June 1998 - Test - lists.nanog.org

Semi-operational; at least to me, it is.
by alex＠nac.net 25 Jun '98

25 Jun '98

Has anyone had experience using the Cisco POET cards in the following scenerio: Site A || -------------- Site B --------------- cisco 7206 Kentrox Some Cisco w/POET --------DS3---------- DS-3 IDSU ---- HSSI --- w/HSSI Or, do I need a POET on both sides? -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP! We have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

4 3

Re:
by kbrown＠primelink.com 24 Jun '98

24 Jun '98

sully(a)mail.usinternet.com on 06/24/98 12:44:29 PM To: nanog(a)merit.edu cc: (bcc: Kevin Brown/Huber & Associates) Subject: Hi, I have a Cisco 3640 that I'm using for xDSL. I am going to be using the unit in junction with a ATM interface for my ptp xDSL, and I wish to authenticate dial-up users via RADIUS. Do any of you have any experience setting up radius on an interface, and if so could you provide me with some help (perhaps cut/paste your config as a reference). Thanks in advance, and much appreciated! --Tim Sullivan US Internet Senior Network Administrator Senior?? <#include randomthought.c> I ponder the realism of such titles when asked such questions Here is a sample for you... aaa new-model aaa authentication login admins local aaa authentication ppp dialin radius local aaa authorization exec local aaa authorization network radius local aaa accounting network start-stop radius radius-server host ip.addy.radius.server radius-server key radiuspasswordkey Kevin Brown - Networking Technologies kbrown(a)primelink.com Huber & Associates, Inc. http://www.primelink.com/haa 573-634-5000 (phone) 573-634-5500 (fax)

1 0

RE: Interesting stratum 1 NTP clock
by S.J.Brannon 24 Jun '98

24 Jun '98

I think there is undocumented Cisco code to access a GPS over the AUX port ---------- From: dirk@power.net[SMTP:dirk@power.net] Sent: Wednesday, June 24, 1998 18:46 To: nanog(a)merit.edu Subject: Re: Interesting stratum 1 NTP clock Would a GPS hooked to the serial port of a Linux box do the same? Dirk On Mon, Jun 22, 1998 at 10:43:48PM -0700, Tony Li wrote: > > Folks who run NTP in their nets might wanna check out: > > http://www.coetanian.com/tss/tss100.htm > > This is a reasonably affordable, NTP-ready, GPS based stratum 1 chimer, > complete with 10BaseT interface. It's also getting close to being > plug-n-play. > > I've been beta testing one for a couple of weeks and it seems to chime > reasonably well. > > Tony > > p.s. I have no finanical interest in this product or this company > whatsoever. I'm just a time geek...

1 0

None
by sully＠mail.usinternet.com 24 Jun '98

24 Jun '98

Hi, I have a Cisco 3640 that I'm using for xDSL. I am going to be using the unit in junction with a ATM interface for my ptp xDSL, and I wish to authenticate dial-up users via RADIUS. Do any of you have any experience setting up radius on an interface, and if so could you provide me with some help (perhaps cut/paste your config as a reference). Thanks in advance, and much appreciated! --Tim Sullivan US Internet Senior Network Administrator

1 0

Additional route debug resource
by Michael Langdon 24 Jun '98

24 Jun '98

An additional "route-server" is available at route-server.ip.att.net and is open to the public. Use and enjoy. Let me know if there are any problems using it or if somebody wants to see something additional. It is running 11.1(18)CE, so you do get the use of "|". Mike

1 0

NANOG 13
by Pam Ciesla 23 Jun '98

23 Jun '98

Anyone registered and paid, who did not attend the NANOG 13 Meeting in Dearborn and would like a refund please contact me. Note - there is a $20 late fee for cancellation. Refund requests must be made by July 6. Thanks Pam ---------------------------------------------------------------------- Pam Ciesla 734-936-0172 - phone Merit Network, Inc. 734-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 -----------------------------------------------------------------------

