- NANOG - lists.nanog.org

RE: Pitfalls of annoucing /24s
by H. Michael Smith, Jr. 15 Oct '03

15 Oct '03

Understood. But... networks filtering out the /24 announcement will always prefer the aggregate learned from the owner/issuer of the space. They'll be completely unaware that another route exists to the (/24) network. If the customers link to the provider that assigned the space goes down, those filtering /24's will still send the traffic to the 'owner' of the space (right?). What is the issuer of the /24 is filtering incoming /24 advertisements (Verio)? Will they learn the route to the other ISP or blackhole traffic destined for their own customer? I keep hoping that I am missing something here. If not, I sure hope more folks don't adopt Verio's filtering techniques. (I know that a VERY low AS # issues /24's out of a /8) -----Original Message----- From: Phil Rosenthal [mailto:pr@isprime.com] Sent: Wednesday, October 15, 2003 5:42 PM To: H. Michael Smith, Jr. Cc: nanog(a)merit.edu; 'John Palmer' Subject: Re: Pitfalls of annoucing /24s On Oct 15, 2003, at 5:24 PM, H. Michael Smith, Jr. wrote: > > > What about the /24's that many ISPs (especially tier 2-3) are assigning > to multi-homed customers? What about an IX or "critical infrastructure > providers" that may be issued a /24 from ARIN (Policy 2001-3)? > As long as it's provider assigned, and your provider announces the supernet that the /24 is from, it will still work. If you announce PI space out of the old class A space in /24's, many networks wont be able to reach you.

1 0

Pitfalls of annoucing /24s
by Jean-Christophe Smith 15 Oct '03

15 Oct '03

In current practice would there be serious jeopardy of portions of the internet not being able to reach this address space due to bgp filters or other restrictions? What is the smallest acceptable block of IPs that can be announced without adverse or unpredictable results? Verio would most likely be picking up these routes from us. I don't want to cause a religious debate, but I am interested in what the industry consensus is. I'm just doing some research, any comments would be appreciated. Thanks, Jean-Christophe Smith

5 4

Re: Pitfalls of annoucing /24s
by Andrew - Supernews 15 Oct '03

15 Oct '03

>>>>> "Phil" == Phil Rosenthal <pr(a)isprime.com> writes: Phil> http://info.us.bb.verio.net/routing.html#PeerFilter Phil> That's how Verio does it, and I assume, that's how most people Phil> who filter by length do it as well. We currently see 28804 /24 prefixes from our transits and peers which are not more-specifics of another prefix that we see. (We see 127981 prefixes in total at the moment, so that's 22.5% of our table). By comparison, we see 41066 /24 prefixes which are more-specifics for another prefix, which is 32.1% of the table. In total, /24s account for 54.6% of the routes we see. Of those 28804 isolated /24 routes, 946 are in "class A" space (0-127), 604 are in "class B" space (128-191), and the remaining 27254 are in "class C" space (192-223). The detailed breakdown by /8 is: /8 |/24 routes | /24 routes |with aggr. | isolated ====|===========|============= 4 39 0 12 722 0 13 1 0 15 6 0 16 1 0 17 2 0 20 5 1 24 706 117 25 0 1 32 94 0 38 50 0 40 23 0 43 1 0 44 2 0 55 1 0 57 11 0 61 281 32 62 360 82 63 1897 8 64 1693 102 65 2012 2 66 1918 250 67 328 35 68 381 13 69 206 71 80 218 197 81 233 31 82 15 4 128 68 26 129 149 3 130 60 2 131 63 13 132 11 8 134 107 5 135 6 4 136 176 2 137 88 21 138 65 1 139 41 9 140 131 1 141 125 11 142 92 1 143 46 0 144 79 7 145 32 1 146 145 124 147 54 12 148 287 4 149 68 11 150 120 1 151 58 2 152 219 2 153 57 1 154 7 0 155 125 4 156 53 5 157 39 4 158 139 1 159 127 16 160 43 3 161 56 13 162 182 180 163 59 4 164 111 14 165 129 23 166 87 9 167 285 19 168 163 12 169 86 8 170 298 17 171 8 0 192 582 4767 193 744 1703 194 672 1326 195 637 639 196 123 350 198 972 2499 199 1064 1763 200 1136 1877 201 1 0 202 1810 2229 203 1426 3775 204 1471 1488 205 1004 1028 206 1630 453 207 2116 370 208 2532 31 209 2294 485 210 761 130 211 320 60 212 642 275 213 611 360 214 15 0 215 22 0 216 2048 1203 217 629 424 218 95 16 219 33 0 220 113 2 221 13 0 222 0 1 -- Andrew, Supernews

