October 2000 - Test - lists.nanog.org

Root registration
by Travis Grant 27 Oct '00

27 Oct '00

How do I locate the the authority for root registration on behalf of a foreign country? Travis Grant

3 2

Microsoft whois
by Alberto Begliomini 27 Oct '00

27 Oct '00

Did anyone see this? It was actually pointed out to me by someone else. It looks likes Internic is having a problem... (aub@paraggi ~) whois microsoft.com [whois.internic.net] Whois Server Version 1.3 Domain names in the .com, .net, and .org domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information. MICROSOFT.COM.IS.SECRETLY.RUN.BY.ILLUMINATI.TERRORISTS.NET MICROSOFT.COM.IS.RULED.BY.HACKERJACK.COM MICROSOFT.COM To single out one record, look it up with "xxx", where xxx is one of the of the records displayed above. If the records are the same, look them up with "=xxx" to receive a full display for each record. >>> Last update of whois database: Wed, 25 Oct 2000 10:07:30 EDT <<< The Registry database contains ONLY .COM, .NET, .ORG, .EDU domains and Registrars. -- Alberto U. Begliomini Email: aub(a)coldstone.com Coldstone Consulting, LLC Phone: 650-400-3990 Security, Data Centers Design and Management Fax: 650-654-5938

8 7

Network reliability and security
by Sean Donelan 27 Oct '00

27 Oct '00

My first trip to Washington DC in almost a year, and things are as weird as ever. One topic which kept coming up Internet security, and the possibility of someone with hostile intent disrupting the Internet. My theory and experience is these attacks, while devastating to individual networks and sites, have extremely localized affect. If you are just a few networks removed, you don't see much collateral affects. Now some folks are pointing to the current "cyber-war" going on in the Middle East as evidence great plans must be made. I poked around a bit, and yes, some sites and networks have severe problems. But it had essentially no affect on Internet performance outside the immediate area. What are network operators experiencing?

1 0

Re: Service Provider Exchange requirements
by Simon Leinen 26 Oct '00

26 Oct '00

>>>>> "jf" == John Fraizer <nanog(a)EnterZone.Net> writes: > If your switch is MCAST aware, you should be able to keep mcast > traffic on ports tagged for it to begin with. Is the idea that you can statically configure which of the IXP switch's ports should be multicast-capable at all? This would cause administrative overhead and would still not solve the problem of multicast-capable routers that receive copies of multicast traffic they aren't currently interested in. > If your switch isn't mcast aware. you need to find a new switch. It is actually quite hard for switches to be "mcast aware" enough to copy multicast packets to exactly the set of who are interested in them. They either have to listen to and understand the multicast routing-protocol-of-the-day, or there must be some explicit protocol between multicast routers and the switch. In any case this is much more difficult than what most "multicast aware" switches currently do, i.e. IGMP snooping (which helps for end-systems, not routers, connected to the switch). -- Simon.

1 0

Beta-testers needed (if not interested please delete now)
by Hugh Irvine 26 Oct '00

26 Oct '00

I am looking for beta-testers for some new software called Nets. (From Open System Consultants, authors of Radiator - the ISP Radius server that many of you will be familiar with.) Nets is an Open Source network inventory and management system, with a graphical user interface that runs on any Unix or Microsoft Windows system and almost any free or commercial SQL database as the back end. If you are interested, please have a look at http://www.open.com.au/nets and contact me directly. Many thanks Hugh Irvine hugh(a)open.com.au

1 0

Route Registry: who uses them?
by Todd Caine 25 Oct '00

25 Oct '00

I've been talking with our router geeks and we have been debating over the usefulness of route registries. We were asked recently on an application for peering if we consult RADB, and our response was, "We have used it although it's not up to date; Why do you use it?", and we received no response. In my experience, I've never heard of any cases where it has been used. Who should use Route Registries? Why? Is it worth the time? Do people trust that the information is accurate enough to let a route server automate establishing your peering sessions? Is there a limit to the detail that you should provide? I've looked at some of the information that other providers have put in the route registry, but nothing really seemed all that useful to us. Would anyone agree or disagree? Am I missing something here? Regards, Todd Caine /* * Todd Caine * (360) 816-4344 * tcaine(a)eli.net */

4 3

Re: Cheapest ethernet switch with monitor/mirror port?
by Dan Hollis 25 Oct '00

25 Oct '00

On Wed, 25 Oct 2000, barry reginaldo wrote: > Why don't you try the Cisco Catalyst 2912XL-EN switch. > It has 12 ports 10/100 priced at $1495 list. An even cheaper alternative is the Cisco Catalyst 1912-A swich. It has 12 port 10Mbps and 2 100Mbps priced a $895 list. Ive found a better solution. An $80 8-port 10/100 desktop switch, and Ill sniff the 100bt uplink. -Dan

