- NANOG - lists.nanog.org

test
by blitz 02 Dec '02

02 Dec '02

no reply needed

1 0

RE: Operational Issues with 69.0.0.0/8...
by Todd A. Blank 02 Dec '02

02 Dec '02

We feel your pain, Scott. We are just glad that we are able to verify that there are problems with this CIDR other than on our network. Now to get them resolved. Hopefully this conversation will end up in the proper inboxes to help clean this up. Does anyone besides me worry that because of the recent cutbacks in this industry that there are orphaned pieces of equipment out there causing some of these problems? Todd 614.207.5853 -----Original Message----- From: Scott Granados [mailto:scott@wworks.net] Sent: Monday, December 02, 2002 1:52 PM To: Todd A. Blank Cc: jfeger(a)feger.net; nanog(a)merit.edu Subject: Re: Operational Issues with 69.0.0.0/8... I'd like to second this. We have ran in to problems as well. Usually this is a great place to get help however we have had very responsive actions taken by others out there who had filters in place. On Mon, 2 Dec 2002, Todd A. Blank wrote: > > Thanks for the reply, James. > > I wish I could tell you the answer. We see traffic passing through some > of the routers (transit), but on each network, or their downstreams > there seem to be different devices filtering. Sometimes it is a border > or peering router. In other cases, it has been access devices, such as > firewalls. > > One we resolved this morning (with some help from the good folks at > ARIN) was a downstream provider from one of these transit providers that > was filtering in their devices as well. > > I am just trying to raise general awareness that the 69.0.0.0/8 block is > assigned and out there in use, and to get people to re-examine their > filters, access lists, etc. > > You help and response is appreciated. > > Sincerely, > > Todd A. Blank > 614.207.5853 > > -----Original Message----- > From: Feger, James [mailto:jfeger@feger.net] > Sent: Monday, December 02, 2002 1:35 PM > To: Todd A. Blank > Subject: Re: Operational Issues with 69.0.0.0/8... > > When you say 'Networks involved' do you mean those providers are > blocking > the traffic, or you see these networks in the transit? > > Thanks, > James > > > On Mon, 2 Dec 2002, Todd A. Blank wrote: > > > > > To all concerned: > > > > We have been assigned a CIDR of 69.1.192.0/19. > > > > We have had numerous problems getting traffic through to various > destinations. > > > > We are finding that many routers are still filtering 69.0.0.0/8. > > > > This block used to be restricted, but was assigned by IANA to ARIN in > August of 2002. > > > > If anyone is still filtering this block in their routers, please > remove the filters! > > > > Here are some of the destinations that are not reachable if your > source is anywhere in the 69.0.0.0/8 CIDR: > > > > www.cplink2.com > > www.ocas.com > > www.indofilms.com > > www.lavalife.com > > > > > > Some of the Networks involved are Cable and Wireless, Allegiance > Internet and AT&T. > > > > Thank you, > > > > Todd A. Blank > > IPOutlet LLC > > 614.207.5853 > > > > >

1 0

Operational Issues with 69.0.0.0/8...
by Todd A. Blank 02 Dec '02

02 Dec '02

Thanks for the reply, James. I wish I could tell you the answer. We see traffic passing through some of the routers (transit), but on each network, or their downstreams there seem to be different devices filtering. Sometimes it is a border or peering router. In other cases, it has been access devices, such as firewalls. One we resolved this morning (with some help from the good folks at ARIN) was a downstream provider from one of these transit providers that was filtering in their devices as well. I am just trying to raise general awareness that the 69.0.0.0/8 block is assigned and out there in use, and to get people to re-examine their filters, access lists, etc. You help and response is appreciated. Sincerely, Todd A. Blank 614.207.5853 -----Original Message----- From: Feger, James [mailto:jfeger@feger.net] Sent: Monday, December 02, 2002 1:35 PM To: Todd A. Blank Subject: Re: Operational Issues with 69.0.0.0/8... When you say 'Networks involved' do you mean those providers are blocking the traffic, or you see these networks in the transit? Thanks, James On Mon, 2 Dec 2002, Todd A. Blank wrote: > > To all concerned: > > We have been assigned a CIDR of 69.1.192.0/19. > > We have had numerous problems getting traffic through to various destinations. > > We are finding that many routers are still filtering 69.0.0.0/8. > > This block used to be restricted, but was assigned by IANA to ARIN in August of 2002. > > If anyone is still filtering this block in their routers, please remove the filters! > > Here are some of the destinations that are not reachable if your source is anywhere in the 69.0.0.0/8 CIDR: > > www.cplink2.com > www.ocas.com > www.indofilms.com > www.lavalife.com > > > Some of the Networks involved are Cable and Wireless, Allegiance Internet and AT&T. > > Thank you, > > Todd A. Blank > IPOutlet LLC > 614.207.5853 >

