February 2008 - NANOG - lists.nanog.org

Peering at Equinix Sanjose
by 정치영 15 Feb '08

15 Feb '08

2 1

Looking for Verizon-GNI network engineer
by K. Scott Bethke 15 Feb '08

15 Feb '08

Sorry if this is off-topic frustration has set in. I've got what looks like a routing loop or a wedge in your network and I cant get past tier2 saying it is an "internet problem". I asked to speak with an engineer directly was told Verizon engineers don't talk directly with customers. Issue going on for 4 days. $ traceroute www.tickerforum.org traceroute to www.tickerforum.org (70.169.168.7), 64 hops max, 40 byte packets 1 10.254.123.1 (10.254.123.1) 3.219 ms 1.085 ms 0.915 ms 2 L301.VFTTP-02.CLPPVA.verizon-gni.net (71.171.93.1) 6.329 ms 6.281 ms 5.036 ms 3 P2-3.LCR-02.CLPPVA.verizon-gni.net (130.81.37.194) 4.885 ms 4.091 ms 6.490 ms 4 so-7-0-0-0.PEER-RTR1.ASH.verizon-gni.net (130.81.10.94) 4.731 ms 8.248 ms 5.167 ms 5 130.81.15.238 (130.81.15.238) 5.926 ms 130.81.15.190 (130.81.15.190) 6.586 ms 9.158 ms 6 * * * 7 * * * 8 * $ traceroute www.google.com traceroute: Warning: www.google.com has multiple addresses; using 64.233.169.104 traceroute to www.l.google.com (64.233.169.104), 64 hops max, 40 byte packets 1 10.254.123.1 (10.254.123.1) 1.774 ms 1.117 ms 0.909 ms 2 L301.VFTTP-02.CLPPVA.verizon-gni.net (71.171.93.1) 5.820 ms 4.029 ms 4.861 ms 3 P2-3.LCR-01.CLPPVA.verizon-gni.net (130.81.37.192) 8.036 ms 6.346 ms 7.671 ms 4 so-6-3-1-0.BB-RTR2.RES.verizon-gni.net (130.81.29.82) 6.524 ms 8.161 ms 8.408 ms 5 * * * 6 * * * Ticket # is VAD01QVDW -Scott

2 1

Re: Question on the topology of Internet Exchange Points
by Paul Vixie 14 Feb '08

14 Feb '08

> > in other words there appeared to be no "exchange-based topology", more > > like a "hybrid exchange and PNI topology." > > > > Paul Vixie > > It is interesting. Is this the common case for the IXP infrastructure?[1] I > mean the hybrid topology? It seems that it is both directly-connected and > exchange-based, but the direct links between participant ASes are much more > the links to the central switch. Right?[2] One more question is: if one AS > participate in an IXP, is it necessary for the AS to place a router in the > IXP?[3] In other words, all the participant ASes must have at least one > router in the IXPs (these routers are geographically nearby)?[4] Can they > use remote connection?[5] > > Kai [1] i think it is very common for an IXP to have a switch, to have racks for participating network operators, and to allow PNI's between those participants. however, i know of IXP's which only have a switch and require the participants to connect to it via telco circuits; and IXP's which have racks but which do not allow PNI's between participants. [2] at PAIX when i was there, the PNI's outnumbered the switch connections by more than 100:1. i don't know what's true today, or elsewhere, but in the IXP's where ISC has a presence, we generally have between two and twenty PNIs and only one or two switch connections. i'm assuming that this is common. [3][4][5] at PAIX when i was there, all switch and PNI connections had to be to locally installed routers. we didn't allow crossconnects between telco equipment (because we were an IXP not an MMR), and we didn't allow connections from a telco equipment to our switch (because we were an IXP not a MEP). the "network effect" at an IXP only comes when everybody has skin in the game, a real BGP-speaking router of some kind. i think PAIX (now part of S&D) still has the same rules. i don't know what's true of other IXP's around the world. paul vixie

2 1

IPv4 Resource Distribution After IANA Free Pool Exhaustion -- ARIN AC BoF
by Owen DeLong 14 Feb '08

14 Feb '08

Members of the ARIN AC will be present to discuss IPv4 after IANA Free Pool Exhaustion and get input from the community on how they feel this should be handled. Members of the community attending the NANOG conference are encouraged to attend this session and give your input. The session will be from 4:00 to 5:30 on Tuesday, February 19th and will be in the Crystal Room on Level B. We will be discussing the recently posted transfer policy proposal and other ideas around the IPv4 free-pool exhaustion process(es). Thanks, Owen DeLong ARIN AC

