- NANOG - lists.nanog.org

Comcast
by Wesley Vaux 07 Oct '03

07 Oct '03

Is anyone having issues sending or receiving email to comcast.net? Is there anyone here from comcast? Wes Vaux, CCNA, CCDA Network Security Engineer

2 1

Re: Reverse DNS problem
by Trent Arsenault 06 Oct '03

06 Oct '03

I've been in touch with ARIN on the same issue noticed at a different site. According to ARIN, some older BIND resolvers aren't handling the referrals that they get back from the gtld-servers for some of ARIN's name servers. The problem started Thursday when ARIN changed the list of NS's for the ARIN in-addr.arpa zones. ARIN is still investigating and I'm waiting to hear back. Trent Arsenault trent(a)trent.us At 05:46 AM 10/6/2003, Schmiedt, Jamie wrote: >We have been experiencing problems with reverse DNS requests since >Thursday 10/2/2003. Just wondering if anyone else is seeing this issue? >This is affecting freeBSD & Linux hosts with Bind version 8.2.3 & 8.3.3. > >Reverse Lookups fail as follows: >host0001$ nslookup >Default Server: host0001.domain123.net >Address: 0.0.0.0 > > ccn.com >Server: host0001.domain123.net >Address: 0.0.0.0 >Name: ccn.com >Address: 63.172.52.127 > > 63.172.52.127 >Server: host0001.domain123.net >Address: 0.0.0.0 >*** Request to host0001.domain123.net timed-out > > > >tcpdump shows this: >16:32:21.864111 123.123.123.123.1024 > 192.12.94.30.53: 6333 A? >chia.ARIN.NET. (31) >16:32:21.864298 123.123.123.123.1024 > 192.12.94.30.53: 48444 A? >dill.ARIN.NET. (31) >16:32:21.864597 123.123.123.123.1024 > 192.12.94.30.53: 43887 A? >henna.ARIN.NET. (32) >16:32:21.864754 123.123.123.123.1024 > 192.12.94.30.53: 13510 A? >indigo.ARIN.NET. (33) >16:32:21.864910 123.123.123.123.1024 > 192.12.94.30.53: 6129 A? >epazote.ARIN.NET. (34) >16:32:21.865067 123.123.123.123.1024 > 192.12.94.30.53: 61408 A? >figwort.ARIN.NET. (34) >16:32:21.865222 123.123.123.123.1024 > 192.12.94.30.53: 38595 A? >ginseng.ARIN.NET. (34) >16:32:21.865383 123.123.123.123.1024 > 192.36.148.17.53: 60682 PTR? >127.52.172.63.in-addr.arpa. (46) >16:32:21.932444 192.12.94.30.53 > 123.123.123.123.1024: 48444- 0/7/7 >(271) (DF) >16:32:21.941921 192.12.94.30.53 > 123.123.123.123.1024: 6333- 0/7/7 (271) >(DF) >16:32:21.951550 192.12.94.30.53 > 123.123.123.123.1024: 43887- 0/7/7 >(272) (DF) >16:32:21.961288 192.12.94.30.53 > 123.123.123.123.1024: 13510- 0/7/7 >(273) (DF) >16:32:21.970903 192.12.94.30.53 > 123.123.123.123.1024: 6129- 0/7/7 (274) >(DF) >16:32:21.980540 192.12.94.30.53 > 123.123.123.123.1024: 61408- 0/7/7 >(274) (DF) >16:32:21.990282 192.12.94.30.53 > 123.123.123.123.1024: 38595- 0/7/7 >(274) (DF) >16:32:22.016671 192.36.148.17.53 > 123.123.123.123.1024: 60682- 0/7/0 >(199) (DF) >16:32:22.017854 123.123.123.123.1024 > 192.54.112.30.53: 46181 A? >chia.ARIN.NET. (31) >16:32:22.017883 123.123.123.123.1024 > 192.54.112.30.53: 28356 A? >dill.ARIN.NET. (31) >16:32:22.017907 123.123.123.123.1024 > 192.54.112.30.53: 29015 A? >henna.ARIN.NET. (32) >16:32:22.017932 123.123.123.123.1024 > 192.54.112.30.53: 39822 A? >indigo.ARIN.NET. (33) >16:32:22.017958 123.123.123.123.1024 > 192.54.112.30.53: 25113 A? >epazote.ARIN.NET. (34) >16:32:22.017984 123.123.123.123.1024 > 192.54.112.30.53: 7656 A? >figwort.ARIN.NET. (34) >16:32:22.018008 123.123.123.123.1024 > 192.54.112.30.53: 53035 A? >ginseng.ARIN.NET. (34) >16:32:22.142472 192.54.112.30.53 > 123.123.123.123.1024: 28356- 0/7/7 >(271) (DF) >16:32:22.151936 192.54.112.30.53 > 123.123.123.123.1024: 46181- 0/7/7 >(271) (DF) >16:32:22.161553 192.54.112.30.53 > 123.123.123.123.1024: 39822- 0/7/7 >(273) (DF) >16:32:22.171199 192.54.112.30.53 > 123.123.123.123.1024: 29015- 0/7/7 >(272) (DF) >16:32:22.180924 192.54.112.30.53 > 123.123.123.123.1024: 25113- 0/7/7 >(274) (DF) >16:32:22.190561 