- Test - lists.nanog.org

Re: Big increase in DNS service ?!?!
by John J. Buxbaum 30 Jul '97

30 Jul '97

I saw the samething last week. Any ideas? -----Original Message----- From: Francois Beauregard <FBorg(a)fbli.com> To: nanog(a)merit.edu <nanog(a)merit.edu> Cc: nanog(a)merit.edu <nanog(a)merit.edu> Subject: Big increase in DNS service ?!?! >Wow... I just checked the root servers for the list of head servers from >a.root-servers.net... > >Anyone knows why all servers are repeated twice... > >>From NSLookup I got... > >(root) > origin = A.ROOT-SERVERS.NET > mail addr = hostmaster.INTERNIC.NET > serial = 1997072900 > refresh = 10800 (3 hours) > retry = 900 (15 mins) > expire = 604800 (7 days) > minimum ttl = 86400 (1 day) >(root) nameserver = J.ROOT-SERVERS.NET >(root) nameserver = K.ROOT-SERVERS.NET >(root) nameserver = L.ROOT-SERVERS.NET >(root) nameserver = M.ROOT-SERVERS.NET >(root) nameserver = A.ROOT-SERVERS.NET >(root) nameserver = H.ROOT-SERVERS.NET >(root) nameserver = B.ROOT-SERVERS.NET >(root) nameserver = C.ROOT-SERVERS.NET >(root) nameserver = D.ROOT-SERVERS.NET >(root) nameserver = E.ROOT-SERVERS.NET >(root) nameserver = I.ROOT-SERVERS.NET >(root) nameserver = F.ROOT-SERVERS.NET >(root) nameserver = G.ROOT-SERVERS.NET >(root) nameserver = J.ROOT-SERVERS.NET >(root) nameserver = K.ROOT-SERVERS.NET >(root) nameserver = L.ROOT-SERVERS.NET >(root) nameserver = M.ROOT-SERVERS.NET >(root) nameserver = A.ROOT-SERVERS.NET >(root) nameserver = H.ROOT-SERVERS.NET >(root) nameserver = B.ROOT-SERVERS.NET >(root) nameserver = C.ROOT-SERVERS.NET >(root) nameserver = D.ROOT-SERVERS.NET >(root) nameserver = E.ROOT-SERVERS.NET >(root) nameserver = I.ROOT-SERVERS.NET >(root) nameserver = F.ROOT-SERVERS.NET >(root) nameserver = G.ROOT-SERVERS.NET >J.ROOT-SERVERS.NET internet address = 198.41.0.10 >K.ROOT-SERVERS.NET internet address = 193.0.14.129 >L.ROOT-SERVERS.NET internet address = 198.32.64.12 > >Because of the size limit of the packets, I receive only 3 IP from the >query to a root server and I get the following response when starting DNS... > >"NOTICE : check_root: 1 root servers after query to root server < min." > >Not pretty... Is this a screwup again or are they getting "spoofed" ??? > > > >Sincerely > >---------------------------------- >Francois Beauregard >FBorg(a)fbli.com >FBLI.COM >We love feedbacks and live by them > >Sales : Sales(a)fbli.com 1 (888) FBLI.COM >Tech support : Support(a)fbli.com 1 (514) 349-0455 >Internet Web : http://www.fbli.com >ICQ : 1907537 > >Montreal, Canada >---------------------------------- >

1 0

Re: how to protect name servers against cache corruption
by James R. Cutler 30 Jul '97

30 Jul '97

Ben, You have stated that there exist potential security fixes for bind which do not require DNSSEC. Please serve your internet community by providing the necessary code to Mr. Vixie. Thank you. - James R. Cutler EDS Mail Stop 4165 800 Tower Drive, Troy, MI 48007-7012 Phone: 248-265-7514 FAX: 248-265-7514 EDS Internal Web: <http://www.iscg.eds.com/cutler/> World Wide Web: <http://www.ltu.edu/midecus/dechtm/cutler/cutler.htm>

