April 2000 - Test - lists.nanog.org

Over subscription
by Arun Welch 27 Apr '00

27 Apr '00

What level of over subscription are people generally using for their tail circuits these days. In other words, if you've got a POP connected by one T3, how many customers (T1 and T3) would you typically connect to that POP (I'm just looking for generalities here, nothing exact)? I've got some numbers, but they're about 4 years old, and I suspect things have changed since then. ...arun Arun Welch Infinite Global Infrastructures

2 1

ICQ & AOL
by Igor V. Vorontsov 27 Apr '00

27 Apr '00

Hello colleque, Sorry my English. If engeneers from AOL or ICQ is present here... Many pople from Russia and Ukraine can't connect to your service. Your engeeners was closed many networks from Russia and Ukraine. But why? Many people from our country was usable service ICQ, but now this service is closed for them. Please open for your service our networks and resolve this problem. One of them - network 193.227.207.0/24 Igor V. Vorontsov IV144-RIPE

1 0

POS on CISCO routers.
by jeanlou.dupont＠na.marconicomms.com 26 Apr '00

26 Apr '00

Hi all; I have a quick question: Does the PPP component of the POS interface include the LCP protocol negotiation specified in RFC 1471, or is it basically just the multiprotocol encapsulation and/or framing functions of PPP which are implemented? Any advice would be gratefully appreciated! :)) Regards, Jean-Lou

1 0

dns hits / 212.5.128/19 going wild
by JP Donnio 26 Apr '00

26 Apr '00

I am seeing a somewhat similar problem with my name server. It is configured not to recurse queries except for our network. Since I enabled this feature, I noticed we receive numerous requests from unauthorized hosts. It seems all the unauthorized queries are MX requests for AOL.COM. Here's a sample rejection log: 25-Apr-2000 12:21:48.647 security: unapproved recursive query from [212.5.135.39].2091 for aol.com and below the number of his for the last 4 days. Notice the 250,000 requests from 212.5.135.39 That's really abusive and I have blackholed 212.5.128/19 for the moment. 1424 192.92.129.3 1332 193.200.17.87 516 193.68.3.250 399 208.226.167.19 70 212.5.133.129 635 212.5.135.16 250292 212.5.135.39 57 212.5.139.65 1286 212.5.159.42 28 212.5.159.53 71 212.56.18.66 58 212.91.173.60 1992 63.192.247.53 Now I do not understand why we are getting those hits. Our nameserver (207.153.200.35) is not an aol.com secondary and has never been. Does anyone have a clue? JP

2 1

Re: Peering Table Question
by Danny McPherson 26 Apr '00

26 Apr '00

Intelligent aggregation techniques break MEDs and therefore introduce a need for advertisement of more-specifics in order to convey the optimal entry point into an AS. Then... Poor address allocation/aggregation models and broken IGP metric -> BGP MED associations, coupled with fear that the peer network will "leak the more specifics", make questionable the value of MEDs, especially for "well established TIER 1" providers with tons of legacy stuff or a really large customer base. -danny > or why dont you require both to peer in 4 - 6 places in the US and honor meds > both ways. This way, each is carrying traffic on their network. Of course the > bigger providers dont want this as they would lose losts of $$ from all the > payments they get for 'transit'.

1 0

More on Above.net
by Chris Brenton 26 Apr '00

26 Apr '00

Found this at: http://www.zdnet.com/zdnn/stories/news/0,4586,2555422,00.html?chkpt=zdhpnew… A couple of snippets taken out of context. Sounds like this can be fixed through a config change: The White Plains, N.Y.-based company is working with the FBI to investigate the attack, and declined to give more specific details. Vixie did say that tracking the attacker should not be as difficult as February's denial-of-service attacks had been. "Technically, there is cause for hope, where in the (denial of service) case their was no cause for hope," he said. This attacker seemed a bit more skilled than the cybervandals who flooded eight major Web sites in February, Vixie added. "I would bet that this was someone with a little more experience than the last batch." Vixie said that specific attack could not succeed again. "We plugged the hole that has allowed it to happen," he said.

1 0

Re: Peering Table Question
by Jeff Barrows 25 Apr '00

25 Apr '00

Sean - We sign and comply with mutual non-disclosure agreements that inhibit my ability to share that information with you. This is not a technical issue. I look forward to viewing your backhoe reports. - jsb -- Jeff Barrows Director, Internetwork Engineering UUNET, an MCI-Worldcom Company > Date: 19 Apr 2000 13:30:38 -0700 > From: Sean Donelan <sean(a)donelan.com> > To: nanog(a)merit.edu > Subject: Re: Peering Table Question > > On Wed, 19 April 2000, Jeff Barrows wrote: > > One shouldn't necessarily believe any third-party web > > pages, documents, articles, or verbal statements about > > which networks any given network is peered with. > > > > Though I have seen many articles, web pages, and other > > tables that detail which networks are 'peering,' I > > have never seen an accurate representation of this > > type of data from a third party. > > Then I hope you would step forward and show us the best practice > for making accurate information available about which networks > any given network peers with starting with yours. I look forward > to viewing the information about your network peering on your website > or IRR or whatever method you decide to use.

7 6

Who's next?
by Sean Donelan 25 Apr '00

25 Apr '00

Unless it was an operator or hardware error masquerading as an attack, the usual pattern is someone else will get hit fairly soon with the same attack. The operational question is there anything which can be learned from Above.net's experience so the impact on the next victim is less? The CNET article indicates Above.net believes the attack was something new, or at least something they had not seen before. Is each future company doomed to experience attacks before figuring out what to do to defend themselves?

1 0

Re: Above.net?
by Paul Vixie 25 Apr '00

25 Apr '00

> Anybody know what's up? There's definitely an issue. Details will be released when I know more. -- Paul Vixie <vixie(a)mibh.net> SVP for Internet Services, MFNX M.I.B.H. Inc. is a subsidiary of Metromedia Fiber Network, Inc.

4 3

Above.net?
by VIIS Network Operations Center 25 Apr '00

25 Apr '00

Anybody know what's going on with above.net? Several of our customers have email outsourcing provided by everyone.net, hosted at above.net. As of this email, everyone.net and above.net are not reachable from any of our locations, and haven't been for at least an hour. Anybody know what's up? Thanks! -- Grant A. Kirkwood - Vision Imaging Internet Services email: grant(a)viis.net web: http://www.viis.net/ voice: 1.909.793.4600 fax: 1.909.793.5600 "True power is knowing that you can, but you don't."

4 3