- NANOG - lists.nanog.org

rfc 1918?
by Chris Davis 23 Feb '01

23 Feb '01

Hello, Does anyone know why I get inbound packets from 10.x.x.x coming from my ISP, UUNet? They're just headed for a webserver, so it's not likely that they're up to no good. This seems to violate rfc 1918. Am I crazy? Feb 22 15:29:48 computerjobs-gw 353094: Feb 22 20:30:10.439 UTC: %SEC-6-IPACCESSLOGP: list 135 denied tcp 10.10.5.18(62438) -> 63.67.217.184(80), 1 packet Feb 22 15:30:02 computerjobs-gw 353095: Feb 22 20:30:24.024 UTC: %SEC-6-IPACCESSLOGP: list 135 denied tcp 10.10.5.18(62440) -> 63.67.217.184(80), 1 packet Feb 22 15:30:06 computerjobs-gw 353096: Feb 22 20:30:28.168 UTC: %SEC-6-IPACCESSLOGP: list 135 denied tcp 10.10.5.18(62455) -> 63.67.217.184(80), 1 packet

11 24

RE: rfc 1918?
by Mark Borchers 23 Feb '01

23 Feb '01

> This is not an issue of paranoia (except for those who actually use > PRIVATE addresses internally and have properly configured > their gateways > to be paranoid about even seeing such packets, let alone > routing them). Unless I'm mistaken, a prime reason for the evolution of RFC 1918 addresses was that it was once common practice for people to help themselves to PUBLIC address space to use on PRIVATE networks. As the world got more connected, these addresses occasionally got leaked and caused address conflicts. Using RFC 1918 addresses prevents conflicts with public/registered space. Obviously the possibility of leakage still exists, but with RFC 1918 the havoc potential is diminished to a mere irritant level. Which is what the incident that started this thread appeared to be.

3 2

Re: rfc 1918?
by Ron Buchalski 23 Feb '01

23 Feb '01

One may argue that, if all your border peers ARE filtering RFC1918 addresses inbound and outbound, they'll take care of your misbehavior. -rb >From: woods(a)weird.com (Greg A. Woods) >Reply-To: woods(a)weird.com (Greg A. Woods) >To: nanog(a)merit.edu (North America Network Operators Group Mailing List) >Subject: Re: rfc 1918? >Date: Fri, 23 Feb 2001 02:55:56 -0500 (EST) <snip> >Can you please try to find at least one even minor technical argument >for not filtering RFC-1918 addresses before you try again to give this idea >any more credit? _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

Re: Choosing a Service/Hosting Provider
by Craig A. Haney 23 Feb '01

23 Feb '01

i sent in a request for beer and gear at 4am wed. morning. i'll call to confirm. -craig

1 0

RE: Choosing a Service/Hosting Provider
by Irwin Lazar 23 Feb '01

23 Feb '01

Our consulting practice spends a lot of time on this very issue. I'd rate the top three things that our customers are looking for from SP's are as follows: - Customer Service - a single point of contact, pro-active network management, and fast provisioning. Poor customer service, IMHO, is the single biggest complaint I hear from our customers about their current service providers - Cost - especially considering market slow-downs - Geographic Availability - being able to provide service where its needed and when its needed, via a single point of contact if partnership arrangements are required. I'd also add financial stability as another concern. Companies are very wary about putting their lifeblood onto a service provider's network when that service provider isn't financially stable. Irwin ----- Irwin Lazar - ilazar(a)tbg.com <mailto:ilazar@tbg.com> Senior Consultant, The Burton Group Office: 703-742-9659 Cell: 703-402-4119 http://www.tbg.com/ "The Ultimate Resource For Network Architects" -----Original Message----- From: Eric Gauthier [mailto:eric@roxanne.org] Sent: Friday, February 23, 2001 11:29 AM To: nanog(a)merit.edu Subject: Choosing a Service/Hosting Provider Hello, I'm pretty sure that this question has been picked to death on this list, but I couldn't find a good thread in the nanog archives. If there is one in there, can someone drop me a pointer off-list? Anyways, here is my question: What should people look for when choosing a service or hosting provider? Thanks. Eric