1 0

Re: Government scrutiny is headed our way
by Hal Murray 22 Jun '98

22 Jun '98

> This is why the government needs to get involved and *demand* that > the ability exist via a *protocol* for people in a NOC to initiate > and follow these traces automatically, without human intervention > by the NOCs in the chain. Would you and other operators be willing to modify peering agreements to include serious fines for running a smurf amplifier or allowing packets with bogus source addresses to enter the system? Tracking back bogus source addresses seems hard. Would fines on smurf amplifiers be good enough to fix the smurf problem? Or do we need to catch a smurfer to use as an example? Currently, NOCs don't have much financial interest in tracking down a smurfer. Karl's stories of non-cooperation make sense if the NOC is looking at their (short term) bottom line rather than the good of the net. The person on the phone won't get any reward for solving Karl's problem (and might get in trouble for sticking his neck out). Is there a way we can change that? One possibility might be to offer a reward to the NOC that gets the evidence on the first smurfer to get tossed in jail or fined more than $100K. Another might be to setup peering contracts that encourage ISPs/NSPs to track down smurfers. I can't quite come up with the right thing to suggest. Everything I think of has too many possibilities for gaming. I'm fishing for something like each ISP/NSP that works on tracking down a smurfer gets to charge the ISP/NSP closer to the source for the time and costs it spends on the problem, including the costs that get passed to it. How much effort is involved in tracking a smurfer through each router? Any router vendors willing to estimate how much it would cost to implement something like Karl's proposed command? > "trace-smurf <forged-victim-address> <amplifier-address>" <return> Do smurf attacks always happen late at night and on weekends? Would major NSPs be willing to setup a smurf hotline so trusted smart people, like Karl, could bypass the first several layers of screening and get the data to the right person fast?

9 11

tw.com domain questions part II
by Tatsuya Kawasaki 22 Jun '98

22 Jun '98

thnx for all who has send us the traceroute via the U.S. Here is a question. Our cisco beleive that BGP routing table entry for 210.67.128.0 255.255.240.0, version 1129569 Paths: (1 available, best #1) 4673 2516 4637 7483 4783 (aggregated by 4783 10.0.0.1) 202.235.64.29 from 202.235.64.29 (203.182.16.29) Origin IGP, metric 100, valid, external, atomic-aggregate, best Routing entry for 210.67.128.0 255.255.240.0, supernet Known via "bgp 4719", distance 20, metric 100 Tag 4673, type external Last update from 202.235.64.29 6d02 ago Routing Descriptor Blocks: * 202.235.64.29, from 202.235.64.29, 6d02 ago Route metric is 100, traffic share count is 1 where AS 4719 is us. According to BGP there seems to the only one wroute to get there. I KNOW we can send to tw via the U.S., could anyone help me how to do that? TIA, Tatsuya いつもお世話になっておりますかわさき@ giganetです。かわさき TK3197 = = = = = = Business Network Telecom (BNT) ビジネスネットワークテレコム株式会社〒111-0053　東京都台東区浅草橋3-8-5 31山京ビル6階 TEL 03-5687-3945 FAX 03-5687-6009 http://www.giganet.net

2 2

Re: Tracking cooperation
by Sean Donelan 22 Jun '98

22 Jun '98

>How much would "Our NOC has it's act together" be worth when recruting? Every sales person I've ever talked to has told me their NOC has it's act together. So the question is how much would a "Our NOC is lousy" be worth when recruting? Ask the Internetweather sites. In the past, some NOCs have ignored requests until the story hit the front page of the New York Times. In most cases the people who can make decisions don't know what's going on, and the people who know what's going on can't make decisions. I've talked to many of the engineers/techincal geeks at such providers. They were often as upset about the problem as I was, but corporate culture wouldn't let them take any action. If you look back all the hot issues have simmered for a long time before they finally caught management's attention usually on CNN or the front page of the New York Times. Forget the FBI, sometimes I think having John Markoff's phone number is the only effective method of getting inter-provider NOC communication. The following is not legal advice, although I did swip it from a presentation by a lawyer on how to plan for emergencies. 1. Planning is less hazardous to your legal health than not planning 2. PPPPP--Prior Planning Prevents Poor Performance 3. Don't plan in a vacuum, involve the community 4. Plan, Practice the plan, Perform the plan 5. Revise and update the plan as necessary 6. Successful lawsuits are less likely when you have considered all factors in advance, prepared for what you can anticipate, and organized to exercise sound discretion on the unexpected 7. Financial loss is unlikely if you plan and maintain the requirements for statutory indemnity/immunity -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

