- NANOG - lists.nanog.org

First Internet outage reported
by Sean Donelan 21 May '00

21 May '00

Traditional carriers have not treated Internet affecting outages as reportable events. Local, long-distance, 9-1-1, SS7 are typical services listed on the FCC outage reports. I believe GlobalCrossing's FCC outage report is one of the first, if not the first, to list the Internet as the service affected by a carrier outage. http://www.fcc.gov/Bureaus/Engineering_Technology/Filings/Network_Outage/20…

1 0

Re: Class B Address
by Sean Donelan 21 May '00

21 May '00

On Sat, 20 May 2000, "HANSEN CHAN" wrote: > Can someone point me to some documents/weblink on how many class B > addresses are still available? Have the registries like RIPE/ARIN/APRIN > exhausted class B addresses already? IPv6 Forum presentations have me > believed class B addresses are exhausted and the situation is especially > bad for country like China. However, after checking with some Chinese I > was told just the opposite. So I am wondering is address scarcity just a > hype? My question is what is your requirement for a "classfull" address? With CIDR you can create the same number of addresses out of any of the traditional Class A, B, or C areas. There are plenty of /16 address blocks available. I have no idea of any need a country such as China has which couldn't be satisfied by using /16 CIDR blocks. If you stop thinking in terms of traditional classfull address blocks, I think you find much of the "scarcity" goes away.

2 1

UU-Net outage in Santa Clara
by Zaid Ali 20 May '00

20 May '00

I called the UU-Net NOC as one of my pipes is down.. there is no reachability to 660.hssi2-0-0.gw2.scl1.alter.net . I detected the downtime from 3:34pm. Zaid ------------------------------------------ Zaid Ali Network Architect WebEx 110 Rose Orchard Way San Jose, CA 95134 Tel: 408-435-7251 fax: 408-435-7004 www.webex.com ----------------------------------------

2 1

Re: New Internet-draft on DDOS defense...
by Richard Steenbergen 20 May '00

20 May '00

> The proposal suggests that hosts not respond to ICMP Echo broadcasts if > the source address is not within the same subnet as the workstation. > The rational is that even with "no ip directed-broadcast" (or it's > equivalent on non-Cisco routers), smurf attacks can still be launched by > a local machine on the local subnet (provided that there are no filters > in place to prevent forged source-addresses from that subnet). > > Such an attack would only be useful where the aggregate bandwidth to the > Internet from the subnet of the compromised host is signifigantly larger > than the aggregate bandwidth to the Internet from the compromised host > itself. In the traditional case of a simple shared media ethernet, this > is obviously not the case -- rather than launching a "local smurf" > attack to generate 10Mbps worth of flooding, the attacker could simply > have the local machine generate 10 Mbps worth of flooding. In modern > networks, a switch of some sort is likely to be involved, so there is > some potential for amplification. However, given that the individual > devices in such an environment are likely to be attached with a minimum > of 100 Mbps Ethernet (and, assuming they are running a reasonable IP > stack, they should then be able to generate a minimum of, say, 80Mbps of > flooding), the cases where a "local smurf" would be beneficial to an > attacker are limited to sites with switched ethernet and OC-3 or better > connectivity. Experience has shown that such sites are not generally > problematic smurf amplifiers. (OC-3 is actually just a low end number. > Given that any such site is likely to have a lot of other traffic > competing for bandwidth, I think 25% is a good high end number for > maximum amplication effect you'd get. You'll need OC-12 or higher for > any serious level of amplification.) An old idea... Its relatively easy to do this by spoofing the raw frames and making your own l2 broadcast. I can think of at least one major brand name colo provider with multiple customers on shared vlans where such an attack would be quite effective. I can think of others that actually have most of their switches on GigE uplinks and many customers sharing a vlan, where such an attack would be rather devestating. Then again any time you put multiple customers on a single layer 2 switch/vlan without doing some kind of l3 switching or vlan trunking and one vlan per customer you are asking for trouble (ip stealing, arp games, broadcast issues including these kind of attacks, etc).

1 0

Re: Anyone else having on and off problems with netscape.
by Rick Irving 19 May '00

19 May '00

> Yes. Service loads, but it's REALLY slow. But I don't think I would > classify it as a DNS problem. I would. :\ > > Using Dig: (What're you doing using NSlookup?! Shame on you! Plech!) > Heh. Would you feel better if I told you I started with a SIGINT to named, and a grep'd through the output ? :} However, I found the multiple response back from a single nslookup query interesting..... :O > [pbarber@host pbarber]$ dig home.netscape.com a > ; <<>> DiG 8.2 <<>> home.netscape.com a > ;; ANSWER SECTION: > home.netscape.com. 1m43s IN CNAME www-jp.netscape.com. > www-jp.netscape.com. 16m55s IN A 64.236.8.10 > [snip] Actually, one might note that this appears to be leaking in via central B'cast/UDP regions along the NAP's.... Someone Colo a Japanese nameserver in JAM Space , or optionally, a Japanese Root mirror ? At least one possible hypothesis ...... BTW: About a week here, as well... (not years, for -us- anyway) >

