Are the Servers of Spamhaus.rg and blackholes.us down?

Hello,
Are this Blacklistservers since x-mas down. We receive in the last days many
errors from this servers...
Exemple enclosed Anonymsed.
Greeting
Xaver

Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.cn-kr.blackholes.us/A' (in 'cn-kr.blackholes.us'?): disabling EDNS
Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.korea.blackholes.us/A' (in 'korea.blackholes.us'?): disabling EDNS
Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.china.blackholes.us/A' (in 'china.blackholes.us'?): disabling EDNS
Dec 31 10:12:38 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.cn-kr.blackholes.us/A' (in 'cn-kr.blackholes.us'?): disabling EDNS
Dec 31 10:12:38 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.korea.blackholes.us/A' (in 'korea.blackholes.us'?): disabling EDNS
Dec 31 10:12:38 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.china.blackholes.us/A' (in 'china.blackholes.us'?): disabling EDNS
Dec 31 10:12:38 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.sbl.spamhaus.org/A' (in 'sbl.spamhaus.org'?): disabling EDNS
Dec 31 10:12:38 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.sbl.spamhaus.org/A' (in 'sbl.spamhaus.org'?): disabling EDNS
Dec 31 10:12:38 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.sbl.spamhaus.org/A' (in 'sbl.spamhaus.org'?): disabling EDNS
Dec 31 10:12:38 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.sbl.spamhaus.org/A' (in 'sbl.spamhaus.org'?): disabling EDNS
D

Hi!

Are this Blacklistservers since x-mas down. We receive in the last days many
errors from this servers...

Exemple enclosed Anonymsed.
Greeting
Xaver

Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.cn-kr.blackholes.us/A' (in 'cn-kr.blackholes.us'?): disabling EDNS
Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.korea.blackholes.us/A' (in 'korea.blackholes.us'?): disabling EDNS
Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.china.blackholes.us/A' (in 'china.blackholes.us'?): disabling EDNS
Dec 31 10:12:38 linux-1ij2 named[14306]: too many timeouts resolving

Is your queuery volume not too high so they simply blocked your servers?

Bye,
Raymond.

blackholes.us has been non-existent for over a year. Their netblocks
were re-allocated and the new owners were getting extremely upset over
people trying to resolve yyy.blackholes.us against their servers. Looks
like it now returns NXDOMAIN.

Can't help you with spamhaus...

Xaver Aerni wrote:

Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.YYY.ZZZ/A' (in 'YYY.ZZZ'?): disabling EDNS

Do you have a firewall in front of this server that limits DNS packets to 512 bytes?

Jason Bertoch <jason@i6ix.com> writes:

Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving
'XXX.YYY.ZZZ/A' (in 'YYY.ZZZ'?): disabling EDNS

Do you have a firewall in front of this server that limits DNS packets to
512 bytes?

statistically speaking, yes, most people have that. which is damnfoolery,
but well supported by the vendors, who think either that udp/53 datagrams
larger than 512 octets are amplification attacks, or that udp packets having
no port numbers because they are fragments lacking any udp port information,
are evil and dangerous. sadly, noone has yet been fired for buying devices
that implement this kind of overspecification. hopefully that will change
after the DNS root zone is signed and udp/53 responses start to generally
include DNSSEC signatures, pushing most of them way over the 512 octet limit.

it's going to be another game of chicken -- will the people who build and/or
deploy such crapware lose their jobs, or will ICANN back down from DNSSEC?

well, having been pushing vendors for a while on this, expect
  at least Checkpoint and Cisco to have corrected solutions fielded
  soon - and RedHat has fixed their DNSMASQ code since it was pointed
  out to them that thier defaults were based on flawed assumptions.

  Not a lost cause - but the inertia of the installed base is huge and
  it will take more than the last six months of work to make a dent.
  It would help if the BIND EDNS0 negotiation would not fall back to the
  512 byte limit - perhaps you could talk with the ISC developers about
  that.

--bill

...

it's going to be another game of chicken -- will the people who build and/or
deploy such crapware lose their jobs, or will ICANN back down from DNSSEC?

Either (a) a large cohort of entries is added to the root before [pick predicate condition of choice, and signing the root is a common one] "foo", or (b) a number of smaller cohorts of entries are added to the root after [pick predicate condition of choice, and signing the root is a common one] "bar".

Security and stability is the last shibboleth in ICANN rhetoric, offered frequently absurdly, e.g., [1], and is one of three fictions [2] which, together with the trademarks issue, constitute the "four overarching issues" which presently prevents the Draft Applicant Guidebook from being final, and therefore, from applications being submitted, and the evaluation system from being exercised under load.

Should "ICANN back down from DNSSEC", the rational for not starting the application rat race would be reduced to trademarks [3]. ICANN appears to be avoiding that for all of 2010 and 2011.

Should "ICANN [not] back down from DNSSEC", the least refutable (by the non-technical community) rational for delay remains controlling, at some cost to businesses that do not invest in issue advocacy at ICANN, and so do not matter in the slightest even if they "go dark".

