- NANOG - lists.nanog.org

The Cidr Report
by cidr-report＠potaroo.net 07 May '04

07 May '04

This report has been generated at Fri May 7 21:43:29 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 30-04-04 134095 94127 01-05-04 134113 94087 02-05-04 134248 94105 03-05-04 134191 94094 04-05-04 134105 94226 05-05-04 134298 94295 06-05-04 134223 94305 07-05-04 134302 94283 AS Summary 17091 Number of ASes in routing system 6904 Number of ASes announcing only one prefix 1439 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 73602816 Largest address span announced by an AS (/32s) AS568 : DISOUN DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 07May04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 134447 94377 40070 29.8% All ASes AS4134 750 152 598 79.7% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 715 200 515 72.0% TWTC Time Warner Telecom AS7018 1439 997 442 30.7% ATTW AT&T WorldNet Services AS7843 502 114 388 77.3% ADELPH-13 Adelphia Corp. AS6197 693 309 384 55.4% BNS-14 BellSouth Network Solutions, Inc AS701 1297 932 365 28.1% UU UUNET Technologies, Inc. AS9583 463 101 362 78.2% SATYAMNET-AS Satyam Infoway Ltd., AS22909 390 34 356 91.3% CMCS Comcast Cable Communications, Inc. AS6198 565 231 334 59.1% BNS-14 BellSouth Network Solutions, Inc AS27364 363 40 323 89.0% ARMC Armstrong Cable Services AS22773 370 49 321 86.8% CXAB Cox Communications Inc. Atlanta AS9929 335 31 304 90.7% CNCNET-CN China Netcom Corp. AS17676 339 37 302 89.1% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS1239 939 638 301 32.1% SPRN Sprint AS4355 381 99 282 74.0% ERSD EARTHLINK, INC AS6140 382 103 279 73.0% IMPSA ImpSat AS6478 304 49 255 83.9% ATTW AT&T WorldNet Services AS209 740 503 237 32.0% QWEST-4 Qwest AS1221 855 621 234 27.4% ASN-TELSTRA Telstra Pty Ltd AS25844 243 16 227 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS14654 228 4 224 98.2% WAYPOR-3 Wayport AS4766 469 259 210 44.8% KIX Korea Internet Exchange for "96 World Internet Exposition AS3356 897 689 208 23.2% LEVEL3 Level 3 Communications AS11305 240 41 199 82.9% INTERL-80 Interland Incorporated AS2386 424 240 184 43.4% ADCS-1 AT&T Data Communications Services AS5668 380 199 181 47.6% CIH-12 CenturyTel Internet Holdings, Inc. AS6327 208 28 180 86.5% SHAWC-2 Shaw Communications Inc. AS19262 267 89 178 66.7% VGN-2 Verizon Global Networks AS6347 401 227 174 43.4% SAVV SAVVIS Communications Corporation AS14824 275 108 167 60.7% NCC-105 NewSouth Communications Corp. Total 15854 7140 8714 55.0% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.160.0.0/11 AS20115 CC04 Charter Communications 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 60.254.0.0/20 AS23889 MAURITIUS-TELECOM-AS-AP MAURITIUS TELECOM 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.12.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 69.6.224.0/19 AS32392 HOSTI-3 Hosting-Network GmbH 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS568 DISOUN DISO-UNRRA 137.0.0.0/13 AS568 DISOUN DISO-UNRRA 138.136.0.0/13 AS568 DISOUN DISO-UNRRA 158.0.0.0/13 AS568 DISOUN DISO-UNRRA 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.153.144.0/21 AS568 DISOUN DISO-UNRRA 192.172.0.0/19 AS568 DISOUN DISO-UNRRA 192.188.208.0/20 AS568 DISOUN DISO-UNRRA 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS568 DISOUN DISO-UNRRA 198.97.80.0/20 AS568 DISOUN DISO-UNRRA 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.192.0/20 AS568 DISOUN DISO-UNRRA 198.97.240.0/20 AS568 DISOUN DISO-UNRRA 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS568 DISOUN DISO-UNRRA 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS568 DISOUN DISO-UNRRA 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.84.0.0/16 AS701 UU UUNET Technologies, Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS568 DISOUN DISO-UNRRA 199.114.128.0/18 AS568 DISOUN DISO-UNRRA 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 DISOUN DISO-UNRRA 199.123.0.0/18 AS568 DISOUN DISO-UNRRA 199.123.16.0/20 AS568 DISOUN DISO-UNRRA 199.123.80.0/21 AS568 DISOUN DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.2.64.0/20 AS9729 IS-AP iAdvantage Limited 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.0.0/20 AS4658 NETFRONT-AS NETFRONT I.T. LIMITED (HONG KONG) 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.142.0/24 AS30362 HAWAI-1 Hawaii-Pacific Teleport 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.123.96.0/20 AS9288 COMCEN-AS-AP Com-Cen Pty Ltd 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.155.243.0/24 AS4795 INDOSAT2-ID INDOSATNET-ASN 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 204.69.144.0/22 AS5668 CIH-12 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 205.159.72.0/24 AS1660 ANSCOM-5 ANS Communications 206.41.32.0/19 AS14824 NCC-105 NewSouth Communications Corp. 206.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 206.253.190.0/23 AS8123 POLYBA Polybase 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.169.219.0/24 AS189 GNTY Genuity 209.169.223.0/24 AS189 GNTY Genuity 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.191.81.0/24 AS6347 SAVV SAVVIS Communications Corporation 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL-33 Telesat International Ltd. 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 210.213.0.0/19 AS6453 GLOBEINTERNET Teleglobe America Inc. 216.18.224.0/21 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.130.0/24 AS11937 TRXI TRX Inc. 216.145.132.0/24 AS11937 TRXI TRX Inc. 216.145.133.0/24 AS11937 TRXI TRX Inc. 216.145.134.0/24 AS11937 TRXI TRX Inc. 216.145.135.0/24 AS11937 TRXI TRX Inc. 216.145.152.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

