- NANOG - lists.nanog.org

Re: Sabotage investigation of fiber cuts in Northwest
by Stewart, William C (Bill), RTSLS 03 Nov '03

03 Nov '03

Subtopics: Redundancy, Hunters. On Sun, Nov 02, 2003 at 09:37:30PM -0500, Robert M. Enger wrote: > You'd think after three previous disruptions, that Qwest would > have enabled some form of redundancy. If a single fiber cut takes them out, it's not _just_ Qwest's fault. A service like 911 should be buying diverse access, with access rings near the customer premises, and if they can't get it they need to be thinking about Microwaves, and if they can't get that they need to think about locating their 911 services somewhere that they _can_ get diversity. Sometimes there are right-of-way issues, so all the fibers go though one place (and I don't expect newspapers to be real precise about whether they're cutting one fiber or one bundle of fibers), but a flood or backhoe doesn't care. A decade ago it was possible to buy physically diverse T1s from most of the LECs where their networks supported it, with physical diversity between the customer prem and the wire center, though most of them no longer offer diversity at that speed (I don't remember how many still offer it at T3 and how many are only at OC3.) John Osmun wrote: > Farmington, NM doesn't have any redundancy either. Two types > of problems seem to drive the 3 or 4 outages in the last few years: > - electrcity cut-off at fiber regen sites because no one pays > the rural electric co-ops > - target shooting of splice boxes One of my former customers, who's in the forestry business, runs T1 cables along their railroad tracks down in the southeast. They occasionally have the usual problems with wet cables, etc. Where they've got bridges, the cables hang down below the tracks, and those also are subject to shotgun fade during hunting season. I don't know how much of it is because birds sitting on the wires make an attractive target for guys named Bubba, and how much is that after shooting up the local stopsigns, Bubba wants more of a challenge, but either way, it seemed to have been a consistent problem. Bill Stewart

1 0

RE: Harassment (was Re: ELAN.NET ...)
by Michel Py 03 Nov '03

03 Nov '03

> Scott Call wrote: > The ethics and/or legality of registering > nanog.us notwithstanding, That's what we are talking about, I think. There is value in a name; for example, Neustar (nic.us) has reserved whitehouse.us (see whois below). I would not have been too worried about some jerk trying to pretend that he's the President of the United States because his email address is president(a)whitehouse.us (besides, whitehouse.com has provided us with enough Bill Clinton jokes). Most people know better. What is to be concerned about is some troll doing something like http://www.wiana.org/ (they hijacked 1.0.0.0/8) with nanog.us. Maybe we know better, but not everyone. Michel. DOMAIN whois information on WHITEHOUSE.US ] [Query Origin: Main Whois Query ] [whois.nic.us] Domain Name: WHITEHOUSE.US Domain ID: D665758-US Sponsoring Registrar: .US RESERVE Domain Status: clientDeleteProhibited Domain Status: clientTransferProhibited Domain Status: clientUpdateProhibited Domain Status: inactive Registrant ID: NEUSTAR Registrant Name: NEUSTAR Registrant Address1: Loudoun Tech Center Registrant Address2: 45980 Center Oak Plaza Registrant City: Sterling Registrant State/Province: VA Registrant Postal Code: 20166 Registrant Country: United States Registrant Country Code: US Registrant Phone Number: +1.5714345757 Registrant Facsimile Number: +1.5714345758 Registrant Email: support(a)neustar.us Registrant Application Purpose: P1 Registrant Nexus Category: C21 Administrative Contact ID: NEUSTAR Administrative Contact Name: NEUSTAR Administrative Contact Address1: Loudoun Tech Center Administrative Contact Address2: 45980 Center Oak Plaza Administrative Contact City: Sterling Administrative Contact State/Province: VA Administrative Contact Postal Code: 20166 Administrative Contact Country: United States Administrative Contact Country Code: US Administrative Contact Phone Number: +1.5714345757 Administrative Contact Facsimile Number: +1.5714345758 Administrative Contact Email: support(a)neustar.us Administrative Contact Application Purpose: P1 Administrative Contact Nexus Category: C21 Billing Contact ID: NEUSTAR Billing Contact Name: NEUSTAR Billing Contact Address1: Loudoun Tech Center Billing Contact Address2: 45980 Center Oak Plaza Billing Contact City: Sterling Billing Contact State/Province: VA Billing Contact Postal Code: 20166 Billing Contact Country: United States Billing Contact Country Code: US Billing Contact Phone Number: +1.5714345757 Billing Contact Facsimile Number: +1.5714345758 Billing Contact Email: support(a)neustar.us Billing Contact Application Purpose: P1 Billing Contact Nexus Category: C21 Technical Contact ID: NEUSTAR Technical Contact Name: NEUSTAR Technical Contact Address1: Loudoun Tech Center Technical Contact Address2: 45980 Center Oak Plaza Technical Contact City: Sterling Technical Contact State/Province: VA Technical Contact Postal Code: 20166 Technical Contact Country: United States Technical Contact Country Code: US Technical Contact Phone Number: +1.5714345757 Technical Contact Facsimile Number: +1.5714345758 Technical Contact Email: support(a)neustar.us Technical Contact Application Purpose: P1 Technical Contact Nexus Category: C21 Created by Registrar: .US RESERVE Last Updated by Registrar: .US RESERVE Domain Registration Date: Thu Apr 18 18:14:15 GMT 2002 Domain Expiration Date: Tue Apr 17 23:59:59 GMT 2007 Domain Last Updated Date: Thu Apr 18 18:14:22 GMT 2002 >>>> Whois database was last updated on: Mon Nov 03 15:22:40 GMT 2003 <<<< NeuStar, Inc., the Registry Administrator for .US, has collected this information for the WHOIS database through a .US-Accredited Registrar. This information is provided to you for informational purposes only and is designed to assist persons in determining contents of a domain name registration record in the NeuStar registry database. NeuStar makes this information available to you "as is" and does not guarantee its accuracy. By submitting a WHOIS query, you agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data: (1) to allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via direct mail, electronic mail, or by telephone; (2) in contravention of any applicable data and privacy protection laws; or (3) to enable high volume, automated, electronic processes that apply to the registry (or its systems). Compilation, repackaging, dissemination, or other use of the WHOIS database in its entirety, or of a substantial portion thereof, is not allowed without NeuStar's prior written permission. NeuStar reserves the right to modify or change these conditions at any time without prior or subsequent notification of any kind. By executing this query, in any manner whatsoever, you agree to abide by these terms. NOTE: FAILURE TO LOCATE A RECORD IN THE WHOIS DATABASE IS NOT INDICATIVE OF THE AVAILABILITY OF A DOMAIN NAME. All domain names are subject to certain additional domain name registration rules. For details, please visit our site at www.whois.us.

