- NANOG - lists.nanog.org

Trend and analysis tools
by David Scott Olverson 20 Mar '03

20 Mar '03

Good afternoon, I was wondering what kind network trend and analysis tools people use out there to try and get a handle on overal network health? (bandwidth, etc.) Feel free to contact me off list if you like? Thanks, Dave Olverson

1 0

VU#464113 - TCP/IP implementations handle unusual flag combinations inconsistently
by Ian Finlay 20 Mar '03

20 Mar '03

Hello, This may be old news to many, but I wanted to follow-up to the message I sent last October on this subject: <http://www.merit.edu/mail.archives/nanog/2002-10/msg00519.html> We have now published information about this issue here: <http://www.kb.cert.org/vuls/id/464113> We also have a few reports of possible exploitation. If you have feedback, please send mail to cert(a)cert.org with VU#464113 in the subject header. Thanks to the NANOG community for prior feedback on this issue. Regards, Ian Ian Finlay Internet Systems Security Analyst - CERT/CC Operations Networked Systems Survivability Program =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= CERT (R) Coordination Center Email: cert(a)cert.org Software Engineering Institute WWW: http://www.cert.org Carnegie Mellon University Hotline: +1-412-268-7090 Pittsburgh, PA USA 15213-3890 FAX: +1-412-268-6989 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0

Need Multicast Feed.
by Ejay Hire 20 Mar '03

20 Mar '03

Can anyone close to 701 or 6347 lend me a multicast tunnel? I'd like to do some experimenting with mulicast and my provider is dragging their feet. Thanks, Ejay

1 0

NJ: Red alert? Stay home, await word
by Jeff Wasilko 20 Mar '03

20 Mar '03

http://www.southjerseynews.com/issues/march/m031603e.htm If the nation escalates to "red alert," which is the highest in the color-coded readiness against terror, you will be assumed by authorities to be the enemy if you so much as venture outside your home, the state's anti-terror czar says. ...

8 9

Re: Your message to "<nanog@merit.edu>"
by Jack Bates 20 Mar '03

20 Mar '03

Hmmm. Would have thought turning off a nanog subscription would be considered on the list of things to do when closing an email account. auto-responder(a)nsf.gov wrote: > Your message to the National Science Foundation is being returned to > you because the address (sgoldste) is no longer valid. A copy of > your message is attached. > > The person you addressed is no longer at the Foundation, and the > Postmaster has no forwarding information. For more information, > please call our Information Center at 703-292-5111, or by email at: > info(a)nsf.gov. -- -Jack

1 0

RE: 69/8 revisited
by McBurnett, Jim 20 Mar '03

20 Mar '03

look at the location too... 61/8 is APNIC and 69 ARIN.. J >-----Original Message----- >From: jlewis(a)lewis.org [mailto:jlewis@lewis.org] >Sent: Wednesday, March 19, 2003 5:02 PM >To: Stephen Sprunk >Cc: Scott Granados; Rick Ernst; North American Noise and Off-topic >Gripes >Subject: Re: 69/8 revisited > > > >On Wed, 19 Mar 2003, Stephen Sprunk wrote: > >> I'm wondering if there's something special about 69/8... I >can't recall >> this sort of discussion for 61/8 through 68/8, at least >after CIDR in the >> former Class A space was initially validated. > >For a very interesting comparison, do groups.google.com searches for >69.0.0.0/8 and then for 61.0.0.0/8. While the first is >several pages of >hits saying to block 69.0.0.0/8 as a bogon, all the links for >61.0.0.0/8 >seem to suggest blocking that /8 due to spam. > >---------------------------------------------------------------------- > Jon Lewis *jlewis(a)lewis.org*| I route > System Administrator | therefore you are > Atlantic Net | >_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________ > >

1 0

69/8 revisited
by Rick Ernst 19 Mar '03

19 Mar '03

We were just allocated a /17 out of 69/8. With all off the recent traffic on 69/8 reachability problems, I asked ARIN if the allocation could come from a different block. Their answer was basically that 69/8 (only) is where they are allocating from and that "from reading NANOG, it appears that much of the problem has been resolved." I haven't seen any updated information that 69/8 is now working for people. Is everyone just quiet about it, or have filters actually been updated making this a non-issue? Thanks, Rick

