- NANOG - lists.nanog.org

slapper changed to udp 1812?
by fingers 01 Oct '02

01 Oct '02

hi I might be totally off the mark here, but has slapper now changed to port 1812? This'll make it really difficult to filter, if you're using this port for RADIUS. I'm seing huge volumes of traffic, to what seem to be slapper infected hosts. I see 2 infected hosts, with 2343 and 2384 unique source addresses speaking to each of them respectively. I'm unable to do actual dumps of the data at this stage, so if anyone could either confirm, or tell me I'm off my rocker, would appreciate it. I've checked a few source and destination ip's, and they all seem to be *nix, with outdated ssl, for example: Date: Tue, 01 Oct 2002 21:46:02 GMT Server: Apache/1.3.23 (Unix) (Red-Hat/Linux) mod_ssl/2.8.7 OpenSSL/0.9.6b DAV/1.0.3 PHP/4.1.2 mod_perl/1.26 netflow shows: FLOW index: 0xc7ffff router: src IP: 211.157.101.158 Dst IP: input ifIndex: 18 output ifIndex: 24 src port: 1812 dst port: 1812 pkts: 1 bytes: 88 IP nexthop: 196.31.39.10 start time: Tue Oct 1 18:38:12 2002 end time: Tue Oct 1 18:38:12 2002 protocol: 17 tos: 32 src AS: 701 dst AS: src masklen: 19 dst masklen: 24 TCP flags: 0x10 engine type: 0 engine id: 0 Regards --Rob

2 1

Re: SPEWS removal (SPEWS: S1970, 65.107.235.160/27)
by Michael L. Barrow 01 Oct '02

01 Oct '02

Ok -- I'm a dumbass. Sorry about this posting. Next time I'll drink my coffee before trying to read web pages. *sigh* -- Michael L. Barrow E: michael(a)mlbarrow.com P: 805-566-0885

1 0

SPEWS removal (SPEWS: S1970, 65.107.235.160/27)
by Michael L. Barrow 01 Oct '02

01 Oct '02

I believe that SPEWS has made an error by listing these 3 /24s (65.107.234.0 - 65.107.236.255, Chase Financial Funding (XO)) in its database as I my organization (using 65.107.235.160/27) has nothing to do with Chase Financial Funding. The fact that we're both connected to XO and are both in Laguna Hills, CA is merely a coincidence. It would be greatly appreciated if someone could correct this error. (Other NANOG readers, I apologize for this posting...) -- Michael L. Barrow E: michael(a)mlbarrow.com P: 805-566-0885

1 0

RE: Economic Justification / Rationale for MPLS
by Matt Ryan 01 Oct '02

01 Oct '02

Whatever the relative technical merits of MPLS/BGP VPNs over other layer 3 VPNs (GRE, IPsec, L2TP etc) there are many service providers around the world selling these services. There is clearly a business need for them, and obviously customers how will buy them (well, we have managed to sell them anyway!), so there is an economic reason to deploy MPLS. Layer 2 based LAN extension services will only extend this market further and again uses MPLS as its base transport mechanism. Matt. -----Original Message----- From: Shannon Lake [mailto:shannon@omnivergent.com] Sent: 01 October 2002 08:26 To: nanog(a)merit.edu Subject: Economic Justification / Rationale for MPLS Ladies and Gentlemen: I have been conducting research looking for the economic justification for MPLS. I have some feedback, but sound rationale from the industry has eluded me thus far. I am looking for a paper, website, etc that explains the benefits of implementing MPLS (other than technical) or gives some economic modeling for MPLS-based networks. Any help, reasoning, rationale or personal insights/views would be greatly appreciated. Thanks in advance, Shannon M. Lake Sr. ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

1 0

Economic Justification / Rationale for MPLS
by Shannon Lake 01 Oct '02

01 Oct '02

Ladies and Gentlemen: I have been conducting research looking for the economic justification for MPLS. I have some feedback, but sound rationale from the industry has eluded me thus far. I am looking for a paper, website, etc that explains the benefits of implementing MPLS (other than technical) or gives some economic modeling for MPLS-based networks. Any help, reasoning, rationale or personal insights/views would be greatly appreciated. Thanks in advance, Shannon M. Lake Sr.

