- NANOG - lists.nanog.org

routing security
by Ratul Mahajan 12 May '03

12 May '03

recent discussion reiterated that the ability to hijack address blocks is a real threat. i am trying to understand in what other ways routing security can be compromised in the current world. (while one can easily come up with scores of potential dangers, it is hard to tell how realistic a given danger is.) i would appreciate (off-list) feedback on what you think the big problems in routing security are. you can either provide your perspective on the issue or rank the list below in order of importance. a. router misconfig b. address block hijacks (a special form of misconfig) c. software bugs d. compromised routers (how frequent is this?) e. dos attacks targetted at routers f. others (please specify) bgp security gets a lot of attention. are people happy with security of intra-domain routing? thanks, -- ratul

1 0

Interesting Announcements
by miltonningis＠hushmail.com 11 May '03

11 May '03

Perhaps someone at AS2828 (XO/Concentric) would like to explain this... Anyone know why AS 8143: $ whois -h whois.arin.net 8143 OrgName: Publicom Corp. OrgID: PUBLIC-35 Address: 1450 Coral Way #10 City: Miami StateProv: FL PostalCode: 33145 Country: US RegDate: 1997-04-25 Is announcing the following blocks? $ whois -h whois.arin.net 155.73.0.0 OrgName: Borealis AS OrgID: BOREAL Address: Hovedgade 96 Address: 2800 Lyngby City: StateProv: PostalCode: Country: DK RegDate: (unknown) $ whois -h whois.arin.net 134.33.0.0 OrgName: Codex Corporation OrgID: CODEXC Address: 20 Cabot Boulevard City: Mansfield StateProv: MA PostalCode: 02048 Country: US RegDate: 1989-04-24 $ whois -h whois.arin.net 196.4.167.0 OrgName: Juta Information Network OrgID: JIN Address: PO Box 14373 Address: Kerwyn Address: 7790 City: StateProv: PostalCode: Country: ZA RegDate: 1994-02-02 $ whois -h whois.arin.net 144.2.0.0 OrgName: Publico B.V. OrgID: PUBLIC-1 Address: Burg. Krolln 14C Address: 5126 PT Gilze City: StateProv: PostalCode: Country: NL RegDate: 1990-10-30 $ whois -h whois.arin.net 143.49.160.0 OrgName: Inform, Ltd. OrgID: INFORM-12 Address: 1123 2nd Ave City: San Francisco StateProv: CA PostalCode: 94103-2705 Country: US RegDate: 1990-03-26 $ whois -h whois.arin.net 160.116.160.0 OrgName: Affiliated Computing Services (Pty) Ltd OrgID: ACSPL Address: Affiliated Computing Services (Pty) Ltd Address: P. O. Box 261333 Address: Excom 2023 City: StateProv: PostalCode: Country: ZA RegDate: 1992-07-23 $ whois -h whois.arin.net 162.73.128.0 OrgName: Information Technology OrgID: INFORM-21 Address: 100 Broadway City: New York StateProv: NY PostalCode: 10004 Country: US RegDate: 1992-08-24 $ whois -h whois.arin.net 198.204.0.0 OrgName: GHR Services Inc. OrgID: GHRSER Address: 995 Old Eagle School Road, Suite 310 City: Wayne StateProv: PA PostalCode: 19087 Country: US RegDate: 1993-06-22 Call me crazy, but seems odd for all these wierd companies with old registrations in all sorts of countries to all be hosted out of one location in NYC, by an AS registered to florida (in 1997). Also, Perhaps someone from AS16631 (Cogent) can explain this one: Why is AS27255: $ whois -h whois.arin.net 27255 OrgName: VMX Inc OrgID: VMXINC Address: 25 Broadway Address: 6th Floor Suite 4A City: New York StateProv: NY PostalCode: 10004 Country: US RegDate: 2003-01-31 Announcing this? $ whois -h whois.arin.net 157.156.0.0 OrgName: VMX Inc OrgID: VMXINC Address: 25 Broadway Address: 6th Floor Suite 4A City: New York StateProv: NY PostalCode: 10004 Country: US RegDate: 1992-01-13 Had a /16 for 11 years, just recently decided to get an ASN? Seems like someone just registered a new company to have the same name as a company that had a /16, and then got a new ASN.... I dunno, call me crazy... ---------------------------------- Milton Ningis Security Specialist Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