RBL Update (Re: Lets go vixie!! rbl)
by Paul Vixie 22 Jun '98

22 Jun '98

paradox(a)nac.net (Ryan Pavely) writes: > Wholy jesus :) > > http://maps.vix.com/cgi-bin/lookup?207.68.152.137 > > ps.. 207.68.152.137=msn.com's mx host. well, ok, so we blackholed microsoft (for the second time now). the blockade lasted 3.5 days, and they used several interesting tricks: first they moved their mail relays to different addresses -- hoping, i suppose, that we would not notice the spam being relayed through the new set? then they sent out a simply *amazing* bit of direction to their customers (many of them, it seems, were calling the 1-800-* number asking why their mail was bouncing). we heard it from one of their customers who was kind enough to include in their complaint to us the mail they'd been given by their microsoft network representative: |Greetings-- | |I am at a loss. I contacted MSN to see what it could do about helping |correct a problem with mail we send to my wife's sister. It says it cannot |help me. What do I have to do in order to send mail to this family member? | |I am enclosing MSN's response to my query; it includes my message sending |them to the MAPS screens: |---------------------------------------------------------- |Hello, | |Thank you for posting to Ask msn Member Support. I appreciate the |opportunity to assist you. | |We apologize for the inconvenience of having your mail blocked by this |server. I have visited the website that the message referred you to and |regret to inform you that we can do nothing from MSN as far as |configuration settings to your system to stop them from blocking the mail. |It is their system that set the block, and it will need to be their system |that removes it. According to the website that you were referred to they |are only blocking that particular IP address. If in fact this is true then |you should be able to send E-mail after you log off MSN and log back on. |MSN gives you a new IP address each time you log on. I do not know for |sure, but am more likely to believe that they have in fact blocked all MSN |and MSN.COM domain names from sending mail. If this is true then even |changing IP addresses will not help you send mail to the address you are |attempting to mail. You need to contact the postmaster of the domain you |are attempting to send mail through. In all likelihood this would be |addressed as "postmaster@(domain name.com)" where (domain name) represents |the name of the ending of the address you are attempting to send to. For |example...if you were attempting to send to an MSN address it would be |"postmaster(a)msn.com" I apologize for the trouble, but if anyone can stop |this domain from blocking users mail transport it is the domain itself. |Hope this helps explain things. | |In order to ensure a quick response to future concerns; please continue to |utilize the on-line forms at the address provided below. If you reply to |this email, be sure to include the original message. | |http://memberservices.msn.com/ | |We hope you are enjoying The Microsoft Network, and we look forward to |meeting all your service needs. | |Thanks, |msn Member Support and i have to admit, until i saw the above text, i was worried that maybe we shouldn't have blackholed MSN. whenever we have to blackhole something large, we get mail from RBL subscribers asking "are you crazy?" or similar. i hate to shake the tree too hard all at once -- the wrong things fall out. but when i saw what microsoft was telling their customers, it became clear to me that this was a battle we could not avoid. hearts and minds, etc. i'd like to correct one misimpression, though: i don't do the RBL alone. i make the decision whenever we have to blackhole somebody, since i'm the one that gets sued. but there's a team of volunteers working night and day to research spam sources and relays, answer phones, help people reconfigure their sendmail (or other mailers), and fill my inbox with just the really *high*quality* spam rather than the run-of-the-mill stuff that doesn't need blackholing (or which came from or through a place that was willing to plug their spam leak.) any indication you may have seen that i could last even five minutes as the main and only RBL guy was incorrect, and holding that view in any form would dishonour the very real and necessary work performed by the whole MAPS RBL team. microsoft, btw, finally called in late this morning and said "ok, we give up, we'll turn off third party relay on our mail gateways." it's not done yet, but they told us when to expect it to be done, and so we've removed them from the RBL until at least that time. we're still getting about two complaints per minute from the backlog of msn.com customers who are only now getting back and finding bounced mail in their inboxes. hopefully it'll level off soon. the only other fun thing i'd've said had i made it to NANOG for my usual RBL status update this last time, is that someone asked us to remove 2.0.0.0/8 from the RBL since the IP address of their mail server ended in ".2" and some customer had done a manual "nslookup" in the RBL.MAPS.VIX.COM zone for their address but without reversing it first (remember, we're like IN-ADDR.ARPA) and had cancelled a leased T1 on the basis that they refused to deal with spammers. OUCH! i hate it when that happens. i offered to intercede, but was told that it was just too late. however, we can't removed 2.0.0.0/8 from the RBL until IANA allocates it, as we still get periodic complaints from people who get blackholed when they try to use unallocated address space. we ask where they got their address space and then we never hear back from them. but note -- the only reason it doesn't work for them is the RBL; there's not wide-enough-spread ingress route filtering going on out there, since most of the net, except for RBL subscribers, is actually reachable from unallocated address space. i know that jerry and tony and others are working on this, but i thought i'd point out to those assembled that it's a REAL problem -- try it yourself and note how far you can get, assuming that your BGP neighbors don't filter ingress, it's definitely a safe bet that THEIR neighbors won't. -- Paul Vixie La Honda, CA "Many NANOG members have been around <paul(a)vix.com> longer than most." --Jim Fleming pacbell!vixie!paul (An H.323 GateKeeper for the IPv8 Network)

20 34