May 2005 - Test - lists.nanog.org

RE: what will all you who work for private isp's be doing in a few years?
by Shaun Bryant 11 May '05

11 May '05

I have to second this one, having used Comcast and qwest. I look for the small guy, they have something to loss if I drop them and switch. I also like that I can drive down to there office and sit on someone's desk if I am not getting the service I want. Shaun ________________________________ From: owner-nanog(a)merit.edu on behalf of Adam Jacob Muller Sent: Wed 5/11/2005 12:33 PM To: Matt Bazan Cc: nanog(a)nanog.org Subject: Re: what will all you who work for private isp's be doing in a few years? It's simple, A DSL provider like speakeasy offers much more to a technical user like myself than Comcast does, plus they have an incentive to keep me happy, if i'm not i can leave and go with a competitor, comcast does, and has on many occasions, simply told me to go f*ck myself when i have service issues. (Sorry your modem died sir, the next we can get a tech out to your place is 2 weeks, when i don't need a tech I know what it means when a modem has a failure code). The fact is, DSL is a competitive market, Cable is not, competitive markets keep customers happy, monopolies anger people. Adam On May 11, 2005, at 2:08 PM, Matt Bazan wrote: > > why in the world would anyone want to purchase dsl from a private > reseller when i can get 4mb down 384 up from comcast for $25? > think you > dsl resellers out there are doomed. in fact, just a matter of time > before most of you isps are down the toilet. im reminded of the > mom and > pop grocery store phenomenon that has now been replaced by the kohls, > a&p, whole foods etc. of course there will always be niche markets > but > this is less applicable for a pure commodity like bandwidth. yeah, i > suppose you'll say something about value added services and such > and you > may have a point but i doubt that will keep the ship afloat for long. > > > !DSPAM:42824b1926542573616784! > >

2 1

DNS requests and Bandwidth
by aljuhani 11 May '05

11 May '05

Hello List. We have one domain setup on our server dns but there is no website or email configured .. Recently we've noticed some increase in server Bandwidth usage and after using tcpdump, we were able to find the problem which is a DNS server on the Internet sending many queries per second to resolve MX , A records for that domain which is not existing of course but it keeps asking. One way was to block requests from that DNS IP but that was not practicle as many users on that DNS won't be able to communicate with our server. so What is the best way to prevent DNS queries consuming bandwidth. tcpdump output extract: 14:40:09.407336 212.26.72.85.34997 > ns.MyNameServer.net.domain: 51794 MX? MyDomain.com. (29)(DF) 14:40:09.411707 212.26.72.85.34997 > ns.MyNameServer.net.domain: 14233 A? MyDomain.com. (29) (DF) 14:40:09.415880 212.26.72.85.34997 > ns.MyNameServer.net.domain: 39317 MX? MyDomain.com. (29) (DF) 14:40:09.419827 212.26.72.85.34997 > ns.MyNameServer.net.domain: 49503 A? MyDomain.com. (29) (DF) 14:40:09.423700 212.26.72.85.34997 > ns.MyNameServer.net.domain: 29362 A? MyDomain.com. (29) (DF) 14:40:09.426963 212.26.72.85.34997 > ns.MyNameServer.net.domain: 16692 A? MyDomain.com. (29) (DF) 14:40:09.430590 212.26.72.85.34997 > ns.MyNameServer.net.domain: 65288 A? MyDomain.com. (29) (DF) 14:40:09.434350 212.26.72.85.34997 > ns.MyNameServer.net.domain: 1341 A? MyDomain.com. (29) (DF) 14:40:09.438163 212.26.72.85.34997 > ns.MyNameServer.net.domain: 57932 A? MyDomain.com. (29) (DF) --- -aljuhani

4 4

RE: DNS requests and Bandwidth
by David Hubbard 11 May '05

11 May '05

From: aljuhani > > > One way was to block requests from that DNS IP but that was not > practicle as many users on that DNS won't be able to communicate > with our server. > > so What is the best way to prevent DNS queries consuming bandwidth. Run an authoritative-only DNS server that won't respond to queries for domains it doesn't handle. tinydns from http://cr.yp.to/djbdns.html would be an example. David

2 1

Re: Blocking port udp/tcp 1433/1434
by Fergie (Paul Ferguson) 11 May '05

11 May '05

You decide: http://www.dshield.org/topports.php http://www.mynetwatchman.com/tp.asp - ferg -- Joe Maimon <jmaimon(a)ttec.com> wrote: Is there still justification for denying transit for ms-sql slammer ports? Thanks, Joe -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Squid Cache DNS Lookup Spoofing Vulnerability
by Fergie (Paul Ferguson) 11 May '05