7 8

PAIX Peering
by Shon Elliott 11 May '03

11 May '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is anyone else experiencing any type of issues at PAIX Peering in Palo Alto? We've been seeing high latency to peers, usually in the 200ms-400ms range. We have checked all of our internal equipment and can find no problems. I have seen other problems between sbcglobal routers between palo alto and santa clara, again, not sure if it's related. Any responses would be appreciated. :-) Have a nice weekend! - -- Thanks, Shon Elliott Systems Engineer; OptiGate Networks, Inc. ASN: 6561 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE+vbK0t49dIzGDssARAlROAJwJYLdhyRS51Tt9DOCXNSwXvQy9awCgnX6t O6vEUILDpQ/K3a4BWBi5shA= =Y+34 -----END PGP SIGNATURE-----

2 1

The Cidr Report
by cidr-report＠potaroo.net 10 May '03

10 May '03

This report has been generated at Fri May 9 21:46:11 2003 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 02-05-03 122251 86865 03-05-03 122319 87066 04-05-03 122363 87067 05-05-03 122379 87079 06-05-03 122340 87095 07-05-03 122432 86820 08-05-03 122376 86965 09-05-03 122433 86761 AS Summary 15091 Number of ASes in routing system 5981 Number of ASes announcing only one prefix 1529 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73183232 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 09May03 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 122403 86785 35618 29.1% All ASes AS4151 1083 77 1006 92.9% USDA-1 USDA AS7132 963 208 755 78.4% SBIS-AS SBC Internet Services - Southwest AS7843 655 169 486 74.2% ADELPHIA-AS Adelphia Corp. AS701 1529 1089 440 28.8% ALTERNET-AS UUNET Technologies, Inc. AS4323 585 172 413 70.6% TW-COMM Time Warner Communications, Inc. AS7018 1331 934 397 29.8% ATT-INTERNET4 AT&T WorldNet Services AS3908 896 526 370 41.3% SUPERNETASBLK SuperNet, Inc. AS1221 1091 779 312 28.6% ASN-TELSTRA Telstra Pty Ltd AS705 533 237 296 55.5% ALTERNET-AS UUNET Technologies, Inc. AS1239 970 682 288 29.7% SPRINTLINK Sprint AS22927 298 14 284 95.3% AR-TEAR2-LACNIC TELEFONICA DE ARGENTINA AS4355 393 111 282 71.8% ERMS-EARTHLNK EARTHLINK, INC AS6198 465 183 282 60.6% BATI-MIA BellSouth Network Solutions, Inc AS6197 483 205 278 57.6% BATI-ATL BellSouth Network Solutions, Inc AS4814 294 21 273 92.9% CHINANET-BEIJING-AP China Telecom (Group) AS2386 546 314 232 42.5% INS-AS AT&T Data Communications Services AS17676 245 22 223 91.0% GIGAINFRA XTAGE CORPORATION AS27364 270 63 207 76.7% ACS-INTERNET Armstrong Cable Services AS22773 209 8 201 96.2% CCINET-2 Cox Communications Inc. Atlanta AS209 489 298 191 39.1% ASN-QWEST Qwest AS3561 505 327 178 35.2% CWUSA Cable & Wireless USA AS2048 262 88 174 66.4% LANET-1 State of Louisiana AS6347 370 198 172 46.5% DIAMOND SAVVIS Communications Corporation AS690 482 315 167 34.6% MERIT-AS-27 Merit Network Inc. AS6327 189 23 166 87.8% SHAWFIBER Shaw Fiberlink Limited AS4200 174 21 153 87.9% AGIS-NET Apex Global Information Services, Inc. AS17557 371 219 152 41.0% PKTELECOM-AS-AP Pakistan Telecom AS2686 256 106 150 58.6% AS2686 AT&T Global Network Services - EMEA AS6140 293 143 150 51.2% IMPSAT-USA ImpSat AS3602 225 79 146 64.9% SPRINT-CA-AS Sprint Canada Inc. Total 16455 7631 8824 53.6% Top 30 total Possible Bogus Routes 24.2.128.0/21 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.7.10.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.11.98.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.14.197.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.18.132.0/23 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.23.8.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.119.0.0/16 AS11492 CABLEONE CABLE ONE 24.180.60.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.183.185.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.183.186.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.183.187.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.183.188.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.183.189.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.183.191.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 24.223.128.0/17 AS11060 NEO-RR-COM Time Warner Cable Northeast Ohio 61.12.32.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 61.12.34.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 64.30.64.0/19 AS14900 USLEC-CORP-1 USLEC Corp. 65.2.165.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 65.6.145.