2 1

Operational Issues with 69.0.0.0/8...
by Todd A. Blank 02 Dec '02

02 Dec '02

To all concerned: We have been assigned a CIDR of 69.1.192.0/19. We have had numerous problems getting traffic through to various destinations. We are finding that many routers are still filtering 69.0.0.0/8. This block used to be restricted, but was assigned by IANA to ARIN in August of 2002. If anyone is still filtering this block in their routers, please remove the filters! Here are some of the destinations that are not reachable if your source is anywhere in the 69.0.0.0/8 CIDR: www.cplink2.com www.ocas.com www.indofilms.com www.lavalife.com Some of the Networks involved are Cable and Wireless, Allegiance Internet and AT&T. Thank you, Todd A. Blank IPOutlet LLC 614.207.5853

1 0

Re: Federal Reserve Risks Collapse Re: Risk of Internet collapse grows
by sgorman1＠gmu.edu 02 Dec '02

02 Dec '02

The validity of the data and assumptions made in the Grubesic paper is not the topic I intended to discuss, I did not write the paper and I am not the person that can answer questions or criticisms. I can sympathize with the difficulties of getting good data for the analysis that was endevoured, and the problems of publishing timely results. We found similar problems with the Boardwatch data (well noted in several posts) when doing related analysis, but I do believe that the paper does make an interesting contribution with the techniques it used - different from the assumptions and data. This is probably the biggest disconnect between the academic and operations community, in academia a greater value is placed on the analytice techniques created, and the data is a means to test those techniques or tools. What happens outside the ivory tower is often an after thought. This is a very general statement and varies considerably by discipline. Regardless it becomes a problem when real world data is being used to inform the policy creation process. This is the unusual situation we find ourselves in, and any and all feedback, commentary, and discussion is very valuable even flames. Hopefully we have a chance to get some in person come the February meeting. This thread has pointed out the pitfalls of research, but it would be interesting to discuss ways that cooperative efforts could be built to avoid these pitfalls. ----- Original Message ----- From: Sean Donelan <sean(a)donelan.com> Date: Saturday, November 30, 2002 6:04 am Subject: Re: Federal Reserve Risks Collapse Re: Risk of Internet collapse grows > On Fri, 29 Nov 2002 sgorman1(a)gmu.edu wrote: > > What you decided to attack on the post was the defense of another > > researchers options of data and how current that data was. He used > > what was available to him at the time, end of statement. > > As long-time readers (or anyone with access to Google) know, > Boardwatch'sISP Directory as a data source has a long history of > problems going back > to the mid 1990's. It has been extensively discussed on this and > many,many other ISP mailing lists in the past. > > When you have limited or poor quality data, you need to be even more > careful about what conclusions you make. > > > If you could you use your expertise and creativity to help the > > research community produce better research instead of shooting > > everything down after the fact, something postitive might actually > > come from the effort. > > I have. > > If researchers are going to use Boardwatch's ISP Directory as a data > source, treat it like any other advertising directory (e.g. the Yellow > Pages). It is a poor source for engineering technical data. Its > a great source for comparing advertising budgets, marketing campaigns, > finding sales departments. > > >

1 0

question concerning traceroute?
by Darrell Carley 01 Dec '02

01 Dec '02

I am trying to troubleshoot a latency issue for some of our networks, and was wondering about this.Knowing that routing isn't always symmetrical, is it possible for a traceroute to traverse a different reverse path, than the path that it took to get there? .or will it provide a trace of the path the packet took to reach the destination? According to definition, is should take the same path, but are there any other cases that I should be aware of? Darrell

