July 2007 - Test - lists.nanog.org

"A drunk employee kills all of the websites you care about"
by Michael Greb 24 Jul '07

24 Jul '07

<http://valleywag.com/tech/breakdowns/a-drunk-employee-kills-all-of-the-webs…> or <http://tinyurl.com/25ly7m>. ------8<------- A drunk employee kills all of the websites you care about 365 Main365 Main, a datacenter on the edge of San Francisco's Financial District, is popular with Soma startups for its proximity and its state-of-the-art facilities. Or it used to be, anyway, until a power outage took down sites including Craigslist, Six Apart's TypePad and LiveJournal blogging sites, local listings site Yelp, and blog search engine Technorati. The cause? You won't believe it. A source close to the company says: Someone came in shitfaced drunk, got angry, went berserk, and fucked up a lot of stuff. There's an outage on 40 or so racks at minimum. Whoever it is, while we like how you roll in theory, in practice, we'd appreciate it if you laid off the servers running websites we actually use. We're sure 365 Main will deny that such a thing could ever happen. And, conveniently, the neighborhood is having power troubles, too. But here's a question: When you have several levels of redundant power, what could bring your customers' servers down other than something like an employee physically ripping the plugs out of the wall? Update: Technorati's Dave Sifry just sent this email: Folks, I just wanted to let you know, it looks like San Francisco is having a MAJOR power event, with outages from the Financial district all the way down to Daly City. One of our colos at 365 Main Street has experienced a power outage (never mind that they always swear up and down that this kind of event can't possibly happen, oh no, they have multiple redundant systems and they charge us up the wazoo to make sure that we'll have business continuity, so of course, this isn't really happening, oh yes) however, our other data centers are all up and running, so we hope to be back up and running as quickly as possible. I'll keep you all updated on progress, and I appreciate you bearing with us as we work our way through this... Dave ------8<-------

1 0

Email lists pertaining to NA colo sites?
by Tuc at T-B-O-H.NET 24 Jul '07

24 Jul '07

Hi, I was wondering if someone was running a single repository of lists run by either Colo sites, or others in support of colo sites, in the North America. (Like for 25 Broadway {Adam?}, or even more specifically 118th, 5th floor, room 518 and anyone that might be in that room in the next week or so. :) ) Maybe there is a general list where someone can post "Hey, I'm in 25B, 5th floor and I need a patch cable" or even more specifically "Hey, I need someone who can get to my cabinet at the specificied location and use a pen to reboot one of my servers so I can save the $43.75 and not spend $5 in gas, $6 for tolls, and $17 for parking to press a button, wait 30 seconds, and press again". Thanks, Tuc

1 0

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking )
by Paul Ferguson 24 Jul '07

24 Jul '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> wrote: >On Tue, 24 Jul 2007, Paul Ferguson wrote: >> >> The particular service to be announced on Monday (BIS, or Botnet >> Identification Service), is nothing more than a BGP feed of _known_ >> and _vetted_ botnet C&Cs as /32s, intended to be a black-hole feed. >> >> Interested folks should either e-mail me off-list, or just wait for >> the official announcement on 30 July. >> > >note that this will take out vhost systems... unless they are vetted off >the list, which is certainly possible of course. But of course. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.2 (Build 2014) wj8DBQFGpm6Rq1pz9mNUZTMRAuVXAJ4jxpw0BRVlv8qmNXZQ9P++VHTjcwCg9JGy 591aYUFqou4ziRL5TQASDGg= =lQba -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

cogent outage
by Mills, Charles 24 Jul '07

24 Jul '07

>From Cogent's Website: Welcome to Cogent Communications' Network Status Message. Today is 7/24/07 at 14:11 ET. At this time, some customers may be experiencing a service outage in Pittsburgh, PA. This is being caused by a possible fiber cut outside Pittsburgh. Cogent Network Operations is working with our vendor to restore as soon as possible. At this time, there is no estimated time of repair. Chuck Charles L. Mills Senior Network Engineer Access Data Corporation / Pittsburgh, PA 15238 (412) 968-4024 FAX: (412) 967-9504 cmills(a)accessdc.com / http://www.accessdc.com Hosting, Colocation, D-R and Managed Services This e-mail message and any files transmitted with it contain confidential information intended only for the person(s) to whom this email message is addressed. If you have received this e-mail message in error, please notify the sender immediately by telephone or e-mail and destroy the original message without making a copy. Thank you. Neither this information block, the typed name of the sender, nor anything else in this message is intended to constitute an electronic signature unless a specific statement to the contrary is included in this message.

