May 2005 - Test - lists.nanog.org

D�j� Vu
by Fergie (Paul Ferguson) 08 May '05

08 May '05

Wikipedia: The term déjà vu (French: "already seen", also called promnesia) describes the experience of feeling that one has witnessed or experienced a new situation previously. Fergie: http://fergdawg.blogspot.com/2005/05/some-thoughts-on-how-to-succeed-or-not… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Routing issues Washington DC area
by Fergie (Paul Ferguson) 07 May '05

07 May '05

Depech Mode - Policy of Truth. Well, thanks for the update, but I certainly hope that this "incident" doesn't get glossed over, euphemized, or simply down-played into non-existence like the Network Solutions problems (earlier) did. I'm still waiting for a rational explanation for that one, and all I've seen is bullsh#t. I won't settle for ludicrous euphemisms of what really happened. Nor should any rational, technically inclined engineer. These problems need to be identified, examined technically, and then, perhaps, we can revisit the technical issues which affect all of us. Having said that, this appeared to clearly be more than a simple "glitch" -- and I'd like to see it explained in the sprirt of truthfulness, openess, and the Tao of the 'net. We can't shadow-dance with half-truths, but we can fix real problems when they are acknowledged. Personally, I'm kind of feeling like a mushroom right now -- fed a bunch of sh#t and kept in the dark. - ferg -- Mark Owen <mr.markowen(a)gmail.com> wrote: Everything is back up now. Guess it was a router glitch somewhere to compliment Google's DNS issue. On 5/7/05, Jonathan M. Slivko <jonathan(a)slivko.org> wrote: > Looks OK to me (from Verizon DSL in NY): > > Traceroute to (64.112.229.131) > 1 * (10.32.19.1) 20 ms 22 ms 22 ms > 2 * (130.81.11.161) 22 ms 22 ms 22 ms > 3 so-6-0-0-0.BB-RTR2.NY325.verizon-gni.net (130.81.18.90) 22 ms 22 > ms 22 ms > 4 so-6-0-0-0.BB-RTR2.NY60.verizon-gni.net (130.81.7.201) 22 ms 24 > ms 22 ms > 5 so-2-0-0-0.PEER-RTR1.NY60.verizon-gni.net (130.81.4.214) 24 ms 22 > ms 22 ms > 6 jfk-edge-20.inet.qwest.net (65.116.172.85) 22 ms 22 ms 22 ms > 7 jfk-core-01.inet.qwest.net (205.171.230.14) 22 ms 22 ms 22 ms > 8 stl-core-01.inet.qwest.net (205.171.5.81) 94 ms 122 ms 94 ms > 9 egn-core-01.inet.qwest.net (205.171.5.126) 100 ms 100 ms 100 ms > 10 eug-edge-02.inet.qwest.net (205.171.150.18) 102 ms 100 ms 100 ms > 11 * (207.109.243.74) 100 ms 100 ms 102 ms > 12 64-112-224-3-ips-eug-or-core02.tcpipservices.net (64.112.224.3) > 116 ms 116 ms 118 ms > 13 64-112-227-69-ips-eug-or-lb01-2.tcpipservices.net > (64.112.227.69) 116 ms 118 ms 118 ms > 14 maverick31.sans.org (64.112.229.131) 142 ms 116 ms 118 ms > > Mark Owen wrote: > > Hi All, > > > > Not sure where the problem is at but several packets are being dropped > > to several different hosts from the DC area. (This is not the Google > > DNS problem) > > I tried connecting to several different known sites with roughly 40% > > being unresponsive from two seperate ISPs (Speakeasy and Comcast.) > > > > Traceroute to sans.org via Comcast: > > ~~~~~~~~~~~~~ > > 1 <1 ms <1 ms <1 ms 192.168.20.1 > > 2 12 ms 15 ms 6 ms 10.84.240.1 > > 3 21 ms 11 ms 7 ms ge-2-3-ur02.lanham.md.bad.comcast.net [68.87.131 > > .125] > > 4 8 ms 12 ms 32 ms te-9-1-ur01.lanham.md.bad.comcast.net [68.87.129 > > .61] > > 5 11 ms 21 ms 9 ms te-9-1-ur01.bowie.md.bad.comcast.net [68.87.128. > > 177] > > 6 8 ms 6 ms 27 ms te-8-2-ar01.capitolhghts.md.bad.comcast.net [68. > > 87.128.182] > > 7 7 ms 8 ms 8 ms 68.87.16.165 > > 8 15 ms 9 ms 7 ms 12.118.122.9 > > 9 8 ms 9 ms 9 ms tbr1-p010401.wswdc.ip.att.net [12.123.9.106] > > 10 7 ms 8 ms 8 ms ggr2-p300.wswdc.ip.att.net [12.123.9.81] > > 11 10 ms 9 ms 12 ms att-gw.dc.sprint.net [192.205.32.166] > > 12 27 ms 13 ms 9 ms sl-bb26-rly-5-0.sprintlink.net [144.232.20.149] > > > > 13 39 ms 33 ms 32 ms sl-bb25-chi-3-0.sprintlink.net [144.232.20.89] > > 14 78 ms 76 ms 84 ms sl-bb21-sea-1-0.sprintlink.net [144.232.20.156] > > > > 15 75 ms 77 ms 74 ms sl-bb20-sea-15-0.sprintlink.net [144.232.6.89] > > 16 75 ms 74 ms 81 ms sl-bb22-tac-6-0.sprintlink.net [144.232.9.151] > > 17 77 ms 75 ms 75 ms sl-bb21-tac-4-0.sprintlink.net [144.232.17.93] > > 18 76 ms 76 ms 76 ms sl-gw6-tac-10-0.sprintlink.net [144.232.17.1] > > 19 88 ms 83 ms 86 ms sl-micro23-1-0-0.sprintlink.net [160.81.243.66] > > > > 20 82 ms 80 ms 83 ms 64-112-224-3-ips-eug-or-core02.tcpipservices.net > > [64.112.224.3] > > 21 86 ms 85 ms 84 ms 64-112-227-69-ips-eug-or-lb01-2.tcpipservices.ne > > t [64.112.227.69] > > 22 maverick32.sans.org [64.112.229.132] reports: Destination host > > unreachable. > > > > ~~~~~~~~~~~~~~~~~~~~~~~ > > Traceroute via Speakeasy would timeout. > > > > Same thing goes for other sites > > ubuntulinux.org > > www.osvdb.org for example. > > > > Anyone else having similar problems? > > > -- Mark Owen -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Routing issues Washington DC area
by Mark Owen 07 May '05

