- Test - lists.nanog.org

Major outage DC area
by Tatsuya Kawasaki 06 May '99

06 May '99

I believe WorldCOM is responsible?! /_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ Tatsuya Kawsaki KIVEX.com Unlock the Power of the Internet URL:www.KIVEX.com Phone 301.215.6777 Fax 301.215.5991 /_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

1 0

COURTESY ...
by Robert Mathews-ICICX 05 May '99

05 May '99

Courtesy: EDUCOM. INTERNET ADDRESS FIRM SUBJECT OF ANTITRUST PROBE The Justice Department has launched an inquiry into allegations that Network Solutions (NSI) has violated antitrust laws by retaining absolute ownership of a database of customer names and electronic addresses, according to sources. The allegations have been leveled by several NSI rivals who claim they need access to the database in order to effectively compete against the company. NSI is arguing that language in the company's agreement with the National Science Foundation allows the company to claim ownership of any intellectual property created in the address-registration process. NSI's Christopher Clough contends it is "very clear" that NSI has the rights to the data. In addition, NSI claims that releasing the data could cause privacy problems that would allow Internet retailers to send out millions of bulk e-mail messages. A Justice department spokeswoman says the department is "looking into the possibility of anti-competitive practices in the Internet address registration industry." Source: Washington Post 05/05/99

1 0

Re: Smurf tone down
by Havard.Eidnes＠runit.sintef.no 05 May '99

05 May '99

> > > access-list 175 permit icmp any any > > > int bleh/bleh > > > rate-limit input access-group 175 128000 8000 8000 conform-action transmit exceed-action drop > > > rate-limit output access-group 175 128000 8000 8000 conform-action transmit exceed-action drop > > > > I agree, the above isn't all that hard. > > > > However, I'd argue that the above is in some sense wrong. > > There's no need to put all ICMP traffic in the same basket; some > > ICMP traffic is required for e.g. path MTU discovery to work. > > So, instead I'd use > > > > access-list 175 permit icmp any any echo-reply > > With all the smurf amplifiers available, it is of course easier to > generate several Mbps of ICMP Echo Reply than it is to generate large > amounts of other ICMP traffic. > > However, if your network is exposed to several Mbps of inbound ICMP > *other* than Echo Reply, it may be equally bad for your network. So > I prefer to leave it as 'icmp any any'. I'll claim that the only real problem that is reasonable to CAR is ICMP Echo Reply traffic. That (and UDP echo, possibly to a lesser extent) are the only types of traffic where the attacker can abuse remote amplifier networks, which contributes to the "popularity" of these attacks. However, just rate-limiting all ICMP traffic will cause a Smurf attack of the current variety to have a larger impact than what it would otherwise have: o it will make network reachability testing via traceroute difficult at best, since the ICMP TTL Exceeded messages will also be rate-limited. o it will cause "ICMP unreachable, fragmentation required but DF set" messages as used by PMTU to be dropped, causing lousy performance or "strange" connectivity problems for those systems which depend on that type of feedback from the network. (Assuming you have some capacity left after the Smurfing, of course, which also goes for the above point...) o it will also cause all other types of ICMP messages to be dropped, some of which are important for proper operation under normal circumstances. If, however, the attack you're under is injected directly from other well-connected hosts under the attackers control without the assistance of amplifier networks, the attacker is free to choose any type of traffic to inject, be it ICMP, UDP, TCP SYN or any other IP protocol, and as far as I know there's no reasonable way to use rate-limiting to counter that sort of traffic (?). - Håvard

1 0

Call for Qwest to conduct a training stand-down
by Sean Donelan 05 May '99

05 May '99

I'm seeing a disturbing pattern develop. Qwest contractors seem to be involved in an unusual number of cases of damaging other providers fiber. I understand that everyone makes mistakes, and a wide-variety of other equipment operators have caused many fiber cuts. But Qwest's name seems to show up with unusual frequency in the last year. Here are the ones I found in my notes. Milwaukee-to-Chicago May 4, 1999 Smyrna, GA March 11, 1999 Gurnee, IL November 19, 1998 (drilled fiber three times over a mile) Anyone have notes about others? I have a vague recollection of a couple of more, but couldn't find them in my notes. I don't know who Qwest is hiring to bury its fiber, but I would like to call on Qwest to conduct an immediate stand-down until it can review its fiber installation practices, training and supervision with its contractors. Including review of safe digging/drilling practices around other providers' fiber. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

