- NANOG - lists.nanog.org

Re: Maformed SNMP Packet log/trace
by Eric Brandwine 27 Feb '02

27 Feb '02

>>>>> "bm" == Brennan Murphy <Brennan_Murphy(a)NAI.com> writes: bm> I need a trace or log file of the Malformed SNMP packets bm> recently tracked by CERT. bm> http://www.cert.org/advisories/CA-2002-03.html Go to the Oulu University page mentioned in the advisory. Download the 4 .jar files that comprise the toolkit. unzip the jar files. There'll be a testcases/ dir in each of them. Each file in this directory is one of their packets. There are 53,000 of them. Have fun! ericb -- Eric Brandwine | Failing organizations are usually over-managed and UUNetwork Security | under-led. ericb(a)uu.net | +1 703 886 6038 | - Warren G. Bennis Key fingerprint = 3A39 2C2F D5A0 FC7C 5F60 4118 A84A BD5D 59D7 4E3E

3 3

OT: spam from Globix to ARIN POCs
by Kai Schlichting 25 Feb '02

25 Feb '02

If there's something I really hate it's a bunch of jerks in the marketing department that are so desperate to get attention, they'll even repeat the mistakes of at least one other organization we all know of - and do so FOR THE SECOND TIME - and annoy operational people at their competitor's (that'd be the NANOG readers), customers and non-customers alike. As far as their "Copyright" on this piece of UCE is concerned, they can stick that where the sun don't shine: There is no inherent right to control 'distribution' of works distributed in an indiscriminate and unsolicited manner: the 2 reproduced UCE/UBE below have key data censored for no other purpose than making it completely useless for getting Globix's message before an even bigger audience. ARIN board: you may want to consider changes to the charter to have sanctions against members that send UCE/UBE to ARIN POCs. There is nothing that gets members' attention as quick as a $5000 "special administrative fee" for unauthorized use of the membership list, even such a public one as the ARIN whois server. Freely accessible doesn't mean free for all and all purposes. Globix abuse desk people: I know your pain. And on another note, that little spamming jerk from Qwest's NYC sales office, NAME REMOVED, should start finding himself a new job while there is time. And don't count on collecting unemployment. Gee, I can be a real jerk on some days, and well: this is such a day. bye,Kai -- "Just say No" to Spam Kai Schlichting New York, Palo Alto, You name it Sophisticated Technical Peon Kai's SpamShield <tm> is FREE! http://www.SpamShield.org | | LeasedLines-FrameRelay-IPLs-ISDN-PPP-Cisco-Consulting-VoiceFax-Data-Muxes WorldWideWebAnything-Intranets-NetAdmin-UnixAdmin-Security-ReallyHardMath --------------------- Received: from mailhost.nyc1.globix.com (mailhost.nyc1.globix.com [209.10.70.250]) by CENSORED (8.9.3/8.9.3) with ESMTP id TAA21672 for <CENSORED@DOMAIN_OF_ARIN_POC>; Fri, 22 Feb 2002 19:XX:XX -0500 (EST) From: dm(a)globix.com Received-Date: Fri, 22 Feb 2002 19:XX:XX -0500 (EST) Received: from mailhost.nyc1.globix.com ([10.0.28.39]) by mailhost.nyc1.globix.com (Netscape Messaging Server 4.15) with SMTP id GRYL0S00.JGT; Fri, 22 Feb 2002 18:XX:XX -0500 To: friends@DOMAIN_OF_ARIN_POC Date: Fri, 22 Feb 2002 18:XX:XX PST Subject: Register for Free Globix Seminar MIME-Version: 1.0 Content-Type: text/html; charset=us-ascii Message-ID: <GRYL0S00.JGT(a)mailhost.nyc1.globix.com> IBM/Globix SeminarG l o b i x C o r p o r a t i o n S e m i n a r S e r i e sIBM and Globix Corporation will present a seminar entitled "New Solutions for the New Year" A discussion on leveraging technology: How small to medium sized companies can take advantage of the lessons learned by other businesses when making an outsourcing decision. XXXXXXXX, February XX, 2002 X:00 PM Registration X:30 PM Presentation X:30 PM Tours and Networking Globix Corporation Seminar Center 139 Centre Street 2nd Floor Seminar Room According to a recent Jupiter Executive Survey, 34 percent of companies handle hosting and infrastructure responsibilities internally - most of these companies overestimate the competitive advantages of hosting internally. This seminar will review the common "Pain Points" of