What's going on with the Routing Table? Seems like everyone is melting down. 27000 routes flapping????? What is everyone else seeing?? Eric _______________________________________________________ Eric D. Madison - Senior Network Engineer - ACSI - Advanced Data Services - ATM/IP Backbone Group 24 Hour NMC/NOC (800)291-7889 Email: noc@acsi.net
On Thu, Apr 17, 1997 at 05:29:17PM -0400, Eric D. Madison wrote:
What's going on with the Routing Table? Seems like everyone is melting down. 27000 routes flapping?????
What is everyone else seeing??
Eric
_______________________________________________________ Eric D. Madison - Senior Network Engineer - ACSI - Advanced Data Services - ATM/IP Backbone Group 24 Hour NMC/NOC (800)291-7889 Email: noc@acsi.net
We have ~800 in the history table, and 92 dampened. That's heavy by normal standards, but not outrageous. There is no significant contributor; it appears there are a half-dozen sources which have flapped enough to get withdrawn, but there is no pattern I can find. -- -- Karl Denninger (karl@MCS.Net)| MCSNet - The Finest Internet Connectivity http://www.mcs.net/~karl | T1's from $600 monthly to FULL DS-3 Service | 99 Analog numbers, 77 ISDN, http://www.mcs.net/ Voice: [+1 312 803-MCS1 x219]| NOW Serving 56kbps DIGITAL on our analog lines! Fax: [+1 312 803-4929] | 2 FULL DS-3 Internet links; 400Mbps B/W Internal
From: "Eric D. Madison" <madison@acsi.net> What's going on with the Routing Table? Seems like everyone is melting down. 27000 routes flapping????? Two hundred, give or take, routes damped. Nothing terribly out of the ordinary. What is everyone else seeing?? Much to my surprise, I'm still on NANOG. I hadn't seen any mail for a while... but upon examination of my rejects file, it looks like my procmail filters are just doing their job. :) ---Rob
There's some most peculiar messages on AGIS' web pages today. In short: 3:00 AM - scheduled Washington D.C. router software update 8:15 AM - report that router had failed at 2:00 AM, making arrangements to replace equipment. 1:40 PM - "AGIS has suffered a concentrated and systematic attack of our network. At this time we cannot provide any further details, except to inform you that a federal investigation is underway, and, that AGIS is assisting in every facet of this investigation. Estimated time of repair is 3:40pm EDT." Huh? I realize that AGIS has had staffing problems, but how often does one call the Feds when a router update messes up? -- John R. Levine, IECC, POB 640 Trumansburg NY 14886 +1 607 387 6869 johnl@iecc.com, http://iecc.com/johnl, "New witty saying coming soon."
We were an old AGIS customer.. I guess we are still on their mailing list. here it is:
AGIS/Net99 (NETBLK-NET99-BLK4) NET99-BLK4 205.198.0.0 - 205.199.255.0 Cyber Promotions Inc (NETBLK-CYBERPROMO-205-199) CYBERPROMO-205-199 205.199.212.0 - 205.199.212.255 Nothing comes without a price. Dima just speculating On Thu, 17 Apr 1997 17:09:46 -0700 (PDT), you wrote:
From all-customers-request@agis.net Thu Apr 17 12:53:44 1997 Return-Path: all-customers-request@agis.net Received: from exosecure.exodus.net (exosecure.exodus.net [209.1.10.206]) by
[...]
Unfortunately, we must inform you that AGIS has suffered a concentrated and systematic attack of our network. At this time we cannot provide any further details, except to inform you that a federal investigation is underway, and, that AGIS is fully cooperating in every facet of this investigation.
[etc etc etc]
I think that speculation holds some merit.
AGIS/Net99 (NETBLK-NET99-BLK4) NET99-BLK4 205.198.0.0 - 205.199.255.0 Cyber Promotions Inc (NETBLK-CYBERPROMO-205-199) CYBERPROMO-205-199 205.199.212.0 - 205.199.212.255
Nothing comes without a price.
Dima just speculating
On Thu, 17 Apr 1997 17:09:46 -0700 (PDT), you wrote:
From all-customers-request@agis.net Thu Apr 17 12:53:44 1997 Return-Path: all-customers-request@agis.net Received: from exosecure.exodus.net (exosecure.exodus.net [209.1.10.206]) by
[...]
