- Test - lists.nanog.org

We're the phone company, we don't need route diversity
by Sean Donelan 05 Jul '99

05 Jul '99

nathan(a)robotics.NET (Nathan Stratton) writes: >To make things worse, many of the new CLECs don't have adiquite trunking >to the 911 tandems or PSAPs. Many of my CLEC customers try to only run the >minimum number or channels to get approved. Most of them also run all of >the 911 over the same circuit or if they have more then one, out of the >same MUX. In the Topeka, Kansas SWBT failure, one of the CLECs did issue a press release pointing out their network was not affected by the software problems on SWBT's telco switch. http://biz.yahoo.com/prnews/990702/ks_kmc_tel_1.html There are a lot of CLECs with very poor procedures and preparedness, and 9-1-1 trunks have interesting issues due to their very high visibility and requirements. Most CLECs rely 100% on the ILEC to provide 9-1-1 tandem services. But don't assume the ILECs are as good as they like to imply. For example, I posted about a Southwestern Bell outage on May 27 in central Missouri on NANOG earlier. SWBT filed their Final Outage Report with the FCC last week. A fiber cut near Lake St. Louis on the main I-70 cross-state highway took out operator, inter-switch, long-distance (inter and intra lata) service for 21 Central Offices and 13 9-1-1 answering points affecting 205,000 customers for 5 hours. SWBT's analysis indicates the root cause for the outage was a contractor laying new fiber for another carrier, damaging SWBT's fiber. However, it turns out SWBT has *ZERO* route diversity for this 300 mile route in their network. SWBT has no plans on adding diversity on this route by either installing new cable, or swapping or leasing space on a different carrier's system. As a customer of SWBT, just try to find out about these 'minor' challenges in SWBT's network. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: (ICANN) STATEMENT ON HACKING OF NETWORK SOLUTIONS' SERVERS
by J.D. Falk 04 Jul '99

04 Jul '99

On 07/04/99, Randy Bush <randy(a)psg.com> wrote: > <plonk> You know, it pisses me off to no end that it's not currently possible to disagree with how ICANN is trying to run things without being lumped in with the kooks. If anybody has any suggestions for a change in tactics, please let me know. And again, if you'd like to see what I /do/ have reasons for these views other than unreasoning paranoia, please contact me off-list. ---------========== J.D. Falk <jdfalk(a)cybernothing.org> =========--------- | "It's hard to keep your head above water | | when you're up to your ass in alligators." | | --Crow T. Robot, MST3K "Swamp Diamonds" | ----========== http://www.cybernothing.org/jdfalk/home.html ==========----

1 0

(ICANN) STATEMENT ON HACKING OF NETWORK SOLUTIONS' SERVERS
by David Alejandro Hernandez Alonso 04 Jul '99

04 Jul '99

fyi http://www.icann.org/icann-pr02july99.htm ICANN PRESS RELEASE (7-2-99): INTERNET CORPORATION FOR ASSIGNED NAMES AND NUMBERS (ICANN) STATEMENT ON HACKING OF NETWORK SOLUTIONS' SERVERS FOR IMMEDIATE RELEASE INTERNET CORPORATION FOR ASSIGNED NAMES AND NUMBERS (ICANN) STATEMENT ON HACKING OF NETWORK SOLUTIONS' SERVERS Marina Del Rey, CA (July 2, 1999) - For several hours earlier today, access to the server which hosts the ICANN Web site was disrupted. The information on ICANN's Web site is administrative in nature and was not damaged. We have since been made aware of a concerted effort to tamper with some of the servers currently operated by Network Solutions, Inc. of Herndon, Virginia. The incident, which is potentially criminal, has been referred to the appropriate law enforcement officials. An investigation into the source of the attack, and the manner in which it was carried out, is currently underway. While there is no evidence that the servers under its control have been harmed, ICANN is taking the appropriate measures to protect its equipment located at the Information Sciences Institute of the University of Southern California. ICANN condemns this action as an attempt to undermine the stability of the domain name system and will cooperate fully with any investigation into the matter

5 8

Re: 911 doesn't work, try a FAX
by Hal Murray 04 Jul '99

04 Jul '99

> At the last NANOG several folks chuckled when I pointed out that > many real emergency plans include sending a FAX as a backup when > the phones don't work. I thought I would pass this news story along. Another item for the checklist is to know which of your phones bypass your local PBX so you can call out when it is sick. I think it's common for fax and/or modems to be setup that way.

