- Test - lists.nanog.org

Hi, we're from the government and we're here to help
by Sean Donelan 15 Mar '00

15 Mar '00

Operational, only in the sense it disrupts our operations http://www.usatoday.com/life/cyber/tech/cth523.htm An interesting article which reviews some of the history and some perspective on the government response to the denial of service attacks. Unfortunately, its even worse. Before the FBI created the NIPC, the NTIA/Department of Commerce was tasked with Internet protection. I went to one of the meetings at DOC. It felt like a cold war contractor unemployment office. The NTIA eventually appointed three groups to represent the interests of the Internet in cyber-security. Anyone know/remember who those groups were? Earlier, the government created the Critical Infrastructure Assurance Office. Before that there was a commission, but the Internet wasn't really considered an "interesting" infrastructure at that time. The US Government as been amazingly pro-active in this area, or at least some small groups have been. They've also consistently said the government can't protect the Internet. The infrastructure is owned by private companies and individuals; and industry has to work together to protect it. The question is does industry think its worthwhile to work together? After several major disruptions received at lot of media attention, IOPS was formed. Later members like UUNET dropped out. After the DOS attacks, several providers announced their Gold Ribbon initiative. Have any providers actually taking concrete steps to change their networks? The IESG has a last call for a Best Common Practice on Internet security. Will any provider actually follow it? There is a barely used $50 million center in Washington we can probably buy real cheap if folks think we'll ever need an emergency response coordination center in the future.

7 12

Re: San Jose Telephone Problems 3/10-3/17
by Dan Bustillos - Datalink Computer Services 14 Mar '00

14 Mar '00

Sean/list, I was watching the news this morning re: This issue. A Pacbell spokesman was talking to a reporter and here is what he had to say ( My memory is a bit foggy) " Pac bell is also the victim here. We did not cause this. It was a private contractor that caused this ACCIDENT" At the point he said accident it sounded like he was getting ready to start yelling at the reporter. I just thought you all might find this funny.. Please no flames! PS: I am going to Vancouver BC on Thursday for a week. Anyone know anything fun to do in the area? Sean Donelan allegedly stated on 3/13/00 19:28: > >I'm sure this has absolutely nothing to do with me moving to >the San Jose area :-) > >On friday a contractor cut four major Pacific Bell cables. About >11,000 circuits were affected. The affected area is roughly bordered >by Interstate Highways 880 and 680 and Trimble and Berryessa roads. >Pacific Bell estimates it won't have the cables repaired until Friday >March 17. > >One cable I can understand. Two cables, ok you didn't realize the first >strange noise was a cable. Three cables, accidents come in threes. Four >cables? > > > Thank you, Dan Bustillos Datalink Computer Services (530) 897-6400 (888) 327-4638 ******************* "First rule of Government Spending: Why build one when you can build two at twice the price"