Unfortunately, we must inform you that AGIS has suffered a concentrated and systematic attack of our network. At this time we cannot provide any further details, except to inform you that a federal investigation is underway, and, that AGIS is fully cooperating in every facet of this investigation.
[etc etc etc]
On Fri, 18 Apr 1997, Dima Volodin wrote: ==>AGIS/Net99 (NETBLK-NET99-BLK4) NET99-BLK4 205.198.0.0 - 205.199.255.0 ==>Cyber Promotions Inc (NETBLK-CYBERPROMO-205-199) CYBERPROMO-205-199 ==> 205.199.212.0 - 205.199.212.255 ==> ==> ==>Nothing comes without a price. ==> ==> ==>Dima ==>just speculating ==> In addition, one can take a look at the auto-mail sent back from mailing abuse@agis.net... It states that Agis thinks that the internet should be free market, and basically states the idea that "spam is where it's at". They go on to claim that all the high management at AGIS reads abuse@agis.net; however, I'd be willing to lay $5 on the table to say that most of it is procmailed to /dev/null. Craig just speculating
On Fri, 18 Apr 1997, Dima Volodin wrote:
AGIS/Net99 (NETBLK-NET99-BLK4) NET99-BLK4 205.198.0.0 - 205.199.255.0 Cyber Promotions Inc (NETBLK-CYBERPROMO-205-199) CYBERPROMO-205-199 205.199.212.0 - 205.199.212.255
Nothing comes without a price.
Dima just speculating
If you had been following the traffic in news.admin.net-abuse.email over the past couple of months, you would not need to speculate, nor would you be surprised that AGIS has been under attack for several weeks. I certainly don't condone any attacks on AGIS but I think this should be a lesson that Internet users expect a certain standard of behavior from network providers. While there may be no legal imperative to force network providers to ehave in a certain way, the will of the people has a way of making itself felt and we ignore it at our peril. In the final analysis, there is no money to be made from harboring customers that abuse the network. The Internet structure is such that it requires a minimum level of cooperation from providers to even function and activities which directly or indirectly abuse the infrastructure need to be curbed. Fidonet had an interesting pair of commandments that I think applies to other networks as well, such as the Internet: 1) Thou shalt not excessively annoy others. 2) Thou shalt not be too easily annoyed. I'll let you ponder the implications of those two statements on your own. If you are interested in the policy document that stems from these two principles, have a look at http://www.fidonet.org/fidonet/policy4.txt BTW, I'm not at all suggesting that the Internet needs anything like this Fidonet policy, but it does seem to me that network abuse is a social problem, and that a big part of the solution will be to succintly define what is good and what is bad in order to more easily communicate this to others. Michael Dillon - Internet & ISP Consulting Memra Software Inc. - Fax: +1-250-546-3049 http://www.memra.com - E-mail: michael@memra.com
On Thu, 17 Apr 1997 19:03:05 -0700 (PDT), you wrote:
On Fri, 18 Apr 1997, Dima Volodin wrote:
AGIS/Net99 (NETBLK-NET99-BLK4) NET99-BLK4 205.198.0.0 - 205.199.255.0 Cyber Promotions Inc (NETBLK-CYBERPROMO-205-199) CYBERPROMO-205-199 205.199.212.0 - 205.199.212.255
Nothing comes without a price.
Dima just speculating
If you had been following the traffic in news.admin.net-abuse.email over the past couple of months, you would not need to speculate, nor would you be surprised that AGIS has been under attack for several weeks.
No, I hadn't been following the newsgroup - it was the first thing that came to my mind. BTW, thanks for mentioning it - I've checked it out, and I must say that I liked the idea that all this attack-talk is just a cover-up of AGIS's incompetence.
Michael Dillon - Internet & ISP Consulting
Cheers Dima
participants (8)
-
Craig A. Huegen -
dvv＠dvv.ru -
Eric D. Madison -
johnl＠iecc.com -
Karl Denninger -
Michael Dillon -
Robert Bowman -
Robert E. Seastrom