June 2003 - Test - lists.nanog.org

has anyone notice this ?
by Vicky Rode 30 Jun '03

30 Jun '03

howdy folks, just wondering has anyone noticed http access issue ("the page cannot be displayed") on time warner network ? i literally have to try 5 to 6 times to get to the page. i believe this problem just started a week or so back. i've even talked to few other people on socal.rr.com network and they are experiencing similar problems. is this socal.rr.com related or other regions are expediting same problems too. time warner's network status page shows everything is okay. regards, /vicky

7 12

Re: National Do Not Call Registry has opened
by Michael.Dillon＠radianz.com 30 Jun '03

30 Jun '03

>>Q: If I register my number on the National Do Not Call Registry, will it stop all telemarketing calls? >> >>A: No. Placing your number on the National Do Not Call Registry will stop most, but not all, telemarketing calls. >>Some businesses are exempt >>from the national registry and still can call you even if you place your number on it. Exempt businesses include: >> >>long-distance phone companies >>airlines >>banks and credit unions; and >>the business of insurance, to the extent that it is regulated by state law. >All the above text has now disappeared from their site ! >-- >Roland Perry, LINX Ohmigod! Now we not only have to contend with hackers, virus writers and script kiddies, we must also quake in our boots for fear of the dreaded *EDITOR*! What is this world coming to? How on earth can a 'body be expected to run a network when editors are out there, changing the words that have been written!? --Michael Dillon <yawn>

1 0

Newbie network upgrade question, apologies in advance to NANOG
by Mary Grace 29 Jun '03

