August 1997 - Test - lists.nanog.org

Re: how to protect name servers against cache corruption
by craig＠ishiboo.com 01 Aug '97

01 Aug '97

You know I can understand how discussing problems in DNS is an valid concern for netowrk operations I cant for the life of me figure out exactly how supposed netowrk and security professionals can show a complete lack of maturity and restraint. Thomas Ptacek is attempting to discuss in a level headed straight forward manner a serious problem and is being met with repeated insults, open hostility and down right rude behavior. Thomas is to be thanked for being the obviously better man, regardless of the validity of his opinions, for coming to the table in a direct, polite fashion. In an open forum it is sad to see people such as Perry Metzger, Paul Vixie, Paul Ferguson all stooping to attack people whose idea they dont like instead of addressing the issue. Can we please get back to the more adult discussion of the issues and leave the childish attacks on peoples intelligence, heritage, personal habits and the like to a more proper forum? this list is begining to remind me of a bad Beavis and Butthead nightmare. It would be most enjoyable to not have to see the following in the future. For example: From: "Perry E. Metzger" <perry(a)piermont.com> I see my opinion of you was more than correct. You're a jerk. I'm sure you've never asked yourself why it is that the people who've written widely deployed software and standards and make the world work hold you in contempt. I'm sure you never will. That's because you're a jerk. Paul has been doing a very good job of slowly but surely getting BIND cleaned up, getting vastly improved code out there into the real world, and largely been paying for the effort out of his own pocket. He's worth about seven thousand Thomas Ptaceks -- perhaps worth more. Frankly, if I had a choice between saving you from drowning by some minimal action like pushing a button under my index finger and, for example, keeping someone from spilling a cup of coffee on Paul's pants, I'd say the latter would be more important for the world and would be the choice I'd almost certainly make. I mean this in the greatest of seriousness. I suspect that the more you post, the more that will become general community consensus as to your worth as a human being. From: Paul A Vixie <vixie(a)vix.com> you are sloppy, ill mannered, and ignorant. it's clear that you have not read rfc 1034 or rfc 1035 (much less 2010 or 2136), or that if you have read them you did not understand them. i have been sloppy, ill mannered, and ignorant in the past. but i did not display those traits when speaking to people who had been doing DNS work for ten years before i started. you have an uphill climb if you expect me to take you seriously in the future. it's not impossible. but from your continued arrogance and inability to see yourself through the eyes of others, i hold out very little hope. From: Paul Ferguson <pferguso(a)cisco.com> Sure, smart guy. And there are also issues with IP packets which are passed across untrusted nodes in the Internet. -craig ---------------- Craig Nottingham craig(a)mil.net

1 0

Re: how to protect name servers against cache corruption
by salo＠msc.edu 01 Aug '97

01 Aug '97

> From: craig(a)ishiboo.com > Subject: Re: how to protect name servers against cache corruption > Date: Fri, 1 Aug 1997 15:26:53 -0500 (EST) > [...] > ... this list is begining to > remind me of a bad Beavis and Butthead nightmare. It would be most > enjoyable to not have to see the following in the future. > [...] I agree with you that some of the mail on nanog appears to bolster the assertion the some of those who develop and operate the Internet appear to have missed the socialization part of the preschool curriculum. On the other hand, I have been known to save some of these e-mails, particularly in my "Great Quotes for use in Proposals" and "I Wonder if I Will Ever Review a Proposal from this Person" folders. -tjs

1 0

ASExplorer 1.0 Beta Announcement
by ipma-support＠merit.edu 01 Aug '97

01 Aug '97

The University of Michigan and Merit Network, Inc. are pleased to announce the 1.0 Beta release of ASExplorer. The new ASExplorer is the first of a series of visualization tools being developed by the Internet Performance Measurement and Analysis project (IPMA). Please see: http://www.merit.edu/ipma/asexplorer The new, light-weight ASExplorer Java client displays routing instability data received from one or more user-selected channels. We are currently providing channels for routing instability data collected at the AADS, MAE-East, MAE-West, PacBell, and PAIX exchange points. Some of the new features of ASExplorer include: * Who is AS1239? Well, just float your mouse cursor over AS1239, and we'll tell you! Dynamically updated Internic information tells you more than just an AS number -- try it and see. * Instability levels are monitored via graphs of BGP announcements and withdrawals, both updated in real-time. * Lists of currently flapping prefixes are hooked into the main ASExplorer window, and allow you to jump to an AS with a single click. * ASExplorer now lists all of the announced routes by an AS within the last time window (currently fixed at 75 minutes). * You can jump directly to an AS if you know its AS number. No more hunting through layers of HTML. * Can't figure out how the darn tool works? Use the on-line help! Also note that if you just want to look at the real-time graphs, you can view them at http://www.merit.edu/ipma/realtime/. The new version of ASExplorer relies on the Salamander Data Distribution infastructure to provide real-time updates to the client applets/application via a platform-independent webcasting technology. If you have any questions, comments, or any form of criticism, please feel free to send mail to ipma-support(a)merit.edu. P.S. If you have any problems running the ASExplorer software, please mail us the contents of your Java console and a brief description of your problem. The ASExplorer team will be more than willing to help you get the software up and running. - Jimmy vecna(a)eecs.umich.edu

