- NANOG - lists.nanog.org

/8 blocks allocation statistcs and current use data
by william＠elan.net 18 Oct '03

18 Oct '03

As by-product of bogons project I just posted about, we also got some interesting statistics on how much ip space is allocated and used in each /8 block. This is all available in nice graphical format at: http://www.completewhois.com/statistics/ip_statistics.htm The data above is updated every day and I'm also entering this all into rrd database and once I have enough samples rrd graphs of how much this statistics change will also be made available (but before such graphs provide really good view there must be year worth of samples or more...) -- William Leibzon Elan Networks william(a)elan.net

2 3

as6198 aggregation event
by James Cowie 18 Oct '03

18 Oct '03

On Friday, we noted with some interest the appearance of more than six hundred deaggregated /24s into the global routing tables. More unusually, they're still in there this morning. AS6198 (BellSouth Miami) seems to have been patiently injecting them over the course of several hours, between about 04:00 GMT and 08:00 GMT on Friday morning (3 Oct 2003). Here's a quick pic: http://www.renesys.com/images/6198.gif I can share more details offline. Usually when we see deaggregations, they hit quickly and they disappear quickly; nice sharp vertical jumps in the table size. This event lasted for hours and, more importantly, the prefixes haven't come back out again, an unusual pattern for a single-origin change that effectively expanded global tables by half a percent. Can anyone share any operational insight into the likely causes of this event? Has it caused any operational problems for anyone? Thanks! ---------- James Cowie Renesys Corporation

8 11

[Fwd: [IP] VeriSign to revive redirect service]
by Suresh Ramasubramanian 18 Oct '03

18 Oct '03

Ouch. -------- Original Message -------- Subject: [IP] VeriSign to revive redirect service Date: Thu, 16 Oct 2003 02:38:14 -0400 From: Dave Farber <dave(a)farber.net> Reply-To: dave(a)farber.net To: ip(a)v2.listbox.com Delivered-To: dfarber+(a)ux13.sp.cs.cmu.edu Date: Wed, 15 Oct 2003 23:30:44 -0700 (PDT) From: Joseph Lorenzo Hall <jhall(a)SIMS.Berkeley.EDU> Subject: VeriSign to revive redirect service To: Dave Farber <dave(a)farber.net> --- http://news.com.com/2100-1038_3-5092133.html VeriSign to revive redirect service by Declan McCullagh VeriSign will give a 30- to 60-day notice before resuming a controversial and temporarily suspended feature that redirected many .com and .net domains, company representatives said Wednesday. Speaking before an unusual gathering of technical experts in Washington, D.C., VeriSign said its own re-evaluation of its Site Finder redirection service found "no identified security or stability problems." When it was active, Site Finder added a "wild card" for .com and .net domains that snared queries to nonexistent Internet sites and forwarded them to VeriSign's own servers. That confused some antispam filters and other network utilities, a side effect that VeriSign downplayed on Wednesday by arguing that Site Finder's benefits to end users--a search screen instead of a an error message--outweighed the costs to network administrators. "One of the segments of the community that has not been looked at in this whole issue, in my opinion, is the user community," VeriSign Vice President Chuck Gomes said. "They're very relevant." In a presentation, VeriSign said that 35 companies were confidentially briefed about Site Finder before its debut and they reported "no issues" or problems before its launch on Sept. 15. Its own expert group--including the chief technology officers of Brightmail and Morgan Stanley--reviewed Site Finder and decided that most issues were "minor or inconvenient," VeriSign said. Before resuming Site Finder, VeriSign said it would address specific criticisms by adding foreign language support to Site Finder and tweaking the way e-mail to nonexistent domains worked. [...] ----------------------------------------------------------------- Joseph Lorenzo Hall Graduate Student http://pobox.com/~joehall "When life gives you SARS, make sarsaparilla." --Cory Doctorow, http://www.craphound.com/ -------------------------------------

