- NANOG - lists.nanog.org

RE: IPV4 as a Commodity for Profit
by Paul Ferguson 20 Feb '08

20 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >1. Where is the current demand for IPv4 coming from? Plenty of analysis here. > I never thought I'd be doing this but: Can we please move this thread elsewhere? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHu9n1q1pz9mNUZTMRAh93AKDSBuNQZqcrXlNOhdytdEYVJDGLRACfSN7k dhZMaUnjtOofL5gsOJ2Db/E= =cMU1 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

4 3

2008.02.19 NANOG 42 Taiwan Earthquake Aftermath notes
by Matthew Petach 20 Feb '08

20 Feb '08

Sorry, quick flurry of notes all at once now that things are wrapping up. ^_^;; Matt 2008.02.19 Aftershocks from Taiwan Earthquake Two presentations, and the IPv6 hour is starting now... Randy Bush has some things to say about the IPv6 hour. The IPv4 LANs have been turned off; you will note that you don't have good v6 connectivity even if you're a v6 expert. Failure is as good as success for this. Thunderbird and Firefox have v6 DNS resolution turned off by default. Macintosh--if you put in v6 DNS server IP address, if you have capital A in it, it drops it! ISC DHCPv6 has issues Cisco NAT-PT has issues Linux based NAT-PT substituted in isn't scaling. So, we've learned a LOT already! The experiment has already been an excellent success as far as Randy is concerned. So, on to the talk. Martin Brown from Renesys will talk about the Taiwan earthquake analysis. With contributions from Alin, Todd, and Earl, all from Renesys. Will look at shape of aftereffects, and then will look at fallout, the shift in transit patterns. Large earthquake hit Luzon Strait, south of Taiwan on 26 Dec 2006 7 of 9 cables were severed in strait reviewed at APRICOT in Bali in 2007 2 not cut: Asia Netcom's EAC, and Guam-Philippines All cables reported reported on Feb 14, 2007. Renesys is like route views, but they do way more processing on the data. Adjacent or 1 hop away from 65% of all internet transit providers Focus on prefixes geo-located in Asia region. Defines what a network outage is, what unreachable means, and what unstable/flapping networks are. Pattern of taiwan earthquakes; shape of impact. ramping up of outages and spikes in instabilities. smaller quake on dec 27th Recovery pattern is typically noisy Outages/immediate aftermath of the quake, 10 days. 4 or 5 big quakes on the 26th, but outage ramps up slowly; the 27th quake has huge spike after that, much like last stick in Jenga. Almost 4000 networks suffered an outage due to the quakes. China, Indonesia, India hit very hard by it. Instabilities, same basic shape, more noisyness to it. same countries hit for outages and instability. Looked at the severity of impact; factor out baseline instability and outage for each country; compare that median to the peak; china/hong kong hit worst. About 70 times more outages in peak at hong kong as a result of the outage, 55 times more in taiwan For instability, china showed 1300 times more instability in 10 days after quake as in 2 weeks before the quake. what did it look like after the event, who went to new providers? Looked at transit relationships, mapped them into market regions, and ranked them based on size. So, score first, then rank. they geolocate all prefixes first of all, give it a location give score to prefix based on length pre-cidr are discounted, probably less well utilized also look at transit patterns for that prefix. ignore any more specifics that share same transit pattern. Now looking at all AS-to-AS relationship; they track all adjacencies on net. Will categorize the nature of the edge. computationally expensive, but lets them track all the relationships. gives a way to sum a score to a geo location or market. relationship between scores is important for ranking, the raw score doesn't matter. Don't show traffic volumes, profit, customer satisfaction, etc. If you have a retail score, if you show up adjacent in a market. probably in the region. Sprint is biggest transit for Sprint; but not much of a retail edge there. Can look at trend, see who gains or loses market share. coloured countries on map are most affected by quake. Look at the changes in the region since quake. compare by size, by deltas, and who gains, and who lost? India gained, Vietnam more than doubled in size four of 22 countries affected, look at the breakdown of who serves them. Can see which edges are interesting, and see who is growing. CW, tiscali, seabone/TI Fairly clear the transit patterns shifted as result of quake. Chunghua provided transit during the aftermath until the restoration. ATT lost Hanaro at quake, then VSNL dropped during time of repair, lost a bit of Asia Netcom, did well with Bharti. SingTel did very well; picked up China Netcom towards end of year; Vietnam Telecom chose singtel PCCW jumped 10 points, picked up starhub out of singapore close to cable repair point. telecom italia jumped 15 places in ranking; they got singtel, but no sharp jump in prefixes. simple metric of prefixes over time doesn't show whole story. Need to also see how *many* people chose the prefix over time. So new edge score is PPT (prefix, peers, time) sum the amount of time the peer saw the prefix routed on the edge during a time interval all prefixes have same weight cannot distinguish between an edge with a lot of prefixes seen by a few, and an edge with a few prefixes seen by many. In the aftermath of the quake, world prefers to use telecom italia to reach singtel. CW gains big in India, Bharti, TM net, jumps huge in the chart. Tiscali gains from Asia Netcom, 6000 prefixes, and wins providers in Hong Kong, Philippines Chinese providers grew, but didn't grow relative to other providers, so they dropped ranks. Still living with fragile internet, in asia and middle east; the cuts in mediterranean region from yesterday highlight that. Need more diversity in the region, both east and west. Q: CNET networks--were you able to detect partitioning, where japan could get to china, but not US, for example? Most likely, but they didn't focus on looking for that in this analysis. Q: Alin, Renesys, Telecom Italia and Singtel were peering before quake; after quake, relationship changed to transit, the prefixes shifted, and were picked up by rest of net. Q: Paul Ferguson, can you draw 30,000 foot view of impact of quake to the middle east cuts, to show relative impact of outages? They can can do that. Taiwan outages were 2.5x as bad as Alexandria, but press impact was higher. After taiwan quake, huge drop in spam and botnet attacks. Todd asks if that means he doesn't think the middle east is as good at spamming as Asia?

