- NANOG - lists.nanog.org

Re: UDP packet/DNS server
by Roeland M.J. Meyer 30 Sep '98

30 Sep '98

Yeah, and if you do then sendmail will be broken, according to the v8.9.1 dox. It's called a wild-card MX record and is specifically not recommended, more than once, in the sendmail dox. I actually had NetCom tech support recommend it once, then I found out why it's not recommended, the hard way. When it comes to DNS, you're *much* better off by being specific, even if it means being verbose. At 10:39 AM 9/30/98 +0900, Tatsuya Kawasaki wrote: >Eric, > >thank for your reply. Though I did not agree with RFC I understand >what you are saying. >Do you think it is about time to change RFC? > >BTW, according to NDS and BIND 2nd Ed. by O'Reilly, it is okay for >MX record too. :-) > >TIA, >Tatsuya > >$B$+$o$5$-(B >TK3197 > >= = = = = = >Business Network Telecom (BNT) >$B%S%8%M%9%M%C%H%o!<%/%F%l%3%`3t<02q<R(B >$B")(B111-0053$B!!El5~ETBfEl6h@uAp66(B3-8-5 >31$B;35~%S%k(B6$B3,(B >TEL 03-5687-3945 FAX 03-5687-6009 >http://www.giganet.net > >On Tue, 29 Sep 1998, Eric Sobocinski wrote: > >> But it's perfectly ok for PTR records, though perhaps your example is less >> than ideal. The objection to the use of "*" was specific to NS records. >> An NS record should exist for a domain only if that domain exists. Since >> "*" matches any subdomain whether the domain exists or not, an NS record >> will be returned for non-existent subdomains and that violates the rule. >> Some records of other types are incompatible with "*" for similar reasons. >> The major point here is that any DNS record should reference either a valid >> response or another record that will lead to a response, and an NS record >> pointing to a zone file that doesn't exist is neither. >> >> Some folks will contend that the use of "*" in PTR records is bad form even >> though it is legal. That's a religious war, not a technical one. (I >> happen to like the use of "*", though I also believe that one should first >> apply specific host names whenever a static mapping allows). >> >> >> On Monday, 28 Sep 1998 at 21:02 EDT, Eric Germann wrote: >> > >> >you have to admit, it does save one hell of a lot of typing for the 1918 >> >IN-ADDR.ARPA delegations. >> > >> >rfc1918.db >> >---------- >> > >> >@ IN SOA ns1.xxx.net. hostmaster.xxx.net. ( >> > 1997101001 ; serial >> > 300 ; refresh >> > 300 ; retry >> > 604800 ; expire >> > 600) ; minimum >> > >> > IN NS ns1.xxx.net. >> > IN NS ns2.xxx.net. >> > >> > >> >* IN PTR rfc1918.xxx.net. >> >----------- >> > >> >then in named.bt >> > >> >primary 16.172.in-addr.arpa RFC1918.DB >> >primary 17.172.in-addr.arpa RFC1918.DB >> >primary 18.172.in-addr.arpa RFC1918.DB >> >primary 19.172.in-addr.arpa RFC1918.DB >> >primary 20.172.in-addr.arpa RFC1918.DB >> >primary 21.172.in-addr.arpa RFC1918.DB >> >primary 22.172.in-addr.arpa RFC1918.DB >> >primary 23.172.in-addr.arpa RFC1918.DB >> >primary 24.172.in-addr.arpa RFC1918.DB >> >primary 25.172.in-addr.arpa RFC1918.DB >> >primary 26.172.in-addr.arpa RFC1918.DB >> >primary 27.172.in-addr.arpa RFC1918.DB >> >primary 28.172.in-addr.arpa RFC1918.DB >> >primary 29.172.in-addr.arpa RFC1918.DB >> >primary 30.172.in-addr.arpa RFC1918.DB >> >primary 31.172.in-addr.arpa RFC1918.DB >> > >> >repeat for 10.x.x.x and 192.168 space >> > >> >To reiterate the question posed by the original poster, (donning asbestos), >> >why is this bad? >> > >> >Eric >> > >> > >> >At 08:31 AM 9/28/98 -0500, you wrote: >> >>Tatsuya Kawasaki wrote: >> >>>xyz.com. IN NS that.host >> >>>*.xyz.com In NS that.host >> >> >> >>Gah!! >> >> >> >>Illegal! >> >> >> >>Never use "*" in DNS! Just makes /bad things/ happen. >> >> >> >>@ IN SOA xyz.com. hostmaster.xyz.com. ( >> >> 1998092801 3600 1800 3600000 7200) >> >> >> >> ns ns1.xyz.com. >> >> ns ns2.xyz.com. >> >> >> >> mx 0 mail.xyz.com. >> >> >> >>mail a 1.2.3.4 >> >> mx 0 mail >> >> >> >>. etc .. >> >> >> >>-- >> >>jamie rishaw (efnet:gavroche) American Information Systems, >> >Inc. >> >> Tel:312.425.7140, FAX:312.425.7240 >> >> Help stop spam! router(config)#no ip routing >> >> thirty thousand feet above the earth..youre a beautiful thing.. >> >> >> > >> >========================================================================== >> > Eric Germann CCTec >> > ekgermann(a)cctec.com Van Wert, OH 45891 >> > http://www.cctec.com Ph: 419 968 2640 >> > Fax: 419 968 2641 >> > Network Design, Connectivity & System Integration Services >> > A Microsoft Solution Provider >> > >> > ___________________________________________________ Roeland M.J. Meyer, ISOC (InterNIC RM993) e-mail: <mailto:rmeyer@mhsc.com>rmeyer(a)mhsc.com Internet phone: hawk.mhsc.com Personal web pages: <http://www.mhsc.com/~rmeyer>www.mhsc.com/~rmeyer Company web-site: <http://www.mhsc.com/>www.mhsc.com/ ___________________________________________ I bet the human brain is a kludge. -- Marvin Minsky

