- NANOG - lists.nanog.org

I think I jinxed Sprint
by Sean Donelan 24 Nov '00

24 Nov '00

Last week I gave Sprint some complements on their success avoiding customer service affecting fiber cuts. Unfortunately, Murphy took it as a challange. First, Sprint lost an STP power supply which blocked SS7 service in Sprint's southeastern network for 2 hours and 52 minutes. Then on Tuesday, Murphy killed a disk drive on Sprint's SCP, blocking Sprint's nationwide network for 4 minutes until it could be taken out of service. Maintaining 99.999% network availability is hard for any network, telephone or the Internet. But sometimes I wonder what the real requirement is. The Australian stock exchange went down for a few hours, it wasn't the end of the world. Sprint had some more blocked calls than normal, most people didn't notice. Are we setting artificial performance requirements, which don't reflect reality? Either in what can be achieved, or is necessary.

2 1

RE: I think I jinxed Sprint
by Roeland Meyer 24 Nov '00

24 Nov '00

> From: Sean Donelan [mailto:sean@donelan.com] > Sent: Friday, November 24, 2000 2:44 AM > > Last week I gave Sprint some complements on their success avoiding > customer service affecting fiber cuts. > > Unfortunately, Murphy took it as a challange. First, Sprint lost an > STP power supply which blocked SS7 service in Sprint's southeastern > network for 2 hours and 52 minutes. After all the discussion that we had on the Datacenter list, I am surprised at this. You'd think that they'd have redundant PS's with redundant UPS's. > Then on Tuesday, Murphy killed > a disk drive on Sprint's SCP, blocking Sprint's nationwide network > for 4 minutes until it could be taken out of service. With the radical reduction in the cost of any form of RAID these days, I am surprised that a single disk-drive failure was able to do this. I'm even putting IDE RAID1 on critical workstations these days (Promis FastTrak66 and 2x10GB IDE drives. 3ware makes one with Linux drivers, IBM has linux drivers for their high-end RAID controllers as well [works on 3090's]). Of course, if they really insist on paying $money$ then they could spec EMC ... > Maintaining 99.999% network availability is hard for any network, > telephone or the Internet. But sometimes I wonder what the real > requirement is. The Australian stock exchange went down for a few > hours, it wasn't the end of the world. Sprint had some more blocked > calls than normal, most people didn't notice. Telephony and internet are substantially different, as are uptime and availability. For the telcos, they have no choice. Local public utilities commissions set the requirement for them and they negotiate how to measure it. Telcos are good at this sort of negotiation (what the meaning of "is" is, in this case, what the meaning of "99.999%" is, there is an amazing amount of varience <g>). For the internet, I see an amazing number of systems with no redundancy whatsoever. Of course, the first hardware failure usually corrects the problem, at the cost of substantial down-time. But many second-tier ISPs and dot-coms are still operating on brand-new equipment that hasn't started hitting its MTBF specs yet and they don't even have a clue on their MTTR ratings. In the next few years, I expect to see a lot more failures, as the equipment starts to age. > Are we setting artificial performance requirements, which > don't reflect > reality? Either in what can be achieved, or is necessary. The internet is a lot less forgiving wrt outages then the telco. The telco can have a circut outage, re-route to another circuit, and the customer never sees an availability gap. Also, a total outage, during reduced traffic times, and no customer ever misses a dial-tone because they aren't trying to get one, is not an outage in telco terms. The internet, on the other hand, may have similar issues, unless we start talking streaming video, streaming audio, and voice over IP. In those cases, packet losses can make a serious mess of things. Also, congestion is treated differently between the two systems. Telcos will actually return a fast-busy when a switch becomes congested. The internet simply starts dropping packets. You can actually hear the latter when using www.dialpad.com or MS-Netmeeting (both of which, I use extensively).