3 3

AT&T ATM Outage This Week
by Spencer.Wood＠dot.state.oh.us 23 Feb '01

23 Feb '01

The following is from our ISP describing the AT&T ATM Outage: ATM Network - AT&T had an ATM network-wide outage on Tuesday affecting some of our DS1 and DS3 ATM connections. The outage began at Tuesday at 1:30 p.m. affecting 17 switches. Switches were restored by 4:30 p.m. but outages continued into the evening due to switch restarts. AT&T attributed the outage to a cable cut resulting in excessive number of control messages from one of AT&T's network switches. The switches were unable handle the message volume and failed. AT&T turned down some of the links between switches to isolate the problem. Problems continued in Columbus on Wednesday due to an unknown issue with the Lucent switch. PVCs were up but are operating slowly. Another failure in Columbus on Friday morning affecting four of our DS3's was isolated to a link between Columbus and Cleveland. Service was restored by late morning. We are expecting a written summary of these issues from AT&T. **************************************************** Spencer Wood, Network Administrator Ohio Department Of Transportation 1320 Arthur E. Adams Drive Columbus, Ohio 43221 E-Mail: Spencer.Wood(a)dot.state.oh.us Phone: 614.644.5422/Fax: 815.361.0714 ****************************************************

1 0

Re: Beer and Gear surprise
by owen＠dixon.delong.sj.ca.us 23 Feb '01

23 Feb '01

And how exactly would you translate that membership into a voting eligibility? Anyone on the internet who wants to claim they provide network services can vote? I'm OK with that definition, but it will be hard to implement in terms of actually conducting voting in some rational manner. Owen > I disagree. The charter defines membership: > > "The group will have membership that broadly includes network providers. > These may include private, public, federal, commercial or other networks > that consider themselves providers of Internet services. However the > representatives attending this group should be prepared to engage in > technical discussions. Membership should not be limited to North American > participants though the general focus of the discussion should be from the > NA networking point of view." > > --- > Opinions in this email are the personal opinions of the author and are not > associated with author's employer. This email account is a not the regular > email account of the author and is being used for the protection of the > employer. > > ----Original Message Follows---- > From: owen(a)dixon.delong.sj.ca.us (Owen DeLong) > To: nanog(a)merit.edu, kawaii_iinazuke(a)hotmail.com > Subject: Re: Beer and Gear surprise > Date: Wed, 21 Feb 2001 23:40:45 -0800 > > <fact> > There is no NANOG membership. There is the NANOG community. There are no > firm criteria for citizenship in said community, so it would be difficult > to define a voting process in terms of who does or does not get to vote. > </fact> > > Owen > > _________________________________________________________________ > Get your FREE download of MSN Explorer at http://explorer.msn.com > > >

4 3

Re: Beer and Gear surprise
by Ukyo Kuonji 23 Feb '01

23 Feb '01

Why would someone need to buy Merit? Nanog doesn't belong to Merit, does it? Funny, I though it was the North American Network Operators' Group. Doesn't that imply that it collectively belongs to those of use that consider ourselves operators? I don't think people are getting it. It's not about the vendorwear that was eliminated. My point is that someone made a decision about the meeting without even informing the people that were going to attend the meeting beforehand. There was no discussion about it beforehand, no information afterwards, and no mention of it when we signed up for the meeting. The only notification that I saw was a addendum to the charter dated November 2000 which was as long as the original charter. My question, I guess, is this: 1) What does Merit do for Nanog? Looks to me like they help organize the meetings (Which are funded entirely by registration fees and vendor donations, and are supposed to be organized by the hosting organization), host the web site (which has little content on it) and host the mailing list. Am I missing anything else? 2) What gives Merit the right to make decisions about the group without consulting the membership? (Hint: It's not in the charter, or anywhere else I could find) 3) If Merit is not listening to it's membership, and is only providing the web page and mailing list, is there a reason why they are still hosting NANOG? (Hint: It's not in the charter.) I would propose one of the following: 1) The NANOG Charter needs to be revised into a more inclusive charter which includes the resolution of conflicts within the membership, review of the officials actions by the membership and removal of officials by the membership in the event that the actions are in conflict with the membership or charter. There should also be included, in the charter, how to revise and amend the charter. In this option, Merit would still be the ruling body. 2) Remove Merit from the ruling body. There is no reason, today, that the web site and mailing list could not be hosted by someone else. I do not believe that Merit is doing a bad job, but there isn't that much work involved in providing this service. The charter states that meetings are to be organized by the hosting company. I don't see a reason why this could not continue. The charter will still need to be resizes, however to include the items from option 1 3) Continue to live under the rule of a ruling body that does not consult of inform it's membership or decisions that affect the membership and meetings. Merit is under no obligation, at this point, to continue to offer services to NANOG, and the membership has no recourse of action under the current charter. I don't want to play politics, but I think something needs to be done. UK --- Opinions in this email are the personal opinions of the author and are not associated with author's employer. This email account is a not the regular email account of the author and is being used for the protection of the employer. _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

