HDTenEightyP/NetNews huggingface dataset:
Organization: Arizona State University
Date: Tuesday, 21 Jul 1992 09:03:43 MST
From: Shahjehan Khatri <IDSAK@ASUACAD.BITNET>
Newsgroups: comp.protocols.tcp-ip.domains,comp.protocols.tcp-ip
Subject: Intermittent "Host Unknown" problem

We're getting problems such as the following, intermittently:

VTVM1.CC.VT.EDU unable to deliver following mail to recipient(s):
    <USER@ospnov.vprc.asu.edu>
550 Host 'ospnov.vprc.asu.edu' Unknown

I found out the following by using Multinet NSLookup on one of our VAXes:

> ospnov.vprc.asu.edu
Server: dcssvx.cc.vt.edu
Address:  128.173.4.247

Non-authoritative answer:
ospnov.vprc.asu.edu     preference = 10, mail exchanger = cncsnov.INRE.ASU.EDU

Authoritative answers can be found from:
ASU.edu nameserver = ASUVAX.EAS.ASU.EDU
ASU.edu nameserver = CCNUCB.COLORADO.EDU
cncsnov.INRE.ASU.EDU    internet address = 129.219.9.85
ASUVAX.EAS.ASU.EDU      internet address = 129.219.30.5
CCNUCB.COLORADO.EDU     internet address = 128.138.238.34

However, yesterday morning this server was saying that it couldn't find
ospnov, but it found facmgt.inre.asu.edu alright.  The later domain is an
identical entry in the asuvax server, as shown below:

> server asuvax
Default Server:  asuvax.ASU.EDU
Address:  129.219.30.5

> ospnov.vprc.asu.edu
Server:  asuvax.ASU.EDU
Address:  129.219.30.5

ospnov.vprc.asu.edu     preference = 10, mail exchanger = cncsnov.INRE.ASU.EDU
cncsnov.INRE.ASU.EDU    internet address = 129.219.9.85
> facmgt.inre.asu.edu
Server:  asuvax.ASU.EDU
Address:  129.219.30.5

facmgt.inre.asu.edu     preference = 10, mail exchanger = cncsnov.INRE.ASU.EDU
cncsnov.INRE.ASU.EDU    internet address = 129.219.9.85

Please note that dcssvx.cc.vt.edu is not the only server that can't find
ospnov. every now and then.  Yuma.acns.colostate.edu, for instance, has run
into the same difficulty.  Actually, sometimes dcssvx. can find ospnov. but
yuma. cannot.

Any replies will be greatly appreciated.

Khatri@PCMAIL.INRE.ASU.EDU
IDSAK@ASUACAD

Newsgroups: comp.protocols.tcp-ip.domains
From: jnford@argos.weeg.uiowa.edu (Jay Ford)
Subject: Re: Service Load Balancing
Keywords: shuffle records
Reply-To: Jay Ford <jay-ford@uiowa.edu>
Organization: Weeg Computing Center, University of Iowa, Iowa City, IA, USA
Distribution: na
Date: Fri, 31 Jul 1992 00:00:27 GMT

In article <dm2xazj@rpi.edu>, finkej@ts.its.rpi.edu (Jon E. Finke) writes:
|> I see a couple of ways of doing this.   Someone mentioned "shuffle" records,
|> which I assume result in a single address being returned per query, but
|> the address stepping through a list of addresses for later queries.  This
|> would take a hack to named, and might go part of the way to meeting the
|> need.

I asked about a BIND rotary capability a while ago, and received a pointer to
some code which does the shuffle address records.  It works for us.  The note I
received follows my signature.  If you have trouble tracking down the code, let
me know and I'll try to package it up for you.