29 Jun '03

NANOG: This message was posted originally on the isp-bgp list, and I was told that it should have been posted on one of the network operator lists or a Cisco list if I really wanted advice on Cisco equipment from veteran network operators who have used this equipment extensively in the past for this application. Please, forgive me if this is not appropriate, but I hope that you will consider it appropriate and not flame me for my ignorance Mary Grace! ******************************* Thank you most graciously for the incredible knowledge that God has given you, and to everyone that has responded so generously to this message that we posted this past week, regarding routers for T3 circuits! I am thankful to you all for sharing your knowledge in response to such a newbie question that I was almost ashamed to ask of you. Since the last email, Mother Superior has talked to our generous contributor from the company who is a T3 circuit provider, and explained this list's advice regarding how it was such a "mismatch between a T3 in one port and a T1 in the other" and how BGP isn't really designed to perform well in a multi-homed situation with such a large difference in bandwidth between the two ports. Thanks to your advice, and the wisdom of our MS, the provider has agreed to donate to our small teaching seminary and convent TWO DS3/T3 45 Mb/s point-to-point HDLC circuits, homed into two different exchange points in two different major cities (NAPs). So, is it still true that we do not need anything more powerful than a 4500 or 4700 to run this system? I believe that is true if we take default routes advertised by the upstream on both sides, and the two diverse-path circuits ARE being advertised out of the same upstream AS, but is it still true if we were nuts enough to want to take full routes anyway from this same provider? And why would we even want to take full routes? It is true that, despite the gracious gift of the two DS3 circuits, we don't have much money to buy a router and so we want to find our what Cisco part numbers are needed for whichever model will support two DS3/T3 and one or two 100base ethernet connections into our internal IP space. Thanks again, and may God bless you all in many rich ways :-) Your most thankful and humble servant before God, Mary Grace At 03:45 PM 6/24/03 -0700, Mike wrote: >Yeah, but 3600's are at least 3-4x more expensive than a 4500 or 4700. > >Mike > >On Wed, 18 Jun 2003, Brian Thoman wrote: > >:| Date: Wed, 18 Jun 2003 10:48:26 -0400 >:| From: Brian Thoman <flyfisher(a)bambooflyrods.com> >:| Reply-To: isp-bgp(a)isp-bgp.com >:| To: isp-bgp(a)isp-bgp.com >:| Subject: [isp-bgp] Re: Newbie Cisco upgrade question, >:| apologies in advance:-) >:| >:| Wouldn't a 3640 or 3660 off of eBay do the same trick? We ran two >DS3's off a 3640 for a while with maxed out RAM. It worked for us. >:| >:| ---------- Original Message ---------------------------------- >:| From: Mike <mike(a)motherone.com> >:| Reply-To: isp-bgp(a)isp-bgp.com >:| Date: Tue, 17 Jun 2003 00:18:40 -0700 (PDT) >:| >:| >If you're looking for really inexpensive, and don't need full routes, get >:| >a 4500/4700 and put a HSSI card in it. With an external CSU, and cable, >:| >you could probably get the whole package for $600-750 on ebay. >:| > >:| >Otherwise, I would suggest looking at a 7100 series (7120 or 7140) with a >:| >built in DS-3 port (or two). Those can be had for dirt cheap on ebay. They >:| >have all the processing power of a comparable 7200, but they're a >:| >smaller form factor and don't have as many port adapter slots (which it >:| >doesn't sound like you need, anyhow). >:| > >:| >Mike >:| > >:| > >:| >On Mon, 16 Jun 2003, E.B. Dreger wrote: >:| > >:| >:| Date: Mon, 16 Jun 2003 21:54:12 +0000 (GMT) >:| >:| From: E.B. Dreger <eddy+public+spam(a)noc.everquick.net> >:| >:| Reply-To: isp-bgp(a)isp-bgp.com >:| >:| To: isp-bgp(a)isp-bgp.com >:| >:| Subject: [isp-bgp] Re: Newbie Cisco upgrade question, >:| >:| apologies in advance :-) >:| >:| >:| >:| MG> Date: Sat, 14 Jun 2003 20:43:03 -0400 >:| >:| MG> From: Mary Grace >:| >:| >:| >:| >:| >:| MG> Our tiny little non-profit religious network has been using a >pair of T1 >:| >:| MG> lines running BGP4 for multihoming to two diverse-path >upstream ASNs for >:| >:| MG> many years now. We have our own portable IP address space and >ASN (of >:| >:| MG> course), and have just decided to install our first DS3, >because a new >:| >:| >:| >:| I think that's the first "tiny little non-profit religious >:| >:| network" I've ever heard of that had/needed that kind of >:| >:| bandwidth. You could run a moderate ISP using that... >:| >:| >:| >:| >:| >:| MG> upstream is offerring us $30 per month per meg port for a full >:| >:| MG> HDLC-encapsulated point-to-point DS3 (yippee!). >:| >:| MG> >:| >:| MG> Our quandary is where to go to ask people with lots of clue on >BGP4/eBGP to >:| >:| MG> tell us what the least expensive Cisco router we must buy to >replace the >:| >:| MG> tired little 2600 series we currently have. The router, which >need not be >:| >:| MG> as race-car fast as a 7206VXR NPE400, should be able to take >full routes, >:| >:| >:| >:| Do you really need full tables? For what you're doing, I doubt >:| >:| it. If there is some weird reason why you do, how many full >:| >:| views will you take? >:| >:| >:| >:| >:| >:| MG> so I am told it must have at least 128 meg memory, and it must >be able to >:| >:| >:| >:| Maybe. >:| >:| >:| >:| >:| >:| MG> take a coax DS3 feed in to one card or module from the new >provider, and a >:| >:| >:| >:| Yes. PA-T3 or PA-2T3. >:| >:| >:| >:| >:| >:| MG> lowly DS1 serial port now from an AdTran TSU on the other side >for one of >:| >:| >:| >:| Keep the 2610 in service. >:| >:| >:| >:| >:| >:| MG> the old DS1 providers, but be upgradeable someday to take a >second DS3 >:| >:| >:| >:| No problem. >:| >:| >:| >:| >:| >:| MG> card. OF course, with a DS3 on one side, it has to have a 100base >:| >:| MG> ethernet, unlike our blessed little sturdy cheapie 2610 :-) >:| >:| MG> >:| >:| MG> Again, please forgive this perhaps off-topic question, but who >knows better >:| >:| MG> which router can hit the double scores of least expensive and >able to take >:| >:| MG> full BGP4 routes for a DS3 but you learned and knowledgeable folks? >:| >:| MG> >:| >:| MG> Thanks in advance, and any charitable response that you may be >willing to >:| >:| MG> offer us will have our most humble thanks! >:| >:| >:| >:| 7200 series would be best. No need for VXR. >:| >:| >:| >:| >:| >:| Eddy >:| >:| -- >:| >:| Brotsman & Dreger, Inc. - EverQuick Internet Division >:| >:| Bandwidth, consulting, e-commerce, hosting, and network building >:| >:| Phone: +1 (785) 865-5885 Lawrence and [inter]national >:| >:| Phone: +1 (316) 794-8922 Wichita >:| >:| _________________________________________________________________ >:| >:| DO NOT send mail to the following addresses : >:| >:| blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net >:| >:| Sending mail to spambait addresses is a great way to get blocked.

