- NANOG - lists.nanog.org

Re: Microsoft spokesperson blames ICANN
by Jim Duncan 25 Jan '01

25 Jan '01

Sean Donelan writes: > Microsoft appears to be blaming ICANN for the failure with Microft's > domain name servers (all located at the same place at Microsoft). > > Microsoft has yet to pin down the cause of the DNS error. "It can > be a system or human error, but somebody could also have done this > intentionally," De Jonge said. "We don't manage the DNS ourselves, > it is a system controlled by the Internet Corporation for Assigned > Names and Numbers (ICANN) with worldwide replicas." > > http://www.idg.net/ic_386962_1793_1-1681.html I have read that article many, many time today, trying to see how you came to that conclusion and I don't get it. To reach that conclusion, you've clearly quoted them out of the context of the larger article. Even to reach that conclusion from the small part you quoted requires a logical leap that is inappropriate, if not outright incorrect. I personally worked on that case for nearly eight hours today, right up until the resolution. I can tell you it was a learning experience for everyone involved. There were clearly some mistakes made, but it is also the case that there were a _lot_ of different things going on that contributed to the problem or complicated its resolution. However, jumping to such a conclusion is out of line, especially with the clout and respect you have on this mailing list. It has inflamed the responses of dozens of list members who want nothing more than to smack back at Microsoft, regardless of the truth in their statements. Microsoft did *not* blame ICANN in that article. I wouldn't put it past a spokesperson, Microsoft or otherwise, to make that mistake, but that clearly wasn't the case here. Let's not complicate the issue by making the same mistakes in our own comments. Thanks. Jim -- Jim Duncan, Product Security Incident Manager, Cisco Systems, Inc. <http://www.cisco.com/warp/public/707/sec_incident_response.shtml> E-mail: <jnduncan(a)cisco.com> Phone(Direct/FAX): +1 919 392 6209

2 1

RE: Great job AT&T (re: Microsoft problems)
by Roeland Meyer 25 Jan '01

25 Jan '01

The problem is that a PDC requires SRV updates on the zone. Only BIND-8.2.2p7 can do this and it's not clear that it runs sufficiently well (consider that feature as beta verging on alpha, IMHO). Certainly, the configuration is as clear as mud... way too much magic. My info says that MSFT only tested sufficiently with Win2K DNS. Integration with BIND was not considered especially important. This, in spite of the trip Vix made to NSFT, Summer '99 (where the SRV fixes came from). It is supposed to work, but the config is a nightmare of exceptions and special cases. > From: Steven J. Sobol [mailto:sjsobol@NorthShoreTechnologies.net] > Sent: Wednesday, January 24, 2001 4:24 PM > > On Wed, 24 Jan 2001, Dave McKay wrote: > > > > I'll just point out a few lines I wrote. I have tried to > be polite about > > all of this. > > Microsoft's ITG is investigating this issue. I haven't > been clued in as > > of yet as to what is the main issue. > > I apolozise for not being able to disclose more information. > > Ok, I wasn't going to say this, but Microsoft has been absolutely > ridiculous about blaming other people, so I'm going to say > it; it's not > directed personally at you, it's directed at the morons who > wrote your DNS > software, and the even bigger morons who insist that > It's-Not-A-Microsoft-Problem-Because-Microsoft-Is-Perfect: > > topaz.nstc.com used to run Microsoft DNS. After a while, having tried > repeatedly to get MSDNS to actually *serve* the zone files I > had set up, > and having not been successful, I switched to Bind 8 and have had no > problems since. > > You might want to try Bind 8.

2 1

RE: Microsoft spokesperson blames ICANN
by Irwin Lazar 25 Jan '01

25 Jan '01

> > On Wed, Jan 24, 2001 at 08:30:12PM -0500, Henry Yen wrote: > > > try: http://secondary.easydns.com > > > > Super-redundant DNS hosting would make a good product. Akamai maybe? > It's already available. See: www.ultradns.com irwin

1 0

Re: Microsoft spokesperson blames ICANN
by Henry Yen 25 Jan '01

25 Jan '01

On Wed, Jan 24, 2001 at 05:34:26AM -0500, Christian Kuhtz wrote: > > SICK, verrrrry sick ;-] > > On Wed, Jan 24, 2001 at 04:24:52PM -0500, Henry Yen wrote: [ snip ] > > agreed that the benefits of Microsoft DNS (tm), powered by oops. nowadays, it wouldn't be called "Microsoft DNS (tm)" (although it sounds really nice, just kinda roollllllls off the tongue :); instead if would be called "Microsoft Active DNS (tm)" (if you are american, think about what M A DNS sounds like when you run-it-altogether :). -- Henry Yen Aegis Information Systems, Inc. Senior Systems Programmer Hicksville, New York