------------------------------------------------------------------------
Jay Ford, Weeg Computing Center, University of Iowa, Iowa City, IA 52242
jay-ford@uiowa.edu (or jnford@handlebar.weeg.uiowa.edu), 319-335-5555


To: jay-ford@uiowa.edu
Cc: bind@vangogh.CS.Berkeley.EDU
Subject: Re: rotary cabability for named? 
             <9112121724.AA08699@handlebar.weeg.uiowa.edu> 
Date: Sat, 14 Dec 91 21:11:18 -0500
From: Bryan Beecher <bryan@notorious.rs.itd.umich.edu>

> A while ago someone mentioned that they had developed a rotary capability for
> named, allowing it to cycle through a group of addresses when asked about a
> name.  I thought I stashed the note away for future use, but now I can't find
> it, and the future seems to be here because I need it now.
>  
> I would appreciate any pointers to the code to do this.  I'm certain that it
> exists;  I just can't find it.

You might be thinking of our shuffle-A (SA) records.  Have a look on
terminator.cc.umich.edu in /unix/dns.  There is a short write-up on
them, and there is a version of BIND 4.8.3 that supports them (and
includes patches that have been posted).
						-- bryan
Newsgroups: comp.protocols.tcp-ip.domains
From: finkej@ts.its.rpi.edu (Jon E. Finke)
Subject: Service Load Balancing
Keywords: shuffle records
Organization: Rensselaer Polytechnic Institute, Troy, NY
Distribution: na
Date: Thu, 30 Jul 1992 21:06:09 GMT

I am hoping that someone has solved this problem (and has code available)
allready.  (Since it is no way unique to my site.....)

We want to be able to provide some amount of "load balancing" between
service machines of some sort.  For the sake of discussion, this could
be a group of "Unix Timesharing" machines, that we want to have appear
as a single service to our users.   One approach we have considered is
to have the name service do the distribution for us, essentially giving
one of a group of addresses for each query.  I assume we would have the ttl
cranked way down to avoid caching the same answer.  

I see a couple of ways of doing this.   Someone mentioned "shuffle" records,
which I assume result in a single address being returned per query, but
the address stepping through a list of addresses for later queries.  This
would take a hack to named, and might go part of the way to meeting the
need.

A more sophisticated system, could take some kind of "load" information for
someplace else, and return addresses to load balance on actual conditions
at the time.   Determining how to measure the "load" for the system is a 
different problem.  One kludge for this, would be to delegate to a fake
name server (or a small one that gets restarted frequently with updated RR
files.)

Does anyone have pointers to working examples of either of these systems?
Ideally they would work on a sun3 or sun4 system, or on an RS/6000
running aix 3.2 (although all of my current servers are suns running bind 4.8.1)

Thanks in advance...



-- 
Jon Finke                              finkej@rpi.edu
Senior Network Systems Engineer        USERB239@RPITSMTS.BITNET
Information Technology Services        518 276 8185 (voice)
Rensselaer Polytechnic Institute       518 276 2809 (fax)
Organization: Ministry of Education, Computer Center NETNEWS system V2.3
Date: Tuesday, 28 Jul 1992 12:57:16 EST
From: <SURU@TWNMOE10.BITNET>
Newsgroups: comp.protocols.tcp-ip.domains
Subject: problems with legal network numbers

Dear Netters,

    We have problems with some legal IP network numbers which NSFNET
refuses to put them in the core gateway. Why? We have been allocated
several dozen class B and over 200 class C network numbers. And the
authority for the NSFNET refuses to put most of the class C network
numbers in the core gateway. Does that mean we can't use those network
numbers?

    I have a solution to this problem though not good :

    1. Spilit our network into two topological parts, A for networks
       with their network numbers registered in NSFNET and B for
       those not registered in NSFNET.

    2. Set up two mail gateways, Gin and Gout, in part A.

    3. Allocate a dummy domain, dummy.TW, for hosts in part B.

    4. Add only a MX RR for dummy.TW such as "*.dummy.TW. MX 0 Name-for-Gin"
       in the name server for domain TW.

    5. Set up a bogus root name server in part B containing a lot of MX
       RRs for domain Edu, Com, Net,... as follows:

                *.Edu. MX 0 Name-for-Gout
                *.Com. MX 0 Name-for-Gout
                *.Net. MX 0 Name-for-Gout
                           .
                           .
                           .
                *.Edu.TW MX 0 Name-for-Gout
                *.Gov.TW MX 0 Name-for-Gout
                *.Net.TW MX 0 Name-for-Gout

    6. Gin query the bogus root name servers in Part B and Gout query the
       normal name server in Part A for resolution. Then Gin will forward
       mails to hosts in Part B, and Gout will forward mails to the
       outside world.