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 65.6.146.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 65.6.147.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 65.6.150.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 65.6.151.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 65.8.0.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 65.11.200.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 65.11.201.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 65.15.117.0/24 AS6478 ATT-INTERNET3 AT&T WorldNet Services 66.41.192.0/18 AS13367 ATT-BBND-B AT&T Broadband 68.192.0.0/14 AS6128 CABLE-NET-1 Cablevision Systems Corp. 69.11.0.0/20 AS803 SASKTEL SaskTel 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 140.240.0.0/13 AS1 GNTY-1 Genuity 155.32.0.0/12 AS1 GNTY-1 Genuity 155.36.0.0/16 AS14751 CONVERSENT Conversent Communications 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 165.212.0.0/16 AS7424 USANET USA.Net 166.16.0.0/16 AS3751 SNET-AS Southern New England Telephone 171.64.0.0/10 AS1 GNTY-1 Genuity 192.16.52.0/24 AS1239 SPRINTLINK Sprint 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 ALTERNET-AS UUNET Technologies, Inc. 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.79.0/24 AS719 AS719 LANLINK autonomous system 192.153.136.0/21 AS568 SUMNET-AS DISO-UNRRA 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.228.0.0/16 AS4637 REACH Reach Network Border AS 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.98.8.0/21 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ATTCA-15290 AT&T Canada Telecom Services Company 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.79.32.0/20 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.167.25.0/24 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 200.14.32.0/22 AS11751 BR-ICEP-LACNIC Instituto Cyber de Ensino e Pesquisa 200.14.34.0/23 AS11751 BR-ICEP-LACNIC Instituto Cyber de Ensino e Pesquisa 202.3.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.145.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.146.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.152.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.155.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.156.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.157.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.4.252.0/22 AS4808 CNCGROUP-BJ CNCGROUP-BJ 202.4.255.0/24 AS4799 UNSPECIFIED Ji Tong Communications Co., Ltd. 202.6.96.0/24 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.6.97.0/24 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.6.99.0/24 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.41.160.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 202.41.161.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 202.41.163.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 202.41.164.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 202.41.165.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 202.44.112.0/20 AS17458 CWNETDG-IO-AP Cable and Wireless 202.79.0.0/20 AS4637 REACH Reach Network Border AS 202.89.200.0/24 AS7473 SINGTEL-AS-AP Singapore Telecom 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.93.64.0/19 AS9425 I-NEXT-AS-AP Inter.net Philippines border AS 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.130.224.0/20 AS4808 CNCGROUP-BJ CNCGROUP-BJ 202.130.240.0/21 AS4808 CNCGROUP-BJ CNCGROUP-BJ 202.130.248.0/21 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.130.248.0/22 AS4812 CHINANET-SH-AP China Telecom (Group) 202.130.252.0/22 AS4812 CHINANET-SH-AP China Telecom (Group) 202.136.254.0/23 AS4808 CNCGROUP-BJ CNCGROUP-BJ 202.136.254.0/24 AS4808 CNCGROUP-BJ CNCGROUP-BJ 202.140.230.0/23 AS9466 UUNET-JP-AP UUNET Japan Limited 202.140.232.0/23 AS9466 UUNET-JP-AP UUNET Japan Limited 202.140.234.0/24 AS9466 UUNET-JP-AP UUNET Japan Limited 202.140.235.0/24 AS9466 UUNET-JP-AP UUNET Japan Limited 202.142.130.0/23 AS17820 DIL-AP DIRECT INTERNET LTD. 202.142.132.0/22 AS17820 DIL-AP DIRECT INTERNET LTD. 202.143.48.0/21 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.143.56.0/21 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.159.128.0/17 AS4622 UNSPECIFIED IndoInternet PT. 202.161.0.0/19 AS10097 FLOWCOM flow communications level 2 541 kent st sydney nsw 2000 202.161.0.0/21 AS4634 -No Whois Entry- 202.161.8.0/21 AS4634 -No Whois Entry- 202.164.192.0/19 AS7599 IPXC-AS-AP IP Exchange 202.165.0.0/19 AS9443 INTERNETPRIMUS-AS-AP Primus Telecommunications 202.173.32.0/19 AS9671 APNIC-AS-3-BLOCK Asia Pacific Network Information Centre 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.76.128.0/24 AS9729 IS-AP iAdvantage Limited 203.76.224.0/24 AS9549 COMDEK-ISP-AS-AP Comdek ISP 203.78.125.0/24 AS17653 PCM-HK-AP Pacific Century Matrix 203.86.2.0/23 AS4058 APNIC-4058 Asia Pacific Network Information Centre 203.90.192.0/20 AS9658 ETPI-IDS-AS-AP Eastern Telecoms Phils., Inc. 