October 2002 - Test - lists.nanog.org

Toolmakers BOF in Eugene
by Joe Abley 02 Oct '02

02 Oct '02

Hi, We're trying to assemble a small herd of script hackers in Eugene in the form of a BOF. If anybody has interesting tools they use to wrangle routers (or interesting problems that can currently only be solved by hand, for which automated solutions would be useful), want to drop me a line and tell me about them? Maybe I can spot some common requests and match them up with some neat solutions, and give the BOF a little kick start. [Note! this is not a sales forum for anybody selling network management software. People selling management software are overwhelmingly welcome to come along and listen, though, if they want to find out how people use software to manage networks in real life] Replies off-list would be good. Thanks :) http://www.nanog.org/mtg-0210/ableybof.html > The software engineering process lends itself well to large, > well-managed, multi-disciplinary teams producing well-defined products > in response to detailed requirements analysis. As much fun as that > sounds, sometimes what you really need is a short and simple answer to a > short and simple question, preferably now. > > The business of daily operations at almost every service provider > depends on the existence of a herd of small, single-use scripts designed > to emulate in a few seconds work that a human operator might take a > couple of hours to do. The focus of these tools is usefulness in the > hands of a network operator over engineering purity or elegance in > design. > > Questions that are readily answered by the judicious application of a > small pile of scripts include: > > # What BGP sessions have gone down in the last hour? > # What routers rebooted in the last five minutes? > # What filters are defined, but not used? > # What filters are used, but not defined? > # What interfaces have been admin shutdown for over a month? > # Who just tripped their maximum-prefix limits? > > This BOF is a place for toolmakers to meet other toolmakers, and to > exchange ideas, code, and horror stories.

1 0

NANOG 26 Misc.
by Carol Wadsworth 02 Oct '02

02 Oct '02

For those of you registered to attend NANOG 26 in Eugene, Oregon, please note the following upcoming deadlines: October 5 -- hotel room block rate expires http://www.nanog.org/mtg-0210/hotel.html October 11 -- registration fee due To check your payment status see: http://www.nanog.org/mtg-0210/attendee.list.html For additional meeting information, please see: Presentation Topics: http://www.nanog.org/mtg-0210/topics.html Registration: https://www.merit.edu/nanog/registration.form.html Meeting Info: http://www.nanog.org/mtg-0210/index.html Hope to see you there!

1 0

Bob on SPAM
by Bob Martinez 02 Oct '02

02 Oct '02

NANOG: Since Ethernet strings die, I give you my opinion of how to stop SPAM. We shall let Ethernet defend for itself for now. It is doing fine w/o my help. Mail Adminstrators need to have peering policies. Traffic Adminstrators need to have traffic policies. Processes beget policies. These policies need to be enforced by protocols. If two peers are authenticated as valid communications agents by the mail transfer protocol, they should be given a higher thread of priority than random email by someone telneting to the server (ex.). As with PIM Snooping, Ethernet based networks can easily snoop this activity (authenticated traffic) and deny it at wirespeed as close the source as you dare go (domain). These service could easily be positioned in the core if you are already pumping the packets to an FPGA. Going to an ASIC may be a bit more difficult. 10G is an FPGA. Bobby _________________________________________________________________ Join the worlds largest e-mail service with MSN Hotmail. http://www.hotmail.com