1 0

Anyone else having on and off problems with netscape.
by Rick Irving 19 May '00

19 May '00

Any else having on and off problem's with resolving home.netscape.com ? I am finding, upon occasion, that it resolves to a CNAME of www-jp.netscape.com instead of www-mv.netscape.com. The name servers differ as well.... Here are the results of one query, with diagnostics. > home.netscape.com. Server: noc.onecall.net Address: 0.0.0.0 ;; res_mkquery(0, home.netscape.com, 1, 2) ------------ Got answer: HEADER: opcode = QUERY, id = 18746, rcode = NOERROR header flags: response, auth. answer, want recursion, recursion avail. questions = 1, answers = 4, authority records = 1, additional = 3 QUESTIONS: home.netscape.com, type = NS, class = IN ANSWERS: -> home.netscape.com nameserver = tdns-me1.netscape.com ttl = 3600 (1H) -> home.netscape.com nameserver = tdns-me2.netscape.com ttl = 3600 (1H) -> home.netscape.com nameserver = tdns2.netscape.com ttl = 3600 (1H) -> home.netscape.com canonical name = www-mv.netscape.com ttl = 500 (8m20s) AUTHORITY RECORDS: -> netscape.com ttl = 3600 (1H) origin = ns.netscape.com mail addr = dnsmaster.netscape.com serial = 528144 refresh = 8600 (2h23m20s) retry = 900 (15M) expire = 604800 (1W) minimum ttl = 3600 (1H) ADDITIONAL RECORDS: -> tdns-me1.netscape.com internet address = 205.188.247.67 ttl = 3600 (1H) -> tdns-me2.netscape.com internet address = 205.188.247.68 ttl = 3600 (1H) -> tdns2.netscape.com internet address = 207.200.77.53 ttl = 3600 (1H) ------------ home.netscape.com nameserver = tdns-me1.netscape.com ttl = 3600 (1H) home.netscape.com nameserver = tdns-me2.netscape.com ttl = 3600 (1H) home.netscape.com nameserver = tdns2.netscape.com ttl = 3600 (1H) home.netscape.com canonical name = www-mv.netscape.com ttl = 500 (8m20s) netscape.com ttl = 3600 (1H) origin = ns.netscape.com mail addr = dnsmaster.netscape.com serial = 528144 refresh = 8600 (2h23m20s) retry = 900 (15M) expire = 604800 (1W) minimum ttl = 3600 (1H) tdns-me1.netscape.com internet address = 205.188.247.67 ttl = 3600 (1H) tdns-me2.netscape.com internet address = 205.188.247.68 ttl = 3600 (1H) tdns2.netscape.com internet address = 207.200.77.53 ttl = 3600 (1H) >

3 3

Re: BGP filtering of supernets out of classful space
by Danny McPherson 19 May '00

19 May '00

> Tell your %^&# pointy-haired sales & marketing pukes not to %^*#ing lie to > their prospects. If you don't have the network that they're selling, you > won't be keeping the customers they get to begin with. Hrmm, let me think about this. ... You're their customer, tell'm yourself. -danny (who will suppress other comments in hopes that this thread will die sooner rather than later)

1 0

Re: BGP filtering of supernets out of classful space
by John Fraizer 19 May '00

19 May '00

On Fri, 19 May 2000, Leigh Porter wrote: > Hiya, > > OK, so you have a seperate router or a zebra daemon or something running as > a BGP route-reflector-client from one of your core routers and with a deny-all > > input dist list. That way, you have a copy of your routing table on a box that > cannot > be used to inject any other routes into the network and that is not in itself > a core > router. > > -- > Leigh Porter > Cable and Wireless > Internet Network Services > http://www.insnet.net http://www.cw.net Leigh, These are the same folks who don't believe that I can take a full boat from them on a box running zebra. They actually think they're peering with a 7513. Little do they know that the PC/Zebra combo is also taking a full boat from 3 other providers. Silly paranoid people. BTW: Who do I contact about exchange point peering with C&W? They have said over and over and over that they want to appear at CMH-IX. We have fiber to you guys. It's time to light it and get you peered up. John Fraizer EnterZone, Inc

1 0

Re: BGP filtering of supernets out of classful space
by Danny McPherson 19 May '00

19 May '00

> I'd like to see sites which filter provide a looking glass or similar so > that other providers can quickly and efficiently debug routing issues, > and also some known place where those providers doing filtering can be > listed, along with test hosts which can be traced to for testing whether > there are routing problems or not. > > Several folks will tell me I'm dreaming (or smoking something), no > doubt. Well, not in so many words, but.. The problem is that while the engineering folks would (perhaps) like to make this information widely available, the marketing, business and sales folks often cringe at the thought of making internal information of this sort public. After all, it could easily be used to compile competitive information, among other interesting things. -danny

2 1

BGP FIltering via IRR
by Jason Lixfeld 19 May '00

19 May '00

Morning, world :) Over the last little while I've brought up an IRR server and have installed into it, and updated all of our information which was previously stored in other IRRs (BTW: Thanx to everyone who replied with human contacts for the CW and ANS irrs). Everything is up to date and ready to go. Now I can start on the config generation part of the process. I started looking into @RtConfig but am not too happy with it. I've heard that others have found the same thing and have fabricated their own ways of extracting information from the IRRs and inserting them into their routers. I'm wondering if people could share any of these with me so I can work on creating my own tool. TiA. Regards, -- Jason A. Lixfeld Senior Network Engineer Look Communications Inc. (V.LKC) --

3 2