    7. Hosts in Part B can still access (telnet, ftp, ...) hosts in Part
       A (not the whole Internet) by IP address and vice versa.

    Any suggestion or comment will be very much appreciated.

Regards,  --Liu
From: gbarnet@uswnvg.com (Gary Barnette)
Newsgroups: comp.protocols.tcp-ip.domains
Subject: Question about routers and resource records
Date: 29 Jul 92 22:58:59 GMT
Distribution: usa
Organization: US West NewVector, Inc., Bellevue, WA
Originator: gbarnet@fred.uswnvg.com


Need some help-

One of our network people wants to have only one
hostname associated with each router but still
be able to assign addresses to the various interfaces.

I noticed in the DNS docs that this is possible if
the name field is left blank. When this happens the
address is associated with the previous resource name.
The documentation does not explain, however, if that
is indeed the purpose of this feature.

I would welcome any comments or caveats concerning
this configuration plan.


Thanks to all who contribute,

Gary Barnette
US West NewVector
gbarnet@uswnvg.com
From: anonymous
Newsgroups: comp.protocols.tcp-ip.domains
Subject: TESTING
Date: 29 Jul 92 16:41:35 GMT
Reply-To: anonymous
Distribution: world,local
Organization: University of Anonymous


This is a test
Newsgroups: comp.protocols.tcp-ip.domains,comp.protocols.tcp-ip
From: rickert@mp.cs.niu.edu (Neil Rickert)
Subject: Re: Intermittent "Host Unknown" problem
Organization: Northern Illinois University
Date: Tue, 21 Jul 1992 17:35:20 GMT

In article <92203.090343IDSAK@ASUACAD.BITNET> Shahjehan Khatri <IDSAK@ASUACAD.BITNET> writes:
>We're getting problems such as the following, intermittently:
>
>VTVM1.CC.VT.EDU unable to deliver following mail to recipient(s):
>    <USER@ospnov.vprc.asu.edu>
>550 Host 'ospnov.vprc.asu.edu' Unknown

  According to NS.NIC.DDN.MIL there are two nameservers for your
domain:


;; ANSWERS:
asu.edu.	172800	NS	ASUVAX.EAS.ASU.EDU.
asu.edu.	172800	NS	CCNUCB.COLORADO.EDU.

 Your problems are due to a gross inconsistency between the records being
reported by CCNUCB.COLORADO.EDU and ASUVAX.EAS.ASU.EDU.  Any nameserver
attempting to resolve an address such as:
	ospnov.vprc.asu.edu
could contact either of these servers.

 The inconsistency could be caused by broken software.  However the most
likely explanation is a failure to always increment the SOA serial
number whenever there is any change in data.  Your secondary server at
CCNUCB examines the SOA serial number.  If it is unchanged, it presumes
that the data is unchanged, and does not make a new copy of your
data.

Newsgroups: comp.protocols.tcp-ip.domains
From: minnich@wind.es.dupont.com (Mike Minnich)
Subject: 2-level forwarders
Organization: DuPont Experimental Station
Distribution: na
Date: Thu, 30 Jul 1992 18:35:36 GMT

I've got a question around the use of the "forwarder" mode of bind.

Let's say I have a bind server that can talk to the Internet, and several
other bind servers responsible for various subdomains that cannot:

[internet]
  |
  |
bind server #1
(primary foo.com)
(secondary a.foo.com)
(secondary b.foo.com)
  |
  |
[other gateways]
  |
  |
bind server #2				bind server #3			...
(primary a.foo.com)			(primary b.foo.com)
(secondary foo.com)			(secondary foo.com)
(forwarder bind server #1)		(forwarder bind server #1)

Initial testing shows that server #2 resolves
queries within b.foo.com by sending a recursive query to server #1 if
the complete answer is not cached in #2.  One would expect that since
#2 is secondary for foo.com it has knowledge of the NS records
and therefore ought to ask #3 directly.