2 1

IPV4 as a Commodity for Profit
by Raymond Macharia 20 Feb '08

20 Feb '08

Hello the article here http://www.networkworld.com/news/2008/021308-ipv6-delay.html is an interesting read given the current state of IPv4 depletion/IPv6 conversion operational climate. As it is indicated, it's a proposal and there are considerations as to whether it makes things better or worse. Regards Raymond Macharia

20 48

newspeering
by Alex Rubenstein 20 Feb '08

20 Feb '08

Please, before you read on, put your [coke can|coffee mug|drinking apparatus] down, so that when you laugh, you don't get any liquids on your keyboard. I am overhauling our news transport network the past couple days. Phasing out some P2-300's and such. Anyway, we have tons of news peers out there, of which I have no idea how to contact anymore. Some of these peers go back to 2001. The issue is that our DNS will change for both inbound and outbound feeds. Whoever news peers with us will need to change to newspeer1.nac.net for both in and out. Email me and let me know who you are so I can actually have this information in the future. You know who you are, there are at least 40 to 50 of you on this list, I estimate. If you don't peer with our news box, and want to, email me your pertinent info. Back to your regularly scheduled hub-bub.

1 0

NANOG42 streaming down?
by William Petrisko 20 Feb '08

20 Feb '08

Anyone else not able to connect to any of the streams of the general session? http://winmedia.internet2.edu/nanog Servername incorrect or server busy. Try again. http://www.nanog.org/qtstream.mov 404: Not Found rtsp://quicktime.internet2.edu/nanog-qt.sdp 404: Not Found http://www.nanog.org/nanog2.ram rstp://198.108.1.99/broadcast/nanog2.rm Requested file not found bill

