June 2001 - Test - lists.nanog.org

Re: peering requirements (Re: DDOS anecdotes)
by Sean Donelan 24 Jun '01

24 Jun '01

On Sat, 23 June 2001, Simon Lyall wrote: > Another point, if people are going to have filters then they MUST have a > quick and easy way for this filters to be changed and to propogate > everywhere quickly. People who insist that you provide an exact list of > what you want to advertise (with the exact prefixes) and then take a week > to process any changes (or 12 hours for that matter) should have prices to > match their discount level of service. I hear there are these really cool things called routing registeries. They allow providers to register and change their routing policies. There are tools which have automated the process. With routing registries who can register one-way, two-way, backup, standby, etc routing policies which don't depend on the active announcement of a route in the BGP tables, but allow the network sourced traffic to flow. RIPE, ARIN and MERIT have more information. Ask your network provider to support routing registries.

1 0

RE: BGP instability (was Re: Exodus Down)
by Sean Donelan 23 Jun '01

23 Jun '01

On Sat, 23 June 2001, "Vivien M." wrote: > > According to Exodus' trouble ticket it is a BGP instability between > > several locations in their network and with BGP customers. > > Hmmmmm... You somehow found a way to get this information without agreeing > to the NDA? Impressive. (For the people around here who aren't Exodus > customers: subscribing to their network engineering/outage list > theoretically implies agreeing to an NDA, which is presumably why no one > here mentioned this) I'm not subscribed to Exodus's network engineering mailing list, nor have I agreed to a NDA with Exodus about their outage information. Trying to apply an NDA to outage information has always struck me as a bit stupid. After all, NDA or not, people know you had an outage, what they don't know is your explanation why it happened. As we've seen, when there is a lack of good information, people will make up stories to fit. AT&T, with over 100 years experience of handling outages, seems to have thought out their policy better than some of the newer communication companies. AT&T doesn't go out of its way to advertise problems, but as far as I can tell, AT&T doesn't try to prevent its customers from telling other people about their experience with AT&T, good or bad. Think of it like a movie studio who only lets movie critics who agree to write good things about their movie see the movie. Whether this is "the" problem affecting Slashdot, a contributing factor, or unrelated, I do not know. Verizon also had DACS problems in Boston affecting circuits in the area. I believe Slashdot is located in the Boston area. And, of course, Slashdot has problems on a regular basis even when the network is working.

1 0

Re: for folks tracking DDOS sources or reading the GRC attack log
by Richard A. Steenbergen 23 Jun '01

23 Jun '01

On Sat, Jun 23, 2001 at 10:18:10PM -0400, RJ Atkinson wrote: > > 24.0/8 is the "cable block". ARIN normally allocates residential > cable modem subnets out of this space. Nearly all the cable operators > have one slice or another from this block. Nearly all North American > cable modems users have address space in this block. Cable modems > themselves are nearly always numbered in 10.0/8. > > For those who have read the GRC web site, note that 216.216.8.x > appears not to be a cable modem slice in any event. ARIN reports > that this slice has been allocated to @Work, which is the commercial > IP lease-line business unit within Excite@Home. Presence of a > *.home.net DNS entry does not mean the system is on any cable modem > network. There are no 24.0/8 addresses listed in the log at > http://grc.com/dos/attacklog.htm > so it isn't clear to me that any cable modems were used in that > particular attack. AFAIK 24/8 is exausted. My cable modem is numbered out of 65.4.208.0/19, and the announcement for this block is 65.0.0.0/13. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Exploding manhole covers in Washington DC
by Sean Donelan 23 Jun '01

23 Jun '01

It was the hottest day so far this year in Washington DC, and once again PEPCO had a case of exploding manhole covers. A fire below 30th and M Street resulted in the loss of power in parts of Georgetown (Washington DC) June 13 2001 about 3:30pm EDT. Apparently the explosions made the news, and I had inquiries. As far as I can tell, it had no impact on the Internet. Most of the fiber carrying Internet traffic through Washington DC isn't on M Street.

3 2

Qwest.Net / US West.Net
by Andy Ellifson 23 Jun '01

23 Jun '01

Does anyone have an escalation number for the dial/DSL/ISDN platform for US West.net/Qwest.net? They have removed my static IP addresses and myself and my customers down. They claim they cannot do anything until Monday. This is unacceptable. Or is there any ISP in the Phoenix Metro area (480,623,602) that will allow me to pay them for a ISDN (2B channel) account with a static /28 for 2 weeks?... and get it setup today?? I'm in a bind right now. Thanks in advance, Andy Ellifson __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

