October 1998 - Test - lists.nanog.org

Re: Encouraging smurf-amp measurements
by Richard Steenbergen 19 Oct '98

19 Oct '98

>This is encouraging news: > >I ran a scan for smurf-amps of /24s in 200/8 through 210/8 in late >July that yielded 30,083 networks that returned duplicate >echo-replies. Today, I rescanned those networks, and found that of the >original 30k, only 21,255 returned duplicates -- that's a 29% drop. > >Whether it means that more networks overall are properly configured, or >that different networks are misconfigured, I know not. Optimistically, >I'd like to guess that the former is true, but a complete scan would >be necessary to know. Its an actual across-the-board drop. If you eliminate the puny bcasts (less then 10 dupes) the numbers are even better. I've got a project setup to automatically scan everything in the bgp routing table, grab contact information for the UPLINK (99.9% of those bcasts remaining are ones with dud contact info), send out aggregated emails to said uplinks, and maintain a database of useful statistics. The only thing I'm waiting on is certain persons coughREIDcough coughSTEVEcough to get off their arses and finish what they said they would a couple months ago. =) -- Richard Steenbergen <humble(a)lightning.net> http://www.bitchx.com/~humble humble@EFnet hkp://keys.pgp.com/humble@lightning.net PGP KeyID: 0x21581362 PGP key fingerprint: 7552 6AB2 B9C7 5A1B F1B6 8EA3 DFCF 793D 2158 1362 "I tried sniffing Coke once, but the ice cubes got stuck in my nose!"

1 0

Encouraging smurf-amp measurements
by mark＠vielle.datasys.net 18 Oct '98

18 Oct '98

This is encouraging news: I ran a scan for smurf-amps of /24s in 200/8 through 210/8 in late July that yielded 30,083 networks that returned duplicate echo-replies. Today, I rescanned those networks, and found that of the original 30k, only 21,255 returned duplicates -- that's a 29% drop. Whether it means that more networks overall are properly configured, or that different networks are misconfigured, I know not. Optimistically, I'd like to guess that the former is true, but a complete scan would be necessary to know. mrl

1 0

Re: Maybe I'm misreading this but...
by shields＠crosslink.net 18 Oct '98

18 Oct '98

In article <4.0.1.19981016224901.00de6240(a)pariah.cncx.com>, I Am Not An Isp <patrick(a)ianai.net> wrote: > FACT: RFC1918 space does not break PMTU discovery. Deal with it. If you use RFC 1918 space on the Internet, PMTU very well may not work for you. You can place fault on whatever standard you like but that doesn't change the *operational* issue. -- Shields, CrossLink.

4 3

Anybody seen this?
by William S. Duncanson 18 Oct '98

18 Oct '98

According to CNN.com: Internet pioneer Jon Postel dies at 55 Jon Postel, the computer pioneer who wielded enormous influence over technical details of the Internet, died of complications from heart surgery in Los Angeles on Saturday. Postel was considered by the White House as a crucial player in the future of the global computer network. Although he was scarcely known outside computer circles, Postel served as director of the Internet Assigned Numbers Authority, which matched unique numerical addresses for computers on the Internet with its millions of web addresses. William S. Duncanson caesar(a)starkreality.com The driving force behind the NC is the belief that the companies who brought us things like Unix, relational databases, and Windows can make an appliance that is inexpensive and easy to use if they choose to do that. -- Scott Adams

2 1

Re: SONET ring questions
by David Greer 18 Oct '98

18 Oct '98

Peter, 3) Which routers should be used. The options are 3com NB-II's DPE+ (dual CPU), Cisco 7200 series, or Cisco 7500 (each router will have at least two 100Base-T LAN ports). If you are going to use Cisco which is a good choice, do not go cheap and get a 7200 for the job. A 7200 can only handle three fast ethernet ports. I would look at the 7500 series or possibly there gigabit router series. That will give you enough muscle to handle the job. I would call in your local Cisco office to check out which model is most appropriate. >1) Bell Atlantic assures us that, because of the redundancy, we can > expect 100% uptime from the OC-12. I would like feedback as to > whether this is a realistic portrayal of the SONET environment. Nobody gets 100% uptime from anything. Can't happen! >2) We have the option of using either single-mode or multi-mode fiber > OC-3 connections - what factors should be considered in selecting > the fiber media type. Look at the distance, I believe multi mode is only good for a couple of miles, then you have to go single mode, which will drive your costs up. I hope this helps! Dave Greer Senior Telecomm Analyst

