- Test - lists.nanog.org

Re: TLD .ES screw up
by Miguel A. Sanz. RedIRIS/CSIC 30 Jul '97

30 Jul '97

On Jul 30, 20:52, Paul A Vixie wrote: > Subject: Re: TLD .ES screw up > I want to correct a misapprehension. InterNIC does not make changes to > the root zone. The root zone is in the province of the IANA, and only > IANA can explain why this change was made or get it fixed for you. NSI > is just a publication facility for the root zone, they don't edit it. >-- End of excerpt from Paul A Vixie I think you're wrong. Last time we had to change .es delegation one and a half years ago, we had to sent a normal template to hostmaster(a)internic.net But InterNIC also make changes to hosts where domains are delegated which seem to be the cause of this problem. Someone made a wrong "host template" request for one of the secondaries of .es (ns.eunet.es) changing its name and IP address, which had the effect of changing the delegation of the .es zone. For what I understand, InterNIC is admiting hosts templates for domains which are not under .com .org .net, etc. (the TLDs under his management) and placing glue records for them in the DNS. Am I right? If this is such, I don't think this is correct. If someone wants a domain under .com to be delegated in a server under .es they shouldn't place glue records for this nameserver (the same way we don't place glue records for nameservers of .es domains delegated into .com NSs). The only glue records they should have for NSs under .es are the ones in which the TLD .es is being delegated and those should be admited only if included in the TLD delegation (or change of delegation) request. Miguel A. Sanz

2 1

Re: how to protect name servers against cache corruption
by Paul A Vixie 30 Jul '97

30 Jul '97

someone asked me a question in private e-mail that deserves a public answer. > 1) How exactly did Eugene Kashperuff propogate this "RR poisoning" across > the Internet? From NANOG's previous mailings I can deduce that it was along > the lines of dig @victim -t ns www.alternic.net. Where www.alternic.net had > duff A records. yes. > 2) What were/are the symptoms of this attack? www.internic.net resolving to > www.alternic.net? yes. > 3) If it was that easy to do, why hasn't it happened again? because that particular attack only works if you are willing to get caught. since eugene did this as a publicity stunt (which, i understand, has now begun to backfire on him since his victims didn't interpret it that way), he _needed_ to be caught. > 3a) What measures were taken (other than discussion of DNSSEC, or lack of > it) to 'cure' affected servers? upgrade to bind-4.9.6 or bind-8.1.1. > 4) How can I check for cache corruption? "dig @0 www.netsol.com a" and "dig @cache00.ns.uu.net www.netsol.com a" and check for differences. > Apologies if any of the above sound moronic or ill-informed; extracting > facts from reams of "what is a backhoe" mail list is a painfully slow task. > Time for some filters I think... no apologia needed. public explainations of this attack have been poor, even and especially by me. i'm grateful for the opportunity to improve on that.