1 0

traces from mae-east and mae-west via nitrous
by Marc Van Hoof 01 Oct '02

01 Oct '02

hey all, just wondering if anyone is seeing strange results coming from traces performed from the coastal mae's via nitrous.digex.net ? tracing to 203.89.226.2 via mae-east i get: 1 atm-east.primustel.com (198.32.187.120) 4 msec 0 msec 0 msec 2 G1-0-10.cr1a.dca.primustel.com (209.227.134.2) [AS 11867] 0 msec 0 msec 4 msec 3 ATM6-0-101.cr1.phi.primustel.com (209.227.128.13) [AS 11867] 4 msec 4 msec 8 msec 4 ATM6-0-103.cr1.jfk.primustel.com (209.227.128.5) [AS 11867] 4 msec 8 msec 8 msec 5 ATM6-0-110.cr1.sjc.primustel.com (209.227.128.78) [AS 11867] 76 msec 76 msec 76 msec 6 209.227.129.242 [AS 11867] 252 msec 256 msec 252 msec 7 vl046.sw02.mel.iprimus.net.au (203.134.50.21) [AS 9443] 252 msec 256 msec 252 msec 8 203.134.50.14 [AS 9443] 256 msec 264 msec 268 msec 9 203-134-48-154.cust.mel.iprimus.net.au (203.134.48.154) [AS 9443] 260 msec 268 msec 280 msec 10 * * * 11 * * * 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * yet tracing to 203.89.226.2 via mae-central i get: 1 dfw10-core1-so-6-0-0.atlas.algx.net (165.117.69.81) 0 msec 0 msec 0 msec 2 ord10-core2-so-0-3-0-0.atlas.algx.net (165.117.200.50) 24 msec 28 msec 24 msec 3 ord10-core10-pos7-0.atlas.algx.net (165.117.192.122) [MPLS: Label 14458 Exp 0] 72 msec 28 msec 24 msec 4 ord2-core3-pos5-0.atlas.algx.net (165.117.56.105) [MPLS: Label 13186 Exp 0] 28 msec 24 msec 28 msec 5 ord2-core4-pos7-0.atlas.algx.net (165.117.48.98) 28 msec 24 msec 28 msec 6 206.220.243.180 56 msec 52 msec 44 msec 7 G1-0-10.cr1a.ord.primustel.com (209.227.140.2) [AS 11867] 60 msec 52 msec 60 msec 8 ATM6-0-101.cr1.ord.primustel.com (209.227.128.61) [AS 11867] 92 msec 96 msec 100 msec 9 209.227.129.242 [AS 11867] 276 msec 280 msec 296 msec 10 vl046.sw02.mel.iprimus.net.au (203.134.50.21) [AS 9443] 268 msec 268 msec 268 msec 11 203.134.50.14 [AS 9443] 296 msec 300 msec 320 msec 12 203-134-48-154.cust.mel.iprimus.net.au (203.134.48.154) [AS 9443] 284 msec 316 msec 284 msec 13 dcr02-g6-0.mlbn01.globalcenter.net.au (64.15.32.20) [AS 9328] 252 msec 260 msec 256 msec 14 64.15.32.51 [AS 9328] 292 msec * 260 msec Hop 9 from mae-east and 12 from mae-central are the same host... anyone seeing similar abnormalities ? thanks heaps, -marc. --- Marc Van Hoof Network Architect Ph: +61-3-9862-7888

1 0

Re: AP IX locations
by Celeste Anderson 30 Sep '02

30 Sep '02

Paul, et al. As I have responded privately to to others offlist, while MAE-LA has withered, the other half of the exchange in LA (LAAP - www.laap.net) run by the University of Southern California is still active. The Telehouse LA facility is interconnected to the LAAP exchange and there are other things in the offing that I am not at liberty to disclose today, but will be rolled out in the very near future (press releases being prepared as I write). So yes, there are viable options in the Los Angeles area for AP carriers to exchange traffic with other entities here and vice versa. Celeste Anderson LAAP Operations Manager (among other things) USC/ISI celeste(a)isi.edu ------- Forwarded Message Date: 29 Sep 2002 06:08:40 -0000 From: Paul Vixie <vixie(a)vix.com> To: nanog(a)merit.edu Subject: Re: AP IX locations > >I would confirm GM's assertion. Also, if you have the luxury of caring > >more about a smaller set of large-capacity Tier1 private peers, there is > >some presence of AsiaPac providers doing this at Equinix SJ. > > Actually Equinix-Los Angeles has more Asian based Networks coming in for > turn-up in October than any other region from details gathered this > week. Chunghwa is in as of this week. SingTel, Japan Telecom, Hanaro, are > on track for peer-ready in October. DACOM is considering, etc. so what does that make telehouse-la after all these years... chopped liver? there have been Plenty of asian isp's in los angeles for Quite a while now. there also seems to be a PAIX switch inside 1 Wilshire now. (mfn's chap.11 filing having sawn off any hope we had of opening PAIX-LA.) - -- Paul Vixie ------- End of Forwarded Message

