- NANOG - lists.nanog.org

IXs
by Josh Richards 28 Feb '01

28 Feb '01

Anyone give me an idea of what sort of traffic passes to (and hopefully thru!) their MAE-LA peers? It's hard to tell whether anyone cares about this NAP or not, and there appears to be significantly less potential peering partners connected to it. Makes for a tough ROI argument when compared to the other NAPs. While I realize some of this might be a critical mass issue, MAE-LA seems to have been fairly stagnant for several years now. While we're at it, have any input on PacBell's NAP? :-) BTW: Anyone considering connecting to Telehouse's 6IIX IPv6 exchange points at this point? They are collocated inside with NYIIX and LAIIX. Thanks! -jr ---- Josh Richards [JTR38/JR539-ARIN] <jrichard(a)geekresearch.com/cubicle.net/fix.net/freedom.gen.ca.us> Geek Research LLC - <URL:http://www.geekresearch.com/> IP Network Engineering and Consulting

8 7

RE: reverse Traceroute
by Matthew Schlegel 28 Feb '01

28 Feb '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I agree. Very cool. Now we just need to get guys like google and msn to put a client or two in their web farms so that those of us with users to deal ("I can't get to MSN, your network is broken") with can trace to and from their farms directly... - -----Original Message----- From: Jason Blakey [mailto:jblakey@playground.net] Sent: Friday, February 23, 2001 8:22 AM To: nanog(a)merit.edu Subject: Re: reverse Traceroute Just checked this out - very cool (although i think the web interface could use a little bit of a rework).... traceroute from anywhere (at least anywhere a client is running) to anywhere... very useful (and moreso as more clients come on line). I would like to urge everyone to check this out --- that way i can test my network more effectively:):) Thanks, jason On Thu, 22 Feb 2001, pbergman(a)rhythms.net wrote: > I just played with this reverse traceroute tool from > www.traceloop.com and it looks cool. It's kind of a cross between > an automated lookingglass system and napster. Anyway, they are > just starting their alpha testing and they need more test points. > > btw, I have no affiliation, just thought it was cool... > > Paul Bergman > Network Engineer > Rhythms NetConnections, Inc. - -- This email from Jason Blakey - jblakey(a)frogboy.net - www.frogboy.net "The luckiest man in the world" -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBOpaREitAKYXwpQg1EQIEEQCfTESIBxAthLJxeZlDpZ4unqkc1bYAoMnG LcrZQUxtJmRqjpH4DuZbxMu/ =X+aD -----END PGP SIGNATURE-----

5 4

Re: reverse Traceroute
by Miller, Scott 28 Feb '01

28 Feb '01

> Date: Mon, 26 Feb 2001 15:59:20 -0500 > From: Matt Zimmerman <mdz(a)csh.rit.edu> > Subject: Re: reverse Traceroute > > On Fri, Feb 23, 2001 at 08:34:26AM -0800, Matthew Schlegel wrote: > > > I agree. Very cool. Now we just need to get guys like google and > > msn to put a client or two in their web farms so that those of us > > with users to deal ("I can't get to MSN, your network is broken") > > with can trace to and from their farms directly... > > If only it didn't require running untrusted, binary code with superuser > privileges. > > - -- > - mdz This is exactly why the source to tltrace is freely available for download and public review. http://www.traceloop/download/tltrace-0.91b-1.src.tar.gz skm

