- NANOG - lists.nanog.org

ARIN Person...
by dies＠pulltheplug.com 02 Jan '01

02 Jan '01

Could someone from ARIN gimme an email off list? I wasn't paying attention to the /20 discussion so I never got a name. Thanks!

1 0

Globally unique versus globally routable (was RE: RFC1918)
by Sean Donelan 02 Jan '01

02 Jan '01

> Using RFC1918 space also gets you an IP range where the outside world has > no route to it -- Sorry, but no packets are not getting there, ergo no way > to hack. > > At that point, just by use of simple routing, you've effectively > eliminated 100% of attacks from the outside, and you only have to worry > about inside. The front door is secure, now work on the back door. One of the things which has always annoyed me about this argument was people making the assumption that routing of addresses and registration of addresses was related. You can have a globally unique address, registered with an address registry (arin, ripe, apnic), which is not routed on the Internet. You can have a "private" shared address, which is routed on the Internet. People who can't figure out how to filter, also can't figure out how to filter RFC1918 addresses. So route leaks of RFC1918 space are common. If your filters are properly configured, there is no difference in the security of RFC1918 addresses or globally unique addresses. What makes RFC1918 addresses "secure" isn't the addresses, but the route filters. If your filters aren't properly configured, there is no difference in the security of globally unique addresses or RFC1918 addresses. Personally, I prefer to always use globally unique addresses whether or not they are announced on the Internet because they cause less problems (security, operational, etc) problems when a route does leak. The problem with RFC1918 addresses, is if you an accidental route leak, you have a fairly high probability of getting nailed by someone else using the same address. Humans have an annoying habit of choosing the same "easy to remember" private addresses. If any security consultant tells you your computers are secure because they are using RFC1918 addresses, I would suggest grabbing your wallet and running. And, yes I've heard security consultants from the "Big 5" firms say exactly that. Note: I did not say either RFC1918 addresses or globally unique addresses were secure, only that there is no difference in the level of security between them.

1 0

IP Multicasting
by deen＠slt.lk 02 Jan '01

02 Jan '01

Hello Nanog, We are developing a streaming video based application. Can someone tell me whether (1) Multicasting is necessary for such an application (2) How do we configure multicasting, and multicast (224.x.x.x) to Global IP Conversion, on Cisco Routers. Some useful sites will be handy. (3) What is the function of the MBone network, and whether it is required for such a situation. Deen Sri Lanka Telecom Internet

6 7

Re: IP Multicasting
by Kevin Facinelli 02 Jan '01

02 Jan '01

Eric, Your research sounds very interesting. As to your question I have come across a few sites that you may want to take a look at: 1)http://www.internettrafficreport.com/ 2)http://ratings.miq.net/compare-by-REACHABILITY-Large.html 3)http://www.internethealthreport.com/ These organizations may have what you are looking for or this could be another starting point. Good Luck and keep me posted as to how things are going. Kevin Facinelli webmaster(a)colosource.com www.colosource.com ===== Kevin Facinelli www.colosource.com webmaster(a)colosource.com __________________________________________________ Do You Yahoo!? Yahoo! Photos - Share your holiday photos online! http://photos.yahoo.com/

1 0

Internet metrics III
by jamie rishaw 02 Jan '01

02 Jan '01

Are any major backbones doing Internet metrics in the oldschool (and more interesting) method -- services breakdown? I remember being a cust of OARnet back in the early 90's, being able to look at true metrics.. bandwidth utilization broken down by service, what percentage of bandwidth was being used over what services over a given period of time. I haven't seen anything similar to that in years. I would love to. As would many others, I'm sure. jamie -- i am jamie at arpa dot com .. and this is my .sig. All I want is a kind word, a warm bed and unlimited power. "i remember when i was little, my mom used to tell me how santa couldnt start his journey until all the little boys and girls went to bed around the world... then i remember staying up the whole night just because i thought it would set back christmas for everyone and it would be funny.." - my friend shortie