RE: BGP Exploit
by Smith, Donald 07 May '04

07 May '04

No. The router stays up. The tool I use is very fast. It floods the GIGE to the point that that interface is basically unusable but the router itself stays up only the session is torn down. I did preformed these tests in a lab and did not have full bgp routing tables etc ... so your mileage may vary. Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: Stephen J. Wilcox [mailto:steve@telecomplete.co.uk] > Sent: Wednesday, May 05, 2004 10:16 AM > To: Smith, Donald > Cc: Steven M. Bellovin; Kurt Erik Lindqvist; > kwallace(a)pcconnection.com; nanog(a)merit.edu > Subject: RE: BGP Exploit > > > Of more interest.. does the router die (cpu load) before you > brute force the > sessions down > > Steve > > On Tue, 4 May 2004, Smith, Donald wrote: > > > > > I have seen 3 pubic ally available tools that ALL work. > > I have seen 2 privately tools that work. > > A traffic generator can be configured to successfully tear down bgp > > sessions. > > > > Given src/dst ip and ports : > > I tested with a cross platform EBGP peering with md5 using > several of > > the tools I could not tear down the sessions. I tested both > Cisco and > > juniper BGP peering after code upgrades without md5 I > could not tear > > down the sessions. > > > > > > Donald.Smith(a)qwest.com GCIA > > http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC > > pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 > AF00 EDCC kill > > -13 111.2 > > > > > -----Original Message----- > > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > > > Behalf Of Steven M. Bellovin > > > Sent: Tuesday, May 04, 2004 11:54 AM > > > To: Kurt Erik Lindqvist > > > Cc: kwallace(a)pcconnection.com; nanog(a)merit.edu > > > Subject: Re: BGP Exploit > > > > > > > > > > > > > > > In message > > > <C4E8C22A-9DA6-11D8-B28B-000A95928574(a)kurtis.pp.se>, Kurt > > > Erik Lindq vist writes: > > > > > > >> > > > >> Now that the firestorm over implementing Md5 has quieted > > > down a bit, > > > >> is anybody aware of whether the exploit has been used? > > > Feel free to > > > >> reply off list. > > > > > > > >Even more interesting, did anyone manage to reproduce it? > > > > > > > > > > I don't know if it's being used; I know that reimplementations of > > > the > > > idea are out there. > > > > > > > > > --Steve Bellovin, http://www.research.att.com/~smb > > > > > > > > > > > > >

4 5

RE: What percentage of the Internet Traffic is junk?
by Mike Damm 07 May '04

07 May '04

Very very very near to, but not quite 100%. Since almost all of the traffic on the Internet isn't sourced by or destined for me, I consider it junk. Also remember that to a packet kid, that insane flood of packets destined for his target is the most important traffic in the world. And to a spammer, the very mailings that are making him millions are more important than pictures of someone's grandkids. I guess my point is junk is a very relative term. A study would need to first be done to identify what junk actually is, then measuring it is trivial. -Mike -----Original Message----- From: William B. Norton [mailto:wbn@equinix.com] Sent: Wednesday, May 05, 2004 11:21 AM To: nanog(a)merit.edu Subject: What percentage of the Internet Traffic is junk? With all the spam, infected e-mails, DOS attacks, ultimately blackholed traffic, etc. I wonder if there has been a study that quantifies What percentage of the Internet traffic is junk? Bill

