- NANOG - lists.nanog.org

RE: Bonding ATM circuits for DSL
by Martin, Christian 01 Aug '02

01 Aug '02

The question is whether IMA exists on DS3 interfaces. I would suspect that the cell rate may be kind of high to support even load-balancing/splitting. Kinda like doing MLPPP on a pair of OC-12s. However, this is generally not needed unless your VC(P) needs to run at greater than the theoretical peak cell rate of the interface. If you have small DSL PVCs, you can just round-robin them via static PVC provisioning, or PNNI load-sharing of soft vcs. HTH -chris >-----Original Message----- >From: Christopher J. Wolff [mailto:chris@bblabs.com] >Sent: Thursday, August 01, 2002 4:51 PM >To: nanog(a)merit.edu >Subject: RE: Bonding ATM circuits for DSL > > > >I may have answered my own question. Create an IMA group interface. > >Regards, >Christopher J. Wolff, CIO >Broadband Laboratories, Inc. >http://www.bblabs.com > >-----Original Message----- >From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On >Behalf Of Christopher J. Wolff >Sent: Thursday, August 01, 2002 1:46 PM >To: nanog(a)merit.edu >Subject: Bonding ATM circuits for DSL > > > >Greetings. > >Has anyone experienced adding additional ATM DS3's and bonding >those together to form a single "fat pipe". For example if >you had a Qwest megacentral DSL DS3 loop and wanted to add >another one to make 90 megs instead of 45 megs is that done on >the ISP side or the Telco side or both? Thank you all so much >for your wisdom. > >Regards, >Christopher J. Wolff, CIO >Broadband Laboratories, Inc. >http://www.bblabs.com >

1 0

Bonding ATM circuits for DSL
by Christopher J. Wolff 01 Aug '02

01 Aug '02

Greetings. Has anyone experienced adding additional ATM DS3's and bonding those together to form a single "fat pipe". For example if you had a Qwest megacentral DSL DS3 loop and wanted to add another one to make 90 megs instead of 45 megs is that done on the ISP side or the Telco side or both? Thank you all so much for your wisdom. Regards, Christopher J. Wolff, CIO Broadband Laboratories, Inc. http://www.bblabs.com

1 1

Re: Is the PAIX Palo Alto taking a dump?
by Herb Leong 01 Aug '02

01 Aug '02

Ryuichi TAKASHIMA wrote: > In article <20020801.094033.65032074.takasima(a)ttnet.ad.jp> > Ryuichi TAKASHIMA <takasima(a)pwd.ad.jp> wrote: > > In article <20020801002457.31718.qmail(a)tomobiki.urusei.net> > > "Herb Leong" <herb(a)tomobiki.urusei.net> wrote: > > > > > All my sessions at the PAIX are active--anybody else seeing this? > > > > > > /herb > > > > Hi, > > All our sessions are "Active" too, from 00:20 GMT. > > > > Are there any scheduled maintenance or else? > > At 00:40 GMT, our sessions turned up. hmm.... I guess they plugged the switch back in... =) /herb

2 1

Identifying DoS sources quickly (was: Bogon list or Dshield.org type list)
by michael.dillon＠radianz.com 01 Aug '02