4 4

DDoS detection and mitigation systems
by Mailing List Subscriptions 03 Nov '03

03 Nov '03

I am looking for real world feedback on the effectiveness of DDoS detection and mitigation devices from Riverhead, Top Layer, ISS (Proventia), Melior, etc. Some of them make pretty impressive claims of performance, too good to be true? This would be used in conjunction with other techniques as part of the defenses in layers approach to DDoS protection for my client. An important consideration would be the ability to scale to Gbps rate and beyond. Also, has anyone deployed Arbor Networks Peakflow or similar platforms to successfully detect and mitigate sizeable (100+ Mbps) DDoS attacks involving 1,000-20,000 attack sources? Do you use/develop in-house tools to analyze Netflow on your peering routers and have that interface in near-realtime with the said routers to null route (BGP and RPF) the offending sources? Last but not least, how many of you offer (or would offer) DDoS protection with strict SLA (e.g. attacks mitigated within X time units) as a value-added service? Thanks! Regards, Joe

3 2

Need contact
by Jeffrey Sharpe 03 Nov '03

03 Nov '03

Could someone from Road runner contact me off list please? This is for a routing issue. ------------------------------------------------ Jeffrey Sharpe CyberLynk Helpdesk and Support 414.858.9335 or 800.942.8022 support(a)cyberlynk.net ------------------------------------------------