2 1

Re: reverse Traceroute
by jrg＠watching.org 28 Feb '01

28 Feb '01

<mdevney(a)teamsphere.com> writes: > And I have a feeling lots of people have the same problems I do with > letting someone else make money off my resources. The idea of 'traceloop' reminds me of what can be done with the Ganymede (now NetIQ) Performance Endpoints as used by Chariot, Pegasus, et al. They have a freebie Qcheck tool (Windows only, for the gui, alas) which can do a traceroute from anything running its agent. http://www.netiq.com/downloads/products/Performance_Endpoints/default.asp http://www.netiq.com/products/Network_Performance/Qcheck.asp Binary distribution only, no docs on the protocol (that I know of) but you can deploy it on your own systems, limit access, and generally control what it is allowed to do ('cept for any bugs that might be therein.) Just thought I'd mention it. (Sadly the Qcheck GUI is Windows only, and NetIQ do ask for 'personal' details when you download it, but you can't have everything - just don't put in anyone's who might be susceptible to a sales pitch!) James. (no connection or affiliation with NetIQ)

1 0

Re: Warning: Cisco RW community backdoor.
by Sean Donelan 28 Feb '01

28 Feb '01

It appears more than one vendor shared the same SNMP library (or SNMP programmer). Folks have sent me evidence at least two other vendor's equipment has similar responses to the same SNMP community string ILMI. However, there are other non-related SNMP issues. Many SNMP implementations included the default community strings "public" and "private". If the operator doesn't change them, the defaults may still work. The other common SNMP implementation issue is if no community string is specified, the SNMP agent accepts any community string. If you are checking your network, I'd suggest checking for all three possibilities.

8 9

BGP Question - how do work around pigheaded ISPs
by Roisman, Dani 27 Feb '01

27 Feb '01

Hey there. Due to the pigheadedness of a specific ISP (which I wil *not* allude to in any way, shape, or form, so don't bother asking), and in the interest of conserving IP addresses, I've been faced with quite a challenge. - The Premis: A parent organization has an unused /16 of address space, for arguments sake, let's say it's 172.16.0.0/16. It's out of the old "class B" address range. Two groups within the organization want to bring up independant Internet datacenters, and need /18 of address space, each. Since the parent organization owns an unsed /16, the IP registry refuses to give the child organizations any address space - they insist all address blocks assigned to the parent organization be used, first. ISPph (ph=pigheaded) has a BGP policy that filters out all routes in 128.0.0.0/2 longer than /16. - The network: One group has Internet connectivity to 2 Tier1 ISPs (ISPa and ISPb) in North America. They announce out 172.16.0.0/18 to both ISPs from AS65001. The other group gets Internet connectivity to ISPc and ISPc in South America. They announce 172.16.64.0/18 to their ISPs from AS65002. There is no private network connectivity or backbones between the 2 companies. - The result: ISPph blocks out the /18s at the peering connections to ISPa, ISPb, ISPc, and ISPd. So, customers of ISPph cannot see servers on AS65001 or AS65002. - The workaround: We announce 172.16.0.0/16 as well as 172.16.0.0/18 from AS65001 to ISPa and ISPb. In our preliminary testing, we've found that what happens is that ISPph would route traffic to 172.16.64.0/18 to ISPa (or ISPb, but we'll assume ISPa has a better connection to ISPph), because it learned the 172.16.0.0/16 route from there. ISPa is hearing the *more specific* /18 from ISPc and ISPd, so it transits the traffic over to ISPc, which then delivers it to the South American site. - Questions: 1) is there a reason to announce the /16 from both ASs? Is that "legal?" 2) under normal situations (assume no link failures) would this cause any problem? 3) Is there a link failure scenario that would cause the /16 to create a blackhole for the 172.16.64.0/18 network? 4) Would you recommend this as a fix? Of course, it would make ISPa transit for ISPph, but they're pigheaded enough to make the Internet suck that way. Thanks for your time! ---- Dani Roisman droisman(a)station.sony.com

11 12

RE: 64.0.0.0/8 etc. [was: Re: BGP Question - how do work around.. .]
by Paul Schultz 27 Feb '01