1 0

Re: Microsoft spokesperson blames ICANN
by Henry Yen 25 Jan '01

25 Jan '01

On Wed, Jan 24, 2001 at 11:33:36AM +0100, Philipp Buehler wrote: > On 24/01/2001, Henry Yen <henry(a)AegisInfoSys.com> wrote To nanog(a)merit.edu: > [..] > > of Windows (tm) computers, without question the most popular > > Operating System environment (tm) for our Global Computing > > Information Infrastructure (tm (tm)). / > > Good shot :> *ROTFL* i hope you're not laughing at the "most popular" bit. it just so happens to be true (that there are more microsoft windows (tm) desktops _and_ servers than anything else). something to think about... :( -- Henry Yen Aegis Information Systems, Inc. Senior Systems Programmer Hicksville, New York

1 0

Re: Great job AT&T (re: Microsoft problems)
by Jeff Frost 25 Jan '01

25 Jan '01

The big problem reaching hotmai,l as a few people have pointed out, is reaching passport.com (where you get redirected from www.hotmail.com if you aren't already logged in). Interestingly enough, the passport.com domain uses 2 of the same 4 nameserver...or at least alleged nameservers that microsoft.com uses: entropy:/home/jeff% nslookup -q=ns microsoft.com Server: squid.digitalpipe.com Address: 64.68.70.135 Non-authoritative answer: microsoft.com nameserver = DNS5.CP.MSFT.NET microsoft.com nameserver = DNS7.CP.MSFT.NET microsoft.com nameserver = DNS6.CP.MSFT.NET microsoft.com nameserver = DNS4.CP.MSFT.NET Authoritative answers can be found from: DNS5.CP.MSFT.NET internet address = 207.46.138.12 DNS7.CP.MSFT.NET internet address = 207.46.138.21 DNS6.CP.MSFT.NET internet address = 207.46.138.20 DNS4.CP.MSFT.NET internet address = 207.46.138.11 entropy:/home/jeff% nslookup -q=ns passport.com Server: squid.digitalpipe.com Address: 64.68.70.135 Non-authoritative answer: passport.com nameserver = DNS4.CP.MSFT.NET passport.com nameserver = DNS5.CP.MSFT.NET Authoritative answers can be found from: DNS4.CP.MSFT.NET internet address = 207.46.138.11 DNS5.CP.MSFT.NET internet address = 207.46.138.12 Anyone want to speculate on why passport.com would only list 2 of the 4 nameservers? Also, anyone want to speculate why all the nameservers are in the same subnet? Oh, I guess they aren't necessarily in the same subnet, but it sure seems likely doesn't it? On Wed, 24 Jan 2001, Yogesh Devaraj wrote: > > > > > > On Wed, 24 Jan 2001, Dave McKay wrote: > > > > > > > > Sean Donelan (sean(a)donelan.com) wrote: > > > > > > > > Well, AT&T couldn't fix the problem, but at least their customer > > > > service people knew there was a problem and were willing to attempt > > > > contact with someone at Microsoft. > > > > > > > > Most Microsoft sites (Microsoft.com, MSN.com, Hotmail.com, etc.) > > > > are affected. The Microsoft technical team is troubleshooting this > > > > issue. > > > > > > Hotmail has had no impact regarding this issue. > > > > > > > > > > Dave, are you certain of that? > > > > i don't have any problems accessing hotmail.. but have with microsoft.com. > > > traceroute www.hotmail.com > traceroute: Warning: checksums disabled > traceroute: Warning: www.hotmail.com has multiple addresses; using 209.185.243.135 > traceroute to www.hotmail.com (209.185.243.135), 30 hops max, 40 byte packets > 1 171.69.58.2 (171.69.58.2) 0.93 ms 0.65 ms 0.60 ms > 2 sjce-bb1-gw2.cisco.com (171.69.14.77) 0.76 ms 0.69 ms 0.65 ms > 3 sjce-corp-gw2.cisco.com (171.69.14.165) 0.77 ms 0.74 ms 0.67 ms > 4 sj-wall-2.cisco.com (198.92.1.138) 0.65 ms 0.97 ms 0.80 ms > 5 sjc-k-dirty-gw1.cisco.com (192.31.7.30) 1.83 ms 0.98 ms 0.65 ms > 6 barrnet-gw.cisco.com (128.107.240.182) 3.54 ms 2.31 ms 4.22 ms > 7 s6-2.paloalto-cr1.bbnplanet.net (4.1.142.237) 3.40 ms 1.78 ms 1.66 ms > 8 p0-2.mshotmail.bbnplanet.net (4.0.24.6) 6.26 ms 5.11 ms 5.17 ms > 9 * * * > 10 law5-rsp-c-f810.hotmail.com (216.32.183.14) 11.25 ms 8.19 ms 6.39 ms > 11 lc2.law5.hotmail.com (209.185.243.135) 8.20 ms 6.73 ms 6.66 ms > > > traceroute www.microsoft.com > traceroute: Warning: ckecksums disabled > traceroute: unknown host www.microsoft.com > > _Yogesh_ > > > Because I can't get to the hotmail.com login page right this second and have > > received complaints from several associates that they can't get into their > > hotmail accounts. > > > > > > -- > > Jeff Frost VP Technology > > <jeff(a)digitalpipe.net> Digital Pipe Communications, Inc. > > > > > > > > > > > > > > > > > > >

