December 1997 - Test - lists.nanog.org

Re: Whoa; the 3 network?
by Eric Germann 23 Dec '97

23 Dec '97

At 10:27 AM 12/23/97 -0800, Michael Dillon wrote: >On Tue, 23 Dec 1997, Adam Rothschild wrote: > >> Funky discovery... question is, why does GE need such massive addr space? >> :) > >Because they are directly responsible for the existence of the Internet. >After all, GE invented the light bulb. If not for that we would have had >no vacuum tubes, thus no transistors, thus no ICs, thus no IMPs, thus no >Internet. > I didn't know Thomas Edison worked for GE? >Or maybe its because GE Information Systems ran the largest internet in >the world until the Internet surpassed it in size a couple of years ago. > >Or maybe they don't. Why don't you ask them why they need it. > ARIN ought to be happy when they get their check for that one! >-- >Michael Dillon - Internet & ISP Consulting >http://www.memra.com - E-mail: michael(a)memra.com > > > > ============================================================================ ==== Eric Germann Computer and Communications Technologies ekgermann(a)cctec.com Van Wert, OH 45891 Phone: 419 968 2640 http://www.cctec.com Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider

3 2

RE: Whoa; the 3 network?
by Eric Germann 23 Dec '97

23 Dec '97

If you're in the process of renumbering, why not renumber into 10/8? Does Jane Pauley need her own gloabally routable IP address? Number of employees <> number of addresses. I suppose if you think about it, ping flooding Tom Brokaw's teleprompter during the Nightly News would be kind of cool. Of course, this could be the spiked eggnog talking too.... Happy Holidays, Eric At 12:03 PM 12/23/97 -0600, you wrote: > >Well, GE is the largest corporation in the world. The total employees >in all seven divisions and their components is just over 1.7 million. >That is a lot. Add in all the IP devices in NBC's network alone and >you've got a huge number of justifiable space right there. Further, >they, uh sorry, we, :-) are renumbering all acquired companies into the >3.0.0.0/8 range and returning the historic class B's (i.e. Ameridata, >Bodan, etc.). > >Vincent J. Bono >Comstor Corporation >A GE Capital Service Company > > > > >> -----Original Message----- >> From: Adam Rothschild [SMTP:asr@millburn.net] >> Sent: Tuesday, December 23, 1997 7:09 AM >> To: Alex Rubenstein >> Cc: nanog(a)merit.edu >> Subject: Re: Whoa; the 3 network? >> >> Funky discovery... question is, why does GE need such massive addr >> space? >> :) >> >> -=asr >> >> On Tue, 23 Dec 1997, Alex Rubenstein wrote: >> >> > >> > Maybe I should be sleeping rather than examining BGP tables, but: >> > >> > >> > whi4#sho ip bgp 3.156.20.0 >> > BGP routing table entry for 3.156.20.0/24, version 449977 >> > Paths: (1 available, best #1, advertised over IBGP) >> > 7372 701 3561 1221 >> > 207.99.5.196 from 207.99.5.196 (208.210.32.17) >> > Origin incomplete, localpref 500, valid, external, best >> > Community: 666 >> > >> > >> > >> > traceroute to 3.156.20.1 (3.156.20.1), 30 hops max, 40 byte packets >> > . >> > . >> > 5 telstra.SanFrancisco.mci.net (166.48.19.250) 332.535 ms >> 538.669 ms 365.308 ms >> > 6 Fddi0-0.pad-core1.Sydney.telstra.net (139.130.249.226) 290.266 >> ms 317.40 ms 290.209 ms >> > 7 Hssi6-0.lon-core1.Melbourne.telstra.net (139.130.249.214) >> 350.701 ms 339.90 ms 439.199 ms >> > 8 Fddi0-0.lon11.Melbourne.telstra.net (139.130.239.234) 419.291 >> ms 424.309 ms 283.243 ms >> > 9 power2.lnk.telstra.net (139.130.49.114) 403.623 ms 353.911 ms >> 307.750 ms >> > 10 203.36.142.146 (203.36.142.146) 348.695 ms 310.482 ms 301.917 >> ms >> > >> > >> > [root@newspeer1 /root]# whois 3.0.0.0 >> > General Electric Company (NET-GE-INTERNET) >> > One Independence Way >> > Princeton, NJ 08540 >> > >> > Netname: GE-INTERNET >> > Netnumber: 3.0.0.0 >> > >> > >> > >> > >> > > ============================================================================ ==== Eric Germann Computer and Communications Technologies ekgermann(a)cctec.com Van Wert, OH 45891 Phone: 419 968 2640 http://www.cctec.com Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider

