- NANOG - lists.nanog.org

Re: Katrina Network Damage Report
by JORDI PALET MARTINEZ 12 Sep '05

12 Sep '05

While I agree that all kind of consumer devices will be most probably the first application of IPv6 at every home, office, etc., the BIG usage will come from sensors of all kinds. Probably will count by thousands at every place. I'm sure that we will never fill in the 64 bits address space of most of the subnets, but what it seems a waste of bits is actually a feature for autoconfiguration, cryptography and other usages still to come. And yes, we need easy autoconfiguration for so many IP-gadgets. Autoconfiguration also means that their are not numbered one after the other ... And yes, having more addresses means also that every device can turn on end-to-end security, which is already an improvement versus today Internet with IPv4+NAT. Regards, Jordi > De: Suresh Ramasubramanian <ops.lists(a)gmail.com> > Responder a: <ops.lists(a)gmail.com> > Fecha: Mon, 12 Sep 2005 08:05:51 +0530 > Para: "Valdis.Kletnieks(a)vt.edu" <Valdis.Kletnieks(a)vt.edu> > CC: Joel Jaeggli <joelja(a)darkwing.uoregon.edu>, Alan Spicer > <a_spicer(a)bellsouth.net>, Steve Gibbard <scg(a)gibbard.org>, <nanog(a)nanog.org> > Asunto: Re: Katrina Network Damage Report > > > On 12/09/05, Valdis.Kletnieks(a)vt.edu <Valdis.Kletnieks(a)vt.edu> wrote: >> A /48 is 80 bits of address. 1,208,925,819,614,629,174,706,176 addresses. >> Even at a million packets/second (which even Joe Sixpack will quite likely >> notice until such time as the Linksys router you get at Walmart does 1M pps), >> that's still 38,334,786,263 years of scanning. Of course, that's about >> 20 billion years after the Sun runs out of hydrogen and goes red giant and >> incinerates the planet.... >> >> Now how big a pile of toasters were you planning to use? > > I'm not planning to use any. I was just assuming that people who > promote v6 as the best thing since sliced bread, and needed because v4 > space is really really scarce now, are going to actually find enough > toasters, printers, phones, computers or whatever to fill all those > /48s that are getting allocated. > > And of course, as I said, small end sites are getting allotted /48s > through tunnelbrokers and such > > So the number of hosts in there is going to be highly limited and all > that /48 worth of IPs are going to wind up bound to the same host, or > the same LAN .. with IPs that are much closer to each other. > > Once you find a host on a /48 jump to the next one I guess. Or make > some guess on what IP addressing scheme is being followed and which > subnets of that /48 are being used [assuming that an end site like a > cellphone carrier decides to give v6 IPs to all its phone users] ... > scan from within the network. > > Unless you say that v6 space is ever going to be as densely populated > as v4 where each IP is often a different host, possibly several miles > apart rather than in the next rack. > > -- > Suresh Ramasubramanian (ops.lists(a)gmail.com) ************************************ The IPv6 Portal: http://www.ipv6tf.org Barcelona 2005 Global IPv6 Summit Information available at: http://www.ipv6-es.com This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

2 1

Re: OT - Vint Cerf joins Google
by George William Herbert 12 Sep '05

12 Sep '05

>How widespread *is* IPv6 adoption, anyhow? It's easier convincing some people to have root canals or elective brain surgery than to broach the subject of their software gaining IPv6 compatibility. It's really annoying. It shouldn't be this hard. -george william herbert gherbert(a)retro.com

2 1

Re: Multi-6 [WAS: OT - Vint Cerf joins Google]
by Brandon Butterworth 11 Sep '05

11 Sep '05

> 1. Give us a maximum number of multihomers. 4 Million > 2. Tell us how a routing table of that size (assuming 1 route per AS) > will scale based on reasonable extrapolations of today's technology. SUP720-3BXL says 1M (500K v6) now, doesn't seem too much of a stretch to 4M over many years brandon

