October 2001 - NANOG - lists.nanog.org

Draft agenda
by Susan Harris 11 Oct '01

11 Oct '01

Here's the tentative agenda for Oakland. Looking forward to seeing you! ======================================================================= NANOG 23 October 21-23 Oakland, CA SUNDAY TUTORIALS 1:30 - 3:00 p.m. IP Routing Protocol Scalability: Theory and Examples Level: Intermediate Alvaro Retana, Cisco 1:30 - 3:00 p.m. ISP Security: Real World Techniques Level: Intermediate Barry Raveendran Greene, Cisco; Chris Morrow and Brian W. Gemberling, UUNET 3:00 - 3:30 p.m. BREAK 3:30 - 5:00 p.m. IP Routing Protocol Scalability: Theory and Examples (cont'd.) 3:30 - 5:00 p.m. ISP Security: Real World Techniques (cont'd.) 5:00 - 7:30 p.m. DINNER BREAK (on your own) 7:30 - 9:00 p.m. BGP Multihoming Guide Level: Introductory Philip Smith, Cisco 7:30 - 9:00 p.m. Packets and Photons: The Emerging Two-Layer Network Level: Intermediate Mike Shepherd, Juniper MONDAY GENERAL SESSION 9:00 a.m. Welcome, Introductions Susan Harris, Merit Tom Herbst, Cisco 9:15 a.m. The Internet under Stress: 9/11 Peter H. Salus, Matrix 9:30 a.m. What Worked and What Didn't: 9/11 Sean Donelan, Equinix 9:50 a.m. Multicasting Worked on 9/11 Marshall Eubanks, Multicast Technologies; Prashant Rajvaidya, UC Santa Barbara; Rich Mavrogeanes, Vbrick 10:10 a.m. BREAK 10:30 a.m. Trends in Denial of Service Attack Technology Kevin Houle, CERT 11:00 a.m. The Spread of the Code-Red Worm (CRv2) David Moore, CAIDA 11:15 a.m. DoS Attacks in the Real World Karthik Arumugham, Global NAPs Steven Schechter, Globix, and Jason Slagle 11:30 a.m. Diversion and Sieving Techniques to Defeat DDoS Yehuda Afek, Anat Bremler-Barr, Tel-Aviv Univ./WANWall Hank Nussbacher, Dan Touitou, WANWall 12:00 p.m. LUNCH 1:30 p.m. NOBAD - Network Oriented Basic Anomaly Detection Jonas M. Luster, d-fensive.com 1:45 p.m. Designing a Testbed for Evaluating DDoS Defense Research Wes Hardaker, NAI Labs 2:00 p.m. How to Do VLAN-Based Security Within Your Network Infrastructure Bill Woodcock, Packet Clearing House 2:15 p.m. Inter-City MAN Services Using MPLS Pascal Menezes,Terabeam 2:45 p.m. MPLS in Perspective Kireeti Kompella, Juniper 3:15 p.m. BREAK 3:45 p.m. Operator Requirements of Infrastructure Management Methods Bill Woodcock, Packet Clearing House Suzanne Woolf, MFN 4:00 p.m. Panel: Terabit POP Design Dave Ward, Cisco, moderator 5:30-7:30 p.m. Beer 'n Gear! Monday Evening BOFs 7:30 - 9:00 p.m. ISP Peering BOF IV Bill Norton, Equinix, moderator 7:30 - 9:00 p.m. Designing a Testbed for Evaluating DDoS Defense Research Wes Hardaker, NAI Labs 9:00 p.m. PGP Key Signing Party TUESDAY GENERAL SESSION 9:00 a.m. Enhancing the Internet's Administrative Look-up Service Mark Kosters, Andrew Newton, VeriSign Applied Research 9:30 a.m. BGP Dynamics Track Dave Meyer, Sprint, moderator Routing Table Growth: News at Eleven Randy Bush, AT&T Research 10:00 a.m. PTOMAINE Update Abha Ahuja, Arbor Networks 10:10 a.m. ARIN Open Mike Session R Richard Jimmerson, ARIN, moderator 10:40 a.m. BREAK 11:00 a.m. Global Routing Instabilities During Code Red II and Nimda Worm Propagation Jim Cowie, Andy Ogielski, Renesys 11:30 a.m. Shining Light on Dark Internet Address Space Craig Craig Labovitz, Abha Ahuja, Merit Network/Arbor Networks 12:00 p.m. LUNCH 1:30 p.m. BGP Multiple Origin AS (MOAS) Conflicts Xiaoliang Zhao, North Carolina State University Dan Massey and Allison Mankin, USC/ISI S. Felix Wu, UC Davis Dan Pei, Lan Wang, and Lixia Zhang, UCLA (speaker) 1:45 p.m. The Impact of BGP Misconfiguration on Connectivity Ratul Mahajan, David Wetherall, and Tom Anderson, Univ. of Washington 2:15 p.m. Analysis of RIPE/RIS Project's BGP Data - CIDR at Work Cengiz Alaettinoglu, Packet Design 2:45 p.m. XML-based Network Management Rob Enns, Juniper 3:00 p.m. TUNDRA Jeffrey Papen, Yahoo 3:15 p.m. Using Topological Mapping to Manage and Secure Large Networks Karl Siil, Lumeta 3:30 p.m. Closing Remarks Susan Harris, Merit 3:35 p.m. Adjourn PS - New t-shirt gallery here: http://www.nanog.org/nanog-tshirts/nanogtees.html Thank you Sue Joiner!

