- Test - lists.nanog.org

DNS TTL
by Andrew Staples 11 Dec '98

11 Dec '98

I hope this is considered operational... A new customer of ours, blah.com, was using a different (unnamed) network for dns services. This other company had messed up the dns zone, with a 1 year ttl in some of the dns records. The domain has been transferred to our dns servers, with correct settings. Various disparate networks are unfortunately using the old cache entries. Short of emailing each network as we find the problem (usually by email not getting through), or asking the old mx ip owner (critical path) to forward the mail from their smtp server, is there anything else to be done? Hmm, just checked, and the old provider is still lame hosting the dns zone, even though it isn't authoritative. Perhaps they just like it that way. Thanks, Andrew

1 0

A tribute to Jon Postel
by Martin Cooper 10 Dec '98

10 Dec '98

/* Apologies to those who receive multiple copies of this owing to their presence on multiple mailing lists. */ I was saddened to learn of the recent passing of Jon Postel, to whom so many people owe so great a debt of gratitude for his contribution to shaping the Internet which so many people use and earn their living through today. In pondering how I should remember him, I settled upon his robustness principle, which is as equally good advice when applied to life as to internetworking. /* 1.3.2 Robustness Principle At every layer of the protocols, there is a general rule (from [TRANS:2] by Jon Postel) whose application can lead to enormous benefits in robustness and interoperability: Be conservative in what you do, be liberal in what you accept from others. */ Also, whilst browsing the Bibliography of the O'Reilly Sendmail V8 text recently, I was amused to find a reference to the following early RFC, published in the year I was born, which illustrates Jon's great vision wonderfully appropriately. /* Network Working Group Jon Postel (SRI-ARC) Request for Comments: 706 Nov 1975 NIC #33861 On the Junk Mail Problem In the ARPA Network Host/IMP interface protocol there is no mechanism for the Host to selectively refuse messages. This means that a Host which desires to receive some particular messages must read all messages addressed to it. Such a Host could be sent many messages by a malfunctioning Host. This would constitute a denial of service to the normal users of this Host. Both the local users and the network communication could suffer. The services denied are the processor time consumed in examining the undesired messages and rejecting them, and the loss of network thruput or increased delay due to the unnecessary busyness of the network. It would be useful for a Host to be able to decline messages from sources it believes are misbehaving or are simply annoying. If the Host/IMP interface protocol allowed the Host to say to the IMP "refuse messages from Host X", the IMPs could discard the unwanted messages at their earliest opportunity returning a "refused" notice to the offending Host. How the IMPs might do this is an open issue -- here are two possibilities: The destination IMP would keep a list (per local Host) of sources to refuse (this has the disadvantage of keeping the network busy). The destination IMP on receiving the "refuse messages from Host X" message forwards the message to the source IMP (the IMP local to Host X). That IMP keeps a list (per local Host) of destinations that are refusing messages from this source Host. This restriction on messages might be removed by a destination Host either by sending a "accept messages from Host X" message to the IMP, or by resetting its Host/IMP interface. A Host might make use of such a facility by measuring, per source, the number of undesired messages per unit time, if this measure exceeds a threshold then the Host could issue the "refuse messages from Host X" message to the IMP. */

1 0

POWER: CORRECTION: San Mateo/San Francisco Power
by Sean Donelan 10 Dec '98

10 Dec '98

Some corrections: Official Start time: 8:17AM Pacific Standard Time Official End time: 3:52PM Pacific Standard Time Root cause, failure by a work crew to *UN*ground two safety ground straps after completing work on the 115Kvolt line at the San Mateo Coyote Point substation. 1 Fatality, a women struck at an intersection with non-functioning traffic signals. San Francisco has two subway systems. BART was able to move their trains to the next station, reportedly in some cases after a 1-2 hour delay. MUNI evacuated people on foot through the tunnels. San Francisco International Airport had emergency power for runway lights and navagation, and did land planes during the outage. The jetways, baggage conveyers, security checkpoints, ticketing systems, etc did not have power. Because the airport can't handle large numbers of passengers without power other flights were delayed, cancelled or diverted to other airports. Effect on Major/Minor Internet providers. A number of people wrote in saying that provider XYZ had problems. There may not have been any 'major' problems with 'major' providers, there were some minor/major problems with major/minor providers. How individual customers were affected varied, mostly depending on the customers' own backup planning. Generally the Customer Premise Equipment lost power (or backup power) before the ISP's equipment went down. Telephone calling volume was up 43% in the Bay area. This may have lead to a higher number of ISP/busy/no connection problems with dialup access. The most common reported problem was with webserver farms only having limited backup battery. I also received a report of a provider's customer service PBX system battery failing, so their phones gave ring-no answer. Providers generally gave priority to routers and access servers over web and mail servers. You could often use the Internet, but your mail or web page may have been unavailable. E-Mail is automatically queued for 2-4 days, so very few e-mail messages should have been lost, only delayed a few hours. When evaluating how your provider did, ask where their POP is and if it lost utlity power. I've noticed some provider sales people already enaging in some competitor bashing, saying they stayed up while provider X didn't. However in some cases, it was because they were located in a different area and never lost utility power. Effects on other industries. Banks may have a lot of backup systems to protect them, but their customer access systems appear less reliable. 600 ATM machines, and 200 bank branches in the area were shutdown due to the power outage. One person noted that Nordstroms, long noted for their customer service, remained open throughout the power outage. At other stores, clerks couldn't make sales without computer price lookup and approval, especially for 'sale' items. VISA/Mastercard say their credit card approval systems remained operational, but some store's inhouse PBX and Verifone terminals didn't have battery backup. Some grocery stores shutdown, others implemented an "honor" system where people used pencil and paper to write the prices off the shelf tags, since the UPC laser scanners require power. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Help with identifying a kind of attack.
by Adam D. McKenna 10 Dec '98