1 0

Re: ANS etc.
by Douglas Jardine 30 Jul '97

30 Jul '97

First, thanks for the replies. >> [4] Some recent threads on NANOG discussed physical layer issues like >> SONET, SDH, circuit layout etc. Could somebody point me to >> technical papers / articles / books which describe fiber and >> copper technology in detail. > >Ask in comp.dcom.telecom.tech. > Judging from the answers to this question, I gather I didn't phrase the question correctly. What I am looking for some is practical literature on fiber and copper technology - stuff which network operators and designers need and use. I would have guessed there would be an equivalent to say what the Stevens Books are to TCP/IP. Or have most people on this list learnt their skill by experience only? -dj ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

ANS etc.
by Douglas Jardine 30 Jul '97

30 Jul '97

Hi, This isn't really a North American Operational issue, but I couldn't find a more appropriate list to post this on. Please bear with me. I do hope that some of the replies would be useful to network operators. [1] From what I know, ANS was formed by Merit, IBM and MCI in 1990 to run the NSFNET backbone. Could somebody update me on the current status of ANS - i.e. after NSFNETs demise in 1995, did ANS become independent and does it qualify as an NSP in its own right? [2] Is there an equivalent to NANOG for Europe and Asia and is there an equivalent list which discusses operational issues for these continents? Pointers appreciated. [3] Is there a web page which lists all the public CIXs and NAPs around the world? Pointers appreciated. [4] Some recent threads on NANOG discussed physical layer issues like SONET, SDH, circuit layout etc. Could somebody point me to technical papers / articles / books which describe fiber and copper technology in detail. TIA. -dj ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

5 4

Big increase in DNS service ?!?!
by Francois Beauregard 30 Jul '97

30 Jul '97

Wow... I just checked the root servers for the list of head servers from a.root-servers.net... Anyone knows why all servers are repeated twice... >From NSLookup I got... (root) origin = A.ROOT-SERVERS.NET mail addr = hostmaster.INTERNIC.NET serial = 1997072900 refresh = 10800 (3 hours) retry = 900 (15 mins) expire = 604800 (7 days) minimum ttl = 86400 (1 day) (root) nameserver = J.ROOT-SERVERS.NET (root) nameserver = K.ROOT-SERVERS.NET (root) nameserver = L.ROOT-SERVERS.NET (root) nameserver = M.ROOT-SERVERS.NET (root) nameserver = A.ROOT-SERVERS.NET (root) nameserver = H.ROOT-SERVERS.NET (root) nameserver = B.ROOT-SERVERS.NET (root) nameserver = C.ROOT-SERVERS.NET (root) nameserver = D.ROOT-SERVERS.NET (root) nameserver = E.ROOT-SERVERS.NET (root) nameserver = I.ROOT-SERVERS.NET (root) nameserver = F.ROOT-SERVERS.NET (root) nameserver = G.ROOT-SERVERS.NET (root) nameserver = J.ROOT-SERVERS.NET (root) nameserver = K.ROOT-SERVERS.NET (root) nameserver = L.ROOT-SERVERS.NET (root) nameserver = M.ROOT-SERVERS.NET (root) nameserver = A.ROOT-SERVERS.NET (root) nameserver = H.ROOT-SERVERS.NET (root) nameserver = B.ROOT-SERVERS.NET (root) nameserver = C.ROOT-SERVERS.NET (root) nameserver = D.ROOT-SERVERS.NET (root) nameserver = E.ROOT-SERVERS.NET (root) nameserver = I.ROOT-SERVERS.NET (root) nameserver = F.ROOT-SERVERS.NET (root) nameserver = G.ROOT-SERVERS.NET J.ROOT-SERVERS.NET internet address = 198.41.0.10 K.ROOT-SERVERS.NET internet address = 193.0.14.129 L.ROOT-SERVERS.NET internet address = 198.32.64.12 Because of the size limit of the packets, I receive only 3 IP from the query to a root server and I get the following response when starting DNS... "NOTICE : check_root: 1 root servers after query to root server < min." Not pretty... Is this a screwup again or are they getting "spoofed" ??? Sincerely ---------------------------------- Francois Beauregard FBorg(a)fbli.com FBLI.COM We love feedbacks and live by them Sales : Sales(a)fbli.com 1 (888) FBLI.COM Tech support : Support(a)fbli.com 1 (514) 349-0455 Internet Web : http://www.fbli.com ICQ : 1907537 Montreal, Canada ----------------------------------

