- NANOG - lists.nanog.org

RE: 151 Front St Toronto (Torix)
by Mark Segal 15 Aug '03

15 Aug '03

They all just came back up... And the Canadians, have managed to bring power to their exchange points, by disconnecting from the American grid ;). Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Mark Segal Sent: August 14, 2003 11:13 PM To: 'Mike Tancsa' Subject: RE: 151 Front St Toronto (Torix) All my peers went down about an hour ago too.. (well the ones that were still up). Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Mike Tancsa [mailto:mike@sentex.net] Sent: August 14, 2003 11:05 PM To: nanog(a)merit.edu Subject: 151 Front St Toronto (Torix) Does anyone know whats up with them ? All my peers are down now and the host for the mailing list is still off the air. ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

1 0

RE: The impending DDoS storm
by Jason Frisvold 15 Aug '03

15 Aug '03

On Wed, 2003-08-13 at 10:55, Ingevaldson, Dan (ISS Atlanta) wrote: > More info: > > -Opens a raw socket and spoofs its source address It *appears* to us through current testing that the source address spoofed is always within the class of the current subnet... So, a spoofing filter that denies all but the local subnet may only be partially affective.. > -Randomizes its source port, but destination is always TCP/80 > -Does one DNS lookup on "windowsupdate.com" and then uses the IP > returned > -The window size is always 16384 (this might be useful) It also looks like there is no throttling at all.. it abuses as much bandwidth as it possibly can... > > Regards, > =============================== > Daniel Ingevaldson > Engineering Manager, X-Force R&D > dsi(a)iss.net > 404-236-3160 > > Internet Security Systems, Inc. > The Power to Protect > http://www.iss.net > =============================== > > > -----Original Message----- > From: Jason Frisvold [mailto:friz@corp.ptd.net] > Sent: Wednesday, August 13, 2003 10:50 AM > To: Ingevaldson, Dan (ISS Atlanta) > Cc: Stephen J. Wilcox; nanog(a)merit.edu > Subject: RE: The impending DDoS storm > > > On Wed, 2003-08-13 at 10:14, Ingevaldson, Dan (ISS Atlanta) wrote: > > It might be somewhat tricky to block TCP/80 going to > > windowsupdate.com. > > I agree... but then, who needs updates anyways.. *grin* > > > Regards, > > =============================== > > Daniel Ingevaldson > > Engineering Manager, X-Force R&D > > dsi(a)iss.net > > 404-236-3160 > > > > Internet Security Systems, Inc. > > The Power to Protect > > http://www.iss.net > > =============================== > > > > > > -----Original Message----- > > From: Stephen J. Wilcox [mailto:steve@telecomplete.co.uk] > > Sent: Wednesday, August 13, 2003 10:38 AM > > To: Jason Frisvold > > Cc: nanog(a)merit.edu > > Subject: Re: The impending DDoS storm > > > > > > > > > > On Wed, 13 Aug 2003, Jason Frisvold wrote: > > > > > All, > > > > > > What is everyone doing, if anything, to prevent the apparent > > upcoming > > > DDoS attack against Microsoft? From what I've been reading, and > > > what > > > I've been told, August 16th is the apparent start date... > > > > > > We're looking for some solution to prevent wasting our network > > > resources transporting this traffic, but at the same time trying to > > > allow legitimate through... > > > > > > So, is anyone planning on doing anything? > > > > See previous discussion on filtering... > > > > > > Other than that experience says if these things turn out to be big > > enough to cause an issue then they quickly burn themselves out anyway > > > > Steve -- --------------------------- Jason H. Frisvold Backbone Engineering Supervisor Penteledata Engineering friz(a)corp.ptd.net RedHat Engineer - RHCE # 807302349405893 Cisco Certified - CCNA # CSCO10151622 MySQL Core Certified - ID# 205982910 --------------------------- "Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." -- Albert Einstein [1879-1955]

