- NANOG - lists.nanog.org

Agenda topics for Dallas
by Susan Harris 18 Jan '06

18 Jan '06

Greetings - here are the talks we've lined up so far for Dallas. Stay tuned - we'll be adding new topics often. SUNDAY ACTIVITIES ----------------- Newcomer's Orientation and Reception 3:30 - 5:00 p.m. Steering Committee Community Meeting 5:00 - 7:00 p.m. Welcome Reception, (fabulous) location TBA 6:30 - 11:00 p.m. GENERAL SESSION (Monday, Tuesday, Wednesday morning) ---------------------------------------------------- - Searching for DNS Cache Poisoners Duane Wessels, Measurement Factory/CAIDA - How Prevalent is Prefix Hijacking on the Internet? Peter Boothe and James Hiebert, Univ. of Oregon; Randy Bush, IIJ - Hurricane Katrina: Telecom Infrastructure Impacts, Solutions, and Opportunities Paula Rhea, Verizon - Flamingo: An Internet Traffic Exploration Tool Manish Karir, Merit - NVisionIP and VisFlowConnect-IP: Two Tools for Visualizing NetFlows for Security Bill Yurcik, NCSA - Panel: Time for the Transition or Just More GOSIP? Dan Golding, Burton Group, moderator - IRR Power Tools: a Utility for Managing Internet Routing Registry Filters Richard Steenbergen, nLayer Communications - Flooding Attacks by Exploiting Persistent Forwarding Loops Jianhong Xia, Lixin Gao and Teng Fei, University of Massachusetts - Clear and Present Increase of AAAA Queries Tsuyoshi Toyono, Keisuke Ishibashi, Katsuyasu Toyama, NTT Labs = v6fix: Fighting Against an IPv6 Pandemic Kenjiro Cho, WIDE Project/IIJ, Ruri Hiromi, WIDE Project/Intec NetCore RESEARCH FORUM -------------- - An Inter-domain Consistency Management Layer Nate Kushman, MIT TUTORIALS (Monday/Tuesday afternoon) ------------------------------------ - Troubleshooting BGP Level: Introductory Philip Smith, Cisco - Overview of QoS for Packet-based IP and MPLS Networks Level: Introductory/Intermediate Paresh Shah, Utpal Mukhopadhyaya, and Arun Sathiamurthi, Cisco BOFS (Monday/Tuesday afternoon) -------------------------------- - Tools BOF Todd Underwood, Renesys, Moderator - ISP Security and NSP-SEC BOF XI Danny McPherson, Arbor, Moderator - Peering BOF XI William B. Norton, Equinix, Moderator Abstracts are linked off this page: http://www.nanog.org/mtg-0602/topics.html See y'all next month.

1 0

BGP route flap damping
by Gustavo Rodrigues Ramos 18 Jan '06

18 Jan '06

Hi folks, Last week we received a DoS attack which got down my BGP connections to my upstream providers (for three or four times I believe). I also belive that event caused some routers to suppress my BGP announcement. I would appreciate suggestions on "how to proceed?" with this situation. Thanks in advance. Regards, Gustavo.

4 5

Re: Intradomain Traffic Engineering
by Robert Boyle 18 Jan '06

18 Jan '06

At 12:06 AM 1/18/2006, you wrote: >(snip) >wrong prediction, the technique suffers very high MLU (as high as 140%). > Basically, I have the following two questions: > 1. In the traces I have, there exist several intervals with a > huge, sudden increase of traffic on some links. The prediction > model I use cannot predict those 'big spikes'. Do these 'big > spikes' really happen in operational networks? Or are they merely > measurement errors? If they really happen, is there a gradual ramp > up of traffic in smaller time scale, say, on the order of tens of > seconds? Or do these 'big spikes' really occur very quickly, say, > in a few seconds? Nobody can predict them so you build your network with excess capacity from an overhead standpoint as well as a link standpoint. Here are several reasons for variation and unpredictability. This is not a comprehensive list and I'm sure others will add to it. CNN or other major network coverage including major advertising events - super bowl, victoria's secret show, etc. (10s of seconds) SQL Slammer / Code Red / Nimda / or other major fast moving outbreaks (10s of seconds - maybe. We saw the spread of SQL slammer within 2 seconds to many unmanaged colo customer machines) depeering of any two or more large networks or routing mistakes or flapping thus dampening (a few seconds to 10s of seconds to hours) major provider outage which moves flows to other paths (a few seconds to 10s of seconds) fiber cuts / regional power outages (a few seconds to 10s of seconds) significant events such as 9/11 & Katrina (a few seconds to many hours) > 2. I have the option to make a tradeoff between average case > performance and worst case performance guarantee, but I don't know > which one is deemed more important by you. Are ISP networks > currently optimized for worst case or average case performance? Is > the trade-off between these two an appealing idea, or may the ISP > networks are already doing it? Each ISP makes their own decisions based on their business needs, budgets, and promised SLAs to customers -Robert Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Well done is better than well said." - Benjamin Franklin

