- NANOG - lists.nanog.org

Any group(s) discounts to NANOG in LA?
by Peter Serwe 18 Sep '08

18 Sep '08

I'm so close to it, not attending is not really an option.. Peter -- ピーター

2 2

Atrivo Update
by Paul Wall 17 Sep '08

17 Sep '08

I've been in touch with all of the upstream transit providers currently routing Atrivo/Intercage netblocks. Without naming any names, they are all aware, and working on getting them pulled in accordiance with their AUPs. Hats off particularly to NTT and AboveNet for going the extra mile here. (Unfortuantely, I understand sales and contractual pushback can sometimes put a damper on these things.) Gas is still expensive, so Drive Slow, Paul Wall

1 0

Today's Point-2Point WAN Options
by Chris Kleban 17 Sep '08

17 Sep '08

Hello Nanog, I'm currently looking into what are the options for enabling inter-datacenter communication. Our current solution is to use ipsec/gre tunnels traversing over the Internet. The specific needs the new solution must meet are: - The ability to run end-to-end QOS. - Dedicated bandwidth - Support 1gbps transfer rates - Enable communication between 3 locations The options I have looked into so far are: - Layer 2 Ethernet (Virtual Private Line): This service seems to be offered by a lot of ISPs using various networking techniques. The price point is attractive however packets are forwarded only at best effort across the ISP's network which means the quality of the service will directly reflect the ISP's network performance. - Traditional Leased Line (dsX/ocX): This service seems to be more expensive then wavelength services however meets my needs. - WaveLength Services (oc3-10gig): This service seems to be cheaper then traditional leased lines when comparing similar bandwidth. However, availability is limited to on-net buildings. This solution meets my needs. - MPLS based VPN solutions: Seems to be a good point to multipoint technology with QOS offerings. However, the price seems to be around the same as wavelength services for the amount of bandwidth we require. If the number of data centers we were looking to connect was larger then this option would be more attractive. This solution meets my needs. Based on my needs and what my options are I am leaning towards point to point wavelength services connecting my 3 locations in a loop like fashion. Are there any other options I should consider? Are my descriptions of the today's possible solutions inaccurate? Are there any thoughts on today's pricing that differs then my findings? Thanks Chris Kleban

4 4

Re: Atrivo/Intercage: Now Only 1 Upstream
by hobbit＠avian.org 17 Sep '08

17 Sep '08

you expect them to apply a null route? Well, I *have* been talking somewhat idealistically here and there with this crop of questions, but frankly I thought in the 2 or 3 years I was ignoring the list that the NETWORK OPERATORS ostensibly in custody of the intertubes would have pulled things together a little better and grown enough of a pair to firmly state "this crap stops here and now" and make it happen. I do see pockets of good progress and research here and there and have gotten a lot of good feedback from people, but the big picture [as I watch my logs roll by] is pretty grim. Especially when the big players don't play at all. I've been around long enough to have a good idea of what *can* be done, but totally lost sight of any sensible reason why it *isn't*. Besides quarterly revenue, which is pretty short-sighted. Fortunately, I still have the luxury of being able to have my mailsystems tell cpe-*.rr.com and pool-*.verizon.net and c-24-*.comcast.net, along with large swaths of offshore IP space, to take a powder. Hundreds of times a day. But it's still their trash flying onto my tiny little lawn, and shouldn't be my job to sweep up. I mentally extend that picture to the millions of recipients who possibly aren't able to implement unusual and/or draconian filtering, and wonder how anybody ever gets any productive work done. _H*

2 1

Re: Atrivo/Intercage: Now Only 1 Upstream
by hobbit＠avian.org 17 Sep '08

17 Sep '08

So in cases like this where the community appears to agree that there's a consistently bad apple, what's preventing everyone from simply nullrouting the netblocks in question and imposing the death penalty? Sorry if this seems naive, but if no legitimate purpose is shown it seems like the obvious thing to do. Maybe they could still *send* packets, but nothing would ever get back to them. _H*

