April 2003 - Test - lists.nanog.org

(SOT) DNS weirdness?
by Rich Sena 07 Apr '03

07 Apr '03

Trying to track down a issue we're seeing on our proxy farms. Lots of connections hung in state. Lots of lookups are failing...I verified this from an alternative site pointing to differing DNS servers... Anyone seeing anything? -- Rich Sena - ras(a)thick.net ThickNET Consulting "On the way to understanding; you understand, and forget."

1 0

New IANA IPv4 DE-allocations and bogon updates
by Stephen Gill 07 Apr '03

07 Apr '03

[ Apologies to those who have received this post in other fora. ] The numerous Team Cymru bogon projects have been updated to reflect the following IANA DE-allocations on March 31, 2003: 173/8 Apr 03 IANA - Reserved 174/8 Apr 03 IANA - Reserved 175/8 Apr 03 IANA - Reserved 176/8 Apr 03 IANA - Reserved 177/8 Apr 03 IANA - Reserved 178/8 Apr 03 IANA - Reserved 179/8 Apr 03 IANA - Reserved 180/8 Apr 03 IANA - Reserved 181/8 Apr 03 IANA - Reserved 182/8 Apr 03 IANA - Reserved 183/8 Apr 03 IANA - Reserved 184/8 Apr 03 IANA - Reserved 185/8 Apr 03 IANA - Reserved 186/8 Apr 03 IANA - Reserved 187/8 Apr 03 IANA - Reserved 189/8 Apr 03 IANA - Reserved 190/8 Apr 03 IANA - Reserved Note well: These are IP DE-allocations which increases the number of Bogon networks! Also note that 188/8 is NOT part of the list above. IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to the FIRST community, as well as on lists such as NANOG, isp-routing, isp-security, isp-bgp, cisco-nsp, and bogon-announce. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not blindly apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the master Bogon Reference Page can be found here: http://www.cymru.com/Bogons/index.html A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List The Text Bogon List, Unaggregated The Text Bogon List, Aggregated Secure BIND Template Secure IOS Template (Cisco) Secure BGP Template (Cisco) Secure JUNOS Template (Juniper) Secure JUNOS BGP Template (Juniper) Ingress Prefix Filter Templates, Loose and Strict (Cisco) Ingress Prefix Filter Template, Loose (Juniper) Ingress Prefix Filter Template, Strict (Juniper) BGP Bogon route-server * RADb fltr-unallocated fltr-martian fltr-bogons DNS Bogon (bogons.cymru.com) zone Monitoring Bogon prefix monitoring * All of the bogon peers have received the appropriate BGP prefix updates. Please feel free to contact Team Cymru with any comments, questions, or concerns. Thanks! Steve, for Team Cymru. [http://www.cymru.com/About/teamcymru.html] -- Stephen Gill gillsr(a)cymru.com

2 1

Centralized control of the Internet decreases resilience
by Sean Donelan 06 Apr '03

06 Apr '03

In this Iraq war it appears the Internet failed first, followed by the wireline telephone system, portions of the electrical grid. Iraq did not have a cellular telephone service. Part of the reason why Internet service was knocked out early was Iraq's apparent centralized control. Uruklink had very little diversity or redundancy, and appeared to route all of its traffic through a single centralized point. The Bahgdad telephone network was composed of 20 central offices, but relied on four critical offices. It appears to have taken a few attempts to disrupt the telephone network, but it eventually succumbed. Broadcast television and radio had taken a beating, but Iraq appears to have planed ahead and had extensive backup broadcast facilities and spare parts. Broadcast service has been off the air for a few hours, but then comes back. Satellite services including satellite television and telephone service seems to survived the longest. However, satellite services are eventually controlled by a very few organizations. Although it may be difficult to attack on the ground, pressuring international satellite providers to turn off transponders is possible. http://www.guardian.co.uk/worldlatest/story/0,1280,-2528727,00.html In recent days, telephone exchange bombings have isolated many of the city's 5 million residents. At least six phone centers have been hit, and most phone lines are down. Intermittent service within certain neighborhoods was still available on Wednesday. ``I can only reach the Sheraton Hotel across the road,'' said the Palestine Hotel operator. Foreign journalists who remain in Baghdad are staying at the hotel. ``I have no work to do,'' the operator said. ``No local calls and no international calls.'' http://seattlepi.nwsource.com/national/apmideast_story.asp?category=1107&sl… "Bombed telephone exchanges have offered the most graphic scenes of destruction - thousands of wires splayed out like a gaping wound, with furniture, computers, and wall insulation everywhere, but everything nearby left alone."

