- Test - lists.nanog.org

Anyone know of a meaningful way to reach teleglobe?
by Drew Weaver 14 Dec '06

14 Dec '06

thanks, -Drew

2 1

SatCom communications alert
by Fergie 14 Dec '06

14 Dec '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just as an FYI, radio communications, satellites communications, and power grids (including some SCADA systems) could face potential interruptions or damage tomorrow due to some very odd (out of cycle) solar activity. Story here: http://www.msnbc.msn.com/id/16187534/ More: http://www.sec.noaa.gov/ Just a heads-up. They're talking about midday tomorrow (Eastern Time, I suppose)... - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.1 (Build 1557) wj8DBQFFgOTeq1pz9mNUZTMRAnqoAKC9cjZ03Uk0LwFltbFqBf8Uvdu7YQCfYQTS D/PYMcYa7TO/W6HWNmmMZIY= =EvSN -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: GBLX issues?
by Alex Rubenstein 14 Dec '06

14 Dec '06

> this morning around <3> am, effecting <2> connections in that You mean 'affecting.' -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben Net Access Corporation, 800-NET-ME-36, http://www.nac.net

2 1

GBLX (or other) issue continuing (?)
by Rick Kunkel 13 Dec '06

13 Dec '06

Hello folks, I've gotten a couple of calls from people today complaining about a spike in latency when using GBLX paths. I saw a couple of posts asking about potential GBLX issues yesterday. (But they seemed to devolve into mild flaming, and I couldn't glean any useful info from them, except that SOME people seemed to be having SOME kind of problem.) Anyhow, here's a trace someone sent.... 1 207.244.155.177 (207.244.155.177) 1.152 ms 0.760 ms 0.593 ms 2 208.99.192.133 (208.99.192.133) 2.990 ms 3.208 ms 1.771 ms 3 204.8.32.85 (204.8.32.85) 3.243 ms 1.573 ms 2.444 ms 4 208.99.192.58 (208.99.192.58) 2.705 ms 2.580 ms 2.782 ms 5 ge-0-1-0.ar2.SEA1.gblx.net (64.215.184.161) 1.752 ms 2.782 ms 2.160 ms 6 * * * 7 * * * 8 te-4-1.car4.LosAngeles1.Level3.net (4.68.110.65) 37.129 ms 36.173 ms 36.437 ms 9 * ae-32-56.ebr2.LosAngeles1.Level3.net (4.68.102.190) 48.388 ms * 10 * ae-2.ebr1.SanJose1.Level3.net (4.69.132.9) 43.981 ms 54.608 ms 11 ae-1-100.ebr2.SanJose1.Level3.net (4.69.132.2) 49.057 ms * 48.426 ms 12 ae-3.ebr1.Denver1.Level3.net (4.69.132.58) 99.259 ms * 100.438 ms 13 ae-3.ebr1.Denver1.Level3.net (4.69.132.58) 89.555 ms ae-1-100.ebr2.Denver1.Level3.net (4.69.132.38) 99.875 ms * 14 * ae-1-100.ebr2.Denver1.Level3.net (4.69.132.38) 89.361 ms ae-3.ebr1.Chicago1.Level3.net (4.69.132.62) 89.568 ms15 * * ae-1-100.ebr2.Chicago1.Level3.net (4.69.132.42) 100.631 ms 16 * ae-7-7.car1.Boston1.Level3.net (4.69.132.241) 116.866 ms 120.512 ms 17 ae-11-11.car2.Boston1.Level3.net (4.69.132.246) 118.752 ms 126.690 ms ae-7-7.car1.Boston1.Level3.net (4.69.132.241) 126.614 ms 18 unknown.Level3.net (63.211.176.18) 116.590 ms 116.168 ms 116.375 ms 19 unknown.Level3.net (63.211.176.18) 116.316 ms ge5-1.aggr2.sbo.ma.rcn.net (207.172.15.152) 116.340 ms 120.395 ms One somewhat savvy customer who had the forethought to commit to his memory a general map of the routes to the last host has noticed that things changed over the last 2 hours. He's now jumping from Seattle to LA, to San Jose, to Denver, to Chicago, and then to Boston before finally hitting his destination. Perhaps this isn't even really a GBLX issue, but the customer seems to remember going straight from Seattle to somewhere east before, all via GBLX I presumably. Anyhow, I'm just fishing for any other weirdness that people may have seen, as well as any news people might have heard about fiber cuts, outages, etc. FWIW, the wind in Seattle right now is outrageous. Probably unrelated, but I figured I'd throw it out there.... Thanks, Rick Kunkel

1 0

GBLX issues anyone?
by J. Oquendo 13 Dec '06

13 Dec '06

Anyone seeing issues for GBLX around NY? DISCLAIMER: I WOULD HAVE POSTED TO THE OUTAGE LIST BUT THAT WOULD MAKE 100+ MAILING LISTS APOLOGIES TO THE OTP (OFF-TOPIC POLICE) -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo echo @infiltrated|sed 's/^/sil/g;s/$/.net/g' http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743 "How a man plays the game shows something of his character - how he loses shows all" - Mr. Luckey