3 2

Re: Big increase in DNS service ?!?!
by John J. Buxbaum 30 Jul '97

30 Jul '97

I saw the samething last week. Any ideas? -----Original Message----- From: Francois Beauregard <FBorg(a)fbli.com> To: nanog(a)merit.edu <nanog(a)merit.edu> Cc: nanog(a)merit.edu <nanog(a)merit.edu> Subject: Big increase in DNS service ?!?! >Wow... I just checked the root servers for the list of head servers from >a.root-servers.net... > >Anyone knows why all servers are repeated twice... > >>From NSLookup I got... > >(root) > origin = A.ROOT-SERVERS.NET > mail addr = hostmaster.INTERNIC.NET > serial = 1997072900 > refresh = 10800 (3 hours) > retry = 900 (15 mins) > expire = 604800 (7 days) > minimum ttl = 86400 (1 day) >(root) nameserver = J.ROOT-SERVERS.NET >(root) nameserver = K.ROOT-SERVERS.NET >(root) nameserver = L.ROOT-SERVERS.NET >(root) nameserver = M.ROOT-SERVERS.NET >(root) nameserver = A.ROOT-SERVERS.NET >(root) nameserver = H.ROOT-SERVERS.NET >(root) nameserver = B.ROOT-SERVERS.NET >(root) nameserver = C.ROOT-SERVERS.NET >(root) nameserver = D.ROOT-SERVERS.NET >(root) nameserver = E.ROOT-SERVERS.NET >(root) nameserver = I.ROOT-SERVERS.NET >(root) nameserver = F.ROOT-SERVERS.NET >(root) nameserver = G.ROOT-SERVERS.NET >(root) nameserver = J.ROOT-SERVERS.NET >(root) nameserver = K.ROOT-SERVERS.NET >(root) nameserver = L.ROOT-SERVERS.NET >(root) nameserver = M.ROOT-SERVERS.NET >(root) nameserver = A.ROOT-SERVERS.NET >(root) nameserver = H.ROOT-SERVERS.NET >(root) nameserver = B.ROOT-SERVERS.NET >(root) nameserver = C.ROOT-SERVERS.NET >(root) nameserver = D.ROOT-SERVERS.NET >(root) nameserver = E.ROOT-SERVERS.NET >(root) nameserver = I.ROOT-SERVERS.NET >(root) nameserver = F.ROOT-SERVERS.NET >(root) nameserver = G.ROOT-SERVERS.NET >J.ROOT-SERVERS.NET internet address = 198.41.0.10 >K.ROOT-SERVERS.NET internet address = 193.0.14.129 >L.ROOT-SERVERS.NET internet address = 198.32.64.12 > >Because of the size limit of the packets, I receive only 3 IP from the >query to a root server and I get the following response when starting DNS... > >"NOTICE : check_root: 1 root servers after query to root server < min." > >Not pretty... Is this a screwup again or are they getting "spoofed" ??? > > > >Sincerely > >---------------------------------- >Francois Beauregard >FBorg(a)fbli.com >FBLI.COM >We love feedbacks and live by them > >Sales : Sales(a)fbli.com 1 (888) FBLI.COM >Tech support : Support(a)fbli.com 1 (514) 349-0455 >Internet Web : http://www.fbli.com >ICQ : 1907537 > >Montreal, Canada >---------------------------------- >

1 0

Re: how to protect name servers against cache corruption
by James R. Cutler 30 Jul '97

30 Jul '97

Ben, You have stated that there exist potential security fixes for bind which do not require DNSSEC. Please serve your internet community by providing the necessary code to Mr. Vixie. Thank you. - James R. Cutler EDS Mail Stop 4165 800 Tower Drive, Troy, MI 48007-7012 Phone: 248-265-7514 FAX: 248-265-7514 EDS Internal Web: <http://www.iscg.eds.com/cutler/> World Wide Web: <http://www.ltu.edu/midecus/dechtm/cutler/cutler.htm>

1 0

Re: ANS etc.
by Douglas Jardine 30 Jul '97

30 Jul '97

First, thanks for the replies. >> [4] Some recent threads on NANOG discussed physical layer issues like >> SONET, SDH, circuit layout etc. Could somebody point me to >> technical papers / articles / books which describe fiber and >> copper technology in detail. > >Ask in comp.dcom.telecom.tech. > Judging from the answers to this question, I gather I didn't phrase the question correctly. What I am looking for some is practical literature on fiber and copper technology - stuff which network operators and designers need and use. I would have guessed there would be an equivalent to say what the Stevens Books are to TCP/IP. Or have most people on this list learnt their skill by experience only? -dj ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

ANS etc.
by Douglas Jardine 30 Jul '97

30 Jul '97

Hi, This isn't really a North American Operational issue, but I couldn't find a more appropriate list to post this on. Please bear with me. I do hope that some of the replies would be useful to network operators. [1] From what I know, ANS was formed by Merit, IBM and MCI in 1990 to run the NSFNET backbone. Could somebody update me on the current status of ANS - i.e. after NSFNETs demise in 1995, did ANS become independent and does it qualify as an NSP in its own right? [2] Is there an equivalent to NANOG for Europe and Asia and is there an equivalent list which discusses operational issues for these continents? Pointers appreciated. [3] Is there a web page which lists all the public CIXs and NAPs around the world? Pointers appreciated. [4] Some recent threads on NANOG discussed physical layer issues like SONET, SDH, circuit layout etc. Could somebody point me to technical papers / articles / books which describe fiber and copper technology in detail. TIA. -dj ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

