July 2005 - Test - lists.nanog.org

SORBs
by Sanfilippo, Ted 06 Jul '05

06 Jul '05

Does anyone know of an easier way to remove IP blocks from a blacklist? We received a /16 from ARIN in May and have been trying to get SORB's to remove the blacklist association on these addresses. They seem to take forever to remove the blacklist association. Thanks Ted

3 2

Re: OT? /dev/null 5.1.1 email
by Valdis.Kletnieks＠vt.edu 06 Jul '05

06 Jul '05

On Tue, 05 Jul 2005 21:27:23 PDT, Justin Mason said: > BTW, someone (possibly Randal L. Schwartz) came up with a neat related > trick to the above -- set up an interface alias on *the same machine* as > the primary MX, list that as the last MX in the list, and (assuming that > the software side of the primary MX is reliable) you're then assured that > any SMTP traffic that arrives on that IP's port 25 is spam, since when > the primary MX's hardware goes down, this MX will, too. (Damn, left out a paragraph somehow) And in fact, given that most link hiccups *are* transitory, the chances are *good* that if our attempts at the first MX fail, the link will be back before we finish running through the MX's - at which point we find ourselves talking to a spamtrap.

2 1

Re: The whole alternate-root ${STATE}horse (was Re: Enable BIND cache server to resolve chinese domain name?)
by Steve Gibbard 06 Jul '05

06 Jul '05

On Tue, 5 Jul 2005, Jay R. Ashworth wrote: > But Steve appeared to be suggesting that there was no reasonable way to > *avoid* problems -- and that's clearly not the case. If I misinterpreted > Steve, no doubt he'll correct me. But there are two fairly prominent, I don't think that was what I said. What I was attempting to say is that the issue of alternate roots probably isn't something that's worth worrying about. I see no reason why they'll catch on, other than perhaps in limited cases where they'll work ok. In the general case, with alternate roots, there's a chicken and egg problem. Right now, if you're an end user doing your DNS lookups via the ICANN root, you can get to just about everything. If you're something that end users want to connect to, using an ICANN-recognized domain will mean almost everybody can get to you, while an "alternative" TLD would mean only a tiny fraction of the Internet would be able to get to you. So, if you're a content provider, why would you use anything other than a real ICANN-recognized domain? And, if the content providers aren't using real domain names, why would an end user care about whether they can get to the TLDs that nobody is using? This is the same phonomenon we saw ten years ago, as the various "online services," GENIE, Prodigy, MCIMail, Compuserve, AOL, etc. either interconnected their e-mail systems with the Internet or faded away and died. As the Internet got more and more critical mass, there was less and less incentive to be using something else. It's been a long time since I've seen a business card with several different, incompatible, e-mail addresses printed on it, and that's because something simpler worked, not because people screamed loudly about the falling sky. The exceptions to this that I see would be either when somebody comes out with something that is so much better that it's useful in spite of a lack of an installed userbase (Skype may be doing this to phone calls), or when something is rolled out to a large enough self-contained user community that the lack of ability to communicate outside that region won't be a significant barrier. If a few large countries were to roll out alternate root zones nation-wide, in such a way that they worked well for domestic communication, but couldn't be used for international stuff, *maybe* that would be good enough to catch on. But still, anybody wanting to communicate outside that region or userbase would probably find they were much happier using addresses that met global standards. So anyhow, that's a long way of saying that, just as this hasn't gone anywhere any of the many other times it's been raised over the last several years, it's unlikely to go anywhere, or cause problems, this time. -Steve

5 4

Worldnic does TCP-before-UDP DNS tricks, breaking powerdns recursor and those w/o TCP connectivity
by bert hubert 06 Jul '05

06 Jul '05

Hi Nanog people, The PowerDNS recursor has hit a snag resolving www.kde-look.org. It appears Worldnic has implemented 'TCP-before-UDP' on ns{9,10}.worldnic.com, whereby it sends out answers with the truncated bit set, and without an actual answer. Once the client has re-asked the query over TCP, it from then on allows UDP queries. This is possibly done to prevent DoS attacks. This hits those people who've been running the pdns recursor w/o heeding the warning on http://doc.powerdns.com/built-in-recursor.html stating our inadequacies regarding truncated packets. But is also hits everybody who only allows UDP port 53, which generally works fine, except now! Recall the AOL huge packet event from way back. So make sure your resolvers have TCP connectivity! And yes, my message may read a bit like djb's back in the time AOL started to use > 512 byte packets :-) The problem is solved in SVN luckily. Apologies. But just a heads up that if you suddenly have non-working Worldnic domains, you now know two possible causes. A quick solution for PowerDNS recursor users is to run 'dig www.kde-look.org @ns9.worldnic.com' periodically. Or upgrade to the SVN snapshot mentioned below, but do note that it is experimental. Wiki: http://wiki.powerdns.com/projects/trac/ Message: http://mailman.powerdns.com/pipermail/pdns-users/2005-July/002414.html SVN snapshot solving the problem: http://ds9a.nl/pdns/pdns-2.9.18-svn.tar.gz -- http://www.PowerDNS.com Open source, database driven DNS Software http://netherlabs.nl Open and Closed source services

1 0

Re: OT? /dev/null 5.1.1 email
by Valdis.Kletnieks＠vt.edu 06 Jul '05

06 Jul '05

On Tue, 05 Jul 2005 21:27:23 PDT, Justin Mason said: > BTW, someone (possibly Randal L. Schwartz) came up with a neat related > trick to the above -- set up an interface alias on *the same machine* as > the primary MX, list that as the last MX in the list, and (assuming that > the software side of the primary MX is reliable) you're then assured that > any SMTP traffic that arrives on that IP's port 25 is spam, since when > the primary MX's hardware goes down, this MX will, too. That's got the same failure mode - if I take a 30-second hit and can't reach the first MX, then the link comes up before I try the last MX, I hit the "bad" one. And since the link burp is at *my* end, you don't even know about it, unless you hook it into a full BGP feed with Zebra or something and see AS1312's routes flap (and even then, it's dicy - a very short burp may not cause the routes to be withdrawn)....