1 0

AOL problems today
by Sean Donelan 11 Oct '01

11 Oct '01

AOL had some problems which seemed to affect a broad range of of AOL services today. AOL didn't release any details.

1 0

RE: IBM Announcing 0/7?
by Martin, Christian 11 Oct '01

11 Oct '01

Stephen, Thanks. I did not mean to exclusively point to ABOV or MFNX, as there are others in the list. Please forgive this transgression - tis late! regards, chris > > Furthermore, Abovenet is propagating it. > > I've forwarded your mail to our NOC and cc'd you so you'll have the > address for future reference; it could also serve as a handy template > for sending mail to the NOCs of the other networks that passed on the > announcement should you choose to contact them (I count eight, but you > can consider AS3557 notified, so seven). > > > This can't be right. > > > > AS Network From Flaps Duration Reuse Path > > h 0.0.0.0/7 202.249.2.86 8 01:34:10 > 7500 2516 6461 2686 > > h 157.130.182.254 76 14:25:44 > 19092 6461 2686 > > h 204.152.184.126 83 14:25:46 > 3557 6461 2686 > > h 207.126.96.1 94 14:25:58 > 6461 2686 > > h 193.0.0.56 100 14:26:07 > 3333 1103 2686 > > h 212.4.193.253 144 19:11:50 > 8918 2686 > > h 213.200.87.254 263 19:12:05 > 3257 2686 > > *d 195.66.224.82 476 1d23h 00:15:10 > 4513 3344 15643 > > *d 192.157.69.27 679 2d18h 00:10:10 > 4513 3344 15643 > > *d 198.32.162.18 657 2d18h 00:15:40 > 4513 3344 15643 > > Stephen > -- > Stephen Stuart stuart(a)mfnx.net > VP, Research and Development > Metromedia Fiber Network >

1 0

IBM Announcing 0/7?
by Martin, Christian 11 Oct '01

11 Oct '01

Call me crazy, but route-views.oregon-ix.net is showing IBM announcing 0/7. Furthermore, Abovenet is propagating it. This can't be right. -chris AS Network From Flaps Duration Reuse Path h 0.0.0.0/7 202.249.2.86 8 01:34:10 7500 2516 6461 2686 h 157.130.182.254 76 14:25:44 19092 6461 2686 h 204.152.184.126 83 14:25:46 3557 6461 2686 h 207.126.96.1 94 14:25:58 6461 2686 h 193.0.0.56 100 14:26:07 3333 1103 2686 h 212.4.193.253 144 19:11:50 8918 2686 h 213.200.87.254 263 19:12:05 3257 2686 *d 195.66.224.82 476 1d23h 00:15:10 4513 3344 15643 *d 192.157.69.27 679 2d18h 00:10:10 4513 3344 15643 *d 198.32.162.18 657 2d18h 00:15:40 4513 3344 15643

2 1

CDT Calls on Internet Activists to Urge Support for Feingold Amendments to Anti-Terrorism Bills
by William Allen Simpson 10 Oct '01