1 0

Reliance buys FLAG
by Suresh Ramasubramanian 03 Nov '03

03 Nov '03

Which means that the undersea cable that feeds most of the connectivity to India (and till recently was, other than satellite, the main connectivity coming in here), now gets to be open to all comers I guess. The (former) incumbent monopoly telco VSNL had exclusive landing rights and reselling rights on FLAG - and 1. refused to allow local peering 2. lit up maybe a fraction of available FLAG capacity (even though there was a lot of demand) This sounds real good to me - except that Reliance is not exactly the sort of company I'd choose to do this. > http://www.convergenceplus.com/oct03%20itu%2042.html > >> October 17, 2003 >> Reliance to acquire FLAG for $207 million >> GENEVA -- FLAG Telecom Group Ltd., a leading provider of international wholesale network transport and communications services, has entered into an agreement and plan of amalgamation with Reliance Gateway Net Pvt. Ltd., a wholly owned subsidiary of Reliance Infocomm Ltd., pursuant to which Reliance Gateway will acquire 100 percent of the company's common shares ... >> >> Reliance, India's largest business group, is a major customer of FLAG. It holds 18 fixed licenses around the sub-continent, as well as running cdma2000 1x WLL (M) services. >> >> FLAG was formed in 1997, the world's first non-club cable operator. However, it was hit by the waves of fresh long-haul capacity launched into the international market by companies such as Global Crossing, Asia Global Crossing and Level 3. It emerged from bankruptcy in October 2002. Although it signed $77 million of new business in the first two quarters this year, FLAG Telecom Group's second quarterly filing showed a loss of $25.8 million on revenue of $33.5 million. -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations

1 0

Re: short question
by sthaug＠nethelp.no 03 Nov '03

03 Nov '03

> I have a question. I need for a project a small router than can do 2xFE > @wire speed, IOS IP feature set, and it will do BGP with a small subset of > the global routing table (~1000 networks). > > Price is a big issue, but so is stability and reliability of the > platform. Cisco Catalyst 3550 with EMI feature set. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

2 1

Telstra took 10 days to understand virus, Senate panel told
by Sean Donelan 03 Nov '03

03 Nov '03

Telstra reported on the problems viruses caused its network to a Senate panel in Australia. http://www.theage.com.au/articles/2003/11/03/1067708121544.html Telstra took 10 days to understand virus, Senate panel told Canberra November 3, 2003 Telstra spent 10 days trying to understand the Swen virus that wreaked havoc on its BigPond network and left customers without email services, a Senate committee heard today. Telstra officials conceded information they were giving BigPond customers when the virus hit last month changed as they learned more about the virus. Regulatory and corporate director Bill Scales said it took Telstra 10 days to fully understand the problem. [...] Mr Scales said Telstra was 99 per cent sure the Swen virus was to blame for the problems. "We think it was this Swen virus, we're reasonably sure that it affected us in Australia more than it affected a number of other countries for a range of reasons," he said. [...]

1 0

FBI arrests tower saboteur: spokane washington
by Sean Donelan 03 Nov '03

03 Nov '03

Today, the California Highway Patrol arrested a Spokane, Washington man in connection with the sabotage of 10 west coast electric grid towers. http://bend.com/news/ar_view%5E3Far_id%5E3D12260.htm Tower saboteur: I was only pointing out flaws By Barney Lerten Bend.com [...] Crews last Thursday had found bolts removed from three of four legs of a high-voltage power line tower south of Sacramento. It was the week's second case of sabotage in that area and the 10th such incident along the West Coast in 10 days, as the FBI intensified its search for Poulin. [...] The FBI's Sacramento Division last month obtained a federal arrest warrant charging Poulin with damaging or attempting to damage an energy facility, said Portland FBI spokeswoman Beth Anne Steele. That carries a potential 20-year prison term, if convicted.

1 0

Sabotage investigation of fiber cuts in Northwest
by Sean Donelan 03 Nov '03

03 Nov '03

KIRO TV has a report concerning the fiber cuts targeting a particular fiber route in the Northwest US. It has been been disrupted four times in the last two years, not by backhoes, but by someone entering a fiber hut. North Sound 911 Service Repeatedly Targeted by Chris Halsne KIRO 7 Eyewitness News Investigative Reporter [...] This person hasn't been randomly chopping entire bundles of cables, but rather he or she is using surgical precision to black out one particular 911 emergency call center. Early in the morning of Sept. 3, some criminal strolled into a Qwest Telecommunications server station with tools in hand and carefully sliced one strand of wire. [...] Operators couldn't help but feel a sense of dj vu. KIRO Team 7 Investigators have learned that someone intentionally rerouted, cut or altered 911 service to Whatcom County on three occasions in two years. Each time the criminal entered the same Qwest fiber optics "hut" to create the chaos. [...] http://www.kirotv.com/news/2601577/detail.html

4 3

RE: Harassment (was Re: ELAN.NET ...)
by Michel Py 03 Nov '03

03 Nov '03

> Richard Cox wrote: > The only relevance of those postings to this group can be > found by observing exactly how the MX (69.60.142.242) for > his email address (MBooth(a)corp.as26857.com) answers on > Port 25. Most interesting! Indeed. Would be worth taking action with nic.us. Michel.

2 1