3 3

2008.02.19 NANOG 42 Peering BOF XVII notes
by Matthew Petach 20 Feb '08

20 Feb '08

Yay! Last one! Cheers to Bill for another successful peering BOF. Matt 2008.02.19 Peering BOF XVII notes A handful of new people, first-time NANOGers Bill Norton starts off by explaining a bit about what a peering BOF is. Who attends it, and for the new folks, what should you expect. Bill Norton shows slide show of what peering coordinators do. Over last 8 or 9 years, peering bof has grown pretty large. Aim is to have community seating, let everyone see who's speaking as much as possible. Goal is to have some folks you'll want to peer with by the end of the meeting. Inspire some dialog, and get people to exchange information. Most important part is to get the right people in the room; get the right people talking to each other; the technical details follow on from that. Bill's job is to facilitate that process. Very full peering agenda peering survey efficient technique for enforcing internet peering policies summary proxy socialogical alaysis of peering coordinator interaction asr transit playbook peering personals, batch 1 ken florance, netflix, video and peering jeffrey payne, p2p, topology awareness and peering great debate--does peering still make sense with transit pricing dropping peering personals part 2, people come to front, mingle some more. Tom Scholl starts off with Ren and Greg, goal is to get some communication going between peering coordinators. Take survey online, see results at end of march, early april. http://tinyurl.com/3xoa6g Sample questions--do you use IPv6 unicast BGP peering? do you use BFD? do you use 4 byte ASNs? what is largest frame size you use on peering links? what is your biggest concern when deploying a new feature? This will be first survey that covers lots of technical issues. Josh will put link at the bottom of the global peering forum page to make it easy to find. Thanks to Ren, Greg, Tom, and don't forget to participate! David Smith--Cisco--efficient enforcement of enforcing policy between peers. Peer should only have IP reachability to your customer prefixes. Should NOT be able to use your AS to reach one of your other peers. Most ISPs rely on BGP to enforce policies between peers. But if you use routing tricks, like pointing a default, there's nothing that stops the packets, they're only enforced in control plane. Alternate options--only carry partial routes on your peering routers; doesn't stop local peers using you as transit. Assumes your peering router is for peering only, no transit, no core. Static interface based ACLs; headache to maintain accurately, hardware issues, etc. proposed technique ISP tags peer prefixes uniquely within BGP and FIB tables ISP tags external packets that ingress peering interconnects based upon longest match prefix match within FIB ISP forwards or discards packets that ingress peering interconnects based upon associated packet tag value Not a futurist talk technique available today supported on high-end routers; not supported on the 7600s use table-map command to do prefix tagging use bgp-policy command to do QPPB for packet tagging use service-policy command via MQC to do packet classification QPBB provides glue between control plane and forwarding plane. IOS configuration sample shown route-map set-prefix-type permit 10 match comm 1 set ip qos-group 66 ip comm-list 1 permit ASN:66 int p3/1 bgp-policy dest ip-qos-map service-policy input peer-in provides much more scaleable manner to enforce peering policy, prevents people from using you as transit against your will. Use of QPBB as glue between control and data. Changes in BGP are automatically reflected in data plane control based on the tagging from BGP. Complements many of the other BGP control plane techniques in use today. All hardware based on the platforms mentioned above on engine 5 and above. You can do this on a Juniper with DCU too. :) arguably more elegant as it can be done in the firewall filter as a global policy. With DCU, instead of matching on QoS value, you can give the forwarding class a name value to make it more readable. Not a new technique, but with the interactions between BGP and MQC, it's not widely understood and used. RAS notes that one note about using it on Juniper; he and Tom talked about it a few years ago, you can build a RIB with just your customer routes, and then send default down an LSP to a traffic sniffing box. Dave notes you can look at snmp counters on DCU and get alerted when it crosses a threshold level of traffic as well. You'd also see discards in the class of service via the MQC MIB. Do people think this is a widescale problem? Do people think bandwidth stealing is happening? Ren notes they found someone who was stealing hundreds of megs of bandwidth in AMSIX; they're no longer a member there. Steve Wilcox has seen this happen at LINX as well; this is a theft issue, so it's odd that we think of it as a technical issue, rather than