1 0

Re: Thanks WAS: any cisco experienced...
by barton＠cent.net 30 Sep '98

30 Sep '98

Sorry if this is the wrong topic for NANOG but some mis-information needs to be fixed before it spreads any further. >I appreciate the assistance several of you provided. As it turns out the >image that was installed on the flash was a compressed image only for the >1605, and not for the 1601-1604 routers. It looks like someone at RMA >inadvertantly loaded the wrong software to flash, and it ended up throwing >most off guard. I knew it had to be something simple. WRONG, WRONG, WRONG. NOT just for 1605. It is a perfectly fine image and one I would routinely recommend for any 1601-1604 user, but you *MUST* understand the implications of running it. You don't mind running about 35% faster, I would assume, as that is what you can now do. You have loaded an image that has to load into DRAM and then self decompresses. Multiple 3rd party toolkits do this routinely for 25xx routers if someone needs more squeeze that an Unix .Z image provides to wedge a recent IOS into FLASH. Sadly the 1601's bootstrap has a **BUG** that precludes running mere .Z images, but then cisco came out with the 1605 and with it came cisco provided -mz images - to everyone's joy. The 1601-1604 have only 2 meg soldered in, so adding a 16 meg non-parity simm ($15 or so these days) only gets you to 18 meg. Not enough for the monster largest images and still leave enough for buffers and tables. Marketing decided to not let the customers only needing some smaller image know you can just as well run from DRAM. Usual cisco arrogance. "keep them stupid - they still pay $1000 for 16 meg DRAM which proves it" So they made the 1605 with 8 meg soldered in. That with a 16meg SIMM is enough to run any image in DRAM and still leave enough for other things. BUY A $15 (or $25 if someone is ripping you off, or $1000 if you are being "ciscoed") 16 meg DRAM simm and your box with the -mz image will not only boot but will run 35% faster than running from FLASH. And, with FLASH left (READ/WRITE), updates are trivial on a running router. This has been rehashed repeatedly on c.d.s.c. Check an archive. >For the record in the 1600-series world.. images with c1600-mz* are >compressed and will only work on the 1605 model. NO NO! - only will work in a 16xx router with adequate DRAM, but since you can MAX that box for a $15 16 meg DRAM SIMM, this is hardly a problem. >Images with c1600-l* are for the 1601-1604 models and are not compressed. Unless someone uses one of the available toolkits to make a -mz. Using a unix compressed .Z image ***SHOULD*** be ok but there is a good old fashioned *BUG* is their boot code. The TAC says so, too (I can probably dig out an old case number if really pressed). Now that cisco ships the -mz images for 1605s, every 16xx should be running them. Many many 25xx users run .Z or -mz images and cisco's code says "wrong image type" which everyone doing this simply ignores.