5 6

Problems with AT&T
by German Martinez 19 Mar '03

19 Mar '03

Anybody here seeing problems with AS7018 ? Thanks German -- "The man who fights for his ideals is the man who is alive." --CERVANTES author of DON QUIJOTE

4 3

RE: 69/8...this sucks
by Frank Scalzo 19 Mar '03

19 Mar '03

Do you really think that people who don't have enough clue to update their filters are going to be able to figure out why they can't reach content in 69/8? Moving all root-servers WOULD fix the problem. Although I doubt anyone is really going to be willing to make the news by causing that much of an outage. What we can REALISTICALLY accomplish is to lean on the people who publish books/web pages/templates/etc. to include big scary warnings about using bogon filters and outline WHY they should be careful. I bet for example we could get Rob Thomas to update his templates to include scarier warnings like don't do this unless you intend to keep current on new allocations if you don't know what that means skip this section (I noticed there is something in the IOS template that says be "VERY" careful). The warnings should be explicit, and scream don't do this unless you understand it. Personally I have always thought overzealous bogon filtering can be dangerous in the wrong hands and thus avoided it. I don't even trust myself to keep current let alone someone who may pick up a generic firewall book off the shelf and then think they are an expert. -----Original Message----- From: Kevin Loch [mailto:kloch@gurunet.net] Sent: Monday, March 10, 2003 4:22 PM To: nanog(a)merit.edu Subject: Re: 69/8...this sucks Stephen J. Wilcox wrote: > >>I repeat my suggestion that a number of DNS root-servers or gtld-servers >>be renumbered into 69/8 space. If the DNS "breaks" for these neglected >>networks, I suspect they will quickly get enough clue to fix their ACLs. >> > Nice idea in principal (from a purist point of view) but its not practical, I > hope your not serious..! > How about making *temporary* allocations to content providers who vounteer to move some/all content to net-69? Use an initial page on your regular net to alert users to "contact their ISP and have them fix their bogon filter if the below link doesn't work." If done right, it might speed up the clean-up. The only problem would be finding volunteers with sufficient traffic who are willing to break their site. I could do this on some of my sites. They're not Ebay, but they do get hit from about 40K unique IP's per day, with a very global distribution. If ARIN is interested, contact me privately. KL