2 1

ICANN, TLDs, and directory services.
by rdobbins＠netmore.net 24 Nov '00

24 Nov '00

I'm no big fan of Brock Meeks - he strikes me as being rather immature and naive much of the time. Still, his piece on the ICANN TLD meeting (see http://www.msnbc.com/news/493721.asp?0nm=-11P ) is certainly enough to make those of us who've been around for a while want to weep and gnash our teeth. The first taste of this sort of nonsense was, in my opinion, the CLNP fiasco of a few years ago. Fortunately, wiser heads prevailed, but the blatant power-play that certain parties made at the Tokyo (it -was- Tokyo, wasn't it?) IETF meeting seems in hindsight to've been a foreshadowing of the bureaucratic diktat under which we now seem to be operating. ARIN's ill-informed (hadn't anyone there heard of SSL?) policy announcement regarding virtual hosting IPs was yet another - hopefully, this will go the way of the dodo after the public thrashing they've been subject to in this and other forums as a result of said stupidity. Still, the root problem (pardon the pun) of the namespace and how it should be managed is a pressing issue, and one which hasn't been resolved to anyone's satisfaction, not even ICANN's. IPv6 will, I think, begin to seep into mainstream usage as a matter of necessity. It's taking longer than it should, but security concerns alone (i.e., the fact that, as far as I can tell, spoofing addresses under IPv6 seems to be a pretty difficult, if not impossible task) will probably help give it some momentum. I wonder how long it will be until the 'research only' caveat will be eliminated by the registrars? The namespace is the big enchilada, though. There's been talk since at least 1993 of either a) switching to a directory service as the naming system for the Internet, or b) converting DNS itself into a true directory service by simply adding more and more directory-like features. X.500 was what most people saw as being the logical choice; its cumbersome design and the fact that it took so long to get the standard itself up to snuff made that choice stillborn during the 1990s. Now that we're starting to see, in very blatant terms, what technical/policy/regulatory issues arise with the current naming structure, I wonder if taking a serious look at directories as an ultimate DNS replacement might be more than just a quixotic thought-exercise? Structured properly, probably along national lines, the TLD/top-OU issue would go away, leaving people free to structure their namespaces as they choose. Object types and properties would certainly be a more elegant way of identifying various content-types rather than merely relying upon URL prefixes plus file extensions and their (assumed) proper mapping to MIME-types on the millions of client machines around the world. There are standards issues which must certainly be addressed before such a change could be contemplated; even so, I'm beginning to wonder whether or not it might be time to revisit the naming issue, with a specific focus on directory services? ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice

1 0

ssh access to cisco and "unfriendlies"
by Jim Mercer 24 Nov '00

24 Nov '00

i've been trying to get ssh access to cisco IOS 12.1.2 working, but no matter what i do, the openssh client says "3des not supported by server". so, i fired up a local copy of win32 SecureCRT, and use just "des" encryption, and lo, and behold, it worked. so, i started poking around and discovered that likely what i need is a version of IOS with 3des support. as i understand it, in order to get a 3des IOS, you need to agree to: We will not supply network services (e.g., running a virtual private network) to, or for government organizations/enterprises other than those of, or in: Austria, Australia, Belgium, Canada, Czech Republic, Denmark, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Luxembourg, Netherlands, New Zealand, Norway, Poland, Portugal, Spain, Sweden, Switzerland, United Kingdom, United States without written authorization from Cisco Systems Inc. and/or the governments of the U.S., United Kingdom, and The Netherlands. now, considering some of my clients, i need to pay heed to this. in smaller countries, the first and only internet service is generally run by the PTT, which is usually a "government organization or enterprise". that being said, i find it extremely draconian that i can't run a 3des IOS on a router in Canada, if i supply network services in countries not on that list. so, when i go to set up a connection to Ghana, i am going to need Cisco's permission if i want 3des ssh enabled on the canadian router? and Brazil? and Mexico? -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Reptilian Research -- Longer Life through Colder Blood ] [ Don't be fooled by cheap Finnish imitations; BSD is the One True Code. ]

