- NANOG - lists.nanog.org

Re: DNS anycast considered harmful (was: .ORG problems this evening)
by Todd Vierling 18 Sep '03

18 Sep '03

On Thu, 18 Sep 2003, Stephane Bortzmeyer wrote: : BIND does it but what about Microsoft cache/forwarder? At RIPE 45 (you : were there), a talk by people at CAIDA showed that A.root-servers.net : received twice as much traffic as the other root name servers since it : is just the first one listed... There's an easy fix to that particular situation: Make the first (or first two) listed servers anycast, and the rest unicast. That gains the distributed nature of anycast to deal with crap like this, while keeping the ability for DNS servers to find one that is *up*. -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com>

1 0

Re: What *are* they smoking?
by George William Herbert 18 Sep '03

18 Sep '03

>> A wildcard A record in the net TLD. > >It's Verisign's return shot at the web browser "couldn't find this page" >searches. Doesn't seem to have much by way of advertising yet, but I'm >sure that'll change. I heard about this coming from somewhere last week, >though I don't recall where. Probably Wired or the WSJ. Verisign wants >the revenue that all those typos are generating. It's just the next shot >in the eyeball war. This is sufficiently technically and business slimy that I would null-route that IP, personally. -george william herbert gherbert(a)retro.com

16 18

Re: ICANN - Formal Complaint re Verisign
by Michael.Dillon＠radianz.com 18 Sep '03

18 Sep '03

>One thing I haven't seen mentioned in all this is the incredible business >monopolizing effect this move will have on the TLD's in question. It >dramatically shifts the domain playing field in Verisign's favor by pointing >millions of potential customers to their site(s) specifically, giving them >millions of dollars in free advertising eye-time over any of the competition I don't see how this eye-time can be translated into millions of dollars. But it is clear that Verisign are making money by selling sponsored links to people who sell spamming services and software. And it is also clear that this redirection of traffic allows them to amass a large database of email addresses that are current, active and which belong to people who don't always check things carefully before acting, i.e. the To: email address was mistyped. They could make a lot of money selling that list of email addresses to spammers. And they could also sell a lot of the mistyped addresses after "correcting" the domain name portion by supplying the closest matches from the .COM and .NET database. I wonder how anyone can continue to trust a company like this as a certificate authority. They seem to have attracted the breed of get-rich-quick management who want to make money by scamming the public and selling very unsubtantial things like names(.COM) and numbers (SSL certs). I don't pretend to believe that we can stop fast-buck artists from running these sorts of scams but we have to find alternative sources for SSL certs from companies whose business model lies squarely in the world of security and trust. That clearly excludes Verisign. Any company with such shoddy business practices that they can unleash this technically flawed redirection of traffic without proper testing and public consultation is also a soft target for infiltration. As was already mentioned, it is only a matter of time before a criminal gang infiltrates Verisign and launches man-in-the-middle attacks on the banking system. There are already people that are specifically targetting banks by installing surreptitious keyloggers on computers that sniff out Internet banking passwords. This would be far more effective if the keyloggers were installed by a man-in-the-middle so that they were targetted only at the intended victims. --Michael Dillon

1 0

Route failures to behosting.com
by Lou Katz 18 Sep '03

18 Sep '03

I am unable to reach them via several different ISPs. It looks to my naive eyes like routes to them have vanished. Can anyone shed any light on this? -- -=[L]=-

5 6

BGP issues
by Bret Baptist 18 Sep '03

18 Sep '03

I recently deployed a multihome BGP configuration at our location. Now I am having issues of some of my netblocks not being reachable or not being able to reach certain networks. I am uncertain what the issue might be. Right now I have visi.com as one provider (AS8015), and Qwest (AS3908) as the other. When I look at the as-paths for my netblocks the ones from visi.com look fine, 208.42.20.0/23 and 208.42.104.0/23, the ones from Qwest go through visi.com and then on to us, 65.116.186.0/24, 65.121.8.0/23. The Qwest networks are the ones that I am having problems reaching hosts from or getting to from other networks. Any insight would be greatly appreciated, if anyone needs more information just let me know and I can supply router configs or whatever might be needed. Thank you in advance. -- Bret Baptist Systems and Technical Support Specialist bbaptist(a)iexposure.com Internet Exposure, Inc. http://www.iexposure.com (612)676-1946 x17 Web Development-Web Marketing-ISP Services ------------------------------------------ Today is the tomorrow you worried about yesterday.

