- NANOG - lists.nanog.org

RE: Dns help.
by McBurnett, Jim 02 Mar '04

02 Mar '04

Ejay, I found a great link some time ago: www.dnsstuff.com http://www.dnsstuff.com/pages/expert.htm This one has an option to do a lookup to any public DNS server... Pick some of the random Internation DNS servers and try it out.. It helped me out awhile back when an old DNS hoster still had us in their named.conf...... Later, Jim ---From Ejay--- Hi all. nanog(signal,noise++) I have a customer that is reporting intermittent reachability issues to Stormpay.com, and need a off-network perspective on dns. The end-user reports not being able to resolve the domain, but it's been okay everywhere I looked. Most of the complaints have been international, but there are a couple of charter and EarthLink addresses mixed in. Last dns change was 2 almost weeks ago, so I don't suspect a propagation issue. It should resolve to 207.65.19.39. Thanks, Ejay. (Who now owes two rounds at the next <400mi from Nashville after-nanog-bar-huddle)

2 1

RE: First Post! Annoying Debate at Work.
by Christopher Aldridge 01 Mar '04

01 Mar '04

-----Original Message----- From: Patrick W.Gilmore [mailto:patrick@ianai.net] Subject: Re: First Post! Annoying Debate at Work. >Please do not take this the wrong way, but I thought it was useful >input. Perhaps not to you, but maybe to those who think that getting >their MCSA will teach them all they need to know. It seems as though you MAY not be up to date on the MCSA. It stands for "Microsoft Certified Systems Administrator", FYI. To obtain the MCSA certification, I took the following exams: Exam 70-218: Managing a Microsoft Windows 2000 Network Environment Exam 70-215: Installing, Configuring, and Administering Microsoft Windows 2000 Server Exam 70-210: Installing, Configuring, and Administering Microsoft Windows 2000 Professional Exam 70-216: Implementing and Administering a Microsoft Windows 2000 Network Infrastructure One who thinks these exam topics cover (as you say" "all they need to know", should really investigate this certification. >Some of the things you asked were extremely basic. What "things" were these? I can only find one question in my entire email that requests a response which was: "What's your take and why?", which was obviously referencing the previous statement: --------------------------------------------------------- The argument non-persuasively put is as follows: Is a USB Ethernet Adapter a "converter"? Personally, I say "no". My coworkers seem to say "yes". --------------------------------------------------------- What this means my friend, is I wouldn't ever refer to a USB Ethernet Adapter as a "converter". A few co-workers seem to disagree, hence my request for the opinion of the nanog community. >I've never taken >any of the certifications you list, but I thought they would cover the >basics - especially after 3 of them (from 3 different vendors, I >think?) Unfortunately, MS and Cisco certifications do not generally cover the opinions of those who would and wouldn't classify an Ethernet Adapter as falling under the broad "converter" definition. If you feel that an Ethernet Adapter is a "converter", I suggest taking a different approach. >All that said, if you don't at least start asking, you will never find >out. Asking what? I'm not sure what you're talking about here, but I have received great responses from many people here who actually contributed to this discussion. >So I would not take this as an attack on you personally - lots of >people answered took the time to answer your questions, asking not even >a favor in return as payment. The people who responded helpfully to my post, will receive any help and assistance in the future from me as a fellow nanog'er; without the POINTLESS sarcasm and flaming. > I would take it as a note to people with >certifications or going for certifications that a cert != clue. I agree here 100%. However you have also made it very clear that no_cert != clue. >(Did any of those certs have >labs, or just multiple-guess tests?) Google is your friend. http://www.microsoft.com/learning/mcp/mcsa/requirements.asp http://www.cisco.com/en/US/learning/le3/le2/le0/le9/learning_certificati on_type_home.html >P.S. I kinda expected as much from MS, but it's sad that a cisco cert >doesn't mean much any more. :( Notice mostly everyone who provided useful feedback on this agreed with my opinion on this. Common sense has nothing to do with certs. Having both isn't a bad trait however. FYI, thanks for everyone who contributed to this.

