- NANOG - lists.nanog.org

RE: Update: CSX train derailment
by Rowland, Alan D 23 Jul '01

23 Jul '01

Not to mention almost continuous on-going Corps Of Engineers dredging operations. -Al -----Original Message----- From: Randy Bush [mailto:randy@psg.com] Sent: Saturday, July 21, 2001 12:48 PM To: up(a)3.am Cc: nanog(a)merit.edu Subject: RE: Update: CSX train derailment > I would think that if fiber can be run across oceans without using tunnels > or bridges, that it could be run across some rivers much the same way, no? the biggest exposure to cut for wet fiber is shallow water. anchors, idiots, ...

1 0

RE: *.mil:80 disconnected in self-defense?
by Roeland Meyer 23 Jul '01

23 Jul '01

As soon as CERT released info on the IIS exploit, before Code Red, we yanked all our IIS servers down. We are moving those vhosts back to OpenLinux-Apache/FrontPage. > -----Original Message----- > From: George William Herbert [mailto:gherbert@retro.com] > Sent: Monday, July 23, 2001 2:04 PM > To: nanog(a)merit.edu > Cc: gherbert(a)gw.retro.com > Subject: *.mil:80 disconnected in self-defense? > > > > > I have a report that .mil disconnected port 80 traffic > from outside hosts, and possibly some other stuff, > in response to DOS attacks last week. > > There was some discussion on the inetproviders list this > morning on the topic, and then I asked someone inside > who confirmed the cutoff and said there's a DISA alert > and operational bulletin about it. > > It seems to be Just One of Those Months. > > > -george william herbert > gherbert(a)retro.com >

1 0

*.mil:80 disconnected in self-defense?
by George William Herbert 23 Jul '01

23 Jul '01

I have a report that .mil disconnected port 80 traffic from outside hosts, and possibly some other stuff, in response to DOS attacks last week. There was some discussion on the inetproviders list this morning on the topic, and then I asked someone inside who confirmed the cutoff and said there's a DISA alert and operational bulletin about it. It seems to be Just One of Those Months. -george william herbert gherbert(a)retro.com

2 1

RE: Netflow bug on 3-GE cards (Trident) in Cisco GSRs
by David Sinn 23 Jul '01

23 Jul '01

I'm sorry, but ACL's are support on E0's and E1's. Who ever told you otherwise is incorrect. I worked on numerous accounts while at Cisco, and have multiple deployments at my new employers where ACL's are implemented on E1 8-port FE, E1 1-port GE, E0 1-port ATM OC12, E1 12-port DS3's, plus many others. This includes GSR's running 12.0(6)S, 12.0(9)S, 12.0(14)S, 12.0(16)S, and 12.0(17)S1 (plus numerous images in-between that I can't remember). Are you confusing the limitation that the ACL's must be inbound and not outbound? Another words when you went to migrate your 7500's config, which probably followed prior recommendation outbound ACL's, it failed? Because of the design of the GSR, all ACL's are actually process on the inbound interface, regardless of how you define the ACL's (this will change with the E3 and E4+ based cards), and given certain versions of IOS you can define outbound ACL's that the router translates into inbound ACL's for you (again with further limitations). This is highly looked down upon by the TAC. I also do not believe that they are planning a 10 port GE card based on the E3. It is also a 2.5 Gig engine, so you would have massive over subscription would that turn out to be the case. E4's are the 10Gig engine, and there are various ones underdevelopment, but you should talk to your account team about the status of them. David -----Original Message----- From: Andrew C. Ohnstad [mailto:andrewo@gblx.net] Sent: Monday, July 23, 2001 11:12 AM To: David Sinn Cc: Mikael Abrahamsson; nanog(a)merit.org Subject: Re: Netflow bug on 3-GE cards (Trident) in Cisco GSRs On Mon, Jul 23, 2001 at 10:42:26AM -0700, David Sinn wrote: > I beg to differ. > > As a former employee of Cisco, you comments about ACL's on E0 and E1 > cards are totally off base. I'm not sure where you got this > "information", but it is most certainly not the case. > > Standard ACL's & Extended ACL's have been supported by the E0's and E1's > that were released in 12.0(5)S (most) and 12.0(6)S (2 port OC-12 DPT) > versions of IOS. This includes the 8 port FE and 1 port GE cards. This > includes support by the development organization that oversees software > on the GSR, and by the TAC. (Whether the TAC engineer is capable of > supporting you is another issue.) I apologize, I made a couple mistakes in my response. ACLs are not supported on E0 and E1 Gig/FE cards. You used to be able to do them anyways, but they didn't work. They were removed in recient releases. They will be supported by (and re-enabled on) the Engine3 10 port GigE cards under development. We found this out the hard way when we upgraded a pair of GSR with GigE "DMZ" type interfaces behind it. We had to scramble to install a 7xxx series routers to serve as dedicated DMZ routers and do the ACLs on them. -- =-=andrewo

