- NANOG - lists.nanog.org

Re: Exodus Down
by Dee McKinney 24 Jun '01

24 Jun '01

This from the SuSE Linux mail list may help :-) >>>>> Forwarded message from "Lewis E. Wolfgang" <wolfgang(a)nosc.mil> Something is definitely rotten here. Whois reports: Server Name: SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG IP Address: 24.240.60.16 Registrar: TUCOWS, INC. Whois Server: whois.opensrs.net Referral URL: http://www.opensrs.org Domain Name: SLASHDOT.ORG Registrar: NETWORK SOLUTIONS, INC. Whois Server: whois.networksolutions.com Referral URL: http://www.networksolutions.com Name Server: NS1.ANDOVER.NET Name Server: NS2.ANDOVER.NET Updated Date: 13-jun-2001 I've never seen whois report two registrars, especially one that says "SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG" I also noticed that traceroutes to both slashdot and freshmeat went through 64.14.80.154, then stopped at that point. I'd guess that some cracker broke something somewhere? Maybe a DNS crack? Maybe Andover went bankrupt and pulled the plug on us? Maybe Micro$oft is behind this? It sort of illustrates the hazards of having all the open-source eggs on one server farm.... Regards, Lew Wolfgang On Sat, 23 Jun 2001, ZephyrQ wrote: > > I've been trying all day to get my /. fix, as well as > Freshmeat! > > Did I miss an announcement? Or is there something else going > on? > >

6 5

peering requirements (Re: DDOS anecdotes)
by Paul Vixie 24 Jun '01

24 Jun '01

> ... but I do not blame their IP stack for this like Mr Gibson does though. Same here. > ... From spoofed sources because ISPs do not source address filter? > Gah. Basically untraceable. This is the problem. > What should we do? Recommendation: upgrade your peering requirements to include language like: Each peer agrees to emit only IP packets with accurate source addresses, to require their customers to do likewise, and to extend this requirement to all other peers by $DATE. Where DATE = (now() + '6 months') or some other negotiated value. I've been saying this since 1993. Is anybody ready to believe me yet? We solve this, or our industry stops growing because we're spending too much time dealing with this problem and new customers see diminished returns.

5 5

Re: peering requirements (Re: DDOS anecdotes)
by Sean Donelan 24 Jun '01

24 Jun '01

On Sat, 23 June 2001, Simon Lyall wrote: > Another point, if people are going to have filters then they MUST have a > quick and easy way for this filters to be changed and to propogate > everywhere quickly. People who insist that you provide an exact list of > what you want to advertise (with the exact prefixes) and then take a week > to process any changes (or 12 hours for that matter) should have prices to > match their discount level of service. I hear there are these really cool things called routing registeries. They allow providers to register and change their routing policies. There are tools which have automated the process. With routing registries who can register one-way, two-way, backup, standby, etc routing policies which don't depend on the active announcement of a route in the BGP tables, but allow the network sourced traffic to flow. RIPE, ARIN and MERIT have more information. Ask your network provider to support routing registries.

1 0

RE: BGP instability (was Re: Exodus Down)
by Sean Donelan 24 Jun '01

24 Jun '01

On Sat, 23 June 2001, "Vivien M." wrote: > > According to Exodus' trouble ticket it is a BGP instability between > > several locations in their network and with BGP customers. > > Hmmmmm... You somehow found a way to get this information without agreeing > to the NDA? Impressive. (For the people around here who aren't Exodus > customers: subscribing to their network engineering/outage list > theoretically implies agreeing to an NDA, which is presumably why no one > here mentioned this) I'm not subscribed to Exodus's network engineering mailing list, nor have I agreed to a NDA with Exodus about their outage information. Trying to apply an NDA to outage information has always struck me as a bit stupid. After all, NDA or not, people know you had an outage, what they don't know is your explanation why it happened. As we've seen, when there is a lack of good information, people will make up stories to fit. AT&T, with over 100 years experience of handling outages, seems to have thought out their policy better than some of the newer communication companies. AT&T doesn't go out of its way to advertise problems, but as far as I can tell, AT&T doesn't try to prevent its customers from telling other people about their experience with AT&T, good or bad. Think of it like a movie studio who only lets movie critics who agree to write good things about their movie see the movie. Whether this is "the" problem affecting Slashdot, a contributing factor, or unrelated, I do not know. Verizon also had DACS problems in Boston affecting circuits in the area. I believe Slashdot is located in the Boston area. And, of course, Slashdot has problems on a regular basis even when the network is working.