2 1

FTC DNCR issues - Thank you ALL!!
by Callahan, Richard M, SOLGV 29 Jun '03

29 Jun '03

Folks - Perhaps along with soliciting advice from this community I would have been better served to go right to Sister Mary Grace and asked for assistance from a higher authority than even NANOG. God was clearly NOT smiling on us this weekend!! But on the other hand He has deservedly had a few issues with me:-) I believe we are now operating in a stable mode and the application is handling things as it was designed to. We will now be able to focus on the tweaking, adjusting and changes typical of the first few days of a launch of this size and scope. Emails are now flowing and queues are almost gone. I am told we are now compliant with at least major protocol and standards. The reverse DNS issues was a side effect of our hardware problem, and is now working properly. 1) If anyone has comment, suggestions or does still think we are operating amateurishly, please let me know!! I actually may have time to get these issues addressed now. 2) I know we were blocked by many ISPs for varying lengths of time due to mostly to our lack of rDNS. I think we have lost these emails as they were likely accepted I am told we stopped sending permanent cookies Saturday afternoon. This is indeed contrary to the Governments privacy policy. It has to do with Webtrends and our requirements to report statistics. I am told session cookies are still going to be necessary 3) Is this acceptable to the community? We have identified some browser issues, particularly some older versions of Netscape. 4) Any issues being seen out there, we would love to ID and address. It was great to find the NANOG community and even though I am (obviously) not a techie (only one of those lowlife sales people that get folks like you in trouble all the time), I will be hanging around on the periphery and continue my education through this new resource. You have all been helpful and I offer my sincere appreciation. Best Regards, Richard -----Original Message----- From: Mary Grace [mailto:nanog@diskserv.com] Sent: Sunday, June 29, 2003 1:03 AM To: nanog(a)merit.edu Subject: Newbie network upgrade question, apologies in advance to NANOG NANOG: This message was posted originally on the isp-bgp list, and I was told that it should have been posted on one of the network operator lists or a Cisco list if I really wanted advice on Cisco equipment from veteran network operators who have used this equipment extensively in the past for this application. Please, forgive me if this is not appropriate, but I hope that you will consider it appropriate and not flame me for my ignorance Mary Grace! ******************************* Thank you most graciously for the incredible knowledge that God has given you, and to everyone that has responded so generously to this message that we posted this past week, regarding routers for T3 circuits! I am thankful to you all for sharing your knowledge in response to such a newbie question that I was almost ashamed to ask of you. Since the last email, Mother Superior has talked to our generous contributor from the company who is a T3 circuit provider, and explained this list's advice regarding how it was such a "mismatch between a T3 in one port and a T1 in the other" and how BGP isn't really designed to perform well in a multi-homed situation with such a large difference in bandwidth between the two ports. Thanks to your advice, and the wisdom of our MS, the provider has agreed to donate to our small teaching seminary and convent TWO DS3/T3 45 Mb/s point-to-point HDLC circuits, homed into two different exchange points in two different major cities (NAPs). So, is it still true that we do not need anything more powerful than a 4500 or 4700 to run this system? I believe that is true if we take default routes advertised by the upstream on both sides, and the two diverse-path circuits ARE being advertised out of the same upstream AS, but is it still true if we were nuts enough to want to take full routes anyway from this same provider? And why would we even want to take full routes? It is true that, despite the gracious gift of the two DS3 circuits, we don't have much money to buy a router and so we want to find our what Cisco part numbers are needed for whichever model will support two DS3/T3 and one or two 100base ethernet connections into our internal IP space. Thanks again, and may God bless you all in many rich ways :-) Your most thankful and humble servant before God, Mary Grace At 03:45 PM 6/24/03 -0700, Mike wrote: >Yeah, but 3600's are at least 3-4x more expensive than a 4500 or 4700. > >Mike > >On Wed, 18 Jun 2003, Brian Thoman wrote: > >:| Date: Wed, 18 Jun 2003 10:48:26 -0400 >:| From: Brian Thoman <flyfisher(a)bambooflyrods.com> >:| Reply-To: isp-bgp(a)isp-bgp.com >:| To: isp-bgp(a)isp-bgp.com >:| Subject: [isp-bgp] Re: Newbie Cisco upgrade question, >:| apologies in advance:-) >:| >:| Wouldn't a 3640 or 3660 off of eBay do the same trick? We ran two >DS3's off a 3640 for a while with maxed out RAM. It worked for us. >:| >:| ---------- Original Message ---------------------------------- >:| From: Mike <mike(a)motherone.com> >:| Reply-To: isp-bgp(a)isp-bgp.com >:| Date: Tue, 17 Jun 2003 00:18:40 -0700 (PDT) >:| >:| >If you're looking for really inexpensive, and don't need full routes, get >:| >a 4500/4700 and put a HSSI card in it. With an external CSU, and cable, >:| >you could probably get the whole package for $600-750 on ebay. >:| > >:| >Otherwise, I would suggest looking at a 7100 series (7120 or 7140) with a >:| >built in DS-3 port (or two). Those can be had for dirt cheap on ebay. They >:| >have all the processing power of a comparable 7200, but they're a >:| >smaller form factor and don't have as many port adapter slots (which it >:| >doesn't sound like you need, anyhow). >:| > >:| >Mike >:| > >:| > >:| >On Mon, 16 Jun 2003, E.B. Dreger wrote: >:| > >:| >:| Date: Mon, 16 Jun 2003 21:54:12 +0000 (GMT) >:| >:| From: E.B. Dreger <eddy+public+spam(a)noc.everquick.net> >:| >:| Reply-To: isp-bgp(a)isp-bgp.com >:| >:| To: isp-bgp(a)isp-bgp.com >:| >:| Subject: [isp-bgp] Re: Newbie Cisco upgrade question, >:| >:| apologies in advance :-) >:| >:| >:| >:| MG> Date: Sat, 14 Jun 2003 20:43:03 -0400 >:| >:| MG> From: Mary Grace >:| >:| >:| >:| >:| >:| MG> Our tiny little non-profit religious network has been using a >pair of T1 >:| >:| MG> lines running BGP4 for multihoming to two diverse-path >upstream ASNs for >:| >:| MG> many years now. We have our own portable IP address space and >ASN (of >:| >:| MG> course), and have just decided to install our first DS3, >because a new >:| >:| >:| >:| I think that's the first "tiny little non-profit religious >:| >:| network" I've ever heard of that had/needed that kind of >:| >:| bandwidth. You could run a moderate ISP using that... >:| >:| >:| >:| >:| >:| MG> upstream is offerring us $30 per month per meg port for a full >:| >:| MG> HDLC-encapsulated point-to-point DS3 (yippee!). >:| >:| MG> >:| >:| MG> Our quandary is where to go to ask people with lots of clue on >BGP4/eBGP to >:| >:| MG> tell us what the least expensive Cisco router we must buy to >replace the >:| >:| MG> tired little 2600 series we currently have. The router, which >need not be >:| >:| MG> as race-car fast as a 7206VXR NPE400, should be able to take >full routes, >:| >:| >:| >:| Do you really need full tables? For what you're doing, I doubt >:| >:| it. If there is some weird reason why you do, how many full >:| >:| views will you take? >:| >:| >:| >:| >:| >:| MG> so I am told it must have at least 128 meg memory, and it must >be able to >:| >:| >:| >:| Maybe. >:| >:| >:| >:| >:| >:| MG> take a coax DS3 feed in to one card or module from the new >provider, and a >:| >:| >:| >:| Yes. PA-T3 or PA-2T3. >:| >:| >:| >:| >:| >:| MG> lowly DS1 serial port now from an AdTran TSU on the other side >for one of >:| >:| >:| >:| Keep the 2610 in service. >:| >:| >:| >:| >:| >:| MG> the old DS1 providers, but be upgradeable someday to take a >second DS3 >:| >:| >:| >:| No problem. >:| >:| >:| >:| >:| >:| MG> card. OF course, with a DS3 on one side, it has to have a 100base >:| >:| MG> ethernet, unlike our blessed little sturdy cheapie 2610 :-) >:| >:| MG> >:| >:| MG> Again, please forgive this perhaps off-topic question, but who >knows better >:| >:| MG> which router can hit the double scores of least expensive and >able to take >:| >:| MG> full BGP4 routes for a DS3 but you learned and knowledgeable folks? >:| >:| MG> >:| >:| MG> Thanks in advance, and any charitable response that you may be >willing to >:| >:| MG> offer us will have our most humble thanks! >:| >:| >:| >:| 7200 series would be best. No need for VXR. >:| >:| >:| >:| >:| >:| Eddy >:| >:| -- >:| >:| Brotsman & Dreger, Inc. - EverQuick Internet Division >:| >:| Bandwidth, consulting, e-commerce, hosting, and network building >:| >:| Phone: +1 (785) 865-5885 Lawrence and [inter]national >:| >:| Phone: +1 (316) 794-8922 Wichita >:| >:| _________________________________________________________________ >:| >:| DO NOT send mail to the following addresses : >:| >:| blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net >:| >:| Sending mail to spambait addresses is a great way to get blocked.