4 6

Re: Carnivore Update - Washington Post 11/21/00
by Sean Donelan 24 Nov '00

24 Nov '00

On Thu, 23 November 2000, Vadim Antonov wrote: > I do not think that carnivore is doing that, but SSL is not resistant to > the man-in-the-middle attack. The problem here is in the lack of any > useful certificate validation support. How many users actually check that > site certificate indeed belongs to whoever is identified as the site owner > on the Web pages? My understanding of Carnivore is it sits as a Man-On-The-Side, not a man-in- the-middle. Carnivore is exactly the type of evesdropping Diffie-Hillman is supposed to protect against. > (Plus, it depends on the security of certification autority's private > keys, their public parts being non-revokable, because they are bundled > with browser software. I have a little doubt that it is all too easy for > law enforcement to obtain these keys if they need to. Interests of my > privacy definitely do not match interests of RSA Cert. Auth., Inc, a > commercial entity. Of course, i have no proof that this happened, but I > have no reason to trust that it didn't happen, too.) I was not aware that Terrorists'R'Us got their certificates from RSA. Besides wouldn't it violate some trading with the enemy law for a reputable certificate authority to sell certificates to known terrorists? Unless, of course, the real targets for the survellience are someone else.

1 0

Someone flucked up...
by Jason Lixfeld 24 Nov '00

24 Nov '00

Sluice is your friend... Lookie what we have here... [root@cflow sluice-1.0.3]# less chart-199.60.228.224 Organization Traffic AS Most routes <normal stuff> usage: fwhois user[@<whois.ser 0.04 KB/s 64621 701(UUNet) <normal stuff> [jlixfeld@cflow jlixfeld]$ whois 64621(a)arin.net [arin.net] Internet Assigned Numbers Authority (ASN-IANA-RSVD2-ASNBLOCK) Information Sciences Institute University of Southern California 4676 Admiralty Way, Suite 330 Marina del Rey, CA 90292-6695 Autonomous System Name: IANA-RSVD2 Autonomous System Block: 64512 - 65535 Coordinator: Internet Corporation for Assigned Names and Numbers (IANA-ARIN) iana(a)IANA.ORG (310) 823-9358 Record last updated on 14-Oct-1999. Database last updated on 23-Nov-2000 18:45:07 EDT. The ARIN Registration Services Host contains ONLY Internet Network Information: Networks, ASN's, and related POC's. Please use the whois server at rs.internic.net for DOMAIN related Information and whois.nic.mil for NIPRNET Information. [jlixfeld@cflow jlixfeld]$ whois 152.121.2(a)arin.net [arin.net] U.S. Department of Transportation (NETBLK-DOTNETA) DOTNETA 152.121.0.0 - 152.123.0.0 U.S. Department of Transportation (NET-DOTNETA1) DOTNETA1 152.121.0.0 To single out one record, look it up with "!xxx", where xxx is the handle, shown in parenthesis following the name, which comes first. The ARIN Registration Services Host contains ONLY Internet Network Information: Networks, ASN's, and related POC's. Please use the whois server at rs.internic.net for DOMAIN related Information and whois.nic.mil for NIPRNET Information. bc-van-hbr-r75-01#sh ip bgp reg 64621 BGP table version is 6006164, local router ID is 199.60.228.224 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path * 152.121.2.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.3.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.4.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.33.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.49.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.100.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i Network Next Hop Metric LocPrf Weight Path * 152.121.200.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.255.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i bc-van-hbr-r75-01# --- BRAVO USDoT. BRAVO UUNet. -Anonymous :)

1 0

Determining what AS' are being announced
by Jason Lixfeld 24 Nov '00

24 Nov '00

I'm doing traffic analysis to try and determine the amount of traffic I'm sending to or through a particular AS. I'm wondering if there is a documented matrix or a utility that can determine what AS' a particular AS is announcing. Once a reasonably accurate as-path has been generated, I can tell flowscan to grab statistics for all the AS' in the path, but until I know that as-path, I can only get stats for say PSI, but not for it's customers. Thanx in advance.