10 Oct '01

More.... I haven't seen the proposed amendments yet. But this is a broader call than just our Internet Engineering groups. -------- Original Message -------- Date: Wed, 10 Oct 2001 17:31:05 -0400 From: Ari Schwartz <ari(a)cdt.org> To: update(a)cdt.org Subject: CDT Calls on Internet Activists to Urge Support for Feingold Amendments to Anti-Terrorism Bills Sender: owner-cdt-adv(a)cdt.org Reply-To: Ari Schwartz <ari(a)cdt.org> CDT has sent out a message to Internet activists across the country asking them to urge their Senators to support Senator Russell Feingold's (D-WI) amendments to the Senate Anti-Terrorism Bill. Sen. Feingold is planning to offer amendments Thursday morning that will address some of the privacy concerns raised by the pending bills, by requiring government surveillance to be more focused and subject to meaningful judicial controls. The message sent to CDT's lists of activists; is available below; and is posted on the CDT site. ----- Dear Activist: Things are moving very fast on Capitol Hill. Legislation to expand government surveillance will be considered by the Senate (and maybe the House) on Thursday, October 11. In the Senate, Sen. Russ Feingold is planning to offer amendments Thursday morning that will address some of the privacy concerns raised by the pending bills, by requiring government surveillance to be more focused and subject to meaningful judicial controls. CDT supports the Feingold amendments. You can make a difference. Call your Senators in Washington right away and let them know that you think civil liberties should be part of the balance as we move forward to protect our country from terrorism. Urge them to support the Feingold privacy amendments BACKGROUND Following the horrendous attacks of September 11, it is clear that US anti- terrorism efforts need to be improved. Unfortunately, there has been little time to develop a response that is effective and does not unnecessarily infringe civil liberties. Legislation moving quickly through Congress involves some fundamental changes in the surveillance laws. Most of the changes are not limited to terrorism cases, but concern all crimes and all intelligence investigations. Among other things, the bills would: * Allow FBI to seize any and all stored records (medical records, educational records, stored e-mail) in intelligence cases without a search warrant. * Allow computer system operators to authorize government surveillance without a court order (the computer trespasser provision). * Authorize roving taps in intelligence cases without clear guidelines, allowing government to monitor pay phones, library computers, cell phones without first determining who is using the device. * Allow secret searches (searches without notice at the time of the search) in all criminal cases. * Extend government surveillance under minimal standards to broad categories of Internet data - all "routing, addressing and signaling information" (the "pen register" provision). For full background the current civil liberties issues with the bill, please see CDT's latest policy post -- http://www.cdt.org/publications/pp_7.10.shtml Also, the New York Times on October 10 explained the current situation in the Senate and Sen Feingold's concerns-- http://www.nytimes.com/2001/10/10/national/10RIGH.html WHAT YOU CAN DO--MAKE YOUR VOICE HEARD 1. Call your your Senators - Sen. XXX at (202) 224-3121 Tell the person who answers the phone that you hope your Senator will support the Feingold privacy amendment to the terrorism bill, so that it adequately protects civil liberties when giving the government new surveillance powers. Use these words if you feel tongue-tied: Staffer: Hello, Sen. XXX's office. You: Hello. I'm a constituent calling to urge the Senator to support the Feingold privacy amendments to the anti-terrorism bill. Government needs to fight terrorism, but the bill fails to protect privacy. I'm concerned about the provisions on Internet surveillance and roving wiretaps. I support the Feingold amendments setting clear limits on government surveillance. Staffer: I'll tell the Senator. Thanks, bye! 2. Let CDT know how it went! Go to http://www.cdt.org/action/feedback.cgi?membid=wijr, and use the feedback form to tell us what happened. Or you can send an email back to me at mclark(a)cdt.org. 3. Lastly, please forward this message to other individuals interested in protecting privacy and free expression on the Internet . They can find information about their Senators at http://www.cdt.org/action/. But they need to act right away. PLEASE NOTE: We are asking you to call your Representatives in Washington because studies have shown that this is the most effective way to make a difference over a short period of time. By the time the office reads your email or letter it will probably be too late and a call into the district office does not have the same impact when the Senator is in Washington. -- To subscribe to CDT's Activist Network, sign up at: http://www.cdt.org/join/ If you ever wish to remove yourself from the list, unsubscribe at: http://www.cdt.org/action/unsubscribe.shtml If you just want to change your address, you should unsubscribe yourself and then sign up again or contact: mclark(a)cdt.org --- ---------------------------------- CDT Update Subscription Information E-mail questions, comments, or requests to subscribe or unsubscribe to ari(a)cdt.org or call (202) 637-9800. Detailed information about online civil liberties issues may be found at http://www.cdt.org/ ----------------------------------- Ari Schwartz Center for Democracy and Technology 1634 Eye Street NW, Suite 1100 Washington, DC 20006 202 637 9800 fax 202 637 0968 ari(a)cdt.org http://www.cdt.org -----------------------------------