01 Aug '02

>As far as tracking DoS, I've read some good papers on the subject and it >always boils down to tracking MAC addresses and going interface by >interface to the source, demanding inter-ISP cooperation, and finally >legal assistance. This has been tried during a few severe instances with >poor results. That's the obvious solution to the problem if the problem is how to track down the source(s) of a DoS attack. However, in any DoS attack, there is always a victim and one or more devices sending attack traffic to the victim. The owners of the attacking devices are accessories to the crime although I'm sure they could plead ignorance and avoid any liability. But what if they could not plead ignorance? What if we could identify some of the attacking devices, and what if the victim sent a legal "cease and desist" letter to the owners of the attacking devices? Now, the victim is in a position to sue the owners of these attacking devices if they don't fix the problem by securing their machines. And once this happens and gets some press coverage, a whole bunch of other machine owners will wake up and realize that they could be stuck with big legal bills if they don't secure their machines. So, to restate the problem, how do we identify some of the sources of a DoS attack quickly, maybe even while the attack is still in progress? >Bots/Zombies are traded openly on IRC and there is no >accountability for personal security. ISPs won't shut someone down >because they've been "hacked", merely send them a warning Email or >call--a process that takes days in my experience. How many ISPs would identify the user of an IP address for the purposes of sending a "cease and desist" letter when contacted by a lawyer? Considering that failure to provide the identity would result in the ISP themselves getting sued by the DoS victim? As long as *SOME* ISPs would cooperate with a DoS victim, there is enough to get the legal ball rolling. The alternative is to painfully backtrack until you find an uncooperative ISP and then sure them. As I said before, if there was a central registry something like dshield.org that collected data on the destination IP addresses of DoS attacks along with estimated magnitude based on analysing the traffic from random source addresses blocked by ingress filters, then we have something an ISP can use to analyze their outgoing traffic. If you are an ISP and you have netflow data that contains destination addresses which also occur in the DoS victim registry then you should be willing to act on that data. Of course, it's up to you what you do with it. You may offer the DoS victim the identity of the source provided that they serve you with the right legal documents. Or you might go to the owner of the machine yourself with the evidence and warn them that they are aiding and abetting cyber terrorists and could suffer the legal consequences if they don't secure their machines. It's certainly not perfect but it's worth a try. --Michael Dillon

8 10

Re: OpenSSH Trojan=tisk tisk
by Gerardo A. Gregory 01 Aug '02

01 Aug '02

The lack of humor of some NANOG list members is also admirable..... ----- Original Message ----- From: "Steve Mickeler" <steve(a)neptune.ca> To: "Gerardo A. Gregory" <ggregory(a)affinitas.net> Cc: "jnull" <jnull(a)truerouting.com>; "'Len Rose'" <len(a)netsys.com>; <nanog(a)nanog.org> Sent: Thursday, August 01, 2002 10:40 AM Subject: Re: OpenSSH Trojan=tisk tisk > > The lack of clue demonstrated by some nanog list members never ceases to > amaze me. > > I'm guessing those bashing SunOS on the server wouldnt be able to hax0r it > if their life depended on it. > > Whats the point in starting an OS war ? > > <sigh> > > On Thu, 1 Aug 2002, Gerardo A. Gregory wrote: > > > > > Might as well have a windows 2000 server doing it!!!!!!!!! > > > > Gerardo A. Gregory > > Manager Network Administration and Security > > 402-970-1463 (Direct) > > 402-850-4008 (Cell) > > Affinitas - Latin for "Relationship" > > Helping Businesses Acquire, Retain, and Cultivate Customers > > Visit us at http://www.affinitas.net > > ------------------------------------------------------------------ > > 1015 N. 98th Suite 100 > > Omaha, NE 68114 > > ------------------------------------------------------------------ > > > > > > ----- Original Message ----- > > From: "jnull" <jnull(a)truerouting.com> > > To: "'Len Rose'" <len(a)netsys.com>; <nanog(a)nanog.org> > > Sent: Thursday, August 01, 2002 10:24 AM > > Subject: RE: OpenSSH Trojan=tisk tisk > > > > > > > > > > > > > A chain is only as strong as its weakest link: > > > Connected to openbsd.sunsite.ualberta.ca. > > > 220- > > > 220- Welcome to SunSITE Alberta > > > 220- > > > 220- at the University of Alberta, in Edmonton, Alberta, Canada > > > 220- > > > 220- All connections to and transfers from this server are logged. If > > > 220- you do not like this policy, please disconnect now. > > > 220- > > > 220- You may want to grab the index file called "ls-lR.gz" in /pub. It > > > is > > > 220- updated nightly with the contents of the ftp tree. > > > 220- > > > 220- If you have any questions, hints, or requests, please email > > > 220- > > > 220- sunsite(a)sunsite.ualberta.ca > > > 220- > > > 220 merlin FTP server (SunOS 4.1) ready. > > > > > > A Sun server as a host for a OpenBSD source is like writing combinations > > > to a bank vault on the back of your hand. > > > > > > jnull > > > PGP: 0x54B1A25C > > > "!!!!!" It's the little things .... > > > > > > > > > -----Original Message----- > > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > > > Len Rose > > > Sent: Thursday, August 01, 2002 3:14 AM > > > To: nanog(a)nanog.org > > > Subject: OpenSSH Trojan.. > > > > > > > > > > > > > > > According to what was posted here, you may wish to start scrubbing. > > > > > > http://docs.freebsd.org/cgi/getmsg.cgi?fetch=394609+0+current/freebsd-se > > > curity > > > > > > > > > --- > > > Incoming mail is certified Virus Free. > > > Checked by AVG anti-virus system (http://www.grisoft.com) > > > Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 > > > > > > > > > --- > > > Outgoing mail is certified Virus Free. > > > Checked by AVG anti-virus system (http://www.grisoft.com) > > > Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 > > > > > > > > > > > > [-] Steve Mickeler [ steve(a)neptune.ca ] > > [|] Todays root password is brought to you by /dev/random > > [+] 1024D/ACB58D4F = 0227 164B D680 9E13 9168 AE28 843F 57D7 ACB5 8D4F >