4 3

Trying to understand network operator management requirements
by Eliot Lear 30 Sep '02

30 Sep '02

Hi, I've put a stake in the ground regarding network management. Below is a URL that discusses the problem. I'm wondering if you would like to send me comments (off list) on what I've gotten right and what I've gotten wrong. This draft compliment's Bill Woodcock's draft, in as much as I'm really summarizing where he is specifying, and I'm also looking in other areas. I welcome your comments on any point you believe to be correct, incorrect, or just poorly written ;-) ftp://ftp.ietf.org/internet-drafts/draft-lear-config-issues-00.txt Thanks in advance, Eliot

1 0

Index of presentations
by Susan Harris 30 Sep '02

30 Sep '02

You'll find new subject & author indices for NANOG presentations here: http://www.nanog.org/subjects.html http://www.nanog.org/authors.html Most talks have an abstract, slides, and RealAudio recording. Only the last six meetings are done, but more will be coming soon. Comments welcome, e.g., do the categories make sense? Please send suggestions to me or nanog-support(a)nanog.org, not to the list. PS - our FAQ has been growing too: http://www.nanog.org/listfaq.html Many thanks to contributors Etaoin Shrdlu, Rachel K. Warren, JC Dill, Joe Abley, Richard Steenbergen, Marty Hannigan, Gwendolynn Ferch Elydyr, John Payne, Ginna Musgrove, and Doug Clements.

1 0

Re: Internet Core Routing - Ethernet
by Bob Martinez 30 Sep '02

30 Sep '02

Alex: >Wrong. None of the vendors wants to help you what so ever. What they want >to >do is to have you spend your money with them by claiming that they want to >help you. Cool, I respect that attitude. At least now I know how to deal with you. The glass is half empty. > > Wouldn't you rather have a reliable, redundant L2 core with isolated > > failures and fast recovery? > >No. I hate complicated words and complicated concepts. It reminds me NASA >spending 10M to invent a pen that writes in 0 gravity instead of using a >pencil. You are the guy that posted about IBGP Nailed Routes. I love that idea. I understand your love of L3 and your design is great; however, as a service provider, you can't always rely on IP. What about Global Ethernet? The NY, Paris, Tokyo, Seoul, Singapore, Frankfurt, Moscow, Bankok, Sydney, Hong Kong, London, Cairo, Los Angeles, Jerusalem, Toronto, Mexico City, Rio (Can I manage this one?) Internet Exchange? MPLS VPLS over Ethernet Anybody? Use your nailed routes trick in the middle (MPLS side) and L2 peering exchanges in each city. Only problem with this is complexity. Do this alone or with few partners and you may be able to pull it off completely L2 without the cost of complexity. Simple like you said. Gotta work on the reliability part though. Test. I'd like to test in Paris, London, Jerusalem, and Toronto. I haven't been to those places yet and I got this cool digital camera. Please don't shoot when you see a Mexican (American) who can't speak Spanish. > > Ethernet is my digital wrapper of choice because of vendor chipsets > > supporting it and quality product. > >Yeah, ethernet over what, carrier pigeons? That will work, but I don't think carrier pigeons are Internet Core unless there has been major pigeon development I'm unaware of. Good question.. 1G (.z and .ad aggregates), 2.5G (POS), 10G (.az), 20G (.ad), 40G (.ad), beyond are more of the realm we are in nowadays huh? I suppose you can use WDM equipment and get an 802.3ad 100G trunk someday, but then again the assumption is that single flows would not be more than 10G :-) Bobby _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com

3 2