1 0

RE: "1997, the Year of the Backhoe" ...Re: Fiber Cut In Sterling VA.
by Peter Galbavy 30 Jul '97

30 Jul '97

On 25 July 1997 20:11, Steve Goldstein [SMTP:sgoldste@nsf.gov] wrote: > At 10:18 AM -0400 7/25/97, Henry Clark wrote: > ... > > > >backhoe season :-) > > "1997, the Year of the Backhoe" For those of us who have not grown up with the (what sounds like) delightful vagaries of US road management - what is a backhoe ? regards, -- Peter Galbavy Demon Internet Ltd

9 8

Apology re: my last mail
by Paul Thornton 30 Jul '97

30 Jul '97

If I may interrupt the great DNS debate ... again ... My mail regarding the LINX move last weekend managed to sit on one of our servers for days and appear yesterday - sorry about adding to the noise! The LINX move went well, and is now happily installed in its own room in London Telehouse. Paul -- Paul Thornton, Network Engineer, London Internet Exchange Ltd. Tel: 07000 783797 Mobile: +44 467 372205

1 0

RE: ANS etc.
by Steve Carter 30 Jul '97

30 Jul '97

> >[2] Is there an equivalent to NANOG for Europe and Asia and is there > > >an equivalent list which discusses operational issues for these > > continents? Pointers appreciated. > > > > Yes, for Europe there's the RIPE-discuss list (for which I don't have > an immediate reference) and for Asia, there's the apops list: > For RIPE, try http://www.ripe.net/ then do some drilling.........

2 1

RE: how to protect name servers against cache corruption
by Dan Dale 30 Jul '97

30 Jul '97

Jeesh people... let's get some life here. Step out and enjoy the weekend will ya??? Upgrade to BIND 8.1.1 and deal with it. Some hack will figure it out and 9.0 will soon be on it's way. DD -----Original Message----- From: Paul A Vixie [SMTP:vixie@vix.com] Sent: Tuesday, July 29, 1997 6:09 PM To: tqbf(a)enteract.com Cc: nanog(a)merit.edu Subject: Re: how to protect name servers against cache corruption > > Noone in the security field has any right to expect any implementation of > > DNS to be secure until DNSSEC is widely implemented. > > > I'm sorry if something I said misled you to believe otherwise. > > So BIND 8.1.1 is NOT "immune" to the poisoned resource-record attack? I > ask because you specifically stated that it was. Sorry to nag, I'd just > like to see this clarified to the operations community. BIND 4.9.6 and 8.1.1 are immune to all known attacks, including the one Eugene Kashpureff copied and put into wide public use recently. I know of attacks we are not immune to, which cannot be stopped without DNSSEC. My paper, whose URL I gave in the previous message, alludes to some of these without exactly giving a road map for their use.

1 0

Tracking cracker, help?
by dlr＠bungi.com 30 Jul '97

30 Jul '97

I'm tracking down an individual that has attacked both my personal site, as well as one of my customers' sites. In this particular attempt, when his 'normal' site was blocked by IP address, he immediately started to use dial-up sites all over his local area, then ranged further into the US. On my system, he had installed a password sniffer. I suspect that this was a common mode of operation for him. Naturally, I logged all of the attempts at the router level. I emailed the logs to the origin ISPs, and (with one notable exception) was met with huge indifference. In the queries, I am asking only for a confirm/deny of the user's name - I am not asking the ISP's involved to release the name of the dialup users. That, of course, will come later. Right now, I'm just trying to confirm that the same individual is launching the attacks. A police report has been filed, and a restraining order will be served tommorow. What's a better way to ask for, and obtain log information in a timely fashion? Wait 6 months for a court trial, when everyone has purged their logs? Clues would be appreciated. -- Dave Rand dlr(a)bungi.com http://www.bungi.com

5 4