- NANOG - lists.nanog.org

BGP communities usage for route origin, entry point
by Thomas Kernen 19 Jun '02

19 Jun '02

This started off as me being curious as to why a UUNet engineer I was talking to told me he could not understand why a network would support a feature such as BGP communities for identifying the origin of a route/network entry point. I tried to explain to him the advantage of being able to quickly identify where a route originates from (geographically), type of interconnect, type of "peer" (in this case I use peer for any BGP peer, customer or transit). I explained that it could be usefull for debugging and gaining more background info (route analysis is one of my favorite tasks) and some of the major and minor networks do provide such a feature/service. Still the engineer could not understand why and only saw this as a security issue, well I guess when you work for a network that does not provide any public looking glass or route server it's not really a surprise </rant> This triggered a thought, do many people actually use BGP communities to pinpoint a route origination point/type, and if so for what purpose (debugging, analysis, other) Thomas PS: If UUNet do actually support this feature please tell me who I should contact.

5 4

RE: ATTBI refuses to do reverse DNS?
by Rowland, Alan D 19 Jun '02

19 Jun '02

As an ATTBI customer in this exact situation, Yeah! Also remember, we're talking legacy cable (monopolist) mindset in most cases. I've already long-ago voted with DirecTV and an analog antenna in my attic, but DirecWay is only competitive (price and latency) if the only other option is dialup or less. Best, -Al BTW, the TV system is HDTV/Surround. How many cable systems support that? -----Original Message----- From: Chris Woodfield [mailto:rekoil@semihuman.com] Sent: Wednesday, June 19, 2002 7:38 AM To: North America Network Operators Group Mailing List Subject: Re: ATTBI refuses to do reverse DNS? If the people who "vote with their wallets" here are the ATTBI customers, don't forget that if you're not served by DSL, cable broadband is really the only good option for broadband access (I'm not counting satellite, with >1s ping times, or wireless, which is still in its infancy as a residential solution). And rarely will you find a home anywhere in the US served by more than one cable company. Makes it kinda kard to vote with your wallet when the vendor has de facto monopoly power. -C > The people who are supposedly hurt here are those who ultimately have > the most influence. In the end they can vote with their wallets even if > they can't edit the appropriate zone files directly. (And the whole > idea behind DNS trust really revolves around having two different > parties agree on the mapping, not in simply allowing the user to edit > their own reverse DNS!) > > > Just as > > Network Address Translation is not a security solution, neither is checking > > INADDR. > > I don't think anyone has said that DNS consistency is a security > solution. You keep confusing these concepts I think. It's only one > tiny part of the picture. Fully consistent DNS only increases the level > of trust you can have in the hostnames used. Since hostnames are > supposed to be more stable than IP addresses, you _want_ to have more > trust in the hostnames, but with current protocols you cannot unless > there is full consistency between forward and reverse lookups. > > > Now if you check INADDR over Secure DNS, you might start having > > some level of information to trust. > > We can only hope, but I'll believe it when I see it. > > -- > Greg A. Woods > > +1 416 218-0098; <gwoods(a)acm.org>; <g.a.woods(a)ieee.org>; <woods(a)robohack.ca> > Planix, Inc. <woods(a)planix.com>; VE3TCP; Secrets of the Weird <woods(a)weird.com>

1 0

RE: D.C. area based ISP's unite
by Mark Segal 19 Jun '02

19 Jun '02

For those of you in BroadNet, we have a similar thing in Canada, works quite well.. Check out CAIP http://www.caip.ca, However, fighting the ILECs is just one of its mandates.. Mark -- Mark Segal Director, Data Services Futureway Communications Inc. Tel: (905)326-1570 > -----Original Message----- > From: Irwin Lazar [mailto:ILazar@burtongroup.com] > Sent: June 18, 2002 10:22 PM > To: 'nanog(a)merit.edu' > Subject: D.C. area based ISP's unite > > > > FYI: > > o ISPs Form DC-based Organization To Battle Large Telecom > Firms Washington, DC -- About 200 Internet service providers > (ISPs) from around the country have formed a new organization > based in Washington DC that will battle against what they > call "monopolistic local telephone companies" regarding the > future deployment of broadband. The new DC-based > organization, called The BroadNet Alliance, plans to lobby > the federal government on behalf of smaller ISPs. "How > America chooses to deploy broadband is one of the most > central policy issues of our time. Though there are many > voices on the traditional long distance, cable and local > telephone sides, the country's independent broadband > providers have lacked a clear voice in the debate," said > Maura Colleton, Executive Director of BroadNet. http://www.newsalert.com/bin/story?StoryId=Cpq6WqbWbrenuvtaYoq&FQ