07 May '05

Hi All, Not sure where the problem is at but several packets are being dropped to several different hosts from the DC area. (This is not the Google DNS problem) I tried connecting to several different known sites with roughly 40% being unresponsive from two seperate ISPs (Speakeasy and Comcast.) Traceroute to sans.org via Comcast: ~~~~~~~~~~~~~ 1 <1 ms <1 ms <1 ms 192.168.20.1 2 12 ms 15 ms 6 ms 10.84.240.1 3 21 ms 11 ms 7 ms ge-2-3-ur02.lanham.md.bad.comcast.net [68.87.131 .125] 4 8 ms 12 ms 32 ms te-9-1-ur01.lanham.md.bad.comcast.net [68.87.129 .61] 5 11 ms 21 ms 9 ms te-9-1-ur01.bowie.md.bad.comcast.net [68.87.128. 177] 6 8 ms 6 ms 27 ms te-8-2-ar01.capitolhghts.md.bad.comcast.net [68. 87.128.182] 7 7 ms 8 ms 8 ms 68.87.16.165 8 15 ms 9 ms 7 ms 12.118.122.9 9 8 ms 9 ms 9 ms tbr1-p010401.wswdc.ip.att.net [12.123.9.106] 10 7 ms 8 ms 8 ms ggr2-p300.wswdc.ip.att.net [12.123.9.81] 11 10 ms 9 ms 12 ms att-gw.dc.sprint.net [192.205.32.166] 12 27 ms 13 ms 9 ms sl-bb26-rly-5-0.sprintlink.net [144.232.20.149] 13 39 ms 33 ms 32 ms sl-bb25-chi-3-0.sprintlink.net [144.232.20.89] 14 78 ms 76 ms 84 ms sl-bb21-sea-1-0.sprintlink.net [144.232.20.156] 15 75 ms 77 ms 74 ms sl-bb20-sea-15-0.sprintlink.net [144.232.6.89] 16 75 ms 74 ms 81 ms sl-bb22-tac-6-0.sprintlink.net [144.232.9.151] 17 77 ms 75 ms 75 ms sl-bb21-tac-4-0.sprintlink.net [144.232.17.93] 18 76 ms 76 ms 76 ms sl-gw6-tac-10-0.sprintlink.net [144.232.17.1] 19 88 ms 83 ms 86 ms sl-micro23-1-0-0.sprintlink.net [160.81.243.66] 20 82 ms 80 ms 83 ms 64-112-224-3-ips-eug-or-core02.tcpipservices.net [64.112.224.3] 21 86 ms 85 ms 84 ms 64-112-227-69-ips-eug-or-lb01-2.tcpipservices.ne t [64.112.227.69] 22 maverick32.sans.org [64.112.229.132] reports: Destination host unreachable. ~~~~~~~~~~~~~~~~~~~~~~~ Traceroute via Speakeasy would timeout. Same thing goes for other sites ubuntulinux.org www.osvdb.org for example. Anyone else having similar problems? -- Mark Owen

2 2

Problem with the list?
by Fergie (Paul Ferguson) 07 May '05

07 May '05

Are there problems with the list today? It appears that I'm getting responses sent to the list quite delayed -- upwards to 45 minutes this evening... What gives? - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: google.com outage?
by Jonathan M. Slivko 07 May '05

07 May '05

Daniel, Hmmm..... I don't think so, but the IP's seem to be different than they were before from a cached WHOIS. IIRC, didn't Google used to be on InterNAP and now they're on Cogent/Verio? -- Jonathan Daniel Medina wrote: > On Sat, May 07, 2005 at 11:48:03PM +0000, Fergie (Paul Ferguson) wrote: > >>Om Malik seems to think they were hacked: >> >>http://www.gigaom.com/2005/05/07/google-hacked/ >> >>Decide for yourselves. > > > Folks reporting the hijack were most likely infected with adware and > being redirected. > > Oops, I didn't mean "infected with adware". I mean they installed a > "customized search tool bar", or "web query optimizer" for themselves. > > Wasn't Google using Akamai? Is the "L" in "l.google.com" for > load-balancing? > > From the above link: > > "Recap: 6:13PM PST: Google was not hacked, but instead had a DNS > problem. For some the site was redirecting to the SoGoSearch page. All > services have been restored." >

1 0

Re: google.com outage?
by Jonathan M. Slivko 07 May '05

07 May '05

Chris, Here's what I get when singling out google.com: Domain Name: GOOGLE.COM Registrar: ALLDOMAINS.COM INC. Whois Server: whois.alldomains.com Referral URL: http://www.alldomains.com Name Server: NS2.GOOGLE.COM Name Server: NS1.GOOGLE.COM Name Server: NS3.GOOGLE.COM Name Server: NS4.GOOGLE.COM Status: REGISTRAR-LOCK Updated Date: 03-oct-2002 Creation Date: 15-sep-1997 Expiration Date: 14-sep-2011 (whois =google.com) Chris Paul wrote: > On or about Sat, 07 May 2005 19:40:20 -0400 > "Jonathan M. Slivko" <jonathan(a)slivko.org> allegedly wrote: > > >>N.B. Seems to be resolved now, after ~ 40 minutes or so. >> > > > doesn't look resolved: > > [cp@honey:/home/cp]$ whois google.com > > Whois Server Version 1.3 > > Domain names in the .com and .net domains can now be registered > with many different competing registrars. Go to http://www.internic.net > for detailed information. > > GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM > GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE.THAN.SECZY.COM > GOOGLE.COM > > To single out one record, look it up with "xxx", where xxx is one of the > of the records displayed above. If the records are the same, look them up > with "=xxx" to receive a full display for each record. > > >>>>Last update of whois database: Sat, 7 May 2005 08:52:39 EDT <<< > >

