- NANOG - lists.nanog.org

Security Problem
by Diamond Technology Group 12 Jul '01

12 Jul '01

I'm working with some techs at sega.com to address a security problem. We are having trouble finding a technical contact for on.wave.home.com. Seems there is an endless shuffle. If anyone has a contact related to this, please forward to me offlist. Jeff Johnstone Diamond Technical Group Ltd.

1 0

RE: DDoS attacks
by Roeland Meyer 12 Jul '01

12 Jul '01

> From: Rob Thomas [mailto:robt@cymru.com] > Sent: Wednesday, July 11, 2001 8:24 PM > > ] I happen to agree, if only because; when script kiddies > don't have IRC to > ] play with they'll start looking elsewhere. I'd rather them > have an IRC net > ] to play with while they're being hunted. Wouldn't you? > > Agreed. Keep in mind that when the kiddies really want to > test something > nasty, they simply build their own (hidden and secured) IRC servers in > which to park the zombies. So a paucity of IRC > servers/networks isn't an > issue to them. > > Eradicating IRC isn't the solution. IRC is the "SOSUS net" > of DDoS. It > would be wise if everyone paid close attention to what is discovered > therein. Of course, it also wouldn't hurt if we actually STARTED a script-kiddie hunt, while they're making themselves so visible/vulnerable, rather than kvetching at the victim, neh?

1 0

RE: MPLS Deployments?
by Irwin Lazar 11 Jul '01

11 Jul '01

There are currently over 20 production MPLS networks in the world. A list of service providers can be found in the MPLS FAQ at www.mplsrc.com irwin ----- Irwin Lazar - ilazar(a)tbg.com <mailto:ilazar@tbg.com> Senior Consultant, The Burton Group Office: 703-742-9659 Cell: 703-402-4119 http://www.tbg.com/ "The Ultimate Resource For Network Architects" -----Original Message----- From: Serbest, Yetik [mailto:serbest@tri.sbc.com] Sent: Wednesday, July 11, 2001 11:06 AM To: 'nanog(a)merit.edu' Subject: MPLS Deployments? Hi, We would like to get some information on MPLS deployments in Today's networks. Specifically, we are interested if there are any large scale deployment with MPLS traffic engineering capabilities. Are the MPLS deployments today just best-effort tunnels based on destination prefixes? Any response is appreciated, thanks, Yetik Serbest SBC-TRI

1 0

MPLS Deployments?
by Serbest, Yetik 11 Jul '01

11 Jul '01

Hi, We would like to get some information on MPLS deployments in Today's networks. Specifically, we are interested if there are any large scale deployment with MPLS traffic engineering capabilities. Are the MPLS deployments today just best-effort tunnels based on destination prefixes? Any response is appreciated, thanks, Yetik Serbest SBC-TRI

1 0

Re: Open Peers at PAIX
by Richard A. Steenbergen 10 Jul '01

10 Jul '01

On Thu, Jun 28, 2001 at 12:46:04PM -0600, Pete Ashdown wrote: > > What follows is a list I compiled of organizations at PAIX who peer > without restrictions. Restrictions are "requirements" like nationwide > [...] > > Organization IP address AS# Email contact > > AboveNet 198.32.176.11 6461 noc(a)above.net > Exodus 198.32.176.15 3967 peering(a)exodus.net > Global Crossing 198.32.176.29 3549 peering(a)gblx.net These are the only large service provider networks I see listed. AboveNet would probably peer with a bum on the street outside PAIX if he could speak BGP, but AFAIK GBLX's requirements were at least 3 locations and bi-costal at a minimium. If I remember correctly Exodus is also slightly picky about its "ghetto peers", probably falling somewhere the middle of the other two. The rest of the list seems to basically fall into the categories of other "tier 2" regionals (Hurricane Electric, Maxim, etc), content looking for a way to save money on their transit bill (Hotmail, EA, etc), Asian networks who have a circuit to the US but aren't willing to cross it and will take any peers they can get (SingTel, KDD, etc), and misc small networks with little overwhelming value. Seems almost all the larger service providers are requiring at least bi-costal these days. You also missed a couple of the email contacts, abov is peering@ and lightning is not noc(a)cp.net :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

9 11

This frogans thing? Hoax?
by dani＠roisman.com 10 Jul '01

10 Jul '01

I'm sure you've all received your "reserve your frograns address now" emails by now. We're debating internally whether this is an elaborate hoax, or a dot.bomb that hasn't yet run out of VC cash. I'm interested in nanog'ers take on it? - Dani

