- Test - lists.nanog.org

RE: cisco site down? multiple sources reporting connectivity problems
by Brennan_Murphy＠NAI.com 06 Oct '03

06 Oct '03

I'm on multiple mailing lists now with multiple persons reporting connectivity issues to cisco.com. Can anyone summarize what the issue is? -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Ezequiel Carson Sent: Monday, October 06, 2003 11:41 AM To: Martin Hepworth Cc: nanog(a)merit.edu Subject: Re: cisco site down? i was using galeon 1.3.5 now it seems to be working.. On Mon, 2003-10-06 at 12:26, Martin Hepworth wrote: > Ezequiel Carson wrote: > > > hi, > > can anyone use cisco site? > > > > > > [root@localhost root]# telnet www.cisco.com 80 > > Trying 198.133.219.25... > > Connected to www.cisco.com. > > Escape character is '^]'. > > Connection closed by foreign host. > > [root@localhost root]# > > > > ezequiel. > > > > > > > doesn't work from UK either... > > mozilla say 'document contains no data! > > borken..:-(

2 1

NSI privacy advocate
by John Kinsella 06 Oct '03

06 Oct '03

I double checked...the press release isn't dated April 1...NSI talking about privacy while keeping a straight face? http://www.verisign.com/corporate/news/2003/pr_20030930.html

1 0

Earthlink contact
by Sean Crandall 06 Oct '03

06 Oct '03

Greetings. If there is someone from Earthlink who wouldn't mind talking about Earthlink's experience with the Cisco 10000, I would appreciate it if you could contact me off list. Thanks. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. 6691 Owens Drive Pleasanton, CA 94588 (925) 201-2530 (office) (925) 201-2550 (fax)

1 0

Re: VeriSign Capitulates
by Michael.Dillon＠radianz.com 06 Oct '03

06 Oct '03

> "There is no data to indicate the core operation of the domain name > system or the stability of the Internet has been adversely affected," > VeriSign's Galvin said. This means that there are no papers published or conference presentations which detail the problems caused by sitefinder. A number of people who posted messages to this list could rectify that lack of data by writing up their findings in a short paper and presenting it at a conference or publishing it in a magazine or journal. I don't think the fight is over yet. --Michael Dillon

3 2

cisco site down?
by Ezequiel Carson 06 Oct '03

06 Oct '03

hi, can anyone use cisco site? [root@localhost root]# telnet www.cisco.com 80 Trying 198.133.219.25... Connected to www.cisco.com. Escape character is '^]'. Connection closed by foreign host. [root@localhost root]# ezequiel.

3 3

RE: cisco site down?
by Wim De Houwer 06 Oct '03

06 Oct '03

works just fine from BE > -----Original Message----- > From: Martin Hepworth [mailto:martinh@solid-state-logic.com] > Sent: maandag 6 oktober 2003 17:26 > Cc: nanog(a)merit.edu > Subject: Re: cisco site down? > > > > Ezequiel Carson wrote: > > > hi, > > can anyone use cisco site? > > > > > > [root@localhost root]# telnet www.cisco.com 80 > > Trying 198.133.219.25... > > Connected to www.cisco.com. > > Escape character is '^]'. > > Connection closed by foreign host. > > [root@localhost root]# > > > > ezequiel. > > > > > > > doesn't work from UK either... > > mozilla say 'document contains no data! > > borken..:-( > > -- > Martin Hepworth > Senior Systems Administrator > Solid State Logic Ltd > +44 (0)1865 842300 > > > > > ********************************************************************** > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote also confirms that this email message has been swept by > MIMEsweeper for the presence of computer viruses. > > www.mimesweeper.com > ********************************************************************** > >