1 0

RE: UDP packet/DNS server
by Tatsuya Kawasaki 30 Sep '98

30 Sep '98

Raymond, Thnx for a quick reply. I checked with the person in the charge of the host. He could not telnet 53 my host. So I believe that is the problem Since they did not like to have zone transfer. I create to record to pass "NS" to that host via tying xyz.com. IN NS that.host *.xyz.com In NS that.host and it works fine when I type www.xyz.com,which give me the A record but ... in the daemonlog, I see Sep 28 14:34:06 auth2 named[8958]: Ready to answer queries. Sep 28 14:34:16 auth2 named[8958]: bad referral (xyz.com !< *.xyz.com) Sep 28 14:34:16 auth2 named[8958]: bad referral (xyz.com !< *.xyz.com) Any suggestion? what did I do? かわさき TK3197 = = = = = = Business Network Telecom (BNT) ビジネスネットワークテレコム株式会社〒111-0053　東京都台東区浅草橋3-8-5 31山京ビル6階 TEL 03-5687-3945 FAX 03-5687-6009 http://www.giganet.net On Sun, 27 Sep 1998, Raymond Forbes wrote: > It is possible that the router or the firewall is not allowing connections, > that would be the only way to explain what you are seeing. > > ray > > > ---------- > > From: Tatsuya Kawasaki[SMTP:tatsuya@giganet.net] > > Sent: Sunday, September 27, 1998 9:33 PM > > To: Raymond Forbes > > Subject: RE: UDP packet/DNS server > > > > I have tried to get zone transfer via dig. it failed. > > None get back. I have looked at their named.conf. > > I did not see any restriction on it. > > > > I could not receive zone transfer from a host. > > So if someone log in the the host telnet 53 to my host. > > If telnet is sccuessful then zone transfer is possible. > > But telent from my host to the host, and telent failed does not > > really means anything? > > > > TIA > > > > Tatsuya > > > > > > > > > > > > ???? > > TK3197 > > > > = = = = = = > > Business Network Telecom (BNT) > > ?????????????????? > > ?111-0053?"??s'??????3-8-5 > > 31????6? > > TEL 03-5687-3945 FAX 03-5687-6009 > > http://www.giganet.net > > > > On Sun, 27 Sep 1998, Raymond Forbes wrote: > > > > > zone transfers are not done by UDP. They are TCP. A couple of ways you > > can > > > test is to telnet to port 53 and see if you make a connection. Also, if > > you > > > do nslookup and then ls domain name this is equivilant to doing a zone > > > transfer. > > > > > > hope this helps. > > > > > > ray > > > > > > > ---------- > > > > From: Tatsuya Kawasaki[SMTP:tatsuya@giganet.net] > > > > Sent: Sunday, September 27, 1998 8:44 PM > > > > To: nanog ml > > > > Subject: UDP packet/DNS server > > > > > > > > Hello Nanog, > > > > > > > > I am trying get zone trasfer from a host, but it seems that because of > > > > firewals?, I can not get any record. > > > > They acknowelged that there is a host behind the firewalls but they > > claim > > > > it should not affect it. (I don't believe it.) > > > > But I don't know how to check/prove that if certain host can > > > > receive/send an UDP packet. > > > > > > > > > > > > TIA, > > > > > > > > Tatsuya > > > > > > > > > > > > ???? > > > > TK3197 > > > > > > > > = = = = = = > > > > Business Network Telecom (BNT) > > > > ?????????????????? > > > > ?111-0053?"??s'??????3-8-5 > > > > 31????6? > > > > TEL 03-5687-3945 FAX 03-5687-6009 > > > > http://www.giganet.net > > > > > > > > > >