192.54.112.30.53 > 123.123.123.123.1024: 53035- 0/7/7 >(274) (DF) >16:32:22.200290 192.54.112.30.53 > 123.123.123.123.1024: 7656- 0/7/7 >(274) (DF) >16:32:26.868123 123.123.123.123.1024 > 192.41.162.30.53: 32457 A? >chia.ARIN.NET. (31) >16:32:26.868300 123.123.123.123.1024 > 192.41.162.30.53: 65240 A? >dill.ARIN.NET. (31) >16:32:26.868452 123.123.123.123.1024 > 192.41.162.30.53: 15332 A? >henna.ARIN.NET. (32) >16:32:26.868602 123.123.123.123.1024 > 192.41.162.30.53: 41975 A? >indigo.ARIN.NET. (33) >16:32:26.868753 123.123.123.123.1024 > 192.41.162.30.53: 21934 A? >epazote.ARIN.NET. (34) >16:32:26.868905 123.123.123.123.1024 > 192.41.162.30.53: 56761 A? >figwort.ARIN.NET. (34) >16:32:26.869057 123.123.123.123.1024 > 192.41.162.30.53: 52488 A? >ginseng.ARIN.NET. (34) >16:32:26.869208 123.123.123.123.1024 > 198.41.0.4.53: 64459 PTR? >127.52.172.63.in-addr.arpa. (46) >16:32:26.923374 192.41.162.30.53 > 123.123.123.123.1024: 32457- 0/7/7 >(271) (DF) >16:32:26.930326 198.41.0.4.53 > 123.123.123.123.1024: 64459- 0/7/0 (199) >16:32:26.931103 123.123.123.123.1024 > 192.52.178.30.53: 45170 A? >chia.ARIN.NET. (31) >16:32:26.939982 192.41.162.30.53 > 123.123.123.123.1024: 15332- 0/7/7 >(272) (DF) >16:32:26.949578 192.41.162.30.53 > 123.123.123.123.1024: 65240- 0/7/7 >(271) (DF) >16:32:26.959220 192.41.162.30.53 > 123.123.123.123.1024: 41975- 0/7/7 >(273) (DF) >16:32:26.968842 192.41.162.30.53 > 123.123.123.123.1024: 21934- 0/7/7 >(274) (DF) >16:32:26.978581 192.41.162.30.53 > 123.123.123.123.1024: 56761- 0/7/7 >(274) (DF) >16:32:26.988220 192.41.162.30.53 > 123.123.123.123.1024: 52488- 0/7/7 >(274) (DF) >16:32:27.058851 192.52.178.30.53 > 123.123.123.123.1024: 45170- 0/7/7 >(271) (DF) > >We can temporarily resolve the problem by issuing the following dig command: > >dig @<any ARIN in-addr.arpa server; ginseng, fogwort, etc.> -x <any sequence> >example: host0001# dig @ginseng.arin.net -x abc > >Then the reverse lookups being to work and the tcpdump is as follows: >(notice the difference in lines 8,9,10,11) >16:33:01.664320 123.123.123.123.1024 > 192.35.51.32.53: 33751 A? >chia.ARIN.NET. (31) >16:33:01.664460 123.123.123.123.1024 > 192.35.51.32.53: 11278 A? >dill.ARIN.NET. (31) >16:33:01.664573 123.123.123.123.1024 > 192.35.51.32.53: 55449 A? >henna.ARIN.NET. (32) >16:33:01.664684 123.123.123.123.1024 > 192.35.51.32.53: 49768 A? >indigo.ARIN.NET. (33) >16:33:01.664797 123.123.123.123.1024 > 192.35.51.32.53: 18859 A? >epazote.ARIN.NET. (34) >16:33:01.664909 123.123.123.123.1024 > 192.35.51.32.53: 40146 A? >figwort.ARIN.NET. (34) >16:33:01.665002 123.123.123.123.1024 > 192.33.14.32.53: 62349 PTR? >127.52.172.63.in-addr.arpa. (46) >16:33:01.725238 192.35.51.32.53 > 123.123.123.123.1024: 33751*- 1/8/8 A >192.5.6.32 (320) (DF) >16:33:01.736288 192.35.51.32.53 > 123.123.123.123.1024: 11278*- 1/8/8 A >192.35.51.32 (320) (DF) >16:33:01.747452 192.35.51.32.53 > 123.123.123.123.1024: 55449*- 1/8/8 A >192.26.92.32 (321) (DF) >16:33:01.758663 192.35.51.32.53 > 123.123.123.123.1024: 49768*- 1/8/8 A >192.31.80.32 (322) (DF) >16:33:01.765379 192.33.14.32.53 > 123.123.123.123.1024: 62349- 0/3/0 >(134) (DF) >16:33:01.765834 123.123.123.123.1024 > 199.191.128.105.53: 19916 PTR? >127.52.172.63.in-addr.arpa. (46) >16:33:01.776697 192.35.51.32.53 > 123.123.123.123.1024: 18859*- 1/8/8 A >192.41.162.32 (323) (DF) >16:33:01.787806 192.35.51.32.53 > 123.123.123.123.1024: 40146*- 1/8/8 A >192.42.93.32 (323) (DF) >16:33:01.794121 199.191.128.105.53 > 123.123.123.123.1024: 19916*- 1/2/2 >(171) (DF) > > >Restarting named does not help. >These host are located on several different ISP networks. >Forward lookups function properly. > >Stumped... > >Any help or suggestions would be greatly appreciated. Thanks. > >-jamie >