1 0

RE: ISPs as content-police or method-police
by Mathew Butler 23 Nov '00

23 Nov '00

About 2 years ago, when I got cable modem service from Cox@Home in Mesa, AZ, I tried to go through their standard tech support channels to get filters removed from my IP line. My request was bounced back and forth between several places until I was told by a tech support manager that "there would be no special-case configurations" -- meaning that the filters on my line were never going to be removed. I also found that it was -much- more possible to talk to someone with a clue if I posed as someone on the global Internet, trying to use services which were operationally impacting me (such as DNS and rDNS). When trying to get something done at any NOC, -don't- say "I'm a customer of yours" at any point in time, else you get transferred to the tech support lines and nothing -ever- gets done. (In the case I'm referring to, @home's rDNS service kept dying, and I ended up having to keep calling their NOC and tell them that it was broken, from the standpoint of someone who was doing log analysis on Apache logs, and noticed a bunch of 'lame zone' errors from their servers in their IP blocks. This issue also operationally impacted me being able to get to certain FTP sites that required rDNS to resolve properly. Guess which way got the problem fixed.) -Mat Butler -----Original Message----- From: Christian Kuhtz [mailto:ck@arch.bellsouth.net] Sent: Monday, November 20, 2000 9:36 AM To: nanog(a)merit.edu Subject: RE: ISPs as content-police or method-police > >What doesn't make sense in that argument is why you couldn't just > simply upsell the customer to a managed fw solution etc > >if that's the concern. > > This doesn't work for a consumer broadband ISP, > where the customers won't be upsold to anything and > the average consumer just expects the network to be "safe". Hmm. I disagree, and consumers with those expectations would be advised to read their service agreements which they signed and accepted closely. > >Educate them, and let them decide based on the education they received. > > Education does not work for a consumer ISP, > whether broadband or dialup, due to scaling limits. > Might or might not work for a lease-line business ISP. Sure it does. Depends on what you consider education. I wasn't referring to a two hour class, but the type of discussion a sales rep has with their customer when you sign up for service. Doesn't a regular cable sales rep offer you HBO, Showtime etc packages when you sign up? Why not offer you a no-charge filter service? (granted, I said upsell in my first post, perhaps that was the wrong term). I do not believe that by default, opt-out filtering is a good practice for an ISP. > >Well, again, I don't believe in 'censoring' traffic by default. > > My perspective isn't about philosophy, but rather what > is practical and sensible from a business perspective. Quit splitting hairs. I do not believe that by default, opt-out filtering is a practical and sensible from a business perspective for an ISP. You may disagree, this is a free country last time I checked. > >I wouldn't be so sure, particularly because of the legal exposure... > > The major consumer broadband ISPs have already > discovered that their legal exposure would be higher > if they did not filter a small number of protocols, > than it is with filtering that small number of protocols, > which is the current common case with consumer broadband > ISPs today. Pointers, background please. And how is that sold and presented to the customer? What sort of legal ramifications have been discovered? How is the tech support role addressed? > >> And as has been pointed out, you can ALWAYS punch a hole > >> in the filter for customers who like to live risky, > >> or they can find other ways to tunnel their packets. > > > >At SP scale? Think again. > > Filtering by default and punching holes upon request > works fine for Media-One's cable modem service in the US > Northeast, so that approach CAN work fine at a large-sized > service provider scale (they are an existence proof). Oh yeah? While I happen to use MediaOne (because I can't get anything else where I live) and it seems to work most of the time, it is damn near impossible to find anyone who has a clue about anything (or cares) thru the tech support channels. And I don't consider spending 1.5hrs+ on hold to speak with a junior tech support person an accessible alternative. I do know from my fw at home that no filtering whatsoever is done. In fact, the service agreement clearly states that you're basically on your own. If this is available (and accessible) in the northeast, consider yourself *very* fortunate. If MediaOne (or my employer if I were be able to get DSL) were to start filtering traffic and gave me no reasonable way to opt-out or customize, I would probably be a very dissatisfied customer. Currently, some of these support channels only work well if you don't need support. > Different service providers might well make different > business decisions, but lets not confuse a business decision > with what is/isn't technically feasible. They aren't the > same thing. I don't think I said anything to that affect. Further, a less presumptious stance would be appreciated. I do believe that an opt-in approach is the better one, rather than opt-out. Cheers, Chris -- Christian Kuhtz <ck(a)arch.bellsouth.net> -wk, <ck(a)gnu.org> -hm Sr. Architect, Engineering & Architecture, BellSouth.net, Atlanta, GA, U.S. "I speak for myself only."

