- Test - lists.nanog.org

Re: Network diversity Software diversity
by Steve Sobol 26 Jan '01

26 Jan '01

Clarification: Roeland Meyer replied to an e-mail I sent earlier today. > I thought you have no PDC's <g>. I said "My PDC is a Linux box". I should have said "was" - I run a very small LAN here in the office that doesn't really require me to run a PDC. It's ready to go if I need to use it in the future; I just am not using it right now. Sorry about that. -- Steve Sobol, BOFH, President 888.480.4NET 866.DSL.EXPRESS 216.619.2NET North Shore Technologies Corporation http://NorthShoreTechnologies.net JustTheNet/JustTheNet EXPRESS DSL (ISP Services) http://JustThe.net mailto:sjsobol@NorthShoreTechnologies.net Proud resident of Cleveland, OH

1 0

RE: Network diversity Software diversity
by Roeland Meyer 26 Jan '01

26 Jan '01

> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Thursday, January 25, 2001 11:48 PM > > On Thu, 25 Jan 2001 22:40:50 PST, Roeland Meyer said: > > Okay, how do you do security, in Win2K, without a domain > controller? > > How do you do a Win2K domain without active directory? > > Contrary to what many puntits would have you believe, you don't > need to be in a domain and be running AD just to serve up static HTML. > Beware such pundits - they are probably trying to sell you > either a software > or hardware upgrade. ;) > You don't even need to be running Win2K. I hear even NT 4.0 does > a passable job once you install all the IIS patches. ;) Actually, Linux does it better w/ Apache. But, IIS is a better RAD environment. But, that isn't the issue. The track started about DNS at MSFT. Windows networks have Win domain controllers ... > > > From: Eric Germann [mailto:ekgermann@cctec.com] > > > > > > Uhh, I highly doubt they have a requirement to run DDNS on > > > the front ends. If all you're doing is serving up html pages > > > without user authentication, Win2K is perfectly happy with > > > its own internal account database. DDNS is a pre-req for AD, > > As Eric said.... you don't need bells and whistles. And if you're > building a machine that *has* to work, you probably want to avoid > bellls and whistles, as broken bell and whistle parts get jammed in > the gears and cause failures.... MSFT is not running static anything.

4 3

charitable organization for the shrinkage of the global routing table
by smd＠clock.org 26 Jan '01

26 Jan '01

The slopes of the curves maintained by Geoff, Erik and Tony appear to be steepening, and while 10**5 routes is a no-brainer to a modern core router, 10**6 is hard, and nothing known will deal with 10**7. We all save enormous money by making sure CIDR keeps the curve as flat as reasonably possible. It seems that getting people to be good aggregators is pretty tricky, in part because alot of the offenders don't seem to have the time to follow the operational forums in which their names come up again and again. At the last IEPG I suggested we collectively send "slot-occupation" bills for small numbers of dollars per long prefix to the worst offenders, in hopes they get the message, or pay each of us for necessary equipment upgrades, operational costs, R&D, and so forth. Since nobody seems as crazy as me, it was counter-suggested that I start a charitable clearing-house, which would send out bills on behalf of "everyone" to the baddies. Hey, maybe some folks will pay, maybe some will aggregate (having gotten the message), while others will have to be handed over to maximally aggressive collections agencies, or even *gasp* be subjected to filtering by one or more providers. I have a simple alternative proposal to put pressure on the "bad guys". Project: set up streaming porn servers that, when a source connects from -------- an address block announced by an AS in the list of Tony Bates's top-N bad aggregators, results in a message like this: Dear Prospective User - You are connecting from [A.A.A.A], an IP address in a netblock [P.P.P.P/M] which should be aggregated by your ISP or one of its upstream providers into a longer prefix. Please see the CIDR Report Project at http://www.employees.org/~tbates/ for an indication of the growth of the global routing table, which is an expensive phenomenon exacerbated by your upstream provider(s). REWARD REWARD REWARD If you can convince your upstream provider(s) to aggregate, renumber, or otherwise withdraw [P.P.P.P/M], we will give you FREE XXX hours of FREE access to the streaming porn on this site. Otherwise, please have your credit-card handy. All proceeds go to the charitable fund for the elimination of long prefixes and the drainage of the routing table swamp, much of which is spent on maintaining this excellent source of adult entertainment. Now then, to kick-start the project, we need some bandwidth (easy enough), some sort of content distribution network or server farm (also easy), a studio in a convenient legal jurisdiction (straightforward), lighting, technical support, that kind of thing (simple opex). Oh, and models. Oh Vint, are you busy? We need your sexy strip tease. It's for the good of the Internet, promoting its long-term sustainability and growth. Other suggestions welcome. Sean.

4 3

RE: From Microsoft's site
by Roeland Meyer 26 Jan '01

26 Jan '01

> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Wednesday, January 24, 2001 11:22 PM > I have *NO* evidence that Ramen was the actual cause other > than it's this > week's problem. However, I'm pretty sure that *whatever* happened, > the poor router tech was *already* having a Very Bad Day > before he ever GOT to the part where he changed the config..... You know, there are times, when I am so tired or stressed out that I will refuse to "su -". It took many, many, years of fixing the resultant problems, to formulate that policy and set the threshold. At that point, I don't care where the dead-line is, or how much $$$ is on the table. Because, I *know* that I'll scrog (neat word) it when I do. That router-tech needs to learn where their thresholds are.