5 4

Big increase in DNS service ?!?!
by Francois Beauregard 30 Jul '97

30 Jul '97

Wow... I just checked the root servers for the list of head servers from a.root-servers.net... Anyone knows why all servers are repeated twice... >From NSLookup I got... (root) origin = A.ROOT-SERVERS.NET mail addr = hostmaster.INTERNIC.NET serial = 1997072900 refresh = 10800 (3 hours) retry = 900 (15 mins) expire = 604800 (7 days) minimum ttl = 86400 (1 day) (root) nameserver = J.ROOT-SERVERS.NET (root) nameserver = K.ROOT-SERVERS.NET (root) nameserver = L.ROOT-SERVERS.NET (root) nameserver = M.ROOT-SERVERS.NET (root) nameserver = A.ROOT-SERVERS.NET (root) nameserver = H.ROOT-SERVERS.NET (root) nameserver = B.ROOT-SERVERS.NET (root) nameserver = C.ROOT-SERVERS.NET (root) nameserver = D.ROOT-SERVERS.NET (root) nameserver = E.ROOT-SERVERS.NET (root) nameserver = I.ROOT-SERVERS.NET (root) nameserver = F.ROOT-SERVERS.NET (root) nameserver = G.ROOT-SERVERS.NET (root) nameserver = J.ROOT-SERVERS.NET (root) nameserver = K.ROOT-SERVERS.NET (root) nameserver = L.ROOT-SERVERS.NET (root) nameserver = M.ROOT-SERVERS.NET (root) nameserver = A.ROOT-SERVERS.NET (root) nameserver = H.ROOT-SERVERS.NET (root) nameserver = B.ROOT-SERVERS.NET (root) nameserver = C.ROOT-SERVERS.NET (root) nameserver = D.ROOT-SERVERS.NET (root) nameserver = E.ROOT-SERVERS.NET (root) nameserver = I.ROOT-SERVERS.NET (root) nameserver = F.ROOT-SERVERS.NET (root) nameserver = G.ROOT-SERVERS.NET J.ROOT-SERVERS.NET internet address = 198.41.0.10 K.ROOT-SERVERS.NET internet address = 193.0.14.129 L.ROOT-SERVERS.NET internet address = 198.32.64.12 Because of the size limit of the packets, I receive only 3 IP from the query to a root server and I get the following response when starting DNS... "NOTICE : check_root: 1 root servers after query to root server < min." Not pretty... Is this a screwup again or are they getting "spoofed" ??? Sincerely ---------------------------------- Francois Beauregard FBorg(a)fbli.com FBLI.COM We love feedbacks and live by them Sales : Sales(a)fbli.com 1 (888) FBLI.COM Tech support : Support(a)fbli.com 1 (514) 349-0455 Internet Web : http://www.fbli.com ICQ : 1907537 Montreal, Canada ----------------------------------

1 0

RE: "1997, the Year of the Backhoe" ...Re: Fiber Cut In Sterling VA.
by Peter Galbavy 30 Jul '97

30 Jul '97

On 25 July 1997 20:11, Steve Goldstein [SMTP:sgoldste@nsf.gov] wrote: > At 10:18 AM -0400 7/25/97, Henry Clark wrote: > ... > > > >backhoe season :-) > > "1997, the Year of the Backhoe" For those of us who have not grown up with the (what sounds like) delightful vagaries of US road management - what is a backhoe ? regards, -- Peter Galbavy Demon Internet Ltd

9 8

Apology re: my last mail
by Paul Thornton 30 Jul '97

30 Jul '97

If I may interrupt the great DNS debate ... again ... My mail regarding the LINX move last weekend managed to sit on one of our servers for days and appear yesterday - sorry about adding to the noise! The LINX move went well, and is now happily installed in its own room in London Telehouse. Paul -- Paul Thornton, Network Engineer, London Internet Exchange Ltd. Tel: 07000 783797 Mobile: +44 467 372205

1 0

RE: ANS etc.
by Steve Carter 30 Jul '97

30 Jul '97

> >[2] Is there an equivalent to NANOG for Europe and Asia and is there > > >an equivalent list which discusses operational issues for these > > continents? Pointers appreciated. > > > > Yes, for Europe there's the RIPE-discuss list (for which I don't have > an immediate reference) and for Asia, there's the apops list: > For RIPE, try http://www.ripe.net/ then do some drilling.........

2 1