2 1

FCC on UUNET ..
by Robert Mathews 01 Aug '02

01 Aug '02

"FCC Chief Cites Internet Weak Spot" Wall Street Journal (07/31/02) P. A2; Dreazen, Yochi J. Federal Communications Commission (FCC) Chairman Michael Powell told the Senate Commerce Committee yesterday that he might not be able to stop WorldCom from shutting down its Internet backbone service, UUNet. Although Powell was confident of his ability to prevent phone services from being abruptly dropped, he said telecommunications and bankruptcy laws were at odds, and made his authority over Internet services unclear. Powell also said the current consolidation going on in the telecommunications market was unavoidable and might necessitate a previously untenable merger, such as one between long distance carrier WorldCom and one of the Baby Bell companies. Committee Chairman Sen. Ernest Hollings (D-S.C.) said he was set to introduce new legislation that would give the FCC more control in cases of bankruptcy. Hollings, however, said he would block one bill coming in from the House of Representatives that would give the FCC more powers because it would also make the Baby Bell local monopolies more dominant in the broadband arena. Powell noted that backbone companies may be legally able to ignore FCC directives and start cutting service to customers before they have a chance to switch providers. http://www.msnbc.com/news/788023.asp

1 0

MAE ATM
by nanog＠missnglnk.com 01 Aug '02

01 Aug '02

Out of curiousity, when were MAE East/West ATM established? -- Omachonu Ogali missnglnk(a)informationwave.net http://www.informationwave.net

11 11

Re: Re: MAE ATM
by Frank Coluccio 01 Aug '02

01 Aug '02

"Anyone remember the Magnum's ...?" Yep. How about the FiberCom FDDI box, the one that went manufacturer discontinued on the day that we commissioned CCNY's 12 building campus network in Harlem, New York? > > Anyone remember the Magnum's or MetroLans? > > :-) > > Jon Hardy wherrrrre arrrree youuu! > > > ----- Original Message ----- > From: "David Diaz" <davediaz(a)smoton.net> > To: "Mark Kent" <mark(a)noc.mainstreet.net>; <scott(a)graphidelix.net> > Cc: <nanog(a)merit.edu> > Sent: Wednesday, July 31, 2002 9:24 PM > Subject: Re: MAE ATM > > > > > > I almost forgot about those netedge boxes, seems the one we had in DC > > was about as reliable as a microwave with tin foil in it. I cant > > remember how many times it or a card had been replaced. > > > > Is anyone out there still using them? I do have fond memories of > > fddi, about the only truly stable card on a grf if there was such a > > thing. > > > > Dave > > > > At 22:04 -0700 7/30/02, Mark Kent wrote: > > >>> How did people interconnect before may 1998, fddi? > > > > > >fddi, some remote with netedge boxes at either end of an atm link. > > >There were some 10baseT connections too, there was at least one > > >low end Catalyst switch dedicated to plain ethernet. > > > > > >Here is a big hint: > > > > > >http://www.nanog.org/2.95.NANOG.notes/mae-west.html > > > > > >-mark > > > > > >

