March 2000 - Test - lists.nanog.org

RE: Redstone
by Kevin Santamaria 03 Mar '00

03 Mar '00

Does anybody have opinions/information on the long term viability of the (former) Redstone product line? Thanks Kevin

1 0

noc@gblx and support@gblx both bounce...
by Steve Sobol 02 Mar '00

02 Mar '00

I just sent a message to noc(a)gblx.net about a possible routing problem. Mail to that address AND to support(a)gblx.net bounced. Isn't noc@ supposed to be a standard reporting address? Just wondering... **SJS -- North Shore Technologies, Cleveland, OH http://NorthShoreTechnologies.net Steve Sobol, President, Chief Website Architect and Janitor sjsobol(a)NorthShoreTechnologies.net - 888.480.4NET - 216.619.2NET

3 2

Heads-up: Another whois change
by Kevin Day 02 Mar '00

02 Mar '00

NSI seems to have modified their WHOIS response format again, now including full information about each contact. Again, this broke one of my scripts since nothing is where it's supposed to be. Didn't they promise before to notify people before they did this again? Anyone else trying to process the response from a WHOIS should take note: # whois -h whois.networksolutions.com microsoft.com The Data in Network Solutions' WHOIS database is provided by Network Solutions for information purposes, and to assist persons in obtaining information about or related to a domain name registration record. Network Solutions does not guarantee its accuracy. By submitting a WHOIS query, you agree that you will use this Data only for lawful purposes and that, under no circumstances will you use this Data to: (1) allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via e-mail (spam); or (2) enable high volume, automated, electronic processes that apply to Network Solutions (or its systems). Network Solutions reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy. Registrant: Microsoft Corporation (MICROSOFT-DOM) 1 microsoft way redmond, WA 98052 US Domain Name: MICROSOFT.COM Administrative Contact: Micosoft Hostmaster (MH37-ORG) msnhst(a)MICROSOFT.COM Microsoft Corp One Microsoft Way Redmond, WA 98052 US 425 882 8080 Fax- - .: 206 703 2641 Technical Contact, Zone Contact: MSN NOC (MN5-ORG) msnnoc(a)MICROSOFT.COM Microsoft Corp One Microsoft Way Redmond, WA 98052 US 425 882 8080 Fax- PATH Record last updated on 11-Dec-1998. Record created on 02-May-1991. Database last updated on 29-Feb-2000 21:55:34 EST. Domain servers in listed order: ATBD.MICROSOFT.COM 131.107.1.7 DNS1.MICROSOFT.COM 131.107.1.240 DNS4.CP.MSFT.NET 207.46.138.11 DNS5.CP.MSFT.NET 207.46.138.12 I'm not sure if this is intentional or not, but it's really ugly. If it's a bug, yuck. Kevin

