- NANOG - lists.nanog.org

Operate until failure
by Sean Donelan 08 Jan '01

08 Jan '01

Is there any consistency among network operators how they operate their networks when they know a possibility of imminent failure exists? 1. Do you attempt to preserve service as long as possible, including running equipment to the point of destruction? 2. Do you attempt to minimize recovery time by shutting down equipment to a "safe" condition before failure? If you are running a database/transaction oriented system, I would expect you want to put the database into a stable condition. On the other hand, if you are operating mostly communication equipment, you would want to leave it operating as long as possible. I'm aware of a variety of proprietary software shutdown programs associated with UPS vendors. But I'm wondering do any "open standards" exist for initiating soft shutdowns?

8 9

SprintNAP
by Simon Lockhart 07 Jan '01

07 Jan '01

Does anyone know if SprintNAP are accepting new customers again yet? I spoke to them over a year ago and they said "We'll have our ATM stuff real soon now, and then we'll accept more customers", but I've not heard anything either way since then. Simon -- Simon Lockhart | Tel: +44 (0)1737 839676 Internet Engineering Manager | Fax: +44 (0)1737 839516 BBC Internet Services | Email: Simon.Lockhart(a)bbc.co.uk Kingswood Warren,Tadworth,Surrey,UK | URL: http://support.bbc.co.uk/

1 0

Re: Exchange point networks
by Sean Donelan 06 Jan '01

06 Jan '01

On Sat, 06 January 2001, deen(a)slt.lk wrote: > > Is a separate AS Number required for an Internet Xchange point network. > No, nor does an exchange point network need to be announced outside the exchange point. If the exchange point network is announced, it will be associated with one or more ASNs. Some exchange points have a separate AS number, other exchange point networks are announced within the ASN or ASNs of its members, and finally some exchange point networks are not announced outside the exchange point.

1 0

RE: FTP with authentication to RADIUS
by Roeland Meyer 06 Jan '01

06 Jan '01

With FTP ... just say "no!". 1) many versions of FTP make you system vulnerable to root cracks. 2) There is NO way to run FTP in a SSH tunnel because it uses dynamic port assignments. 3) FTP logins are plain-text. For sharing files, with anonymous users, HTTP is much better (see: http://files.dnso.net) > From: Steven J. Sobol [mailto:sjsobol@NorthShoreTechnologies.net] > Sent: Thursday, January 04, 2001 2:35 PM > > On Thu, 4 Jan 2001, joshua stein wrote: > > Michael Medwid wrote: > > > Anyone know of an FTP server product that hooks into RADIUS for > > > authentication? NT or Linux? > > proftpd has more features, but isn't very stable (and has had a few > > security problems in the past). > > It's much less security-hole-ridden than the godforsaken piece-of-crap > copy of wuftpd that ships with many Linux distros (in

9 10

as-path filtering
by Marc Williams 06 Jan '01

06 Jan '01

Do any providers do as-path filtering based on entries in routing registeries? -- Marc

3 2

CANTAT2 break? problems?
by Jim Mercer 05 Jan '01

05 Jan '01

i was notified by teleglobe that there was a problem with CANTAT2 (transatlantic undersea fiber). our circuits appear to be back up (down from 14:00 to 16:00 EST). not sure if teleglobe is re-routing via another cable, or the problem was fixed quickly. -- [ Jim Mercer jim(a)pneumonoultramicroscopicsilicovolcanoconiosis.ca ] [ Reptilian Research -- Longer Life through Colder Blood ] [ aka jim(a)reptiles.org +1 416 410-5633 ]

1 0

RE: FTP with authentication to RADIUS
by Roeland Meyer 05 Jan '01

05 Jan '01

> From: Steve Sobol [mailto:sjsobol@NorthShoreTechnologies.net] > Sent: Friday, January 05, 2001 12:35 PM > > "Brian W." wrote: > > > scp is also a possibility, its usage is a bit cryptic, but it is an > > option.. > But it requires an active shell account on both ends. > > Ain't no way I'm granting shell access to anyone who doesn't > specifically > ask for it. Actually, I'm picky about granting it even to > people who DO > ask for it. This pretty much reflects the attitudes of most of production Unix admins. I don't do it here either. The only shell accounts, on production hosts, are admins and I force most of them to use sudo. Very few (2) have root access here. We've also killed telnetd and ftpd (as in; deleted, never to be used, period). If we have a customer that needs to upload files, we write a special applet for them and make them use a web browser.