4 3

route to behosting.com
by Lou Katz 18 Sep '03

18 Sep '03

Actually, me bad. It is the nameservers they use for their clients: ns5.behosting.com 208.56.139.155 ns6.behosting.com 208.56.138.142 I cannot reach either from many nets on the west coast, and the traceroutes die very early: >From usenix.org: 12-% traceroute -n 208.56.139.155 traceroute to 208.56.139.155 (208.56.139.155), 30 hops max, 40 byte packets 1 131.106.3.254 0.677 ms 0.324 ms 0.310 ms 2 131.106.1.252 0.937 ms 0.971 ms 0.931 ms 3 * * * 4 * normally goes out: 1 gw.usenix.org (131.106.3.254) 0.561 ms 0.296 ms 0.260 ms 2 alternet-gw.usenix.ORG (131.106.1.252) 1.396 ms 1.024 ms 1.324 ms 3 twtwan (206.169.168.45) 235.612 ms 106.793 ms 156.533 ms 4 twtgw (206.169.155.13) 212.983 ms 154.202 ms 213.979 ms 5 ^C dist-02-so-0-0-0-0.okld.twtelecom.net (168.215.55.74) 176.927 ms 217.310 ms 173.318 ms >From other nets available to me: traceroute to 208.56.139.155 (208.56.139.155), 64 hops max, 44 byte packets 1 megapath-gw (192.160.193.1) 3.408 ms 1.670 ms 1.634 ms 2 ip-64-139-1-1.dsl.sca.megapath.net (64.139.1.1) 11.782 ms 11.101 ms 10.642 ms 3 * * * traceroute to 208.56.139.155 (208.56.139.155), 64 hops max, 44 byte packets 1 (10.9.129.35) 3.734 ms 2.450 ms 2.311 ms 2 (10.8.5.73) 89.816 ms 169.081 ms 145.875 ms 3 (10.8.2.1) 210.021 ms 219.102 ms 280.200 ms 4 * * (10.x.x.x internal to my ISP - WCOM) traceroute to 208.56.139.155 (208.56.139.155), 30 hops max, 38 byte packets 1 sonic-gw (209.204.189.1) 14.490 ms 14.470 ms 12.984 ms 2 fast1-0-0.border.sr.sonic.net (208.201.224.194) 16.476 ms 24.872 ms 14.633 ms 3 fast4-1-0.border2.sr.sonic.net (64.142.0.26) 15.193 ms 14.675 ms 16.076 ms 4 serial1-0.gw.focal-sf.sonic.net (64.142.0.2) 17.359 ms 16.794 ms 15.017 ms 5 * * * >From the well: traceroute to 208.56.139.155 (208.56.139.155) 30 hops max, 38 byte packets 1 gw.well.com (206.14.209.1) 2 ms 2 ms 1 ms 2 206.14.211.65 (206.14.211.65) 86 ms 1 ms 1 ms 3 206.14.211.65 (206.14.211.65) 1 ms (ttl=254!) !H * 1 ms (ttl=254!) !H -- -=[L]=-

2 1

RE: Route failures to behosting.com
by McBurnett, Jim 18 Sep '03

18 Sep '03

good from AT&T and Broadwing J > -----Original Message----- > From: Haesu [mailto:haesu@towardex.com] > Sent: Wednesday, September 17, 2003 9:46 PM > To: Henry Yen; nanog(a)merit.edu > Subject: Re: Route failures to behosting.com > > > > Also accessible no problem from Qwest and Nlayer. > > -hc > > -- > Sincerely, > Haesu C. > TowardEX Technologies, Inc. > WWW: http://www.towardex.com > E-mail: haesu(a)towardex.com > Cell: (978) 394-2867 > On Wed, Sep 17, 2003 at 09:35:54PM -0400, Henry Yen wrote: > > > > On Wed, Sep 17, 2003 at 09:29:57AM -0400, Brian Bruns wrote: > > > Attempts to access behosting.com were successful from > several different > > > locations, which included ameritech and sprint. I'm not > going to include > > > traceroutes here (if you would like them, I can email them to you > > > privately). What ISPs are you using to try and get to them? > > > > behosting.com/www.behosting.com (aka 216.121.96.160) also accessible > > without problem from sprint and uunet. > > > > > ----- Original Message ----- > > > From: "Lou Katz" <lou(a)metron.com> > > > To: <nanog(a)merit.edu> > > > Sent: Wednesday, September 17, 2003 9:23 PM > > > Subject: Route failures to behosting.com > > > > > > > I am unable to reach them via several different ISPs. It looks > > > > to my naive eyes like routes to them have vanished. Can anyone > > > > shed any light on this? > > > > -- > > Henry Yen Aegis > Information Systems, Inc. > > Senior Systems Programmer Hicksville, New York > >

