September 2010 - NANOG - lists.nanog.org

AS11296 -- Hijacked?
by Ronald F. Guilmette 28 Sep '10

28 Sep '10

Evidence strongly suggests that AS11296 together with all of the IPv4 space it is currently announcing routes for, i.e.: 63.247.160.0/19 199.241.64.0/19 206.226.64.0/24 206.226.65.0/24 206.226.66.0/24 206.226.67.0/24 206.226.68.0/24 206.226.69.0/24 206.226.70.0/24 206.226.71.0/24 206.226.72.0/24 206.226.73.0/24 206.226.74.0/24 206.226.75.0/24 206.226.76.0/24 206.226.77.0/24 206.226.78.0/24 206.226.79.0/24 206.226.96.0/19 have all been hijacked. I will be reporting this formally to ARIN today, via their helpful fraud reporting web form. In the meantime, while this case is being carefully adjudicated by ARIN, some folks may wish to blackhole the above. (The IP space appears to be in use by some sort of snowshoe spamming operation.) Regards, rfg P.S. Connectivity for AS11296 appears to come from only one place: http://www.robtex.com/as/as11296.html#graph

2 1

EFF needs your help to stop the Senate's DNS censorship bill
by Peter Eckersley 28 Sep '10

28 Sep '10

As you may or may not have heard, there is a censor-DNS-to-enforce-copyright bill that is going to be passed by the Senate Judiciary Committee this Wednesday (!!!). It will require service providers to censor the DNS entries of blacklisted domains where piracy is deemed too "central" to the site's purpose. Senators are claiming that they haven't heard any opposition to this bill, and it is being sponsored by 14 of the 19 committee members. We believe it needs to be stopped, and we need your help. What EFF needs right now is sign-ons to an open letter, from the engineers who helped build the Internet in the first place. The text of our letter is below. If you agree with it and would like to sign, please send me an email at pde(a)eff.org, with your name and a one-line summary of what part of the Internet you have helped to design, implement, debug or run. This is URGENT. I need your sign-ons by 4:00pm, US Eastern time (1pm Pacific), tomorrow. Unfortunately, the civil liberties community has been ambushed by this bill. You can find out more details on the bill here: https://eff.org/coica --------------------------- Open letter from Internet engineers to members of the Senate Judiciary Committee: We, the undersigned, have played various parts in building a network called the Internet. We wrote and debugged the software; we defined the standards and protocols that talk over that network. Many of us invented parts of it. We're just a little proud of the social and economic benefits that our project, the Internet, has brought with it. We are writing to oppose the Committee's proposed new Internet censorship and copyright bill. If enacted, this legislation will risk fragmenting the Internet's global domain name system (DNS), create an environment of tremendous fear and uncertainty for technological innovation, and seriously harm the credibility of the United States in its role as a steward of key Internet infrastructure. In exchange for this, the bill will introduce censorship that will simultaneously be circumvented by deliberate infringers while hampering innocent parties' ability to communicate. All censorship schemes impact speech beyond the category they were intended to restrict, but this bill will be particularly egregious in that regard because it causes entire domains to vanish from the Web, not just infringing pages or files. Worse, an incredible range of useful, law-abiding sites can be blacklisted under this bill. These problems will be enough to ensure that alternative name-lookup infrastructures will come into widespread use, outside the control of US service providers but easily used by American citizens. Errors and divergences will appear between these new services and the current global DNS, and contradictory addresses will confuse browsers and frustrate the people using them. These problems will be widespread and will affect sites other than those blacklisted by the American government. The US government has regularly claimed that it supports a free and open Internet, both domestically and abroad. We can't have a free and open Internet without a global domain name system that sits above the political concerns and objectives of any one government or industry. To date, the leading role the US has played in this infrastructure has been fairly uncontroversial because America is seen as a trustworthy arbiter and a neutral bastion of free expression. If the US suddenly begins to use its central position in the DNS for censorship that advances its political and economic agenda, the consequences will be far-reaching and destructive. Senators, we believe the Internet is too important and too valuable to be endangered in this way, and implore you to put this bill aside. -- Peter Eckersley pde(a)eff.org Senior Staff Technologist Tel +1 415 436 9333 x131 Electronic Frontier Foundation Fax +1 415 436 9993