1 0

Re: for folks tracking DDOS sources or reading the GRC attack log
by Richard A. Steenbergen 24 Jun '01

24 Jun '01

On Sat, Jun 23, 2001 at 10:18:10PM -0400, RJ Atkinson wrote: > > 24.0/8 is the "cable block". ARIN normally allocates residential > cable modem subnets out of this space. Nearly all the cable operators > have one slice or another from this block. Nearly all North American > cable modems users have address space in this block. Cable modems > themselves are nearly always numbered in 10.0/8. > > For those who have read the GRC web site, note that 216.216.8.x > appears not to be a cable modem slice in any event. ARIN reports > that this slice has been allocated to @Work, which is the commercial > IP lease-line business unit within Excite@Home. Presence of a > *.home.net DNS entry does not mean the system is on any cable modem > network. There are no 24.0/8 addresses listed in the log at > http://grc.com/dos/attacklog.htm > so it isn't clear to me that any cable modems were used in that > particular attack. AFAIK 24/8 is exausted. My cable modem is numbered out of 65.4.208.0/19, and the announcement for this block is 65.0.0.0/13. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Exploding manhole covers in Washington DC
by Sean Donelan 24 Jun '01

24 Jun '01

It was the hottest day so far this year in Washington DC, and once again PEPCO had a case of exploding manhole covers. A fire below 30th and M Street resulted in the loss of power in parts of Georgetown (Washington DC) June 13 2001 about 3:30pm EDT. Apparently the explosions made the news, and I had inquiries. As far as I can tell, it had no impact on the Internet. Most of the fiber carrying Internet traffic through Washington DC isn't on M Street.

3 2

Qwest.Net / US West.Net
by Andy Ellifson 24 Jun '01

24 Jun '01

Does anyone have an escalation number for the dial/DSL/ISDN platform for US West.net/Qwest.net? They have removed my static IP addresses and myself and my customers down. They claim they cannot do anything until Monday. This is unacceptable. Or is there any ISP in the Phoenix Metro area (480,623,602) that will allow me to pay them for a ISDN (2B channel) account with a static /28 for 2 weeks?... and get it setup today?? I'm in a bind right now. Thanks in advance, Andy Ellifson __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

3 2

Re: Exodus Down
by George William Herbert 24 Jun '01

24 Jun '01

>This from the SuSE Linux mail list may help :-) >>>>> Forwarded message from "Lewis E. Wolfgang" <wolfgang(a)nosc.mil> >Something is definitely rotten here. >Whois reports: > Server Name: SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG > IP Address: 24.240.60.16 > Registrar: TUCOWS, INC. > Whois Server: whois.opensrs.net > Referral URL: http://www.opensrs.org > > Domain Name: SLASHDOT.ORG > Registrar: NETWORK SOLUTIONS, INC. > Whois Server: whois.networksolutions.com > Referral URL: http://www.networksolutions.com > Name Server: NS1.ANDOVER.NET > Name Server: NS2.ANDOVER.NET > Updated Date: 13-jun-2001 > >I've never seen whois report two registrars, especially one that says >"SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG" There's nothing rotten there at all. People have had the ability to name their nameservers whatever they wanted for some time, as long as it was one of their TLDs. There have been quite a number of my.domain.rulez.your.domain.sux.dude.we.rule.daves.org type nameserver names for years. Whois is just reporting both matches (both things that contain slashdot.org in the domain or nameserver that are in the database). -george william herbert gherbert(a)retro.com

1 0

Re: Exodus Down
by Andy Bradford 23 Jun '01

23 Jun '01

Thus said mike harrison on Sat, 23 Jun 2001 18:51:51 EDT: > Websites and services all over the place seem to be down. I am not sure if this is related or not, but my pager has been ringing off the wall with various host unreachable or host down alerts (from netsaint). During this time, a traceroute from my DSL at home to where netsaint is running changed 4 times. It seems to have stabilized finally and the route has returned to normal, but every once in a while I get another page. > Including my favorites like freshmeat, slashdot... > and one of our e-commerce credit card processors: CyberSource I noticed this as well---actually it was a co-worker in slashdot withdrawals... :-) If anyone is interested in the traceroutes, I can make them available. Andy -- [-----------[system uptime]--------------------------------------------] 5:46pm up 45 days, 20:23, 7 users, load average: 1.07, 1.08, 1.07

1 0

Re: Exodus Down
by Richard A. Steenbergen 23 Jun '01

23 Jun '01

On Sat, Jun 23, 2001 at 06:51:51PM -0400, mike harrison wrote: > > Maybe all this DDOS discussion is what killed Exodus? > > Websites and services all over the place seem to be down. > Including my favorites like freshmeat, slashdot... > and one of our e-commerce credit card processors: CyberSource > > The common route seems to take them into Exodus.net but not out again. > > Any idea whats up? Maybe they couldn't pay the bills and someone reposessed their routers? :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0