- Test - lists.nanog.org

Re: Above.net off the air
by smd＠clock.org 27 Apr '99

27 Apr '99

You would think that a person working at UUNET might be able to find a counterpart at Abovenet and ask directly, rather than floating a "ha ha look - Abovenet crashed!" message on the NANOG mailing list. Sean. (disappointed)

2 1

Geektools - whois-servers.net #2
by Rodney Joffe 27 Apr '99

27 Apr '99

Ok, as has been pointed out, CNAME and TXT records rarely mix :-) So, we've made a change... tld.whois-servers.net will provide the CNAME etc. tld.info.whois-servers.net will provide the TXT data, when asked... /rlj www.centergate.com www.geektools.com

1 0

Re: Above.net off the air
by Avi Freedman 27 Apr '99

27 Apr '99

In article <99327.04417.24304(a)avi.netaxs.com> you wrote: : Anyone who was in the know care to comment on what caused Above.net to : seemingly go off the air for over an hour on 2/25/1999? : Having an entire major AS just vanish seems to be an interesting : operational item from the pov of people buying transit or having equipment : colo'ed with them. : /vijay All of the people buying transit or having collocated equipment have received 3 updates so far about what happened. Below is a summary. A bunch of bad routes got injected into OSPF and the Ciscos apparently lack some of the damping of SPF calculations that was promised some time ago. CPU went to 100%, all for OSPF process, on all routers. We were on top of it within minutes. It took rebooting some routers and disabling OSPF on others to get the core back to normal. It was the only time AboveNet has ever had a network-wide outage in AboveNet's 3 year history. We are doing some re-engineering to ensure that nothing of that scale can happen again, and have put some fixes into place to prevent any kind of OSPF confusion from lasting for more than a few minutes. I hate link state protocols. At least it didn't take us 6 hours to clear routes like the BGP deaggregation incident of a few years ago, or 18 hours as has happened to other providers who got OSPF cranked in the last few years. Avi Freedman VP, Enginering AboveNet Communications

1 0

Above.net off the air
by Vijay Gill 27 Apr '99

27 Apr '99

Anyone who was in the know care to comment on what caused Above.net to seemingly go off the air for over an hour on 2/25/1999? I checked the above.net network blocks at all the public exchanges, all the route servers, and there were no blocks being annouced from above.net for a while, and then the network entries came back. http://www.iad.above.net/traffic/core1.iad.above.net.pos5-0.html seems to bear out the fact that there was traffic loss. Having an entire major AS just vanish seems to be an interesting operational item from the pov of people buying transit or having equipment colo'ed with them. /vijay

1 1

GeekTools update Part 1 - whois-servers.net
by Rodney Joffe 26 Apr '99

26 Apr '99

Based on suggestions, we've now added a new set of nameservers which will serve up data on known whois servers. Requests in the form: dig xxx.whois-servers.net where xxx = tld (de, jp, com, ch, int, etcetera) will return a record with the correct CNAME and dns values. dig xxx.whois-servers.net any will return additional TXT records with the 'common' name for the TLD, for logic checking (Germany, Japan, Switzerland, International, etcetera). Obviously these answers will only be valid for the whois servers we are aware of. nslookup xxx.whois-servers.net will return the valid ip address and aliases, of course. Additionally, zone transfers (axfr) may be made for whois-servers.net if you prefer to proxy this data internally. I suggest you do this at least once to see which tld's we know about. I will also post the latest updates and features to the whois.geektools.com proxy shortly. These include: - AS numbers via APNIC, RIPE, and ARIN. Queries are routed to the proper server. - ARIN, RIPE, and APNIC "handle" and netblock lookups - RADB queries - Queries can be forced to specific NIC servers if needed while still using the proxy. - IP block lookups using the correct registry. - Self-contained - no external programs (unix whois or other lookup utility) required. - "Smart" whois server handling for those servers that tend to spew output in strange forms. The same features will also appear in the web-based whois tool at www.geektools.com. Finally, as usual, please send updates, feature requests and comments to complaints(a)centergate.com Rodney Joffe CenterGate Research Group www.centergate.com www.geektools.com

2 1

Re: Contact handles disappearing mysteriously from the whois database!
by John Fraizer 26 Apr '99

