- NANOG - lists.nanog.org

Testing router code before deployment
by Tom Holbrook 21 Nov '02

21 Nov '02

Just curious what testing protocol people use with router code (IOS or JunOS for example) when considering deployment of a new version. Obviously the deployment would be made incrementally, but I wonder if you do anything more than running it in a lab router for a couple of weeks before the initial deployment. Thanks -Tom __________________ Tom Holbrook Sr. Network Engineer Earthlink - Atlanta 'Safe?' said Mr. Beaver...'Who said anything about safe? 'Course he isn't safe. but he's good. He's the King, I tell you.' --The Lion, the Witch and the Wardrobe

3 3

Re: Network integrity and non-random removal of nodes
by sgorman1＠gmu.edu 21 Nov '02

21 Nov '02

Hmm - not sure on who owns the trees, but if anyone does know it would be very useful. Most of the work I've read say the connection distribution follows a power law, and is why I did not think it would follow a linear pattern, but just guess work on my part. There has been some work at BU that says all the power law stuff is just sampling bias inherent in traceroute type of data aquisition. In which case vulnerbility might not be as dire as some of the early reports. How to get an accurate topology is the real big problem, but no need to reopen the private sector vs government vs academia debate. ----- Original Message ----- From: William Waites <ww(a)styx.org> Date: Thursday, November 21, 2002 7:56 pm Subject: Re: Network integrity and non-random removal of nodes > >>> "Sean" == <sgorman1(a)gmu.edu> writes: > > >> The supposition would be that the remaining nodes are evenly > >> distributed around the core so the percentage of nodes outside > >> of the core without connectivity should be roughly the > same as > >> the percentage of nodes removed from the core. At least until > >> the core goes non-linear... > > Sean> Is that the supposition stated in the paper? > > No. > > Sean> The reason being it contradicts quite a bit of similar > Sean> research. Nodes inside and outside of the core do not > Sean> typically disconnect at the same rate. > > References? Note that I posited that the rate was proportional, not > the same. > > Sean> The nodes outside of the core on the other hand are much > Sean> more sparsely connected. 55% of them are trees meaning that > Sean> they only have one connection. There is no back up > link, so > Sean> if their big hub node goes down they are out of commission. > > That's more or less what I said. If the trees are evenly distributed > around the core, and you take away 2% of the core, you can > expect 2% > of the trees to disappear too. Of course 2% of the trees is a much > larger number of nodes than 2% of the core. > > Sean> Hence you could have large numbers of nodes outside the core > Sean> disconencted before you would see any effect inside the > Sean> core. By the time the core goes non-linear the > periphery is > Sean> gonna be long gone and disconnected. > > True iff the links to the periphery are not evenly distributed across > the core, which is my, perhaps faulty, underlying assumption. Does > UUNet still own most of the trees? > > -w > >

1 0

Re: Network integrity and non-random removal of nodes
by sgorman1＠gmu.edu 21 Nov '02

21 Nov '02

> The supposition would be that the remaining nodes are evenly > distributed around the core so the percentage of nodes outside of the > core without connectivity should be roughly the same as the percentage > of nodes removed from the core. At least until the core goes > non-linear... Is that the supposition stated in the paper? The reason being it contradicts quite a bit of similar research. Nodes inside and outside of the core do not typically disconnect at the same rate. Think of it this way, if a big well connected node goes down the other big conencted nodes in the core are likely to have an alternate connection to compensate for the link loss. Average distance might go up a little bit, but that is about it. The nodes outside of the core on the other hand are much more sparsely connected. 55% of them are trees meaning that they only have one connection. There is no back up link, so if their big hub node goes down they are out of commission. Hence you could have large numbers of nodes outside the core disconencted before you would see any effect inside the core. By the time the core goes non-linear the periphery is gonna be long gone and disconnected. ----- Original Message ----- From: William Waites <ww(a)styx.org> Date: Thursday, November 21, 2002 7:14 pm Subject: Re: Network integrity and non-random removal of nodes > >>> "Sean" == <sgorman1(a)gmu.edu> writes: > > Sean> it says nothing about what will happen to the other > 91.7% of > Sean> nodes. Considering that 55% of the remaining nodes are > Sean> trees, they will be saying "Houston we have a problem" well > Sean> before 25%. > > The supposition would be that the remaining nodes are evenly > distributed around the core so the percentage of nodes outside of the > core without connectivity should be roughly the same as the percentage > of nodes removed from the core. At least until the core goes > non-linear... > > >> It would be interesting to see what outdegree looks like > as a > >> function of rank -- in the paper they give only the maximum and > >> average (geo. mean) outdegrees. Is there also a critical point > >> 25% of the way through the ranking? Probably not or one would > >> expect they'd have mentioned it... > > It turns out that this is buried in one of the graphs (fig. 6) and > does not appear to have any special properties 25% of the way through. > It does have an inflection point around the 1000th node or so (2.5%). > > -w > >

