- NANOG - lists.nanog.org

RE: 69/8...this sucks -- Centralizing filtering..
by Michael.Dillon＠radianz.com 10 Mar '03

10 Mar '03

>What I really meant by single pt. of failure was... problems of losing the >filtering list if the central system is down... Granted, this would not >cause any network issues.. We know how to set up central authorities without central systems or obvious single points of failure. For instance, the DNS has a single root authority but there are 13 distributed servers publishing authoritative data. And not all of those servers are single systems. For some time now Vixie's root server has been at least two systems using his own FreeBSD kernel hack to handle load balancing and failover. Also, people are beginning to realize that having a local cache of authoritative data is a wise thing and is not very difficult to do. That's why ISC is now offering a replica service for network operators to set up local copies of Vixie's F root server. I would expect that the LDAP service for IP address range attributes would leverage all of this knowledge about architecture. LDAP may a more versatile protocol than DNS but it is clearly from the same family tree of directory service protocols and there are no major roadblocks preventing it from being deployed in a sane fashion. --Michael Dillon

1 0

Re: [Re: 69/8...this sucks -- Centralizing filtering..]
by Joshua Smith 10 Mar '03

10 Mar '03

interesting idea, enable it by default, with the option to turn it off (i hope)... my-big-fat-router# conf t my-big-fat-router(config)# no ip clueless Joe Abley <jabley(a)isc.org> wrote: > > > On Monday, Mar 10, 2003, at 10:54 Canada/Eastern, Haesu wrote: > > >> Since most service providers should be thinking about a sink hole > >> network > >> for security auditing (and backscatter), why not have ONE place > >> where you > >> advertise all unreachable, or better yet -- a default (ie everything > >> NOT > >> learned through BGP peers), and just forward the packets to a bit > >> bucket.. > >> Which is better than an access list since, now we are forwarding > >> packets > >> instead of sending them to a CPU to increase router load. > >> > >> I don't think ARIN can help the situation. ISPs just need to remove > >> the > >> access lists from each router in the network and centralize them. > > > > I totally agree with you. However, as always, centralized systems, > > while > > ease management and scalability, everything becomes a trust issue and a > > single point of failure or source of problems... > > I can think of two organisations which could probably take care of a > good chunk of the problem, if people were prepared to leave it up to > them. The routing system is already largely dependent on the > interoperability of bugs produced by these people, and so arguably no > additional trust would be required. > > One organisation has a name starting with "j", and the other starts > with "c". > > > Joe > "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

RE: 69/8...this sucks -- Centralizing filtering..
by Mark Segal 10 Mar '03

10 Mar '03

> -----Original Message----- > From: Haesu [mailto:haesu@towardex.com] > > I totally agree with you. However, as always, centralized > systems, while ease management and scalability, everything > becomes a trust issue and a single point of failure or source > of problems... Single point of failure? Not sure I agree with you.. What happens if your sink hole disapears? Your filtering goes out.. O no.. Please not that. Hardley think that is even a reason for a noc to page you... :). Regards, Mark -- Mark Segal Director, Data Services Futureway Communications Inc. Tel: (905)326-1570

2 1

RE: 69/8...this sucks -- Centralizing filtering..
by Mark Segal 10 Mar '03

10 Mar '03

> From: E.B. Dreger [mailto:eddy+public+spam@noc.everquick.net] > > The problem with only a default: Think when a rogue ISP > decides to advertise an unused netblock and utilize that IP > space for malicious purposes. A route exists... do we trust it? But that kinda filtering should be done at BGP route ingress by, you, or the transit provider of choice. I'm not suggesting that a default is the only way. It just happens to be a good lazy way for the people who can't seem to find the time to check the IANA web page at least once a quarter.. :). Regards, Mark -- Mark Segal Director, Data Services Futureway Communications Inc. Tel: (905)326-1570

1 0

RE: Abstract of proposed Internet Draft for Best Current Practic e (please comment)
by Dr. Jeffrey Race 10 Mar '03

10 Mar '03

On Mon, 10 Mar 2003 09:11:31 -0500, Cutler, James R wrote: >Implies that a simple "j'accuse" is enough to create a denial of service. I >prefer the US to Napoleonic codes, where an accusation is insufficient to >prove guilt. Please read the details in the text. It is all spelt out there. Jeffrey Race

3 2

Re: Building Cited for Housing Fuel Tanks Catches Fire [NYT]
by Michael.Dillon＠radianz.com 10 Mar '03

10 Mar '03

> > An electrical fire broke out in the basement of an office tower > > in TriBeCa yesterday, four months after building inspectors said > > they had discovered illegal diesel fuel tanks installed on the > > upper floors of the tower. > basement. roof. what is it i am not getting here? osama bin > elevator? the ratcheting (rat sh<bleep>ing?) up of the american > press hysteria? Diesel fuel from a leaky roof tank will eventually drip down to the basement. Heat from a basement fire will eventually rise up to the roof and cause diesel fuel tanks to explode. In any case, this problem should be solved by the city government in a large city. It is a fact that large cities are large telecomm hubs. It is a fact that large telecomm hubs need guaranteed power supplies. It is a fact that the individual players in telecomm want to be located near each other in large cities (same building, same block). The solution to this whole mess is for the city government to run a special power utility that operates a pair of safe and highly secure diesel power generating plants which provide dual entrance service to telecomm hotels in a specific area of the city. That way folks can install equipment with no batteries and no generators because they are getting triply redundant and diverse power (utility, and 2 city diesel generation plants). We eliminate the dangers of hydrogen fumes and exploding batteries and flammable diesel. BTW, has anyone done any studies of heat generation in routers and switches to identify which bits of the hardware generate the most heat (i.e. consume the most power) and which functions generate the most heat? Maybe there are opportunities for dramatically reducing power consumption by changing the way we configure our networks. --Michael Dillon

