May 1998 - NANOG - lists.nanog.org

Re: BGP & CIDR blocks
by dharvey＠dataplace.net 07 May '98

07 May '98

We just had the same problem with ANS. It took them almost two weeks to address the issue. They even told me that it was fixed several time, even though it had not been. Drake Harvey Manager, Internet Technologies DPNet.Net dharvey(a)dataplace.net Is it unreasonable of me to think it's awfully backwards of ANS.NET to require anyone getting a new CIDR block to physically call ANS's NOC and say "please listen to routes for this block from this AS"? First they told me "we don't trust BGP, so we use the various routing registries to build our routing tables." So I got our new block and our AS in radb.ra.net. A few days (and an ANS routing table update or two) go by, and still we have no connectivity to ANS. Then I get an email from them asking me to please call thier NOC to verify that they really should listen to our route. Isn't the point of BGP that you don't have to manually take care of routing updates? Are there other backbones I need to call to make sure they see our routes? ------------------------------------------------------------------ Jon Lewis <jlewis(a)fdt.net> | This space reserved for routing Network Administrator | update confirmations. Florida Digital Turnpike | ______http://inorganic5.fdt.net/~jlewis/pgp for PGP public key____

1 0

Re: Routing Policy and http://rs.arin.net/ip-allocation.html
by Michael Gibson 07 May '98

07 May '98

As part of Canadian Internet Community, we have been following the CIDR guidelines. We also do not route IPs from other CIDR blocks. Michael Gibson Sr. Network Admin - Netcom Canada -----Original Message----- From: Michael Dillon <michael(a)memra.com> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Wednesday, May 06, 1998 5:13 PM Subject: Re: Routing Policy and http://rs.arin.net/ip-allocation.html >On Wed, 6 May 1998, Mark Kent wrote: > >> That is the wrong question to ask. The real question is who has been >> handing out 206.116/16 like they were dealing cards? A quick look >> at the announcments and in whois.arin.net reveals a bunch of /24 >> spread out over Canada. > >This is because historically, addresses in Canada were handed out without >regard to CIDR even after everyone else was doing CIDR allocations. A >couple of years ago the Canadian IP registry was shut down and allocations >since that time have followed CIDR guidelines more closely. If you want to >see an excellent example of the kind of things that used to happen, have a >look at "whois -h whois.arin.net 199.166.227". In 1994 I applied for a >CIDR block of two Class C's, i.e. a /23 and this is what I got. Look >closely now... If you still can't see the problem try writing both /24's >in binary one above the other. > >> Historically, and currently, the Canadians crowd the top of >> the Tony Bates cidr list. Why is that? > >Part of it is because of the above allocation problem but another large >part of the problem is a severe lack of clue. Not enough Canadians go to >NANOG meetings to learn how to run a network properly, especially at the >Canadian backbone providers. Even when there were 10 provincial backbones >within the CA*NET consortium, the knowledge transfer just did not take >place. In some provinces like Ontario the network operators seemed more >interested in socialist politics than in running a network properly. > >Things are a bit better now in some regions and in some companies but >there is still a lot more knowledge sharing that could be done. > >And if anyone wants to flame me for this, please don't inflict it on the >NANOG list. Instead, come see me in person this weekend at the 12th annual >Canadian Internet conference http://www.net98.bc.ca and tell me what a >twit I am. I'll even buy you a beer. > >-- >Michael Dillon - Internet & ISP Consulting >http://www.memra.com - E-mail: michael(a)memra.com > > >

1 0

VIX Looking Glass (was: AS1853 announcing default)
by Christian Panigl, ACOnet/UniVie 07 May '98