2 1

Re: primary for aol.com?
by brian moore 18 Oct '98

18 Oct '98

On Fri, Oct 16, 1998 at 04:44:00PM -0400, Jon Lewis wrote: > On Fri, 16 Oct 1998, bryan s. blank wrote: > > > |o| Ugly! > > |o| > > |o| Add this to root.cache instead: > > |o| > > |o| aol.com. 3600000 NS dns-02.aol.com. > > |o| dns-02.aol.com. 3600000 A 152.163.199.56 > > |o| > > |o| You might go through your named cache dump and use a different AOL DNS > > |o| server so we're not all pounding the same one. > > > > thanks man ;) i have been schooled ... thanks ... > > I give up. A few minutes after doing this, the DNS server on > 152.163.199.56 seems to have vanished...so this worked for a bit, and no > longer does. I've taken it out and notified our support staff that they > should expect calls about AOL being unreachable. I've still got some time in my cache.... I see the following: aol.com. 948 SOA dns-01.ns.aol.com. hostmaster.aol.net. ( 1998101400 ; serial 1800 ; refresh (30 mins) 300 ; retry (5 mins) 604800 ; expire (7 days) 3600 ) ; minimum (1 hour) ;; AUTHORITY RECORDS: aol.com. 2890 NS dns-01.ns.aol.com. aol.com. 2890 NS DNS-02.ns.aol.com. ;; ADDITIONAL RECORDS: dns-01.ns.aol.com. 100595 A 152.163.200.52 DNS-02.ns.aol.com. 100595 A 152.163.200.116 No idea where you got your above number. -- Brian Moore | "The Zen nature of a spammer resembles Sysadmin, C/Perl Hacker | a cockroach, except that the cockroach Usenet Vandal | is higher up on the evolutionary chain." Netscum, Bane of Elves. Peter Olson, Delphi Postmaster

