- NANOG - lists.nanog.org

Qwest leaking routes?
by Vinny Abello 18 Jun '02

18 Jun '02

Has anyone else noticed that Qwest appears to be leaking routes to 10.0.0.0/8?? BGP routing table entry for 10.0.0.0/8, version 1073573 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 1784 209 216.182.0.65 (metric 5803520) from 216.182.0.65 (216.182.0.65) Origin IGP, localpref 90, valid, internal, best Vinny Abello Network Engineer Server Management vinny(a)tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN

2 1

Looking for infrastructure, international & national peering policies
by ren 18 Jun '02

18 Jun '02

Hi folks, As mentioned to several of you last week in Toronto, I'm looking for infrastructure, international and national peering policies that anyone wants to donate to a good cause. It is time for the bi-annual update! If we have a wide variety of policies in hand it will help. For some reason I'm having trouble finding public facing documents about infrastructure peering... thanks in advance, -ren

1 0

???
by blitz 18 Jun '02

18 Jun '02

Anyone else getting the group msgs in duplicate like I am? Server brainfart?

2 1

Sean takes a vacation somewhere sunny....
by David Lesher 18 Jun '02

18 Jun '02

Sean has branched out into lightweight tools.... MADRID, June 15 (AFP) - Thousands of phones and Internet connections were severed in 15 Spanish provinces after saboteurs used chainsaws to cut through fibre optic cables belonging to Spanish telecoms operator Telefonica, the Spanish press reported Saturday. ..... Communications between airports were particularly affected, causing delays of three hours in the Galicia region, northwestern Spain, while numerous automatic cash distributors shut down across Spain. ... The Spanish ministry of science and technology has asked telecommunications companies to activate a backup plan in the case of such emergencies in future. Spare fibers in the same duct ;-? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

4 3

NANOG wins a bot
by Rob Thomas 18 Jun '02

18 Jun '02

Hi, all. This evening the NANOG mailing list received e-mail from a "jim bruer," aka jim_teh_man(a)yahoo.com. This e-mail, with a topic of "ConfigMaker Beta" (a Cisco product) included an attachment labelled as "cisco_configmaker.exe." This is actually a war bot known as Slackbot, version 1.0. This bot attempts to connect to the IRC server irc.easynews.com, 140.99.102.3. This IP address is part of the 140.99.96.0/19 prefix announced by ASN 2 (ACES Research - The Tucson Interconnect). The channel is #midgets_in_drag with no channel key. The server is not running, so this botnet (perhaps an old one) is not available for woe. The bot runs on Windows as wuordona.exe, and installs in c:\winnt\. This is likely an attempt by some miscreants to build a botnet through the e-mail spam method. Since Slackbot does not include a spam mechanism, some other bit of malware must be involved. Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

3 3

Re: [Fwd: FOUND VIRUS IN MAIL from <owner-nanog@merit.edu>]
by Larry Rosenman 18 Jun '02

18 Jun '02

On Mon, 2002-06-17 at 23:34, Patrick Thomas wrote: > > > I didn't see the mail, just my virus scanner going off. I figured > > SOMEONE might actually care. > > Which virus scanner are you using for your MUA ? I didn't know there were > any good ones for pine or elm...or do you have it working directly with > your MTA ? If so, which MTA is it tied into ? amavisd-milter, tied into sendmail 8.12.3 on a FreeBSD host, using McAffee's UVSCAN. Works great. I have a client that has a website, and they've been getting 10-50 klez.h@MM virii a day blocked by the same setup. > -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: ler(a)lerctr.org US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749

1 0

How to make setup backup route for windows server
by william＠elan.net 18 Jun '02

18 Jun '02

Hi everyone, I need advice on how to best impliment backup routing for windows server. More particularly I have situation where a new server will be placed behind firewall but the server also has 2nd ethernet port which will be connected directly to the router (for that port firewall rules are being entered directly on cisco router). Firewall connection should be the one used for actual traffic unless firewall is down and in that case direct route to the server should be used. The actual ips stay the same (they are on loopback interface on the windows server) so what is necessary is for cisco router to know if firewall is up and if so route that block of ips throuh the firewall and if not, then route it directly to the server through ethernet interface. Now, the firewall itself is actually linux server with its own set of firewall, logging, routing rules, that server is currently not running any routing software. The router is cisco 7500 and its setup with BGP for internet and EIGRP for intranet routing to other routers on our net. I'm thinking the best way to do this maybe to run gated on the linux firewall server and run OSPF on both linux firewall and router. The other problem that still may ned to be solved is default route on windows server (currently I'm thinkin of justing pointing it to interface connected to the router as there would not be any outgoin firewall rules). In addition I will in two weeks need to impliment the same scenario with solaris server being behind firewall with backup connection to router, so it'd good to find universal soltutions. Any suggestions? How are others doing in similar situations? --- William Leibzon Elan Communications Inc.

