- NANOG - lists.nanog.org

Attacked by Inktomi/Exodus
by Roy 05 Dec '01

05 Dec '01

Any else seeing an attack by Inktomi originating from Exodus address space? I have had an average of 5 queries per second for over a day to one specific web site. I have them blocked at the router but they keep trying. Email to Inktomi doesn't seem to help. Roy Engehausen

4 5

interesting CAR related crashes in 12.0(14)S
by alex＠yuriev.com 04 Dec '01

04 Dec '01

Hello, Does anyone know of any "interesting" bugs that are triggered on GSRs with CAR active running 12.0(14)S, preferably S3? The simptoms are > 40% packet loss with the aggregate gige traffic being under 100Mbit/sec. The total number of VLANs that GSR sees is about 100... Alex --

3 4

Secure BIND Template v3.1 released
by Rob Thomas 04 Dec '01

04 Dec '01

Hi, all. Hopefully this is reasonably on topic. :) I have made version 3.1 of the Secure BIND Template available here: http://www.cymru.com/~robt/Docs/Articles/secure-bind-template.html It has been reviewed by minds greater than mine. The mistakes are all my own. :) Comments and feedback are always welcome! Be the first in your netblock to join the CREDITS section. :) Thanks, Rob. -- Rob Thomas http://www.cymru.com/~robt ASSERT(coffee != empty);

2 2

New mailing lists
by Patrick Greenwell 04 Dec '01

04 Dec '01

(resending because 1.5 hours later, post still hasn't appeared...) Hi all, I've started a couple of new mailing lists; one dedicated to those in the Internet consulting industry, and another for those that run/work in operations departments. If you are interested in subscribing: inet-consultants-subscribe(a)list.stealthgeeks.net inet-ops-subscribe(a)list.stealthgeeks.net or see http://lists.stealthgeeks.net Thanks.

1 1

Federal plans for Internet simulation and assessment
by Fred Heutte 04 Dec '01

04 Dec '01

Declan McCullogh has a number of interesting references in his current Politech note. Excerpts are shown below. The concern for improved security and resilience is commendable, the immediate focus on vendors cramming down patches on users is, erm, debatable. http://www.politechbot.com/p-02875.html -------- As part of its efforts to beef up homeland security, the federal government will set up a national center for infrastructure simulation and analysis in January, said Richard Clarke, chairman of President Bush (news - web sites)'s Critical Infrastructure Protection Board. ``The center will create, if you will, an acupuncture map of the country, so that if there is a fire in a railroad tunnel in Baltimore, we know the Internet slows down in Chicago,'' Clarke told a gathering of high-tech executives at the Business Software Alliance's first Global Tech Summit .. Clarke also appealed to the private sector, which controls the vast majority of the Internet's infrastructure, to beef up its security practices as well. ``We need to decide that IT security functionality will be built into what we do. It's not an afterthought anymore,'' he said. Software products should be shipped with security settings at their highest level, he said, and high-speed Internet providers should require individual users to install ''firewalls'' to protect against damaging viruses. Software companies should not just make ``patches'' available to fix vulnerabilities in their products, but automatically update users' software for them, he said. ``It's not beyond the wit of this industry to figure out a way of forcing down these patches,'' he said. http://dailynews.yahoo.com/h/nm/20011204/wr/tech_security_dc_1.html

1 0

RE: interesting CAR related crashes in 12.0(14)S
by Joe Marr 04 Dec '01

04 Dec '01

Are the GigE cards single port or 3 port. I jave had issues with packetloss on the 3 port GigE cards on my GSRs. Joe -----Original Message----- From: alex(a)yuriev.com [mailto:alex@yuriev.com] Sent: Monday, December 03, 2001 7:33 PM To: Rodney Dunn Cc: nanog(a)merit.edu Subject: Re: interesting CAR related crashes in 12.0(14)S > Alex, > > Typically when people say crash they mean the router rebooted. > But in your description you are talking about packet loss. I am talking about packet loss, crash, packet loss, crash, packet loss, crash and so on. > Send me a 'sh tech' *OFFLINE* and a more detailed description > of the problem. We'll post a response to the alias once it's a bit > more clear what the issue is. I understand the point of image/damage control, thought at this time what I am interested is not a reply from Cisco along the lines of "please send the 'sh tech'". Rather I am interested in hearing from people who are using GSRs in non-lab environments about similiar issues since I happen to have a hunch that should I not get that background information myself, I would have a problem convincing people that the issue had even been there... So, returning to my original question... Does anyone know of "interesting" crashes related to CAR on GSRs running IOS release close to what I have described... (Since during the past tests the same router in the same setup with the same IOS ran just fine when it was applying same type of rate-limiting to 3x as much traffic on a different sub-interface) Thanks, Alex > > Thanks, > rodney > > On Mon, Dec 03, 2001 at 07:00:05PM -0500, alex(a)yuriev.com wrote: > > > > > > Hello, > > Does anyone know of any "interesting" bugs that are triggered on > > GSRs with CAR active running 12.0(14)S, preferably S3? The simptoms are > > > 40% packet loss with the aggregate gige traffic being under 100Mbit/sec. > > The total number of VLANs that GSR sees is about 100... > > > > Alex > > > > > > -- > --