1 0

RE: [nanog]: cisco site down?
by Tomas Daniska 06 Oct '03

06 Oct '03

the same here -- deejay > -----Original Message----- > From: Ezequiel Carson [mailto:ezequiel@ifxnw.com.ar] > Sent: 6. októbra 2003 17:23 > To: nanog(a)merit.edu > Subject: [nanog]: cisco site down? > > > hi, > can anyone use cisco site? > > > [root@localhost root]# telnet www.cisco.com 80 > Trying 198.133.219.25... > Connected to www.cisco.com. > Escape character is '^]'. > Connection closed by foreign host. > [root@localhost root]# > > ezequiel. > > >

2 1

Re: Security v. Privacy (was Re: Is there anything that actuallygets users to fix their computers?)
by Sean Donelan 06 Oct '03

06 Oct '03

On Sun, 5 Oct 2003, Jamie Reid wrote: > While we were fighting blaster/nachi and others, we relied heavily on > IDS's to generate alerts for the worms, then we disabled their network > access and called them. Generic viruses are not an ISP's problem, but > a worm is something that affects the prviders infrastructure, and is > therefore a network operators business. Did the users actually believe you when you told them their computer had a worm? How many times did you disable the same user's network access because they didn't actually fix their computer but told you it was fixed? But I have a really important document that has to be sent right now, and I can't wait to fix the computer.