1 0

The Cidr Report
by Tony Bates 05 Jan '01

05 Jan '01

This is an auto-generated mail on Fri Jan 5 12:00:00 PST 2001 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 05Jan01 0) General Status Table History ------------- Date Prefixes 291200 96164 301200 95187 311200 95059 010101 95093 020101 95079 030101 95173 040101 95422 050101 95475 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 7237 Number of ASes announcing only one prefix: 3821 (1389 cidr, 2432 classful) Largest number of cidr routes: 637 announced by AS701 Largest number of classful routes: 1652 announced by AS1221 1) Gains by aggregating at the origin AS level --- 05Jan01 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS1221 1652 1215 437 26.5% TELSTRA-AS AS701 1581 1426 155 9.8% Alternet AS271 284 131 153 53.9% BCnet Backbone AS7545 189 67 122 64.6% TPG Internet Pty Ltd AS9269 165 46 119 72.1% Hong Kong CTI AS8013 449 344 105 23.4% PSINET-CA AS6595 162 63 99 61.1% DODDSEUR AS7657 253 164 89 35.2% The Internet Group Limited AS2563 127 40 87 68.5% KoRean Education Network AS705 326 241 85 26.1% ALTERNET-AS AS4755 209 124 85 40.7% Videsh Sanchar Nigam Ltd. India AS4293 341 258 83 24.3% Internal ASN for C&W AS174 527 448 79 15.0% Performance Systems International AS7496 100 22 78 78.0% Power Up AS4151 278 201 77 27.7% USDA Internet Access Network AS1727 187 111 76 40.6% MRMS-WEST AS7046 329 254 75 22.8% UUNET-CUSTOMER AS724 244 172 72 29.5% DLA-ASNBLOCK-AS AS3908 233 161 72 30.9% Supernet, Inc. AS1942 137 65 72 52.6% FR-CICG-GRENOBLE AS13999 79 7 72 91.1% UNKNOWN AS577 240 170 70 29.2% Bell Backbone AS7018 594 527 67 11.3% AT&T WorldNet Service Backbone AS5106 101 37 64 63.4% AADS-COLUMBUS AS3749 122 58 64 52.5% TECNET AS3602 307 244 63 20.5% Sprint Canada Inc. AS226 167 104 63 37.7% USC/Information Sciences Institut AS2548 365 308 57 15.6% DIGEX-AS AS16758 63 6 57 90.5% UNKNOWN AS376 133 77 56 42.1% RISQ For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Re: fwd ppml: ARIN asking about SWIP procedures
by Eric A. Hall 05 Jan '01

05 Jan '01

> On Thu, 4 Jan 2001, Eric A. Hall wrote: > > > All of this stuff (global WHOIS included) really needs to go into > > LDAP, using standardized schemas for the relevant data. > I'm not sure this is a good idea, or even possible. That's two arguments, and they need to be separated. As to the quality of the concept, standardized views of a partitioned database are required in order to facilitate improved levels of debugging and problem reporting. We already know this much: given that the Internet is a collection of independent networks, mechanisms for locating and identifying the operators of the networks are necessary in order for the network operators to manage their interconnections effectively. Every network operator with more than a year's experience under his belt will agree with this. Standardizing the information structure and supplementing the data with a standards-based referral mechanism to the downstream databases is the only real difference for this model versus the schema-free WHOIS/rWHOIS already tried. So if standardized views allow for more/better management of independent networks and their interconnections then its a good idea. The benefits of standardized schema are most apparent when you look at them in the context of a referral-based partitioned database. If every network has its own isolated partition with its own WHOIS service (requiring manual manipulation), standardized data is not necessary. But if the data sources are interconnected then standardized schema allow for higher degrees of automation, which does lead to "better". For example, an operator can provide an address in question as a search key, and then programmatically follow the referrals to locate the operator of the end-point network which owns the address in question. Faster is the "better" quality in this case. Programmatic access to distributed data can also allow for a limited amount of route-management automation, address-to-domain mapping (validation? DNS is very easy to lie to and with), and many other services. These are all positive benefits, so the idea is a good one. Whether the benefits are high enough to justify the effort is your second question. > Given the wide range of organizational approaches and privacy customs > and/or laws worldwide, I'm not sure how you could approach this. If the parties agree that it should be done, it will get done. It doesn't appear they agree with the premise, so there's no motivation to do it. Maybe from your perspective there is no requirement for it, but from the outside there is a strong desire for this kind of service. Our jobs as network operators are much harder than they should be. > Even within just the RIR's, there's the different philosophies > regarding the contents of the data. For instance, ARIN maintains > fairly tight-fisted control over it's database, which allows them the > freedom to fix things that are broken. The RIPE database is owned and > maintained by RIPE members, which allows members the freedom to update > their information on their own, and use the amount of protection they > feel appropriate. (Not to sure about the APNIC database, but the > Asia-Pacific region has its own cultural mores and specific background > as well.) What if this happened from the top down? Surely the parties would do it if they were instructed to do so by the body that empowered them in the first place? Given that scenario, the parties also have the power to do it themselves once they are motivated. I am not reading motiviation from your post. > I get the impression that LDAP/X.500 was designed with a specific > corporate and/or governmental organizational structure in mind. I > don't necessarily think this maps very well on to the anarchy that is > the Internet. The referral mechanism is the key, since it allows for distributed management of autonomous partitions. The standardized schema is only important if the referrals work. LDAP is a well-documented protocol for querying, viewing, managing and navigating partitioned data so its a good solution to the problem. > Shane Kerr <shane(a)ripe.net> > Database Software Engineer > RIPE NCC > +31 20 535 4427 -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

1 0

Information Sharing
by Kevin Facinelli 05 Jan '01

05 Jan '01

Industry Experts, This is an opportunity to get your ideas heard. I am asking the NANOG group for industry relevant white papers, articles or information regarding: Bandwidth, Colocation Selection, Computer Hardware Selection, Network Operations Centers, Legal Issues SLA's/QOS, Peering and Interconnection, Power Systems, and Service Models. This information will be available free of charge from the web resource www.colosource.com. Colosource is a web service dedicated to providing information on issues that surround the Colocation/DataCenter industry segment. We provide a clearinghouse of information regarding over 400 different companies and seek to continue improving the value of this service. Please feel free to email me directly information that you may have for publish that can help educate our community of users. Thank You, Kevin Facinelli www.colosource.com webmaster(a)colosource.com __________________________________________________ Do You Yahoo!? Yahoo! Photos - Share your holiday photos online! http://photos.yahoo.com/

1 0