- Test - lists.nanog.org

Request for submissions: messy cabling and other broken things
by Eric Kuhnke 23 Dec '03

23 Dec '03

Sometimes illustrating the way a job should *not* be done is a powerful educational tool. I have collected a gallery of messy and ridiculous cabling jobs: http://gallery.colofinder.net/shameful-cabling my favorite (not horrible, but funny): http://gallery.colofinder.net/shameful-cabling/cables Anonymous submissions can be sent to fnord(a)fnordsystems.com , equipment labels and faces will be blurred if requested.

21 30

Minimum Internet MTU
by Chris Brenton 23 Dec '03

23 Dec '03

Greetings all, I'm working with a few folks on firewall and IDS rules that will flag suspicious fragmented traffic. I know the legal minimum of a non-terminal fragment is 28 bytes, but given non-terminals should reflect the MTU of the topologies along the link, this number is far lower than what I expect you should see for legitimate fragmentation in the wild. A few years back I noted some 512-536 MTU links in ASIA. I've been doing some testing and can't seem to find them anymore. Is is safe to assume that 99.9% of the Internet is running on 1500 MTU or higher these days? I know some people artificially set their end point MTU a bit lower (like 1400) to deal with things like having their traffic encapsulated by GRE or IPSec. With this in mind, would we be safe to flag/drop/what ever all fragments smaller than 1200 bytes that are not last fragments (i.e., more fragments is still set)? Does anyone maintain, or is aware, of links that would not meet this 1200 MTU? Any and all feedback would be greatly appreciated, C

8 10

Trace and Ping with Record Option on Cisco Routers
by Danny.Andaluz＠triaton-na.com 23 Dec '03

23 Dec '03

Hey, Group. In my production network, I'm trying to do some extended traces and pings with the record option turned on to see what route my packets take going and returning. It's not working. If I do the extended traceroute or ping without the record option, it works fine. There is a firewall (PIX) a few hops in front of the destination I'm trying to record the route for. What part of ICMP is this that needs to be opened on the firewall to allow this to come back? First time I'm coming across this. Thanks, Danny

4 3

ALLTEL contact?
by Allan Carscaddon 23 Dec '03

23 Dec '03

Sorry for the noise, but I'm having trouble getting a router on an ALLTEL circuit configured correctly and I am getting caught in the level one support net. Can a clueful ALLTEL network engineer please contact me off list? Thanks, Allan

1 0

Stupid .org registry code change
by Michael Lewinski 22 Dec '03

22 Dec '03

During the recent changes to .org, whois stopped being useful for what I need. > Sponsoring Registrar:R11-LROR All I really want to know is the Registrar's name/URL to tell my client so they can modify their nameservers. Does anyone have: 1) A URL to the table that will allow me to lookup a name from the above code (or better, a hack to whois that will do said lookup for me)? 2) The e-mail address where I should my suggestion that the person who came up with this brilliant scheme needs to pursue a new career in a non-IT related field? TIA, Mike

3 3

RE: Stupid .org registry code change
by Alon Tirosh 22 Dec '03

22 Dec '03

Strangely enough, PIR doesn't recognize that one... Google-mining seems to indicate that its TUCOWS/OPENSRS, but I wont swear to that. As for actually contacting someone to get it fixed, considering past experience I think nothing short of a public outcry is going to draw attention to the problem, and whois issues might be just a little to esoteric for NYT/WP/CNET coverage... -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Michael Lewinski Sent: Monday, December 22, 2003 6:19 PM To: nanog(a)nanog.org Subject: Stupid .org registry code change During the recent changes to .org, whois stopped being useful for what I need. > Sponsoring Registrar:R11-LROR All I really want to know is the Registrar's name/URL to tell my client so they can modify their nameservers. Does anyone have: 1) A URL to the table that will allow me to lookup a name from the above code (or better, a hack to whois that will do said lookup for me)? 2) The e-mail address where I should my suggestion that the person who came up with this brilliant scheme needs to pursue a new career in a non-IT related field? TIA, Mike

1 0

california quake
by Scott Granados 22 Dec '03

22 Dec '03

Apparently there was just a 6.4 quake in central california. We felt it here in San Jose but its probably to minor up here to cause any disruptions. However closer to the center there may be.