07 May '98

>Date: Wed, 06 May 1998 11:50:55 -0400 >From: Paul Ferguson <ferguson(a)cisco.com> Hi Paul, and whoever might have gotten nervous about our (AS1853) "default-route": please calm down, there is no such beast, and we have never announced a default-route "at the Vienna Internet eXchange" (http://www.vix.at/) Please read below my answer/explanation to Paul Donner, the rumour is based on a misinterpretation ... As I'm not subscriber to the NANOG list, my CC to this list will most probably bounce back, therefore, Paul, please forward my answer there !!! Regards CP ======================================= Date: Wed, 06 May 1998 13:23:32 MET-DST From: "Christian Panigl, ACOnet/UniVie" <panigl(a)cc.univie.ac.at> To: pdonner(a)cisco.com CC: helpdesk(a)aco.net, panigl(a)cc.univie.ac.at Subject: VIX Looking Glass >Date: Wed, 06 May 1998 04:32:14 -0400 >From: "Paul G. Donner" <pdonner(a)cisco.com> >To: helpdesk(a)aco.net > >You guys are annoucing a default route at VIX. Is this what you really >want to be doing? I found this while using LOOKING GLASS. For example, >I was looking for a route to block 209.58.48.0/20. Now AS1583 does not >advertise a route for this block but they do offer to route any traffic >that is destined for this block. So you will be blackholing traffic >destined for this site from any of your peers. Dear Paul Donner, thanks for your hint. However, we are NOT announcing a default route "at VIX". AS1853 (ACOnet Backbone) is announcing a default route to AS1120 (ACOnet/VIX Service AS). The router Service.ACO.net/AS1120 is offering access to some special servers/services for all VIX members and is open to peer with all VIX members. Also the "VIX Looking Glass" is asking this router, which, besides of its VIX peerings, does not have any (not to speak about full) explicit routing information but a default route to the ACOnet Backbone (AS1853). This default route is NOT re-advertised to any VIX peer ! This looking glass wrt routing table therefore has only local meaning for VIX members and their customers. We might think of placing an explicit note there explaining the situation. Thanks for your input anyway ! Regards CP --- ---------------------------------------------------------------------- --- --- Christian Panigl : Vienna University Computer Center - ACOnet --- --- VUCC - ACOnet - VIX : -------------------------------------------- --- --- Universitaetsstrasse 7 : Mail: Panigl(a)CC.UniVie.ac.at (CP8-RIPE) --- --- A-1010 Vienna / Austria : Tel: +43 1 4277-14032 (Fax: -9140) --- --- ---------------------------------------------------------------------- ---

2 1

Routing Policy and http://rs.arin.net/ip-allocation.html
by Mike Tancsa 06 May '98

06 May '98

For the first time we have had to deal with Sprint's routing policy as defined by http://www.sprint.net/filter.htm. Here is the situation. One of our dialup customers wants to access his website in the 206.116.31.0/24 network at another provider. PSI is advertising it as a /24. According to Sprint's routing policy, they do not honour anything longer than a /19 in 206.0.0.0/8 . I am now in the position trying to explain to the very non-technical customer, why he cant reach that site, which from his point of view just seems like I am passing the buck... Anyways, my question is, are their any other ISPs/NSPs that follow the same guidelines. UUNet seems to honor it just fine, as does MCI. Is Sprint more hardnosed than most ? ---Mike ********************************************************************** Mike Tancsa (mike(a)sentex.net) * To do is to be -- Nietzsche Sentex Communications Corp, * To be is to do -- Sartre Cambridge, Ontario * Do be do be do -- Sinatra (http://www.sentex.net/~mdtancsa) *

9 8

Re: Routing Policy and http://rs.arin.net/ip-allocation.html
by Lehrer, Neil 06 May '98

06 May '98

i am very interested in this also. if you want to see how other isps handle that route you can go to http://www.boardwatch.com/isp/trace.htm and run tracerts from servers on different isps. `````````` To: nanog(a)merit.edu From: Mike Tancsa <mike(a)sentex.net> For the first time we have had to deal with Sprint's routing policy as defined by http://www.sprint.net/filter.htm. Here is the situation. One of our dialup customers wants to access his website in the 206.116.31.0/24 network at another provider. PSI is advertising it as a /24. According to Sprint's routing policy, they do not honour anything longer than a /19 in 206.0.0.0/8 . I am now in the position trying to explain to the very non-technical customer, why he cant reach that site, which from his point of view just seems like I am passing the buck... Anyways, my question is, are their any other ISPs/NSPs that follow the same guidelines. UUNet seems to honor it just fine, as does MCI. Is Sprint more hardnosed than most ? ---Mike ********************************************************************** Mike Tancsa (mike(a)sentex.net) * To do is to be -- Nietzsche Sentex Communications Corp, * To be is to do -- Sartre Cambridge, Ontario * Do be do be do -- Sinatra (http://www.sentex.net/~mdtancsa) * Regards +++++++++++++++++++++++++++++++++++++++ + Neil Lehrer + U.S. Information Agency + Networks and Systems Support Division + + voice 202 619-0903 + fax 202 619-3883 + internet nlehrer(a)usia.gov + + "oh what a tangled net we weave + when we seek to retrieve." + +++++++++++++++++++++++++++++++++++++++

