July 2002 - Test - lists.nanog.org

RE: WorldComm Fiber Cut????
by James Smith 08 Jul '02

08 Jul '02

Ah, but she didn't say she believed it. Just said where the data was... Do we really need to verify what it shows? At best, it shows that they have spotty reporting. At worst, it shows rather severe reliability problems. Take your pick... James H. Smith II NNCDS NNCSE First Call Response Center Professional Services - Network Engineer The Presidio Corporation > -----Original Message----- > From: Internet Guy [mailto:internetguy205@hotmail.com] > Sent: Monday, July 08, 2002 12:22 PM > To: nanog(a)merit.edu > Subject: Re: WorldComm Fiber Cut???? > > > > HHHMMM... Very interesting. Someone who believes what a > carrier really > tells them. > > If you go to the MFN homepage & click on the graphs listed > below, then you > might see that possibly the data being displayed is both > inaccurate, as well > as misleading. > > Go to SJC OC3 Los Angeles, to OC192 SJC3 to SJC4, to OC12 > MaeW ATM, OC48 # 2 > for IAD to NYR, IAD # 2 to PAIX VA OC48, DCA2 to DFW2 OC48, > PAIX OC12 to > Core1.sjc, NPA - DS3 to San Jose, LGA1 OC192#2 to IAD, LGA1 > OC48 to Chicago, > NYC Backbone OC192 to LGA2, NYC Backbone OC48 # 2 to > core3.lga1, ETC... > > Each one of these graphs shows abnormalities in the flow of > internet data, > such as "pits", spikes, square wave function graphs, clipping on some > waveforms, etc. > > This is not limited to MFN. I have observed this on other > similiar types of > Sundry network data collection systems. > > It is not easy to see HOW BAD the problem is with these Sundry data > collection systems, UNTIL you expand the MRTG graph. Once > this is done, > then you can really see how bad the integrity of the > collected data really > is. A small MRTG graph really masks the problems associated > with the data > which is being displayed. With a larger graph, you > definately see the > problems associated with todays Sundry systems. > > > As there is no way to really verify the QUALITY or INTEGRITY > of the data > being displayed, then I submit as fact, that what is being > shown here is > really in a grey area, at best. > > So who really knows how correct, the data which is being > displayed on the > MFN home page is really is ? > > Cause with the clipping, spiking, pits, & squarewave graphs, > small graphing > scale being shown, definately, I have my doubts ... > > One would also wonder, that if this data collection system is > used by MFN to > generate bills for customers of MFN who are charged by the > Megabyte, what > these customers bills look like & HOW accurate these bills > really are... > > Regards, > > Mike Martin. > > >From: "Pawlukiewicz Jane" <pawlukiewicz_jane(a)bah.com> > >To: "nanog(a)merit.edu" <nanog(a)merit.edu> > >Subject: Re: WorldComm Fiber Cut???? > >Date: Mon, 08 Jul 2002 10:52:18 -0400 > > > > > >MFNs status page is: > > > >http://www.mfn.com/network/ip_networkstatus.shtm#sjc > > > >Jane > > > >Sean Donelan wrote: > > > > > > On Sun, 7 Jul 2002, Gerardo A. Gregory wrote: > > > > Can someone from WorldComm please verify a fiber cut > that happened > >today at > > > > around 11:30 am (Central). I have bveen informed that > a fiber cut in > > > > Illinois (or Indiana) has been in effect (until just a > few minutes) > >for all > > > > of the afternoon and most of the evening. > > > > > > Worldcom is reporting a problems near Chicago. Earthlink > is reporting > > > problems affecting its customers in Indiana, Illinois, > Iowa, Michigan, > > > Wisconsin and Ohio. > > > > > > http://help.mindspring.com/netstatus/ > > > http://www.noc.uu.net/ > > > > > > Cable & Wireless is showing delays out of Cleveland, Ohio > > > > > > http://sla.cw.net/ > > > > > > AT&T and Sprint aren't reporting any problems. > > > > > > http://ipnetwork.bgtmo.ip.att.net/index.html > > > http://www.sprint.net/ > > > > > > MFN's and PSI's network status pages have stopped working > for me, so I > > > don't know if they are having problems. > > > > > > http://www.above.net/html/techlog.txt > > > http://www.psi.net/cgi-bin/netstatus.pl5 > > > > > _________________________________________________________________ > Chat with friends online, try MSN Messenger: http://messenger.msn.com >

1 0

rewars/benefit bogon filters
by jnelson 08 Jul '02

08 Jul '02

Looking for some statisitcs from some dataminers out there.... Bogon lists? How effective are they? DDoS scripts are abundant to those who seek them. Am I going to reep any rewards by taxing my edge routers an extra 25 lines of ACL? Who out there has some stats I can look at? And by posting this, am I diminishing its value? ....provide..comment...Best practice? jnull PGP: 0x54B1A25C "!!!!!" It's the little things ....