1 0

NANOG 42 PGP signing...
by Joel Jaeggli 14 Feb '08

14 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just a quick note, The keysigning sessions are going to be during the morning breaks during the general session, and will be located in the Garden Room. Monday Feb 18th 11:30-12:00 Tuesday Feb 19th 11:30-12:00 Wednesday Feb 20th 10:30-11:00 If you haven't already done so and plan to participate, please add your key to the keyring at: http://biglumber.com/x/web?keyring=6341 If you have any further questions, feel free to contact me via email or corner one of the people with the pgp signing dots since they mostly know the score. While printouts will probably be available feel free to add your key to the keyring right up to the time of the last keysigning event. thanks joel -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFHtPbx8AA1q7Z/VrIRAijmAJ962VmdLvZI9cnI81XGgUjqAe3ztACgiFbf z1Lodg8es3d7KBezw4eXNQI= =KPYz -----END PGP SIGNATURE-----

1 0

IBM report reviews Internet crime
by michael.dillon＠bt.com 14 Feb '08

14 Feb '08

IBM has released a report on Internet crime in 2007 here <http://www.iss.net/documents/whitepapers/xforce_2007_annual_report.pdf> Some highlights from the Management summary with my comments in [square brackets]: Vulnerabilities * Although total vulnerability disclosures went down, the number of reported high severity vulnerabilities increased by 28 percent in comparison with 2006. * The busiest day of the week for vulnerability disclosures continued to be Tuesday, with 1,361 new vulnerabilities disclosed on this day of the week in 2007. * Of all the vulnerabilities disclosed in 2007, only 50 percent can be corrected through vendor patches. [suggests that ISPs need to be proactive about detecting and blocking compromised machines] * Nearly 90 percent of 2007 vulnerabilities could be remotely exploited, up one percentage point from 2006. Web Browser Exploitation * Most in-the-wild browser exploits are generated by Web exploit toolkits. * Critical vulnerabilities for Mozilla Firefox were dramatically lower in 2007 compared to 2006. [If you still distribute any kind of software kits that do not install FireFox, you are doing your customers a disservice and making your detection and blocking task that much bigger. When you contact customers with compromised machines you might want to make it mandatory to install Firefox from your servers before re-enabling Internet access] Spam and Phishing * Of the top 20 companies targeted by phishing in 2007, 19 are in the banking industry and one conducts recruiting. [This suggests keywords to look for in incoming email. Also, for local and regional ISPs, the number of companies in these two industries are low enough that you may want to consider establishing a direct relationship with them to configure stricter incoming email filters] Web Content * 9 percent of Internet content was classified as unwanted (criminal, pornography, etc) as compared to 12.5 percent in 2006. * The U. S. far outpaces other countries as the primary hosting source of adult, socially deviant and criminal content on the Internet, accounting for roughly 40-48 percent in each content category. * The U. S. and Germany were the only two countries consistently among the top three hosting sources for each type of "unwanted" Internet content monitored throughout 2007. [Suggests that NANOG members need to raise the bar considerably to clean up their own backyard. What do you know about your own Internet peering partners?] Malcode * Trojans represent the largest category of malware in 2007 - 109,246 varieties account for 26 percent of all malware. * The most frequently occurring malware on the Internet was Trojan.Win32.Agent - 26,573 varieties in 2007 account for 24 percent of all Trojans. * The most common worm in 2007 was Net-Worm.Win32.Allaple with 21,254 varieties. It is a family of polymorphic worm that propagates by exploiting Windows(r) vulnerabilities instead of using e-mail. [This suggests that targetting these specific attack vectors could clean up a significant amount of the problem and correspondingly recduce your costs for detection and blocking of compromised machines.] Make sure to download the report for the complete management summary and many more details. ------------------------------------------------------- Michael Dillon RadianzNet Capacity Forecast & Plan -- BT Design 66 Prescot St., London, E1 8HG, UK Mobile: +44 7900 823 672 Internet: michael.dillon(a)bt.com Phone: +44 20 7650 9493 Fax: +44 20 7650 9030 http://www.btradianz.com Use the wiki: http://collaborate.intra.bt.com/