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 203.135.224.0/19 AS4058 APNIC-4058 Asia Pacific Network Information Centre 203.161.39.0/24 AS4768 CLIX-NZ CLEAR Internet Exchange 204.19.224.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 204.29.189.0/24 AS11755 WAYMARKCOMM Waymark Internet Services, Inc. 204.52.232.0/24 AS7177 DFWNET DFW Internet Services, Inc. 204.89.225.0/24 AS2495 KANREN Kansas Research and Education Network 204.154.240.0/21 AS11572 MEDIACOM Mediacom,llc / RidgeNet 204.194.110.0/23 AS10588 ICSNET Intelligent Computer Solutions, Inc 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 205.173.248.0/21 AS2548 ALGX-ATCW-AS Allegiance Telecom Companies Worldwide 205.233.139.0/24 AS15290 ATTCA-15290 AT&T Canada Telecom Services Company 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.82.64.0/18 AS7029 ALLTELNET Alltel Information Services, Inc. 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.126.0.0/19 AS5750 FLEXNET-HAWAII FlexNet Inc. 206.191.64.0/18 AS15290 ATTCA-15290 AT&T Canada Telecom Services Company 206.251.69.0/24 AS10494 AAI Accurate Automation, Inc. 207.47.39.0/24 AS816 UUNET-AS4 UUNET Technologies, Inc. 207.92.0.0/14 AS2551 ICG ICG NetAhead, Inc. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.65.232.0/23 AS701 ALTERNET-AS UUNET Technologies, Inc. 208.66.66.0/24 AS14985 VEROXITY Veroxity Technology Partners, Inc. 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 208.101.8.0/24 AS3561 CWUSA Cable & Wireless USA 208.104.103.0/24 AS1239 SPRINTLINK Sprint 209.104.198.0/24 AS6137 SISNA SISNA, Inc. 209.104.199.0/24 AS6137 SISNA SISNA, Inc. 209.104.218.0/24 AS6137 SISNA SISNA, Inc. 209.104.219.0/24 AS6137 SISNA SISNA, Inc. 209.104.252.0/22 AS12030 PACIFIC-ONLINE-PON Pacific Online Services 209.108.0.0/14 AS2551 ICG ICG NetAhead, Inc. 209.151.128.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 209.160.70.0/23 AS13415 LUMIX Lumix Communications, Inc. 209.160.73.0/24 AS13415 LUMIX Lumix Communications, Inc. 209.160.209.0/24 AS13415 LUMIX Lumix Communications, Inc. 209.160.210.0/24 AS13415 LUMIX Lumix Communications, Inc. 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.172.0.0/18 AS7770 TRITON Triton Technologies, Inc. 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.222.137.0/24 AS10494 AAI Accurate Automation, Inc. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 211.27.156.0/24 AS9768 PUBNET1-AS KT 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.47.32.0/19 AS11304 SPLUS Solutions Plus Inc. 216.81.32.0/20 AS3356 LEVEL3 Level 3 Communications, LLC 216.81.64.0/20 AS3356 LEVEL3 Level 3 Communications, LLC 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services 216.115.178.0/24 AS11676 ACSBPS Affiliated Computing Services Business ProcessSolutions 216.115.179.0/24 AS11676 ACSBPS Affiliated Computing Services Business ProcessSolutions 216.115.182.0/24 AS11676 ACSBPS Affiliated Computing Services Business ProcessSolutions 216.115.183.0/24 AS11676 ACSBPS Affiliated Computing Services Business ProcessSolutions 216.115.184.0/23 AS11676 ACSBPS Affiliated Computing Services Business ProcessSolutions 216.115.186.0/23 AS11676 ACSBPS Affiliated Computing Services Business ProcessSolutions 216.115.186.0/24 AS11676 ACSBPS Affiliated Computing Services Business ProcessSolutions 216.115.189.0/24 AS11676 ACSBPS Affiliated Computing Services Business ProcessSolutions 216.115.190.0/24 AS11676 ACSBPS Affiliated Computing Services Business ProcessSolutions 216.115.191.0/24 AS11676 ACSBPS Affiliated Computing Services Business ProcessSolutions 216.153.0.0/17 AS6203 ISDN-NET ISDN-Net Inc. 216.153.96.0/20 AS1239 SPRINTLINK Sprint 216.211.177.0/24 AS14473 KNET KNet, Inc. 216.226.108.0/22 AS3602 SPRINT-CA-AS Sprint Canada Inc. 217.117.117.0/24 AS2007 INFONET3 INFONET Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

