November 1998 - Test - lists.nanog.org

UseNet News Stats Request
by John M. Brown 13 Nov '98

13 Nov '98

I am interested in receiving some stat info on what peoples top 100 news groups are. Just a day or two worth of samples. jmbrown

1 0

Re: Journal of Internet Disasters
by Dean Anderson 13 Nov '98

13 Nov '98

At 03:11 PM 11/13/1998 -0800, you wrote: >- it is known that various individuals flood the Internic with packets >related to aatempts to suck down the whois database, one item at a time >and/or detect when a specific domain name goes off hold and becomes >available for re-registration > >- pathshow indicated that the Internic circuit over which AXFR was being >attempted was congested. > >> - f.root-servers.net and NSI's servers reacted differently. What >> are the differences between them (BIND versions, in-house source >> code changes, operating systems/run-time libraries/compilers) > Of course, it would be possible for Internic to have multiple connections routing whois requests over one link, and DNS transfers over another link. Or limiting the bandwidth for whois, reserving bandwidth for DNS. etc. Aside from the obvious solution to not have insane servers. The purpose of analyzing disasters is to identify ways of avoiding them. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Heads up around Nov 17..
by Rodney Joffe 13 Nov '98

13 Nov '98

Besides the other nonsense going on here, a reminder that we'll be visited by the Leonids around Nov 17. Pagers for outages may be intermittently unavailable... and Avi's satellite links may hiccup :-) http://ssd.jpl.nasa.gov/leonids.html With luck, we won't notice.... /rlj Assistant Janitor CenterGate Research LLC

1 0

The Cidr Report
by Tony Bates 13 Nov '98

13 Nov '98

This is an auto-generated mail on Fri Nov 13 12:00:00 PST 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 13Nov98 0) General Status Table History ------------- Date Prefixes 061198 53673 071198 53323 081198 53161 091198 53249 101198 53388 111198 53419 121198 53674 131198 53601 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 4244 Number of ASes announcing only one prefix: 2088 (1113 cidr, 975 classful) Largest number of cidr routes: 338 announced by AS3561 Largest number of classful routes: 975 announced by AS701 1) Gains by aggregating at the origin AS level --- 13Nov98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 349 150 199 57.0% BCnet Backbone AS1785 583 402 181 31.0% NYSERNet Backbone AS3749 230 70 160 69.6% TECNET AS2493 345 195 150 43.5% iSTAR Internet, Inc. AS701 975 842 133 13.6% Alternet AS174 690 562 128 18.6% Performance Systems International AS4200 187 95 92 49.2% AGIS (Apex Global Information Ser AS5668 127 40 87 68.5% Century Telephone Inc. AS4293 207 135 72 34.8% IMCI AS4755 128 64 64 50.0% Videsh Sanchar Nigam Ltd. India AS549 221 159 62 28.1% ONet Backbone AS4740 388 326 62 16.0% Ozemail Pty Ltd (ASN-OZEMAIL) AS7046 265 205 60 22.6% UUNET-CUSTOMER AS8517 127 72 55 43.3% ULAKNET-ASN AS7545 117 65 52 44.4% TPG Internet Pty Ltd AS6335 71 19 52 73.2% NTRNET AS72 88 40 48 54.5% Schlumberger Information Network AS1239 523 477 46 8.8% SprintLink Backbone AS803 77 33 44 57.1% SaskNet Backbone AS1221 354 310 44 12.4% AARNET-AS AS7122 127 85 42 33.1% MTS ADVANCED Network Policy AS3221 84 42 42 50.0% EENet Autonomous System AS852 166 125 41 24.7% AGT Advance Communication AS10928 91 50 41 45.1% UNKNOWN AS3804 182 143 39 21.4% Bell Solutions AS7496 66 33 33 50.0% Power Up AS2707 65 32 33 50.8% WEC AS6181 63 31 32 50.8% FUSE-NET AS719 432 401 31 7.2% LANLINK autonomous system AS4307 32 1 31 96.9% SVINET-1 For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Hold on to your news servers
by Jeff Garzik 13 Nov '98

13 Nov '98

Hey guys, this is a heads-up about Karl Denninger's new clean-news system. I haven't seen any posts on this list about it. His message describing the implementation is attached below, posted "publicly" on chi.internet. Hold on to your news servers -- Karl is about to send out cancel messages, cancelling _every_ Usenet binary that is not PGP-signed by someone registered with his system. Karl says that these cancels will only go out to people he explicitly peers with, and not Usenet at large. He then adds that what these peers do with the cancel msgs is their own business. Folks, the goal is good, but the implementation is bad. These cancel msgs will leak out to Usenet at large. History proves this; leaking of bofh.*, clari.*, etc. occurs all the time despite peoples' best efforts. And when these cancels leak, every news server on Usenet will * suddenly be receiving _thousands_ of additional cancels, and * 99.9999% of the porn out there will disappear from your servers. I do not want to be handling the support calls when this occurs. If you are interested in this issue, there is a discussion (amongst all the noise) on news.admin.net-abuse.usenet, thread "Karl Denninger loses his marbles..." Or ask me, I'm more than happy to outline the technical ramifications of this, and why it's a bad idea, in more detail. I tried to debate this with Karl, but he went off into k00k land and starting turning every technical point into a free speech debate. :) If he doesn't want to talk about the issues, fine... Jeff (news admin/consultant for many years)

