- Test - lists.nanog.org

Exploding manhole covers in Washington DC
by Sean Donelan 24 Jun '01

24 Jun '01

It was the hottest day so far this year in Washington DC, and once again PEPCO had a case of exploding manhole covers. A fire below 30th and M Street resulted in the loss of power in parts of Georgetown (Washington DC) June 13 2001 about 3:30pm EDT. Apparently the explosions made the news, and I had inquiries. As far as I can tell, it had no impact on the Internet. Most of the fiber carrying Internet traffic through Washington DC isn't on M Street.

3 2

Qwest.Net / US West.Net
by Andy Ellifson 24 Jun '01

24 Jun '01

Does anyone have an escalation number for the dial/DSL/ISDN platform for US West.net/Qwest.net? They have removed my static IP addresses and myself and my customers down. They claim they cannot do anything until Monday. This is unacceptable. Or is there any ISP in the Phoenix Metro area (480,623,602) that will allow me to pay them for a ISDN (2B channel) account with a static /28 for 2 weeks?... and get it setup today?? I'm in a bind right now. Thanks in advance, Andy Ellifson __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

3 2

Re: Exodus Down
by George William Herbert 24 Jun '01

24 Jun '01

>This from the SuSE Linux mail list may help :-) >>>>> Forwarded message from "Lewis E. Wolfgang" <wolfgang(a)nosc.mil> >Something is definitely rotten here. >Whois reports: > Server Name: SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG > IP Address: 24.240.60.16 > Registrar: TUCOWS, INC. > Whois Server: whois.opensrs.net > Referral URL: http://www.opensrs.org > > Domain Name: SLASHDOT.ORG > Registrar: NETWORK SOLUTIONS, INC. > Whois Server: whois.networksolutions.com > Referral URL: http://www.networksolutions.com > Name Server: NS1.ANDOVER.NET > Name Server: NS2.ANDOVER.NET > Updated Date: 13-jun-2001 > >I've never seen whois report two registrars, especially one that says >"SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG" There's nothing rotten there at all. People have had the ability to name their nameservers whatever they wanted for some time, as long as it was one of their TLDs. There have been quite a number of my.domain.rulez.your.domain.sux.dude.we.rule.daves.org type nameserver names for years. Whois is just reporting both matches (both things that contain slashdot.org in the domain or nameserver that are in the database). -george william herbert gherbert(a)retro.com

1 0

Re: Exodus Down
by Andy Bradford 23 Jun '01

23 Jun '01

Thus said mike harrison on Sat, 23 Jun 2001 18:51:51 EDT: > Websites and services all over the place seem to be down. I am not sure if this is related or not, but my pager has been ringing off the wall with various host unreachable or host down alerts (from netsaint). During this time, a traceroute from my DSL at home to where netsaint is running changed 4 times. It seems to have stabilized finally and the route has returned to normal, but every once in a while I get another page. > Including my favorites like freshmeat, slashdot... > and one of our e-commerce credit card processors: CyberSource I noticed this as well---actually it was a co-worker in slashdot withdrawals... :-) If anyone is interested in the traceroutes, I can make them available. Andy -- [-----------[system uptime]--------------------------------------------] 5:46pm up 45 days, 20:23, 7 users, load average: 1.07, 1.08, 1.07

1 0

Re: Exodus Down
by Richard A. Steenbergen 23 Jun '01

23 Jun '01

On Sat, Jun 23, 2001 at 06:51:51PM -0400, mike harrison wrote: > > Maybe all this DDOS discussion is what killed Exodus? > > Websites and services all over the place seem to be down. > Including my favorites like freshmeat, slashdot... > and one of our e-commerce credit card processors: CyberSource > > The common route seems to take them into Exodus.net but not out again. > > Any idea whats up? Maybe they couldn't pay the bills and someone reposessed their routers? :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

RE: DDOS anecdotes
by Tim Devries 23 Jun '01

23 Jun '01

-----Original Message----- From: Mikael Abrahamsson [mailto:swmike@swm.pp.se] Sent: Saturday, June 23, 2001 4:16 PM To: 'nanog(a)merit.edu' Subject: RE: DDOS anecdotes On Sat, 23 Jun 2001, Tim Devries wrote: > FYI beware of service pack 2. It sets the DF bit so packets cannot > fragment. Particularily offensive if your server is on the other side of a > tunnel (due to the overhead). The solution is to reduce the MTU on the box. > Or use a different OS :) >I thought this was standard behaviour of Microsoft OSes since at least >Win95. I know NT does this as standard, so does Win95 and 98. Win2k does >this standard out of the box (at least last time I checked). I have tested it with sp1 and this behaviour does not occur. I have not tested it without any serverice packs so you may be correct in that regard. Tim Devries Technical Trainer Q9 Networks 100% Uptime