hosting internally and look at how some companies have confronted and answered these questions. Topics to be presented for discussed will be: What are the costs of outsourcing hosting and infrastructure needs as opposed to fulfilling them in-house?How do companies trap themselves into over spending. How can they correct avoidable mistakes?What criteria can companies rely on to select the best hosting and infrastructure vendor?How can you plan for business continuity as a hedge against unforeseen downtime? The theme of the event will be how Globix and IBM combine to provide solutions to challenges. This seminar will also introduce the Globix/IBM Partnership to attendees and show how Globix services combined with IBM products can meet business needs. Featured Speakers: Larry O'Connell, Global Emerging and Competitive Markets, IBM Corporation Steve Wolf, Technology and Applications Services Group, Globix CorporationTo register for this event, visitwww.globix.com/serverseminar/. For additional details, contact Globix at 1-800-4-GLOBIX, or via email @info@globix.com "Globix" and the stylized "G" logo are trademarks of Globix Corporation. © Copyright 2002 Globix Corporation. All Rights Reserved. If you have received this in error or do not wish to be contacted, please reply to this email with 'Remove Me' in the subject line. If you would like this directed to someone else in your organization please reply with new contact details. ===8<===========End of original message text=========== ===8<==============Original message text=============== Received: from mailhost.nyc1.globix.com (mailhost.nyc1.globix.com [209.10.70.250]) by CENSORED (8.9.3/8.9.3) with ESMTP id PAA08893 for <CENSORED@DOMAIN_OF_ARIN_POC>; Thu, 24 Jan 2002 15:XX:XX -0500 (EST) From: dm(a)globix.com Received-Date: Thu, 24 Jan 2002 15:XX:XX -0500 (EST) Received: from mailhost.nyc1.globix.com ([10.0.28.39]) by mailhost.nyc1.globix.com (Netscape Messaging Server 4.15) with SMTP id GQGLDV00.PMB; Thu, 24 Jan 2002 15:XX:XX -0500 To: globix@DOMAIN_OF_ARIN_POC Date: Thu, 24 Jan 2002 15:10:XX PST Subject: Globix and IBM Internet Partnership Seminar MIME-Version: 1.0 Content-Type: text/html; charset=us-ascii Message-ID: <GQGLDV00.PMB(a)mailhost.nyc1.globix.com> Globix Seminar InvitationLast week we sent you a special invitation to the first in a series of seminars hosted by Globix and IBM. This is a reminder that you are cordially invited to this presentation. As strategic business partners, Globix and IBM are uniquely qualified to assist your business in solving complex e-business problems. Industry experts from both Globix and IBM will discuss ways of leveraging today s technology to achieve real results on the Internet. Registration information and the seminar agenda are available by clicking on the link below. Seminar: New Solutions for the New Year Date: January XX, 2001 Time: 4:00 pm to 6:00 pm Location: Globix World Headquarters 139 Centre Street New York, NY 10013 Registration Online: www.globix.com/serverseminar By phone: 1-800-4-GLOBIX, code XXXX Refreshments and tours of our state-of-the-art data center will be available after the seminar. We look forward to seeing you there. Globix Corporation If you would like for us to remove your name from our email list, please hit respond and enter REMOVE in the subject box. We apologize for any inconvenience. ===8<===========End of original message text=========== --

2 1

DNS timeline
by Sean Donelan 25 Feb '02

25 Feb '02

Since it appears DNS goofiness is about to return, I put together a timeline of significant events that affected DNS service technically over the last 20 years. http://www.donelan.com/dnstimeline.html In comparison with other utilities, DNS performs about average. AT&T's telephone network had two major nationewide failures in the last 20 years. Several electrical grids have failed, including the grid covering the Western States due to a single tall tree. All the root servers have been down once, and there have been a couple of instances of zone files being truncated in the last 20 years. Not perfect, but amazingly robust for a technology operated by humans.

