- Test - lists.nanog.org

Re: Smurfing
by Joe Provo - Network Architect 13 Feb '98

13 Feb '98

> ==>Perhaps some of the folks on NANOG that use equipment other than Cisco > ==>would like to share how they "configure their router for that"? It would > ==>be a nice service to everyone... > > http://www.quadrunner.com/~chuegen/smurf.txt > > It has Bay Networks and Proteon information, and I'm adding Ascend > information as well within the next week. ...and I've given Craig FORE, Livingston and DEC info. I'm looking to get some more CPE-ish vendors out to him as well. > With Ascend, you must filter traffic to the broadcast address. Am I the only one who thinks them not setting the knob to turn this off is nuts? To have to cut filters specific to each address on a case-by case basis is a lot of work that some people won't take on, and clue- challenged custromers will have difficulty with... Joe

1 0

The Cidr Report
by Tony Bates 13 Feb '98

13 Feb '98

This is an auto-generated mail on Fri Feb 13 12:00:00 PST 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 13Feb98 0) General Status Table History ------------- Date Prefixes 290198 50396 300198 50242 310198 49848 010298 49715 020298 49739 030298 49600 040298 49877 050298 49484 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 2407 Number of ASes announcing only one prefix: 718 (0 cidr, 718 classful) Largest number of cidr routes: 0 announced by Largest number of classful routes: 1044 announced by AS701 1) Gains by aggregating at the origin AS level --- 13Feb98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS2493 691 368 323 46.7% iSTAR Internet, Inc. AS6235 495 252 243 49.1% Intermedia Communications, Inc. AS4293 430 210 220 51.2% IMCI AS174 874 673 201 23.0% Performance Systems International AS816 635 444 191 30.1% UUNET Canada (ASN-UUNETCA-AS4) AS3602 455 304 151 33.2% Sprint Canada Inc. AS3749 202 61 141 69.8% TECNET AS701 1044 931 113 10.8% Alternet AS3336 109 19 90 82.6% Internet Services, Kolumbus proje AS3751 125 48 77 61.6% SNET-AS AS5668 107 40 67 62.6% Century Telephone Inc. AS3804 204 142 62 30.4% WORLDLINX AS2048 154 92 62 40.3% LaNet AS1239 596 534 62 10.4% SprintLink Backbone AS3221 92 33 59 64.1% EENet Autonomous System AS1 840 782 58 6.9% BBNPLANET AS271 110 55 55 50.0% BCNET-AS AS719 519 468 51 9.8% LANLINK autonomous system AS549 214 163 51 23.8% ONET-AS AS3464 115 64 51 44.3% Alabama Research and Education Ne AS1221 263 214 49 18.6% AARNET-AS AS72 84 36 48 57.1% Schlumberger Information Network AS4763 128 80 48 37.5% Telstra New Zealand AS7545 114 69 45 39.5% TPG Internet Pty Ltd AS684 86 42 44 51.2% MBNET-AS AS4740 354 312 42 11.9% ASN-OZEMAIL (Ozemail Pty Ltd) AS2711 97 55 42 43.3% SUNBELT-AS AS7046 130 89 41 31.5% UUNET-CUSTOMER AS3561 897 857 40 4.5% MCI AS852 156 117 39 25.0% CANET-ASN For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 1

Re: Inexperienced Seeks Partner
by Lewis Eatherton 13 Feb '98

13 Feb '98

Yup, I'd say your missing something.... At 08:50 AM 2/13/98 -0500, Adam Rothschild wrote: >> friends and I have a dialup connection to 5 exchange points. We are >> using 33.6 US Robotics Sportster Win-Modems with a linux box running >> gated. We are applying for our own ASN, and we expect to get it soon. > >Winmodems with a Linux box? Last I checked, there was no software driver, >nor was there any intent on developing one (given USR's strict >non-disclosure policies)... Am I missing something here? > > > > > > > Lewis Eatherton Network Architect SegaSoft, Inc 650.654.2318

1 0

SPAM: beware of CRL! you are LOOSING EMAIL and LOOSING CONTACTS
by Steve Carter 13 Feb '98

