July 1999 - Test - lists.nanog.org

NSI/Internic operational announcement list
by Sean Donelan 03 Jul '99

03 Jul '99

Does anyone have the current location of NSI's operational announcement list? It appears NSI had some trouble today, but I couldn't find any information on their web site. I believe I'm still subscribe to rs-info(a)internic.net, but I didn't see any notices from NSI. Did I just miss it? -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

2 1

Re: FW: Root Domain Server Hacked.
by George Herbert 02 Jul '99

02 Jul '99

Sean Donelan <SEAN(a)SDG.DRA.COM> >rmeyer(a)mhsc.COM (Roeland M.J. Meyer) writes: >>That's not what Paul said. >>> Randy Bush writes: >>> this is false and specious garbage > >Both statements are true. You can hijack domain names and insert >bogus data in caches without hacking any root servers. It is much >easier to just e-mail a domain modify template to NSI, and insert >some bogus IP addresses for certain names. Similar to what happened >to AOL last year (actually it appears to be a glue issue on some NS >records). >I haven't seen NSI official statements myself, only the news reports. >But there is no evidence any of the independently operated root-name >servers were hacked. If any systems were hacked, they were NSI's >registration process. >I think some people are getting too wrapped up in some really exotic >attacks on DNS, when the simple ones still work. Maybe BEFORE-UPDATE >will get finished now. Won't help. My sources are confirming it was a glue record issue... someone did the rough equivalent of putting in a new domain registration with servers WWW.NETWORKSOLUTIONS.NET and WWW.NETSOL.NET as their nameservers, but with the IPs of the real ICANN webservers. The problem is that the nameserver entries and glue records in general aren't sanity checked (or weren't before today). The real solution eventually has to be some sort requested nameserver forward lookup IP match confirmation prior to accepting a nameserver record in new/change applications; if nameserver FOO.BAR.COM is listed on an application and its IP is listed as 123.4.5.6 but nslookup foo.bar.com shows it at 78.9.10.11 then the application should be held until the discrepancy is resolved properly. I remember suggesting this to Mark Kosters in, oh, April 1993? -george william herbert gherbert(a)crl.com

1 0

Re: FW: Root Domain Server Hacked.
by Sean Donelan 02 Jul '99

02 Jul '99

rmeyer(a)mhsc.COM (Roeland M.J. Meyer) writes: >That's not what Paul said. >> Randy Bush writes: >> this is false and specious garbage Both statements are true. You can hijack domain names and insert bogus data in caches without hacking any root servers. It is much easier to just e-mail a domain modify template to NSI, and insert some bogus IP addresses for certain names. Similar to what happened to AOL last year (actually it appears to be a glue issue on some NS records). I haven't seen NSI official statements myself, only the news reports. But there is no evidence any of the independently operated root-name servers were hacked. If any systems were hacked, they were NSI's registration process. I think some people are getting too wrapped up in some really exotic attacks on DNS, when the simple ones still work. Maybe BEFORE-UPDATE will get finished now. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2

Peering woes
by dlr＠daver.bungi.com 02 Jul '99

02 Jul '99

Since the last message I sent didn't appear... It seems that another major provider is going down the "we don't want to peer any more" road. If you have been affected by this, please give me a call, or drop me an email. Dave Rand +1 408 367-7111

1 0

The Cidr Report
by Tony Bates 02 Jul '99

02 Jul '99

This is an auto-generated mail on Fri Jul 2 12:00:00 PDT 1999 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 02Jul99 0) General Status Table History ------------- Date Prefixes 260699 60645 270699 60627 280699 60609 290699 60732 300699 60815 010799 60761 010799 60799 020799 60891 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 5221 Number of ASes announcing only one prefix: 2716 (1491 cidr, 1225 classful) Largest number of cidr routes: 432 announced by AS701 Largest number of classful routes: 825 announced by AS701 1) Gains by aggregating at the origin AS level --- 02Jul99 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 347 144 203 58.5% BCnet Backbone AS4293 267 158 109 40.8% IMCI AS2609 122 27 95 77.9% EUnet-TN AS577 281 188 93 33.1% Bell Canada Backbone AS174 582 491 91 15.6% Performance Systems International AS7046 326 243 83 25.5% UUNET-CUSTOMER AS4200 186 105 81 43.5% AGIS (Apex Global Information Ser AS7545 141 66 75 53.2% TPG Internet Pty Ltd AS3749 137 63 74 54.0% TECNET AS1221 487 414 73 15.0% TELSTRA-AS AS10928 119 50 69 58.0% UNKNOWN AS7496 99 34 65 65.7% Power Up AS7657 201 142 59 29.4% The Internet Group Limited AS9269 70 14 56 80.0% Hong Kong CTI AS72 95 39 56 58.9% Schlumberger Information Network AS4740 312 258 54 17.3% Ozemail Pty Ltd (ASN-OZEMAIL) AS719 460 408 52 11.3% LANLINK autonomous system AS2493 166 115 51 30.7% iSTAR Internet, Inc. AS4755 123 74 49 39.8% Videsh Sanchar Nigam Ltd. India AS3737 159 110 49 30.8% PenTeleData Inc. (ASN-PTD) AS684 88 43 45 51.1% Manitoba Regional Network Backbon AS803 78 34 44 56.4% SaskNet Backbone AS549 221 178 43 19.5% ONet Backbone AS6944 46 5 41 89.1% RapidSite, Inc. AS1 485 449 36 7.4% BBNPLANET AS6172 155 120 35 22.6% HOME-NET-1 AS1785 246 213 33 13.4% NYSERNet Backbone AS6762 33 2 31 93.9% Telecom Italia international high AS4307 32 1 31 96.9% SVINET-1 AS3549 132 101 31 23.5% Frontier GlobalCenter For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

