August 2003 - Test - lists.nanog.org

Atm-t1 8t1-ima
by Ejay Hire 29 Aug '03

29 Aug '03

Hi all. Can anyone tell me if the 8 port IMA network module is supported in the 3640s? I used the Compatibility tool, and it said I'd be good with 12.2.11 YT but I'm having no success. Any advice is appreciated. *Mar 1 00:00:05.211: %PA-2-UNDEFPA: Undefined Port Adaptor type BD in bay 2 Cisco Internetwork Operating System Software IOS (tm) 3600 Software (C3640-I-M), Version 12.2(11)YT2, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) TAC Support: http://www.cisco.com/tac Copyright (c) 1986-2003 by cisco Systems, Inc. Compiled Thu 27-Feb-03 16:41 by cmong Ejay Hire ... ln -s /dev/null /dev/clue

4 3

Re: London Power outage
by Will Hargrave 29 Aug '03

29 Aug '03

On Thursday 28 August 2003 22:00, Stephen J. Wilcox wrote: > I saw it on CNN but it sounds like it wasnt as bad as they wanted to make > out.. frmo what I was told none of the major colos which are all in the > East lost utility and I dont know about stuff in the South which is where > the power was out.. seems theres not much of interest there from a netork > pov. None of our network (mainly west London) was affected. Media reports that it just hit [mainly residential] south London, so didn't affect either Docklands facilities nor the various datacentres in the west (Park Royal etc) and south-west (Heathrow). It did knock out most of the tube system by my experiences. Fights at bus stops; so much for the 'stiff upper lip' ;-)

1 0

RE: GLBX ICMP rate limiting (was RE: Tier-1 without their own bac kbone?)
by Temkin, David 28 Aug '03

28 Aug '03

Not that Yipes is necessarily a transit provider by any means, but they have done the same thing within the cores of their network. I was troubleshooting an issue yesterday that was pointing to them for 15-20% packet loss, and I called them and they stated that they started rate limiting ICMP last weekend, but that it was only on a temporary basis. -----Original Message----- From: variable(a)ednet.co.uk [mailto:variable@ednet.co.uk] Sent: Thursday, August 28, 2003 8:24 AM To: nanog(a)merit.edu Subject: GLBX ICMP rate limiting (was RE: Tier-1 without their own backbone?) On Wed, 27 Aug 2003, jlewis(a)lewis.org wrote: > We have a similarly sized connection to MFN/AboveNet, which I won't > recommend at this time due to some very questionable null routing > they're doing (propogating routes to destinations, then bitbucketing > traffic sent to them) which is causing complaints from some of our > customers and forcing us to make routing adjustments as the customers > notice MFN/AboveNet has broken our connectivity to these destinations. We've noticed that one of our upstreams (Global Crossing) has introduced ICMP rate limiting 4/5 days ago. This means that any traceroutes/pings through them look awful (up to 60% apparent packet loss). After contacting their NOC, they said that the directive to install the ICMP rate limiting was from the Homeland Security folks and that they would not remove them or change the rate at which they limit in the foreseeable future. What are other transit providers doing about this or is it just GLBX? Cheers, Rich

4 3

Re: Fun new policy at AOL
by Dr. Jeffrey Race 28 Aug '03

28 Aug '03

On Thu, 28 Aug 2003 12:07:30 -0400, Matthew Crocker wrote: >It can be built without choke points. ISPs could form trust >relationships with each other and bypass the central mail relay. AOL >for example could require ISPs to meet certain criteria before they are >allowed direct connections. ISPs would need to contact AOL, provide >valid contact into and accept some sort of AUP (I shall not spam >AOL...) and then be allowed to connect from their IPs. AOL could kick >that mail server off later if they determine they are spamming. Now there is an idea! However an improved variant is to make the entire internet a 'trust relationship' using the (obvious) steps you propose. For several months I have been pondering possible details of implementing same; see <http://www.camblab.com/misc/univ_std.txt>. Comments welcome. Jeffrey Race

2 1

Re: Fun new policy at AOL
by Dr. Jeffrey Race 28 Aug '03

28 Aug '03

On Thu, 28 Aug 2003 13:13:31 -0500, John Palmer wrote: >I connect with my laptop from 3 or 4 locations to drop off mail to >my servers. I cannot use their mail servers from other locations other >than when I am connected to them. I have about 2 dozen e-mail >accounts defined in outlook express and would have to change >the outbound mail server setting for EACH one ever time I move >off the RCN connection to one of the other locations from which I >work and then back again when I get back to RCN. Do you mean you SEND from each of the two dozen accounts at the new location each time? (I experience the same inconvenience when travelling with my notebook computer i.e. I need to amend the outgoing SMTP server in my mail client on the fly. But it takes only a moment [admittedly I use only two accounts] but it seems like a reasonable rule.) Jeffrey Race

