August 2003 - Test - lists.nanog.org

RE: East Coast outage?
by Ejay Hire 15 Aug '03

15 Aug '03

I similar technology has been discussed before, and I believe it is still a viable option: RFCs 1149 and 2549, Avian Carriers. While avian carriers do present problems, (flapping, unpredictable delay, queuing issues, and buggy implementations (specifically lice and mites)), I believe they are a better option than IP via Balloon. Balloons offer higher bandwidth (practically any payload size can be accommodated with a larger envelope), but the connection is much slower and less predictable than avian carrier. Balloon carrier retransmits are very expensive and the TTL is affected by the cost of propane and the general wind direction. As an alternative, perhaps we should consider IP via dirigible. A properly sized airship loaded with a high speed DVD-rw library comprising (tens of ) thousands of discs providing a very high bandwidth, high latency, low loss (if helium is used instead of hydrogen) carrier might be an option. -e -----Original Message----- From: Petri Helenius [mailto:pete@he.iki.fi] Sent: Friday, August 15, 2003 4:50 PM To: alex(a)yuriev.com; Rich Casto Cc: nanog(a)merit.edu Subject: Re: East Coast outage? > > subsidize) local power generation via renewable energy sources (e.g. > > solar, wind, hydro) it would go a long way towards solving this problem. > > Rubbish. > > If in order to make it viable such energy needs to be subsidized then it is > not "affordable". > And solar nor wind are good for base energy production so we´re stuck with other methods unless you want to move IP packets only when it´s windy. Maybe we could attach the packets to hot air balloons and send them with the wind? Pete

2 1

RE: MSBlast CLI scanner (unix)?
by Ingevaldson, Dan (ISS Atlanta) 15 Aug '03

15 Aug '03

David- There is no reliable way to detect if a computer is infected with blaster without logging into it and looking for the reg key or the executable. The backdoors (tftp and 4444) are not permanent. ISS X-Force released a great scanner for the vulnerability itself. It does two different checks to see if a box is patched, and it will detect the difference between a machine that has DCOM disabled or if it is patched. It's available here: http://www.iss.net/support/product_utilities/ms03-026rpc.php Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: David A. Ulevitch [mailto:davidu@everydns.net] Sent: Friday, August 15, 2003 4:34 PM To: nanog(a)merit.edu Subject: MSBlast CLI scanner (unix)? Nanog'ers, I've seen a couple of the windows-based MSBlast scanners but I'm looking for a unix tool to simply plug in an IP/netmask and have it scan via the command line and return the status of the vulnerability (patched, unaffected, exploited, etc). Has anyone found or heard of one that runs on *nix or have any other suggestions? thanks, davidu ---------------------------------------------------- David A. Ulevitch -- http://david.ulevitch.com http://everydns.net -+- http://communitycolo.net Campus Box 6957 + Washington University in St. Louis ----------------------------------------------------

1 0

Telehouse (25 Broadway) back on utility power
by pr＠isprime.com 15 Aug '03

15 Aug '03

Just in case anyone's keeping track, utility power was restored about an hour ago, and the generators were shut down about 10 minutes ago. I don't know which facility, but somewhere else must have just came back up, as a few bgp sessions on NYIIX to companies who backhaul to elsewhere came up about 10 minutes ago. Things are starting to normalize. I'm told 60 Hudson is still without utility power.

1 0

MSBlast CLI scanner (unix)?
by David A. Ulevitch 15 Aug '03

15 Aug '03

Nanog'ers, I've seen a couple of the windows-based MSBlast scanners but I'm looking for a unix tool to simply plug in an IP/netmask and have it scan via the command line and return the status of the vulnerability (patched, unaffected, exploited, etc). Has anyone found or heard of one that runs on *nix or have any other suggestions? thanks, davidu ---------------------------------------------------- David A. Ulevitch -- http://david.ulevitch.com http://everydns.net -+- http://communitycolo.net Campus Box 6957 + Washington University in St. Louis ----------------------------------------------------

