- NANOG - lists.nanog.org

RE: Congrats to Alternet/UUNET/MFS/Worldcom/MCI IP Network Security Team
by McBurnett, Jim 17 Apr '03

17 Apr '03

I hate to be the downtroden one... But did you REALLY see the date of that news release.. ;-) Good Job folks..... Jim >-----Original Message----- >From: Sean Donelan [mailto:sean@donelan.com] >Sent: Wednesday, April 16, 2003 11:08 PM >To: nanog(a)merit.edu >Subject: Congrats to Alternet/UUNET/MFS/Worldcom/MCI IP >Network Security >Team > > > >In an April 1 press release. > >WorldCom's First Class Security Team In addition to the company awards, >four of WorldCom's principal security experts, Chris Morrow, network >security manager; Brian W. Gemberling, senior network security >specialist; >Blaine S. Christian, manager of traffic engineering and support and >Heather Skanks, network security specialist, were recognized >by the SANS >Institute as instrumental in successfully developing and executing >remediation plans for both the DDOS and worm attacks. > >http://global.mci.com/news/news2.xml?newsid=7350&mode=long&lang =en&width=530&root=/&langlinks=off

1 0

Independent space from ARIN
by Dan Hollis 17 Apr '03

17 Apr '03

Would like to hear from anyone who purchased independent address space from ARIN, what issues you had (technical, or otherwise). -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

20 46

Broadsoft, Sylantro softswitch info
by Christopher J. Wolff 17 Apr '03

17 Apr '03

Greetings, If anyone out there is using one of the above softswitches, please contact me off-list. I need some ballpark pricing and configuration info and the vendors can't turn it around fast enough. Thank you very much in advance. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com email: chris(a)bblabs.com

1 0

Congrats to Alternet/UUNET/MFS/Worldcom/MCI IP Network Security Team
by Sean Donelan 17 Apr '03

17 Apr '03

In an April 1 press release. WorldCom's First Class Security Team In addition to the company awards, four of WorldCom's principal security experts, Chris Morrow, network security manager; Brian W. Gemberling, senior network security specialist; Blaine S. Christian, manager of traffic engineering and support and Heather Skanks, network security specialist, were recognized by the SANS Institute as instrumental in successfully developing and executing remediation plans for both the DDOS and worm attacks. http://global.mci.com/news/news2.xml?newsid=7350&mode=long&lang=en&width=53…

1 0

Verizon Mapping contact
by Gerald 16 Apr '03

16 Apr '03

I am working my way through the VZ phone channels, but if someone from Verizon who could help with T3 mapping in Manhattan could contact me off list, I would really appreciate it. I think I blew the poor phone techs mind when I asked him for help with that. :-) Thanks, Gerald

1 0

DoS and cable cuts take toll on entire country of Pakistan
by Sean Donelan 16 Apr '03

16 Apr '03

Guessing the motives of attackers is always difficult, but this probably has less to do with international politics and more with local politics and personal disputes. http://www.jang.com.pk/thenews/apr2003-daily/12-04-2003/business/b2.htm KARACHI: The Pakistan Telecommunication Company Limited has decided to isolate government websites from Pakistan Internet Exchange (PIE) to make internet browsers safe from Denial of Service attacks, which slow down the internet speed to a snail's pace, sources close to the company said on Friday. "The PTCL has decided to isolate these (government's) websites from PIE by providing a 2 megabyte IPLC link to National Telecommunications Corporation (NTC) and all sites are hosted at the server connected to this IPLC," sources added. "In this way, rest of Pakistan's internet could be safe from DoS attacks and only these 2 megabytes link would be effected," they added. Pakistani websites have been facing attacks by some hackers for over a month and thanks to DoS, the internet browsing is increasingly becoming a very trying job by the day. http://www.paktribune.com/news/index.php?id=22300 The Minister called up the presentation in the wake of strong reaction by the ISP community on the denial of service attacks on the Pakistan Internet Exchange for the last one month which also took its toll on the performance of entire internet infrastructure in the country. Earlier the company officials briefed the minister on the problems they had faced in the recent past on account of damage to their fiber optic cable as well as the incidents of denial of service attacks which slowed down the performance of all users.

