- Test - lists.nanog.org

Re: Is it time for an disruption analysis working group for the Internet?
by Dean Anderson 14 Nov '98

14 Nov '98

In aviation and probably the power industry, there is sense (and a reality) that lives and property are at stake. While the same may soon be true of the internet, there is still a perception that no one dies if the 'internet is down', and no property is destroyed though income is certainly lost. So there is no compelling need to force people to cooperate. Even if you can't force people to cooperate with information, there is still a lot of information about network disasters that will either leak out, or can be deduced or measured remotely. If you have someone with the credible technical authority to make accurate judgements about what happened and how it can be avoided, pressure can still be applied through bad publicity. Even the FAA's enforcement is for the most part pretty lassiz faire. It is well known in aviation circles that FAA regulations are "written in blood", by analyzing accidents and developing a set of rules to avoid them. Failure to follow the rules may result in your own death, and possibly others. Death is a pretty severe penalty. Many FAA enforcement actions are 'post-crash'. The rules aren't there to satisfy the ego of a bureaucrat, and the penalties are enforced more harshly by nature than by the FAA. >>How is this handled in other networked industries? I'm sure that the same >>issues of proprietary information and public humliation exist there; how >>do they deal with it? ... >A point from aviation -- incidents such as near-misses can be reported >without fear of liabiity, because the consensus is that it's more important >to recognize potential safety problems than it is to set up opportunities >for acting against individuals or setting up opportunities for lawsuits. This sounds pretty utopian. A counter point is that while this is the official spin, the fact is that the FAA treats non-reporting as suspicious. When there is a near miss, it usually involves a fault by 2 to 5 people: the controller if in controlled airspace, the pilots in command of both aircraft, and the copilots of both aircraft if they have copilots. If a near miss is reported, the non-reporting persons are asked "Were you aware that a near miss occurred?" If no, why not, if yes, why didn't you report it? Failure to report a near miss is much like refusing to take the breath-a-lyzer after a dwi stop. Usually not as bad as guilty, but a strong message is usually sent anyway. Later, they get into the question of who should have anticipated a collision course or who failed to follow instructions/procedures, etc. But if you report a near miss, and you were at fault, you will still be punished by the FAA. One must worry that someone else will report it: other pilots, other controllers, passengers, people on the ground, etc. And there have been cases where passengers reported near misses (at JFK) which were not reported by either pilots or controllers, until questioned by the FAA. Note also that a pilot is required by FAA regulations to be of "High moral character" to hold an ATP (Airline Transport) rating. While the Democrats (admittedly with huge public support) have worked hard to remove the concept, "High moral character" actually requires that one be honest, and do the right thing despite one's embarrassment or disinclination to do so. For pilots and controllers, it means reporting near misses and telling the truth about what happened. Of course, the FAA doesn't cite this specifically when revoking a pilots or controllers license, but it still affects their decisions and the penalties they impose. My point with all this is to illustrate that these are vastly different systems with vastly different underpinning behavioral motivations. I think to get something like this to work for the internet, you need to have an agency with enough purpose (e.g. people have to be at risk of death, or property must be at risk of destruction) to force people to cooperate. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Is it time for an disruption analysis working group for the Internet?
by Sean Donelan 14 Nov '98

14 Nov '98

Have we reached a critical mass of multi-provider disruptions to make it possible to do something yet? Most networked industries have some group which collects and analyzes information about disruptions. What's interesting is how often similar disruptions had precursor events across multiple different service providers. For example, there have been several cases in the last few months of root and gtld servers failing to transfer zone files. And there have been several cases of routers not withdrawing routes after an erroneous announcement. It is only after the major disruption occurs does the information get shared, usually via the public news media. Once upon a time, the IETF had a group called 'netstat,' and NANOG had presentations about the 'State of the Internet.' Neither have appeared on the agenda of those organizations for a variety of reasons recently. If there was a process for providers to submit initial and final reports about significant service disruptions; and a group to organize a regular report of common root causes across multiple providers (not a report card on any single provider) would any provider voluntarily participate? I'm not thinking about a real-time shared trouble ticket system, but something on the same scale as other industry outage reports to industry working groups. I suspect I know the answer to that question. Craig, Randy, Jhawk stop reading here----------------------------------- On the other hand, suppose instead of being very hard to reach I suddenly started returning reporters' phone calls promptly and telling them about this great idea I have to improve the reliability of the Internet. Eventually one will write a story about it, and maybe even get some decent coverage. How high up do I have to shoot in order to get your CEO's attention? Does it have to be the front page of the New York Times? Would that change the answer to the question above? -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