5 4

RE: LoA (Letter of Authorization) for Prefix Filter Modification?
by Skywing 17 Sep '08

17 Sep '08

It is only a good audit trail if the audit log can be trusted, though. Given how "secure" things like faxes are, well, that's a thing for another day, I suppose. Very few things out there in today's interconnected world really provide "hard" security, instead of security theatre/CYA/minor deterrants/"keeping honest people honest". That is not to say that these things have zero inherent value, at least in my mind, but they are not IMO to be confused with high security (as in military grade versus making a few clever [socially engineered] phone calls). Even so, much of the modern day business world relies on these things to some degree or another. - S -----Original Message----- From: Joe Greco <jgreco(a)ns.sol.net> Sent: Tuesday, September 16, 2008 11:15 To: Jon Lewis <jlewis(a)lewis.org> Cc: Rodriguez Mauricio <Mauricio.Rodriguez(a)fpl.com>; nanog(a)nanog.org <nanog(a)nanog.org> Subject: Re: LoA (Letter of Authorization) for Prefix Filter Modification? > On Tue, 16 Sep 2008, Christian Koch wrote: > > I dont mind, i think it is another good step towards 'good filtering' > > but...i think the PITA part is > > downstream 'clueless' customers, who may need an explanation on prefix > > hijacking and the state > > of the internet today, and that these are all just combined efforts to > > minimize the risk of accepting allocations > > that don't belong to you. > > IMO, it's just an illusion of added security and is really just CYA for > the provider. When I fax TWTelecom an LOA that a customer faxed to me, > how does TWTelecom verify the authenticity of that LOA? I doubt they try. > I suspect it's just filed, and will only be pulled out if the > advertisement is challenged by some 3rd party. How do you verify the authenticity of anything? This is a common problem in the Real World, and is hardly limited to LoA's. How do you prove that what was on Pages 1 to (N-1) of an N page contract contained the words you think they said? I knew a guy, back in the early days, who habitually changed the SLA's in his contracts so that he could cancel a contract for virtually no reason at all ... the folly of mailing around contracts as .doc files in e-mail. But even failing that, it's pretty trivial to reprint a document, so where do you stop, do you use special paper, special ink, watermarking of documents, initial each page, all of the above, etc? Look at what people are willing to go through with paper checks to increase the chances of authenticity. Google Abagnale. The real world already has ways of dealing with fraud and forgery, and while the paper is certainly CYA for the provider, it does provide an actual trail back that can probably be followed to some party. To refer to it as an "illusion" is only vaguely true. It is an illusion in that it will not prevent all cases of hijacking. Of course. However, it is another step that makes it significantly more difficult for someone to just start announcing random bits of IP space. It's just like physical security, in many ways. Given a sufficiently determined attacker, any door can be broken. Wood door? May require only my boot. Steel door? Prybar. Bank vault? Explosives. Etc. The thing is, as you increase the level of protection, the ease of countermeasures typically decreases (I wear my boots almost 100% of the time, I may have a prybar nearby, but I am unlikely to be carrying explosives at any time.) So let's not trivialize improvements such as LoA's which reduce the ease of hijackings, eh. ... JG -- Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net "We call it the 'one bite at the apple' rule. Give me one chance [and] then I won't contact you again." - Direct Marketing Ass'n position on e-mail spam(CNN) With 24 million small businesses in the US alone, that's way too many apples.