1 0

Re: how to protect name servers against cache corruption
by Thomas H. Ptacek 01 Aug '97

01 Aug '97

> What, exactly, does Bind 8.1 do? BIND 8.1.1 does not appear to have an easy mechanism to match a query ID to the question-section details of an open query. Currently, BIND increments a counter, prints a debugging log line, and drops the packet; it does not invalidate the open query. > > Netcom's nameservers. They will no longer be able to resolve NETSOL.COM, > > since every query they open up will be immediately invalidated by a fake > > response. > Well, one could make observations about comparisons of IP source > addresses here... All of the attacks being discussed assume the attacker has the ability to inject completely forged packets onto the network. All of my suggestions are given under the assumption that this is a situation that we do not have a reasonable expectation of being able to prevent in IPv4. > I don't see that the problem you describe affects the people > _answering_. You'd have to nail _every_ _inquirer_. Ok, yes, hitting This is true. However, remember that this thread occurred in response to an attack by Eugene Kashpureff, who used a far more primitive attack and made national news by effectively disabling NSI's home page. I don't think the operation community wants to think about the implications of someone with both malice and BRAINS trying to utilize the same security problems. ---------------- Thomas Ptacek at EnterAct, L.L.C., Chicago, IL [tqbf(a)enteract.com] ---------------- "If you're so special, why aren't you dead?"

10 16

how to protect name servers against cache corruption
by Paul A Vixie 01 Aug '97

01 Aug '97

a BIND 4.9.6 or 8.1.1 server is immune. so, you could upgrade. to so do, see http://www.isc.org/isc/ which will lead you to ftp://ftp.isc.org/isc/. (the root name servers are all running modern software at this point.) alternic's corruption works by locating authoritative name servers via the "NS RR"'s published in various zones. if you run these as authoritative- only (recursion disabled) then they will never fetch any data from anywhere. (the root name servers are configured this way, for example.) the downside is that you can't list such nameservers in your "resolv.conf" files or PC equivilents (Control Panel\\Networking\\TCP IP Settings, or some such rot.) this means you need more name servers if you separate recursive from non- recursive.

18 49

Re: Root Nameserver problems?
by John J. Buxbaum 01 Aug '97

01 Aug '97

I have noticed some problems today aswell, but nothing significant yet. I had assumed that it was problems with our customers, since our DNS servers are up and the records are good. john AT&T CBB Maintenance DNS -----Original Message----- From: Eric D. Madison <madison(a)acsi.net> To: nanog(a)merit.edu <nanog(a)merit.edu> Subject: Root Nameserver problems? >Anyone else having problems with lookups this morning? Can't seem to >resolve a lot of domains today.. > >Eric > > >_______________________________________________________ > Eric D. Madison - Senior Network Engineer - > ACSI - Advanced Data Services - ATM/IP Backbone Group > 24 Hour NMC/NOC (800)291-7889 Email: noc(a)acsi.net > >

2 1

Root Nameserver problems?
by Eric D. Madison 01 Aug '97

01 Aug '97

Anyone else having problems with lookups this morning? Can't seem to resolve a lot of domains today.. Eric _______________________________________________________ Eric D. Madison - Senior Network Engineer - ACSI - Advanced Data Services - ATM/IP Backbone Group 24 Hour NMC/NOC (800)291-7889 Email: noc(a)acsi.net

1 0

MAE-East
by Brian Merritt 01 Aug '97

01 Aug '97

I'm sure all of you noticed that MAE-East has ate it a few times in the last hour or so. Did any of you have any luck getting an explanation as to what's going on? Connections to the gigaswitches, the shared fddi concentrators, and the ethernet switches all went down... Power? If not, what would cause such a massive disturbance? Besides an airplane crashing into it.... -Brian

3 3

RE: disabling directed broadcasts
by jan.novak＠aliatel.cz 01 Aug '97

01 Aug '97

I also have (past) experience with a network running MS/NetBIOS cruft through routers with forwarding of directed broadcasts DISABLED. It worked fine. If there is some corner case I've missed that requires forwarding of directed broadcast packets, it would be useful for that specific case to be enumerated _in detail, in public_. Ran rja(a)home.net We ran MS Windows over routed network in seven localities without any type of broadcast enabled. All what is needed for user transparent operation is to setup WINS.

1 0