- Test - lists.nanog.org

RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by Roeland Meyer 14 May '01

14 May '01

> From: Adam McKenna [mailto:adam@flounder.net] > Sent: Monday, May 14, 2001 1:23 AM > > On Mon, May 14, 2001 at 12:42:54AM -0700, Roeland Meyer wrote: > > > > Oracle (try and build a DB without reverse working right. > > > Net8 stops you > > > > dead in your tracks). > > > > > > Sorry, but this is just 100% wrong. I've set up Oracle on > > > many boxes and you > > > don't need any DNS at all to set up an oracle DB. In fact, I > > > tell our DBA's > > > to use IP addresses in their TNSNAMES.ORA files because I > > > don't want the DB > > > depending on DNS. > > > > Let's see, I don't want to make my DBs dependent on DNS, so > I use IP addrs. > > Yet, I can't depend on IP addrs because my upstream might have to be > > changed... damn, I shouldn't have depended on my scumbag > DSL upstream, eh? > > I believe we've been through this discussion before. Yeah, you and I keep dancing around the same bush. My point is that, nothing is real good by you. One day, names are no good and later, addrs are no good. That's a flip-flop worthy of Bill Clinton. Looking at each specific case, you come up with answers, which may be absolutely the best answer for that case, which may also absolutely contradict another specific case. But, since the two of them are invariably conjoined, you have two contradictory and mutually exclusive answers... for the same thing. Therein, lays my frustration. > > Gee, maybe I should have had a names based system after > all? Either way, I > > wind up having to rebuild Oracle boxen and application > servers, every time > > somebody farts. Just what in blue hell are we supposed to do? > > Maybe you should get a clue, or hire someone who has one. Tried both, it appears non-soluble, at the moment. > > BTW, the last I checked SSL certs are usually names based. > Pretty slack > > security, eh? > > Yes. See > http://cr.yp.to/djbdns/bugtraq/19991114052453-12962-qmail@cr-yp-to > and http://cr.yp.to/djbdns/forgery.html Read the caveats.

2 1

RE: PSI, CAIS, etc..
by Murphy, Brennan 14 May '01

14 May '01

To support what Lee said, I got a notice today from Internap: Internap has determined that PSINet does not meet the service and quality requirements for Internap Service Point connectivity providers. For this reason, Internap will be removing PSINet from our border fabric. PSINet will be accessible via our Service Points over our other connectivity providers. Internap network engineers will be removing PSINet from our border fabric on Monday, May 14 after 22:00 local time. Impact to customers connected to the service point will be limited to a brief period of route reconvergence. Please direct general questions regarding PSINet's removal from Internap's border fabric to your Internap sales account manager. Please continue to direct questions of a technical nature to the Internap NOC. Regards, Krista ---------------------------------------------------------------------------- Krista Horstman EMAIL: noc(a)internap.com Senior Manager, Network Operations NOC: (206) 256-9500 / Internap Network Services (877) THE-INOC Two Union Building OFFICE: (206) 441-8800 -----Original Message----- From: Lee Watterworth [mailto:lwatterworth@rim.net] Sent: Monday, May 14, 2001 8:29 AM To: 'nanog(a)nanog.org' Subject: PSI, CAIS, etc.. The impending doom of PSI has been a foul stench in the air for quite some time now -- how many of you still rely on PSI as your primary (or only) uplink provider? Whether your connection is a T1 or a xDSL, you will likely run into problems similar to what mr Palmer did -- botched cutovers, etc. Maybe its time for the few of you to look for a new uplink provider. I was almost a PSI customer. -Lee ---------------------------- Lee Watterworth, lee(a)rim.net Data Network Specialist Research In Motion 519-888-7465 x 2610 ---------------------------- Tent, Beer, Sleeping Bag, Firewood, Blackberry

1 0

RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by Roeland Meyer 14 May '01

