August 2003 - Test - lists.nanog.org

AS announcement question (easy)
by Mike Donahue 04 Aug '03

04 Aug '03

Hi, sorry for this low-level question, but at least I'm not posting in html. :) My company owns a class C, and we're switching ISPs. The "new" provider is telling us that they can start announcing, without us having to tell the old provider to stop announcing. I.e., a 2-3 day period where both are announcing our class C. This conflicts with my extremely (admittedly)limited knowledge. Can someone let me know if this is OK/not OK? Thanks in advance, Mike Michael Donahue WATG (949) 574-8500 x261

5 4

RE: AS announcement question (easy)
by Pete Templin 04 Aug '03

04 Aug '03

Is it a class C, or a /24? Regardless, longest match wins. If old provider is announcing your space as part of a larger announcement, you'll be a bad netizen for a few days because you're violating the RFCs concerning inconsistent AS, but your traffic will swing almost entirely over to new provider, and rather quickly. Traffic originating in old provider's network will likely still come in on your old link. (I've done this for three new customers in the past month.) If your old provider is specifically announcing your space as a /24, standard BGP path selection processes will take place all over the 'Net, and YMMV on the traffic balance. On or before disconnecting the link to old provider (if they are specifically announcing your /24), be sure to have them stop announcing that /24. Pete Templin Senior Staff Engineer TexLink Communications (210) 892-4183 pete.templin(a)texlink.com -----Original Message----- From: Mike Donahue [mailto:mdonahue@WATG.com] Sent: Monday, August 04, 2003 1:22 PM To: 'nanog(a)merit.edu' Subject: AS announcement question (easy) Hi, sorry for this low-level question, but at least I'm not posting in html. :) My company owns a class C, and we're switching ISPs. The "new" provider is telling us that they can start announcing, without us having to tell the old provider to stop announcing. I.e., a 2-3 day period where both are announcing our class C. This conflicts with my extremely (admittedly)limited knowledge. Can someone let me know if this is OK/not OK? Thanks in advance, Mike Michael Donahue WATG (949) 574-8500 x261

1 0

RE: North America not interested in IP V6
by McBurnett, Jim 04 Aug '03

04 Aug '03

Jack Bates Wrote: >In the US, the pipe is limited in any number of ways in attempts to >limit how many people share their broadband with their neighbor at a >reduced rate. > >Another issue is that handing out IP addresses to the home at this point >is foolish. User's, in general, can't protect themselves. EXACTLY-- I wish there was some kind of regulatory something or other that made a cable/dsl router mandatory... HMMM -- Wonder is Lieberman would sponsor a bill? ;) Jim

3 3

RE: AS announcement question (easy)
by H. Michael Smith, Jr. 04 Aug '03

04 Aug '03

If the old provider is advertising the prefix based on your advertisement to them (you're running BGP), then their advertisement should cease shortly after your link to them goes down. Likewise, the new provider would only propagate the advertisement after you advertise it to them. Michael H. Michael Smith, Jr. Network Services and Security Manager Clark Atlanta University -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Donahue Sent: Monday, August 04, 2003 2:22 PM To: 'nanog(a)merit.edu' Subject: AS announcement question (easy) Hi, sorry for this low-level question, but at least I'm not posting in html. :) My company owns a class C, and we're switching ISPs. The "new" provider is telling us that they can start announcing, without us having to tell the old provider to stop announcing. I.e., a 2-3 day period where both are announcing our class C. This conflicts with my extremely (admittedly)limited knowledge. Can someone let me know if this is OK/not OK? Thanks in advance, Mike Michael Donahue WATG (949) 574-8500 x261