1 0

Please update filters for 58/8
by John Tran 06 Jul '05

06 Jul '05

Dear colleagues In May 2005, IANA's delegation of the following address block to APNIC was widely broadcast to the operational and RIR mailing lists: 58.0.0.0/8 However, since that time, APNIC has received widespread reports of difficulties routing address space within this range. If you haven't already done so, please update your network configurations specifically for this range. IANA maintains a list of reserved and delegated IPv4 address ranges at: http://www.iana.org/assignments/ipv4-address-space Regards Son __________________________________________________________________________ Resources Services Manager <Son(a)apnic.net> Asia Pacific Network Information Centre phone: +61 7 3858 3100 http://www.apnic.net fax: +61 7 3858 3199 Helpdesk phone: +61 7 3858 3188 email: helpdesk@apnic$ Please send Internet Resource Requests to <hostmaster(a)apnic.net> __________________________________________________________________________

3 2

OT: Stupid vendor tricks.
by Bill Nash 05 Jul '05

05 Jul '05

Co-workers from past lives will recognize this as a subject near and dear to my little black heart: CISCO-SLB-MIB::slbServerFarmBindId.4."10.0.0.10" = Gauge32: 0 CISCO-SLB-MIB::slbServerFarmBindId.4."10.0.0.11" = Gauge32: 0 CISCO-SLB-MIB::slbServerFarmBindId.4."10.0.0.12" = Gauge32: 0 CISCO-SLB-MIB::slbServerFarmBindId.4."10.0.0.13" = Gauge32: 0 The pure numerics are even worse, right down to the polling response behavior. - billn

1 0

Re: source for GIS-correlated fiber conduit data
by Gregory Hicks 05 Jul '05

05 Jul '05

> Date: Tue, 05 Jul 2005 20:09:39 +0000 (GMT) > From: "Christopher L. Morrow" <christopher.morrow(a)mci.com> > > On Tue, 5 Jul 2005, Justin M. Streiner wrote: > > > On Mon, 4 Jul 2005, Sam Crooks wrote: > > > > > Can anyone point me in the direction of a source for fiber cable > > > installations correlated to GIS data? > > > > You will probably have difficulty in getting this from your carriers of > > choice. Chances are, if they provide anything at all, it would be done > > under NDA. > > Didn't Sean Doran do this out of GMU about 2 years ago? and get slapped > with some silly classification by the us-gov for it? (or am I thinking of > another sean?) Someone did but it was not limited to fiber but included utilities... And did get slapped down for putting together publicly available info into a usable form... --------------------------------------------------------------------- I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

3 2

Net traffic explodes for NASA'S comet collision
by Fergie (Paul Ferguson) 05 Jul '05

05 Jul '05

I hope many of you saw this near- real-time. It was awsome. Roy Mark writes for internetnews.com: [snip] Deep Impact's spectacular collision with the comet Tempel 1 resulted in an explosion of record traffic to the NASA Web site to see how it looked. The hyper-speed demise of the ship's probe, as it smashed into a comet half the size of Manhattan, generated approximately 80 million page views. "It's off the scale," Brian Dunbar, NASA's Internet Services Manager, told internetnews.com, noting the previous traffic record was 30 million page views for the Mars landing in 2004. "Hands down, it was a record day." [snip] http://www.internetnews.com/xSP/article.php/3517721 Pretty cool stuff. :-) - ferg ps. We should also be aware of how far AOL has come, too, since the 1996 Victoria's Secret fashion show. From every report, they pulled off streaming 7 simulateous video feeds of the Live 8 concerts this past weekend without any substantial problems whatsoever. http://news.yahoo.com/news?tmpl=story&u=/ap/20050705/ap_en_bu/internet_vide… Time they are a'changin'. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

U.S. Won't Cede Control of Net Computers
by Fergie (Paul Ferguson) 05 Jul '05

05 Jul '05

I've reached my post limit for the day after this one. http://news.yahoo.com/news?tmpl=story&u=/ap/20050630/ap_on_hi_te/internet_c… [snip] The U.S. government said Thursday it would indefinitely retain oversight of the Internet's main traffic-controlling computers, ignoring calls by some countries to turn the function over to an international body. The announcement marked a departure from previously stated U.S. policy. Michael D. Gallagher, assistant secretary for communications and information at the U.S. Commerce Department, shied away from terming the declaration a reversal, calling it instead "the foundation of U.S. policy going forward." The signals and words and intentions and policies need to be clear so all of us benefiting in the world from the Internet and in the U.S. economy can have confidence there will be continued stewardship," Gallagher said in an interview with The Associated Press. [snip] - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 5