1 0

Re: redundancy [was: something about arrogance]
by Pedro R Marques 31 Jul '02

31 Jul '02

Pedro Roque Marques wrote: >------- Start of forwarded message ------- >From: pre(a)PRE.ORG (Patrick Evans) >To: Jim Shankland <nanog(a)shankland.org> >Cc: nanog(a)merit.edu >Newsgroups: jnx.ext.nanog >Subject: Re: redundancy [was: something about arrogance] >Message-ID: <Pine.LNX.4.44.0207310130150.3798-100000(a)pimlico.PRE.ORG> >Date: 31 Jul 02 00:32:49 GMT >References: <200207310019.RAA05167(a)ndk.shankland.org> >Organization: Juniper Networks, San Francisco, California > > >On Tue, 30 Jul 2002, Jim Shankland wrote: > > > >>Patrick Evans <pre(a)PRE.ORG> writes: >> >> >> >>>My first project, if network availability were a key issue, within any >>>organisation would be to a) obtain [an AS number] and b) make use of >>>it. >>> >>> >>Heh. How many bits in an AS number, again? >> >> >> >*grin* > >That's a problem with the underlying protocol. I get paid to run >operational networks, not bleat endlessly about "how much work would >it *really* take to implement 24bit AS numbers?" :) > > The plan is 32 bits... (see draft-ietf-idr-as4bytes-05.txt for details). Essentially i think it just takes interest/demand from ISPs since the mechanism can be implemented and deployed without in a non disrruptive way. >Crying about protocol deficiencies is a distant second to keeping a >business up and running these days. > > imho, protocol efficiencies are not so much the problem. If it is clear the scale routing must operate on the right hardware/software can be engineered... that assuming that people are willing to upgrade their existing boxes and that it isn't a requirement that it must run on 5 year old small entreprise boxes. The later seems to be the biggest problem although. Effectivly the growth of routing table size is bound by the maximum memory size and CPU capacity present in the most common boxes used in the network and not by protocol efficiency. It is not so much of a question if one can build a database engine and respective distribution protocol than can scale upto n million paths but of the limits of the current day moral equivalent of the AGS+. Thus all the people that have these deployed in their networks tend to be concerned about the need to upgrade them as the size of the routing table increase. As one of the posters was king enought to point out these sometimes end up being more issues of economics/buisiness than of engineering. regards, Pedro.

1 0

Re: redundancy [was: something about arrogance]
by Patrick Evans 31 Jul '02

31 Jul '02

On Tue, 30 Jul 2002, David Schwartz wrote: > One more just for kicks. Client had a 100Mbps circuit from their sole > provider (100Mbps to colocated router, DS3 from this router to their > premises). The circuit had been in place for several years and the contract > had long since expired. One day, they got a call Er, what does due diligence mean to you? (We're waaaay into no-shit-sherlock territory here) (For the record, I'd consider any operation without an AS number a startup, and my first project, if network availability were a key issue, within any organisation would be to a) obtain one and b) make use of it. YMMV, but some V are more equal then others. Particularly in the current economic climate.) -- Patrick Evans, allegedly Email: pre(a)pre.org CV: www.pre.org/pre/cv Wheels: Kawasaki ZXR400L9

2 2