1 0

MAE-East Status?
by Kevin Martin 23 Dec '97

23 Dec '97

Can anyone comment on the current status of problems at MAE-East? As far as I can see from here, packet loss has risen sharply, and performance has dropped sharply, several months ago, and rarely has it improved. For most pairings of providers on different Gigaswitches, packet loss is regularly in the 20-30% range. If this isn't what most people are seeing, I'd like to know. If it is, I'd like to hear any insight on when the situation might improve. If this isn't an operational issue, by God, I don't know what is, but flame me if you need to. Kevin Martin sigma(a)pair.com

1 0

Whoa; the 3 network?
by Alex Rubenstein 23 Dec '97

23 Dec '97

Maybe I should be sleeping rather than examining BGP tables, but: whi4#sho ip bgp 3.156.20.0 BGP routing table entry for 3.156.20.0/24, version 449977 Paths: (1 available, best #1, advertised over IBGP) 7372 701 3561 1221 207.99.5.196 from 207.99.5.196 (208.210.32.17) Origin incomplete, localpref 500, valid, external, best Community: 666 traceroute to 3.156.20.1 (3.156.20.1), 30 hops max, 40 byte packets . . 5 telstra.SanFrancisco.mci.net (166.48.19.250) 332.535 ms 538.669 ms 365.308 ms 6 Fddi0-0.pad-core1.Sydney.telstra.net (139.130.249.226) 290.266 ms 317.40 ms 290.209 ms 7 Hssi6-0.lon-core1.Melbourne.telstra.net (139.130.249.214) 350.701 ms 339.90 ms 439.199 ms 8 Fddi0-0.lon11.Melbourne.telstra.net (139.130.239.234) 419.291 ms 424.309 ms 283.243 ms 9 power2.lnk.telstra.net (139.130.49.114) 403.623 ms 353.911 ms 307.750 ms 10 203.36.142.146 (203.36.142.146) 348.695 ms 310.482 ms 301.917 ms [root@newspeer1 /root]# whois 3.0.0.0 General Electric Company (NET-GE-INTERNET) One Independence Way Princeton, NJ 08540 Netname: GE-INTERNET Netnumber: 3.0.0.0

5 4

InterNIC again?
by Edward S. Marshall 23 Dec '97

23 Dec '97

Hmmm... ----- The following addresses had permanent fatal errors ----- <hostmaster(a)internic.net> ----- Transcript of session follows ----- ... while talking to rs.internic.net.: >>> RCPT To:<hostmaster(a)internic.net> <<< 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1) 550 <hostmaster(a)internic.net>... User unknown Whoops? ;-) -- ____ ______ _____ _/ __ \ ___// \ Edward S. Marshall <emarshal(a)logic.net> \ ___/___ \| | | \ http://www.logic.net/~emarshal/ \____\_____>__|_|__/ Information Systems Manager, Logical Solutions [ Are you a spammer looking for a great opportunity to be blacklisted? Then ] [ have your automatic bots email spam(a)logic.net and secure a spot on my list! ]

1 0

Sprintnap problems Monday afternoon?
by John R Levine 23 Dec '97

23 Dec '97

One of my users called me up complaining of ridiculously slow echo, and a few traceroutes showed something like 7 second delays for data passing between Sprintlink and Nysernet. Any idea what it was? Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner Finger for PGP key, f'print = 3A 5B D0 3F D9 A0 6A A4 2D AC 1E 9E A6 36 A3 47

1 0

NSI Bulletin 097-010 | RS machine outage
by David H. Holtzman 22 Dec '97

22 Dec '97

The Internic is currently experiencing technical difficulties with some of the rs hosts. This problem is expected to be resolved within the next hour. Users may experience temporary problems with whois in the interim. We apologize for the inconvenience. _____________________________________ David H. Holtzman (dholtz(a)internic.net) Sr Vice President of Engineering Network Solutions, Inc.

