May 1999 - Test - lists.nanog.org

Re: MAE-East weirdness on May 13, 1999 (fwd)
by Deepak Jain 14 May '99

14 May '99

We were told by Worldcom that there was a linecard failure and they were working on replacing it. Of course, that is what the ticket said and no one from Dallas has actually confirmed this. And yes, we are still seeing those problems too. Deepak Jain AiNET On Fri, 14 May 1999, David Diaz wrote: > > Is anyone else still seeing problems @ MAE-E? We are still seeing > issues that appear to be similar to yesterday's problems... > Thank you, > David Diaz > Chief Technical Officer > Netrail, Inc > > email: davediaz(a)netrail.net > pager: 888-576-1018 > office: 888-NETRAIL > Fax: 404 522-2191 > > Build 1: 46 cities nationwide > Build 2: 67 cities nationwide > > ++I don't suffer from stress. I'm a carrier.++ > >

1 0

Re: MAE-East weirdness on May 13, 1999
by Sean Donelan 14 May '99

14 May '99

davediaz(a)netrail.NET (David Diaz) writes: >Is anyone else still seeing problems @ MAE-E? We are still seeing >issues that appear to be similar to yesterday's problems... Something is going on, official MFS sources have become ominously quiet though. One unofficial on-site reporter indicated one of the gigaswitches had gone belly up. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

2 1

Re: MAE-East weirdness on May 13, 1999
by Gerry Boudreaux 14 May '99

14 May '99

At 04:14 PM 5/13/99 -0700, Tim Wolfe wrote: >Is this the episode where Fox Mulder discovers that the Internet is really a >tool for alien communication by encoding extraterrestrial DNA into tcp/ip >packets? Sorry if I missed it but, does anyone have the RFC number for encoding extraterrestrial DNA into tcp/ip packets? I would hate to be non-conforming. G P.S. Is it true that Sean Donelan has become the first nationwide, tier-one backhoe provider(tm)(c)?

6 5

The Cidr Report
by Tony Bates 14 May '99

14 May '99

This is an auto-generated mail on Fri May 14 12:00:01 PDT 1999 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 14May99 0) General Status Table History ------------- Date Prefixes 070599 58948 080599 58752 090599 58864 100599 58995 110599 58977 120599 59116 130599 58987 140599 59083 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 221.43.160.0/19 from AS12323 AS Summary ---------- Number of ASes in routing system: 4952 Number of ASes announcing only one prefix: 2526 (1378 cidr, 1148 classful) Largest number of cidr routes: 397 announced by AS701 Largest number of classful routes: 805 announced by AS701 1) Gains by aggregating at the origin AS level --- 14May99 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 355 144 211 59.4% BCnet Backbone AS4293 282 176 106 37.6% IMCI AS174 565 474 91 16.1% Performance Systems International AS2493 210 125 85 40.5% iSTAR Internet, Inc. AS4755 174 90 84 48.3% Videsh Sanchar Nigam Ltd. India AS577 254 175 79 31.1% Bell Canada Backbone AS4200 175 99 76 43.4% AGIS (Apex Global Information Ser AS3749 137 61 76 55.5% TECNET AS1267 94 24 70 74.5% IUNET-AS AS7496 99 30 69 69.7% Power Up AS7545 111 47 64 57.7% TPG Internet Pty Ltd AS1785 384 321 63 16.4% NYSERNet Backbone AS9269 69 8 61 88.4% Hong Kong CTI AS1221 457 397 60 13.1% TELSTRA-AS AS7122 140 81 59 42.1% MTS ADVANCED Network Policy AS4740 333 276 57 17.1% Ozemail Pty Ltd (ASN-OZEMAIL) AS10928 110 53 57 51.8% UNKNOWN AS72 94 39 55 58.5% Schlumberger Information Network AS7657 164 110 54 32.9% The Internet Group Limited AS719 473 419 54 11.4% LANLINK autonomous system AS1239 519 466 53 10.2% SprintLink Backbone AS7046 252 206 46 18.3% UUNET-CUSTOMER AS3737 111 73 38 34.2% PenTeleData Inc. (ASN-PTD) AS803 72 36 36 50.0% SaskNet Backbone AS1 499 465 34 6.8% BBNPLANET AS6172 155 124 31 20.0% HOME-NET-1 AS4307 32 1 31 96.9% SVINET-1 AS3549 133 102 31 23.3% Frontier GlobalCenter AS2907 208 177 31 14.9% SINET AS11515 32 1 31 96.9% UNKNOWN For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