3 2

Just keep telling yourself, "Worldcom won't fail, Worldcom won't fail"
by Fletcher E Kittredge 25 Feb '02

25 Feb '02

This is an interesting NYT article (free registration required) for all of those of us trying to convince themselves that even if Worldcom goes bankrupt, UUnet will stay up. The example used is Global Crossings. If a company has complex enough finances and gets deeply enough under water, the courts might not be able to figure it out and creditors may just liquidate... whether or not it makes sense for the customers and society as a whole. If the government is not willing to step in for Enron, would they step in for UUnet? http://www.nytimes.com/2002/02/25/technology/25GLOB.html By the way, I never said to Dan Hollis and others: "You were right; I was wrong." about Global Crossing. If one had listened to Dan, one would have known 12 months that Global Crossing was in trouble. I read their press releases and balance sheets and didn't see it... Mea Culpa. regards, fletcher

1 0

Re: [nsp] Cisco DS3 Questions..
by rs＠seastrom.com 25 Feb '02

25 Feb '02

Jesper Skriver <jesper(a)skriver.dk> writes: > On Mon, Feb 25, 2002 at 07:36:11AM -0800, Eliot Lear wrote: > > > > At 09:24 PM 2/22/2002 +0100, Jesper Skriver wrote: > > > > > > int Serial0 > > > > encap hdlc > > > > down-when-looped > > > > > >I know, but that needs to be configued in both ends, and as it's not the > > >default, it's likely not to be configured on the CPE device ... > > > > Neither is PPP. > > The customer will never get the link up if he/she doesn't > configure PPP, he/she will get link up if the link is configured > for HDLC but they havn't configured 'down-when-looped' The customer's failure to configure "down-when-looped" on his end will not adversely affect the behavior of "down-when-looped" on your end. But this argument is really pedantic and silly. Can we call it quits? Please? ---rob

2 1

Cisco DS3 Questions..
by Gyorfy, Shawn 25 Feb '02

25 Feb '02

Since the topic exploded, what are your opinions on encapsulation of leased line DS3s. We currently use Frame Relay for out Point to Point DS3 connections. Personally, I don't know why we use FR as our encapsulation, and so the question to all. If you are running Cisco to Cisco, would it be wise to run HDLC or PPP? Our DS3s' here are hardly maxed out, 15% or so, so I'm not complaining about the few extra bits I can squeeze out them but maybe that 15% can shrink to 10% with less overhead. Opinions or examples of life appreciated. Thanks shawn -----Original Message----- From: Iljitsch van Beijnum [mailto:iljitsch@muada.com] Sent: Wednesday, February 20, 2002 4:28 PM To: Jon Mansey Cc: nanog(a)merit.edu Subject: Re: Cisco PPP DS-3 limitations - 42.9Mbpbs? On Wed, 20 Feb 2002, Jon Mansey wrote: > OMG! Arent we missing the point here? What about never running links above > 60% or so to allow for bursts against the 5 min average, and <shudder> > upgrading or adding capacity when we get too little headroom. > And here we are, nickel and diming over a few MBps near to 45M on a DS3... And why not? Obviously there is a reason why they're not upgrading, because there is plenty of traffic to fill up a second or faster circuit if packets are being dropped because of congestion. (Which has not been confirmed so far.) There shouldn't be any problems pushing a DS3 well beyond 99% utilization, by the way. With an average packet size of 500 bytes and 98 packets in the output queue on average, 99% only introduces a 9 ms delay. The extra RTT will also slow TCP down, but not in such a brutal way as significant numbers of lost packets will. Just use a queue size of 500 or so, and enable (W)RED to throttle back TCP when there are large bursts.

10 11

IEPG in Minneapolis?
by Howard C. Berkowitz 25 Feb '02

25 Feb '02

Will there be an IEPG on Sunday?