4 4

Dns help.
by Ejay Hire 01 Mar '04

01 Mar '04

Hi all. nanog(signal,noise++) I have a customer that is reporting intermittent reachability issues to Stormpay.com, and need a off-network perspective on dns. The end-user reports not being able to resolve the domain, but it's been okay everywhere I looked. Most of the complaints have been international, but there are a couple of charter and EarthLink addresses mixed in. Last dns change was 2 almost weeks ago, so I don't suspect a propagation issue. It should resolve to 207.65.19.39. Thanks, Ejay. (Who now owes two rounds at the next <400mi from Nashville after-nanog-bar-huddle)

1 0

Re: Possibly yet another MS mail worm
by Rubens Kuhl Jr. 01 Mar '04

01 Mar '04

> > I'm not aware of any mail scanner that does this without running an external > > anti-virus or something alike, although is not that intensive to follow the > > zip headers (as they already do with the MIME headers in order to drop > > external attachments). Most scanners can accept an anti-virus plugin and > > them scan inside zip files, but that requires more processing power, more > > queue disk space, more RAM, more administration to update virus patterns, > > and so on. The cost/benefit usually pays off, but more complexity means less > > people will adopt the solution, thus making worm spreading easier. > > your description makes it all sound quite complicated, possibly because > you are passing all the processing down to the end-user's machine. I was talking about central anti-virus processing... although it's easier on administration than updating hundreds or thousands of machines, it establishes a central bottleneck. Doing decompression and extensive pattern matching on a high volume server is not an easy task. > we have anti-virus (clamav) and anti-spam (spamassassin) running at the > server level, and thus save the end-user alot of cycles. Even on low volume servers, this task is not something one would do without some thinking; on high volume, this is achievable but would require a good systems design to cope with the higher latency between mail receive and mail delivery. > clamav will look inside zip files, and automatically updates its signature > database. > > spamassassin uses both global rules and per-user rules to rate incoming email > and reduce the impact of spam. Been there at many installations of MailScanner (http://www.mailscanner.info) > we even run in-line scans of MIME headers during the SMTP process and reject > specific attachments (.exe, .pif, etc) without even bothering the end-user. That kind of filtering is much easier to configure, administer and goes low on resources. Extending this to verify filenames inside zip files would not be difficult to do, and is simple and not intensive enough to lots of people to turn such filters on. Rubens

7 6

RE: First Post! Annoying Debate at Work.
by Christopher Aldridge 01 Mar '04

01 Mar '04

From: Michael.Dillon(a)radianz.com [mailto:Michael.Dillon@radianz.com] Sent: Monday, March 01, 2004 6:04 AM To: nanog(a)merit.edu Subject: Re: First Post! Annoying Debate at Work. >Thanks for your EXCELLENT example of how technical certification >programs are no guarantee of fundamental technical understanding. >P.S. If you don't ask the right questions you will never get the right >answers. Thanks for the useful input!

2 1

Re: First Post! Annoying Debate at Work.
by Michael.Dillon＠radianz.com 01 Mar '04

01 Mar '04

>Network Analyst >CCNA/MCP/MCSA Thanks for your EXCELLENT example of how technical certification programs are no guarantee of fundamental technical understanding. P.S. If you don't ask the right questions you will never get the right answers.

