- NANOG - lists.nanog.org

Re: Are SW upgrades needed in MPLS core networks?
by Rubens Kuhl Jr. 06 Feb '04

06 Feb '04

> > I don't get why Juniper and Cisco trie-lookup forwarding would differ in > > comparing IPv4 and IPv6; Juniper does a 8+1+1+1+1+... search until a leaf > > node is found, while Cisco does 16+8+8 (or something near it but still with > > 3 phases); for both architetures, IPv6 longer addresses implies walking more > > deeply into the tree in order to find where to route. > > ahhh. you have been watching marketing architecture presentations. Usually it's a good way to learn about the architecture of the competitor's(i.e, not the company of the presenter) router; watch both of them and you get a pretty good image of what they are. > otoh, we have been using real routers. Those real routers have real architetures with what behaviour regarding prefix-length ? Rubens

1 0

ev1.net security contact
by John Obi 06 Feb '04

06 Feb '04

Hello, Can I get someone from ev1.net contact me off the list? it's security/hacking issue. Thanks, -J __________________________________ Do you Yahoo!? Yahoo! Finance: Get your refund fast by filing online. http://taxes.yahoo.com/filing.html

1 0

RE: ISS X-Force Security Advisories on Checkpoint Firewall-1 and VPN-1
by McBurnett, Jim 06 Feb '04

06 Feb '04

-> ->> Why is that bad? I have no objection to giving vendors a reasonable ->> amount of time to fix problems before announcing the whole. -> Or is your ->> point that two days hardly seems like enough time to develop -- and ->> *test* -- a fix? HMMM, If I was a real hacker, and I found the problem, might I also know the fix? And if I was really nice, would I give that fix to the vendor? Or could it be that a former Checkpoint employee is now an ISS employee? Or .....? J

2 1

Re: MTUs - Was: Strange public traceroutes return private RFC1918 addresses
by Michael.Dillon＠radianz.com 06 Feb '04

06 Feb '04

>So there we are. Want to bet on whether 40 GigE will still have the 1522 >byte limit? Given the growing number of folks who will only buy xGigE equipment that supports 9000 byte MTUs I'd say the chances are very good that 40GigE will no longer have a 1522 byte limit. --Michael Dillon