1 0

v6
by Randy Bush 19 Jun '02

19 Jun '02

so i have a local address # ifconfig wi0 wi0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 inet6 fe80::260:1dff:fe23:c352%wi0 prefixlen 64 scopeid 0x6 inet 192.35.167.202 netmask 0xfffffc00 broadcast 192.35.167.255 ether 00:60:1d:23:c3:52 media: IEEE 802.11 Wireless Ethernet autoselect (DS/11Mbps) status: associated ssid nanog 1:"" stationname roam.psg.com channel 11 authmode OPEN powersavemode OFF powersavesleep 100 wepmode OFF weptxkey 1 and can ping the local exit # ping6 fe80::208:a3ff:fe8b:b5c2%wi0 PING6(56=40+8+8 bytes) fe80::260:1dff:fe23:c352%wi0 --> fe80::208:a3ff:fe8b:b5c2%wi0 16 bytes from fe80::208:a3ff:fe8b:b5c2%wi0, icmp_seq=0 hlim=64 time=55.512 ms 16 bytes from fe80::208:a3ff:fe8b:b5c2%wi0, icmp_seq=1 hlim=64 time=3.012 ms though the rtt is a bit scary but i am not getting a global address randy

18 32

Re: ATTBI refuses to do reverse DNS?
by Jared Mauch 19 Jun '02

19 Jun '02

On Tue, Jun 18, 2002 at 06:20:44PM -0700, Patrick Thomas wrote: > Once again, thanks for imposing your conveniences on me, and for > ARBITRARILY _breaking the network_ when I choose not to participate. It > is arbitrary because you and I both know there is no technical reason to > discriminate against non-named hosts. Actually there is. statistically speaking these hosts tend to be less well maintained and more likely the source of spam, amongst other things. This is only used on smtp here. It's not like i'm running a dynamic bgp feed that injects a /32 null0 route for someone who has no reverse dns. This method was not reached arbitrarily. after many years of "hey, this host is an open-relay", attempting to contact the rfc2142 prescribed contacts as well as those stored at arin/ripe/apnic to resolve the issue. These people are either real rogue hosts, or people that don't understand why they need such fancy services as dns. I seriously think this has to do with clue dilution and the "diameter of the internet thread" as with the treatment of the internet as a comodity as it has become, there are less incentives to get it right rather than get the service on to bill the customer. There are some days I wish it was (yes, there were others, but..) back to the original few (ANS, uunet, SprintLink, internetMCI) as one could expect a particular level of service and competence out of ones provider. As for the original issue, i encourage ATTBI (as well as all providers) to provide some sort of reverse dns for their netblocks be it unknown.level3.net, or 1-2-3-4.rev.example.com. - Jared > > --PT > > On Tue, 18 Jun 2002, Jared Mauch wrote: > > > And it will continue to work that way. > > > > That is the quality work of the people who spend many > > man-hours putting together such a system that is robust enough > > that when i decide that when you send me e-mail (not via a list) > > from a host that has no reverse dns, i can easily flag that for > > further scrutiny. > > > > What you are missing here is that, while yes, you can > > send e-mail from root(a)[1.2.3.4] to people, they may say "hmm, e-mail > > from an ip address is not typical of the people that i communicate > > with", and therefore treat it differntly. just like policy-routing > > but for your mailbox. > > > > it is a good reflection of provider clue(tm). even if they > > have rev-192.168.0.1.example.com. as their reverse dns, it's slightly > > more responsible (imho) than nothing/nxdomain. > > > > - jared > > > > On Tue, Jun 18, 2002 at 05:48:29PM -0700, Patrick Thomas wrote: > > > > > > Hi - what if I don't _want_ a domain name ? Last time I checked all of > > > the standard Internet protocols worked just fine with just an IP - thank > > > you for imposing your own sense of expediency and "convenience" on me and > > > then arbitrarily breaking the network for me when I choose not to > > > participate. > > > > > > --PT > > > > > > On Tue, 18 Jun 2002, Jared Mauch wrote: > > > > > > > > > > > On Tue, Jun 18, 2002 at 04:54:54PM -0500, Stephen Sprunk wrote: > > > > > > > > > > Thus spake "Stephen Griffin" <stephen.griffin(a)rcn.com> > > > > > > The lack of clue tends to be on the providing in-addr side of > > > > > > things. I think it is a great thing to refuse connections from > > > > > > ips without in-addr, in the same way it is great to refuse mail > > > > > > from domains that don't provide postmaster addresses. > > > > > > > > > > On first reading, I thought that was sarcasm. Now I realize you're serious. > > > > > > > > I've found that filtering out mail from > > > > people that have no reverse dns tends to typically point to > > > > a) open-relays, b) spam, c) lack of working abuse/postmaster. > > > > > > > > > > It is a means through which one can influence the laziness of > > > > > > others. Simply disregarding what others do, only legitimizes > > > > > > the laziness, and continues us along the road of everyone > > > > > > doing the absolute minimum. > > > > > > ... > > > > > > You neglect to include the option of the customer changing > > > > > > to an ISP that provides in-addr. > > > > > > > > > > So, if you ran Amazon.com, you wouldn't accept money from customers of clueless > > > > > ISPs? > > > > > > > > You can't do it on the store side, but you can do it on the > > > > residental customer side, or at least give those messages a higher > > > > level of attention in any overall spam score for a message. > > > > > > > > > Sadly, even that level of coercion wouldn't be anywhere near enough to motivate > > > > > most ISPs. And your (non-)customers will be caught in the crossfire. > > > > > > > > Anyone that sends e-mail to me from a host/server with no reverse > > > > dns I will not see. It is not rejected w/ 400/500 series code > > > > as I know some people do. it goes to it's own 'spam' folder. > > > > > > > > I have found that some companies (american express) for > > > > example can not seem to make their systems have reverse dns, and > > > > they suffer from the lack of a working postmaster/hostmaster > > > > address too. > > > > > > > > It just means i read that folder once every few days and > > > > periodically send e-mail to people i know that have hit the filter > > > > or other legit folks. > > > > > > > > - jared > > > > > > > > -- > > > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > > > > > > > > > > -- > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