1 0

Re: East Coast outage?
by sgorman1＠gmu.edu 15 Aug '03

15 Aug '03

I think the power grid outage is a good example of the robust yet fragile phenomenon found in many complex networks. The power grid is robust to even large variations in demand, but is extremely sensitive to the loss of particualr power lines or generators (see any of the work done by Massoud Amin). The reason is that vast majority of generators have only a few internconnections but there are a minority that have a large number that are critical to keeping the system going. If one of those gerneators in the minority has a failure it can rapidly result in a cascading failure since most of the adjacent generators do not have the capacity to handle the rerouted power. The Internet at the AS level is similar to the US power grid from a structural connectivity perspective, except there is even a smaller minority of nodes with an even larger percentage of connections. Theoretically going from a few large transit providers to more mid size or smaller providers would increase the resilie... The big 1996 power failure out west ended up resulting from a power line in Oregon that was downed by a falling tree branch. The rerouted capacity resulted in a cascading failure that spread to Denver and California. ----- Original Message ----- From: Iljitsch van Beijnum <iljitsch(a)muada.com> Date: Friday, August 15, 2003 1:53 pm Subject: Re: East Coast outage? > > On vrijdag, aug 15, 2003, at 17:55 Europe/Amsterdam, > Michael.Dillon(a)radianz.com wrote: > > >> Perhaps the lesson to learn is that very large networks don't > always>> lead to very high stability. A much larger number of > smaller, more > >> autonomous generation and transmission facilities might have > much more > >> reasonable interconnection requirements, and hence less wide- > ranging>> failure modes. > > > And if we extrapolate that lesson to IP networks it implies that any > > medium to large sized organization should do their own BGP peering > > and multihome to 3 or more upstream network providers. > > While this certainly has its advantages, I don't think it follows > from > Joe's remarks. What would follow is having many smaller transit > networks rather than a few big ones. But I think in this regard IP > is > well ahead of the electricity people. > > Still, I don't think it's this simple, as the problem with power > is > that supply and demand must be the same at all times. So if a > decent > chunk of the network that connects the two goes down, the supply > side > gets into trouble because they're suddenly generating too much. If > the > difference is big enough it's probably impossible to arrive at a > new > equilibrium above 0 fast enough. If you connect everything > together you > can absorb bigger imbalances but then when you get one you can't > absorb, the impact is larger of course. > > Fortunately in our business we have queues to smooth the spikes in > network use and when we drop packets there are no sparks. > > > Perhaps we should start working on a hierarchical routing system in > > which the concept of a "global routing table" cannot develop. > Perhaps> announcements and withdraws should have a TTL so that > they never > > propogate very far from their source AS? > > Have a look at the work going on in the IETF multihoming in IPv6 > (multi6) working group and the IRTF routing working group. > > >

1 0

60 Hudson?
by Temkin, David 15 Aug '03

15 Aug '03

Does anyone know what the status of 60 Hudson in NYC is? We're waiting for Yipes to come back online and info has been hard to come by.. Thanks, -Dave David Temkin S-I-G

2 2

RE: Power outage in North East
by Ejay Hire 15 Aug '03

15 Aug '03

I remember a recent thread about a security guard shutting down a Colo facility. It seems he hit the Emergency power off button while looking for a way to silence a door alarm. Anyone know if he found a new job with the power company? -e -----Original Message----- From: Ejay Hire Sent: Thursday, August 14, 2003 5:25 PM To: nanog(a)merit.edu Subject: RE: Power outage in North East IME, releasing the magic smoke from $device is not considered normal unlesss the device intentionally uses processes like internal combustion. -e

1 0

Re: Battery lifetimes RE: East Coast outage?
by Mike Tancsa 15 Aug '03

15 Aug '03

Thanks. A couple of people told me that the target is 8hrs for Bell Canada huts. So hopefully some power will make it there before long. Not sure how well they will prioritize what huts to charge with portable gensets. I imagine they dont of course have a portable genset for every hut out there. ---Mike At 08:00 PM 14/08/2003 -0400, Sean Donelan wrote: >Of course it varies from location to location. Generally, after 8-12 >hours we will start seeing infrastructure problems as remote batteries >run down. Providers will be re-charging batteries with portable >generators, but predicting battery lifetimes is as much art as science. >Sometimes the battery doesn't last as long as predicted.