8 8

Tomatoes for Verisign at NANOG 29
by JC Dill 18 Oct '03

18 Oct '03

Dan and Owen, I nominate you two for the tomato acquisition and distribution committee. To recap: At NANOG 29 in Chicago, on Monday October 20th at 9:15 am a session on "VeriSign's Wildcard Record: Effects and Responses" will be held, with Mark Kosters and Matt Larson from VeriSign and Suzanne Woolf from ISC: <http://www.nanog.org/mtg-0310/dns.html> If you are attending NANOG 29, please attend this session and wear a red shirt. If possible, please buy/bring a tomato. Take your tomato to the front of the room and place them in a pile before Verisign, to make it absolutely clear how you feel about Verisign's wildcards and sitefinder. Please do not throw your tomatoes. I wish I could be there! Now to make sure that someone with clue from the Chicago Sun Times and the Chicago Tribune are both there, with photographers. Does anyone on this list have any contacts at either of these papers? jc

16 21

Mail problems continued, AOL sprung back up
by Damian Gerow 18 Oct '03

18 Oct '03

Apologies for using this as a 'Please contact me' list, but can a postmaster from AOL please give me a call? Our outbound mail has (again) mysteriously started getting bounced, even while having a 30-day temporary whitelist on this server. Calls to the NOC line receive a fast busy after the automated prompter. -- Damian Gerow damian(a)sentex.net Systems and Networks Administrator work +1 519 651 3400 x213 Sentex Communications

4 5

RE: Pitfalls of annoucing /24s
by Ejay Hire 17 Oct '03

17 Oct '03

Am I the only one that has never had an issue multihoming with /24's? Ejay Hire -----Original Message----- From: H. Michael Smith, Jr. [mailto:michael@awtechnologies.com] Sent: Wednesday, October 15, 2003 4:24 PM To: 'Phil Rosenthal'; 'John Palmer' Cc: nanog(a)merit.edu Subject: RE: Pitfalls of annoucing /24s What about the /24's that many ISPs (especially tier 2-3) are assigning to multi-homed customers? What about an IX or "critical infrastructure providers" that may be issued a /24 from ARIN (Policy 2001-3)? Although it may be rare that a large aggregate would become unreachable to a "large" network, doesn't the possibility exist that a customer with a /24 would become unreachable (to some) due to the aggregate dropping out even though the /24 should still be reachable? That scenario may not be very likely, but the question of assymetric routing and one's ability to balance traffic become issues. Assigning a lower preference to /24's would be a lot friendlier than just throwing them away. If I am way off base, I fully expect to be corrected (with volume). My flame retardant suit is in place. Michael -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Phil Rosenthal Sent: Wednesday, October 15, 2003 4:47 PM To: John Palmer Cc: nanog(a)merit.edu Subject: Re: Pitfalls of annoucing /24s http://info.us.bb.verio.net/routing.html#PeerFilter That's how Verio does it, and I assume, that's how most people who filter by length do it as well. --Phil On Oct 15, 2003, at 4:40 PM, John Palmer wrote: > > Good question. > > You know there are thousands of legacy /24's out there that were > allocated by > IANA as /24's How can you aggregate them up if all you have is the /24? > > To those who filter out /24's - how is this done - just by the netmask > size? > > ----- Original Message ----- > From: "Jean-Christophe Smith" <jsmith(a)vitalstream.com> > To: <nanog(a)merit.edu> > Sent: Wednesday, October 15, 2003 15:34 > Subject: Pitfalls of annoucing /24s > > >> >> >> In current practice would there be serious jeopardy of portions of the >> internet not being able to reach this address space due to bgp >> filters or >> other restrictions? What is the smallest acceptable block of IPs that >> can be >> announced without adverse or unpredictable results? Verio would most >> likely >> be picking up these routes from us. I don't want to cause a religious >> debate, but I am interested in what the industry consensus is. >> >> I'm just doing some research, any comments would be appreciated. >> >> Thanks, >> Jean-Christophe Smith >> >> > > --Phil Rosenthal ISPrime, Inc.