1 0

EFF needs your help to stop the Senate's DNS censorship bill
by Peter Eckersley 27 Sep '10

27 Sep '10

Dear network operators, I apologise for a posting that contains some politics; I hope you'll agree that it also has fairly substantial short-to-medium term operational implications. As you may or may not have heard, there is a censor-DNS-to-enforce-copyright bill that is going to be passed by the Senate Judiciary Committee this Wednesday. It will require service providers to censor the DNS entries of blacklisted domains where piracy is deemed too "central" to the site's purpose. Senators are claiming that they haven't heard any opposition to this bill, and it is being sponsored by 14 of the 19 committee members. We believe it needs to be stopped, and we need your help. What EFF needs right now is sign-ons to an open letter, from the engineers who helped build the Internet in the first place. The text of our letter is below. If you agree with it and would like to sign, please send me an email at pde(a)eff.org, with your name and a one-line summary of what part of the Internet you have helped to design, implement, debug or run. This is URGENT. I need your sign-ons by 4:00pm, US Eastern time (1pm Pacific), tomorrow. Unfortunately, the civil liberties community has been ambushed by this bill. You can find out more details on the bill here: https://eff.org/coica --------------------------- Open letter from Internet engineers to members of the Senate Judiciary Committee: We, the undersigned, have played various parts in building a network called the Internet. We wrote and debugged the software; we defined the standards and protocols that talk over that network. Many of us invented parts of it. We're just a little proud of the social and economic benefits that our project, the Internet, has brought with it. We are writing to oppose the Committee's proposed new Internet censorship and copyright bill. If enacted, this legislation will risk fragmenting the Internet's global domain name system (DNS), create an environment of tremendous fear and uncertainty for technological innovation, and seriously harm the credibility of the United States in its role as a steward of key Internet infrastructure. In exchange for this, the bill will introduce censorship that will simultaneously be circumvented by deliberate infringers while hampering innocent parties' ability to communicate. All censorship schemes impact speech beyond the category they were intended to restrict, but this bill will be particularly egregious in that regard because it causes entire domains to vanish from the Web, not just infringing pages or files. Worse, an incredible range of useful, law-abiding sites can be blacklisted under this bill. These problems will be enough to ensure that alternative name-lookup infrastructures will come into widespread use, outside the control of US service providers but easily used by American citizens. Errors and divergences will appear between these new services and the current global DNS, and contradictory addresses will confuse browsers and frustrate the people using them. These problems will be widespread and will affect sites other than those blacklisted by the American government. The US government has regularly claimed that it supports a free and open Internet, both domestically and abroad. We can't have a free and open Internet without a global domain name system that sits above the political concerns and objectives of any one government or industry. To date, the leading role the US has played in this infrastructure has been fairly uncontroversial because America is seen as a trustworthy arbiter and a neutral bastion of free expression. If the US suddenly begins to use its central position in the DNS for censorship that advances its political and economic agenda, the consequences will be far-reaching and destructive. Senators, we believe the Internet is too important and too valuable to be endangered in this way, and implore you to put this bill aside. -- Peter Eckersley pde(a)eff.org Senior Staff Technologist Tel +1 415 436 9333 x131 Electronic Frontier Foundation Fax +1 415 436 9993

