- NANOG - lists.nanog.org

Re: Bogon list
by smd＠clock.org 05 Jun '02

05 Jun '02

| Traceroute to www.foo.com, see it goes through an exchange. Ping | the router on the far end of the exchange, "host unreachable". How do you know the name of the thing at the far end of the exchange? Is it traceroute? Did the traceroute come from a looking glass, perhaps, or pass through a router controlled by the network participating in the exchange? If someone massaged or annotated the results of the traceroute, do you think you might a/ not ping that address, b/ ping an address which somehow corresponds to that router, c/ not know what the hell is going on at all -- maybe there's an MPLS tunnel across 15 routers! | Traceroute to it, "host unreachable" at the first default free | router. Not only will this confuse your customers, but often first | level support staff. The latter can be programmed to use an expert system that looks alot like a looking glass, but returns edited or annotated traceroutes instead. Hey, an in-house FAQ with hyperlinks for your support staff, that's too novel! Let's leak prefixes instead. | Also, you buy service from your favorite default free network. | They aren't present at an exchange. You want to traceroute/ping | a host on that lan. You can't, unless someone tranists the exchange. : macosx ; host some-router-at-mae-xyzzy.foo-bar.net <some loopback address> : macosx ; host some-router-at-mae-xyzzy-actual-interface-address.foo-bar.net <some RFC 1918 address> Which do you more likely ping? This is done all over the place now, unfortunately minus the 1918 addressing. Are there router implementations out there which ALWAYS do the wrong thing, and use the actual-interface-address when sending unreachables & exceededs? (Well, yes, I know there are. Sigh.) Sean.

1 0

Oh, I almost forgot...
by Rob Thomas 04 Jun '02

04 Jun '02

Hi, folks. If you are interested in yet another view of the global table size, you can take a look here: http://www.cymru.com/BGP/ I graph routing table size based on the data collected from my BGP peers. I also display any bogon prefixes, complete with origin ASN. Comments and feedback are always welcome! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

RE: route authentication
by Sean Donelan 04 Jun '02

04 Jun '02

How do you enable an IP interface because you need a unique address for your interfaces? When I say not part of the default configuration I mean the default configuration doesn't even have a space for "put key here." On Tue, 4 Jun 2002, Farhan Memon wrote: > How can u enable auth by default, since you would have to stick in a key > somehow, and if that was default then it could be exploited. > > rgrds > > Faz > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > batz > Sent: 04 June 2002 15:20 > To: Sean Donelan > Cc: Barbara Fraser; nanog(a)merit.edu > Subject: Re: route authentication > > > > On Tue, 4 Jun 2002, Sean Donelan wrote: > > :Some ISPs are practically religious about using them, usually the result > :of a single person at the ISP pushing it. But for the most part it hasn't > :really taken hold in the professional security consulting field. > > I would suggest that it is also ISP's who do not hire security consultants. > Consulting fees tend to come from departmental budgets, and almost > every network engineer I have ever met fancies themselves a security > expert. There isn't alot of incentive for them to get a third party > opinion, because of a lack of faith in the clue of most consultants, and > a general aversion to having anyone touch the delicate house of cards > many network engineers have constructed. > > Maybe Cisco could add this as a default requirement of the configuration > that had to be explicitly disabled? In fact, it would be nice if all > protocol configurations had to have their authentication manually > disabled. > > > > -- > batz > > > >

1 0

route authentication
by Barbara Fraser 04 Jun '02

04 Jun '02

I'm wondering just how many ISPs are using HMAC-MD5 to authenticate IS-IS route advertisements within their ASs, or MD5 on BGP peering sessions? I don't need a real number, just a sense of the community. Is usage increasing? is it dead? is it regional? etc. Any anecdotal info you have is appreciated. I don't need names of ISPs, just whether or not these technologies are being used. thanks, Barbara Barbara Fraser Consulting Engineer Cisco Systems, Inc. Phone: +1 (408) 525-1735

5 4

packet sniffers and protocol decoders used by isps
by Daniska Tomas 04 Jun '02

04 Jun '02

hi, this topic seems being at least semi-operational to me :) i'd like to make an idea of which sniffers and (the more important part) decoders are included in the arsenal of engineering tools used by network engineers at various isp sizes practical experience would be the most valuable information please feel free to reply privately if you feel this does not fit the list topics thanks much -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first.