8 9

Your class 'B' address space
by Mark Vickers 30 Sep '98

30 Sep '98

Let's add a little spice to you list...run it up the flag pole etc... but please let's deal with this professionally with out to much flame! My goal is to ensure the network meets the business objective of our company, not simply to debug traffic etc. In order to do this I need redundant connections to multiple ISP's, and a method for delivering delay sensitive traffic in the most efficient way possible. The above implies BGP. I've applied to ARIN for a number block large enough to ensure routablility, and have been rejected. This leaves me with three alternatives, please correct me if you see any another alternatives. First, we can attempt to buy address space which may or may not be transferable, or more likely we acquire a small company, and/or it's assets, one of which just happens to be a large chuck of address space. Second, I can do the time proven technique of lying about how many hosts I have or how many I plan to have, this I find uncomfortable as I think it is dishonest! I'd bet at least one of the readers of this list has exaggerated about how may hosts they have in their network, or how many they planed to have on a template, so don't be to quick to grab for the high moral ground!! Finally, I can appeal ARIN's decision, which I have already requested from IANA, and was told to request an appeal from hostmaster(a)ARIN.net. I'm still waiting to here something. On appeal I plan to quote RFC2050 which according to the ARIN web site is what they use make allocation descions. Basically I think ARIN procedures only take into account network size, and nothing else. I don't think RFC2050 language is that strict. Please see item '3b' below: "In order for the Internet to scale using existing technologies, use of regional registry services should be limited to the assignment of IP addresses for organizations meeting one or more of the following conditions: a) the organization has no intention of connecting to the Internet-either now or in the future-but it still requires a globally unique IP address. The organization should consider using reserved addresses from 1918. If it is determined this is not possible, they can be issued unique (if not Internet routable) IP addresses. b) the organization is multi-homed with no favored connection. c) the organization's actual requirement for IP space is very large, for example, the network prefix required to cover the request is of length /18 or shorter. All other requesters should contact its ISP for address space or utilize the addresses reserved for non-connected networks described in 1918 until an Internet connection is established. Note that addresses issued directly from the IRs,(non-provider based), are the least likely to be routable across the Internet. " Also, from 3.1 "utilization is a key factor" implying it's not the only factor. " 3.1 Common Registry Requirements Because the number of available IP addresses on the Internet is limited, the utilization rate of address space will be a key factor in network number assignment. " Basically our normal output traffic is about 45mb/s with a peak as high as 67.6Mb/s during Clinton's shinangians, we've been listed as the 16th busiest web site in the world, and I think that ought to count toward getting a routable address space!!! I also wonder if there aren't free speech issues involved if US entities start dropping traffic based on non technical factors? I welcome any suggestions you may have as to how I can archive my goal of obtaining an address block big enough to implement BGP succesfully. Thank You Mark Vickers RealNetworks, Inc. " In order for the Internet to scale using existing technologies, use of regional registry services should be limited to the assignment of IP addresses for organizations meeting one or more of the following conditions: a) the organization has no intention of connecting to the Internet-either now or in the future-but it still requires a globally unique IP address. The organization should consider using reserved addresses from 1918. If it is determined this is not possible, they can be issued unique (if not Internet routable) IP addresses. b) the organization is multi-homed with no favored connection. c) the organization's actual requirement for IP space is very large, for example, the network prefix required to cover the request is of length /18 or shorter.

8 8

Thanks WAS: any cisco experienced...
by Kevin Brown 30 Sep '98

30 Sep '98

I appreciate the assistance several of you provided. As it turns out the image that was installed on the flash was a compressed image only for the 1605, and not for the 1601-1604 routers. It looks like someone at RMA inadvertantly loaded the wrong software to flash, and it ended up throwing most off guard. I knew it had to be something simple. For the record in the 1600-series world.. images with c1600-mz* are compressed and will only work on the 1605 model. Images with c1600-l* are for the 1601-1604 models and are not compressed. The responses ranged from get new flash, get new router, your tftp is broke, you didn't get the whole image, to finally...wrong image, thanks to some fine folks from Cisco here on Nanog :=) Hats off to you folks. Now I can keep all my hair, and draw a quick breath of sanity before the next lightning storm or backhoe comes through.

