- NANOG - lists.nanog.org

RE: RBL quandry - opinions hereby solicited
by Chris Mauritz 16 Nov '98

16 Nov '98

No. That's not really a valid comparison. You have a choice about which credit card company you deal with. Network Solutions is spamming you based on information you are required to provide to them. If you refuse to provide them with the info, you get no domain registration. Cute, eh? C Chris Mauritz Director, Systems Administration Rare Medium, Inc. chrism(a)raremedium.com -----Original Message----- From: Ron_Johnson(a)enron.net [mailto:Ron_Johnson@enron.net] Sent: Monday, November 16, 1998 12:46 PM To: Paul A Vixie Cc: nanog(a)merit.edu Subject: Re: RBL quandry - opinions hereby solicited I don't really see this as SPAM. It's is annoying, but I would place it in the same classification as a credit card company, one that I hold a card from. sending me junk mail. Since they (Network solutions), have developed this mailing list from infomation you provided to them in registering domain(s). They are entitled to contact you. You may, of course complain, and they (Network solutions), are of course are entitled to take no action. Ron Johnson Paul A Vixie <paul(a)vix.com> on 11/16/98 02:17:36 AM To: nanog(a)merit.edu cc: (bcc: Ron Johnson/Enron Communications) Subject: RBL quandry - opinions hereby solicited The RBL team and I are kind of wondering what to do about some spam we got. Because blackholing NSI would be of operational concern to a lot of you, I've decided to ponder this question out loud: ------- Forwarded Message Date: Wed, 11 Nov 1998 08:50:26 PST To: rbl(a)maps.vix.com Subject: Paul - value call on this Technically, this is an opt-out customer-relationship spam. I think it is a special case, because _there is no where else to go_. 208.226.58.70 should be RBL'ed, IMHO. Help me. > Return-Path: owner-admin1(a)LISTS.NETSOL.COM > Received: from pasteur.netsol.com ([208.226.58.70]) by ns2.galaxy-net.net > (8.8.7/8.6.9) with ESMTP id QAA00585; Tue, 10 Nov 1998 16:50:06 -0800 (PST) > Received: from pasteur (pasteur [208.226.58.70]) > by pasteur.netsol.com (8.9.1/8.9.1) with ESMTP id TAA23788; > Tue, 10 Nov 1998 19:40:31 -0500 (EST) > Received: from LISTS.NETSOL.COM by LISTS.NETSOL.COM (LISTSERV-TCP/IP release > 1.8c) with spool id 0342 for ADMIN1(a)LISTS.NETSOL.COM; Tue, 10 Nov > 1998 15:01:15 -0500 > Received: (from listmngr@localhost) by pasteur.netsol.com (8.9.1/8.9.1) id > PAA18548 for admin1(a)lists.netsol.com; Tue, 10 Nov 1998 15:01:14 > -0500 > (EST) > X-Mailer: ELM [version 2.4 PL25] > MIME-Version: 1.0 > Content-Transfer-Encoding: 7bit > Message-ID: <199811102001.PAA18548(a)pasteur.netsol.com> > Date: Tue, 10 Nov 1998 15:01:14 -0500 > Reply-To: admin-remove(a)LISTS.NETSOL.COM > Sender: Owner-Admin <owner-admin(a)LISTS.NETSOL.COM> > From: List Manager Account <listmngr(a)LISTS.NETSOL.COM> > Subject: Network Solutions' E-Commerce Update > To: ADMIN1(a)LISTS.NETSOL.COM > Content-Type: text/plain; charset=US-ASCII > > ########################### > > Dear Customer, > > You are a valued customer and we want to help increase and > protect the value of your domain name. As a free added benefit of > your domain name registration, we would like to send you our > "E-Commerce Update" from time to time. In these updates, we will > try to identify helpful information and news that you can use to > enhance the value of your Web address. If you do not wish to > receive this newsletter in the future, simply respond to this > e-mail with the word "remove" in the first line of the message. > If you have any questions or comments, please send them to > hostmaster(a)internic.net. > > Network Solutions - the world's leading provider of domain name > services -- together with VeriSign -- the world's leading Web > security provider -- has published a new informative guide to > on-line security, "Securing Your Web Site for Business." > > "Securing Your Web Site for Business" outlines the options you > have to secure and protect your Web site. By downloading your > free copy (http://www.verisign.com/nsi/whitepaper) you will be > able to learn how easy it is to secure your site in order to > protect yourself and your customers. > > Issues covered in "Securing Your Web Site for Business" include: > > * Why on-line security problems could slow the growth of your > business > * How to maximize your on-line security at a low cost > * How to accept credit cards and sell products on-line---securely > * What a Digital ID is > * Why you need a Digital ID > * How to obtain a Digital ID for your Web site > > As an additional service to our customers, Network Solutions and > VeriSign bring you a special free trial version Secure Server ID. > VeriSign Secure Server IDs are the security solution currently > used by over 90 percent of Web sites conducting secure online > commerce and this free trial will allow you to experience how > easy Web site security can be. Please visit us at > http://www.verisign.com/nsi/trial to start experiencing the > benefits of on-line security today. > > We would also like to take this opportunity to remind you of the > importance of keeping your Network Solutions domain name records > up to date. Incorrect data can result in your next invoice being > delivered to the wrong location, and may cause delays when you > request other services such as a Secure Server Digital ID. To > review your domain name records and the associated information go > to http://www.internic.net/verisign/update.html. > > Thank you for being a Network Solutions customer. We look forward > to serving your future domain name needs. > > Sincerely, > > Doug Wolford > Senior Vice President ------- End of Forwarded Message