24 34

Re: Risk of Internet collapse grows
by sgorman1＠gmu.edu 30 Nov '02

30 Nov '02

Sean makes a good point about the importance of the quality of data, but the question is how can good data be made available for research. We've covered this ground before, that firms are not going to make data available. There are better data sets that have become recently available from a few sources, and hopefully improved analysis will result. That said a few things should be kept in mind with academic work. The time from when work is done until it appears in publication is quite legthy, especially when peer reviewed (the Grubesic et al article was peer reviewed). I saw his paper presented in the Fall of 2001, which means he probably did the research in the spring of 2001, and the latest data available was Boardwatch 2000. so, you end with a lag in Internet time that seems horrendous. One of the problems with academia. I do think it is important to think about the best contributions from academia providing tools (algorithm's etc.) to analyze data and view issues from a different perspective. We will never have the quality of data the operations community has. That said I think it is vital to get good feedback from the operations communtiy on our assumptiopns and something this forum has been great with helping with from my experience. I was curious if we put some recent research online if folks would be interested in providing feedback. Happy holidays, sean ----- Original Message ----- From: Sean Donelan <sean(a)donelan.com> Date: Wednesday, November 27, 2002 3:49 pm Subject: Re: Risk of Internet collapse grows > > On Wed, 27 Nov 2002 sgorman1(a)gmu.edu wrote: > > The full paper is available at: > > > > http://whopper.sbs.ohio-state.edu/grads/tgrubesi/survive.pdf > > > > password: grubesic > > > > It was posted on the www.cybergeography.org website with the > password,> plus I'm sure Tony would like the feedback. > > Was this paper peer reviewed ? > > I'm interested in the problem, but this is not the paper. > > AT&T's network is the most vulnerable? While Onyx is among the least > vulnerable? Onyx is bankrupt, and their network is no longer in > operation. I guess you could argue Onyx not vulnerable any more. This > paper starts out with some bad assumptions, such as there is one > NAP in a > city, one path between cities or the marketing maps in Boardwatch are > meaningful. > > Until we figure out how to collect some meaningful starting data, we > can't draw these types of conclusions. > > > >

6 5

Re: Federal Reserve Risks Collapse Re: Risk of Internet collapse grows
by sgorman1＠gmu.edu 30 Nov '02

30 Nov '02

Is this selective argumentation? I agree that the proper assumptions need to be made for research. This is the whole reason I started posting here in the first place, and the request I made at the end of the post - help making sure assumptions are correct. What you decided to attack on the post was the defense of another researchers options of data and how current that data was. He used what was available to him at the time, end of statement. If you could you use your expertise and creativity to help the research community produce better research instead of shooting everything down after the fact, something postitive might actually come from the effort. "But misunderstanding the risks and vulnerabilities is worse because it diverts resources away from the real ones." Perhaps giving contructive advice would be away to avoid such a pitfall. Nahhhhh - it is much more fun to flame. ----- Original Message ----- From: Sean Donelan <sean(a)donelan.com> Date: Thursday, November 28, 2002 6:10 pm Subject: Federal Reserve Risks Collapse Re: Risk of Internet collapse grows > > On Thu, 28 Nov 2002 sgorman1(a)gmu.edu wrote: > > That said a few things should be kept in mind with academic > work. The > > time from when work is done until it appears in publication is quite > > legthy, especially when peer reviewed (the Grubesic et al > article was > > peer reviewed). I saw his paper presented in the Fall of 2001, > which> means he probably did the research in the spring of 2001, > and the > > latest data available was Boardwatch 2000. so, you end with a > lag in > > Internet time that seems horrendous. One of the problems with > > The paper would have the same problems in 2000. It starts with bad > assumptions. Age doesn't improve bad assumptions. > > Suppose I wrote an academic paper about the design of the Federal > Reserve Banking System. After carefull analysis of the map at > http://www.federalreserve.gov/otherfrb.htm (street addresses available > at http://www.federalreserve.gov/fraddress.htm) I write a fully > footnotedpaper that the Federal Reserve system is vulnerable to > the destruction > of the board in Washington DC and twelve banks in Boston, New York, > Philadelphia, Cleveland, Richmond, Atlanta, Chicago, St. Louis, > Minneapolis, Kansas City, Dallas and San Francisco. The US banking > system would collapse, ATMs would stop, paychecks wouldn't get cashed, > checks couldn't be cleared, etc. I would miss Alan Greenspan, but > that'snot how the US banking system works. > > The Federal Reserve system does have vulnerabilities. So does the > Internet (and the post office, and the telephone network, and ...) > But misunderstanding the risks and vulnerabilities is worse because > it diverts resources away from the real ones. > > > >

2 1

Risk of Internet collapse grows
by Irwin Lazar 30 Nov '02

30 Nov '02

Thought this might be worth passing on: http://news.bbc.co.uk/2/hi/technology/2514651.stm <http://news.bbc.co.uk/2/hi/technology/2514651.stm> There is a recent book out called "Linked: The New Science of Networks" which details the potential for causing widespread Internet damage by targeting a few hubs instead of random or widespread attacks against large numbers of hosts. This simulation seems to backup the author's concerns. Irwin

10 9

Odd DDoS, anyone else seen this?
by Stephen J. Wilcox 29 Nov '02

29 Nov '02

Hi, we had a large DDoS over the weekend, I wondered if anyone else has seen this and knows what software is behind it. We saw many hundred thousand packets per second entering our network from various international peers, each packet was tcp destined to a single real end user IP address and sourced from a /16 network address eg 61.254.0.0, where the src was random and different on each packet but always x.x.0.0 I was unable to find out more about the data within the packet, the sheer volume made diagnosis impossible without killing the routers. Steve

8 9