March 2003 - Test - lists.nanog.org

Problems on internet today ?
by James-lists 28 Mar '03

28 Mar '03

Are others seeing latency and slow or stalled web pages today ? I opened a ticket with my provider, who indicates they are seeing problems with many of their peers. I am seeing very increased RTT to all the points I usually trace to. The latency does start past my provider, after they hand off to others, and is not specific to one major provider. james

2 3

Iraq Telecom Facility
by Jeffrey Meltzer 28 Mar '03

28 Mar '03

MSNBC just reported that 2 Iraq 'Telecom Facilities' were bombed. Anyone know if this is having further reaching effects on the PSTN/Internet in that region? Don't see a url on MSNBC or CNN yet. Jeff -- Jeffrey Meltzer Network Services Manager ICS/VillageWorld 631.218.0700 x100

2 1

aljazeera.net domain owned.
by Abdullah Ibn Hamad Al-Marri 27 Mar '03

27 Mar '03

Hello, aljazeera.net domain owned. Per what the Chief Editor of www.aljazeera.net told me in the phone a while ago the domain isn't in their control anymore. all the info got changed and they are wondering how did this happen. A visit to the website now would explian it all. Thanks, -Abdullah

6 6

Re[2]: Verizon mail server on MAPS RSS list
by Richard Welty 27 Mar '03

27 Mar '03

On Thu, 27 Mar 2003 13:24:06 -0800 (PST) Jay Hennigan <jay(a)west.net> wrote: > Verizon allows anyone who forges an @verizon.net From: address > to relay through their servers. This behavior is intentional. ah. then they will find it "challenging" to get off of anybody's open relay list. richard (just fixed one of those types of open relay at a customer's site) -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Unix, Linux, IP Network Engineering, Security

1 0

burst.net DDoS?
by Danny 27 Mar '03

27 Mar '03

Hey, I've got a several domains hosted on bursts IP space and currently they are getting about 35-45% packet loss. Does anyone have any idea what is going on? I've tried calling them but to no avail sadly enough. Cheers Danny Network Security Engineer PGP Print: C6AD B205 E3C6 38AB 0164 6604 66F5 CCFC F4ED F1E0 PGP Key: http://akasha.irt.drexel.edu/danny.asc

3 2

Domain oddity - possibly early warning...
by Rodney Joffe 27 Mar '03

27 Mar '03

Hello, We've noticed something we've never noticed before that became evident at 14:00 today... and which could be an isolated glitch at Verisign/Netsol, or it could be a sign of a larger problem looming. The domain utclassifieds.com is answered as NXDOMAIN in the gtld-servers. [rjoffe@layer9 rjoffe]$ dig @a.gtld-servers.net utclassifieds.com ns ; <<>> DiG 8.3 <<>> @a.gtld-servers.net utclassifieds.com ns ; (1 server found) ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 4 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUERY SECTION: ;; utclassifieds.com, type = NS, class = IN ;; AUTHORITY SECTION: com. 2D IN SOA a.gtld-servers.net. nstld.verisign-grs.com. ( 2003032500 ; serial 30M ; refresh 15M ; retry 1W ; expiry 1D ) ; minimum ;; Total query time: 96 msec ;; FROM: layer9.com to SERVER: a.gtld-servers.net 192.5.6.30 ;; WHEN: Tue Mar 25 16:15:26 2003 However it has a whois record at networksolutions, but it has no nameservers in the whois record. And the domain is valid and expires in July 2003. http://www.networksolutions.com/cgi-bin/whois/whois?STRING=utclassifieds.co… If anyone else has a similar domain problem, I'd appreciate a note offline... Meantime we're trying to get an answer from NSI. -- Rodney Joffe CenterGate Research Group, LLC. http://www.centergate.com "Technology so advanced, even we don't understand it!"(SM)

2 2

Re: how to get people to upgrade? (Re: The weak link? DNS)
by Paul Vixie 27 Mar '03