1 0

Service contracts and "Morally objectionable activities"
by Kevin 18 Jan '06

18 Jan '06

On 1/17/06, Bill Nash <billn(a)bacchus.billn.net> wrote: > On Tue, 17 Jan 2006, Matt Ghali wrote: > > On Tue, 17 Jan 2006, Robert E.Seastrom wrote: > >> The first and second paragraphs are sane. The last paragraph gives Go > >> Daddy the right to capriciously and arbitrarily delete your domain for > >> any reason they wish ("Morally objectionable activities will include, > >> but not be limited to...") > > > > Do you believe that your philosophical objections to the language absolves > > you as a customer from the minimal due dilligence of knowing what you are > > agreeing to? > > Find me a registrar that DOESN'T have that kind of language in their user > agreements, then tell me if anyone wishing to do any kind of e-commerce > has a choice. Yes, but that language DOESN'T have to stay in YOUR agreement. Many registrars will negotiate contract language, at least for larger customers. My employer isn't a huge network operation, with just a few hundred domains, but is big enough to have staff counsel, and stubborn enough to routinely stonewall ISPs and registrar's into removing content related clauses from their contracts. Messes with my project deadlines, but better late than Godaddy. > I've gone off on a tear about this before: A registrar has a license to > print money. Boilerplate user agreements that leave the user zero recourse > are the standard. I haven't seen a registrar yet that doesn't have this > kind of verbiage completely freeing them from liability for *any* action > taken on a domain registration, including none. And this is why, if any money is riding on the service at all, you have at least one law talking guy vet all contracts at the front of the process. Kevin Kadow

1 0

OT: Training
by Ted Fischer 18 Jan '06

18 Jan '06

All, I am working on a training proposal, and would appreciate your input. This training is going to be an introductory course aimed at those who are new to networking. Just to put it in context ... I'm presuming that most of you on this list have help desk personnel who would be 3 or more levels above the training I'm working on. For example, if I even mention BGP it would be along the lines of "BGP is a routing protocol {presuming I've even mentioned routing protocols} that is used between ISPs." Period. I don't expect that people coming out of this particular course will be able to do even non-VLSM subnetting - with a calculator, let alone on paper - but at least they will have seen it. What I'm more interested in from you all is something along the lines of - "What do you wish the Help Desk personnel that your Help Desk is trying to help actually knew." Or even, more basically, "What do I wish that people interested in - or in the process of being hired for/"promoted to"/assigned to (because no one else wants it) - network help desk assignments knew, or should be sent to training to learn, before even trying to talk to me". What would be an appropriate 5-10 minute overview (i.e. what is MPLS and how does it help networks), and what might be appropriate for more in depth (i.e. IP Addressing basics). What networking myths do you want me to bust? I may also be able to let them actually do something ... perhaps run a traceroute (live or canned, not sure yet) and explain how it works. I will definitely have a chapter - or at least portion of a chapter - on history (how we got where we are), including the who/what/why/where/when of RFCs (traceroute might be a good one to explore the technical aspects of implementation; i.e. why should UDP be used instead of ICMP - what do the RFCs say about it). If nothing else, I may assign some of Jon Postel's writing for research - like RFC 791 :-) Everyone has to start somewhere, and I want this to be the best, yet most succinct, training I can come up with. Please keep in mind that I only have 4 or 5 (probably 4) days to do this in. It is meant to be an introduction, and not cure all network training fauxes pas (is that the correct plural?) in one fell swoop. One of the other things I want to accomplish is to hook people on networking so that they will continue their training. Off-list replies welcome - you decide. Thanks. Regards. Ted Fischer