1 0

Re: NSI/Internic operational announcement list
by Paul Vixie 03 Jul '99

03 Jul '99

SEAN(a)SDG.DRA.COM (Sean Donelan) writes: > It appears NSI had some trouble today, but I couldn't find any information > on their web site. I believe I'm still subscribe to rs-info(a)internic.net, > but I didn't see any notices from NSI. > > Did I just miss it? i don't think you missed it. the operators of the secondary COM servers were not informed of any of the problems until after my analysis was published, and by that time netsol had published a new and corrected COM zone. i'm NOT happy to have had to learn of it from non-netsol channels when it's clear that they knew something was happening. this was a highly operational issue and affected a lot of users. NANOG, or at least rs-info(a)internic.net, or at least the root name server operators, ought to have been told.

2 1

FW: Root Domain Server Hacked.
by David Alejandro Hernandez Alonso 03 Jul '99

03 Jul '99

fyi from cypherpunks mailing list. > -----Original Message----- > From: Ian [SMTP:ian@deepwell.com] > Sent: Friday, July 02, 1999 2:16 PM > To: cypherpunks(a)einstein.ssz.com > Subject: Root Domain Server Hacked. > > http://www.news.com/News/Item/0,4,0-38721,00.html?st.ne.lh..ni > > So who were the people on here that said you couldn't take down the root > name servers? > > Told ya. > > Oh and let me be very VERY clear. > > for those FBI agents trolling this list who suddenly noticed > my name. > I owned an ISP for 3 years, Im a founding representative of the ISP/C and > pretty much an Internet head > I am extremly PRO internet and the people who did this should go to jail > for a long time > then be banned from using a computer <in my book a fate almost woste than > having a leg cut off>. > > hacking on your own network is fine > screwing with someone elses isn't. > > Ian

4 3

NSI/Internic operational announcement list
by Sean Donelan 03 Jul '99

03 Jul '99

Does anyone have the current location of NSI's operational announcement list? It appears NSI had some trouble today, but I couldn't find any information on their web site. I believe I'm still subscribe to rs-info(a)internic.net, but I didn't see any notices from NSI. Did I just miss it? -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

2 1

Re: FW: Root Domain Server Hacked.
by George Herbert 03 Jul '99

03 Jul '99

Sean Donelan <SEAN(a)SDG.DRA.COM> >rmeyer(a)mhsc.COM (Roeland M.J. Meyer) writes: >>That's not what Paul said. >>> Randy Bush writes: >>> this is false and specious garbage > >Both statements are true. You can hijack domain names and insert >bogus data in caches without hacking any root servers. It is much >easier to just e-mail a domain modify template to NSI, and insert >some bogus IP addresses for certain names. Similar to what happened >to AOL last year (actually it appears to be a glue issue on some NS >records). >I haven't seen NSI official statements myself, only the news reports. >But there is no evidence any of the independently operated root-name >servers were hacked. If any systems were hacked, they were NSI's >registration process. >I think some people are getting too wrapped up in some really exotic >attacks on DNS, when the simple ones still work. Maybe BEFORE-UPDATE >will get finished now. Won't help. My sources are confirming it was a glue record issue... someone did the rough equivalent of putting in a new domain registration with servers WWW.NETWORKSOLUTIONS.NET and WWW.NETSOL.NET as their nameservers, but with the IPs of the real ICANN webservers. The problem is that the nameserver entries and glue records in general aren't sanity checked (or weren't before today). The real solution eventually has to be some sort requested nameserver forward lookup IP match confirmation prior to accepting a nameserver record in new/change applications; if nameserver FOO.BAR.COM is listed on an application and its IP is listed as 123.4.5.6 but nslookup foo.bar.com shows it at 78.9.10.11 then the application should be held until the discrepancy is resolved properly. I remember suggesting this to Mark Kosters in, oh, April 1993? -george william herbert gherbert(a)crl.com

1 0

Re: FW: Root Domain Server Hacked.
by Sean Donelan 03 Jul '99

03 Jul '99

rmeyer(a)mhsc.COM (Roeland M.J. Meyer) writes: >That's not what Paul said. >> Randy Bush writes: >> this is false and specious garbage Both statements are true. You can hijack domain names and insert bogus data in caches without hacking any root servers. It is much easier to just e-mail a domain modify template to NSI, and insert some bogus IP addresses for certain names. Similar to what happened to AOL last year (actually it appears to be a glue issue on some NS records). I haven't seen NSI official statements myself, only the news reports. But there is no evidence any of the independently operated root-name servers were hacked. If any systems were hacked, they were NSI's registration process. I think some people are getting too wrapped up in some really exotic attacks on DNS, when the simple ones still work. Maybe BEFORE-UPDATE will get finished now. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2

Peering woes
by dlr＠daver.bungi.com 02 Jul '99

02 Jul '99

Since the last message I sent didn't appear... It seems that another major provider is going down the "we don't want to peer any more" road. If you have been affected by this, please give me a call, or drop me an email. Dave Rand +1 408 367-7111

1 0