May 2001 - Test - lists.nanog.org

Re: heads up on 80/8 [actually operational, so don't read this!!!]
by smd＠clock.org 16 May '01

16 May '01

I wrote: > IRRs (RIPE, ARIN, APNIC) of course I meant RIR (regional internet registry) and not IRR (internet routing registry), however one might say that they have similar operational consequence. Sean.

1 0

RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by Roeland Meyer 15 May '01

15 May '01

> From: Adam McKenna [mailto:adam@flounder.net] > Sent: Sunday, May 13, 2001 10:06 PM > > Oracle (try and build a DB without reverse working right. > Net8 stops you > > dead in your tracks). > > Sorry, but this is just 100% wrong. I've set up Oracle on > many boxes and you > don't need any DNS at all to set up an oracle DB. In fact, I > tell our DBA's > to use IP addresses in their TNSNAMES.ORA files because I > don't want the DB > depending on DNS. Let's see, I don't want to make my DBs dependent on DNS, so I use IP addrs. Yet, I can't depend on IP addrs because my upstream might have to be changed... damn, I shouldn't have depended on my scumbag DSL upstream, eh? Gee, maybe I should have had a names based system after all? Either way, I wind up having to rebuild Oracle boxen and application servers, every time somebody farts. Just what in blue hell are we supposed to do? BTW, the last I checked SSL certs are usually names based. Pretty slack security, eh? This is right on up there with: 1) You idiot DSL monkey, you deserve your Inet death because you didn't multi-home. 2) No, you can't advertise less than a /20. 3) No, you don't deserve larger than a /32. 4) Yes, we know that makes multi-homing impossible for those that need it the most. 5) No, we don't care, you idiot DSL monkeys deserve Inet death. Yeah, the message you send out is real clear. ... and one wonders why the Internet has an implosion problem... -- Internet implosion at 10:00 ... special web report, at 11:00.

11 15

RE: Whois -a?
by John Murphy 15 May '01

15 May '01

Straight from the MAN page Roeland (man whois)... ... DESCRIPTION Whois looks up records in the databases maintained by several Network In- formation Centers (NICs). The options are as follows: -a Use the American Registry for Internet Numbers (ARIN) database. It contains network numbers used in those parts of the world cov- ered neither by APNIC nor by RIPE. Contact (handle) information should be looked up by appending "-ARIN" to the NIC handle: ... -----------------------Original Message----------------------- >From: Roeland Meyer >To: Vivien M.;nanog(a)nanog.org >Date: 5/15/01 5:16 AM >Subject: RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS > > >> From: Vivien M. [mailto:vivienm@dyndns.org] >> Sent: Monday, May 14, 2001 2:44 PM > >> As someone posted before (but you probably didn't read): > >Actually, I read it just fine. Yes, that is the block that is in use here. I >just don't know who the hell Alex Black is. I also asked SpeakEasy. Weeks >later, I'm still waiting for an answer. > >> vivienm@amethyst:~$ host www.mhsc.com >> www.mhsc.com is a nickname for vweb1.mhsc.com >> vweb1.mhsc.com has address 216.27.184.250 >> vivienm@amethyst:~$ whois -a 216.27.184.250 > >When did '-a' become a whois option? > >> Speakeasy Network (NETBLK-SPEAKEASY-4) SPEAKEASY-4 >> 216.27.128.0 - >> 216.27.191.255 >> Black, Alex (NETBLK-SPEK-RMEYER-0) SPEK-RMEYER-0 >> 216.27.184.224 - >> 216.27.184.255 > >> vivienm@amethyst:~$ whois -a \!NETBLK-SPEK-RMEYER-0 >> Black, Alex (NETBLK-SPEK-RMEYER-0) >> 440 Mission Court >> Fremont, CA 94539 >> US >> >> Netname: SPEK-RMEYER-0 >> Netblock: 216.27.184.224 - 216.27.184.255 >> >> Coordinator: >> Stollar, Andreas (AS3414-ARIN) abuse(a)speakeasy.net >> +1-206-728-9770 (FAX) (206)728-1500 > >> Now, I realize your name isn't Alex Black (unless you have multiple >> personalities), but it sure looks to me like SpeakEasy knows >> how to SWIP >> (and the SPEK-RMEYER-0 name suggests they were trying to SWIP >> it to you). > >Among other things, I'm also a SysAdmin. Of course, I have multiple >personalities! But, Alex Black isn't one of them. Also note, Andreas >Stoller's email addr. Do you actually think I would get any sort of response >if I sent an email there? I might as well send it to abuse(a)mhsc.net. He >probably uses the same bit-bucket that mhsc.net does (the /dev/null brand). > >

