- NANOG - lists.nanog.org

Re: Malformed AS PATH
by Marshall Eubanks 14 Sep '01

14 Sep '01

> >> >> >Well, I got this as AS 16517. s/as/at/ > >Can you be more specific. The 6:00 am >status run is going on right now, but my initial probes >into the routers seems OK. > >Except - >show ip bgp incon >reveals a LOT of inconsistent routes - I will know a lot more in >about 10 minutes. > Everything seems normal here - the inconsistent routes were present 24 hours ago, so I do not think that they are caused by your problem. Regards Marshall Eubanks >Regards >Marshall Eubanks > >>-----BEGIN PGP SIGNED MESSAGE----- >>Hash: SHA1 >> >>Not that anyone will ever get this as I'm in penalty box hell, but >>did that malformed as_path just hit every1 else? We saw our eleet >>RFC compliant edge gear disconnect itself from every ebgp peer.. Can >>anyone confirm seeing this elsewhere? > >> >> >> >>Regards, >>Matt >> >> >>- -- >>Matt Levine >>@Home: matt(a)deliver3.com >>@Work: matt(a)easynews.com >>ICQ : 17080004 >>PGP : http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x6C0D04CF >> >>-----BEGIN PGP SIGNATURE----- >>Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> >> >>iQA/AwUBO6GuMMp0j1NsDQTPEQLMtgCgxkznNF9nTA0FhjSQ7U1Ev91795IAoKtv >>Cy0FmfqfO7YHLwJ5iaHFtUeU >>=8PfI >>-----END PGP SIGNATURE----- >> >> Marshall Eubanks tme(a)21rst-century.com

1 0

Re: Emergency Alert System TEST - This is only a TEST
by Marshall Eubanks 14 Sep '01

14 Sep '01

> Dear Sean; Do you know if they are interested in webcasters and other Internet news / entertainment services ? Regards Marshall Eubanks >FEMA will be conducting a TEST of the primary entry point system >for the Emergency Alert System. The Emergency Alert System is >the successor to the Emergency Broadcast System, and is frequently >used for tornado warnings, hurricane warnings, flash floods warnings >and so forth. It is also designed, but never in history used, for >Presidential messages to the nation. > >The FCC Compliance Bureau has suspended all other testing of the >Emergency Alert System for 30 days. However, some automated broadcast >stations may send a test message without operator intervention. > >If the EAS is activated in your area listen carefully if it is a >test or a real activation. The EAS has been accidently activated >in the past, so if it is activated, avoid undue panic and listen >carefully. Severe weather alerts using the EAS are continuing. > >Most broadcast AM/FM, television and cable systems participate in >the Emergency Alert System. However, participation is voluntary. >Individual stations may or may not be participate. Non-participating >stations will go off the air during a national EAS activation. > >Once again, this is a TEST. This is only a TEST. > >> GREETINGS: >> >> THE PRIMARY ENTRY POINT SYSTEM WILL BE TESTED IN THE NEXT FEW DAYS. THE >> TESTS WILL BE CLOSED CIRCUIT AT BEST. THERE MAY BE SOME AUDIO PASSED AS >> PART OF THE TEST. IN ONE CONFIGURATION THE PEP CONFERENCE IS INVOKED, BUT >> ENDECS ARE NOT ADDRESSED OR POLLED. >> >> DAVE PIPER AND I HAVE GONE OVER THE TEST PLAN TO CONFIRM THAT IT IS WITHIN >> THE PEP SPECIFICATIONS. REST ASSURED THAT THE PEP SYSTEM WILL NOT BE >> ACTIVATED WITHOUT PROPER AUTHORIZATION AND APPROVAL. >> >> I WILL TRY TO MAKE THE RESULTS OF THE TEST AVAILABLE VIA THIS SITE, TIME AND >> WORKLOAD PERMITTING. >> >> I HAVE HAD A LOT OF E-MAILS ON THE TESTING, THANK YOU FOR YOUR COMMENTS AND >> INPUT. CIRCUMSTANCES ARE SUCH THAT THE TESTING MUST BE ACCOMPLISHED AT THIS >> TIME. >> >> PUTPRUSH SENDS >> >> TIMOTHY L. PUTPRUSH, FEMA PEP PROJECT MANAGER > > > Marshall Eubanks tme(a)21rst-century.com

1 0

Re: 25 Broadway...
by Marshall Eubanks 14 Sep '01

14 Sep '01

> >On Thu, 13 Sep 2001, Keith Woodworth wrote: > > > The Dante US world service (provides international connectivity to some >of the ten-155 european academic network members) is there for example. And we have lost all connectivity to Dante and points beyond (26 ASN in all). Regards Marshall Eubanks > >--Ariel >> >> ok as I dont know but who/what is housed in 25 broadway in regards to >> equipment? If it goes down how serious an affect will it be? >> > >-- >Ariel Biener >e-mail: ariel(a)post.tau.ac.il >PGP(6.5.8) public key http://www.tau.ac.il/~ariel/pgp.html > > Marshall Eubanks tme(a)21rst-century.com

1 0

Re: Malformed AS PATH
by Marshall Eubanks 14 Sep '01

14 Sep '01

> > Well, I got this as AS 16517. Can you be more specific. The 6:00 am status run is going on right now, but my initial probes into the routers seems OK. Except - show ip bgp incon reveals a LOT of inconsistent routes - I will know a lot more in about 10 minutes. Regards Marshall Eubanks >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >Not that anyone will ever get this as I'm in penalty box hell, but >did that malformed as_path just hit every1 else? We saw our eleet >RFC compliant edge gear disconnect itself from every ebgp peer.. Can >anyone confirm seeing this elsewhere? > > > >Regards, >Matt > > >- -- >Matt Levine >@Home: matt(a)deliver3.com >@Work: matt(a)easynews.com >ICQ : 17080004 >PGP : http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x6C0D04CF > >-----BEGIN PGP SIGNATURE----- >Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> > >iQA/AwUBO6GuMMp0j1NsDQTPEQLMtgCgxkznNF9nTA0FhjSQ7U1Ev91795IAoKtv >Cy0FmfqfO7YHLwJ5iaHFtUeU >=8PfI >-----END PGP SIGNATURE----- > > Marshall Eubanks tme(a)21rst-century.com

