- NZNOG - lists.nznog.org

RE: Banking/Hospital Problems and MTU
by rob.edkins＠axon.co.nz 28 Jul '02

28 Jul '02

> > Probably the reason its not on by default, is because it is > not a "fix", > its just a workaround, to work around braindead firewalls > that block all ICMP. > Agreed, it's a hack...but it's not only firewalls that drop ICMP...I came across this a few years ago with a WAN router that was misbehaving between Token Ring and Ethernet segments. > As such there would probably be considerable sacrifice in > performance when > it has to operate - first of all there will have to be a few lost > retransmitions of large MTU packets before it realises > something is wrong, > and then (from Juha's post) it just drops the MTU to 536 for further > communication, which is definately sub optimal, depending on > what the real > maximum MTU of the path is... > Yes, although it will only kick in on these sites that have this problem. It's dynamic on a per connection basis. Overall performance on the majority of connections won't be affected, as the 'ol TCP stack will behave as intended. > If it was on by default, it would hide the real problem, and > nothing would > ever get done about it. > Fixing is always better than working around, but given that ICMP access policy at the far end of the pipe is not something that Joe User usually has a lot of control over, then something that will work is probably better than something that doesn't. (From a user perspective) Unless it has some other negative impact.... Rob -- The information contained in this e-mail message is intended only for the use of the person or entity to whom it is addressed and may contain information that is CONFIDENTIAL and may be exempt from disclosure under applicable laws. If you read this message and are not the addressee you are notified that use, dissemination, distribution, or reproduction of this message is prohibited. If you have received this message in error, please notify us immediately and delete the original message. You should scan this message and any attached files for viruses. Axon Computertime accepts no liability for any loss caused either directly or indirectly by a virus arising from the use of this message or any attached file. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

DNS monitoring update
by Rob Thomas 28 Jul '02

28 Jul '02

Hi, NZNOGers. [ Apologies to those of you who have already seen this on NANOG. ] I have added two additional data collection points to my DNS root name server monitoring. I have also scaled the graphs and added a text only version. You will find it all here: http://www.cymru.com/DNS Comments and feedback are always welcome! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Pictures from Uniforum 2002 Online
by Mark Foster 28 Jul '02

28 Jul '02

Thanks to Eaden and Robert from Opentec - http://opentec.co.nz/uniforum Cheers, Mark. (Please forgive the CrossPosting.) - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Banking/Hospital Problems and MTU
by Simon Byrnand 28 Jul '02

28 Jul '02

At 10:46 29/07/02 +1200, rob.edkins(a)axon.co.nz wrote: >http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q159211& >http://support.microsoft.com/default.aspx?scid=KB;EN-US;q314825& > >Are useful too. > >This fix has been around for at least 4-5 years to my knowledge. >I don't know why it isn't on by default by now, but I guess it wasn't all >that big an issue in the old dial-up world. Probably the reason its not on by default, is because it is not a "fix", its just a workaround, to work around braindead firewalls that block all ICMP. As such there would probably be considerable sacrifice in performance when it has to operate - first of all there will have to be a few lost retransmitions of large MTU packets before it realises something is wrong, and then (from Juha's post) it just drops the MTU to 536 for further communication, which is definately sub optimal, depending on what the real maximum MTU of the path is... If it was on by default, it would hide the real problem, and nothing would ever get done about it. (I can see it now - "our Bank site works fine for MS operating systems, its only those weirdo's that run Linux that have problems because they don't have PMTUBHDetect" :) For once MS got something right by not making it on by default... Regards, Simon - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Banking/Hospital Problems and MTU
by rob.edkins＠axon.co.nz 28 Jul '02

28 Jul '02

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q159211& http://support.microsoft.com/default.aspx?scid=KB;EN-US;q314825& Are useful too. This fix has been around for at least 4-5 years to my knowledge. I don't know why it isn't on by default by now, but I guess it wasn't all that big an issue in the old dial-up world. > > http://www.microsoft.com/windows2000/techinfo/reskit/en/cnet/c > nbc_imp_yvjd.htm > > has more details. > > -- The information contained in this e-mail message is intended only for the use of the person or entity to whom it is addressed and may contain information that is CONFIDENTIAL and may be exempt from disclosure under applicable laws. If you read this message and are not the addressee you are notified that use, dissemination, distribution, or reproduction of this message is prohibited. If you have received this message in error, please notify us immediately and delete the original message. You should scan this message and any attached files for viruses. Axon Computertime accepts no liability for any loss caused either directly or indirectly by a virus arising from the use of this message or any attached file. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Banking/Hospital Problems and MTU
by rob.edkins＠axon.co.nz 28 Jul '02

