May 2000 - Test - lists.nanog.org

Anyone from 360.net?
by Andrew Silva 21 May '00

21 May '00

Would an engineer or other technical person from 360.net please contact me privately? I am having little luck getting responses from the aliases on the web site. TIA, Andy __________________________________________________ Do You Yahoo!? Send instant messages & get email alerts with Yahoo! Messenger. http://im.yahoo.com/

4 3

ELI/GBLX Peering
by Jeffrey Meltzer 21 May '00

21 May '00

Anybody else see any problems between Electric Lightwave and Global Crossings? ELI NOC says they don't know of any problems, but anytime I try and get through globix to ELI, my traceroutes bomb (of course it could be because of an access list)...I bomb out at gw-eli.PAO.gblx.net Jeff -- Jeffrey Meltzer, Sr. Network Administrator VillageWorld.com, Inc. P 631.218.9090 F 631.218.0769 620-1B Johnson Ave, Bohemia, NY 11716

1 1

Re: Class B Address
by Sean Donelan 21 May '00

21 May '00

On Sat, 20 May 2000, Patrick Evans wrote: > And then watch certain tier-Ns filter out your routes? As far as I know, every provider has relented and will accept announcements on ARIN/RIPE/APNIC allocation bounderies. Even the original Sprint access-list 112 was modified to match the allocations. The problem was people wanted to announce smaller blocks than the allocation, e.g. /24's out of traditional class B/16 space.

2 1

Re: Time line for love bug alerts
by Sean Donelan 21 May '00

21 May '00

Due to some timezone problems, and machines with bad clocks, things aren't always what they seemed. In particular Bugtraq's extremely early alert appears to be a bad clock. I believe this is the actual order of alerts. I can't verify the Financial Services Information Sharing Alert, but this is the time given in the congressional hearing. Some folks sent me internal company alerts which were earlier, in some cases much earlier. A Swiss bank issued an intra-company alert very early. I suppose I wasn't clear, my interest was only "public," or at least semi-public alerts such as the FS/ISAC. So I've left private alerts out of the list, except for the intra-government ones discussed at the Senate hearing. One intersting thing came out during the Senate hearing. Things really haven't changed that much since the Internet Worm in 1988. People turned off their Internet connection which also kept them from getting the "cure." On the other side, out-of-date contact information and lack of an out-of-band method to alert people meant many didn't receive the alert because their e-mail systems had already been filled by the bug. 4-May-2000 07:00 UTC Financial Services Information Sharing and Analysis Center (FS/ISAC) Alert (unverified), it remains unclear to me who FS/ISAC alerted, e.g. only its 22 member companies or others 4-May-2000 08:57 UTC alt.comp.virus posting from the UK 4-May-2000 09:45 UTC FBI/NIPC Watch Center notified by a representative from private industry 4-May-2000 10:17 UTC NANOG posting from BBC in UK 4-May-2000 10:40 UTC Department of Defense Joint Task Force for Computer Network Defense (JTF-CND) first alerted by a unit 4-May-2000 11:18 UTC Telecommunications Information Sharing and Analysis Center (T/ISAC) notified by a carrier, I have found no information T/ISAC notified any of its members 4-May-2000 11:44 UTC JTF-CND begins to notify DOD components 4-May-2000 11:45 UTC NIPC notifies FedCIRC about virus 4-May-2000 11:45 UTC FedCIRC begins to notify federal agencies 4-May-2000 12:54 UTC AP news story (Hong Kong) 4-May-2000 13:17 UTC Reuters news story(London) 4-May-2000 13:30 UTC ZDNet news story 4-May-2000 13:31 UTC F-Secure press release 4-May-2000 14:30 UTC CERT/CC public alert 4-May-2000 14:38 UTC Symantec press release 4-May-2000 15:00 UTC FBI/NIPC first public alert 4-May-2000 15:05 UTC Computer Associates press release 4-May-2000 16:19 UTC Trend Micro press release 4-May-2000 16:56 UTC Bugtraq posting