3 2

RE: Network diversity Software diversity
by Roeland Meyer 26 Jan '01

26 Jan '01

Okay, how do you do security, in Win2K, without a domain controller? How do you do a Win2K domain without active directory? How do you install active directory without DNS SRV updates(it won't let you)? Which are the ONLY two DNS packages that can do SRV updates correctly (and one of them is doubtful)? > -----Original Message----- > From: Eric Germann [mailto:ekgermann@cctec.com] > Sent: Thursday, January 25, 2001 6:00 PM > To: Roeland Meyer > Cc: 'nanog(a)merit.edu' > Subject: RE: Network diversity Software diversity > > > Uhh, I highly doubt they have a requirement to run DDNS on > the front ends. If all you're doing is serving up html pages > without user authentication, Win2K is perfectly happy with > its own internal account database. DDNS is a pre-req for AD, > but AD is not a requirment. In fact, I would probably strip > it off to save resources if all I was doing was pumping out > pages. Furthermore, why would you run DDNS to map names to > IP addresses for devices that should stay on static > addresses? DDNS is used in Win2K for resource location, such > as AD and the various role servers. None of those have any > use outside on the Internet > > (assuming of course they don't let you map a drive to their > web servers, which by the way you used to be able to do to > their FTP server many eons ago. I remember the fun of > copying their FTP site with XCOPY from a mapped drive to a > local drive with a 56K line [probably on both ends at the > time] in between). > > Reaching further back, I also remember NFS mounting the WUSTL > archive to our brand new RS/6K in the comp sci department. > Really drove home the idea of mounting NFS hard and the > transparency of the link when the tape filled up using our > 56K campus line over a weekend. Really pissed off the sys > admin also. :) Then again, thats when you had to be at least > 18 to get on the Internet ... > > Eric > > > At 09:30 AM 1/25/01 -0800, Roeland Meyer wrote: > > >> From: woods(a)weird.com [mailto:woods@weird.com] > >> Sent: Wednesday, January 24, 2001 9:47 PM > >> > >> [ On , January 24, 2001 at 17:19:29 (-0800), Sean Donelan wrote: ] > >> > Subject: Network diversity Software diversity > >> > > >> > Using FreeBSD and BIND on *ALL* your name servers may be just as > >> > bad a practice as using Windows 2000 and Microsoft DNS on *ALL* > >> > your name servers. I still think NSI is taking a tremendous risk > >> > using identical servers for all their GTLD-servers, even though > >> > they are geographically distributed. > >> > >> Yeah, I was going to mention that, but I thought I'd already been > >> preaching too much to the converted! :-) > > > >Unless another name server, besides BIND8p7, can do SRV > updates properly, I > >don't think it is possible to build that heterogenous > software environment, > >when Win2K Active Directory is involved. In fact, even BIND8 > has problems. > >It's only possible, with WinNT4, because WinNT4 doesn't have > [very] many > >silly requirements and can live with a standard name server. > > > >> > You might try using UltraDNS on half your critical > nameservers and > >> > BIND on the other half. And even using Solaris on some of the > >> > boxes and AIX or Linux, or NetBSD on the others. This is > not because > >> > I think one or the other has a fatal flaw, but because > software is > >> > a hard beast to manage. The idea behind diversity isn't you will > >> > never have an error. But the errors are unlikely to strike both > >> > servers at the same time. > >> > >> Therein lies the rub -- adding extra complexity to your > systems also > >> makes them more difficult to manage, prone to error, and subject to > >> interoperational problems. > >> > >> Diversity of all forms definitely has its advantages, but > it has its > >> costs too. The trick is to find a fair balance. :-) > > > >In this case, at this time, that is not possible under > Win2K. It's the MSFT > >way or the highway ... However, if you think about it, this > will definitely > >delay MANY Win2K Data Center migrations. > > > ============================================================== > ============ > Eric Germann Inacom > Info Systems > egermann(a)inacomlima.com Lima, OH 45801 > Ph: > 419 331 9050 > ICQ: 41927048 Fax: > 603 825 5893 > > "It is so easy to miss pretty trivial solutions to problems deemed > complicated. The goal of a scientist is to find an > interesting problem, > and live off it for a while. The goal of an engineer is to evade > interesting problems :)" -- Vadim Antonov <avg(a)kotovnik.com> on NANOG >

