September 2001 - NANOG - lists.nanog.org

(fwd) Re: telehouse - 25 broadway
by Simon Lockhart 14 Sep '01

14 Sep '01

------- Forwarded Message Date: Thu, 13 Sep 2001 22:06:14 -0400 From: Steven Nash <snash(a)lightning.net> Subject: Re: telehouse - 25 broadway Simon, Please post to list, never emailed for posting access :-) The power to at least parts of the 5th floor was returned until about 10 minutes ago (9:47 EDT). The power as of now is as it was, completely gone as we await for the generator fix. No ETR I know of at this time. At 02:29 AM 9/14/2001 +0100, you wrote: > >well their generator overheated. no power at the facility > >Status as at 02:25 (UK) / 21:25 (New York): > >They have a Generator Tech on site at the moment, and he is working on >fixing the generator. They have also spoken to Con Ed about borrowing a >generator to get them going. Someone from Con Ed is heading down to see >what they can do. Telehouse seem pretty hopeful that they will get power >back in a few hours. > >Simon >-- >Simon Lockhart | Tel: +44 (0)1737 839676 >Internet Engineering Manager | Fax: +44 (0)1737 839516 >BBC Internet Services | Email: Simon.Lockhart(a)bbc.co.uk >Kingswood Warren,Tadworth,Surrey,UK | URL: http://support.bbc.co.uk/ - ---- Steven Nash Director of Network Engineering Lightning Internet Services, LLC http://www.lightning.net o:516.248.8400 f:516.248.8897 c:516.779.3007 e:888.935.2698 "remember, hijackers are ticketed passengers too." ------- End of Forwarded Message -- Simon Lockhart | Tel: +44 (0)1737 839676 Internet Engineering Manager | Fax: +44 (0)1737 839516 BBC Internet Services | Email: Simon.Lockhart(a)bbc.co.uk Kingswood Warren,Tadworth,Surrey,UK | URL: http://support.bbc.co.uk/

1 0

RE: IPSEC and PAT
by Vandy Hamidi 14 Sep '01

14 Sep '01

I see now, thanks! My logic is complete. thanks, -=Vandy=- -----Original Message----- From: Steven M. Bellovin [mailto:smb@research.att.com] Sent: Thursday, September 13, 2001 6:44 PM To: Vandy Hamidi Cc: nanog(a)merit.edu Subject: Re: IPSEC and PAT In message <912A91BC69F4D3119D1B009027D0D40C01BB45A7(a)exchange1.secure.insweb.co m>, Vandy Hamidi writes: >It is working now. I've done it with Linksys and Netopia DSL routers. >Software client on the laptop that DOES tunnel mode ESP. No AH and running >through a PAT and it works flawlessly. I just want to know how it works, >I've already determined that it does. >The point where my logic fails is where PAT relies on modifying the TCP/UDP >port numbers, an ESP packet has a standard IP header with an additional >protocol 50 ESP header. Since there is no ports to change to create a table >to keep track of which packet came from which internal client, what is used >to keep track. >Someone said something about the UDP encapsulation, but what about the >NETOPIA which doesn't do that? I repeat -- it doesn't do PAT. Some "routers" -- they're really no such thing, of course; they're NAT boxes and/or bridges -- allow one host behind them to speak IPsec. If a host emits a packet using ESP, it's tagged as *the* IPsec user; return IPsec packets are routed to that host. (Some of these boxes may use manual configuration instead or in addition.) You can't have two IPsec hosts, because there's no way to know which should receive incoming packets -- there's no relationship between inbound and outbound SPIs. As for the UDP encapsulation -- yes, the IETF's IPsec working group is moving in that direction. But it's not standardized yet, and there may be patent issues to sort through. --Steve Bellovin, http://www.research.att.com/~smb http://www.wilyhacker.com

1 0

telehouse - 25 broadway
by Rob Mosher 14 Sep '01

14 Sep '01

well their generator overheated. no power at the facility -- Rob Mosher 516 248 8400 x 121 Lead Programmer / Systems Engineer Lightning Internet Services, LLC