1 0

UDP packet/DNS server
by Tatsuya Kawasaki 29 Sep '98

29 Sep '98

Hello Nanog, I am trying get zone trasfer from a host, but it seems that because of firewals?, I can not get any record. They acknowelged that there is a host behind the firewalls but they claim it should not affect it. (I don't believe it.) But I don't know how to check/prove that if certain host can receive/send an UDP packet. TIA, Tatsuya かわさき TK3197 = = = = = = Business Network Telecom (BNT) ビジネスネットワークテレコム株式会社〒111-0053　東京都台東区浅草橋3-8-5 31山京ビル6階 TEL 03-5687-3945 FAX 03-5687-6009 http://www.giganet.net

6 7

Your class 'B' address space (fwd)
by howland＠Priss.com 29 Sep '98

29 Sep '98

Just to add fuel to the fire, he seems to have sent out *another* one. This is really getting old, Mark. Curt- ----- Forwarded message from Curt Howland ----- >From mvickers(a)real.com Tue Sep 29 11:04:32 1998 X-Sender: mvickers(a)mail.prognet.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.2 (32) Date: Tue, 29 Sep 1998 11:01:23 -0700 To: bquijalv(a)ENCORE.COM, mdavison(a)UNLINFO.UNL.EDU, boening.pad(a)SNI.DE, system(a)BEACH.UTMB.EDU, D.Nash(a)UTEXAS.EDU, copeland(a)UNT.EDU, tribunes(a)KODAK.COM, jackie(a)TRAVIS.CSD.HARRIS.COM, Fred.Lowe(a)SUN.COM, dalewl(a)RADIAN.COM, benbenek(a)SED.JSC.NASA.GOV, NSIOPS(a)NSIPO.NASA.GOV, NSIOPS(a)NSIPO.NASA.GOV, lncc(a)lerc.nasa.gov, pbl(a)SEBANK.SE, Patrick.RAMAHEFA(a)BULL.NET, norm(a)TC.FLUKE.COM, lm-nic(a)LMCO.COM, shearer(a)THOMAS.GE.COM, lm-nic(a)LMCO.COM From: Mark Vickers <mvickers(a)real.com> Subject: Your class 'B' address space Content-Length: 291 You appear to have a class B net that isn't reachable from my site, or perhaps your net is entirely behind a fire wall? Anyway, I'm wondering if you want to try to sell your class -B address space? Best price someone has offered me so far was $200,000 Mark Vickers RealNetworks, Inc. ----- End Included Message -----

1 0

PSInet?
by sigma＠pair.com 29 Sep '98

29 Sep '98

Is anyone else seeing that PSInet has disappeared this morning? Or mostly disappeared? I can reach them only via Sprint to MAE-East. UUnet and Digex both go nowhere. Something wrong with PSInet's private peerings? Kevin

4 5

RE: Any Cisco-experienced folks wanna tackle this one?
by Bonin, Brad T 29 Sep '98

29 Sep '98

99.9% sure it is not a hw problem nor is it your IOS version. If flash is not being loaded or is crashing during load, you might have to reload microcode. If flash is loaded and an attempt is made to load the config file from NVRAM and it crashes, then I suggest you go into ROMMON> and erase your NVRAM and reload. This has fixed the same problem for me in the past. The problem usually lies in a file being corrupted during a power down. If you need more assistance, please respond directly. Brad Bonin Internetwork Engineering - EDS -----Original Message----- From: Jason Lixfeld [mailto:jlixfeld@idirect.com] Sent: Tuesday, September 29, 1998 12:32 AM To: Kevin Brown Cc: nanog(a)merit.edu Subject: Re: Any Cisco-experienced folks wanna tackle this one? So I take it you cannot load the IOS in the flash? Have you tried getting into ROMMON> by breaking the boot? That may help decipher where the problem lies. It may be the pre-boot flash (I think the Ciscos have a shrunken bootflash and then a full size IOS image in flash). My $0.02. On Mon, 28 Sep 1998, Kevin Brown wrote: > I will expect replies to this message directly as it doesn't really fit > into the normal fodder for nanog, but it is a last ditch effort for problem > resolution. > > I have a customer who I am integrating into our network via a T1 link and > have already gotten all the nominal routing setup prepared. This customer > is using RFC1918 addressing on his LAN, and requires a firewall-type > solution with NAT capabilities. Bless this customer for thinking ahead > with his internal addressing :=) > > Anyway, I have run into a problem with his hardware/software provisioning > and I think this can be recreated in a lab environment: > > Cisco 1601 router > 6 MB Flash > 4 MB DRAM > WIC-1DSU-56K4 > IP Plus/Firewall IOS version 11.3 > (actual image name: c1600-nosy-mz.113-3.T ) > > Everytime I have start the router, I get a software crash that TAC says > should not be happening. > > If anyone else might have this equipment setting around, and be willing to > replicate this and see what happens for you, I would much appreciate > hearing about it. I'm thinking I've found an ewps in the code/hardware > configuration and have just provisioned a non-working solution. I'd like to > hear what the rest of you might come up with. Yes, I know it's a small > configuration, but surely we've all got lessor routers in the field with > similar requirements. > > > Thanks in advance if you would assist > > Kevin Brown >

