- Test - lists.nanog.org

NYT on Internet traffic reporting
by Sean Donelan 21 Feb '00

21 Feb '00

The New York Times has an article about Internet traffic reporting today. http://www.nytimes.com/library/tech/00/02/biztech/articles/21view.html

1 0

SMTP in distributed DOS
by Dirk Harms-Merbitz 20 Feb '00

20 Feb '00

SMTP bounces can be used in yet another form of Denial Of Service attack. Just imagine what happens when some script kiddie uses a few ten thousand trojaned cable/dsl connected home computers to send email to tens of thousands of domains and they all bounce back to your mail server! Why don't we all just turn SMTP bounces OFF? Like return-receipts, the information content in bounces is very low. A database would be much more efficient if you just want to know wether an email address is spelled correctly. Resending the entire message after adding a few hundred bytes is just idiotic. Escpecially if the attacker only has to send one message to generate 100 bounces. We are currently seeing this first hand: Our real mail.power.net is at 207.151.19.8. The attacker is sending individualized emails with faked headers that contain "mail.power.net (unverified [209.26.14.22])". The recipient computers are dumb enough to send their bounces to the real mail.power.net. This is a DOS because the innocent mail server a) gets millions of bounces and b) might get black listed on various "anti-spam" lists. Dirk Received: from mail.power.net (unverified [209.26.14.22]) by mee.yjapt.co.kr (EMWAC SMTPRS 0.83) with SMTP id <B0000119229(a)mee.yjapt.co.kr>; Mon, 21 Feb 2000 01:20:18 +0900 Message-ID: <12PAIZTiA2Vyp.5wFyFudzDR_N8(a)mail.power.net> From: FinancialJobs70972(a)power.net <FinancialJobs70972(a)power.net> Bcc: Subject: Private Consultants Needed for Venture Capital Firm Date: Mon, 30 Mar 1998 10:04:48 -0400 (EDT)

5 6

whois-servers.net
by William Allen Simpson 20 Feb '00

20 Feb '00

Acting on an old memory, I found that Rodney Joffe already registered whois-servers.net last year. Can this be leveraged to build the needed distributed whois network? I guess I've just become lazy and use geektools whois web page, because it finds the right whois server for me. We should have built the redundant server network long ago. WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

1 0

Re: whois broke again?
by Sean Donelan 20 Feb '00

20 Feb '00

On Sat, 19 February 2000, Alex Rubenstein wrote: > But, more to the point; I was commenting more on the fact that NSI [has > not|probably will not] comment(ed) on any of said outages, not even a > post-mortem, in any fashion. Unfortunately in today's environment, many companies don't want to admit to problems even to their own customers. If you look at the denial of service attacks, almost all the victims were identified first by Keynote press releases to Businesswire before the companies made any statements to their own customers or the public. I've been asked by several different publications if I would send outage reports directly to them. NANOG's off-topic volume is actually a fairly good defense mechanism, since reporters and assignment desks don't want to read through all the stuff either. The intent has always been to give other network operators a head's up about common problems, not generate press coverage. Waiting for each network provider to notice, debug, and contact the source of the problem is one method. In addition to notifying the source, telling your neighbors could save them a lot of time and effort. Next time it might be you they save. Even when a Yahoo! engineer sent a message to a supposedly private list, the Associated Press obtained a copy and reported it. There is a supposedly private list between banks which received a "warning" four days before the first attack. It was also reported extensively by the press. So if private lists don't work, and public lists don't work, what's the alternative? Although jhawk will probably think its off-topic, BBN has one of the best customer notification systems in the business. BBN (or is it still GTEI) is a well-run network, but they occasionally have problems. Sometimes even major problems. But you don't see the "what's going on" and unhappy customer messages as much any more, compared to the Stanford rat incident or other providers today. Its strange how most of the executives came out the White House meeting saying the solution was "Cooperation."

4 3

Funk *that* (was Re: whois broke again?)
by Leonard, Jason M. 20 Feb '00

20 Feb '00

How hard could it be to maintain a mirror or something close to a mirror? I'm willing to donate a box and a few hours a week. Email me off list with your input and I'll post the results. -Jason > In the meantime, the members of NANOG have to keep the Net working in spite > of NSI foulups. Figure out how to live with NSI or figure out how to work > around NSI. But don't bitch about NSI in this forum because it won't do any > good. The sooner everyone accepts this reality, the better off everyone > will be. > > That's the bottom line, plain and simple.

3 2

Re: whois broke again?
by Danny McPherson 20 Feb '00

20 Feb '00

> While it would probably not be an accurate assessment, it could be assumed > that they are doing nothing at all to fix problems ever; how would we > know? Considering that we (as in ISP's) are the primary source of thier > income, don't they owe this information to us, at least in a watered-down > version? Absolutely, unless assumming "us" == NANOG. But that's between each NSI customer and NSI, not NANOG and NSI. And as an NSI customer, once escalated to this level, it's something that I'd address directly and formally with those NSI folks, the ones that have that ve$ted interest in the success of NSI. I assure you that if you're able to demonstrate that all reasonable steps have been taken to follow the formal trouble reporting process, but to no avail, they'll be interested. and if not, well, sufficient documentation would then be in place to more formally address the problem. -danny