2 1

Fiber Cut in Utah
by scott w 13 Nov '98

13 Nov '98

MFS describes a "major" fiber cut in Utah. No further info from them. Anyone got details? Thanks, Scott ------------------------------------------------------------------- Scott Weeks Network Operations Center +1 808 540 4021 +1 808 540 4020 Digital Island, Inc Honolulu, Hawaii -------------------------------------------------------------------

3 4

Blue Jacket Found at NANOG 14
by Jonathan A. Zdziarski 13 Nov '98

13 Nov '98

We found a blue jacket at nanog 14, with some items in the pocket. If this is yours and can tell us what's in the pocket we'll be happy to send it to you. Thank you, Jonathan A. Zdziarski Sr. Systems Administrator Netrail, inc. 888.NET.RAIL x240

1 0

Re: Fiber Cut in Utah
by Eric Doiron 13 Nov '98

13 Nov '98

The actual cut is between Trail Cannon and Mountain Green Utah...techs are on site ... -- *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- Eric Doiron GTEInternetworking, Powered by BBN Network Operations Center (NOC) 3 Van De Graf Rd Burlington, MA *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-

1 0

Fiber Cut
by scott w 13 Nov '98

13 Nov '98

290 DS-3s cut in Mount Green, Wyoming. Backhoe at site. *heh* let's don't go there. Got those t-shirts yet? Tech's currently splicing fiber and rerouting as they go. All this from MFS, so take it with what you will... scott

1 0

Re: Journal of Internet Disasters
by Paul Vixie 13 Nov '98

13 Nov '98

> This should go on the name-droppers list, but here goes.... these days it's not clear whether namedroppers is an operations list or a protocol list or still both. i think nanog is a fine forum for this: > What do we know about the events with the name servers > > - f.root-servers.net was not able to transfer a copy of some of > the zone files from a.root-servers.net > - f.root-servers.net became lame for some zones just COM. > - tcpdump showed odd AXFR from a.root-servers.net just a lot of missed/retransmitted ACKs. > - [fjk].gtld-servers.net have been reported answering NXDOMAIN to > some valid domains, NSI denies any problem the nanog archives include some dig results that are hard for NSI to deny. > Other events which may or may not have been related > - BGP routing bug disrupted connectivity for some backbones in the > preceeding days this turned up a performance problem in BIND's retry code, btw, but was not otherwise related to the COM lossage of yesterday (as far as i know). > - Last month the .GOV domain was missing on a.root-servers.net due > to a 'known bug' affecting zone transfers from GOV-NIC different bug. that one causes truncated zone transfers; the secondary zone files on [fjk].gtld-servers.net yesterday were not truncated and it just took a restart to make them stop behaving badly. > - Someone has been probing DNS ports for an unknown reason > > Things I don't know > - f.root-servers.net and NSI's servers reacted differently. What > are the differences between them (BIND versions, in-house source > code changes, operating systems/run-time libraries/compilers) they are completely different systems (solaris vs. digital unix) running the same (unmodified) bind 8.1.2 sources, which had completely different failure modes for completely different reasons. > - how long were servers unable to transfer the zone? The SOA says > a zone is good for 7 days. Why they expire/corrupt the old zone > before getting a new copy? damn good question. i'll look into that. shouldn't've happened. > - Routing between ISC and NSI for the preceeding period before the > problem was discovered there was asymmetry (they reached me via bbnplanet, i reached them via alternet). they are now preferring alternet to reach me, so we have better path symmetry now. but their first mile is still congested and i am still retransmitting a lot of ACKs. > Theories > - Network connectivity was insufficient between NSI and ISC for long > enough the zones timed out (why were other servers affected?) other servers are more conservative, and had switched to manual daily FTP of the COM zone longer ago than F has done. (with manual daily FTP you get the advantages of gzip, and of the pretense of "zone master" status while you manually retry after timeouts. AXFR needs those properties.) > - Bug in BIND (or an in-house modified version) (why did vixie's and > NSI's servers return different responses?) there's definitely a bug in BIND if [fjk].gtld-servers.net were able to return different answers after restarts with no new zone transfers. (i'm sitting here wishing i had core dumps.) > - Bug in a support system (O/S, RTL, Compiler, etc) or its installation > - Operator error (erroneous reports of failure) > - Other malicious activity? i think there were a goodly number of procedural errors. -- Paul Vixie <paul(a)vix.com>

1 0