- NANOG - lists.nanog.org

IGP metrics on WAN links
by Tom Holbrook 19 Jul '02

19 Jul '02

Just curious as to what people are using for metrics in their IGP and what their reasons are; bandwidth? geographical distance? latency? etc... Thanks -Tom __________________ Tom Holbrook Sr. Network Engineer Atlanta Earthlink

6 7

Re: IGP metrics on WAN links
by Warren Van Camp 19 Jul '02

19 Jul '02

At 12:27 PM 7/19/02 -0400, Tom Holbrook wrote: >Just curious as to what people are using for metrics in their IGP and what their reasons are; bandwidth? geographical distance? latency? etc... In the @Home backbone, we used actual fiber miles (plus a small offset per hop to break ties when a particular route had multiple paths with differing numbers of routers). This, of course, just created a "base" configuration which could be tweaked somewhat depending on what needed to happen to make the best use of circuits. Warren Van Camp (formerly @Home Network backbone engineering)

1 0

RE: /24s run amuck... again
by Alexander, Nathan M 19 Jul '02

19 Jul '02

That is of limited usefulness. 1) They'd all have to have the same next hop. 2) you would have to hear all three /24's of them from all your peers, all with the same next hop, metrics, med, etc. Otherwise the aggregate route becomes the backup route for other, more specific announcements of the /24 that you can't aggregate. It would be nice for the single homed, but then why are you running bgp? Nathan Alexander NMC Shift Manager 703/363-5293(office) 301/442-8695(cell) 877/541-2189(pager) Nathan.Alexander(a)qwest.com - Internal Use Only - Disclose and Distribute only to Qwest Employees and authorized persons working for Qwest. Disclosure outside of Qwest is prohibited without authorization. > -----Original Message----- > From: Ralph Doncaster [mailto:ralph@istop.com] > Sent: Friday, July 19, 2002 8:07 AM > To: Richard A Steenbergen > Cc: nanog(a)merit.edu > Subject: Re: /24s run amuck... again > > > > On Fri, 19 Jul 2002, Richard A Steenbergen wrote: > > > With all the recent talk about filtering, I figured now was > a good time > > to update my list of evil /24 announcers... There are > currently over 63k > > /24s out of 113k total unfiltered announcements (over 55%). > > Does anyone (Cisco, Juniper, etc.) have an auto-aggregation feature? > Let's say a router that receives the following prefixes under > a single AS > 206.51.128.0/24 > 206.51.129.0/24 > 206.51.131.0/24 > > And the following network is not in the table: > 206.51.130.0/24 > > Then it would be usefull to collapse it into a single 206.52.128/22 > aggregate (especially if the metrics & communities are the same). > > -Ralph > >