1 0

First Post! Annoying Debate at Work.
by Christopher Aldridge 29 Feb '04

29 Feb '04

NOTE: I have been a nanog observer for nearly a year. The following may be slightly off topic, but it seems as though nanog is my last hope. Recently at work, I've been battling fellow coworkers on a very simple debate. The fact that I will not "give in" on my argument really makes me look arrogant, but I absolutely refuse to let this one go without logical reason! The argument non-persuasively put is as follows: Is a USB Ethernet Adapter a "converter"? Personally, I say "no". My coworkers seem to say "yes". My argument: 1) Ethernet isnt "converted" to USB. The adapted information from the ethernet segment may traverse the USB segment if the NIC adapts it to the CPU, but is never "converted" to USB. You can use USB for many things, thus making it an underlying "serial bus" in which other technologies can traverse. Whatis.com definition: USB (Universal Serial Bus) is a plug-and-play interface between a computer and add-on devices (such as audio players, joysticks, keyboards, telephones, scanners, and printers). With USB, a new device can be added to your computer without having to add an adapter card or even having to turn the computer off. USB in this scenario would be synonymous with PCI, in regards to the type of technology that interfaces with the cpu. 2) I cant seem to place "converter" above layer 1. Yet a Network adapter ( both PCI or USB ) have layer 2 mac addresses that are stored into the PROM from the manufactor. From my understanding, if an ethernet frame comes in via cat5, and is destined for the wrong MAC address, the traffic will not move up the OSI model and to the PC; It will be dropped right there and then. Only frames destined for the correct MAC or broadcast will traverse the USB portion. If this is true, then aparantly our "converter" is doing a lot more than "converting" ethernet to "USB"! - Filtering, forwarding, encapsulating, de-encapsulating, etc. 3) Just because a device has two physical mediums of connectivity, dosent make it a "converter". My coworkers argue that a USB Ethernet adapter is an "Ethernet to USB Converter". If this is true, then the following could be said: a. A PCI Ethernet Adapter is a "converter" because it "converts" Ethernet to PCI. b. An Alcatel switch w/ a T1 and a DS3 controller card would be a "converter" because it "converts" cat5 from the T1 card to coax on the DS3 card. c. Lastly ( I love this one ), An integrated Ethernet adapter on a motherboard is a "converter" because it "converts" ethernet to uhh ?? processor? Riiiiight" My co-workers arguments are basically that because Ethernet is plugged into one side, and usb is plugged into the other, it's a converter. I strongly that's an understament if not an incorrect statement. Whats your take and why? Input from ANY of you would be GREATLY appreciated. Otherwise, a simple "I aggree with you" will be fine also! Thanks in advance! Christopher Aldridge Network Analyst CCNA/MCP/MCSA

6 7

Re: How relable does the Internet need to be? (Was: Re: Converged Network Threat)
by Michael.Dillon＠radianz.com 29 Feb '04

29 Feb '04

>[1] Should VoIP include 911/999 service, and how does one resolve the >various geographic location issues associated with this. Anyone who claims to answer this one should consider the how to handle the case of a British subscriber to a VoIP service who travels to the USA, Canada, all over Europe and Australia. What would happen if a native of one of those countries picked up the VoIP device and dialled for emergency services. In Canada and the USA they would dial 911 In the UK they would dial 999 In Europe they would dial 112 or possibly one of the various legacy national numbers for emergency service. And in Australia they would dial 000. Do you route all these calls to Britain? Do you use some sort of geographical locator database for IP addresses to route the call? Do you route the call based on the actual number dialed, i.e. all 000 calls go to Australia? Or do we pass legislation requiring the RIRs and all ISPs to maintain a database with the current physical location of every device with an IP address? Personally I don't think the regulators have a clear enough grasp of the technical issues to be prescribing solutions for this issue. --Michael Dillon P.S. I think a solution lies in the general direction of converting the entire world to use 112 for emergency services and having the VoIP services set up an automated system that rings back whenever your phone connects using a different IP address and asks you where you are.

12 19

Re: Lawsuit on ICANN (was: Re: A few words on VeriSign's sitefinder)
by neil＠DOMINO.ORG 28 Feb '04

28 Feb '04

> http://biz.yahoo.com/rc/040226/tech_verisign_2.html can't say I'm surprised. Another nail in the Verisign coffin.

9 9

RE: How relable does the Internet need to be? (Was: Re: Converged Network Threat)
by Pendergrass, Greg 28 Feb '04