2 1

Gabe Resigns
by James Rishaw 16 Nov '98

16 Nov '98

CEO of Network Solutions resigns http://www.news.com/News/Item/0,4,28830,00.html -- jamie rishaw (efnet:gavroche) American Information Systems, Inc. Don't anthropomorphise computers. They don't like it. "Did they just ask Don King to come to the lobby?!" - davidr

1 0

Network Solutions CEO resigns.
by Mike Perez 16 Nov '98

16 Nov '98

FYI. http://www.news.com/News/Item/0,4,28830,00.html - Mike -- Mike Perez <mike(a)ef.net> PGP fingerprint = 66 BF C5 DE 78 C6 01 63 76 D9 BF E7 70 24 55 50

1 0

Re: Journal of Internet Disasters
by Mathias Koerber 16 Nov '98

16 Nov '98

-----Original Message----- From: Paul Vixie <paul(a)vix.com> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Saturday, November 14, 1998 1:12 AM Subject: Re: Journal of Internet Disasters [...] > >other servers are more conservative, and had switched to manual daily FTP >of the COM zone longer ago than F has done. (with manual daily FTP you >get the advantages of gzip, and of the pretense of "zone master" status >while you manually retry after timeouts. AXFR needs those properties.) > wouldn't a new transfer type (AZFR/IZFR) be useful here, being basically AXFR/IXFR but piped through gzip on each end? These would need to be negotiated (based onversion number) of course, but would help a lot with large zones like COM...

3 3

Network Solutions on TV
by Leo Bicknell 16 Nov '98

16 Nov '98

That's right, in TV ads... "Network Solutions activates more dot com domains than any other ISP"....."use Network Solutions, the dot com people." This actually raises an operational concern. A little traceroute will show you that www.networksolutions.com and the worldnic stuff are down the same pipes as the internic.net stuff. With the DNS problems of the past few days, one has to ask, would "internic" activities have worked just fine if Network Solutions had not been using some {small,large} amount of the bandwidth for their other commercial activities. Not that I hold out any hope of the two activities using separate facilities, but it would be nice. -- Leo Bicknell - bicknell(a)ufp.org Systems Engineer - Internetworking Engineer - CCIE 3440 Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

