February 2001 - Test - lists.nanog.org

RTR with a Cisco router
by Rick Smith 06 Feb '01

06 Feb '01

Hi All, This is a quick mail and my apologies for interrupting people at work, I am curious to see if any one is using the RTR commands with in a Cisco IOS, I ask because we may look to incorporate the command to test across our core network, (currently 6509 OSR's) then look to use these results as a base line within HPOV. This would (I think) provide us with a base line indication and also a rtt that we can 'show' to clients. any comments or advice would be welcome as always, thanks Richard Smith Firstnet Leeds email: rsmith(a)firstnet.co.uk **************************************************************************** ****** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. The views expressed in the email and files transmitted with it are those of the individual, not the company. If you have received this email in error please notify rsmith(a)firstnet.co.uk ******************************************** **************************************

1 0

NetSaint
by Andy Grosser 06 Feb '01

06 Feb '01

Hi there, Anyone out there evaluated or implemented NetSaint? On how large a network? Comments? Please reply off-list. Thanks. --- Andy Grosser andy(a)conrad.harvard.edu (The above comments are my own; Harvard University claims no responsibility for them.) ---

1 0

California Seizes Power Contracts
by Henry R. Linneweh 06 Feb '01

06 Feb '01

http://dailynews.yahoo.com/h/nm/20010205/bs/utilities_california_dc_14.html -- Thank you; |--------------------------------| | Thinking is a learned process. | | ICANN member @large | | Gigabit over IP, ieee 802.17 | | working group | | Resilient Packet Transport | |--------------------------------| Henry R. Linneweh

4 3

PhoenixDSL/Telocity/Megapath
by Robert L. Harris 05 Feb '01

05 Feb '01

Just got some news that in a neat twist of sales between PheonixDSL, Telocity and Megapath, anyone originally on Pheonix's line will be without support. A friend of mine in the mean time tried to hook up a new firewall and can't get past his gateway, but can ping the gateway. The windows box originally installed works fine though. Someone at Level 1 customer support says "yeah something's wrong" and he won't be able to do anything until he gets a new Telocity DSL router for his DSL. This of course will take 3 weeks to ship. This sound normal? Does the person on the other end of the phone have a clue? (i.e. Anyone at Telocity/Megapath know the truth of what's going on with them? ) I have some customers using them for small businesses. No, cablemodems and other dsl systems aren't available where he is right now. Robert :wq! --------------------------------------------------------------------------- Robert L. Harris | Micros~1 : Senior System Engineer | For when quality, reliability at RnD Consulting | and security just aren't \_ that important! DISCLAIMER: These are MY OPINIONS ALONE. I speak for no-one else. FYI: perl -e 'print $i=pack(c5,(41*2),sqrt(7056),(unpack(c,H)-2),oct(115),10);'

4 6

Re: upstream scanning - upstream filtering
by Roger Marquis 05 Feb '01

05 Feb '01

"Henry R. Linneweh" <linneweh(a)concentric.net> wrote: > The reason above.net is not allowing Orbs to scan is because the owner > of Orbs wants to scan every domain in the world for open relays The logic of this escapes me. So ORBS scans for open relays. Their goals are no different from Above.net's scanning for vulnerable nameservers. The only fundamental differences are that Above.net is probing their own customers and using a different TCP/UDP port. If Above.net wants to filter scans that's one thing but they could have started better by filtering some of the many netscans we see from .kr and .cn subnets. I have no problem being scanned by either ORBS or Above.net. I do have a problem with upstream port filtering without my knowledge or express permission. One reason Above.net might block ORBS probably has not been discussed on NANOG. ORBS competes directly with RBL/DUL/RSS/mail-abuse.org. RBL and Above.net share management. Above.net's filters, it would seem, are the result of a business decision whose goal has less to do with customer safety than with inhibiting competition. With the exception of ORBS filtering both Above.net and ISC are doing a great job. Here's hoping Above.net takes the opportunity to improve by adopting more consistent policies on scanning and filtering. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