2 1

[Somewhat OT] ATM Port/Class of Service Pricing
by Allan Carscaddon 25 Oct '00

25 Oct '00

I just had some materials dropped off on my desk to verify with regards to ATM pricing. I am, unfortunately, not as current on ATM service pricing as I would need to be to verify the prices that I have. I don't know very well where to begin and I hope that someone here can a) help, or b) point me to someone who could. I have some prices for ATM service based on port speed (e.g., ATM ports from an IXC), at a customer site for various speeds (DS3, OC3, etc). I also have some additional prices based on Class of Service (CBR, UBR, and VBR) and by the amount of "committed data rate" (PCR in the case of CBR traffic and SCR in the case of VBR traffic). If anyone out there is willing to share information that they have on ATM pricing, I would very much appreciate their sharing with me. If interest warrants, I will summarize to the group (pending permission from those providing information). Best regards, and thanks in advance, Allan

1 0

whois breakage
by Joshua Goodall 25 Oct '00

25 Oct '00

$ whois -h whois.internic.net microsoft.com Whois Server Version 1.3 Domain names in the .com, .net, and .org domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information. MICROSOFT.COM.IS.SECRETLY.RUN.BY.ILLUMINATI.TERRORISTS.NET MICROSOFT.COM Enough said. Similar for apple.com. The web-based whois client at nsiregistry.com is giving correct results, as are the gtld-servers, as does -h networksolutions.com FreeBSD and at least one release of Linux I've tested query whois.internic.net by default. If anyone is using automated whois in production (very likely), check your results! J

3 2

RE: whois
by Karyn Ulriksen 24 Oct '00

24 Oct '00

You're kidding, right? -K > -----Original Message----- > From: bmanning(a)vacation.karoshi.com > [mailto:bmanning@vacation.karoshi.com] > Sent: Tuesday, October 24, 2000 7:23 AM > To: tme(a)21rst-century.com > Cc: nanog(a)nanog.org > Subject: Re: whois > > > > Yow! A chance to play devils advocate... Cool :) > > If you told me a dialup user on my network did anything, I'd doubt > your veracity. How do you know I have dialup services in my network? > The accuracy of your clock and the recorded IP address > are suspect since I have zero visability into your network structure > or administrative practice... and you don't have that visability into > mine. Your clock is hacked and you are forging IP addresses > in an attempt > to distract me from providing services. Tell me why this is > not a simple > case of harassment? Full and public disclosure of the attack > profile would > help build your credibility. And yes, if I have no business > relationship > to you and I've never had a relationship with you and you are making > assertions about my infrastructure and clients, I will prolly want > some incentive to cover the costs of investigating your outragous > claims. > > > > Are you really saying that if I tell you that a dial-up > user on your network > > hacked into my system at some precise time, from a precise > IP address > > (so that you could probably tell easily which user did it), > and did so > > in a fashion > > which suggested an automated "script kiddie" effort, I should only > > expect a response from you if I PAY for it ?!? > > > > This seems pretty close to the "protection" money that I > hear people with > > POP's in Moscow have to pay :) > > > > (BTW, I said nothing about timeliness > > or 24x7 availability - a note a week or two later would > have sufficed.) > > > > > > > > > > > > The key to an anti-hacker ISP association would be > > > > > a very special ip address / contact person lookup database. > > > > > ie: who/how to contact for the 'SWAT' response for a > particular IP > > > > > address. > > > > > > > > > > --Mike-- > > > > > > > > Hello; > > > > > > > > When we have had attacks such as root exploits, we have > notified the > > > > source (at least, > > > > the ISP hosting the immediate source) as to the date, > time, IP address, etc. > > > > (In one case, the attack appeared to come from a > dial-up address in Germany, > > > > so I thought we had them.) We have NEVER received a > response. From > > > > conversations at meetings, etc., I understand that this > is typical - almost > > > > universal - and that it would be naive to expect other > ISPs to actually > > > > do anything > > > > about being a source for attacks. > > > > > > > > Maybe a start would be to a BCP for some level of > minimal response if > > > > you source > > > > an attack, and a "web site of shame" listing those > domains that source > > > > attacks and do nothing about it when notified. > > > > > > > > > > -- > > > > > > Regards > > Marshall Eubanks > > > > > > Multicast Technologies, Inc. > > 10301 Democracy Lane, Suite 201 > > Fairfax, Virginia 22030 > > Phone : 703-293-9624 Fax : 703-293-9609 > > e-mail : tme(a)on-the-i.com http://www.on-the-i.com > > > >

2 1