3 2

The Cidr Report
by cidr-report＠potaroo.net 06 Feb '04

06 Feb '04

This report has been generated at Fri Feb 6 21:47:41 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 30-01-04 129929 90863 31-01-04 130004 91032 01-02-04 130080 91025 02-02-04 130010 91079 03-02-04 130093 91091 04-02-04 130207 91165 05-02-04 130288 91107 06-02-04 130549 91114 AS Summary 16505 Number of ASes in routing system 6640 Number of ASes announcing only one prefix 1383 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 AT&T WorldNet Services 73517312 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 06Feb04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 130505 91103 39402 30.2% All ASes AS4323 679 203 476 70.1% TW-COMM Time Warner Communications, Inc. AS6197 720 297 423 58.8% BATI-ATL BellSouth Network Solutions, Inc AS7018 1383 962 421 30.4% ATT-INTERNET4 AT&T WorldNet Services AS701 1350 957 393 29.1% ALTERNET-AS UUNET Technologies, Inc. AS7843 506 124 382 75.5% ADELPHIA-AS Adelphia Corp. AS27364 382 33 349 91.4% ACS-INTERNET Armstrong Cable Services AS6198 545 214 331 60.7% BATI-MIA BellSouth Network Solutions, Inc AS4134 653 329 324 49.6% CHINANET-BACKBONE No.31,Jin-rong Street AS22909 337 18 319 94.7% DNEO-OSP1 Comcast Cable Communications, Inc. AS22773 342 34 308 90.1% CCINET-2 Cox Communications Inc. Atlanta AS1239 949 664 285 30.0% SPRINTLINK Sprint AS4355 385 101 284 73.8% ERMS-EARTHLNK EARTHLINK, INC AS1221 899 642 257 28.6% ASN-TELSTRA Telstra Pty Ltd AS17676 294 41 253 86.1% GIGAINFRA Softbank BB Corp. AS6347 329 82 247 75.1% DIAMOND SAVVIS Communications Corporation AS9583 341 103 238 69.8% SATYAMNET-AS Satyam Infoway Ltd., AS6140 358 126 232 64.8% IMPSAT-USA ImpSat AS25844 243 16 227 93.4% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS6478 259 40 219 84.6% ATT-INTERNET3 AT&T WorldNet Services AS209 722 511 211 29.2% ASN-QWEST Qwest AS14654 214 3 211 98.6% WAYPORT Wayport AS13083 216 8 208 96.3% AS13083 Mannesmann Datenverarbeitung Autonomes System AS11305 242 41 201 83.1% INTERLAND-NET1 Interland Incorporated AS2386 417 229 188 45.1% INS-AS AT&T Data Communications Services AS20115 608 422 186 30.6% CHARTER-NET-HKY-NC Charter Communications AS5668 345 160 185 53.6% AS-5668 CenturyTel Internet Holdings, Inc. AS4519 202 19 183 90.6% MAAS Maas Communications AS6327 206 28 178 86.4% SHAW Shaw Communications Inc. AS9929 200 30 170 85.0% CNCNET-CN China Netcom Corp. AS15270 210 40 170 81.0% AS-PAETEC-NET PaeTec.net -a division of PaeTecCommunications, Inc. Total 14536 6477 8059 55.4% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 ANDARA-HSI Andara High Speed Internet c/o Halifax Cable Ltd. 64.62.126.0/23 AS25700 SWIFTDESK SWIFTDESK VENTURE 66.114.0.0/19 AS16526 BIRCH-TELECOM Birch Telecom, Inc. 66.114.28.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 66.114.29.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 66.114.30.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 66.114.31.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 69.8.128.0/17 AS7260 NORLIGHT Norlight Telecommunications 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.64.84.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.136.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.144.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.152.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.154.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.114.156.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.160.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.0.0/20 AS4658 NETFRONT-AS NETFRONT I.T. LIMITED (HONG KONG) 202.70.16.0/22 AS17888 SINGTEL-HK SingTel Hong Kong Limited 202.70.240.0/20 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.72.112.0/22 AS22351 INTELSAT-1 INTELSAT 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.128.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.142.0/24 AS30362 HPT-ASN Hawaii-Pacific Teleport 202.86.171.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.172.0/23 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.190.0/24 AS4750 loxley-th Loxley Information Co., Ltd. 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 203.32.4.0/23 AS7617 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.86.2.0/23 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.111.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 204.69.144.0/22 AS5668 AS-5668 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBIT Exobit Networks Inc. 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.5.208.0/20 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 210.213.0.0/19 AS6453 GIEUROPE Teleglobe America Inc. 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.36.46.0/24 AS7176 GENUITY-AS7176 Genuity 216.36.47.0/24 AS7176 GENUITY-AS7176 Genuity 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Re: MTUs - Was: Strange public traceroutes return private RFC1918 addresses
by Kevin Oberman 05 Feb '04

05 Feb '04

> From: Warren Kumari <warren(a)kumari.net> > Date: Thu, 5 Feb 2004 15:04:00 -0500 > Sender: owner-nanog(a)merit.edu > > > Ok, I know that this is getting away from the original thread, but I've > always wondered this... > > Why is the MTU on Ethernet 1500 bytes? I have looked through various > docs (eg IEEE Std 802.x) and can find where maxUntaggedFrameSize is > listed as 1518 octets, but there is no mention of why this was chosen. > I know where the minimum frame size comes from (CSMA/CD and propagation > times, etc), but the maximum frame size number sounds fairly arbitrary. It is based on the original 10Base5 (yellow hose) Ethernet and was largely "picked out of the air" to meet several design criteria. One was the cost of buffering on the card. Back then, 2K of buffer was expensive and the designers wanted to allow for $500 NICs. This was in the late 1970s and this was no trivial feat. Early Ethernet cards were several K and taps were typically over $200. And that awful AUI cable that always came loose (the designer has publicly apologized for that) was usually at least $50. Another issue was how long a system with a packet ready to transmit might have to wait for a transmission to end so that it could have a shot at the wire. (Remember that in the 10Base5 days it was not uncommon to see 50 or 100 taps on a single cable.) At 10 Mb/s, long frames would have been prohibitively time consuming. Also, a large percentage of network traffic in these pre-web days was telnet with huge numbers of 64 byte frames and few over 1K. So 1518 seemed reasonable. When FastEthernet was developed by Grand Junction, the idea of expanding the frame size first came up. At 100 Mb/s, 1500 bytes no longer took very long. But that made for problems in bridging between 10Base5 and 100Base-T networks. There was no good way to break up a 4K frame into 1518 byte frames in a switch and, while many schemes were suggested none proved practical and the idea faded. Then came GigE and 1518 bytes was getting to look very silly. But the issues of bridging and fragmentation remained and, after LOTS of debate, the 1518 byte frame limit was left in place. But the idea did not die and many companies started producing equipment that could handle larger frame sizes. It worked pretty well because most GigE links were point-to-point between end systems switching to slower speed links less common. Finally we got to 10GigE and 1522 (extended for vLANs) was absolutely ridiculous, but at least one large vendor fought had to retain the size and, in the end, the 10GigE spec specified the same maximum frame size. The only reason now was cost. At 10GigE, buffers already had to be very big as a great many frames had to be stored just to handle "normal" traffic was congestion. Some vendors were selling relatively cheap switches with VERY limited buffering. To move from 1520 to 4K or 9K would have required a significant increase in buffer size and that would have made the switches much more expensive. So there we are. Want to bet on whether 40 GigE will still have the 1522 byte limit? -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

