- NANOG - lists.nanog.org

Looking for historical data
by Alif The Terrible 29 Jul '02

29 Jul '02

Does anyone know of any repository of snapshots of the global routing tables? I am specifically interested in tracking back to the first announcements of individual prefixes. Please respond off-list. Thanks. -- Yours, J.A. Terranson sysadmin(a)mfn.org

2 1

RE: OC-768 availability?
by Williams, Ken 29 Jul '02

29 Jul '02

hah 2621 rockin oc-192 are you for real? -----Original Message----- From: dalph(a)hushmail.com [mailto:dalph@hushmail.com] Sent: Monday, July 29, 2002 4:10 PM To: nanog(a)nanog.org Subject: OC-768 availability? Hello, I am currently running a network of cisco 2621s with the OC-192 NM for my upstream connections. The internal network links are a mixture of K56Flex modems and GRE tunnels. I am looking to upgrade to OC-768 real soon now and am wondering what the prospects are for OC-768 availability on the 2621 platform. I've found the 2621 to be rock-solid, except when I ping it, so I'd like to keep my network on that platform if possible. In addition, if anyone knows the availability of OC-768 circuits between the following cities I'd appreciate any fiber maps and an approximate price range: Ottawa, ON, CA Midland, ON, CA Goderich, ON, CA Toronto, ON, CA Compton, CA, US Sealand At each site I plan to announce a /24 from a /20 I was allocated so if everyone could please update their prefix filters now that would be great. Thank you. -- Dalph Roncaster Communicate in total privacy. Get your free encrypted email at https://www.hushmail.com/?l=2 Looking for a good deal on a domain name? http://www.hush.com/partners/offers.cgi?id=domainpeople

2 1

anyone have a genealogy of providers?
by k claffy 29 Jul '02

29 Jul '02

does anyone know of a concise genealogy of providers since 1990 (e.g., GTE + BBN begat GTE Internetworking; GTEI absorbed Genuity; GTE + BBN + Genuity + ... => Verizon; by ASes even better but we can do the mappings if needed) we're trying to integrate a little more semantic sanity to presentations of macroscopic infrastructure growth over time (notwithstanding the fact that semantic sanity in this space is a losing battle) and it would sure help to have the metabolic process codified in a single source. pointers muchly appreciated, k

1 0

RE: Bogon list or Dshield.org type list
by michael.dillon＠radianz.com 29 Jul '02

29 Jul '02

Having recently read David Moore's paper on backscatter analysis, http://www.caida.org/outreach/papers/2001/BackScatter/ this data is interesting because most of these filters seem to be blocking an amount of traffic proportional to their size. >Extended IP access list 120 (Compiled) > permit tcp any any established (243252113 matches) > deny ip 0.0.0.0 1.255.255.255 any (825328 matches) ^^^ ^^^^^^ The netmask is twice as large and it blocks twice the traffic as the following three blocks. > deny ip 2.0.0.0 0.255.255.255 any (413487 matches) > deny ip 5.0.0.0 0.255.255.255 any (410496 matches) > deny ip 7.0.0.0 0.255.255.255 any (413621 matches) > deny ip 10.0.0.0 0.255.255.255 any (1524547 matches) RFC 1918 space is different from the rest. <some deleted to save space> > deny ip 72.0.0.0 7.255.255.255 any (3300703 matches) ^^^ ^^^^^^^ Eight times as big blocks eight times as much traffic <some deleted to save space> > deny ip 224.0.0.0 31.255.255.255 any (13165320 matches) And the relationship holds even up here in the multicast range. However, since you are seeing this on your ingress filters, this can't be backscatter. It must be incoming attack traffic and since the traffic is evenly distributed over the entire IPv4 address space, you can calculate how much attack traffic is still getting through by adding up the amount of IPv4 address space that you aren't filtering. If you would look at the destination IP addresses from some of the netblocks in the above list, then you could identify which of your machines (or your customer machines) are being attacked. This now provides enough information to identify attack traffic close to its source. If you would publish the destination addresses and time periods of the attacks then other people could look in their netflow data for traffic from bogon addresses to your destination. A central repository like dshield.org for this data would be interesting. Other than for idle curiosity, I think this is interesting because there is the real possibility of being able to identify an attacker and victim soon enough after an attack begins that the victim could issue legal warnings to the attacker and possibly follow up in the courts. I would think that after a few well-publicised cases, the owners of compromised machines used to initiate DDOS attacks will begin to secure their machines the way they should have in the first place. -- Michael Dillon

4 3

Any people still with old filters?
by Roy 29 Jul '02

29 Jul '02

In a recent discussion with a company that owns a /16 and has it broken down further, the statement was made that there are ISPs that filter routes at /16 in what was traditional class B space. The example cited was Verio. Verio web pages state they don't do this any more (the filter is /21). Is there anyone that still filters routes longer than /8 and /16 in the traditional Class A and B space?

5 5

Bogon list or Dshield.org type list
by alsato 29 Jul '02

29 Jul '02

Im wondering how many of you use Bogon Lists and http://www.dshield.org/top10.html type lists on your routers? Im curious to know if you are an ISP with customers or backbone provider or someone else? I have a feeling not many people use these on routers? Im wondering why or why not? Ive never used them on my routers although I work for a new isp/cable provider. Im thinking it would make my users happy to use them though. alsato

7 9

AS286 effectively no more..
by Huopio Kauto 29 Jul '02

29 Jul '02

Interesting how quietly one of the powerhouses in Europe has been shut down yesterday evening. Any notes on increased latency / routing issues wrt AS286 shutdown? --kauto Kauto Huopio - kauto.huopio(a)ficora.fi Information Security Adviser Finnish Communications Regulatory Authority / CERT-FI tel. +358-9-6966772, fax. +358-9-6966515 CERT-FI duty desk +358-9-6966510 - http://www.cert.fi

10 13

NIST & Wireless ...
by W.D.McKinney 28 Jul '02

28 Jul '02

NASA has had this out for over a year. http://www.nas.nasa.gov/Groups/Networks/Projects/Wireless/index.html /Dee -- W.D.McKinney (Dee) http://3519098920

2 1

verio arrogance
by Ralph Doncaster 28 Jul '02

28 Jul '02

http://info.us.bb.verio.net/routing.html#PeerFilter It seems if I were one of their customers they would accept my 66.11.168/23 announcement and re-announce it to their peers, but they won't accept it from any of their peers. Announcing a covering /20 along with the regional more specifics I have will only serve to increase the size of the routing table for most backbones, and lead to sub optimal routing in some cases since I'm announcing the more specifics due to geographical diversity. Ralph Doncaster principal, IStop.com

19 43

Understanding BGP misconfiguration
by Sean Donelan 28 Jul '02

28 Jul '02

A nice academic paper looking at the causes of BGP errors. They found configuration errors are pervasive, with 200-1200 prefixes experienceing problems due to misconfigurations every day. But they also found the Net is relatively robust, with only one in twenty-five misconfigurations affect connectivity. http://www.acm.org/sigcomm/sigcomm2002/papers/bgpmisconfig.html

2 1