27 Mar '03

> Isn't the problem with this that in order to get the code out, people need > to upgrade and you therefor risk ending up with only notifying the people > that upgrade anyway? eventually a hard drive fails or the operating system is replaced, and then a BIND upgrade happens as a side effect. statistically this takes between five and ten years for a server whose operator doesn't read CERT advisories. so while the opportunity isn't as frequent as i'd like, it does occur, and i'd like to slip in some logic that makes subsequent upgrades more frequent. (several nanoggers have pointed out that the trouble is human nature, not technology, but that doesn't mean we can't make it easier to do the right thing.)

1 0

Re: Both Iraqi state provider Uruklink.net name servers offline
by Brian McWilliams 27 Mar '03

27 Mar '03

Someone has apparently hacked the Uruklink.net DNS server, and is trying to redirect visitors to a third-party 9-11 memorial site. The Uruklink.net site is still generally available via its IP address: http://62.145.94.111 Details here: http://www.pc-radio.com/uruklink-0wned.html Brian At 02:57 AM 3/27/2003, Sean Donelan wrote: >Despite very old recommendations, the Iraqi state provider Uruklink.net >kept all of its name servers on the same subnet. Although this is >recognized as a poor design, many domain name server operators worldwide >do the same thing. > >nic1.baghdadlink.net. 2D IN A 62.145.94.1 >nic2.baghdadlink.net. 2D IN A 62.145.94.2 > >The nic2 (62.145.94.2) has been offline for over a week. Yesterday the >remaining name server nic1 (62.145.94.1) was running an old version of >bind (8.1.2). It was returning obviously bogus answers to queries. > >In the last 24 hours, the name server application on nic1 (62.145.94.1) >went offline. The server is online (responds to pings), but neither >tcp or udp port 53 responds. The name server application may have >crashed, been trashed, or shutdown by the system administrator.

1 0

The weak link? DNS
by Sean Donelan 27 Mar '03

27 Mar '03

Watching the Iraqi Ururklink and Al Jazeera over the weekend what struck me is how many different ways network administrators can mess up. Although malicious actors have been trying (and succeeding) to exploit vulnerabilities, the worst problems seem to be self-inflicted. Administrators had used firewalls and locked down their web sites, sometimes so well they couldn't handle the traffic load. But the real weak link was their DNS servers. For example, Al Jazeera had time-to-live set of their domain records set to 15 minutes, making them even more vulnerable to increasing the load on their systems. Of course, Al Jazeera had other problems too. What even stranger about the Iraqi state provider Uruklink.net is the DNS servers are now self-identifying with earlier (with known bugs) versions of BIND. Last week the Uruklink name server 62.145.94.1 was running 8.2.2-P5, but now is running 8.1.2. Although the web site for www.uruklink.net is up, DNS lookups for www.uruklink.net return various other IP addresses (not in 62.145.94.0/24). Including some addresses running web sites claiming the site is "owned." In reality, the site isn't owned, you are being redirected to a unrelated web site.

11 15

Both Iraqi state provider Uruklink.net name servers offline
by Sean Donelan 27 Mar '03

27 Mar '03

Despite very old recommendations, the Iraqi state provider Uruklink.net kept all of its name servers on the same subnet. Although this is recognized as a poor design, many domain name server operators worldwide do the same thing. nic1.baghdadlink.net. 2D IN A 62.145.94.1 nic2.baghdadlink.net. 2D IN A 62.145.94.2 The nic2 (62.145.94.2) has been offline for over a week. Yesterday the remaining name server nic1 (62.145.94.1) was running an old version of bind (8.1.2). It was returning obviously bogus answers to queries. In the last 24 hours, the name server application on nic1 (62.145.94.1) went offline. The server is online (responds to pings), but neither tcp or udp port 53 responds. The name server application may have crashed, been trashed, or shutdown by the system administrator.

2 1