1 0

RE: Pitfalls of annoucing /24s
by Jean-Christophe Smith 15 Oct '03

15 Oct '03

I noticed the verio filter policy, in relation to inbound: - In the traditional Class A space (i.e., 0/1), we accept /22 and shorter. If I want to announce a /24 in the 64.x.x.x space(traditional Class A space) am I'm going to have a problem with other networks that have peer filters similar to Verios? Thanks, Jean-Christophe Smith -----Original Message----- From: Phil Rosenthal [mailto:pr@isprime.com] Sent: Wednesday, October 15, 2003 1:47 PM To: John Palmer Cc: nanog(a)merit.edu Subject: Re: Pitfalls of annoucing /24s http://info.us.bb.verio.net/routing.html#PeerFilter That's how Verio does it, and I assume, that's how most people who filter by length do it as well. --Phil On Oct 15, 2003, at 4:40 PM, John Palmer wrote: > > Good question. > > You know there are thousands of legacy /24's out there that were > allocated by > IANA as /24's How can you aggregate them up if all you have is the /24? > > To those who filter out /24's - how is this done - just by the netmask > size? > > ----- Original Message ----- > From: "Jean-Christophe Smith" <jsmith(a)vitalstream.com> > To: <nanog(a)merit.edu> > Sent: Wednesday, October 15, 2003 15:34 > Subject: Pitfalls of annoucing /24s > > >> >> >> In current practice would there be serious jeopardy of portions of the >> internet not being able to reach this address space due to bgp >> filters or >> other restrictions? What is the smallest acceptable block of IPs that >> can be >> announced without adverse or unpredictable results? Verio would most >> likely >> be picking up these routes from us. I don't want to cause a religious >> debate, but I am interested in what the industry consensus is. >> >> I'm just doing some research, any comments would be appreciated. >> >> Thanks, >> Jean-Christophe Smith >> >> > > --Phil Rosenthal ISPrime, Inc.

3 2

RE: Pitfalls of annoucing /24s
by Forrest 15 Oct '03

15 Oct '03

This is just one of the many reasons why we need ARIN proposal 2002-3 to be approved. So that small networks that wish to multihome don't have issues with networks filtering out their /24 along with all the other garbage /24's that are announced. http://www.arin.net/policy/2002_3.html If you support 2002-3 I urge you to get on the ARIN Public Policy Mailing List (PPML) and voice your opinion. http://www.arin.net/mailing_lists/index.html Forrest -----Original Message----- From: H. Michael Smith, Jr. [SMTP:michael@awtechnologies.com] Sent: Wednesday, October 15, 2003 4:24 PM To: 'Phil Rosenthal'; 'John Palmer' Cc: nanog(a)merit.edu Subject: RE: Pitfalls of annoucing /24s What about the /24's that many ISPs (especially tier 2-3) are assigning to multi-homed customers? What about an IX or "critical infrastructure providers" that may be issued a /24 from ARIN (Policy 2001-3)? Although it may be rare that a large aggregate would become unreachable to a "large" network, doesn't the possibility exist that a customer with a /24 would become unreachable (to some) due to the aggregate dropping out even though the /24 should still be reachable? That scenario may not be very likely, but the question of assymetric routing and one's ability to balance traffic become issues. Assigning a lower preference to /24's would be a lot friendlier than just throwing them away. If I am way off base, I fully expect to be corrected (with volume). My flame retardant suit is in place. Michael -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Phil Rosenthal Sent: Wednesday, October 15, 2003 4:47 PM To: John Palmer Cc: nanog(a)merit.edu Subject: Re: Pitfalls of annoucing /24s http://info.us.bb.verio.net/routing.html#PeerFilter That's how Verio does it, and I assume, that's how most people who filter by length do it as well. --Phil On Oct 15, 2003, at 4:40 PM, John Palmer wrote: > > Good question. > > You know there are thousands of legacy /24's out there that were > allocated by > IANA as /24's How can you aggregate them up if all you have is the /24? > > To those who filter out /24's - how is this done - just by the netmask > size? > > ----- Original Message ----- > From: "Jean-Christophe Smith" <jsmith(a)vitalstream.com> > To: <nanog(a)merit.edu> > Sent: Wednesday, October 15, 2003 15:34 > Subject: Pitfalls of annoucing /24s > > >> >> >> In current practice would there be serious jeopardy of portions of the >> internet not being able to reach this address space due to bgp >> filters or >> other restrictions? What is the smallest acceptable block of IPs that >> can be >> announced without adverse or unpredictable results? Verio would most >> likely >> be picking up these routes from us. I don't want to cause a religious >> debate, but I am interested in what the industry consensus is. >> >> I'm just doing some research, any comments would be appreciated. >> >> Thanks, >> Jean-Christophe Smith >> >> > > --Phil Rosenthal ISPrime, Inc.

