May 1998 - Test - lists.nanog.org

AUTORESPONDERS
by jamie＠dilbert.ais.net 29 May '98

29 May '98

OK.. People need to learn how to use autoresponders for nanog e-mail. I received three replies to my last post saying "I'll be out of the office". If this were my list, those people with less than a quarter clue (as ass-u-med in my last post) would have earned themselves auto unsubscribes. Please.. Please people :) If you're going to set up autoresponders, take appropriate measures to make sure your listmail doesnt get replied to. Here's a procmailrc for those who cant figure it out. Please, change "jamie" to "youremailaddress". :-p :0 h c * !^FROM_DAEMON * !^X-Loop: jamie * ^TO(jamie@) | (formail -r -A"Precedence: junk (autoreply)" \ -A"X-Loop: jamie" ; \ cat $HOME/.autoreply) | $SENDMAIL -t and then I have "~/.autoreply" with the body of what I want to reply with. Then again, if you set up an autoreply and don't know how to do it right, you probably aren't important enough to matter, and you should remove it anyhow. Now I go back to my lil' lurk hole. -jamie -- jamie rishaw (dal/efnet:gavroche) American Information Systems, Inc. rdm: "Religion is obsolete." gsr: "By what?" jgr: "Solaris." (1996) Tel:312.425.7140, FAX:312.425.7240

1 0

RE: ingress filtering
by John Fraizer 29 May '98

29 May '98

At 08:57 AM 5/29/98 -0400, you wrote: >> Actually it has nothing to do with WINS. If all the ISP's would >implement > >Bzzt. Thank you for playing, though. If it were not for WinS, there >wouldn't >be a second packet being sent, no matter what junk is the payload. Thanks. I knew I wasn't crazy and seriously doubted that my sniffer was inventing these packets just to piss me off. >Now I agree ISP's should do better DNS resolution, but every MS box >plugged into >the net sending a second packet adds up to a lot of junk packets eating >up >expensive bandwidth. MS catches the blunt of the critisizm because they >are the >only ones to have adopted such a lame networking scheme, and then forced >it >down others quotes. As stated before: [OverKill]:/# nslookup www.stefcam.com Server: NS1.ENTERZONE.NET Address: 209.41.244.5 Name: STEFCAM.COM Address: 209.41.244.238 Aliases: www.stefcam.com [OverKill]:/# nslookup 209.41.244.238 Server: NS1.ENTERZONE.NET Address: 209.41.244.5 Name: StefCAM.Com Address: 209.41.244.238 By the way, Stronghold will refuse to bind to an address that does not reverse so, I knew it was right even before the lookup. ------- John Fraizer (root) | __ _ | The System Administrator | / / (_)__ __ ____ __ | The choice mailto:root@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

1 0

RE: PC Bozo's World bites again (CNN, too)
by Jeff Victor - Sun Microsystems Systems Engineer 29 May '98

29 May '98

Of course, instead of just theorizing about which factors have the greatest impact after changing the client's MTU, someone could end this discussion by performing the following experiment with: * PC with MS Windows * Macintosh * Unix box Hook each box up to the same dial-up line, using the same dial-up service. Measure response time to visit various web sites, ftp sites, etc. Perform various runs with different MTUs. Of course, to ensure validity of the data, memory and disk caches must be cleared between tests, and the tests must be run multiple times to remove the effects of caching at the servers and between the servers and the client. If the PC shows a significant performance improvement at smaller MTUs, but the other two don't, we can conclude that Windows is unusual (in a new way). But if they all behave similarly according to MTU size, Windows would be "innocent." I would be very interested in the results. Unfortunately, I don't have the equipment at home to do this. Does anyone out there? ---------------------------------------------------------------------------- Jeff Victor Voice#: 518-782-1046 Systems Engineer Fax#: 518-783-7359 Sun Microsystems jeff.victor(a)east.sun.com ----------------------------------------------------------------------------

1 0

Cable & Wireless buys MCI Internet
by hhui＠arcfour.com 29 May '98

29 May '98

http://www.news.com/News/Item/0,4,22519,00.html well, this should be interesting. --- Tung-Hui Hu (HH26) Network admin and poet hhui(a)arcfour.com

10 9

Re: ARIN Advisory Council recommendations I have made
by John Fraizer 29 May '98

29 May '98

>These changes will fix the transparency problems which I believe exist today >within the structure of ARIN. AMEN > >You have the other two (the address allocation policy changes and pricing >changes) as well. Would you like me to write these up formally? Yes, please do and make them available via www. ------- John Fraizer (root) | __ _ | The System Administrator | / / (_)__ __ ____ __ | The choice mailto:root@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