1 0

RE: Netflow bug on 3-GE cards (Trident) in Cisco GSRs
by David Sinn 23 Jul '01

23 Jul '01

I beg to differ. As a former employee of Cisco, you comments about ACL's on E0 and E1 cards are totally off base. I'm not sure where you got this "information", but it is most certainly not the case. Standard ACL's & Extended ACL's have been supported by the E0's and E1's that were released in 12.0(5)S (most) and 12.0(6)S (2 port OC-12 DPT) versions of IOS. This includes the 8 port FE and 1 port GE cards. This includes support by the development organization that oversees software on the GSR, and by the TAC. (Whether the TAC engineer is capable of supporting you is another issue.) Turbo ACL's were added in 12.0(6)S for all E0 and E1 cards that were out at the time. One correct point in your statement is that newer rev's of software are better at not allowing you to implement ACL's on interfaces that the hardware/software doesn't support. This includes ACL's, NetFlow, CAR, and others. Further there is no E2 based 10xGIGE card. The E2 is only a 2.5Gig engine, so you can at MOST run 1/4 line rate, and they aren't that crazy. Did you mean the E4/E4+ based cards that are in development? David -----Original Message----- From: Andrew C. Ohnstad [mailto:andrewo@gblx.net] Sent: Monday, July 23, 2001 7:20 AM To: Mikael Abrahamsson Cc: nanog(a)merit.org Subject: Re: Netflow bug on 3-GE cards (Trident) in Cisco GSRs On Sat, Jul 21, 2001 at 09:37:36AM +0200, Mikael Abrahamsson wrote: > > On Fri, 20 Jul 2001, Dani Roisman wrote: > > > Turns out you can only run netflow on the first port of a 3-GigE port > > on the current S-tract software rev. If you have been struggling with > > this as well, I'm eager to hear about it off-list. > > In 12.0.15S you cannot use access-lists on subinterface on the 3GE either. > Wonder if that's a software bug too, or hardware limitation (like the MTU > difference on the 3GE compared to the 1GE). Actually Cisco has never supported ACLs on Engine 0 or Engine 1 cards in the GSR. Used to be that you could apply those ACLs, but they were implemented by the router very erratically. Cisco finally removed the ability to apply ACLs to an ineligible interface because the TAC was tired of telling people "it's not supported, even though it's there." Best wait another 6 months for the Engine 2 10xGIGE card which will support ACLs, or change to/add something from the 7xxx platform. DownReving the router isn't really an option, like I said because the ACLs never really worked right anyway. I don't remember the exact details (I can get them if anyone wants) but I believe it did something like arbitrarily testing random packets with random rules, whereas some packets would get thru without being checked at all. -- =-=andrewo

3 2

Re: Update: CSX train derailment
by George William Herbert 23 Jul '01

23 Jul '01

One of the things that may change over time is that some of the new drilling technologies being used in oil drilling, drilling with turns, angles, and horizontal drilling, may become viable for many telecom conduit builds. You can do about 5 horizontal miles today, and that would get you around or under nearly all obstacles such as rivers, and would in fact be enough to run deep *under* metro centers when you're trying to go through rather than into the builtup area. Those are more expensive to do than traditional trenching or hanging in existing rail tunnels or off bridges though, so it may not be cost effective except in limited areas. -george william herbert gherbert(a)retro.com