5 6

government eavesdropping
by Jeff Ogden 02 Mar '00

02 Mar '00

So what is the real story here? Is all, most, some of our international Internet traffic being intercepted by various governments? Is it only international traffic that is at issue or is domestic traffic within the US subject to routine eavesdropping without a court order? For years I've been telling people that while there was some risk that traffic on the Internet could be intercepted, that the risk was greatest at the ends of a connection and that as long as they were working with a reputable ISP that there was almost no risk that anyone was eavesdropping on the traffic from the more central networks. I've also been telling people that data "at rest" on disks or stored in servers is much more at risk than data "in motion" as it moves across the Internet. Have I been misleading people? -Jeff Ogden Merit >From http://dailynews.yahoo.com/h/ap/20000223/wl/eu_espionage_1.html > >Wednesday February 23 9:50 AM ET > >Report Details Vast Spy Network > >By CONSTANT BRAND Associated Press Writer > >BRUSSELS, Belgium (AP) - A U.S.-led communications >monitoring network is intercepting ``billions of messages per >hour'' including telephone calls, fax transmissions and private >e-mails, according to a European Parliament report made public >Wednesday. > >``We are not talking about a trivial thing here ... we cannot stop >them, they will continue,'' said Ducan Campbell, author of the >special parliament-commissioned report on the Echelon >spy-network. > >Campbell said that the intelligence network monitors and >intercepts sensitive European-wide commercial communications. >``The level of use is getting out of control,'' he told a packed >hearing of the Parliament's Committee for Justice and Home >Affairs. > >He said Canada, Britain, Australia and New Zealand are also >involved in Echelon. Other nations including France and Germany >also participate in a lower level in the spy-network which dates >back 50 years to the beginning of the Cold War. > >``The capacity of the filtering systems is enormous,'' Campbell >said. He added that most international internet communications >are being routed through the United States and through nine known >U.S. National Security Agency interception sites. > >Intelligence facilities located in the five countries can intercept fax, >e-mail or telephone communications easily he said. Campbell >urged the European Union to take action to protect against >unwanted interception of communications, which he said were >violations of human rights. > >Committee chairman Graham Watson said he wanted to be sure >the international surveillance system was not abusing its powers. > >Campbell said Microsoft, IBM, and a certain ``large American >microchip maker'' were providing certain product features which >allow the interception of information flow. > >Campbell said he did not know whether the U.S. corporations were >benefitting from the information gathering but said previous >commercial espionage resulted in the collapse of several European >contracts in the airline industry - both military and commercial.

13 13

Re: Alternative to BGP-4 for multihoming?
by Paul Vixie 02 Mar '00

02 Mar '00

> http://www.radware.com/product/lproof/Default.htm > > I have a customer that requires multihoming and they want to use Linkproof > and I want them to do BGP-4. Does anyone have any experience using this as > an alternative to BGP-4? According to ftp://ftp.vix.com/pub/vixie/ifdefault/, this idea has been around for several years, and does not require any closed-source products. -- Paul Vixie <vixie(a)mibh.net> SVP for Internet Services, MFNX M.I.B.H. Inc. is a subsidiary of Metromedia Fiber Network, Inc.

1 0

Forwarded: 47th IETF: ITRACE BOF
by Steven M. Bellovin 01 Mar '00

01 Mar '00

------- Forwarded Message Return-Path: <ietf-123-owner(a)loki.ietf.org> Received: from postal.research.att.com by fetchmail-4.5.7 POP3 for <smb/localhost> (single-drop); Wed, 01 Mar 2000 19:23:02 EST Received: from mail-green.research.att.com (mail-green.research.att.com [135.207.30.103]) by postal.research.att.com (8.8.7/8.8.7) with ESMTP id TAA10215 for <smb(a)postal.research.att.com>; Wed, 1 Mar 2000 19:20:12 -0500 (EST) Received: by mail-green.research.att.com (Postfix) id 1F98A1E032; Wed, 1 Mar 2000 19:20:12 -0500 (EST) Received: from loki.ietf.org (loki.ietf.org [132.151.1.177]) by mail-green.research.att.com (Postfix) with ESMTP id 10D301E036; Wed, 1 Mar 2000 19:20:07 -0500 (EST) Received: (from adm@localhost) by loki.ietf.org (8.9.1b+Sun/8.9.1) id SAA05354 for ietf-123-outbound.01(a)ietf.org; Wed, 1 Mar 2000 18:25:00 -0500 (EST) Received: from ietf.org (odin.ietf.org [10.27.2.28]) by loki.ietf.org (8.9.1b+Sun/8.9.1) with ESMTP id SAA05280 for <all-ietf(a)loki.ietf.org>; Wed, 1 Mar 2000 18:13:06 -0500 (EST) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA16131; Wed, 1 Mar 2000 18:13:04 -0500 (EST) Delivered-To: smb(a)research.att.com Message-Id: <200003012313.SAA16131(a)ietf.org> To: IETF-Announce: ; From: ietf-secretariat(a)ietf.org Cc: new-work(a)ietf.org Subject: 47th IETF: ITRACE BOF Date: Wed, 01 Mar 2000 18:13:03 -0500 Sender: mbeaulie(a)cnri.reston.va.us Content-Type: text X-UIDL: de9f75cb7001aedbabad2854bdf994cd ICMP Traceback BOF (itrace) Thursday, March 30 at 1530-1730 =============================== CHAIR: Steve Bellovin <smb(a)research.att.com> DESCRIPTION: The purpose of the BoF is to look at a mechanism to help address the problem of tracing back denial of service attacks. The suggested mechanism is that with low probability (order 1/20,000), a router seeing a packet would send to the destination an ICMP message giving as much information as it knows about the immediate previous hop of that packet. With enough of these messages -- and if one is being flooded, by definition there will be a lot of traffic, so that the low probabilities will still result in a reasonably complete set of traceback packets. Such a mechanism has other uses as well. It lets people trace down the source of accidentally-emitted bogus packets, i.e., those with RFC1918 addresses. It helps characterize the reverse path, which traceroute does not do. The output will be a standards-track RFC describing the packet format, and the conditions under which it should be sent. Issues include authentication, router load, and host load. AGENDA: Introduction, motivation 15 min Marcus Leech's prototype 20 min Open issues list 30 min Charter 20 min ------- End of Forwarded Message --Steve Bellovin

