers, Thomas

1 0

QoS Service and montoring methods
by Joe Shen 07 Sep '04

07 Sep '04

Hi, I'm woring with QoS level analysis in ISP networks. But I don't know where could I find infomation on the following questions: 1. Is there a list of ISPs providing QoS in their networks? 2. Where could I find detailed infomation on QoS level parameters in those ISPs who do QoS? e.g.,( e2e bandwidth, e2e delay, e2e delay jitter, packet loss rate )for Real-time service level, Golden Service, Silver Service etc. 3. Is there any question on setting up QoS in current networks? 4. Is traffic engineering used for QoS ? 5. Is there any method to monitor amount of traffic on each service class? Each word will be highly appreciated. Joe __________________________________________________ Do You Yahoo!? Download the latest ringtones, games, and more! http://sg.mobile.yahoo.com

1 0

Re: Spammers Skirt IP Authentication Attempts
by Edward B. Dreger 06 Sep '04

06 Sep '04

JB> Date: Mon, 06 Sep 2004 13:42:22 -0600 JB> From: Jawaid Bazyar JB> 1) Domains spammers own will quickly become blacklisted. JB> Spammers will be forced to purchase register tons of JB> domains in order to continue spamming. However their Or use SPF-less domains. JB> 2) Pressure will quickly mount on domains that don't JB> facilitate authentication, with the effect snowballing JB> over time. This will ensure system-wide adoption of close JB> to 100% fairly quickly. There's a spark of optimism buried deep inside me that really wants to believe that. SAV has made me more cynical. :-/ JB> There's something else you're not granting here, however. JB> Once the domains that are commonly used for forged headers JB> get "protected" with an authentication mechanism, I as a JB> system administrator no longer have to spend excessive time JB> and effort trying to distinguish between spam with that JB> domain name and legitimate email with that domain name. Agreed entirely; IIRC, I think I said something similar a few weeks back. SPF is a useful data point -- we use ~19 RBLs as data inputs, and no one can authoritatively nail email as spam. Even if "SPF pass" is totally useless, I'd be surprised if "SPF fail" didn't indicate a high probability of spam. JB> Instead of lookups on numerous RBLs and numerous other CPU JB> and network-intensive checks, I can simply trust email from JB> aol.com, msn.com, hotmail.com, yahoo.com - and these comprise JB> enough of my email load that I will get an instant resource JB> utilization benefit from knowing that email from @yahoo.com JB> is really from @yahoo.com and short-circuiting all the spam JB> checks I usually do. Very good point. No disagreement here. However, I didn't like the article's overgeneralized "News flash! whitelisting all 'SPF pass' entries will let spam by!" attitude. Anyone whitelisting mail that has a valid SPF entry is nuts. JB> Thus even if authentication should never become 100% and even JB> if it doesn't stop spam, I still get a net benefit. Definitely. It's increased information... not enough for "perfect" decisions, but enough for "better" decisions. Eddy -- Everquick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita

1 0

Hurricane Frances impacts
by Sean Donelan 06 Sep '04

06 Sep '04

Since the FCC no longer makes outage reports public, folks will have to obtain their information from other sources. The networks in Broward, Palm Beach, Martin, Brevard counties appear to be the most impacted. Cellular had problems due to wireless sites being without power. The wireless industry brought in 500 new generators in advance of the hurricane, but needed to wait until the hurricane passed before sending them out to the cell sites. Miami and Orlando also have sites down due to power issues and connectivity to local carriers. The various local access line providers in Florida, Florida has a lot of tiny LATAs and phone companies, report some access lines are down but haven't published any counts. Cable networks have the same issues with local cable service. No reports of damage to telephone central offices or cable headends. Due to power outages and local access network problems, bank networks and cash machines are out of service in most of the affected counties. No reports of problems to any NAPs, POPs, data centers or fiber trunks. They generally have permanent generators. So if you have local connectivity, Internet access is working. Streaming audio/video from Florida television and radio stations over the Internet did not have any problems. Some WiFi providers are once again offering free WiFi service in the affected counties, if you can reach a working hotspot (with local power and local network connectivity).

2 4

Distributed Dictonary email slam
by Matt Hess 06 Sep '04

06 Sep '04

We are secondary mx for a specific domain that has been hammered since friday night. We've accumulated literally thousands of email messages in our queue while the primary mx at the customer site is out of service yet again. In looking at the queue it appears that it's one heck of a dictionary based slam. Interesting thing about this is that it is distributed.. entire dictionary destination addresses such as bene*(a)domain.com come from one host (apparently with a trojan on it or otherwise) while benf*(a)domain.com come from yet a different host.. and so on down the alphabet all the while constantly changing source hosts.. Now being as we are a secondary mx I'm dropping their record out of our email system as I write this, however, I am curious if other have gone through or are currently going through something of this magnitude (12K spam/dictionary msgs per hour destined to one domain and that's just what is getting past the blacklist checks). Normally I see my spam block daemon at around 10 - 15 concurrent requests.. right now it's tearing along at around 160 - 180 concurrent bad connections. And of course a few suggestions to mitigate this would be appreciated.. I currently employ multiple blacklists such as spamcop.net, abuseat.org, spews level 1 and 2, and spamhaus, plus my own blocklists for china and korea to check on incoming email source addresses.

6 8

RIPE "Golden Networks" Document ID - 229/210/178
by Rodney Joffe 06 Sep '04

06 Sep '04

Hello folks, This is actually NANOG applicable, despite referring to RIPE... ;-) How many of you who manage BGP speaking networks implement the RIPE "best practices" regarding dampening parameters for so-called "golden networks"? See: http://www.ripe.net/ripe/docs/routeflap-damping.html and http://www.qorbit.net/documents/golden-networks (thanks, Steve!) If you do, what parameters do you use, or do you not dampen the "golden networks" at all? If you don't implement ripe-229, why not? If there is enough interest/response (i.e if anyone besides me feels this is a real operational issue currently and wants to deal with it), I'll work on compiling the responses and producing a report. Note: A *significant* number of networks appear to *not* follow ripe-229 guidelines at all. Thanks, Rodney Joffe CenterGate Research Group, LLC http://www.centergate.com "Technology so advanced, even WE don't understand it"(R)

18 27

Re: OT- need a new GSM provider
by Paul Vixie 06 Sep '04

06 Sep '04

> You can get most of these phones unlocked from the sim lock > and then <british>flog</british> it on ebay - goes to the time > and effort costs of the aggrevation of dealing with mobile > operators. i plan to send the shattered remains of that phone back to AT&T in case they think that my small claims suit is a way to get myself a low-cost phone by proving that they violated the contract first. besides which, i hated the phone. i couldn't get it out of my pocket without hitting the voice-call button. the asynchronous nature of the java-based UI meant that the softkeys often changed what they meant while i was trying to press one. what a total piece of garbage.

3 2