14 May '01

> From: John Fraizer [mailto:nanog@Overkill.EnterZone.Net] > Sent: Monday, May 14, 2001 1:33 AM > On Mon, 14 May 2001, Roeland Meyer: > > Yet, I can't depend on IP addrs because my upstream might have to be > > changed... damn, I shouldn't have depended on my scumbag > DSL upstream, eh? > > Gee, maybe I should have had a names based system after > all? Either way, I > > wind up having to rebuild Oracle boxen and application > servers, every time > > somebody farts. Just what in blue hell are we supposed to do? > > Um, lets see...how about this. You use NAT. That'll be > $180.00 please. > I'll send you an invoice. Good luck, some critical stuff can't NAT. Send it, I'll file it in the appropriate receptacle. > > BTW, the last I checked SSL certs are usually names based. > Pretty slack security, eh? > > Slack, no. You're comparing apples to oranges here and > HOPEFULLY, you know > it. Basing security on IN-ADDR is absolutely idiotic. Agreed, but some code requires it. Which was my point. I'm talking smaller vendors, like Oracle. BTW, how do I fake in-addr.arpa responses for NAT'd space? My Oracle 8i server keeps checking the reverse addr every time I try to create a DB. It's really annoying. Funny thing, my DB2 servers do the same thing ... > Basing security on IP addresses on the other hand is while > not a complete > security solution, MUCH MORE SOUND than IN-ADDR. You can at least build > ACLs in your router(s) that don't allow spoofed traffic to enter your > network. Then, why bother with DNS? This becomes a real problem with non-portable IP blocks. My point remains, names are more portable than IP addrs. > Now, about the SSL security thing. SSL > certification is designed > to certify the identity of the server and that identity is > based on the > FQDN. SSL CERTs are around for the PRECISE reason that it is > too easy to spoof IN-ADDR, etc. I agree, and always have, that reverse is easy to spoof. However, breaking reverse is guaranteed to make some things fail. Some of those things are proprietary code, owned by someone else, that I don't have sources for (and which I paid a lot of money for). No, I don't have any clout with Oracle (any more than you do, with Bill Gates). > > This is right on up there with: > > > > 1) You idiot DSL monkey, you deserve your Inet death > because you didn't > > multi-home. > > 2) No, you can't advertise less than a /20. > > 3) No, you don't deserve larger than a /32. > > 4) Yes, we know that makes multi-homing impossible for > those that need it > > the most. > > 5) No, we don't care, you idiot DSL monkeys deserve Inet death. > > > > Yeah, the message you send out is real clear. > > ... and one wonders why the Internet has an implosion problem... > > And that's right up there with "<plonk!> me please! I'm an idiot DSL > monkey! WAAAAAAAAAA! My DSL provider went tits-up and I > hadn't built any > contengency plan. I'm going to go bankrupt! WAAAAAAAAA!" I'm glad you enjoyed that, it was supposed to be funny. BTW, DSLnetworks is still in business...how (if they're so bad)? But, that wasn't the point. The point is that many of us, on the end-points, are being hung out there without recourse. How do we multi-home to different providers when routing gets munged as a guaranteed side-effect? > If your business depends (depended) on stable and reliable internet > connectivity with your own (or at least non-changing) address > space, might > I suggest that you should have gone to ARIN for a microblock > of address > space and established a contengency plan with some other > provider(s) in > the event that the sky fell? I've been trying to do that for years. Minor technical difficulties keep getting in the way, like routability. I can get the /24, already have the ASN, but can't get it routed. If it's so easy, how come you haven't done it yet?

3 2

RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by Roeland Meyer 14 May '01

14 May '01

> From: Frank Rizzo [mailto:rizzo@drunkagain.org] > Sent: Sunday, May 13, 2001 3:09 PM > > On Sun, May 13, 2001 at 02:20:28PM -0700, Roeland Meyer wrote: > > > > I've had similar problem at SpeakEasy. They still don't > have a reverse-DNS clue. > > > > http://www.mhsc.com/recovery.htm > > > > None of the DSL ISPs can do larger than /27 anymore, even > when they're > > ILECs. Anything less than a /24 can't be SWIP'd and if you > don't control > > your in-addr.arpa entries you don't control your domain and have no > > security. > > wow, relying on dns for security is pretty freaking ignorant, > and so are you appearantly. that's okay, i'll shut up now because i'll be > busy playing with my reverse dns to get your hosts to trust me! Gee, I wish you knew what you were talking about. Basic security starts with reverse, see tcp_wrappers, SSH, Oracle (try and build a DB without reverse working right. Net8 stops you dead in your tracks). Half of my ACLs don't work right because reverse isn't correct. > ps - 32/27.0.168.192.in-addr.arpa., learn it, love it, live it. Thu May 10 22:59:09 [root:2]#> ps - 32/27.0.168.192.in-addr.arpa. ERROR: Garbage option.