1 0

PATRIOT/USA technical problems, call to action
by William Allen Simpson 10 Oct '01

10 Oct '01

Democracy is not a spectator sport. The US House (hr.2975 PATRIOT) and US Senate (s.1510 USA) have introduced bills that will cost ISPs a lot of money -- potentially tens of thousands of dollars -- even for small ISPs. Unlike CALEA, there is no requirement that ISPs be reimbursed. This happened because the legislators are clueless about technical requirements. It is up to you to educate them! With the bombing started, it is thought that the bills will be pushed through this week, without going through the normal committee review. Each and every one of you MUST call your legislators, where you work and again where you live. Call your Senator, and then call your Representative. Do not send email, it won't get read soon enough! Since Monday is a legal holiday of sorts, you may have to wait until Tuesday morning, but try on Monday anyway. -- Urge your representatives in Congress to hold full hearings, and fix technical problems. 1. Call the White House switchboard at 202-224-3121, and ask to be connected to the office of your Congressional representative. -or- Look up the office numbers on the web at www.house.gov and www.senate.gov. 2. When you are put through, say "May I please speak to the staff member who is working on the anti-terrorism legislation?" If that person is not available to speak with you, say "May I please leave a message?" 3. Briefly explain that you work for an Internet Service Provider, and although you appreciate the efforts of your representative to address the challenges brought about by the September 11th tragedy, it would be a mistake to make any changes in the federal wiretap statute that do not respond to "the immediate threat of investigating or preventing terrorist acts." -- If they want to talk details, here they are: Both bills add "addressing" and "routing" to the list of activities that can be requested without a specific court order. So, just like call setup for the phone companies, every single address that you assign, via DHCP or otherwise, and every ARP, RIP, OSPF, and BGP routing table change, must be recorded for posterity -- just in case any state or federal agents want to review it someday. No time limits, and no statute of limitations. Some lawyers read this to extend to tracking every URL accessed through your POPs, and every email To: and From: transmitted over your networks, since they both can be considered "addressing" and your activity "routing". Obviously, the legislators don't quite understand what a dynamic packet connectionless Internet means! -- My solution, after talking to several Representatives and Senators staffs, is to add clarification to the definitions section 3127: (7) the term "addressing" means a numeric identifier that assists the delivery of electronic communications over a specific link, attached to the outermost encapsulation of the communication (but not including the contents of such communication). (8) the term "routing" means the numeric internetwork locator associated with a communication that facilitates its carriage between electronic communication services, contained within the internetwork communication encapsulation (but not including the contents of such communication). -- As you can see, my solution means you can do it with standard tools, like tcpdump or snort, and unlike phone call setup, there's nothing in the definitions that indicates the information has to be recorded for future requests.... -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

6 7

RE: Filtering Best Practices, et al (Was Verio Peering, Gordon's Knot)
by Hallgren, Michael 10 Oct '01

10 Oct '01

> > On Wed, Oct 10, 2001 at 10:54:03AM +0200, Stephane Bortzmeyer wrote: > > > > > I'm currently in the process of setting up a new border > router, and the > > > recent debate on the above topic got me wondering what > the best practice > > > filtering policy is? Is there one? > > > > I'm interested to see if people filter route anouncements > on the basis > > of registered routes in an Internet Routing Registry. In our area > > (Europe), the RIPE database typically contains less than half of the > > routes which are actually announced. I assume it is not better in > > ARINland. > > When I worked at Tiscali (World Online) Denmark, we did prefix > filtering on our peers, the results of that can be seen on > http://as8807.net/dixirrstats.txt (Though that is old, january this > year) > I believe that TeleDanmark also still do IRR filtering, and I know of > several providers in Denmark who are ready to follow suit as soon as > some of the "worst IRR-offenders" have updated their IRR > records (which > actually has happened already) > > If you decide to implement IRR filtering you may want to see how your > peers perform in the IRR area by using a small utility, which can be > downloaded from http://noc.tele.dk/util.html. This is the utility that > was used to produce the stats for Tiscali's router. Thanks. (Yes, successfully filtering peers wrt IRR sometimes require human interaction - asking peer not up-to-date to become so.) mh > > -- > Andreas Plesner Jacobsen >

1 0

RE: Filtering Best Practices, et al (Was Verio Peering, Gordon's Knot)
by Hallgren, Michael 10 Oct '01