3 2

Re: whois broke again?
by Danny McPherson 20 Feb '00

20 Feb '00

> A) Do you happen to have proof that people *arent* reporting the > problems to NSI as well as posting here? I'd guess he doesn't, though yet another glean of the entire thread also doesn't reveal anything suggesting that an attempt to contact, or even a simple cc NSI has occurred to this point. Perhaps denoting a failed attempt in the initial post would have made sense. I assure you that the NSI folks are indeed concerned with the accuracy and availability of the services they provide, especially considering they've a ve$ted interest in the integrity of their services, as somewhat mis-representedly pointed out a few messages back. Assuredly, the folks that have the most at stake to this regard are also the most concerned with their performance, and are the ones in a position to make things happen. However, while NANOG posts are amazingly very far-reaching, I doubt these folks read NANOG directly, and I especially doubt they'll be posting here any time soon. Given, seemingly with every service-oriented provider on the Internet, they have their share of problems, but, as with most service providers, they must be made aware of the problem(s) before they can correct them .. and IMO, NANOG isn't the appropriate _initial step towards making folks aware of a problem. I'd also guess that the solution(s) to these problems reside a bit beyond a spare server and a couple of hours, though I'd not be overly surprised if the solution was trivial. > B) Considering how important NSI has been to keeping the net > going, I'm surprised we haven't seen a CNN soundbite of Wolf Blitzer > standing in front of NSI's corporate headquarters, talking about > NSI executives preparing to explain to a Congressional subcommittee > exactly why there are so many problems... Between this and VoIP, I'm sure someone will be testifying soon :-) > A few days ago a total of 13 sites got DOS'ed, for an average of > a few hours each, and that got MAJOR press coverage. It's surprising > there wasn't a similar fuss the time that 30% of the .com's were > dropped on the floor due to a undetected disk-full condition, and > sites were having sporadic problems for several DAYS till all the DNS > caches timed out, or the time a few days later there was ANOTHER > problem, or the time..... > > Let's face it guys, taken on the "number of sites times outage time" > basis, NSI operational issues have screwed a *LOT* more of the 4 > million .COM's out there than trin00 has.... Though far less visible, and less interesting to the folks looking for a story. -danny

2 1

RE: Funk *that* (was Re: whois broke again?)
by Leonard, Jason M. 20 Feb '00

20 Feb '00

Understood, that's why I'm looking for input. I'd like to come up with a reliable system, even though it's necessarily going to be a hair or two behind the 'live' databases. -----Original Message----- From: Valdis.Kletnieks(a)vt.edu To: Leonard, Jason M. Cc: 'nanog(a)merit.edu' Sent: 2/20/00 1:41 AM Subject: Re: Funk *that* (was Re: whois broke again?) On Sun, 20 Feb 2000 01:32:35 EST, "Leonard, Jason M." <Jason.Leonard(a)wcom.net> said: > How hard could it be to maintain a mirror or something close to a mirror? > I'm willing to donate a box and a few hours a week. Email me off list with > your input and I'll post the results. A mirror would help if the primary server was unreachable. The problem being reported NOW is the spewage of data that claims to be correct. Unless you run your mirror in a "pull, wait 8 hours for verification, and THEN commit" mode, the mirror will be spewing the same broken data. Valdis Kletnieks Operating Systems Analyst Virginia Tech

1 0

Re: whois broke again?
by Bohdan Tashchuk 20 Feb '00

20 Feb '00

> Whats amazing to me is that there is not one peep from NSI about this, no > news service picked up on it, and it will go unnoticed, in general. > Isn't it amazing that a company as significant on the 'net as NSI can have > such repetitive, continual database problems, and no one cares? It's even worse than that. NSI just sold approx $500 million of new stock. SAIC just sold $1.6 billion of their stock in NSI. If the market continually rewards NSI so richly despite continuing problems, why should they get better? Why should they care about little things like broken databases? After all, it could conceivably cost them upwards of 1% of their newly acquired cash to fix the problems. There is an operational point in the above and here it is: There is no incentive at all for NSI to do any better. They don't care. They don't have to. They're a rich monopoly. Maybe they will improve, and maybe they won't. In the meantime, the members of NANOG have to keep the Net working in spite of NSI foulups. Figure out how to live with NSI or figure out how to work around NSI. But don't bitch about NSI in this forum because it won't do any good. The sooner everyone accepts this reality, the better off everyone will be. That's the bottom line, plain and simple.

1 0

NSI/Whois broke, for the 2093802nd time
by Alex Rubenstein 19 Feb '00

19 Feb '00

[root@netflow local]# whois -h whois.networksolutions.com nac.net The Data in Network Solutions' WHOIS database is provided by Network Solutions for information purposes, and to assist persons in obtaining information about or related to a domain name registration record. Network Solutions does not guarantee its accuracy. By submitting a WHOIS query, you agree that you will use this Data only for lawful purposes and that, under no circumstances will you use this Data to: (1) allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via e-mail (spam); or (2) enable high volume, automated, electronic processes that apply to Network Solutions (or its systems). Network Solutions reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy. [No name] (MM2425 ) ORG [root@netflow local]# whois -h whois.networksolutions.com yahoo.com The Data in Network Solutions' WHOIS database is provided by Network Solutions for information purposes, and to assist persons in obtaining information about or related to a domain name registration record. Network Solutions does not guarantee its accuracy. By submitting a WHOIS query, you agree that you will use this Data only for lawful purposes and that, under no circumstances will you use this Data to: (1) allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via e-mail (spam); or (2) enable high volume, automated, electronic processes that apply to Network Solutions (or its systems). Network Solutions reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy. [No name] (ID?) Is it really that hard to operate a domain registry!? They've only been doing it for about 10 years..

2 1