- Test - lists.nanog.org

wallstreet.com goes for $1.03M
by Hank Nussbacher 26 Apr '99

26 Apr '99

http://www.wired.com/news/news/email/explode-infobeat/business/story/19285.h tml Why is this interesting? Names listed as owners are Ehud Gavron and Joel Synder (both from NANOG). I am happy for the 2 of you but something doesn't sit right with me if NANOG as a group always tries to assume the moral high ground on network and specifically, Internic issues. Oh well, wish it was me! -Hank

3 3

address spoofing
by Randy Bush 26 Apr '99

26 Apr '99

first, apologies for bringing up an operational issue. a long while back, i noticed my border filters were showing incoming packets from 1918 addresses and my own address blocks. i wrote this off to anomalies and did not have the time to pursue. yesterday, i happened to notice it again. i described it on an internal mailing list. other folk looked at their filters, and lo and behold, it is a widespread problem. fyi, my filter looks like the following: ! what we allow to come in the serials from the world no access-list 105 ! PSGnet access-list 105 deny ip 147.28.0.0 0.0.255.255 any access-list 105 deny ip 192.83.230.0 0.0.0.255 any access-list 105 deny ip 198.133.206.0 0.0.0.255 any ! rfc1918 access-list 105 deny ip 127.0.0.1 0.255.255.255 any access-list 105 deny ip 10.0.0.0 0.255.255.255 any access-list 105 deny ip 172.16.0.0 0.15.255.255 any access-list 105 deny ip 192.168.0.0 0.0.255.255 any ! block portmapper and nfsd attacks access-list 105 deny udp any any eq sunrpc access-list 105 deny tcp any any eq 2049 ! block samba access-list 105 deny tcp any any eq 137 access-list 105 deny tcp any any eq 138 access-list 105 deny tcp any any eq 139 ! ! some other stuff ! allow all others access-list 105 permit ip any any the results of 30 hours of running are deny ip 147.28.0.0 0.0.255.255 any (6 matches) deny ip 192.83.230.0 0.0.0.255 any deny ip 198.133.206.0 0.0.0.255 any deny ip 127.0.0.0 0.255.255.255 any (375 matches) deny ip 10.0.0.0 0.255.255.255 any (593 matches) deny ip 172.16.0.0 0.15.255.255 any (201 matches) deny ip 192.168.0.0 0.0.255.255 any (769 matches) deny udp any any eq sunrpc (9 matches) deny tcp any any eq 2049 (494 matches) deny tcp any any eq 137 deny tcp any any eq 138 deny tcp any any eq 139 permit ip any any (9467763 matches) when we tried it on routers in different parts of the network, it seemed to show similar patterns. anyone have clues other than net slime and misconfigured nats? randy

17 32

PHONE PROBLEM: Worldcom customer service 1-800 number
by Sean Donelan 26 Apr '99

26 Apr '99

MCI/Worldcom's customer service center is having problems with their 1-800 numbers, lots of fast busies, dropped calls, and dead air. They know something is wrong, but haven't tracked down what it is yet. Ops Note: Please have an international direct-dial telephone number for your NOC/CSC which doesn't depend on special access code routing, e.g. a non-1-800/888/877 number. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Non-existing domain
by trall＠almaden.ibm.com 25 Apr '99

25 Apr '99

>Is there any way to see if people have tried to get to non-existing >domains? I mean, if someone requests doda.org and it does not exist, is >the request logged anywhere? The only ones to know about that request would be one of authoritative nameservers for "org." (which happens to be the A-K root nameservers). Would they log it? Almost assuredly not (at least not in a log that they would keep for very long). It would be just another request for an undefined domain. Tony Rall

1 0

Re: address spoofing
by sthaug＠nethelp.no 25 Apr '99

25 Apr '99

> > then, you can have (if you want) another bind listening on other > > interfaces for other stuff. like the "internal dns" server that you > > mentioned. or maybe a recursive, caching-only server that listens > > only on 127.0.0.1. of course...they can speak to each other if need > > be. :) > > I tried 2 instances of BIND and they didn't work right. One functioned > and the other played dead (very dead ... as in the process blocked and > would not wake up). One needs 2 separate machines to get it to actually > work right (times the amount of redundancy desired). If you know the > magic to make it work right, I'd sure like to know. Maybe some kind of > lock somewhere? Works great here. You need to make sure that each bind instance has its own set of named.conf/zone files/pid file/ndc channel, that they bind to different interfaces. I also like to force them to have different query ports, but this shouldn't be necessary as long as they are on different interfaces. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

OUTAGE: Central Florida
by Sean Donelan 24 Apr '99

24 Apr '99

MCI is reporting multiple circuits (DS3 and higher) have gone down somewhere in Florida. As of yet, they are unable to pinpoint the exact location or the extent of the outage. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Contact handles disappearing mysteriously from the whois database!
by John Fraizer 24 Apr '99

24 Apr '99

Everyone take a moment and check your NIC handles in the whois database. We have noted two that have vanished within the past week. ------------------------------------------------------------------ ML.ORG is gone. Check out http://www.EZ-IP.Net - It's *FREE* ------------------------------------------------------------------ Get your *FREE* Parked Domain account at http://www.EZ-Hosting.Com ------------------------------------------------------------------ John Fraizer | __ _ | The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation PGP Key fingerprint = 7DB6 1CA2 DAA6 43DA 3AAF 44CD 258C 3D7E B425 81A8

3 2

Re: address spoofing
by sthaug＠nethelp.no 24 Apr '99

24 Apr '99

> means that packets with source addresses from RFC 1918 space should not be > permitted on the global internet. While I agree that RFC 1918 addresses > should not be used on internet visible interfaces, I'm unaware of anywhere > in the RFC's where it says that "routers should be configured to reject > packets coming from RFC 1918 space." As others have pointed out, there are indeed RFC sections which seem to imply that packets coming from RFC 1918 space should not be visible on the global Internet. Furthermore, whether the RFC says so or not, I'm going to block these packets at *my* border routers, because: - I have absolutely *no* idea of where these packets might be coming from, - and I have no possibility of generating sensible replies to packets with RFC 1918 source addresses. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

8 7

Re: address spoofing
by sthaug＠nethelp.no 23 Apr '99

23 Apr '99

> > Furthermore, whether the RFC [1918] says so or not, I'm going to block > > these packets at *my* border routers, because: > > Curious as to the cost (added latency) in doing RFC 1918 source address > filtering on all packets in the context of cost-benfit analysis. Well, we added filtering of spoofed source addresses (ie. our own) at our border routers quite a while ago. Adding filters for the RFC 1918 source addresses was a complete no-brainer - three more lines in a filter that already had around 15 lines. *No* visible (to us) increased processor load or latency. (I'm sure it can be measured - but in our case it's completely lost in the noise.) Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

FIBER CUT: Fire in Houston damages fiber
by Sean Donelan 23 Apr '99

23 Apr '99

A fiber reported carrying 3 OC-48 systems was damaged by fire in Houston, TX. The fire was at Pinemont & Rankin. Time-Warner is repairing/patching around the damaged fiber now. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0