1 0

RE: DDOS anecdotes
by Tim Devries 23 Jun '01

23 Jun '01

-----Original Message----- From: woods(a)weird.com [mailto:woods@weird.com] Sent: Saturday, June 23, 2001 3:56 PM To: nanog(a)merit.edu Subject: RE: DDOS anecdotes [ On Saturday, June 23, 2001 at 20:04:06 (+0200), Mikael Abrahamsson wrote: ] > Subject: RE: DDOS anecdotes > > This is a real problem. It's not FUD. Microsofts choice to include full > IP stack capabilities will make the problem worse, but I do not blame > their IP stack for this like Mr Gibson does though. >No, their stack's not the root of the problem -- all the rest of their >OS is (and of course in particular the security model, or lack thereof). FYI beware of service pack 2. It sets the DF bit so packets cannot fragment. Particularily offensive if your server is on the other side of a tunnel (due to the overhead). The solution is to reduce the MTU on the box. Or use a different OS :) Greg A. Woods +1 416 218-0098 VE3TCP <gwoods(a)acm.org> <woods(a)robohack.ca> Planix, Inc. <woods(a)planix.com>; Secrets of the Weird <woods(a)weird.com>

2 1

RE: DDOS anecdotes
by Daniel Senie 23 Jun '01

23 Jun '01

At 02:37 PM 6/23/01, Tim Wilde wrote: > > This is a real problem. It's not FUD. Microsofts choice to include full > > IP stack capabilities will make the problem worse, but I do not blame > > their IP stack for this like Mr Gibson does though. > >Oh, it's most certainly a real problem, but I don't agree that the changes >in Win XP will really make any difference whatsoever. With some very >trivial driver additions, raw sockets can be accessed under any previous >version of Windows, just like in XP. Indeed, there have been LAN analyzers which run on all variants of Windows for a very long time. These can generate / play back traffic, using whatever source IP addresses and MAC addresses were on the original packets. Obviously, a general spoofing tool for Win95 could be written. After reading that part of the tirade, I came to the same conclusion as a previous poster... lots of FUD, and not much more. It's been 5 years since the document now published as RFC 2827 was first a draft. Many sites do ingress or egress filtering. Many don't. Most router equipment can now handle it, according to the manufacturers. Yes, there are issues dealing with multi-homing. However, it appears many attacks still originate from single homed sites, dialup sites, cable modem attached systems, and the like. In most cases, these could be filtered. Has anyone at any of the cable modem vendors made any attempts to try ingress filtering in the cable system head-end routers? Did it work? Need help trying it out? While Ingress filtering will not cure the world, it can help de-fang many attacks. Unfortunately, it requires cooperation to be effective. ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com

5 4

RE: DDOS anecdotes
by Tim Devries 23 Jun '01

23 Jun '01

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Sean M. Doran > Sent: June 23, 2001 11:31 AM > To: nanog(a)merit.edu > Subject: DDOS anecdotes > > > Some of you may find http://grc.com/dos/grcdos.htm > very interesting. The rest of NANOG may, as we do, wonder why Mr. Gibson, after almost naming us in that page (he didn't name _us_ directly, but left enough not-so-subtle hints that both us and our users noticed us being mentioned), chose to brush off our offers to help, claiming instead that he just wanted to move on and forget about the whole thing. (I ought to mention that it took at least a week to get a reply from Mr. Gibson) We ended up concluding that Mr. Gibson's main goal is the distribution of large quantities of FUD. It seems, I might add, that Mr. Gibson is particularly successful at this remarkably valuable art. Vivien -- Can you elaborate further? Tim

2 1

IP Addresses for colocation
by Mark J. Scheller 23 Jun '01

23 Jun '01

Hello NANOG, I'm in the process of evaluating whether to transition away from self-hosting web servers to have them hosted at a colocation facility. The obvious advantages being greater capacities for bandwidth, power, cooling, and oh yes, proper methods of putting out a fire (instead of drowning the servers in water if they so much as overheat). The concern I have is this: if we decide a few months down the road that we don't like this particular colocation facility and wish to move to another one across the street, I'd have to renumber all of my hosts. Is it possible to go to any colocation facility with a block of IP addresses in hand and use them? I'm talking about a /24 here, so I cannot request the addresses directly from ARIN, rather I need to get them from some other source. I attempted to get them from our current bandwidth provider, but they seem to be a little taken aback by my request for a block of addresses that will not be routed by them -- in fact, while writing this they called to tell me they will not provide IP space unless they route to it. Is there a better way to get a /24 that can "go anywhere"? Or should I just justify a /24 at the colocation facility and go through the same process should we decide to change? Is there a way to buy a routable /24? Thanks in advance for any advice, on or off list. I will summarize unless the answer is "you're crazy, such things aren't possible" in which case I'll be off drowning my sorrows at a nearby watering hole. Mark J. Scheller (scheller(a)u1.net)

1 1