1 0

RE: RFC1918 addresses to permit in for VPN?
by Richard Welty 02 Jan '01

02 Jan '01

> So the picture that emerges is that Randy is very definitely > speaking of NAT as Bi-directional or Two-Way NAT (in the terminology > of RFC 2663), where no address conservation is practiced, and > machines with private addresses are directly reachable via public > addresses, through a fixed incoming mapping applied by the NAT > device. umm, fixed is not a requirement here. you can go two way through addresses allocated out of a pool easily enough. yes, the hacker won't have control over what is in the pool that he is trying to hack into, and the externally visible addresses of systems may change, but as long as the NAT is being done and is two way, there are things which are subject to attack. the combination of RFC 1918 space and NAT is a sorry excuse for security. you need some sort of packet filtering or access control on the path, possibly in the box doing the NAT, possibly in some other box, but you _must_ have it. if a network is completely isolated from the public internet, then the RFC1918 issue is irrelevant, as the network is inaccessible regardless of what network addresses are being used. richard

1 0

NANOG 21 -- Registration Open
by Carol Wadsworth 02 Jan '01

02 Jan '01

***************************** NANOG 21 Registration Open ***************************** Happy New Year Everyone! Registration is now open for the 21st Meeting of the North American Network Operators' Group. The meeting will be held February 18-20 at the Sheraton Atlanta Hotel in Georgia and will be hosted by Riverstone Networks. ---------------------- Online Registration: https://www.merit.edu/nanog/registration.form.html.0102 ---------------------- Hotel Reservations: http://www.nanog.org/mtg-0102/hotel.html ---------------------- Call for Presentations: Submission deadline: January 8 http://nanog.org/mtg-0102/call21.html http://www.nanog.org/mtg-0102/call21.pdf Hope to see you in Atlanta! Carol Wadsworth Merit Network, Inc.

1 0

RE: public route servers
by Jeremy Furr 02 Jan '01

02 Jan '01

There is also: route-server.ip.att.net (12.0.1.28) Jeremy jfurr(a)va.rr.com -----Original Message----- From: Neil J. McRae [mailto:neil@DOMINO.ORG] Sent: Saturday, December 30, 2000 5:24 AM To: snoble(a)sonn.com Cc: goemon(a)sasami.anime.net; nanog(a)merit.edu Subject: Re: public route servers Ones I know of are: ner-routes.bbnplanet.net route-server.exodus.net and route-server.colt.net Neil. > > I randomly check www.traceroute.org at the bottom... they tend to have a > nice list. > > On Fri, Dec 29, 2000 at 04:32:26PM -0800, Dan Hollis wrote: > > > > route-server.cerf.net appears to have been shut down, so all I have left > > is route-views.oregon-ix.net... > > > > What are some others...? > > > > -Dan > > > > -- > ---------------------------------------------------------------------------- --- > : Steven Noble / Network Janitor / Be free my soul and leave this world alone : > : My views = My views != The views of any of my past or present employers : > ---------------------------------------------------------------------------- --- > >

1 0

Packeteer
by Hank Nussbacher 02 Jan '01

02 Jan '01

Can anyone point me to a user forum, newsgroup, mailing list discussing Packeteer? Thanks, Hank

1 0

Re: RFC1918 addresses to permit in for VPN?
by Ryan O'Connell 02 Jan '01

02 Jan '01

On Fri, Dec 29, 2000 at 11:31:17AM -0500, Andrew Brown wrote: > speaking of rfc1918 addresses...one of my machines at home got poked > at, so i did the usual thing which was perhaps waste about five > minutes poking back from some place else if i feel like it. what i > saw piqued my interest: [snip bt.net traceroute] BT have little-to-no-clue in their ISP technical management it seems. They filter out all ICMP to their web servers, then use NT web servers that set the DF bit. (NANOGs passim) As a result, you can't access BTs web servers if there's any network with an MTU of less than 1500 between you and BT. (Which covers many default Frame Relay configs...) Talking to BT tech support is useless, they refuse the escalate any problem unless they get large numbers (tens/hundreds) or users complaining. (Kudos to Unet for rapidly escalating the problem to their top engineers and 'fixing' their network by upping the Frame Relay MTU, when it wasn't even their problem in the first place.) They're also totally inflexible in their sales department - refuse to sell just a leased line with BGP peering, they insist on supplying a router too because it's "too difficult" to support a customer that doesn't have an ISP-provided router, apparently. They only appear to want to sell to clueless customers. I've also had issues with BT leaking routes they shouldn't be and their NOC probing (Telnet and SNMP) routers I've managed, because they weren't sure what they were. (They were not in their network, they were in a colo facility) Rant over. :-) -- Ryan O'Connell - <ryan(a)complicity.co.uk> - http://www.complicity.co.uk I'm not losing my mind, no I'm not changing my lines, I'm just learning new things with the passage of time

1 0