2 1

Re: peer "sanity" filters - best practices?
by Sean Donelan 25 Jan '01

25 Jan '01

On Wed, 24 January 2001, "David P. Maynard" wrote: > Several times over the past few years, the NANOG list has discussed the > topic of if or how non-transit peer BGP announcements should be filtered. > I searched through the archives, but couldn't find where anyone had > published a summary of best practices for filtering announcements from > peers that aren't one of the "top N" (for some debatable value of N) > NSPs. I don't know why you wouldn't also filter the Top N providers, since most of the huge problems have resulted in poor filtering between large providers. A small provider can't really have much of an impact on the net unless their bogus announcements are propagated. Its the propagation of bad information which turns it into a worldwide problem. As to your question. Try searching for discussion about "access-list 112" It will be a bit heated, but you'll find a few usefull tidbits in there.

1 0

Re: Microsoft spokesperson blames ICANN
by Scott Gifford 25 Jan '01

25 Jan '01

"Stephen J. Wilcox" <steve(a)opaltelecom.co.uk> writes: > Out of interest.. does anyone happen to know why rs.internic.net reports > the following of microsoft.com? > > [rs.internic.net] [ ... ] > MICROSOFT.COM.HACKED.BY.HACKSWARE.COM [ etc... ] That's a fairly recent trick (which has been discussed here before); the default Whois search is a substring search. Since anybody with a domain can register their DNS servers with any registrar, the smartass owner of 'hacksware.com' just named their nameserver: MICROSOFT.COM.HACKED.BY.HACKSWARE.COM which is a legitate name for a nameserver, and contains the substring microsoft.com. You can work around it by only searching domains (not nameservers): whois 'domain microsoft.com' Either funny or disturbing, depending on how you look at it. Perhaps both . . . -----ScottG.

1 0

Re: Maintenance Windows for Networks Spanning Multiple Time Zones
by Kurt Erik Lindqvist 25 Jan '01

25 Jan '01

> On Mon, 22 Jan 2001 17:20:03 EST, "Brett L. Hawn" said: > > Pardon my intrusion, but common sense tells me: at a time where you will > > have the least amount of impact on the least amount of people. > > I'll play devil's advocate here. Do you want to minimize the impact on > the end users, or the number of phone calls generated to the NOC? ;) > > And yes, we're alledgedly a one time zone shop. But I've gotten complaints > from Europe when our 3AM window for Listserv updates impacted *their* > ability to post stuff *right now*. Didn't I *understand* that this was > *important* and that it was already *10AM* there? ;) > > And I believe the *original* question was (or at least intended to be) > "how do I *calculate/guess* when I'll have the least impact on least users". > And *that* is probably still in the realm of black magic.... One of doing this is to split into several zones. We have one for US work, one for transatlantic and one for Europe. This increases the complexity but tends to lower the impact per maintenace session. - kurtis -

2 1

Microsoft spokesperson blames ICANN
by Sean Donelan 25 Jan '01

25 Jan '01

Microsoft appears to be blaming ICANN for the failure with Microft's domain name servers (all located at the same place at Microsoft). Microsoft has yet to pin down the cause of the DNS error. "It can be a system or human error, but somebody could also have done this intentionally," De Jonge said. "We don't manage the DNS ourselves, it is a system controlled by the Internet Corporation for Assigned Names and Numbers (ICANN) with worldwide replicas." http://www.idg.net/ic_386962_1793_1-1681.html Microsoft gamers (users of www.zone.com) quickly came up with various workarounds so they could continue playing. They were posting HOSTS.TXT files on various gamer bulletin boards overnight. In particular "Asheron's Call" had several problems during the last week, including banning a number of users and rolling back experience points due to a game bug.

13 12