13 16

what the .. constant connects from adelphia.net..
by Nicole 06 May '04

06 May '04

As shown below I keep getting these connects from various adelphia.net mta servers. No data is ever sent. Anyone know what they are up to? Nicole May 6 14:17:45 krell postfix/smtpd[90694]: connect from mta7.adelphia.net[68.168.78.193] May 6 14:17:45 krell postfix/smtpd[90694]: disconnect from mta7.adelphia.net[68.168.78.193] May 6 14:17:56 krell postfix/smtpd[90694]: connect from mta11.adelphia.net[68.168.78.205] May 6 14:17:56 krell postfix/smtpd[90694]: disconnect from mta11.adelphia.net[68.168.78.205] May 6 14:17:58 krell postfix/smtpd[90694]: connect from mta9.adelphia.net[68.168.78.199] May 6 14:17:58 krell postfix/smtpd[90694]: disconnect from mta9.adelphia.net[68.168.78.199] May 6 14:17:59 krell postfix/smtpd[90694]: connect from mta2.adelphia.net[68.168.78.178] May 6 14:18:00 krell postfix/smtpd[90694]: disconnect from mta2.adelphia.net[68.168.78.178] May 6 14:33:14 krell postfix/smtpd[91003]: connect from mta4.adelphia.net[68.168.78.184] May 6 14:33:14 krell postfix/smtpd[91003]: disconnect from mta4.adelphia.net[68.168.78.184] May 6 14:33:17 krell postfix/smtpd[91003]: connect from mta2.adelphia.net[68.168.78.178] May 6 14:33:17 krell postfix/smtpd[91003]: disconnect from mta2.adelphia.net[68.168.78.178] May 6 14:33:21 krell postfix/smtpd[91003]: connect from mta11.adelphia.net[68.168.78.205] May 6 14:33:22 krell postfix/smtpd[91003]: disconnect from mta11.adelphia.net[68.168.78.205] May 6 14:33:23 krell postfix/smtpd[91003]: connect from mta8.adelphia.net[68.168.78.196] May 6 14:33:23 krell postfix/smtpd[91003]: disconnect from mta8.adelphia.net[68.168.78.196] May 6 14:33:25 krell postfix/smtpd[91003]: connect from mta13.mail.adelphia.net[68.168.78.44] May 6 14:33:25 krell postfix/smtpd[91003]: disconnect from mta13.mail.adelphia.net[68.168.78.44] May 6 14:33:25 krell postfix/smtpd[91003]: connect from mta9.adelphia.net[68.168.78.199] May 6 14:33:26 krell postfix/smtpd[91003]: disconnect from mta9.adelphia.net[68.168.78.199] May 6 14:48:48 krell postfix/smtpd[91161]: connect from mta8.adelphia.net[68.168.78.196] May 6 14:48:49 krell postfix/smtpd[91161]: disconnect from mta8.adelphia.net[68.168.78.196] May 6 14:48:56 krell postfix/smtpd[91161]: connect from mta9.adelphia.net[68.168.78.199] May 6 14:48:57 krell postfix/smtpd[91161]: disconnect from mta9.adelphia.net[68.168.78.199] May 6 14:48:59 krell postfix/smtpd[91161]: connect from mta6.adelphia.net[68.168.78.190] May 6 14:49:00 krell postfix/smtpd[91161]: disconnect from mta6.adelphia.net[68.168.78.190] May 6 14:49:02 krell postfix/smtpd[91161]: connect from mta1.adelphia.net[68.168.78.175] May 6 14:49:02 krell postfix/smtpd[91161]: disconnect from mta1.adelphia.net[68.168.78.175] -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ "The term "daemons" is a Judeo-Christian pejorative. Such processes will now be known as "spiritual guides" -Politicaly Correct UNIX Page http://www.nonsenseband.com *** Spam Sucks and I get tons of it. So I have some tight spam filters. If any email to me bounces, please use your secret decoder ring and please send to blabgoo at yahoo dot com :)

3 2

Question about obtaining ASN #
by Vish Yelsangikar 06 May '04

06 May '04

Hi there. We are in the middle of a major project that will be rolled out in the next 3-4 months. With this project, I will be multihoming my network. To get ready for this project, I recently applied for an AS# for my company with ARIN and I was denied because I don't have a multihomed network and dont intend to be one in the next 30 days. Is there any other way to obtain AS#? I dont want to wait until 11th hour to get the AS#. Any suggestions are appreciated. Thanks. Vish Yelsangikar.