1 0

RE: [operations] FW: abuse case management
by Damian Gerow 04 Aug '03

04 Aug '03

On Mon, 4 Aug 2003, William Devine, II wrote: > I used RT a looong time ago around 1998 & 1999 and liked it, but OTRS, > compared to THEN features is superior. I haven't tried RT yet, although I > did start installing it and I know I gave up on RT once when trying to > install it but got OTRS up and running rather easily, so I can't say about > their new things. > I do know that there is a feature article this month in Linux journal, Linux > review or one of the Linux related mags that states that OTRS is used by one > national British ISP that pumps 20,000 tickets per DAY through it, and one > business that has around 2,000 CSR's using OTRS for customer support > services, both using MySQL as the database backend. I thought that was a > pretty good testament as well. We have been using RT for some time now, and it's incredibly easy to get up and running (especially with a ports system). It's not even close to processing 20k tickets/day, but it definitely handles what we give it. RT has its quirks, but Jesse Vincent is a good guy, and it's mindbogglingly easy to customize it. There's more testemonials in the NANOG archives I believe. And getting back to the original post... Mikael Abrahamsson asked: > Is there an abuse case management system as freeware somewhere, something > like all the ticket/case handling packages out there, but more > specifically aimed at abuse/complaint handling. I googled some but couldnt > find any. I haven't checked it out yet, but Jesse's written an interface to RT specifically for Abuse desks - it's called RTIR. Look through http://www.bestpractical.com/ and http://www.fsck.com/pub/ for mote details. - Damian

1 0

RE: [operations] FW: abuse case management
by William Devine, II 04 Aug '03

04 Aug '03

I used RT a looong time ago around 1998 & 1999 and liked it, but OTRS, compared to THEN features is superior. I haven't tried RT yet, although I did start installing it and I know I gave up on RT once when trying to install it but got OTRS up and running rather easily, so I can't say about their new things. I do know that there is a feature article this month in Linux journal, Linux review or one of the Linux related mags that states that OTRS is used by one national British ISP that pumps 20,000 tickets per DAY through it, and one business that has around 2,000 CSR's using OTRS for customer support services, both using MySQL as the database backend. I thought that was a pretty good testament as well. william -----Original Message----- From: ODHIAMBO Washington [mailto:wash@wananchi.com] Sent: Monday, August 04, 2003 8:32 AM To: operations(a)wananchi.com Cc: William C. Devine II; nanog(a)nanog.org Subject: Re: [operations] FW: abuse case management This is for William Devine and the nanog staff: I have a question. Have any of you had the chance to try out RT (Request Tracker) available at http://www.bestpractical.com/ and compared it with OTRS??? I would be interested in the comparison of features, but if I have to install OTRS to compare, then I will spare some time to try it out in due course. -Wash * Joseph Mucheru <mucheru(a)wananchi.com> [20030803 09:49]: wrote: > > > ------ Forwarded Message > From: "William Devine, II" <william(a)smartguys.net> > Date: Fri, 1 Aug 2003 06:06:51 -0500 > To: <nanog(a)nanog.org> > Subject: RE: abuse case management > > > I started using OTRS (Open Ticket Request System) a month or so ago and LOVE > IT. You can setup pre-canned response templates and have multiple users > login and maintain various queues. It's open source and works VERY well. > > http://www.otrs.org/ > > william > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Mikael Abrahamsson > Sent: Friday, August 01, 2003 4:08 AM > To: nanog(a)nanog.org > Subject: abuse case management > > > Is there an abuse case management system as freeware somewhere, something > like all the ticket/case handling packages out there, but more > specifically aimed at abuse/complaint handling. I googled some but couldnt > find any. > > My idea is that it should provide functions to do the following flow: > > Abuse complaint comes in via email, is scanned if it's in a certain > format, if it is, put it directly into the case handling system. > > If not, This email is presented to the handler on a web page. The handler > looks at the email and decides whether the email has enough information in > it to be a complete abuse complaint. > > If NO, press button to send back a form to the one who complained stating > what information is needed and that they can either fill in the email form > and return the email, or go to a web page and fill it in (the link should > go to their original complaint so they can add information). > > If YES, the handler puts complaint IP adress, time and type of complaint > in some web fields and then presses another button to put the complaint > (now categorized) into the case handling system. > > This, coupled to a customer IP database, will enable daily reporting on > top customers who get complained about, bundling of complaints per > customer etc, plus it makes the process of cases without enough > information take 5-10 seconds to handle. > > This is a variation on the telia web way that was complained about a month > back or so, in that it enables the same categorization by a handler in an > efficiant (?) way. > > It was mentioned in the earlier discussion that we should have a > standardized way of reporting abuse via email. Was anything ever done > about this, or should we try to just make a de facto form that might > spread if more ISPs adopt it? Do the spamcop etc people have any > suggestions on how to handle the huge amount of complaints they generate? > > Any suggestions welcome. > > -- > Mikael Abrahamsson email: swmike(a)swm.pp.se > > > ------ End of Forwarded Message > > -------------------------------------------------------------- > <Internal> discussion forum for Wananchi Online Operations Dept. > operations(a)wananchi.com Best regards, Odhiambo Washington Wananchi Online Ltd. ___W_A_N_A_N_C_H_I__O_N_L_I_N_E__L_T_D___The People's Choice______ Wananchi Head Office |*| Tel: +254 2 313 985-9 1st Flr Loita, Loita St.|*| Fax: +254 2 313 922 10286-GPO, NAIROBI, KE |*| e-mail: <wash at wananchi dot com> ------------------------------------------------------------------ ++ Micros~1 : For when quality, reliability and security just aren't that important!