3 2

PSI, CAIS, etc..
by Lee Watterworth 14 May '01

14 May '01

The impending doom of PSI has been a foul stench in the air for quite some time now -- how many of you still rely on PSI as your primary (or only) uplink provider? Whether your connection is a T1 or a xDSL, you will likely run into problems similar to what mr Palmer did -- botched cutovers, etc. Maybe its time for the few of you to look for a new uplink provider. I was almost a PSI customer. -Lee ---------------------------- Lee Watterworth, lee(a)rim.net Data Network Specialist Research In Motion 519-888-7465 x 2610 ---------------------------- Tent, Beer, Sleeping Bag, Firewood, Blackberry

1 0

RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by John Murphy 14 May '01

14 May '01

<quote> Roeland Meyer, "None of the DSL ISPs can do larger than /27 anymore, even when they're ILECs. Anything less than a /24 can't be SWIP'd..." </quote> I really couldn't care less about SpeakEasy. I just didn't feel like watching yet another of your blatantly inaccurate blanket statements slide by. Case in point, *both* of those statements above are inaccurate. -----------------------Original Message----------------------- >From: Roeland Meyer >To: John Murphy;nanog(a)nanog.org >Date: 5/14/01 5:06 AM >Subject: RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS > >> From: John Murphy [mailto:nanog@mail.murfnet.com] >> Sent: Sunday, May 13, 2001 8:07 PM >> >> I'm sorry Roeland, but your statement about SWIP'ing anything >> less than a >> /24 is just inaccurate. We SWIP /29s and /30s daily, for >> both our Frame >> and our DSL customers. > >Tell it to SpeakEasy. >

1 0

Re: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by John Palmer (NANOG Acct) 14 May '01

14 May '01

> > > John Palmer wrote: > > > I don't think the technology is the problem, but the competence > > > (or lack of it) amongst the major players. > > > All of our problems have not been related to the DSL technology > itself, but > > > rather the screwups of the providers. > > > >Have you considered the possibility that you weren't paying for > >competence? If you chose to call the _business_ services group of any of > >the involved providers, and order a T1 at normal price, you might > >discover whether they're competent or not. > > > > -Bill > Excuse me, but we are a Business customer and are paying for business-class service. We dont need a T-1 because we dont need that bandwidth.

1 0

RE: To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS
by Roeland Meyer 13 May '01

13 May '01

I've had similar problem at SpeakEasy. They still don't have a reverse-DNS clue. http://www.mhsc.com/recovery.htm None of the DSL ISPs can do larger than /27 anymore, even when they're ILECs. Anything less than a /24 can't be SWIP'd and if you don't control your in-addr.arpa entries you don't control your domain and have no security. > From: John Palmer (NANOG Acct) [mailto:nanog@adns.net] > Sent: Sunday, May 13, 2001 1:40 PM > <FLAME ON> > PSINet dumped all of their DSL customers onto CAIS. Covad is > the backhaul > provider for them both. Need I say more? > > Bottom line, I dont know how many thousands of people were > without service > for more than a day because the whole transfer was botched. > > We have a situation where we had a DSL connection from PSI > and were using > our own IP addresses. Problem is that no one changed the > routing tables and the packets dead-ended at PSI. > > Getting CAIS to fix this problem has been a nightmare. At > first, PSI didnt > stop announcing the routes and now that they have, it seems that > CAIS will not announce the routes till Monday becuase "no one > at our NOC > knows how to do this and the one guy (ONE GUY IN THE WHOLE > COMPANY - AND THEY ARE A NATIONWIDE PROVIDER????) who knows > how doesn't work > weekends." > <flame off - sorry to the list for being so loud>