6 5

Re: Hold on to your news servers (fwd)
by MegaZone 14 Nov '98

14 Nov '98

Once upon a time John M. Brown shaped the electrons to say... >Wouldn't it be nice if people actually quoted things correctly.... > >Quoting from his FAQ as posted on inet-access. > >" THIS CANCEL ADVISORY SYSTEM IS OPT-IN; THE CANCELS > WILL *NOT* BE GENERALLY INJECTED BACK INTO THE USENET > NEWS STREAM. " Yeah - and I have a bridge I'm selling. Have you been reading Karl's rants on this subject? He expects that the people who sign up for this service will control leakage. Sure, and pigs will fly. We have see many times that sites do NOT control leakage of local groups, clarinews feeds, bofh.*, etc. Do you honestly believe, for a second, that these cancels will NOT find their way back into the general stream? I sure as hell don't. It is a BROKEN implementation - can so far on inet-access Karl has done his usual job of refusing to listen to anyone other than himself when they have tried to suggest other means of distributing this to make it TRULY OPT-IN. And not OPT-IN - in Utopia only, and OPT-OUT in the real world. If he pushes ahead with this system as he has described it to date, it would be a very bad thing. -MZ -- <URL:mailto:megazone@megazone.org> Gweep, Discordian, Author, Engineer, me.. Join ISP/C Internet Service Providers' Consortium <URL:http://www.ispc.org/> "A little nonsense now and then, is relished by the wisest men" 781-788-0130 <URL:http://www.megazone.org/> <URL:http://www.gweep.net/> Hail Discordia!

1 0

Cisco IOS12.0 x 11.1CC
by Rubens Kuhl Jr. 14 Nov '98

14 Nov '98

Searching CCO for some keywords, I've found two interesting documents: http://www.cisco.com/warp/public/620/ios_11_1cc.html tells that IOS 11.1CC(17) was the basis for IOS 12.0(1). In other words, if 11.1CC(17) was good for you, 12.0(1) (and possibly 12.0(1a)) would also meet your requirements. http://www.cisco.com/warp/public/620/ios_12_0s.html tells that the IOS 11.1CC line will be replaced by IOS 12.0S. Cisco sources indicate that 12.0(3)S will be the first public release, and 12.0(4)S would be a better choice. Does someone know the release date of 12.0(2)S ? I'm trying to estimate a schedule for IOS 12.0(4)S deployment, based on release date of 12.0(2)S and two increments of 7 weeks for each release. Rubens Kuhl Jr.

2 1

For amusement (more on root nameserver problem)
by David R. Conrad 14 Nov '98

14 Nov '98

Hi, Received the following recently. I'll let it speak for itself. Regards, -drc -------- Original Message -------- >>From: FGC Sunnyvale NOC [mailto:snvnoc@globalcenter.net] >>Sent: Wednesday, November 11, 1998 4:14 PM >>To: global(a)isi.net >>Subject: Internet Degradation November 11, 1998 >> >>Inconsistencies between InterNIC and the Internet Software Consortium >>(root-servers.net) caused a wide-scale DNS outage today starting around >>17:15 UTC (09:15 PST). Technically, F.ROOT-SERVERS.NET's cache seemed to >>have been removed or in some way distorted. A number of domains may have >>shown up as non-existant during queries. This has in no way affected >>internal FGC nameservers. >> >>Unfortunately, InterNIC was unaware of this situation directly. The >>Internet Software Consortium who maintain the root-servers were >>unavailable for discussing the situation directly. >> >>The situation was resolved at approximately 20:30 UTC (12:30 PST). >> >>Frontier GlobalCenter ticket #981111066 was created to track this >>service degradation. >> >>If you have questions regarding this email notification, wish to be >>removed from the customer list, or require further assistance, please >>send Email to 'snvnoc(a)globalcenter.net' or call 1-888-541-9888, >>outside the US dial +1-408-541-9888. Thanks!

1 0

UseNet News Stats Request
by John M. Brown 14 Nov '98

14 Nov '98

I am interested in receiving some stat info on what peoples top 100 news groups are. Just a day or two worth of samples. jmbrown

1 0

Re: Journal of Internet Disasters
by Dean Anderson 13 Nov '98

13 Nov '98

At 03:11 PM 11/13/1998 -0800, you wrote: >- it is known that various individuals flood the Internic with packets >related to aatempts to suck down the whois database, one item at a time >and/or detect when a specific domain name goes off hold and becomes >available for re-registration > >- pathshow indicated that the Internic circuit over which AXFR was being >attempted was congested. > >> - f.root-servers.net and NSI's servers reacted differently. What >> are the differences between them (BIND versions, in-house source >> code changes, operating systems/run-time libraries/compilers) > Of course, it would be possible for Internic to have multiple connections routing whois requests over one link, and DNS transfers over another link. Or limiting the bandwidth for whois, reserving bandwidth for DNS. etc. Aside from the obvious solution to not have insane servers. The purpose of analyzing disasters is to identify ways of avoiding them. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Heads up around Nov 17..
by Rodney Joffe 13 Nov '98

