November 2002 - NANOG - lists.nanog.org

Re: Network integrity and non-random removal of nodes
by sgorman1＠gmu.edu 21 Nov '02

21 Nov '02

> The supposition would be that the remaining nodes are evenly > distributed around the core so the percentage of nodes outside of the > core without connectivity should be roughly the same as the percentage > of nodes removed from the core. At least until the core goes > non-linear... Is that the supposition stated in the paper? The reason being it contradicts quite a bit of similar research. Nodes inside and outside of the core do not typically disconnect at the same rate. Think of it this way, if a big well connected node goes down the other big conencted nodes in the core are likely to have an alternate connection to compensate for the link loss. Average distance might go up a little bit, but that is about it. The nodes outside of the core on the other hand are much more sparsely connected. 55% of them are trees meaning that they only have one connection. There is no back up link, so if their big hub node goes down they are out of commission. Hence you could have large numbers of nodes outside the core disconencted before you would see any effect inside the core. By the time the core goes non-linear the periphery is gonna be long gone and disconnected. ----- Original Message ----- From: William Waites <ww(a)styx.org> Date: Thursday, November 21, 2002 7:14 pm Subject: Re: Network integrity and non-random removal of nodes > >>> "Sean" == <sgorman1(a)gmu.edu> writes: > > Sean> it says nothing about what will happen to the other > 91.7% of > Sean> nodes. Considering that 55% of the remaining nodes are > Sean> trees, they will be saying "Houston we have a problem" well > Sean> before 25%. > > The supposition would be that the remaining nodes are evenly > distributed around the core so the percentage of nodes outside of the > core without connectivity should be roughly the same as the percentage > of nodes removed from the core. At least until the core goes > non-linear... > > >> It would be interesting to see what outdegree looks like > as a > >> function of rank -- in the paper they give only the maximum and > >> average (geo. mean) outdegrees. Is there also a critical point > >> 25% of the way through the ranking? Probably not or one would > >> expect they'd have mentioned it... > > It turns out that this is buried in one of the graphs (fig. 6) and > does not appear to have any special properties 25% of the way through. > It does have an inflection point around the 1000th node or so (2.5%). > > -w > >

2 1

RE: Arin Smack down?
by Martin Renschler (EWU) 21 Nov '02

21 Nov '02

tried the link and entered my PacBell home DSL static IP address and was shocked to see my private name come up behind CustName field! Wrong Address though. -------------------------------------------- Whois: CustName: Martin Renschler Address: 268 Bush St San Francisco CA 94104 Country: US RegDate: 2002-08-27 Updated: 2002-08-27 NetRange: 67.116.xxx.xxx - 67.116.xxx.xxx CIDR: 67.116.xxx.xxx/29 NetName: SBC067116xxxxxx020827 NetHandle: NET-67-116-xxx-xxx-1 Parent: NET-67-112-0-0-1 NetType: Reassigned Comment: For Policy Abuse issues, contact: abuse(a)swbell.net For Technical issues, contact: noc(a)swbell.net RegDate: 2002-08-27 Updated: 2002-08-27 ----------------------------------------------------- Isn't this violating privacy rules? Geez! /Martin (private mail not representing my employer's opinion...) -----Original Message----- From: Johannes Ullrich [mailto:jullrich@euclidian.com] Sent: Thursday, November 21, 2002 5:46 AM To: Joe; nanog(a)merit.edu Subject: Re: Arin Smack down? > Perhaps something I've mised, but is ARIN.Net no longer handling > lookups? I usually use them to find offending users but got this > when doing a lookup. > > No match for 64.124.168.60 I did have the same problem yesterday (Wednesday). Looks like it is working today. Maybe some leftover bug from their conversion to the new formats? Or just high load... you can try our ipinfo page, which caches whois queries. If you are lucky, someone else looked up the same ip... http://www.dshield.org/ipinfo.php?ip=64.124.168.60 -- -------------------------------------------------------------------- jullrich(a)euclidian.com Collaborative Intrusion Detection join http://www.dshield.org

6 5

Re: Network integrity and non-random removal of nodes
by sgorman1＠gmu.edu 21 Nov '02

