- NANOG - lists.nanog.org

UUNET connectivity in Minneapolis, MN
by Erik Amundson 11 Aug '05

11 Aug '05

Anyone else having issues with UUNET connectivity in MSP? We were seeing slowness, now we see no traffic flow at all...we make it one hop, then nothin'. Erik Amundson A+, N+, CCNA, CCNP IT and Network Manager Open Access Technology Int'l, Inc. mailto:erik.amundson@oati.net CONFIDENTIAL INFORMATION: This email and any attachment(s) contain confidential and/or proprietary information of Open Access Technology International, Inc. Do not copy or distribute without the prior written consent of OATI. If you are not a named recipient to the message, please notify the sender immediately and do not retain the message in any form, printed or electronic.

5 4

Looking Glass failure in DC
by David Lesher 11 Aug '05

11 Aug '05

Hi: Atlantech.net reports that their ongoing DC region outage is a Looking Glass issue; and LG has troops on the way. I don't know if it is limited to Atlantech only, or other providers are also afflicted. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

IPv6 Address Planning
by Cody Lerum 11 Aug '05

11 Aug '05

Currently we are in the process of planning our IPv6 addressing schema for our network. We are a service provider with around 20 core routers, and several hundred enterprise customers. These customers currently connect back to our core via a separate VLANs or channelized DS1/DS3/OC-X type interfaces. Thus currently lots of /30 IPv4 blocks. Our address allocation is 2001:1940::/32 Here is our current plan, but we are looking for suggestions from people who have been down this road before. The plan is to break out a /48 for our organization. Then break out the first /64 for loopbacks, and the next /64 for point-to-point connections. The PTP /64 then breaks out further into 1 /80 for core links, and 1 /80 for each of our distribution sites. Within these /80's are individual /112's for PTP links. What this will allow us to do is aggregate each sites PTP connections into /80's within our IGP. Looks something like this. 2001:1940::/48 - TransAria 2001:1940::/64 - Loopbacks/NMS/ETC 2001:1940::1/128 - Router 1 2001:1940::2/128 - Router 2 2001:1940:0:1::/64 - PTP Links 2001:1940:1::/80 - Core Links (non-aggergratable) 2001:1940:0:1::/112 - Core Link 1 2001:1940:0:1::1 - Router A 2001:1940:0:1::2 - Router B 2001:1940:0:1::1:1/112 - Core Link 2 2001:1940:0:1::1:1 - Router A 2001:1940:0:1::1:2 - Router B 2001:1940:0:1:1::/80 - Distribution Site 1 2001:1940:0:1:1::/112 - Customer Link 1 2001:1940:0:1:1::1 - Dist Router 2001:1940:0:1:1::2 - Customer Equipment 2001:1940:0:1:1:0:1:0/112 - Customer Link 2 2001:1940:0:1:1:0:1:1 - Dist Router 2001:1940:0:1:1:0:1:2 - Customer Equipment 2001:1940:0:1:2::/80 - Distribution Site 2 2001:1940:0:1:2:::/112 - Customer Link 1 2001:1940:0:1:2::1 - Dist Router 2001:1940:0:1:2::2 - Customer Equipment 2001:1940:0:1:2:0:1:0/112 2001:1940:0:1:2:0:1:1 - Dist Router 2001:1940:0:1:2:0:1:1 - Customer Equipment 2001:1940:1::/48 - Customer 1 Assignment 2001:1940:2::/48 - Customer 2 Assignment 2001:1940:3::/48 - Customer 3 Assignment Thoughts? Thanks! Cody

15 33

Weird traffic from data393.net [AS29863]?
by Fergie (Paul Ferguson) 11 Aug '05

11 Aug '05

Sent e-mails, etc. Anyone else seen "BGP probe" traffic claiming to be from Savvis? - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Long walk off a short PIER revisited [Was: Re: IPv6 Address Planning]
by Fergie (Paul Ferguson) 10 Aug '05

