- NANOG - lists.nanog.org

RE: Good Job, White House!
by Rowland, Alan D 24 Jul '01

24 Jul '01

IMHO "fixing" whitehouse.gov scales much better than "fixing" *.mil in a number of interesting ways. YMMV -Al -----Original Message----- From: Alan Clegg [mailto:alan@clegg.com] Sent: Monday, July 23, 2001 8:24 PM To: nanog(a)merit.org Subject: Good Job, White House! According to: http://abcnews.go.com/sections/world/DailyNews/militarycyberattack_010723.ht ml > In recent weeks, variations of the virus are believed to have infected at > least 225,000 business and institutional computer systems. Last Thursday, > infected computers were instructed to flood the White House Web site, but > with minutes to spare the White House was able to protect itself. I'm personally more pleased with the network operators that dealt with the problem. Thanks, Guys! I'm not exactly sure what the White House did. The above web page also confirms that http://*.mil:80 is currently unavailable. I guess the military should contact the White House to see how to go about fixing the problem. AlanC

2 1

RE: How many ISPs are out there?
by Roeland Meyer 24 Jul '01

24 Jul '01

Sprint is the worst for pre-fix filtering for all but their own customers. I recently went through this with my old /24. It's still SWIP'd to MHSC but I can't use it. > -----Original Message----- > From: up(a)3.am [mailto:up@3.am] > Sent: Tuesday, July 24, 2001 7:41 AM > To: nanog(a)merit.edu > Subject: RE: How many ISPs are out there? > > > > On Tue, 24 Jul 2001, Roeland Meyer wrote: > > > some exceptions <Qwest?>) use BGP either. Then there is the > old route > > pre-fixing problem. Not many ISPs, smaller than /19, are > going to be doing > > effective ASN's either. > > I would take issue with the assertion that you need a /19 or > larger to "be > doing effective ASNs". My understanding is that as long as you get a > block from former class C or "the swamp", you should be visible > everywhere. We recently requested, and got a /21 from 65/8 > from Sprint. > A phone call and some pleading got them to change that to > 208.8.16.0/21 > > AFAIK, that's reachable everywhere from AS19975 If that's > *not* correct, > I'd sure like to know... > > James Smallacombe PlantageNet, Inc. CEO and Janitor > up(a)3.am > http://3.am > ============================================================== > =========== >

1 0

RE: How many ISPs are out there?
by Roeland Meyer 24 Jul '01

24 Jul '01

I was actually thinking along IAP (Internet Access Provider) lines. But, most folks lump ISPs and IAPs in the same breath. > -----Original Message----- > From: Adam Rothschild [mailto:asr@latency.net] > Sent: Monday, July 23, 2001 11:09 PM > To: Roeland Meyer > Cc: nanog(a)merit.edu > Subject: Re: How many ISPs are out there? > > > On Mon, Jul 23, 2001 at 10:37:01PM -0700, Roeland Meyer wrote: > > Is there a site that can give me that info? > > When in doubt, ask Jeeves: > > <http://www.ask.com/main/askjeeves.asp?ask=How+many+ISPs+are+o > ut+there%3F> > > What exactly is an ISP anyways? > > -a >

9 10

How many ISPs are out there?
by Roeland Meyer 24 Jul '01

24 Jul '01

Is there a site that can give me that info? -- R O E L A N D M J M E Y E R Managing Director Morgan Hill Software Company t:01 925 373 3954 c:01 925 352 3615 f:01 925 373 9781

4 3

Netflow bug on 3-GE cards (Trident) in Cisco GSRs
by Dani Roisman 24 Jul '01

24 Jul '01

Hey folks, Sharing some knowledge to try and save frustration. I think this is on-topic, forgive me if it isn't. We were struggling to get netflow to work on our 3-port GigE cards in our GSRs. I'll spare you the ugly details, but a few maintenance windows and many useless TAC calls later, we finally were directed to the following Cisco Bug ID: CSCdu72555 Turns out you can only run netflow on the first port of a 3-GigE port on the current S-tract software rev. If you have been struggling with this as well, I'm eager to hear about it off-list. Have a great weekend. - Dani

