- Test - lists.nanog.org

RR.COM has backbone problems
by Vadim Antonov 07 Feb '00

07 Feb '00

I tried to contact their NOC, but the bozo on call didn't even want to hear what the problem is, advising me to contact my cable provider (how helpful). Please if there's anyone with a clue from RR.COM / MEDIAONE.NET or any other Time Warner holding - wake up, you've got a big problem. It doesn't show on your network monitors, but it is sure to screw your customers. And, please track down who was on the NOC telephone ((703) 345-3416) at this time (see message headers) and kick him hard for being an idiot and not taking a real trouble report. It appears that somehow long packets between boxes 24.218.189.197 and 24.218.188.118 get corrupted: kitty 67: ping -s1500 24.218.188.118 PING 24.218.188.118 (24.218.188.118): 1500 data bytes 1508 bytes from 24.218.188.118: icmp_seq=0 ttl=246 time=164.0 ms wrong data byte #1404 should be 0x7c but was 0xaa 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 <skipped> 1508 bytes from 24.218.188.118: icmp_seq=1 ttl=246 time=164.6 ms 1508 bytes from 24.218.188.118: icmp_seq=2 ttl=246 time=166.1 ms 1508 bytes from 24.218.188.118: icmp_seq=3 ttl=246 time=164.7 ms 1508 bytes from 24.218.188.118: icmp_seq=5 ttl=246 time=164.3 ms 1508 bytes from 24.218.188.118: icmp_seq=6 ttl=246 time=168.6 ms wrong data byte #1404 should be 0x7c but was 0xaa 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 <skipped> 1508 bytes from 24.218.188.118: icmp_seq=7 ttl=246 time=163.9 ms wrong data byte #924 should be 0x9c but was 0xaa 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 <skipped> kitty 70: ping -s1500 24.218.189.197 PING 24.218.189.197 (24.218.189.197): 1500 data bytes 1508 bytes from 24.218.189.197: icmp_seq=0 ttl=248 time=144.3 ms 1508 bytes from 24.218.189.197: icmp_seq=1 ttl=248 time=83.2 ms 1508 bytes from 24.218.189.197: icmp_seq=2 ttl=248 time=82.4 ms 1508 bytes from 24.218.189.197: icmp_seq=3 ttl=248 time=80.8 ms 1508 bytes from 24.218.189.197: icmp_seq=4 ttl=248 time=80.9 ms kitty 72: /usr/sbin/traceroute 24.218.189.170 traceroute: Warning: Multiple interfaces found; using 205.158.141.97 @ eth0 traceroute to 24.218.188.118 (24.218.188.118), 30 hops max, 40 byte packets 1 192.168.203.1 (192.168.203.1) 19.680 ms 19.540 ms 19.521 ms 2 mpk.core.rtr.wavepath.net (205.158.140.129) 19.825 ms 19.699 ms 21.328 ms 3 pop.access.rtr.wavepath.net (205.158.140.249) 21.097 ms 21.252 ms 21.030 ms 4 pop.border.rtr.wavepath.net (205.158.140.1) 21.204 ms 21.146 ms 23.449 ms 5 us-ca-scl-web1-e8.rtr.concentric.net (205.158.7.97) 22.883 ms 21.793 ms 22.879 ms 6 us-ca-scl-border2-fe4-0d0.rtr.concentric.net (207.88.95.9) 24.269 ms 101.210 ms 23.812 ms 7 us-ca-scl-core2-g5-0-0.rtr.concentric.net (207.88.1.3) 23.506 ms 24.663 ms 22.793 ms 8 PacBellrr.com (198.32.128.50) 23.761 ms 25.667 ms 26.280 ms 9 pabrt02-pabrt03.rr.com (24.218.189.197) 26.108 ms 57.919 ms 24.778 ms 10 24.218.188.118 (24.218.188.118) 110.427 ms * 116.969 ms 11 bsgsr01-nygsr01.rr.com (24.218.188.21) 116.396 ms 115.738 ms 116.053 ms 12 cambrt01-bsgsr01.rr.com (24.128.191.58) 113.668 ms 114.166 ms 115.836 ms 13 cmrtr01-srp3.ne.mediaone.net (24.218.189.170) 113.589 ms 114.720 ms 113.175 ms (Note that the problem affects all _transit_ packets): kitty 78: ping -s1500 24.218.188.21 PING 24.218.188.21 (24.218.188.21): 1500 data bytes 1508 bytes from 24.218.188.21: icmp_seq=1 ttl=245 time=525.0 ms 1508 bytes from 24.218.188.21: icmp_seq=2 ttl=245 time=171.2 ms 1508 bytes from 24.218.188.21: icmp_seq=3 ttl=245 time=173.8 ms 1508 bytes from 24.218.188.21: icmp_seq=4 ttl=245 time=174.3 ms wrong data byte #1404 should be 0x7c but was 0xaa 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 <skipped> Regards, --vadim