whois changes
by Kevin Day 14 May '99

14 May '99

This isn't strictly network related, but... The format of the WHOIS responses changed, which broke a script of mine. # whois nonexistantdomain.com No match for "NONEXISTANTDOMAIN.COM". You agree that you will not reproduce, sell, transfer, or modify any of the data presented in response to your search request, or use of any such data for commercial purpose, without the prior express written permission of Network Solutions. # whois dragondata.com Registrant: Dragon Data (DRAGONDATA-DOM) 1703 W Brown St Arlington Heights, IL 60004 US Domain Name: DRAGONDATA.COM Administrative Contact, Technical Contact, Zone Contact: Day, Kevin (KD748) toasty(a)DRAGONDATA.COM 847-797-9975 (FAX) 847-222-0912 Billing Contact: Day, Kevin (KD748) toasty(a)DRAGONDATA.COM 847-797-9975 (FAX) 847-222-0912 Record last updated on 08-Jul-98. Record created on 03-Apr-97. Database last updated on 13-May-99 08:35:10 EDT. Domain servers in listed order: NS1.DRAGONDATA.COM 204.137.237.2 CEREBUS.MCS.COM 192.160.127.125 NS2.DRAGONDATA.COM 204.137.237.8 You agree that you will not reproduce, sell, transfer, or modify any of the data presented in response to your search request, or use of any such data for commercial purpose, without the prior express written permission of Network Solutions. The verbage change broke my script, only because of sloppy programming on my part, but.... Since whois'es sometimes close before you get the entire report, I needed a way to know I got the entire message. This effect anyone else? Anyone else in favor of a "HEADS-UP" from networksolutions before these take place? :) Kevin Day DragonData

1 0

GeekTools SuperWhois v2.0
by Rodney Joffe 14 May '99

14 May '99

Hello, v2.0 of SuperWhois is now up and in production (subject to bugs you find tho'...). The same version exists at both the web interface, and the command line whois proxy. We currently query for 88 tlds, including 6bone. To get the entire list (also used for whois-servers.net) do: dig @ns1.centergate.com whois-servers.net axfr We've instituted some limits because of potential abuse by spammers. So, if you make more than 25 queries a day from the same ip, please send email letting us know what ip address you are coming from, and convince us that you are not using it for spamming, and we'll open it up for you. Important Privacy Note: We are now logging whois queries only - for obvious reasons... Here is the 'man' section. We're working on cleaning up the source to release level, and then we'll place it in the software section of geektools for download. We also hope to have a 'geek' version of a windows superwhois client within a couple of weeks, for those who have to use windows boxen. Enjoy. And please remember to provide updates to whois server information to registry(a)geektools.com. These updates also go into the whois-servers.net zone. /rlj rjoffe(a)centergate.com www.centergate.com "Technology so advanced, even *we* don't understand it!" ---------------------------------------------------------------------- Using the GeekTools WHOIS Proxy ------------------------------- whois.geektools.com Czar - Robb Ballard robb(a)centergate.com Note: Due to the variety of whois clients currently in use, this document makes no attempt to tell the user how to operate his/her whois client. Any query examples which appear in this document are in the format that the whois proxy requires. It is up to the user to determine how to get his/her own whois client to pass this information to the proxy. Features and Descriptions: -------------------------- The GeekTools WHOIS proxy has the ability to parse and/or interpret information provided to it in the form of a query. The proxy automatically determines if the query is a full or partial IP address, domain, NIC handle, etc. and then (usually) acts appropriately. The following list shows valid query types and examples. - Domain Query Format: domain.tld Example: nanog.org Action: The proxy determines the proper whois server to query based on the TLD and queries that server for the information. - IP Address Format: ###.###.###.###, ###.###.###, or ###.### Example: 204.69.234.0 Action: The proxy first queries ARIN for the answer. If ARIN has delegated the block to another registry, the proxy will query the appropriate server for the information. - AS Numbers Format: ### Example 12008 Action: The proxy determines the appropriate registry to query for the AS number information and retrieves it. - NIC Handles Format: XX### Example: RB190, RB190-ARIN Action: The proxy queries the appropriate registry, based on the suffix of the handle if one is given. - Forced Queries Format: query destination Example: smith ra Action: Forces the query to be sent to any of the following servers based on the destination. The destination may be INTERNIC, RIPE, APNIC, AUNIC, ARIN, or RA. Other Information: - The proxy automatically includes query switches for certain whois servers. For example, queries to whois.nic.ad.jp are returned in Japanese. The proxy appends "/e" to the query to force the server to return the information in English. - Queries for which an authoritative whois server is not available default to Internic unless forced to a different server. - Basic help may be obtained by sending a null query to the whois proxy. ----------------------------------------------------------------------