2 1

OT: The End of Empire
by Mikey Wilsker 10 Jul '01

10 Jul '01

Something to perk up your Tuesday... -- mikey Forwarded-by: Gene Spafford <spaf(a)cerias.purdue.edu> Forwarded-by: David Farber <dave(a)farber.net> Forwarded-by: Stuart Staniford [mailto:stuart@silicondefense.com] Forwarded-by: Shamim Mohamed <shamim(a)languid.org> Darth Vader took two giant strides toward the immense visiscreen that occupied the forward wall of the bridge of his flagship Imperial star destroyer. "We've got them now," he rumbled. Whirling on the technicians cowering at their consoles, Vader snapped, "Tractor beam!" "Yes, Lord Vader," replied one, bending attentively to his task. Then he looked up hesitantly. Vader gestured dramatically at the screen, indicating the fleeing spacecraft. "I want a tractor beam on that ship," he declared. "Now!" The technician busied himself with switches and dials. "Where's that tractor beam?" roared Vader, his voice dark with menace. The other technicians turned frightened eyes on their peer. They knew what happened when Darth Vader's instructions weren't executed instantly. "The tractor beam seems to be down, sir," quavered the technician. "What do you mean down?" Vader inquired with a disturbing silkiness to his voice. "It's not accepting commands, sir," the technician explained. Another technician leaned over and examined the console. "That's odd. The beam itself is showing green," he pointed out. "Yes, I know," agreed the first. "But I'm not getting any acknowledgment to my 'Engage' command." He pressed a button several times to demonstrate. "Maybe the network's down again," suggested a third technician. "Oh, that could be," admitted the first technician. "The network might be down, Lord Vader," he informed the large black figure trembling with rage. "What network?" Vader asked ominously. The second technician jumped in. "Since we've moved to a distributed architecture on the Imperial star destroyers, everything is on a network. It was felt that the direct connections were too unreliable." The third technician added. "The tractor beam is on one of the peripherals sub networks, with the printers and the scanners. It's not on the main weapons network." "Why isn't the tractor beam on the weapons network?" asked Vader, now more puzzled than angry. The technicians exchanged sheepish looks. It was embarrassing to have to point out something so obvious to a superior. The second technician cleared his throat. "Well, sir, the weapons network is a higher priority. It makes more sense to put the less commonly used systems on a separate sub network that has lower QOS." "QOS?" Vader queried. "Hang on a second," said the first technician. "If the network is down, how come we're getting a green light for the tractor beam?" The third technician brightened. "Ah! Maybe the console is retrieving old MIB data and displaying that." "MIB?" rumbled Vader. The first technician answered "We use SNMP to monitor the network elements. When the server queries the element, it stores its current status. If the network goes down, it can't query the element anymore, and all you have is the latest status in the MIB." He turned to the other technicians, musing. "We really should have an indicator of when the last successful query was, instead of just a green or red light." "Good idea," said the third technician. "I'll call tech support." "Say," said the second technician. "How about if we ping the tractor beam? Let me bring up a telnet window." "Telnet?" asked Vader, now obviously confused. "Ping?" The first technician glanced briefly at Vader, a little annoyed at the interruptions. Why couldn't this guy keep up with the service bulletins? "The system runs Unix, but the consoles run NT 5000," he replied with exaggerated patience. "You need a telnet window to ping the element." He turned his attention back to the screen. "That's strange. It comes back 'active'. Listen, when you get tech support tell them we can't engage the tractor but we can ping it." "Right," said the third technician. "I'm still on hold." "Here's a thought," said the second technician. "What if we just call the guys down at tractor control and have them engage the beam manually?" Vader seemed to brighten up at this, and swiveled his head from one to another. "Good idea," said the first technician. He lifted his communicator and tapped the switch several times. "Nothing," he said. The second technician shook his head. "Didn't we tell them we couldn't do voice and data with that little bandwidth?" Suddenly Vader noticed the visiscreen and let out a bellow of anger. "They're gone!" he boomed. The third technician looked up smiling. "Hey, I got tech support!" -- .--------------------------------------------------------------, |Michael Wilsker Director, Network Engineering | |mikey(a)interpacket.net and Operations | |Tel: +1.310.382.3344 ,---------, Verestar, Santa Monica | '-----------------------' `--------------------------' "Satellite in my eyes - Like a diamond in the sky" - DMB

1 0

space wanted in 1220 L, 25 Broadway and 60 Hudson
by alex＠yuriev.com 10 Jul '01

10 Jul '01

Hello, I am looking for (1/4 rack to 1 rack) in 1220 L in DC and 25 Broadway in NYC, and 60 Hudson in NYC. If anyone has any pointers, I would greatly appreciate it. Should one be a sales person, please feel free to contact me for RFQ. Thanks, Alex

1 0

Getting an AS and /18
by Andy Ellifson 10 Jul '01

10 Jul '01

I have a customer that is a cable modem provider. They submitted the form to request an AS and some address space. The response from ARIN wanted a ton of documentation. I understand why ARIN requires all of the documentation. Does ARIN require a ton of SWIPS be present for the customer before they will issue address space? This customer genuinely needs the address space but doesn't have the time to gather up all the information that is 'required'. Does anyone know of a person they can talk to at ARIN to help with this process? -Andy Ellifson __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

21 29

Cisco RFC1997 implementation clarification.
by John Fraizer 10 Jul '01

10 Jul '01

While researching an RFC1997 issue this morning, I made the following observations: According to RFC1997: " Well-known Communities The following communities have global significance and their operations shall be implemented in any community-attribute-aware BGP speaker. NO_EXPORT (0xFFFFFF01) All routes received carrying a communities attribute containing this value MUST NOT be advertised outside a BGP confederation boundary (a stand-alone autonomous system that is not part of a confederation should be considered a confederation itself). NO_ADVERTISE (0xFFFFFF02) All routes received carrying a communities attribute containing this value MUST NOT be advertised to other BGP peers. NO_EXPORT_SUBCONFED (0xFFFFFF03) All routes received carrying a communities attribute containing this value MUST NOT be advertised to external BGP peers (this includes peers in other members autonomous systems inside a BGP confederation). " On Cisco's site at http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/12cgcr/np1_… I find the following: " internet - Advertise this route to the Internet community. All routers belong to it. no-export - Do not advertise this route to EBGP peers. no-advertise - Do not advertise this route to any peer (internal or external). local-as - Send this route to peers in other sub-autonomous systems within the local confederation. Do not advertise this route to an external system. " Unless I'm mistaken, there are some potential interop issues with this. CISCO no-export = RFC1997 NO_EXPORT_SUBCONFED CISCO no-advertise = RFC1997 NO_ADVERTISE CISCO local-as = RFC1997 NO_EXPORT Can someone more familiar with the RFC1997 implementation in IOS comment on this? Thanks, --- John Fraizer EnterZone, Inc

2 1