March 2004 - Test - lists.nanog.org

RE: UUNet Offer New Protection Against DDoS
by Douglas.Dever＠alltel.com 03 Mar '04

03 Mar '04

From: On Behalf Of John Obi Sent: Wednesday, March 03, 2004 2:21 AM > MCI/WorldCom Monday unveiled a new service level agreement (SLA) At the risk of sounding thoroughly underwhelmed... Uhm, where's the beef? All I see is the opportunity to get a service credit should one complain loud enough after a DoS attack. Maybe I'm missing something here, but I doubt it. I've never seen an SLA that guarantees 5 9's of reliability keep a T1 from going down - but the paper it was written on was nice... somewhat soft, and you didn't have to worry about your finger poking through it. -- Douglas A. Dever ACI/IT Network Services ALLTEL Communications Inc. 330.963.1720 ****************************************************************************************** The information contained in this message, including attachments, may contain privileged or confidential information that is intended to be delivered only to the person identified above. If you are not the intended recipient, or the person responsible for delivering this message to the intended recipient, ALLTEL requests that you immediately notify the sender and asks that you do not read the message or its attachments, and that you delete them without copying or sending them to anyone else.

1 0

External (not in the same domain) name server
by Antti Louko 03 Mar '04

03 Mar '04

Hello, I searched if this issue has been around previously, but neither google or Nanog list search produced anything recent and relevant. There has been some discussion on whois host entries etc, however. The real issue, why this seems impossible with many registrars, is explained in the end of this email. Background: (I use private IP addresses in this example, but in the real life they would be normal routable IP addresses) I have in my mind a setup where: - There is one main domain, which is used for "master" name servers: mxx1.net NS ns1.mxx1.net mxx1.net NS ns2.mxx1.net mxx1.net NS ns3.mxx1.net mxx1.net NS ns4.mxx1.net ns1.mxx1.net A 10.1.1.2 ns1.mxx1.net A 10.1.2.2 ns1.mxx1.net A 10.2.1.2 ns1.mxx1.net A 10.2.2.2 ns1, ns2, ns3 and ns4 are well connected and quite permanently in their IP addresses. - There are a number of cooperating organizations each having one dedicated name server (which can also handle other tasks, like act as an secondary SMTP server etc.) - Organizations are (there may be tens or hundreds of them): cxx-1.com cxx-2.com . . - Each cxx-n.com has its domain registered like this: cxx-1.com NS ns1.cxx-1.com.e.mxx1.net. cxx-1.com NS ns2.cxx-1.com.e.mxx1.net. cxx-1.com NS ns3.cxx-1.com.e.mxx1.net. cxx-1.com NS ns4.cxx-1.com.e.mxx1.net. cxx-1.com NS ns5.cxx-1.com.e.mxx1.net. , cxx-2.com NS ns1.cxx-2.com.e.mxx1.net. cxx-2.com NS ns2.cxx-2.com.e.mxx1.net. cxx-2.com NS ns3.cxx-2.com.e.mxx1.net. cxx-2.com NS ns4.cxx-2.com.e.mxx1.net. cxx-2.com NS ns5.cxx-2.com.e.mxx1.net. etc. - Each cxx-n.com.e.mxx.1.net zone name server offers records like this: ns1.cxx-1.com.e.mxx1.net 600 A 10.20.1.2 ; server at cxx-1's location ns2.cxx-1.com.e.mxx1.net 600 A 10.20.2.2 ; server at cxx-2's location ns3.cxx-1.com.e.mxx1.net 600 A 10.20.3.2 ; server at cxx-3's location ns4.cxx-1.com.e.mxx1.net 600 A 10.20.4.2 ; server at cxx-4's location ns5.cxx-1.com.e.mxx1.net 600 A 10.20.5.2 ; server at cxx-5's location ns1.cxx-4.com.e.mxx1.net 600 A 10.20.4.2 ; server at cxx-4's location ns2.cxx-4.com.e.mxx1.net 600 A 10.20.5.2 ; server at cxx-5's location ns3.cxx-4.com.e.mxx1.net 600 A 10.20.6.2 ; server at cxx-6's location ns4.cxx-4.com.e.mxx1.net 600 A 10.20.7.2 ; server at cxx-7's location ns5.cxx-4.com.e.mxx1.net 600 A 10.20.8.2 ; server at cxx-8's location Pro: - {ns1,ns2,ns3,ns4}.mxx1.net don't have to handle all NS requests to different cxx-n.com domains. - Each cxx-n.com.e.mxx.net name server can monitor if each of its name servers is alive and change the A record to more suitable address when necessary. Con: - Needs careful configuration - Requires more DNS requests than simpler setup: + To resolve eg. www.cxx-1.com A (traditional setup): www.cxx-1.com:A --> A.GTLD-SERVERS.NET cxx-1.com NS ns-1.cxx-1.com 10.20.1.2 ns-1.cxx-1.com A 10.20.1.2 www.cxx-1.com:A --> 10.20.1.2 www.cxx-1.com A 10.20.1.3 is 2 transactions + New setup: www.cxx-1.com:A --> A.GTLD-SERVERS.NET cxx-1.com NS ns1.cxx-1.com.e.mxx1.net ns1.cxx-1.com.e.mxx1.net:A --> A.GTLD-SERVERS.NET mxx1.net NS ns1.mxx1.net ns1.mxx1.net A 10.1.1.2 ns1.cxx-1.com.e.mxx1.net:A --> 10.1.1.2 ns1.cxx-1.com.e.mxx1.net A 10.20.1.2 www.cxx-1.com:A --> 10.20.1.2 www.cxx-1.com A 10.20.1.3 is 4 transactions and if we separate each cxx-1.com.e.mxx1.net zone in a different name server, we get 5 transaction. The difference is that we can adjust with TTL values which parts of the name resolution are short lived and which are long lived. And now the problem with some registrars (or is it the same with all of them): godaddy.com: Does only allow to use "registered hosts" as name servers in .com and .net domains. If the name server host is in com or net domain and it is not in the same domain, it needs to be a registered host which basically means that it has to be (or have been) a NS of its SLD with glue record (an A record). But for example, any .fi ending (Finland) host name can be entered as a name server and it gets automatically "registered" without an A record. joker.com: Same as godaddy.com but doesn't allow foreign (like .fi) host names as name servers if they have too many dots in the host name. I didn't dare to try Network Solutions because it was very slow last time I tried the WWW interface. To summarize: I have read this <URL:http://cr.yp.to/djbdns/notes.html#gluelessness> and understand that point of view. Am I trying accomplish something which is not really needed or would such an approach be useful in some situations?