5 4

Re: PMTU and Broken Servers
by Jeff McAdams 10 May '03

10 May '03

Blah...forgot to send this to nanog as well...it seems there is a lack of understanding of why this works in some situations and not in others, so attempted to spread some knowledge here. Also Sprach Leo Bicknell >but I find it slightly (emphasis on the slightly) that someone would >turn on PMTU discovery, and then filter it out right in front of the >boxes where they turned it on. As someone else mentioned...it happens all the time...disconnect between server and network admins probably, or something along those lines (or just general cluelessness) >Also, it seems to me most DSL users are behind PPPoE links with lower >MTU, and should get hit by the same problem. No. The trick, here, is that the PPPoE (typically) terminates on the same system that's terminating the TCP connection, so the PPPoE end system can see that the PMTU is going to be, at most, 1492, so it can use a lower Maximum Segment Size in TCP to start the whole scenario off at the 1492 MTU size and try to go down from there. You're seeing the problem because the tunnel is not terminated on the system that's also terminating the TCP connection, so the TCP processing can't know about the 14xx MTU somewhere out there except through PMTU (which is broken in this case), so it can't set the corresponding MSS to compensate for it initially. >The temporary hack is to have tunnelbox1 clear the DF bit on all >incoming packets, which just causes the packets to get fragmented going >down the tunnel. A minor performance hit, but it works. An only slightly better hack would be to have the tunnel and/or firewall twiddle the MSS on outgoing TCP connections to compensate for the lower tunnel MTU. Still pretty gross, but won't have as much of an effect on the TCP performance. >Are the servers really that broken (PMTU enabled, ICMP Can't Fragement >filtered)? Yes. The last time I ran into this, my test site was www.harvard.edu (!)...though that's been a year or more ago, so they may have resolved their issues since then. We ran into plenty more sites that had the problem, but that's the one that sticks out in my mind because, like I said, it was the one that I used as a site to try to connect to as a test. >Does the head end box of DSL services generally do something to work >around this (ie, clear the DF bit)? Am I just being an idiot and >missing something obvious? I wouldn't say idiot, or missing anything obvious...but you were missing the whole MSS issue. I've never thought the behavior was intuitive or obvious...but once you think about it becomes a "Why didn't I think of that?" sorta thing. -- Jeff McAdams "He who laughs last, thinks slowest." -- anonymous