1 0

RE: AT&T @Home customers - what AS are you moving into?
by Turpin, Mark 03 Dec '01

03 Dec '01

Not at this time, unfortunately, but as plans proceed you can expect for peering to begin. -mark "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers."

1 0

RE: AT&T @Home customers - what AS are you moving into?
by Turpin, Mark 03 Dec '01

03 Dec '01

@home -> Charter will show up as: 22665, 22521, 19115, 19157, 22269, 22291, 20115, there might be a couple more as time goes by. However, due to the fact that nearly all these sites connect via 7018, look for 7018. -Mark -----Original Message----- From: Anthony Pardini To: Christian Nielsen; dani-post(a)roisman.com Cc: nanog(a)merit.edu Sent: 12/3/2001 4:27 PM Subject: Re: AT&T @Home customers - what AS are you moving into? I show them with the /8. BGP routing table entry for 12.0.0.0/8 7018 At 03:51 PM 12/3/2001, Christian Nielsen wrote: >On Mon, 3 Dec 2001 dani-post(a)roisman.com wrote: > > > For those of you who have had your connection switch from AT&T @Home > > to AT&T Broadband, would you mind providing a sample prefix (or at least > > destination AS) that you're now in? > > > > @home (AS6172) played a significant traffic role on my network, and I > > want to make sure I'm prepared for any potential shift as customers > > are moved off that backbone. > >Earlier, someone posted 12.233.190/23 which is out of the 7018 range of >space. > >I would assume that everyone of the ATT@home customers will be behind >7018. Remember that ATT is not all of the @home customer base. > >If you have been watching traffic growth over that past few years, you >would have noticed that 7018 has continued to grow while other large >networks arent growing or arent growing as fast. > > >Christian >--------- > >i am me, i dont write/speak for them "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers."

1 0

The Tables Have Turned For PSI And Peering
by Rachel Warren 03 Dec '01

03 Dec '01

I think this is ironic, considering the history of what PSI has done to de-peer with multiple companies. ;-) Rachel > ---------- Forwarded message ---------- > Date: Mon, 03 Dec 2001 16:01:03 -0500 > From: Nikki Mashack <mashackn(a)psi.com> > Subject: peering > > Hello, > > > My name is Nikki Mashack and I'm with PSINet. As you may know PSINet is a > Tier 1 ISP. Would you be interested in competitive transit or settlement > peering services from PSINet if we were colocated in the PAIX Palo Alto > facility? > > > http://www.psi.com/ > > > Best Regards, > > Nikki Mashack > PSINet Senior Account Manager > direct: 703.726.1062 > toll free: 800.827.7482, x1062 > fax: 703.709.3922 > email: mashackn(a)psi.com ----- End forwarded message ----- -- Once harm has been done, even a fool understands it. - Homer

4 3

Re: AT&T @Home customers - what AS are you moving into?
by Anthony Pardini 03 Dec '01

03 Dec '01

I show them with the /8. BGP routing table entry for 12.0.0.0/8 7018 At 03:51 PM 12/3/2001, Christian Nielsen wrote: >On Mon, 3 Dec 2001 dani-post(a)roisman.com wrote: > > > For those of you who have had your connection switch from AT&T @Home > > to AT&T Broadband, would you mind providing a sample prefix (or at least > > destination AS) that you're now in? > > > > @home (AS6172) played a significant traffic role on my network, and I > > want to make sure I'm prepared for any potential shift as customers > > are moved off that backbone. > >Earlier, someone posted 12.233.190/23 which is out of the 7018 range of >space. > >I would assume that everyone of the ATT@home customers will be behind >7018. Remember that ATT is not all of the @home customer base. > >If you have been watching traffic growth over that past few years, you >would have noticed that 7018 has continued to grow while other large >networks arent growing or arent growing as fast. > > >Christian >--------- > >i am me, i dont write/speak for them

1 0