- NANOG - lists.nanog.org

RE: How common is lack of DNS server diversity?
by Tony Rall 27 Jan '01

27 Jan '01

>MS DNS, WinNT4 and below, have broken search algorithm implementations. >DDNS, Win2K, is currently untested. Search algorithm? I thought we were talking about making full use of the dns server list - i.e., if first server doesn't respond try the next one in the list. Win2k, at least, has no problem doing this. (I do not remember having any problem with the domain search list in previous MS OSs. That is, if I specify almaden.ibm.com and ibm.com, it will find xyz.ibm.com if I just use the name xyz and xyz.almaden.ibm.com does not exist.) Tony Rall

1 0

RE: How common is lack of DNS server diversity?
by Roeland Meyer 27 Jan '01

27 Jan '01

> It appeared from the reports/complaints we > received that a number of client systems/resolvers had decided to only > request data from the nonfunctional DNS server and despite > failing on that > wouldn't ask our other listed DNS servers. They therefore could not > resolve addresses for otherwise functional network assets. I seem to > remember this was somehow related to systems running Microsoft OS's. > Am I confused or could it be that Microsoft knows something > about this? MS DNS, WinNT4 and below, have broken search algorithm implementations. DDNS, Win2K, is currently untested.

1 0

Blackouts again?
by Roy 27 Jan '01

27 Jan '01

This may just be a coincidence but our NOC is in the dark (again). Power went out at 6AM (almost exactly). Since we already were blacked out once when the crisis started, we thought we were safe for a while so this may be a real failure. PG&E's computer did accept our power outage report. Roy Engehausen

1 1

RE: DNS availability
by Roeland Meyer 27 Jan '01

27 Jan '01

> From: richb(a)pioneer.ci.net [mailto:richb@pioneer.ci.net] > Sent: Friday, January 26, 2001 8:24 AM > > Christian Nielsen <cnielsen(a)nielsen.net> wrote: > > ultradns does this and has a great product. > > Interesting to read the faq on UltraDNS's website: > > > Q. I read that your service is supposed to make use of > several servers > > all over the world, but you only give people two server addresses to > > provide to their registrar. How do I make use of all the other > > servers? > > > A. The two server addresses you supply your registrar when > you set up > > a domain on the Managed DNS Service system are actually 'virtual' > > addresses that will route to the best possible server on > our network, > > based on a number of factors. This highly intelligent > mechanism allows > > you to achieve full redundancy and reliability with only two name > > server addresses actually listed. In fact, if the registrar would > > allow you to do so, you could achieve the same level of reliability > > with only one name server address. > Or maybe there have been a few extensions to BGP which I haven't > learned about...;-) It's not BGP! see www.3dns.com and www.f5.com for similar technology. As well as a clue or two. You might also ask yourself the difference between packet routing and query routing. While you're at it, better also ask how those wizards make cluster load balancing work. "Sufficiently advanced technology is indistinguishable from magic, to the uninitiated" paraphrased from Arthur C. Clark

2 1

Re: Proactive steps to prevent DDOS?
by Sean Donelan 27 Jan '01

27 Jan '01

On Fri, 26 January 2001, RJ Atkinson wrote: > > At 19:15 26/01/01, Sean Donelan wrote: > > >Help me, what proactive steps can I take to protect my network from a DDOS? > > A good starting point is to review the past NANOG presentations. > URL for NANOG is: > http://www.nanog.org Most are suggestions for what other networks can do to prevent them from being a source of a DDOS attack. There is less help for what the target of a DDOS can do.

3 2

RE: How common is lack of DNS server diversity?
by Roeland Meyer 27 Jan '01

27 Jan '01

> From: Sean Donelan [mailto:sean@donelan.com] > Sent: Friday, January 26, 2001 7:01 PM > > Mice and Men found that 38% of the .COM domains surveyed > had all their name servers on the same subnet. And 75% > had one or more configuration errors. > > http://www.menandmice.com/dnsplace/healthsurvey.html Distribution requirements,of root name servers, is dependent on where in the tree you live. dot root servers should be spread out, as they are authoritative for everything. TLD root servers should also be spread out, they are authoritative for many things. SLD root servers need not be spread out so much, they are authoritative for few things. 3LD root servers don't need to even leave their AS, if the AS is down the servers, they are authoritive for, are probably also down. 4LD root servers ... who cares? More interestingly, how many root servers allow recursive lookup?