6 6

Draft client notice for 69/8 problems
by Matt Martini 19 Mar '03

19 Mar '03

Nanog: Below is a draft of a letter that we will be sending to clients who experience 69.0.0.0/8 connectivity problems. I am making it available to help those ISPs that are confronted by clients with connectivity issues due to assigning them 69.0.0.0/8 addresses. It can be adapted to suit an ISP's specific needs. I welcome commments and advice. (I know I'm gonna hate myself for saying that around here ;^) Matt __________________________ http://www.invision.net/ _______________________ Matthew E. Martini, PE InVision.com, Inc. (631) 543-1000 x104 Chief Technology Officer matt(a)invision.net (631) 864-8896 Fax _______________________________________________________________________pgp_ _______________________________________________________________________ NOTICE REGUARDING NETWORK REACHABLITY _______________________________________________________________________ Dear Customer: This document discusses problems connecting to/from your site over the Internet due to outdated filtering by your ISP or IT Department. It will give a high level explanation of the problem and offer a solution. It will then discuss the issue in detail at a technical level sufficient for network administrators to fix the problem. <ISP_NAME>'s Customer Service will work with you to help your ISP/IT Department resolve these issues. You can contact us at tech-support@<ISP.COM> or (555) 555-5555 x555. <YOUR_NAME> <YOUR_TITLE> <ISP_NAME> Problem Description ___________________ Certain computers cannot reach and/or be reached by other computers on the Internet. Symptoms of this would be the inability to go to certain web sites, or the inability to send/receive email from certain sites. The cause of this is outdated IP filters on routers and/or firewalls. These filters are put into place by network administrators to prevent malicious use of unallocated IP addresses. However, the list of allocated addresses changes over time and so the filters must be updated to avoid blocking legitimate, albeit newly valid IP addresses. Every few months a new block of IP addresses are released by the IP registries to ISPs and then in turn to end users. The IP block 69.0.0.0/8 was allocated to ARIN as a usable block in August 2002. Before this time these addresses were unallocated and invalid for use on the Internet. Network administrators before this time may have filtered this block of IPs, along with all of the other unallocated blocks, in their routers and firewalls. If these filters were not updated since August 2002, they would improperly filter traffic to and from these addresses and thus cause the connectivity problems you are experiencing. Recommended Solution ____________________ The solution is rather a simple one. All that has to be done is to update these router and firewall filters to allow the 69.0.0.0/8 block of addresses. This is usually a matter of a fairly simple configuration change that can be accomplished by your Network Administrators, IT Department, or ISP. Finding the correct person to implement these changes can be somewhat more challenging than the problem itself. <ISP> Customer Service can help you track down the place where the filtering is taking place. It may be taking place at your ISP's boundary, or a corporate firewall. Once the place is identified you can then have the responsible party make the changes. Once again <ISP> will be there to explain the technical details of this issue. Please let us know if we can assist in any way to help you fix this problem. Action Items for Network Administrators and ISPs _______________________________________________ Please update your BGP ingress filters and firewall rules to allow 69.0.0.0/8 routes and traffic as these addresses became valid IPs allocated by ARIN in August 2002. Please contact tech-support@<ISP.COM> for assistance. Detailed Explanation ____________________ The Internet Assigned Numbers Authority (IANA) allocates Internet Protocol version 4 (IPv4) address space to Registries including ARIN, RIPE, and APNIC. These registries in turn allocate address space to ISPs who in-turn allocate addresses for end-users. This is documented in RFC 1466. See: http://www.iana.org/assignments/ipv4-address-space All of the addresses that are not allocated by the above process should never appear in the Internet routing table. These unallocated addresses are dubbed "Bogons". A packet routed over the public Internet should never have a source address in a bogon range. These are commonly found as the source addresses of DDoS attacks. As such a network administrator may filter these IP addresses from their routing tables and block them from entering their network via firewall rules. This behavior is actually encouraged because it helps to limit Denial of Service attacks. However, these filters must be kept up to date to avoid filtering newly released and valid IPs. The IANA allocations change fairly often, sometimes in as little as every four months. Administrators who elect to engage in strict filtering must be prepared to follow the IANA allocation changes and update their filters regularly. Mailing lists such as NANOG, isp-bgp, isp-routing as well as http://www.cymru.com/Bogons are good places to look for announcements of changes. http://www.cymru.com/Bogons is also an excellent reference which explains bogon filters, shows how to find the latest lists, and educates network administrators on how to subscribe to appropriate announcement lists to become aware of updates/changes in what IPs can be safely filtered. Here is a brief look at the more recent changes: Address Block Date Registry - Purpose Notes or Reference ----- ------ --------------------------- ------------------ 063/8 Apr 97 ARIN (whois.arin.net) 064/8 Jul 99 ARIN (whois.arin.net) 065/8 Jul 00 ARIN (whois.arin.net) 066/8 Jul 00 ARIN (whois.arin.net) 067/8 May 01 ARIN (whois.arin.net) 068/8 Jun 01 ARIN (whois.arin.net) 069/8 Aug 02 ARIN (whois.arin.net) 080/8 Apr 01 RIPE NCC (whois.ripe.net) 081/8 Apr 01 RIPE NCC (whois.ripe.net) 082/8 Nov 02 RIPE NCC (whois.ripe.net) 220/8 Dec 01 APNIC (whois.apnic.net) 221/8 Jul 02 APNIC (whois.apnic.net) 222/8 Feb 03 APNIC (whois.apnic.net) 223/8 Feb 03 APNIC (whois.apnic.net) Those administrators who feel that maintaining their filters regularly is too difficult, or those organizations who don't have an IT department can setup filtering for just DUSA addresses. These are routes that should NOT be routed on the Internet. They include RFC 1918, "Martian" networks, 127.0.0.0/8, and multicast blocks. These are fully detailed in Bill Mannin's document: ftp://ftp.ietf.org/internet-drafts/draft-manning-dsua-08.txt Along with filtering your own IPs from ingress and allowing only your assigned IPs at egress this filtering set is the minimum that all ISPs and corporations should use. It has the benefit that it is fairly static and requires much less maintenance. Again, please contact tech-support@<ISP.COM> for assistance in updating your filters.

1 0