1 0

Re: Fun new policy at AOL
by Susan Zeigler 28 Aug '03

28 Aug '03

Bob Bradlee wrote: > > Road-Runner pulled the same stunt with a chain of radio stations > I have as clients. We went ON-AIR with a NEWS story, and > recomended that everyone effected should call Roadrunner > or AOL. AOL contacted me, verified the problem, and had my > IP's whitelisted in a matter of hours. Both SBC and WOW were happy > to sign up the few that switched before AOL woke up. > > Good luck, I hope for your sake that your national association > has a national name and is ready to black list AOL in their > news letter for this. > > We dont care, we dont have to, were AOL > > Back to lurking... > > Bob > > ps: I dont think I have posting rights, or I would have sent this to the list, > back when it happened. I am sure there are a lot of people out there > who dont know they are Blacklisted by AOL/Timewarner yet. > Thanks Bob!!! Someone else has sent me the right phone number and I'm working on that. I'm forwarding this to the list as well so others can see we're not alone:) -- -- -- -Susan -- Susan Zeigler | Technical Services szeigler(a)spindustry.com | Spindustry Systems 515.225.0920 | "You cannot strengthen the weak by weakening the strong." -- Abraham Lincoln **************************************************************** Spindustry Systems, Inc. DES MOINES / CHICAGO / INDIANAPOLIS / DENVER CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message including any attachments.

1 0

London Power outage
by David Diaz 28 Aug '03

28 Aug '03

Can anyone in London provide details on the outage... are any colos on generator? dave

3 2

Re: Sobig.f surprise attack today
by Owen DeLong 28 Aug '03

28 Aug '03

OK.. Seems to me that under the circumstances, since they're willing to disconnect that host from the internet (any rational ISP would be), that replacing it with a /32 route to a honeypot created by the ISP would not be that difficult. Sure, it's unlikely that 100% of the ISPs could do it in the time required, but, even if you gust got the top 3 or so on the worm's hit list, it would have a significant impact. If you got 10, then the surprise would be no more than 50% effective. Sure, it won't happen in 30 minutes, but, I don't understand why this wasn't started when F-Secure first noticed the situation. Owen --On Friday, August 22, 2003 1:39 PM -0500 "Beprojects.com" <info(a)beprojects.com> wrote: > So who's going to do that? There are 20 machines on 20 different networks > covering the US, Canada and parts of Asia (from what I've read). Each > network would have to contact the individual user and ask permission to > put a honeypot on their IP and that's not going to happen in the next 30 > minutes. > > ----- Original Message ----- > From: "Owen DeLong" <owen(a)delong.com> > To: <jdawson(a)flexpop.net>; <nanog(a)merit.edu>; <Jaana.Sirkia(a)f-secure.com> > Sent: Friday, August 22, 2003 1:27 PM > Subject: Re: Sobig.f surprise attack today > > >> >> OK... Maybe I'm smoking crack here, but, if they have the list of 20 >> machines, >> wouldn't it make more sense to replace them with honey-pots that download >> code to remove SOBIG instead of just disabling them? >> >> Let's use the virus against itself. At this point, I think that's a >> legitimate >> countermeasure. >> >> Owen >> >> >> --On Friday, August 22, 2003 11:01 AM -0700 Jim Dawson <jdawson(a)navi.net> >> wrote: >> >> > >> > F-Secure Corporation is warning about a new level of attack to be >> > unleashed by the Sobig.F worm today. Supposed to take place at 1900 >> > UTC. >> > >> > http://www.f-secure.com/news/items/news_2003082200.shtml >> > >> > Jim >> > -- >> > >> > See what ISP-Planet is saying about us! >> > http://isp-planet.com/services/wholesalers/flexpop.html >> > __________________________________________________________________ >> > Jim Dawson jdawson(a)flexpop.net >> > Flexpop/Navi.Net http://www.flexpop.net >> > 618 NW Glisan St. Ste. 101 v. +1.503.517.8866 >> > Portland, Or 97209 USA f. +1.503.517.8868 >> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> > >> >> >> >

7 10

Re: Re[2]: relays.osirusoft.com
by George William Herbert 28 Aug '03

28 Aug '03

Paul wrote: >this part, on the other hand... > >> he's put >> *.*.*.* in, he's asking people not to use it anymore. > >...mystifies me. anyone who has read rfc1034 or rfc1035, even >if they did not also read rfc2181 or rfc2136 or rfc2308, knows >that in a zone containing the following wildcardish data: > > $ORIGIN example.vix.com. > * 1H IN A 127.0.0.1 > *.* 1H IN A 127.0.0.2 > *.*.* 1H IN A 127.0.0.3 > *.*.*.* 1H IN A 127.0.0.4 > >the result will be that only the top one will match: I must hope and pray that nobody on NANOG would be foolish enough to load narrative prose mailed to the list into their BIND configurations ;-) BGP, now, feel free to do that all you want. -george william herbert gherbert(a)retro.com

1 0

Re: Fun new policy at AOL
by Johnny Eriksson 28 Aug '03

28 Aug '03

Matthew Crocker <matthew(a)crocker.com> wrote: > Technically no, There is no reason for a customer to have direct > access to the net so long as the ISP can provide appropriate proxies > for the services required. Good idea. I'll start working on the SSH proxy tomorrow. > -Matt --Johnny

1 0