2 1

Katrina Network Damage Report
by Todd Underwood 11 Sep '05

11 Sep '05

As promised, Renesys has released a brief paper on the effects of Hurricane Katrina as seen from the Internet. We cover the period of land fall in some detail and also review the recovery efforts. http://www.renesys.com/resource_library/Renesys-Katrina-Report-9sep2005.pdf People who are interested should obviously read the report (and I'm pretty sure it's on-topic, for once! This might be the second on-topic thread today. Danger!). But highlights include: --the Internet was fine --the Gulf Coast wasn't --Louisiana was hit particularly hard --many outaged prefixes still haven't been restored, 10 days later We're happy to take questions on the report, the data, the methodology, etc. t. -- _____________________________________________________________________ todd underwood director of operations & security renesys - interdomain intelligence todd(a)renesys.com www.renesys.com

4 9

www.usenetabuse.com?
by Howard C. Berkowitz 11 Sep '05

11 Sep '05

I'm assisting in trying to deal with a group of flooders/trolls. One remailer directs complaints to www.usenetabuse.com. Does anyone know if this is a legitimate anonymizer abuse desk, or phishing for details of exploits?

2 1

Correct inclusion of rwhois info in WHOIS server output?
by Albert Meyer 11 Sep '05

11 Sep '05

I've been talking to ARIN about the rwhois setup on our SWIPped blocks, and there appears to be a problem with the standard output from whois.arin.net. The two rwhois clients I've tried are rwhois and jwhois. The rwhois client behavior is something like this: 1. Query whois.arin.net. 2a. If the response contains the name of an rwhois server, query that server and return its output. 2b. If the response doesn't contain the name of an rwhois server, follow the links. Query every rwhois server you find and return all of the output. The jwhois client behavior is something like this: 1. Query whois.arin.net. 2a. If the response contains the name of an rwhois server, query that server and return its output. 2b. If the response doesn't contain the name of an rwhois server, return the SWIP. On blocks which are owned by CoreNAP, that works fine. For example, if I type: whois -h whois.arin.net 66.219.44.0 The whois server returns our complete SWIP record including: ReferralServer: rwhois://rwhois.corenap.com:4321/ So this block works fine with both jwhois and rwhois: bash-2.05$ jwhois 66.219.44.0 [Querying whois.arin.net] [Redirected to rwhois.corenap.com:4321] [Querying rwhois.corenap.com] [rwhois.corenap.com] %rwhois V-1.5:003fff:00 cache02.ns.corenap.com (by Network Solutions, Inc. V-1.5.7.3) network:Auth-Area:66.219.32.0/19 ... On blocks which are SWIPped to CoreNAP by an upstream provider, the response from whois.arin.net does not include an rwhois record. For example, if I type: whois -h whois.arin.net 65.59.252.0 The whois server returns this: Level 3 Communications, Inc. LC-ORG-ARIN-BLK2 (NET-65-56-0-0-1) 65.56.0.0 - 65.59.255.255 Core NAP, L.P. LVLT-CORENAP-NETBLOCK-03 (NET-65-59-252-0-1) 65.59.252.0 - 65.59.252.255 VC Sterling, Inc. NET-65-59-252-0-1 (NET-65-59-252-0-2) 65.59.252.0 - 65.59.252.255 Since there is no rwhois server listed here, rwhois clients don't necessarily manage to find the referral. rwhois apparently follows both links and returns results from every rwhois server it finds, but jwhois doesn't follow either link; it just returns the SWIP info. I believe that the correct response to this query would be: Level 3 Communications, Inc. LC-ORG-ARIN-BLK2 (NET-65-56-0-0-1) 65.56.0.0 - 65.59.255.255 ReferralServer: rwhois://rwhois.level3.net:4321 Core NAP, L.P. LVLT-CORENAP-NETBLOCK-03 (NET-65-59-252-0-1) 65.59.252.0 - 65.59.252.255 ReferralServer: rwhois://rwhois.corenap.com:4321/ VC Sterling, Inc. NET-65-59-252-0-1 (NET-65-59-252-0-2) 65.59.252.0 - 65.59.252.255 I've read through the apparently relevant RFCs (812, 954, 1714, 1834, 1835, 1913, 1914, 2050, 2167, 3912) but did not find a clear specification of correct WHOIS server output. The people I talked to at ARIN say that the configuration of whois.arin.net can be changed based on "significant community consensus" but they suggested that the problem could be fixed by rewriting the jwhois client (and any other client that doesn't follow links to search for an rwhois server). I spent a fair amount of time looking through the (apparently non-searchable) mailing list archive at http://lists.arin.net/pipermail/dbwg/ and saw some discussion of rwhois issues but I didn't manage to find information showing how the previous change was initiated. Questions: 1. Does anyone agree that the present lack of rwhois server information in the initial WHOIS response for SWIPped blocks is a problem? 2. Can anyone think of a compelling reason why rwhois server information should not be included in the initial response to a standard whois query for all IP blocks, including SWIPped blocks, besides the fact that it is not included now? 3. Would this change (adding rwhois server information to the initial response to a standard whois query for SWIPped blocks) break your scripts that parse WHOIS output? 4. How disruptive was the change when rwhois server information was initially added to WHOIS output? 5. Was the issue fully thought through at that time, and the rwhois server information intentionally left out of the initial response for SWIPped blocks, or did this happen by accident? 6. Does anyone know where that change process was documented?

