September 2001 - NANOG - lists.nanog.org

Re: The Gorgon's Knot. Was: Re: Verio Peering Question
by smd＠clock.org 29 Sep '01

29 Sep '01

| Other providers never adopted filters, Sprint has since dropped its | filters. The Internet is still growing. Verio adopted filters. It is Verio's use of these filters which triggered tonight's whine-fest. | It even continued to grow faster because Sprint couldn't control its | own route announcements. You are confusing exponential post-filter growth of the global routing table (for which there is negative evidence) with exponential post-filter exponential growth of the number of things reachable through the Internet. I will not claim a causal relationship. However, it'd be nice if there were evidence that the constrained growth the first of enabled or at least increased the growth of the other, since that was the entire goal in the first place. | Its difficult to view the act as altruistic, when in the face of | impending doom, Sprint could always afford new routers, had deployed many, and was in the process of a defensive upgrade which would have meant the problem would never have occurred in the first place. Doom was never going to happen all at once, except to regional/national networks that did not/could not upgrade their routers in time. However, as noted by others, unconstrained growth would have made the Internet impossibly expensive to remain as dynamic as it was then and is today. | But perhaps we didn't recognize the behavior as a cry | for help. Well, you were either stupid or blind. | Much like and addict, it couldn't stop itself from prostituting "prostituting" | Many a politician and religious leader has condemned the | sinner, only to be found in bed with the sinner themselves. "sinner" by implication philanderer | A hypocritic condemns others for what he does himself. I call people names too, but my chosen epithets are both on-target and deserved. Sean. PS: | If you really believed the Internet was facing immenient doom, why | not also save it by also filtering the outbound announcements. Why | engage in the very behaivor your condemnded? This was answered at least twice earlier tonight. Blind or stupid? You tell me.

1 0

Re: The Gorgon's Knot. Was: Re: Verio Peering Question
by smd＠clock.org 29 Sep '01

29 Sep '01

| So your downstreams pay you to connect to: | | + Your AS only; | | + Some of the Internet, but with little concern re accessibility | of small networks; | | + The whole Internet with as much reliability as possible? if #3 then what's the problem with: ip as-path access-list 1 permit _badguy_ route-map fix-badguy permit 10 descr proxy-aggregate the networks who are "holey" match as-path 1 router bgp my-as aggregate-address bad.guy.blo.ck1 255.255.224.0 as-set suppress-map fix-badguy aggregate-address bad.guy.blo.ck2 255.255.224.0 as-set suppress-map fix-badguy ... except that historically (with one exception, which was rude but educational) the "badguys" weren't really bad as much as lost somewhere, and didn't realize what was happening to them. So, rather than make a subtle change that some backwards ISPs never even noticed, a more forceful change (filtering) was made, and everyone noticed that, but more because of the continuing bad PR about how evil and rapacious it was to filter in the first place. Oh, wait, throwing away the holes can lead to a sub-optimal path selection! And troubles with holes coming from other directions! "shut up and send me a cheque." -> something more polite but meaning the same so that customer will happily pay for a "route-pull". Again, the great regret was the lack of a web page that would let one pay to blow holes in the filter and similar mechanisms that have been deployed from time to time (proxy-aggregation against backwards ISP, filtering against backwards ICM, RIPE-210 against the entire universe). | Maybe I'll filter anything longer than a /8... Please do, and tell us what you CAN'T reach after you throw away all the longer prefixes, and if you care after you install a default or proxy-aggregate, or whatnot to try to retain connectivity to those "extraneous info" destinations. Sean. ps - for those who don't know, ICM is AS 1800, and has an interesting history

2 1

Re: The Gorgon's Knot. Was: Re: Verio Peering Question
by smd＠clock.org 29 Sep '01

29 Sep '01

Sean Donelan wrote: | Sprint kept the filters on for years afterwards. It may have taken | the clueless salespeople a few years, but they eventually did figure out | how to recite the magic words "buy your circuit from sprint and you | won't have problems with filters" was a way to win a sale. "Thank you even more clueless competitors." | And who could forget the popular "Don't buy a circuit from small ISP, because | they won't be able to get past the Internet filters." I went through | a half-dozen Sprint sales people in different parts of the country, | and by 1996 or so they all had the spiel down pat. Wouldn't it have been easier for small ISP to just aggregate? I mean, /19s got through after all! The ONLY reason this became a competitive advantage for Sprint was because it's COMPETITORS didn't have the brains to impose a similar filter. Honestly, nobody anticipated they'd be so stupid, but good luck is good luck.... Sean. (who had left by the time of "a few years")