13 Feb '98

Thought this might interest some of you guys, especially those at CRL and one other fella...... >;) BTW, I am the messenger, not the author..... -Steve. From: dabao38(a)hotmail.com >Subject: beware of CRL! you are LOOSING EMAIL and LOOSING CONTACTS >Date: Fri, 13 Feb 1998 00:21:26 -0600 >Message-ID: <887350032.1587019783(a)dejanews.com> >Newsgroups: >ba.internet,alt.internet,alt.internet.access,alt.internet.commerce,alt. internet. >providers.america,alt.internet.services >Organization: Deja News Posting Service >Path: >news.iswest.net!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!logbrid ge.uorego >n.edu!nntp2.dejanews.com!grunt.dejanews.com!not-for-mail >X-Article-Creation-Date: Fri Feb 13 06:07:13 1998 GMT >X-Authenticated-Sender: dabao38(a)hotmail.com >X-Http-User-Agent: Mozilla/4.0 (compatible; MSIE 4.01; Windows 95) >X-Originating-IP-Addr: 207.171.196.242 (sf-pm10-18-242.dialup.slip.net) >Lines: 43 >Xref: news.iswest.net ba.internet:34461 alt.internet:15772 >alt.internet.commerce:62928 alt.internet.providers.america:1533 >alt.internet.services:135128 > >Why C R L SUCKS AND YOU TOO SHOULD DROP THEM: 1) Your email address at >CRL only works with the portion of the world THEY like. Did you know they >block off many servers and all of their users from being able to reach >you because someone onced might have used that machine to send commercial >email? And they will NOT tell you this nor admit to it until you've >mysteriously lost touch with your contacts and loved ones. A few >examples: kiss your love ones goodbye from hotmail.com, juno.com, >hinet.net (this would be the entire nation for Taiwan). They say they are >doing this to fight spam, ironically a lot of spam is actually generated >from CRL. More like kissing up to this self appointed Internet Lord Paul >Vixie who runs the Real Time Blackhole List (the list which does this >emai censoring and blocking, with out any concern for end users' >connectivity). This guy prettymuch figured he has the power to decide who >you can and can not get email from. And they are banking on you NOT >FINDING OUT about it. And guess what, my spam has not decreased, but >actually increased since they used this none-selective block.. they did >managed to cut me off from my important contacts, but not spam. 2) Try >it. Their Dial up in San Francisco and Southbay hang up on you or do not >answer 70% of the time during prime time and 50% during off peak (this >was my experience, not scientific.. but still). They refuse to upgrade >beyond 28.8k (spending all the money they made on the fat corporate job >hogs). 3) Tech support? What tech support? When I confronted them about >the missing email they actually yelled at me (after 10-15 emails to get a >response, phone calls? forget it..) and told me it was my contacts' fault >that they subscribed to the "bad, bad spamming company for ISP). Imagin >if your phone company told you you can not get calls from your mom >because she lives in an area with a phone company they did not like.. >Since when did CRL figure out dictatorship was in again? 4)They will NOT >cancel your service and will keep on charging your credit card... Many >other users complained about this, it was even mentioned in PC Magazine's >ISP review. There are many more reasons why they bite, but I really do >not want to waste my energy over those bastards anymore. I am actually >the last of my associates to drop their service because I do not want to >change my email and web address for the sake of business (I've already >spent a lot on printing them on all kinds of materials). Face it, CRL has >gotten fat off of it's customers, now it is screwing them. The email >block was what really did it. How would you like a phone service >(especially for business) that can only take calls from a PART of the >country and the world? Email me if you want to start a class action >lawsuit against them. > >-------------------==== Posted via Deja News ====----------------------- > http://www.dejanews.com/ Search, Read, Post to Usenet

2 1

Operational issue: Mae-west
by dlr＠bungi.com 13 Feb '98

13 Feb '98

The good folks at MFS, in their continuing attempted at making mae-west a more interesting place to attempt to peer, are doing yet more unscheduled upgrades. The latest is their attempt to add more cross connected capacity in the form of an OC3 to giga5. When they attempted this (in an unannounced upgrade this morning), of course everything melted, and we enjoyed packet loss up to 75% this morning to most of our peers. If anyone can get MFS's attention, could you please remind them about mae-west(a)nsipo.arc.nasa.gov? It's a good way to let people at mae west know about what's going on. Dave Rand -- Dave Rand dlr(a)bungi.com http://www.bungi.com

2 1

Inexperienced Seeks Partner
by 31337 h4ck3r 13 Feb '98

13 Feb '98

Dear Peering Co-Ordinators or your respective NSPs. I have been researching peering policies and current peering infrastructure and I want to contact you to make you aware of my offerings. Five of my friends and I have a dialup connection to 5 exchange points. We are using 33.6 US Robotics Sportster Win-Modems with a linux box running gated. We are applying for our own ASN, and we expect to get it soon. Our content includes 2 irc servers, (one on efnet and the other on undernet) and a web farm that serves 0 day warez and login/passwds for over 1,000 porn sites. I think that we have higher quality content and audience than most other companies dream of. Peering with us will assure that your customers get the best possible connectivity to what is obviously the creme brulee' of the internet. We currently have connections at the Baltimore Nap, New York Nap, Boston MAE g-Nap and the Latin Internet Exchange. Also, Could someone from Agis contact me ASAP? I believe we finally met your peering requirements. Thank you for your time, great apostles of the Internet, who were there when the commandments(RFCs) were written, and when Jesus, (Vint Cerf) still walked among the living (engineers). I am expectantly looking forward to your peering requests. Thank you for your time. Yours Sincerely, Chuck U. Farley ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

8 7

Update on The NANOG Channel
by Eric Germann 13 Feb '98

13 Feb '98

In the interest of ecumenicism, The NANOG Channel is now NetCaster compliant, as well as an MS IE 4.0 Channel. To subscribe via your browsers, http://www.cctec.com/maillists/nanog BTW, about 30 people are interested enough to pull this stuff on their desk every morning .... Eric

