- NANOG - lists.nanog.org

RE: IS-IS protocol implementation problem
by rdobbins＠netmore.net 30 Oct '00

30 Oct '00

I had a bizarre event occur on Thursday night/Friday morning, and this is likely the culprit. I peer with AS701. At approximately 11:15PM PDT or thereabouts (2:15AM EDT), the 7507 which provides my connectivity to uu.net went belly-up in a very strange way. The BGP session with 701 showed active, with full tables; existing TCP connections stayed up. However, it appeared that all new connections inbound from 701 were being dropped on the floor, and my outbound traffic with them dropped from 40mb/sec down to about 5kb/sec. The same router was also handling a secondary connection to pbi.net; because the BGP stayed active and in a supposedly functional state, traffic didn't get routed in that direction as it should've been. I had to reload the router to get it to function properly. Very odd. Nothing in the logs, etc. The router just essentially went on strike, and I've no idea why. I don't run IS-IS, needless to say, especially with a foreign AS. This particular 7507 was running an 11.3.x CC-train IOS, and hadn't had any of the ISO/CLNS family of protocols enabled, ever. This is a bit earlier than the timeframe Sean cited, but I don't think it was a coincidence, either. ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice -----Original Message----- From: Neil J. McRae [mailto:neil@COLT.NET] Sent: Monday, October 30, 2000 1:28 AM To: sean(a)donelan.com Cc: smd(a)clock.org; nanog(a)merit.edu Subject: Re: IS-IS protocol implementation problem > At approximately 7:37am EDT on Friday, about 258 Cisco 12000's on UUNET's > primary backbone reloaded. This appeared to be isolated to routers > in ASN 701. It disrupted reachability to about 15% of the world-wide Internet > based on data from Matrix measurements. A contributing cause was a bad > IS-IS packet which confused certain IOS versions in the 12.0 IOS software > train. I haven't heard what the root cause was or what originated the > bad IS-IS packet. The Cisco bug id is CSCdr05779. Any provider running the > affected IOS version may be vulnerable depending on what the root cause > turns out to be. > > Although the bad IS-IS packet didn't propagate to other providers, several > other providers did report BGP resets and route flaps about the same time. If a large AS such as AS701 starts flapping I wouldn't be surprised if other ASes start seeing BGP resets and route-flaps. Could be that crud routing information was exchange when that chaos started [jeez 258 routers I'd hate to have been the on duty NOC guy on that morning :-)] Interestingly though we still see alot routes with bad AS-PATH information people should be setting more stringent configurations on the routes the learn and subsequentally pass on to avoid this. Regards, Neil.

1 0

Re: IS-IS protocol implementation problem
by Sean Donelan 30 Oct '00

30 Oct '00

On Sun, 29 October 2000, smd(a)clock.org wrote: > P.S.: any chance you can be a bit more concrete about what's happening? When I'm concrete, providers complain I'm picking on them, and getting them bad press. But since you asked.... At approximately 7:37am EDT on Friday, about 258 Cisco 12000's on UUNET's primary backbone reloaded. This appeared to be isolated to routers in ASN 701. It disrupted reachability to about 15% of the world-wide Internet based on data from Matrix measurements. A contributing cause was a bad IS-IS packet which confused certain IOS versions in the 12.0 IOS software train. I haven't heard what the root cause was or what originated the bad IS-IS packet. The Cisco bug id is CSCdr05779. Any provider running the affected IOS version may be vulnerable depending on what the root cause turns out to be. Although the bad IS-IS packet didn't propagate to other providers, several other providers did report BGP resets and route flaps about the same time.

2 1

Re: IS-IS protocol implementation problem
by smd＠clock.org 30 Oct '00

30 Oct '00

| Because IS-IS is an IGP protocol, it does not propagate between | providers. This is not the reason why it will not propagate between separate ASes. The "saving factor" here is that nobody really routes CLNS natively, and therefore, the maximum hop-count of a CLNS datagram is 1. It would be possible to cascade an IS-IS problem across multiple separate ASes in the unfortunate event that more than one AS treated a single LAN (e.g. an IX) or point-to-point link as an internal one across which IS-IS is run, with the same key. This kind of mutual poisoning between separate ASes happens with some regularity, amusingly often with RIP as the IGP. An IGP based on a natively routed protocol (including routed CLNS) widens the scope for inter-AS poisoning. This is why it is important to have good authentication in one's IGP. Unfortunately, *no* IGPs currently in wide use have any such thing. :-( For clarity, a separate AS is really short hand for, "a collection of routers participating in a common IGP instantiation"; there are cases where different ASes (in the BGP sense) share a common IGP. Also, "propagating between providers" seems to ignore the fact that there are single providers who have multiple IGP instantiations. Sean. P.S.: any chance you can be a bit more concrete about what's happening?

1 0

IS-IS protocol implementation problem
by Sean Donelan 29 Oct '00

29 Oct '00

Network operators using IS-IS on Cisco should be aware of a problem which can result in their routers reloading unexpectedly when a corrupt IS-IS packet is received. Cisco has fixed the problem in various 12.0 software trains. The problem can cascade through a single provider's network. Because IS-IS is an IGP protocol, it does not propagate between providers. This has already affected a provider. I haven't found out what is originating the bad IS-IS packet, i.e. is this an inter-vender operability issue?