4 4

Re: DNS problem at NANOG18
by Michael Shields 07 Feb '00

07 Feb '00

In article <4.2.2.20000207125404.02969100(a)ianai.net>, I Am Not An Isp <patrick(a)ianai.net> wrote: > There do not seem to be even reverses for the wireless IPs. The nameserver the DHCP server is handing out knows about the reverses somehow, but the in-addr delegation chain is broken. And there are no forwards. -- Shields.

2 1

Simple? Question...
by NANOG Mailing List 07 Feb '00

07 Feb '00

Can someone please tell me what I need to do in order to have secondary interfaces on a Cisco report themselfs as the alias IP rather than the primary interface IP address in a traceroute? Example: FastEthernet 1/0/1 has a primary address of 10.1.1.1 It has a secondary address of 172.16.1.1 In a traceroute, where it would be expected that the box report itself as 172.16.1.1, it is reporting itself as 10.1.1.1 Is there a way to remedy this situation and have it report itself as the IP address that is actually being used for that flow?

2 1

DNS problem at NANOG18
by takei＠csm.jcsat.co.jp 07 Feb '00

07 Feb '00

Can someone setup DNS lookup dabase for DHCP address pool in NANOG18? Currently, I can get right DNS reverse look up, but normal DNS lookup looks like has not been setup. My server refuse connection, because they can get hostname from DNS but cannot resolve IP address from DNS. Thank you. --- Jun Takei NTT Satellite Communications Inc. Japan Satellite Systems Inc. Tokyo Japan

3 2

Audio Quality
by David Brouda 07 Feb '00

07 Feb '00

Is it just me, or is the audio in the real stream corrupt? Also, the audio in the H.261 stream is a bit distorted. Perhaps the input level to the machine generating the stream need to be turned down? -David

1 0

An addition...
by Paul Ferguson 07 Feb '00

07 Feb '00

An additional resource for stuff in Steve Bellovin's talk: http://users.quadrunner.com/chuegen/smurf.cgi - paul

1 0

Re: www.netscape.com
by Dirk Harms-Merbitz 06 Feb '00

06 Feb '00

Guess there are bugs in that technology then. My name server was 207.151.19.6. Dirk On Sat, Feb 05, 2000 at 10:44:21PM -0800, Nicholas W. Blasgen wrote: > It just uses the same DNS technology as Yahoo and others. > > nick:~# dig www.netscape.com > > ;; ANSWER SECTION: > www.netscape.com. 15M IN CNAME vwww-va2.netscape.com. > > > The DNS server will check the IP address of the name server which you use > and find the nearest location it can find for that IP address. In your case > you might be using a DNS server that is in another country, or the other > sites were getting so many hits that it decided AU was the fastest. > > > > > Netscape is feeding web from Australia? Can this be? > > > > [dirk@noc dirk]$ dig www.netscape.com > > > > ; <<>> DiG 8.1 <<>> www.netscape.com > > ;; res options: init recurs defnam dnsrch > > ;; got answer: > > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6 > > ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 4, ADDITIONAL: 4 > > ;; QUERY SECTION: > > ;; www.netscape.com, type = A, class = IN > > > > ;; ANSWER SECTION: > > www.netscape.com. 13m59s IN CNAME wwwld-au.netscape.com. > > wwwld-au.netscape.com. 58m59s IN A 203.89.225.69 >

