December 1998 - Test - lists.nanog.org

Re: Help with identifying a kind of attack.
by Adam D. McKenna 09 Dec '98

09 Dec '98

tcp and udp are transport layer protocols. If someone is sending raw IP packets that aren't using a particular transport protocol, maybe they could get through (?) --Adam -----Original Message----- From: Thom Youngblood <thom(a)cais.net> To: North America Network Operators Group <nanog(a)merit.edu> Date: Tuesday, December 08, 1998 5:55 PM Subject: Help with identifying a kind of attack. :-----BEGIN PGP SIGNED MESSAGE----- :Hash: SHA1 : : :I've been tracking an attack all day long, and have been frustrated :trying to figure out both what was being attacked, and how. Finally, :I realized it was *not* ICMP, UDP, or TCP. : :#sh access-lists 151 :Extended IP access list 151 : permit icmp any 20.0.0.0 0.255.255.255 (1023 matches) : permit udp any 20.0.0.0 0.255.255.255 (4347 matches) : permit tcp any 20.0.0.0 0.255.255.255 (86444 matches) : deny ip any 20.0.0.0 0.255.255.255 (5547308 matches) : permit ip any any (4450563 matches) : : :In the above, notice the disparity? So, my question is... : :What the hell kind of packet is it if it's not ICMP, UDP, or TCP? : : :-----BEGIN PGP SIGNATURE----- :Version: PGPfreeware 6.0 for non-commercial use <http://www.pgp.com> : :iQA/AwUBNm2jB2fkezbzToVaEQIQQQCgllupf+cmax8w5n/RgYhlATz+BuQAn38r :Di2Ec9bI2Prrahm9yKp5rohS :=/qOm :-----END PGP SIGNATURE----- : :

3 2

Re: More Sidgemore on per-bit pricing
by Dean Anderson 09 Dec '98

09 Dec '98

At 06:43 PM 12/9/1998 -0500, Jay R. Ashworth wrote: >> I was just saying how you could lower the cost of the ADSL loop from >> around $150 to $30, with both you would need to supply the IP. The idea >> would be that you would not just use the port for internet traffice. You >> would provide voice services, you would provice VOD (video on demand), and >> cable services (using something like I Magic TV). > >Oh yeah, I got that, Nathan. It's just that I get miffed when people >keep going on (don't take this personal) about how cool it is that I >can get my loop down from $300 to $150... when my router port is still >$1800. Nice, yeah, but not what people mean when they blather about >"cheap bandwidth". If it's _that_ cheap, it's running under completely >different assumptions than a standard T-1; viz: cable modems. Um, actually, I think think you can get DSLAM's for about $700 per port or less going by my recent informal surveys. Router ports have been way overpriced for a long time. They were overpriced when an AGS sold for 30K with a stack of ethernet, serial, and an fddi port. Of course, back then the pricing model optimistically expected to sell only a few thousand. They got even more overpriced later, and now expect to sell hundreds of thousands. What I've yet to find out is what sort of latency one gets with a DSL modem as compared to a DSU... I'm not sure DSL is somehow inferior technology (as Bob Metcalfe seems to think from an article several years ago), or if it just represents a (slight) change and a collapse of the fee structure. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3 2

More Sidgemore on per-bit pricing
by Pete Kruckenberg 09 Dec '98

09 Dec '98

Sidgemore talks again: http://www.news.com/News/Item/0,4,29533,00.html?st.ne.fd.gif.a I'm sure this subject has been discussed at length here, but I still fail to see any benefit for per-piece pricing other than to the seller's revenue stream. I think it's always interesting that discussions of per-piece pricing always fail to mention the fundamental issue: provide a disincentive to the consumer to use the service. There is already per-piece pricing: 1.544Mbps of traffic costs $500 to $2000+/mo, depending upon how much the provider is counting on you to not use the service. However, in this case the burden is placed on the ISP to balance closing the sale with making money off of how much the customer actually uses the service. The thing I most distrust about people who talk about per-piece pricing is that in spite of the fact that it should end up costing lower-use customers less, for some reason it always ends up costing everyone more. Look at UUNet's pricing now (for 256K ASU, or something like that), versus the flat-rate price available from equivalent NSP's. Is that where things are going? Pete.

11 21

Ignorant mass-media strikes again
by Vadim Antonov 09 Dec '98

09 Dec '98

>From http://www.cnn.com/TECH/computing/9812/09/isp.idg/ : > Don't let your ISP cut you off > How to fight back when your ISP keeps kicking you off. > by Carla Thorton > (IDG) -- PROBLEM: Your Internet service provider kicks you offline when > you're in the middle of important work. > > SOLUTION: Install an anti-timer utility, reconfigure your e-mail package, > or choose a regional ISP. I bet Ms. Thorton never heard that TCP can preserve idle connections when dial-up link is down. Yeah, dial-on-demand is such a hard thing to do! Am i paranoid, or is mass-media hell-bent on propaganda of antisocial behavior in the Internet? Or are they just really clueless? --vadim

