- NANOG - lists.nanog.org

inter-domain link recovery
by Chengchen Hu 21 Aug '07

21 Aug '07

Hi, folks I find that the link recovery is sometimes very slow when failure occures between different ASes. The outage may last hours. In such cases, it seems that the automatic recovery of BGP-like protocol fails and the repair is took over manually. We should still remember the taiwan earthquake in Dec. 2006 which damaged almost all the submarine cables. The network condition was quit terrible in the following a few days. One may need minutes to load a web page in US from Asia. However, two main cables luckly escaped damage. Furthermore, we actually have more routing paths, e.g., from Asia and Europe over the trans-Russia networks of Rostelecom and TransTeleCom. With these redundent path, the condition should not be that horrible. And here is what I'd like to disscuss with you, especially the network operators, 1. Why BGP-like protocol failed to recover the path sometimes? Is it mainly because the policy setting by the ISP and network operators? 2. What is the actions a network operator will take when such failures occures? Is it the case like that, 1)to find (a) alternative path(s); 2)negotiate with other ISP if need; 3)modify the policy and reroute the traffic. Which actions may be time consuming? 3. There may be more than one alternative paths and what is the criterion for the network operator to finally select one or some of them? 4. what infomation is required for a network operator to find the new route? Thank you. C. Hu

20 54

question on algorithm for radius based accouting
by Joe Shen 21 Aug '07

21 Aug '07

hi, I 'google' algorithm for radius based accounting. but can't find anything. My question is: what's the best algorithm for constrcting broadband access record from radius accouting packets? To my knowledge, some system takes: Record Accouting-on packet arriving time -> record Accouting-Off packet's Acct-Session-Time and Acct-Delay-Time -> The Log-off time is calculated as: Accouting-on time + ( Acct-Session-Time - Acct_delay-Time) But, some other takes : Record Accouting-off arriving time --> record Accouting-Off packet's Acct-Session-Time and Acct-Delay-Time --> Log-on time is calculated as: Accouting-off arriving time - ( Acct-Session-Time - Acct_delay-Time) Are the two methods have the same effect on calculating result? If radius packets were sent to two accouting systems simulataneusly, while the two system takes the different algorithm, will there be any difference between the result of accouting ? regards Joe __________________________________ Yahoo! Movies - Search movie info and celeb profiles and photos. http://sg.movies.yahoo.com/

4 6

Re: For want of a single ethernet card, an airport was lost ...
by Paul Ferguson 21 Aug '07

21 Aug '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Stephen Sprunk" <stephen(a)sprunk.org> wrote: >Such secondary procedures are okay in the banking world, where you can >back out transactions that an audit reveals are fraudulent after the fact. The same does not apply to letting persons across a border where you can't retroactively deny them entry after they've killed a bunch of people (and, most likely, martyred themselves). It's the same problem with voting systems, actually: the anonymity requirements mean all security hinges on making sure only authorized people vote, and only once at that; you can't back out fraudulent votes after they're cast, which is why all of the attacks are on the authorization system and being undetected in an audit doesn't matter. > It does matter. Unfortunately, find ourselves in a position where easy business decisions allow people to make very bad technical decisions, and put the integrity of their network security directly in the path of "test". "Test" is not a good business decision, because if there is a possibility where things can be compromised, generally they will be. We (collectively) have done a very fine job of delivering functionality first, and security secondly. That puts most of us in the position of the 'Little Dutch Boy', with our finger in the security dike. So, having said all that, it's pretty difficult to figure out where the problems and solutions actually meet. We're actually at a very difficult cross-roads right now. Cheers, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFGymB3q1pz9mNUZTMRAssqAJ4+J5jhtDoFWO81cjSvZ9JXArTMqgCguyzL R3oyka3IzcgVPtiFaYNOUUo= =2oUE -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

[policy] When Tech Meets Policy...
by Paul Ferguson 21 Aug '07

21 Aug '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 As bad as the "domain tasting" problem really is, will anyone from the Ops community speak up? http://www.icann.org/announcements/announcement-2-10aug07.htm I personally consider this issue to be one of the most insidious policy issues facing the Ops community at-large. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.2 (Build 2014) wj8DBQFGvpUeq1pz9mNUZTMRAgDbAKCznDQEwjl4dabVmS2luC9tIqtdZgCfQmOK cvaPDnzbGItoI2SYF0TBt+c= =TQS/ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