28 Jul '02

There's a somewhat simpler reg hack on Windoze. Set HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnablePMTUBHDetect to 1 This enables automatic 'Black Hole' router detection and triggers automatic MTU scaling. BTW, the 'Don't Fragment' Bit is on by default with Windows. Rob > > How incredibly serendipitous. I just ran into this problem > at work the > yesterday. The service techs. for our digital radiology > system came in > and applied the latest service update. All of a sudden users weren't > able to log in via their browser loaded Java client. Funny thing is, > these guys spent 2 days trying to figure out the problem before > resorting to asking "the network guy"... one of those pride things I > guess. > > Some quality time (15 minutes) with tcpdump (well, windump) showed the > DF bit being set and repeated acknowledgment requests during the > "hang". After a modest amount of investigation and a few phone calls > the following was found: > > 1. a remote firewall blocking all ICMP (the admin won't change it) > 2. a router somewhere in the path with a lower MTU requirement > 3. a software upgrade forcing the DF bit to be set (developer won't > change it) > > Lowering the MTU on the client end fixed the problem; > however, I need to > get the registry hack distributed across ~500 desktop and all > potentially have different interface descriptions in the > HKLM/system/current control set/service/ ...what a PITA. > > > -- The information contained in this e-mail message is intended only for the use of the person or entity to whom it is addressed and may contain information that is CONFIDENTIAL and may be exempt from disclosure under applicable laws. If you read this message and are not the addressee you are notified that use, dissemination, distribution, or reproduction of this message is prohibited. If you have received this message in error, please notify us immediately and delete the original message. You should scan this message and any attached files for viruses. Axon Computertime accepts no liability for any loss caused either directly or indirectly by a virus arising from the use of this message or any attached file. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Domainz falling prey to spambots?
by Simon Byrnand 28 Jul '02

28 Jul '02

Hi Everyone, I've just noticed a disturbing trend in the last few days. I've started receiving considerable spam to an address (which is actually just an alias) which we *only* use as the technical contact address when registering new domains with domainz. (I won't say what it is in this forum, least I make life easy for any spambots that havn't found it yet :) Email is *never* sent from this address, it is *not* on any of our web pages or used in way except to be listed as technical contact. (In case anyone just looked up our own domain, that is not the contact address in question, we've only been using it for registrations in the last couple of months) This poses the question - just how have the spambots got hold of it ? Maybe they got lucky, and guessed it, but I don't think so. That leaves the domainz website, and whois servers. For a spambot to be able to find contact details of a domain, it would have to know the domain existed in the first place, as to my knowledge domainz don't provide a "list" of domains they have in their registry for exactly this sort of reason. And yet only a few months ago there was the case of the disreputable Australian registry that somehow managed to get a list of a large number of .co.nz's and their contact details, presumably through some kind of automated queries. I'm curious if anyone else has received spam to an address they know for certain is only used as contact details on domains registered at domainz... Regards, Simon Byrnand iGRIN Internet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Banking Problems and MTU
by Craig Whitmore 28 Jul '02

28 Jul '02

I was wondering what people think about this latest story.. http://www.idg.net.nz/webhome.nsf/UNID/4AA2988B4A1835C5CC256BFF0014A6A8!ope… (a more technical expanation from Cisco of the problem http://www.cisco.com/warp/public/105/56.html) I've noticed this problem for ages (for example the ASB's site) when viewing their pages via a GRE tunnel (or the inability to). Is blocking _all_ ICMP types the wrong thing to do? (in paticular type 3 (unreacable), subtype 4(needs fragmentation) for PMTU Discovery) and basiclly breaking their website for people who have paths who get fragmented TCP/IP Packets) Thanks Craig Whitmore

11 15

Are you lame? :)
by Rob Thomas 26 Jul '02

26 Jul '02

Hello, NZNOGers. [ Apologies to those of you who have already seen this post on NANOG. ] I recently came across a web site belonging to Justin McNutt that lists all of the lame delegations his name servers have detected. This is a great way to share some clue and keep track of errant domains. I have received his kind permission to mimic his efforts using data collected from three of my name servers. I will update this page weekly, and you will find it here: http://www.cymru.com/DNS/lame.html Justin's page is available here: https://dnps-linux2.telecom.missouri.edu/~mcnuttj/lame.html The DNS root name server statistics are still available, and have moved here: http://www.cymru.com/DNS/dns.html My thanks to the authors of the lamers.sh script, which I modified to suit my purposes. Comments and feedback are always welcome! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

OT but desperate!
by PhoneNet 25 Jul '02

25 Jul '02

I'vspent several hours today tryingt o find info on how to get past an old Compaq deskpro's setup password so I can alter the system setup for a friend - any one know if it can be done? I've tried disconnecting the CMOS jumper but despite it losing the config the sytem password stuff still comes up and I figure its a ssociated with the compaq's diagnostics partition some how .... Can't find anyhting on the internet and I'm so frustrated I'm going home! - something fo rthe night owls to ponder? Ian PhoneNet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0