1 0

Re: google.com outage?
by Fergie (Paul Ferguson) 07 May '05

07 May '05

Om Malik seems to think they were hacked: http://www.gigaom.com/2005/05/07/google-hacked/ Decide for yourselves. - ferg -- "Jonathan M. Slivko" <jonathan(a)slivko.org> wrote: N.B. Seems to be resolved now, after ~ 40 minutes or so. Jonathan M. Slivko wrote: > > Hmmm.... did anyone hear anything about a Google outage that's been > going on for the past 20 minutes or so? It appears to be DNS related > (ns1-ns4.google.com didn't have a record of www.google.com or > www.gmail.com) I can't find any articles on the net about it and was > wondering if anyone heard anything. > -- Jonathan M. Slivko - jonathan(a)slivko.org "Linux: The Choice for the GNU Generation" - http://www.linux.org/ - Don't fear the penguin. .^. /V\ /( )\ ^^-^^ He's here to help. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

google.com outage?
by Jonathan M. Slivko 07 May '05

07 May '05

Hmmm.... did anyone hear anything about a Google outage that's been going on for the past 20 minutes or so? It appears to be DNS related (ns1-ns4.google.com didn't have a record of www.google.com or www.gmail.com) I can't find any articles on the net about it and was wondering if anyone heard anything. -- Jonathan M. Slivko - jonathan(a)slivko.org "Linux: The Choice for the GNU Generation" - http://www.linux.org/ - Don't fear the penguin. .^. /V\ /( )\ ^^-^^ He's here to help.

3 3

anycast and ddos
by Randy Bush 07 May '05

07 May '05

it seems that anycasting was quite insufficient to protect netsol's service from being severely damaged (udp dead, tcp worked) for a considerable length of time by a ddos [0] last week [1]. it would be very helpful to other folk concerned with service deployment to understand how the service in question was/is anycast, and what might be done differently to mitigate exposure of similar services. anyone have clues or is this ostrich city? maybe a preso at nanog would be educational. randy --- [0] - as it seems that the ddos sources were ip address spoofed (which is why the service still worked for tcp), i owe paul an apology for downplaying the immediacy of the need for source address filtering. [1] - netsol is not admitting anything happened, of course <sigh>. but we all saw the big splash as it hit the water, the bubbles as it sank, and the symptoms made the cause pretty clear.

3 6

Re: anycast and ddos
by Fergie (Paul Ferguson) 06 May '05

06 May '05

As one of the co-authors of RFC-2827, I'm assuming you meant me -- if so, no apology needed. :-) I'm just sorry to have to see a "weakness" exploited which could easily be "fixed".... - ferg ps. This also seems like a good time to mention (again) "The Spoofer Project" at MIT: http://momo.lcs.mit.edu/spoofer/ [and] http://momo.lcs.mit.edu/spoofer/summary.php -- Randy Bush <randy(a)psg.com> wrote: it seems that anycasting was quite insufficient to protect netsol's service from being severely damaged (udp dead, tcp worked) for a considerable length of time by a ddos [0] last week [1]. it would be very helpful to other folk concerned with service deployment to understand how the service in question was/is anycast, and what might be done differently to mitigate exposure of similar services. anyone have clues or is this ostrich city? maybe a preso at nanog would be educational. randy --- [0] - as it seems that the ddos sources were ip address spoofed (which is why the service still worked for tcp), i owe paul an apology for downplaying the immediacy of the need for source address filtering. [1] - netsol is not admitting anything happened, of course <sigh>. but we all saw the big splash as it hit the water, the bubbles as it sank, and the symptoms made the cause pretty clear. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4