a criminal issue. Do people see this as an issue on a private peer, or only on the public sessions? Chris Malayter, social network around peering, helps run the peering IRC network many of us hang out on. Less activity on the channel once NANOG started, guess we're all talking face to face, not online. shows you when users are generally online. irc.terahertz.net, if you were here, you know the channel. :) Peering personals, first batch now. Hopefully people here are looking for peering at the exchange points. VideoBox, AS36472, peer with them, get free membership 365Main, PAIX, San Jose Equinix, SFMix, Heavy transit load from them; 98% is transit. No clusters out east yet. If you have eyeballs, they've got the content your eyeballs want to see. AS36472.net tens of gigs of traffic. They do ACL on their side, see things like leaked OSPF traffic, and tier1s that are on the public fabric, with high bar, starting with X, they leak OSPF and may send packets towards you. Simon Ferret Veoh AS40415, another video provider, no peering yet; content delivery through partners at the moment; thinking about insourcing at some point. P2P as well as streaming; if people use p2p, saves a lot of CDN volume; most is still over CDN right now; video on website is CDN based, download to keep is p2p. Aim is to get a good TV experience. Bryan Berg, Imeem, AS36119, social networking site; old school napster meets youtube, ad supported music streaming site. Looking for eyeball networks, 15G of traffic. Ash, SJC, public, private in CHI, LAX, PAIX PAO Looking for south america, philippines, malaysia, portugal About 30% peering so far; wasn't as hard as he'd heard, but it's not a walk in the park. Jeffrey Payne, peer-to-peer QA Used to be at real networks, used his gear to broadcast nanog in the early days; very knowledgeable about the current peer to peer arena. Q: What techniques do peer 2 peer networks use to determine which host to pull a fragment of a file from? Well, let's go back to what p2p is; early model of p2p used central sites and servers; then RIAA got involved, gnutella had horrible search but was decentralized; then Kazaa came along, got search better. Now, bittorrent is a huge explosion of micronetworks. The simplest model in use has no intelligence; don't mind the local transfers, but the remote ones hurt--but the system has no knowledge about near vs far peers. Why does remote vs local matter? Is it due to asymmetric last mile? It's more the bit-miles issue; how much are you moving over how many network miles? commercial systems are trying to introduce intelligence; aimed at one-to-many data delivery, with central command and control that you expect from commercial delivery system. So, for commercial interests, need to work to optimize flows and reduce costs in one-to-many or few to many model. The P4P model has ISP intelligence in the Itracker to give some sense of topology to the torrent tracker. with the old system, it couldn't tell local peer from remote peer. Newer system has to 'infer' from hop counts and performance indices to figure out who is better/closer than others. Frank, talks about IPTV on your computer, p2p supported CDN, can take content from multiple sources. Goal is to add more control into tracker to optimize the assignment of clients to seeds. Pando networks, P4P networks speaks up, come talk to him, he can get you all the information you could want on it. But will networks really participate out of the goodness of their hearts? Not so much that, as about reducing the operational expenses. Is there some level of buyin from the people here around that architecture? Verizon notes that you don't need to provide a huge amount of data to get a big win. who would be willing to contribute data? a good chunk of the room. consumer adoption is the challenge; now that flash supports sockets, can start doing it in the browser. traffic shaping devices are targetting more and more protocols, like http, when they used to just target p2p traffic. The commercial side is agnostic; just don't want to be traffic shaped. Moving from mp3s to mpeg4, traffic volume is really skyrocketing, we need to start thinking more intelligently about the problem. Many of the major p2p efforts are behind it as well. Can we do more optimization in CMTS systems, DSLAMs, and try to get network layer efficiencies. Any last minute thoughts? Both trying to create these commercial content delivery systems; may not be seeing it quite as holistically, but both trying to improve the situation. Peering News Ren Provo moved from SBC/ATT to Comcast now, she can now watch premium channels while saying "No" Peter Cohen moved from uh...well...to Sprint as peering coordinator. The great debate--does peering make sense anymore? Pro--Patrick Gilmore--peering still makes sense Con--Guy Tal--peering doesn't make sense anymore 2 minutes per side, referreed match. Patrick still saves money to peer in the right place Also provides multiple