1 0

Re: Inexperienced Seeks Partner
by Patrick W. Gilmore 13 Feb '98

13 Feb '98

At 08:50 AM 2/13/98 -0500, Adam Rothschild wrote: >> friends and I have a dialup connection to 5 exchange points. We are >> using 33.6 US Robotics Sportster Win-Modems with a linux box running >> gated. We are applying for our own ASN, and we expect to get it soon. > >Winmodems with a Linux box? Last I checked, there was no software driver, >nor was there any intent on developing one (given USR's strict >non-disclosure policies)... Am I missing something here? Yes. The punch line. ;) TTFN, patrick P.S. Heh. "1337 h4ck3r" ;) ************************************************************** Patrick W. Gilmore voice: +1-650-482-2840 Director of Operations, CCIE #2983 fax: +1-650-482-2844 PRIORI NETWORKS, INC. http://www.priori.net "Tomorrow's Performance Today" **************************************************************

2 1

Re: Inexperienced Seeks Partner
by Gerald Andrew Winters 13 Feb '98

13 Feb '98

> Thank you for your time. Yours Sincerely, > > Chuck U. Farley Should I brush the dust off my pig-latin, Chuck? Let's just say that this is not the best way to get people to take you seriously. --Gerald Winters

1 0

Broken domain statistics...
by Dalvenjah FoxFire 13 Feb '98

13 Feb '98

Hi all, I'd finally had it up to here with people coming from misconfigured domains trying to connect to my servers and filling up the logs with 'Host name mismatch..' errors, so I decided to put together a bunch of scripts to try and see exactly how widespread the problem of bogus DNS info is. What I found was kind of surprising. Here're the raw stats for my test (done on the entire com zone): Total domains checked: 1401150 Domains with NO good nameservers (all responded non-auth): 236008 Domains with NO good nameservers (some timed out): 107482 Domains with at least one bad non-auth (but most/all answering):99211 Bringing that into percentages, about 17% of all domains in COM have NO good nameservers listed. If one adds in the nameservers that timed out, that number goes up to 25%, and adding in domains with at least one bad nameserver brings the number up to 32% of the domains in .com that have bad nameserver info registered. Please note, it appears that it's not entirely accurate to view the nameservers that timed out as necessarily 'bad' in my test - several known good nameservers timed out during the runs, and I only had a retry of 1 (so the nameservers got 1 chance to give the correct data within 4 seconds). It's very interesting, however, that the number of domains that had all listed nameservers respond, all of which responded non-authoritatively (i.e. 'I don't know about this domain') is so high. Here is my testing methodology: I read in the entire com zone, and when I found a line containing dom IN NS server I would spawn off a 'dig ANY dom @server +retry=1', and parse the output to see if it contained 'aa', the authoritative flag. If it did, it was a good domain. If it didn't, it was a bad domain. Timeouts and non-authoritative responses were counted separately. I then had three variables for each domain - goodResponses, badResponses, and timeouts. Domains where badResponses and timeouts were both 0 were considered 'good'. Domains where goodResponses and timeouts were both 0 were considered to have 'no good nameservers (but all responded)'. Else, domains where goodResponses was 0 were considered bad (noting that some queries timed out). Beyond that, if there was 1 or more badResponses, it was listed in the 'at least one bad non-auth NS' list. The processes that did this would fork out about 80 processes per host to run the digs; I was on a reasonably fast connection, so bandwidth shouldn't have become a problem as far as increasing the timeouts I got. I split the com zone file into 200,000 line sections and ran one section per host. I then stopped the stats collection server after every few runs to gather statistics. The queries occurred over a period of 12 hours between 3pm and 3am Pacific Time, Tuesday 2/9 - Wednesday 2/10. I've put up the code, results, and the logs of non-auth queries and timed-out queries at ftp1.dal.net:/pub/misc/domain-test/. The files haven't (and won't) propogate to the mirror sites. (Note, this machine will be switching IPs sometime this week, so there may be a period of an hour or two when the machine will be unreachable.) If I've got some sort of flaw in my logic, please let me know; I'm willing to correct it and run the test again. But it looks right. I haven't tested the net/edu/org domains, but I suspect that since folks using those are slightly more clued than the folks using .com, the numbers of bogus domains will be lower. And if it is, it means that 17% of the folks on the internet are paying for domains that don't work. Either that, or something else is broken. I'm posting here because I feel it is an operational issue; that, plus I feel there're more folks here who can and will hammer at InterNIC to start doing something to enforce their policies that require real, authoritative nameservers. One last request - if you plan to use this data somewhere, *please* listen to any responses that may show up here explaining how it might be wrong, and *please* go through my methodology and find out for yourself if it looks right. I don't want to be responsible for any false/overinflated claims out there }:P . And please provide context, too, especially where the 'nameserver timed out' statistics are concerned. Anyhow, there it is. -dalvenjah -- Dalvenjah FoxFire (aka Sven Nielsen) Stupid people shouldn't breed. Founder, the DALnet IRC Network e-mail: dalvenjah(a)dal.net WWW: http://www.dal.net/~dalvenjah/ whois: SN90 Try DALnet! http://www.dal.net/

14 13