- Test - lists.nanog.org

Re: Good Timing for .COM Problems ?
by Dave Crocker 20 Jul '97

20 Jul '97

At 02:16 PM 7/20/97 -0400, David Mercer wrote: >On Sun, 20 Jul 1997, Paul Trotter wrote: >Seems to me that NSI have shown that their training procedures don't work, That's not the problem. The problem is bad procedures, not the failure to follow them correctly. The procedures should have prevented the operator from installing the update, absent serious overrides. Since it is far, far more dangerous to add a bad update than it is to delay the update, the procedures should have prevented the update as soon as the update data failed any of its validity tests. To override preventative mechanisms should require the intervention of senior operations staff. In other words, besides requiring a positive override, it should require additional staff who are not part of the regular, daily activity. Merely issuing passive alarms that can be ignored is representative of basic ignorance about well-understood operator human factors. I said well-understood. That, of course, means that one must use designers knowledgeable in such matters. NSI didn't. That's a management error, not an operator error. >I personally don't find their assurance that such duties will now be Indeed, you shouldn't. It's more important to change the procedures than it is to change the staff. d/ -------------------- Dave Crocker Internet Mail Consortium +1 408 246 8253 675 Spruce Dr. fax: +1 408 249 6205 Sunnyvale, CA 94086 USA info(a)imc.org , http://www.imc.org Member, interim Policy Oversight Committee http://www.gtld-mou.org

1 0

RE: Good Timing for .COM Problems ?
by Jim Fleming 20 Jul '97

20 Jul '97

On Sunday, July 20, 1997 12:44 PM, Paul Trotter[SMTP:ptrotter@ny.ubs.com] wrote: @ Then perhaps we should question why the "problems" are occuring at a @ time when it would be to NSI's benefit (e.g. future IPO) to show that @ the traditional volunteer method doesn't work. @ It should not be very difficult for NSI (and SAIC) to deploy the necessary, robust TLD servers to handle just the .COM, .NET and .ORG TLDs. It seems logical that their "public" shareholders would want their name servers to be under their control. If they decide to do that, then it would be good to coordinate the changes so that the various Root Name Server Confederations can make the switch at the same time. Since the "volunteers" do not have the registry infrastructure to handle .COM, it seems likely that .COM will go where NSI moves it, if they do. Also, not many (if any) companies have stepped forward to provide alternative TLD name servers for .COM. I would imagine that NANOG members would be alerted to these changes well in advance....although, if done properly, it should not be noticed. Only the Root Name Servers need to be changed and it seems to follow that such changes would happen before next year. -- Jim Fleming Unir Corporation

1 0

Re: DC fiber cut: field report
by Jay R. Ashworth 20 Jul '97

20 Jul '97

On Fri, Jul 18, 1997 at 06:44:21PM -0400, Robert E. Seastrom wrote: > Am I the only one who's a cables and switches weenie enough to know > that the telco's _already do this_? Large numbers of local multi-pair ^^^^^^^^^^^^^^^^ > trunking cables are pressurized with nitrogen, and they put pressure > drop alarms on them, so they know if one takes a hit. > > pressurized nitrogen is usually done to keep moisture out, not so that > they can monitor pressure loss. pressure loss in a fed, very long, > pipe is an extremely local phenomenon anyway. i think there are > spooks at some black agencies that monitor against tapping this way. > but in practice, nitrogen pressurization is only done for copper. Yes. I know. ;-) I'm told they really do pressure loss monitor the local stuff, though, even if more for dryness purposes than cable-break. Cheers, -- jra -- Jay R. Ashworth jra(a)baylink.com Member of the Technical Staff Unsolicited Commercial Emailers Sued The Suncoast Freenet "People propose, science studies, technology Tampa Bay, Florida conforms." -- Dr. Don Norman +1 813 790 7592

1 0

To ListOwner
by Ray O'Keefe 20 Jul '97

20 Jul '97

Attn ListOwner (nanog list) Please remove any and all email addressees at [www.metsys.com] from the nanog list. There are no personal mailboxes at www.metsys.com so any email address coming to this website cannot be correct. Thanks ......... webmaster(a)metsys.com