2 1

RE: route authentication
by Joshua Wright 04 Jun '02

04 Jun '02

I am encouraging my local ISP/consortium (www.oshean.org) to utilize MD5 auth for BGP, but have been unsuccessful so far. The most difficult challenge I face there is convincing people of the "need" with the lack of a published exploit that the MD5 authentication would prevent. So much for best practices. <sigh> -Joshua Wright Team Leader, Networks and Systems Johnson & Wales University Joshua.Wright(a)jwu.edu pgpkey: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xD44B4A73 fingerprint: FDA5 12FC F391 3740 E0AE BDB6 8FE2 FC0A D44B 4A73 > -----Original Message----- > From: Barbara Fraser [mailto:byfraser@cisco.com] > Sent: Monday, June 03, 2002 7:48 PM > To: nanog(a)merit.edu > Subject: route authentication > > > > I'm wondering just how many ISPs are using HMAC-MD5 to > authenticate IS-IS > route advertisements within their ASs, or MD5 on BGP peering > sessions? I > don't need a real number, just a sense of the community. Is usage > increasing? is it dead? is it regional? etc. Any anecdotal > info you have is > appreciated. I don't need names of ISPs, just whether or not these > technologies are being used. > > thanks, > Barbara > Barbara Fraser > Consulting Engineer > Cisco Systems, Inc. > Phone: +1 (408) 525-1735 >

2 1

New IPv6 blcok allocated to RIPE NCC
by leo vegoda 04 Jun '02

04 Jun '02

Dear Colleagues, The RIPE NCC received the IPv6 address range 2001:0800::/23 from the IANA in May 2002. You may wish to adjust any filters you have in place accordingly. More information on the IP space administered by the RIPE NCC can be found on our web site at: <http://www.ripe.net/ripe/docs/smallest-alloc-sizes.html> Kind regards, -- leo vegoda RIPE NCC, Registration Services Assistant Manager

1 0

AS8070
by Ralph Doncaster 03 Jun '02

03 Jun '02

I've noticed a large chunk of my customer traffic coming from Microsoft. Anyone know if they peer anywhere on the East coast? Ralph Doncaster principal, IStop.com div. of Doncaster Consulting Inc.

3 3

OT: Saturday Site Seeing
by K. Graham 02 Jun '02

02 Jun '02

Here is an invite to anyone that will be here this Saturday June 8th. Weather permitting, I am willing to be a tour guide in downtown Toronto. I was thinking a ride up the CN tower to the very top observation tower called "SkyPod". It is the worlds highest observation tower standing at 1,465ft. There is also a lower observation "Glass Floor" which can make you a bit dizzy. The CN tower over looks the SkyDome and the ACC Center. The website and cost are below. http://www.cntower.ca/ Look Out + Glass Floor + Skypod (Taxes extra) $22.49 (CDN) To add to the day a walk along the Toronto Waterfront. Harbourfront is on the Central portion of the Martin Goodman Trail. This is a trail that stretches from one end of the city to the other. At it's westend it joins up with pathways into Mississauga and Oakville and on towards Hamilton. Eventually creating a park around the lakefront. Harbourfront is a bustling area with many shops, art galleries, outdoor venues, and a spectuclar view of the inner harbour. We had the Tall Ships moored there in the past. http://www.ryerson.ca/vtoronto/wwwsite/themes/cultrec/html/harbour.htm http://www.harbourfront.on.ca/ If time permits and if everyone would like a ferry ride to the island to put their feet into the sandy beach that can also be added into the day. I have a Neon so could probably put 3 - 4 others into it. As well as anyone else that would like to drive down. Contact me off-line if you would like to go. Kim

1 0

Is ISPSec group still active
by Sean Donelan 02 Jun '02

02 Jun '02

Is the Internet Sevice Providers Security Consortium (ISPSec) still active? In the past ISPSec developed some best practices for ISPs. Have ISPs stopped using ISPSec and started using NRIC instead. http://www.icsalabs.com/html/communities/ispsec/index.shtml

1 0