Eric

[1] ICANN Email Archives: [draft-eoi-model]
[2] The Four Overarching Issues are (1) Intellectual Property and Trademark Protection, (2) Economic Analysis, (3) Security and Stability and (4) Malicious Conduct.
[3] OK, there is another biggie out there, the idiots at CRAI proposed that we junk the registry-registrar separation _and_ let every moron cereal and/or soap trademark portfolio manager suff their brands into the IANA root. The separation issue is really big, as it is a stalking horse for 15 U.S.C. § 1–7. The marks-in-the-root issue should give one pause, not for sizeof(footprint) reasons, but because it is unavoidable that strings in the IANA root will become private property, and because as a string generator, trademarks are an infinite string source.

Date: Fri, 1 Jan 2010 22:16:31 +0000
From: bmanning@vacation.karoshi.com

  It would help if the BIND EDNS0 negotiation would not fall back to
  the 512 byte limit - perhaps you could talk with the ISC developers
  about that.

i don't agree that your proposed change would help with this problem at all.
but in any case nanog isn't the place to ask ISC to change BIND, nor is it
the place to discuss protocol implementation or interpretation. i suggest
bind-users@, bind-workers@, dns-operations@, dnsop@, and/or namedroppers@,
depending on what aspect of your above-described concerns you focus on.

I am looking at the possibility of leasing a ~70 mile run of fiber. I don't have access to any mid point section for regeneration purposes, and so I am wondering what the chances that a 120km rated SFP would be able to light the path and provide stable connectivity. There are a lot of unknowns including # of splices, condition of the cable, or the actual dispersion index or other properties (until we actually get closer to leasing it). Its spare telco fibers in the same cable binder they are using interoffice transport, but there are regen huts along the way so it works for them but may not for us, and 'finding out' is potentially expensive. How would someone experienced go about determining the feasibillity of this concept and what options might there be? Replies online or off would be appreciated.

Thanks.

The first thing you need to do is test the fiber with an OTDR. If you don't have one, you can probably contract a local cabling company to test it for you.

How do you plan to drive transport over the fiber? GE? 10G? >10G? CWDM? DWDM?

To drive a signal that far without a regen somewhere in the middle, your best bet might be something in the xWDM space, and then you can provision labmdas for GE, 10G, etc... There are boxes out there (Ciena, Infinera, Cisco ONS, etc) that can do this.

How do you plan to handle responses to fiber cuts, signal degradation, someone at $telco unplugging the wrong jumper, etc?

jms

That shouldn't be too difficult, especially at only 1G (though pesonally
I can't imagine why you would bother leasing dark fiber for that :P).
There are several ways you could do it, including 120km+ rated SFPs
(iirc there have been 200km SFPs out for a while too), an external
optical amplifier (ideally you'd want to amp in the middle, but with a
single channel you should be fine w/pre-amp), and a digital FEC wrapper
to extend the receive sensitivity. Remember that the distance spec on
optics is mostly a rough guideline, so depending on the fiber conditions
and number of splices/panels along the way you could potentially expect
to get the entire distance out of a "standard" 100km optic.

There was an excellent thread on this list last year about using "unusual"
high power lasers for long range optical networking.

http://www.merit.edu/mail.archives/nanog/2008-10/msg00226.html

Pardon my ignorance in this area but is too much to ask for OTDR data before signing contracts? In addition to data on the make of the fiber if you wanted to do xWDM in the future.

NDAs shall be signed of course....

Yes, it's too much to ask. They won't splice your path until you sign
the contracts and you can't get useful OTDR and loss readings until
the fiber is spliced.

You can probably put an escape clause in the contract that lets you
exit with little or no cost if the readings aren't good enough after
the fact. If you're not time-constrained, you can probably request a
pre-check for a modest fee after main splicing but before trenching to
your endpoints.

Regards,
Bill Herrin

The best OTDR data I have ever gotten prior to signing an agreement for strands is the readings from another pair on the same route. That being said most dark fiber agreements have some sort of minimum performance specifications in them.

John van Oppen
Spectrum Networks LLC
Direct: 206.973.8302
Main: 206.973.8300
Website: http://spectrumnetworks.us

fibre grade / quality, absolutely. otdr is difficult, because fibre
providers usually splice up a specific path for a specific order. This
means that they cannot always provide the otdr without first going to some
trouble and expense. So you may find yourself having to specify acceptable
attenuation limits in advance, then putting in an order and then getting
the otdr + accurate attenuation results after the order has been accepted.
Obviously, you assume some risk in terms of hoping that the optics that you
buy for the circuit will actually do the job.

Nick

Why would you want an OTDR report on the fiber, when an attenuation report is probably more accurate? OTDR is good for locating WHERE a problem is, but if you're seeing .2 dB/km attenuation end-to-end, there is little reason to break out the OTDR.