2 1

RE: Hold on to your news servers
by Chris Mauritz 16 Nov '98

16 Nov '98

*shrug* If Karl's latest windmill attack adversely affects anyone (via leaking cancels), I suspect folks will quickly find out who's feeding him and make it stop. This will be about as effective as his empty threat to somehow get Playboy to punish folks who posted copyrighted images. I believe someone went so far as to post images with their own PGP signature to call his bluff and nothing ever happened. It's unfortunate that someone with such a long history and undoubtedly a wealth of experience chooses to spend their time in these fruitless endeavors rather than using that energy for something useful. Chris -----Original Message----- From: Alan Spicer To: Karl Denninger; jgarzik(a)pobox.com Cc: nanog(a)merit.edu Sent: 11/14/98 1:10 PM Subject: Re: Hold on to your news servers It sounds like you want to censor UseNet and you want to be the god that gets to do that. I think UseNet will survive you as it has survived everyone else. Everyone will OPT you OUT. I'm curious of several things. 1.) Did you consult any Internet standards group or organization about your plan for UseNet? 2.) What is your motivation political or profit? Or do you answer to a higher authority? At 07:25 PM 11/13/98 -0600, you wrote: > >Oh, those who want to try to sink this with public opinion (won't work; >anyone who's known me for more than a day knows how much I count that >in my evaluations) don't have to bother telling the truth. > >- >-- >Karl Denninger (karl(a)denninger.net) http://www.mcs.net/~karl >I ain't even *authorized* to speak for anyone other than myself, so give >up now on trying to associate my words with any particular organization. > > >On Fri, Nov 13, 1998 at 06:00:15PM -0700, John M. Brown wrote: >> Wouldn't it be nice if people actually quoted things correctly.... >> >> Quoting from his FAQ as posted on inet-access. >> >> " THIS CANCEL ADVISORY SYSTEM IS OPT-IN; THE CANCELS >> WILL *NOT* BE GENERALLY INJECTED BACK INTO THE USENET >> NEWS STREAM. " >> >> > /------------------------------------------------\ | Alan Spicer (tech(a)ebiznet.com) NIC:AGS14 | | Systems Analyst / Administrator / Tech Support | | | | www.ebiznet.com | www.websgreatesthits.com | \------------------------------------------------/

3 4

Re: Clue problems / OTHER!
by TTSG 16 Nov '98

16 Nov '98

Hi, Got a reply to the emails I sent to the support for the register.com people : We will look into it. Thank you for notifying us. register.com So much for that.................

3 2

Journal of Internet Disasters
by Sean Donelan 16 Nov '98

16 Nov '98

eric.CArroll(a)acm.ORG (Eric M. Carroll) writes: >Do we actually need the cooperation of the organizations in question to >effect this? Yes and no. It would be fairly 'easy' to become a editor, start Donelan's Journal Of Internet Disasters, get a number of noted experts to contribute articles analyzing failures with no cooperation of the organizations. But I can predict what the organizations in question would say about such an endeavor: 1) Donelan is engaging in FUD to sell his journal. 2) They are making rash assumptions without knowing all the facts. 3) You know the Internet, you can't please everyone. Its just a small group of people with an axe to grind. 4) It didn't happen. If it did happen, it was minor. If it wasn't minor, not many people were affected. If many people were affected, it wasn't as bad as they said. If it was that bad, we would have known about it. Besides we fixed it, and it isn't a problem (anymore). Sure, sometimes a problem breaks through to the public even when the company tries all those things. Just ask INTEL's PR department about their handling of the Pentinum math bug. But that is relatively rare, and not really the most efficient way to handle problems. >For large enough failures, the results are obvious and the data is fairly >clear. Perhaps a first stage of a Disruption Analysis Working Group would >simply be for a coordinated group to gather the facts, sort through the >impact, analyze the failure and report recommendations in a public forum. I'm going to get pedantic. The results may be obvious, but the cause isn't. I would assert there are a number of large failures where the initial obvious cause has turned out to be wrong (or only a contributing factor). Was the triggering fault for the western power grid failure last year caused by a terrorist bombing or a tree growing too close to a high tension line. From just the results you can't tell the cause. It may have been possible for an outside group, with no cooperation from the power companies, to have discovered the blackened tree on the utility right of way. But without the utility's logs and access to their data, I think it would have been very difficult for an outside group to analyze the failure. In particular I think it would have been close to impossible for an outside group to find the other contributing factors. This should go on the name-droppers list, but here goes.... What do we know about the events with the name servers - f.root-servers.net was not able to transfer a copy of some of the zone files from a.root-servers.net - f.root-servers.net became lame for some zones - tcpdump showed odd AXFR from a.root-servers.net - [fjk].gtld-servers.net have been reported answering NXDOMAIN to some valid domains, NSI denies any problem Other events which may or may not have been related - BGP routing bug disrupted connectivity for some backbones in the preceeding days - Last month the .GOV domain was missing on a.root-servers.net due to a 'known bug' affecting zone transfers from GOV-NIC - Someone has been probing DNS ports for an unknown reason Things I don't know - f.root-servers.net and NSI's servers reacted differently. What are the differences between them (BIND versions, in-house source code changes, operating systems/run-time libraries/compilers) - how long were servers unable to transfer the zone? The SOA says a zone is good for 7 days. Why they expire/corrupt the old zone before getting a new copy? - Routing between ISC and NSI for the preceeding period before the problem was discovered Theories - Network connectivity was insufficient between NSI and ISC for long enough the zones timed out (why were other servers affected?) - Bug in BIND (or an in-house modified version) (why did vixie's and NSI's servers return different responses?) - Bug in a support system (O/S, RTL, Compiler, etc) or its installation - Operator error (erroneous reports of failure) - Other malicious activity? -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

