- NANOG - lists.nanog.org

Re: Can a customer take IP's with them?
by Alex Rubenstein 29 Jun '04

29 Jun '04

On Tue, 29 Jun 2004, Florian Weimer wrote: > * Alex Rubenstein: > > > b) customer is exercising the right not to renew the business agreement, > > and is leaving NAC voluntarily. > > The customer probably has a different opinion on this particular > topic, doesn't he? No. This is a clear situation where the customer has canceled his service with us in writing. > If there's a contract dispute, it actually makes a lot of sense to > issue the order you quoted. There's no harm to you (or the Internet > as a whole) because the customer just appears to be another > multi-homed customer of yours, provided that the prefix that is > involved reaches a certain size. OTOH, if you were allowed to > reassign the IP address space while the dispute is being resolved, > this could severely harm the customer's business. > > Of course, this setup can be just temporary. If you are ordered to > permanently give up that particular prefix, then you'll have reason to > complain. I can't address all of the points you raise, but I can say the following: a) NAC did not terminate the customers service in any respect. The customer chose, on his own, to terminate their service with us. This fact is undisputed. Also, NAC was willing to continue the customers service (we were not forcing them out the door). b) In regards to your passage, "because the customer just appears to be another multi-homed customer of yours", this is a key point. The customer *WILL NOT* be a customer of NAC any longer once they physically leave. The key point here is that the customer has gotten a TRO, which allows them to take the IP address space that is allocated to NAC with them, and NOT HAVE ANY SERVICE FROM NAC. NAC WILL NOT BE ONE OF THE NETWORKS THAT THEY ARE MULTIHOMED TO. c) In regards to the tail-end of your mail, what you propose (the temporary reassignment of space to an ex-customer) is in (as I intepret ARIN policy) direct contradiction and violation of ARIN policy. If this policy were to stand, what prevents cable modem users, or dialup users, or webhosting customers, the right to ask to take their /32 with them? Regards,

8 8

RE: Can a customer take IP's with them?
by Michel Py 29 Jun '04

29 Jun '04

VJB> From: Vincent J. Bono VJB> I think one avenue of approach will be to see if VJB> ARIN would grant you another contiguous block to VJB> replace not just what the customer got but the VJB> entire block they have polluted. > Edward B. Dreger > I thought of that, too. However, that would require > NAC renumbering an entire /17 because an ex-customer > is too lazy to renumber a /24.[*] If NAC's ex-customer > thinks renumbering a /24 is excessive, what about > something two orders of magnitude larger? Indeed, but that's not the worst part. Should this happen, it would mean that the ex-customer just got PI space for free. Then the floodgates would open and a bunch of "why-not-me-too" would sue their ISPs to transform their PA block into a free PI block. Michel.

1 0

Re: BGP list of phishing sites?
by Paul Vixie 29 Jun '04

29 Jun '04

> meanwhile your sister has the hassle of getting southwest to send that > fax, or changing her travel plans. i'm sure glad you're not running my > isp. if i were running your isp, paying customers would get to choose.

1 0

RE: Strange behavior of Catalyst4006
by Greg Schwimer 29 Jun '04

29 Jun '04

Some things you can look into: > firewall interface(10.10.1.122/30). > ip route 192.168.5.0 255.255.255.0 10.10.1.124 Is that the firewall interface is 10.10.1.122, or is it 10.10.1.124? 10.10.1.122 is a host address in the 10.10.1.120/30 subnet. 10.10.1.124 is a /30 network. Either way, you're dealing with two different subnets. Oddly, it's working sometimes. > At the very begining all system works fine. After sometime they said they could not acces their email/web/dns > server from host outside their company's network... We restart ( shut; noshut) the fastethernet interface on Catalyst4006, > and then servers' network access recovered. > Sounds suspiciously like an IP conflict or some MAC weirdness with the firewall's or 4006's IP. Is the connection between the 4006 and the customer's firewall a basic crossover, or does the customer have a hub/switch on their side? Assuming the subnetting statement I've made above is based on erroneous info, check your arp cache/mac table when it *is* working. Write down the MAC for the customer's firewall. When it stops working, check the arp cache/mac table again. Compare the MACs to be sure they're the same. Just for giggles, clear the arp cache and see if that fixes it. If that doesn't, clear the entry from the cam table. Good luck... Greg Schwimer

3 2

RE: The use of .0/.255 addresses.
by Chris Ranch 29 Jun '04

29 Jun '04

I see traffic from this last IP address octet all the time from prefixes of length less than /24. Use of these host id's when the prefix length is greater than or equal to /24 is illegal. So if that's your case, I'd suggest not doing it. If that's not the case, look for over-zealous or incorrect filters in the path. I saw this situation once before. There was a border ingress filter with a typo in it... Chris > Various people I've asked about this have said they wouldn't > use the .0 > or .255 addresses themselves, though couldn't present any > concrete info > about why not; my experience above would seem to suggest a > reason not to > use them.