8 7

Re: More Sidgemore on per-bit pricing
by Dean Anderson 09 Dec '98

09 Dec '98

>Unless I'm misunderstanding you, you've misunderstood me. :-) > >I'm not talking about the card, I'm talking about my proportion of the >amount the guy I'm buying from has to pay for _his_ uplink. > >Bandwidth Costs Money. Oh I see. But you insert 'value added' inbetween, right? Or in the case of Cable modems/home DSL for 50/mo, its probably better described as 'value removed'. If I put 50 DSL T1's against 1 T1 uplink, I can pay a lot for uplink and it still won't make much difference. As long as the DSL lines hit a web cache and a newserver, everything is fine. When they don't, too bad, I guess. Isn't USWest doing all of Phoenix on 4 T1's? Whats that come out to? X,000 to 1? It looks to me like the crucial cost factor is the cost of the home equipment, and whether the customer pays for that or the ISP pays. It's not the last mile, its the last 6 inches. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

POWER: San Mateo/San Francisco power outage report
by Sean Donelan 09 Dec '98

09 Dec '98

Howdy, I'm back from vacation. By popular demand, a summary of the San Francisco/San Mateo power outage on December 8, 1998. At 8:15am workers making changes to 115-kilovolt lines at the San Mateo substation failed to properly ground the system. When they turned on the power, it caused a low frequency condition and tripped protective breakers on the substation. It also caused a cascade effect, tripping the Hunters Point and Potrero power plants. This isolated San Mateo County and northward to parts of San Francisco City from the electrical grid primary power sources. Aside from the human error, the system worked "as designed to protect the rest of the grid." Approximately 375,000 customers were without power, including San Francisco Airport (SFO), the Pacific Stock Exchange, traffic lights, and cable cars. BART (subway) used emergency power to bring trains to the next station, and then shutdown. Since the electrical grid was isolated, PG&E had to "blackstart" the system on a circuit by circuit basis. The SFO airport power was restored at 9:10AM. The San Francisco Office of Emergency Services was activated at 9:22AM according to EDIS. At 1:00PM about 200,000 customers were still without power. PG&E estimated that full restoration would be completed by 2:15PM, but some customers were still without power through the afternoon. No major injuries have been reported directly attributable to the power failure. No major Internet provider reported any network problems directly attributable to the power failure. Since this outage was caused by a PG&E error, customers may make claims for some types of damages. Other damages may be covered by private insurance. http://www.pge.com/resources/claim_form/claim_form.html In other news: On December 7, 1998 PG&E donated $87,000 to San Fransico's Emergency Services Communications Center to install extra back up electrical facilities for the center. The new facility will work with PG&E during major service interruptions to establish restoration priorities. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

10 12

Re: Ignorant mass-media strikes again
by Tony Li 09 Dec '98

09 Dec '98

avg(a)alink.net (Vadim Antonov) writes: > Am i paranoid, or is mass-media hell-bent on propaganda of antisocial > behavior in the Internet? > > Or are they just really clueless? They found out a long time ago that controversy and sensationalism sells papers. This predates the Internet or its founders. Tony

2 1

Re: Ignorant mass-media strikes again
by cache22 09 Dec '98

09 Dec '98

Subject: Ignorant mass-media strikes again Date: Wed, 09 Dec 1998 13:59:37 -0800 From: Vadim Antonov <avg(a)alink.net> To: nanog(a)merit.edu > I bet Ms. Thorton never heard that TCP can preserve idle connections > when dial-up link is down. Yeah, dial-on-demand is such a hard thing > to do! if dial-on-demand means you _demand_ the same ip address... matt sommer

1 0

ARIN co-located nameserver problem
by Dean Anderson 09 Dec '98

09 Dec '98

We are having a problem getting ARIN to do a nameserver change. We are consolidating nameservers for a new customer, and want to make our nameservers authoritative for the in-addr maps. We have a nameserver co-located at Empire Net in Nashua, NH. We do this because we don't want to have nameservice fail if our own internet connection goes down. Needless to say, Empire.net isn't responsible for our address space, nor our domains, nor the management of this machine. The machine at empire.net is currently authoritative for in-addr zones for other address space, and changing nameserver IP addresses previously has not been problematic. ARIN is now enforcing a policy of registering nameservers by IP address instead of by name as Internic and other registeries do (and did prior to ARIN). ARIN says that the IP address of the nameserver 208.223.51.250 does not belong to us (it belongs to Empire.net)--and therefore they can't put through a change to our inverse map for address space that we are coordinator of. We only have one address for one colocated machine. ARIN says it (one IP address) must be SWIP'ed to us before the changes will be allowed. ?!? This hasn't been a problem until now apparently because ARIN never previously enforced this policy. So, does anyone else have a similar situation where nameservers are colocated somewhere else? I'm pretty sure this is the case, so this is a heads up that you will have problems with updating IN-ADDR info. What about this policy of ARIN's--Do people think ARIN should be registering nameservers by name or by IP address? To make this work in general, one would need to SWIP single IP addresses. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

5 4

Re: ARIN co-located nameserver problem
by Dean Anderson 09 Dec '98

09 Dec '98

Thanks! --Dean >Dean...we added this requirement a while ago after Jon Postel/IANA came >to us about the number of unassigned and incorrect IP numbers being used >on in-addr entries. Up to now, it hasn't been an issue but you do have >a valid point so we'll review the policy and adjust it in a way to allow >for exceptions like yours. > >Kim ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0