vectors, provides better resiliency in case of issues. Also, provides better scaling as traffic grows, allows for scaling as needed to specific areas. Provides shorter paths to talk to people in an area. Helps getter better transit deals when you go to good central peering locations. Guy Peering is hard; as was pointed out earlier, our transit prices are decreasing, it's getting close to transport cost; why spend your resources and time doing an exercise that's someone else's core competency; focus on your core competency instead. Let the carriers do the heavy lifting for the most expensive part of the work; they have multiple vectors already, they know how to scale. Why try to map who the right peers are to go after, and how to protect yourself from your peers--let your transit handle that headache. Patrick Peering is indeed hard, it's hard to set up a network that's resilient; but there's many things that are hard but are still useful. You'll have to have some level of clue already to set up your network; it's not that much harder to add BGP to the portfolio of skills needed. Transport is getting more expensive relative to transit, but they haven't crossed yet; you can still get ring-based paths for less than transit for now; so you might as well go to the peering point, get access to your transit provider as well as your peering partners at the same facility. Guy While transport hasn't crossed transit, you also have many other costs; engineering resources, a NOC, pay for rack/power at peering sites, router costs to go into peering points, etc. There's many fixed costs, like buying a peering port; per-port cost may be more than you pay for transit initially. Transit gives you SLAs, peers don't. The more traffic you give to your transit, the better your cost. And whatever you may think, peering isn't free. You'll always have to have some transit relationship; if you're not already SFI, you'll never be able to be SFI, that club is closed; so, since you're not going to be able to meet everyone's peering requirements, you'll need to keep transit, might as well let them handle it all for you. Patrick Scalabiility, reliability, performance need same skillsets you already need to run your network to do BGP; doesn't greatly increase your skillset, should be a minor increase over skills you already have; will allow you to go to places where you can get better pricing, and will allow you weather internet daily issues that come up. Guy Having a higher percentage of peering will raise your costs initially; until you do a large amount of it, it won't save you money. And it's not true that it's a minor skillset above running a basic network; let someone with the real skillset handle it; you don't have to worry about someone patenting peering and suing you over it, or being accosted by Patrick asking whether or not you peer yet. So, who made the more compelling case--people get to vote once for each side. The people will be counted. "Patrick believes peering is hard, but is also useful" 62 and 45 in favour of Patrick? 14 and 14 in favour of Guy 107 to 28 in favour of Patrick. Now, feedback from audience. Port costs on public peering fabrics have not tracked in relation to transit costs dropping. Peering to someone can help get additional ports in place faster to provide capacity, rather than getting two different networks to upgrade their transit links. Prices in Europe are so different, it makes more sense in Europe than in US; prices in US need to get more in line with EU. Brokaw agrees that without visibility on links, it may be very hard to tell how well your transit provider will be able to handle surge loads or increases in traffic over time. Patrick notes that with most of the networks, it's the transit port to the other end of the conversation that has capacity challenges you can't fix. Over to Ken at netflix to talk about challenges with handling video traffic. They used to do DVD rentals only, now doing bits over the wire as well. In January, went from money capped, to model where service isn't capped. Unlimited PC viewing, not MAC viewing yet, DRM issue. Future looks like people consuming things on PCs, TVs, etc. Have services embedded in DVRs, HDplayers, game consoles, things hooked to both TV networks as well as IP networks. Volume can end up growing drastically. Want to keep traffic off people's backbones if at all possible; optimize p2p delivery, cache, etc. People are consuming their content through IP networks more and more. Goal is to get the bits into the access networks; can peer at centralized locations, or they can put equipment in their pops if that makes sense. If you have ideas on where they can stick their equipment, come let him know. Cheol Hee Yun AS3786 LG Datacom Largest IDC in Korea 4Gb in Korea, 10Gb in US, they are present in PAIX Palo Alto, and Equinix San Jose They don't have peering in Korea, unfortunately at this time. Again, don't forget to fill in the survey!