6 5

RE: Strange behavior of Catalyst4006
by Joe Shen 29 Jun '04

29 Jun '04

2 1

Re: BGP list of phishing sites?
by dlr＠bungi.com 29 Jun '04

29 Jun '04

[In the message entitled "Re: BGP list of phishing sites?" on Jun 28, 18:43, Simon Lockhart writes:] > > On Mon Jun 28, 2004 at 04:47:21PM +0000, Paul Vixie wrote: > > if it's easier for you to BGP-blackhole these bad sources and the only > > reason you don't is because you think it would be unfair, then you're > > part of the problem and you're helping to make the problem worse. > > It's wholy unfair to the innocent parties affected by the blacklisting. > i.e. the collateral damage. > > Say a phising site is "hosted" by geocities. Should geocities IP addresses > be added to the blacklist? > None of this would be an issue, if abuse desks were: 1. Responsive 2. Responsible 3. Empowered 4. Accountable Today, they are none of the above. If any of you out there think that isn't the case with your network, please let me know. I'll be happy to provide you with the spam from your network over the last 24 hours (or 24 days, or 24 months, or whatever other period you like). Blackholing is simply a way to draw immediate, and unmistakable attention to a problem, instead of sweeping it under the carpet. The problem is going to get worse before it gets better, much as it pains me to say that. Let's look at ways that it can be made better. A BGP feed, or other real time distribution method, can be used to let your abuse desk know that there is a problem, and to address it faster. It can be abused for this purpose as well, so it's important for *whatever* method is used to be run by responsible, accountable people. Think about it. Please. --

2 1

RE: BGP list of phishing sites?
by matthew.ford＠bt.com 29 Jun '04

29 Jun '04

> my sister called me last night to tell me that she was unable > to receive > mail from southwest airlines, and that her e-ticket was in > limbo for some > flight somewhere. i checked and sure enough southwest > airlines has sent > me three or messages per day that i don't want, for most days > out of the > last six months. since neither southwest nor their ISP was willing to > take any responsibility for this unwanted e-mail, i > blackholed them, and > i guess that means they'll have to fax that e-ticket. or > something. it's > not my problem. meanwhile your sister has the hassle of getting southwest to send that fax, or changing her travel plans. i'm sure glad you're not running my isp. --mat