1 0

Re: Dealing with ARIN.. my experiences & tips
by Jeff McAdams 16 Apr '03

16 Apr '03

Also Sprach Brian Johnson >OK. Let's all assume that Reform is necessary. >Please state, in detail, how you would reform ARIN and all of the >policy changes that you would instate (asside from giving you whatever >you want) to make ARIN "reformed" in the yes of it's membership. >I await, with baited breath, the answers form the Maha-Jeffy. :-) Alas...I agree with what some others have said. The answers aren't easy, and I don't have them all easily at hand. I think there are some steps that could be taken. Some comments off the top of my head... First and foremost...ARIN seems disconnected from the realities of running an ISP...particularly a smaller ISP. There needs to be more effort to understand the business needs of ISPs in general (again, particularly smaller ISPs) to understand *why* so many people (even those that do it on a regular basis and are "experts" in it) find dealing with ARIN to be such a PITA. They need to consider whether the policies that they have in place really and truly do accomplish the goals that they are supposed to accomplish. I think its pretty clear at this point that they don't. They need some common sense discussion about really how to accomplish the goals, the current policies clearly aren't doing it...even can be counter-productive wrt to the whole point of why ARIN was created (ie, more common sense policies would have resulted in me advertising half the number of routes in BGP than I am now...the goal of reducing routing table growth has most definitely not been accomplished in my case...and, as I've pointed out...I'm really *trying* to do the Right Thing...not all ISPs do). They need to "normalize" (for lack of a better word) their published policies...as well as "normalize" their actual policies with what's published. The feel that I get (this is a perception...not much hard evidence to back it up...but I'd be surprised if I'm alone in this) is that ARIN has put policies up on its web site, and then totally independantly, developed policies for operation...with the same basic set of goals in mind. The result being policies in real life that are similar, but not the same, as what's published. If there's a change in the real-life policy, that needs to be reflected on their website. As for some specific policy points that I think are bogus. Obviously, I feel the allocating for 3-months needs to be expanded...I'd say probably to a year would be reasonable. Basing it on past usage growth...ok...I don't have any inherent problems with that, but specific situations, such as a desire to renumber out of PA space, should be considered much more strongly than it is currently. Limiting SWIP to /29 or shorter prefixes doesn't seem to have much merit to me...I imagine a lot of ISPs wouldn't want to SWIP longer prefixes because of the administrative overhead (of which there certainly would be some)...our system allows us to do it pretty easily, so it wouldn't be a big deal here. And, as bdragon pointed out, circuit size (and I'll add network size) doesn't correlate precisely with ip address space consumption (ie, the idea that you can put a very large corporate network behind a single, or very small number of ip addresses). Certainly, large networks like that, should probably have their own records...even if only a single public IP address is in use. So, what guideline would I come up for this? As a discussion starting point, require anything shorter than /29 to be SWIP'ed, but leave longer up to the ISP...yes, not many ISPs would SWIP anything longer than /29, but we would, *particularly* if it made dealing with ARIN easier (which is should). Anyway...some starting points...I'm sure...with more thought and more experience dealing with ARIN, I could come up with some more suggestions...but I'll be the first to admit that I don't have all the answers. -- Jeff McAdams Email: jeffm(a)iglou.com Head Network Administrator Voice: (502) 966-3848 IgLou Internet Services (800) 436-4456