2 1

some DNS data ...
by bmanning＠karoshi.com 17 Oct '03

17 Oct '03

We have finished the latest quarterly audit of the DNS <http://www.ep.net> and now include not only the reverse trees, but 64% of the forward map too. This is the rough cut, using version.server and version.bind replies. Presenting some preliminary numbers for your amusment. For the DNSsec junkies... we have some work to do - 0.1% penetration is really poor, but its better than last quarter. For the wildcard zelots - time to play catch-up w/ the latest ISC code. The bind 4.x tail off is dragging. :( Time to kill the beast. And for you folks w/ the user generated strings, the next pass will have some additional tests. ---------------------------------------------------- 164,395 unique servers user generated strings = 73034 ~44% bind 4.x = 1589 ~ 0.9% bind 8.x = 34792 ~21% bind 9.x = 54980 ~33% ------------------- summary detail ----------------- 1747 report " " 70433 report <various user-generated strings> 174 report 3.1415 (to 40 digits) 148 report x.x versions (where x.x is anything pre 4.8.3) 5 report 4.8.x 1584 report 4.9.x 317 report {5-8}.x 81 report 8.1.1 1219 report 8.1.2 48 report 8.2 92 report 8.2.1 2165 report 8.2.2 8701 report 8.2.3 2284 report 8.2.4 416 report 8.2.5 211 report 8.2.6 301 report 8.2.7 16855 report 8.3.x 2419 report 8.4.x 103 report 9.0.0x 1457 report 9.1.0x 382 report 9.1.1x 622 report 9.1.2x 2702 report 9.1.3x 2386 report 9.2.0x 33923 report 9.2.1x 11618 report 9.2.2x 2 report 9.2.3 214 report 9.2.3rc1 393 report 9.2.3rc2 101 report 9.2.3rc3 880 report 9.2.3rc4 27 report 9.3.0a0 (ISC internal release only) 3 report 9.3.0s20020328 2 report 9.3.0s20020703 11 report 9.3.0s20020722 2 report 9.3.0s20021004 1 report 9.3.0s20021115 151 report 9.3.0s20021217 (last "stable" DNSSEC release) ----------------------------------------------- --bill

1 0

False information: CEO of Versign facts are wrong
by Sean Donelan 17 Oct '03

17 Oct '03

http://news.com.com/2008-7347-5092590.html Quotes Stratton Sclavos: "The DDOS (distributed denial-of-service) attacks last October on the root system--hey, there are 13 global copies of that, and they're all operating. It should scare people that nine of the 13 went down. It's time for the Internet infrastructure to go commercial. On the core services of the infrastructure, it's time to pull the root servers away from volunteers who run them out of a university or lab or some other level. That's going to be an unpopular decision." This factoid has been proven false multiple times, in multiple forums over the last year. Its incredible that a CEO of a company that claims DNS expertise wouldn't know this was false. One particular "internet security" company was PINGing the root servers, and some of the root server operators turned off ping. The root servers themselves were unaffected (except maybe one operated by the US Military). Historically, the only wide-spread failures have been due to NSI operators screwing up the COM or NET zone files. Historically, the other network operators have needed to pick up the load when NSI fell down. NSI controls two root servers. Perhaps its time to split those up among different organizations. There is no reason why NSI must operate any root name severs. NSI moved all the COM and NET zones to seperate GTLD servers controlled SOLELY by NSI years ago.

6 8

Fascinating interview with Verisign CEO
by Hank Nussbacher 17 Oct '03

17 Oct '03

http://news.com.com/2008-7347-5092590.html -Hank

11 11

RE: Tomatoes for Verisign at NANOG 29
by John_York＠Dell.com 17 Oct '03

17 Oct '03

> -----Original Message----- > From: Kenny Sallee > Sent: Friday, October 17, 2003 3:03 PM > To: Matt Levine; Dan Riley > Cc: NANOG > Subject: Re: Tomatoes for Verisign at NANOG 29 > > > From another perspective, it could be how Verisign > plans on making money off this. If they can redirect > to their own Site Finder site, I'm sure they can > redirect to other large corporations, who would > probably pay for that kind of service. Buy this > service, user types www.coke-soft-drink.com, and gets > redirected automatically to www.coke.com. > Corporations now have a much broader reach then > yesterday. They'd make a deal on the trademark thing, > if there is one. > > Kenny Wouldn't it be easier (sheaper) to just buy the domain www.coke-soft-drink.com? Or maybe you meant www.*coke*.com and www.*soft-drink*.com would be redirected?

1 0