1 0

RE: ingress filtering
by Eric Germann 29 May '98

29 May '98

At 08:57 AM 5/29/98 -0400, jeyers(a)ialn.com wrote: > >-----Original Message----- >From: Eric Germann [mailto:ekgermann@cctec.com] >Sent: Friday, May 29, 1998 8:09 AM >To: John Fraizer >Cc: Mr. Dana Hudes; nanog(a)merit.edu >Subject: Re: ingress filtering > >At 02:32 PM 5/28/98 -0400, John Fraizer wrote: > >> Actually it has nothing to do with WINS. If all the ISP's would >implement > >Bzzt. Thank you for playing, though. If it were not for WinS, there >wouldn't >be a second packet being sent, no matter what junk is the payload. > Buzz, again. Try reading about WINS. It is a manifestation of a NetBIOS name server as defined in RFC 1001/1002. If it were using WINS for this, it would NOT hit the target machine, but the WINS server. Also, if DNS can resolve the in-addr.arpa mapping, the second packet is never sent. Ergo, it has nothing to do with WINS. >>solid in-addr.arpa reverse mappings, this would go away. Microsoft's >DNS >>resolver has been extended, when DNS lookups fail, to do a reverse >NETBIOS >>query against the target machine so it can use its name when displaying >>stuff via NBTSTAT, etc. It was designed this way, before the Internet >>became popular. > >Excuse me? I was using the Internet way before Microshaft was a dream >in Bill's >head. The RFC's you quote were rammed into existance by DARPA to >provide early >ecanpsulation techniques so that companies like MS could say they were >IP/Internet >compatible, (instead of using a real protocol) and get away from Novel >slamming >them for non-routable protocol support only. All they did was to take >the same >non-routable junk and throw it inside an ip packet and call it >"internet" >compatible. The RFC's quoted provide a way to make that encapsulation >work, they >do not recommend conversion to that as a standard. To encourage that >kind of >conversion would be a major leap backwards. (Wow! let's all abandon our >routeable >protocols and use a non-routed local segment only, encapsulated >protocol. Yippee!) > >Now I agree ISP's should do better DNS resolution, but every MS box >plugged into >the net sending a second packet adds up to a lot of junk packets eating >up >expensive bandwidth. MS catches the blunt of the critisizm because they >are the >only ones to have adopted such a lame networking scheme, and then forced >it >down others quotes. > Again, do solid reverse DNS and the problem goes away. It only does it iff reverse DNS fails. Period. As for timing, MS didn't give a shit about IP at the time they were written. MS wasn't even directly in the business at the time. Repeat after me, NetBIOS is a programming interface, not a protocol. Write it 100 times and them come back and play the game. NetBIOS is neither inherently routable or nonroutable. It depends on the underlying transport protocol, be it XNS, IPX, IP, OSI or proprietary NetBEUI. As for forcing it down others "quotes", the industry picked it. MS networking will run quite happily over any of the above mentioned transport protocols. Your customers selected it. Do your reverse DNS right, and you won't have the problem. ============================================================================= Eric Germann Computer and Communications Technologies ekgermann(a)cctec.com Van Wert, OH 45891 Phone: 419 968 2640 http://www.cctec.com Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider

1 0

RE: ingress filtering
by jeyers＠ialn.com 29 May '98

29 May '98

-----Original Message----- From: Eric Germann [mailto:ekgermann@cctec.com] Sent: Friday, May 29, 1998 8:09 AM To: John Fraizer Cc: Mr. Dana Hudes; nanog(a)merit.edu Subject: Re: ingress filtering At 02:32 PM 5/28/98 -0400, John Fraizer wrote: > Actually it has nothing to do with WINS. If all the ISP's would implement Bzzt. Thank you for playing, though. If it were not for WinS, there wouldn't be a second packet being sent, no matter what junk is the payload. >solid in-addr.arpa reverse mappings, this would go away. Microsoft's DNS >resolver has been extended, when DNS lookups fail, to do a reverse NETBIOS >query against the target machine so it can use its name when displaying >stuff via NBTSTAT, etc. It was designed this way, before the Internet >became popular. Excuse me? I was using the Internet way before Microshaft was a dream in Bill's head. The RFC's you quote were rammed into existance by DARPA to provide early ecanpsulation techniques so that companies like MS could say they were IP/Internet compatible, (instead of using a real protocol) and get away from Novel slamming them for non-routable protocol support only. All they did was to take the same non-routable junk and throw it inside an ip packet and call it "internet" compatible. The RFC's quoted provide a way to make that encapsulation work, they do not recommend conversion to that as a standard. To encourage that kind of conversion would be a major leap backwards. (Wow! let's all abandon our routeable protocols and use a non-routed local segment only, encapsulated protocol. Yippee!) Now I agree ISP's should do better DNS resolution, but every MS box plugged into the net sending a second packet adds up to a lot of junk packets eating up expensive bandwidth. MS catches the blunt of the critisizm because they are the only ones to have adopted such a lame networking scheme, and then forced it down others quotes. >Before we all rant at MS, I suggest we all read RFC's 1001 and 1002 and >UNDERSTAND NetBIOS over IP, before we blame ALL the worlds ills on MS. >Last I knew, they weren't written by MS. > > >RFC 1001-> http://answerpointe.cctec.com/notes/rfcs1/254e_1e2.htm > >RFC 1002-> http://answerpointe.cctec.com/notes/rfcs1/2e46_1e2.htm > >Author(s): Defense Advanced Research Projects Agency, End-to-End Services >Task Force, Internet Activities Board, NetBIOS Working Group > >>------- >>John Fraizer (root) | __ _ | >>The System Administrator | / / (_)__ __ ____ __ | The choice >>mailto:root@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU >>http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation >> A 486 is a terrible thing to waste... >> > >======================================================================= ====== >Eric Germann Computer and Communications Technologies >ekgermann(a)cctec.com Van Wert, OH 45891 > Phone: 419 968 2640 > >http://www.cctec.com Fax: 419 968 2641 >Network Design, Connectivity & System Integration Services >A Microsoft Solution Provider >

1 0

Re: ingress filtering
by John Fraizer 29 May '98

29 May '98

At 01:28 PM 5/28/98 -0400, you wrote: >Who *does* do ingress filtering? I have it on our border routers >and customer connect ports. We have transit from MCI and UUNET. >Neither has ingress filters -- see below message from MCI on >this. We do ingress and egress filtering. It's just a matter of keeping people on both sides of the border router from spoofing either by mistake or maliciously. >The result of course is that spammers and other bad guys can try >to attack your systems with forged source IP addresses. >Random strange people in the 'net send "NETBIOS name service" >(port 137) packets to my unix mail relay, which of course ignores >them. The NETBIOS name service comes from Winblows machines. I would venture to guess that your mailserver also has a resolver running that is also most likely authoritative for your or someones domain. Either that or you are specifying that resolver via radius to your dialup clients. When a Winblows box does a DNS lookup, for some reason, it will also send a NETBIOS name service request thinking that there is a WINS resolver living at the same IP. It's just another example of MS doing very strange things. (Read: They don't know $h!t about IP and show it regularly!) The dialup provider that these requests is originating should be filtering port 137 on egress to prevent it from making it to the global internet. Then again, we should all be egress and ingress filtering, filtering ICMP to our broadcast and network addresses and sending money to our favorite charity too. No matter how much we harp, there will be idiots with the keys to the router cabinets who just won't do the right thing. ------- John Fraizer (root) | __ _ | The System Administrator | / / (_)__ __ ____ __ | The choice mailto:root@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

2 1

RE: PC Bozo's World bites again (CNN, too)
by Doug Stanfield 29 May '98

29 May '98

The explanation lies in transiting circuits with high latencies and/or packet loss, whether they're the last mile by dial up or frame circuit backbone connections. Larger packets are more prone to be corrupted or discarded so sessions with smaller packets have a better performance in comparison. No excess retransmission and all that. We've seen it in networks where the customer connection is high quality but there were provider latency/loss problems. Smaller MTU helped while the frame relay problems persisted. Once the provider network was up to snuff there was no discernable performance difference between large or small and I think most of our users went back to defaults. > The improved-performance-with-low-MTU is a puzzle I'd certainly like to > understand better. It seems step 1 is to eliminate the possibility that > the 1500 MTU is leading to fragmentation. > Vern Doug Stanfield Oceanic Cable Data Networking Manager 200 Akamainui St. dougs(a)oceanic.com Mililani, HI 96789

1 0

Re: The Great Exchange
by Sean Donelan 29 May '98

29 May '98

>I think it's a North American view of the world, unsurprising on NANOG >:-) Traffic metering is the dominant charging mechanism for permanent >connections in Oz and Connect differentiate traffic based on its >source (domestic/cache/external). Hasn't a price war just broken out in Australia, with the dominant feature being the introduction of flat-rate pricing? -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2