1 0

First Internet outage reported
by Sean Donelan 21 May '00

21 May '00

Traditional carriers have not treated Internet affecting outages as reportable events. Local, long-distance, 9-1-1, SS7 are typical services listed on the FCC outage reports. I believe GlobalCrossing's FCC outage report is one of the first, if not the first, to list the Internet as the service affected by a carrier outage. http://www.fcc.gov/Bureaus/Engineering_Technology/Filings/Network_Outage/20…

1 0

Re: Class B Address
by Sean Donelan 20 May '00

20 May '00

On Sat, 20 May 2000, "HANSEN CHAN" wrote: > Can someone point me to some documents/weblink on how many class B > addresses are still available? Have the registries like RIPE/ARIN/APRIN > exhausted class B addresses already? IPv6 Forum presentations have me > believed class B addresses are exhausted and the situation is especially > bad for country like China. However, after checking with some Chinese I > was told just the opposite. So I am wondering is address scarcity just a > hype? My question is what is your requirement for a "classfull" address? With CIDR you can create the same number of addresses out of any of the traditional Class A, B, or C areas. There are plenty of /16 address blocks available. I have no idea of any need a country such as China has which couldn't be satisfied by using /16 CIDR blocks. If you stop thinking in terms of traditional classfull address blocks, I think you find much of the "scarcity" goes away.

2 1

UU-Net outage in Santa Clara
by Zaid Ali 20 May '00

20 May '00

I called the UU-Net NOC as one of my pipes is down.. there is no reachability to 660.hssi2-0-0.gw2.scl1.alter.net . I detected the downtime from 3:34pm. Zaid ------------------------------------------ Zaid Ali Network Architect WebEx 110 Rose Orchard Way San Jose, CA 95134 Tel: 408-435-7251 fax: 408-435-7004 www.webex.com ----------------------------------------

2 1

Re: New Internet-draft on DDOS defense...
by Richard Steenbergen 19 May '00

19 May '00

> The proposal suggests that hosts not respond to ICMP Echo broadcasts if > the source address is not within the same subnet as the workstation. > The rational is that even with "no ip directed-broadcast" (or it's > equivalent on non-Cisco routers), smurf attacks can still be launched by > a local machine on the local subnet (provided that there are no filters > in place to prevent forged source-addresses from that subnet). > > Such an attack would only be useful where the aggregate bandwidth to the > Internet from the subnet of the compromised host is signifigantly larger > than the aggregate bandwidth to the Internet from the compromised host > itself. In the traditional case of a simple shared media ethernet, this > is obviously not the case -- rather than launching a "local smurf" > attack to generate 10Mbps worth of flooding, the attacker could simply > have the local machine generate 10 Mbps worth of flooding. In modern > networks, a switch of some sort is likely to be involved, so there is > some potential for amplification. However, given that the individual > devices in such an environment are likely to be attached with a minimum > of 100 Mbps Ethernet (and, assuming they are running a reasonable IP > stack, they should then be able to generate a minimum of, say, 80Mbps of > flooding), the cases where a "local smurf" would be beneficial to an > attacker are limited to sites with switched ethernet and OC-3 or better > connectivity. Experience has shown that such sites are not generally > problematic smurf amplifiers. (OC-3 is actually just a low end number. > Given that any such site is likely to have a lot of other traffic > competing for bandwidth, I think 25% is a good high end number for > maximum amplication effect you'd get. You'll need OC-12 or higher for > any serious level of amplification.) An old idea... Its relatively easy to do this by spoofing the raw frames and making your own l2 broadcast. I can think of at least one major brand name colo provider with multiple customers on shared vlans where such an attack would be quite effective. I can think of others that actually have most of their switches on GigE uplinks and many customers sharing a vlan, where such an attack would be rather devestating. Then again any time you put multiple customers on a single layer 2 switch/vlan without doing some kind of l3 switching or vlan trunking and one vlan per customer you are asking for trouble (ip stealing, arp games, broadcast issues including these kind of attacks, etc).