11 15

FW: BGP TTL Security
by Ben Butler 14 Feb '08

14 Feb '08

Hi Danny, Thanks for you help - no problems. I would agree 192 vs 63/64 it is to much of a coincidence for it not to be related somehow. Weirder and weirder - presumably people trying to hack the BGP session below: neighbor 212.121.34.1 ttl-security hops 192 And the session is up and we get: Extended IP access list ACL-MATCH-TTL-0/254 (Compiled) 10 permit ip any any ttl eq 0 (869 matches) 20 permit ip any any ttl eq 1 (1 match) 260 permit ip any any ttl eq 25 (1 match) 580 permit ip any any ttl eq 57 (1 match) 590 permit ip any any ttl eq 58 600 permit ip any any ttl eq 59 610 permit ip any any ttl eq 60 620 permit ip any any ttl eq 61 (2 matches) 630 permit ip any any ttl eq 62 (2 matches) 640 permit ip any any ttl eq 63 (1 match) <- presumably the foundry 1210 permit ip any any ttl eq 120 (2 matches) 1220 permit ip any any ttl eq 121 (2 matches) 1230 permit ip any any ttl eq 122 (1 match) 1240 permit ip any any ttl eq 123 (1 match) 1250 permit ip any any ttl eq 124 (1 match) 2500 permit ip any any ttl eq 249 (6 matches) 2510 permit ip any any ttl eq 250 (3 matches) This is connected to an ethernet IX and all peers are one hop away. Kind Regards Ben -----Original Message----- From: Danny McPherson [mailto:danny@tcb.net] Sent: 15 February 2008 01:16 To: Ben Butler Cc: Hank Nussbacher Subject: Re: BGP TTL Security On Feb 14, 2008, at 6:12 PM, Ben Butler wrote: > Hi, > > I have put a route map on the interface and matched every TTL from 0 > to > 254 and I am only getting matches on TTL 0. Is the ttl-security check still in place? I believe the way Cisco implemented that is that if the TTL doesn't match the prescribed value then they expire the TTL to drop the packet in the fast path. > The box on the other side in this particular instance is a high end > Foundry. > > I don't really care about the 192 thing because I will never have > mutlihop peers that far away - it was simply an observation. Well, that's quite a coincidence because Foundry's default IP TTL value is 64, which is quit suspicious. > The problem is needing to configure both sides of the peering and > consequently on a per session basis / cordinatition which means a lot > of work and inertia of organising other people to roll out the change. Hrmm... On other thought.. Is the Foundry a multi-hop peer? If so, perhaps in their configuration they're specifying ebgp multli-hop 1, which is triggering this behavior? But I'd suspect the above rather than this, because of the 192 behavior. Thoughts? -danny

1 0

BGP TTL Security
by Ben Butler 14 Feb '08

14 Feb '08

Hi, I am trying to implement BGP TTL security between one of my routers and an eBGP peer that is one hop away over a layer 2 IX. As soon as I add: neighbor 212.121.34.1 ttl-security hops 2 or neighbor 212.121.34.1 ttl-security hops 1 The peer drops to active/open sent with entries in syslog for hold time expired. I have validated via trace in both directions as being 1 hop. I have read another article that implies the default behaviour at the other end will to be send TTL 1 not 255 and consequently I need to configure both ends to get the session to come back up. An access list reveals all the packets I am receiving have a TTL of 0. The session re-establishes if I configure: neighbor 212.121.34.1 ttl-security hops >=192 <=191 and the session stays down. Which is proper bizarre! Is it necessary to configure this on both side for the session to re-establish. Is this a Cisco bug? Kind Regards Ben Butler ++++++++++++++++++++++++++++++++++++++++++ C2 Internet Ltd Globe House, The Gullet, Nantwich, Cheshire, CW5 5RL E mailto:ben.butler@c2internet.net W http://www.c2internet.net/ B1 http://c2internet.blogspot.com/ B2 http://c2noc.blogspot.com/ T +44-(0)845-658-0020 F +44-(0)845-658-0070 All quotes & services from C2 are bound by our standard terms and conditions which are available on our website at: http://www.c2internet.net/legal/main.htm#tandc C2 Internet Limited is a company registered in England and Wales with company number 03910154 Our VAT Registration number is GB 752 7650 17

2 2

Re: Network Notifcation - SMS via Verizon
by Henry Linneweh 14 Feb '08

14 Feb '08

I found this product of particular interest... http://www.scomobile.com/hipcheck/ -Henry ----- Original Message ---- From: "Bowman, Jonathan" <jbowman(a)virtela.net> To: nanog(a)merit.edu Sent: Tuesday, February 12, 2008 10:24:55 AM Subject: RE: Network Notifcation - SMS via Verizon I've used <10 digit number>@vtext.com with my Verizon phone for several years now without any issues or dropped SMS messages. Obviously that's an in-band solution, but it's simple to implement and fairly (in my experience) reliable. -Jonathan -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gregory Boehnlein Sent: Friday, February 08, 2008 7:03 PM To: nanog(a)merit.edu Subject: Network Notifcation - SMS via Verizon Hello, We have been discussing adding a wireless SMS based option to our TAP and SMTP delivery systems. We are running Nagios. In looking at the list archives, I found the following thread: http://www.irbs.net/internet/nanog/0408/0039.html Lots of great suggestions.. In looking at the options, it seems that Gnokii seems to be a well used solution to integrate a GSM or GPRS based phone/modem for text messaging. However, I am trying to determine if anyone is doing this with Verizon right now. Our existing Cell contract is w/ Verizon and so we want to avoid the potential of lost SMS messages in hopping from say T-mobile or Cingular to Verizon. So.. anyone doing SMS notification to Verizon w/ a wireless GSM/GPRS or Cell Phone solution? If so, you want to share how you are doing it? Thanks in advance..

1 0

remote hands / contractor / courier needed in Tokyo
by Alexander Koch 14 Feb '08

14 Feb '08

Folks, does anyone know or can refer to someone in Tokyo to do remote hands work, rack servers, fetch a server and bring from A to B etc? If no- one is coming to your mind, can someone refer to a courier service one can instruct/ sort things out with by email / credit card Ah, yeah, speaking English in a good way would be needed. If in doubt we also accept German, Dutch, French, or Italian, but that might get a bit more tricky. :-) Thanks in advance! Alexander

1 0