2 1

John Postel has died. (fwd)
by bryan s. blank 17 Oct '98

17 Oct '98

;( |o| >Delivered-To: ip-sub-1(a)majordomo.pobox.com |o| >X-Sender: farber(a)158.130.12.3 |o| >Date: Sat, 17 Oct 1998 07:28:40 -0400 |o| >To: ip-sub-1(a)majordomo.pobox.com |o| >From: Dave Farber <farber(a)cis.upenn.edu> |o| >Subject: IP: Remembrance/postel |o| >Mime-Version: 1.0 |o| >Sender: owner-ip-sub-1(a)majordomo.pobox.com |o| >Precedence: list |o| >Reply-To: farber(a)cis.upenn.edu |o| > |o| > |o| >I, and others I fear, have spent a sleepless night after hearing of the |o| >death of Jon Postel last night. This morning there was a note in my mail |o| >box from Vint Cerf that said many of the things I feel at this time. I |o| >asked him for permission to send on which he granted. |o| > |o| >I also remember Jon. I was his primary thesis advisor along with Jerry |o| >Estrin and I remember with fond memories the months spent closely working |o| >with Jon while his eager mind developed the ideas in back of what was a |o| >pioneering thesis that founded the area of protocol verification. Since I |o| >was at UC Irvine and Jon at UCLA we used to meet in the morning prior to |o| >my ride to UCI at a Pancake House in Santa Monica for breakfast and the |o| >hard work of developing a thesis. I gained a great respect for Jon then |o| >and 10 pounds of weight. |o| > |o| >I will miss him greatly. Jon was my second Ph.D. student. The first, |o| >Philip Merlin, also died way before his time. |o| > |o| >Dave |o| > |o| >________________________________________________________________________ |o| > |o| > October 17, 1998 |o| > |o| >I REMEMBER IANA |o| > |o| >Vint Cerf |o| > |o| >A long time ago, in a network, far far away, a great adventure took place= |o| =85 |o| > |o| >Out of the chaos of new ideas for communication, the experiments, the |o| >tentative designs, and crucible of testing, there emerged a cornucopia of |o| >networks. Beginning with the ARPANET, an endless stream of networks |o| >evolved, and ultimately were interlinked to become the Internet. Someone |o| >had to keep track of all the protocols, the identifiers, networks and |o| >addresses and ultimately the names of all the things in the networked |o| >universe. And someone had to keep track of all the information that |o| >erupted with volcanic force from the intensity of the debates and |o| >discussions and endless invention that has continued unabated for 30 |o| >years. That someone was Jonathan B. Postel, our Internet Assigned Numbers |o| >Authority, friend, engineer, confidant, leader, icon, and now, first of |o| >the giants to depart from our midst. |o| > |o| >Jon, our beloved IANA, is gone. Even as I write these words I cannot quite |o| >grasp this stark fact. We had almost lost him once before in 1991. Surely |o| >we knew he was at risk as are we all. But he had been our rock, the |o| >foundation on which our every web search and email was built, always there |o| >to mediate the random dispute, to remind us when our documentation did not |o| >do justice to its subject, to make difficult decisions with apparent ease, |o| >and to consult when careful consideration was needed. We will survive our |o| >loss and we will remember. He has left a monumental legacy for all |o| >Internauts to contemplate. Steadfast service for decades, moving when |o| >others seemed paralyzed, always finding the right course in a complex |o| >minefield of technical and sometimes political obstacles. |o| > |o| >Jon and I went to the same high school, Van Nuys High, in the San Fernando |o| >Valley north of Los Angeles. But we were in different classes and I really |o| >didn=92t know him then. Our real meeting came at UCLA when we became a par= |o| t |o| >of a group of graduate students working for Prof. Leonard Kleinrock on the |o| >ARPANET project. Steve Crocker was another of the Van Nuys crowd who was |o| >part of the team and led the development of the first host-host protocols |o| >for the ARPANET. When Steve invented the idea of the Request for Comments |o| >series, Jon became the instant editor. When we needed to keep track of all |o| >the hosts and protocol identifiers, Jon volunteered to be the Numbers Czar |o| >and later the IANA once the Internet was in place. |o| > |o| >Jon was a founding member of the Internet Architecture Board and served |o| >continuously from its founding to the present. He was the FIRST individual |o| >member of the Internet Society I know, because he and Steve Wolff raced to |o| >see who could fill out the application forms and make payment first and |o| >Jon won. He served as a trustee of the Internet Society. He was the |o| >custodian of the .US domain, a founder of the Los Nettos Internet service, |o| >and, by the way, managed the networking research division of USC |o| >Information Sciences Institute. |o| > |o| >Jon loved the outdoors. I know he used to enjoy backpacking in the high |o| >Sierras around Yosemite. Bearded and sandaled, Jon was our resident |o| >hippie-patriarch at UCLA. He was a private person but fully capable of |o| >engaging photon torpedoes and going to battle stations in a good |o| >engineering argument. And he could be stubborn beyond all expectation. He |o| >could have outwaited the Sphinx in a staring contest, I think. |o| > |o| >Jon inspired loyalty and steadfast devotion among his friends and his |o| >colleagues. For me, he personified the words =93selfless service.=94 For |o| >nearly 30 years, Jon has served us all, taken little in return, indeed |o| >sometimes receiving abuse when he should have received our deepest |o| >appreciation. It was particularly gratifying at the last Internet Society |o| >meeting in Geneva to see Jon receive the Silver Medal of the International |o| >Telecommunications Union. It is an award generally reserved for Heads of |o| >State but I can think of no one more deserving of global recognition for |o| >his contributions. |o| > |o| >While it seems almost impossible to avoid feeling an enormous sense of |o| >loss, as if a yawning gap in our networked universe had opened up and |o| >swallowed our friend, I must tell you that I am comforted as I contemplate |o| >what Jon has wrought. He leaves a legacy of edited documents that tell our |o| >collective Internet story, including not only the technical but also the |o| >poetic and whimsical as well. He completed the incorporation of a |o| >successor to his service as IANA and leaves a lasting legacy of service to |o| >the community in that role. His memory is rich and vibrant and will not |o| >fade from our collective consciousness. =93What would Jon have done?=94 we |o| >will think, as we wrestle in the days ahead with the problems Jon kept so |o| >well tamed for so many years. |o| > |o| >There will almost surely be many memorials to Jon=92s monumental service t= |o| o |o| >the Internet Community. As current chairman of the Internet Society, I |o| >pledge to establish an award in Jon=92s name to recognize long-standing |o| >service to the community, the Jonathan B. Postel Service Award, which is |o| >awarded to Jon posthumously as its first recipient. |o| > |o| >If Jon were here, I am sure he would urge us not to mourn his passing but |o| >to celebrate his life and his contributions. He would remind us that there |o| >is still much work to be done and that we now have the responsibility and |o| >the opportunity to do our part. I doubt that anyone could possibly |o| >duplicate his record, but it stands as a measure of one man=92s astonishin= |o| g |o| >contribution to a community he knew and loved. |o|----------------------------------------------------------------------|o| |o| bryan s. blank (203)-351-1178 voice |o| |o| senior systems analyst (203)-351-1186 fax |o| |o| discovernet, incorporated (203)-979-5126 emerg |o|

1 0

Re: Maybe I'm misreading this but...
by shields＠crosslink.net 17 Oct '98

17 Oct '98

In article <Pine.BSF.4.02A.9810161946280.293-100000@localhost>, Marc Slemko <marcs(a)znep.com> wrote: > Note that if there is no MTU change at that point, there is no problem > because there will never (well, almost never and the almost is dependent > on having funky/broken routers) be any reason to be unable to fragment at > that hop. For this to be ok, you also have to be certain that whenever you add an interface to that router -- by adding a card, configuring a tunnel, or anything -- that you stop and check whether you need to renumber the 1918-using interfaces. For a dialup box, you also need to be sure it will never create a PPP session with an MTU unequal to the MTU of all the other interfaces. These things are possible, but it's more likely that PMTU will be broken because no one will think about it when adding an interface. -- Shields, CrossLink.

