May 2005 - Test - lists.nanog.org

VoIP operators given 120-day deadline to implement E911 services
by Fergie (Paul Ferguson) 19 May '05

19 May '05

Yep: http://news.yahoo.com/news?tmpl=story&u=/ap/20050519/ap_on_hi_te/911_intern… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 3

Re: Underscores in host names
by Mark Andrews 19 May '05

19 May '05

In article <1116377042.592906.137650(a)g44g2000cwa.googlegroups.com> you write: >Hello all. >We have a client containing an underscore in the email address domain >name. Our email server rejects it because of it's violation of the RFC >standard. This individuals claim is that he doesn't have problems >anywhere else and if this is going to be a problem he's "going to take >his business elsewhere"! > >I understand it's a violation of the standard, but does it pose a >security hole to the email server to allow this sort of mail? > >Thanks > RFC 952 and RFC 1123 describe what is currently legal in hostnames. Underscore is NOT a legal character in a hostname. Before anyone says that domain names allow underscore which they do. RFC 1034 Section 3.3 For hosts, the mapping depends on the existing syntax for host names which is a subset of the usual text representation for domain names, together with RR formats for describing host addresses, etc. Because we need a reliable inverse mapping from address to host name, a special mapping for addresses into the IN-ADDR.ARPA domain is also defined. Mail domains follow the same rules as for hostnames. RFC 821 and its replacement RFC 2821 havn't extended the syntax to include underscores. Mark

17 36

Re: Underscores in host names
by MARLON BORBA 19 May '05

19 May '05

Hmm, they've always teached to me that . (dot) at the end of hostnames indicates the (hidden) Root domain: blah.domain.com.[Root] And my teachers always said that we don't need to write the final . because every domain belongs to the Root domain. As for DNS servers for the Root domain, they are the reason for putting that "hint" files into our /var/named directory, "non"? Regards, Marlon Borba, CISSP Abraços, Marlon Borba, CISSP. "Por que 100? Bastaria um se eu estivesse errado!" --Albert Einstein, sobre o livro dos nazistas "100 cientistas contra Einstein". >>> "Peter & Karin Dambier" <peter(a)peter-dambier.de> 05/19/05 9:00 AM >>> [...] Because programmes like check_soa from the O'Reilly book "DNS and BIND" or sendmail believe it makes sense to force a dot at the end of every name they look up. There are nameservers in the root zone file that DNS will not find. /etc/hosts is the only way to get them. Dont forget to have both names with and without dot.

3 2

Cisco Vulnerability in a Variant of the TCP Timestamps Option
by Fergie (Paul Ferguson) 19 May '05

19 May '05

Cisco yesterday reported a vulnerability with some implementations of the Transmission Control Protocol (TCP) Timestamps option (RFC1323) are vulnerable to a Denial of Service (DoS) attack from specifically crafted packets. Cisco also states that only certain implementations of the TCP Timestamps option are vulnerable. The entire security alert can be found here: http://www.cisco.com/warp/public/707/cisco-sn-20050518-tcpts.shtml - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Underscores in host names
by Peter & Karin Dambier 19 May '05

19 May '05

> --- original message --- > from: Mark Andrews <Mark_Andrews(a)isc.org> > to: nanog(a)merit.edu > Re: Underscores in host names > Datum: Thu, 19 May 2005 10:40:32 +1000 (EST) > > Hostnames can't have a dot at the end either. The dot at the > end is a local resolver indication to not use the search list. > /etc/hosts: 217.29.76.4 IT2.MIX-IT.NET IT2.MIX-IT.NET. Why? Because programmes like check_soa from the O'Reilly book "DNS and BIND" or sendmail believe it makes sense to force a dot at the end of every name they look up. There are nameservers in the root zone file that DNS will not find. /etc/hosts is the only way to get them. Dont forget to have both names with and without dot. That is horrible, but I have to live with it Regards, Peter and Karin Dambier -- Peter und Karin Dambier Graeffstrasse 14 D-64646 Heppenheim +49-6252-671788 (Telekom) +49-6252-599091 (O2 Genion) +1-360-226-6583-9738 (INAIC) peter(a)peter-dambier.de peter(a)mail.inaic http://iason.site.voila.fr peter-dambier.site.voila.fr