1 0

RE: Route failures to behosting.com
by Shawn Jackson 18 Sep '03

18 Sep '03

Behosting.com is accessible from AT&T with no problems. traceroute to behosting.com (216.121.96.160), 30 hops max, 38 byte packets 1 gw (12.22.x.xxx) 1.974 ms 1.939 ms 1.983 ms 2 12.118.156.29 (12.118.156.29) 8.395 ms 6.070 ms 6.015 ms 3 gbr5-p59.sffca.ip.att.net (12.123.195.130) 8.975 ms 8.543 ms 8.453 ms 4 tbr1-p013501.sffca.ip.att.net (12.122.11.73) 9.568 ms 9.286 ms 9.276 ms 5 ggr1-p360.sffca.ip.att.net (12.123.13.65) 8.584 ms 8.544 ms 8.503 ms 6 svl-brdr-02.inet.qwest.net (205.171.1.165) 141.856 ms 142.191 ms 141.599 ms 7 svl-core-03.inet.qwest.net (205.171.14.162) 142.247 ms 144.525 ms 144.658 ms 8 svl-edge-09.inet.qwest.net (205.171.14.98) 142.824 ms 141.505 ms 137.071 ms 9 65.113.32.50 (65.113.32.50) 139.001 ms 148.024 ms 139.999 ms 10 behosting.com (216.121.96.160) 144.550 ms 135.547 ms 138.744 ms Shawn Jackson Systems Administrator Horizon USA 1190 Trademark Dr #107 Reno NV 89521 www.horizonusa.com Email: sjackson(a)horizonusa.com Phone: (775) 858-2338 (800) 325-1199 x338 -----Original Message----- From: Lou Katz [mailto:lou@metron.com] Sent: Wednesday, September 17, 2003 5:23 PM To: nanog(a)merit.edu Subject: Route failures to behosting.com I am unable to reach them via several different ISPs. It looks to my naive eyes like routes to them have vanished. Can anyone shed any light on this? -- -=[L]=-

1 0

RE: Worst design decisions?
by Shawn Solomon 18 Sep '03

18 Sep '03

The 12016 does have handles on the sides, but the documentation states not to use them for lifting purposes. Yeah, I laughed too, just before realizing that bear-hugging a 16 into position takes a bit of motivation. It is definitely one big hunk of iron (300+lbs on the shipping invoice), but I just couldn't understand why in the @%$$ useful handles weren't provided. On a side note, the scissor-jacks that came with them could lift a house. Heh. http://www.cisco.com/en/US/products/hw/routers/ps167/prod_installation_g uide09186a0080188f38.html ------------------------------------------------------------------------ -------- Warning Do not attempt to lift the chassis with the handles on the back and sides of the chassis. These handles are not designed to support the weight of the chassis, and should be used only to steady and guide the chassis while it is being inserted into or removed from an equipment rack. To reduce the risk of damage to the chassis and serious bodily injury, do not use these handles to lift or support the chassis. ------------------------------------------------------------------------ -------- -----Original Message----- From: Matt [mailto:acheron@qwest.net] Sent: Wednesday, September 17, 2003 5:43 PM To: nanog(a)merit.edu Subject: Worst design decisions? Hello all, Was doing some upgrades on a UBR7246 (to a VXR), and I got to thinking about short sighted design considerations. I was curious if any of you had some pet peeves from a design perspective to rant about. I'll start with a couple. 1) Why did Cisco design the I/O controller on the 7246 with screws in the corner, which are very difficult to get at? And worse than that, why did they not include a cheap handle on the blank in this slot? 2) Why did Cisco not include side handles on the 12000 chassis? It's a heavy chassis, and I can imagine how many techs have thrown out their back moving that chassis around. I've got a couple others in my head from 3Com and a couple of others, but I thought I'd get the ball rolling. So, what do you think?

1 0

ICANN - Formal Complaint re Verisign
by Jerry Eyers 18 Sep '03

18 Sep '03

One thing I haven't seen mentioned in all this is the incredible business monopolizing effect this move will have on the TLD's in question. It dramatically shifts the domain playing field in Verisign's favor by pointing millions of potential customers to their site(s) specifically, giving them millions of dollars in free advertising eye-time over any of the competition Jerry

5 4