1 0

IXC Fiber cut Michigan
by Jared Mauch 14 May '99

14 May '99

IXC has a fiber cut in Southeastern Michigan that is affecting a number of service providers in our area. Currently there is no ETR - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 1

Re: Smurf attack on AS9126
by Neil J. McRae 14 May '99

14 May '99

On Fri, 14 May 1999 11:17:05 +0200 (MET DST) Jens Schweikhardt <schweikh(a)noc.dfn.de> wrote: > A little less detail would have been appropriate, IMHO. In something like this less detail means that nobody does anything, sad but true. I used nanog as it seems to be the only way to talk to alot of ISPs easily and seemed relevant to the theme of that mailing list. If you have a problem with the archiving of lists I'm sure we can donate you a disk drive and 3 lines of perl to filter out long email messages. If you don't want to recieve this type of message, then unsubscribe is your friend, there will always be people attacking networks and we will always have to work together on issues like this. No I don't like it either but its the way it is. I actually intended to write a script to get the AS path of the offending packets and post that also so I guess in the end you got your wish and I did post a little less detail. I'll put up a url next time but doing that impacts on the response that one gets to this type of message. Regards, Neil.

1 0

Re: MAE-East weirdness on May 13, 1999
by Sean Donelan 14 May '99

14 May '99

The explanation for the May 13, morning weirdness at MAE-East appears to be a trunk failure between one or more of the Gigaswitches. I haven't heard officially back from MFS yet on it, but other people had. The afternoon is still unexplained. Although there were several jokes about the alien packets, the afternoon weirdness does in fact seem to be related to large streams of unknown packets which drove the CPU on the router to 100%. But I don't have any copies of the mystery packets, nor do I know what caused them. I'm pretty sure it wasn't SMURF, the traffic pattern was very different. It seems to have consisted of four short, huge bursts of unknown packets. My current working assumption is it was some type of strange data corruption related to the repair activity from the morning incident, which then cleared up. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: MAE-East weirdness on May 13, 1999
by Sean Donelan 13 May '99

13 May '99

>Did anyone else experience some weirdness at MAE-East this morning at >about 9:30-10:00am Eastern? All of our circuits were up, but BGP had >an unusually difficult problem maintaining sessions. The same thing >happened again around 1:00-2:00pm Eastern this afternoon. Lots of "me too's" but no one knows why. So does anyone know why? Alien packets on the Gigaswitchs? Denial of Service attack? Y2K? -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2