1 0

Another major smurf run
by Karl Denninger 06 May '98

06 May '98

Hi Folks, If you're monitoring my page on this, you want to take a look in another 10-15 minutes. We were just hit by another major smurf attack, and I captured over a dozen new prefixes (which got added to our "bite me" list). http://www.mcs.net/smurf (update in process right now; give it 10-15 minutes) -- -- Karl Denninger (karl(a)MCS.Net)| MCSNet - Serving Chicagoland and Wisconsin http://www.mcs.net/ | T1's from $600 monthly / All Lines K56Flex/DOV | NEW! Corporate ISDN Prices dropped by up to 50%! Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL ACCOUNTS Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included at no cost

4 3

AS1853 announcing default
by Paul Ferguson 06 May '98

06 May '98

Forwarded for a colleague. - paul >Date: Wed, 06 May 1998 03:52:39 -0400 >From: "Paul G. Donner" <pdonner(a)cisco.com> >Subject: for NANOG > >Paul: > >I currently cannot send email to NANOG. Could you forward this for >me if you feel it is relevant to NANOG? > >I have found that at the Vienna Internet Exchange AS1853 is announcing >a default address. I didn't think this was very wise and it may not >affect much but it looks in error. > >>From Looking Glass: >------------------- > >Router: Service.ACO.net >Query: bgp >Addr: 209.58.48.0 > >BGP routing table entry for 0.0.0.0/0, version 530 >Paths: (1 available, best #1) > 1853 > 193.171.25.81 from 193.171.25.81 (193.171.23.241) > Origin IGP, localpref 100, valid, external, best > >-Donner >

