- Test - lists.nanog.org

Verisign Responds
by David Lesher 22 Sep '03

22 Sep '03

>Looks like the lawsuits are going to be the ones to settle this >dispute...anyone think there's a chance of ICANN pulling .COM and .NET >from Verisign due to breach of contract? I think it's highly unlikely. ...about as likely as Mary Carey winning the Califunny recall. VeriSlime has big lobbying muscle here Inside the Beltway. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Operations notification manager software
by Pete Kruckenberg 22 Sep '03

22 Sep '03

My apologies in advance for asking a rather "low-brow" question. What software is available/recommended for NOC contact management? I assume that big networks use CRM type stuff (probably heavily customized), integrated into the OSS and other operational systems. What about for the rest of the world? Is there any decent (free, proprietary, or home-grown) software that can do contact management justice (either as a complete package or integration of multiple packages), supporting features like: - contact information refresh (regularly verify contact information via electronic or triggered human interaction, dealing with failed notification attempts)? - complex notification (ie per-event customized notification by affected device/region/service, notification to customer-selected method based on type and urgency of notice) - customer-friendly subscription management (including multiple notification methods) and notification archiving - notification SLA's (ie re-sending multiple timed notices when required, tracking notifications for auditing, etc) - efficiently managing multiple conduits for notification (email, alpha pager, text-to-voice/scripted call center, RSS feed, Web archives/posting) - enforcing consistency in notifications (ie form-/ rule-based notification creation and validation, notification review/authorization prior to distribution) - handling feedback from notifications (handling customer responses, tracking viewing and/or reading of notifications, measuring effectiveness of notifications) - other important features? I know that some of these features are built into products like HPOV. Do they fill the needs of large network operators? What software do you use to manage customer notifications? Thanks. Pete.

4 4

RE: When is Verisign's registry contract up for renewal
by Mike Damm 22 Sep '03

22 Sep '03

The webpage was very 'thrown together' so we could get to work on actually getting the servers built. Our policy is to provide clean versions of the COM and NET zones. Minus all of VeriSign's hackery. If you register a .com domain, it will appear in our zone, if you don't renew one, it disappears. We plan to mimic exactly how a responsible TLD operator should work. We don't want to change the world, we don't want to expand the number of TLDs, and we really don't even want to run a root. The root we are (temporarily) running is just a hack to allow people to access our gTLD zones, everything else is pointed to *.root-servers.net. At this point, nothing really works. But we hope to have it operational within the next week. If you don't like it, don't use it. This is the last post about this you'll see on NANOG from me about it. -Mike -----Original Message----- From: Stephane Bortzmeyer [mailto:bortzmeyer@nic.fr] Sent: Monday, September 22, 2003 4:44 AM To: Mike Damm Cc: 'Jared Mauch '; 'nanog(a)merit.edu ' Subject: Re: When is Verisign's registry contract up for renewal On Sun, Sep 21, 2003 at 07:53:19AM -0700, Mike Damm <MikeD(a)irwinresearch.com> wrote a message of 63 lines which said: > This sort of not-for-profit is exactly what I proposed when the VeriSign > discussion started. A non-technical response to a non-technical problem. > Since my inital email, I've recruited a few other NANOG folks and put up a > website: www.alt-servers.org. In what way your proposal is different from the other "alternative roots" (such as ORSC, www.open-rsc.org)? All of them are facing the same problem: we don't like ICANN's policies, OK, but what are ours? Do we redelegate .md? Do we give .com to someone else? To who? Do we delegate .god to the jerk that just asked? I'm not aware of any serious policy work from any of the alternative roots: they just claim that they work very hard but they never explain the details. You claim to have working servers already (the easiest part) but you say nothing about your policy...

1 0

Providers removing blocks on port 135?
by Adam Hall 22 Sep '03

22 Sep '03

Anyone know anything about prorviders removing ACLs from their routers to allow ports 135/445/4444 back into their network? Curious only because customers are calling in saying that Verizon, Cox, Bellsouth, and DSL.net are doing so and seem to have a big problem with the fact that we're hesitent follow their lead. Adam

19 34

Need help with Ex-Pat project
by Douglas S. Peeples 22 Sep '03

22 Sep '03

I am helping on several areas for the design, testing, and deployment of a Metro Ethernet network (based on MPLS) in the Pacific rim. If you or if you know anyone interested in working over seas for a year or so drop me an email with contact information. Cheers, Doug Peeples

1 1

[Administrativia] Posting rules: are messages silently dropped?
by Stephane Bortzmeyer 22 Sep '03

22 Sep '03

Messages I send from an email address which is not subscribed to nanog-post are apparently silently dropped. I do not receive a bounce (like it is typically the case when a list is closed) but, according to the archives, they are not distributed either (which may be good for the S/N ratio but I digress). Isn't it too harsh? <URL:http://www.nanog.org/email.html> explains how to post but does not mention what happens to posts from non-subscribers.

