- Test - lists.nanog.org

site finder performance
by Petri Helenius 19 Sep '03

19 Sep '03

The redirect port 80 server seems to gain on performance, I wonder if that´s due to Verisign fixing issues or enough people blocking it so the load lowers? We´ve gone from 22 seconds average transaction time yesterday, to about two seconds so far today. Minimum achieved is 239 milliseconds, which is also about the theoretical minimum from our neck of woods because of light speed limitations. Pete

1 0

RE: News of ISC Developing BIND Patch
by Adam Atkinson 19 Sep '03

19 Sep '03

> I would say _supposed_ to be unique. Surely some cheapo manufacturer > has recycled addresses from their old ISA card days. I've seen at least one manufacturer ship multiple cards with the same MAC address. One shop in Tottenham Court Road, London sold several people on the same LAN cards with identical MAC addresses.

1 0

Interesting interaction between Blaster worm variants and Verisign DNS change
by Jeremy_Powell＠sbcss.k12.ca.us 19 Sep '03

19 Sep '03

I think that an interesting interaction involving: 1) Blaster worm DDoS attack against windows update. 2) The default action of Windows 2000 and XP computers to automatically append the domain name under "Network Identification" or the suffix search list to DNS lookups. 3) The number of non-existent domains that exist in the above settings. 4) The change that Verisign made so that all non-existent domains resolve to 64.94.110.11 is the cause of the DDoS attack that Verisign is experiencing. It is simple to reproduce 2-4. Reconfigure any Windows 2000 computer or XP computer so that its domain name does not exist or so that the first domain name in its domain suffix search order does not exist and then do an nslookup. It will append the domain you added to your lookup and the result of the lookup will be 64.94.110.11 if the domain you added does not exist. All that is needed next is a machine satisfying this condition to have a variant of the Blaster worm that is performing its DDoS against windowsupdate.com. It will instead sends its traffic to 64.94.110.11. In a network of roughly 30,000 computers we have had 2 with this combination of troubles already. Jeremy Powell San Bernardino County Superintendent of Schools _________________________________________________________________________________ Statement of Confidentiality: The contents of this e-mail message and any attachments are intended solely for the addressee. The information may also be confidential and/or legally privileged. This transmission is sent for the sole purpose of delivery to the intended recipient. If you have received this transmission in error, any use, reproduction, or dissemination of this transmission is strictly prohibited. If you are not the intended recipient, please immediately notify the sender by reply e-mail, send a copy to postmaster(a)sbcss.k12.ca.us and delete this message and its attachments, if any. E-mail is covered by the Electronic Communications Privacy Act, 18 USC SS 2510-2521 and is legally privileged. Date Sent (d/m/yy): 18/9/2003 - Sender: Jeremy_Powell(a)sbcss.k12.ca.us

1 0

News of ISC Developing BIND Patch
by John Neiberger 19 Sep '03

19 Sep '03

http://apnews.excite.com/article/20030916/D7TJOF3G0.html --

29 39

Kill Verisign Routes :: A Dynamic BGP solution
by Eric Germann 19 Sep '03

19 Sep '03

I wanted to discuss the merits of the following: I have written a proof of concept solution to nuke a route to sitefinder. Code to those who care or to the list if anyone cares. Perl is your friend :) Basic concept: Use Net::BGP to set up a peering session with my route server. Query DNS for *.com and *.net on x interval. Then take the answers (if they are valid A records) and inject them into the route server (which in our case is used solely to feed a blackhole network to sink traffic from APNIC space, etc). If an address no longer appears in the DNS (i.e. the idiots switched hosts), withdraw the route. If they set up multiple hosts, it will catch each one of them. You can set the polling interval as you please. Thoughts? Eric ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert OH 45891 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "The fact that there are actually ways of knowing and characterizing the extent of one’s ignorance, while still remaining ignorant, may ultimately be more interesting and useful to people than Yarkovsky" -- Jon Giorgini of NASA’s Jet Propulsion Laboratory