2 1

Creating a visual Map of a network?
by castellan2004-nsm＠yahoo.com 16 Sep '08

16 Sep '08

I am being tasked to map a network. In the past I have used nmap to find the systems on the local LAN and remote LANs (same enterprise). This time I want to create a visual map of the LAN. With cheops, I reasonably good results but cannot be documented for managers with certainty. What are some good tools now that will create visual maps of the networks? What is the best way to map a network when ICMP echo has been turned off? Thank you in advance for any help. Subba Rao

4 3

community real-time BGP hijack notification service
by Gadi Evron 16 Sep '08

16 Sep '08

Hi, WatchMy.Net is a new community service to alert you when your prefix has been hijacked, in real-time. Following the discussion on NANOG a couple of weeks ago on what to do if your prefix is hijacked, people mentioned that detection-wise, free services are limited (to certain communities or by not being real-time). The current fully public and free services will alert you with a few hours delay. Over labor day weekend we built a free real-time service. We invite people to try it out during our beta stage. Register for alerts at: http://www.watchmy.net/ We hope you find it useful, Avi Freedman, Andrew Fried && Gadi Evron.

13 27

IPv6 Penetration Survey: Your Participation Requested
by Member Services 16 Sep '08

16 Sep '08

The American Registry for Internet Numbers (ARIN), in cooperation with the Cooperative Association for Internet Data Analysis (CAIDA), is conducting a new survey to gather data regarding current and future use of IPv6. We have expanded the scope of the survey to seek IPv6 penetration data from around the world. We cordially invite and encourage all organizations in the AfriNIC, APNIC, ARIN, LACNIC, and RIPE NCC regions to participate in the survey so we can establish a comprehensive view of present IPv6 penetration and future plans for IPv6 deployment. The survey opened on 8 September and remains available until 17:00 EDT on 1 October. The results of the survey will be presented and discussed at the ARIN XXII Public Policy and Members Meeting to be held in Los Angeles, CA 15-17 October 2008. Additionally, the summary results will be shared with all the RIRs for further distribution within their respective regions. The survey data will support ongoing research. The survey is composed of 22 questions that can be answered in a few minutes. This is a secure survey and all data will be presented in summary form only, and kept confidential between ARIN and CAIDA. When you complete the survey you will be entered in a drawing for prizes, one raffle per RIR region. You must provide your contact information to win. Please take a few moments to complete the survey located at: https://www.surveymonkey.com/s.aspx?sm=loMM8qu18yFoKyi0rTUpQg_3d_3d Regards, Member Services American Registry for Internet Numbers (ARIN)

1 0

Re: Re: Anyone know Wiltel's EWAN service
by 정치영 16 Sep '08

16 Sep '08

Sorry, it is Los Angeles. I don't know whether our circuit is ralative to ATT oc12 ============================================= Chi-Young Joung SAMSUNG NETWORKS Inc. Email: lionair(a)samsung.com Tel +82 70 7015 0623, Mobile +82 17 520 9193 Fax +82 70 7016 0031 ============================================= ------- Original Message ------- Sender : charles(a)thewybles.com<charles(a)thewybles.com> Date : 2008-09-16 22:44 (GMT+09:00) Title : Re: Anyone know Wiltel's EWAN service La as in Los Angeles? Or Louisiana? There we're numerous strange issues last night in Los Angeles with T-Mobile that were caused by att loosing some oc12 circuits. That could have affected other carriers I'm sure. ------Original Message------ From: ChiYoung Joung To: nanog ReplyTo: lionair(a)samsung.com Subject: Anyone know Wiltel's EWAN service Sent: Sep 16, 2008 12:40 AM I have EWAN circuits of Wiltel(currently same company with Level3 you know) as my backbone circuit in LA. About 2 months ago, there were some packet loss on L2 circuit, but I didn't get any clear answer from Level3 support center. It became okey without any action, but now, same problem happen again. I feel bored, I need your help. Anyone know if there are any problems of WilTel's L2 circuit on LA area ? or Could anyone advice me the contact person who know well EWAN configuration of Wiltel ? Frankly, I felt Level3 guys seems to be unfamiliar with EWAN circuit of Wiltel. Best regards, Chiyoung ============================================= Chi-Young Joung SAMSUNG NETWORKS Inc. Email: lionair(a)samsung.com Tel +82 70 7015 0623, Mobile +82 17 520 9193 Fax +82 70 7016 0031 ============================================= Sent via BlackBerry from T-Mobile

1 0