2 1

Re: How common is lack of DNS server diversity?
by Tony Rall 05 Feb '01

05 Feb '01

>Then it probably doesn't matter if you resolve their DNS, because you won't be >getting to any of their services anyway. Several folks have mentioned that they don't see a problem with dns failure caused by an inability to reach all of the nameservers for a domain - because presumably clients won't be able to reach any of the hosts in that domain. First, as we've seen demonstrated so clearly in the Microsoft case this week, nameserver unreachability does not always imply unreachability of the hosts in the domain. Second (and even if all of the hosts are truly unreachable), there is one somewhat important service that has a markedly different failure mode if the server appears to not exist - email (smtp). Folks sending mail to a domain that doesn't resolve usually get an immediate "delivery failure" response. But those sending to a resolvable domain when the target mail server is simply unreachable get their mail queued. It will typically get retried by the mail system for a few days. Only after such a long outage of the target will a delivery failure occur. (One somewhat ugly side effect of the dns outage is that some mailing lists will remove the user from their list when a delivery failure occurs. Not good to have to explain this to your users.) I lived through both situations (dns plus entire domain unreachable, and the domain unreachable but dns still works); I much prefer the results with a diverse dns setup. Tony Rall

5 5

Videotron peering contact
by Jason Lixfeld 05 Feb '01

05 Feb '01

If anyone here is, or knows who the peering contact is for Videotron in Montreal, please drop me a note. Thx in advance! Regards, -- Jason A. Lixfeld Senior Network Engineer Look Communications Inc. -- jlixfeld(a)team.look.ca .

1 0

Re: Reasons why BIND isn't being upgraded
by Paul Vixie 05 Feb '01

05 Feb '01

Simon(a)wretched.demon.co.uk (Simon Waters) writes: > The ISC.ORG web site recommends leaving the BIND version string > unchanged to assist in troubleshooting. > > I remain unconvinced that showing the version string helps much. it helped you with your survey, didn't it? hiding it doesn't help at all. people who want to know if you're vulnerable and to what have tools to find out. hiding it DOES however make it harder for people (including network owners) to do surveys. until, that is, somebody breaks into a server using some published hole and then modifies the version string so the admin's periodic audit won't show it as needing to be upgraded. so -- don't believe it if it says you're safe, use indications of unsafety as reasons to prioritize those servers for a closer audit.

16 21

RE: How common is lack of DNS server diversity?
by Roeland Meyer 05 Feb '01

05 Feb '01

> From: Adam McKenna [mailto:adam@flounder.net] > Sent: Saturday, January 27, 2001 4:09 PM > On Sat, Jan 27, 2001 at 03:23:08PM -0800, Roeland Meyer wrote: > > You obviously don't understand the difference between "concept" and > > "definition". > > > > www.open-rsc.org > > www.dnso.net > > www.icann.org > > www.dnso.org > > Very interesting.. I can also add www.pacificroot.com www.atlanticroot.com www.irsc.com and a whole bunch of others... > http://www.dnso.org/constituency/gtld/gtld.html: > > : Root servers. > : The list of 13 current root servers > : ftp://ftp.rs.internic.net/domain/named.root > : The map of 13 current root servers > : http://www.wia.org/pub/rootserv.html > : IAB Technical Comment on the Unique DNS Root > : http://www.isi.edu/in-notes/rfc2826.txt > > http://www.icann.org/committees/dns-root/y2k-statement.htm You can selectively look at anything you want. All sites had both pro and con positions. > I can't find anything that supports your comments at > open-rsc.org, and I'm > going to assume that you threw in dnso.net as a joke, since > a) you own the domain I figured that you were adult enough to make up your own mind. However, your constant string of personal insults seems to contradict such evaluation. As difficult as you try and make it, I am trying to remain neutral here. -=- Personal insults fm Adam McKenna 5, slightly over 1 per message Personal insults fm Roeland Meyer 0

5 4

RE: Vixie doing his part to make people upgrade (was:Re: Reasons why BIND isn't being upgraded)
by Roeland Meyer 05 Feb '01

05 Feb '01

> No need to continue this thread, I think everybody knows > where everybody > stands on the ORBS issue. Thank you.

1 0