February 2000 - Test - lists.nanog.org

RE: Yahoo! Lessons Learned
by Ron Buchalski 09 Feb '00

09 Feb '00

Ken writes: >From: "K. Graham" <kgraham(a)ican.net> >To: nanog(a)merit.edu >Subject: RE: Yahoo! Lessons Learned >Date: Tue, 08 Feb 2000 09:47:58 -0700 > <snip> >It was mentioned that this was a co-ordinated attack. That meant a bit of >planning and access to various machines. As to the number of attackers >only Yahoo's internal people may know. Even then it may have only been one >individual with a script that accessed many locations at one time and >initiated the commands. There is the ability to do such an attack. It's an interesting coincidence that, at roughly the same time that the attack was taking place, we were sitting in the NANOG meeting listening to a presentation on Distributed Denial of Service attacks. It's definitely a major threat... -rb ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

Strange announcements for www.cisco.com
by Neil J. McRae 09 Feb '00

09 Feb '00

To QWEST NOC PEOPLE Folks, You appear to be announcing 198.133.219.0, which is the network that www.cisco.com lives on, whats strange is that you are then transiting this route onto GTEI [AS1] to deliver the traffic. This is fairly sub-optimal and I'm sure incorrect. kenny>sh ip bgp 198.133.219.25 BGP routing table entry for 198.133.219.0/24, version 23258497 Paths: (4 available, best #1, advertised over IBGP) 3356 209 209.244.160.57 from 209.244.160.57 (209.244.2.210) Origin IGP, metric 4401, localpref 100, valid, external, best 3356 209, (received-only) 209.244.160.57 from 209.244.160.57 (209.244.2.210) Origin IGP, metric 4401, localpref 100, valid, external 1 109 4.1.74.105 from 4.1.74.105 (4.0.4.8) Origin IGP, metric 11340, localpref 100, valid, external Dampinfo: penalty 492, flapped 1 times in 00:00:23 1 109, (received-only) 4.1.74.105 from 4.1.74.105 (4.0.4.8) Origin IGP, metric 11340, localpref 100, valid, external kenny>traceroute www.cisco.com Type escape sequence to abort. Tracing the route to www.cisco.com (198.133.219.25) 1 serial4-0-3.hsa1.nyc1.Level3.net (209.244.160.57) [AS 3356] 0 msec 0 msec 0 msec 2 hsipaccess2.Denver1.Level3.net (209.244.2.61) [AS 3356] 48 msec 48 msec 48 msec 3 hsipaccess2.Seattle1.Level3.net (209.244.2.23) [AS 3356] 76 msec 72 msec 76 msec 4 209.0.227.130 [AS 3356] 76 msec 200 msec 148 msec 5 sea-core-01.inet.qwest.net (205.171.26.53) [AS 209] 76 msec 72 msec 76 msec 6 sfo-core-02.inet.qwest.net (205.171.5.105) [AS 209] 84 msec 84 msec 84 msec 7 sjo-core-01.inet.qwest.net (205.171.5.121) [AS 209] 80 msec 80 msec 80 msec 8 sjo-edge-05.inet.qwest.net (205.171.22.46) [AS 209] 84 msec 84 msec 80 msec 9 a5-0-1.sanjose1-nbr1.bbnplanet.net (4.24.145.1) [AS 1] 84 msec 84 msec 84 msec 10 p4-0.paloalto-nbr2.bbnplanet.net (4.0.1.1) [AS 1] 84 msec 84 msec 84 msec 11 p0-0-0.paloalto-cr18.bbnplanet.net (4.0.3.86) [AS 1] 84 msec 84 msec 84 msec 12 * * * 13 pigpen.cisco.com (192.31.7.9) [AS 109] 88 msec 88 msec 88 msec 14 www.cisco.com (198.133.219.25) [AS 209] 88 msec 84 msec 88 msec A fix/explanation would be useful. Regards, Neil. -- Neil J. McRae C O L T I N T E R N E T neil(a)COLT.NET

1 0

Re: MAE-East Problems?
by NANOG Mailing List 09 Feb '00

09 Feb '00

Ahem: > > No problems getting to MAE-East. Just getting things THROUGH it. I'm reporting 20% loss THROUGH the MAE, not *TO* the MAE. On Tue, 8 Feb 2000, Adam Rothschild wrote: > Hi, > > I'm a bit confused here. You're reporting 20% packet loss, and then > pasted ping output indicating zero packet loss. What's the dilly? > > -adam > > On Tue, Feb 08, 2000 at 02:38:19PM -0500, NANOG Mailing List wrote: > > > > > > Is anyone else having problems with packet-loss through MAE-EAST? We're > > down 20% to MAE-E and I'm almost certain it is as result of packet-loss. > > > > No problems getting to MAE-East. Just getting things THROUGH it. > > > > core1-Col>en > > Password: > > core1-Col#term length 20 > > core1-Col#ping > > Protocol [ip]: > > Target IP address: vie1 > > Translating "vie1"...domain server (206.183.224.8) [OK] > > > > Repeat count [5]: 250 > > Datagram size [100]: > > Timeout in seconds [2]: > > Extended commands [n]: > > Sweep range of sizes [n]: > > Type escape sequence to abort. > > Sending 250, 100-byte ICMP Echoes to 206.183.226.36, timeout is 2 seconds: > > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > > Success rate is 100 percent (250/250), round-trip min/avg/max = 20/25/36 > > ms > > > > > > John Fraizer > > EnterZone, Inc > > >