1 0

2008.02.19 NANOG 42 JumboFrames across the Interet
by Matthew Petach 20 Feb '08

20 Feb '08

*whew* Two more to go. :) Matt 2008.0-2.19 Tom Scholl, ATT labs, Jumbo packets on the internet MTU = maximum transmit unit PMTUD = path mtu discovery Every media has its own 'standard' MTU. Most have large MTU of at least 4470 Ethernet MTU is 1500, which makes the large size in core mostly useless. benefits of bigger packets==fewer packets per second, fewer lookups, fewer interrupts. on the host, does it really help? What about jumboframes? what's a jumbo frame? anything bigger than 1500; modern gear can do larger than 1500; driven by customers, not by a standard. Path MTU discovery fragmenting packets and reassembling is difficult PMTUD detects lower MTU, sends message to host asking it to readjust packet size. PMTUD is very easy to break. filtering ICMP kills it if not done right. If mismatched MTUs on a link, PMTU can't detect it. path mtu mismatch can't be communicated back if the far end of a link has an MTU too small, as upstream never gets the message. Interprovider jumboframes works great on point to point links; but what about point to multipoint links? Can't negotiate to a given router, so has to be set across the fabric/subnet. how about adaptive arp protocol; use existing arp to find MAC address, then use that to probe for MTU on path. good luck getting it implemented. hacking it in BGP might work, but would require everyone to run BGP. some exchanges have different vlans for jumboframe (NetNOD) but we already have so many vlans! what's a good target MTU? How about 8192 plus lots of header room and encapsulation room. anything bigger than 1500 makes sense. What about going all the way up to 65k? how do you specify the MTU on an interface? is it frame payload frame payload plus headers ...plus FCS ...plus 802.1q depends on vendors and cards you're running. Not all vendors can do 9k older cisco gear older juniper PICs enabling jumbo can be production impacting. may be unrealistic to rexpect jumboframes to reach all the way to home users for any time soon. Actions required have IEEE standardize on a new MTU value? Need a negotiation to discover neighbor MTU need less breakable replacement for PMTUd http://darkwing.uoregon.edu/~joe/jumbo-clean-gear.html Q: better PMTUd--could end host report back to sending host that the biggest sized fragment I got back was Y, don't send packets bigger than that please? Sounds reasonable. Q: Todd, Renesys. Lots of challenges, and a few benefits; does this mean we're stuck with 1500? Will larger MTUs actually happen? Can we at least support 1500 across the board? larger would give more room for encapsulation as we add more and more header foo into the mix. Q: Danny notes that options aren't being calculated correctly; is MD5 calculated before or after CRC, etc. Q: Kevin Oberman, ESnet, RE networks around the world are generally running jumboframes, the joint engineering task force, under department of defense came up with recommended value of 9000 bytes, and the RnD community has standardized on 9000 payload bytes to be usable from end to end; intra-AS is your own business, but if you want to talk to the Q: Darrel, Calren, when you have a boundry, you have a big cloud of 9000 byte MTU, your edge device will have to handle the fragmentation; be aware of the performance impacts that you may cause in having edge router have to process and deal with or discard. Q: Patrick--we're basically talking about distributing the fragmentation processing challenge out towards the edge; sounds like a reasonable idea to implement. Q: David Sinn notes that he's dealt with issues at the gigapop where setting the DF bit is actually nicer than making the edge router try to handle the fragementation. What about using rate limiters Q: RAS, why are we doing it at all? IPv6 doesn't support it at all; why not just stop doing fragmentation across the board--if you forget to set DF, you just blackhole yourself. OK, Break time. Survey is linked off nanog.org, go fill it out! In spite of late start first two days, we start at 9am tomorrow--wake up extra early.