10 Dec '98

tcp and udp are transport layer protocols. If someone is sending raw IP packets that aren't using a particular transport protocol, maybe they could get through (?) --Adam -----Original Message----- From: Thom Youngblood <thom(a)cais.net> To: North America Network Operators Group <nanog(a)merit.edu> Date: Tuesday, December 08, 1998 5:55 PM Subject: Help with identifying a kind of attack. :-----BEGIN PGP SIGNED MESSAGE----- :Hash: SHA1 : : :I've been tracking an attack all day long, and have been frustrated :trying to figure out both what was being attacked, and how. Finally, :I realized it was *not* ICMP, UDP, or TCP. : :#sh access-lists 151 :Extended IP access list 151 : permit icmp any 20.0.0.0 0.255.255.255 (1023 matches) : permit udp any 20.0.0.0 0.255.255.255 (4347 matches) : permit tcp any 20.0.0.0 0.255.255.255 (86444 matches) : deny ip any 20.0.0.0 0.255.255.255 (5547308 matches) : permit ip any any (4450563 matches) : : :In the above, notice the disparity? So, my question is... : :What the hell kind of packet is it if it's not ICMP, UDP, or TCP? : : :-----BEGIN PGP SIGNATURE----- :Version: PGPfreeware 6.0 for non-commercial use <http://www.pgp.com> : :iQA/AwUBNm2jB2fkezbzToVaEQIQQQCgllupf+cmax8w5n/RgYhlATz+BuQAn38r :Di2Ec9bI2Prrahm9yKp5rohS :=/qOm :-----END PGP SIGNATURE----- : :

3 2

Re: More Sidgemore on per-bit pricing
by Dean Anderson 10 Dec '98

10 Dec '98

At 06:43 PM 12/9/1998 -0500, Jay R. Ashworth wrote: >> I was just saying how you could lower the cost of the ADSL loop from >> around $150 to $30, with both you would need to supply the IP. The idea >> would be that you would not just use the port for internet traffice. You >> would provide voice services, you would provice VOD (video on demand), and >> cable services (using something like I Magic TV). > >Oh yeah, I got that, Nathan. It's just that I get miffed when people >keep going on (don't take this personal) about how cool it is that I >can get my loop down from $300 to $150... when my router port is still >$1800. Nice, yeah, but not what people mean when they blather about >"cheap bandwidth". If it's _that_ cheap, it's running under completely >different assumptions than a standard T-1; viz: cable modems. Um, actually, I think think you can get DSLAM's for about $700 per port or less going by my recent informal surveys. Router ports have been way overpriced for a long time. They were overpriced when an AGS sold for 30K with a stack of ethernet, serial, and an fddi port. Of course, back then the pricing model optimistically expected to sell only a few thousand. They got even more overpriced later, and now expect to sell hundreds of thousands. What I've yet to find out is what sort of latency one gets with a DSL modem as compared to a DSU... I'm not sure DSL is somehow inferior technology (as Bob Metcalfe seems to think from an article several years ago), or if it just represents a (slight) change and a collapse of the fee structure. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3 2

