- Test - lists.nanog.org

Re: Heads up: Long AS-sets announced in the next few days
by Lorenzo Colitti 09 Mar '05

09 Mar '05

James A. T. Rice wrote: > So, the ASn's are not picked at random, yet mine might be included if I > don't specifically ask for them not to be included, yet you decline to > tell how my ASn might have been selected for this. Ok, I realize I might have given the wrong impression here. Sorry. So here's what we are doing: by artificially inserting ASes into the AS-set of an announcement, the ISP that makes the announcement can control where the announcement is propagated and thus discover paths followed by its announcements that are not usually visible, giving it a more complete knowledge of network topology in the vicinity. Since this is a new technique, it's not clear if it is actually effective, and to measure this we need to test it in the real world. If the experiments show that the technique performs as we hope, we intend to publish the results and provide the details for public use. We will post appropriate references to this list as soon as we have some hard data and have put it into a presentable form. But first we need to do the experiments... Regards, Lorenzo

9 18

enom/name-services.com nameservers are severe broken
by Michael Tokarev 09 Mar '05

09 Mar '05

Just noticied a weird behaviour of dns?.name-services.com nameservers. Here it goes (there are several problems, pls read the whole this message): $ host -t a -v name-services.com. dns1.name-services.com. this gives normal answer (details skipped): name-services.com. 7200 IN A 63.251.163.109 And this is Very Wrong (tm): $ host -t cname -v name-services.com. dns1.name-services.com. Host name-services.com not found: 3(NXDOMAIN) In short: for *some* types of records for a valid name, the server returns NXDOMAIN, which it should not be. Obviously, when doing this query using a caching nameserver, the cache gets poisoned (remembering that the domain in question does not exists, as opposed to "No data of requested type" response). Another example for a domain hosted by them: $ host -t a -v jandg-cooper.com. dns1.name-services.com. NXDOMAIN $ host -t mx -v jandg-cooper.com. dns1.name-services.com. jandg-cooper.com. 3601 IN MX 10 cooper-linux.jandg-cooper.com. This happens with CNAME and A records so far, eg asking for AAAA record returns proper reply with empty answer section. And here's another brokeness: $ host -t ptr -v jandg-cooper.com. dns1.name-services.com. ;; Warning: ID mismatch: expected ID 15165, got 0 ;; Warning: ID mismatch: expected ID 15165, got 0 It returns "proper" (fsvo) reply but with wrong ID. Reportedly there's some (pretty legal) query which returns SERVFAIL but I can't reproduce it now. All dns?.name-services.com behaves the same way. I think it should be fixed ASAP.. ;) /mjt

2 2

route-views.oregon-ix.net
by Erik Sundberg 08 Mar '05

08 Mar '05

hello, is any one having troubles getting in to route-views.oregon-ix.net a.k.a.(route-views.oregon-ix.org) i can ping but no telnet into it. i have tried from a couple of places on and off my network. [box@box box]# telnet route-views.oregon-ix.net Trying 128.223.60.103... telnet: connect to address 128.223.60.103: Connection timed out [root@asp-12 root]# ping route-views.oregon-ix.net PING route-views.oregon-ix.net (128.223.60.103) 56(84) bytes of data. 64 bytes from g0-1.route-views.routeviews.org (128.223.60.103): icmp_seq=1 ttl=237 time=80.2 ms 64 bytes from g0-1.route-views.routeviews.org (128.223.60.103): icmp_seq=2 ttl=237 time=79.8 ms 64 bytes from g0-1.route-views.routeviews.org (128.223.60.103): icmp_seq=3 ttl=237 time=80.1 ms thanks erik --- [This E-mail scanned for viruses by Appsmail.com]

3 2

VoIP Port Blocking Draws Congressional Interest
by Fergie (Paul Ferguson) 08 Mar '05

08 Mar '05

http://www.eweek.com/article2/0,1759,1773832,00.asp - ferg

2 1

Re: Clue on Europe
by christian.macnevin＠uk.bnpparibas.com 08 Mar '05

08 Mar '05

It's possible the WAN link was for customer-owned monitoring equipment. Internet alex(a)alex.org.uk - 08/03/2005 10:10 Please respond to alex(a)alex.org.uk To: Christian MACNEVIN, nanog cc: alex Subject: Re: Clue on Europe --On 08 March 2005 10:07 +0000 christian.macnevin(a)uk.bnpparibas.com wrote: > Also, when I dealt with them, I > believe their NOC was connected to the Net for external monitoring > purposes by a leased line which was frequently down. I don't think that's true. Their NOC has always been in either one data center or another (separated by a few hundred yards). Alex This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. ********************************************************************************************** BNP Paribas Private Bank London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Securities Services London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Fund Services UK Limited is authorised and regulated by the Financial Services Authority.