1 0

iPhone and Network Disruptions ...
by Prof. Robert Mathews (OSIA) 24 Jul '07

24 Jul '07

Fellow Nanogers: Reports have floated across my desk in the past week, which have suggested that iPhones owned by faculty, staff and students have been flooding university campus Wi-Fi networks in parts of the country. For example, see: *"Duke Wi-Fi Crippled by Apple iPhones" *at http://www.sci-tech-today.com/story.xhtml?story_id=10200AG9NMHU Since that story first aired, and by applying a patch that was subsequently provided by Cisco, Duke has now come to see the elimination of the problem, see: "*Duke Resolves iPhone, Wi-Fi Outage Problems"* at http://www.eweek.com/article2/0,1895,2161065,00.asp There are certain aspects of this story in which I have the most interest, and the following questions (if I may be permitted to list them) detail my concern - adequately. I wish to ask you: 1) is the iPhone an extra-ordinary device when comparing it with devices of a comparable nature, which also request ties to a Wi-Fi network, (there are many that use Wi-Fi enabled Smart-phones and PDAs on campuses -- so, why do 'they' not pose a similar problem) 2) is this problem a result of poor planning and services implementation at certain campuses, 3) is this story - a product of great exaggerations? 4) if there are technical issues indeed that permit iPhones in particular to DoS Wi-Fi nets, what can these storms be attributed to, and what can/should be done about it? If you are in a position to respond, I would like to hear from you, either publicly or privately. If there is enough group interest in the matter, I would be most happy to summarize. All the best, Robert. --

10 10

Question on Unrecognized BGP Path Attribute
by Xin Liu 24 Jul '07

24 Jul '07

Hi, I have a question about unrecognized BGP path attribute. According to RFC4271, when a BGP router sees an UPDATE with an unrecognized optional and transitive path attribute, it should retain the attribute, and if the path is selected, it should propagate the attribute to its neighbors. My question is, if later the router sees an update to the path in which only the unrecognized attribute has changed, should it immediately propagate the change to its neighbors? My guess is a yes, but I'm not sure because it's not explicitly written down in the RFC. Another question is, in such a case, what will the current routers from different vendors do? Anyone has any experience on this? Best Regards, Xin Liu