More Sidgemore on per-bit pricing
by Pete Kruckenberg 10 Dec '98

10 Dec '98

Sidgemore talks again: http://www.news.com/News/Item/0,4,29533,00.html?st.ne.fd.gif.a I'm sure this subject has been discussed at length here, but I still fail to see any benefit for per-piece pricing other than to the seller's revenue stream. I think it's always interesting that discussions of per-piece pricing always fail to mention the fundamental issue: provide a disincentive to the consumer to use the service. There is already per-piece pricing: 1.544Mbps of traffic costs $500 to $2000+/mo, depending upon how much the provider is counting on you to not use the service. However, in this case the burden is placed on the ISP to balance closing the sale with making money off of how much the customer actually uses the service. The thing I most distrust about people who talk about per-piece pricing is that in spite of the fact that it should end up costing lower-use customers less, for some reason it always ends up costing everyone more. Look at UUNet's pricing now (for 256K ASU, or something like that), versus the flat-rate price available from equivalent NSP's. Is that where things are going? Pete.

11 21

Ignorant mass-media strikes again
by Vadim Antonov 10 Dec '98

10 Dec '98

>From http://www.cnn.com/TECH/computing/9812/09/isp.idg/ : > Don't let your ISP cut you off > How to fight back when your ISP keeps kicking you off. > by Carla Thorton > (IDG) -- PROBLEM: Your Internet service provider kicks you offline when > you're in the middle of important work. > > SOLUTION: Install an anti-timer utility, reconfigure your e-mail package, > or choose a regional ISP. I bet Ms. Thorton never heard that TCP can preserve idle connections when dial-up link is down. Yeah, dial-on-demand is such a hard thing to do! Am i paranoid, or is mass-media hell-bent on propaganda of antisocial behavior in the Internet? Or are they just really clueless? --vadim

8 7

Re: More Sidgemore on per-bit pricing
by Dean Anderson 10 Dec '98

10 Dec '98

>Unless I'm misunderstanding you, you've misunderstood me. :-) > >I'm not talking about the card, I'm talking about my proportion of the >amount the guy I'm buying from has to pay for _his_ uplink. > >Bandwidth Costs Money. Oh I see. But you insert 'value added' inbetween, right? Or in the case of Cable modems/home DSL for 50/mo, its probably better described as 'value removed'. If I put 50 DSL T1's against 1 T1 uplink, I can pay a lot for uplink and it still won't make much difference. As long as the DSL lines hit a web cache and a newserver, everything is fine. When they don't, too bad, I guess. Isn't USWest doing all of Phoenix on 4 T1's? Whats that come out to? X,000 to 1? It looks to me like the crucial cost factor is the cost of the home equipment, and whether the customer pays for that or the ISP pays. It's not the last mile, its the last 6 inches. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

POWER: San Mateo/San Francisco power outage report
by Sean Donelan 10 Dec '98

10 Dec '98

Howdy, I'm back from vacation. By popular demand, a summary of the San Francisco/San Mateo power outage on December 8, 1998. At 8:15am workers making changes to 115-kilovolt lines at the San Mateo substation failed to properly ground the system. When they turned on the power, it caused a low frequency condition and tripped protective breakers on the substation. It also caused a cascade effect, tripping the Hunters Point and Potrero power plants. This isolated San Mateo County and northward to parts of San Francisco City from the electrical grid primary power sources. Aside from the human error, the system worked "as designed to protect the rest of the grid." Approximately 375,000 customers were without power, including San Francisco Airport (SFO), the Pacific Stock Exchange, traffic lights, and cable cars. BART (subway) used emergency power to bring trains to the next station, and then shutdown. Since the electrical grid was isolated, PG&E had to "blackstart" the system on a circuit by circuit basis. The SFO airport power was restored at 9:10AM. The San Francisco Office of Emergency Services was activated at 9:22AM according to EDIS. At 1:00PM about 200,000 customers were still without power. PG&E estimated that full restoration would be completed by 2:15PM, but some customers were still without power through the afternoon. No major injuries have been reported directly attributable to the power failure. No major Internet provider reported any network problems directly attributable to the power failure. Since this outage was caused by a PG&E error, customers may make claims for some types of damages. Other damages may be covered by private insurance. http://www.pge.com/resources/claim_form/claim_form.html In other news: On December 7, 1998 PG&E donated $87,000 to San Fransico's Emergency Services Communications Center to install extra back up electrical facilities for the center. The new facility will work with PG&E during major service interruptions to establish restoration priorities. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

10 12

Re: Ignorant mass-media strikes again
by Tony Li 10 Dec '98

10 Dec '98

avg(a)alink.net (Vadim Antonov) writes: > Am i paranoid, or is mass-media hell-bent on propaganda of antisocial > behavior in the Internet? > > Or are they just really clueless? They found out a long time ago that controversy and sensationalism sells papers. This predates the Internet or its founders. Tony

2 1