Is there an alternative configuration that would achieve the desired effect?

--
Mike Minnich				minnich@wind.es.dupont.com
From: rickk@endeavor18.NoSubdomain.NoDomain (Rick Krull)
Newsgroups: comp.protocols.tcp-ip
Subject: Cheap router S/W
Date: 27 Jul 92 22:54:02 GMT
Reply-To: rickk@orca.wv.tek.com
Organization: tekronix

I want to put simulate a poor to bad network for testing network devices.
My current thoughts run toward a router that I can reprogram to do drops,
duplication, etc.  This would leave me with native code on all other
devices, which is what I'm trying to test anyway.

I remember PCroute sometime back, that sounded fine, but I also don't
remember if source was part of the deal.

Rick Krull
Tektronix
Newsgroups: comp.protocols.tcp-ip
From: bob@MorningStar.Com (Bob Sutterfield)
Subject: Re: Firewall usage
Organization: Morning Star Technologies
Date: Wed, 29 Jul 1992 13:36:10 GMT

In article <Bs3vCz.K13@cs.columbia.edu> ji@cs.columbia.edu (John Ioannidis) writes:
     - A firewall only protects you against *known* external threats. 

Our firewall is set up conversely: it permits only traffic that's
strongly suspected (notice I didn't say "known") not to be a threat.
It's configured to give our internal users maximal access to the rest
of the world, to give the rest of the world the sort of access to our
net and hosts that we want them to have, and to ease our burden in
managing systems from dozens of vendors.

I'm not a lazy or unconscientious system/network administrator, I'm a
wily one.  This strategy reduces the size of my problem domain, makes
my network manageable with limited staff resources, and lets me go
home at night to my wife and kids when I otherwise spent evenings in
the office, chasing crackers.
Newsgroups: comp.protocols.tcp-ip
From: imp@solbourne.com (Warner Losh)
Subject: Re: SMTP mail
Organization: Solbourne, User Interface Group
Date: Wed, 29 Jul 1992 16:55:46 GMT

In article <92211.092548KKEYTE@ESOC.BITNET> Karl Keyte
<KKEYTE@ESOC.BITNET> writes:
>& that's not a security hole?

No.  It is an authentication hole.  It's not as if it give anybody
unauthorized access to your machine, or prevent others from accessing
your machine.

>It is if you want to believe mail that you receive.
>Paper mail is usually signed.  The point is, SMTP is stupidly
>simple (as we all know) in it's "authentication".  My question still
>stands.

SMTP is does not provide any authentication.  Neither does paper mail.
It is quite easy to forge both, but they are the best that we have
right now.  How do you know that the signature in paper mail is cool
or not?  Some people that you communicate with all the time maybe, but
just a random piece of mail?  SMTP is the same way.  Its message have
a weak "signature" on them in the form of Received: lines.

You might want to investigate using an RFC931 server.  It will make it
harder to forge the mail.

You might also want to see what the state of the art in PEM is these
days.  PEM doesn't prevent forgeries, but it does have a much stronger
digitial signature coded into the message itself.

There is absolutely NOTHING that you can do that will prevent all
kinds of forgeries.  There are things that you can do to make it
harder to forge mail, but NOTHING is 100% secure.

Warner
-- 
Warner Losh		imp@Solbourne.COM
Interview Horror Story #882: "It's pretty informal around here.
Thursdays are clothing optional.."
From: reece@eco.twg.com (Reece R. Pollack)
Subject: Re: ATT 3B2 Hop Counter
Reply-To: reece@eco.twg.com (Reece R. Pollack)
Organization: The Wollongong Group (East Coast Operations)
Date: Tue, 28 Jul 92 15:43:42 GMT


In article <1992Jul27.161124.17031@wdl.loral.com>, wrl@wdl1.wdl.loral.com (Bill Lewandowski) writes:
|>We have a user with a ATT 3B2 computer. We think we have a problem
|>with data packets taking more than 16 hops through the NSFNET
|>T3 network and the MILNET and the 3B2 is ignoring them because >16.
|>
|>Anyone know how I can increase the hops to a normal 32 or so.
|>
|>I don't have the computer here so I can't read any manuals so
|>any help is really appreciated.