1 0

Re: Remote Shell
by Adam D. McKenna 29 Sep '98

29 Sep '98

This will work if you have no passphrase on your RSA key. This is a *really* stupid thing to do, IMHO, especially to a root account, as anyone who manages to get access to your ~/.ssh/identity file will be able to log into any host that you have set this up on, without a password. While it's a little more secure than .rhosts authentication, the absence of any kind of password/passphrase validation makes it (again IMHO) an undesirable option for the security conscious. --Adam -----Original Message----- From: Zachary McGibbon <mzac(a)uunet.ca> To: Roeland M.J. Meyer <rmeyer(a)mhsc.com> Cc: Benicio Miguel Sanchez Fuentes <bsanchez(a)alestra.com.mx>; NorthAm Net Ops Grp List <nanog(a)merit.edu> Date: Tuesday, September 29, 1998 1:42 AM Subject: Re: Remote Shell You can perform 'rsh' type commands with ssh as well... here's an example: /# ssh servername w root@servername's password: <type password here> 10:45pm up 19 days, 6:31, 2 users, load average: 0.18, 0.11, 0.09 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT root ttyp0 client 8:08pm 2:37m 0.27s 0.10s You can also setup authorized keys on the server side. In your home dir on the server, go into the '.ssh' dir, and create a file called 'authorized_keys', then on your workstation, type 'ssh-keygen'. In your home dir, go into '.ssh' and take the contents of 'identity.pub' and copy that to the 'authorized_keys' on the server side. Then 'chmod 600 authorized_keys' on the server side. Then it won't ask you for a password when you ssh to that machine. It's usefull if you want to set this up as a cronjob to do something on a remote machine. On Mon, 28 Sep 1998, Roeland M.J. Meyer wrote: > Set up SSH <http://www.datafellows.com> and open port 22. I would NOT allow > plain ol' telnet over the Internet. SSH is free for non-commercial use and > is works quite well under HP-UX. > > > > At 01:32 PM 9/28/98 -0500, you wrote: > >I need to give remote shell access to a user in a server (an HP-9000 k410 > >running HP-UX 10.10) conected to mine through a 3Com router, I have done > >some investigation and what I have found is that I have to open port 514 > >for tcp, for some reason this did not work, so I opened (temporarily of > >course) all the ports on the router....and it worked, but I donŽt want to > >leave it like that, Does anyone now what port(s) I need to leave open to > >alow the remote shells?. > > > >Is there any configuration needed other than the equiv.hosts and (or) the > >.rhosts files ? > > > >Thanks in advance for your answers > > > >Benicio Sanchez > >Network Operations Engineer > >Alestra > > > > _________________________________________________ > Morgan Hill Software Company, Inc. > Colorado Springs, CO - Livermore, CA - Morgan Hill, > CA > Domain Administrator > MHSC2-DOM and MHSC3-DOM > Administrative and Technical contact > ____________________________________________ > InterNIC Id: MHSC hostmaster (HM239-ORG) > e-mail: <mailto:hostmaster@mhsc.com>mailto:hostmaster@mhsc.com > web -pages: <http://www.mhsc.com/>http://www.mhsc.com/ > ____________________________________________ > A group of politicians deciding to dump a President because his morals > are bad is like the Mafia getting together to bump off the Godfather for > not going to church on Sunday. > -- Russell Baker > Zachary McGibbon mzac(a)uunet.ca

3 2