2 1

Carnivore Update - Washington Post 11/21/00
by Pickett, Mclean 23 Nov '00

23 Nov '00

To view the entire article, go to http://washingtonpost.com/wp-dyn/articles/A48737-2000Nov21.html Study: FBI Tool Needs Honing The FBI's hotly debated Internet wiretap program is a sound law enforcement tool but needs modification to protect people's routine e-mail and other communications from being intercepted unlawfully, according to a draft study released yesterday by the Justice Department. The study, undertaken by the Illinois Institute of Technology Research at the request of the Justice Department, said although "Carnivore" can be "more effective" in protecting privacy and enabling lawful surveillance than other alternatives, it does not eliminate the risk of unauthorized monitoring of electronic communications by FBI agents. The report recommended that Carnivore be modified, subjected to further outside review and ultimately have its underlying "source code"--the technical details of how its software works--released to the public. Some privacy advocates say the institute, which the Justice Department paid $175,000 to review Carnivore, was biased in favor of the new technology. They also sa! y the FBI cannot be trusted to use Carnivore because the program can pick up all communications that pass through an Internet service provider--such as America Online--rather than monitoring e-mail traffic between suspects under surveillance. House Majority Leader Richard K. Armey (R-Tex.), a longtime Carnivore critic, said the selection of the evaluation team determined the nature of the report. "The Department of Justice selected reviewers and set the rules in order to ensure they would get the best possible review," Armey said. Justice officials said yesterday that the study confirms Carnivore is a legitimate law enforcement tool that can be refined to address concerns. They said the recommendations in the study would enable them to simplify and improve Carnivore's operation. "We are pleased with the findings and the constructive recommendations made in today's draft report," said Donald M. Kerr, head of the FBI's laboratory division. "From the beginning, we have welc! omed this review for two main reasons: First, subjecting Carnivore to outside scrutiny allows for practical criticism, feedback and suggestions for improvements which will ultimately benefit everyone," Kerr said. "Secondly, a review such as this presents the public with a clearer understanding of the facts, which is critical in maintaining public confidence in law enforcement's ability to effectively investigate and prevent serious crimes." The study said Carnivore poses no operational or security risks to Internet service providers, some of which feared that having the program installed would disrupt communications. The report also said that when the technology is used correctly under a valid court order, it gives investigators appropriate access to information. However, it said that since Carnivore poses the risk of going beyond court-permitted information collection in some instances, multiple versions of the wiretap system need to be developed. "This is a very fair repo! rt," a Clinton administration official said. "It doesn't give [Carnivore] a clean bill of health, but says Carnivore has better safeguards than other alternatives and has recommendations for how to improve the use of this technique. It also has suggestions for how to avoid accidental over-use." The report warned that while Carnivore was designed to perform fine-tuned searches, it is also capable of broad ones. "Incorrectly configured, Carnivore can record any traffic it monitors," the study said. But the study rejected fears that FBI agents would be reading all of the routine e-mail traffic of a given Internet service provider, saying that Carnivore "does not have nearly enough power" to do so. The FBI has legitimate reasons to oppose public release of Carnivore's underlying source code; the current version's technical limitations could enable hackers and others to defeat surveillance, the study said. The bureau needs to work toward public release of Carnivore's source code! by eliminating "exploitable weaknesses." Until that public release, outside, independent monitoring is needed to assess the effectiveness and risk of over- or under-collection of data, the study said. In addition, the bureau needs to simplify Carnivore and employ a formal development process in its next version to reduce errors. James Lewis, senior fellow at the Washington-based Center for Strategic and International Studies, said Carnivore is critical for law enforcement, but said selecting the name "Carnivore" has created a public relations problem for the bureau. "Right before Thanksgiving, 'Vegetarian' is the name I would go for," he said. McLean Pickett digex, Inc.

2 1

Re: Carnivore Update - Washington Post 11/21/00
by Steven M. Bellovin 23 Nov '00

23 Nov '00

You can find the draft report itself (and a request for comments) at http://www.usdoj.gov/jmd/publications/carniv_entry.htm or you can get an html version at http://cryptome.org/carnivore-rev.htm --Steve Bellovin

1 0