4 3

RE: Question about obtaining ASN #
by McBurnett, Jim 06 May '04

06 May '04

->i think you only need to wait until 30 days before, not 11 ->hours before. -> ->ARIN in my experience responds with reasonable promptness to ->ASN requests, ->and assuming your paperwork is in order, you really are ->worrying unnecessarily. -> I second that.. When we multihomed, I gave the info and had my AS in about 24 hours. We had the IP's were using them, both providers in house. Went multihomed the day after the AS was given. The only thing I suggest you worry about is making sure the 2 providers give you time/date for an engineer's time. It took me more time to set that up than anything else... and even then only 2 calls at my sales support engineers staff.... Later, Jim

1 0

RE: BGP Exploit
by Smith, Donald 06 May '04

06 May '04

I don't believe it FILLED the pipe. I suspect it made the interface unusable by consuming buffer/processes/io ... Other interfaces on the system were still functional. I did NOT measure the actual through put. Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111/2 > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Christopher L. Morrow > Sent: Wednesday, May 05, 2004 5:31 PM > To: Patrick W.Gilmore > Cc: nanog(a)merit.edu > Subject: Re: BGP Exploit > > > > On Wed, 5 May 2004, Patrick W.Gilmore wrote: > > > > > On May 5, 2004, at 2:39 PM, Smith, Donald wrote: > > > > > No. The router stays up. The tool I use is very fast. It > floods the > > > GIGE to the point that that interface is basically > unusable but the > > > router itself stays up only the session is torn down. I did > > > preformed these tests in a lab and did > > > not have full bgp routing tables etc ... so your mileage may vary. > > > > That is DAMNED impressive. I've never seen a router which > can take a > > Gigabit of traffic to its CPU and stay up. What kind of router was > > this? You mentioned Juniper and Cisco before, but I know a > cisco will > > fall over long before a gigabit and a Juniper either does or drops > > packets destined for the CPU (but keeps routing). > > recieve-path acl and recieve-path-limits perhaps on a cisco > will allow survival? Though if this is 'bgp' from a valid > peer it seems likely to crunch it either way. > > > > > Perhaps it was rate limiting the # of packets which reached > the CPU, > > and the session stayed up because the "magic" packet was dropped in > > the rate limiting? > > > > That sees likely. >

1 0

Re: Network discovery tools
by sgorman1＠gmu.edu 06 May '04

06 May '04

Thanks for the suggestions. The network ferret tools reports to do layer 2 discovery as well, maybe not so wishful thinking but I could be wrong - http://www.panix.com/~logikos/ ----- Original Message ----- From: Mark Boolootian <booloo(a)ucsc.edu> Date: Thursday, May 6, 2004 11:59 am Subject: Re: Network discovery tools > > > > The best GPL tool that I've come across in a long while, as far > as > > network discovery goes, would have to be the discovery engine > inside > > Netdisco (http://www.netdisco.org) This tool is fairly Cisco- > centric, > > but Max has put a lot of work into a tool for folks who are > tired of > > CiscoWorks not working. > > netdisco does automated topology discovery for CDP-speaking devices > (where the C is Cisco and not Cabletron). That includes Cisco gear > and some HP stuff (at least the ProCurve line of switches - not sure > what else they have it in). netdisco will also do topology discovery > using Bay's discovery protocol (though this probably only exists in > old stuff and likely didn't make the cut in the move to Nortel). > There'ssome hope for using the work done by some guys at Bell Labs > to do the L2 > topology discovery relying on existing MIBs (primarily the BRIDGE > MIB),and there is proof-of-concept code, but that's mostly wishful > thinkingat this point. > >

2 1

Network discovery tools
by sgorman1＠gmu.edu 06 May '04

06 May '04

I was wondering if anyone could recommend a good shareware or demo network discovery tool. I was hoping to find something that will show vendor type during node discovery. I came across a tool called network ferret that did the job, but nothing downloadable. I'm hoping to do some more work on the effects of network diversity, and wanted to do testing on real world networks. I figured starting of with GMU would get us going, but if anyone knows of any available datasets with node-link topology and vendor type it would be great to play with them. thanks, sean

2 1

RE: Network discovery tools
by Brian Wilson 06 May '04

06 May '04

The best GPL tool that I've come across in a long while, as far as network discovery goes, would have to be the discovery engine inside Netdisco (http://www.netdisco.org) This tool is fairly Cisco-centric, but Max has put a lot of work into a tool for folks who are tired of CiscoWorks not working. -B -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of sgorman1(a)gmu.edu Sent: Thursday, May 06, 2004 11:13 AM To: nanog(a)merit.edu Subject: Network discovery tools I was wondering if anyone could recommend a good shareware or demo network discovery tool. I was hoping to find something that will show vendor type during node discovery. I came across a tool called network ferret that did the job, but nothing downloadable. I'm hoping to do some more work on the effects of network diversity, and wanted to do testing on real world networks. I figured starting of with GMU would get us going, but if anyone knows of any available datasets with node-link topology and vendor type it would be great to play with them. thanks, sean

2 1