9 8

ICG Status
by David McGaugh 15 May '01

15 May '01

Anyone have any idea what's going on with ICG these days? I sent an e-mail to noc(a)noc.icg.com regarding their peering and received a response from mindspring.com... -Dave

5 5

Re: Whois -a?
by Richard A. Steenbergen 15 May '01

15 May '01

On Tue, May 15, 2001 at 03:47:01PM -0400, Steve Sobol wrote: > > Mathias Koerber wrote: > > > > > whois -a is most commonly seen on BSD systems, and is most definitely > > > > not available on every current UNIX. > > > > > > You can query any whois server with query@server > > > ie: 192.168.1.1(a)arin.net works. > > > > This too is dependent on your WHOIS client, and NOT available > > (by default) on all UNICES. > > fwhois uses whois@server, Whois Classic uses whois -h server Come on guys, what does this have to do with nanog. Please take the "how do I man whois" thread, the "we got screwed over by our incompetant dsl provider" thread, the "can someone help me find some bits in wisconsin" thread, and the "I can't figure out how noc@ or peering@ works" thread and CEASE AND DESIST while there is still SOME hope of content making this list worthy of reading. If you have a complaint about your DSL provider, TELL IT TO SOMEONE WHO CARES, or maybe (*gasp* here's a thought) vote with your wallet. Please, can we just STOP replying to these threads? I know 5 other people made this request when they first started, but perhaps they were too nice about it because it is still going on. When your nanog-reading experience consists of 95% D)elete something is wrong. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Re: 2 Wire T1 - HDLC
by Jared Mauch 15 May '01

15 May '01

I should have mentioned that i'm in MI/Ameritech - Jared On Tue, May 15, 2001 at 02:27:47PM -0400, Joe Barnhart wrote: > > I actually have one to my home delivered as a single pair. > > JB > > On Tue, 15 May 2001, Jared Mauch wrote: > > > > > I have 2 T1's that are delivered as a single pair per T1. > > > > - Jared > > > > On Mon, May 14, 2001 at 05:41:01PM -0400, mike harrison wrote: > > > > > > John Tamplin: > > > > the smartjack extracts the T1 -- I have two of these in my house, using > > > > Pairgain (now ADC)'s HiGain Solitaire H2TU.R402 for T1 transport. The URL > > > > of the frame describing the product line is at (minus any line breaks or > > > > spaces added along the way): > > > > http://www6.adc.com/ecom/wps?lineid=OND2737&group=T1%2bTransport%252FHiGain… > > > > This specific card is under HDSL2 RT Modules. > > > > > > Thats the units we have on the wall for some recent T1 installs as well. > > > So far working very well.. Yes, it is HDSL, It's not 2 x 786K sDSL or > > > whatever as stated in the original posted email that I responded to. > > > > > > Whats funny is I got 2 private emails from BellSouth engineering types > > > that did not know they were being installed in this region. > > > > > > > > > > > > > > > > > > > > > > > > > -- > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > > > > ------------------------- > Joseph Barnhart > Florida Digital Turnpike > Network Administrator > http://www.fdt.net > ------------------------- -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