1 0

Re: Clue on Europe
by christian.macnevin＠uk.bnpparibas.com 08 Mar '05

08 Mar '05

A flaw in either their air conditioning or fire alarm system shut down their power last year sometime as well. Also, when I dealt with them, I believe their NOC was connected to the Net for external monitoring purposes by a leased line which was frequently down. Now you got to read the disclaimer regarding my opinion etc.. Internet bilse@networksignature.com@merit.edu - 08/03/2005 08:03 Sent by: owner-nanog(a)merit.edu To: subhi, acanvar cc: nanog Subject: Re: Clue on Europe On Mar 8, 5:22am, Subhi S Hashwa <subhi(a)thebigboss.com> wrote: > Avoid Redbux Hex (London) like the plague, just ask about their > recent power outages. AFAIK their other facilities are ok. I think that's a bit unfair. I've had my personal Internet connectivity (copper line and baseband modems) via RedBus and Harbour Exchange for four years now, and have no particular complaints. Something went wrong during a generator test or seomthing last week, but considering what I've experienced in other facilities, I don't think this colo is notably better or worse than most other colos; at least, I know several others that have a much worse history. Trouble is, things come and go. Expect problems during run-in and build-out, then a period of stability, then problems as places fill up and capacities max out; rinse; repeat. Is there any colo that doesn't come with its own set of horror stories and folklore? Ask me about what legendary MFS did to a router of mine at equally legendary MAE-West.-) Best, -- Per This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. ********************************************************************************************** BNP Paribas Private Bank London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Securities Services London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Fund Services UK Limited is authorised and regulated by the Financial Services Authority.

2 1

Clue on Europe
by Ashe Canvar 08 Mar '05

08 Mar '05

Hi all, Plan to set up a 2 rack outpost in a colo in Europe. I am looking for prior experience(s) -- Good or ugly. My research leads me to believe that London and Amsterdam have the most dense connectivity. Is this true ? If so, then what colo's / ISPs in these 2 cities would you recommend. The primary aim is to get smallest RTTs to most of western Europe. - I would prefer a carrier neutral facility. - Backhaul to the US is a lesser concern but, of course, cheaper is better. - I have a small setup in the Isle of Dogs (London) presently, but the local loop charges are atrocious. - I am posting here instead of Euronog because I want to get US based prespective. Will summarize to list, Thanks !

6 5

How to identify interconnection relationship between AS?
by Joe Shen 08 Mar '05

08 Mar '05

Hi, I'm trying to identify how an AS is interconnected with other ASes. For example, I can access our border router which has BGP run, and I want to know how another AS ( e.g. 1234 ) is connected to internetwork ( e.g. as1234 interconnects with as1235, as1236, as1345 ....). How can I do it? thanks Joe __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

2 1

Re: www.nanog.org returning 403 Forbidden error?
by W.D.McKinney 08 Mar '05

08 Mar '05

>-----Original Message----- >From: Brent Chapman [mailto:Brent@GreatCircle.COM] >Sent: Monday, March 7, 2005 11:58 PM >To: nanog(a)merit.edu >Subject: www.nanog.org returning 403 Forbidden error? > > >I just tried accessing http://www.nanog.org/, and am getting back a >403 "Forbidden" error: > > Forbidden > You don't have permission to access / on this server. > >Did somebody break the web server? > Works here fine for me. Nice to see Seattle on it also! Dee

1 0

Is current DDoS detecting method effective?
by Joe Shen 07 Mar '05

07 Mar '05

Hi, I use flow-tools to monitor the link bandwidth utilization on three backbone interfaces. The total bandwidth utilized is about 11Gbps, and netflow data is analyzed to show statistics on some special port (e.g. port 0, port 445 etc.). I think this could give us some indication of possible DoS attach, but it's hard to monitor DoS attack on all hosts or all ports. In fact, I'm not sure whether traffic monitoring could REALLY help to identify some DoS attack, esp. in ISP networks. My questions include: 1) what should be protected in ISP networks? the ISP's own network or both ISP's network and its customers? I think the answer is, ISP should only care about the safety of its own network, which should be overprovisioned ( not only link bandwidth but also CPU/MEM etc.); we could use some technique like reverse route checking and ACL to immunize those core router/switch from DoS. 2) What's the cost should we take to identify any possible DoS in ISP network? I think it will cost a lot if we keep monitoring traffic on all edge routers ( both to backbone network and to customers), because we have to set up traffic monitoring on all interfaces and we have to set up analysis hosts whose ability have to be increased time to time. While the gainback is not obivious ( at least Botnet could not be crashed easily). 3) Is those technique use in current days really effective ? Where can I find some theretical analysis on the method Arbor used to identify DoS? To my experience, network attack is continuous. I do a experiment in our network, I put a Win2003 server on access layer. After 24 hours, the software firewall on it recorded about 10,0000 scan&attack attemps. Arbor says its product build up traffic model before identify DoS, while DoS may have been on its peak point when Arbor's box is building up its traffic model!! So, how can we do with DoS in ISP network? --- "David J. Hughes" <bambi(a)hughes.com.au> wrote: > > On 04/03/2005, at 5:17 AM, Chris Roberts wrote: > > I know you said not Arbor, but I'd second this > opinion. I used Arbor > > at a > > medium-sized European ISP and it was fantastic at > the job. Just in the > > trial > > period found a lot of smaller DoS attacks on our > network that we > > didn't even > > know were there, and this was without a particular > baseline. I think > > the > > development time you'd spend building something > like (we tried building > > similar with cflowd et al) would outweigh the > costs... This is always > > a moot > > point if you don't have the cash though I guess > :-) > > Another option on the commercial front is from > Esphion in New Zealand > (www.esphion.com) I've been involved with > deploying their products at > a large hosting provider in Australia and I've been > very impressed with > the performance and reliability. It's now an > integral part (if not the > corner stone) of our DOS mitigation procedure. Good > bit of kit. > > > David > ... > __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

5 6