3 2

Re: The Gorgon's Knot. Was: Re: Verio Peering Question
by smd＠clock.org 29 Sep '01

29 Sep '01

Sean Donelan writes: | Ding, Ding, Ding, we have a winner. We didn't need the filters, but | it got more money by filtering routes, so it kept them. | | Although many people suspected that was the reason, Sprint's sales | and marketing people denied it for years. Because some of them, unlike you, understood (or at least were told) that we DID need the filter, otherwise the Internet would start becoming too expensive to continue growing. The entire Internet, not just Sprintlink. I realize that this is hard for you to wrap your brain around when you're in a rant against an evil corporate behemoth, but try just for a second to believe that people can act altruistically and in self-interest SIMULTANEOUSLY. | They said buy your circuit from Sprint and you can bypass Sprint's "save | the Internet" filters. That was true. However, if they said it would bypass anyone else's filter, or that there was zero chance of anyone else installing a similar filter, that would be a lie. Well, almost -- not many similar filters got installed. Blame Sprint's then-competition for being too stupid to protect their market share (and incidentally simultaneously act altruistically!). | If you asked a Sprint sales guy why Sprint had | the filters, the answer was generally along the lines "if Sprint didn't | have the filter, the Internet would collapse." That was true. Sean.

3 2

Re: The Gorgon's Knot. Was: Re: Verio Peering Question
by smd＠clock.org 29 Sep '01

29 Sep '01

| I also encouraged all other backbones to filter Verio as Verio filters them. FWIW, I (continue to) encourage this too. Filter more than Verio, while you're at it. Sean. (against representation without taxation :-) )

5 6

Re: The Gorgon's Knot. Was: Re: Verio Peering Question
by smd＠clock.org 29 Sep '01

29 Sep '01

| progressive dampening is much more appealing than | filtering, to solve this problem Filtering was the first attempted solution to CIDR failure. Damping had the advantage of time, reflection, and input from Curtis Villamizar (who I believe invented the first described damping algorithm) and many others, as well as the help from some truly excellent co-authors, patient customers and colleagues. RIPE as a publication venue also had some distinct advantages over IETF and NANOG. | other alternative method ... (ie Multi6 mapped to IPv4, etc). Ah, you're anticipating solution mark III. | I suspect if customers knew routes were being filtered, they | would care a lot. It got put in overnight because nobody had screamed since the first time it had been threatened some months before. The only serious complaint registered was from some competitors who had been allocating from short prefixes they'd obtained in the very new space covered by the filters, which did not, in fact, filter out long prefixes in older swampy but in-use address ranges. Had the competitors in question (also or instead) announced the prefixes they had actually been allocated, they would not have noticed for some time. (Probably someone would have first noticed odd traceroute behaviour towards one of the "holes" in the big short-prefix allocations that didn't work in the intended way when trying to load-balance or recover from a partition. That is, traffic hitting Sprintlink would go to the big network announcing the short prefix, rather than to the other network announcing the hole. And at the time there were no short prefixes, only holes, almost all of which seemed to be singly homed. If someone has NANOG archives from the time, there are some analyses of what got affected. 'Tweren't much on day one, and the filter was a big enough stick that 'tweren't much on day something-hundred either). | This only works because it is targetted at | less-noticeable address blocks Right. Moreover, they were less-noticeable not just because they were small, but because they were totally new. (Or not even yet used). | and exceptions are made for | noticeable address blocks (major site on a /24's). The swamp was the exception. The exception became the swamp. We thought the swamp would drain thanks to PIARA. It didn't, but it didn't become the toxic waste dump either, thanks to good (space) conservation efforts by the RIRs and the community in general. | If | customers knew that this was being done, and there was no | noticeable value created by the change (as is the case now), | they would have a problem. This information probably isn't | included Verio's sales slick, it wouldn't land many sales. If it were, it would be presented as: "Connect to Verio and avoid filtering -- announce everything you like, everyone else is too stupid to protect their networks from such abuse!" Sean.