1 0

Re: Anyone else having on and off problems with netscape.
by Rick Irving 19 May '00

19 May '00

> Yes. Service loads, but it's REALLY slow. But I don't think I would > classify it as a DNS problem. I would. :\ > > Using Dig: (What're you doing using NSlookup?! Shame on you! Plech!) > Heh. Would you feel better if I told you I started with a SIGINT to named, and a grep'd through the output ? :} However, I found the multiple response back from a single nslookup query interesting..... :O > [pbarber@host pbarber]$ dig home.netscape.com a > ; <<>> DiG 8.2 <<>> home.netscape.com a > ;; ANSWER SECTION: > home.netscape.com. 1m43s IN CNAME www-jp.netscape.com. > www-jp.netscape.com. 16m55s IN A 64.236.8.10 > [snip] Actually, one might note that this appears to be leaking in via central B'cast/UDP regions along the NAP's.... Someone Colo a Japanese nameserver in JAM Space , or optionally, a Japanese Root mirror ? At least one possible hypothesis ...... BTW: About a week here, as well... (not years, for -us- anyway) >

1 0

Anyone else having on and off problems with netscape.
by Rick Irving 19 May '00

19 May '00

Any else having on and off problem's with resolving home.netscape.com ? I am finding, upon occasion, that it resolves to a CNAME of www-jp.netscape.com instead of www-mv.netscape.com. The name servers differ as well.... Here are the results of one query, with diagnostics. > home.netscape.com. Server: noc.onecall.net Address: 0.0.0.0 ;; res_mkquery(0, home.netscape.com, 1, 2) ------------ Got answer: HEADER: opcode = QUERY, id = 18746, rcode = NOERROR header flags: response, auth. answer, want recursion, recursion avail. questions = 1, answers = 4, authority records = 1, additional = 3 QUESTIONS: home.netscape.com, type = NS, class = IN ANSWERS: -> home.netscape.com nameserver = tdns-me1.netscape.com ttl = 3600 (1H) -> home.netscape.com nameserver = tdns-me2.netscape.com ttl = 3600 (1H) -> home.netscape.com nameserver = tdns2.netscape.com ttl = 3600 (1H) -> home.netscape.com canonical name = www-mv.netscape.com ttl = 500 (8m20s) AUTHORITY RECORDS: -> netscape.com ttl = 3600 (1H) origin = ns.netscape.com mail addr = dnsmaster.netscape.com serial = 528144 refresh = 8600 (2h23m20s) retry = 900 (15M) expire = 604800 (1W) minimum ttl = 3600 (1H) ADDITIONAL RECORDS: -> tdns-me1.netscape.com internet address = 205.188.247.67 ttl = 3600 (1H) -> tdns-me2.netscape.com internet address = 205.188.247.68 ttl = 3600 (1H) -> tdns2.netscape.com internet address = 207.200.77.53 ttl = 3600 (1H) ------------ home.netscape.com nameserver = tdns-me1.netscape.com ttl = 3600 (1H) home.netscape.com nameserver = tdns-me2.netscape.com ttl = 3600 (1H) home.netscape.com nameserver = tdns2.netscape.com ttl = 3600 (1H) home.netscape.com canonical name = www-mv.netscape.com ttl = 500 (8m20s) netscape.com ttl = 3600 (1H) origin = ns.netscape.com mail addr = dnsmaster.netscape.com serial = 528144 refresh = 8600 (2h23m20s) retry = 900 (15M) expire = 604800 (1W) minimum ttl = 3600 (1H) tdns-me1.netscape.com internet address = 205.188.247.67 ttl = 3600 (1H) tdns-me2.netscape.com internet address = 205.188.247.68 ttl = 3600 (1H) tdns2.netscape.com internet address = 207.200.77.53 ttl = 3600 (1H) >

3 3