- NANOG - lists.nanog.org

The Cidr Report
by Tony Bates 04 Jun '99

04 Jun '99

This is an auto-generated mail on Fri Jun 4 12:00:00 PDT 1999 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 04Jun99 0) General Status Table History ------------- Date Prefixes 280599 60794 290599 60486 300599 60423 310599 60546 010699 60651 020699 60740 030699 61574 040699 60877 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 5052 Number of ASes announcing only one prefix: 2600 (1423 cidr, 1177 classful) Largest number of cidr routes: 400 announced by AS701 Largest number of classful routes: 1230 announced by AS209 1) Gains by aggregating at the origin AS level --- 04Jun99 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS209 1230 577 653 53.1% Qwest Communications AS271 349 144 205 58.7% BCnet Backbone AS4293 256 151 105 41.0% IMCI AS577 276 183 93 33.7% Bell Canada Backbone AS174 582 491 91 15.6% Performance Systems International AS4200 175 99 76 43.4% AGIS (Apex Global Information Ser AS3749 137 63 74 54.0% TECNET AS7046 304 231 73 24.0% UUNET-CUSTOMER AS1267 94 24 70 74.5% IUNET-AS AS7496 99 33 66 66.7% Power Up AS10928 118 52 66 55.9% UNKNOWN AS7545 115 50 65 56.5% TPG Internet Pty Ltd AS7122 139 78 61 43.9% MTS ADVANCED Network Policy AS1221 452 392 60 13.3% TELSTRA-AS AS4755 139 80 59 42.4% Videsh Sanchar Nigam Ltd. India AS1239 543 484 59 10.9% SprintLink Backbone AS9269 68 10 58 85.3% Hong Kong CTI AS7657 181 124 57 31.5% The Internet Group Limited AS72 95 39 56 58.9% Schlumberger Information Network AS4740 323 267 56 17.3% Ozemail Pty Ltd (ASN-OZEMAIL) AS2493 174 121 53 30.5% iSTAR Internet, Inc. AS719 465 413 52 11.2% LANLINK autonomous system AS3737 161 111 50 31.1% PenTeleData Inc. (ASN-PTD) AS803 73 37 36 49.3% SaskNet Backbone AS1 490 455 35 7.1% BBNPLANET AS6944 34 2 32 94.1% RapidSite, Inc. AS6172 154 122 32 20.8% HOME-NET-1 AS1785 246 214 32 13.0% NYSERNet Backbone AS549 164 133 31 18.9% ONet Backbone AS4307 32 1 31 96.9% SVINET-1 For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Re: C&W Outage, more info, sort of
by Sean Donelan 03 Jun '99

03 Jun '99

jmbrown(a)ihighway.NET (John M. Brown) writes: >It seems that 2 of C&W's core routers in SFO had BGP session problems >and they cleared the sessions and everything was ok... Its a "level >two issue" at this time and the ticket is still open. L2 folks are >looking into the problem to try and figure out what happened. > >From our perspective we had no conectivity to NetScape or Yahoo via >the C&W link. Sounds like the cisco bug which has affected several different providers over the last month or so. A route (almost always a high-interest destination) doesn't get added to the forwarding table correctly. Nothing appears wrong at the router, but traffic between individual destinations dies. Unless a customer calls, the provider may not even notice, because it only affects traffic on a particular path through the network. A quick temporary solution is clearing the route table. The router usually builds a fresh route table with the correct forwarding information. And it appears to work until some event tickles the bug later. So far this problem manifest itself only with certain IOS versions using CEF. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

CW has SFO Master Ticket 1091
by John M. Brown 03 Jun '99

03 Jun '99

Seems anything going to Yahoo or Netscape (the two biggest) via cw.net is broke. According to CW NOC there core routers in SFO are having some sort of BGP problem... No ETR

2 1

C&W Outage, more info, sort of
by John M. Brown 03 Jun '99

03 Jun '99

It seems that 2 of C&W's core routers in SFO had BGP session problems and they cleared the sessions and everything was ok... Its a "level two issue" at this time and the ticket is still open. L2 folks are looking into the problem to try and figure out what happened. >From our perspective we had no conectivity to NetScape or Yahoo via the C&W link. Our affected time period was around 2 hours jmbrown(a)ihighway.net On Wed, Jun 02, 1999 at 11:21:06PM -0500, Sean Donelan wrote: > >Seems about 8 months ago one of my folks put DRA.COM into our > >spamsites list for SendMail. > > Ok. So back to what I was originally going to ask before I got > distracted into hacking into your mail system .... > > What was the story with C&W in San Francisco? It seems to have > cleared up, and C&W wouldn't say much to me. >

1 0

Interesting in-addr for sprintlink, NO DUH (Non Op)
by John M. Brown 03 Jun '99

03 Jun '99

3 core3.Bloomington.cw.net (204.70.4.21) 23.067 ms 24.411 ms 30.238 ms 4 somerouter.sprintlink.net (206.157.77.42) 26.112 ms 26.53 ms 37.65 ms 5 sl-bb10-ana-2-2.sprintlink.net (144.232.1.17) 25.518 ms 46.323 ms 26.47 ms

1 0

Re: NIST: 5% of attacks against Internet infrastructure
by Sean Donelan 02 Jun '99