2 1

F.ROOT-SERVERS.NET is no longer open for AXFR of COM, NET, or ORG
by Paul A Vixie 05 May '99

05 May '99

------- Blind-Carbon-Copy To: nobody Subject: F.ROOT-SERVERS.NET is no longer open for AXFR of COM, NET, or ORG Date: Mon, 03 May 1999 15:12:05 -0700 From: Paul A Vixie <vixie(a)bb.rc.vix.com> (sent to the NANOG, IETF, and NAMEDROPPERS lists to catch everybody who cares.) Today we (Internet Software Consortium, Inc) received a verified request from the US-DOC asking that we disable public zone transfers for the COM, NET and ORG zones from now until July 23. This is part of a controlled experiment designed to uncover the actual uses and users of this information. ISC recognizes US-DOC as one of the parties authorized to make such a request, and so we have complied with it as of Mon May 3 14:57:39 1999 (Pacific). All users who have been fetching the COM, NET, or ORG zones from F.ROOT-SERVERS.NET should during this interrim period contact Network Solutions for access. Unless instructed otherwise by US-DOC, IANA, or ICANN, we plan to restore public access to the COM, NET, and ORG zones from F.ROOT-SERVERS.NET during the morning of July 23, 1999. (signed) Paul Vixie (Chairman) Internet Software Consortium ------- End of Blind-Carbon-Copy

4 3

ISP FCC exemption
by Roeland M.J. Meyer 04 May '99

04 May '99

While following through on some other issues, I ran across this reference. ------------------------------------------------------------- http://urbanlegends.miningco.com/library/weekly/aa012099.htm It was an erroneous assumption. FCC chairman William Kennard had announced the opposite just the day before: "The FCC has repeatedly stated for the past decade and is stating again today that it is NOT repealing the ISP exemption that [prevents] Internet service providers from paying per-minute charges to local telephone companies." ------------------------------------------------------------- Can anyone point me at the FCC regulation, or other documentation, for this ISP exemption? ----------------------------- Roeland M.J. Meyer Morgan Hill Software Company, Inc. http://staff.mhsc.com/~rmeyer mailto://rmeyer@mhsc.com ----------------------------- Lead; Follow; Get out of the way; ... pick one!

2 1

Worldcom Fibert Cut
by Mark Moore 04 May '99

04 May '99

Worldcom seems to have this problem under control (either repaired or re-routed). ~mark ---------------------------- Mark Moore <mark(a)gleim.com> Network Administrator Gleim Publications, Inc. http://www.gleim.com (352) 375-0772 ext. 116 (800) 87-GLEIM ext. 116 FAX: (352) 375-6940 -----------------------------

1 0

FIBER CUT: milwaukee and chicago
by Sean Donelan 04 May '99

04 May '99

Also reported, a TCG outage between Milwaukee and Chicago. Yes, again! It seems like this line has gotten hit about four times over the eighteen months or so. Supposedly no rouge ex-employees were seen in the area this time. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Worldcom Fiber Cut (FLA)
by Mark Moore 04 May '99

04 May '99

I did not even ask about how it happened. Getting our circuit re-routed is hard enough. :> ~mark At 04:34 PM 05/04/1999 , you wrote: >mark(a)gleim.COM (Mark Moore) writes: >>Worldcom has a fiber cut between on New England Ave in Winterpark affecting >>97 DS3's. There are no technicians on site yet. Looks like AT&T circuits >>have been affected also. > >Ah, you beat me to it. My first report was in northern florida, but >see from your information it was central florida. Worldcom told me it >was a construction crew. ---------------------------- Mark Moore <mark(a)gleim.com> Network Administrator Gleim Publications, Inc. http://www.gleim.com (352) 375-0772 ext. 116 (800) 87-GLEIM ext. 116 FAX: (352) 375-6940 -----------------------------

1 0

FIBER CUT: Northern Florida
by Sean Donelan 04 May '99

04 May '99

A fiber cut has been reported in Northern Florida (Tallahasse?). Repair crews are enroute, but no estimated time for repair. In other news, last evening severe storms and at least one F-5 tornado and eighteen other tornados passed through Oklahoma, Kansas and Texas. 34 confirmed deaths. At least six electrical power substations were destroyed. Most interstate telephone lines are buried in the area, and the telephone buildings just happened to get missed. Southwestern Bell Telephone reports very high telephone traffic as people tried calling into or out of the area, causing some congestion and blocked calls. No problems reported with any Internet backbone providers at this time, but there may be some dig-ups as heavy machinery is used to clear debris in the area over the next few weeks. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0