- NANOG - lists.nanog.org

PSINet and C&W peering
by Mitchell Levinn 05 Jun '01

05 Jun '01

C&W did indeed shutdown their peering connections to PSINet this weekend. While there are many potential explanations for their actions, I have no visibility into their decision process. I am disappointed with their decision to disconnect. PSINet continues to seek a resolution with C&W to restore normal connectivity in order to avoid further negative impact to both companies and the Internet. Their decision is hard to understand based on the following: - C&W and PSINet upgraded circuits used for peering between the two networks earlier this year. C&W's recent action seems inconsistent with the strategy that led to these upgrades. - PSINet's recent addition of direct private peering with several of C&W's transit customers relieved the peering connections between the networks of a couple hundred Mbps of traffic (improving connectivity overall and, undoubtedly, lowering costs for those transit customers). This is significant only because C&W claims PSINet no longer has sufficient traffic to justify the connections according to their published standards. In fact, PSINet's overall traffic continues to grow. - Most of the PSINet traffic previously destined for sites behind C&W has alternative paths through other providers. While this sounds like a generally good thing, especially given the actions C&W has taken, it does make it difficult for those that require certain traffic levels to be maintained consistently for peering. Specifically, C&W's customers (or C&W itself) could alter "natural" traffic flow to favor (or not) various connections to meet their published standards (or not). PSINet demonstrated to C&W that if naturally less favorable announcements were preferred, PSINet could make an almost arbitrarily large (or small) amount of traffic flow between the peers. Even so, in C&W's opinion, PSINet will not be able to comply with their peering policy's traffic standards. It is gratifying to note that even without C&W peering, substantially all of the traffic previously flowing between PSINet and C&W continues to be delivered. - At this time PSINet has not disabled the C&W peering interfaces nor decommissioned any facilities. If C&W chooses to, they can re-enable interfaces on their side and bring back the connectivity lost between their non-transit customers and PSINet. PSINet remains open to discuss with them a new bilateral peering agreement if they so choose. PSINet remains committed to servicing its customers and the Internet with the best possible infrastructure and policies. PSINet still maintains hundreds of peering connections with other ISPs throughout the world. While posting about matters between PSINet and its peering partners is not typical, the circumstances and questions arising from C&W's decision required some clarification. Hopefully this additional clarification helps everyone understand the current situation. -Mitch Levinn PSINet

12 14

Re: small exchanges (was: Re: PSINet and C&W peering)
by Jim Mercer 05 Jun '01

05 Jun '01

On Tue, Jun 05, 2001 at 02:01:57PM -0400, up(a)3.am wrote: > I've been starting to think about this...how is the financial burden > divided? Who pays for the facilities? Say you have a good place, with > lots of room, power, cooling, etc. Is it reasonable to collect some sort > of colo or cross-connect fees from your peers? Of course, if everyone > comes to you, they have to pay for the loops, and you don't... the operating expenses can be substantially reduced if the parameters are defined appropriately. torix is physically managed on a best-effort basis by a core group of techs from the founding members. techs from newer members are welcome to help out. not that there are that many techical issues. TorIX is a switch (well, hopefully soon, two switches). there is not alot of management, or failure points there. the interface is cat5, 10 or 100mbit ethernet. there is some talk about getting gigE ports added, but that doesn't make things more complicated. the location of the switch is what is most important. it needs to be in a reasonably neutral place, and one that lots of people can drag circuits to. in the case of TorIX, this is in the RACO facilities at 151 front. cat5 can be dragged from anywhere in the building (at the members expense) or external circuits pulled in (again at the members expense). the location of the switch is currently in a members space, but a second switch is being installed in a RACO common area to provide more neutrality. we are also open to putting other switches in other places. no one member "owns" TorIX. TorIX is not intended to be a full-bore MAE-North. at a recent meeting some people were interested in making it more "professional" complete with SLA's and paid-staff, etc, etc. my comment was that they were welcome to start TorIX-II, but there was no reason to disband or mutate the existing facilities. for a small exchange, especially if you are looking to start with small or medium ISP's, you need to keep the monthly costs as low as possible. with TorIX, those monthly fees are zero. but each member bears their own costs of getting to the switch. -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Now with more and longer words for your reading enjoyment. ]

1 0

TorIX contact info
by Jim Mercer 05 Jun '01

05 Jun '01

i've gotten a number of queries about "how do i get in?" etc. www.torix.net is, well, functioning non-optimally. there is some statistical info at: http://torix.golden.net/~torix/ and an email to torix-info(a)torix.net will get you in contact with the existing members. -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Now with more and longer words for your reading enjoyment. ]

1 0

Re: small exchanges (was: Re: PSINet and C&W peering)
by Jim Mercer 05 Jun '01

05 Jun '01

On Tue, Jun 05, 2001 at 11:14:24AM -0700, Ehud Gavron wrote: > Similarly in Tucson we founded The Tucson Interconnect. > It worked for a long while (except for one ISP who still doesn't > understand what peering is, but they're just a stain on the > big isp carpet). > > Eventually the small ISPs were using DS3 uplinks, and then > a local interconnect became an expensive proposition... > T-1s were easy to justify but in town (read LEC) DS3s or > 100BTx is expensive... we lucked out, in that 151 Front Street in Toronto is sorta like 60 hudson, 25 broadway, ??? wilshire. so many ISP's had bandwidth going in that direction anyways. most of the peers are connected with a simple cat5 running back to their own closet/room in the building. there has been some talk about putting sister switches in other buildings,etc but that starts to get into real money, and then you have to work out how to split it and maintain it and SLA's, etc, etc, etc. right now the switch(es) are on loan/donated/sponsored? by cisco. extreme and other vendors have offered their hardware as well. the location of the first switch was picked up by one of the founding members. we have since made an arrangement with RACO in 151 Front whereby RACO will give the switches a place to live. works out pretty good. -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Now with more and longer words for your reading enjoyment. ]

