June 2003 - Test - lists.nanog.org

TWC/RR In Austin
by Dominic J. Eidson 24 Jun '03

24 Jun '03

Anyone know what's going on with TWC's network (specifically, Road Runner) in Austin, TX? All that their support could say was "We're not sure what's going on, and there's no ETA". - d. -- Dominic J. Eidson "Baruk Khazad! Khazad ai-menu!" - Gimli ------------------------------------------------------------------------------- http://www.the-infinite.org/ http://www.the-infinite.org/~dominic/

1 0

RE: ISPs are asked to block yet another port
by Christopher L. Morrow 24 Jun '03

24 Jun '03

On Tue, 24 Jun 2003, gml wrote: > Security is a lifestyle. > People laugh when I say this, do they laugh when you say it? > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Christopher L. Morrow > Sent: Tuesday, June 24, 2003 12:00 AM > To: Niels Bakker > Cc: nanog(a)merit.edu > Subject: Re: ISPs are asked to block yet another port > > > > > On Tue, 24 Jun 2003, Niels Bakker wrote: > > > > > * chris(a)UU.NET (Christopher L. Morrow) [Mon 23 Jun 2003, 18:01 CEST]: > > [..] > > > Two interesting points though: > > > > > > 1) Spammers adapt > > > 2) default insecure OS installs cause problems > > > > Employees of XS4ALL, a Dutch ISP, today held several talks about a > > variety of subjects for its customers to celebrate its 10th anniversary. > > One of the talks was about security in general, held by Scott McIntyre. > > Hopefully he'll have the slides on soon because it was an excellent > > talk, in which he touched upon several subjects mentioned in this thread > > (spammers, trojans, viruses, default installations being vulnerable, > > that port blocking is not a solution at all). > > > > I'll post a URL when it becomes available. > > Sweet, too many people just don't take security very seriously :( Its a > shame really, security only seems to matter when the sky is falling, its > not taken as a daily necessity. > > -Chris >

2 2

Oh where, oh where has Comcast gone
by John R Levine 24 Jun '03

24 Jun '03

I saw a bunch of mail to comcast.net bouncing, so I figured I'd check to see if maybe their mail servers were misconfigured or something. Holy petunias, they've imploded into private network space. It appears that the glue records in the GTLD servers are OK, but ns02 is returning the 172.30 address which, since it's authoritative for itself, overwrites the good data. Tsk, tsk. I suppose that's one way to cut down the amount of spam they get. $ dnsqr ns comcast.net 2 comcast.net: 76 bytes, 1+2+0+0 records, response, noerror query: 2 comcast.net answer: comcast.net 4929 NS ns01.jdc01.pa.comcast.net answer: comcast.net 4929 NS ns02.jdc01.pa.comcast.net $ dnsqr a ns01.jdc01.pa.comcast.net 1 ns01.jdc01.pa.comcast.net: 59 bytes, 1+1+0+0 records, response, noerror query: 1 ns01.jdc01.pa.comcast.net answer: ns01.jdc01.pa.comcast.net 4923 A 172.30.0.16 $ dnsqr a ns02.jdc01.pa.comcast.net 1 ns02.jdc01.pa.comcast.net: 59 bytes, 1+1+0+0 records, response, noerror query: 1 ns02.jdc01.pa.comcast.net answer: ns02.jdc01.pa.comcast.net 4919 A 172.30.0.17 Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner "More Wiener schnitzel, please", said Tom, revealingly.

3 2

Re: [RE: ISPs are asked to block yet another port]
by Joshua Sahala 24 Jun '03

24 Jun '03

"Christopher L. Morrow" <chris(a)UU.NET> wrote: > > > On Tue, 24 Jun 2003, gml wrote: > > > Security is a lifestyle. > > > > People laugh when I say this, do they laugh when you say it? usually they remember a very important event that must be attended to, and assure me that they do believe in security and appreciate what i am saying (as they walk away laughing behind their hands). [cut] > > Sweet, too many people just don't take security very seriously :( > > Its a shame really, security only seems to matter when the sky is > > falling, its not taken as a daily necessity. > > > > -Chris > > it has been my experience that the sky must fall before they (pointy-haired managers) start pointing fingers (at the security minded). then there is a brief period of fear in which things start to get moving...which dwindles into the same [avoidance|excuses] as before. /joshua "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

RE: Router crash unplugs 1m Swedish Internet users
by Jim Deleskie 24 Jun '03

24 Jun '03

One router and it takes there entire network off-line... Maybe someone needs a Intro to Networks 101 class. -jim -----Original Message----- From: Sean Donelan [mailto:sean@donelan.com] Sent: Monday, June 23, 2003 4:24 PM To: nanog(a)merit.edu Subject: Router crash unplugs 1m Swedish Internet users Has anyone heard what the cause of the outage was? Router crash unplugs 1m Swedish Internet users Saturday, 21 June 2003 The breakdown of one of Sweden's main Internet routers in Stockholmon today unplugged more than 1 million of its Internet subscribers. Reports says in total over 340,000 broadband and 700,000 dial-up customers across the country were affected by the incident. The router failure might also have caused disruptions to other Internet subscribers, who use the services of providers operating on the Telia network. http://www.abc.net.au/science/news/scitech/SciTechRepublish_885166.htm