7 7

Multicast storm
by Wilson Chu 16 Nov '98

16 Nov '98

Has anyone ever seen that only one bogus packet caused multicast storm in a vlan environment? In the following example, the first packet with src/dest MAC addresses 72:3a:20:63:6f:9/41:2d:63:6f:6c:6f caused other machines in the network generated nearly 10Mbps traffic towards some multicast MAC addresses for few minutes in a 10/100 switched vlan. Is there any way to prevent it or let those "amplify" devices not to re-send them? 19:27:07.080000 72:3a:20:63:6f:9 41:2d:63:6f:6c:6f 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 570133376:570134836(1460) ack 13531 58 win 8760 (DF) 19:27:07.080000 0:0:f8:5:60:8d 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.080000 0:e0:21:1:0:b1 1:0:5e:42:63:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.080000 0:a0:24:23:39:82 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:a0:24:2a:5a:33 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:0:f8:5:60:8d 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:a0:24:7:30:3d 1:0:5e:5:48:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:0:f8:5:60:8d 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:e0:21:1:0:b1 1:0:5e:42:63:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:a0:24:7:30:3d 1:0:5e:5:48:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:a0:24:2a:5a:33 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:60:97:e2:51:8a 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:a0:24:2a:5a:33 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.110000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.110000 0:a0:24:7:30:3d 1:0:5e:5:48:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) <snip, a 7 MB file> ------ Wilson Chu AboveNet Communications http://www.above.net

1 0

Re: Journal of Internet Disasters
by Roeland M.J. Meyer 16 Nov '98

16 Nov '98

At 10:20 AM 11/15/98 -0500, Deborah Ann Smith wrote: > >Sure, we have a responsibility to mitigate problems from up the pipe. > >But We as an industry and consumers need to start demanding - via writing >to the congress people (They will read letters, not email- and they will >listen if enough people contact them), complaints to the FCC and other >involved groups - high standards of quality from the InterNic and other >organizations that the Internet depend on. We are essentially captive to >their screwups, NO MATTER HOW WELL we prepare. > >Even the FAA recognizes no matter how good a flight crew, if they get >incorrect information from the Tower, any problems that occur are the >Tower's fault! Ahem, I suspect that you're not a pilot. The last time I went through ground school, the pilot has ultimate responsibility for the lives and welfare of all aboard. This includes the responsibility to tell the tower to buzz-off when it's obvious that they're wrong. Even in controlled air-space, where control is heavily biased towards the tower, the pilot has *final* responsibility. If someone dies, the pilot had better have been there first or have a good reason why they're still around, to explain why they're still around. If you're wrong, you had better be dead wrong. Actually, I find your analogy very apropos. To our customers, their internal systems are most important, after that it is their inter-facility connections, *then* they consider their connections to everyone else. Some of us handle their internal and inter-facility connections, as well as their external connections. When the InterNIC fargs-up who do they call? Are they going to understand? The bottom-line is that they don't care. Failure costs them $cash$. It is our job to shield our customers from this as much as possible. Those of us who do, will have satisfied customers, vs. those of us who rely on excuses. ___________________________________________________ Roeland M.J. Meyer, ISOC (InterNIC RM993) e-mail: <mailto:rmeyer@mhsc.com>rmeyer(a)mhsc.com Internet phone: hawk.mhsc.com Personal web pages: <http://www.mhsc.com/~rmeyer>www.mhsc.com/~rmeyer Company web-site: <http://www.mhsc.com/>www.mhsc.com/ ___________________________________________ Who is John Galt? "Atlas Shrugged" - Ayn Rand

1 0