11 May '05

Given the recent attention to all matters of DNS cache poisoning (real or imagined), I figured this item might of interest to the list. I know there's a lot of Squid Caches out there... - ferg [snip] Via Secunia: http://secunia.com/advisories/15294/ Secunia Advisory: SA15294 Release Date: 2005-05-11 Impact: Spoofing Where: From local network Solution Status: Vendor Patch Software: Squid 2.x Description: A vulnerability has been reported in Squid, which can be exploited by malicious people to spoof DNS lookups. The vulnerability is caused due to an unspecified error in the DNS client when handling DNS responses and can be exploited to spoof DNS lookups. The vulnerability has been reported in version 2.5 and prior. Solution: Apply patch for version 2.5.STABLE9: http://www.squid-cache.org/Versi...id-2.5.STABLE9-dns_query-2.patch Original Advisory: http://www.squid-cache.org/Versi...ugs/#squid-2.5.STABLE9-dns_query [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Correction: Squid Cache DNS Lookup Spoofing Vulnerability
by Fergie (Paul Ferguson) 11 May '05

11 May '05

Mea culpa: The correct link for the appropriate patch(es): http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: Given the recent attention to all matters of DNS cache poisoning (real or imagined), I figured this item might of interest to the list. I know there's a lot of Squid Caches out there... - ferg [snip] Via Secunia: http://secunia.com/advisories/15294/ Secunia Advisory: SA15294 Release Date: 2005-05-11 Impact: Spoofing Where: From local network Solution Status: Vendor Patch Software: Squid 2.x Description: A vulnerability has been reported in Squid, which can be exploited by malicious people to spoof DNS lookups. The vulnerability is caused due to an unspecified error in the DNS client when handling DNS responses and can be exploited to spoof DNS lookups. The vulnerability has been reported in version 2.5 and prior. Solution: Apply patch for version 2.5.STABLE9: http://www.squid-cache.org/Versi...id-2.5.STABLE9-dns_query-2.patch Original Advisory: http://www.squid-cache.org/Versi...ugs/#squid-2.5.STABLE9-dns_query [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Unusual IN ANY DNS Traffic
by Douglas E. Warner 11 May '05

11 May '05

On Wednesday 11 May 2005 03:57, Simon Waters wrote: > Indeed moderns versions of BIND default to high ports for DNS queries as > well unless configured otherwise. I think old versions of BIND and the odd > firewall product were the main thing doing source port 53 queries. > > I was going to suggest email servers as a possible cause -- I think > probably you'll have to speak to a customer if it still persists. Make sure > they haven't been owned. Might just have been a spam run or mailshot with > "msn.com" as the reply, and you discovering how many email servers are out > there or similar. > I suspect you're correct; these are probably some DSL customers who have "0wn3d" by either a virus or malware and have just been "turned on" to spam domains at "msn.com". Unfortunately we don't do protocol graphs on our major routers or else I would have been able to see a spike of port 25 traffic if it had existed - we just graph our DNS server query which is why I noticed the jump. > I assume your not using something daft like MS DNS server, but a recent > BIND or DJB cache. Also correct; we're running BIND 9.2.2 and I parse the query logs to see what kind of traffic we're getting via the different query types. -Doug -- Douglas E. Warner <dwarner(a)ctinetworks.com> Network Engineer CTI Networks, Inc. http://www.ctinetworks.com +1 717 975 9000

1 0

RE: DOS attack tracing
by Richard 11 May '05

11 May '05

> Right... I did mention that further down in my message. And yeah - > almost impossible to get much done when the CPU is pegged. I remember > a DOS attack demo where they used 7200s for the examples - almost > wanted to yell out "try pegging the CPU with lots of traffic and THEN > try to identify / null0 the destination or source". That's the problem in our case. One of our downstream customers got the attack. Once we disconnected them, everything became fine. I tried pretty much everything under our control to divert the traffic, including ingress acl to block all incoming traffic to their subnets. But every time I turn the downstream ISP back on, our router was dead. We got a 7206VXR and 100M Ethernet to the primary upstream. I think that the lesson is _always_ use a router powerful enough to handle all ingress traffic at wire rate. Without access to the router, there is nothing you can do. So we are going to switch out the router. Richard

2 1

Google DNS problems?!?
by Fergie (Paul Ferguson) 10 May '05

10 May '05

Does anyone else think that its a bit odd that if it were simply "DNS problems" that a redirect for www.google.com would end up at a location which provided this: http://img179.echo.cx/img179/7959/googlehacked7to.jpg [or] http://img241.echo.cx/img241/6208/googlemsn3lp.png Seems more than simple "DNS problems" to me. I hate being played like an idiot.... - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

8 8

RE: DOS attack tracing
by Chris Ranch 10 May '05

10 May '05

> > I don't know why they even sell the NSE100. You want the > NPE with the > > PXF. > > > > Chris > > No, that's backward. > > The NSE100 has the PXF processor. > > The NPE-G100 is a software router. Correct, of course. Thanks. Chris

1 0