January 2001 - Test - lists.nanog.org

Re: How common is lack of DNS server diversity?
by Tony Rall 05 Feb '01

05 Feb '01

>Then it probably doesn't matter if you resolve their DNS, because you won't be >getting to any of their services anyway. Several folks have mentioned that they don't see a problem with dns failure caused by an inability to reach all of the nameservers for a domain - because presumably clients won't be able to reach any of the hosts in that domain. First, as we've seen demonstrated so clearly in the Microsoft case this week, nameserver unreachability does not always imply unreachability of the hosts in the domain. Second (and even if all of the hosts are truly unreachable), there is one somewhat important service that has a markedly different failure mode if the server appears to not exist - email (smtp). Folks sending mail to a domain that doesn't resolve usually get an immediate "delivery failure" response. But those sending to a resolvable domain when the target mail server is simply unreachable get their mail queued. It will typically get retried by the mail system for a few days. Only after such a long outage of the target will a delivery failure occur. (One somewhat ugly side effect of the dns outage is that some mailing lists will remove the user from their list when a delivery failure occurs. Not good to have to explain this to your users.) I lived through both situations (dns plus entire domain unreachable, and the domain unreachable but dns still works); I much prefer the results with a diverse dns setup. Tony Rall

5 5

RE: How common is lack of DNS server diversity?
by Roeland Meyer 05 Feb '01

05 Feb '01

> From: Adam McKenna [mailto:adam@flounder.net] > Sent: Saturday, January 27, 2001 4:09 PM > On Sat, Jan 27, 2001 at 03:23:08PM -0800, Roeland Meyer wrote: > > You obviously don't understand the difference between "concept" and > > "definition". > > > > www.open-rsc.org > > www.dnso.net > > www.icann.org > > www.dnso.org > > Very interesting.. I can also add www.pacificroot.com www.atlanticroot.com www.irsc.com and a whole bunch of others... > http://www.dnso.org/constituency/gtld/gtld.html: > > : Root servers. > : The list of 13 current root servers > : ftp://ftp.rs.internic.net/domain/named.root > : The map of 13 current root servers > : http://www.wia.org/pub/rootserv.html > : IAB Technical Comment on the Unique DNS Root > : http://www.isi.edu/in-notes/rfc2826.txt > > http://www.icann.org/committees/dns-root/y2k-statement.htm You can selectively look at anything you want. All sites had both pro and con positions. > I can't find anything that supports your comments at > open-rsc.org, and I'm > going to assume that you threw in dnso.net as a joke, since > a) you own the domain I figured that you were adult enough to make up your own mind. However, your constant string of personal insults seems to contradict such evaluation. As difficult as you try and make it, I am trying to remain neutral here. -=- Personal insults fm Adam McKenna 5, slightly over 1 per message Personal insults fm Roeland Meyer 0

5 4

Network Solutions Bilking ex-customers
by Daniel Senie 03 Feb '01

03 Feb '01

For those who haven't already seen this, Network Solutions is sending "FINAL NOTICE" bills to domain holders who've transferred their names to other registrars. Many people get nervious when they receive something which looks official and says "your domain name will be repossessed" or something like that. I have been advising clients to file complaints with the Federal Trade Commission. This is a flagrant attempt to bilk end users. It is unclear if those who DO pay wind up getting their domains transferred back to Network Solutions, or if they just pocket the money. Anyone from the press who wants some choice quotes from me on this matter, feel free to contact me. -- ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com

6 6

RE: More 6509 problems...
by Danny Snyder 03 Feb '01

03 Feb '01

Ya got me on that one....Cisco didn't really say why and I didn't think to ask them either.... --Danny -----Original Message----- From: Kenny Sallee [mailto:k_sallee@yahoo.com] Sent: Tuesday, January 30, 2001 11:28 AM To: agudgeon(a)firstnet.co.uk; 'Danny Snyder' Cc: nanog(a)merit.edu Subject: Re: More 6509 problems... How would CEF cause an interface to be up/down? Just curious....Kenny ----- Original Message ----- From: "Alison Gudgeon" <agudgeon(a)firstnet.co.uk> To: "'Danny Snyder'" <dsnyder(a)nowdocs.com>; <nanog(a)merit.edu> Sent: Tuesday, January 30, 2001 8:36 AM Subject: RE: More 6509 problems... > > Hi > > Hybrid IOS > > I've got IP CEF DISTRIBUTED set globally. Did you have it enabled or > disabled on the T3 interface? > > Ali > > -----Original Message----- > From: Danny Snyder [mailto:dsnyder@nowdocs.com] > Sent: 30 January 2001 16:21 > To: agudgeon(a)firstnet.co.uk; nanog(a)merit.edu > Subject: RE: More 6509 problems... > > > Alison, > > I've had VERY similar problems with a 6509 (Sup 1a + MSFC2) with a FlexWAN > and a PA-2T3+. After spending the better part of two weeks on the phone > with Cisco, we finally determined that ip cef distributed needed to be > turned on in global configuration. > > Also, are you running native IOS or Catalyst OS on the Supervisor and IOS on > the MSFC ? > > Danny Snyder > Network Administrator > NowDocs, Inc. > > > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Alison Gudgeon > Sent: Tuesday, January 30, 2001 10:18 AM > To: nanog(a)merit.edu > Subject: More 6509 problems... > > > > Hi, > > Is anyone doing the following: > > 6509 (supervisor 1a + msfc) - with a flexWAN adapter to take a Packet Over > Sonet OC-3 card. > > I'm having great problems getting up/up on the interface, the current > situation is up/down, a hardware loop at the telco kit brings the line up/up > but otherwise just up/down. Config is default I've just put IP's on. > > I'm running very new code - 12.1(4)E1 > > many thanks in advance for any help. > > > Kind Regards > > > Alison > >