2 1

Re: An Internet IPv6 Transition Plan
by Christian Kuhtz 24 Jul '07

24 Jul '07

Chris, I think those are very sane opinions and very well stated at that. There is no reason for there to be a fundamental shift here, there is nothing all that revolutionary about IPv6 that breaks existing model (policy decisions around MH, dreaming about NAT / PAT-less Internet, etc aside). Once businesses decide that it's time to adopt, this should be a normal process like any other adoption. Best Regards, Christian ------Original Message------ From: Chris L. Morrow Sender: owner-nanog(a)merit.edu To: Durand, Alain Cc: John Curran Cc: nanog Sent: Jul 24, 2007 12:11 PM Subject: RE: An Internet IPv6 Transition Plan On Tue, 24 Jul 2007, Durand, Alain wrote: > > One of the things that is missing IMHO is that there is no clear vision > of what the IPv6 Internet will/should looks like. Let me focus on the 'look like'... there are mostly ipv4 paths from each ipv4 endpoint to each other ipv4 endpoint (keeping ourselves to the 'global internet' here). I think it makes sense that the 'ipv6 internet' will look very similar (v6 connectivity from endpoint to endpoint). Now, the tricky parts are the mean time where some ipv4-only host (due to it's network infrastructure not being upgraded to dual-stack capabilities) needs to access some 'important' ipv6-only content. Or the reverse situation as well... (yes, there are firewalls and things that block some end-to-end connectivity those are mostly not important for the 'looks like' discussion) > residential > broadband for a minute, I'm fully aware there are other cases, but let's > start somewhere. > > 1) What is the IPv6 'service'? I think that in the near term 'all' dsl/cable/dial folks will have to offer dual-stack environments. There is little hope of gateways being successful in larger deployments. (imho) > > 2) What is the connectivity model in IPv6 for the residential customer? > 1 address versus prefix delegation? > what prefix size? I had thought it was 1 prefix, I had thought it was a /64 or a /56 someone keeps moving the classful boundaries :( but pick one. Maybe it'd be helpful to be able to subnet that, we ought to think about that too I suppose. > is this prefix 'stable' or 'variable' over time? (ie renumbering is > expected) renumbering is 'free' in ipv6 right? why not stick to your 7 day leases? Surely you'll want to keep the ability to move netspace around as capacity issues arise? > What types of devices are connected? PCs or appliances or sensors? what types exist today? pc's, appliances, sensors... I suspect phones as well. > What is the management model in the home? call grandson? I am probably missing your question here... > Are there 'servers' (ie things that answers connections from the > outside) in the home? my personal opinion is 'yes'... there are a number of things today that do this sort of function, in the IETF v6ops meeting slingbox was mentioned as a specific example. > 3) What is the security model of all this? > I just listened today half mistified to a presentation at IETF > that was saying that the 'recommended' deployment model in the home > is to put a NAT-like stateful firewall in the home gateway... > This would mean that IPv6 would have to inherit all the NAT-traversal > technologies from IPv4 to work... Is this really what we want? I think that NAT is coming, regardless of anyone's want to avoid it, we'll have to plan for that. I think that if we get the chance to start over, let's do it 'right' or 'righter' or 'more correctly/securely' if at all possible, eh? Less direct pc->internet more pc->firewally-thingy->internet. (imho) > > 4) What about the 'legacy' devices that cannot upgrade to IPv6? > What kind of service is expected for those? Does defining an > 80% type solution as in 1) take care of them? > won't they have ipv4 'forever'? at some point the traffic will flip (more v6 than v4) but for the near term v4 seemingly will dominate and thus remain strong. -Chris -- Sent from my BlackBerry.

1 0

Bots back to full throttle
by Sean Donelan 24 Jul '07

24 Jul '07

The DNS entries for the EFnet and other mainline IRC servers previously affected appear to have timed-out/been removed from various ISP caching DNS resolvers I checked. I didn't check if all the routing blackholes have cleared up. User-based IRC servers should back to being pummled by Bot C&C requests as normal now. As I said, false positives suck. Unfortunately there isn't an anti-abuse system that never makes a mistake; unless you do nothing. I'm skeptical of people who claim they've never made a mistake.

1 0

Current rack pricing?
by Mike Lyon 24 Jul '07

24 Jul '07

Curious as to what other companies are paying on a per-rack basis at the various tier-1 providers (L3, att, sprint) with dual 30 amp 120vac drops in them? Any input would be appreciated. Thanks, Mike

1 0

Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking
by Paul Ferguson 23 Jul '07

23 Jul '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Sean Donelan <sean(a)donelan.com> wrote: >On Mon, 23 Jul 2007, Joe Greco wrote: >> So how do you connect to the real IRC server, then? Remember that most >> end users are not nslookup-wielding shell commandos who can figure out >> whois and look up the IP. > >If those users are so technically unsophisticated, do you really expect the other users with infected computers to figure out how to disinfect their computer and remove the Bots instead? > I would imagine that if we're talking about "unsophisticated" users, the majority of them have no idea what IRC is anyway -- most of them are using AIM, or Yahoo! IM, or.... - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.2 (Build 2014) wj8DBQFGpO2Uq1pz9mNUZTMRArtXAKD/gF0YM9MYcLA6AZ2InaNBrlgaHACgngiP kzDzfUd+9BsdcbxDz1Z9xig= =OoHG -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

5 4