3 3

Sympatico technical contact
by Aaron 12 May '01

12 May '01

I've been running around for the past 20 minutes or so trying to find a technical contact for Sympatico in ontario to no avail. Does anyone on this list have someone I could speak with? They're having reverse DNS issues - ie. hostnames saying the client is in barrie while the client is in london. Just wanted to get someones attention on this issue as its rather frustrating. -Aaron

1 0

Re: 10 gige experience
by Frank Coluccio 12 May '01

12 May '01

re gige: As long as we're discussing reading material, the July 2001 Cook report contains two good interviews on Ethernet in the First Mile (EFM) with Howard Frazier [ex-Cisco, now-Dominet] and WorldWidePacket's Jonathan Thatcher. 10 gige is discussed sporadically throughout, along with three variations of outside plant (Ethernet over UTP, P-P Fiber, and P-MP Fiber PONs, or EPONs) with implications to the greater 'Net's backbone, and other architectural opportunities/implications. http://www.cookreport.com FAC ------Original Message------ From: "Nipper, Arnold" <arnold(a)nipper.de> To: Frank Coluccio <fcoluccio(a)dticonsulting.com>, dave o'leary <doleary(a)juniper.net>, Mike Leber <mleber(a)he.net>, Vinay Bannai <bannai(a)pacbell.net> Sent: May 11, 2001 6:10:40 PM GMT Subject: Re: 10 gige experience http://www.nwfusion.com/research/2001/0507feat3.html might also be interesting ... Arnold ----- Original Message ----- From: "Frank Coluccio" <fcoluccio(a)dticonsulting.com> To: "dave o'leary" <doleary(a)juniper.net>; "Mike Leber" <mleber(a)he.net>; "Vinay Bannai" <bannai(a)pacbell.net> Cc: <nanog(a)merit.edu> Sent: Thursday, May 10, 2001 6:53 AM Subject: Re: 10 gige experience > > Off Topic, kinda... check out the caption at the bottom of this page: > > http://www.iec.org/tutorials/opt_ethernet/topic05.html > > The tutorial isn't bad, either ;) > > > > > > ------Original Message------ > From: "dave o'leary" <doleary(a)juniper.net> > To: Mike Leber <mleber(a)he.net>, Vinay Bannai <bannai(a)pacbell.net> > Sent: May 10, 2001 2:35:24 AM GMT > Subject: Re: 10 gige experience > > > > > IEEE standards web page at http://grouper.ieee.org is quite helpful > for finding the status of the various standards. > > In particular, check > > http://grouper.ieee.org/groups/802/3/ae/public/mar01/minutes_0301.pdf > > for the minutes of the last IEEE 802.3ae Working Group meeting. > > Target for completion is 1Q 2002. > > At this point, much of the work has been completed, I believe that > all of the outstanding issues were resolved at the meeting and they > have gone to working group ballot (don't ask me about all the details > of the IEEE decision making process, but they are online). > > So at least things are close enough that chip sets are being developed > and equipment vendors can get underway with confidence that there > won't be too much change, such that standards compliant products > should be available about in the same timeframe that the standard > is completed. > > dave > > At 04:14 PM 5/9/01 -0700, Mike Leber wrote: > > > >On Wed, 9 May 2001, Vinay Bannai wrote: > > > > Anybody out there have any experience with 10 gigabit ethernet? > > > > > > I don't think the 10GEA has standarized the draft. It is slated for mid > > 2002. > > > But some vendors might have non-standard implementations, but I am not > > aware of > > > it. > > > >Here is an article that states that IntelliSpace and others are already > >using 10 Gigabit Ethernet equipment provided by Extreme Networks. It is > >skimpy on the details. > > > >http://www.computerworld.com/cwi/story/0,1199,NAV47_STO54671,00.html > > > >I'm trolling to see if anybody in the nanog crowd was willing or able > >(NDAs and all) to tell us about any 10 gige equipment they might be using. > > > >+------------------- H U R R I C A N E - E L E C T R I C > -------------------+ > >| Mike Leber Direct Internet Connections Voice 510 580 4100 > | > >| Hurricane Electric Web Hosting Colocation Fax 510 580 4151 > | > >| mleber(a)he.net http://www.he.net > | > >+-------------------------------------------------------------------------- -+ > > > > > > > > > > > >

2 1