1 0

RE: verio arrogance
by David Diaz 19 Jul '02

19 Jul '02

Getting back to the more original thread. Is there any need to keep the routing table to a smaller size. Since in theory, it creates suboptimal routing. And considering the new routers out there today should be able to handle it. Considering verio is using junipers, and they pride themselves on handling a tremendously large table. Why should we shoot for a 100,000 route table instead of 500,000 if it does not impact performance? I do understand that the 100,000 might be that actual 'installed best routes' and that the routers might in fact be dealing with a much larger route table. That might be an issue. But certainly 100,000- 500,000 installed routes, is that a problem for large backbones with high end routers? My only consideration might be the small multihomed ISPs with 2-3 providers with full BGP feeds and cisco 4000s (256meg ram). I saw one last week. I might be concerned at that level. I'd love to hear feedback. It would then justify filtering...or not. David At 21:37 -0400 7/18/02, Phil Rosenthal wrote: >How is it arrogant? >I read that as: a customer set up an exploitable FormMail. Verio >received notice about it. Verio removed the FormMail in question. Verio >asked to be removed since they corrected the problem. Verio was ignored. > >Verio may have some problems with not terminating spammers, and I >believe this to be the truth -- I buy from verio, and Don't spam, and >whenever one of my clients spam, they get terminated for it. I receive >plenty of spam from verio ips, and no matter how much I complain, it >never gets terminated. This is probably a scenario of asking sales rep >"If I want to spam, but I pay more per meg -- Is this OK?" and getting >a positive answer. > >That is why the NANAE people don't like verio. But, nonetheless, I >don't think that putting verio's mailserver on a formmail list is >accomplishing anything good, since they fixed THAT problem... > >--Phil > >-----Original Message----- >From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of >Kai Schlichting >Sent: Thursday, July 18, 2002 6:37 PM >To: nanog(a)merit.edu >Cc: Kai Schlichting >Subject: Re: verio arrogance > > > >How's THIS for Verio arrogance, going to a whole new level: > >http://www.monkeys.com/anti-spam/filtering/verio-demand.ps > >Details were on the SPAM-L list Wed, 17 Jul 2002 15:51:05 EDT: Verio >threatens to sue Ron Guilmette over the IP 208.55.91.59 appearing on his >FormMail.pl open-proxy/formmail server DNSBL. > >And given the ever-increasing number of spammers now hopping onto Verio >tells me that Verio must be well down the spiral of death (spammers seem >to be attracted by NSP's going chapter 7/11, or who are getting close), >or else the dozen-or-so automated messages going to abuse(a)verio.net >every week complaining about connections (real or attempted) to hosts >under my control, and originating from their spamming customers would >have shown any results over time. > >I don't need connectivity to 208.55.0.0/16. I really don't, and I have >not the slightest tolerance for litigious, small-minded, >panic-lawyer-dialling scum like this. > >/etc/mail$ grep 208.55 access.local >208.55 550 Access for FormMail spam and litigious scum >denied - XXXX Verio in their XXXXXXXX XXX - we block more than just >208.55.91.59 - Spammers must die - see >http://www.monkeys.com/anti-spam/filtering/verio-demand.ps >/etc/mail$ > >PS: I also have zero tolerance for Nadine-type spam-generating, >"single-opt-in", > "87% permission-based" emailers nowadays: 2 bounces or a single mail >to a > never-existing account, and all your /24's are off into gated.conf as >a > next-hop route to 127.0.0.1. And no, they won't get around that by >advertising > /25's. > >Good-bye route-prefix-filtering wars, and welcome to the war on spam, >where Null0'd /28's for filtering 'undesirables' just doesn't cut it any >more. Casualties like 10-15 bystanding rackspace.com customers with a >"Nadine- type" mailer in neighboring IP space be damned: "move your >servers into a different slum, cause da landlord's running down 'da >neighborhood". > >-- >"Just say No" to Spam Kai >Schlichting >New York, Palo Alto, You name it Sophisticated Technical >Peon >Kai's SpamShield <tm> is FREE! >http://www.SpamShield.org >| >| | >LeasedLines-FrameRelay-IPLs-ISDN-PPP-Cisco-Consulting-VoiceFax-Data-Muxe >s >WorldWideWebAnything-Intranets-NetAdmin-UnixAdmin-Security-ReallyHardMat >h -- David Diaz dave(a)smoton.net [Email] pagedave(a)smoton.net [Pager] Smotons (Smart Photons) trump dumb photons

7 8

/24s run amuck... again
by Richard A Steenbergen 19 Jul '02

19 Jul '02

With all the recent talk about filtering, I figured now was a good time to update my list of evil /24 announcers... There are currently over 63k /24s out of 113k total unfiltered announcements (over 55%). http://www.e-gerbil.net/ras/projects/ipaddr/amuck-071902.txt This scan is done from the point of view of Williams (AS7911) transit, a fairly "average" unfiltered view of around 113k routes. It's not perfect, but it's pretty easy to go down the list and verify which ones are really poluting the internet. The reason these don't get picked up on other peoples "cidr scans" is that they have "gaps", so they are not perfectly cidr-able. The reasons for these announcements vary, including obvious incompetence and cable/dsl companies without a "backbone" connecting their various POPs announcing a /24 for each location to a single transit provider. If I had more free time I would extend this analysis past /24s, but since they're such a huge amount of polution it's a good place to start. If someone wanted to do an analysis of routes from a common block with identical attributes, I suspect they would find it a bigger cause of net polution than multihomers punching holes. For quick complaining, the top 10 offenders are: ASN Name Reg'd Netblock Prefixes --- ---- -------------- -------- 6595 DoD Dependents Schools - Europe 204.218.0.0/15 236 22927 TELEFONICA DE ARGENTINA 168.226.0.0/16 167 7029 Alltel Information Services 166.102.0.0/16 128 7303 Telecom Argentina Stet-France 200.43.0.0/16 127 14654 Wayport 64.134.0.0/16 113 16473 Bell South 198.146.0.0/16 111 11492 Cable One 24.116.0.0/16 108 18687 MPower Communications 208.57.0.0/16 98 7132 Southwestern Bell 207.193.0.0/16 89 1580 Army HQ, 5th Signal Command 144.170.0.0/16 88 -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