1 0

RE: Strange behavior of Catalyst4006
by Pendergrass, Greg 29 Jun '04

29 Jun '04

Hi Joe, It would be good to know the type (and software version) of firewall as it could be the firewall and not the switch that's the problem. For instance, there's a known bug with checkpoint and NAT where automatic arp entries "disappear". If you can ping it all from the catalyst but not from the rest of your network it could be that you have a problem with your dynamic routing protocols, or with a device connected to the catalyst. Check your adjacent routers, do you have a valid route to the catalyst for the 192.168.5.7 subnet? What does a traceroute show from your NOC? -GP -----Original Message----- From: Joe Shen [mailto:jshen@spymac.com] Sent: 29 June 2004 02:01 To: nanog(a)merit.edu Subject: Strange behavior of Catalyst4006 Hi, We met a strange problem with Catalyst 4006 when provideing leased line service to one of our customers. Catalyst4006 ------------ Customer's firewall ---------------Customer's Intranet The customer is allocated a Class C address block 192.168.5/24. And , they connect their network to our network by using a firewall. The Interface on Cata4006 is set up as "no switchport", and inter-connecting subnet is configured between Cata4006 and firewall interface(10.10.1.122/30). Static route is used on Catalyst4006 to designate route to customer's intranet address. ( ip route 192.168.5.0 255.255.255.0 10.10.1.124 ). Customer setup their email server at 192.168.5.7, dns server at 192.168.5.1, web server at 192.168.5.9. At the very begining all system works fine. After sometime they said they could not acces their email/web/dns server from host outside their company's network. But, when we telnet to Cata4006, we could 'ping' 192.168.5.7, but if we move to host in NOC ping failed all the time. ( ping to server is allowed on firewall). At the same time, their intranet host could access our network. We restart ( shut; noshut) the fastethernet interface on Catalyst4006, and then servers' network access recovered. The phenomon comes up frequently, and our customer said this is a bug with catalyst4006. But, to my understanding, if this is a bug to catos, it should not only affact only three servers. But, why it could be solved by restart catalyst interface? Would you please do some help? ( I attach system info below) Joe Shen ======================-= 4006#sh version Cisco Internetwork Operating System Software IOS (tm) Catalyst 4000 L3 Switch Software (cat4000-IS-M), Version 12.1(12c)EW1, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) TAC Support: http://www.cisco.com/tac Copyright (c) 1986-2002 by cisco Systems, Inc. Compiled Thu 24- Oct-02 23:05 by eaarmas Image text-base: 0x00000000, data-base: 0x00CA7368 ROM: 12.1(12r)EW Dagobah Revision 63, Swamp Revision 24 4006-wulin uptime is 41 weeks, 12 hours, 34 minutes System returned to ROM by power-on System restarted at 05:40:46 RPC Mon Sep 15 2003 System image file is "bootflash:cat4000-is-mz.121-12c.EW1.bin" cisco WS-C4006 (XPC8245) processor (revision 5) with 524288K bytes of memory. Processor board ID FOX05200BRH Last reset from PowerUp 144 FastEthernet/IEEE 802.3 interface(s) 2 Gigabit Ethernet/IEEE 802.3 interface(s) 403K bytes of non- volatile configuration memory. Configuration register is 0x2102 4006# 4006-wulin#sh run int f4/41 Building configuration... Current configuration : 141 bytes ! interface FastEthernet4/41 no switchport ip address 10.10.1.213 255.255.255.252 duplex full speed 100 end 4006# =============================================== ---- Cool Things Happen When Mac Users Meet! Join the community in Boston this July: www.macworldexpo.com Vodafone Group Services Limited Registered Office: Vodafone House, The Connection, Newbury, Berkshire RG14 2FN Registered in England No. 3802001 This e-mail is for the addressee(s) only. If you are not an addressee, you must not distribute, disclose, copy, use or rely on this e-mail or its contents, and you must immediately notify the sender and delete this e-mail and all copies from your system. Any unauthorised use may be unlawful. The information contained in this e-mail is confidential and may also be legally privileged.

1 0

RE: Can a customer take IP's with them?
by Michel Py 29 Jun '04

29 Jun '04

>> Michel Py wrote: >> In short: drop the monkey on ARIN's back. The issue that >> non-portable blocks are indeed non-portable is ARIN's to >> deal with, and partly why we are giving money to them. > Patrick W Gilmore wrote: > I wonder why ARIN, or even more importantly, ICANN has > not jumped all over this. Seems to me if IP space is not > "owned" or something close to it by ICANN, they have lost > a cornerstone of their power. Indeed, or there's something else we don't know about. >> b) _do_ announce the specific block routed to null0 >> (ARIN has delegated this space to you, if you want to >> announce unallocated parts of it to a blackhole it's >> nobody's business to tell you that you can't). > DO NOT DO THIS. The TRO specifically prohibits him > from doing these types of things. Breaking the TRO > will have immediate and detrimental impact on Alex > and NAC.Net. That remains to be seen, especially if the authority issuing the TRO has no jurisdiction over BGP routing. If you find an attorney that wants your money (easy enough) and a judge who is stupid enough to issue a TRO that I can't wear a green sock and a red sock, I will nevertheless keep wearing a green sock and a red sock and the detrimental consequences are going to be for the bozo that issued the TRO if they try to enforce it and not for me. Judges can be suspended or removed and states can be sued, to. > See my previous post re: liquor & the next NANOG.... Do you own a winery or something :-) > Alex Rubenstein > c) In regards to the tail-end of your mail, what you > propose (the temporary reassignment of space to an > ex-customer) is in (as I interpret ARIN policy) direct > contradiction and violation of ARIN policy. If this > policy were to stand, what prevents cable modem users, > or dialup users, or webhosting customers, the right to > ask to take their /32 with them? Exactly, I have one IP address with SBC (formerly Pacific Bell) at home, I'm too lazy to renumber my tunnels if I switch ISPs, so I'm going to require SBC to allow my one IP to be routed somewhere else? Ridiculous. By the way Alex, have you given some thoughts to suing the company that announces parts of your block? Should not be too difficult, if it's not portable and assigned to you. We all like customers that bring lawsuits with them, don't we? And what's the block in question so we can WHOIS it? Michel.

1 0