21 Nov '02

It still depends on the network that you are using for analysis. Assuming the paper uses the same dataset as the link Sean provided the giant cluster they are analyzing is only 8.3% of IP nodes in their sample. It takes the removal of 25% when only looking at that small densely connected section, it says nothing about what will happen to the other 91.7% of nodes. Considering that 55% of the remaining nodes are trees, they will be saying "Houston we have a problem" well before 25%. Whether or not it matters that they have a problem in an entirely different question. I've probably kicked this dead horse enough already ----- Original Message ----- From: William Waites <ww(a)styx.org> Date: Thursday, November 21, 2002 6:31 pm Subject: Re: Network integrity and non-random removal of nodes > > >>> "Sean" == Sean Donelan <sean(a)donelan.com> writes: > > Sean> On 20 Nov 2002, William Waites wrote: > >> If you randomly select nodes to remove, by the time you have > >> removed 25% of them, the network breaks up into many isolated > >> islands. > > Sean> One of the key points was the nodes were removed in ranked > Sean> order, not in random order. > > I stand corrected. > > It would be interesting to see what outdegree looks like as a function > of rank -- in the paper they give only the maximum and average > (geo. mean) outdegrees. Is there also a critical point 25% of the way > through the ranking? Probably not or one would expect they'd have > mentioned it... > > So then the 12500 *biggest* routers have to be disabled before the > graph breaks into many islands. This would be yet harder > from an > attacker's point of view, no? > > -w > > >

2 1

on-line briefing on NRC study of Internet on 9/11 of last year
by Craig Partridge 21 Nov '02

21 Nov '02

Dave Clark, Sean Donelan and I will be briefing the National Research Council report on how the Internet handled the events of 9/11/2001 on Thursday morning. The report is available on-line this evening and the briefing will be webcast. For more details see www.nas.edu Thanks! Craig

1 0

[OT] Anyone have clueful AOL postmaster contacts?
by Ben Browning 20 Nov '02

20 Nov '02

I have been wrestling with their Postmaster contact staff (via phone, and the email black holes at postmaster(a)aol.com and abuse(a)aol.com) for over a week now. I need some sort of resolution, or anything other than "Your case is open. Someone somewhere will do something. Someday". If anyone has any contacts inside AOL, I would greatly appreciate an off-list email. ~Ben --- Ben Browning <benb(a)theriver.com> The River Internet Access Co. Network Operations 1-877-88-RIVER http://www.theriver.com

1 0

Re: Cyberattack FUD
by sgorman1＠gmu.edu 20 Nov '02

20 Nov '02

Well said - the radical elements get a lot more bang for their buck with well placed media stories, than they would ever likely get from a cyber attack on the Internet. The one point to consider is that there are critical networks for the economy that run on shared infrastructure also used by the Internet. Hence studying the susceptibility of the Internet can be more than an exercise is guarateeing porn availability. Proprietary issues aside there is a lot to be learned and for fairly good reasons. Micro-biologists study the neural network of the c.elgans worm not because they give a crap about worm brains but because it gives insight to a bigger picture. Not the best analogy but ya get the drift. ----- Original Message ----- From: William Waites <ww(a)styx.org> Date: Wednesday, November 20, 2002 8:35 pm Subject: Re: Cyberattack FUD > > >>> "Kurt" == Kurt Erik Lindqvist <kurtis(a)kurtis.pp.se> writes: > > Kurt> I am not sure what you mean with 25% of the Internet? What > Kurt> connectivity would degrade? From where to where? > > If you randomly select nodes to remove, by the time you have removed > 25% of them, the network breaks up into many isolated islands. As Sean > pointed out, the CAIDA study considered a sample of the 50k most > connected nodes. So a successful attack aimed at 12500 big routers > simultaneously would break the Internet into little pieces. > > If more strategy is used in the selection process, you get localized > outages -- i.e. disabling everything in 60 Hudson or 151 > Front is > likely to cause significant problems in New York or Toronto but you'll > probably be able to see the rest of the world just fine from > Sweden. > > A distributed physical attack against a large number of Telco Hotels > and trans-oceanic fibre landing points would be somewhat > worse. It > would also be very difficult to do from a laptop. > > With the exception of E911 service (which normally doesn't > use IP > anyways), any such disruption is unlikely to really hurt anyone. Such > hand-wringing whenever someone threatens to break the Internet > is > maybe a sign of an unhealthy dependence on a medium that is younger > than most of the people on this list? > > Taking the fear mongering and sabre rattling too seriously is much > more dangerous than any possible network outage. > > -w > >

1 0

Experts: Don't dismiss cyberattack warning
by Rajendra G. Kulkarni 20 Nov '02

20 Nov '02

http://computerworld.com/securitytopics/security/story/0,10801,76000,00.html

5 5

MIA: oregon-ix.net
by Kai Schlichting 20 Nov '02

20 Nov '02

As some of you have noticed, the BGP4 route containing the address for route-views.oregon-ix.net has disappeared a while ago (mid-October?). Their website seems to be gone, and I swear, I couldn't resolve the domain for a little while just now. Has the Oregon IX been shut down? Their route-server was probably the best-connected one, with the most views, of any public route server I am aware of (please prove me wrong, but do not torment me with any web-based looking glasses :) . Nothing like having to poke around 10 other RS's to establish that rogue AS 26212 really only has 1, 6402 and 2914 as their upstreams.