1 0

Fw: Re: Block all servers?
by Fred Heutte 15 Oct '03

15 Oct '03

The new issue of Network Magazine has a cover story that may be worth a look: "SSL VPNs: Remote Access for the Masses," by Andrew Conry-Murray, which makes a pretty convincing case for the use of SSL VPNs instead of IPSec. A lot of this is still-emerging stuff and the author, to his credit, doesn't pull any punches saying so. But it does make the point that, although IPSec has many admirable design ideas, deployment is sticky. http://www.networkmagazine.com/shared/article/showArticle.jhtml?articleId15… In a similar vein is Lisa Phifer's "VPNs: Tunnel Visions, How do SSL VPNs match up with their older IPSec cousins?" in the August issue of Information Security: http://infosecuritymag.techtarget.com/ss/0,295796,sid6_iss21_art83,00.html Naturally, given the audience, she focuses much more on the security specifics. Of particular interest: IPSec prevents packet modification to thwart man-in-the-middle attacks. However, this strong security feature also generates operational problems. NAT frequently breaks IPSec because it modifies packets by substituting public IP addresses for private ones. Many IPSec products implement NAT traversal extensions, but support for this feature isn't universal, and interoperability is still an issue. SSL is almost as tough against man-in-the-middle attacks, without IPSec's NAT conflict. SSL rides on TCP, so it's insulated from IP and port modifications, and thus passes easily through NAT. SSL carries sequence numbers inside encrypted packets to prevent packet injection, and TLS uses message authentication to detect payload changes. And Phifer notes later that one of the critical issues with SSL VPNs is whether you want to "Webify" everything. For all of us (I hope), the net is much more than just port 80. fred

3 2

Any RBLs still alive that list DSL/Dialup/Cable Modem dynamic addr ranges?
by John Palmer 15 Oct '03

15 Oct '03

Are there any RBLs still out there that list cable modem, dialup and dsl IPs? (anything dynamically assigned or home users)? DIALUPS.MAIL-ABUSE.ORG does not seem to be functioning.

6 6

SECSAC Meeting on Verisign Sitefinder Service
by Brian Bruns 15 Oct '03

15 Oct '03

http://media.icann.org/ramgen/encoder/secsac.rm Live feed of the meeting. Having listened to just about 5 minutes so far, Verisign is fudging quite a bit on how many people like the sitefinder service. Its almost unreal to hear what they are saying. -------------------------- Brian Bruns The Summit Open Source Development Group Open Solutions For A Closed World / Anti-Spam Resources http://www.sosdg.org ICQ: 8077511

1 0

abuse from a user of this list
by Andrew D Kirch 15 Oct '03

15 Oct '03

Last night in conjunction with the attacks on my DSL line and the Summit Open Source Development Group, I received a threatening phone call on my home business line at 1:44 in the morning (GMT-5 CST Indiana-East). My roommate answered the call, and the dialog was simply "how's your DSL B----!", then the caller hung up. This evening my roommate informed me of the call, and told me that the caller had not blocked caller ID, the number in question being 320-282-5940. I tracked this number to a T Mobile cellphone in St Cloud, MN. Thinking this might be the kiddie responsible for the attack I made a *67 call back. I was greeted with the voice mail of Matthew Hallacy (AKA poptix) who has used this forum to take cheap shots at myself and my staff repeatedly. Now he has denigrated to simple threats and harassment off list that didn't even get to me but to my roommate who is entirely uninvolved in this. I must note that this incident greatly saddened me, as I would have thought that all on this list have suffered Denial of Service attacks, and understand the seriousness and severity of these attacks, obviously one of us doesn't get it. please contact me if you have questions regarding this incident. -- Andrew D Kirch | trelane(a)2mbit.com | Security Admin | Summit Open Source Development Group | www.sosdg.org

8 10

Blocking servers: Comcast accidently blocks gamers
by Sean Donelan 15 Oct '03

15 Oct '03

People use the Internet for a lot of different reasons. Its not all client/server access. End-to-end communications occurs between many applications. Its always interesting to watch what things break when ISPs start filtering ports, even if it happens accidently. http://news.com.com/2100-1043_3-5091176.html A Comcast representative confirmed that the problem was with the cable company. A routine upgrade of the software some Comcast routers use inadvertently blocked access to certain server ports, the representative said, adding that the problem was fixed late Monday. ISPs commonly use port-blocking rules to restrict access to a server that may be generating hacking attacks or other objectionable activity.

2 1