- NANOG - lists.nanog.org

Customer oversubscription levels
by Mathew Lodge 29 May '02

29 May '02

This might be a dumb question, but I can be sure that I'll be told if that's the case, so here goes: What's a good oversubscription ratio for customer traffic to global Internet bandwidth these days? I.e., if you have, say 90megs of bandwidth to other transit providers, how much bandwidth, in aggregate, are you selling to customers -- 90? 450? 900? Do customers care about this? Or do they assume that if they get a T1 to the Internet from you that they have their own T1's worth of non over-subscribed bandwidth to your transit providers? Thanks, Mathew

5 5

ARIN Route Registry Auto-Reply out of Control
by David McGaugh 28 May '02

28 May '02

Anyone on the list with ARIN (hopefully in the capacity to deal with ARIN route registry) who can help out with an out of control auto-reply from rtreg(a)arin.net please contact me off-list. We are getting hammered with auto-replies at a rate of about 40 messages a minute. ------------------------------------------- Dave McGaugh, Internetwork Engineer Electric Lightwave, Inc. E-mail: dmcgaugh(a)eli.net Office: 360.816.3718 | Fax: 360.816.3297 -------------------------------------------

1 0

upcoming NANOG
by Ariel Biener 28 May '02

28 May '02

Hi, Does any of you plan to make it to the upcoming Nanog ? If so, please contact me off list. thanks, --Ariel -- Ariel Biener e-mail: ariel(a)post.tau.ac.il PGP(6.5.8) public key http://www.tau.ac.il/~ariel/pgp.html

1 0

RE: operational: icmp echo out of control?
by Rowland, Alan D 28 May '02

28 May '02

We had one user report our DNS servers were hacking his system. Knew enought to do a whois but didn't have any clue beyond that. :) (lots of port 53 activity in the logs every time he surfed the web...) Best, -Al -----Original Message----- From: Richard A Steenbergen [mailto:ras@e-gerbil.net] Sent: Tuesday, May 28, 2002 1:01 PM To: Mike Tancsa Cc: Jeff Mcadams; nanog(a)merit.edu Subject: Re: operational: icmp echo out of control? On Tue, May 28, 2002 at 03:36:08PM -0400, Mike Tancsa wrote: > > Jeu 09 mai 2002 15:30:22, Port 3, ICMP, Destination Unreachable > Jeu 09 mai 2002 15:30:21, Port 3, ICMP, Destination Unreachable > Jeu 09 mai 2002 15:30:10, Port 3, ICMP, Destination Unreachable > Jeu 09 mai 2002 15:30:09, Port 3, ICMP, Destination Unreachable I don't know whats worse, those crappy personal firewalls that make every packet look like a life or death assault, or the idiots who send abuse email demanding that you do something for them or they will sue and/or hax0r you. I've seen supposed "security professionals" for theoretically clued places like NASA send abuse complaints over traceroutes they've originated, and people complain about "port 80 hacking attempts" then flatly refuse to admit they visited website. At best, it's annoying clutter. Is it any wonder that legitimate emails about ongoing DoS attacks are completely ignored or responded to a week later? At worst, it can get innocent people in trouble and cost them a lot of time, effort, and potentially money. These false abuse reports are FAR too common, and the net equivilent of crying wolf. In my opinion, it is the responsability of these personal firewall makers to at least make an EFFORT to warn their users about this. So far, I havn't seen it. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 1

operational: icmp echo out of control?
by Mark Kent 28 May '02

28 May '02

Hello, I've observed that our border routers are getting pinged a fair bit. I measured on one router and saw: 5 per second, seems consistent throughout the day, roughly 40 different sources every 15 seconds I took a look at the varied sources and discovered that the sites are well connected and those that resolve resolve to akamai names. This isn't more than a nuisance for me, but I run a small net. Should I conclude that an ISP with a population 10 times bigger would have their border routers getting pinged at 10 times the rate I see? If so, should we care, or just ignore it? Thanks, -mark

15 18

Re: operational: icmp echo out of control?
by John Kristoff 28 May '02

28 May '02

> > We call them OZZADs and here is how we respond: > > Hmm.. 3 people have asked already "What's an OZZAD?" ;) So I don't have to keep answering this, forwarded to the group: Over Zealous Zone Alarm Dork John

1 0

Request for Comments re: OpenRiver's Riversoft monitoring tools
by Austin Schutz 28 May '02

28 May '02

Would anyone using Riversoft to monitor a large scale IP network mind sharing operational experiences? Please reply off list. If anyone else would care for the same information, I'd be happy to send (off list) a summary of any responses. Thanks! Austin

1 0

ARIN DB down ?
by Mike Tancsa 28 May '02

28 May '02

Anyone know whats up ? wat-border2# whois -h whois.arin.net 192.168.0.0 An error has occured, please contact the administrator. wat-border2# ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

3 2

AT&T Broadband UseNet leak
by Sameer R. Manek 28 May '02

28 May '02

It appears that attbi have leaked out, what essentially is spam to non attbi customers, who read usenet. Below is the headers. Did attbi recently become green card/immigration lawyers recently? No idea who to report this to, sending this to abuse@ will obviously do little, other then help someone's ticket close metrics. ------------------------------------------------------------------------- Sameer R. Manek Email: manek(a)ghur.net "What one has not experienced, one will never understand in print." --Isadora Duncan ------------------------------------------------------------------------- Path: newsmaster1.news.pas.earthlink.net!stamper.news.pas.earthlink.net!newsfeed1. earthlink.net!newsfeed.earthlink.net!feed2.news.rcn.net!rcn!dca6-feed2.news. algx.net!jfk3-feed1.news.algx.net!allegiance!news.stealth.net!news.stealth.n et!news-east.rr.com!cyclone.kc.rr.com!news.kc.rr.com!news-west.rr.com!cyclon e1.we.ipsvc.net!cyclone.mw.ipsvc.net!news.mw.ipsvc.net!typhoon.mw.ipsvc.net. POSTED!no-remote.post Newsgroups: alt.autos.toyota.trucks Subject: Important information regarding your usenet service From: customer.support(a)broadband.att.com Lines: 40 Message-ID: <bkwH8.389$uh4.76(a)typhoon.mw.ipsvc.net> Date: Fri, 24 May 2002 19:16:23 GMT NNTP-Posting-Host: 24.131.1.118 X-Complaints-To: abuse(a)attbi.net X-Trace: typhoon.mw.ipsvc.net 1022267783 24.131.1.118 (Fri, 24 May 2002 15:16:23 EDT) NNTP-Posting-Date: Fri, 24 May 2002 15:16:23 EDT Xref: stamper.news.pas.earthlink.net alt.autos.toyota.trucks:32375 X-Received-Date: Fri, 24 May 2002 12:32:04 PDT (newsmaster1.news.pas.earthlink.net) On June 6th, 2002 AT&T Broadband will restructure the configuration of the servers, which provide access to Usenet newsgroups. <snip>

2 1

Pac Bell Internet down?
by Roy 27 May '02

27 May '02

Traces to some PBI IP addresses seem to die at the Sprint-PBI transition.

1 1