2 3

Reverse DNS problem
by Schmiedt, Jamie 06 Oct '03

06 Oct '03

We have been experiencing problems with reverse DNS requests since Thursday 10/2/2003. Just wondering if anyone else is seeing this issue? This is affecting freeBSD & Linux hosts with Bind version 8.2.3 & 8.3.3. Reverse Lookups fail as follows: host0001$ nslookup Default Server: host0001.domain123.net Address: 0.0.0.0 > ccn.com Server: host0001.domain123.net Address: 0.0.0.0 Name: ccn.com Address: 63.172.52.127 > 63.172.52.127 Server: host0001.domain123.net Address: 0.0.0.0 *** Request to host0001.domain123.net timed-out > tcpdump shows this: 16:32:21.864111 123.123.123.123.1024 > 192.12.94.30.53: 6333 A? chia.ARIN.NET. (31) 16:32:21.864298 123.123.123.123.1024 > 192.12.94.30.53: 48444 A? dill.ARIN.NET. (31) 16:32:21.864597 123.123.123.123.1024 > 192.12.94.30.53: 43887 A? henna.ARIN.NET. (32) 16:32:21.864754 123.123.123.123.1024 > 192.12.94.30.53: 13510 A? indigo.ARIN.NET. (33) 16:32:21.864910 123.123.123.123.1024 > 192.12.94.30.53: 6129 A? epazote.ARIN.NET. (34) 16:32:21.865067 123.123.123.123.1024 > 192.12.94.30.53: 61408 A? figwort.ARIN.NET. (34) 16:32:21.865222 123.123.123.123.1024 > 192.12.94.30.53: 38595 A? ginseng.ARIN.NET. (34) 16:32:21.865383 123.123.123.123.1024 > 192.36.148.17.53: 60682 PTR? 127.52.172.63.in-addr.arpa. (46) 16:32:21.932444 192.12.94.30.53 > 123.123.123.123.1024: 48444- 0/7/7 (271) (DF) 16:32:21.941921 192.12.94.30.53 > 123.123.123.123.1024: 6333- 0/7/7 (271) (DF) 16:32:21.951550 192.12.94.30.53 > 123.123.123.123.1024: 43887- 0/7/7 (272) (DF) 16:32:21.961288 192.12.94.30.53 > 123.123.123.123.1024: 13510- 0/7/7 (273) (DF) 16:32:21.970903 192.12.94.30.53 > 123.123.123.123.1024: 6129- 0/7/7 (274) (DF) 16:32:21.980540 192.12.94.30.53 > 123.123.123.123.1024: 61408- 0/7/7 (274) (DF) 16:32:21.990282 192.12.94.30.53 > 123.123.123.123.1024: 38595- 0/7/7 (274) (DF) 16:32:22.016671 192.36.148.17.53 > 123.123.123.123.1024: 60682- 0/7/0 (199) (DF) 16:32:22.017854 123.123.123.123.1024 > 192.54.112.30.53: 46181 A? chia.ARIN.NET. (31) 16:32:22.017883 123.123.123.123.1024 > 192.54.112.30.53: 28356 A? dill.ARIN.NET. (31) 16:32:22.017907 123.123.123.123.1024 > 192.54.112.30.53: 29015 A? henna.ARIN.NET. (32) 16:32:22.017932 123.123.123.123.1024 > 192.54.112.30.53: 39822 A? indigo.ARIN.NET. (33) 16:32:22.017958 123.123.123.123.1024 > 192.54.112.30.53: 25113 A? epazote.ARIN.NET. (34) 16:32:22.017984 123.123.123.123.1024 > 192.54.112.30.53: 7656 A? figwort.ARIN.NET. (34) 16:32:22.018008 123.123.123.123.1024 > 192.54.112.30.53: 53035 A? ginseng.ARIN.NET. (34) 16:32:22.142472 192.54.112.30.53 > 123.123.123.123.1024: 28356- 0/7/7 (271) (DF) 16:32:22.151936 192.54.112.30.53 > 123.123.123.123.1024: 46181- 0/7/7 (271) (DF) 16:32:22.161553 192.54.112.30.53 > 123.123.123.123.1024: 39822- 0/7/7 (273) (DF) 16:32:22.171199 192.54.112.30.53 > 123.123.123.123.1024: 29015- 0/7/7 (272) (DF) 16:32:22.180924 192.54.112.30.53 > 123.123.123.123.1024: 25113- 0/7/7 (274) (DF) 16:32:22.190561 192.54.112.30.53 > 123.123.123.123.1024: 53035- 0/7/7 (274) (DF) 16:32:22.200290 192.54.112.30.53 > 123.123.123.123.1024: 7656- 0/7/7 (274) (DF) 16:32:26.868123 123.123.123.123.1024 > 192.41.162.30.53: 32457 A? chia.ARIN.NET. (31) 16:32:26.868300 123.123.123.123.1024 > 192.41.162.30.53: 65240 A? dill.ARIN.NET. (31) 16:32:26.868452 123.123.123.123.1024 > 192.41.162.30.53: 15332 A? henna.ARIN.NET. (32) 16:32:26.868602 123.123.123.123.1024 > 192.41.162.30.53: 41975 A? indigo.ARIN.NET. (33) 16:32:26.868753 123.123.123.123.1024 > 192.41.162.30.53: 21934 A? epazote.ARIN.NET. (34) 16:32:26.868905 123.123.123.123.1024 > 192.41.162.30.53: 56761 A? figwort.ARIN.NET. (34) 