11 19

Re: Independent space from ARIN
by Jeff McAdams 15 Apr '03

15 Apr '03

Also Sprach bdragon(a)gweep.net >> Yes...following policy over common sense. Exactly as I feared. >Or some would say that the policy _is_ common sense. Uhm...only someone on the moon, maybe. Their (unpublished) policies are seriously lacking in common sense...I think that's been shown in my postings...and acknowledged by any of the number of people here that are much more expert at dealing with ARIN than I am. >Sometimes it makes things harder, you deal with it, or in your case, >you whine about it on mailing lists. Or, you try to reform the situation by shedding light on the inadequacies of the institution. >You claimyou were efficiently utilizing the space, but of course ARIN >can't defend themselves, so we are left to believe you. Even if you >_are_ telling the truth, the number of folks on this list who have >stated that they've advocated lying, or have helped people lie seems to >tell me that ARIN shouldn't believe you. I haven't seen anyone in this thread advocate lying...though I don't follow all nanog posts, so I don't know if it may have happened in other threads...if so, I find that reprehensible. More than that I can't say. >> Again, we had greater than 80% utilization on *all* of our >> blocks...not just the most recently allocated one, and closer to 90% on most >> of them. The documentation that we gave to ARIN in support of our >> request showed this as well. >So you say. So...at this point, your defense of ARIN is to assume that *I'm* lying. Great. >>My "error" was that I expected ARIN would give me enough space to >>renumber out of my current space as their documentation on their >>website seems to indicate is necessary. Silly me. >So, you did absolutely nothing. This is a common problem with many on >nanog. If I can't do something 100% my ay, I'ld rather do nothing. I did nothing because I was told by ARIN that I wasn't expected to re-number...that it wasn't a consideration in the allocation. I offered to renumber in the initial allocation because I was under the impression that it was required, not because we wanted to do it at that time. When they said it wasn't expected, or a consideration, no, we didn't renumber. Then we find out, much later, that it *is* a consideration, and that we're partially screwed because we didn't read their mind that it was a consideration when they were verbally telling us that it wasn't. >>Yeah, it would be silly of ARIN to actually abide by the documentation >>that they post on their website...so silly. >I've read their documentation. It sounds like they abided with their >policies to me. Depends on when you ask, apparently. (Actually, neither explanation I got from ARIN, either after the initial allocation, nor the one I got in the process of the most recent allocation, line up with what's on their website). >Oof, so even _you_ translate circuit size into eligibility for address >space? Actually...if you really want to get pedantic, we translate how much money a customer pays us into partial eligibility for address space. We still require justification, but if a customer doesn't have a certain size account, they won't get the address space even if they *are* justified for it. Again, we're going above and beyond what ARIN requires as far as address space requirements...despite your attempt to spin this into being my problem (why you're so emotionally invested in ARIN, I haven't a clue). >How stupid indeed, since circuit size has no bearing on need for >addresses (either in support or against). There is a correlation there...not strict, I'll acknowledge, but generally, larger circuits will end up using larger numbers of IP's. To deny that is as absurd as saying the correlation is strict, or to have a policy of certain size circuits automatically get certain sized allocations. Again, we try to do the Right Thing. I've turned down allocations from upstreams that weren't needed in an effort to prevent address space fragmentation and routing table polution, etc. >If I were ARIN I'ld definately look at your documentation with a close >eye. Again, your defense of ARIN seems to be accusing me of under-handed actions. >Well, good for you. However, if you think you can do this once and be >done, you are sorely misinformed. We haven't had to go back and redesign and renumber our network, because we learned from the first experience and have followed good allocation practices since then. I've gone back and audit'ed our network usage (informally) and it still falls within good allocation guidelines. So, no, I *don't* have to go back and do this more than once...as long as the allocations made, going forward, follow best practices, which we have. >In any event, it all comes down to: you had the opportunity to begin >readdressing. You failed to do so on anything but your own terms. Now >you (presumably) still have not readdressed and are still whining about >it. You just don't get it. As I mentioned earlier, we offered to re-number at the initial allocation because we thought it was necessary, but ARIN themselves told us it wasn't, that *IT WASN'T A CONSIDERATION*...you seem to keep skipping over this very important point...ARIN told us we didn't need to renumber. They lied to us, full stop. Had they been up-front and said that re-numbering would be a consideration at our next allocation, we would have (grudgingly) worked towards renumbering...again...since they didn't give us sufficient space to renumber, we would not have been able to do so completely, but we would have started the process. Let's be clear on this. Our decision not to start the renumbering process was informed by ARIN telling us it wasn't a consideration. I know I'm repeating myself here, but this is a critically important point that you have repeatedly ignored. >This thread has sapped too much of my time, and the brain cells of the >community. Hopefully you'll just go and renumber and quit your >bitching. No, as long as ARIN's policies and actions are ill-founded, they (and likely other relevant...at least tangentially) fora such as nanog will continue to hear about it...from me, and no doubt from others who have to tolerate this charade of trying to protect the public interest. ARIN has failed. -- Jeff McAdams Email: jeffm(a)iglou.com Head Network Administrator Voice: (502) 966-3848 IgLou Internet Services (800) 436-4456

11 13

Stopping TCP DDoS HOWTO
by John Obi 15 Apr '03

15 Apr '03

Hello Nanogers, What is the best way to stop TCP DDoS, I'm not talking about UDP or ICMP, just TCP attacks, and not spoofed too. I see alot of attacks coming from rr.com and attbi.com beside other cable and DSL providers. Thanks, -J __________________________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo http://search.yahoo.com

2 1

Re: Independent space from ARIN
by Eric Brunner-Williams in Portland Maine 15 Apr '03

15 Apr '03

> I am sure Microsoft would love to have this implemented. For them to drop, > say, $5b and buy up all remaining available IP address space is no big > deal. ... Howdy Hank, Back when I was contributing to "Working Group C" (ICANN New gTLDs), through the clutter of trademark zealots (no new tlds ever) and anarchists (zillions now) the insight swept over me one like-verisign-to-compeat-verisign evening. Everyone wanting "in" was an amature, or one of the six new registrars, and a cut above amature, and no one had deep pockets, except courtesy of the dot gone bubble. So who could sweep this market, and bundle a domain name into their product... It hasn't happened. My crystal ball has a crack. Eric

1 0