28 Feb '04

I think how reliable the internet needs to be depends on what you want to use it for: if you want to call an ambulance you DON'T use the internet, if you want to transfer money from one account to another you DO use the internet. In other words right now it's good for things that are important but not critical from an immediate action standpoint. If it can wait until tomorrow use the internet otherwise pick up the phone and dial. I can count on one hand the number of times I've had problems with my landline in my entire life but I can count on two hands the number of problems I've had with my internet connection in one year. If we ever want the internet to grow from being a handy medium for exchanging data to the converged, all-encompassing communications medium then it needs to go from "Mom, the internet's down again!" to "Dude, my internet connection went down yesterday, that ever happen to you before?". For that to happen there has to be more accountability in the industry. -GP -----Original Message----- From: Steve Gibbard [mailto:scg@gibbard.org] Sent: 26 February 2004 00:30 To: nanog(a)merit.edu Subject: How relable does the Internet need to be? (Was: Re: Converged Network Threat) Having woken up this morning and realized it was raining in my bedroom (last night was the biggest storm the Bay Area has had since my house got its new roof last summer), and then having moved from cleaning up that mess to vacuuming water out of the basement after the city's storm sewer overflowed (which seems to happen to everybody in my neighborhood a couple of times a year), I've spent lots of time today thinking about general expectations of reliability. In the telecommunications industry, where we tend to treat reliability as very important and any outage as a disaster, hopefully the questions I've been coming up with aren't career ending. ;) With that in mind, how much in the way of reliability problems is it reasonable to expect our users to accept? If the Internet is a utility, or more generally infrastructure our society depends on, it seems there are a bunch of different systems to compare it to. In general, if I pick up my landline phone, I expect to get a dialtone, and I expect to be able to make a call. If somebody calls my landline, I expect the phone to ring, and if I'm near the phone I expect to be able to answer. Yet, if I want somebody to actually get through to me reliably, I'll probably give them my cell phone number instead. If it rings, I'm far more likely to able to answer it easily than I am my landline, since the landline phone is in a fixed location. Yet some significant portion of calls to or from my cell phone come in when I'm in areas with bad reception, and the conversation becomes barely understandable. In many cases, the signal is too weak to make a call at all, and those who call me get sent straight to voicemail. Most of us put up with this, because we judge mobility to be more important than reliability. I don't think I've ever had a natural gas outage that I've noticed, but most of my gas appliances won't work without electric power. I seem to lose electric power at home for a few hours once a year or so, and after the interuption life tends to resume as it was before. When power outages were significantly more frequent, and due to rationing rather than to accidents, it caused major political problems for the California government. There must be some threshold for what people are willing to accept in terms of residential power outages, that's somewhere above 2-3 hours per year. In Ann Arbor, Michigan, where I grew up, the whole town tended to pretty much grind to a halt two or three days a year, when more snow fell than the city had the resources to deal with. That quantity of snow necessary to cause that was probably four or five inches. My understanding is that Minneapolis and Washington DC both grind to a halt due to snow with somewhat similar frequency, but the amount of snow requred is significantly more in Minneapolis and significantly less in DC. Again, there must be some threshold of interruptions due to exceptionally bad weather that are tolerated, which nobody wants to do worse than and nobody wants to spend the money to do better than. So, it appears that among general infrastructure we depend on, there are probably the following reliability thresholds: Employees not being able to get to work due to snow: two to three days per year. Berkeley storm sewers: overflow two to three days per year. Residential Electricity: out two to three hours per year. Cell phone service: Somewhat better than nine fives of reliability ;) Landline phone service: I haven't noticed an outage on my home lines in a few years. Natural gas: I've never noticed an outage. How Internet service fits into that of course depends on how you're accessing the Net. The T-Mobile GPRS card I got recently seems significantly less reliable than my cell phone. My SBC DSL line is almost to the reliability level of my landline phone or natural gas service, except that the DSL router in my basement doesn't work when electric power is out. I'm probably poorly qualified to talk about the end-user experience on the networks I actually work on, even if I had permission to. Like pretty much everybody else here, I'm always interested in doing better on reliability. And, like many of my neighbors, I'd like to be able to store stuff on my basement floor. In comparison to a lot of other infrastructure we depend on, it seems to me the Internet is already doing pretty well. -Steve On Wed, 25 Feb 2004, Jared Mauch wrote: > > Ok. > > I can't sit by here while people speculate about the possible > problems of a network outage. > > I think that most everyone here reading NANOG realizes that > the Internet is becoming more and more central to daily life even > for those that are not connected