- Test - lists.nanog.org

Odd DDoS, anyone else seen this?
by Stephen J. Wilcox 29 Nov '02

29 Nov '02

Hi, we had a large DDoS over the weekend, I wondered if anyone else has seen this and knows what software is behind it. We saw many hundred thousand packets per second entering our network from various international peers, each packet was tcp destined to a single real end user IP address and sourced from a /16 network address eg 61.254.0.0, where the src was random and different on each packet but always x.x.0.0 I was unable to find out more about the data within the packet, the sheer volume made diagnosis impossible without killing the routers. Steve

8 9

Re: DNS 101
by Damian Gerow 29 Nov '02

29 Nov '02

On Fri, 2002-11-29 at 18:07, Phillip Vandry wrote: > > I'm looking for a bit of DNS help here... > > > > We've been doing a bit of work that involves looking up the real > > authoritative nameservers for domains that we believe we are > > authoritative for, and have run into a spot of trouble when it comes to > > looking up ca. sub-domains. > > Damian, > > I was running exactly that kind of script for a while when I wanted to > clean up a nameserver (couldn't customers notify nameserver operators > when they redelegate their zones somewhere else? No, that would be :) Maybe we should set a fine or something... > too much to ask for.). I also had trouble with the ca. domains. > Several of the nameservers pick up the NS records at the top of *my* > zonefile instead of reporting what's in the "ca." zonefile. None > of the GTLD servers do this. I guess they're configured for recusrion > and fetch-glue and shouldn't be. Just to let everyone know, this has all been clarified, and it was the swap in responses that had me all confused. BIND8 responded, in this case, with an answer, giving the /n/ name servers, thus setting ANCOUNT to /n/. BIND9 responds, again in this case, with the nameservers as glue data, thus keeping the ANCOUNT at 0 (no official answers, right?). Thanks to Kandra for shedding light on this, and Joe Abley for explaining some of the more detailed items. Much appreciated. - Damian

1 0

Spanning tree melt down ?
by Huff, Mark 29 Nov '02

29 Nov '02

Cisco wins... As a result of the crash, Beth Israel Deaconess plans to spend $3 million to replace its entire network - creating an entire parallel set of wires and switches, double the capacity the medical center thought it needed.

12 11

DNS 101
by Damian Gerow 29 Nov '02

29 Nov '02

I'm looking for a bit of DNS help here... We've been doing a bit of work that involves looking up the real authoritative nameservers for domains that we believe we are authoritative for, and have run into a spot of trouble when it comes to looking up ca. sub-domains. Could I ask people with domains ending in .ca to do lookups of type NS for that/those domain(s) against all the ca. nameservers, and let me know if you see anything weird? Specifically, can you look at the ANCOUNT response? Just looking to see if my DNS understanding is way off whack, or if there really /is/ something funky going on with a couple of the servers. TIA... - Damian P.S. I /have/ contacted the organization in question, but received a response that was *entirely* puzzling, which is why I'm asking here...

2 1

Re: Spanning tree melt down ?
by Bohdan Tashchuk 29 Nov '02

29 Nov '02

> Minimal social engineering plus a weak network security infrastructure > is a disaster waiting to happen for any major medical facility. You forgot to mention probable political infighting. And maybe inexperienced leadership. My favorite snippet from the article is: Dr. John Halamka, the former emergency-room physician who runs Beth Israel Deaconess Medical Center's gigantic computer network. Is a physician, after years of medical school, internship, residency, etc. the right person to be in charge of a "gigantic" computer network? Are arteries and veins the equivalent of fiber and CAT-5? I'd love to be the Cisco rep selling $3 million of new network equipment to this guy. What is the probability that he as ANY idea what "spanning tree protocol" means?

4 3

Re: South Asia Network Operators Group (SANOG)
by Bill Woodcock 29 Nov '02

29 Nov '02

"Poyerd, Denis" <Denis.Poyerd(a)veridian.com> wrote: > From multiple news sources. Please correct me if I'm wrong, your > message happened to come out as I hear about "possible" issues in > Nepal. Oh, come on, don't be a nitwit. Whois says you're in _Arlington, Virginia, in the United States_. Now which do you think is safer, staying at home, or going to Nepal for the same period of time? Let me guess; you have a television, you think Thailand is full of prostitutes, you think Russia is full of gangsters, and you've never actually been to any of those three countries. Am I right? Free clue: go look at the numbers. You have my abject apologies, of course, if you're actually Canadian. For everybody else, yes, I know I'm being grouchy. I just find this kind of behavior incredibly offensive; this kind of reality-defying jingoism is one of the most embarassing things about being identified as an American while travelling. Happy Thanksgiving. -Bill

2 1

RE: South Asia Network Operators Group (SANOG)
by Poyerd, Denis 29 Nov '02

29 Nov '02

>From multiple news sources. Please correct me if I'm wrong, your message happened to come out as I hear about "possible" issues in Nepal. Denis -----Original Message----- From: Philip Smith To: Poyerd, Denis Cc: 'nanog(a)merit.edu ' Sent: 11/28/2002 2:19 AM Subject: RE: South Asia Network Operators Group (SANOG) Is this from personal experience, or believing the media? philip -- At 23:27 27/11/2002 -0500, Poyerd, Denis wrote: >Nepal? Kind of an unstable location these days. > >-----Original Message----- >From: Philip Smith >To: nanog(a)merit.edu >Sent: 11/27/2002 9:42 PM >Subject: FYI: South Asia Network Operators Group (SANOG) > > >This is an FYI only... > >The first meeting of the South Asia Network Operators Group (SANOG) will > >take place alongside ITConference2003 (http://www.itconference.org.np/) >in >Kathmandu, Nepal on 23rd-27th January 2003. > >Its aimed at ISPs and Network Operators in the South Asia region, >basically >encompassing the Indian subcontinent and neighbouring countries. SANOG >doesn't quite yet have a website, but hopefully this isn't too far off. > >This is the first attempt to create such an operators group in this part >of >Asia; if anyone is interested in supporting this new NOG, please feel >free >to contact Gaurab Raj Upadhaya <gaurab(a)lahai.com> who is organising the >event. > >philip >--