1 0

Riverhead or Lancope?
by John Obi 22 Sep '03

22 Sep '03

Nanogers, Did you ever tested Riverhead or Lancope? I know rackspace uses one or both of them. Are they good products and worth the try? Can they really decrease the the DDoS damage? Are they better than CISCO products? Are there any tips? Thanks, -J __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

3 2

Re: Windows updates and dial up users
by Jonathan Hunter 22 Sep '03

22 Sep '03

On Sun, 21 Sep 2003, Sean Donelan wrote: > "It occurred to me that one way to make things easier for dial-up users, > and even broadband users in many cases, would be to issue periodic update > CDs. Imagine a disc with all of the updates on it and a program, it could > even be written in Windows Script Host, to check a system for which > updates need to be installed, apply them in the correct order and even > reboot in between. Such a program would not be hard to write." > > [...] > > "I recently put this suggestion to Microsoft and their response basically > avoided the whole issue. Why wouldn't the company want to offer such a CD, > assuming that's the motivation behind their stonewalling?" >From this month's issue of /PC Pro/ magazine (UK, Issue 109) : "please accept our apologies for the lack of Microsoft patches or DirectX on our cover discs. Microsoft US has banned the inclusion of any of its code on magazine discs. Presumably, the company assumes we all have broadband to download up to 166MB for DirectX 9b or 134MB for Windows XP Service Pack 1a." And that's without mentioning the mean-time-till-infection of an unpatched system, of course... Regards, Jonathan

1 0

Re: VeriSign SMTP reject server updated
by Michael.Dillon＠radianz.com 22 Sep '03

22 Sep '03

>> Wrong protocol. There should be *NO* SMTP transactions for >> non-extistant domains. >After being bit by this over the weekend I would have to agree, due to >a screwup at netSOL a companies domain I manage was resolving to their >sitefinder service, and all mail just went *poof*. At anytime, Verisign could remove your .COM domain from their DNS for a short period of time which would result in all of your inbound email going to the Verisign collector servers. If this was only done for a brief interval, say 10 minutes, you might never notice that it had happened. But Versign's industrial espionage department would have your email in their hands and could do whatever they wish with it. How profitable might that be? Of course, the right way to do this would be to resend the email onward so that you never notice any missing messages at all. In fact, if I were designing the system to do this, I wouldn't log anything at the mailserver. I'd let the mail server and web server technical folks have plausible deniability. Meanwhile, I would have diverted a copy of the mailserver communications at the Ethernet switch to a secret server that does the actual logging of addresses and messages. Son of Carnivore? --Michael Dillon

2 1

Verisign's Threat to Infrastructure Stability
by Curt Akin 22 Sep '03

22 Sep '03

FWIW: To: The Department of Homeland Security Sent (via dhs.gov site form) Dated: 21 Sep 2003 14:24:37 -0000 Category: Security Threats Message: Threat to the stability and predictability of the Internet infrastructure: Verisign is solely and exclusively responsible for the maintenance (and therefore stability) of the root GTLD domain name servers for .com and .net top level domains. Verisign has recently "wildcarded" address records in such a way that attempts to access nonexistant (ie unregistered or mistyped) domain names results in a redirection to a Verisign site at sitefinder.verisign.com. This obviously profit-motive-driven act is not only in violation of certain terms of its contract with ICANN, but has had a destabilizing effect on the network operators community who expect the Internet name service to operate in a designed and predictable way. DHS would be well advised to consider the potential threat that Internet unpredictability has on this country's cyber infrastructure and to seriously consider the relocation of root server responsibility to non-profit-motive-driven organizations. We are all too busy maintaining stable environments to have to consider reactions and countermeasures to Verisign's autonomous and arrogant behavior.

3 2