2 1

Re: Re: Root DNS Server Issues?
by John Neiberger 01 Oct '02

01 Oct '02

We're getting responses from the root servers, the names just aren't resolving. From a windows NT machine the error is "Non- existent Domain". Ah, I just noticed something. The packet length for the DNS response is supposed to be 510 bytes but it's being truncated to 128. What the heck would cause that?? John ---- On Tue, 1 Oct 2002, John M. Brown (john(a)chagresventures.com) wrote: > > > Here is for L, F also seems to reply. Tested from 8 different > places on the net. OTW Transit splay on the test was 8 different > providers. > > > > Can you give a sample of the "errors" you are seeing? > > Got a sample DIG line ?? > > John Brown > Le Geek > > > > %dig @l.root-servers.net com ns > > ; <<>> DiG 8.3 <<>> @l.root-servers.net com ns > ; (1 server found) > ;; res options: init recurs defnam dnsrch > ;; got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6 > ;; flags: qr rd; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 13 > ;; QUERY SECTION: > ;; com, type = NS, class = IN > > ;; ANSWER SECTION: > com. 2D IN NS L.GTLD-SERVERS.NET. > com. 2D IN NS F.GTLD-SERVERS.NET. > com. 2D IN NS J.GTLD-SERVERS.NET. > com. 2D IN NS K.GTLD-SERVERS.NET. > com. 2D IN NS E.GTLD-SERVERS.NET. > com. 2D IN NS M.GTLD-SERVERS.NET. > com. 2D IN NS A.GTLD-SERVERS.NET. > com. 2D IN NS G.GTLD-SERVERS.NET. > com. 2D IN NS H.GTLD-SERVERS.NET. > com. 2D IN NS C.GTLD-SERVERS.NET. > com. 2D IN NS I.GTLD-SERVERS.NET. > com. 2D IN NS B.GTLD-SERVERS.NET. > com. 2D IN NS D.GTLD-SERVERS.NET. > > ;; ADDITIONAL SECTION: > L.GTLD-SERVERS.NET. 2D IN A 192.41.162.30 > F.GTLD-SERVERS.NET. 2D IN A 192.35.51.30 > J.GTLD-SERVERS.NET. 2D IN A 192.48.79.30 > K.GTLD-SERVERS.NET. 2D IN A 192.52.178.30 > E.GTLD-SERVERS.NET. 2D IN A 192.12.94.30 > M.GTLD-SERVERS.NET. 2D IN A 192.55.83.30 > A.GTLD-SERVERS.NET. 2D IN A 192.5.6.30 > G.GTLD-SERVERS.NET. 2D IN A 192.42.93.30 > H.GTLD-SERVERS.NET. 2D IN A 192.54.112.30 > C.GTLD-SERVERS.NET. 2D IN A 192.26.92.30 > I.GTLD-SERVERS.NET. 2D IN A 192.43.172.30 > B.GTLD-SERVERS.NET. 2D IN A 192.33.14.30 > D.GTLD-SERVERS.NET. 2D IN A 192.31.80.30 > > ;; Total query time: 89 msec > ;; FROM: jedi.staff.chagres.net to SERVER: l.root- servers.net 198.32.64.12 > ;; WHEN: Tue Oct 1 17:29:36 2002 > ;; MSG SIZE sent: 21 rcvd: 453 > > % > On Tue, Oct 01, 2002 at 07:08:37PM -0400, John Neiberger wrote: > > > > We seem to be getting name resolution errors when we query any > > of the root servers, and this just started a hour or so ago. > > > > Anyone else noticing a problem? > > > > John > >