7 7

general? monitoring and statistics
by Jon Torrez 15 Aug '03

15 Aug '03

With the media and others flinging "... Niagara-Mohawk power grid was overloaded." Why are the power grid/$joe_powercompany line capacity stats so hard to come by? One would think a simple http(s)? request would show graphs of current/slightly delayed line capacity publicly. If not, with todays events showing international connectivity and their weaknesss change anything? Of course the technology is avaliable to do this exists but one would have to sit in a certain chair to see it. Sure, that's fine with private / managed service(s). I'm talking the grid here and their capacity buy and sell metrics by watt to $joe_powercompany. What about $joe_powercompany load sharing lines as well? Anyone running a list of URLs that are relative to this?

2 1

Private port numbers?
by Iljitsch van Beijnum 15 Aug '03

15 Aug '03

Be damned if you filter, be damned if you don't. Nice choice. I think it's time that we set aside a range of port numbers for private use. That makes all those services that have no business escaping out in the open extremely easy to filter, while at the same time not impacting any legitimate users. Services could even be assigned two port numbers: a public one and a private one. So I could use port 80 to access the web, but port 32768 + 80 (or whatever) to manage my ADSL modem over HTTP. Applications would just need a few lines of code to try either the public or the private port first (depending on the type of application and possibly some heuristics) and try the other port when there is a destination port unreachable or administratively prohibited message. (Note that what I mean here has nothing to do with what IANA calls "private" ports.)

8 11

RE: Big power outage in Ontario ?
by Malayter, Christopher 15 Aug '03

15 Aug '03

The power outages in the North East US, also go into canada as far in as Toronto and Ottawa from what US news sources are reporting. -Chris -----Original Message----- From: Mike Tancsa [mailto:mike@sentex.net] Sent: Thursday, August 14, 2003 3:29 PM To: nanog(a)merit.edu Subject: Big power outage in Ontario ? Anyone know whats up with the big power outage in Ontario Canada ? ---Mike

5 4

Re: NERC summer 2003 power predictions
by Steven M. Bellovin 15 Aug '03

15 Aug '03

http://www.cbc.ca/stories/2003/08/14/energyexpert_030814 We predicted this: energy expert Last Updated Thu, 14 Aug 2003 20:57:07 BOULDER, COLORADO - Energy experts have been warning about large-scale blackouts in North America since the early eighties. Bill Browning of the Rocky Mountain Institute in Colorado says a report for the U.S. Pentagon in 1982 cautioned the American government about the fragility of the power grid system in North America. ... --Steve Bellovin, http://www.research.att.com/~smb

1 0

Power outage in the Northeast
by Timo Janhunen 15 Aug '03

15 Aug '03

I hope they get the power issues resolved soon ... my igloo is going to melt soon! Cheers! Timo Janhunen Aurora Cable Internet email: timo(a)aci.on.ca | voice: +1 (905) 727-1981 x253 | fax: +1 (905) 727-7407

1 0

RE: East Coast outage? (remote power -- as in remote huts)
by Mike Tancsa 15 Aug '03

15 Aug '03

Although our main office here has generator power, what do all the intermediary unmanaged network sites typically have for DC power along the way ? One of my local fibre providers told me that the remote hut we are off of only will last until about 9:30pm tonight and then bye bye. Is that typical to have 6hrs battery ? I am sure its all over the map from provider to provider, but does anyone know what Bell Canada (my other local loop provider) typical aims for in terms of battery power for remote huts ? ---Mike At 05:41 PM 14/08/2003 -0400, Ingevaldson, Dan (ISS Atlanta) wrote: >Latest is the failure at 14th street was the original failure and the >rest cascaded from there. > >-d > >-----Original Message----- >From: up(a)3.am [mailto:up@3.am] >Sent: Thursday, August 14, 2003 4:51 PM >To: Aaron D. Britt >Cc: nanog(a)merit.edu >Subject: Re: East Coast outage? > > > > > >From CNN: > >NEW YORK (CNN) -- A major power outage simultaneously struck several >large cities in the United States and Canada late Thursday afternoon. > >Cities affected include New York; Boston, Massachusetts; Cleveland, >Ohio; Detroit, Michigan; Toronto, Ontario; and Ottawa, Ontario. The >power outage occurred shortly after 4 p.m. > ><snip> > >no word on the cause(s), but a ConEd transformer on East 14th street was >said to be on fine...not sure how that could affect other cities, >though... > >On Thu, 14 Aug 2003, Aaron D. Britt wrote: > > > > > I just lost 80 circuits (Voice and Data), across multiple states on > > the East Coast in the last 10 minutes. Is there a Northeast power > > outage or fiber cut that anyone knows about? > > > > Any info would be appreciated... > > > > -Aaron > > > > > >James Smallacombe PlantageNet, Inc. CEO and Janitor >up(a)3.am http://3.am >======================================================================== >=