1 0

~ Work International Business from Home ~
by strategies＠connect4free.net 01 Mar '00

01 Mar '00

1 0

Re: Alternative to BGP-4 for multihoming?
by Steven M. Bellovin 01 Mar '00

01 Mar '00

In message <3.0.5.32.20000301174204.0081c280(a)max.ibm.net.il>, Hank Nussbacher w rites: > > Radware has a product called Linkproof and claims that it negates the need > for BGP-4 and portable IP addresses: > > http://www.radware.com/product/lproof/Default.htm > > I have a customer that requires multihoming and they want to use Linkproof > and I want them to do BGP-4. Does anyone have any experience using this as > an alternative to BGP-4? The Web page states that the device uses NAT. I can't speak for others, but NAT is against my religion.... --Steve Bellovin

1 0

show interface switch
by ww 01 Mar '00

01 Mar '00

There used to be an undocumented command in Cisco IOS that would provide statistics about how packets were being dealt with -- namely 'show interface switch'. A sample output of the command: Ethernet1/1 Throttle count: 0 Protocol Path Pkts In Chars In Pkts Out Chars Out Other Process 451 54909 24890 1493400 Cache misses 0 Fast 0 0 0 0 Auton/SSE 0 0 0 0 IP Process 17354 2180875 123854 12437965 Cache misses 18678 Fast 13066464 788505528 11642545 4290345939 Auton/SSE 0 0 0 0 Trans. Bridge Process 0 0 104 6240 Cache misses 0 Fast 549 38962 63 8268 Auton/SSE 0 0 0 0 DEC MOP Process 0 0 414 31878 Cache misses 0 Fast 0 0 0 0 Auton/SSE 0 0 0 0 Spanning Tree Process 0 0 584 35040 Cache misses 0 Fast 0 0 0 0 Auton/SSE 0 0 0 0 ARP Process 75404 4531576 149 8940 Cache misses 0 Fast 0 0 0 0 Auton/SSE 0 0 0 0 CDP Process 35 10885 533 168537 Cache misses 0 Fast 0 0 0 0 Auton/SSE 0 0 0 0 For certain this command exists in versions of 11.X vintage, although it seems to have disappeared in 12.X. Does anyone know why it has been abandoned? These are usefull statistics from a debugging perspective (i.e. why is this router crumbling under high traffic load? because it's process switching all of its packets) and I don't think that it's possible to garner them from netflow. Has it been replaced by another undocumented command? Cheers, Will Waites ww(a)pandora.styx.org

4 3

~ EveryBody Loves Chocolate! ~
by candyman＠pplmail.com 01 Mar '00

01 Mar '00

1 0