2 1

GBLX issues?
by J. Oquendo 13 Dec '06

13 Dec '06

Anyone seeing issues for GBLX around NY? DISCLAIMER: I WOULD HAVE POSTED TO THE OUTAGE LIST BUT THAT WOULD MAKE 100+ MAILING LISTS APOLOGIES TO THE OTP (OFF-TOPIC POLICE) -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo echo @infiltrated|sed 's/^/sil/g;s/$/.net/g' http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743 "How a man plays the game shows something of his character - how he loses shows all" - Mr. Luckey

5 4

need utillity that can do complex tcp replay
by william(at)elan.net 12 Dec '06

12 Dec '06

I need to find utility for testing of application debugging issue that can replay captured ip traffic, something similar to description at: http://tcpreplay.synfin.net/trac/wiki/flowreplay Basicly what I want is to capture data for several hours on the server (preferably with tcpdump) and then I'd like to replay requests that came to server from another computer that would act as a client and simulate this traffic including using the same ip addresses as on the original captured packets, but all would be sent to different server which has basically same setup & data as original but with debugging & testing utilities (and with possibility to run application in debugging mode). So what would be replayed would all be new TCP requests but contain same data as original and testing server would have direct 1-1 connection to a "simulated client" with this captured data and this client would need to be able to replay TCP packets creating sequence that is same order as original. Note that what I need to debug is actually HTTPS which may present additional problems (including various timing issues since Expires header can not be rewritten without decoding encrypted data, but for that I'll reset time on the test server to be exactly same as it was when data was captured; but I'm sure there other other issues). While I'd greatly prefer to find unix-based open-source package that can do above, I'll consider other including commercial alternatives. If you know of something that can do it, please reply. -- William Leibzon Elan Networks william(a)elan.net

2 1

Comcast mail folks
by S. Ryan 12 Dec '06

12 Dec '06

Any Comcast mail admins around? If they could kindly contact me off list I would greatly appreciate it! Thanks!

1 0

looking for operational community input
by Gadi Evron 10 Dec '06

10 Dec '06

Hi guys. This January a couple hundred people from the net-ops world, anti virus, anti spam, law enforcement, etc. are getting together. I'd appreciate if any of you can send me input (off list, if not relevant to generate discussion) on what the net-ops community at large, rather than just the security operations community, sees and is pre-occupied by. Specifically on subjects such as: 1. Attacks. 2. Law enforcement. 3. DDoS. 4. Botnets. 5. Financial fraud. 6. Spam. 7. End users (bots?) 8. Your topic here? And whats specifically you've had issues with and/or are looking for solutions for or for what others are doing when it comes to security and security related issues. We will relay information back after the workshop, likely in early February. One of the net-ops folks who attend will likely relay this information back (Probably Danny McPherson or Don Smith). To ask specific questions and/or direct us in specific directions, pick and choose: http://isotf.org/isoi2.html Thanks, Gadi.

1 0

Re: DNS - connection limit (without any extra hardware)
by Fergie 09 Dec '06

09 Dec '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sorry for the top-post, but wanted to retain context here. Also, sorry for the specific product mention, but much of is mentioned below is something that we are doing with ICSS/BASE: http://www.trendmicro.com/en/products/nss/icss/evaluate/overview.htm $.02, - - ferg - -- Joe Abley <jabley(a)ca.afilias.info> wrote: On 8-Dec-2006, at 11:52, Geo. wrote: > >> Actually, reading your reply (which is the same as my own, pretty >> much), I >> figure the guy asked a question and he has a real problem. >> Assuming he >> doesn't want to clean them up is not nice of us. > > Infected machines (bots) will cause a lot more than just DNS > issues. Issues > like this have a way of getting worse all by themselves if not > addressed. > > Anyway, to play nice.. how about using a router to dampen traffic > much like > icmp dampening? Would it be possible to do DNS dampening? I think the trouble comes when you want to limit the request rate *per client source address*, rather than limiting the request rate across the board. That implies the retention of state, and since DNS transactions are brief (and since the client population is often large) that can add up to a lot of state to keep at an aggregation point like a router. There some appliances which are designed to hold large amounts of state (e.g. f5's big-ip) but you're talking non-trivial dollars for that. Beware enterprise-scale stateful firewall devices which might seem like sensible solutions to this problem. They are often not suitable for use in front of busy DNS servers (even a few hundred new flows per second is a lot for some vendors, despite the apparent marketing headroom based on the number of kbps you need to handle). You may find that you can install ipfw (or similar) rules on your nameservers themselves to do this kind of thing. Take careful note of what happens when the client population becomes large, though -- the garbage collection ought to be smooth and painless, or you'll just wind up swapping one worm proliferation failure mode for another. Host-based per-client rate limits scale better if there are many hosts providing service, e.g. behind a load balancer or using something like <http://www.isc.org/pubs/tn/isc-tn-2004-1.html>. As to the wider question, cleaning up the infected hosts is an excellent goal, but it'd certainly be nice if your DNS servers continued to function while you were doing so. Having every non- infected customer phone up screaming at once can be an unwelcome distraction when you already have more man hours of work to do per day than you have (staff * 24). Joe -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.1 (Build 1557) wj8DBQFFebFQq1pz9mNUZTMRAk+xAKCg1dPMivTo6ee5Nj1I4yjVXQzvCQCgnBSI NV3RnsEijPJcHNawWS4uWog= =pawb -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1