January 1998 - Test - lists.nanog.org

ISPs in Bombay India
by Geoff White 02 Feb '98

02 Feb '98

Can anybody point me to an ISP in Bombay that can supply ISDN or Frame Relay into the internet. Thanks Geoff White

5 4

Re: The Cidr Report
by Vince Fuller 02 Feb '98

02 Feb '98

> As you can see things are startng to move up recently. I'd suggest > folks take a look at the "Interesting Aggregates" section on the web > page as it appears there's been a large influx of routes > here. Particularly AS719 who look like they may have a config error > with many many /28s showing up. They aren't the only ones as there > seems to be a lot of potential savings to be made here just by > eye-balling the aggregates. It looks like AS 719 may have cleaned-up their act, but there is still a lot of garbage in that section of the report. Most of them seem to be subnets of /16's that all have the same AS path and therefore have no reason to not be aggregated. 168.108.x.y, 166.102.x.y, 152.166.x.y-152.172.x.y, 129.81.x.y, and 139.175.x.y are the most obvious offenders - all of the components of each are singly-homed to a single AS path (yes, AS 1 has a couple of small ones not listed above - I'll see about chasing those down). Others, like 161.11.x.y, 138.87.x.y, 137.15.x.y, 137.98.x.y, and 143.233.x.y appear to be multi-homed but still shouldn't need to be propagated to the global Internet. If you're going to accept CIDR block subcomponents from your customers for load-balancing or other purposes, please set community "no-advertise" or otherwise prevent them from leaking out to the rest of the net - everyone else doesn't need to see your trash... --Vince (note: from address modified to discourage spam)

2 1

noncooperation in tracing an attack
by Brian Holt 31 Jan '98

31 Jan '98

I'm very unhappy to have to post a message here to get someone at globalcenter.net to help in tracing an attack that has been going on for several hours now. Their NOC notified our NOC that they would not be able to get security involved in this attack until monday, which is completely unacceptable. If anyone cares, the target for the attack is a single IP address of 207.227.138.15 and it has been spoofed to be coming from several different IP addresses over the past few hours. The first few addresses used were 1.1.1.1 and 2.2.2.2, now the current traffic flow is said to be coming from 207.227.138.15. I personally have no problem with blocking this attack to stop it, but it sure would be nice to actually nab one of these people once in awhile. Thanks for the lack of help, Brian

1 0

Rumored Large Fiber Break
by Rodney Joffe 31 Jan '98

31 Jan '98

GXN Networks is reporting a major fiber break that has affect most of the European/US connectivity. Does anyone have any more details?

5 4

New NAP
by Rodney Joffe 31 Jan '98

31 Jan '98

Has anyone heard about a new MFS NAP being planned/built in Texas area?

3 2

DNS report released
by Dean Anderson 30 Jan '98

30 Jan '98

I think a lot of people on this list might be interested in this. >From: gordoni(a)base.com (Gordon Irlam) > >The government today issued a report on governance of the Domain Name >System. > >Please review: > > http://www.ntia.doc.gov/ntiahome/domainname/domainname130.htm > >It says a lot of positive sounding things, but on a careful reading >it seems to leave the way open for Network Solutions to obtain monopoly >control over the registry functions for .com, .net, and .org, and to >extract extremely serious monopoly rents as a result. > >I'd be interested in other people's thoughts on this report, and what >to do about this problem, which I feel is potentially extremely serious. > >I have a bunch of material online on this issue at: > > http://www.base.com/gordoni/thoughts/dns-control.html > >but have not updated it to take into consideration the above report. > > gordoni > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

DNS of exite.com hacked ?
by Winfried Haug 30 Jan '98

30 Jan '98

Hello.. some customers are complaining, that they cant reach www.exite.com... hmmm a nslookup shows... $ dig @ns1.coastline.com www.exite.com. ; <<>> DiG 2.2 <<>> @ns1.coastline.com www.exite.com. ; (1 server found) ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10 ;; flags: qr aa rd ra; Ques: 1, Ans: 1, Auth: 2, Addit: 2 ;; QUESTIONS: ;; www.exite.com, type = A, class = IN ;; ANSWERS: www.exite.com. 86400 A 192.168.254.254 ^^^^^^^^^^^^^^^ ;; AUTHORITY RECORDS: exite.com. 86400 NS ns1.coastline.com. exite.com. 86400 NS ns2.coastline.com. ;; ADDITIONAL RECORDS: ns1.coastline.com. 86400 A 205.180.85.126 ns2.coastline.com. 86400 A 205.180.85.125 ;; Total query time: 406 msec ;; FROM: hq.seicom.net to SERVER: ns1.coastline.com 205.180.85.126 ;; WHEN: Fri Jan 30 13:48:03 1998 ;; MSG SIZE sent: 31 rcvd: 134 hmmmm well this ip adress is never reachable :-) was this dns-server hacked ? Winfried