6 6

Re: Re: Root DNS Server Issues?
by John Neiberger 01 Oct '02

01 Oct '02

Forgive me for being a DNS clunkhead. <g> I honestly don't know much about it, but I thought I'd post this to the list because it did appear to be a problem with the root servers, which would be A Bad Thing (tm). Probable dumb question: if I do an nslookup from a desktop directed at a root server, should the name eventually resolve? Or, is a request to a root server from our DNS server a different kind of request? I have a feeling it is and that I'm barking up the wrong tree. That might explain why an nslookup directed at someone else's name server is working. Still, that would lead us back to the original problem. Our DNS server can't communicate with the root servers. Hmm.. Again, I apologize for being a total noob at this. I believe that I'm misunderstanding the symptoms and using the wrong tools to troubleshoot! Thanks to all, John ---- On Tue, 1 Oct 2002, John M. Brown (john(a)chagresventures.com) wrote: > Root servers don't resolve names other than the TLD's. > > OTW they don't have data for www.yahoo.com only for .com > which will point you towards the gTLD servers (listed below) > which will point you towards Yahoo's name servers. > > What names are you trying to lookup ? > > John Brown > Le Geek > > > On Tue, Oct 01, 2002 at 07:46:00PM -0400, John Neiberger wrote: > > We're getting responses from the root servers, the names just > > aren't resolving. From a windows NT machine the error is "Non- > > existent Domain". > > > > Ah, I just noticed something. The packet length for the DNS > > response is supposed to be 510 bytes but it's being truncated > > to 128. What the heck would cause that?? > > > > John > > > > ---- On Tue, 1 Oct 2002, John M. Brown > > (john(a)chagresventures.com) wrote: > > > > > > > > > > > Here is for L, F also seems to reply. Tested from 8 different > > > places on the net. OTW Transit splay on the test was 8 > > different > > > providers. > > > > > > > > > > > > Can you give a sample of the "errors" you are seeing? > > > > > > Got a sample DIG line ?? > > > > > > John Brown > > > Le Geek > > > > > > > > > > > > %dig @l.root-servers.net com ns > > > > > > ; <<>> DiG 8.3 <<>> @l.root-servers.net com ns > > > ; (1 server found) > > > ;; res options: init recurs defnam dnsrch > > > ;; got answer: > > > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6 > > > ;; flags: qr rd; QUERY: 1, ANSWER: 13, AUTHORITY: 0, > > ADDITIONAL: 13 > > > ;; QUERY SECTION: > > > ;; com, type = NS, class = IN > > > > > > ;; ANSWER SECTION: > > > com. 2D IN NS L.GTLD- SERVERS.NET. > > > com. 2D IN NS F.GTLD- SERVERS.NET. > > > com. 2D IN NS J.GTLD- SERVERS.NET. > > > com. 2D IN NS K.GTLD- SERVERS.NET. > > > com. 2D IN NS E.GTLD- SERVERS.NET. > > > com. 2D IN NS M.GTLD- SERVERS.NET. > > > com. 2D IN NS A.GTLD- SERVERS.NET. > > > com. 2D IN NS G.GTLD- SERVERS.NET. > > > com. 2D IN NS H.GTLD- SERVERS.NET. > > > com. 2D IN NS C.GTLD- SERVERS.NET. > > > com. 2D IN NS I.GTLD- SERVERS.NET. > > > com. 2D IN NS B.GTLD- SERVERS.NET. > > > com. 2D IN NS D.GTLD- SERVERS.NET. > > > > > > ;; ADDITIONAL SECTION: > > > L.GTLD-SERVERS.NET. 2D IN A 192.41.162.30 > > > F.GTLD-SERVERS.NET. 2D IN A 192.35.51.30 > > > J.GTLD-SERVERS.NET. 2D IN A 192.48.79.30 > > > K.GTLD-SERVERS.NET. 2D IN A 192.52.178.30 > > > E.GTLD-SERVERS.NET. 2D IN A 192.12.94.30 > > > M.GTLD-SERVERS.NET. 2D IN A 192.55.83.30 > > > A.GTLD-SERVERS.NET. 2D IN A 192.5.6.30 > > > G.GTLD-SERVERS.NET. 2D IN A 192.42.93.30 > > > H.GTLD-SERVERS.NET. 2D IN A 192.54.112.30 > > > C.GTLD-SERVERS.NET. 2D IN A 192.26.92.30 > > > I.GTLD-SERVERS.NET. 2D IN A 192.43.172.30 > > > B.GTLD-SERVERS.NET. 2D IN A 192.33.14.30 > > > D.GTLD-SERVERS.NET. 2D IN A 192.31.80.30 > > > > > > ;; Total query time: 89 msec > > > ;; FROM: jedi.staff.chagres.net to SERVER: l.root- > > servers.net 198.32.64.12 > > > ;; WHEN: Tue Oct 1 17:29:36 2002 > > > ;; MSG SIZE sent: 21 rcvd: 453 > > > > > > % > > > On Tue, Oct 01, 2002 at 07:08:37PM -0400, John Neiberger > > wrote: > > > > > > > > We seem to be getting name resolution errors when we query > > any > > > > of the root servers, and this just started a hour or so ago. > > > > > > > > Anyone else noticing a problem? > > > > > > > > John > > > > > > > > > >