1 0

Re: The Gorgon's Knot. Was: Re: Verio Peering Question
by smd＠clock.org 29 Sep '01

29 Sep '01

Alex said it better than me, but this week he has a 1 time zone advantage. :-) Sean Donelan writes: | What annoyed me isn't the technical decision, but the marketing | blitz used to justify it as "saving the Internet." Marketing blitz? There was me. And me. And me. And more me. Find another Sprint person who blitzed. I had alot of vocal supporters, many of whom were at vendors and customers. If it was shrill at times, it was because there were real problems that went beyond Sprint, and which were contained only by virtue of Sprint's relative size and inertia. The one-direction-only filter was an attempt to goad Tony Bates in particular into putting in place a "revenge filter" because it was causing him headaches in dealing with his new customers who were cut off from Sprintlink, and it was causing his sales staff headaches in terms of lost upgrade/2nd-circuit orders to us. The arrival of money to connect directly to Sprintlink and thus avoid the filter (and there was some) was what kept other people at Sprint from putting in the energy to overcome the inertia, otherwise the filter would have been gone gone gone a long time ago. Sales guys weren't saying "because our routers can't handle the full routing table" or anything of the sort. Weren't you trying to buy from Sprint sales people then? You *know* what they were like. Indeed, some of the cleverer ones were thrilled that their jobs got easier. The grillings of sales people over the filter and the bad PR surrounding it in the first year of the filter could be counted on one hand, and in base ten. Likewise, so could the number of "revenge filters" that would have encouraged our customers to clean up their own long prefixes so that our sales people wouldn't have to say: | say "because our routers can't handle the full routing table." instead of "MCI are filtering you, those bastards. We're sorry. There's nothing we can do. You'll just have to renumber." (or connect to them... and the next big network that filters you, and the one after that...) So I'm far from perfect, but I think I had good reasons for making the filter one-way-only, and it mostly worked. Or perhaps you could now argue in hindsight that the filters did NOT affect the global growth of the routing system at all or in any positive way, and that the people who believed otherwise at the time were badly misguided? Sean. ps - for the other networks, large and small, that filtered, i would be interested in your experiences with sales/marketing/pr/etc.

2 1

Re: The Gorgon's Knot. Was: Re: Verio Peering Question
by smd＠clock.org 28 Sep '01

28 Sep '01

| Still using an 8086 for a desktop? | | Obsolences does happen.... As I've said many times since the early 90s, *I* can afford top of the line computational power to solve my local problems. Other people are not so lucky, and may not be able to help grow the Internet any more if forced to buy the equipment I can. Also, there are better things to spend money on than top of the line computational power across one's entire network... (That is, I try to schedule my obsolescences so that today's top of the line stuff replaces the stuff that no longer is sufficient for the core, which then gets moved in to replace the stuff that is no longer sufficient for the region, which then gets moved in to replace stuff that is no longer sufficient for the edge, or sold to smaller providers, or turned into scrap/art. Accelerating this schedule is certainly possible, as is standardizing on only one box which is sufficient for the core, but I think either approach is gonna make our services much more expensive, and some of our competitors and customers just won't be able to keep up... The effects of decelerating this schedule, and how it applies in networks which are smaller than the ones I tend to associate with, or even end users at home, are left as an exercise for the reader.) Sean. ps - to answer the question, my desktop is now one of NetBSD -current with XFree86 CVS HEAD & gwm or Mac OS X 10.1 with XFree86 CVS HEAD in rootless mode coexisting with the native Aqua graphical system plug plug plug: 10.1 is awesome (caveat: i never used 9 or earlier extensively, so ymmv)

3 2

Re: The Gorgon's Knot. Was: Re: Verio Peering Question
by smd＠clock.org 28 Sep '01

28 Sep '01

| No. Not at all. But nor should we cry wolf and defend our corporate | policies with phoney hysteria. If you are filtering to keep your | internal routing tables clean fine, to get the most out of your | older or less than optimum equipment, fine too, but don't say the | "the internet is in danger of imminent collapse if we don't do | this" either. shut up and send me a cheque. Sean. ps - thank you for keeping the internet affordable for home users. pps - | Although this is certainly the first time I've seen | ivory tower idealism (aka nice clean routing tables with short allocations) | match up to the goals of a real world corporation was i an asshole to you such that you procmailed me out of your mailbox (this happens alot, you know) or am i getting old enough to believe i've been more consistent in my statements than i really have been?

1 0

Re: The Gorgon's Knot. Was: Re: Verio Peering Question
by smd＠clock.org 28 Sep '01

28 Sep '01

Alex Bligh writes: | This misses the point, it's not about what you /can/ afford | locally, it's how it's paid for. The problem is that the cost | implications are suffered disproportionately by those not | enjoying substantial benefit of having the route accepted. | You yourself have argued that $$ would fix this. You're right. I should simply go into randy-mode and repeat a mantra: - -- for future reference --- > [someone says that long prefixes are good/not-a-problem/...] shut up and send me a cheque. - -- Sean.

1 0