16:32:26.869057 123.123.123.123.1024 > 192.41.162.30.53: 52488 A? ginseng.ARIN.NET. (34) 16:32:26.869208 123.123.123.123.1024 > 198.41.0.4.53: 64459 PTR? 127.52.172.63.in-addr.arpa. (46) 16:32:26.923374 192.41.162.30.53 > 123.123.123.123.1024: 32457- 0/7/7 (271) (DF) 16:32:26.930326 198.41.0.4.53 > 123.123.123.123.1024: 64459- 0/7/0 (199) 16:32:26.931103 123.123.123.123.1024 > 192.52.178.30.53: 45170 A? chia.ARIN.NET. (31) 16:32:26.939982 192.41.162.30.53 > 123.123.123.123.1024: 15332- 0/7/7 (272) (DF) 16:32:26.949578 192.41.162.30.53 > 123.123.123.123.1024: 65240- 0/7/7 (271) (DF) 16:32:26.959220 192.41.162.30.53 > 123.123.123.123.1024: 41975- 0/7/7 (273) (DF) 16:32:26.968842 192.41.162.30.53 > 123.123.123.123.1024: 21934- 0/7/7 (274) (DF) 16:32:26.978581 192.41.162.30.53 > 123.123.123.123.1024: 56761- 0/7/7 (274) (DF) 16:32:26.988220 192.41.162.30.53 > 123.123.123.123.1024: 52488- 0/7/7 (274) (DF) 16:32:27.058851 192.52.178.30.53 > 123.123.123.123.1024: 45170- 0/7/7 (271) (DF) We can temporarily resolve the problem by issuing the following dig command: dig @<any ARIN in-addr.arpa server; ginseng, fogwort, etc.> -x <any sequence> example: host0001# dig @ginseng.arin.net -x abc Then the reverse lookups being to work and the tcpdump is as follows: (notice the difference in lines 8,9,10,11) 16:33:01.664320 123.123.123.123.1024 > 192.35.51.32.53: 33751 A? chia.ARIN.NET. (31) 16:33:01.664460 123.123.123.123.1024 > 192.35.51.32.53: 11278 A? dill.ARIN.NET. (31) 16:33:01.664573 123.123.123.123.1024 > 192.35.51.32.53: 55449 A? henna.ARIN.NET. (32) 16:33:01.664684 123.123.123.123.1024 > 192.35.51.32.53: 49768 A? indigo.ARIN.NET. (33) 16:33:01.664797 123.123.123.123.1024 > 192.35.51.32.53: 18859 A? epazote.ARIN.NET. (34) 16:33:01.664909 123.123.123.123.1024 > 192.35.51.32.53: 40146 A? figwort.ARIN.NET. (34) 16:33:01.665002 123.123.123.123.1024 > 192.33.14.32.53: 62349 PTR? 127.52.172.63.in-addr.arpa. (46) 16:33:01.725238 192.35.51.32.53 > 123.123.123.123.1024: 33751*- 1/8/8 A 192.5.6.32 (320) (DF) 16:33:01.736288 192.35.51.32.53 > 123.123.123.123.1024: 11278*- 1/8/8 A 192.35.51.32 (320) (DF) 16:33:01.747452 192.35.51.32.53 > 123.123.123.123.1024: 55449*- 1/8/8 A 192.26.92.32 (321) (DF) 16:33:01.758663 192.35.51.32.53 > 123.123.123.123.1024: 49768*- 1/8/8 A 192.31.80.32 (322) (DF) 16:33:01.765379 192.33.14.32.53 > 123.123.123.123.1024: 62349- 0/3/0 (134) (DF) 16:33:01.765834 123.123.123.123.1024 > 199.191.128.105.53: 19916 PTR? 127.52.172.63.in-addr.arpa. (46) 16:33:01.776697 192.35.51.32.53 > 123.123.123.123.1024: 18859*- 1/8/8 A 192.41.162.32 (323) (DF) 16:33:01.787806 192.35.51.32.53 > 123.123.123.123.1024: 40146*- 1/8/8 A 192.42.93.32 (323) (DF) 16:33:01.794121 199.191.128.105.53 > 123.123.123.123.1024: 19916*- 1/2/2 (171) (DF) Restarting named does not help. These host are located on several different ISP networks. Forward lookups function properly. Stumped... Any help or suggestions would be greatly appreciated. Thanks. -jamie

1 0

Removal of wildcard A records from .com and .net zones
by Matt Larson 06 Oct '03

06 Oct '03

VeriSign was directed by ICANN to suspend the Site Finder service by 0100 UTC on Sunday, October 5. We requested an extension from ICANN to give more notice to the community but were denied. We will be removing the wildcard A records from the .com and .net zones beginning at 2300 UTC on Saturday, October 4. The former behavior for these zones (returning Name Error/RCODE=3 in response to queries for nonexistent domain names) will be in place by 0100 UTC on Sunday, October. Matt -- Matt Larson <mlarson(a)verisign.com> VeriSign Naming and Directory Services

14 14