1 0

2008.02.19 NANOG 42 Law enforcement interaction with nanog
by Matthew Petach 20 Feb '08

20 Feb '08

Three more to go, yay!!! Matt 2008.02.19 Paul Fergusen, Trend Micro, Law enforcement engagement and response handling, NANOG engagement. Not geared towards just ISPs who are bitshippers; some issues will overlap into their areas of responsibility. this is a subset of slides for anti-phishing talk to be given in Tokyo. Mostly the issue is in EU, Asia, where contact information for responsible party is incorrect or outdated. Problem--web threats have moved from highly visible media events to financially motivated threats. Attacks to infrastructure are waning, mainly just kids being pissed off, or someone has a grudge. The true financial attacks don't want to lose connectivity, so infrastructure DoS attacks are counterindicated. Not just windows, now hitting Linux and Mac as well, aiming to comporomise Linux servers. You end up with thousands of compromised websites infecting more and more machines. Used for click fraud and other financial engagements. Notifying the victims as well as notifying the users, two different challenges. Contacting the owners of the IP space on both ends is tough. Large rise in misconfigured, rogue DNS resolvers; many sitting on compromised boxes, on home connections, etc; boxes will resolve anything, possibly incorrectly; estimated 300,000 compromised DNS servers. Threat vectors now moved to web; Google finding 180,000 web servers serving malicious code in their crawls. Even trusted websites getting used to source malware. Government sites/city/county are targets as people trust them. Primary goal of security company is to protect the customer; they have a staff who implements honeypots, sandboxes, reverse-engineered binaries, they incorporate new AV signatures, etc. Try to notify owners of compromised sites; can't handle that for 75,000 servers. Secondary goal is to actually find the criminals; so very few staff who work with law enforcement agents, work with national CERTs/CSIRTs, etc. Stuff massively falls through the cracks. abuse@ is falling through the cracks more and more often. Don't dumb down the language used; this isn't just 'cracking', this is criminal activity; serious moving of money from account to account, using moneygrams, western union, and Xboxes. Some of the activity now is more properly organized crime; the internet is a success, as the activities of the real wold have moved online; the criminals follow the money, and the money is now online. Much unwanted traffic is actually backscatter from criminal activity. There's enough low-hanging fruit to make this a multimillion dollar a year industry for them. Many criminals operating in the open, as there's not enough resources to track them down and stop them. Goal and desired results better two-way communication for all stakeholders law enforcement NGOs (non-government organizations) National and organizational CERTS and incident response teams. We're up to 700+ registrars, so it's getting harder and harder to track people. Hasn't been much backlash against it, as credit card companies are eating the losses; but some areas are making customers more liable for losses, and bank may reserve right to investigate your PC to make sure it is kept up to date, or you may be liable for the loss. Trying to work with the unwitting middleman between criminals and the victims. Need to get better reporting mechanisms for cybercrimes, engage the ISPs better at picking up the ball; if we don't police ourselves better, we may find ourselves getting stuck with having the policing forced on us. For NGOs, already have some piecemeal relationships in place. FIRST.org affiliate list of CERTs/CSIRTs as a baseline is a good start. When an issue comes up, start trying to contact people up through the contact lists; worst case scenario is having to publicize the issue to try to get in touch with people. Use the FIRST.org list--it works! ISP and network operations engagement is not an easy path, but it has to be done. Biggest challenge is internal processes are weak; domain information is often completely incorrect. discipline is everything, and disciplined process is crucial. Registry info (RADB, RIR, RIPE, ARIN) tend to be pretty good, as that's a registry of resources. NANOG is uniquely positioned to take a leadership role in trying to get these principles adopted. We're on a good path, but there's lots of course corrections; we see the threats in near realtime, the same compromised server on tens of thousands of webservers all over the internet; many .gov and .edu hosting malicious code, fake canadian pharmacies, etc. Need NANOG community to act as one voice with internal engagement. Is this the right way to take action? Do people prefer to handle things this way. Q: Carl at mike notes that "bulletproof hosting" is a red flag--beware of it. Q: There's a set of at least 5 ISPs in the US who are very black, who are *not* helping in our efforts in this war; why are they still allowed to advertise routes on the internet? Q: Mike at the mike, from Cisco; from NIAG, the idea was to have a /security page on each webserver that told you how to contact people at a company when there's an issue, as now root@, hostmaster@, and abuse@ are generally black holes. What we're really lacking at the moment is process; how can you make sure that contacts are reachable? Q: port scanning, if we're considering that 'criminal', why not also come down hard on the copyright violators? In finland, there are criminal cases from banks against port scanners. We're 13 minutes overdue, so hold rest of questions for later.