In the system IP configuration file '/etc/master.d/ip' there is a
definition:

	IP_TTL = 0xf

Change this to whatever hexadecimal value you deem neccesary and
reboot using '/etc/system' to rebuild the kernel.

--
Reece R. Pollack
Senior Software Engineer
The Wollongong Group, Inc.
From: barmar@think.com (Barry Margolin)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: IP Directed Broadcast
Date: 30 Jul 1992 19:54:39 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
NNTP-Posting-Host: telecaster.think.com

In article <11132@crackers.clearpoint.com> martillo@stars.clearpoint.com (Joachim Martillo) writes:
>If a networks gateways do not filter IP broadcasts and that network
>has active loops in its subnet topology, and if someone extern to the
>network sends a directed broadcast to that network with a TTL of 255,
>the target network could easily suffer a major broadcast storm.
>
>Such a storm would seem a bad thing.  Maybe I am missing something,
>but perhaps filterning directed broadcasts should be obligatory rather
>than optional.

This is why they are allowed to filter them out.  They aren't required to
filter them because they don't cause a problem on non-subnetted networks
(e.g. directed broadcasts to a subnet of a subnetted network), networks
without active loops, or networks where the routers compute a spanning tree
to prevent broadcast loops (cisco Brouters have this option).  Why actively
prohibit something when there are reasonable ways of making use of it?

Routers that support forwarding of directed broadcasts should have a way to
disable it, so that networks where it will cause storms will not be
susceptible to this.  It should probably even be off by default.  But
network administrators should be able to enable it if they want.
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar
Newsgroups: comp.protocols.tcp-ip
From: mjr@hussar.dco.dec.com (Marcus J. "will do TCP/IP for food" Ranum)
Subject: Re: Terminology for firewalls (was Re: Firewall usage)
Organization: Digital Equipment Corporation, Washington ULTRIX Resource Center
Date: Sun, 26 Jul 1992 21:36:53 GMT

>Firewall - a combination of a security policy with some of the components
>	above. Specifically, an implementation of the given policy that
>	is enforced by a combination of screening and/or routing.

	I should have mentioned that I believe that a "policy" needs to be
something coherent and consistent that is more or less regular. I don't
believe that a firewall can be implemented successfully by just plugging
onto the network and disabling a bunch of stuff until it "works". I'm
as far from a theoretical kind of guy as I think you can get, but I really
think it's very important here to have a clear statement of the goals of
the firewall before any connection is undertaken.

	Simply dividing the overall philosophy of the firewall into one
of these two categories or the other will make a huge difference:
"everything not expressly forbidden is permitted"
"everything not expressly permitted is forbidden"

	Consider that in the latter case, the administrator's life is
(hopefully!) easier - we tilt instinctively towards more security. In
the former case, the user's life is usually easier - they are free to
do anything that they can think of that the administrator has not
identified as a security risk and blocked.

mjr.
Newsgroups: comp.protocols.tcp-ip
From: cws@vax.ftp.com  (Cris Shuldiner)
Subject: Re: ODI and Clarkson driver spec
Nntp-Software: PC/TCP NNTP
Reply-To: cws@ftp.com
Organization: FTP Software, Inc., Wakefield, MA
Date: Tue, 21 Jul 1992 07:36:28

In article <1992Jul20.170533.19619@pacdata.uucp> johnr@pacdata.com (John Reed) writes:

    
    
    Would a kind soul point me in the right location to find the
    ODI (Open Data-link Interface) specification and the
    Clarkson Packet Driver specification.
    
Actually it is the FTP Packet Driver Specification and it can be
found on vax.ftp.com in the pub directory.  There are three copies
there:  packet-d.ascii (plain text), packet-d.mss (FinalWord Format),
and packet-d.prn (HP-GL Format).

				Cris.