10 Oct '01

Hi/Bonjour Stephane, > > > On Wed, Oct 10, 2001 at 10:22:09AM +0100, > Hallgren, Michael <michael.hallgren(a)Teleglobe.com> wrote > a message of 50 lines which said: > > > we - Teleglobe, that is - filter our customers wrt. as-path > and prefix... > > also in the RIPE area. If a customer isn't up-to-date with IRR, we > > Well, your customers, OK, but your peers (the ones without transit > traffic, which are supposed to announce only their networks) at > exchange points? In general, currently, yes, peers as well. mh >

1 0

RE: Filtering Best Practices, et al (Was Verio Peering, Gordon's Knot)
by Hallgren, Michael 10 Oct '01

10 Oct '01

Hi, we - Teleglobe, that is - filter our customers wrt. as-path and prefix... also in the RIPE area. If a customer isn't up-to-date with IRR, we advice/help him to become so. (The idea is, keeping filters on our customers is also of benefit to our peers, etc, etc.) mh > -----Message d'origine----- > De : Stephane Bortzmeyer [mailto:bortzmeyer@gitoyen.net] > Envoyé : mercredi 10 octobre 2001 10:54 > À : Grant A. Kirkwood > Cc : nanog(a)merit.edu > Objet : Re: Filtering Best Practices, et al (Was Verio > Peering, Gordon's > Knot) > > > > On Tue, Oct 09, 2001 at 07:58:19AM -0700, > Grant A. Kirkwood <grant(a)virtical.net> wrote > a message of 18 lines which said: > > > I'm currently in the process of setting up a new border > router, and the > > recent debate on the above topic got me wondering what the > best practice > > filtering policy is? Is there one? > > I'm interested to see if people filter route anouncements on the basis > of registered routes in an Internet Routing Registry. In our area > (Europe), the RIPE database typically contains less than half of the > routes which are actually announced. I assume it is not better in > ARINland. > > On the basis of inetnum objects (network addresses, not routes), it is > a bit better in coverage but you cannot use inetnum directly in a > comparison, you have to check that a BGP announce *includes* at least > one registered inetnum. > > To summary, I dropped the idea. Does anyone implemented it? > > >

2 1

Re: BGP noise tonight? (fwd)
by jlewis＠lewis.org 09 Oct '01

09 Oct '01

So who do you blame...the RFC or the vendor that ignores it? Dropping the session seems to break the "be conservative in what you send and liberal in what you accept" suggestion. If you know someone else will ignore the rules (there's always someone) breaking due to their error kind of sucks. -- ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route System Administrator | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________ ---------- Forwarded message ---------- Return-Path: <if(a)sil.at> Received: from mailhost.mmaero.com (mailhost.mmaero.com [208.152.224.3]) by redhat1.mmaero.com (8.11.6/8.9.3) with ESMTP id f984S0Z24869 for <jlewis(a)redhat1.mmaero.com>; Mon, 8 Oct 2001 00:28:00 -0400 Received: from waste.silverserver.co.at (waste.silverserver.co.at [194.152.178.7]) by mailhost.mmaero.com (8.11.2/8.11.2) with ESMTP id f984Rxp20147 for <jlewis(a)lewis.org>; Mon, 8 Oct 2001 00:28:00 -0400 Received: from ikarus (ikarus.sil.at [194.152.178.41]) by waste.silverserver.co.at (8.11.6/8.11.6) with ESMTP id f984Roi31471 for <jlewis(a)lewis.org>; Mon, 8 Oct 2001 06:27:50 +0200 Date: Mon, 8 Oct 2001 06:27:51 +0200 (MEST) From: Ingo Flaschberger <if(a)sil.at> X-Sender: chaoztc@ikarus To: jlewis(a)lewis.org Subject: Re: BGP noise tonight? In-Reply-To: <Pine.LNX.4.30.0110080010050.1854-100000(a)redhat1.mmaero.com> Message-ID: <Pine.SOL.4.21.0110080627120.15412-100000@ikarus> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Hi i could not post to nanog directly.. perhaps you could do it for me? our 2 uplinks, ebone and carrier1 went down (flapping routes at the borders). the problem was a malformed as-path (with a private confederation in it), which was distributed from netherland over the network... (over routers VendorX). rfc-compliant routers dropped the peering session after receiving this malformed route ebone has contaced the provider and he has already fixed this announcement. thnx & bye, Ingo -- "I worry about my child and the Internet all the time, even though she's too young to have logged on yet. Here's what I worry about. I worry that 10 or 15 years from now, she will come to me and say 'Daddy, where were you when they took freedom of the press away from the Internet?'" --Mike Godwin

10 14