3 2

Re: multicast stream
by Paul Thornton 08 Feb '00

08 Feb '00

Hi, Its "just started working"! FYI, I'm using vic and I'm on 216.33.132.41. The quality is breaking up a bit but I suspect thats just a roomful of notebooks all hammering the wavelan kit :-) On Tue, 8 Feb 2000, Joel Jaeggli wrote: > you're at the meeting? what tool and what ip do you have? are you using > I'd be interested to see if I can see you joined. > > joelja > > On Tue, 8 Feb 2000, Paul Thornton wrote: > > > > > Is anyone else failing to get the H261 stream? I had it yesterday afternoon > > but have been able to get it from the meeting net all morning... > > > > -- > > Paul > > > > > > -------------------------------------------------------------------------- > Joel Jaeggli joelja(a)darkwing.uoregon.edu > Academic User Services consult(a)gladstone.uoregon.edu > PGP Key Fingerprint: 1DE9 8FCA 51FB 4195 B42A 9C32 A30D 121E > -------------------------------------------------------------------------- > It is clear that the arm of criticism cannot replace the criticism of > arms. Karl Marx -- Introduction to the critique of Hegel's Philosophy of > the right, 1843. > > > -- Paul -= Paul Thornton, 2 Durnford Way, Cambridge, CB4 2DP, UK. +44 1223 575384 =-

1 0

RE: junk fax
by Robert Cannon 08 Feb '00

08 Feb '00

You may be interested in the following webpages: ** What you can do about unsolicited telephone marketing phone calls and faxes http://www.fcc.gov/ccb/consumer_news/unsolici.html Telephone Consumer Protection Act(TCPA) http://www.fcc.gov/ccb/consumer_news/tcpa.html FTC Telemarketing Webpage http://www.ftc.gov/bcp/menu-tmark.htm SEC Cold Calling Rules http://www.sec.gov/enforce/alerts/coldcall.htm -Robert Cannon ------Original Message------ From: Randy Bush <randy(a)psg.com> To: nanog(a)merit.edu Sent: February 4, 2000 7:00:12 PM GMT Subject: junk fax to where does one submit formal complaints of junk fax? ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com?sr=mc.mk.mcm.tag001

1 0

Re: MAE-East Problems?
by rs＠seastrom.com 08 Feb '00

08 Feb '00

Since you don't provide an origin adress or a traceroute, it's not exactly easy to help you. That said, FNSI and I are both on giga4 (81b) and have symmetric routing via mae-e, and are suffering no packet loss. ---rob

1 0

multicast stream
by Paul Thornton 08 Feb '00

08 Feb '00

Is anyone else failing to get the H261 stream? I had it yesterday afternoon but have been able to get it from the meeting net all morning... -- Paul

1 0

MAE-East Problems?
by NANOG Mailing List 08 Feb '00

08 Feb '00

Is anyone else having problems with packet-loss through MAE-EAST? We're down 20% to MAE-E and I'm almost certain it is as result of packet-loss. No problems getting to MAE-East. Just getting things THROUGH it. core1-Col>en Password: core1-Col#term length 20 core1-Col#ping Protocol [ip]: Target IP address: vie1 Translating "vie1"...domain server (206.183.224.8) [OK] Repeat count [5]: 250 Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 250, 100-byte ICMP Echoes to 206.183.226.36, timeout is 2 seconds: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Success rate is 100 percent (250/250), round-trip min/avg/max = 20/25/36 ms John Fraizer EnterZone, Inc

1 0

Re: Microsoft search gone?
by Shawn McMahon 08 Feb '00

08 Feb '00

If you don't have any users, or if you have users but you don't answer technical support questions from them, then you won't be helped by this at all. If, however, you're in the 99.99999% of all other people here, it could potentially help you. Glad to see you agree. At 10:28 AM 2/8/2000 -0500, you wrote: >more valuable email reporting incidents/status/gripes about online >services or providors. knowing this will help us all greatly in operating >our networks today.

1 0

Microsoft search gone?
by Simon Lockhart 08 Feb '00

08 Feb '00

home.microsoft.com (as used by the search button on IE3 and IE4) appears to have been returning "Connection Refused" for several hours now, and has resulted in many complaints from users "unable to search the internet". Just a heads up, really, Simon -- Simon Lockhart | Tel: +44 (0)1737 839676 Internet Engineering Manager | Fax: +44 (0)1737 839516 BBC Internet Services | Email: Simon.Lockhart(a)bbc.co.uk Kingswood Warren,Tadworth,Surrey,UK | URL: http://support.bbc.co.uk/

2 1