3 2

The Cidr Report
by cidr-report＠potaroo.net 29 Nov '02

29 Nov '02

This report has been generated at Fri Nov 29 21:45:21 2002 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 22-11-02 116795 84759 23-11-02 117137 84733 24-11-02 117342 84973 25-11-02 117875 84933 26-11-02 117560 85077 27-11-02 117565 85161 28-11-02 117576 84918 29-11-02 117628 85008 AS Summary 14099 Number of ASes in routing system 5541 Number of ASes announcing only one prefix 2403 Largest number of prefixes announced by an AS AS3908 : SUPERNETASBLK SuperNet, Inc. 72949760 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 29Nov02 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 117621 84999 32622 27.7% All ASes AS3908 2403 1314 1089 45.3% SUPERNETASBLK SuperNet, Inc. AS701 1714 1237 477 27.8% ALTERNET-AS UUNET Technologies, Inc. AS18566 377 5 372 98.7% COVAD Covad Communications AS7018 1406 1038 368 26.2% ATT-INTERNET4 AT&T WorldNet Services AS7843 664 300 364 54.8% ADELPHIA-AS Adelphia Corp. AS4323 526 184 342 65.0% TW-COMM Time Warner Communications, Inc. AS6197 460 123 337 73.3% BATI-ATL BellSouth Network Solutions, Inc AS1221 1176 853 323 27.5% ASN-TELSTRA Telstra Pty Ltd AS7046 585 296 289 49.4% UUNET-CUSTOMER UUNET Technologies, Inc. AS6347 358 81 277 77.4% DIAMOND SAVVIS Communications Corporation AS4355 403 136 267 66.3% ERMS-EARTHLNK EARTHLINK, INC AS22927 275 20 255 92.7% AR-TEAR2-LACNIC TELEFONICA DE ARGENTINA AS1239 911 658 253 27.8% SPRINTLINK Sprint AS6198 420 167 253 60.2% BATI-MIA BellSouth Network Solutions, Inc AS705 439 206 233 53.1% ASN-ALTERNET UUNET Technologies, Inc. AS4814 248 15 233 94.0% CHINANET-BEIJING-AP China Telecom (Group) AS1 663 440 223 33.6% GNTY-1 Genuity AS4151 352 149 203 57.7% USDA-1 USDA AS852 669 468 201 30.0% ASN852 Telus Advanced Communications AS17557 314 123 191 60.8% PKTELECOM-AS-AP Pakistan Telecom AS6595 243 58 185 76.1% DODDSEUR DoD Education Activity Network Assistance Center AS4134 299 117 182 60.9% ERX-CHINALINK Data Communications Bureau AS209 519 338 181 34.9% ASN-QWEST Qwest AS17676 230 50 180 78.3% GIGAINFRA XTAGE CORPORATION AS690 506 334 172 34.0% MERIT-AS-27 Merit Network Inc. AS2048 260 88 172 66.2% LANET-1 State of Louisiana AS6140 268 103 165 61.6% IMPSAT-USA ImpSat AS6327 182 33 149 81.9% SHAWFIBER Shaw Fiberlink Limited AS7132 215 67 148 68.8% SBIS-AS Southwestern Bell Internet Services AS2386 364 223 141 38.7% INS-AS AT&T Data Communications Services Total 17449 9224 8225 47.1% Top 30 total Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)lists.apnic.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

RE: South Asia Network Operators Group (SANOG)
by Poyerd, Denis 29 Nov '02

29 Nov '02

Wow! One statement about unrest in a country and the flames hit the ceiling. I've travelled to over twenty countries (incl, one of the two listed below), many others hostile...and the news about them are very often not too far off the mark. I'm not trying to dissuade people from attending the conference, just be aware...of course, if anyone wants to waste anymore bw on this, I'll have to turn on my deny flames statement. Denis -----Original Message----- From: Bill Woodcock To: Denis.Poyerd(a)veridian.com; nanog(a)merit.edu Sent: 11/28/2002 9:09 PM Subject: Re: South Asia Network Operators Group (SANOG) "Poyerd, Denis" <Denis.Poyerd(a)veridian.com> wrote: > From multiple news sources. Please correct me if I'm wrong, your > message happened to come out as I hear about "possible" issues in > Nepal. Oh, come on, don't be a nitwit. Whois says you're in _Arlington, Virginia, in the United States_. Now which do you think is safer, staying at home, or going to Nepal for the same period of time? Let me guess; you have a television, you think Thailand is full of prostitutes, you think Russia is full of gangsters, and you've never actually been to any of those three countries. Am I right? Free clue: go look at the numbers. You have my abject apologies, of course, if you're actually Canadian. For everybody else, yes, I know I'm being grouchy. I just find this kind of behavior incredibly offensive; this kind of reality-defying jingoism is one of the most embarassing things about being identified as an American while travelling. Happy Thanksgiving. -Bill

1 0

Internet Security Whitepaper
by Jeremy Parr 28 Nov '02

28 Nov '02

We are a wireless ISP, and have a client asking for a document regarding the security of their wireless connection. I am looking for some sort of whitepaper explaining the insecurities of the Internet. They don't seem to realize that no matter how secure their connection from their office to mine is, the Internet is a wild and insecure place. Jeremy

1 0