4 3

Redundant diversity and rights of way
by Roeland Meyer 23 Jul '01

23 Jul '01

> From: up(a)3.am [mailto:up@3.am] > Sent: Sunday, July 22, 2001 7:45 AM > Subject: RE: Update: CSX train derailment > > On Sat, 21 Jul 2001, Jamie Bowden wrote: > Subject: RE: Update: CSX train derailment > > > On Sat, 21 Jul 2001 up(a)3.am wrote: > > Subject: RE: Update: CSX train derailment > > > > > > > On Sat, 21 Jul 2001, Roeland Meyer wrote: > > > > Subject: RE: Update: CSX train derailment > > > > > > > > :Have you checked available rights of way lately? They > > > > :haven't changed much for quite a while. Telecom has > > > > :not really any ability to build dedicated bridges for > > > > :telcom fibre. It uses existing facilities wherever > > > > :possible. Following the paths of least cost/resistance, > > > > :this pretty much determines that rivers and bridges > > > > :become choke-points. The only real alternatives are > > > > :microwave towers (a cost/benefit argument I won't > > > > :touch, even with your ten-foot pole). > > > > > > I would think that if fiber can be run across oceans > > > without using tunnels or bridges, that it could be run > > > across some rivers much the same way, no? > > > > How were [you] planning to get to that > > [river|stream|lake|etc]shore? The rights of way lead to > > existing bridges and tunnels. Buying a contiguous right > > of way in America is exorbitantly expensive, if it's even > > possible, which I highly doubt. If you're already at a > > bridge, tunnel, whatever, (because hey, that's where > > the existing right of way you're using takes > > you) why wouldn't you use it? > > I didn't think we were discussing right-of-way issues, so > much as diverse redundancy issues at "choke points" (see > above). If everybody's fiber goes through the same tunnel, > and the tunnel has a bad fire, that can lead to nasty > outages...wait, it just *did* that, didn't it (not that > this situation was even a river, but I digress)? Anyway, it > would seem that unless you bury it fairly deeply under the > riverbed, it ain't such a great idea. There goes my > Mensa application... Right of way and redundant diversity is deeply intertwined. One can't have diversity without redundant rights of way and one doesn't need redundant rights of way without the need for diversity. Having been through this, from the RBOC side, I can tell you that even the RBOCs have serious problems with this. Basically, the rights of way that are extant are often the ONLY rights of way obtainable. They were acquired decades ago, by AT&T and others, and any new rights of way are individually negotiated (and paid) at exhorbitant costs. It gets worse going through local municipalities that look at the telco as having near-government depth pockets (almost guaranteed to not be the case). Many of those municipalities also fly the "jolly roger" and don't mind resorting to extortionary practices (yes, were I still working at said RBOC, I would be disciplined for saying that). On the other hand, I can understand their [municipality] desire to integrate and consolidate the infrastructure going through their territory/domain and to minimize build-out impact and trenching activity in public areas. The problem is that this happens on a case by case basis and, in the case of an area like Los Angeles, mile by mile. This exacerbates the expense as cumulative cost, end to end, for a given route, increases with the number of municipalities that have to be paid along the way. I might point out that this is also deeply related to last-mile issues and why ILECs have such an advantage over CLECS. But, I digress. For rural routes and rights of way the problem is different and mainly based on geo-physical issues, like mountains, rivers, lakes, and fault-lines. As an example, many rights of way follow I-70, through the Rockies. This is because cutting an independent path, through 36 fourteeners, is enormously expensive and the Feds have already paid for I-70. Adding some conduit to an existing Interstate is substantially cheaper. It also gives you maintenance access to said conduit, that someone else will keep cleared, throughout the Rocky Mountain Winters. Tunnels and bridges are in this same catagory, as are oil pipelines and railroads. But, in each case, access to the right of way has to be negotiated with each owner. I guarantee that they've had the same issues, in obtaining their extant right of way, and will charge accordingly. IOW, it will be less expensive, but not by that much, usually involving some sort of revenue sharing. In short, one can theoretically demand redundant diversity of routes, but may not be able to achieve that goal in practice. Those that have higher expectations need to have those expectations examined. -- R O E L A N D M J M E Y E R Managing Director Morgan Hill Software Company t:01 925 373 3954 c:01 925 352 3615 f:01 925 373 9781