10 Aug '05

Perhaps it's time to revisit PIER? Hey, it's only been ten (10) years, but perhaps it's worth consideration? Remember this: http://www.merit.edu/mail.archives/nanog/1995-08/msg00239.html [and] http://www.isi.edu/div7/pier/papers.html I think my name is on a few of those papers... ;-) - ferg -- bmanning(a)vacation.karoshi.com wrote: On Wed, Aug 10, 2005 at 09:26:08PM +0200, Iljitsch van Beijnum wrote: > On 10-aug-2005, at 19:32, bmanning(a)vacation.karoshi.com wrote: > > > so renumbering out of a /56 into a /48 is harder than renumbering > > out of a /124 into a /112 how? > > Having a /60 or a /48 is better than a /56 or a /48 because: we are not talking better/worse, we are talking the issues with renumbering... and the only credible argument you make is... > > 1. Most people who are going to encounter the problem realize that a / > 60 isn't enough and go for the /48 immediately > 2. Going from a /60 to a /48 would happen earlier than from a /56 to > a /48 so there is less to renumber. less to renumber. which argues that folks should be given just the amount of space they need, not more. right? :) > > renumbering - regardless of version > > is hard... > > Not hard, inconvenient. inconvient/hard ... regardless of versioning (v4 or v6) it is not trival to renumber a network that is managable. > > primarly becuase application developers insist that > > the IP address is the nodes persistant identifier, > > Disagree. There are two issues: the DNS and access restrictions and > similar based on IP addresses. The DNS can be fixed with some > searching and replacing and/or dynamic DNS updates, but using literal > IP addresses, especially in filters and such, isn't easy to solve > because there are no reasonable alternatives in many cases. ok, you disagree. clearly we do not have the same understanding of global networks, end-system configuration and maintaince, and the demand for reliable, auditable logs. > > renumbering hosts is a breese in either > > version of predominate IP protocol, DHCP is your friend. > > That friend will kill all your sessions when you get a new address. Sniff. Tear. your DOA w/ IPv6 as well and IPv4 in a renumbering event. You want to maintain session awareness over a renumbering event? IPv6 is not going to help. You need HIP. > DHCP implementations in IPv6 aren't ready for prime time either. that statement could be made of so many applications. > > Or if you > > want less robust functionality and semantic overload, you can use > > the RA/ND stuff in IPv6. > > How is that less robust and does it imply a semantic overload? DHCP is a protocol that has a long interoperability history. RA/ND does not. DHCP has many fine host configuration features .. some of which are being added to the RA/ND suite. Hence my claim of less robust. Semantic overload... hum... I want my router to route. infrastructure services should come from service boxes... in much the same way i want the police to direct traffic, not do my produce shopping, then take the goods home and prepare my meals. The police should do police work, routers should route. YMMV of course. Some people LIKE running their router, RA/ND, DHCP, and DNS, NTP, and WEB server off a single platform. Or due to cost constraints they "bundle-up"... I'm of the opinion that functional seperation is a good thing in the provisioning of network services. > > - regardless, renumbering from one address > > range to another is painful - CIDR -might- be helpful, but > >artifical > > constraints e.g /64 only serve to confuse. > > I agree. All boundaries between different parts of the address must > be flexible. That includes the boundary at the end of the address. > But I guess we have to save something for IPv7. IPv7, IPv8, and IPv9 are all registered w/ the IANA. then IPX is a Novell trademark so i think the next step would have to be IPv11.. --bill -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Cisco crapaganda
by Chris Gilbert 10 Aug '05

10 Aug '05

Given the term "Crapaganda" I couldn't help but share this when I ran across it today: http://www.cisco.com/edu/peterpacket Enjoy :) Also, > Of course, in the end, Juniper is also vulnerable. ... Now I > believe that Open Source software techniques can solve this root > problem because many eyes can find more bugs. This doesn't just > mean *BSD and Linux. There are also systems like OSKit > http://www.cs.utah.edu/flux/oskit/ and RTAI http://www.rtai.org/ > that are more appropriate for building things like routers. But in some ways, aren't those Open Source software techniques also assisting Juniper, as JunOS is based in no small part on FreeBSD? Perhaps their hybrid of Open-Source adoption and proprietary development will take the benefits from both worlds and prove an effective method for maintaining a high level of software security. Also, what about DoD Orange Book certification? Can this kind of testing methodology be applied to routing systems as well, such as IOS? In recent years Microsoft has been releasing code for internal security audits to special customers such as large corporate partners and government. I wonder if infrastructure customers should, or could be getting similar treatment from Cisco in regards to IOS, for them to better protect their customers. (Government would apply here too.) -- Regards, Chris Gilbert IO Interactive A/S