to the internet. > > From where i'm sitting, I see a number of potentially dangerous > trends that could result in some quite catastrophic failures of networks. > No, i'm not predicting that the internet will end in 8^H7 days or anything > like that. I think the Level3 outage as seen from the outside is a clear > case that single providers will continue to have their own network failures > for time to come. (I just hope daily it's not my employers network ;-) ) > > So, We're sitting here at the crossroads, where VoIP is > "coming of age". Vonage, 8x8 and others are blazing a path that > the rest of the providers are now beginning to gun for. We've already > read in press releases and articles in the past year how providers > in Canada and the US are moving to VoIP transport within their long-distance > networks. > > I keep hear of Frame-Relay and ATM signaling that is going > to happen in large providers MPLS cores. That's right, your "safe" TDM > based services, will be transported over someones IP backbone first. > This means if they don't protect their IP network, the TDM services could > fail. These types of CES services are not just limited to Frame and ATM. > (Did anyone with frame/atm/vpn services from Level3 experience the > same outage?) > > Now the question of Emergency Services is being posed here but also > in parallel by a number of other people at the FCC. We've seen the E911 > recommendation come out regarding VoIP calls. How long until a simple > power failure results in the inability to place calls? > > Now, i'm not trying to pick on Level3 at all. The trend I > outline here is very real. The reliance on the Internet for critical > communications is a trend that continues. Look at how it was used > on 9/11 for communications when cell and land based telephony networks > were crippled. > > The internet has become a very critical part of all of our lives > (some more than others) with banks using VPNs to link their ATMs back into > their corporate network as well as the number of people that use it for > just plain "just in time" bill payment and other things. I can literally > cancel my home phone line, cell phone and communicate soley with my > internet connection, performing all my bill payments without any paperwork. > I can even file my taxes online. > > We're at (or already past) the dangerous point of network > convergence. While I suspect that nobody directly died as a result of > the recent outage, the trend to link together hospitals, doctors > and other agencies via the Internet and a series of VPN clients continues > to grow. (I say this knowing how important the internet is to > the medical community, reading x-rays and other data scans at home for the > oncall is quite common). > > While my friends that are local VFD do still have the traditional > pager service with towers, etc... how long until the T1's that are > used for dial-in or speaking to the towers are moved to some sort of > IP based system? The global economy seems to be going this direction with > varying degrees of caution. > > I'm concerned, but not worried.. the network will survive.. > > - Jared > > > On Wed, Feb 25, 2004 at 09:17:30AM -0600, Pete Templin wrote: > > If an IP-based system lets you see the status of the 23 hospitals in San > > Antonio graphically, perhaps overlaid with near-real-time traffic > > conditions, I'd rather use it as primary and telephone as secondary. > > > > Counting on it? No. Gaining usability from it? You betcha. > > > > Brian Knoblauch wrote: > > > > > If you're counting on IP (a "best attempt" protocol) for critical > > >data, you've got a serious design flaw in your system... > > > > > >-----Original Message----- > > >From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > > >Pete > > >Templin > > >Sent: Wednesday, February 25, 2004 9:10 > > >To: Colin Neeson > > >Cc: nanog(a)merit.edu > > >Subject: Re: Level 3 statement concerning 2/23 events (nothing to see, move > > >along) > > > > > > > > > > > > > > >Are you sure no one died as a result? My hobby is volunteering as a > > >firefighter and EMT. If Level3's network sits between a dispatch center > > >or mobile data terminal and a key resource, it could be a factor > > >(hospital status website, hazardous materials action guide, VoIP link > > >that didn't reroute because the control plane was happy but the > > >forwarding plane was sad, etc.). > > > > > >And if the problem could happen to another network tomorrow but could be > > >prevented or patched, wouldn't inquiring minds want to know? Your life > > >might be more interesting when the fit hits the shan if you have the > > >same vulnerability. > > > > > >Colin Neeson wrote: > > > > > > > > >>Because, in the the grand scale scheme of things, it's really not that > > >>important. > > >> > > >>No one died because of it, the normal, everyday events of the world > > >>went > > >>on, > > >>unaffected by a Level 3 outage... > > >> > > >>Might be nice to know what happened, but my life will certainly not be > > >>less interesting by not having that knowledge... > > -- > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > ---------------------------------------------------------------------------- ---- Steve Gibbard scg(a)gibbard.org +1 415 717-7842 (cell) http://www.gibbard.org/~scg +1 510 528-1035 (home) Vodafone Global Content Services Limited Registered Office: Vodafone House, The Connection, Newbury, Berkshire RG14 2FN Registered in England No. 4064873 This e-mail is for the addressee(s) only. If you are not an addressee, you must not distribute, disclose, copy, use or rely on this e-mail or its contents, and you must immediately notify the sender and delete this e-mail and all copies from your system. Any unauthorised use may be unlawful. The information contained in this e-mail is confidential and may also be legally privileged.

7 8