4 3

NANOG 12
by Pam Ciesla 30 Jan '98

30 Jan '98

Registration for the NANOG 12 Meeting in Albuquerque will be closed at midnight (EST) tonight. Registration fee after midnight will be $170. Anyone phoning in credit card info can leave it on voicemail or I will return calls on Monday 2/2. Checks must be mailed by 1/30 unless other arrangements have been made. NANOG webpage http://www.nanog.org/. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Pam Ciesla 734-936-0172 - phone Merit Network, Inc. 734-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1 0

The Cidr Report
by Tony Bates 30 Jan '98

30 Jan '98

This is an auto-generated mail on Fri Jan 30 12:00:00 PST 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 30Jan98 0) General Status Table History ------------- Date Prefixes 230198 48658 240198 48671 250198 48612 260198 49037 270198 49125 280198 49117 290198 50396 300198 50242 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 95.9.43.0/24 from AS2878 *** Bogus 212.192.0.0/16 from AS5568 *** Bogus 212.255.0.0/16 from AS2871 AS Summary ---------- Number of ASes in routing system: 3169 Number of ASes announcing only one prefix: 1477 (766 cidr, 711 classful) Largest number of cidr routes: 1103 announced by AS719 Largest number of classful routes: 1022 announced by AS701 1) Gains by aggregating at the origin AS level --- 30Jan98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS2493 726 386 340 46.8% iSTAR Internet, Inc. AS6235 495 252 243 49.1% Intermedia Communications, Inc. AS4293 424 215 209 49.3% IMCI AS174 856 659 197 23.0% Performance Systems International AS816 598 417 181 30.3% UUNET Canada (ASN-UUNETCA-AS4) AS3602 456 304 152 33.3% Sprint Canada Inc. AS3749 200 59 141 70.5% TECNET AS701 1022 909 113 11.1% Alternet AS1785 456 371 85 18.6% NYSERNet Backbone AS3751 123 47 76 61.8% SNET-AS AS2048 165 93 72 43.6% LaNet AS5668 107 40 67 62.6% Century Telephone Inc. AS1239 602 539 63 10.5% SprintLink Backbone AS3804 203 141 62 30.5% Bell Solutions AS1 842 784 58 6.9% BBNPLANET AS271 111 56 55 49.5% BCnet Backbone AS3464 119 67 52 43.7% Alabama Research and Education Ne AS719 519 468 51 9.8% LANLINK autonomous system AS549 210 160 50 23.8% ONet Backbone AS7545 115 67 48 41.7% TPG Internet Pty Ltd AS72 84 36 48 57.1% Schlumberger Information Network AS4763 128 80 48 37.5% Telstra New Zealand AS1221 263 218 45 17.1% AARNET-AS AS7046 123 81 42 34.1% UUNET-CUSTOMER AS2711 97 55 42 43.3% SUNBELT-AS AS684 85 44 41 48.2% Manitoba Regional Network Backbon AS3561 914 873 41 4.5% MCI AS852 155 116 39 25.2% AGT Advance Communication AS6335 62 24 38 61.3% NTRNET AS1691 162 124 38 23.5% BCTEL For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 1

Re: whois?
by Martin Hannigan 30 Jan '98

30 Jan '98

I thought this list was related to Internet operations. I've been flamed at least 5 times now regarding the post re: whois? Is InterNIC availability not an operational issue? The reference to the text I clipped included an NFS timeout. This was not mine, it was theirs. If information regarding InterNIC availability isn't appropriate, apologies. < Maybe I should join the "blue man" thread > Regards, -- Martin Hannigan hannigan(a)xcom.net Sr. Network Engineer CO/Carrier Networks XCOM Technologies, INC. F:617.500.0002 V:617.500.0108

1 0