- NANOG - lists.nanog.org

Re: Akamai DNS Issue?
by John Neiberger 15 Jun '04

15 Jun '04

>>> Mike Tancsa <mike(a)sentex.net> 6/15/04 1:53:00 PM >>> > > >So anyone know what was the cause ? http://apnews.excite.com/article/20040615/D837KIU00.html It appears that Akamai is claiming it was an "international attack". John --

2 1

OER ready for prime time?
by Matthew Crocker 15 Jun '04

15 Jun '04

Anyone out there running 12.3(8)T with OER in a production/semi production environment? I know it is only v1.0 just wondering what people are seeing. -Matt

1 0

RE: Akamai DNS Issue?
by Mike Tancsa 15 Jun '04

15 Jun '04

Interesting.... At one point I did a quick sniff of my outbound traffic to one of their name server IP addressees and all looked like normal DNS queries.... But then again I didnt look that closely. ---Mike At 04:07 PM 15/06/2004, Brian Conant wrote: >Looks like DoS > >http://www.theregister.co.uk/2004/06/15/akamai_goes_postal/ > > > >Brian Conant >Lead Security Engineer >ADESA Corp > >-----Original Message----- >From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of >Mike Tancsa >Sent: Tuesday, June 15, 2004 2:53 PM >To: Leo Bicknell; nanog(a)merit.edu >Subject: Re: Akamai DNS Issue? > > > >So anyone know what was the cause ? > > ---Mike > > >At 09:08 AM 15/06/2004, Leo Bicknell wrote: > > > From here neither www.google.com, nor www.apple.com work. Both > >seem to return CNAMES to akadns.net addresses (eg, >www.google.akadns.net, > >www.apple.com.akadns.net) and from here all of the akadns.net > >servers listed in whois are failing to respond. > > > >Can someone confirm from another location? Comments from Akamai? > > > >-- > > Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 > > PGP keys at http://www.ufp.org/~bicknell/ > >Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

1 0

Cellphone Virus
by Edward B. Dreger 15 Jun '04

15 Jun '04

Scratch the comments about telephone CPE not being hacked and rolling up big bills. Interesting timing considering the recent circlej^H^H^H^H^H^H^Hthreads re who's responsible for what. http://www.newscientist.com/news/news.jsp?id=ns99995111 Eddy -- EverQuick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

1 0

(Routing-101) Protocol redistribution question BGP into OSPF
by Rich Sena 15 Jun '04

15 Jun '04

Working on what I thought was going to be an easy solution - but hey... Have 2 campus networks with 2 different autonomies now joined together. As an initial step we will leave the different autonomies and try to glue them together. Each campus has a distinct OSPF network and each campus has separate BGP peering sessions with unique AS's at it's borders. What we are trying to do is this. The campuses are connected via 2 PtP circuits that are internal to each campus. We have established separate BGP peering on each circuit - completely distinct from one another. We chose iBGP because of some 3rd party sites that are dual homed to each campus, local-pref seemed to be the best way to deal with route preference. So each site is using the same ASN on these internal iBGP sessions. But there are 2 main peering routers and at each campus (i-e: not a full mesh but 2 separate iBGP instances). The routers on the same campus do not peer with one another. Rather each router in addition to the BGP session is an ASBR into a common OSPF area on each campus. The thought is that the routes learned from iBGP will be redistributed and weighted via OSPF into the local campus WAN. There are 3 entry points into each LAN from a BGP/OSPF transition - each is independent of the other and each will originate default into OSPF. Now the quandary is this - how to get the campus routes to exchange from BGP - to OSPF and back again - *without enabling* "redistribute internal" on BGP. A few of us are/were of the opinion that once the routes are populated in the routing table from BGP - the OSPF instance would then re-advertise them since they are valid routes (of course with a specific network statement in OSPF) but practice is telling us that this is not working. The only way we can get this working at all is by enabling "redistribute internal" in BGP and then redistributing BGP in OSPF with a route filter. Does anyone have something similar working with a method differing from "redistribute internal" in BGP. Please contact me off-list. -- Rich Sena - ras(a)thick.net ThickNET Consulting "On the way to understanding; you understand, and forget."