1 0

Rooted boxen and the law
by Jamie Norwood 05 Jun '01

05 Jun '01

I am just curious, in these days where every script kiddie with a few spare hours is out cracking into every box in sight, what do you all do when it happens? I know the isolate/reinstall stuff, I am specifically more interested in administrative stuff. Do you log it? Report it to the police? FBI? Who? Basically, I just had a box cracked, and have time to kill before I get access to it to reinstall (Damn cheap colo provider...) and am wondering if I should just reinstall and get on with life, or if I should be covering my ass, since I have things on their that will make me unhappy if they are taken and released to the public domaine (Reg codes for software and the like.) Let me know! Jamie

4 4

Re: Rooted boxen and the law
by Scott Gifford 05 Jun '01

05 Jun '01

Jamie Norwood <jnorwood(a)adelphia.net> writes: > I am just curious, in these days where every script kiddie with a > few spare hours is out cracking into every box in sight, what do you > all do when it happens? I know the isolate/reinstall stuff, I am > specifically more interested in administrative stuff. Do you log it? > Report it to the police? FBI? Who? When we had a cracked box on our network, and a reasonable chance of catching the guy, we got absolutely zero help from the FBI. We were only able to get ahold of the agent handling our case once, and never got phone calls returned. That was from the Detroit office; you may have better luck depending on where you're at. Calling CERT might not be a bad idea; might make law enforcement more willing to listen, and somebody at CERT might be able to help apply pressure if needed. > Basically, I just had a box cracked, and have time to kill before I > get access to it to reinstall (Damn cheap colo provider...) and am > wondering if I should just reinstall and get on with life, or if I > should be covering my ass, since I have things on their that will > make me unhappy if they are taken and released to the public domaine > (Reg codes for software and the like.) I would back up the whole thing as it stands now, both to tell what happened and to provide evidence if it comes to that. Hell, hard drives are cheap enough; maybe you should just pull the HD from your cracked machine, and reinstall onto a fresh one. ----ScottG.

1 0

Re: PSI statement on C&W peering issue
by Morris, Gary 05 Jun '01

05 Jun '01

>>> Good for CW. Companies shouldnt cut off peering with >>> others and not think that one day it might just happen to them. What I find alarming about this is what is stopping CW from asking a prohibitive sum of money from other providers? Providers can't simply 'transit through somebody else' free of charge because ultimately somebody is paying for the transit rights.

3 2

C&W Peering Problem?
by Charles Scott 05 Jun '01

05 Jun '01

All: Just got off the phone with C&W's NOC trying to find out why NASA.GOV had fallen off the edge of the earth. When I asked if this had anything to do with the C&W peering policy, the answer was yes. Does anyone have any more information on this? Chuck

8 9

RE: engineering --> ddos and flooding
by Matt Zito 05 Jun '01

05 Jun '01

> Sorry but IMESHO null routing a /32 during a DoS attacck > doesn't exactly > strike me as engineering. It is more like dealing with the attack in > real-time. To mean engineering would mean desinging networks > to be resistant to DDoS and flooding in the first plsce. > > To that end no NSP should ever allow spoofed IP addresses outside of > their network. (not just RFC 1918 addresses but valid IPs that don't > belong to that NSP) > > e.e if I'm have a circut from C&W nd I try to spoof a packet > eith a source address of 216.35.172.135 it should be dropped as > close to the edge of C&W's network as possible. > > note on RFC 1918 addresses: These should never get past customer > edge routers IMESHO. > > Two NSPs should rate limit DoS traffic (ICMP & SYNs) within their > networks in such a way that it can never DoS a T-1 (or E-1 if you are > not in the US). [note: I'm not sure if ciso's are up for this workload > since I primarily work with Juniper.] > Rate-limiting ICMP is not so difficult - rate-limiting SYNs is basically useless. Syn floods work not because the amount of traffic they do, but because they fill up state tables or make them so horribly inefficient as to make the box cease responding on that port. Given that, say, a linux box has a default queue depth of 128, I can send 128 spoofed SYNs at a rate of one a second, and in two minutes that box will stop responding. The larger you make the queue, the longer it will stand up to a slow SYN attack, but the more costly each incoming SYN and SYN+ACK becomes, as the data structures become more and more unwieldy. Thanks, Matt -- Matthew J. Zito Systems Engineer Register.com, Inc., 11th Floor, 575 8th Avenue, New York, NY 10018 Ph: 212-798-9205 PGP Key Fingerprint: 4E AC E1 0B BE DD 7D BC D2 06 B2 B0 BF 55 68 99

2 1

ORBS go bye bye?
by Eric Whitehill 05 Jun '01

05 Jun '01

Anyone know what happened to ORBS? I can't get their web page - all I get is "Due to circumstances beyond our control, the ORBS website is no longer available. " I have my mail servers attempted at being used as relays and it becoming a spammers haven - some customers of mine are getting 1500+ messages and it's starting to become an issue. (From other people relaying to me) Any word? Ideas? I don't want to start a MAPS vs. ORBS thing here.... -Eric

7 8