- NANOG - lists.nanog.org

RE: Can a customer take IP's with them?
by Chris Ranch 23 Jun '04

23 Jun '04

Sorry about the html. ^%$%&*.! -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Chris Ranch Sent: Wednesday, June 23, 2004 10:12 AM To: 'alex(a)nac.net' Cc: nanog(a)nanog.org Subject: RE: Can a customer take IP's with them? Hello Alex, > > In other words, customer is asking a court to rule whether > > or not IP space should be portable, when an industry- > > supported organization (ARIN) has made policy that the > > space is in fact not portable. It can be further argued that > > the court could impose a TRO that would potentially negatively > > affect the operation of my network. > > A court will likely decide this based upon the terms of > your contract and what the court thinks is fair. They will > likely give very little consideration to common practice or > ARIN's rules. That's the crux of the biscuit. Your case depends on whether you provided for this in your contract with the customer. If its missing, you have a big challenge on your hands. No RFC or ARIN policy is a binding legal document. If its there, your chances are much better. So, do you discuss non-portable address space assignment in your contract? Where was this case filed? NJ or federal court? Do let us know how it turns out. This will establish a key legal precedent. Chris

1 0

new operationally relevant papers from caida
by k claffy 23 Jun '04

23 Jun '04

CAIDA/UCSD: "Building a Better Netflow" http://www.caida.org/outreach/papers/2004/betternetflow/ to be presented at Sigcomm 2004 http://www.acm.org/sigs/sigcomm/sigcomm2004/ (we can write the papers, but you customers have to insist on vendors improving measurement. pass on the word if not the pdf file along w your zillion dollar purchase order. :) ) MeasurementFactory/CAIDA (Duane Wessels): "Is Your Caching Resolver Polluting the Internet?" http://www.caida.org/outreach/papers/2004/dns-pollution/ to be presented at Sigcomm 2004 troubleshooting workshop: http://www.acm.org/sigs/sigcomm/sigcomm2004/netts.html WIDE/CAIDA: "Identifying IPv6 Network Problems in the Dual-Stack World" [URL up at http://www.caida.org/outreach/papers/ in a few days, same workshop as above] [a workshop i reckon thoughtful NANOGers might enjoy attending as well as offer mutually valuable insights to other attendees; papers will be posted there eventually courtesy ACM] see http://www.acm.org/sigs/sigcomm/sigcomm2004/workshops.html for other sigcomm workshops you might find an interesting source as well as destination of insights. less operationally relevant, but for those who care about what's afoot at CAIDA: ----- Forwarded message from k claffy <kc(a)caida.org> ----- Date: Wed, 23 Jun 2004 07:56:40 -0700 From: k claffy <kc(a)caida.org> Subject: recent Internet topology, passive, and telescope data sets available To: caida(a)caida.org some of these have been up for a while, others new, but we're starting to catalog them all in a more usable way thanks to project funding from the National Science Foundation (your US tax dollars at work) http://www.caida.org/projects/trends/data/ so far includes comprehensive topology data sets, including AS and router adjacency matrices, passive traces (under various levels of AUP), network telescope data, and some other data sets provided in conjunction with valiant collaborating organizations. there are also links to pages that give more detail about the project. please contact me if you're interested in contributing data sets; we plan to have a prototype of the community data catalog by the end of this summer. k ----- End forwarded message ----- k

1 0

"Sizing router buffers" paper
by Mikael Abrahamsson 23 Jun '04

23 Jun '04

http://yuba.stanford.edu/~appenz/pubs/sigcomm-extended.pdf Anyone care to comment on this paper? I find that it confirms my beliefs and gut feeling I have had since 2000 or so, and my real life experiences with L3 switches with just a few ms of packet buffer. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

2 1

Packeteer
by rwcrowe＠comcast.net 23 Jun '04

23 Jun '04

Anyone had any good/bad experiences with the PacketSeeker or PacketShaper product ? (http://www.packeteer.com/) It looks like a good sub-$10,000 traffic monitor that will allow you to see all Layers of traffic utilization and reporting. Plus you can upgrade it to shape traffic with a license and firmware upgrade. Rob

3 2

Time Warner Telecom Launches Managed Security Services (DDoS)
by John Obi 23 Jun '04

23 Jun '04

Hello, Another network to add stuff against DDoS after other NSPs. Check it here http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=109&STORY=/www/story/06-2… Thanks, -J __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail

1 0

real-time DDoS help?
by Charles Sprickman 23 Jun '04

23 Jun '04

Howdy, Is there any place where people with experience dealing with DDoS attacks hang out? I'm getting very little assistance from my upstream beyond "call whomever is in charge of each IP attacking and make them stop", and "even though we null route the destination IP being attacked, this traffic will be billed". I've got a nice snippet of flows, so I can mostly see where everything is coming from, and it's obvious what the target is, but my flow-stat/flow-report skills are pretty weak. Oddly, in eight years of working for smallish ISPs I've never been hit very hard, believe it or not. Is the response from my upstream typical? I was expecting a bit more cooperation rather than them seeing as this as an opportunity to bill me for lots of traffic. Thanks, Charles -- Charles Sprickman spork(a)inch.com

10 14

APNIC New IPv6 address block
by John Tran 22 Jun '04

22 Jun '04

Dear colleagues APNIC received the IPv6 address range 2001:4400::/23 from IANA in June 2004 and will be making allocations from this range in the near future. This announcement is being made for the information of the Internet community, and so that network configurations such as routing filters may be updated as appropriate. For more information on the resources administered by APNIC, see: http://www.apnic.net/db/ranges.html For information on the minimum allocation sizes within address ranges administered by APNIC, see: http://www.apnic.net/db/min-alloc.html Kind regards Son ____________________________________________________________________ Resources Services Manager <Son(a)apnic.net> Asia Pacific Network Information Centre phone: +61 7 3858 3100 http://www.apnic.net fax: +61 7 3858 3199 Helpdesk phone: +61 7 3858 3188 email: helpdesk(a)apnic.net Please send Internet Resource Requests to <hostmaster(a)apnic.net> _____________________________________________________________________

1 0

Re: real-time DDoS help?
by Bubba Parker 22 Jun '04

22 Jun '04

My IRC server is at irc.citynetwireless.net. It runs dancer-ircd 1.0.35 along with its own services (Nick/ChanServ/etc) and stays up as long as my DS3 does :). On Sun, Jun 20, 2004 at 08:29:40PM -0700, ken(a)calpop.com wrote: > > > > Hey, > > > Let me know if the IRC server has been setup... > I do know there is already a #nanog channel on EFNet.. > > > Regards, > Ken > Network Engineer > CalPOP.com, Inc. > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Bubba Parker > Sent: Saturday, June 19, 2004 9:01 PM > To: nanog(a)merit.edu > Subject: Re: real-time DDoS help? > > I could host and/or setup the irc server if anyone is interested. > > On Sun, Jun 20, 2004 at 03:23:06AM +0000, Christopher L. Morrow wrote: > > > > > > On Sat, 19 Jun 2004, Charles Sprickman wrote: > > > > > > > > On Sun, 20 Jun 2004, Suresh Ramasubramanian wrote: > > > > > > > On Sat, 19 Jun 2004, Jonathan Slivko wrote: > > > > > > > > > Maybe if NANOG had irc.nanog.org, maybe that might be something > to > > > > > consider - a real-time network of communication for network > operators > > > > > to deal with issues, etc. > > > > > > > > There's always > http://puck.nether.net/mailman/listinfo/nsp-security > > > > > > I can tell you right off AS8059 doesn't meet the requirements. I'd > gladly > > > respond to any reports of attacks from them, but I don't think you'd > ever > > > see any. > > > > which of your 2 upstreams isn't helping out? I'm fairly certain both > > providers have security groups, and do mitigate attacks for customers > on a > > regular basis. Perhaps you are not getting in touch with the correct > > customer service folks? We often have this issue ;( > > > > > > > > Basement multihomers unite. > > > > > > > hurray! > > -- > Bubba Parker > sysadmin(a)citynetwireless.net > CityNet LLC > http://www.citynetinfo.com/ > -- Bubba Parker sysadmin(a)citynetwireless.net CityNet LLC http://www.citynetinfo.com/

10 15

Netflow/flowscan
by andrew matthews 22 Jun '04

22 Jun '04

Anyone ever done some major flowscan stuff? We tried it once for a while and we had so much traffic our dual zeon 3.06ghz system couldn't keep up. The flows just started getting more and more behind... anyone ever succesfully graphed large amounts of data? If so what kind of systems did you use and what type of capture/processor layout did you have? Thanks in advanced Andrew

3 2

Inside look at a spammer's business
by Michael.Dillon＠radianz.com 22 Jun '04

22 Jun '04

This site http://rejo.zenger.nl/abuse/1085493870.php has an interesting insider's account of running a spamming business and all the support business that exist to help spammer businesses to survive and thrive. --Michael Dillon

2 1