1 0

Reminder: DC-ISOC Meeting This Monday Night
by Russ Haynal 06 May '98

06 May '98

If any of you are Near Washington DC, you might be interested in this meeting next Monday Night (it's free) Russ [ Note: This email contains several pieces of information: ] [ 1- Final Meeting Announcement for DC-ISOC (May 11) ] [ 2- Reminder for ISOC Board of Directors Elections ] [ 3- Netpreneur Announcement about E-commerce meeting ] - - - - Internet Governance - "Who's in Charge Here?" - - - - - Monday, May 11, 1998, 6:30-9:00 p.m. FINAL Meeting Agenda The Internet has continued to grow at an astonishing rate. This diverse expansion has attracted the interests of several regulating organizations and governments. Are the industry self-governing groups (e.g., ISOC, IAB, IANA, etc.) sufficient, or is there a role for governmental bodies (e.g., FCC, ITU, etc.)? Are new industry groups needed, as the White House's Green Paper suggests? If so, how will they come about? The final agenda includes the following speakers; * Ira C. Magaziner - Senior Advisor to The President for Policy Development http://www.ntia.doc.gov/ntiahome/domainname/domainname.htm * Barbara A. Dooley - Executive Director, Commercial Internet eXchange Association http://www.cix.org * David W. Maher - Chair of the Policy Oversight Committee (POC), Council of Registrars (CORE) http://www.gtld-mou.org/docs/core.html * Donald Heath - President/CEO of the Internet Society http://www.isoc.org Following the speaker presentations, there will be an open Q&A session with the audience. Meeting Location: Hyatt Dulles (Across Route 28 from Dulles Airport) 2300 Dulles Corner Blvd. Herndon VA 22071 USA Telephone: 1 703 713 1234 http://www.hyatt.com/pages/d/dullea.html Directions From Beltway: Take exit for Dulles Toll Road - West Take exit 10 from Dulles Toll Road Head South on Centreville Road Right on Fox Mill Road Hotel is 1 mile ahead on the right. As with all of our previous events, there is no charge to attend this event. Seating will be on a first-come, first-seated basis, though we expect that there should be room for all those interested. Please plan to arrive by 6:30 to "network", and to enjoy the refreshments (cookies & soft drinks) that are being provided by our sponsor. Speakers will begin at 7pm. ************* T H A N K S T O O U R S P O N S O R *********** * DC-ISOC wishes to thank InternetMCI for sponsoring this meeting. * * internetMCI offers Internet access options to fit every need * * and every budget. internetMCI Access Services provide * * you with a direct and reliable connection to the Internet * * through flexible options for dial-up or dedicated access. * * Please visit internetMCI at http://www.mci.com * ********************************************************************* To Sponsor a DC-ISOC Meeting, see http://www.dcisoc.org/sponsor.htm A short list of related links for this topic: * Internet Society http://www.isoc.org * Internet Architecture Board (IAB) http://www.iab.org/iab * Internet Assigned Numbers Authority http://www.iana.org/iana * Generic Top Level Domain Memorandum of Understanding http://www.gtld-mou.org/ * US Government's "green paper" on domain names http://www.ntia.doc.gov/ntiahome/domainname/022098fedreg.htm * Internet Society's web page relating to the "Green Paper" http://www.isoc.org/internet/news/greenpaper.shtml * MCI's formal response to the White House Green Paper on domain name system reform http://www.mci.com/mcisearch/aboutyou/interests/technology/ontech/DNSpaper.s html * FCC's Factsheet about ISP's and Access Charges http://www.fcc.gov/Bureaus/Common_Carrier/Factsheets/ispfact.html * International telecommunication Union http://www.itu.ch/ ========== ATTENTION ISOC MEMBERS... DON'T FORGET TO VOTE =============== Reminder - The 1998 Internet Society Board of Trustees Elections are underway. 11 candidates are running for 5 trustee Positions. As an Internet Society member, you are given 5 votes to distribute any way you choose among the candidates. For example, you could: - cast 1 vote each for 5 different candidates - cast all 5 of your votes for a specific candidate - cast 2 votes for candidate "A", 2 votes for "B", and 1 vote for "C" - etc. You should have received already your ballots in the mail. You can read about the candidates and CAST YOUR VOTE ONLINE at: http://www.isoc.org/members/vote/98election/98candinfo.shtml The deadline for Voting is May 29, but why not go to the online site NOW, and influence the Future of the ISOC and Internet. ======================================================================== Membership Information.... Individuals who are interested in becoming members of DC-ISOC can do so by joining the Internet Society. See Internet Society's web site at http://www.isoc.org for more information. The Washington DC Chapter of the Internet Society maintains its own web site at: http://www.dcisoc.org Please feel free to pass this announcement message along to other interested individuals. If this message was forwarded to you, you can join the DC-ISOC announcement mailing list through our web site ( http://www.dcisoc.org ) ============================================================= AN EVENING WITH THE STARS OF E-COMMERCE Presented by the Morino Institute June 3, Mayflower Hotel, Washington, D.C. 6:00 p.m. Registration & Pre-reception 7:00 p.m. Program 9:00 p.m. Post Reception To Register: http://netpreneur.org/ecommerce The Potomac KnowledgeWay Netpreneur Program invites you to spend An Evening with the Stars of E-Commerce. This is your opportunity to learn from and interact with five stellar entrepreneurs who founded some of the region's hottest electronic commerce businesses. Gary Arlen, who Advertising Age referred to as "one of the most visible and most quoted new media gurus" will moderate and lead the evening's discussion. Gary is President of Arlen Communications Inc. On June 3, find out what John Backus, President & Chief Executive Officer of Intelidata Technologies Corporation Bill Gorog, Chairman of the Board of Directors of Intelidata Technologies Corporation (also developer of Lexis-Nexis and former director of VeriFone) Jack McDonnell, President & Chief Executive Officer of Transaction Network Services, Inc. Bill Melton, Chief Executive Officer, CyberCash, Inc. Mark Walsh, President & Chief Executive Officer of VerticalNet, Inc. view as the keys to survival and success in an industry that is expected to explode in the next two years. With expertise in areas that include home banking software, vertical trade communities, data communications services for transaction-oriented applications, and the development of technologies of the caliber of Lexis Nexis, this group has the capacity to address the world of electronic commerce from all angles. The event will follow a town-hall format with brief six- to eight-minute presentations from the Stars, followed by extensive time for audience interaction. Mario Morino, Chairman of the Morino Institute, will wrap up the evening with his own views of the region and the netpreneur movement. Previous An Evening With Netpreneur events drew cumulative crowds of nearly 2,000. Only 700 seats are available for the June 3 program. To be assured of your seat to star gaze, sign up now at: http://netpreneur.org/ecommerce You may also email your registration to <ecommerce(a)netpreneur.org>. Please include your name, company, email address and a brief description of your company. ____________________________________________________________________ Russ Haynal - Internet Consultant, Instructor, Speaker "Helping organizations gain the most benefit from the Internet" russ(a)navigators.com http://navigators.com 703-729-1757 -------------------------------------------------------------------- Author:"Internet; A Knowledge Odyssey" (Top-rated CD-ROM Tutorial) See MindQ Publishing- http://www.mindq.com/cdt/company/products.html

