June 2001 - Test - lists.nanog.org

Re: Global BGP - 2001-06-23
by Sean Donelan 24 Jun '01

24 Jun '01

Yes, but I guess you'll have to wait for the official press announcement since everyone wants to keep what happened under NDAs. One way to sure-fire attract the attention of reporters is to claim something is a secret. Its like waving a red cape in front of a bull. Those that don't remember their history are doomed to repeat it. Anyone remember why NERC, NRIC and mandatory goverment reporting of outages in other industries came to be? On Sun, 24 June 2001, lucifer(a)lightbearer.com wrote: > Out of curiosity - did anyone see a duration of significanlt instability > in the global routing tables on Saturday afternoon? Without violating NDA, > all I can say is that it resembled a historic event involve a bad route, > Ciscos, and Bay routers (only this time, it was a bad route, Ciscos, and > <X> vendor whom I cannot name but is being soundly beaten with wet noodles > to resolve the issue). The bad route, and instability, were seen across > all of our transit vendors (all "household" names of transit service). > > Anyone else see this sort of event, or further details on the cause?

1 0

BGP announcements 'stuck' in route-reflector
by Pete Kruckenberg 24 Jun '01

24 Jun '01

I think this may be re-hash, apologies if so. Several people have told me Cisco IOS 'used' to have a well-known bug related to route-reflectors (clients), where they would ignore BGP withdraw messages and continue to announce routes (including full original AS path). I can duplicate this type of problem with one upstream provider (but not the other), I am trying to help them help me (as they seem to be somewhat at a stand-still resolving the problem). So far I've only gotten somewhat vague information, and haven't been able to find anything specific myself. Any pointers (Cisco bug ID, IOS releases with the problem and those that fixed it, etc) would be helpful. Thanks. Pete.

1 0

Re: Operational Content, I think...
by George William Herbert 24 Jun '01

24 Jun '01

There are plenty of things in the Grainger and similar catalogs. Get either the complete one, or the "Materials Handling" subset catalog. -george william herbert gherbert(a)retro.com

1 0

DDOS anecdotes
by smd＠clock.org 24 Jun '01

24 Jun '01

Some of you may find http://grc.com/dos/grcdos.htm very interesting. Sean.

15 24

Re: Operational Content, I think...
by prelude＠mindspring.com 24 Jun '01

24 Jun '01

I've used boxes as a brace, or mounted a shelf or another piece of equipment immediately below(or used already mounted equipment) to hold up stuff while I put down the screwdriver and slid it out. Most of the time i'm sure i've violated OSHA by doing it. This might be better answered on robbie's datacenter mailing list (datacenter(a)shorty.com) andrew still looking for a job deepak(a)ai.net wrote: > This comes up every now and then, and I still haven't seen a good solution, so here is the situation. Every now and then, the graveyard maintenance shift (read: few people) needs to mount a 7' tall or 600 lb piece of equipment we've all come to know and love in a rack. While pad jacks are available to move them around the datacenter floor, equipped with friendly hydraulics and all, there is a piece missing. Is there a common-sense piece of equipment available that 1 person can operate that will support a very bulky, rackmountable piece of equipment so the same, single person can mount/unmount it near the top of a rack? I have seen plenty of solutions for this on warehouse floors, but most datacenters don't have the ceiling height for track-crane. I don't know how people handle the 15' relay racks either now that I am sharing my gap in knowledge. Your advice, suggestions and even jokes are appreciated, but remember, I'm armed. :) Deepak

1 0

Re: BGP instability (was Re: Exodus Down)
by Andy Bradford 24 Jun '01

24 Jun '01

Thus said "Vivien M." on Sun, 24 Jun 2001 00:05:50 EDT: > > the following != "implies agreeing to an NDA" ?? > > 3. The information received via the list is considered > > confidential information, not to be reproduced in any form > > without prior written approval of Exodus. > > I hate to argue on NANOG about this, but #3 seems to me like it's an NDA > (although a rather informal one), for all intents and purposes. If they aren't encrypting the list traffic, then in reality, it isn't ``private'' or ``confidential'' email now is it? :-) Andy -- [-----------[system uptime]--------------------------------------------] 12:36pm up 46 days, 15:14, 7 users, load average: 1.25, 1.29, 1.24