9 8

RE: History of private peering and exchanges?
by Howard C. Berkowitz 23 Feb '01

23 Feb '01

> > At some point, there started to be a business case for large >> providers to interconnect with bilateral private links as well as at >> exchanges. When did such links first get used for commercial >> traffic? In the beginning, were they short-haul connections between >> cages in exchanges, or WAN links between major provider hubs? I'm >> referring here only to interprovider links, not to transit customers. Mark Borchers added, > >Well, if this is to be a comprehensive list, private interconnects >predated the commercial Internet. At OARnet in Ohio, we set up >peering with CICNet in a facility near the Ohio Supercomputer Center >in order to avoid long round trips. Clearly, there's a need to broaden my scope! I do want differentiate between good solid technical examples, such as yours for OARnet-CICNet, between examples where the suits had an economic motivation. The latter, I would assume, came later. While I recognize I won't be able to publish the details of many NDA-covered commercial private peerings, it is my hope to identify when this practice began. A side motivation for this particular point is to identify when commercial NDA considerations might have restricted the potential ability of routing registries to give reasonably accurate representations of topology and policy. Yeah, yeah...if everyone DID put all their policies in an RR. Yet Another Issue.

2 1

BGP filters for rfc 1918 and other nasties
by Lee Watterworth 23 Feb '01

23 Feb '01

I have been doing some looking around for a decent access-list or prefix-list to start my inbound BGP filters. I have found quite a few flawed examples, but none that look solid.. What do you use for ingress filters? Found an interesting link in an ancient (12/97) Nanog post. Those who have coffee and BGP for breakfast should take a peek. http://www.employees.org/~tbates/cidr-report.html http://www.lucentnps.com/knowledge/whitepapers/bgp_main_isp.asp missing 172.16/12 ??? access-list 100 deny ip 127.0.0.0 0.255.255.255 255.0.0.0 0.255.255.255 access-list 100 deny ip 10.0.0.0 0.255.255.255 255.0.0.0 0.255.255.255 access-list 100 deny ip 192.168.0.0 0.0.255.255 255.255.0.0 0.0.255.255 access-list 100 deny ip 192.0.2.0 0.0.0.255 255.255.255.0 0.0.0.255 access-list 100 deny ip 128.0.0.0 0.0.255.255 255.255.0.0 0.0.255.255 access-list 100 deny ip 191.255.0.0 0.0.255.255 255.255.0.0 0.0.255.255 access-list 100 deny ip 192.0.0.0 0.0.0.255 255.255.255.0 0.0.0.255 access-list 100 deny ip 223.255.255.0 0.0.0.255 255.255.255.0 0.0.0.255 access-list 100 deny ip 224.0.0.0 31.255.255.255 224.0.0.0 31.255.255.255 access-list 100 deny ip any 255.255.255.128 0.0.0.127 access-list 100 deny ip 0.0.0.0 0.255.255.255 0.0.0.0 255.255.255.255 access-list 