Also, for 1G there is little reason to worry about dispersion mentioned in the thread, receive power is basically the only thing to worry about.

In my experience the fiber splice/patch-teams have quite accurate estimations on the overall attenuation of unprovisioned paths. They know the distance (0.25dB/km for G.652 @ 1550nm), the number of connectors (0.35dB per plug average here) and splices (0.1dB/spice). YMMV though. We add +20% safety, include an escape clause wherever possible and cross our fingers.

With regards to suggested EDFA amplification tricks and similar: If the requirement is not > 150km@1G or 80km@10G/DWDM then I personally strongly disencourage the use of optical amps. 200km / 41dB 1G SFPs are available with costs way below dual EDFAs plus spare, and the chance for the untrained to get eye damages in the process of implementation is far less. So put some laser googles at around 400 USD/each to the purchase list. If one decides to do so then add a post-amplifier on each *end* of the fiber link to increase the signal before hitting the receiver, and do not pump in star-wars class laser power at the beginning :wink: .

Cheers,

Depends where you buy your EDFAs, I suspect you could probably get them
for less than the cost of a single channel of super long reach optics if
you tried hard enough. If you needed to add DWDM later on, and/or
dispersion compensation for 10G links the EDFAs will be needed anyways,
so sometimes it just makes sense to solve the problem once with an amp
rather than trying to solve it on a per-channel basis.

You're also vastly exagerating the power of what are effectively metro
reach amps, you're really in no danger of making an eye hazard unless
you start slapping on ultra long-haul 1500+km transport gear with class
3B lasers (i.e. you're in far more danger from someone with a green
laser pointer ordered from the Internet :P). Remember that 1550nm is
infrared and very effectively filtered by the human eye, so even a
+17dBm output EDFA (the max output for most metro systems) is still
going to be class 1M and effectively safe as long as you don't stare at
it in a microscope.

With regards to suggested EDFA amplification tricks and similar: If
the requirement is not > 150km@1G or 80km@10G/DWDM then I personally
strongly disencourage the use of optical amps. 200km / 41dB 1G SFPs
are available with costs way below dual EDFAs plus spare, and the
chance for the untrained to get eye damages in the process of
implementation is far less. So put some laser googles at around 400
USD/each to the purchase list. If one decides to do so then add a
post-amplifier on each *end* of the fiber link to increase the signal
before hitting the receiver, and do not pump in star-wars class laser
power at the beginning :wink: .

Depends where you buy your EDFAs, I suspect you could probably get them
for less than the cost of a single channel of super long reach optics if
you tried hard enough.

Respectfully disagree here - been there (googled^H^Hmarket research, talked to both manufactures and resellers for the last year), bought sample and went through lab tests. Still was unable to find trustful/working EDFAs near the cost of a pair of 40dB SFPs. 200km SFPs are even cheaper than 'original' Cisco CWDM-SFPs (standard 80km). We have them on stock for resale (no commercials intended here), so this price indication is near real-time :wink:

If you needed to add DWDM later on, and/or
dispersion compensation for 10G links the EDFAs will be needed anyways,
so sometimes it just makes sense to solve the problem once with an amp
rather than trying to solve it on a per-channel basis.

It depends on the requirement - of course.

When Mike is heading for 10G DWDM demand levels he will probably have to amplify and cromatic-disperse-compensate with 120km G.652 (depending on the transceiver type) in any case. There are plenty of commercial solutions available for such spans, or he can try a building-block approach.

My point is to skip EDFAs in a single 1G 120km fiber setup for commercial aspects, let alone technical reasons (complexity, safety), if there is no requirement for more bandwidth. IMHO even with multiple 1G CWDM-style setups, but your mileage may of course vary.

You're also vastly exagerating the power of what are effectively metro
reach amps, you're really in no danger of making an eye hazard unless
you start slapping on ultra long-haul 1500+km transport gear with class
3B lasers

In Mikes scenario this might be as a +10dB pre-amp would do the trick with low power, but a post-amp (+17dB gain with levels around -20..-30dBm to get some additional power budget) is what I would use if EDFAs are a stringent requirement.

Most new long-haul transport systems have an automatic power-off feature for optical protection (e.g.the splice teams after a fiber cut/disconnect) now because of this.

> (i.e. you're in far more danger from someone with a green

laser pointer ordered from the Internet :P).

Agreed, but failed to save the whales - http://www.youtube.com/watch?v=Tuxf2xJ08Cc

Remember that 1550nm is
infrared and very effectively filtered by the human eye, so even a
+17dBm output EDFA (the max output for most metro systems) is still
going to be class 1M and effectively safe as long as you don't stare at
it in a microscope.

Or stare in the beam at 500mW/27dBm without noticing because it is infrared, and there is no eyelid closure reflex. I tend not to take chances for my colleagues and me but as common knowledge says it is everyones own decision to look into the laser with the remaining good eye.

Cheers,