1 0

Re: Over three million computers 0wned?
by Jamie Reid 28 Jun '03

28 Jun '03

Even if 3mil machines are actively and currently compromised, of all reachable hosts on the Internet, it would not be unreasonable to assume that %80 or more are vulnerable to remote compromise in some way. That number is speculative, but most estimates from consutling firms are much higher. (Based on hundreds if not thousands of penetration tests against corporate networks with a %90+ success rate). So of all possible 0wnable machines (including those without basic anti-virus protection) I would personally speculate that the 3mil is a pretty low estimate. What these sort of stats mean is that ultimately, the Internet is not in a state in which security controls can easily be added, mostly because of the high degree of autonomy and relatively low level of sophistication of each host and user on the network. The other reality of this is that even if hackers aren't directly in control of that most machines, it would not be inaccurate to say that due to the intrinsic risks in being connected, users aren't really in control of their systems either. Security tools are the same as any other software in that they are controls that you add to a system to optimize it and extract value from it. These studies show that there is still lots of room for optimization (read: buy their software) and the implication that there is value in those optimizations. So yeah, buy more software. ;) -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324 >>> "Sean Donelan" <sean(a)donelan.com> 06/28/03 07:09pm >>> http://www.vnunet.com/News/1141901 Trustcorps claims it has scientific and anecdotal resaerch supporting its conclusion that over three million computers are "owned" by malicious groups. On the other hand, Information Risk Management questioned how any one person could "own" hundreds of computers at any one time. And systems are often not "owned" by a single group, but exploited by multiple groups Like most statistics, the "truth" is probably a little harder to find, and a little bit scarier. The FBI estimates a car is stolen every 27 seconds somewhere in the US. In 2000, FBI Uniform Crime Report statistics showed that 1,165,559 cars were stolen; with an estimated value of $7.8 Billion. Police apprehend less than 15% of all auto thieves. Unfortunately this computer crime doesn't fit the FBI crime reporting statistics well. Vandalism of Property? Is the cracking of computers happening more or less often than car theft?