Re: looking for some bits in SE wisconsin
by Casey Ransom 15 May '01

15 May '01

area code/phone number is 262 728 6464. ----- Original Message ----- From: "Philip Walenta" <pwalenta(a)emasterlink.com> To: "'Casey Ransom'" <ccransom(a)students.wisc.edu> Sent: Tuesday, May 15, 2001 12:38 PM Subject: RE: looking for some bits in SE wisconsin > What area code/office code will the pipe you're looking for be terminated? > > -----Original Message----- > From: Casey Ransom [mailto:ccransom@students.wisc.edu] > Sent: Tuesday, May 15, 2001 12:07 PM > To: nanog(a)nanog.org > Subject: looking for some bits in SE wisconsin > > > > Hi, I'm from Delavan, WI and was looking around for places to hook up with > bandwidth. I'm slightly inexperienced with large scale pipes, so I came > here for a hand. We don't have a very large operation, but need more than > dual channel isdn. The guy that referred me here just told me to say "HEY > IM FROM BUMFUCK WI AND IM LOOKING FOR BITS" (yeah, thanks ben). Anyway, any > help is appreciated.-- > > Casey Ransom > ccransom(a)students.wisc.edu > > > ps- don't say DSL >

1 0

looking for some bits in SE wisconsin
by Casey Ransom 15 May '01

15 May '01

Hi, I'm from Delavan, WI and was looking around for places to hook up with bandwidth. I'm slightly inexperienced with large scale pipes, so I came here for a hand. We don't have a very large operation, but need more than dual channel isdn. The guy that referred me here just told me to say "HEY IM FROM BUMFUCK WI AND IM LOOKING FOR BITS" (yeah, thanks ben). Anyway, any help is appreciated.-- Casey Ransom ccransom(a)students.wisc.edu ps- don't say DSL

1 0

Security practices
by Roeland Meyer 15 May '01

15 May '01

> From: Adam McKenna [mailto:adam@flounder.net] > Sent: Monday, May 14, 2001 11:18 PM > > On Mon, May 14, 2001 at 05:27:09PM -0400, Christopher A. > Woodfield wrote: > > > > I didn't intend to imply that matching forward/reverse DNS > was a security > > measure I'd trust by itself, but it certainly doesn't hurt > to implement as > > a "outer perimeter" measure in conjunction with IP-based rules and > > secure authentication... > > It does hurt. It causes non-obvious problems. Forcing > hostnames and PTR's > to match (commonly referred to as PARANOID checking) does not > provide extra > security, it just prevents people with badly configured DNS > from accessing > your servers. IOW, it lets lazy/incompetent ISPs and SysAdms get away with not being thourough. Actually, basic security isn't that bad, if you tighten up the ship such that, you are doing what you are supposed to be doing ...exactly... and no more. Cut out the slop and most things work better, with fewer holes. This is on the principle that memcpy, strcmp, and strcpy are the biggest (only?) security holes on the net (and why open-source is the only acceptable source of security related code). Reverse checks work if you run your own zone servers and control your own in-addr.arpa entries and they are all on the same LAN/net-block. Clone a [RFC 2870] root zone server into this and you are almost spoof proof. When accessing your own hosts, you shouldn't be going outside your LAN for any authentication or host reference data (the single reason spoofs work at all) nor should your packets leave your LAN.

1 0

re: in-addr survey
by ggm＠apnic.net 15 May '01

15 May '01

Hi. I'm new here, I hope I'm not in breach of AUP diving in. Some time ago (2-3 years?) I discussed how a large mirror site could use BGP information to modify common log format logging in apache to dump BGP source-AS information. The idea was to tag the logline with the AS of the neighbour of the ISP the mirror was hosted on, so the inbound path could be determined. Actually, the idea was to do the (much smaller than exhaustive IP) work to tag things in one of 3 or 4 classes which could be named: on-net # this ISP, or zero-cost equivalents domestic# at least I know its onshore offshore# came on a slow/long link Glenn (its aarnet) worked out a simple hack on Zebra to make this fly. I didn't deploy it, because first approximation the simple dumps of IP for on-net and domestic were enough to let me sinbin all the rest to offshore. Well, I thought so, but history proved me wrong. Anyway. My point is that BGP is your friend. It should be both cheap (as cheap as a routing lookup, which for an application writing a log to disk like apache is cheap, at least compared to DNS lookup) and very cacheable. Why don't more applications do this? Why is this not viable for implementing things like on/offshore applications policy, egregiously wrong though it may be from a libertarian aspect? cheers -George

2 1