1 0

RE: cisco site down? multiple sources reporting connectivity problems
by Sean McPherson 06 Oct '03

06 Oct '03

> From: Brennan_Murphy > Date: Mon Oct 06 14:56:46 2003 > > --------------------------------------------------------------------------- > > I'm on multiple mailing lists now with multiple persons reporting > connectivity issues to cisco.com. > > Can anyone summarize what the issue is? I'm currently getting the following: [sean@smidgen /tmp]$ telnet www.cisco.com 80 GET / HTTP/1.0 HTTP/1.1 200 OK Date: Mon, 06 Oct 2003 20:33:47 GMT Server: CCO/1.0 (Unix) Set-Cookie: CP_GUTC=128.107.241.137.138341065472427777; path=/; expires=Fri, 29-Sep-28 20:33:47 GMT; domain=.cisco.com Content-Type: text/html Connection: close Connection closed by foreign host. And poof, that's it. No data. Try again, and I randomly get the whole page, part of the page down to the 'Feedback' line, or nothing. Same thing happens from work (AT&T / Qwest) or from my cable modem at home (InsightBB.com) Mozilla/Firebird and IE (5 or 6) seem to treat it a bit differently, and so far, Galeon and Opera seem the most adept at handling it w/o spitting up when a page closes mid-stream. Sean McPherson nanog <@ is the at sign> seanmcpherson dotcom

2 1

Will reverting DNS wildcard have any adverse affects?
by Gerald 06 Oct '03

06 Oct '03

I keep trying to think of how this discussion could be operationally relevant. The only thing I could come up with is: Will reverting back to the proper NXDOMAIN break anything? I have only seen inconveniences on my network since they changed, though I know some had it worse than I did. For the benefit of other NANOG readers, make sure reverting back won't cause more headaches on your network. Gerald Coon - How are ya? Never been better, ... Just once I'd like to be better.