2 1

Re: Re: Root DNS Server Issues?
by John Neiberger 01 Oct '02

01 Oct '02

---- On Tue, 1 Oct 2002, Adam McKenna (adam-nanog(a)flounder.net) wrote: > > On Tue, Oct 01, 2002 at 07:46:00PM -0400, John Neiberger wrote: > > > > We're getting responses from the root servers, the names just > > aren't resolving. From a windows NT machine the error is "Non- > > existent Domain". > > You still haven't told us what you are trying to look up and what exact error > you are getting. > > Until you do that, nobody is going to be able to provide you with any kind of > real answer. > > --Adam > This was my mistake. My desktop was sending out a request that didn't get a valid response, so it then sent a second request with out internal domain appended to the original request and *that* is what generated an actual error. So, we're not getting a specific error response, it's just that the responses are being truncated to 128 bytes even though the IP header says that they all should be longer. I think this is occurring because I'm being a dork and trying to do an nslookup on a root server and they're not designed for that. An nslookup directed at another ISP's name server seems to work just fine so the problem must lie in our own DNS server. Nothing was changed recently and that is the perplexing issues. It just appeared that it couldn't reach any of the root servers, so we--being unwashed and unschooled--went barking up the wrong tree. My apologies, and I'll get back to hounding our DNS admin. :-0 Thanks, John

1 0

Re: Re: Root DNS Server Issues?
by John Neiberger 01 Oct '02

01 Oct '02

Okay, nevermind. Even the valid responses from another ISP's domain server are being 'sliced', yet we get valid responses. None of the responses from the root servers contain a valid name resolution. John ---- On Tue, 1 Oct 2002, John Neiberger (neiby(a)ureach.com) wrote: > > We're getting responses from the root servers, the names just > aren't resolving. From a windows NT machine the error is "Non- > existent Domain". > > Ah, I just noticed something. The packet length for the DNS > response is supposed to be 510 bytes but it's being truncated > to 128. What the heck would cause that?? > > John > > ---- On Tue, 1 Oct 2002, John M. Brown > (john(a)chagresventures.com) wrote: > > > > > > > Here is for L, F also seems to reply. Tested from 8 different > > places on the net. OTW Transit splay on the test was 8 > different > > providers. > > > > > > > > Can you give a sample of the "errors" you are seeing? > > > > Got a sample DIG line ?? > > > > John Brown > > Le Geek > > > > > > > > %dig @l.root-servers.net com ns > > > > ; <<>> DiG 8.3 <<>> @l.root-servers.net com ns > > ; (1 server found) > > ;; res options: init recurs defnam dnsrch > > ;; got answer: > > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6 > > ;; flags: qr rd; QUERY: 1, ANSWER: 13, AUTHORITY: 0, > ADDITIONAL: 13 > > ;; QUERY SECTION: > > ;; com, type = NS, class = IN > > > > ;; ANSWER SECTION: > > com. 2D IN NS L.GTLD-SERVERS.NET. > > com. 2D IN NS F.GTLD-SERVERS.NET. > > com. 2D IN NS J.GTLD-SERVERS.NET. > > com. 2D IN NS K.GTLD-SERVERS.NET. > > com. 2D IN NS E.GTLD-SERVERS.NET. > > com. 2D IN NS M.GTLD-SERVERS.NET. > > com. 2D IN NS A.GTLD-SERVERS.NET. > > com. 2D IN NS G.GTLD-SERVERS.NET. > > com. 2D IN NS H.GTLD-SERVERS.NET. > > com. 2D IN NS C.GTLD-SERVERS.NET. > > com. 2D IN NS I.GTLD-SERVERS.NET. > > com. 2D IN NS B.GTLD-SERVERS.NET. > > com. 2D IN NS D.GTLD-SERVERS.NET. > > > > ;; ADDITIONAL SECTION: > > L.GTLD-SERVERS.NET. 2D IN A 192.41.162.30 > > F.GTLD-SERVERS.NET. 2D IN A 192.35.51.30 > > J.GTLD-SERVERS.NET. 2D IN A 192.48.79.30 > > K.GTLD-SERVERS.NET. 2D IN A 192.52.178.30 > > E.GTLD-SERVERS.NET. 2D IN A 192.12.94.30 > > M.GTLD-SERVERS.NET. 2D IN A 192.55.83.30 > > A.GTLD-SERVERS.NET. 2D IN A 192.5.6.30 > > G.GTLD-SERVERS.NET. 2D IN A 192.42.93.30 > > H.GTLD-SERVERS.NET. 2D IN A 192.54.112.30 > > C.GTLD-SERVERS.NET. 2D IN A 192.26.92.30 > > I.GTLD-SERVERS.NET. 2D IN A 192.43.172.30 > > B.GTLD-SERVERS.NET. 2D IN A 192.33.14.30 > > D.GTLD-SERVERS.NET. 2D IN A 192.31.80.30 > > > > ;; Total query time: 89 msec > > ;; FROM: jedi.staff.chagres.net to SERVER: l.root- > servers.net 198.32.64.12 > > ;; WHEN: Tue Oct 1 17:29:36 2002 > > ;; MSG SIZE sent: 21 rcvd: 453 > > > > % > > On Tue, Oct 01, 2002 at 07:08:37PM -0400, John Neiberger > wrote: > > > > > > We seem to be getting name resolution errors when we query > any > > > of the root servers, and this just started a hour or so ago. > > > > > > Anyone else noticing a problem? > > > > > > John > > > > > > >