13 Nov '98

Besides the other nonsense going on here, a reminder that we'll be visited by the Leonids around Nov 17. Pagers for outages may be intermittently unavailable... and Avi's satellite links may hiccup :-) http://ssd.jpl.nasa.gov/leonids.html With luck, we won't notice.... /rlj Assistant Janitor CenterGate Research LLC

1 0

The Cidr Report
by Tony Bates 13 Nov '98

13 Nov '98

This is an auto-generated mail on Fri Nov 13 12:00:00 PST 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 13Nov98 0) General Status Table History ------------- Date Prefixes 061198 53673 071198 53323 081198 53161 091198 53249 101198 53388 111198 53419 121198 53674 131198 53601 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 4244 Number of ASes announcing only one prefix: 2088 (1113 cidr, 975 classful) Largest number of cidr routes: 338 announced by AS3561 Largest number of classful routes: 975 announced by AS701 1) Gains by aggregating at the origin AS level --- 13Nov98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 349 150 199 57.0% BCnet Backbone AS1785 583 402 181 31.0% NYSERNet Backbone AS3749 230 70 160 69.6% TECNET AS2493 345 195 150 43.5% iSTAR Internet, Inc. AS701 975 842 133 13.6% Alternet AS174 690 562 128 18.6% Performance Systems International AS4200 187 95 92 49.2% AGIS (Apex Global Information Ser AS5668 127 40 87 68.5% Century Telephone Inc. AS4293 207 135 72 34.8% IMCI AS4755 128 64 64 50.0% Videsh Sanchar Nigam Ltd. India AS549 221 159 62 28.1% ONet Backbone AS4740 388 326 62 16.0% Ozemail Pty Ltd (ASN-OZEMAIL) AS7046 265 205 60 22.6% UUNET-CUSTOMER AS8517 127 72 55 43.3% ULAKNET-ASN AS7545 117 65 52 44.4% TPG Internet Pty Ltd AS6335 71 19 52 73.2% NTRNET AS72 88 40 48 54.5% Schlumberger Information Network AS1239 523 477 46 8.8% SprintLink Backbone AS803 77 33 44 57.1% SaskNet Backbone AS1221 354 310 44 12.4% AARNET-AS AS7122 127 85 42 33.1% MTS ADVANCED Network Policy AS3221 84 42 42 50.0% EENet Autonomous System AS852 166 125 41 24.7% AGT Advance Communication AS10928 91 50 41 45.1% UNKNOWN AS3804 182 143 39 21.4% Bell Solutions AS7496 66 33 33 50.0% Power Up AS2707 65 32 33 50.8% WEC AS6181 63 31 32 50.8% FUSE-NET AS719 432 401 31 7.2% LANLINK autonomous system AS4307 32 1 31 96.9% SVINET-1 For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Hold on to your news servers
by Jeff Garzik 13 Nov '98

13 Nov '98

Hey guys, this is a heads-up about Karl Denninger's new clean-news system. I haven't seen any posts on this list about it. His message describing the implementation is attached below, posted "publicly" on chi.internet. Hold on to your news servers -- Karl is about to send out cancel messages, cancelling _every_ Usenet binary that is not PGP-signed by someone registered with his system. Karl says that these cancels will only go out to people he explicitly peers with, and not Usenet at large. He then adds that what these peers do with the cancel msgs is their own business. Folks, the goal is good, but the implementation is bad. These cancel msgs will leak out to Usenet at large. History proves this; leaking of bofh.*, clari.*, etc. occurs all the time despite peoples' best efforts. And when these cancels leak, every news server on Usenet will * suddenly be receiving _thousands_ of additional cancels, and * 99.9999% of the porn out there will disappear from your servers. I do not want to be handling the support calls when this occurs. If you are interested in this issue, there is a discussion (amongst all the noise) on news.admin.net-abuse.usenet, thread "Karl Denninger loses his marbles..." Or ask me, I'm more than happy to outline the technical ramifications of this, and why it's a bad idea, in more detail. I tried to debate this with Karl, but he went off into k00k land and starting turning every technical point into a free speech debate. :) If he doesn't want to talk about the issues, fine... Jeff (news admin/consultant for many years)

2 1