32 79

Cogent latency / congestion
by Mike Tancsa 21 Aug '07

21 Aug '07

Does anyone have any details about the Cogent outage that started this morning (9am GMT-400) and is still continuing ? If its a fibre cut between Montville (NJ?) and Cleveland OH (http://status.cogentco.com/) why is it so bad in Chicago and Albany locations ? Is there really that little excess capacity ? My connection out of Toronto is pretty bad via Albany 3 g8-22.mpd01.yyz02.atlas.cogentco.com (38.104.158.77) 7.470 ms 6.754 ms 6.481 ms 4 v3493.mpd01.yyz01.atlas.cogentco.com (154.54.5.85) 6.981 ms 6.730 ms 6.984 ms 5 g2-0-0-3490.core01.yyz01.atlas.cogentco.com (154.54.5.73) 6.482 ms 7.175 ms 5.974 ms 6 p4-0.core01.alb02.atlas.cogentco.com (66.28.4.217) 105.954 ms 112.055 ms 111.426 ms 7 p6-0.core01.bos01.atlas.cogentco.com (154.54.7.42) 115.413 ms 117.090 ms 113.816 ms and Bell's through Chicago is even worse 6 64.230.229.5 (64.230.229.5) 12.572 ms 36.983 ms 200.187 ms 7 64.230.242.97 (64.230.242.97) 4.685 ms 5.439 ms 3.645 ms 8 64.230.147.14 (64.230.147.14) 14.351 ms 15.344 ms 14.387 ms 9 206.108.103.142 (206.108.103.142) 14.374 ms 14.280 ms 14.255 ms 10 p13-0.core01.ord01.atlas.cogentco.com (154.54.11.29) 156.616 ms * 142.150 ms 11 te3-1.mpd01.ord01.atlas.cogentco.com (154.54.1.206) 135.199 ms 138.900 ms * 12 t2-4.mpd01.mci01.atlas.cogentco.com (154.54.2.233) 152.292 ms 149.956 ms 148.095 ms 13 t4-2.mpd01.iah01.atlas.cogentco.com (154.54.5.221) 149.047 ms 150.556 ms 151.232 ms ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

11 18

BGP Speaking tenants in 360 Spear // NAC
by David Ulevitch 20 Aug '07

20 Aug '07

NANOG, We're interested in doing a XC for a neighbor-of-last-resort with a BGP speaking tenant located at 360 Spear in the NAC on the first floor. This would essentially serve as an OOB peer and a fall-back default route for our office (which is point to point into the NAC). We would extend the same offer back to you. Replies off-list please. Thanks, David Ulevitch

1 0

Re: Cogent latency / congestion
by Robert Bonomi 20 Aug '07

20 Aug '07

> Date: Mon, 20 Aug 2007 15:21:38 -0400 > To: nanog(a)merit.edu > Subject: Cogent latency / congestion > > > > Does anyone have any details about the Cogent outage that started > this morning (9am GMT-400) and is still continuing ? If its a fibre > cut between Montville (NJ?) and Cleveland OH > (http://status.cogentco.com/) why is it so bad in Chicago and Albany > locations ? Is there really that little excess capacity ? No details, but I've seen reports of 100+ms between S.F. and L.A. on Cogent, as well.

3 2

RE: rv2 outage
by tariq biziou 20 Aug '07

20 Aug '07

>Although I have still NOT seen any evidence to either support >or dispell this report, I did see this report regarding some >sort of "show ip bgp regexp" DoS exploit circulating on Friday: show ip bgp regexp (.*)(_\1)+ Vendor C, please fix. -- --tariq

2 1

Re: rv2 outage
by Paul Ferguson 20 Aug '07

20 Aug '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Paul Ferguson" <fergdawg(a)netzero.net> wrote: >http://www.heise-security.co.uk/news/94526/ Re-checking this myself, I see that the report has been updated to include this acknowledgment from Cisco that they are looking into the 'problem': https://puck.nether.net/pipermail/cisco-nsp/2007-August/043010.html Sorry for any confusion. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.2 (Build 2014) wj8DBQFGyTw2q1pz9mNUZTMRAjbYAKC61wMego5fj2FsX3AKbwL98MfTvgCg9xU3 LXylChwLWVIVbrZpaFkVIV4= =Q5K+ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: rv2 outage
by Paul Ferguson 20 Aug '07

20 Aug '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Sean Donelan <sean(a)donelan.com> wrote: >On Sun, 19 Aug 2007, Randy Bush wrote: >> did anyone else see an rv2 outage yesterday? >> from Aug 18 04:17:30 >> to Aug 18 08:21:45 >> >> are these logged so longitudinal analysis can do a bit less 'heuristic' >> guessing? > >I'm guessing you mean route-views2. > >Some folks found a command that crashed the CLI on some public route-views >or looking-glass systems this week. > Although I have still NOT seen any evidence to either support or dispell this report, I did see this report regarding some sort of "show ip bgp regexp" DoS exploit circulating on Friday: http://www.heise-security.co.uk/news/94526/ $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.2 (Build 2014) wj8DBQFGySROq1pz9mNUZTMRAkt7AJ98ul+Q4ghYBuAEYUsozpQlKHU5LgCfapI3 7E/+E/wmYjfsmbyscsXsVTc= =1vbd -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0