Adeklphia update
by blitz 19 Jun '02

19 Jun '02

Adelphia announced price increases today.... 90 cents a month for cable TV, bringing the package to about $39. a month in Buffalo, and $41. outside. Also they increased the "powerlink" cablemodem $2.00 a month. (this is the second increase this year)

6 5

D.C. area based ISP's unite
by Irwin Lazar 19 Jun '02

19 Jun '02

FYI: o ISPs Form DC-based Organization To Battle Large Telecom Firms Washington, DC -- About 200 Internet service providers (ISPs) from around the country have formed a new organization based in Washington DC that will battle against what they call "monopolistic local telephone companies" regarding the future deployment of broadband. The new DC-based organization, called The BroadNet Alliance, plans to lobby the federal government on behalf of smaller ISPs. "How America chooses to deploy broadband is one of the most central policy issues of our time. Though there are many voices on the traditional long distance, cable and local telephone sides, the country's independent broadband providers have lacked a clear voice in the debate," said Maura Colleton, Executive Director of BroadNet. http://www.newsalert.com/bin/story?StoryId=Cpq6WqbWbrenuvtaYoq&FQ

2 1

RE: remember the "diameter of the internet"?
by Martin, Christian 19 Jun '02

19 Jun '02

>Regarding the diameter of the Internet - I'm still trying to >figure out >why the hell anyone would want to have "edge" routers (instead of dumb >TDMs) if not for inability of IOS to support large numbers of virtual >interfaces. Same story goes for "clusters" of backbone routers. When ANY router becomes as reliable as a dumb TDM device, then maybe we can begin collapsing the POP topology. However, the very nature of the Internet almost prevents this reliability from being achieved (having a shared control and data plane seems to be the primary culprit). There are routers out there today that can single-handedly replace entire POPs at a fraction of the rack, power, and operational cost. Hasn't happened, tho. I don't like wasting ports for redundant n^2 or log(n^2) interconnect either, but router and reliability mix like oil and water... My 2c. -chris > >--vadim > >On 18 Jun 2002, Jeff Harper wrote: > >> >> On Tue, 2002-06-18 at 12:34, brett watson wrote: >> >> > no, just lamenting the passing of an era. an era where we >engineers >> > cooperated, and "just fixed" the problems as they occured. > and we didn't >> > do things like this. >> >> Keep in mind the reason why the era passed. During that >era, you had >> top level, blue sky engineers. Now the field has been >saturated by a >> lot of less than desirable "engineers" out there (not >calling you one >> at >> all) that ruined it for us all... >> >> >> >> >