3 2

Re: Internet vulnerabilities
by Mike Tancsa 08 Jul '02

08 Jul '02

Well, the recent jumbo AS path issue had an interesting effect of resource starvation on a few routers. Still, I think the softest targets are the root name servers. I was glad to hear at the Toronto NANOG meeting that this was being looked into from a routing perspective. Not sure what is being done from a DoS perspective. ---Mike At 01:56 PM 04/07/2002 -0400, Jason Lewis wrote: >There is a lot of news lately about terrorist groups doing recon on >potential targets. The stories got me thinking. > >What are the real threats to the global Internet? > >I am looking for anything that might be a potential attack point. I don't >want to start a flame war, but any interesting or even way out there idea >is welcome. > >Is it feasible that a coordinated attack could shutdown the entire net? I >am not talking DDoS. What if someone actually had the skills to disrupt >BGP on a widescale? > >jas

17 30

Bogus bogon?
by David Luyer 08 Jul '02

08 Jul '02

Something looks wrong here: ; host ns.eu.sun.com ns.eu.sun.com A 192.18.1.3 ; wget -q -O- http://www.cymru.com/Documents/bogon-dd.html | grep '192.18' 192.18.0.0 255.254.0.0 192.18.0.0 255.254.0.0 192.18.0.0 0.1.255.255 192.18.0.0 0.1.255.255 The bogon list references rfc2455 as mentioning 192.18.0.0/15, however the subnet is never referenced in it. In fact, no IP addresses appear to be in rfc2455, and the network seems to be a perfectly legitimate block containing two /16's (Sun, Agere) and one /24 more-specific in Sun's /16 block (mrc-apu.cam.ac.uk). Rob? An experiment in social engineering? :-) David.

2 1

Assistance with a Customer Network Staffing Support Levels
by Ryan Clark 08 Jul '02

08 Jul '02

Good Evening: I'm looking for any kind of industry benchmark data to help me justify IT head count. We're also looking for the same kind of data that you may uses in order to justify IT head count. Things like, How many engineers per device? At what point should the set up internal help desks? Number of trouble tickets per technician, Number of changes per engineer, etc.etc. Can you point me in the right direction to get this information? Thank you in advance for any help you can offer. Regards, Ryan _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com

1 0

stats on spam?
by deeann mikula 08 Jul '02

08 Jul '02

can anyone point me to any current statistics on the amount of email traffic carried on the internet that is actually spam? everyone kicks around an AOL report to the FTC in 1997 stating that 1/3 of their email messages received were spam, and another by ATT labs (5-15% of their email, 1997) but i've been using those stats for a while, and i'd like to update my resources for my current paper/talk, but i've been searching around and am not having much luck. private responses are welcome, since i believe this borders on off-topic land... thanks much! deeann m.m. mikula director of operations telerama public access internet http://www.telerama.com * 412.688.3200

2 1

Re: DOS attack from PANAMSAT
by Rizzo Frank 07 Jul '02

07 Jul '02

Roy wrote: > Their NOC is clueless. Anyone have a better number? Your upstreams, who will help you back-track. Nobody DoS'es with their real IP's anymore. Frank

6 7

wcom overbilling
by news＠kippona.com 07 Jul '02

07 Jul '02

Wcom's overbilling will be investigated: http://www.ctnow.com/business/hc-worldcomcover0704.artjul04.story?coll=hc%2… Chris

15 16

European packet loss average increasing
by Sean Donelan 07 Jul '02

07 Jul '02

My non-scientific measurements (i.e. pings to well known european sites) show an increase in packet loss to about 6%, the 10 day average previously was less than 1%. Neither ns.ebone.net nor auth1.ebone.net are answering queries. BGP data still looks normal KPNQwest data http://bgp.potaroo.net/as286/ So far I don't see much change in traffic levels at LINX http://www.linx.net/tools/stats/index.thtml AMS-IX graphs seem to have a glitch, or one heck of a DDOS. http://www.ams-ix.net/hugegraph.html

6 5

Re: DOS attack from PANAMSAT
by Rizzo Frank 07 Jul '02

07 Jul '02

Rob Thomas wrote: > ] Your upstreams, who will help you back-track. Nobody DoS'es with their > ] real IP's anymore. > > Hmm, not according to the data I collect. I track numerous botnets and > DoSnets, and a bit over 80% of them use the real IPs DDoS/botnet, yes. Targeted DoS (think Jason Legate's stream.c), no. Frank

1 0