7 8

The Geography of Spam
by sgorman1＠gmu.edu 02 Mar '04

02 Mar '04

Thought folks might find this blurb from Sophos on the geography of Spam interesting. 30% of Spam, they report, comes from hijacked PC's. Matches pretty close to what we see across our network - i.e. all sorts of stuff from swbell.net o U.S. Routes More Spam than World Combined, Study Shows Paris -- Intentionally or not, the U.S. routes more spam e-mail traffic than the rest of the world combined, according to a new study by anti-virus firm Sophos. The study concludes that most of the unsolicited junk e-mails originate in Russia and then passes through hacked computers in the U.S. "More than 30% of the world's spam is sent from these compromised computers, underlining the need for a coordinated approach to spam and viruses," said Charles Cousins, Sophos' Asia managing director . The U.S. accounts for a whopping 56% of the global spam pie, followed by Canada with 6.8%. Europe did not fair very well in the report either, with the Netherlands (5th), Germany (7th), France (8th), the U.K. (9th) and Spain (12th) all making the list. http://www.sophos.com/spaminfo/articles/dirtydozen.html

5 4

Re: External (not in the same domain) name server
by Joe Abley 02 Mar '04

02 Mar '04

On 2 Mar 2004, at 21:02, Randy Bush wrote: >>> Does only allow to use "registered hosts" as name servers >>> in .com and .net domains. >> This is a requirement of Verisign registry, and should be >> true for all net/com registrars. > > s;net/com;; > > presuming you mean that there should be registered host rr > for all known servers. otherwise, i suspect the servfails > will get even worse. Actually, no. Verisign registry requires host records with addresses for nameservers named under com and net, and requires host records without addresses for nameservers named within other domains. Most other registries do not follow the verisign schema of inter-relational host and domain objects; typically nameservers are stored as fields in the records for their dependant domains. In those registries no "registration of hosts" is required. Joe

1 0

NANOG 31 Meeting Information
by Carol Wadsworth 02 Mar '04

02 Mar '04

I am pleased to announce that NANOG 31 will be held May 23-25 at the Westin St. Francis, Union Square, in San Francisco. The meeting will be hosted by CNET Networks. The Call for Presentations will be forthcoming next week. Please continue to check www.nanog.org for meeting updates.

1 0

RE: Converged Networks Threat (Was: Level3 Outage)
by Kuhtz, Christian 02 Mar '04

02 Mar '04

> If events are not properly triggered back upstream (ie: > adjencies stay up, bgp remains fairly stable) and you end up > dumping a lot of traffic on the floor, it's sometimes a bit > more dificult to diagnose than loss of light on a physical path. > > On the sunny side, I see this improving over time. > Software bugs will be squashed. Poorly designed networks > will be reconfigured to better handle these situations. But this happens everywhere, everyday, regardless of the underlying technology. ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." 113

1 0

RE: Converged Networks Threat (Was: Level3 Outage)
by Kuhtz, Christian 02 Mar '04