4 3

A headsup re Verizon Wireless paging
by Michael R. Wayne 22 Dec '03

22 Dec '03

Summary: If you use Verizon Wireless pagers (pagers with an @myairmail.com email address) to monitor your network, your alerts may be blocked without notice. The saga: We use multiple paging companies for our pagers, under the theory that redundancy is a "good thing". Last week, our people who carry pagers from Verizon Wireless realized that they were not getting pages from our Netsaint monitoring system, although they were getting other pages and people carrying pagers from other paging companies were getting Netsaint pages. After a bit of testing, we discovered that email to pagers from netsaint@<our monitoring system> was not getting through but email to pagers from any other username on that machine seemed to go through fine. So one of my people contacted their tech support Friday morning. After 7.5 hours of being told: 1) The problem is that you are not running a web server on that machine. (Actually we are but it's firewalled and why should they care?) 2) The problem is that DNS is broken for that address. (It's not, plus why do pages for other users go through?) 3) The problem is that our server is not actually sending the messages to Verizon wireless (we sent them the sendmail logs to prove that the messages were accepted). 4) The problem must be something else at our end. 5) The problem is that you are using email to deliver the page, can't you use a modem? 6) Assorted other excuses which we neglected to note. someone FINALLY admitted that pages from the netsaint address were being filtered. The guy who eventually admitted this basically told the gal who had been working on this all day: "We did this to protect our network, no, you cannot speak to anyone else about it, we may just leave it in forever and we're not going to do anything about it." And hung up on her. He must have been pretty rude (which I why I omit his name) because after dealing with this all day she was frustrated to the point that she was in tears. So, I sent her home and picked up the fight. I eventually, reached the same person who admitted that they were filtering email from that address because of a problem with one customer earlier in the month so they discarded messages to ALL customers if the address contained netsaint. His stand: - Verizon Wireless did this to protect their network. - They occasionally install such filters for an indeterminate amount of time. - No notice is given to customers of such a filter. When I asked about it he seemed to feel that there was no way to inform customers. I figure it would take about an hour to develop a script with a simple database of pager destinations that paged once to inform customers that a word was suppressed. - No notice is given to their tech support people that such a filter has been put in place. - No notice is given to their resellers, so if a customer calls to inquire, the reseller has no clue that it's going on. - There is no clear process for a customer to determine that such a filter has been installed. - He had to obtain permission from "the field" as to whether or not the block could be removed. - He pretty much ignored my question as to why they blocked all customers rather than just the one in question. But he promised to contact me before leaving for the day. I started hacking a filter to simply substitute another address for netsaint and, in the process, discovered that what was actually going on was that any page that contains the word netsaint anywhere in the header or in the message was being discared without notice. I did get a call back as promised. I mentioned that they were not filtering on address but the entire messaged and got an: "Oh, I knew that" (would have been nice of him to TELL me). He claimed that the block would be removed either later Friday night, Saturday morning at the latest. Pages were still being blocked Friday night and Saturday morning but a test page sent this morning worked OK. /\/\ \/\/

4 3

smart hands requested in san jose
by joshua sahala 22 Dec '03

22 Dec '03

hello all, i was wondering if anyone was interested in some possible ongoing 'smart hands'-type work in the san jose area. ideally looking for someone with some unix (debian), juniper, and/or cabling skills. if you are interested please drop me a note. thanks /joshua /* i hope everyone in the quake area is ok */

1 0

RE: california quake
by Claydon, Tom 22 Dec '03

22 Dec '03

If a fault line slips, then the terrorists have already won. -----Original Message----- From: Gerald [mailto:gcoon@inch.com] Sent: Monday, December 22, 2003 1:34 PM Cc: nanog(a)merit.edu Subject: Re: california quake On Mon, 22 Dec 2003, Scott Granados wrote: > Apparently there was just a 6.4 quake in central california. Terrorists! Gerald

1 0