2 1

RE: XO
by Mansey, Jon 17 Jun '02

17 Jun '02

They already did http://www.isp-planet.com/cplanet/news/03march2002/28adelphia.html Jm > -----Original Message----- > From: blitz [mailto:blitz@macronet.net] > Sent: Monday, June 17, 2002 4:11 PM > To: nanog(a)trapdoor.merit.edu > Subject: XO > > > > Did I hear right on the nightly news, XO went bankrupt today? > > Presently, we're taking bets on when Adelphia goes chapter 11... >

1 0

RE: remember the "diameter of the internet"?
by Mansey, Jon 17 Jun '02

17 Jun '02

I think this is pretty simple. Its just that the closest city to you where ATT and XO peer is Chicago. If they peered in Dallas, it would a whole lot better. I get this all the time, not as bad as this, going to sites across town (LA) when a trace regularly goes via San Jose and back. I guess the Internet isnt as inter-networked as it could be, and less and less so seemingly. The old idea of mutual peering being good for the net etc seems firmly dead nowadays. jm > -----Original Message----- > From: brett watson [mailto:brett@the-watsons.org] > Sent: Monday, June 17, 2002 2:38 PM > To: nanog(a)merit.edu > Subject: remember the "diameter of the internet"? > > > > i sit behind cox-cable service at home, and in troubleshooting why my > connectivity is *so* horrible, i find the following traceroute. does > anyone do any sane routing anymore? does diameter matter (we > used to talk > about it a long, long while ago). i guess i'm just old and > crusty but this > seems to violate so many natural laws. > > i find in more random testing that i seem to be a minimum of > 15 hops from > anything, and it's not just the # of hops, it's the *paths* i travel. > bouncing between two cities several times, on several > different provider > networks, from one border to the other. > > wow. > > -b > > traceroute www.caida.org > > > 1 10.113.128.1 30 unavailable > 2 68.2.6.25 10 ip68-2-6-25.ph.ph.cox.net > 3 68.2.0.26 40 ip68-2-0-26.ph.ph.cox.net > 4 68.2.0.18 50 ip68-2-0-18.ph.ph.cox.net > 5 68.2.0.10 20 ip68-2-0-10.ph.ph.cox.net > 6 68.2.0.70 10 ip68-2-0-70.ph.ph.cox.net > 7 68.2.14.13 10 chnddsrc02-gew0303.rd.ph.cox.net > 8 68.1.0.168 20 chndbbrc02-pos0101.rd.ph.cox.net > 9 68.1.0.146 30 dllsbbrc01-pos0102.rd.dl.cox.net > 10 12.119.145.125 40 unavailable > 11 12.123.17.54 30 gbr6-p30.dlstx.ip.att.net > 12 12.122.5.86 51 gbr4-p90.dlstx.ip.att.net > 13 12.122.2.114 80 gbr2-p30.kszmo.ip.att.net > 14 12.122.1.93 50 gbr1-p60.kszmo.ip.att.net > 15 12.122.2.42 70 gbr4-p40.sl9mo.ip.att.net > 16 12.122.2.205 60 gbr3-p40.cgcil.ip.att.net > 17 12.123.5.145 60 ggr1-p360.cgcil.ip.att.net > 18 207.88.50.253 90 unavailable > 19 64.220.0.189 80 ge5-3-1.RAR1.Chicago-IL.us.xo.net > 20 65.106.1.86 70 p0-0-0-0.RAR2.Chicago-IL.us.xo.net > 21 65.106.0.34 60 p1-0-0.RAR1.Dallas-TX.us.xo.net > 22 65.106.0.14 120 p6-0-0.RAR2.LA-CA.us.xo.net > 23 64.220.0.99 80 ge1-0.dist1.lax-ca.us.xo.net > 24 206.111.14.238 211 a2-0d2.dist1.sdg-ca.us.xo.net > 25 209.31.222.150 80 unavailable > 26 198.17.46.56 140 pinot.sdsc.edu > 27 192.172.226.123 91 cider.caida.org >