8 11

RE: MIA: oregon-ix.net
by Kris Foster 20 Nov '02

20 Nov '02

It's definitely there.. Non-authoritative answer: Name: route-views.oregon-ix.net Address: 198.32.162.100 route-views.oregon-ix.net>sh ip bgp sum BGP router identifier 198.32.162.100, local AS number 6447 BGP table version is 5314229, main routing table version 5314229 125745 network entries and 5682928 paths using 216279693 bytes of memory 960510 BGP path attribute entries using 49946520 bytes of memory 744324 BGP AS-PATH entries using 18454476 bytes of memory 4303 BGP community entries using 159674 bytes of memory Dampening enabled. 11361 history paths, 7196 dampened paths 11361 paths received but denied BGP activity 216653/85313 prefixes, 27124356/21395751 paths Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 4.0.4.90 4 1 1200789 41872 5314204 0 0 04:49:38 115086 62.164.11.10 4 8782 58138 41878 5314204 0 0 1w0d 2678 64.50.224.5 4 4181 1227857 41871 5314204 0 0 3w6d 115686 64.166.72.140 4 65533 0 0 0 0 0 never Active 64.200.199.3 4 7911 2362162 41872 5314204 0 0 1w4d 116068 64.200.199.4 4 7911 2325433 41868 5314204 0 0 4w1d 116066 66.185.128.48 4 1668 1409836 41873 5314204 0 0 2w2d 116352 129.250.0.6 4 2914 1437478 41860 5314204 0 0 1w1d 100143 129.250.0.11 4 2914 1235081 41862 5314204 0 0 1w1d 100145 130.217.2.25 4 681 44469 41869 5314204 0 0 4w1d 853 134.55.20.229 4 293 1569091 41874 5314204 0 0 3w4d 116575 141.142.12.1 4 1224 1920843 81928 5314204 0 0 5d22h 118615 144.228.241.81 4 1239 865616 41869 5314204 0 0 4w1d 114890 154.11.63.86 4 852 1300077 41869 5314204 0 0 4d14h 117015 154.11.98.18 4 852 1250484 41751 5314204 0 0 1d06h 117015 ... route-views.oregon-ix.net> > -----Original Message----- > From: Jared Mauch [mailto:jared@puck.Nether.net] > Sent: Wednesday, November 20, 2002 1:05 PM > To: Kai Schlichting > Cc: nanog(a)merit.edu > Subject: Re: MIA: oregon-ix.net > > > > Kai, > > i'm not sure about the dns for the domain (i suspect the > appropriate people are at ietf.. infact i know i saw their faces > on the mcast stream) but you can reach it by ip. > > 198.32.162.100 > > - jared > > On Wed, Nov 20, 2002 at 12:50:34PM -0500, Kai Schlichting wrote: > > > > As some of you have noticed, the BGP4 route containing the > address for > > route-views.oregon-ix.net has disappeared a while ago > (mid-October?). > > Their website seems to be gone, and I swear, I couldn't resolve > > the domain for a little while just now. Has the Oregon IX > been shut down? > > > > Their route-server was probably the best-connected one, > with the most > > views, of any public route server I am aware of (please > prove me wrong, > > but do not torment me with any web-based looking glasses :) . > > > > Nothing like having to poke around 10 other RS's to establish that > > rogue AS 26212 really only has 1, 6402 and 2914 as their upstreams. > > -- > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > clue++; | http://puck.nether.net/~jared/ My statements > are only mine. >

1 0

Re: Even the New York Times withholds the address
by Michael.Dillon＠radianz.com 20 Nov '02

20 Nov '02

>It'd >be cheaper to move the entire carrier hotel to the "safe" area and forget >having offsite power. Exactly! If you are going to solve the redundant services problem (power and cooling) with some kind of regional power and cooling network, then it makes sense to cluster the various organizations who need these services in the same area. Therefore, we should be thinking about how we can move carrier hotels to be near major hospitals. And if you think that clustering defeats the idea of distributing your assets, I am not suggesting that there should be only one cluster in a metropolitan area. Just as there are several major hospitals, there should be several carrier hotels. -- Michael Dillon

1 0