- Test - lists.nanog.org

Re: Lurking lawyers
by Sean Donelan 10 Jul '00

10 Jul '00

On Sat, 08 July 2000, Steve Sobol wrote: > Ok. Would it be more accurate to say that no attorneys or judges > actively participate in this group? All of the people I see posting > are techies. The Internet is still rather new. We're just now seeing the first generation of network operators who grew up wanting to be network operators. Almost all of us old foggies had other careers before stumbling into this Internet thing. Yes, there are people who are, or were, members of the bar actively participate on occasion. Some of my best friends are lawyers :-) But, unless you've paid for it, their opinions on this list aren't worth any more than anyone else's. Remember AGIS?

3 2

RE: LoadBalancing products: Foundry ServerIron
by Sutantyo, Danny 10 Jul '00

10 Jul '00

Someone from the maker of BIND company for DNS came here, and he told us that he's using OSPF to load balance the server, I don't know how he did it. Unless he's using the small routers to do it for servers. -----Original Message----- From: tony bourke [mailto:tony@vegan.net] Sent: Friday, July 07, 2000 9:12 AM To: Sutantyo, Danny Cc: lb-l(a)vegan.net; nanog(a)merit.edu Subject: RE: LoadBalancing products: Foundry ServerIron Hi Danny, I'm not sure what you mean. Are you talking about load balancing routers? Or load balancing output from load balancers? Tony On Fri, 7 Jul 2000, Sutantyo, Danny wrote: > > How about load balancing on the router? Any idea? I heard someone is using > ospf method to load balance? > > > -----Original Message----- > From: tony bourke [mailto:tony@vegan.net] > Sent: Friday, July 07, 2000 8:57 AM > To: Roeland M.J. Meyer > Cc: 'Sutantyo, Danny'; lb-l(a)vegan.net; nanog(a)merit.edu > Subject: RE: LoadBalancing products: Foundry ServerIron > > > True, thats why I don't particularly like LocalDirectors. Most of the > other load balancing solutions do offer GigE, however. I prefer LB over > clustering as it gives you more flexibility in what you use as far as your > platform. Microsoft's clustering software limits you to microsoft, while > I'm not sure if resonate will let you do both UNIX and Windows. > > The implementation is alot simpler as well, the LB is bascially acting as > a glorified router in most cases, so its a very logical and elegant > solutions. Clustering, at least in my experience, tends to be more > combersome and complex to setup. > > But that is just my humble opinion. > > LB vs Clustering sounds like a possible religeous debate ;) > > Tony > > On Fri, 7 Jul 2000, Roeland M.J. Meyer wrote: > > > > > Yeah, so why bother? As long as load balancers don't have GigE > > ports, I can't use them and have to use something like Resonate. > > Besides, LBs don't do site-site load balancing. If you want to do > > distributed load sharing then there really isn't much choice. > > Personally, I don't see benefits of LBs that proper clustering > > wont give you. Component clusters work well, much better than > > simple LB will give you. > > > > > From: tony bourke: Friday, July 07, 2000 8:01 AM > > > > > > you can do EtherChannel for more than 100 Mbps, but we all > > > know how well > > > that works. > > > > > > Tony > > > > > > On Fri, 7 Jul > > > 2000, Roeland M.J. Meyer wrote: > > > > > > > > > > > The last time I looked at one, I couldn't get it in > > > > GigE...100baseTX only. Ergo, I couldn't run it on my > > backbone. > > > > > > > > > Sutantyo, Danny: Thursday, July 06, 2000 8:37 AM > > > > > > > > > > How about Local Director? > > > > > > > > > > From: Richard Colella: Thursday, July 06, 2000 5:38 AM > > > > > > > > > > Products are also available from Alteon, Cisco (Distributed > > > > > Director) and Resonate. Last time I looked, none of these > > > > > products does everything one wants, IMHO, but the set union > > > > > of features comes pretty close. > > > > > > -------------- -- ---- ---- --- - - - - - -- - - - - - - > Tony Bourke tony(a)vegan.net > > > > -------------- -- ---- ---- --- - - - - - -- - - - - - - Tony Bourke tony(a)vegan.net

3 2

bad idea?
by Jeremiah Kristal 10 Jul '00

10 Jul '00

Given a small, globally routable netblock to be used for front-end web servers, and a strong aversion for using DNS for any type of load balancing, would it be reasonable to build two identical servers farms with the same public IP addresses and rely on the BGP sessions with the hosing providers to remove one advertisement in the event of a problem? I've been looking at ways to ensure that the webservers are always available, short of building a network connecting hosting facilities. Jeremiah being a customer stinks

12 16

Opinion on NSI's quasi-monopoly
by Steve Sobol 10 Jul '00

10 Jul '00

http://webdeveloper.com/refresh/refresh_070700.html -- North Shore Technologies, Cleveland, OH http://NorthShoreTechnologies.net Steve Sobol, BOFH - President, Chief Website Architect and Janitor Pictures of two of my 'children': http://www.WrinkleDogs.com About Spamfighters: "We're not net nazis. We're dot communists." - W. Arnold