1 0

Re: Online games stealing your bandwidth
by Brandon Butterworth 27 Sep '10

27 Sep '10

> > I fail to see the point. If an ISP needs to add caches they may > > as well just add a simple, cheaper, standard, http cache. > > It's a bang-per-buck issue, and depends highly on whether your > particular network sees more HTTP or P2P traffic. Orly. No, I mean if there have to be caches why use p2p in the first place, once there's a network of caches p2p becomes a more complicated http and that model has been well optimised by some. I know the people stealing things don't want to pay akamai but games charging for access are a different matter. brandon

3 2

Re: Online games stealing your bandwidth
by Brandon Butterworth 27 Sep '10

27 Sep '10

> Even if we had > ISP supporting caches, there is always the problem getting p2p clients > to support them (given they often are too busy trying to circumvent). I fail to see the point. If an ISP needs to add caches they may as well just add a simple, cheaper, standard, http cache. No special clients required, no fiddling to make locality work and no extra, expensive in some architectures, last mile traffic brandon

2 1

Re: Routers in Data Centers
by ym1r.jr＠gmail.com 27 Sep '10

27 Sep '10

As far as I know open source solutions doesn't have support for fabric or high speed asics. So the throughput will always be a big difference. Unless you are comparing a pure packet software interrupt platform. ------Original Message------ From: Adam Armstrong To: Venkatesh Sriram To: nanog(a)nanog.org Subject: Re: Routers in Data Centers Sent: Sep 25, 2010 7:18 PM On 24/09/2010 11:22, Venkatesh Sriram wrote: > Hi, > > Can somebody educate me on (or pass some pointers) what differentiates > a router operating and optimized for data centers versus, say a router > work in the metro ethernet space? What is it thats required for > routers operating in data centers? High throughput, what else? Depending upon the specific requirements of the scenario at each type of site, the optimal devices could be either identical, or completely different. :) adam. Sent via my BlackBerry® device from Claro

7 9

Routers in Data Centers
by Venkatesh Sriram 27 Sep '10

27 Sep '10

Hi, Can somebody educate me on (or pass some pointers) what differentiates a router operating and optimized for data centers versus, say a router work in the metro ethernet space? What is it thats required for routers operating in data centers? High throughput, what else? Thanks, Venkatesh

16 23

Re: Odd BGP AS Path
by Sriram, Kotikalapudi 26 Sep '10

26 Sep '10

We (at NIST) performed some additional data analysis to characterize AS_SETs in BGP updates in RIB entries. The results can be found in the slides at this link: http://www.antd.nist.gov/~ksriram/AS_SET_Aggregator_Stats.pdf This work was presented at the IETF SIDR WG meeting in Maastricht in July 2010. Please look at mainly slides #3 and #4. The findings are consistent with Olaf Maennel's (that Randy posted) in term of how few updates have AS_SETs in them. We additionally looked at the the question of -- when AS_SET is present, how often does the ASN in the AGGRGATOR field in the update matches the originating AS? This question has relevance to origin AS validation using ROAs in RPKI -- to try to propose how origin validation can be done if AS_SET is present in an update. Please look into my slides if you are interested in the details. I will be happy to answer any questions. Currently, the push from several of us (Warren Kumari, Randy, many others -- I support it too) is to deprecate AS_SETs altogether in future BGP enhancements such as RPKI. This would mean an update will not pass origin validation (in fact, origin validation using ROAs will not even be attempted) if AS_SET is present in an update. Comments/reaction/feedback to this from ops people who currently use AS_SETs would be very useful. (This would be good for discussion of Warren's draft in the IDR WG. http://tools.ietf.org/html/draft-wkumari-deprecate-as-sets-00 ) Sriram ==================================================== >Date: Thu, 23 Sep 2010 10:59:07 -0400 >From: Randy Bush <randy(a)psg.com> >Subject: Re: Odd BGP AS Path >To: Warren Kumari <warren(a)kumari.net> >Cc: nanog(a)nanog.org > >just to uncloak a bit. when we first decided to look at deprecating >as-sets et alia, we begged olaf maennel to analyse the use thereof. the >following is edited from internal email from early august. we then >begged one of our number, warren, to do the dirty, and he was kind >enough to do so. we owe him. > >--- > >using data from ripe r00 >years total real >stable as-sets as-sets > 7 4 2 > 6 6 2 > 5 20 3 > 4 22 5 > 3 64 16 > 2 214 87 > 1 875 289 > > years stable is how many years that as-set was announced for that > prefix. > > total as-sets is the number of prefixes that had any as-set. > >real as-sets is the number of prefixes with as-sets which were not >singleton asns and were not private asns. > >olaf scanned for ten years but none were stable for more than seven. > >in ten years, 1205 different prefixes with as-sets were seen. removing >private asns and removing singletons left only 404 prefixes over the ten >years. > >he did not check for covering prefixes, i.e. two prefixes with the same >as-set where one was a sub-prefix of the other, longer, one. > >and i suspect the data are somewhat self-similar. i.e. the 289 that >were stable for the last year may have shorter term components which >were much higher. i.e. looking at data for a week or a day may give >higher values. > >a graph which should be pretty self-explanitory may be found at > > http://archive.psg.com/fraction-and-absolute-number-of-ASsets-in-table-over… > >it is interesting that, at no time, i.e. in no single rib dump, were >there more than 23 prefixes with as-sets. while this is suspicious, it >seems to be true. > >randy