1 0

Re: Abuse.cc ???
by joej＠Rocknyou.com 06 Apr '03

06 Apr '03

Jacks right on the money there. Traffic being generated and directed to my network uses bandwidth, something I/my company pays for. Since its a cost I am tasked to prove/disprove its benefit, so. Perhaps if one isn't probing and/or reporting utilization trends and usage this would not be so much an issue, but on my networks it is. If I were to take the stance of "oh but its not hurting anything" you bet most of my IPOPs would look like ripe pickings for the masses of kiddie scripters/hackers. Its part of the job to police and keep clean the networks I'm responsible for. As well I do the inverse, if I get a complaint about some activity from within one of my netblocks I do my best to follow up on it and see its not some new "feature" of M$ or a fat fingered configuration somewhere. I actually welcome the complaint as it may bring to my attention something/one that is gone wrong. Granted I'm not about to nit pick a few packets type in error by some poor sap on AOL, but in this case over 400 would enlighten a response to you/your provider. Perhap this is "old school" thinking but in my model of networks its a proven and working theory. Well just my 2¢s. -Joe /* "Well if all the bits are 1's then we charge more" "Why is that?" "Larger audience" */ ----- Original Message ----- From: "Jack Bates" <jbates(a)brightok.net> To: "Matthew S. Hallacy" <poptix(a)techmonkeys.org> Cc: "McBurnett, Jim" <jmcburnett(a)msmgmt.com>; <nanog(a)merit.edu> Sent: Saturday, April 05, 2003 12:16 PM Subject: Re: Abuse.cc ??? > > Matthew S. Hallacy wrote: > > > > How was this traffic causing harm to your network? I'd rather have them > > dealing with people actively breaking into systems, DoS'ing, etc than > > terminating some customer who's probably infected with the latest > > microsoft worm. > > > > Worm control is important. If we let them run rampant, then they will > build up to a critical mass and become DOS quality. One of my transit > customers was ignoring the worm reports I was sending him. Interesting > enough, he DOS'd his own routers as several of the people infected were > behind NAT generating 11,000 connections in less than a minute. Ever > seen a C3640 with 11,000 NAT translations? In this case, it's a customer > that didn't have high end equipment. If he'd had high end equipment, > then others would suffer the performance hit, not to mention extra noise > making it harder to detect purposeful scans and attacks. Some worms, > like Code Red, cause a DOS on web enabled equipment as well. The F > variant, for example, will shut down Net2Net dslams, some cisco > equipement, and I'm sure a lot of other things. > > > -Jack

1 0

Looking for advice on datacenter electrical/generator
by Dan Lockwood 06 Apr '03

06 Apr '03

Everyone, My organization is in a growth phase right now and within the next year will find ourselves having outgrown our current 16KVa Symmetra. We have comissioned an electrical engineer to make a recommendation as to what is required to install a new 130Kva Liebert nPower UPS along with a generator. Our current plan is to purchase the UPS with a minimal amount of battery, approximately 15min worth; just enough to get the generator running. Is this the better way to go? Or should we consider more battery? What is everyone's experience with the Liebert line of products? Any kudos or gripes? Our electrical engineer also recommended that we purchase a Generac generator and transfer switch. Any experiences with that company? He also is strongly opposed to us purchasing a natural gas generator which seemed like a shoe-in for us. We have natual gas facilities and didn't want to hassel with the diesel maintenance problems. Is a natual gas generator something that we should consider? Additionally he recommneded that we place the HVAC and lighting upstream from the UPS and use some sort of junction box to supply both the UPS load and the HVAC. How do you "big guys" do it? Here is a link to the diagram that he gave us today. Your thoughts are appreciated! http://www.shastalink.k12.ca.us/nanog/nanog.jpg Dan Lockwood Microsoft Certified Professional CompTIA Network+ Certified Cisco Certified Network Associate

18 32

RE: Re[2]: Looking for advice on datacenter electrical/generator
by Dan Lockwood 05 Apr '03

05 Apr '03

Assuming the genset was running under load, how often would the oil filter need to be changed? Are there any other issues that would need to be addressed in a sustained power outage? As far as genset maintenance that is. Dan -----Original Message----- From: Richard Welty [mailto:rwelty@averillpark.net] Sent: Saturday, April 05, 2003 10:09 To: nanog list Subject: Re[2]: Looking for advice on datacenter electrical/generator On Sat, 5 Apr 2003 17:47:33 +0000 (GMT) "E.B. Dreger" <eddy+public+spam(a)noc.everquick.net> wrote: > DL> Date: Fri, 4 Apr 2003 21:26:25 -0500 (EST) > DL> From: David Lesher > DL> D) Diesel engines, err Diesel-fueled piston engines, be they 2 or > DL> 4-cycle, need frequent oil changes. > I thought it was the exact opposite. Diesel fuel has much better > lubricity than LPG/CNG/gasoline. diesels need frequent oil filter changes because they load the oil up with soot. the oil itself can last a long time. richard -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Unix, Linux, IP Network Engineering, Security