1 0

Blocking port 135?
by Adi Linden 04 Aug '03

04 Aug '03

http://www.cert.org/advisories/CA-2003-19.html Would blocking port 135 at the network edge be a prudent preventative measure?

17 24

Complaint of the week: Ebay abuse mail (slightly OT)
by David G. Andersen 03 Aug '03

03 Aug '03

To add to the eternally annoying list of companies that ignore abuse@ mail... ebay now requires that you fill in their lovely little web form to send them a note. Even if, say, you're trying to let them know about another scam going around that tries to use the machine www.hnstech.co.kr to extract people's credit card information. Has anyone had success in convincing companies that this is just A Bad Idea (ignoring abuse mail), and if so, how did you manage to do it? Sorry for the slightly non-operational content, but I've had it with ebay on this one. -Dave ----- Forwarded message from eBay Safe Harbor <SafeHarbor(a)eBay.com> ----- Date: Sat, 02 Aug 2003 22:58:01 -0700 From: eBay Safe Harbor <SafeHarbor(a)eBay.com> Subject: Your message to safeharbor(a)ebay.com was not received (KMM86277800V90276L0KM) To: "David G. Andersen" <dga(a)lcs.mit.edu> Auto-Submitted: auto-replied Reply-To: eBay Safe Harbor <SafeHarbor(a)eBay.com> X-MIME-Autoconverted: from quoted-printable to 8bit by eep.lcs.mit.edu id h735w5sU087612 Thank you for writing to the eBay SafeHarbor Team. The address you wrote to (safeharbor(a)ebay.com) is no longer in service. Please resend your email to us through one of the online webforms listed below. Using these forms will help us direct your email to the right department where we can quickly answer your question correctly and get it right back to you. For Trust and Safety issues (reports of policy violations, problems with transactions, suspensions, etc.) please use the following webform: http://pages.ebay.com/help/basics/select-RS.html For General Support questions (billing, bidding, or selling concerns and technical issues, etc.) please use the following webform: http://pages.ebay.com/help/basics/select-support.html Once on the webform, what will really help us assist you further is if you choose the best topic for your question. This will allow you to view our Instant Help pages, where you may find your answer immediately. Should you not find your answer there, choosing the best topics will still help us answer your question faster, correctly, and completely. We truly appreciate your assistance in this matter and apologize for any inconvenience this may have caused. Sincerely, eBay SafeHarbor Team ----- End forwarded message ----- -- work: dga(a)lcs.mit.edu me: dga(a)pobox.com MIT Laboratory for Computer Science http://www.angio.net/ I do not accept unsolicited commercial email. Do not spam me.