6 5

Re: Alternative to BGP-4 for multihoming?
by Gary E. Miller 14 Mar '00

14 Mar '00

Yo Joe! On Tue, 14 Mar 2000, Joe Loiacono wrote: > >Checking the path to my DNS servers tells you NOTHING about the > >path to my hosts. > > Right. But your situation is not the one being looked at, as you don't have > geograpically distributed web servers. But of course I DO (and that is a different question again... :-) > I believe for that situation 3DNS, > et. al., can work. Once the client's DNS request has worked its way over to > the primary DNS for the distributed web-servers, 3DNS has each of the other > 3DNS boxes (located adjacent to the other distributed servers) ping the > *clients* primary DNS. 3DNS then returns the URL for the web-server whose > 3DNS machine is 'closest' (fewest hops) to the clients DNS machine. Thus, > for example, clients in Asia can get to a server in Asia. > > I think that's the gist of it, if not the specifics... Let us take a client example. I manage a DNS with clients (users) in Singapore, California, New York and UK. DNS servers in Singapore and California and mirrored Web servers in Singapore in California. The DNS servers in Singapore do forward, and reverse for all zones in use (except ISP roaming) AND cacheing for ALL hosts in use. All hosts worldwide use our in house master DNS servers and not the local ISP servers. This allows the users to get DNS access for hostnames that are behind our firewalls on private addresses. It also allows inhouse tech support to more easily troubleshoot PCs remotely. I have seen this setup in use by many companies with firewalls. All laptops given to employees are shipped preset to use the 2 main corporate DNS servers for their DNS cacheing servers. Now let us say that a user (client) in UK connects to one of our corporate DNS cacheing server in Singapore or California. That DNS server connects to the 3DNS in New York. Now how does the 3DNS in New York decide the nearest web server to UK by checking DNS servers in California or Singapore? And I sure hope that HOP count is not used, Singapore has a mixture of very fast and very slow links to foreign countries so hop count is a useless measure of "closeness". Now it gets worse. Our users in Singapore take their laptops home but still use the DNS cacheing from the office servers. At home they are on a local ISP network that connects to the US by a very different path! Some ISPs in Singapore connect directly from Singapore to LA, some directly to Palo Alto and some to Japan and then Seattle. When our user goes home all that changes about his configuration is his IP address and reverse DNS. But his connectivity to the US is totally changed. Some ISPs connect directly to Malaysia and some need to go to LA and back. Picking the server based on DNS could add a second of extra round trip time! I have a few other clients with totally different configurations that also break the 3DNS, but that is another discussion... RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 20340 Empire Ave, Suite E-3, Bend, OR 97701 gem(a)rellim.com Tel:+1(541)382-8588 Fax: +1(541)382-8676

1 0

Re: Alternative to BGP-4 for multihoming?
by Patrick Evans 14 Mar '00

14 Mar '00

On Tue, 14 Mar 2000, Pete Templin wrote: > On Tue, 14 Mar 2000, Marc Slemko wrote: > > > Saying "the clients's primary DNS" is misleading. There is no way to know > > what the "primary" DNS server is for a zone, and there may not even be > > what is typically known as a primary. > > What if it's a UUNet resold modem to a client of iAmerica - what server > gets used then? We know that UUNet's DNS servers are likely to not be > located close (in net terms) to the client, and how do we know what DNS > servers are being assigned to the client? > User's machine contacts caching nameserver x to do a lookup. Nameserver x contacts authoritative nameserver y, which then works out where x is before returning an RR that's good for wherever x is. If n isn't net.near to the user's machine, then something's a bit weird. If part of a dialup ISP's internal network falls over, you hardly want every single user's resolvers to fail! > Or what if my clients get assigned dns servers in 192.168.254/24? Sounds > to me like it's not a valid geographic identifier. > I'd hope that nameserver would talk to the world with a real source address, which y would then use to do a proximity test, rather than a 1918 address - at least it should if it actually wants to get a response. What address the client-side interface uses is neither here nor there. -- Patrick Evans - Sysadmin, bran addict and couch potato pre at pre dot org www.pre.org/pre

1 0

Re: Alternative to BGP-4 for multihoming?
by Randy Bush 14 Mar '00

14 Mar '00

> Once the client's DNS request has worked its way over to the primary DNS > for the distributed web-servers, 3DNS has each of the other 3DNS boxes > (located adjacent to the other distributed servers) ping the *clients* > primary DNS. 3DNS then returns the URL for the web-server whose 3DNS > machine is 'closest' (fewest hops) to the clients DNS machine. you may want to seriously reread the previous sender's message. the point is that in the modern post-2182 world, many of the client's nameservers are vastly net.distant from the client. psg.com nameserver = DNS.LIBRARY.UCLA.EDU psg.com nameserver = RAIN.PSG.COM psg.com nameserver = ARIZONA.EDU it is best common practice. randy