2 1

RE: Update: CSX train derailment
by Roeland Meyer 22 Jul '01

22 Jul '01

Have you checked available rights of way lately? They haven't changed much for quite a while. Telecom has not really any ability to build dedicated bridges for telcom fibre. It uses existing facilities wherever possible. Following the paths of least cost/resistance, this pretty much determines that rivers and bridges become choke-points. The only real alternatives are microwave towers (a cost/benefit argument I won't touch, even with your ten-foot pole). WRT the other comment about that MCI conduit on the tunnel wall, I have reports that temperatures are exceeding 1000F, near the fire. I submit that no amount of armor-clading is going to shield that cable, from those temps. The only cable that might survive is whatever may be buried under the road-bed. > -----Original Message----- > From: Brian Wallingford [mailto:brian@meganet.net] > Sent: Saturday, July 21, 2001 1:28 AM > To: Sean Donelan > Cc: nanog(a)merit.edu > Subject: Re: Update: CSX train derailment > > > > "Rivers and bridges"? > > Either Frank is sensationalizing his comments for the benefit of the > press, or he's been asleep since '93. > > Seems to me the so-called "choke-points" now are more social > and fiscal > than physical - I doubt rivers and bridges are much of an issue. > > > > > > :According to the Baltimore Sun, companies have laid 30,000 feet of > :emergency fiber to patch around the damage in the Howard Tunnel. > : > : "There was a ripple effect around the country with > corporate networks > : due to this Baltimore disaster," said Frank Stanton, an > executive with > : Lexent Inc., a New York-based company that repaired > fiber-optic cable > : after the World Trade Center bombing in 1993. "Everybody > thinks they > : have redundancy, but these type incidents show people > there are huge > : issues. When you cross rivers and bridges, these choke > points are the > : Achilles' heel." > : > :On the Washington DC to New York City fiber route, there seems to be > :at least one train derailment leading to significant network traffic > :re-routes every year. >

7 9

filtering whitehouse.gov?
by Sabri Berisha 22 Jul '01

22 Jul '01

Hi all, A couple of days ago I mentioned here that I have nullrouted the IP which whitehouse.gov resolves to. After that I received some mail in private mentioning not only the fact that I filtered the wrong IP (that's fixt now) but also the dangers of posting about such a thing here. "Hey, he nullroutes them, let's do it too!". My decision to nullroute whitehouse.gov was based on the following: - the traceroute from my net to whitehouse.gov goes through AT&T which means that any DoS packets originating from our network will affect that network too; - my customerbase is not that type that would visit whitehouse.gov frequently nor would whitehouse.gov (if coming from that IP as a source) be interested in any of my customers; - most of the boxes in our network have a 100mbit/s nic in their box. Our main uplink is a STM-1 at the moment so if a colocated NT box would be compromised, that would give a huge effect. Imagine what would happen if 2 or three boxes are infected. After careful consideration we (our engineering team and the CEO) decided we would not want to be a part of any attacks against the US government or any other network. If you have any reasons to believe you need to blackhole whitehouse.gov please do so, but don't blackhole just because others do it as well. -- /* Sabri Berisha CCNA,BOFH,+iO O.O speaking for just myself * Join HAL!!: www.HAL2001.org ____oOo_U_oOo____ http://www.bit.nl/~sabri * "We deliver quality services, we just can't get it on the internet" * Anonymous sysadmin - on IRC */

5 6

RE: Update: CSX train derailment
by Roeland Meyer 22 Jul '01

22 Jul '01

> From: up(a)3.am [mailto:up@3.am] > Sent: Saturday, July 21, 2001 9:50 AM > > On Sat, 21 Jul 2001, Randy Bush wrote: > > > > I would think that if fiber can be run across oceans > without using tunnels > > > or bridges, that it could be run across some rivers much > the same way, no? > > > > the biggest exposure to cut for wet fiber is shallow water. > anchors, > > idiots, ... > > Yes, I can see that; but I imagine you could handle this much the way > fiber is handled near the shoreline. Bury it a few feet > under the mud or sand. Not trivial when erosion makes huge changes in river beds. Please plot changes in the lower Mississippi River for the past 200 years. Note the, sometimes, seasonal changes. Note also, the regular changes in sand-bar locations along the entire length of same river. It is definitely a more chaotic environment than your average seashore.

1 0