1 0

IP flooding by using broadcast address
by Edward Henigin 20 Jul '97

20 Jul '97

We're seeing a pernicious sort of DOS attack lately. The attack takes advantage of hosts IP stack implementation, and how it deals with ICMP packets to the broadcast address. Basically, the short and sweet of it is that most hosts will respond to an echo-request to its broadcast address with an echo reply. So imagine this scenario: some disgruntled hax0r forges his source address to be your web server (or shell server, or irc server, or whatever) and sends some broadcast pings to a well populated remote network. His/her ping will be amplified by the number of hosts on the remote network. Here is an example to illustrate: In one window, I did this: (ed) spanky:~$ ping 205.236.175.255 205.236.175.255 is alive (ed) spanky:~$ In another, this: (root) spanky:~# snoop -d isptp0 proto icmp Using device /dev/isptp (promiscuous mode) spanky -> 205.236.175.255 ICMP Echo request toolbox.total.net -> spanky ICMP Echo reply falcon.total.net -> spanky ICMP Echo reply annex-08.mtl.total.net -> spanky ICMP Echo reply 199.166.230.99 -> spanky ICMP Echo reply gig.net -> spanky ICMP Echo reply 205.236.53.122 -> spanky ICMP Echo reply middletown.total.net -> spanky ICMP Echo reply 205.236.53.199 -> spanky ICMP Echo reply server95.total.net -> spanky ICMP Echo reply 205.236.175.20 -> spanky ICMP Echo reply freddy.total.net -> spanky ICMP Echo reply 205.205.162.10 -> spanky ICMP Echo reply tors.accent.net -> spanky ICMP Echo reply lightning.total.net -> spanky ICMP Echo reply c4700-01.mtl.total.net -> spanky ICMP Echo reply as5200-35.mtl.total.net -> spanky ICMP Echo reply newsfeeder.total.net -> spanky ICMP Echo reply annex-03.mtl.total.net -> spanky ICMP Echo reply annex-02.mtl.total.net -> spanky ICMP Echo reply as5200-31.mtl.total.net -> spanky ICMP Echo reply as5200-30.mtl.total.net -> spanky ICMP Echo reply phoenix.total.net -> spanky ICMP Echo reply bretweir.total.net -> spanky ICMP Echo reply 205.236.175.10 -> spanky ICMP Echo reply wacky.total.net -> spanky ICMP Echo reply 205.236.87.200 -> spanky ICMP Echo reply annex-01.mtl.total.net -> spanky ICMP Echo reply annex-10.mtl.total.net -> spanky ICMP Echo reply as5200-06.mtl.total.net -> spanky ICMP Echo reply as5200-33.mtl.total.net -> spanky ICMP Echo reply as5200-13.mtl.total.net -> spanky ICMP Echo reply as5200-34.mtl.total.net -> spanky ICMP Echo reply annex-09.mtl.total.net -> spanky ICMP Echo reply as5200-28.mtl.total.net -> spanky ICMP Echo reply annex-06.mtl.total.net -> spanky ICMP Echo reply as5200-08.mtl.total.net -> spanky ICMP Echo reply as5200-22.mtl.total.net -> spanky ICMP Echo reply as5200-36.mtl.total.net -> spanky ICMP Echo reply as5200-03.mtl.total.net -> spanky ICMP Echo reply cradlerock.total.net -> spanky ICMP Echo reply as5200-26.mtl.total.net -> spanky ICMP Echo reply as5200-37.mtl.total.net -> spanky ICMP Echo reply c4700-02.mtl.total.net -> spanky ICMP Echo reply www.greernet.com -> spanky ICMP Echo reply 199.166.230.69 -> spanky ICMP Echo reply ns2.accent.net -> spanky ICMP Echo reply rizzo.infobahnos.com -> spanky ICMP Echo reply www.webquebec.com -> spanky ICMP Echo reply annex-07.mtl.total.net -> spanky ICMP Echo reply as5200-12.mtl.total.net -> spanky ICMP Echo reply as5200-32.mtl.total.net -> spanky ICMP Echo reply as5200-19.mtl.total.net -> spanky ICMP Echo reply as5200-02.mtl.total.net -> spanky ICMP Echo reply as5200-29.mtl.total.net -> spanky ICMP Echo reply as5200-11.mtl.total.net -> spanky ICMP Echo reply as5200-20.mtl.total.net -> spanky ICMP Echo reply as5200-10.mtl.total.net -> spanky ICMP Echo reply as5200-21.mtl.total.net -> spanky ICMP Echo reply as5200-16.mtl.total.net -> spanky ICMP Echo reply as5200-15.mtl.total.net -> spanky ICMP Echo reply as5200-05.mtl.total.net -> spanky ICMP Echo reply as5200-01.mtl.total.net -> spanky ICMP Echo reply irc.total.net -> spanky ICMP Echo reply as5200-25.mtl.total.net -> spanky ICMP Echo reply as5200-04.mtl.total.net -> spanky ICMP Echo reply squid.total.net -> spanky ICMP Echo reply 205.236.175.12 -> spanky ICMP Echo reply as5200-14.mtl.total.net -> spanky ICMP Echo reply pico.total.net -> spanky ICMP Echo reply c4700-03.mtl.total.net -> spanky ICMP Echo reply nic2.total.net -> spanky ICMP Echo reply under.total.net -> spanky ICMP Echo reply annex-04.mtl.total.net -> spanky ICMP Echo reply 198.168.57.42 -> spanky ICMP Echo reply as5200-09.mtl.total.net -> spanky ICMP Echo reply as5200-24.mtl.total.net -> spanky ICMP Echo reply as5200-27.mtl.total.net -> spanky ICMP Echo reply as5200-23.mtl.total.net -> spanky ICMP Echo reply as5200-17.mtl.total.net -> spanky ICMP Echo reply as5200-18.mtl.total.net -> spanky ICMP Echo reply as5200-07.mtl.total.net -> spanky ICMP Echo reply (I've already been in contact with Total Access Inc, and they were most cooperative in putting filters on their networks to prevent this from happening again.) In the above example, you see that a single echo request resulted in 81 echo replies, an 81x amplification of Internet traffic. A 28.8Kbps Internet connection becomes 2332.8Kbps, about a T1 and a half, worth of bandwidth, when amplified 81 times. You well know that this much traffic is more than enough to peg a small ISP. If one of these fiends either a) enlists the help of a few friends, all on 28.8 connections, or b) does this sort of thing from an open box on a higher speed university connection, well, they can take down even larger ISP's. What you need to do is put filters on your routers to prevent broadcast packets from entering your network. I believe that some networks, like Total Access Inc's, are among a list of "known" networks that can be used as part of a "portfolio", if you will, of networks that can be used to attack other networks. Everyone needs to be doing the following: 1) Keep measured traffic stats, and look at them, using something like MRTG. 2) Filter all broadcast traffic from coming into your network. I believe that it's QUITE rare to have an application that is both *routed* and uses the broadcast address. This is made harder when you VLSM, but I belive the majority of networks are provisioned on an 8 bit boundary, so you can filter 90% of the traffic by filtering to the .255 address. 3) Re-iterating what people have said before, filter outbound traffic to allow only *your* host traffic from getting out. This makes you a responsible Internet citizen, by preventing people from using your network to launch attacks such as this against others. I think it would be very wise of cisco to have a global flag (or at least, a per-interface flag) which would prevent the forwarding of a packet to an all-ones address. If cisco won't add this feature, maybe Ascend will in their GRF, and maybe a few more GRF's will be sold because of it. Thank you for your time. Edward Henigin Engineering Director, Texas Networking, Inc. ed(a)texas.net (512) 427-1655 Alternate POC's for Texas.Net: Michael Douglass Senior Systems Engineer mikedoug(a)texas.net Bill Bradford Systems Administrator mrbill(a)texas.net Jonah Yokubaitis President barron(a)texas.net