2 1

Reminder: BOF on Distributed DoS, San Jose 2/7/00
by David Kennedy CISSP 06 Feb '00

06 Feb '00

The purpose of this message is to solicit participation in birds of a feather (BOF) session to discuss the Distributed Denial of Service (DDOS) problem. WHO: Everyone interested in aggressively addressing a category of attack threatening Internet-connected systems. WHAT: We (ICSA.net ) are have put together at least two BOF's to discuss DDOS attacks in the trin00, TFN, TNF2K, stacheldraht...family. WHEN & WHERE: The next BOF session will be Monday, February 7, 2000 from 7 to 9 pm at Doubletree Hotel San Jose, 2050 Gateway Place, San Jose, CA - phone 408-453-4000 (conference hotel). Refreshments will be served. This BOF session coincides with the North American Network Operators Group (NANOG) conference and a meeting of ICSA's ISPSec Consortium, but the BOF is open to all interested parties. WHY: The goals are two-fold initially, awareness of the problem and see if the collection of smarts at a BOF can suggest effective ways of dealing with these attacks other than "hoping" the clue-challenged secure their systems before the trojans are installed. relevant URL's: http://www.icsa.net/html/communities/ispsec/ http://www.nanog.org/mtg-0002/ http://www.washington.edu/People/dad/ http://www.ietf.org/internet-drafts/draft-moskowitz-hip-01.txt http://www.ietf.org/internet-drafts/draft-moskowitz-hip-enc-00.txt http://www.ietf.org/internet-drafts/draft-moskowitz-hip-dns-00.txt http://www.ietf.org/internet-drafts/draft-moskowitz-hip-arch-01.txt Tentative Agenda: Introduction: The Problem: Technical Review of Attack tools Trends/ Implications/ Characteristics Possible Mitigations: Scanning for Master / Slaves ISP Egress /Ingress Filtering Potential Protocol Changes HIP Open discussion Next Steps Noteworthy Participants: Dave Dittrich Bob Moskowitz -- Regards, Dave Kennedy CISSP Director of Research Services, ICSA.net http://www.icsa.net Protect what you connect. Look both ways before crossing the Net.

1 0

junk fax
by Randy Bush 06 Feb '00

06 Feb '00

to where does one submit formal complaints of junk fax?

6 5

www.netscape.com
by Dirk Harms-Merbitz 06 Feb '00

06 Feb '00

Netscape is feeding web from Australia? Can this be? [dirk@noc dirk]$ dig www.netscape.com ; <<>> DiG 8.1 <<>> www.netscape.com ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 4, ADDITIONAL: 4 ;; QUERY SECTION: ;; www.netscape.com, type = A, class = IN ;; ANSWER SECTION: www.netscape.com. 13m59s IN CNAME wwwld-au.netscape.com. wwwld-au.netscape.com. 58m59s IN A 203.89.225.69 ;; AUTHORITY SECTION: netscape.com. 1d23h6m43s IN NS NS.CW.NET. netscape.com. 1d23h6m43s IN NS NS.netscape.com. netscape.com. 1d23h6m43s IN NS NS-ME1.netscape.com. netscape.com. 1d23h6m43s IN NS NS2.netscape.com. ;; ADDITIONAL SECTION: NS.CW.NET. 1d23h53m5s IN A 204.70.128.1 NS.netscape.com. 1d23h6m43s IN A 198.95.251.10 NS-ME1.netscape.com. 59m8s IN A 205.188.247.65 NS2.netscape.com. 1d23h6m43s IN A 207.200.73.80 ;; Total query time: 2 msec ;; FROM: noc.power.net to SERVER: default -- 127.0.0.1 ;; WHEN: Sat Feb 5 18:11:14 2000 ;; MSG SIZE sent: 34 rcvd: 228 Dirk

2 1