- NANOG - lists.nanog.org

European packet loss average increasing
by Sean Donelan 07 Jul '02

07 Jul '02

My non-scientific measurements (i.e. pings to well known european sites) show an increase in packet loss to about 6%, the 10 day average previously was less than 1%. Neither ns.ebone.net nor auth1.ebone.net are answering queries. BGP data still looks normal KPNQwest data http://bgp.potaroo.net/as286/ So far I don't see much change in traffic levels at LINX http://www.linx.net/tools/stats/index.thtml AMS-IX graphs seem to have a glitch, or one heck of a DDOS. http://www.ams-ix.net/hugegraph.html

6 5

Re: DOS attack from PANAMSAT
by Rizzo Frank 07 Jul '02

07 Jul '02

Rob Thomas wrote: > ] Your upstreams, who will help you back-track. Nobody DoS'es with their > ] real IP's anymore. > > Hmm, not according to the data I collect. I track numerous botnets and > DoSnets, and a bit over 80% of them use the real IPs DDoS/botnet, yes. Targeted DoS (think Jason Legate's stream.c), no. Frank

1 0

FW: wcom overbilling
by joe mcguckin 07 Jul '02

07 Jul '02

------ Forwarded Message From: joe mcguckin <joe(a)via.net> Date: Sat, 06 Jul 2002 21:43:23 -0700 To: Hank Nussbacher <hank(a)att.net.il> Subject: Re: wcom overbilling On 7/6/02 9:04 PM, "Hank Nussbacher" <hank(a)att.net.il> wrote: > > At 04:50 PM 06-07-02 +0100, Stephen J. Wilcox wrote: > >> .. which is why I think people (especially US altho it seems to be coming >> more >> the normal in other markets) use EBITDA as it smooths out the bumps even >> tho the >> bumps are still there! >> >> The other nice thing in the telecoms world about EBITDA is the 'D' which >> seems >> to work quite well at hiding losses caused by falling fibre/bandwidth prices! > > From Barrons: > EBITDA = Earnings Before I Tricked the Dumb Auditor > > -Hank > > >> Steve > > Why shouldn't interest expense be taken into account? After all, they (name your favorite carrier) wouldn't have that nice fiber network if it weren't for all the money they borrowed. Paying the interest on the borrowed money should be treated as a normal business expense. Joe ------ End of Forwarded Message

1 0

Re: wcom overbilling
by Hank Nussbacher 07 Jul '02

07 Jul '02

At 04:50 PM 06-07-02 +0100, Stephen J. Wilcox wrote: >.. which is why I think people (especially US altho it seems to be coming more >the normal in other markets) use EBITDA as it smooths out the bumps even >tho the >bumps are still there! > >The other nice thing in the telecoms world about EBITDA is the 'D' which seems >to work quite well at hiding losses caused by falling fibre/bandwidth prices! From Barrons: EBITDA = Earnings Before I Tricked the Dumb Auditor -Hank >Steve

1 0

ddos taxonomy paper from ucla research group
by k claffy 06 Jul '02

06 Jul '02

reasonable article on ddos taxonomy if you haven't seen it http://www.lasr.cs.ucla.edu/ddos/ucla_tech_report_020018.pdf am sure jelena et al would be grateful for any operationally flavored feedback k

1 0

DOS attack from PANAMSAT
by Roy 06 Jul '02

06 Jul '02

I am receiving a DOS attack from multiple IP addresses in the 216.139.xx.xx range belonging to PANAMSAT (AS 19199). Upstreams seem to be QWEST, EPOCH, and UUNET. Their NOC is clueless. Anyone have a better number?