2 1

RE: Arin Smack down?
by Martin Renschler (EWU) 21 Nov '02

21 Nov '02

tried the link and entered my PacBell home DSL static IP address and was shocked to see my private name come up behind CustName field! Wrong Address though. -------------------------------------------- Whois: CustName: Martin Renschler Address: 268 Bush St San Francisco CA 94104 Country: US RegDate: 2002-08-27 Updated: 2002-08-27 NetRange: 67.116.xxx.xxx - 67.116.xxx.xxx CIDR: 67.116.xxx.xxx/29 NetName: SBC067116xxxxxx020827 NetHandle: NET-67-116-xxx-xxx-1 Parent: NET-67-112-0-0-1 NetType: Reassigned Comment: For Policy Abuse issues, contact: abuse(a)swbell.net For Technical issues, contact: noc(a)swbell.net RegDate: 2002-08-27 Updated: 2002-08-27 ----------------------------------------------------- Isn't this violating privacy rules? Geez! /Martin (private mail not representing my employer's opinion...) -----Original Message----- From: Johannes Ullrich [mailto:jullrich@euclidian.com] Sent: Thursday, November 21, 2002 5:46 AM To: Joe; nanog(a)merit.edu Subject: Re: Arin Smack down? > Perhaps something I've mised, but is ARIN.Net no longer handling > lookups? I usually use them to find offending users but got this > when doing a lookup. > > No match for 64.124.168.60 I did have the same problem yesterday (Wednesday). Looks like it is working today. Maybe some leftover bug from their conversion to the new formats? Or just high load... you can try our ipinfo page, which caches whois queries. If you are lucky, someone else looked up the same ip... http://www.dshield.org/ipinfo.php?ip=64.124.168.60 -- -------------------------------------------------------------------- jullrich(a)euclidian.com Collaborative Intrusion Detection join http://www.dshield.org

6 5

Re: Network integrity and non-random removal of nodes
by sgorman1＠gmu.edu 21 Nov '02

21 Nov '02

It still depends on the network that you are using for analysis. Assuming the paper uses the same dataset as the link Sean provided the giant cluster they are analyzing is only 8.3% of IP nodes in their sample. It takes the removal of 25% when only looking at that small densely connected section, it says nothing about what will happen to the other 91.7% of nodes. Considering that 55% of the remaining nodes are trees, they will be saying "Houston we have a problem" well before 25%. Whether or not it matters that they have a problem in an entirely different question. I've probably kicked this dead horse enough already ----- Original Message ----- From: William Waites <ww(a)styx.org> Date: Thursday, November 21, 2002 6:31 pm Subject: Re: Network integrity and non-random removal of nodes > > >>> "Sean" == Sean Donelan <sean(a)donelan.com> writes: > > Sean> On 20 Nov 2002, William Waites wrote: > >> If you randomly select nodes to remove, by the time you have > >> removed 25% of them, the network breaks up into many isolated > >> islands. > > Sean> One of the key points was the nodes were removed in ranked > Sean> order, not in random order. > > I stand corrected. > > It would be interesting to see what outdegree looks like as a function > of rank -- in the paper they give only the maximum and average > (geo. mean) outdegrees. Is there also a critical point 25% of the way > through the ranking? Probably not or one would expect they'd have > mentioned it... > > So then the 12500 *biggest* routers have to be disabled before the > graph breaks into many islands. This would be yet harder > from an > attacker's point of view, no? > > -w > > >