3 2

RE: Abuse.cc ???
by McBurnett, Jim 05 Apr '03

05 Apr '03

I tell ya, what really gets me in a bad mood is when my PIX logs show the same IP address hitting port 80 on 25 different IP's and the time line is 2 seconds start to finish. And then you report it, and it continues after a week every single day. Substitute port 80 here with 1433, 139,135, and on and on.. When a Syslog trap with a NTP sync time base and the entire log is not good enough, I don't know what is.... Yesterday, I got word from a network operator that 50 entries was not sufficient. So I parsed 4 days's worth and sent them over 1200 messages from their block.. have not heard back yet.. With a syslog file, sometimes an IDSLog and a Syslog. Some ISP's either /dev/null all of it, or they can't stop their users or politics stop 'em.. Later, J > -----Original Message----- > From: Simon Lyall [mailto:simon.lyall@ihug.co.nz] > Sent: Friday, April 04, 2003 5:04 PM > To: nanog(a)merit.edu > Subject: Re: Abuse.cc ??? > > > > On Thu, 3 Apr 2003, Gerald wrote: > > I hate to play devil's advocate here, but I've been on the > receiving end > > of the abuse@ complaints that became unmanagable. The bulk of them > > consisting of: > > > > "Your user at x.x.x.x attacked me!" (And this is sometimes the > > nameserver:53 or mailserver:113) > > We added this to the auto-reply of our abuse@ address: > > --- cut - here ---- > > For complaints of port scanning or supposed hacking attempts, > complete logs of the abuse are required. At a minimum, a log > of abuse contains the time (including time zone) it happened, > the hosts/ips involved and the ports involved. > > Please note that we received a large number of false > complaints from people > using personal firewall programs regarding port scanning. If you are > submitting a complaint based on the logs from one of these > programs we > highly suggest you to read the following: > > http://www.samspade.org/d/persfire.html AND > http://www.samspade.org/d/firewalls.html > > --- cut - here ---- > > The abuse guys concentrate on spam reports, open-relay reports and > sometimes port scanning reports from proper admins (these are easy to > spot). Junk from dshield.org and the like is pushed to the > bottom of the > priority list. There are just too many random packets flying > about for the > personal firewall reports to be useful. > > The other problem is it's hard to act against a client based > on one packet > received by some person on the other side of the world > running a program > they don't understand. At least with spam reports you'll get several > independant reports with full headers and if they use our > servers we'll > even have our own logs. > > -- > Simon Lyall. | Newsmaster | Work: > simon.lyall(a)ihug.co.nz > Senior Network/System Admin | Postmaster | Home: > simon(a)darkmere.gen.nz > Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

5 4

Update to IANA IPv4 Page
by John L Crain 05 Apr '03

05 Apr '03

Hello All, A few days later than originally expected but: As announced to this list earlier this year, the IANA has updated the IPv4 Address pages http://www.iana.org/assignments/ipv4-address-space to reflect the status of the following ranges as listed below. 173/8 Apr 03 IANA - Reserved 174/8 Apr 03 IANA - Reserved 175/8 Apr 03 IANA - Reserved 176/8 Apr 03 IANA - Reserved 177/8 Apr 03 IANA - Reserved 178/8 Apr 03 IANA - Reserved 179/8 Apr 03 IANA - Reserved 180/8 Apr 03 IANA - Reserved 181/8 Apr 03 IANA - Reserved 182/8 Apr 03 IANA - Reserved 183/8 Apr 03 IANA - Reserved 184/8 Apr 03 IANA - Reserved 185/8 Apr 03 IANA - Reserved 186/8 Apr 03 IANA - Reserved 187/8 Apr 03 IANA - Reserved 189/8 Apr 03 IANA - Reserved 190/8 Apr 03 IANA - Reserved Please send questions or comments to iana(a)iana.org -- Best regards, John mailto:crain@iana.org

1 0

Contact with Clue at XO?
by Eric Whitehill 05 Apr '03

05 Apr '03

Sorry to populate the list with traffic like this... Extended IP access list 120 deny ip 216.156.98.0 0.0.0.255 any (31607418 matches) permit ip any any (43284187 matches) (this is under 2 hours) Which is a very, very bad thing. Can someone from XO, please contact me about this? 15:33:51 pfe R ge-0/0/0.0 ICMP 216.156.98.x 206.xx.xx.xx 15:33:51 pfe R ge-0/0/0.0 UDP 216.156.98.x 206.xx.xx.xx Apparently emails to their abuse dept with contact info and such do not generate responses. Thanks! -Eric

2 2

RE: Looking for advice on datacenter electrical/generator
by matthew＠eeph.com 05 Apr '03

05 Apr '03

Oh. I guess I missed the reasonably-priced natural gas generator that has an on-board compressor and tank system for storing natural gas. If such a beast exists, then yes, that makes even more sense. Matthew

1 0