3 2

fcc ruling on dsl providers' access to infrastructure
by Randy Bush 10 Aug '05

10 Aug '05

interesting that nanog is chattering so seriously about the calea thing (which does concern me), but seems to be unconcerned about another ruling that would seem to be a major anti-competitive change threatening the businesses of a few hundred members of this list <http://news.com.com/2061-10785_3-5820294.html>. or maybe i am misreading the ruling. randy

14 21

RE: Cisco crapaganda
by Maness, Drew 10 Aug '05

10 Aug '05

Sorry 2 years ago (2003) http://www.blackhat.com/html/bh-multi-media-archives.html#USA-2003 FX - More (Vulnerable) Embedded Systems Lynn also refered to a "Chinese Hacker" group that was reviewing pieces of stolen IOS code for the sole purpose of shovleing shell code into IOS. -----Original Message----- From: owner-nanog(a)merit.edu on behalf of Maness, Drew Sent: Wed 8/10/2005 10:11 AM To: Michael.Dillon(a)btradianz.com; nanog(a)merit.edu Cc: Subject: RE: Cisco crapaganda Lynn refered to FX from phenoelit's presentation at blackhat 3 years ago. Http://www.phenoelit.de -----Original Message----- From: owner-nanog(a)merit.edu on behalf of Michael.Dillon(a)btradianz.com Sent: Wed 8/10/2005 6:14 AM To: nanog(a)merit.edu Cc: Subject: Re: Cisco crapaganda > I, desperately, hope you are not referring to Raven Adler's > presentation at Defcon following Black Hat. No, I am referring to something that was published 3 years ago and describes substantially the same exploits and techniques as Lynn described except the 3 year old document has much more technical detail and offers a URL where source code for the exploits can be acquired. Maybe Lynn rediscovered this independently. Maybe he heard rumours of an exploit in blackhat communications and this guided him where to look. But if my memory serves me correctly, Lynn himself claimed that his work was based on the work of a blackhat. --Michael Dillon

1 0

RE: Cisco crapaganda
by Maness, Drew 10 Aug '05

10 Aug '05

Lynn refered to FX from phenoelit's presentation at blackhat 3 years ago. Http://www.phenoelit.de -----Original Message----- From: owner-nanog(a)merit.edu on behalf of Michael.Dillon(a)btradianz.com Sent: Wed 8/10/2005 6:14 AM To: nanog(a)merit.edu Cc: Subject: Re: Cisco crapaganda > I, desperately, hope you are not referring to Raven Adler's > presentation at Defcon following Black Hat. No, I am referring to something that was published 3 years ago and describes substantially the same exploits and techniques as Lynn described except the 3 year old document has much more technical detail and offers a URL where source code for the exploits can be acquired. Maybe Lynn rediscovered this independently. Maybe he heard rumours of an exploit in blackhat communications and this guided him where to look. But if my memory serves me correctly, Lynn himself claimed that his work was based on the work of a blackhat. --Michael Dillon

1 0

@Home's 119 domain names up for sale
by Fergie (Paul Ferguson) 10 Aug '05

10 Aug '05

I know this is horribly off-topic, but seeing a reference to @Home kind made me a little nostalgic. :-) [snip] Apparently former high-speed Internet provider Excite@Home once felt likewise. But At Home Liquidating Trust, successor to the once high-flying Internet darling Excite@Home, said Wednesday it is selling the former broadband company's 119 domain names. [snip] http://news.com.com/ExciteHomes+119+domain+names+up+for+sale/2100-1030_3-58… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0