- NANOG - lists.nanog.org

Big increase in DNS service ?!?!
by Francois Beauregard 30 Jul '97

30 Jul '97

Wow... I just checked the root servers for the list of head servers from a.root-servers.net... Anyone knows why all servers are repeated twice... >From NSLookup I got... (root) origin = A.ROOT-SERVERS.NET mail addr = hostmaster.INTERNIC.NET serial = 1997072900 refresh = 10800 (3 hours) retry = 900 (15 mins) expire = 604800 (7 days) minimum ttl = 86400 (1 day) (root) nameserver = J.ROOT-SERVERS.NET (root) nameserver = K.ROOT-SERVERS.NET (root) nameserver = L.ROOT-SERVERS.NET (root) nameserver = M.ROOT-SERVERS.NET (root) nameserver = A.ROOT-SERVERS.NET (root) nameserver = H.ROOT-SERVERS.NET (root) nameserver = B.ROOT-SERVERS.NET (root) nameserver = C.ROOT-SERVERS.NET (root) nameserver = D.ROOT-SERVERS.NET (root) nameserver = E.ROOT-SERVERS.NET (root) nameserver = I.ROOT-SERVERS.NET (root) nameserver = F.ROOT-SERVERS.NET (root) nameserver = G.ROOT-SERVERS.NET (root) nameserver = J.ROOT-SERVERS.NET (root) nameserver = K.ROOT-SERVERS.NET (root) nameserver = L.ROOT-SERVERS.NET (root) nameserver = M.ROOT-SERVERS.NET (root) nameserver = A.ROOT-SERVERS.NET (root) nameserver = H.ROOT-SERVERS.NET (root) nameserver = B.ROOT-SERVERS.NET (root) nameserver = C.ROOT-SERVERS.NET (root) nameserver = D.ROOT-SERVERS.NET (root) nameserver = E.ROOT-SERVERS.NET (root) nameserver = I.ROOT-SERVERS.NET (root) nameserver = F.ROOT-SERVERS.NET (root) nameserver = G.ROOT-SERVERS.NET J.ROOT-SERVERS.NET internet address = 198.41.0.10 K.ROOT-SERVERS.NET internet address = 193.0.14.129 L.ROOT-SERVERS.NET internet address = 198.32.64.12 Because of the size limit of the packets, I receive only 3 IP from the query to a root server and I get the following response when starting DNS... "NOTICE : check_root: 1 root servers after query to root server < min." Not pretty... Is this a screwup again or are they getting "spoofed" ??? Sincerely ---------------------------------- Francois Beauregard FBorg(a)fbli.com FBLI.COM We love feedbacks and live by them Sales : Sales(a)fbli.com 1 (888) FBLI.COM Tech support : Support(a)fbli.com 1 (514) 349-0455 Internet Web : http://www.fbli.com ICQ : 1907537 Montreal, Canada ----------------------------------

1 0

RE: "1997, the Year of the Backhoe" ...Re: Fiber Cut In Sterling VA.
by Peter Galbavy 30 Jul '97

30 Jul '97

On 25 July 1997 20:11, Steve Goldstein [SMTP:sgoldste@nsf.gov] wrote: > At 10:18 AM -0400 7/25/97, Henry Clark wrote: > ... > > > >backhoe season :-) > > "1997, the Year of the Backhoe" For those of us who have not grown up with the (what sounds like) delightful vagaries of US road management - what is a backhoe ? regards, -- Peter Galbavy Demon Internet Ltd

9 8

Apology re: my last mail
by Paul Thornton 30 Jul '97

30 Jul '97

If I may interrupt the great DNS debate ... again ... My mail regarding the LINX move last weekend managed to sit on one of our servers for days and appear yesterday - sorry about adding to the noise! The LINX move went well, and is now happily installed in its own room in London Telehouse. Paul -- Paul Thornton, Network Engineer, London Internet Exchange Ltd. Tel: 07000 783797 Mobile: +44 467 372205

1 0

RE: ANS etc.
by Steve Carter 30 Jul '97

30 Jul '97

> >[2] Is there an equivalent to NANOG for Europe and Asia and is there > > >an equivalent list which discusses operational issues for these > > continents? Pointers appreciated. > > > > Yes, for Europe there's the RIPE-discuss list (for which I don't have > an immediate reference) and for Asia, there's the apops list: > For RIPE, try http://www.ripe.net/ then do some drilling.........