1 0

Collateral Damage
by Patrick W. Gilmore 17 Jan '06

17 Jan '06

My previous post sparked quite a bit of traffic (mostly to me personally). It also sparked some confusion. That's mostly my fault for writing e-mails far too late at night and mixing it with an emotionally charged thread. So I would like to separate my questions out of the GoDaddy thread, write them slightly differently, and give a little more scope for clarity. These questions are designed as "yes/no", not "it depends". The idea being if there are general circumstances (not billion-in-one corner cases) which would make the action in question acceptable, please answer yes, and move to the next question. For instance, I would answer the first question as "yes", because there are circumstances which happen reasonably often where I would take down an innocent domain to stop network abuse. (E.g. I would null-route a /24 that is sending gigabits of DoS traffic, even if there is an "innocent" mail server in that block.) Anyway, on to the poll. You are welcome and encouraged to send the answers to me privately, I will collate and post back to the list in a few days. * Please answer yes/no. - Additional text is encouraged, but I need a yes/no to tabulate the vote. * These questions are not regarding a specific provider or even specific abuse type. - You can consider spam, DoS, phishing, hacking, etc. - Please assume what you consider to be the "worst" abuse which is common on the Internet today. * There is a basic assumption that due diligence has been applied. - You have investigated and are certain this is not a false positive or such. - I hope we can all agree that shutting someone down without doing proper investigation is a Bad Thing. * There is a basic assumption of notification and grace period. - The provider in question knows Bad Things are happening. - The provider in question has had a reasonable amount of time to fix said Bad Things. - Bad Things are still happening. * Please do not consider extremely rare occurrences or utra-extreme scenarios. - Null-routing an IP address to stop nuclear war is not in scope of this survey. If you have any questions, please feel free to e-mail me. 1) Do you think it is ever acceptable to cause collateral damage to innocent bystanders if it will stop network abuse? 2) If yes, do you still think it is ever acceptable to take down a provider with 100s of innocent customers because one customer is misbehaving? 3) If yes, do you still think it is ever acceptable if the "misbehaving" customer is not intentionally misbehaving - i.e. they've been hacked? 4) If yes, do you still think it is ever acceptable if the collateral damage (taking out 100s of innocent businesses) doesn't actually stop the spam run / DoS attack / etc.? Thank you all for your time. -- TTFN, patrick

1 0

DOS attack against DNS?
by Roy 17 Jan '06

17 Jan '06

I just started seeing thousands of DNS queries that look like some sort of DOS attack. One log entry is below with the IP obscured. client xx.xx.xx.xx#6704: query: z.tn.co.za ANY ANY +E When you look at z.tn.co.za you see a huge TXT record. Is anyone else seeing this attack or am I the lucky one? Is this a known attack? Roy

11 18

AW: Odd policy question.
by John van Oppen 17 Jan '06

17 Jan '06

Assuming that you are running separate authoritative and recursive servers this would only be a problem when someone goes to a lame-delegated domain. It is probably also good to note that it is a best practice to separate authoritative and recursive servers. john -----Ursprüngliche Nachricht----- Von: Christopher McCrory [mailto:chrismcc@pricegrabber.com] Gesendet: Friday, January 13, 2006 11:49 AM An: Randy Bush Cc: nanog(a)merit.edu Betreff: Re: Odd policy question. On Fri, 2006-01-13 at 08:32 -1000, Randy Bush wrote: > > Don't forget: > > www IN CNAME goatse.cx > > and don't forget the terminating dot on goatse.cx. > > but this did cause me to update those trapper zone files and > bump the serials. last time the serials had been bumped since > 1995. so you had the suggestion of a decade. mahalo. > Ouch. So you are going to punish the rest of the world for the mistakes of a few people (however annoying it is). /me just cannot imagine explaining this to my mother when she mis-types some URL. Granted that what your (former-) customers did was not any sort of best practice, but I think your "solution" is a little too extreme. > randy -- Christopher McCrory "The^W One of the guys that keeps the servers running" chrismcc(a)pricegrabber.com http://www.pricegrabber.com Let's face it, there's no Hollow Earth, no robots, and no 'mute rays.' And even if there were, waxed paper is no defense. I tried it. Only tinfoil works.

18 36

Marc, care to respond?
by Mark Bodley 16 Jan '06

16 Jan '06

I agree that in fact it seems that Go daddy followed their procedures to the letter as they are supposed to do. The gentlemen in "The President's office" was very concise in his assessment of the issue, AND his repeated attempts to take the issue home to closure. I used to work for a guy that ran a datacenter in a similar way, and had to make calls on his behalf to carriers to plead my case, after emails to the principle went unanswered. I can feel the pain that Marc was under in his pleas, and hope that I have never been so whiney, or belligerent with my carriers. After reading his home page I see there is a bit of leaning towards aggrandizement, so with a balance to all: Marc would you care to respond now that our feet are out of the fire? The repeated use of the phrase that an entire datacenter is turned off is rather distressing, given that all that was turned off where the links to the primary name servers? We operate in a datacenter, and provide name services to our clients. Often, we have to shut down, remove from network, a non-managed server, that is spewing crap. Usually we are the ones to discover this, but if our carriers report this, we have to respond quickly, that is the business we are all in. Marc, are you the technical contact for the domain, or a customer? If you are the technical contact, I hope that you will be more careful, or make your email the primary technical contact for the domain. If you are just a friend, and I am guessing customer, for this domain, RUN. I use Go daddy, and the same procedures that you where trying to circumvent, are the same procedures that they would have gone through to notify the POC. Mark D. Bodley Senior Partner, Cyrix Systems 954-537-9499 m(a)cyrixsys.com

1 0

sc minutes of 2006.01.12
by Randy Bush 16 Jan '06

16 Jan '06

marty hannigan asked that we make on-list noise when sc minutes are posted. so this is the noise. http://www.nanog.org/sc.minutes06.html randy

1 0