1 0

2008.02.19 NANOG 42 Lightning talk #7 freenum.org talk
by Matthew Petach 20 Feb '08

20 Feb '08

Only a few more to go, and then the drinking can commence. ^_^ Matt 2008.02.19 Lightning talk #6 Freenum.org INOC-DBA for the rest of the world use DTMF handsets to talk to SIP-based systems. INOC-DBA Central SIP proxy endpoints are all register or "static" routed Great for its purpose scales well to expected small environment. Adds ASNs to dial string. only works with entity with ASN Goes from least specific to most specific. Problem with using telephone numbers; E.164 numbers tied to taxation, assignment, regulation issues. Can't give everyone with email an E.164 number. You can't delegate E.164 numbers; only hierarchy is geography/subgeography. 1234*256 256 is in an ITAD number RFC3219 (TRIP) allocated by IANA, no charge 32 bit number. DNS used for all data delivery control can be delegated to the org or wildcarded for ease. 1234*256 becomes NAPTR 4.3.2.1.256.freenum.org becomes 1234(a)loligo.com in SIP notation it's like ENUM; uses same protocols for lookups; but zone is delegated out to individual companies. Doesn't solve SPIT--just a pointer system. about 600 ITAD participants 2+ years in testing self administration web pages up now. 48 nations, many higher ed, high end networking folks using it. get ITAD from IANA publish your NAPTRs in the freenum.org zone compatible with asterisk, and other dump sip systems. many scripts available for your platform for gatewaying calls. You can track him down jtad(a)freenum.org? Wow, he's fast! You have until 4pm to submit lightning talks for tomorrow.

1 0

2008.02.19 NANOG 42 Lightning talk #5 network costs in the core
by Matthew Petach 20 Feb '08

20 Feb '08

2008.02.19 Lightning talk #5 One more round tomorrow, submit your ideas now! Curtis Villamizar, Drew Perkins Total network costs in the core. glimpse at key findings; look at slides later. Made up topology, came up with core nodes, core links onto it; presented to non-IP-aware group at Stanford. 66 cities modeled, 18 core cities, you have small city-to-city traffic flows, you aggregate them into large core-to-core traffic flows. costs with various interfaces. costs for various network interfaces. Router costs for OC768 on large routers; aimed for demands comperable to smaller ISPs on left, and larger ISPs are on the right, and then scaled out to right into future. At low utilization, you have wasted, unused capacity on OC768; for 10gig, similar curve, but much; $700/Mb for OC, $400/Mb for 10g costs for l2/l3 10gigE; smaller capacity, you need to build a CLOS, an array of routers to handle capacity, you get beyond one; but router costs go WAY down, so your transport costs dominate, rather than router costs, and drops you to $250/Mb UUnet did IP router bypass parallel 10gig links between sets of cities; if you put links bypassing routers, you can eliminate interface card costs, save money. Practical limit to IP bypass, based on the traffic matrix needs and failover requirements. at top end, bypass ends up being full mesh, which is also impractical. IP router bypass link cost savings can be very substantial, if you can use them; but the practicality is limited by the number you can effectively make use of. Even with free transport, full mesh is not cost effective. Impact of MPLS TE...lots of interesting directions they're going into. OC768 tops out over OC192, which tops 10gigE

1 0