2 1

Re: Maybe I'm misreading this but...
by I Am Not An Isp 17 Oct '98

17 Oct '98

At 01:12 PM 10/16/98 -0400, tvo wrote: >Doesn't this break MTU path discovery though? No, it wouldn't. Those addresses are not routable on the global 'Net, however, there is nothing stopping a device with an RFC1918 address from sending a packet onto the 'Net. Assume you have a T1 between two routers, but you are out of 'normal' addresses. So you make the two serial ports 10.1.1.1 and 10.1.1.2. Simple, huh? Well, anyone outside your network attempting to reach those addresses will fail - there is no route to 10.x.x.x on the Internet. (At least not in *my* network. :) Let's further assume there's a LAN on the other side of this T1 with a MTU below 1500 bytes. Now, when you attempt PMTU discovery to a device on that small MTU LAN (going through the T1 of course), what happens? When the router on the opposite end of the T1 gets the packet, it sees that the packet is "too big" and DF bit is set (as per PMTU rules) and cannot send the packet. So what should it do? Why send an ICMP "Datagram Too Big" error message, of course. (Type 3, "Destination Unreachable", Code 4, "fragmentation needed and DF set". See RFC 1191, http://www.pmg.lcs.mit.edu/cgi-bin/rfc/view-plain?number=1191, and RFC 792, http://www.pmg.lcs.mit.edu/cgi-bin/rfc/view?792, for more info.) Just like any other (properly functioning) router on the Internet. But what's the source address? Why 10.1.1.1 of course. So you get a packet from RFC1918 space. Perfectly normal, perfectly acceptable, perfectly legitimate. See, when a router gets a packet, it does not look at the source IP for routing info. (Unless you're doing something weird like policy routing.) So the source IP is irrelevant to a router. Hell, even the destination IP is irrelevant as long as it's 32 bits and matches something in the router's table (including a possible default route). I have never seen a router vendor treat a packet with RFC1918 space in source or destination any differently than any other packet. Unless, of course, the user manually modifies the default behavior with filters or something - which can be done to any address just as easily. The point is, there is magical router fairy looking for RFC1918 space and removing all those packets from your network. Those addresses are treated by your router just like *any other address*. Forwarded, filtered, whatever depending upon the rules you set up and the information it receives dynamically. I hope that explains everything. TTFN, patrick I Am Not An Isp www.ianai.net "Think of it as evolution in action." - Niven & Pournelle

2 3

AOL DNS - temporary resolution of problem
by David Hares - AutoNet 17 Oct '98

17 Oct '98

At about noon today NetworkTwo (formerly Autonet) noticed heavy usage of our Internet links and DNS. When we investigated we discovered what you already know ... someone pointed AOL's root server entry at us. We contacted AOL about the same time they contacted us. AOL asked us to load their primary zone file on our DNS, but it quickly became apparent that our upstream pipe and our DNS server could not handle the load. We (AOL and N2) contacted NetworkTwo's upstream provider MichNet (aka Merit of nanog(a)merit.edu fame). Merit loaned us their new, not yet in service, DNS server. This was loaded with both the AOL and Autonet primary zones. Merit then hijacked the 206.88.0.x network and redirected it to their server, where AOL and Autonet are currently resolving. Some of my clients are affected, but most have been pointed to other name servers. The InterNIC folks predict it will take 18 hours for the root servers to be up to date. We will monitor the situation throughout the weekend, and take apart this hack when the number of queries drops off. On behalf of NetworkTwo, I'd like to thank the on call staff at Merit and AOL, all of whom pitched in totally professional way with time and equipment to solve this problem. Thanks also to Goodnet (spelling?), a peer of AOL and MichNet, who offered equipment and bandwidth that we might have needed, but didn't. On a personal note, it's nice to find out that people can still work together in a crisis. Now if we can only get NSI to secure the domain update process ... With hopes for a calmer weekend, Dave Hares -- David L. Hares, Director of Network Engineering NetworkTwo Communications Group Phone: (313) 995-6539 175 Jackson Plaza FAX : (313) 995-6458 Ann Arbor, MI 48106 (USA) Email: dhares(a)networktwo.net

3 2