3 4

Quote of the day!
by jamie＠comet.net 20 Jul '97

20 Jul '97

From someone-I-can't-name-cuzza-their-job: "MFS is the spawn of satan, it's all a conspiracy to send us back to the dark ages of hand-written communication." jamie jamie(a)comet.net *************************************************************************** For PGP public key, mail me with Subject:GET KEY For random Ambrose Bierce quote, Mail me with Subject: ambrose Support the anti-Spam amendment - Join at http://www.cauce.org/ "Microsoft was invented by domestic terrorists. Remember, it's no longer an import industry."

2 1

default routes on Ciscos
by Nick Lauriat 19 Jul '97

19 Jul '97

Hi there! Just curious if anyone out there knows of a way to configure default routes on a per interface basis on a Cisco. So that different interfaces had different default routes statically defined. Any thoughts? Thanks! Nick Lauriat

5 4

Re: silly tiers; treno
by Barb Dijker 19 Jul '97

19 Jul '97

A sales rep doesn't need the concept of tiers to spread misinformation and have delusions of granduer. Here's a question I got from a potential customer wanting a backup link from us but needing to de-program his boss. >My bosses' major concern is that UUNet claims Sprint as one of their >customers, and he wants proof that the COOP's Sprint connection is not >traveling on the UUNet backbone. I know that we have a dedicated link to >Cheyenne, but what happens after there? Barbara L. Dijker, Executive Director =============================================== Colorado Internet Cooperative Association 2525 Arapahoe Ave E4-280, Boulder CO 80302-6724 Voice: +1 303 443 3786, FAX: +1 303 443 5162 WWW: http://www.coop.net/

1 0

Re: DC fiber cut: field report
by Joe McGuckin 19 Jul '97

19 Jul '97

I thought the nitrogen pressurisation was to keep the copper cables dry...

1 0

Re: tiers? (fwd)
by Danny 19 Jul '97

19 Jul '97

Does everyone agree with this, it's the only response I have received thus far (and according to the list, the sender works for a tier 1 provider). [snip] Tier 1: _Owns the fiber_, Multiple coast to coast paths of significant bandwidth Tier 2: Reseller, Major connections (DS3/OC3) to multiple tier 1 providers. Possibly: Major connections to one (1) tier 1 provider. Tier 3: Everybody else. > > Anyone care to take a stab at what places a provider in > a given "tier-group"? Seems to me as though the large(st) > providers are a bit harsher (naturally) than the smaller > providers.

12 14