1 0

Re: Two renumbering questions
by Joe Provo - Network Architect 05 May '98

05 May '98

> My ISP is changing upstreams for a variety of reasons around May 18th. > > 1. I have a /24 SWIPed to me, 205.238.207.0. The ARIN listing doesn't say > it's non-portable, so can I take it with me? The ARIN db lost all portable/non-portable atributes in the conversion. Unless folks have gone back and requested they get re-tagged, portability is unclear from the ARIN db. [snip] > rather than filtered for being too long? It's right in the middle of the old > upstream's block 205.238.192/18. If it is a singleton hole in a /18, your most net-friendly action would be to voluntarily renumber. The provider's most net-friendly action would be to indicate it was non-portable. [snip] > (There's other servers elsewhere that won't get renumbered.) If I tell the > Internic that ivan's host number has changed, will that update all the > domains served from it? Yes, that's the purpose of the HST record. Update the HST and you're all set. Joe -- Joe Provo, Network Architect 508.229.8400 x3006 Network Operations Center Fax 508.229.2375 UltraNet Communications, Inc., an RCN Company <jprovo(a)ultra.net>

6 5

Re: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!!
by philip bridge 05 May '98

05 May '98

Well, the ranges... >164.128.116.0 >164.128.119.0 >164.128.122.0 >164.128.123.0 >164.128.57.0 >164.128.81.0 ...are ours, and they are used in our backbone infrastructure. I was a bit surprised to see some of our backbone addresses on the list, because a few weeks back I went around all of the potential amplifiers and configured no ip directed-broadcast. I turns out that the ranges mentioned are all used to address serial access lines to customers - they are all /30 or /32. I have a bit of a problem with blocking of address ranges that really cannot be used as significant amplifiers. We take our responsibilities an ISP seriously: we have blocked all LANs that are connected by fat pipes and/or have large amplification factors, and we have started configuring 'no ip directed-broadcast' on ALL interfaces as a matter of standard. But we have several hundred legacy /30 interfaces that can't be reconfigured overnight. While I support the sentiment that ISPs responsible for large amplifiers should be blocked until they take action, I feel that the decision to block an address range should actually be tempered by an assessment of how damaging an amplifier the address block represents. If a smurf attack is detected from an address range, is it really that difficult to check what the amplification factor is before deciding if it should go onto a blocking list? I would certainly suggest that /30s should not be blocked, since they are so numerous and the damage they can cause is limited. How about a compromise: two lists - one of known smurf amplifier ranges > /30, which are blocked, and another of ranges where the amplifiers are =< /30, and which are no blocked, but simply publicised? As another thought, maybe what we need is a rough 'smurf effectivness metric' composed of amplification factor and access bandwidth. If address ranges only get onto the list because an attack has been sourced from them, then it should be possible to approximate these numbers. Phil At 08:11 PM 4/29/98 -0400, Martin, Christian wrote: >All, > >Here is my contribution to the block list. The script that generated >this will follow. It is 'public domain', in that it can be modified, >BUT, please give credit where credit is due! > >!!!!!NOTE: This script assumes that the offending bounce sites are /24 >blocks. It isn't that smart yet, but if someone can figure out a way to >glean more info, modify the script and repost. > ...previous message truncated... ______________________________________________________________ Philip Bridge ++41 31 688 8262 bridge(a)ip-plus.net www.ip-plus.ch PGP: DE78 06B7 ACDB CB56 CE88 6165 A73F B703

1 0