9 19

RE: cisco site down? multiple sources reporting connectivity problems
by Brennan_Murphy＠NAI.com 06 Oct '03

06 Oct '03

I'm on multiple mailing lists now with multiple persons reporting connectivity issues to cisco.com. Can anyone summarize what the issue is? -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Ezequiel Carson Sent: Monday, October 06, 2003 11:41 AM To: Martin Hepworth Cc: nanog(a)merit.edu Subject: Re: cisco site down? i was using galeon 1.3.5 now it seems to be working.. On Mon, 2003-10-06 at 12:26, Martin Hepworth wrote: > Ezequiel Carson wrote: > > > hi, > > can anyone use cisco site? > > > > > > [root@localhost root]# telnet www.cisco.com 80 > > Trying 198.133.219.25... > > Connected to www.cisco.com. > > Escape character is '^]'. > > Connection closed by foreign host. > > [root@localhost root]# > > > > ezequiel. > > > > > > > doesn't work from UK either... > > mozilla say 'document contains no data! > > borken..:-(

2 1

NSI privacy advocate
by John Kinsella 06 Oct '03

06 Oct '03

I double checked...the press release isn't dated April 1...NSI talking about privacy while keeping a straight face? http://www.verisign.com/corporate/news/2003/pr_20030930.html

1 0

Earthlink contact
by Sean Crandall 06 Oct '03

06 Oct '03

Greetings. If there is someone from Earthlink who wouldn't mind talking about Earthlink's experience with the Cisco 10000, I would appreciate it if you could contact me off list. Thanks. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. 6691 Owens Drive Pleasanton, CA 94588 (925) 201-2530 (office) (925) 201-2550 (fax)

1 0

Re: VeriSign Capitulates
by Michael.Dillon＠radianz.com 06 Oct '03

06 Oct '03

> "There is no data to indicate the core operation of the domain name > system or the stability of the Internet has been adversely affected," > VeriSign's Galvin said. This means that there are no papers published or conference presentations which detail the problems caused by sitefinder. A number of people who posted messages to this list could rectify that lack of data by writing up their findings in a short paper and presenting it at a conference or publishing it in a magazine or journal. I don't think the fight is over yet. --Michael Dillon

3 2

cisco site down?
by Ezequiel Carson 06 Oct '03

06 Oct '03

hi, can anyone use cisco site? [root@localhost root]# telnet www.cisco.com 80 Trying 198.133.219.25... Connected to www.cisco.com. Escape character is '^]'. Connection closed by foreign host. [root@localhost root]# ezequiel.

3 3

RE: cisco site down?
by Wim De Houwer 06 Oct '03

06 Oct '03

works just fine from BE > -----Original Message----- > From: Martin Hepworth [mailto:martinh@solid-state-logic.com] > Sent: maandag 6 oktober 2003 17:26 > Cc: nanog(a)merit.edu > Subject: Re: cisco site down? > > > > Ezequiel Carson wrote: > > > hi, > > can anyone use cisco site? > > > > > > [root@localhost root]# telnet www.cisco.com 80 > > Trying 198.133.219.25... > > Connected to www.cisco.com. > > Escape character is '^]'. > > Connection closed by foreign host. > > [root@localhost root]# > > > > ezequiel. > > > > > > > doesn't work from UK either... > > mozilla say 'document contains no data! > > borken..:-( > > -- > Martin Hepworth > Senior Systems Administrator > Solid State Logic Ltd > +44 (0)1865 842300 > > > > > ********************************************************************** > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote also confirms that this email message has been swept by > MIMEsweeper for the presence of computer viruses. > > www.mimesweeper.com > ********************************************************************** > >

1 0