1 0

RE: Root registration
by Roeland M.J. Meyer 29 Oct '00

29 Oct '00

www.iana.org www.icann.org and if you want an over-view of TLD politics www.dnso.net > -----Original Message----- > From: Travis Grant [mailto:tgrant@kore.com] > Sent: Thursday, October 26, 2000 6:58 PM > To: 'nanog(a)merit.edu' > Subject: Root registration > > > > > How do I locate the the authority for root registration on behalf of a > foreign country? > > Travis Grant >

1 0

NMAP/TBIT
by Jitendra Padhye 28 Oct '00

28 Oct '00

Dear NANOG mailing list: We gave a talk at NANOG earlier this week in Washington, D.C., in which we reported on our development of TBIT (the TCP Behavior Inference Tool) for testing the TCP behavior of web servers in the Internet. We also raised the issue of running NMAP to help us correlate TCP behaviors with operating systems. The purpose of this correlation is so that any bugs identified by TBIT can be appropriately reported and fixed. One suggestion made at NANOG was that we send email to this mailing list to inform people when we are running large-scale NMAP scans. So the purpose of this email is to say that, over the weekend, we will be running NMAP against 20,000+ IP addresses from machines in bind.com domain, kindly provided to us by Aaron Hughes. If you have any problems with this, please contact us (padhye(a)aciri.org, floyd(a)aciri.org) instead of flaming Aaron :) Here are some URLs for more information: ACIRI: http://www.aciri.org/ TBIT: http://www.aciri.org/tbit/ NMAP: http://www.insecure.org/nmap/ Regards, - Jitendra Padhye and Sally Floyd. ---------------------- http://www.aciri.org/ ----------------------

1 0

RE: UO slashdotted
by Rishi Singh 27 Oct '00

27 Oct '00

Doesn't work. I got this message when I clicked on: http://people.oven.com/asr/carnivore.mpg 404 Not Found The requested URL '/asr/carnivore.mpg' was not found on this server. ---------------------------------------------------------------------------- ---- thttpd/2.19 23jun00 -----Original Message----- From: Adam Rothschild [mailto:asr@latency.net] Sent: Friday, October 27, 2000 4:21 PM To: nanog(a)merit.edu Subject: Re: UO slashdotted On Fri, Oct 27, 2000 at 10:29:40AM -0700, hardie(a)equinix.com wrote: > It looks like a slashdot link to the UO Carnivore files > has taken out the service. We've got a mirror up at: <http://people.oven.com/asr/carnivore.mpg> This may be subject to rate-shaping, but if so, the thresholds defined will be more than generous. Have fun! -adam

3 3

RE: UO slashdotted
by Rishi Singh 27 Oct '00

27 Oct '00

Thank you very much for the effort Hans. I am now able to download the multicast viewer toolkit. -----Original Message----- From: Hans Kuhn [mailto:hak@oregon.uoregon.edu] Sent: Friday, October 27, 2000 4:46 PM To: Rishi Singh Cc: 'Lucy E. Lynch'; 'nanog(a)merit.edu' Subject: RE: UO slashdotted Rishi, I mirrored the IP/TV viewer and MIM client on another ftp server that is not mirroring the carnivore stuff. You should be able to get through to get the client at least and watch it on multicast. There is a link at http://videolab.uoregon.edu/download.html or you can go directly to the ftp site for the browser impaired. ;) ftp://denali.uoregon.edu/pub/videolab/iptv-30.zip Hans -- Hans Kuhn, Academic User Services office (541) 346-1714 University of Oregon, 233 CC fax (541) 346-4397 Key fingerprint = 1E BC 32 03 AC E9 82 6C 44 4A CD 63 BB 2D 51 89 On Fri, 27 Oct 2000, Rishi Singh wrote: : : Every single download link on the page for the MPEG videos are broken or : maybe the sites are too busy? : : In addition the link to get the IPTV software is also broken at: : : ftp://limestone.uoregon.edu/pub/videolab/iptv-30.zip : : : -----Original Message----- : From: Lucy E. Lynch [mailto:llynch@darkwing.uoregon.edu] : Sent: Friday, October 27, 2000 2:25 PM : To: hardie(a)equinix.com : Cc: nanog(a)merit.edu : Subject: Re: UO slashdotted : : : : We're also got a mirror up - the UO page: : : http://videolab.uoregon.edu/nanog/carnivore/ : : but point here would be that the multicast session is way : more effective - given the bandwidth, an MPEG capable : client already installed, and multicast turned up for your : site ;-) : : Lucy E. Lynch Academic User Services : Computing Center University of Oregon : llynch(a)darkwing.uoregon.edu (541) 346-1774 : Cell: (541) 912-7998 5419127998(a)mobile.att.net : Key fingerprint = 2C 80 2F 8C 5F 68 37 E3 AC 16 09 F1 36 E4 61 15 : : :

1 0

UO slashdotted
by hardie＠equinix.com 27 Oct '00

27 Oct '00

It looks like a slashdot link to the UO Carnivore files has taken out the service. Ted

4 4

RE: UO slashdotted
by Rishi Singh 27 Oct '00

27 Oct '00

Every single download link on the page for the MPEG videos are broken or maybe the sites are too busy? In addition the link to get the IPTV software is also broken at: ftp://limestone.uoregon.edu/pub/videolab/iptv-30.zip -----Original Message----- From: Lucy E. Lynch [mailto:llynch@darkwing.uoregon.edu] Sent: Friday, October 27, 2000 2:25 PM To: hardie(a)equinix.com Cc: nanog(a)merit.edu Subject: Re: UO slashdotted We're also got a mirror up - the UO page: http://videolab.uoregon.edu/nanog/carnivore/ but point here would be that the multicast session is way more effective - given the bandwidth, an MPEG capable client already installed, and multicast turned up for your site ;-) Lucy E. Lynch Academic User Services Computing Center University of Oregon llynch(a)darkwing.uoregon.edu (541) 346-1774 Cell: (541) 912-7998 5419127998(a)mobile.att.net Key fingerprint = 2C 80 2F 8C 5F 68 37 E3 AC 16 09 F1 36 E4 61 15

1 0