4 3

does KPNQwest really start to shut down?
by Nipper, Arnold 19 Jul '02

19 Jul '02

>From their website: "If no agreement can be reached, the network will be shut down in a controlled and orderly manner, starting on Friday, 19-07-2002 at 11:00 European time" see http://www.kpnqwest.com for details. Arnold -- Arnold Nipper / nIPper consulting e-mail: arnold(a)nipper.de phone/mob: +49 172 265 0958 fax: +49 6224 9259 333

3 2

Multi-collector Netflow/etc
by Pete Kruckenberg 19 Jul '02

19 Jul '02

There are lots of interesting tools to collect and analyze network traffic information from protocols like Netflow, sFlow, LFAP, etc. Few of the collectors/analyzers share common data repositories, so one sets up a machine for each with its own export from each router. How are others handling this problem, particularly after hitting the limit of one or two export flows supported by most routers today? Apparently there are a number of packet reflectors (usually running on a Unix machine) that work in theory, how do these work in actual practice, what kind of performance and reliability to they have, and which work well for traffic collection? Has anyone tried using multicast or broadcast addresses or other tricks (shared IP address or MAC address on multiple machines) to share a single accounting stream across multiple collectors? Any other methods that are working for scaling multiple collectors without exceeding router limitations or burdening routers unnecessarily? Pete.

4 5

Re: If you thought Y2K was bad, wait until cyber-security hits
by Mathew Lodge 19 Jul '02

19 Jul '02

Probe Research has a very lucid take on this very topic at http://www.proberesearch.com/alerts/networksecurity.htm Their point is that, given the current climate, the RBOCs are likely to be setting the agenda for cyber security. To quote Probe's first two conclusions: "First, the RBOCs will be the focus of developing a telecom national security plan; Second, the RBOCs will use this position to force costs onto all players. For example, co-location will be viewed as increasing the risk to telecom, so carriers may be forced to abandon co-location in favor of smaller nodes and these nodes will have to have remote backup nodes." Cheers, Mathew At 08:22 PM 7/18/2002 -0400, Sean Donelan wrote: >http://www.eweek.com/article2/0,3959,387377,00.asp > >"All the while maintaining that the government will not set IT security >requirements for the private sector, top federal IT officials today said >they expect such mandates will be imposed on federal agencies and that the >same standards will also be used by industry." > >While standards are great, one-size-fits-all standards aren't. When the >government's cyber-security plan is released in September, will >there be 500 requirements that Internet Service Providers must meet? >Should ISPs be more secure than the post office or the telephone or the >bike messenger? Must Bill's Bait & Sushi Shop ISP Service meet the same >security requirements as the ISP for the White House? > >ISPs come in all sorts of shapes and sizes. Consumers use cordless >phones at home, but the NSA prohibits use of cordless phones in secure >areas. Just because the government issues a security standard doesn't make >it suitable for all purposes. Some people like paying $9.95 for Internet >service from an ISP without a backup generator, and wouldn't want to pay >$29.95 for a "certified" ISP with a backup generator. If the $9.95 ISP >fails, heck they could almost afford two more for the same price as a >single "certified" ISP. Sometimes a hammer is just a hammer, and you >don't need a MIL-SPEC. If the Department of Homeland Security creates a >new security standard for ISPs, what do you think will happen to any ISP >which doesn't meet it? > >The security "Gold Standard" for Microsoft 2000 was written by the >Critical Infrastructure Protection Board, the Center for Internet >Security, the National Security Agency, the General Services >Administration, the National Institute of Standards and Technology, and >the SANS Institute. > >Do you know who is writing the security "Gold Standard" for Internet >Service Providers?