1 0

The Cidr Report
by CIDR Report 23 Feb '02

23 Feb '02

This is an auto-generated mail on Fri Feb 22 23:00:00 PST 2002 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. NEW: Check http://www.employees.org/~tbates/cidr-report-region.html for the regional version of this report. NEW: Check http://www.employees.org/~tbates/autnums.html for a complete list of autonomous system number to name mappings as used by the CIDR-Report. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to GX Networks for giving me access to their routing tables once a day. Please send any comments about this report directly to CIDR Report <cidr-report(a)cisco.com>. ------------------------------------------------------------------------------ CIDR REPORT for 22Feb02 0) General Status Table History ------------- Date Prefixes 150202 105693 160202 105736 170202 105803 180202 105879 190202 105989 200202 106186 210202 105821 220202 106236 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 96.0.0.0/20 from AS3549 AS Summary ---------- Number of ASes in routing system: 12451 Number of ASes announcing only one prefix: 7566 (4299 cidr, 3267 classful) Largest number of cidr routes: 728 announced by AS701 Largest number of classful routes: 1369 announced by AS701 1) Gains by aggregating at the origin AS level --- 22Feb02 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS1221 1150 886 264 23.0% Telstra Pty Ltd AS701 1369 1125 244 17.8% UUNET Technologies, Inc. AS17557 224 96 128 57.1% Pakistan Telecom AS7018 836 712 124 14.8% AT&T AS577 320 197 123 38.4% Bell Advanced Communications Inc. AS16473 198 77 121 61.1% Bell South AS4151 254 149 105 41.3% USDA AS705 309 205 104 33.7% UUNET Technologies, Inc. AS852 425 324 101 23.8% Telus Advanced Communications AS6595 150 55 95 63.3% DoD Education Activity Network As AS7046 324 239 85 26.2% UUNET Technologies, Inc. AS19632 94 9 85 90.4% Metropolis Intercom S.A. AS2048 186 105 81 43.5% State of Louisiana AS12302 110 31 79 71.8% MobiFon S.A. AS1239 482 405 77 16.0% Sprint AS4323 432 356 76 17.6% Time Warner Communications, Inc. AS4755 221 147 74 33.5% Videsh Sanchar Nigam Ltd. Autonom AS3908 339 271 68 20.1% Supernet, Inc. AS3464 157 97 60 38.2% Alabama SuperComputer Network AS724 215 156 59 27.4% DLA Systems Automation Center AS7303 106 48 58 54.7% Telecom Argentina Stet-France Tel AS16758 63 6 57 90.5% IKON Office Solutions AS226 145 89 56 38.6% Los Nettos AS19834 63 8 55 87.3% NetForce, Inc. AS10620 77 22 55 71.4% TVCABLE BOGOTA AS9051 75 22 53 70.7% INCONET Autonomous System AS702 621 568 53 8.5% UUNET Technologies, Inc. AS703 271 219 52 19.2% UUNET Technologies, Inc. AS2149 305 253 52 17.0% Performance Systems, Inc. AS209 300 248 52 17.3% Qwest Total 53958 42075 11883 22.0% For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

XO Communication expects to file for bankruptcy
by Joe Blanchard 22 Feb '02

22 Feb '02

FYI > XO Communication expects to file for bankruptcy--report > > NEW YORK, Feb 21 (Reuters) - Voice and data services firm XO > Communications > Inc. (OTC BB:XOXO.OB - news) expects to file for Chapter 11 bankruptcy > protection within the next two weeks, Business Week magazine reported on > Thursday. > > XO, founded by wireless pioneer Craig McCaw, said on Nov. 29 that buyout > firm Forstmann Little and Mexican telecommunications firm Telefonos de > Mexico S.A. de C.V. planned to invest $400 million each in XO. > > But XO said the restructuring, if completed, would essentially leave > current stockholders with nothing. > > Business Week reported that XO expects to file for bankruptcy protection > in > order to convince debtholders to agree to the restructuring plan. > > ``It could happen in days; it could be two weeks,'' a source close to XO > told the magazine. > > XO was not immediately available for comment. >

2 1

RE: [nsp] Cisco DS3 Questions..
by Martin, Christian 22 Feb '02

22 Feb '02

> link in a controlled way. Not saying that's a particularly > good use, just > that that's the most common reason I've seen it deployed on otherwise > simple point-to-points. The idea behind frame relay is that > it gives you > a multipoint layer-2 protocol to use on a more complicated network of > circuits. > > -Bill It can also be used to 'equalize' two links of different speeds in such a way that you can do reasonable equal-cost load-balancing. For example, if you have a DS3 and an OC3, you can create 3 FR subinterfaces on the OC3 and add the DS3 to the mix to give you essentially 4 DS3s. There is a slight speed difference, but it is minimal. This can be done for 2 OC-12s and an OC-48, for example. Another reason for virtualizing a ptp circuit is for differentiate billing in a MPLS VPN environment with an Internet offload component. You can direct VPN traffic on one VC and Internet on the other, and then take advantage of basic MIB-II stats for billing and per-(sub)interface CAR for enforcement of contract and reclassification, etc. regards, chris

1 0