5 6

AS1 Network peering
by Flash 10 May '03

10 May '03

This is my first posting after lurking for quite some time so please be gentle. I wanted to know if anyone else felt the pain of the former Genuity AS1 de-peering with a number of key nap's Wednesday May 7th. Unfortunately one of our EBGP peers is AS3356 which appears to have picked up a number of the peerings that AS1 disconnected from. Since Level3 and Genuity are one in the same now was this event the merging of portions of AS1 into AS3356 ? Gordon AS13407

2 1

Noc Contact List
by /micah mcnelly 09 May '03

09 May '03

I am looking for a current NOC contact listing for US/CANADA. There are a few people that I need to get ahold of right away. respect, /micah style.net

2 1

RE: Noc Contact List
by Kris Foster 09 May '03

09 May '03

See Jared's list at http://puck.nether.net/netops/ <http://puck.nether.net/netops/> Kris -----Original Message----- From: /micah mcnelly [mailto:micah@style.net] Sent: Friday, May 09, 2003 2:37 PM To: nanog(a)merit.edu Subject: Noc Contact List I am looking for a current NOC contact listing for US/CANADA. There are a few people that I need to get ahold of right away. respect, /micah style.net

1 0

RCN/Erols Peering Contact
by Leo Bicknell 09 May '03

09 May '03

If you are one, and could drop me a note off list that would be grand. :) -- Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

1 0

Re: PMTU and Broken Servers
by ddragon＠hushmail.com 09 May '03

09 May '03

"Dalvenjah" you are in direct violation of the NANOG AUP. Please come into compliance by posting with your real name, as opposed to your IRC nickname, otherwise you'll be removed from the list. If we are to believe that "Dajvenjah Foxfire" is your real name, please provide proof of your legal name change, or a birth certificate, for NANOG review. >>>>>> "bicknell" == Leo Bicknell <bicknell(a)ufp.org> writes: > > bicknell> This is a new problem to me, but I'm sure people have > bicknell> run into it before. Are the servers really that broken > bicknell> (PMTU enabled, ICMP Can't Fragement filtered)? Does >the > bicknell> head end box of DSL services generally do something >to > bicknell> work around this (ie, clear the DF bit)? Am I just > bicknell> being an idiot and missing something obvious? > >I first saw this about four years ago with a web site running behind >a load balancing device. It was -- and probably still is -- another >issue of default configuration hell. The web servers were configured >by default to do Path MTU discovery, while the load balancer had >no concept of passing the ICMP Need Fragment packet back to the >appropriate server. > >(There may still be no good way to do this; if I remember right, >> >the ICMP Need Fragment packet contains only IPs and not ports; >the host sending the ICMP packet will be using its IP and the outside >IP of the load balancer, giving the load balancer no good way to >determine where to pass the ICMP packet, unless the load balancer >is guaranteeing that all data from a particular IP goes to a particular >server -- also not a default configuration.) > >It's a hard call for which to make the default; PMTU makes sense, >> >obviously, unless you're running behind a load balancer. It's another >one of those things that probably isn't documented anywhere, or >if it is, >it's buried in an appendix that nobody gets to. > >The only solution is to mail the folks maintaining the web sites >you >can't get to with a short explanation of what you think the problem >is, >and hope they look into it and fix it. Not unlike smurf relays and >networks that don't filter outgoing source addresses. }:> > >-dalvenjah > >-- > > > Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0