2 1

Re: From Microsoft's site
by Richard A. Steenbergen 26 Jan '01

26 Jan '01

Fri, Jan 26, 2001 at 01:14:34AM -0500, Greg A. Woods wrote: > > I haven't looked at how the routing advertisements for that /24 appear > out in the rest of the world, beyond what's registered at whois.ra.net, > but I doubt they've made separate advertisments for each IP# or some > subnets that would separate them, and even if they did I doubt such > advertisments coul even make it past the route filters of their peers. ... > So, how is it that ARIN let them get away with two entries for the same > damn server?!?!?!?!? Why do we continue to be so shocked by this? Do we really expect to find that microsoft has created an elaborate tunnel configuration and is really running 16 totally diverse highly redundant servers which are simply disguised as coming from a contiguous set of ips and a single router in traceroutes? Perhaps the real reason for their failure was a well planned attack based on knowledge purchased from corporate espionage which targetted key portions of their infrastructure in a massive DDoS effort? Much like the discussion of the clue of their network engineers, perhaps we need to stop looking for elaborate explanations and accept a more straight-forward and logical motivation. Incompetence, pure and simple. Have we ever seen anything good networking-related come out of MS yet? Why do we expect things to change now? Besides, if everyone knew what they were doing, the people with a clue would get paid a lot less. Sometimes a cigar is just a cigar. Can this thread please die now? Please? -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

From Microsoft's site
by Jeremy Randall 26 Jan '01

26 Jan '01

http://www.microsoft.com/info/siteaccess.htm "Microsoft Explains Site Access Issues On Tuesday evening and Wednesday, many Microsoft customers had difficulty accessing the company's Web sites. The cause has been determined, and the issue is resolved. At 6:30 p.m. Tuesday (PST), a Microsoft technician made a configuration change to the routers on the edge of Microsoft's Domain Name Server network. The DNS servers are used to connect domain names with numeric IP addresses (e.g. 207.46.230.219) of the various servers and networks that make up Microsoft's Web presence. The mistaken configuration change limited communication between DNS servers on the Internet and Microsoft's DNS servers. This limited communication caused many of Microsoft's sites to be unreachable (although they were actually still operational) to a large number of customers throughout last night and today. This was an operational error, and not the result of any issue with Microsoft or third-party products nor the security of our networks. Microsoft regrets any inconvenience caused to customers due to this issue. At approximately 5 p.m. Wednesday (PST), Microsoft removed the changes to the router configuration and immediately saw a massive improvement in the DNS network. All sites are currently available to customers. Again, Microsoft apologizes for the inconvenience."

5 4

traffic stats
by Ian A Finlay 26 Jan '01

26 Jan '01

Hello, So I've followed this list for about a year now and find it to be very interesting. It's great to be able to read what's on the minds of all the intelligent folks that frequent this list. The reason I am posting is because I have been following the Microsoft outage(s) over the last several days. I just noticed that several news sources are reporting that Microsoft has stated that the problems on Thursday have to do with being hit with a denial-of-service attack. I then ran across the following: http://west-boot.mfnx.net/traffic/sjc2/sjc2-sea-oc48.html Looks like a nice spike on Tuesday. Anyway, I thought that was kind of interesting. Hope this post wasn't a waste of text :-) -Ian Ian Finlay

2 1

Re: Monitoring highly redundant operations
by Howard C. Berkowitz 26 Jan '01

26 Jan '01

>On Wed, 24 Jan 2001, Simon Lockhart wrote: > >> >> Indeed. We currently monitor each part of our operation from a monitoring >> station on our network. Under certain conditions, this can give us both >> false positives and false negatives: >> >Umm... Keynote? >(http://www.keynote.com) > >I find it truly amazing that people don't already diversely >monitor. Hell, have cronned pings running off your friend's cable modem >if that's all you can afford, but for christ's sake, a single box colo'd >in someone else's cage, or a shell at shells.com or nether.net really >isn't that expensive. > > >Fighting the war against bad networks, > >Matthew Devney >Teamsphere Interactive Might be interesting to define a set of basic monitoring functions that independent ISPs can run on each other and share results. Early warnings could go to a special email. _________________________________ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to abuse(a)groupstudy.com

1 0

Estimated Time To Repair (was Re: History: lengthy outages)
by Sean Donelan 26 Jan '01

26 Jan '01

On Thu, 25 January 2001, Clayton Fiske wrote: > 1. I think it might be prudent to weed out the 2-5 hour outages here. > While that's still an excessively long time to recover a change that > should have been monitored and tested properly in the first place > (and still probably cause for firing in some shops), I can at least > conceive of it taking this amount of time. Too long, yes, but not > quite in the jaw-dropping category. I deliberately included them for a reason. Historically, when I look at a lot of network problems I notice an interesting coincidence. Outages involving "operator error" tended to take the longest time to fix, while outages involving equipment failure tend to be the shortest times. Complete hardware box failure (smoke makes debugging easy): 1 hour Power failure (utility, generator, etc): 3 hours External malicious attack (ddos, etc): 4 hours Fiber/Cable cut: 5 hours Electronic DCS failure: 18 hours Operator error: 1 business day (24-72 hours depending whether the operator made the change before leaving on a Friday night or a Tuesday night) Vendor software error: 2 business days (1 day to "escalate" the problem through customer channels, 1 day to actually get the fix, can take as long as 5 days if the problem happens after 3pm on Friday) Psychologists study why people have a difficult time recognizing their own mistakes. It is a very difficult problem. The problem is worse with "smart" people.

1 0