5 4

RE: Router crash unplugs 1m Swedish Internet users
by Ben Buxton 24 Jun '03

24 Jun '03

> On Mon, 23 Jun 2003, Jim Deleskie wrote: > > > One router and it takes there entire network off-line... > Maybe someone needs > > a Intro to Networks 101 class. > > Well, if the memory errors corrupts the forwarding table > placed on the > line cards or something similar, and still keeps its > adjacancies up, then > you can get these problems. I've seen it happen on > route-cache boxes where > certain entries in the ip-forwarding table was corrupted and thus > incorrectly routed. Oooh I had one of these once - a bug in the forwarding engine of a J-box caused all through traffic to drop whilst maintaining adjacencies and VRRP mastership. It took two incidents to determine what the cause of the fault was. So much for redundancy... Fortunately it was at the tail end of a maintenance window. Unfortunately it affected a similar size user base to the Telia fault (but luckily it seems no-one noticed enough to publicise it :) BB

1 0

Router crash unplugs 1m Swedish Internet users
by Sean Donelan 24 Jun '03

24 Jun '03

Has anyone heard what the cause of the outage was? Router crash unplugs 1m Swedish Internet users Saturday, 21 June 2003 The breakdown of one of Sweden's main Internet routers in Stockholmon today unplugged more than 1 million of its Internet subscribers. Reports says in total over 340,000 broadband and 700,000 dial-up customers across the country were affected by the incident. The router failure might also have caused disruptions to other Internet subscribers, who use the services of providers operating on the Telia network. http://www.abc.net.au/science/news/scitech/SciTechRepublish_885166.htm

4 3

ISPs are asked to block yet another port
by Sean Donelan 23 Jun '03

23 Jun '03

http://www.lurhq.com/popup_spam.html "LURHQ Corporation has observed traffic to large blocks of IP addresses on udp port 1026. This traffic started around June 18, 2003 and has been constant since that time. LURHQ analysts have determined that the source of the traffic is spammers who have discovered that the Windows Messenger service listens for connections on port 1026 as well as the more widely-known port 135. Windows Messenger has been a target for spammers since late last year, because it allows anonymous pop-up messages to be displayed on any Windows system running the messenger service. Due to widespread abuse, many ISPs have moved to block inbound traffic on udp port 135. It appears the spammers have adapted, so ISPs are urged to block udp port 1026 inbound as well." How many ports should ISPs block? People still buy and connect insecure computers to the net.

11 13

RE: Router crash unplugs 1m Swedish Internet users
by Stewart, William C (Bill), RTSLS 23 Jun '03

23 Jun '03

Jim wrote: > One router and it takes there entire network off-line... > Maybe someone needs a Intro to Networks 101 class. I assume things are designed in such a way that if the router were actually dead, the traffic would take an alternate route. But the posting commented that they'd been saying something about memory corruption. There are unfortunately too many ways for a router to be "not dead yet", happily answering routing protocol messages but not bothering to actually forward packets between network interfaces, and if that happens on the router that's your best route due to geography or BGP or whatever, it can take a while to catch. Dealing with that is at least Networks 203 or maybe Networks 532 :-) Additionally, while the article in the press referred to it as a "router", that may be an actual technical description accurately described by a reporter who knows the technology, or it may be press shorthand for "one of those high-tech thingies that ISPs use", or it may be the ISP's Speaker-To-Reporters's watered-down description of something.

1 0

RE: Router crash unplugs 1m Swedish Internet users
by Jim Deleskie 23 Jun '03

23 Jun '03

I've lived though one of these a few years ago, the core itself stayed up though crippled as it was :) David, you name sounds familiar have we worked @ the same place before? -Jim -----Original Message----- From: David Barak [mailto:thegameiam@yahoo.com] Sent: Monday, June 23, 2003 5:27 PM To: Jim Deleskie; nanog(a)merit.edu Subject: RE: Router crash unplugs 1m Swedish Internet users I've seen a case where a single error in the configuration file of a $VENDOR_1 router was accepted (due to an 'undocumented feature'), and this caused the wholesale importation of BGP routes into the IGP, which caused most of their $VENDOR_2 hardware to spaz out. Locating the single error was a matter of hours, not minutes, so effectively a typo took out that ISP - and it's considered by most to be a relatively well-designed network. -David Barak --- Jim Deleskie <jdeleski(a)rci.rogers.com> wrote: > > > One router and it takes there entire network > off-line... Maybe someone needs > a Intro to Networks 101 class. > > -jim > ===== David Barak -fully RFC 1925 compliant- __________________________________ Do you Yahoo!? SBC Yahoo! DSL - Now only $29.95 per month! http://sbc.yahoo.com

1 0