3 2

Re: spare fibers
by Kelly J. Cooper 17 Jun '02

17 Jun '02

If you're referring to the National Security Council (NSC) or the President's Critical Infrastructure Protection Board (PCIPB) and the ISP-related working groups they put together (which Avi reported on at NANOG) when you say "they" then you should know that they are looking at those sorts of things and they're working on building a simulator/test-bed. It just wasn't part of the charters for the WGs. They're looking at a lot of different issues because they understand there aren't any silver bullets. Hence the working groups... hence the long set of questions that someone else pointed to... hence some of the other projects they're working on... they want feedback. They want to understand as many aspects of the various problems as possible. BUT there are also a LOT of different sets of "they" out there, so try to be specific. Regards, Kelly J. On Jun 16, 7:42pm, Daniel Golding wrote: > Subject: RE: Re: spare fibers * *Hmm. How many points of disruption, backhoes, chainsaws, hooligans, etc, *would be needed to do this in the US and Canada? 20? 30? Sean Donelan on *a specially outfitted Segway? (just picture it...) * *I suspect that might be a better source of inquiry for our friends in *the federal government, then, say, SBGP. * *Might be useful for the Powers That Be to actually do a simulation of *this, and see how far they can get. * *- Daniel Golding * *> -----Original Message----- *> From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On *> Behalf Of Frank Coluccio *> Sent: Sunday, June 16, 2002 6:43 PM *> To: blitz(a)macronet.net *> Cc: nanog(a)trapdoor.merit.edu *> Subject: Re: Re: spare fibers *> *> *> *> Almost without exception, "ring topology" implies a *> single-carrier doing physical *> layer provisioning and support. In the case where multiple *> points are under *> attack in a concerted effort to knock out service (including *> the failover *> capabilities), it's either an "inside job" or, at the least, *> one where *> intelligence relating to individual SONET backbones and rings *> has been obtained *> from various sources for the purpose of thwarting such _self-healing_ *> capabilities that are usually afforded by SONET/SDH. *> *> In the not too distant past (during the pre-sonet and early *> SONET days when N+1 *> automatic protection switching was used instead of *> counter-rotating recovery *> schemes) we saw this occur, albeit infrequently, during *> periods of labor unrest *> and other tense forms of situations relating to competition *> (where folks feared *> for their jobs) along the NY-NJ corridor and in certain parts *> of California, to *> name just two that I recall off the top of my head. Until *> recently (post 9-11), *> however, it was hardly a matter of overwhelming concern. *> Today it is becoming *> more so a matter of heightened concern. Meshing through the *> use of diverse *> providers' facilities may prove to be the ultimate means of *> protection, with the *> proviso being that those providers are not all sharing the *> same physical routes. *> fwiw. *> *> FAC *> *> > *> > *> > Hi Daniel and all, *> > Yes, multiple fiber in multiple conduits, traveling *> multiple paths is *> > the *> > best way to insure something's going to have connectivity. *> > Ring topology is what I've seen mostly for best protection, *> if something *> > goes down, restoration takes milliseconds and is automatic. *> Worst case, is *> > some contractor digs up the place where your fiber enters *> your building and *> > severs everything....not much you can do about that kind of outage. *> > *> > *> > At 20:41 6/16/02 +0200, you wrote: *> > *> > *> > >Hi blitz, *> > > *> > >I think that you talk about multiple outage in the *> Telefonica Network *> > >in Spain cause by sabotage. (48 fibers in 4 points at the same *> > >time) *> > > *> > >I see ok the interest of the ministry, is necessary to assure that *> > >outages don't affect to the national infraestruture. *> > > *> > >In our case we build our network over diverse companys *> with diverse *> > >path in their fiber network. I see ok, that all companys *> that operate *> > >basic services do it and they will have backup and emergency plans. *> > > *> > >Regards, *> > >Daniel *> > >Intelideas *> > > *> > > *> > >On Sun, 16 Jun 2002, blitz wrote: *> > > *> > > > *> > > > The Spanish ministry of science and technology has asked *> > > > telecommunications companies to activate a backup *> plan in the *> > > > case of such emergencies in future. *> > > > *> > > > Spare fibers in the same duct ;-? *> > > > *> > > > Doesn't sound like it would be much protection from "backhoe *> > > > fade"...heh *> > > > * >-- End of excerpt from Daniel Golding

2 1