1 0

RE: DNS announcement question (take 2)
by Pete Templin 28 Jun '03

28 Jun '03

Sounds like you might need to increase the local preference on the new registrar. OK, back to being serious, they don't announce to the root server. The registered nameservers (belonging to the registrar in your case, but in many other cases belonging to an ISP/NSP/WHP) answer queries made by the resolvers of millions of happy end viewers. The TLD servers (a level below the root servers) will at some point begin referring questions about your domain name(s) to the new nameservers (belonging to the new registrar). Some of those resolvers out and about the Internet will have cached the reference to the old nameservers for 1-2 days, but will eventually forget that and be told to ask the new nameservers. Try the O'Reilly book on DNS and BIND; the mud will become clear as spring water. Pete Templin IP Network Engineer Tex-Link Communications pete.templin(a)texlink.com (210) 892-4183 -----Original Message----- From: Jim Popovitch [mailto:jimpop@yahoo.com] Sent: Saturday, June 28, 2003 12:18 PM To: nanog(a)merit.edu Subject: RE: DNS announcement question (take 2) OK, I seem to have missed identifying a finer point. Both registrars (old and new) also host the DNS records for the domain (actually several domains). My question is which registrar (both are fully configured) will ultimately win at the root server, and how is this determined? The mail and web servers are up and running, and their IP addresses are not going to change. I just want to guarantee that when the account on registrar ABC is fully removed that registrar XYZ will begin DNS announcements to the root servers. Thank you for the responses so far, as well as the pointers to additional info/faq/rfc/etc. -Jim P. > -----Original Message----- > From: Jim Popovitch > Sent: Saturday, 28 June, 2003 12:09 > To: nanog(a)merit.edu > Subject: DNS announcement question > > I have a question about the way DNS records are announced/handled. Thank > you in advance for any insight into this, and I hope this isn't > too far off > topic for discussion here. > > Background: > - I have a domain whose MX and DNS is handled by registrar ABC > and I am moving that domain to registrar XYZ. > > - I have verified (via dig) the proper config on the new registrar. > > - This has nothing to do with donotcall.gov ;) > > > Questions: > 1) How does one registrar 'win out' over a second registrar when > updating root servers? > > 2) How can I verify that the domain will be properly 'announced' > to the root servers by the new registrar? > > > -Jim P. > > > > > > >

1 0

Re: announcing ix-chicago - Chicago area Internet exchange list
by Kevin Oberman 28 Jun '03

28 Jun '03

Thanks, John. I appreciate it. As participants at AADS, StarLight, and StarTAP, I feel that this will be a significant enhancement to communication among th participants. Now, if we can just convince the AADS management to use the list... -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

1 0

DNS announcement question
by Jim Popovitch 28 Jun '03

28 Jun '03

I have a question about the way DNS records are announced/handled. Thank you in advance for any insight into this, and I hope this isn't too far off topic for discussion here. Background: - I have a domain whose MX and DNS is handled by registrar ABC and I am moving that domain to registrar XYZ. - I have verified (via dig) the proper config on the new registrar. - This has nothing to do with donotcall.gov ;) Questions: 1) How does one registrar 'win out' over a second registrar when updating root servers? 2) How can I verify that the domain will be properly 'announced' to the root servers by the new registrar? -Jim P.

4 6

Re: Non-GPS derived timing sources (was Re: NTp sources that work in a datacenter)
by Peter Lothberg 28 Jun '03

28 Jun '03

> I don't expect GPS to spin out of control soon.. So GPS tracks TAI and the difference is published (2 months after the fact..) But it's simple to build a 'jamer' that makes GPS reception not work in a limited area, same for Loran-C used in combination with GPS in many Sonet/SDH S1 devices. > but I did wonder how > hard it is to find a another reliable clock source of similar quality to > GPS to double check GPS. Short for a lab part of TAI, I really don't knew. GPS price/perfromance is fenomenal. > US clocks account for 40% of the input to TAI. In the month of April 2003; NIST was 4.662% USNO was 44.314% (and we where 0.501%...) -Peter

8 8

Unauthorized Announcement from Bell South Customer
by Elliott, Andrew 28 Jun '03

28 Jun '03

Hello, AS29766 is originating 67.105.199.0/24 to Bell South without authorization. I have tried getting this resolved with Jason and Chuma at 800-317-3343, but they refuse to block this without authorization from the customer. I have leaked the /24 as well, but this needs to be addressed ASAP. If anyone from Bell South with clue can contact me off list, this would be great. --- (o< Andrew Elliott ph. 989.907.2155 //\ Router/IP Lvl 2 Support pg. 888.221.4152 V_/_ XO Communications aelliott(a)xo.com -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- ------- Registered Linux User #318207 ---------

1 0