1 0

large icmp packet issue
by fedora fedora 26 Sep '10

26 Sep '10

I am having problem getting ping to work to a specific destination host when using large size icmp packet and i am hoping someone here can offer some suggestion. With regular ping, i can ping this remote host without any problem, but if i crank up the packet size to above 1500 (1500 still works), i won't get any icmp reply. My first thought was this was a pmtu issue. but when I ran tcpdump on this remote host, i saw the incoming ping requests and this host actually sent back icmp replies, so it appears that there is some device in between blocking these large size icmp reply packets. Here is the question, how can i find out which hop on the path is causing this behavior? FD

2 1

Re: Online games stealing your bandwidth
by Robert Bonomi 26 Sep '10

26 Sep '10

> From nanog-bounces+bonomi=mail.r-bonomi.com(a)nanog.org Sat Sep 25 17:00:42 2010 > Date: Sun, 26 Sep 2010 00:01:38 +0200 > From: Jeroen Massar <jeroen(a)unfix.org> > To: Valdis.Kletnieks(a)vt.edu > Subject: Re: Online games stealing your bandwidth > Cc: NANOG <nanog(a)merit.edu> > > On 2010-09-25 23:53, Valdis.Kletnieks(a)vt.edu wrote: > > On Sat, 25 Sep 2010 21:43:25 BST, Matthew Walster said: > > > >> Was anything ever standardised in that field? I imagine with much of > >> P2P traffic being (how shall I put this...) less than legal, it's of > >> questionable legality and the ISPs would not want to be held liable > >> for the content cached there? > > > > The ISP is off the hook on that one. 17 USC 512(2) specifically carves out an ISP > > safe-harbor for data that's only cached on an ISP's servers due to an end > > user's request. IANAL, so have somebody you pay for legal advice read 17 USC 512(2) > > and tell you what they think. > > So it that is true, if you define "news server" as a "cache", even > though you have to buy several terabytes, make that several petabytes, > to "be able to "cache" this data one along with all the network > environment to support getting data out of this "cache", the ISP is > completely in the clear even though that "cache" is the sole single > point where one can retrieve that "cached" data from even years after > the data was originally put on the network, the original is gone and > that "cache" works without anything being attached to it ? :) There is existant _recent case law, specifically with regard to operating a newsserver, that holds otherwise. Of course the server operator was blatently _advertizing_ the copyright-infringing (and more) nature of their content. Several of the major ISPs who recently discontinued providing USENET did so as a direct result of the above-mentioned case -- attorney-generals were 'making noises' -- and the ISP chose not to risk a confrontation.

2 1