5 5

Re: ATTBI refuses to do reverse DNS?
by Jared Mauch 19 Jun '02

19 Jun '02

And it will continue to work that way. That is the quality work of the people who spend many man-hours putting together such a system that is robust enough that when i decide that when you send me e-mail (not via a list) from a host that has no reverse dns, i can easily flag that for further scrutiny. What you are missing here is that, while yes, you can send e-mail from root(a)[1.2.3.4] to people, they may say "hmm, e-mail from an ip address is not typical of the people that i communicate with", and therefore treat it differntly. just like policy-routing but for your mailbox. it is a good reflection of provider clue(tm). even if they have rev-192.168.0.1.example.com. as their reverse dns, it's slightly more responsible (imho) than nothing/nxdomain. - jared On Tue, Jun 18, 2002 at 05:48:29PM -0700, Patrick Thomas wrote: > > Hi - what if I don't _want_ a domain name ? Last time I checked all of > the standard Internet protocols worked just fine with just an IP - thank > you for imposing your own sense of expediency and "convenience" on me and > then arbitrarily breaking the network for me when I choose not to > participate. > > --PT > > On Tue, 18 Jun 2002, Jared Mauch wrote: > > > > > On Tue, Jun 18, 2002 at 04:54:54PM -0500, Stephen Sprunk wrote: > > > > > > Thus spake "Stephen Griffin" <stephen.griffin(a)rcn.com> > > > > The lack of clue tends to be on the providing in-addr side of > > > > things. I think it is a great thing to refuse connections from > > > > ips without in-addr, in the same way it is great to refuse mail > > > > from domains that don't provide postmaster addresses. > > > > > > On first reading, I thought that was sarcasm. Now I realize you're serious. > > > > I've found that filtering out mail from > > people that have no reverse dns tends to typically point to > > a) open-relays, b) spam, c) lack of working abuse/postmaster. > > > > > > It is a means through which one can influence the laziness of > > > > others. Simply disregarding what others do, only legitimizes > > > > the laziness, and continues us along the road of everyone > > > > doing the absolute minimum. > > > > ... > > > > You neglect to include the option of the customer changing > > > > to an ISP that provides in-addr. > > > > > > So, if you ran Amazon.com, you wouldn't accept money from customers of clueless > > > ISPs? > > > > You can't do it on the store side, but you can do it on the > > residental customer side, or at least give those messages a higher > > level of attention in any overall spam score for a message. > > > > > Sadly, even that level of coercion wouldn't be anywhere near enough to motivate > > > most ISPs. And your (non-)customers will be caught in the crossfire. > > > > Anyone that sends e-mail to me from a host/server with no reverse > > dns I will not see. It is not rejected w/ 400/500 series code > > as I know some people do. it goes to it's own 'spam' folder. > > > > I have found that some companies (american express) for > > example can not seem to make their systems have reverse dns, and > > they suffer from the lack of a working postmaster/hostmaster > > address too. > > > > It just means i read that folder once every few days and > > periodically send e-mail to people i know that have hit the filter > > or other legit folks. > > > > - jared > > > > -- > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > > -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

remember the "diameter of the internet"?
by brett watson 18 Jun '02

18 Jun '02

i sit behind cox-cable service at home, and in troubleshooting why my connectivity is *so* horrible, i find the following traceroute. does anyone do any sane routing anymore? does diameter matter (we used to talk about it a long, long while ago). i guess i'm just old and crusty but this seems to violate so many natural laws. i find in more random testing that i seem to be a minimum of 15 hops from anything, and it's not just the # of hops, it's the *paths* i travel. bouncing between two cities several times, on several different provider networks, from one border to the other. wow. -b traceroute www.caida.org 1 10.113.128.1 30 unavailable 2 68.2.6.25 10 ip68-2-6-25.ph.ph.cox.net 3 68.2.0.26 40 ip68-2-0-26.ph.ph.cox.net 4 68.2.0.18 50 ip68-2-0-18.ph.ph.cox.net 5 68.2.0.10 20 ip68-2-0-10.ph.ph.cox.net 6 68.2.0.70 10 ip68-2-0-70.ph.ph.cox.net 7 68.2.14.13 10 chnddsrc02-gew0303.rd.ph.cox.net 8 68.1.0.168 20 chndbbrc02-pos0101.rd.ph.cox.net 9 68.1.0.146 30 dllsbbrc01-pos0102.rd.dl.cox.net 10 12.119.145.125 40 unavailable 11 12.123.17.54 30 gbr6-p30.dlstx.ip.att.net 12 12.122.5.86 51 gbr4-p90.dlstx.ip.att.net 13 12.122.2.114 80 gbr2-p30.kszmo.ip.att.net 14 12.122.1.93 50 gbr1-p60.kszmo.ip.att.net 15 12.122.2.42 70 gbr4-p40.sl9mo.ip.att.net 16 12.122.2.205 60 gbr3-p40.cgcil.ip.att.net 17 12.123.5.145 60 ggr1-p360.cgcil.ip.att.net 18 207.88.50.253 90 unavailable 19 64.220.0.189 80 ge5-3-1.RAR1.Chicago-IL.us.xo.net 20 65.106.1.86 70 p0-0-0-0.RAR2.Chicago-IL.us.xo.net 21 65.106.0.34 60 p1-0-0.RAR1.Dallas-TX.us.xo.net 22 65.106.0.14 120 p6-0-0.RAR2.LA-CA.us.xo.net 23 64.220.0.99 80 ge1-0.dist1.lax-ca.us.xo.net 24 206.111.14.238 211 a2-0d2.dist1.sdg-ca.us.xo.net 25 209.31.222.150 80 unavailable 26 198.17.46.56 140 pinot.sdsc.edu 27 192.172.226.123 91 cider.caida.org

12 18