1 0

routing troubles?
by Adam Korab 10 Jul '00

10 Jul '00

Does anybody know of anything going on in Kansas City? Both my UUnet and Sprint routes are simply dying there, and making parts of the network inaccessible to my customers. Thanks, --Adam -- Adam Korab System Administration Internet Nebraska (402) 434-8680 RFC 882 put the dot in .com, not Sun Microsystems

1 0

Re: ISP performance
by Sean Donelan 10 Jul '00

10 Jul '00

"Well-engineered" is a loaded term, and presumes unchanging routes are always the best way to engineer a network. With ATM, MPLS and other provider games the IP-level path may have very little to do with where your packets go. What you are looking for is the work done at MERIT and later the Skitter project at CAIDA. See www.caida.org for more infomation. On Mon, 10 July 2000, Rajesh Talpade wrote: > At the risk of making a possibly naive request, could > someone point me to data on ISP network performance > (routing stability, packet loss, latency) ? I am > primarily interested in the first metric, and am > trying to understand the relative stability of large, > _well-engineered_ ISP networks. In other words, with > what degree of confidence can I predict the IP-level > path between two PoPs of a large ISP. Please note > that I am not getting into the general Internet > performance here. > > Somehow I get this feeling that the answer would be > a fairly large...it depends ! It would be useful to > understand the influencing factors as well.

2 1

ISP performance
by Rajesh Talpade 10 Jul '00

10 Jul '00

Hi Folks At the risk of making a possibly naive request, could someone point me to data on ISP network performance (routing stability, packet loss, latency) ? I am primarily interested in the first metric, and am trying to understand the relative stability of large, _well-engineered_ ISP networks. In other words, with what degree of confidence can I predict the IP-level path between two PoPs of a large ISP. Please note that I am not getting into the general Internet performance here. Somehow I get this feeling that the answer would be a fairly large...it depends ! It would be useful to understand the influencing factors as well. Thanks. Rajesh. -- Rajesh R. Talpade rrt(a)research.telcordia.com 973 829-4261 Telcordia Technologies

1 0

CERT Advisory CA-2000-69
by jamie＠next.hway.net 10 Jul '00

10 Jul '00

CERT Advisory CA-2000-69 AIBO Authentication Algorithm Corruption Vulnerability Original Release Date: July 10, 2000 Last Revised: -- Source: CERT/CC A complete revision history is at the end of this file. Systems affected * AIBO ERS-110 Aperios OS * AIBO ERS-111 Aperios OS Overview A vulnerability involving the Visual authentication algorithm has recently been identified in the Sony, Inc. "AIBO" Entertainment Robot. Owners of AIBO Robots are encouraged to upgrade their Aperios DogOS soon as possible. The AttackBite() control has a serious vulnerability that allows remote intruders within earshot of AIBO to execute arbitrary code. Scripts are proliferating the Internet with new routines such as PeeOnRug(), ShoeChew(), KillTheCat() and AttackOwnersGenitals(). The latter, classified by CERT as a "Denial of Service" attack, is most vicious, and for this reason CERT encourages immediate patch implementation. Some common cicrumstances under which this vulnerability can be exploited are addressed by the Sony patch; others are not. I. Description There are at least three distinct vulnerabilities in the ERS-110 and ERS-111 implementation of the Aperios software. All of these vulnerabilities may be exploited to effect Quicker-Picker-Upper and Owner Discomfort attacks with varying degrees of severity. Owners are advised, until patch completion, to guard themselves, and to have extra paper towels on hand. - The AIBO Sound Controller, when configured to play Britney Spears' "Oops, I Did It Again," will cause AIBO to lift a hind leg and spontaneously leak battery juice on the floor, simulating a urination (female ERS-110 models "squat" during this exploit). - The buffer used to hold the variable MyOwner in the function process_face() can be overflowed, reverting AIBO into experimental AiboPitBull code. When combined with the Sound Controller's Performance Mode signal, unpatched AIBO units can receive arbitrary code, and multiple reports of owner emasculation have been reported. - (Unverified) Owners who accidentally have left their television on late at night have reported incidents of AIBO attacking their small children and pets within minutes of the airing of "Tom Vu's Real Estate Seminar," The Story of A Vietnamese Immigrant's rags-to-riches Infomercial. - Two reports have been submitted where a race condition involving Tom Vu's Real Estate Seminar and presence of Richard Simmons' "Farewell to Fat" have caused AIBO units to "die". We are still investigating this. II. Impact Depending on the version of AIBO, the environment in which it is running, and the particular vulnerability that is exploited, a remote attacker can cause one or more of the following: - The AIBO to attack its owner, - The AIBO to wake, walk off its base station and attack children/pets, - The AIBO to generate Cyber-Body-Fluid and/or Excretion, and/or - The AIBO to die. III. Solution Upgrade your version of AIBO Aperios DogOS If you are running vulnerable Aperios and cannot upgrade, you are strongly advised to remove the battery from AIBO's behind and contact Sony for more assistance. Appendix A. Vendor Information Sony, Inc. Please see http://www.world.sony.com/robot/aperios_vuln.htm Richard Simmons Please see http://www.richardsimmons.com/shop/info.idc?id=08-00164 _________________________________________________________________ The CERT Coordination Center thanks your Mom and Eva Peron for their help in developing this advisory. _________________________________________________________________ Author: Jamie Rishaw <jamie(a)arpa.com> _________________________________________________________________ This document is available from: http://arpa.com/advisories/CERT-2000-69.html _________________________________________________________________ (This is a spoof, if you haven't gotten it by now) _________________________________________________________________ CERT/CC Contact Information Email: cert(a)cert.org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A. CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryption We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from http://www.cert.org/CERT_PGP.key If you prefer to use DES, please call the CERT hotline for more information. Getting security information CERT publications and other security information are available from our web site http://www.cert.org/ To be added to our mailing list for advisories and bulletins, send email to cert-advisory-request(a)cert.org and include SUBSCRIBE your-email-address in the subject of your message. * "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office. * "CERT" and "CERT Coordination Center" had absolutely nothing to do with this advisory, and do not support it. It's a parody. NO WARRANTY Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement. _________________________________________________________________ Conditions for use, disclaimers, and sponsorship information Revision History July 10, 2000: Initial Release