2 1

Re: DNS availability
by Bill Woodcock 27 Jan '01

27 Jan '01

> Perhaps instead of snaping [sic] back with elitist, your [sic] so > clueless banter, how about someone explain for us how if abovenet > (were [sic] their servers are) goes down how they deal with it. I don't have any reason to assume that they have servers in AboveNet's physical space. You may know more about it than I do. A quick look shows that they've got _services_ advertised from two different /24s, both of which are being advertised _through_ both AboveNet's and Exodus' ASes. It seems likely that those _services_ are being advertised from _servers_ which are located at AboveNet and Exodus facilities, however they may be locating their _servers_ at exchange points, as Nominum does, rather than in colos. Taking a quick look in Route-Views, I don't see that they have any peering, so that doesn't help us discern whether they're in colo or exchange facilities. They have servers hanging off both AboveNet's DC and SJ routing hubs, and one presumes that they're doing the same sort of geographic diversity thing with Exodus. Perhaps if you look at their web site they have a map of where their servers are, or perhaps not. So in short, it's pretty unlikely that anyone other than UltraDNS would ever know if their AboveNet connectivity went away. -Bill

1 0

Re: DNS availability
by Troy Corbin 27 Jan '01

27 Jan '01

Rich- Actually, there has... Perform a few traceroutes from various route-servers to UDNS1.ULTRADNS.NET. They are announcing the same netblock from various locales, so basically it will take you to the closest server. To actually traceroute to a few of their specific boxen in various locales, change your destination to ns1.east.ultradns.net, ns1.west.ultradns.net, ns1.jp.ultradns.net, etc. This was laid out in detail somewhere on their site during the very generous free trial of their service while in Beta. -troy On Fri, 26 Jan 2001 richb(a)pioneer.ci.net wrote: > > Christian Nielsen <cnielsen(a)nielsen.net> wrote: > > ultradns does this and has a great product. > > Interesting to read the faq on UltraDNS's website: > > > Q. I read that your service is supposed to make use of several servers > > all over the world, but you only give people two server addresses to > > provide to their registrar. How do I make use of all the other > > servers? > > > A. The two server addresses you supply your registrar when you set up > > a domain on the Managed DNS Service system are actually 'virtual' > > addresses that will route to the best possible server on our network, > > based on a number of factors. This highly intelligent mechanism allows > > you to achieve full redundancy and reliability with only two name > > server addresses actually listed. In fact, if the registrar would > > allow you to do so, you could achieve the same level of reliability > > with only one name server address. > > Looks to me like most of their hiring lately has been in marketing > and business-dev. How could an engineer make statements like the > above with a straight face? > > Or maybe there have been a few extensions to BGP which I haven't > learned about...;-) > > -rich > >

1 0

Proactive steps to prevent DDOS?
by Sean Donelan 27 Jan '01

27 Jan '01

Ok, Yahoo, Ebay, Amazon and Microsoft have all made essentially the same statement after being hit by a DDOS: "taken steps to improve protection of their networks from this type of attack." My question is What are these steps, and why can't people take them before they experience a DDOS? Is there some magic command I can put into my router to help protect my network from a DDOS, or is this just PR fluff to make it look like the corporation is doing something. But in reality there is nothing you can do, but wait for the attacker to get bored and stop on their own.

4 4

Re: DNS availability
by richb＠pioneer.ci.net 27 Jan '01

27 Jan '01

Christian Nielsen <cnielsen(a)nielsen.net> wrote: > ultradns does this and has a great product. Interesting to read the faq on UltraDNS's website: > Q. I read that your service is supposed to make use of several servers > all over the world, but you only give people two server addresses to > provide to their registrar. How do I make use of all the other > servers? > A. The two server addresses you supply your registrar when you set up > a domain on the Managed DNS Service system are actually 'virtual' > addresses that will route to the best possible server on our network, > based on a number of factors. This highly intelligent mechanism allows > you to achieve full redundancy and reliability with only two name > server addresses actually listed. In fact, if the registrar would > allow you to do so, you could achieve the same level of reliability > with only one name server address. Looks to me like most of their hiring lately has been in marketing and business-dev. How could an engineer make statements like the above with a straight face? Or maybe there have been a few extensions to BGP which I haven't learned about...;-) -rich

3 2