7 7

RE: "The internet is slow"
by Jack.W.Parks＠alltel.com 03 Aug '03

03 Aug '03

Rebooting the Internet once a month might prevent future problems. Power off, count to ten, then restart...Proactive Management!? Jack -----Original Message----- From: McBurnett, Jim [mailto:jmcburnett@msmgmt.com] Sent: Thursday, July 31, 2003 2:57 PM To: Richard A Steenbergen; Rick Ernst Cc: NANOG Subject: RE: "The internet is slow" But isn't that the purpose of NANOG? To fix the major problems before the world knows about them. I would much rather discuss a problem here and solve it and tell a reported, Yes (sir,or mam) the Internet commnity worked togather to solve the problem...... Than say, I don't it just cleared up it's all a mystery....... :) J -----Original Message----- From: Richard A Steenbergen [mailto:ras@e-gerbil.net] Sent: Thursday, July 31, 2003 3:53 PM To: Rick Ernst Cc: NANOG Subject: Re: "The internet is slow" On Thu, Jul 31, 2003 at 12:02:32PM -0700, Rick Ernst wrote: > > Packet loss within UUNET, apparently localized to the Portland (OR) > area. I've turned down our peer with them and things are looking much > better. > > Thanks for all the help/responses. Shhhhhhh, next thing you know some reporter is going to be writing a story about how the NANOG mailing list fixed that darn "the internet is slow" problem everyone has been complaining about. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

5 4

DOS attack fills input queue?
by Scott Call 03 Aug '03

03 Aug '03

One of my FE interfaces was "stuttering" this morning, and when I checked it out, it had an input queue of 76/75 which of course made me think of the recent Cisco vulnerability, which we have upgraded IOS and added ACLs to counteract. I checked the ACLs and they hadn't caught any traffic from the "bad four" protocols, only TCP and UDP, so I started to investigate. The packets (as pulled from the buffer) have headers like: Buffer information for Small buffer at 0x42561A68 data_area 0x42561D18, refcount 1, next 0x41C4F394, flags 0xA00 linktype 7 (IP), enctype 1 (ARPA), encsize 14, rxtype 1 if_input 0x42E47824 (FastEthernet4/0/0.7), if_output 0x0 (None) inputtime 0x1433CC, outputtime 0x0, oqnumber 65535 datagramstart 0x42561D5E, datagramsize 60, maximum size 260 mac_start 0x42561D5E, addr_start 0x42561D5E, info_start 0x0 network_start 0x42561D6C, transport_start 0x42561D78, caller_pc 0x403F5BD4 source: 71.209.243.3, destination: 163.29.243.5, id: 0x0100, ttl: 128, TOS: 0 prot: 6, source port 0, destination port 40 Buffer information for Small buffer at 0x425868E4 data_area 0x42586B94, refcount 1, next 0x4253BC7C, flags 0xA00 linktype 7 (IP), enctype 1 (ARPA), encsize 14, rxtype 1 if_input 0x42E47824 (FastEthernet4/0/0.7), if_output 0x0 (None) inputtime 0x96724, outputtime 0x0, oqnumber 65535 datagramstart 0x42586BDA, datagramsize 60, maximum size 260 mac_start 0x42586BDA, addr_start 0x42586BDA, info_start 0x0 network_start 0x42586BE8, transport_start 0x42586BFC, caller_pc 0x403F5BD4 source: 224.209.80.156, destination: 163.29.243.5, id: 0x0100, ttl: 128, TOS: 0 prot: 6, source port 0, destination port 40 and so on.... Random sources, same destination, same source/destination port pairs (0/40 tcp) I added: access-list 111 deny tcp any host 163.29.243.5 access-list 111 deny tcp host 163.29.243.5 any to the interface and it did not catch any of them, and the input queue returned to 76/75 (when the customer is disconnected the queue empties back to 0/75, when I re-enable their switchport, it takes 30-60 seconds to fill back up). I'm sure the packets are problably just one of the latest windows worms, but what concerns me is that I can't seem to catch them in an ACL before they cause damage to the router. The router is a 7507 with 12.0.25S on it. Since 12.0.25S has given me (unreleated) problems on other boxes, and been pulled by Cisco, I've scheduled a reload to 12.0.21S7 tonight. I don't know if that will, however, fix this problem, so I wanted to both ask for the advice of, and maybe raise a red flag for, the nanog folks out there who might run into the same thing. Thanks -Scott

1 0