3 3

ISS X-Force Security Advisories on Checkpoint Firewall-1 and VPN-1
by Ingevaldson, Dan (ISS Atlanta) 05 Feb '04

05 Feb '04

Nanog- ISS X-Force release two X-Force Security Advisories this evening detailing high-risk issues in Checkpoint Firewall-1 and VPN-1. Please refer to the following URLs for more information: http://xforce.iss.net/xforce/alerts/id/162 http://xforce.iss.net/xforce/alerts/id/163 ------------------ Daniel Ingevaldson Director, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net

15 19

RE: Strange public traceroutes return private RFC1918 addresses
by Michael.Dillon＠radianz.com 05 Feb '04

05 Feb '04

>And why 4470 for POS? Did everyone borrow a vendor's FDDI-like default >or is there a technical reason? PPP seems able to use 64k packets (as >can the frame-based version of GFP, incidentally, POS's likely >replacement). According to this URL http://www.columbia.edu/acis/networks/advanced/jumbo/jumbo.html which you have seen before, the number of CRC bits in the protocol header limits the number of bytes you can practically use for the MTU. I expect that we won't go beyond 9000 byte MTUs for a long time. The 4470 for POS probably comes from Token Ring originally. In the original 4 Mbps token ring a device was allowed to hold the token for 9.1 ms which was enough time to transmit 4550 octets. This timing was probably adopted by FDDI which borrowed a lot from the token ring design. No doubt, the designers of POS were also influenced by token ring and just chose the same size. --Michael Dillon

6 5

Re: MTUs - Was: Strange public traceroutes return private RFC1918addresses
by sthaug＠nethelp.no 05 Feb '04

05 Feb '04

> Why is the MTU on Ethernet 1500 bytes? I have looked through various > docs (eg IEEE Std 802.x) and can find where maxUntaggedFrameSize is > listed as 1518 octets, but there is no mention of why this was chosen. > I know where the minimum frame size comes from (CSMA/CD and propagation > times, etc), but the maximum frame size number sounds fairly arbitrary. I believe Rich Seifert once said (on comp.dcom.lans.ethernet) that the cost of the necessary buffer memory for the first Ethernet cards was a relevant factor. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

Peering BOF VII - Peering Personals is Full
by William B. Norton 05 Feb '04

05 Feb '04

Hi all - At this point the Peering Personals part of the Peering BOF is full - please do not send any more RSVPs. Since there was confusion over this point the last time, there is no need to RSVP to *attend* the Peering BOF, only to participate in the Peering Personals during the second half of the BOF. That is the part where Peering Coordinators introduce themselves with a screen behind them indicating where they peer, their AS#, e-mail address, etc. This is the part of the BOF where we can not (for time reasons) fit anymore speakers. I could use a couple people though to help manage the logistics (and security ;-)) for the opening "Great Debate" on "Restrictive Peering Policies; Makes Business Sense vs. Counter-productive" however. Send me an e-mail if you can help. Also, if you think there are some key questions that need to be answered by the debaters, or further comments or suggestions regarding the BOF, I'd love to hear them as well. See you all in Miami - Bill

1 0