3 2

Re: Exodus Down
by George William Herbert 23 Jun '01

23 Jun '01

>This from the SuSE Linux mail list may help :-) >>>>> Forwarded message from "Lewis E. Wolfgang" <wolfgang(a)nosc.mil> >Something is definitely rotten here. >Whois reports: > Server Name: SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG > IP Address: 24.240.60.16 > Registrar: TUCOWS, INC. > Whois Server: whois.opensrs.net > Referral URL: http://www.opensrs.org > > Domain Name: SLASHDOT.ORG > Registrar: NETWORK SOLUTIONS, INC. > Whois Server: whois.networksolutions.com > Referral URL: http://www.networksolutions.com > Name Server: NS1.ANDOVER.NET > Name Server: NS2.ANDOVER.NET > Updated Date: 13-jun-2001 > >I've never seen whois report two registrars, especially one that says >"SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG" There's nothing rotten there at all. People have had the ability to name their nameservers whatever they wanted for some time, as long as it was one of their TLDs. There have been quite a number of my.domain.rulez.your.domain.sux.dude.we.rule.daves.org type nameserver names for years. Whois is just reporting both matches (both things that contain slashdot.org in the domain or nameserver that are in the database). -george william herbert gherbert(a)retro.com

1 0

Re: Exodus Down
by Andy Bradford 23 Jun '01

23 Jun '01

Thus said mike harrison on Sat, 23 Jun 2001 18:51:51 EDT: > Websites and services all over the place seem to be down. I am not sure if this is related or not, but my pager has been ringing off the wall with various host unreachable or host down alerts (from netsaint). During this time, a traceroute from my DSL at home to where netsaint is running changed 4 times. It seems to have stabilized finally and the route has returned to normal, but every once in a while I get another page. > Including my favorites like freshmeat, slashdot... > and one of our e-commerce credit card processors: CyberSource I noticed this as well---actually it was a co-worker in slashdot withdrawals... :-) If anyone is interested in the traceroutes, I can make them available. Andy -- [-----------[system uptime]--------------------------------------------] 5:46pm up 45 days, 20:23, 7 users, load average: 1.07, 1.08, 1.07

1 0

Re: Exodus Down
by Richard A. Steenbergen 23 Jun '01

23 Jun '01

On Sat, Jun 23, 2001 at 06:51:51PM -0400, mike harrison wrote: > > Maybe all this DDOS discussion is what killed Exodus? > > Websites and services all over the place seem to be down. > Including my favorites like freshmeat, slashdot... > and one of our e-commerce credit card processors: CyberSource > > The common route seems to take them into Exodus.net but not out again. > > Any idea whats up? Maybe they couldn't pay the bills and someone reposessed their routers? :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

RE: DDOS anecdotes
by Tim Devries 23 Jun '01

23 Jun '01

-----Original Message----- From: Mikael Abrahamsson [mailto:swmike@swm.pp.se] Sent: Saturday, June 23, 2001 4:16 PM To: 'nanog(a)merit.edu' Subject: RE: DDOS anecdotes On Sat, 23 Jun 2001, Tim Devries wrote: > FYI beware of service pack 2. It sets the DF bit so packets cannot > fragment. Particularily offensive if your server is on the other side of a > tunnel (due to the overhead). The solution is to reduce the MTU on the box. > Or use a different OS :) >I thought this was standard behaviour of Microsoft OSes since at least >Win95. I know NT does this as standard, so does Win95 and 98. Win2k does >this standard out of the box (at least last time I checked). I have tested it with sp1 and this behaviour does not occur. I have not tested it without any serverice packs so you may be correct in that regard. Tim Devries Technical Trainer Q9 Networks 100% Uptime

1 0

RE: DDOS anecdotes
by Tim Devries 23 Jun '01

23 Jun '01

-----Original Message----- From: woods(a)weird.com [mailto:woods@weird.com] Sent: Saturday, June 23, 2001 3:56 PM To: nanog(a)merit.edu Subject: RE: DDOS anecdotes [ On Saturday, June 23, 2001 at 20:04:06 (+0200), Mikael Abrahamsson wrote: ] > Subject: RE: DDOS anecdotes > > This is a real problem. It's not FUD. Microsofts choice to include full > IP stack capabilities will make the problem worse, but I do not blame > their IP stack for this like Mr Gibson does though. >No, their stack's not the root of the problem -- all the rest of their >OS is (and of course in particular the security model, or lack thereof). FYI beware of service pack 2. It sets the DF bit so packets cannot fragment. Particularily offensive if your server is on the other side of a tunnel (due to the overhead). The solution is to reduce the MTU on the box. Or use a different OS :) Greg A. Woods +1 416 218-0098 VE3TCP <gwoods(a)acm.org> <woods(a)robohack.ca> Planix, Inc. <woods(a)planix.com>; Secrets of the Weird <woods(a)weird.com>

2 1