2 1

The Cidr Report
by CIDR Report 06 Jul '02

06 Jul '02

This is an auto-generated mail on Fri Jul 5 23:00:01 PDT 2002 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. NEW: Check http://www.employees.org/~tbates/cidr-report-region.html for the regional version of this report. NEW: Check http://www.employees.org/~tbates/autnums.html for a complete list of autonomous system number to name mappings as used by the CIDR-Report. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amount of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to GX Networks for giving me access to their routing tables once a day. Please send any comments about this report directly to CIDR Report <cidr-report(a)cisco.com>. ------------------------------------------------------------------------------ CIDR REPORT for 05Jul02 0) General Status Table History ------------- Date Prefixes 280602 111076 290602 111083 300602 111065 010702 111089 020702 111046 030702 110779 040702 110898 050702 110820 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 13188 Number of ASes announcing only one prefix: 8046 (4527 cidr, 3519 classful) Largest number of cidr routes: 613 announced by AS701 Largest number of classful routes: 1234 announced by AS701 1) Gains by aggregating at the origin AS level --- 05Jul02 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS1221 1098 847 251 22.9% Telstra Pty Ltd AS701 1234 987 247 20.0% UUNET Technologies, Inc. AS17557 305 108 197 64.6% Pakistan Telecom AS6595 210 58 152 72.4% DoD Education Activity Network As AS852 482 352 130 27.0% Telus Advanced Communications AS7018 804 675 129 16.0% AT&T AS16473 194 76 118 60.8% Bell South AS4151 237 142 95 40.1% USDA AS19632 99 5 94 94.9% Metropolis Intercom S.A. AS1239 520 426 94 18.1% Sprint AS7303 157 69 88 56.1% Telecom Argentina Stet-France Tel AS16814 105 20 85 81.0% NSS, S.A. AS7046 313 230 83 26.5% UUNET Technologies, Inc. AS226 171 88 83 48.5% Los Nettos AS2048 180 103 77 42.8% State of Louisiana AS4755 212 136 76 35.8% Videsh Sanchar Nigam Ltd. Autonom AS577 262 190 72 27.5% Bell Advanced Communications Inc. AS4323 407 338 69 17.0% Time Warner Communications, Inc. AS724 229 161 68 29.7% DLA Systems Automation Center AS3464 163 102 61 37.4% Alabama SuperComputer Network AS19834 64 4 60 93.8% NetForce, Inc. AS10620 83 23 60 72.3% TVCABLE BOGOTA AS9498 84 27 57 67.9% BHARTI BT INTERNET LTD. AS16758 63 6 57 90.5% IKON Office Solutions AS1 441 384 57 12.9% GENUITY AS9051 82 26 56 68.3% INCONET Autonomous System AS3908 295 239 56 19.0% Supernet, Inc. AS209 309 255 54 17.5% Qwest AS6535 67 17 50 74.6% Chilesat Servicios Empresariales AS702 519 473 46 8.9% UUNET Technologies, Inc. Total 54644 42182 12462 22.8% For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

RE: Internet vulnerabilities
by Rizzo Frank 06 Jul '02

06 Jul '02

Sean Donelan wrote: > Disrupting the Internet is a matter of scale and time. Quick show of hands. How many of you recently-laid-off engineers have automated router-pampering scripts still running on your old workstations, which nobody at your ex-employer knows about? How many of you still have enable? Therein lies the real danger. Frank "Mr. Wiggles" Rizzo

2 1

Re: DNS was Re: Internet Vulnerabilities
by Paul Vixie 05 Jul '02

05 Jul '02

> ... beyond that, security and anycast don't mix well without the data > being authenticated, e.g. dnssec. i won't disagree. anycast's cost:benefit analysis is compellingly against its use in most situations. root name service may be one of them. now, if the ops community can figure out a way to secure the edge->core boundary such that packets heard by a DDoS victim will have reasonable IP source addresses, then that would be better overall. however, in the 36 hours since i last cleared the ipfw stats on c.root-servers.net, i see: packets bytes rule 938231392 60808555788 pipe 1 udp from any to any 53 in 48248328 2919355408 deny ip from 192.168.0.0/16 to any in 34199691 2254707782 deny ip from 10.0.0.0/8 to any in 16030262 1061648337 deny ip from 172.16.0.0/12 to any in and so i don't see much chance that IP source addresses will be believable any time during the working lives of anyone now reading this. i also think the likelihood of wide scale dnssec deployment within the next year or two is two orders of magnitude lower than the likelihood of a DDoS against the root server system. "more later."

1 0

Re: DNS was Re: Internet Vulnerabilities
by Randy Bush 05 Jul '02

05 Jul '02

> Now that we've seen enough years of experience from Genuity.orig, > UltraDNS, Nominum, AS112, and {F,K}.root-servers.net, we're seriously > talking about using anycast for the root server system. without dnssec, how do we differentiate this from a routing attack on the roots? the as112 anycast thingie is fine, as who cares if someone attacks reverse servers for bogus requsts. attacking bogosity is good. :-) the decade of sprint, uunet, ... running anycast caching is within an isp is risky, but they are responsible for their own security and fate. beyond that, security and anycast don't mix well without the data being authenticated, e.g. dnssec. randy

1 0