1 0

List of port numbers used by P2P applications?
by Chris Boyd 14 Sep '01

14 Sep '01

Has anyone compiled a reasonably complete list of P2P filesharing application port numbers? I've got the following so far: 1214 - napster and the like 5000 5555 6346 - Gnutella and clones 7777 8311 8875 8888 - AudioGalaxy? 6257 - WinMX TCP 6699 - WinMX UDP Thanks for any input. -- Chris Boyd Director of Technology Apogee Telecom 512-493-8546

4 3

Malformed AS PATH
by Matt Levine 14 Sep '01

14 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Not that anyone will ever get this as I'm in penalty box hell, but did that malformed as_path just hit every1 else? We saw our eleet RFC compliant edge gear disconnect itself from every ebgp peer.. Can anyone confirm seeing this elsewhere? Regards, Matt - -- Matt Levine @Home: matt(a)deliver3.com @Work: matt(a)easynews.com ICQ : 17080004 PGP : http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x6C0D04CF -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBO6GuMMp0j1NsDQTPEQLMtgCgxkznNF9nTA0FhjSQ7U1Ev91795IAoKtv Cy0FmfqfO7YHLwJ5iaHFtUeU =8PfI -----END PGP SIGNATURE-----

1 0

OT Re: Analysis from a JHU CS Prof
by Eliot Lear 14 Sep '01

14 Sep '01

> OK. You need photo-id to get your boarding pass. Since I always use > e-tickets, the boarding pass is the only "paper" involved. Under normal circumstances for flights within the US the FAA seems not to require ANY form of ID. It's many of the *airlines* that require ID, supposedly in the name of security, but mainly to keep people from using other people's tickets. Continental does not enforce an ID requirement at SFO, for instance. You stick your credit or frequent flyer card in the machine and it spits out your boarding pass, which you then hand to the gate agent.

7 6

Re: IPSEC and PAT
by Steven M. Bellovin 14 Sep '01

14 Sep '01

In message <LCEKLACNFGLMOPOGNBNMMEBBCEAA.tim(a)eng.bellsouth.net>, "Tim Irwin" wr ites: > >I looked at this a while back... I am dusting off the cobwebs of my mind, so >no flames please. I believe that the NATing device must modify the SPI >values. The sending device sends out an ESP packet with src addy of, say >192.168.1.2, to the NAT router. The router must look at the TCP port to >determine that it's IPSEC in order to figure out that it's a special case >and NAT it. It then must modify the SPI value (which is partially made up >of the src IP address) as it leaves because the NAT dst device will use the >info in the SPI value in the formulation of it's reply. > >If this is wrong, please correct me... I'm interested in knowing as well. That doesn't work -- the SPI is protected by ESP's authentication check (section 2 of RFC 2406) or by AH (section 2 of RFC 2402). --Steve Bellovin, http://www.research.att.com/~smb http://www.wilyhacker.com

1 0

Re: IPSEC and PAT
by Tony Rall 14 Sep '01

14 Sep '01

On Thursday, 2001/09/13 at 21:43 AST, "Steven M. Bellovin" <smb(a)research.att.com> wrote: > I repeat -- it doesn't do PAT. Some "routers" -- they're really no > such thing, of course; they're NAT boxes and/or bridges -- allow one > host behind them to speak IPsec. If a host emits a packet using ESP, > it's tagged as *the* IPsec user; return IPsec packets are routed to > that host. (Some of these boxes may use manual configuration instead > or in addition.) You can't have two IPsec hosts, because there's no > way to know which should receive incoming packets -- there's no > relationship between inbound and outbound SPIs. Actually you can have multiple IPSEC sessions hidden behind a NAT box with a single public IP address - we've found several vendors' "routers" that can work in this environment. I believe the key is that each tunnel must be to distinct remote IP addresses. All the NAT box has available to separate the traffic for the different tunnels (which use IP protocol 50) is the address of the other end of the tunnel, but that is all it needs. Of course, many users would like to have multiple tunnels to the same partner. I don't know how that is possible with current IPSEC technology. Tony Rall

4 3

Further considerations for the future
by George William Herbert 14 Sep '01

14 Sep '01

I posted on Wednesday regarding some long term network issues that I thought were raised by the NYC attacks. An additional one has occurred to me from some subsequent events. For organizations which are dependent on the net for day to day operations (despite the dot-com collapse, the number of these is steadily increasing) the acceptability of single homing is likely to have decreased significantly. I addressed this a bit with the significance of true separation in physical links that I brought up in the first mail. Beyond that, though, we have seen that whole facilities can be outright destroyed or fail due to cascading infrastructure and backups failures as in 25 Broadway (are your generators n+1 redundant...and do you stock spare water pumps for them?). This really means that except for truly extraordinary ISPs, no end customer can really be sure that an ISP is going to be able to maintain services through a major incident (or even a localized serious incident). Expect to see in the coming months many more end customers desiring to get truly dually homed, with redundant ISPs, redundant local loops in different directions, etc. We should be prepared to deal with the additional routing and provisioning complexity involved in handling additional customers doing BGP, dual homing, etc., both new customers coming for their second connection and existing customers as they reach out to a second ISP for the redundant connectivity. -george william herbert gherbert(a)retro.com

1 0