1 0

Reback SMS / DSL packet loss issue.
by Stephen Fulton 19 May '05

19 May '05

Hi all, Hope the last NANOG was good, I was supposed to go, but alas business got in the way. I've got a question about an issue I'm seeing with some DSL clients. It may not be limited to Redback's SMS, but that's the platform being used, so I won't speak in generalities. Occasionaly clients connected via ATM PVC's experience packet loss after reconnecting due to power loss. The line sync is fine, but packet loss of between 40 - 60% occurs. Only once I've used "clear sub <subscriber>" to disconnect the session does the packet loss stop. Anyone know why that would be? I'd appreciate any insight or a push in the right direction regarding this, thanks. -- Stephen Fulton | We can be quick-witted Systems Administrator | or very intelligent Toronto, Canada | but not both. http://www.esoteric.ca/ | -- Stephen Hawking.

4 4

Announcing BGP troubleshooting work for ISPs
by Z. Morley Mao 18 May '05

18 May '05

Dear all, We (jointly with AT&T Research Lab) have recently developed a real-time troubleshooting tool that identifies significant and actionable BGP routing events (on the order of a few dozen) from millions of BGP updates from border routers of a given ISP network. The goal is for an ISP's network operators to identify locally observed BGP events that are important (e.g., affect a large number of prefixes, shift a lot of traffic, etc.) Our paper is published at NSDI: http://www.eecs.umich.edu/~zmao/Papers/nsdi05-jian.pdf The talk slides are at: http://www.eecs.umich.edu/~zmao/talks/nsdi2005.ppt http://www.eecs.umich.edu/~zmao/talks/nsdi2005.pdf We have several interesting findings when we applied our tool for the AT&T data: -We found more than 15% of the updates are due to persistently flapping prefixes even when flap damping was enabled. The reason is that flap damping is session-based. When a session is reset, the damping history is not retained. Moreover, damping is not implemented for iBGP sessions. There are three main causes for persistent flapping: (1) Conservative damping parameters (2) Protocol oscillations due to MED (3) Unstable interfaces or BGP sessions -We found eBGP session resets and hot potato changes contribute to many routing disturbances, and most of the routing events that have major impact on traffic shift are also due to session resets and hot potato events. Please let us know if you have any comments/feedback. Unfortunately, the tool is not yet available, but the detailed information of how the tool works is available in the paper. Thanks! -Z. Morley Mao, Jian Wu, Jennifer Rexford, Jia Wang

1 0

Experiences with 911 calls and SIP
by Dan Lockwood 18 May '05

18 May '05

Hi all, I'm having a discussion with one of my vendors about the 911 capabilities of their SIP VoIP phone system. The vendor says that if we use an Enhanced 911 service that their phone system will transmit location information to the PSAP at the time of the call in addition to the ANI. I was under the impression that this functionality was not possible, hence all the problems that Vonage is having. Can anyone help clarify this for me? Thanks, Dan

5 4

Engineers in the Miami area
by J. Oquendo 18 May '05

18 May '05

Hey all, Anyone in the Miami (South Beach) area willing to contact me offlist. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x0D99C05C http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0D99C05C To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

1 0

Two items: Honeynet 'Phishing" paper & Honeywall CDROM 'Roo'
by Fergie (Paul Ferguson) 18 May '05

18 May '05

Of emminent interest to NANOG'ers: The good folks over at the Honeynet Project and Research Alliance have published an excellent paper, "Know Your Enemy: Phishing; Behind the Scenes of Phishing Attacks" -- http://www.honeynet.org/papers/phishing/ Definately worth a read. Also, they have also have released a new Honeywall CDROM "Roo" -- "The purpose of the new CDROM is to make honeynets easier to deploy, maintain, and analyze. This new version has been redesigned rom the ground up and represents the latest in our GenIII (third generation) technologies." More info: http://www.honeynet.org/papers/cdrom/ http://www.honeynet.org/tools/cdrom/ Cheers, - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0