7 8

RE: www.usenetabuse.com?
by Hannigan, Martin 11 Sep '05

11 Sep '05

I haven't run a large usenet server in awhile, but, anyone asking for your phone number related to a usenet complaint has a whole lot of time on their hands. Wait for Supernews to chime in. Martin -----Original Message----- From: Howard C. Berkowitz [mailto:hcb@gettcomm.com] Sent: Sat Sep 10 21:51:47 2005 To: nanog(a)merit.edu Subject: www.usenetabuse.com? I'm assisting in trying to deal with a group of flooders/trolls. One remailer directs complaints to www.usenetabuse.com. Does anyone know if this is a legitimate anonymizer abuse desk, or phishing for details of exploits?

1 0

Re: Katrina Network Damage Report
by George William Herbert 11 Sep '05

11 Sep '05

Randy wrote: >George William Herbert <gherbert(a)retro.com> >> Looking at the routing tables you see failures. If a prefix >> goes away completely and utterly, and is truly unreachable, >> then anyone trying to see it is going to see an outage. > >not if a covering or more specific tells us how to get packets >to the destination. but perhaps that's what you mean by a >prefix being unreachable and i am being too picky. Yes, to clarify, by "completely and utterly" i mean not just the prefix that you saw drop, but more specific and more general routes that you may have access to as well. -george william herbert gherbert(a)retro.com

1 0

China Telecom Blocking Skype
by Fergie (Paul Ferguson) 09 Sep '05

09 Sep '05

Okay, don't get too excited. I'm not trying to incite the whole off-topic thread that was going here earlier regarding ethical issues regarding China content, etc, However, on the issue of services denial (thinking back to the discussion of various ISP's around the world blocking various service, e.g. Vonage, other VoIP traffic, etc.), I have to say that I think I see a lot of hypocritical folks out there that, well... you can see the issue. Via Red Herring: [snip] China Telecom, Chinas largest telecommunications carrier, has begun blocking VoIP calls in an effort to stanch the massive loss of revenue it could sustain if a substantial percentage of that countrys 100 million Internet users switch their long-distance calling to Skype. Reuters cited media reports and Internet postings as the source of its information that the former monopoly carrier has begun blocking Internet users from accessing Skypes voice services in the city of Shenzhen. The news service also cites a report in the Shanghai Daily that China Telecom plans to block Skypes service throughout the country, eventually. News reports said the carrier, which owns a large broadband network and controls a large network of ISPs, has created a blacklist of Skype users in Shenzhen and threatened punitive action against those who try to circumvent the carriers Skype blocks. [snip] http://www.redherring.com/article.aspx?a=13516 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

need a contact at verizon...
by Perry E. Metzger 09 Sep '05

09 Sep '05

I need a contact at Verizon (or at least for whatever portion of their IP network is AS 6167). Anyone know who to talk to? I've discovered a badly screwed up router inside the network that serves their EVDO wireless customers but trying to fight my way up through the normal channels turns out to be too hard -- there are too many people there who don't know what an IP address is etc. and won't escalate to someone to whom you can say "can you log in to 66.174.105.14 and try pinging the following hosts and note that the behavior is anomalous?" I briefly managed to get that high up after literally 2.5 hours of fighting, but the guy I got put me on hold for 30 minutes and then promised to call me back and did not. My usual friend of a friend contacts have failed, so I'd appreciate help. -- Perry E. Metzger perry(a)piermont.com

1 0