2 3

WTC: pilot puzzle
by Mathias K�rber 14 Sep '01

14 Sep '01

This was just mentioned on a CNN chatboard: quote from the board: So Ameer Bukhari, student pilot, from Vero Beach, Florida was killed in a plane crash on 9-11-00 and Ameer Bukhari from Vero Beach, Florida hijacked a plane and crashed it into the WTC/Pentagon/rural area on 9-11-01? What is going on? The first link is to a cincinatti newspaper, scroll down and read about the plane crash. Check out the 2 articles. http://enquirer.com/editions/2000/09/13/loc_tristate_a_m_report.html http://www.cnn.com/2001/US/09/12/investigation.terrorism -- Mathias Körber |2385 Bay Road |Tel:+1-650-381.6044|Fax:+1-650-381.6055 Sr. Consult. Engr. |Redwood City |Direct Fax/Voicemail:+1-240-368.1170 Nominum, Inc. |CA 94063, USA |Private: Mobile:+65-9815.7807 mathias@nominum.com|www.nominum.com|E:mathias@koerber.org|Fax/Vmail:+1-801-650.9591

3 3

RE: Yes it's off topic but who cares right now.
by Roeland Meyer 14 Sep '01

14 Sep '01

|> From: Dmitri Krioukov [mailto:dima@krioukov.net] |> Sent: Thursday, September 13, 2001 2:10 PM |> "resist the cycle of violence and hate." I have been resisting responding to this wrong-headed phrase since randy first printed it. Yes, the cycle of hate must be stopped. Hate has no place in war. One must be as unemotional and rational as possible. The results of error are severe. There is no second place in combat. Winning a war is expensive, losing one costs the loser everything they have. Violence has been with us since time immemorial. It is inconvenient that we have to defend ourselves, but sevitude is inconvenient as well. However, defence is an ultimately losing strategy. Offensive violence will ultimately be required. The opposition is one of deeply held religious belief. They are willing to die for that belief. They are not insane. They are not irrational. In fact, they are coldly calculating. This incident was not an accident. It is also not isolated. It is the current culmination of a campaign that has been on-going, for decades. They want to end our civilization, period. Newt Gingrich said it well today, in the current phase, "they hope to drive us into a police-state". They will win, unless we start to get a grip on what we're really dealing with. At that point in time, we will become more like them. In a sense, that is what ultimately needs to happen. The western way of life needs to ascend to become a deeply held religious belief as well. Is there any doubt that the founders of the USofA felt that way? A large part of that feeling needs to be revived. We need to rebuild the old BlackOps forces and the ground-based intelligence networks that provided the targeting systems. We have to quit wasting resources on this pathetic war on drugs and use those assets to hunt down and destroy terrorist bases whereever we can find them. The big drug smugglers either work with us or they die, that simple. A border that's hardened against terrorists doesn't give a smuggler much room to maneuver anyway. Yes Susan, I got your note and I have been good, but I couldn't let this one pass. I leave the rest of reality advocacy to Vadim, he's a little extreme, but I agree with much of what he says.

1 0

RE: IPSEC and PAT
by Vandy Hamidi 14 Sep '01

14 Sep '01

It is working now. I've done it with Linksys and Netopia DSL routers. Software client on the laptop that DOES tunnel mode ESP. No AH and running through a PAT and it works flawlessly. I just want to know how it works, I've already determined that it does. The point where my logic fails is where PAT relies on modifying the TCP/UDP port numbers, an ESP packet has a standard IP header with an additional protocol 50 ESP header. Since there is no ports to change to create a table to keep track of which packet came from which internal client, what is used to keep track. Someone said something about the UDP encapsulation, but what about the NETOPIA which doesn't do that? -=Vandy=- -----Original Message----- From: Steven M. Bellovin [mailto:smb@research.att.com] Sent: Thursday, September 13, 2001 5:21 PM To: Vandy Hamidi Cc: nanog(a)merit.edu Subject: Re: IPSEC and PAT In message <912A91BC69F4D3119D1B009027D0D40C01BB459C(a)exchange1.secure.insweb.co m>, Vandy Hamidi writes: > >I know that in Tunnel Mode, IPsec can be NATed and PATed (without IKE on UDP >500 being used), but as I'm trying to break down the process of how it is >working, I've been stumped by this: >NAT - Changes source IP during translation >PAT - Changes source IP and TCP/UDP port to another to track multiple to one >translations. >My question is, how does PAT track the packets with their internal hosts >when there is not a TCP/UDP header to translate. >How does it know which "internal" host a returning ESP packet must be >forwarded to after it un PATs the incoming packet? >thanks and I hope this isn't a totally stupid question. If it is, humor me >;), IPsec can't be PATted, because the TCP and UDP port numbers are in the protected part of the packet. --Steve Bellovin, http://www.research.att.com/~smb http://www.wilyhacker.com