1 0

RE: "Default" Internet Service
by Smith, Donald 15 Jun '04

15 Jun '04

First are the consumers willing to pay for a "safer" internet DSL/dial/isdn? I believe if they were there would be a safer service available. I have seen several "secure" isp's fail in the last few years. If you have any data that shows that there is a market for a more secure dialup/DSL/isdn... please share it. 2nd blaming infected machines on the internet is similar to blaming your postal carrier for bringing you junk mail and bills. About 1/2 of all of the large "infection" events on the internet are the result of people running unpatched unsecured applications on their machines. The other half of the infections I see are due to an end user opening an email and running an attachment. Even with a secure OS this simple method of infection will continue to work. How and when did it become the responsibility of the ISP to protect the end users machines? Do ISP's get paid to protect end user machines? If you want to blame someone maybe the company that provided the insecure os that requires monthly patches to fix portions of the broken code they sold. Or you could blame the end users who open unknown attachments. I would like a real solution to the problem. Simply blocking ports is not successful. So I recommend 2 steps. First buy OS's that are more secure out of the box. 2nd Teach users NOT to click on every thing they see. Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC Brian Kernighan jokingly named it the Uniplexed Information and Computing System (UNICS) as a pun on MULTICS. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Matthew Sullivan > Sent: Sunday, June 13, 2004 5:02 PM > To: nanog > Subject: Re: "Default" Internet Service > > > > Christopher L. Morrow wrote: > > >On Sat, 12 Jun 2004, John Curran wrote: > > > > > > > >>The real challenge here is that the "default" Internet service is > >>wide-open Internet Protocol, w/o any safeties or controls. This > >>made a lot of sense when the Internet was a few hundred > sites, but is > >>showing real scaling problems today (spam, major viruses, > >>etc.) > >> > >>One could imagine changing the paradigm (never easy) so that the > >>normal Internet service was proxied for common applications > and NAT'ed > >>for everything else... This wouldn't eliminate all the > problems, but > >>would dramatically cut down the incident rate. > >> > >> > > > >This sounds like a fantastic idea, for instance: How much direct IP > >does joe-average Internet user really require? Do they > require anything > >more than imap(s)/pop(s)/smtp(+tls) and dns/http/https ? I > suppose they > >also > >need: > >1) internet gaming > >2) voip > >3) kazaa/p2p-app(s)-of-choice > >4) IM > > > >Actually I'm sure there are quite a few things they need, > things which > >require either very smart NAT/Proxy devices or open access. The > >filtering of IP on the broad scale will hamper creativity and > >innovation. I'm fairly certain this was not what we want in the long > >term, is it? > > > > > I acutally suggested something like this at the recent AusCERT 2004 > conference... It's not such a bad idea.... > > The real question being "why are we giving mum's and dad's > who sign up > to the internet, and know nothing about either the Internet or > computers, full unrestricted incoming and outgoing access...?" ... > answer because the more bandwidth they use the more the ISP > earns... so > the ISPs don't care (in some cases) if the mum's and dad's > get trojaned, > because it's all money. > > My suggestion to the AusCERT delegates was to introduce a new default > service which has very limited access, and if people ask for > more, give > them the access after they have read through various 'educational' > pages.... Perhaps a simple online quiz at the end -just 3-5 > questions > with the answers being very clearly explained in the previous pages - > just to show the people have actually read the pages, rather than > skipped to the end and hit 'I accept'. > > I also suggested that if ISPs have the technology perhaps a simple IP > pools method of allocating the users IP, where they could turn on and > turn off access to certain protocols - eg: have a pool for > P2P users, a > pool for VOIP etc... > > / Mat > > > >

9 12

Assurant
by Daniel Corbe 15 Jun '04

15 Jun '04

If anyone from the Assurant Group monitors nanog, please contact me off-list. Regards, Daniel Corbe Senior Network Engineer Results Techologies, Inc. 954-921-2400 x104

1 0

RE: Akamai DNS Issue?
by wrolf.courtney＠donovandata.com 15 Jun '04

15 Jun '04

People seem to be getting around this by changing their DNS entries. E.g. www.yahoo.com always used to be a CNAME for www.yahoo.akadns.net. But now: # host www.yahoo.com www.yahoo.com is an alias for www.dcn.yahoo.com. www.dcn.yahoo.com has address 216.109.118.64 www.dcn.yahoo.com has address 216.109.118.65 www.dcn.yahoo.com has address 216.109.118.66 www.dcn.yahoo.com has address 216.109.118.67 www.dcn.yahoo.com has address 216.109.118.68 www.dcn.yahoo.com has address 216.109.118.69 www.dcn.yahoo.com has address 216.109.118.70 www.dcn.yahoo.com has address 216.109.118.71 www.dcn.yahoo.com has address 216.109.118.72 www.dcn.yahoo.com has address 216.109.118.73 www.dcn.yahoo.com has address 216.109.118.74 www.dcn.yahoo.com has address 216.109.118.75 Which is owned by Yahoo! (via HotJobs.com) Wrolf Courtney

1 0

Re: Points on your Internet driver's license (was RE: Even you can
by Paul Vixie 15 Jun '04

15 Jun '04

> So you claim even the ISPs you ran yourself have never attempted to do > any of these things? the last access-side isp i had anything to do with running used uucp and shell and was just getting going on c-slip when i pushed off. (i assure that any rmail or rnews spam was grounds for suspension during my watch.) my last gig at a colo-side isp ended with me moving over to paix due to the board's discomfort over my policies toward certain colo-side customers (who have since improved, yay.) > If you didn't do them, why do you think other people should? so you aren't going to google for "chemical polluter business model", huh?

21 42

RE: Akamai DNS Issue?
by Pranav Sheth 15 Jun '04

15 Jun '04

Seems to be the same thing here in DFW, Texas Google is accessible and yahoo is not fully functional (login pages fail). -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Tycho Eggen Sent: Tuesday, June 15, 2004 8:18 AM To: nanog(a)merit.edu Subject: Re: Akamai DNS Issue? On Tue, Jun 15, 2004 at 09:08:40AM -0400 Leo Bicknell(bicknell(a)ufp.org) wrote: > > From here neither www.google.com, nor www.apple.com work. Both seem > to return CNAMES to akadns.net addresses (eg, www.google.akadns.net, > www.apple.com.akadns.net) and from here all of the akadns.net servers > listed in whois are failing to respond. > > Can someone confirm from another location? Comments from Akamai? we see the same thing here in The Netherlands. it would seem like Akamai has fallen off the net. Tried all NSs on all locations, none of them responded. Regards, Tycho -- Tycho Eggen (Unix|Network) Engineer tycho(a)e-dude.org 0x3FCFB844 I'm going to say an exploit by tommorow. End of the internet by Saturday. All back to normal on Monday - Yet Another Cisco Bug

3 2