02 Jun '99

alex(a)Relcom.EU.NET (Alex P. Rudnev) writes: >More interesting could be the _reasons of attacks_. > >(through you should divide _before NATA / after NATA bobbings -:) ). I don't know about other people, CERT?, but I still see the biggest correlation between the school year and attacks. In particular, there still is the September effect (start of the North American school year) and a rise between spring break and the start of finals in May. But that may just be an artifact of my customer base, or I may be missing the signs. No, this is not a request or challenge to test my security. Serbia, china, nato, etc have gotten a bunch of press coverage. But for the most part they vanish into the noise of what goes on every day. If the FBI put up an IRC server, then I would worry and try to get as far away as possible.... I guess we now know why the FBI didn't come to Eugene last week. I found the NIST report on infrastructure attacks interesting because historically phreakers/crackers have rarely gone after the network infrastructure they used. They did go after the billing and fraud systems, but usually left the network elements operating (sometimes with improvements). Since the Internet didn't have billing or fraud systems built into the backbone infrastructure, that eliminated a normally attractive target. >From an operations point of view, are people seeing more attacks on the backbone infrastructure itself than in the past? Sure, routers have fallen over in the past due to denial of service attacks. Which were usually directed at a host system, and the router was just collateral damage. But the only backbone infrastructure I can think of ever being attacked directly was AGIS during the spam years. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

NANOG17 (October 3 - 5, 1999)
by Craig Labovitz 02 Jun '99

02 Jun '99

NANOG will hold its 17th meeting in Montreal, Canada on October 3 - 5, 1999. This we be our first truly North-American (i.e. not United States) meeting. The local host for NANOG17 is Nortel Networks. More information on the meeting and conference hotel is available at http://www.nanog.org/mtg-9910/ Call for Presentations ---------------------- NANOG invites presentations on backbone engineering, coordination, and research topics. Presentations should highlight issues relating to technology already deployed or soon to be deployed in core Internet backbones and exchange points. Previous meetings have included presentations on: Backbone traffic engineering Coordination of inter-provider QoS Deployment experience with queueing disciplines (CAR, RED) Inter-provider security and routing protocol authentication Routing scalability in backbone infrastructures Security issues for the Internet core Routing policy specification and backbone router configuration Building large-scale measurement infrastructure Cooperative inter-provider caching Alternatives to hot-potato routing Recommendations on queue management and congestion avoidance Experience with differentiated services Reports from next-generation networks (Internet2, CA*net, etc) Inter-domain multicast deployment Backbone network failure analysis Inter-exchange point updates Tutorials have covered topics such as: BGP case studies Address allocation and renumbering External route selection IP multicast technologies How to Present -------------- Submit an informal one- or two-paragraph abstract describing the presentation in email to nanog-support(a)nanog.org. The proposal should be submitted well in advance of the conference. Notification of acceptance is rolling and is usually provided one or two days after receipt of the abstract. NANOG also welcomes suggestions/recommendations for tutorials, panels and other presentation topics.

1 0

NIST: 5% of attacks against Internet infrastructure
by Sean Donelan 02 Jun '99

02 Jun '99

Operational only in the sense that network operators will get asked about this fun statistic by their managers on Internet infrastructure attacks. NIST's ITL bulletin covered "Computer Attacks: What are they and how to defend against them" this month. NIST researchers estimated that 5% of the computer attacks they analyzed were against "Internet infrastructure" (which, in their analysis, includes both routers and firewalls). http://www.nist.gov/itl/lab/bulletns/may99.htm Instead of diverting your manager's attention by yelling "Watch where you step, the token fell out of the ethernet!" you might try soothing his concerns by reporting the bulletin also said most Internet infrastructure attacks were scanning and denial of service, and few involved penetration attacks. # config t (config)# ! too many commands to list here, ask the TAC for help securing (config)# ! your router -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

2 1

request for flow stats data
by Steve Feldman 01 Jun '99

01 Jun '99

About 18 months ago I collected some flow statistics summary data from busy routers and put the results in http://www.mae.net/flowstats/ There's interest in repeating the survey to see how things have changed and get more data points. If you are running cisco flow switching on a busy router and wouldn't mind sharing, please send me the top part of the output of a show ip cache flow (the summary info, not the individual flow information) and I'll include it. I'll keep the data source anonymous unless you explicitly give me permission to share it. As an alternative, if you are running cflowd the output 'artsprotos' on a 24-hour aggregate file would be useful. Also, please let me know approximately where in your topology the data comes from (e.g. exchange point, core, customer edge, etc.) and which part of the world it's in. Thanks for your help, Steve

1 0

DEW alert
by bmanning＠ISI.EDU 01 Jun '99

01 Jun '99

Hi, I appologize for duplicates. Its almost time for the next quarterly walk of the inverse tree of the DNS. For the last few quarters, I've been walking the in-addr tree looking for numbers of delegations, accurate delegations, and types and styles of error conditions. So... this is a heads up that you will be seeing zone transfers being generated by a couple of the collecter machines here. For those of you who utilize BINDs access controls, I'd appreciate your inclusion of the collector machines in allowed transfers. The expectation is that they will be the following IP addresses: 128.9.160.57 and 198.32.4.13 Past data is at: www.isi.edu/div7/people/bmanning.home/in-addr-audit.html The run is scheduled to start 01 July 1999. If there are any questions or concerns, I'd be happy to talk about them. Past data has been presented at IEPG, Apricot and RIPE meetings. The expectation is that future data will be presented in the same and similar forums. -- bill

1 0