4 6

OT: The lawsuits to verisign being.. 100 Million
by netmask 19 Sep '03

19 Sep '03

I thought it might be relevant.. The legal wars have also begun: Popular Enterprises Files $100 Million Lawsuit against VeriSign Inc. The Complaint alleges antitrust violations, unfair competition and violations of the Deceptive and Unfair Trade Practices Act based upon VeriSign's release of the http://sitefinder.verisign.com product. According to Popular Enterprises, the "Sitefinder" service allows VeriSign to monopolize unregistered ".com" and ".net" domains, and to profit by redirecting all Internet traffic for these sites to pay-for-placement sites controlled by VeriSign. If they are allowed to operate Sitefinder, VeriSign will now profit from Internet traffic directed to all unregistered domain names, including thousands of domain names that VeriSign has refused to allow the public to register. ......... http://home.businesswire.com/portal/site/google/index.jsp?epi-content=GENER… -netmask

1 0

let the lawsuits begin
by Alan Hannan 19 Sep '03

19 Sep '03

Let the lawsuits begin. " KNOXVILLE, Tenn.--(BUSINESS WIRE)--Sept. 18, 2003--Popular Enterprises LLC, the parent company of Netster.com, has filed a $100 million dollar lawsuit against VeriSign, Inc. The Complaint alleges antitrust violations, unfair competition and violations of the Deceptive and Unfair Trade Practices Act based upon VeriSign's release of the http://sitefinder.verisign.com product. " http://home.businesswire.com/portal/site/google/index.jsp?epi-content=GENER… http://search.netster.com/about/lawsuit.asp

1 0

ISC Patches
by Peter Losher 18 Sep '03

18 Sep '03

The official announcements are going out via the bind-announce(a)isc.org list, but just in case: http://www.isc.org/products/BIND/delegation-only.html Best Wishes - Peter Losher -- Peter_Losher(a)isc.org | ISC | OpenPGP 0xE8048D08 | "The bits must flow"

6 6

Re: .ORG problems this evening
by Todd Vierling 18 Sep '03

18 Sep '03

On Thu, 18 Sep 2003, John Fraizer wrote: : As has been stated by others, UltraDNS, like the roots and other TLD hosts : is under nearly constant attack. Perhaps your local nodes were effected : by an attack. IE; the pipe was full but the service was still alive so the : anycast prefix wasn't retracted. Bummer. Sucks to be you. Sucks to be anyone trying to use the service whose routers pick those nodes as the only ones available. That's the fault of the implementor, not the client. The major issue here is that no *gTLD*, particularly one of the Big Three, should be subject to a SPOF -- even if it's only a regionally visible SPOF due to anycast selection. It should *always* be possible to attempt queries to more than one physical location's servers for a gTLD. Yet last night, I could not query .ORG from several different locations in the continental US, even though there were perfectly functional servers available (in the same country, no less). BGP errors happen (everyone here should be able to attest to that readily), and they did. What's to stop some other boneheaded DoS or oversight from causing this again? And again? This particular outage was in the late evening in what appeared to be the affected area from my probing, which is why people like you don't appear to care; it "didn't affect you". What about when it happens in the middle of the day in your neck of the woods? : Doesn't really matter to me though. Bitch and moan all you like. : Demonstrate your lack of experience and understanding. Uh-huh. Quite a few people here know better; they also know I am surrounded by <cloak/> on this list and others. If my public resume were up to date and filled in more detail, you'd know otherwise. Don't try to speak for my experience from your pedestal when you don't have the information to make that kind of baseless judgment. On the other hand, if you can't see the fatal flaw in a major Internet infrastructure service depending on a single point of failure, I can point you at a few books that could enlighten you. -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com>

3 3

Re: Worst design decisions?
by Miquel van Smoorenburg 18 Sep '03

18 Sep '03

In article <cistron.Pine.NEB.4.58.0309181101380.8936(a)server.duh.org>, Todd Vierling <tv(a)duh.org> wrote: > >On Thu, 18 Sep 2003 up(a)3.am wrote: > >: Without a question: PS/2 style keyboard and mouse connectors. Impossible >: to tell from each other, > >And this part is somewhat funny, too, because the PS/2 connector layout is >capable of having both devices share the same bus (there's two unconnected >pins, which some laptops use to provide alternate CLK/DATA signals). > >If PS/2 mice used the unconnected pins rather than the same CLK/DATA pins as >the keyboard, all machines could simply have two connectors using all six >pins and you'd be able to plug either device into either socket. Actually a PC can detect if a mouse or keyboard is plugged in and behave appropiately - there were PCs (I forget which) on which it didn't matter what port you used for kbd or mouse, it all just worked. In fact 2 kbds is quite possible as well. So that is basically a software problem. Mike.

1 0