2 1

Forwarded message: NANOG - Outage Summary
by Richard Welty 14 Aug '03

14 Aug '03

forwarded (with permission) for someone who can't post to nanog: ------ Forwarded message ------ From: Ben Venzke <bvenzke(a)intelcenter.com> Date: Thu, 14 Aug 2003 18:56:00 -0400 Subject: NANOG - Outage Summary To: Richard Welty NE Outages - v2.9 The cause appears to be an overload of the Niagara-Mohawk grid which then caused cascading failures. Outage started around 1600 EST List of areas without power that I'm aware of. Sporadic impact in Maine, Tennessee, Illinois - Ben Venzke AIRPORTS WITHOUT POWER: Cleveland Detroit Kennedy LaGuardia Newark Ottawa Toronto Outage Areas: US CONNECTICUT: Bridgeport Fairfield Counties Hartford Stanford MASSACHUSETTS: Boston (sporadic) Pittsfield Springfield MICHIGAN: Ann Arbor Detroit Lansing NEW JERSEY (everywhere north of New Brunswick): East Rutherford Nanuet Newark Seacaucus NEW YORK: Albany Buffalo NYC (including City Hall and Wall Street, subways down) Plattsburg Rochester Syracuse Utica OHIO: Akron Ashland Cleveland Medina Toledo PENNSYLVANIA (NW parts): Erie Oil City Philadelphia Titusville VERMONT (southern areas) Burlington CANADA: Toronto Ottawa (Ottawa - Pembroke - North Bay corridor) Windsor, Ontario Waterloo, Ontario Cambridge, Ontario Guelph, Ontario Hespler, Ontario -------- End of message ------- -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Java, PHP, PostgreSQL, Unix, Linux, IP Network Engineering, Security

1 0

August 14 2003 Power Outages - NERC Announcement
by Sean Donelan 14 Aug '03

14 Aug '03

Starting at about 4:15 PM EDT, major losses of electric load occurred in the northeastern U.S. and Canada in the Eastern Interconnection. No cause is known at present, but the outages do not appear to be the result of a terrorist attack. The areas most affected center around the Great Lakes plus New York City, northern New Jersey and parts of New England. We do not know if these blackouts are related for sure, but it is likely. Con Edison in New York lost its entire system, it is not known when service will be restored. Immediate outages totaled about 28,000 MW, at this time 5-10,000 MW remain out of service. The power in Ontario is being brought back on line through connections with Manitoba. In Ohio, Perry Nuclear plant went off-line. Major transmission lines were out of service at the time of the disruption. It appears that ten nuclear plants went offline, probably as a result of fluctuations in frequency. Preliminary indications are that the problems may have started in either Ohio or the Niagara Falls area. Although the event was felt throughout the entire Eastern Interconnection, the south and midwest were unaffected. NERC is having regular conference calls among the NERC reliability coordinators and will provide additional information as we know more. We do not know the cause of the disturbances at present but will continue to evaluate the situation throughout the rest of the day and evening. 8/14/2003 6:13 PM

1 0