27 Feb '01

I think we're talking about filtering the 64.0.0.0/8 prefix, EXACT prefix. That wouldn't block anyone from reaching anything as long as you only filter the /8 and not any of the more specific advertisements. My company's got a /16, a /17, and a /18 out of 64/8 and I *WANT* people to filter out the annoying 64.0.0.0/8 prefix that much of my traffic may be destined for if something explodes on my end and my routes get withdrawn. Paul -----Original Message----- From: Shawn McMahon [mailto:smcmahon@eiv.com] Sent: Tuesday, February 27, 2001 6:25 PM To: nanog(a)merit.edu Subject: Re: 64.0.0.0/8 etc. [was: Re: BGP Question - how do work around...] On Tue, Feb 27, 2001 at 08:01:46AM -0800, Christian Nielsen wrote: > > > For 64.0.0.0/8 this seems to have happened in the meantime... but now > > there's a route for 62.0.0.0/8 (the RIPE equivalent of 64.0.0.0/8), sigh. > > i dont know why you even allow 64/8 and/or 62/8 into your network. Filter > them... Aren't many Earthlink dialups in 64/8? Filtering that would mean his employees couldn't get Sprint DSL, and prevent millions of potential customers from reaching his web servers. That's not smart business. It's called "cutting off your nose to spite your face."

1 0

Re: Warning: Cisco RW community backdoor.
by SMcGrath＠dhhs.state.nh.us 27 Feb '01

27 Feb '01

Same here Cisco account manager sent us a notification of the bug. Scott Adrian Chadd <adrian(a)creative.net.au>@merit.edu on 02/27/2001 08:11:31 AM Sent by: owner-nanog(a)merit.edu To: Jim Duncan <jnduncan(a)cisco.com> cc: nanog(a)merit.edu Subject: Re: Warning: Cisco RW community backdoor. On Tue, Feb 27, 2001, Jim Duncan wrote: > As a side note, this is a problem with the standards. In particular, > how the standards _require_ a function to be implemented. <TONGUE LOCATION="CHEEK"> Now, if only all other standards were implemented so faithfully by all the vendors .. </TONGUE> :-) (sorry, couldn't resist.) And yes, we received a call at work from our cisco rep outlining the bug a few days ago. That was really nice of them. Well done guys. Adrian -- Adrian Chadd "The fact you can download a 100 megabyte file <adrian(a)creative.net.au> from half way around the world should be viewed as an accident and not a right." -- Adrian Chadd and Bill Fumerola

1 0

Warning: Cisco RW community backdoor.
by Simon Lyall 27 Feb '01

27 Feb '01

It appears that 2500 are not affected. The fix below doesn't work on 11.1 and 11.2 , you have to turn snmp off by the looks. have fun. ----- Forwarded message from "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> ----- Date: Tue, 27 Feb 2001 00:39:38 +0000 (GMT) From: "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> X-Sender: <jamesr@inet15> To: <members(a)lonap.net>, <ops(a)linx.net> Subject: Warning: Cisco RW community backdoor. Precedence: bulk If your router responds to `snmpwalk router.isp.net.uk ILMI`, you probabally will want to do the following to disable it: conf t snmp-server community ILMI RO 99 access-list 99 deny any log (pick another spare access-list if 99 isn't available) If you dont, assuming your ios/hardware combination supports it, (most of the bigger routers do) anyone can do things like: `snmpset router.isp.net.uk ILMI system.sysName.0 s \ "ALL YOUR ROUTER ARE BELONG TO US."` Thats a harmless example. You can do almost anything with RW snmp. Warm Regards James -- James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk Internet Operations Engineer | Phone: 01737 839 737 BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 12

Re: Warning: Cisco RW community backdoor.
by Sean Donelan 27 Feb '01

27 Feb '01

> ----- Forwarded message from "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> ----- > If your router responds to `snmpwalk router.isp.net.uk ILMI`, you > probabally will want to do the following to disable it: > conf t > snmp-server community ILMI RO 99 > access-list 99 deny any log > (pick another spare access-list if 99 isn't available) should be RW not RO Anyone with a Smartnet contract have a response from Cisco yet? I really need to get my own Smartnet number.

6 5