Newsgroups: comp.protocols.tcp-ip
From: vjs@rhyolite.wpd.sgi.com (Vernon Schryver)
Subject: Re: Firewall usage (was: Re: ping works, but ftp/telnet get "no route)
Organization: Silicon Graphics, Inc.  Mountain View, CA
Date: Fri, 31 Jul 1992 05:11:55 GMT

In article <1992Jul31.000924.7528@decuac.dec.com>, mjr@hussar.dco.dec.com (Marcus J. Ranum) writes:
> drw@euclid.mit.edu (Dale R. Worley) writes:
> 
> >I haven't studied the matter, but I believe that the more
> >sophisticated firewalling routers actually *do* track connections.
> 
> 	I prefer to use a somewhat different approach in general. First
> you determine the services that your users have a clear business need
> for. Then you develop an application gateway that "knows" that protocol
> and can give you decent access control, logging, and piggy-back blocking.
> This is much more secure (in my opinion) since you preserve the "that which
> is not expressly permitted is prohibited" doctrine and you can incorporate
> appropriate per-protocol authentication or authorization as needed.


The meaning I infer for "piggy-back blockin" seems formally
impossible.  Does it mean preventing people from using permitted
facilities for impermissible things?  Such as piggy-backing a full
featured "gateway" on top of rlogin?

Consider the recent talk of running SLIP over email over UUCP over
DECNET over x.25 over mirrors, or some such.


There is code floating around that does what its name, "gateway,"
implies with an rlogin or telnet session through a firewall.  We
recently encountered a version with a different name (it's trivial to
write from scratch) that a "security expert" (sic) from a major network
provided had "helped" a naive, trusting, related employee install.  The
thing let people from that network provider's network by pass the
sgi.com firewall.  The turkey could not understand why we considered
him no different from any other bad guy who had tried to punch a hole
through the firewall.  He only admitted guilt in having his code
go crazy and eat up all of the processes allowed "guest".

Who will guard the guardians?


Vernon Schryver,  vjs@sgi.com
From: emv@msen.com (Edward Vielmetti)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: ftp network programming
Date: 21 Jul 92 18:46:39 GMT
Organization: Msen, Inc. -- Ann Arbor, Michigan
NNTP-Posting-Host: nigel.msen.com
X-Newsreader: Tin 1.1 PL3

mark@homebase.vistachrome.com (Mark Alexander) writes:
: I am trying to learn how to write a C program which uses the 
: socket library to connect to a remote ftp server and negotiate
: file transfers.  I am having a bit of a hard time although I
: believe I understand a good deal of what needs to be done.

look at
- "ftpget", from ftp.uunet.ca
- "mirror", from a number of sites including
	ftp.uu.net:networking/archival/mirror

the first is in C, the 2d is in perl, both of them speak FTP and
deal with file transfers.

you might also take a peek at 
	alex.sp.cs.cmu.edu:/
and take a look at Vince Cate's "alex" system, which builds a file
system on top of FTP servers.

	--Ed
Newsgroups: comp.protocols.tcp-ip
From: vjs@rhyolite.wpd.sgi.com (Vernon Schryver)
Subject: Re: SMTP mail
Organization: Silicon Graphics, Inc.  Mountain View, CA
Date: Wed, 29 Jul 1992 18:53:02 GMT

In article <92211.092548KKEYTE@ESOC.BITNET>, KKEYTE@ESOC.BITNET (Karl Keyte) writes:
> >>
> >>The SMTP has recently been removed at our site because of its well-known
> >>security hole.
> >
> >  It is well known that email can be forged.  Most people don't consider
> >this a security problem, although it may present an identification
> >problem.  If you consider email forgery a security hole, then I presume
> >you have also shut off all paper mail, which can just as easily be
> >forged.
> >
> 
> & that's not a security hole?  It is if you want to believe mail that you
> receive.  Paper mail is usually signed.  The point is, SMTP is stupidly
> simple (as we all know) in it's "authentication".  My question still
> stands.


If you do not use SMTP, you will not get a lot of mail.

If you require the other end of TCP/IP or UDP/IP connections over the
Internet to be really authenticated, you can get by with a very low
speed link.

There is PEM, Privacy Enhanced Mail, which involves digital signatures
to authenticate mail.  It is based on SMTP, so you might find it
unacceptible.


Vernon Schryver,  vjs@sgi.com