1 0

BGP instability (was Re: Exodus Down)
by Sean Donelan 24 Jun '01

24 Jun '01

According to Exodus' trouble ticket it is a BGP instability between several locations in their network and with BGP customers. Whether it was a security issue, vendor bug or operator error hasn't been determined yet. Exodus customers should contact Exodus customer service for more information, reporters should contact Exodus media relations for more information. I don't know if Exodus will have any public statement. On Sat, 23 June 2001, "Richard A. Steenbergen" wrote: > On Sat, Jun 23, 2001 at 06:51:51PM -0400, mike harrison wrote: > > Maybe all this DDOS discussion is what killed Exodus? > > > > Websites and services all over the place seem to be down. > > Including my favorites like freshmeat, slashdot... > > and one of our e-commerce credit card processors: CyberSource > > > > The common route seems to take them into Exodus.net but not out again. > > > > Any idea whats up? > > Maybe they couldn't pay the bills and someone reposessed their routers? :P

7 8

RE: DDOS anecdotes
by Bohdan Tashchuk 24 Jun '01

24 Jun '01

> So what do we do about it? There are 10th of thousands of "0wned" machines > out there. 10.000 machines sending one SYN per second to somewhere > constitutes a 6mbit SYN flood that'll make almost any web server get into > trouble. 10 SYNs per second and we're really talking traffic here. From > spoofed sources because ISPs do not source address filter? Gah. Basically > untraceable. Wouldn't it be poetic justice if/when these "Owned" Windoze machines turn their attentions to www.microsoft.com? That would get Microsoft's attention. I don't care how big their pipes or how widely distributed their servers. A DDOS like this would be devastating.

2 1

Re: Exodus Down
by Dee McKinney 24 Jun '01

24 Jun '01

This from the SuSE Linux mail list may help :-) >>>>> Forwarded message from "Lewis E. Wolfgang" <wolfgang(a)nosc.mil> Something is definitely rotten here. Whois reports: Server Name: SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG IP Address: 24.240.60.16 Registrar: TUCOWS, INC. Whois Server: whois.opensrs.net Referral URL: http://www.opensrs.org Domain Name: SLASHDOT.ORG Registrar: NETWORK SOLUTIONS, INC. Whois Server: whois.networksolutions.com Referral URL: http://www.networksolutions.com Name Server: NS1.ANDOVER.NET Name Server: NS2.ANDOVER.NET Updated Date: 13-jun-2001 I've never seen whois report two registrars, especially one that says "SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG" I also noticed that traceroutes to both slashdot and freshmeat went through 64.14.80.154, then stopped at that point. I'd guess that some cracker broke something somewhere? Maybe a DNS crack? Maybe Andover went bankrupt and pulled the plug on us? Maybe Micro$oft is behind this? It sort of illustrates the hazards of having all the open-source eggs on one server farm.... Regards, Lew Wolfgang On Sat, 23 Jun 2001, ZephyrQ wrote: > > I've been trying all day to get my /. fix, as well as > Freshmeat! > > Did I miss an announcement? Or is there something else going > on? > >

6 5

peering requirements (Re: DDOS anecdotes)
by Paul Vixie 24 Jun '01

24 Jun '01

> ... but I do not blame their IP stack for this like Mr Gibson does though. Same here. > ... From spoofed sources because ISPs do not source address filter? > Gah. Basically untraceable. This is the problem. > What should we do? Recommendation: upgrade your peering requirements to include language like: Each peer agrees to emit only IP packets with accurate source addresses, to require their customers to do likewise, and to extend this requirement to all other peers by $DATE. Where DATE = (now() + '6 months') or some other negotiated value. I've been saying this since 1993. Is anybody ready to believe me yet? We solve this, or our industry stops growing because we're spending too much time dealing with this problem and new customers see diminished returns.

5 5