2 1

Be glad you're not in the U.K.
by blitz 19 Jul '02

19 Jul '02

And coming soon to the US! >BBC News Online: Sci/Tech >Wednesday, 17 July, 2002, 09:15 GMT 10:15 UK >Switch on for state snooping > >Police forces want to plug in to lots of networks > > >From August net service providers in the UK will be obliged to carry out >surveillance of some customers' web habits on behalf of the police. >Controversial laws passed in 2000 oblige large communications companies >to install technology that allows one in 10,000 of their customers to be >watched. > >The information gathered about what people look at on the web, the >content of e-mail messages and their phone conversations will be passed >to the police or a government monitoring station. > >The demands have been criticised by experts who say the law conflicts >with basic guarantees of privacy and that the government is not doing >enough to help pay for the installation of the surveillance systems. > >Data hoover > >The controversial Regulation of Investigatory Powers Act was passed in >October 2000 and gave law enforcement agencies sweeping powers to snoop >on the electronic lives of citizens. > >" It's the internet equivalent of a telephone tap " >Roland Perry, Linx > >The Act demands that organisations it dubs Communication Service >Providers (CSP) - broadly anyone that helps people keep in touch via the >web, fax machine or phone - install technology that can automatically >monitor what many of their customers are doing. > >It also demands that service providers start monitoring a customer >within 24 hours of being told that the police or other investigation >agencies want to snoop on them. > >The information collected must also be passed on electronically to the >agency which asked for the snooping to start. > >A spokesman for the Home Office said 1 August was the day on which the >new surveillance regime would start, even though the technology to do >the watching are yet to be installed. > >He said only law enforcement agencies would have the power to ask for >the surveillance to start. > >Police would have to get a warrant from the Home Office before they >could ask for surveillance to start, he said, and it would only be used >to gather evidence about serious crimes. > >Data delivery > >Roland Perry, public policy director for the London Internet Exchange >which interconnects the networks of net service companies, said the >government was still working out how best to put the surveillance >systems in place. > >"It's a very long-term project," he said. "The whole thing will be done >on a one-to-one basis with the individual companies concerned." > >" Agencies have to make a judgement whether it's worth making a request >if it costs a few hundred pounds to do it " > >Ian Brown, Foundation for Information Policy Research > >The government is also currently working out what types of information >it wants from CSPs and how it will be delivered. > >"In theory, an interception capability would deliver all the data," said >Mr Perry. "It's the internet equivalent of a telephone tap." > >The government is hoping that its work on automatic surveillance will >become a European standard and be widely adopted. > >Costly communication > >Service providers have asked for help to buy the equipment needed to set >up the permanent interception capability. > >"The Home Office has said it would contribute £20m to this but the net >industry has said it will cost a lot more than that," said Ian Brown, >director of the Foundation for Information Policy Research. > >The Internet Service Providers Association has warned about the >potentially huge costs of installing surveillance equipment to meet the >demands of the RIP Act and the recently passed Anti-Terrorism, Crime and >Security Act. > >A spokesman for the organisation said it was still seeking clarification >over the types of data its members were supposed to be catching, how >long it had to be stored for and who would pay for the storage. > >Mr Brown said one of the few safeguards on the snooping system was the >fact that the agencies asking for the surveillance to be carried out >will be charged to use it. > >"This means agencies have to make a >judgement whether it's worth making a request if it costs a few hundred >pounds to do it," said Mr Brown. > > >------------------------ Yahoo! Groups Sponsor ---------------------~--> >Will You Find True Love? >Will You Meet the One? >Free Love Reading by phone! >http://us.click.yahoo.com/O3jeVD/R_ZEAA/Ey.GAA/qkHolB/TM >---------------------------------------------------------------------~-> > > > > > >Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

1 0

RE: What is a reasonable range for global BGP table size?
by Kris Foster 18 Jul '02

18 Jul '02

That number is still too high since some people are advertising their /25 to /32 prefixes to the route-views box.. Kris > -----Original Message----- > From: Jared Mauch [mailto:jared@puck.Nether.net] > Sent: Thursday, July 18, 2002 12:47 PM > To: Robert Boyle > Cc: nanog(a)merit.edu > Subject: Re: What is a reasonable range for global BGP table size? > > > > I was going off my data analysis of > route-views data. > > wc -l oix.home_as.out > 135949 oix.home_as.out > > this file has prefix:home_asn > > (where home_asn is the last asn in the as_path. prefixes > with inconsistent home_as will appear twice. this may be > cause of some > of your confusion. eliminating those brings it to 120131 prefixes) > > - jared > > On Thu, Jul 18, 2002 at 12:37:09PM -0400, Robert Boyle wrote: > > > > At 11:26 AM 7/18/2002 -0400, you wrote: > > >Hmm. > > > > > >We don't filter, and > > > > > >112942 network entries and 391859 paths using 25288182 > bytes of memory > > > > We don't filter either and... > > > > 117800 network entries and 339843 paths using 23660948 > bytes of memory > > > > > > "about 135k prefixes last i checked." is not what we see > here from any of > > our upstreams. > > > > > > -Robert > > > > > > > > > > Tellurian Networks - The Ultimate Internet Connection > > http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 > > "Good will, like a good name, is got by many actions, and > lost by one." - > > Francis Jeffrey > > -- > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > clue++; | http://puck.nether.net/~jared/ My statements > are only mine. >

4 3