3 2

Re: 69/8...this sucks
by Michael.Dillon＠radianz.com 10 Mar '03

10 Mar '03

> According to ARIN's whois server, there are 95 subdelegations for > NET-69-0-0-0-0...we're the 95th. Clearly this problem is going to get a lot worse before it gets better. And since most network operators are not on NANOG or USENET or any other mailing list, there are really only two means of contact. Either every affected party probes the net, identifies misconfigured networks and contacts them one by one using email, phone and letters. Or we use the press to make the problem and solution widely visible. In either case, I think it would be a mistake to just fix the immediate problem of a few ISPs needed full reachability from 69/8 space. Since we have to put the effort into this problem, let's try to fix the general problem, not just a small part of it. The general problem is that ever large numbers of devices are getting IPv4 address ranges hard-coded into their configurations with no process in place for reviewing and changing those configurations. These devices are not just routers but also firewalls and application servers. In order to solve the general problem we need to make it easy for people to review and change their configurations. This is not a lot different from the problems that DNS solved. When you configure a device with a domain name, the device will dynamically review and update the IP address that it uses for communication. No human intervention is necessary. Essentially, what we need is something that provides a capability similar to DNS except that it works for IP address ranges, not for individual IP addresses. This is where ARIN comes in. Because ARIN has the top-level authority for IP address ranges in North America, they are the *ONLY* organization that can authoritatively identify who an IP address range is delegated to. I have suggested that ARIN should set up an LDAP server to publish the delegation of all their IP address space updated on a daily basis. And that organizations which sub-delegate space, i.e. ISPs, should also run LDAP servers as part of a delegation hierarchy similar to DNS. This type of referral LDAP is part of the IETF standard and has been implemented by most LDAP software vendors. Because LDAP is a widespread technology that is used in the enterprise for identification and authentication, there is a high likelihood that the suppliers of firewalls and application servers will build in support for querying the ARIN delegation hierarchy. > I realize ARIN can't guarantee global routability of IP space, but should > they continue to give out IP blocks they absolutely know are not fully > routable on the internet today? ISPs make addresses routable. ARIN is not an ISP. ARIN members are ISPs. ARIN does not compete with its members. Therefore, ARIN should focus on the problem of how to publish authoritative data about which IP addresses should be routable. The appropriate technology combined with the appropriate publicity will create demand from enterprise network admins which will drive all ISPs and device vendors to fix the problem. If anyone wants to discuss this further, then I suggest that the upcoming ARIN meeting in Memphis is the ideal venue to do so. --Michael Dillon

2 1

RE: 923 Mbps across the Ocean ...
by Pete Templin 10 Mar '03

10 Mar '03

-----Original Message----- From: Marshall Eubanks [mailto:tme@multicasttech.com] Sent: Friday, March 07, 2003 3:58 PM To: David G. Andersen Cc: Mikael Abrahamsson; nanog(a)nanog.org Subject: Re: 923 Mbps across the Ocean ... BTW, when I did VLBI for the Navy, we used to move literally tons of tapes around the world per month and achieved sustained bandwidths > 1 Gbps, albeit with FED-EX, not routers. Does this take into account the delay from encapsulating the tapes into a FED-EX packet and assigning the appropriate layer 1 header, then the queueing delays experienced while awaiting an open buffer on the next FED-EX truck? Pete Templin IP Network Engineer TexLink Communications (210) 892-4183 pete.templin(a)texlink.com

2 1

RE: Abstract of proposed Internet Draft for Best Current Practic e (please comment)
by Cutler, James R 10 Mar '03

10 Mar '03

"Well-managed.......profitably....." leaves out a lot of companies. Also >>is there a forthcoming section on criterium for demonstrating >>reformation by the sp and/or 'offending' user? > >The criterion is stated: no more complaints Implies that a simple "j'accuse" is enough to create a denial of service. I prefer the US to Napoleonic codes, where an accusation is insufficient to prove guilt. - James R. Cutler, EDS 800 Tower Drive, Troy, MI 48098 248-265-7514 james.cutler(a)eds.com -----Original Message----- From: Peter Galbavy [mailto:peter.galbavy@knowtion.net] Sent: Friday, March 07, 2003 9:06 AM To: Dr. Jeffrey Race Cc: nanog(a)merit.edu Subject: Re: Abstract of proposed Internet Draft for Best Current Practice (please comment) quote: > Well-managed, ethical members of the internet industry already conduct > their businesses, successfully and profitably, according to the > principles specified in the Practice. The proposed Practice simply > aims to raise the entire industry to the level of today's best > players. I object to this wording; even without reading *any* other part of your document, I am already very cautious about it's contents simply because of the implication of your statement above. This is very much one of those political "you're either with us or against us" declarations. So - if you don't so it 'our way' then you must be unethical and badly-managed. At least. Peter

1 0

UK ISPs not cooperating with law enforcement
by Sean Donelan 10 Mar '03

10 Mar '03

It difficult to tell from the article whether UK ISPs are refusing to cooperate with lawful requests from UK police, or if UK police are trying to get ISPs to give information without proper authorization. http://www.computerweekly.com/articles/article.asp?liArticleID=119873

8 8