3 2

RE: microsoft.com - what happens when there is no DNS record
by Ingevaldson, Dan (ISS Atlanta) 15 Aug '03

15 Aug '03

Our assessment of worm's behavior is below: If windowsupdate.com fails to resolve, it will return a -1, which is not interpreted because this routine has no error checking. The worm then attempts to send its SYN packets to 255.255.255.255, which may have done some interesting things, but it looks like the Windows raw socket implementation won't let that packet out. So basically, nothing happens. There might be some issues with cached DNS, but besides that it looks like the majority of the infections won't be doing much of anything besides eating CPU cycles on the infected hosts. Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: McBurnett, Jim [mailto:jmcburnett@msmgmt.com] Sent: Friday, August 15, 2003 10:26 AM To: Patrick_McAllister(a)WASHGAS.COM; Robbie Foust Cc: Bryan Heitman; nanog(a)merit.edu; owner-nanog(a)merit.edu; Chris Horry Subject: RE: microsoft.com good here thru AT&T and Broadwing.. Jim -----Original Message----- From: Patrick_McAllister(a)WASHGAS.COM [mailto:Patrick_McAllister@WASHGAS.COM] Sent: Friday, August 15, 2003 10:16 AM To: Robbie Foust Cc: Bryan Heitman; nanog(a)merit.edu; owner-nanog(a)merit.edu; Chris Horry Subject: Re: microsoft.com No problems here, UUNET out of DC.... Robbie Foust <rfoust(a)duke.edu> To: Chris Horry <zerbey(a)wibble.co.uk> Sent by: cc: Bryan Heitman <bryan(a)bryanheitman.com>, nanog(a)merit.edu owner-nanog@merit Subject: Re: microsoft.com .edu 08/15/2003 10:04 AM I've had no problem getting to Microsoft's site(s) today...I'm in the southeastern US if it makes a difference. - Robbie Chris Horry wrote: > > Bryan Heitman wrote: > >> Several networks I have talked to are reporting they can't get to >> www.microsoft.com >> >> Has the virus began? anyone? > > > Yep, remember it's already August 16th in some parts of the world. > Unable to get to www.microsoft.com at 0958 EDT. > > Chris > -- Robbie Foust, IT Analyst Systems and Core Services Duke University

1 0

RE: microsoft.com
by McBurnett, Jim 15 Aug '03

15 Aug '03

good here thru AT&T and Broadwing.. Jim -----Original Message----- From: Patrick_McAllister(a)WASHGAS.COM [mailto:Patrick_McAllister@WASHGAS.COM] Sent: Friday, August 15, 2003 10:16 AM To: Robbie Foust Cc: Bryan Heitman; nanog(a)merit.edu; owner-nanog(a)merit.edu; Chris Horry Subject: Re: microsoft.com No problems here, UUNET out of DC.... Robbie Foust <rfoust(a)duke.edu> To: Chris Horry <zerbey(a)wibble.co.uk> Sent by: cc: Bryan Heitman <bryan(a)bryanheitman.com>, nanog(a)merit.edu owner-nanog@merit Subject: Re: microsoft.com .edu 08/15/2003 10:04 AM I've had no problem getting to Microsoft's site(s) today...I'm in the southeastern US if it makes a difference. - Robbie Chris Horry wrote: > > Bryan Heitman wrote: > >> Several networks I have talked to are reporting they can't get to >> www.microsoft.com >> >> Has the virus began? anyone? > > > Yep, remember it's already August 16th in some parts of the world. > Unable to get to www.microsoft.com at 0958 EDT. > > Chris > -- Robbie Foust, IT Analyst Systems and Core Services Duke University

1 0