9 9

Good Job, White House!
by Alan Clegg 24 Jul '01

24 Jul '01

According to: http://abcnews.go.com/sections/world/DailyNews/militarycyberattack_010723.h… > In recent weeks, variations of the virus are believed to have infected at > least 225,000 business and institutional computer systems. Last Thursday, > infected computers were instructed to flood the White House Web site, but > with minutes to spare the White House was able to protect itself. I'm personally more pleased with the network operators that dealt with the problem. Thanks, Guys! I'm not exactly sure what the White House did. The above web page also confirms that http://*.mil:80 is currently unavailable. I guess the military should contact the White House to see how to go about fixing the problem. AlanC

1 0

Re: Clarification: List of AS names by ASN?
by George Michaelson 23 Jul '01

23 Jul '01

I probably didn't word that last posting well. I don't accuse AS stats people of being spammers, its more that in an operational sense, grazing the whois database for AS information is probably going to look much like grazing the whois database for SPAM information, so our logfile checks may well block this class of access. That, and that there are substantive scaling and policy issues in how we make reliable, trustable, consistent data about AS and other address information accessible to the community when we have a small number of whois servers, all of which may be taking load. I doubt if NANOGers are capable of being suprised by anything, but it suprised me that whois is actually very heavily used. It didn't occur to me that firewall and spamblocking s/w would assume whois was able to answer their questions about where the source of the badstuff was coming from, and that this was automatable. That they ask both the wrong whois server (I hate to think about the load ARIN takes in respect of APNIC and RIPE data) and the wrong questions doesn't help much. In short, whois is a very limited use tool in this context, and automatic grazing of whois to mail back spammers is pretty broken right now and probably for the forseeable future, at least as long as whois data is semi voluntary. I don't see the kinds of trends in Internet governance which can help the data accuracy problem. What we can do is make the service more widely available, replicated, reliable at a machine level. I'm sensitive that APNIC has had more than its share of problems lately. We do realize its not (yet) a HA service, we do realize this is impacting on what people (including NANOGites) want to do. cheers -George -- George Michaelson | APNIC Email: ggm(a)apnic.net | PO Box 2131 Milton QLD 4064 Phone: +61 7 3367 0490 | Australia Fax: +61 7 3367 0482 | http://www.apnic.net

1 0

Re: Clarification: List of AS names by ASN?
by George Michaelson 23 Jul '01

23 Jul '01

"We live to serve" might be the RIR motto (it should be) but it should be borne in mind: Whois is a centralized service, it has scaling limits and grazers which walk the space are almost certainly going to be presumed to be SPAM robots and ultimately rejected. I think there are many operational and policy issues in respect of whois data, and how its used. Can I suggest that we should talk about this kind of thing as much as "just do it" cheers -George -- George Michaelson | APNIC Email: ggm(a)apnic.net | PO Box 2131 Milton QLD 4064 Phone: +61 7 3367 0490 | Australia Fax: +61 7 3367 0482 | http://www.apnic.net

1 0

Re: *.mil:80 disconnected in self-defense?
by George William Herbert 23 Jul '01

23 Jul '01

I wrote: >I have a report that .mil disconnected port 80 traffic >from outside hosts, and possibly some other stuff, >in response to DOS attacks last week. >There was some discussion on the inetproviders list this >morning on the topic, and then I asked someone inside >who confirmed the cutoff and said there's a DISA alert >and operational bulletin about it. >It seems to be Just One of Those Months. I've since received a second and third confirmation on this, both of whom want to remain anonymous. -george william herbert gherbert(a)retro.com

1 0

RE: Update: CSX train derailment
by Rowland, Alan D 23 Jul '01

23 Jul '01

It's not uncommon for empty conduit in the ground to accumulate water, sometimes very dirty water. The usual quick fix is some compressed air in one end and all the goop hopefully comes out the other. Be sure to let anyone around the other end know before you turn on the air so they can clear the end of the cable. Imagine Old Faithful as a cold mud bath... :) -Al -----Original Message----- From: David Lesher [mailto:wb8foz@nrk.com] Sent: Saturday, July 21, 2001 6:18 PM To: nanog(a)merit.edu Subject: Re: Update: CSX train derailment I asked a resident who happen to work in the area re: the 30kft temporary fiber run. See <http://www.sunspot.net/news/local/bal-traingridlockmap.graphic> for a map. It must be in a tunnel. I drove right past there today on my way to work and didn't see anything at all. The Sun {newspaper} is on Calvert St. between Center and Orleans. There are no visible aboveground cables (phone, electrical, cable) on Calvert or on Guilford for as far as I can see from the windows right now. There was a later reference to pipes blocked with mud. Do we infer they got permission to run it through storm sewers? In any case, that was fast work by the fiber folks.. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0