2 1

on-line briefing on NRC study of Internet on 9/11 of last year
by Craig Partridge 21 Nov '02

21 Nov '02

Dave Clark, Sean Donelan and I will be briefing the National Research Council report on how the Internet handled the events of 9/11/2001 on Thursday morning. The report is available on-line this evening and the briefing will be webcast. For more details see www.nas.edu Thanks! Craig

1 0

[OT] Anyone have clueful AOL postmaster contacts?
by Ben Browning 20 Nov '02

20 Nov '02

I have been wrestling with their Postmaster contact staff (via phone, and the email black holes at postmaster(a)aol.com and abuse(a)aol.com) for over a week now. I need some sort of resolution, or anything other than "Your case is open. Someone somewhere will do something. Someday". If anyone has any contacts inside AOL, I would greatly appreciate an off-list email. ~Ben --- Ben Browning <benb(a)theriver.com> The River Internet Access Co. Network Operations 1-877-88-RIVER http://www.theriver.com

1 0

Re: Cyberattack FUD
by sgorman1＠gmu.edu 20 Nov '02

20 Nov '02

Well said - the radical elements get a lot more bang for their buck with well placed media stories, than they would ever likely get from a cyber attack on the Internet. The one point to consider is that there are critical networks for the economy that run on shared infrastructure also used by the Internet. Hence studying the susceptibility of the Internet can be more than an exercise is guarateeing porn availability. Proprietary issues aside there is a lot to be learned and for fairly good reasons. Micro-biologists study the neural network of the c.elgans worm not because they give a crap about worm brains but because it gives insight to a bigger picture. Not the best analogy but ya get the drift. ----- Original Message ----- From: William Waites <ww(a)styx.org> Date: Wednesday, November 20, 2002 8:35 pm Subject: Re: Cyberattack FUD > > >>> "Kurt" == Kurt Erik Lindqvist <kurtis(a)kurtis.pp.se> writes: > > Kurt> I am not sure what you mean with 25% of the Internet? What > Kurt> connectivity would degrade? From where to where? > > If you randomly select nodes to remove, by the time you have removed > 25% of them, the network breaks up into many isolated islands. As Sean > pointed out, the CAIDA study considered a sample of the 50k most > connected nodes. So a successful attack aimed at 12500 big routers > simultaneously would break the Internet into little pieces. > > If more strategy is used in the selection process, you get localized > outages -- i.e. disabling everything in 60 Hudson or 151 > Front is > likely to cause significant problems in New York or Toronto but you'll > probably be able to see the rest of the world just fine from > Sweden. > > A distributed physical attack against a large number of Telco Hotels > and trans-oceanic fibre landing points would be somewhat > worse. It > would also be very difficult to do from a laptop. > > With the exception of E911 service (which normally doesn't > use IP > anyways), any such disruption is unlikely to really hurt anyone. Such > hand-wringing whenever someone threatens to break the Internet > is > maybe a sign of an unhealthy dependence on a medium that is younger > than most of the people on this list? > > Taking the fear mongering and sabre rattling too seriously is much > more dangerous than any possible network outage. > > -w > >

1 0

Experts: Don't dismiss cyberattack warning
by Rajendra G. Kulkarni 20 Nov '02

20 Nov '02

http://computerworld.com/securitytopics/security/story/0,10801,76000,00.html

5 5

MIA: oregon-ix.net
by Kai Schlichting 20 Nov '02

20 Nov '02

As some of you have noticed, the BGP4 route containing the address for route-views.oregon-ix.net has disappeared a while ago (mid-October?). Their website seems to be gone, and I swear, I couldn't resolve the domain for a little while just now. Has the Oregon IX been shut down? Their route-server was probably the best-connected one, with the most views, of any public route server I am aware of (please prove me wrong, but do not torment me with any web-based looking glasses :) . Nothing like having to poke around 10 other RS's to establish that rogue AS 26212 really only has 1, 6402 and 2914 as their upstreams.

8 11