3 2

Re: Alternative to BGP-4 for multihoming?
by brandon＠rd.bbc.co.uk 14 Mar '00

14 Mar '00

> you may want to seriously reread the previous sender's message. the point > is that in the modern post-2182 world, many of the client's nameservers are > vastly net.distant from the client. > > psg.com nameserver = DNS.LIBRARY.UCLA.EDU > psg.com nameserver = RAIN.PSG.COM > psg.com nameserver = ARIZONA.EDU sure but which one are they most likely to be using for their resolver (in firewalled environments it may be none of those)? Lots will use one fairly local to them for resolution and that could be the one making the request of the hosting providors server (assumptions about which ones would recurse etc.). There will always be a few that use one a continent away but nobody is expecting 100% on this are they? brandon

3 2

Re: Alternative to BGP-4 for multihoming?
by Joe Loiacono 14 Mar '00

14 Mar '00

> >Checking the path to my DNS servers tells you NOTHING about the >path to my hosts. Right. But your situation is not the one being looked at, as you don't have geograpically distributed web servers. I believe for that situation 3DNS, et. al., can work. Once the client's DNS request has worked its way over to the primary DNS for the distributed web-servers, 3DNS has each of the other 3DNS boxes (located adjacent to the other distributed servers) ping the *clients* primary DNS. 3DNS then returns the URL for the web-server whose 3DNS machine is 'closest' (fewest hops) to the clients DNS machine. Thus, for example, clients in Asia can get to a server in Asia. I think that's the gist of it, if not the specifics... Joe Joe Loiacono Phone: (301) 794-2509 Computer Sciences Corporation Fax: (301) 794-9480

1 0

Re: "Stale" root-server
by Paul Vixie 14 Mar '00

14 Mar '00

> Are there standards for operations of a root DNS server? Yes. RFC 2010 was written by two root name server operators. Another document, with broader authorship, is due to replace it soon. > I would think that checking and making sure that your zone files are > current would be either something you could do once a day or at the > minimum write a script to check the serial against the current date and > start yelping if it was too far out of date. That's not in RFC 2010, but it is something that NetSol does, and notifies the operator of any machine who falls behind in the way G currently has. (This is only fair, since NetSol's internet connectivity has been historically weak, and the usual cause of a root server being behind is that NetSol didn't have enough bandwidth to ship COM that day on top of everything else it does.) -- Paul Vixie <vixie(a)mibh.net> SVP for Internet Services, MFNX M.I.B.H. Inc. is a subsidiary of Metromedia Fiber Network, Inc.

1 0

"Stale" root-server
by Forrest W. Christian 14 Mar '00

14 Mar '00

I just came across the fact that one of the root servers (G) has a stale .com zone. (Serial number from 3/10). Of course, my primary DNS server seems to prefer G (or any other root server with a problem for that matter). I did call the number for the NOC listed and let's just say that although they said that "the responsible person would be notified" I got the impression that fixing the problem wasn't going to be on the top of their list and probably was going to wait till the next business day. I also was told that "They got a call like this friday" (which was the last day the data was synched. Are there standards for operations of a root DNS server? I would think that checking and making sure that your zone files are current would be either something you could do once a day or at the minimum write a script to check the serial against the current date and start yelping if it was too far out of date. If I was responsible for a root server, making sure it was up with the "correct" (quotes added thanks to our favorite registry/ies) data would be my top priority. - Forrest W. Christian (forrestc(a)imach.com) KD7EHZ ---------------------------------------------------------------------- iMach, Ltd., P.O. Box 5749, Helena, MT 59604 http://www.imach.com Solutions for your high-tech problems. (406)-442-6648 ----------------------------------------------------------------------

2 1

Filtering policies
by Timothy Brown 14 Mar '00

14 Mar '00

I apologize in advance if this subject has been regurgitated. I would imagine it has, but a quick search of NANOG archives reveals nothing. What is the "party line" among providers as regards to BGP route filtering? I have a customer with a /24 (grandfathered) who now seeks to multi-home. Is their /24 globally routable? There's no way they can justify anything less specific than a /22. Are there any other solutions? Regards, Tim -- Timothy | tim (at) tux (dot) org | 4FE3 6D8E 5F7A 61E9 27B9 | NSP/ISP/ASP Brown | Encrypted Mail Preferred | 9220 B6E5 F181 4A94 11C3 | Engineer

3 2