3 5

Re: Operate until failure
by Sean Donelan 03 Feb '01

03 Feb '01

On Mon, 08 January 2001, Henry Yen wrote: > And if you are running a late-model linux (preferably RedHat), you can > download APC's own "award-winning PowerChute Plus" software for linux from > their website. It seems to be identical to PowerChutePlus running on > any other platforms, except that the interface is through X86. And what if you are not using APCs? One issue with highly redudandent data centers is the failure modes are "interesting." You don't want to shutdown due to a single UPS failure, so you don't use something simple like PowerChute Plus. You most likely don't want to shutdown based on any automatic signal. However, you do want a way for an operator to gracefully shutdown a lot of equipment quickly when the decision is made. For a server farm, with potentially thousands of individual systems, is there any standard piece of software you can install on all of the systems to act as a receiver of a signal to begin a graceful shutdown that does not depend on a vendor's proprietary interface? Preferabally one which does not involve running a lot of additional wires. I know, everyone says their systems will never fail. Think of this as the "else" statement for the condition which will never happen. Again this is only needed if people want a gracefull shutdown. If you can live with a hard shutdown, you wouldn't require this. If you use ctrl-alt-del as a normal management practice, I suspect you don't really require a graceful shutdown.

8 7

Quasi-operational re. Exim
by Steve Sobol 02 Feb '01

02 Feb '01

In light of the recent thread about a carrier-class mail server, and since I don't have the address of the mailing list mentioned there, I was wondering how people felt about Exim. I apologize in advance to those NANOG readers who are going to yell at me about operational content, but I couldn't come up with a better mailing list to send this to. I've installed Exim. I like what I've seen so far. Robust, lots of features... and I was mightily impressed when my out-of-the-box RPM installation passed all of abuse.net's spam relay tests. So... Can Exim handle large queues, and delivery to tens of thousands of mailboxes? (I'm not at the point where I'd need that kind of scalability yet, but I don't want to have to switch mail servers any time soon.) -- Steve Sobol, BOFH, President 888.480.4NET 866.DSL.EXPRESS 216.619.2NET North Shore Technologies Corporation http://NorthShoreTechnologies.net JustTheNet/JustTheNet EXPRESS DSL (ISP Services) http://JustThe.net mailto:sjsobol@NorthShoreTechnologies.net Proud resident of Cleveland, OH

2 1

Not a good day now stuff from here is on BBC
by Henry R. Linneweh 02 Feb '01

02 Feb '01

Major net security holes identified http://news.bbc.co.uk/hi/english/sci/tech/newsid_1142000/1142572.stm -- Thank you; |--------------------------------| | Thinking is a learned process. | | ICANN member @large | | Gigabit over IP, ieee 802.17 | | working group | | Resilient Packet Transport | |--------------------------------| Henry R. Linneweh

8 8

Scalable Mail solution with NAS
by Patrick Hollowell 01 Feb '01

01 Feb '01

My company is in the process of evaluating several mail solutions, scalable to 150k to 200k mailboxes. One thing we'd like to do is run the message store over Gig-E on network attached storage. Two of the vendors we've been looking at claim performance issues running this solution over NFS. Does anyone know of a carrier-class mail solution that will run well on NAS? Patrick Hollowell Sr. Network Engineer CTC Internet Services phollowell(a)vnet.net 800-377-3282 x3527

14 15

Re: sorry to ruin several of your evenings...
by Paul Vixie 01 Feb '01

01 Feb '01

vince(a)penguin-power.com ("Vincent Power") writes: > the only thing that I had to do when upgrading between 8.x and 9.x was at > add $TTL line to the top of every zone file. BIND 8.2.3 makes you do that, too.

13 18

Wierd portscans
by Elric 01 Feb '01

01 Feb '01

I've been going though my scanlogs and in the past couple of days I have seen someone trying to come in. Thier not getting in but im noticing them hitting a number of ports over and over. Primarily attempting udp port 0, but also 35072, 41612, and 63240. I've done searches on Google, Dejanews, Bugtraq etc but can't seem to find out what these ports are. Just wondering if anyone had come across them ever.... - Elric -------------------------------------------------------------------------- Network Administrator Dierking Scott Enterprises --------------------------------------------------------------------------

2 1