2 1

RE: how to protect name servers against cache corruption
by Dan Dale 30 Jul '97

30 Jul '97

Jeesh people... let's get some life here. Step out and enjoy the weekend will ya??? Upgrade to BIND 8.1.1 and deal with it. Some hack will figure it out and 9.0 will soon be on it's way. DD -----Original Message----- From: Paul A Vixie [SMTP:vixie@vix.com] Sent: Tuesday, July 29, 1997 6:09 PM To: tqbf(a)enteract.com Cc: nanog(a)merit.edu Subject: Re: how to protect name servers against cache corruption > > Noone in the security field has any right to expect any implementation of > > DNS to be secure until DNSSEC is widely implemented. > > > I'm sorry if something I said misled you to believe otherwise. > > So BIND 8.1.1 is NOT "immune" to the poisoned resource-record attack? I > ask because you specifically stated that it was. Sorry to nag, I'd just > like to see this clarified to the operations community. BIND 4.9.6 and 8.1.1 are immune to all known attacks, including the one Eugene Kashpureff copied and put into wide public use recently. I know of attacks we are not immune to, which cannot be stopped without DNSSEC. My paper, whose URL I gave in the previous message, alludes to some of these without exactly giving a road map for their use.

1 0

Tracking cracker, help?
by dlr＠bungi.com 30 Jul '97

30 Jul '97

I'm tracking down an individual that has attacked both my personal site, as well as one of my customers' sites. In this particular attempt, when his 'normal' site was blocked by IP address, he immediately started to use dial-up sites all over his local area, then ranged further into the US. On my system, he had installed a password sniffer. I suspect that this was a common mode of operation for him. Naturally, I logged all of the attempts at the router level. I emailed the logs to the origin ISPs, and (with one notable exception) was met with huge indifference. In the queries, I am asking only for a confirm/deny of the user's name - I am not asking the ISP's involved to release the name of the dialup users. That, of course, will come later. Right now, I'm just trying to confirm that the same individual is launching the attacks. A police report has been filed, and a restraining order will be served tommorow. What's a better way to ask for, and obtain log information in a timely fashion? Wait 6 months for a court trial, when everyone has purged their logs? Clues would be appreciated. -- Dave Rand dlr(a)bungi.com http://www.bungi.com

5 4

Re: how to protect name servers against cache corruption
by Francois Beauregard 30 Jul '97

30 Jul '97

At 22:13 97-07-29 -0400, Perry E. Metzger wrote: > >Paul has made it clear that there are holes in the DNS protocols that >cannot be fixed without DNSSEC. He isn't papering anything over -- he >is merely describing reality. If you want to be sarcastic to him for >doing his best and being honest in public, well, that's fine, but >frankly I think you are doing the community a serious disservice by >attacking Paul. 110% behind you on that one... Sincerely ---------------------------------- Francois Beauregard FBorg(a)fbli.com FBLI.COM We love feedbacks and live by them Sales : Sales(a)fbli.com 1 (888) FBLI.COM Tech support : Support(a)fbli.com 1 (514) 349-0455 Internet Web : http://www.fbli.com ICQ : 1907537 Montreal, Canada ----------------------------------

1 0

NSI bulletin 097-005 | Reissuing deleted domain names
by David H. Holtzman 30 Jul '97

30 Jul '97

Effective immediately, Network Solutions will reinstitute deletion of unpaid domain names. Dave

3 2

Check me on this...
by Eric Germann 29 Jul '97

29 Jul '97

Its tuesday Jul 29,1997 at 3:00pm EDT ( a weekday in the US, correct? ) f.root-servers.net is still returning 1997072500 as a S/N instead of 1997072800 like all the rest, and bogus data about some zones. 4.5 hours ago I sent mail to Internic. No acknowledgement and no fix, so maybe they will hear it here. I will not respond to politics on the list if everyone else doesn't either :) Eric

4 3

Re: Check me on this...
by Eric Germann 29 Jul '97

29 Jul '97

Maybe a page with "We noticed a problem with xxxxx and we're working on it!" http://www.internic.net/current-issues.html as a suggestion. On second thought, maybe a well known page at each provider wouldn't be bad... Would certainly cut down my rants on the lists, and probably everyone elses. Eric At 04:26 PM 7/29/97 -0400, Jordan Mendelson wrote: >On Tue, 29 Jul 1997, Eric Germann wrote: > >> Its tuesday Jul 29,1997 at 3:00pm EDT ( a weekday in the US, correct? ) > >Hmm, nope... > >Last week, Senate passed a new bill removing the existance of weekdays so >that they could slack off and do less work. > >> f.root-servers.net is still returning 1997072500 as a S/N instead of >> 1997072800 like all the rest, and bogus data about some zones. > >I think a few people have reported this... > >> 4.5 hours ago I sent mail to Internic. No acknowledgement and no fix, so >> maybe they will hear it here. > >They REALLY need some people full time to respond to email. I hate sending >my email into "The Blackhole of Death" which is InterNIC's mail system. > > >Wow, a valid InterNIC warning... go figure. > > >Jordan > >-- >Jordan Mendelson : www.wserv.com/~jordy/ >Web Services, Inc. : www.wserv.com > > > >

1 0