i'm hearing reports of new DNS cache corruption
by Paul Vixie 02 Jul '99

02 Jul '99

one person's caching name server had been told that www.networksolutions.com's "A" record was that of ICANN's web server. the last person who did this sort of thing spent time in jail for it, so i'm not expecting anyone to claim credit publically this time. the current work is either a dark and stupid joke, or an attempt to discredit ICANN, or an attempt to prompt earlier deployment of DNSSEC. (while we plugged the particular hole used by eugene kashpureff a few years ago, it is widely known that DNS cannot be made secure from this kind of attack without new technology like DNSSEC.) if anyone who has a corrupted BIND server would dump its cache and send me the IP address that the corrupt A RR came from, i'd appreciate it (and i'll share it with CERT and the FBI.)

1 0

Re: [Y2K-PT] - a better NTP test source
by Bill Manning 02 Jul '99

02 Jul '99

http://www.eecis.udel.edu/~mills/ntp/ ..."happy chiming" -dave mills > > Where is Dave Mills page? > > On Fri, 2 Jul 1999, Bill Manning wrote: > > > > > This from Dave Mills pages on public NTP servers: > > -------------------------------------------------------- > > > > y2k-test.timefreq.bldrdoc.gov (132.163.135.136) > > Location: NIST Boulder Laboratories, Boulder, Colorado > > Synchronization: ACTS dial-up using modified lockclock algorithm, DEC Alpha/UNIX > > Service Area: All areas > > Access Policy: Open access. > > This server will transmit time packets that are fast by exactly 2 years (63158400 seconds). It is intended to help users test the y2k > > performance of their systems. The advance is set so that the year is 2 years in the future but the remainder of the time is correct. Thus the > > message transmitted at any time on 1 November 1998 will have a time corresponding the same time of day on 1 November 2000, etc. It will > > operate from Mid-October 1998 through the end of 1999. Contact: Judah Levine (jlevine(a)time.nist.gov) 303 492 7785 > > Note: This system is intended for test purposes only and it should be used with care. Although NTP itself should not have a problem handling > > dates in the year 2000, many host operating systems cannot do so, and system crashes or data corruption are possible if the date is set using > > this test facility. > > -- --bill

1 0

Re: [Y2K-PT] - a better NTP test source
by Bill Manning 02 Jul '99

02 Jul '99

This from Dave Mills pages on public NTP servers: -------------------------------------------------------- 83.y2k-test.timefreq.bldrdoc.gov (132.163.135.136) Location: NIST Boulder Laboratories, Boulder, Colorado Synchronization: ACTS dial-up using modified lockclock algorithm, DEC Alpha/UNIX Service Area: All areas Access Policy: Open access. This server will transmit time packets that are fast by exactly 2 years (63158400 seconds). It is intended to help users test the y2k performance of their systems. The advance is set so that the year is 2 years in the future but the remainder of the time is correct. Thus the message transmitted at any time on 1 November 1998 will have a time corresponding the same time of day on 1 November 2000, etc. It will operate from Mid-October 1998 through the end of 1999. Contact: Judah Levine (jlevine(a)time.nist.gov) 303 492 7785 Note: This system is intended for test purposes only and it should be used with care. Although NTP itself should not have a problem handling dates in the year 2000, many host operating systems cannot do so, and system crashes or data corruption are possible if the date is set using this test facility. --bill

1 0

Re: NOC listing
by Diana Welborn 02 Jul '99

02 Jul '99

That's the one! Thanks a million! :) Sara Ruhmann wrote: > Would it be this one? > > http://puck.nether.net/netops/nocs.cgi > > -sara > -- Diana Welborn diwelbor(a)usa.alcatel.com Customer Network Operations Center Engineer Alcatel USA CNOC 1000 Coit Road Phone - 972-477-7229 MS 593 Fax - 972-519-7550 Plano, TX 75075 Pager - 800-759-8888 PIN 1453528 or http://www.skytel.com/Paging/pageme.cgi?pin=1453528,1 A wise man named Tom Zabel once reminded me: ========================================================================== Standard Disclaimer: Hear me now and hear me well - I do not speak for Alcatel. But that is OK you see - for Alcatel does not speak for me. ==========================================================================

1 0

NOC listing
by Diana Welborn 02 Jul '99

02 Jul '99

A couple of months ago (like, probably January or February), someone posted a hyperlink to a list of all the NOCs in the country. I've since changed places of employment and I cannot find that list. Does anyone have it and are you willing to part with the knowledge? Thanks! -- Diana Welborn diwelbor(a)usa.alcatel.com Customer Network Operations Center Engineer Alcatel USA CNOC 1000 Coit Road Phone - 972-477-7229 MS 593 Fax - 972-519-7550 Plano, TX 75075 Pager - 800-759-8888 PIN 1453528 or http://www.skytel.com/Paging/pageme.cgi?pin=1453528,1 A wise man named Tom Zabel once reminded me: ========================================================================== Standard Disclaimer: Hear me now and hear me well - I do not speak for Alcatel. But that is OK you see - for Alcatel does not speak for me. ==========================================================================

1 0