1 0

Root DNS Server Issues?
by John Neiberger 01 Oct '02

01 Oct '02

We seem to be getting name resolution errors when we query any of the root servers, and this just started a hour or so ago. Anyone else noticing a problem? John

5 5

Updated ASN allocation to ARIN
by Rob Thomas 01 Oct '02

01 Oct '02

Hi, NANOGers. A range of ASNs have been allocated to ARIN as of September 2002. The range is 26624 - 27647. You may wish to adjust your filters. The definitive list can be found here: http://www.iana.org/assignments/as-numbers I have updated my bogus ASN monitoring to reflect these changes. You can see the list of networks that leak bogus ASNs here: http://www.cymru.com/BGP/asnbogusrep.html Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

slapper changed to udp 1812?
by fingers 01 Oct '02

01 Oct '02

hi I might be totally off the mark here, but has slapper now changed to port 1812? This'll make it really difficult to filter, if you're using this port for RADIUS. I'm seing huge volumes of traffic, to what seem to be slapper infected hosts. I see 2 infected hosts, with 2343 and 2384 unique source addresses speaking to each of them respectively. I'm unable to do actual dumps of the data at this stage, so if anyone could either confirm, or tell me I'm off my rocker, would appreciate it. I've checked a few source and destination ip's, and they all seem to be *nix, with outdated ssl, for example: Date: Tue, 01 Oct 2002 21:46:02 GMT Server: Apache/1.3.23 (Unix) (Red-Hat/Linux) mod_ssl/2.8.7 OpenSSL/0.9.6b DAV/1.0.3 PHP/4.1.2 mod_perl/1.26 netflow shows: FLOW index: 0xc7ffff router: src IP: 211.157.101.158 Dst IP: input ifIndex: 18 output ifIndex: 24 src port: 1812 dst port: 1812 pkts: 1 bytes: 88 IP nexthop: 196.31.39.10 start time: Tue Oct 1 18:38:12 2002 end time: Tue Oct 1 18:38:12 2002 protocol: 17 tos: 32 src AS: 701 dst AS: src masklen: 19 dst masklen: 24 TCP flags: 0x10 engine type: 0 engine id: 0 Regards --Rob

2 1