02 Mar '04

> From where i'm sitting, I see a number of potentially > dangerous trends that could result in some quite catastrophic > failures of networks. No, i'm not predicting that the > internet will end in 8^H7 days or anything like that. I > think the Level3 outage as seen from the outside is a clear > case that single providers will continue to have their own > network failures for time to come. (I just hope daily it's > not my employers network ;-) ) I don't agree with this 'the sky is falling' perspective and we've seen these discussions over and over. Survivability was and continues to be a design goal of anything we do here. Was from the first days and it's true to this day. When you implement a critical service, you need to do due diligence on whether the path chosen meets the needs. > Now the question of Emergency Services is being posed > here but also in parallel by a number of other people at the > FCC. We've seen the E911 recommendation come out regarding > VoIP calls. How long until a simple power failure results in > the inability to place calls? There are specific requirements (read: gov't regulations) to implement E911 with a number of redundancy options, typicalling calling for things like triple path redundancy. While I have worked on E911 infrastructure in the past and I'm not aware of an exhaustive analysis for E911 over IP, I don't see a reason off the top of my head why you can't do the same thing on IP. Sure, requires careful planning. But what critical service doesn't? What are you asking for? More gov't regulation? > While my friends that are local VFD do still have the > traditional pager service with towers, etc... how long until > the T1's that are used for dial-in or speaking to the towers > are moved to some sort of IP based system? The global > economy seems to be going this direction with varying degrees > of caution. > > I'm concerned, but not worried.. the network will survive.. What's your point then? :) There's no panacea for poor implementation. That's why knowledge and experience is important in network design and it's importance is directly linked to the definined critical need of the service implemented. Sorry, just angst for me here. No visible life. Thanks Christian ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." 113

1 0

Re: The Geography of Spam
by sgorman1＠gmu.edu 02 Mar '04

02 Mar '04

I should add that I meant to say it matches the fact we gets lots of spam from hijacked machines - not the 30% number. We have just been looking at a few machines, but would love to see or hear about anyone who has bigger datasets to work with. ----- Original Message ----- From: Brian Bruns <bruns(a)2mbit.com> Date: Tuesday, March 2, 2004 11:23 am Subject: Re: The Geography of Spam > > On Tuesday, March 02, 2004 11:11 AM [EST], sgorman1(a)gmu.edu > <sgorman1(a)gmu.edu>wrote: > > > Thought folks might find this blurb from Sophos on the geography > of Spam > > interesting. 30% of Spam, they report, comes from hijacked > PC's. Matches > > pretty close to what we see across our network - i.e. all sorts > of stuff > > from swbell.net > > > > o U.S. Routes More Spam than World Combined, Study Shows > > > > Paris -- Intentionally or not, the U.S. routes more spam e-mail > traffic> than the rest of the world combined, according to a new > study by > > anti-virus firm Sophos. The study concludes that most of the > unsolicited> junk e-mails originate in Russia and then passes > through hacked computers > > in the U.S. "More than 30% of the world's spam is sent from these > > compromised computers, underlining the need for a coordinated > approach to > > spam and viruses," said Charles Cousins, Sophos' Asia managing > director . > > The U.S. accounts for a whopping 56% of the global spam pie, > followed by > > Canada with 6.8%. Europe did not fair very well in the report > either, with > > the Netherlands (5th), Germany (7th), France (8th), the U.K. > (9th) and > > Spain (12th) all making the list. > > http://www.sophos.com/spaminfo/articles/dirtydozen.html > > I guess I can say, that I can somewhat agree with what they are > saying, but > the percentage seems to be a bit lower then what I would have > said. With the > recent round of viruses that seem to be designed to help spammers > hijack end > user machines, I'd say the percentage is more towards 45-50%. > Sometimes its > very hard to tell the difference between an open proxy, and a > drone running an > open proxy (take the AHBL's proxy list, which is over 410,000 > proxies listed, > and our infected/hijacked machine count comes nowhere near that). > > Part of the reason why alot of the spam comes from outside of the > US is > because US spammers need to hide their actual locations in order > to avoid > getting snared by CAN-SPAM and similar. This is why Ralsky bases > his spamming > campaigns out of China, where the laws are more relaxed in terms > of this > stuff, and is less likely to get yanked off of his net connection. > This is > also why spammers have 'fronts'. :-) > > > -- > Brian Bruns > The Summit Open Source Development Group > Open Solutions For A Closed World / Anti-Spam Resources > http://www.sosdg.org > > The Abusive Hosts Blocking List > http://www.ahbl.org > >

1 0

Need Comcast contact
by Brian Bruns 02 Mar '04

02 Mar '04

Anyone happen to know of a contact for Comcast's mail server administrators? I need to discuss an issue with them about their mail servers mailbombing my systems from a joe job. Thanks. -- Brian Bruns The Summit Open Source Development Group Open Solutions For A Closed World / Anti-Spam Resources http://www.sosdg.org The Abusive Hosts Blocking List http://www.ahbl.org

2 1

Netvision.net.il contact
by cw 02 Mar '04

02 Mar '04

Hi there folks We are having pretty significant issues with person using both Netvision ADSL and what would appear to be a netblock assigned to an Israeli newspaper by Netvision. I saw an old email from someone at Netvision in the NANOG archives so I am hoping that he, or someone else there still reads the list. Does anyone have any experiences of dealing with Netvision with regards to issues with their users? I know there is a website somewhere with known NOC contacts but I can't remember it and don't have it bookmarked. Thanks, Colin.

2 2