100 permit any any http://www.cymru.com/~robt/Docs/Articles/secure-bgp-template.html ip prefix-list bogons description Bogon networks we won't accept. ip prefix-list bogons seq 5 deny 0.0.0.0/8 le 32 ip prefix-list bogons seq 10 deny 1.0.0.0/8 le 32 ip prefix-list bogons seq 15 deny 2.0.0.0/8 le 32 ip prefix-list bogons seq 20 deny 10.0.0.0/8 le 32 ip prefix-list bogons seq 25 deny 23.0.0.0/8 le 32 ip prefix-list bogons seq 30 deny 31.0.0.0/8 le 32 ip prefix-list bogons seq 35 deny 67.0.0.0/8 le 32 ip prefix-list bogons seq 40 deny 68.0.0.0/6 le 32 ip prefix-list bogons seq 45 deny 72.0.0.0/6 le 32 ip prefix-list bogons seq 50 deny 76.0.0.0/6 le 32 ip prefix-list bogons seq 55 deny 80.0.0.0/6 le 32 ip prefix-list bogons seq 60 deny 84.0.0.0/6 le 32 ip prefix-list bogons seq 65 deny 88.0.0.0/6 le 32 ip prefix-list bogons seq 70 deny 92.0.0.0/6 le 32 ip prefix-list bogons seq 75 deny 96.0.0.0/6 le 32 ip prefix-list bogons seq 80 deny 100.0.0.0/6 le 32 ip prefix-list bogons seq 85 deny 104.0.0.0/6 le 32 ip prefix-list bogons seq 90 deny 108.0.0.0/6 le 32 ip prefix-list bogons seq 95 deny 112.0.0.0/6 le 32 ip prefix-list bogons seq 100 deny 116.0.0.0/6 le 32 ip prefix-list bogons seq 105 deny 120.0.0.0/6 le 32 ip prefix-list bogons seq 110 deny 124.0.0.0/7 le 32 ip prefix-list bogons seq 115 deny 126.0.0.0/8 le 32 ip prefix-list bogons seq 120 deny 127.0.0.0/8 le 32 ip prefix-list bogons seq 125 deny 169.254.0.0/16 le 32 ip prefix-list bogons seq 130 deny 172.16.0.0/12 le 32 ip prefix-list bogons seq 135 deny 192.0.2.0/24 le 32 ip prefix-list bogons seq 140 deny 192.168.0.0/16 le 32 ip prefix-list bogons seq 145 deny 198.18.0.0/16 le 32 ip prefix-list bogons seq 150 deny 201.0.0.0/8 le 32 ip prefix-list bogons seq 155 deny 223.255.255.0/24 le 32 ip prefix-list bogons seq 160 deny 224.0.0.0/3 le 32 ! Allow all prefixes up to /27. Your mileage may vary, ! so adjust this to fit your specific requirements. ip prefix-list bogons seq 170 permit 0.0.0.0/0 le 27 -----Original Message----- From: Chris Davis [mailto:chris.davis@computerjobs.com] Sent: February 22, 2001 3:39 PM To: 'nanog(a)merit.edu' Subject: rfc 1918? Hello, Does anyone know why I get inbound packets from 10.x.x.x coming from my ISP, UUNet? They're just headed for a webserver, so it's not likely that they're up to no good. This seems to violate rfc 1918. Am I crazy? Feb 22 15:29:48 computerjobs-gw 353094: Feb 22 20:30:10.439 UTC: %SEC-6-IPACCESSLOGP: list 135 denied tcp 10.10.5.18(62438) -> 63.67.217.184(80), 1 packet Feb 22 15:30:02 computerjobs-gw 353095: Feb 22 20:30:24.024 UTC: %SEC-6-IPACCESSLOGP: list 135 denied tcp 10.10.5.18(62440) -> 63.67.217.184(80), 1 packet Feb 22 15:30:06 computerjobs-gw 353096: Feb 22 20:30:28.168 UTC: %SEC-6-IPACCESSLOGP: list 135 denied tcp 10.10.5.18(62455) -> 63.67.217.184(80), 1 packet

1 0