1 0

OT, but very high human factor
by Jason Legate 14 Sep '01

14 Sep '01

Just received this email: --- Light a Candle for Unity! Though terrorists may have struck out at us as Americans, let us come together and show our unity. Let us show that though our arm may have been hurt, they can not dim the heart of America which rages bright. On Thursday September 13, 2001 at 10:30 pm EST, walk out your door and light a candle or lantern to show the world that our spirit burns bright. Gather with loved ones or gather with neighbors but let our light burn in the night to show that we are united and that we remain strong. Please pass this on to anyone you know..print it up and pass it to neighbors who may not have internet access, post it to message boards, clubs, news stations, anywhere and everywhere there is a PROUD American! May we all be Blessed --- -j -- Jason Legate Sr. Net/Sys Admin, eVine, Inc. work- jlegate(a)evine.com | home- jlegate(a)alienchick.com Key Fingerprint: 4FB4 2228 DE63 3BBA 7B72 40DD 13D5 2547 821D 2909

1 0

Re: IPSEC and PAT
by Adam Herscher 14 Sep '01

14 Sep '01

FWIW, some VPN devices including Cisco's line of "Concentrators" (from the aquisition of Altiga), conquer this problem by encapsulating the IPSEC data in UDP. It's hackish, but is a good solution for VPNs to telcommuters behind hotel PAT and little Linksys dsl devices. According to our vendors, these Cisco devices are currently "special order" items, meaning they take a long time to stock. They're also relatively new, so open box/dying dotcom/ebay hardware is hard to come by. Regards- Adam On Thu, 13 Sep 2001, Steven M. Bellovin wrote: > > In message <912A91BC69F4D3119D1B009027D0D40C01BB459C(a)exchange1.secure.insweb.co > m>, Vandy Hamidi writes: > > > >I know that in Tunnel Mode, IPsec can be NATed and PATed (without IKE on UDP > >500 being used), but as I'm trying to break down the process of how it is > >working, I've been stumped by this: > >NAT - Changes source IP during translation > >PAT - Changes source IP and TCP/UDP port to another to track multiple to one > >translations. > >My question is, how does PAT track the packets with their internal hosts > >when there is not a TCP/UDP header to translate. > >How does it know which "internal" host a returning ESP packet must be > >forwarded to after it un PATs the incoming packet? > >thanks and I hope this isn't a totally stupid question. If it is, humor me > >;), > > IPsec can't be PATted, because the TCP and UDP port numbers are in the > protected part of the packet. > > --Steve Bellovin, http://www.research.att.com/~smb > http://www.wilyhacker.com > >

1 0

assistance available
by Paul A Vixie 14 Sep '01

14 Sep '01

PAIX and Abovenet (both subsidiaries of MFN) have space, power and various forms of connectivity available at 111 8th. Anyone who was impacted by the WTC disaster and who needs a place to set up an emergency network node should get in touch w/ me (I'll intro you to MFN or to Abovenet if PAIX can't help.)

6 6

Re: IPSEC and PAT
by Steven M. Bellovin 14 Sep '01

14 Sep '01

In message <912A91BC69F4D3119D1B009027D0D40C01BB459C(a)exchange1.secure.insweb.co m>, Vandy Hamidi writes: > >I know that in Tunnel Mode, IPsec can be NATed and PATed (without IKE on UDP >500 being used), but as I'm trying to break down the process of how it is >working, I've been stumped by this: >NAT - Changes source IP during translation >PAT - Changes source IP and TCP/UDP port to another to track multiple to one >translations. >My question is, how does PAT track the packets with their internal hosts >when there is not a TCP/UDP header to translate. >How does it know which "internal" host a returning ESP packet must be >forwarded to after it un PATs the incoming packet? >thanks and I hope this isn't a totally stupid question. If it is, humor me >;), IPsec can't be PATted, because the TCP and UDP port numbers are in the protected part of the packet. --Steve Bellovin, http://www.research.att.com/~smb http://www.wilyhacker.com

1 0