2 1

NSI Bulletin 097-009 | RS machine outage
by David H. Holtzman 22 Dec '97

22 Dec '97

The Internic is currently experiencing technical difficulties with some of the rs hosts. This problem is expected to be resolved within the next hour. Users may experience temporary problems with whois in the interim. We apologize for the inconvenience. _____________________________________ David H. Holtzman (dholtz(a)internic.net) Sr Vice President of Engineering Network Solutions, Inc.

2 1

Re: "Today is a good day to die"
by Prabhu Kavi 22 Dec '97

22 Dec '97

Nope. Try a bunch of 1+Meg emailed executables showing things like Rudolph going splat, men and women dancing, etc. Prabhu ______________________________ Reply Separator _________________________________ Subject: "Today is a good day to die" Author: "J.D. Falk" <jdfalk(a)priori.net> at smtplink Date: 12/19/97 11:08 AM There seem to be a lot of packets deciding that today is a good day to die and rushing towards exchange points in order to throw themselves off of the nearest gigaswitch. Has Worldcom upgraded the MAE's again, or is this the much- touted explosion of "e-commerce" for the Christmas season? We've gotten nothing useful out of Worldcom today; anybody else had any better luck? ********************************************************* J.D. Falk voice: +1-650-482-2840 Supervisor, Network Operations fax: +1-650-482-2844 PRIORI NETWORKS, INC. http://www.priori.net "The People You Know. The People You Trust." *********************************************************

4 3

RE: Broadcast pings.
by Al Roethlisberger 22 Dec '97

22 Dec '97

At 04:04 PM 12/22/97 -0500, you wrote: >Yeah that was my initial thought, but we've been hit now from multiple >nameservers (and constantly machines that are named "ns" or appear in a >'nic record). I just found it odd that we're only getting hit from >machines matching this pattern. I guess it was random, but you never >know :-) > hmm, don't know. But it may be that a casual hacker that has recently jumped on the smurf bandwagon may be using ns addresses as they are so readily available. I have often been surprised at the lack of real knowledge some of the perpetrators have had in some of these cases. They just get the code, plug in some easy data(like their ISPs ns) and away they go. Fortunately for us, many of these folks don't know how to choose large enough networks to ping, so we often come out OK. Or maybe 'someone' just discovered nslookup =) and decided to use that data. Who knows though.... it is certainly hard to tell sometimes. al >Best regards, > >Jamie Scheinblum - FASTNET(tm) / You Tools Corporation >jamie(a)fast.net (610)954-5200 http://www.fast.net/ >FASTNET - Business and Personal Internet Solutions > >> -----Original Message----- >> From: Al Roethlisberger [SMTP:aroethli@cisco.com] >> Sent: Monday, December 22, 1997 3:23 PM >> To: Jamie Scheinblum >> Cc: nanog(a)merit.edu >> Subject: Re: Broadcast pings. >> >> At 12:50 PM 12/22/97 -0500, you wrote: >> >Has anyone seen an increase of broadcast pings, where the source >> route >> >appears to be from a nameserver? >> > >> >We took a look through our access-list logs, and it seems all of the >> >attempted attacks during the last few days have had an IP-source of a >> >nameserver. >> > >> >Just thought it was curious. >> > >> >Best regards, >> > >> >Jamie Scheinblum - FASTNET(tm) / You Tools Corporation >> >jamie(a)fast.net (610)954-5200 http://www.fast.net/ >> >FASTNET - Business and Personal Internet Solutions >> > >> >> >> Jamie, >> >> It is probably just someone 'smurfing', where they fudge the source ip >> of >> the broadcast ping request. The actual source of the ICMP request is >> probably entirely different than the nameserver you are seeing in your >> logs....hence the difficulty(although not impossible) tracking these >> attacks. >> >> I would imagine that this poor nameserver in question is also >> suffering from >> the attack as well when all the pinged devices attempt to respond. >> You >> probably have one or more folks using the same dummy address for the >> source. >> This is the nature of the 'smurf' problem. >> >> Check out: >> >> http://www.quadrunner.com/~chuegen/smurf.cgi >> >> This is a co-worker of mine that has put together some useful >> background and >> tips addressing this issue. >> >> Hope that helps. >> >> al >> > >

1 0