1 0

Re: Lurking lawyers
by Robert Cannon 10 Jul '00

10 Jul '00

I lurk and occasionally participate.* *Disclaimer: Opinions expressed by said attorney do not reflect those of any rational person or his dog. This communication via the Internet does not constitute legal advice; no attorney client privilege has been established. Believe me, if this was legal advice, you would get a really really big bill. By reading this far you have consented to the proposition that said attorney's are in fact worth more than any one elses. Fromheretofore, you agree to pay said attorney $1 for each word read. Application of this provision is heretoandthereafter retroactive. Any technical flaws or misunderstandings in said attorneys opinions are the fault entirely of David Lesher. By "Internet," this disclaimer refers to 47 USC § 231(e)(3) and not 47 USC § 230(f)(1). Attorneys do not have "best friends" and none should be so misconstrued. -Robert Cannon Director Internet Telecom Project www.cybertelecom.org cannon(a)world.oberlin.edu Senior Counsel for Internet Issues FCC Office of Plans and Policy rcannon(a)fcc.gov PS: Do I have to say "It's a joke" PSS: If you are looking for listservs that discuss Internet legal issues I recommend cybertelecom-l (federal reg of the Internet with emphasis on the FCC) and cyberia-l (high volume on all Internet legal issues). Many here are there. ------Original Message------ From: Sean Donelan <sean(a)donelan.com> To: nanog(a)merit.edu Sent: July 9, 2000 1:20:55 AM GMT Subject: Re: Lurking lawyers On Sat, 08 July 2000, Steve Sobol wrote: > Ok. Would it be more accurate to say that no attorneys or judges > actively participate in this group? All of the people I see posting > are techies. Yes, there are people who are, or were, members of the bar actively participate on occasion. Some of my best friends are lawyers :-) But, unless you've paid for it, their opinions on this list aren't worth any more than anyone else's. ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup

1 0

RE: RBL-type BGP service for known rogue networks?
by Karyn Ulriksen 10 Jul '00

10 Jul '00

Shawn, I noticed that in BIND8, DNS gets _VERY_ unhappy if you use a CNAME for the zone's MX. Maybe there's something else at work.... Karyn -----Original Message----- From: Shawn McMahon [mailto:smcmahon@eiv.com] Sent: Monday, July 10, 2000 8:38 AM To: nanog(a)merit.edu Subject: Re: RBL-type BGP service for known rogue networks? On Mon, Jul 10, 2000 at 11:10:35AM -0400, Greg A. Woods wrote: > > However I should have listed the other requirement that I thought was > self-obvious since we're talking about SMTP here. I.e. I don't ever > accept e-mail from anything less than the most strictly conforming SMTP > implementations. You're violating part one of RFC 1123 section #5.2.5. > The name given by your SMTP server in the HELO "MUST" be a canonical > hostname. It must not be a CNAME. Oh, you wanna go there? 5.2.5 HELO Command: RFC-821 Section 3.5 The sender-SMTP MUST ensure that the <domain> parameter in a HELO command is a valid principal host domain name for the client host. As a result, the receiver-SMTP will not have to perform MX resolution on this name in order to validate the HELO parameter. The HELO receiver MAY verify that the HELO parameter really corresponds to the IP address of the sender. However, the receiver MUST NOT refuse to accept a message, even if the sender's HELO command fails verification. Hmm. MUST NOT refuse. Who's violating the RFC here, again? *ANYBODY* using sendmail from a dynamic IP is either going to do this, or worse. RFC 1123 requires you to live with it. If you choose not to, don't wave the damn RFC around like a magic shield. CNAMEs are "valid principal host domain name[s]". Nothing in the RFC says it can't be a CNAME, but something in the RFC says you have to accept it even if it's flat-out wrong or a lie. Your thin ice just cracked, Greg. Admit you're wrong and get on with your life. You're not running an RFC 1123-compliant mail setup at present.

4 3