26 Apr '99

At 07:35 PM 4/23/99 -0400, you wrote: >Well my handle didn't disappear, but there's someone else who's been >issued the same handle as mine. take a look at internic-al2. > >alex Latzko, Alexander (AL2) latzko(a)NOC.RUTGERS.EDU +1 732 445 5021 (908) 445-2351 (FAX) +1 732 445 2968 Leung, Hannah (aL2) hannahleung(a)HOME.COM 949 951 7009 (FAX) 949 951 7009 The second one SHOULD be HL2 I guess. Nice to see that they are so on top of things that could cause huge headaches. So just how many domains do you and Hannah now share Admin contact status for? ------------------------------------------------------------------ ML.ORG is gone. Check out http://www.EZ-IP.Net - It's *FREE* ------------------------------------------------------------------ Get your *FREE* Parked Domain account at http://www.EZ-Hosting.Com ------------------------------------------------------------------ John Fraizer | __ _ | The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation PGP Key fingerprint = 7DB6 1CA2 DAA6 43DA 3AAF 44CD 258C 3D7E B425 81A8

4 3

Non-existing domain
by Mark Moore 26 Apr '99

26 Apr '99

Is there any way to see if people have tried to get to non-existing domains? I mean, if someone requests doda.org and it does not exist, is the request logged anywhere? ~mark ---------------------------- Mark Moore <mark(a)gleim.com> Network Administrator Gleim Publications, Inc. http://www.gleim.com (352) 375-0772 ext. 116 (800) 87-GLEIM ext. 116 FAX: (352) 375-6940 -----------------------------

3 2

wallstreet.com goes for $1.03M
by Hank Nussbacher 26 Apr '99

26 Apr '99

http://www.wired.com/news/news/email/explode-infobeat/business/story/19285.h tml Why is this interesting? Names listed as owners are Ehud Gavron and Joel Synder (both from NANOG). I am happy for the 2 of you but something doesn't sit right with me if NANOG as a group always tries to assume the moral high ground on network and specifically, Internic issues. Oh well, wish it was me! -Hank

3 3

address spoofing
by Randy Bush 26 Apr '99

26 Apr '99

first, apologies for bringing up an operational issue. a long while back, i noticed my border filters were showing incoming packets from 1918 addresses and my own address blocks. i wrote this off to anomalies and did not have the time to pursue. yesterday, i happened to notice it again. i described it on an internal mailing list. other folk looked at their filters, and lo and behold, it is a widespread problem. fyi, my filter looks like the following: ! what we allow to come in the serials from the world no access-list 105 ! PSGnet access-list 105 deny ip 147.28.0.0 0.0.255.255 any access-list 105 deny ip 192.83.230.0 0.0.0.255 any access-list 105 deny ip 198.133.206.0 0.0.0.255 any ! rfc1918 access-list 105 deny ip 127.0.0.1 0.255.255.255 any access-list 105 deny ip 10.0.0.0 0.255.255.255 any access-list 105 deny ip 172.16.0.0 0.15.255.255 any access-list 105 deny ip 192.168.0.0 0.0.255.255 any ! block portmapper and nfsd attacks access-list 105 deny udp any any eq sunrpc access-list 105 deny tcp any any eq 2049 ! block samba access-list 105 deny tcp any any eq 137 access-list 105 deny tcp any any eq 138 access-list 105 deny tcp any any eq 139 ! ! some other stuff ! allow all others access-list 105 permit ip any any the results of 30 hours of running are deny ip 147.28.0.0 0.0.255.255 any (6 matches) deny ip 192.83.230.0 0.0.0.255 any deny ip 198.133.206.0 0.0.0.255 any deny ip 127.0.0.0 0.255.255.255 any (375 matches) deny ip 10.0.0.0 0.255.255.255 any (593 matches) deny ip 172.16.0.0 0.15.255.255 any (201 matches) deny ip 192.168.0.0 0.0.255.255 any (769 matches) deny udp any any eq sunrpc (9 matches) deny tcp any any eq 2049 (494 matches) deny tcp any any eq 137 deny tcp any any eq 138 deny tcp any any eq 139 permit ip any any (9467763 matches) when we tried it on routers in different parts of the network, it seemed to show similar patterns. anyone have clues other than net slime and misconfigured nats? randy

17 32

PHONE PROBLEM: Worldcom customer service 1-800 number
by Sean Donelan 26 Apr '99

26 Apr '99

MCI/Worldcom's customer service center is having problems with their 1-800 numbers, lots of fast busies, dropped calls, and dead air. They know something is wrong, but haven't tracked down what it is yet. Ops Note: Please have an international direct-dial telephone number for your NOC/CSC which doesn't depend on special access code routing, e.g. a non-1-800/888/877 number. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0