- NANOG - lists.nanog.org

RE: SMURF amplifiers
by Martin, Christian 25 Jan '99

25 Jan '99

www.powertech.no/smurf > -----Original Message----- > From: Alex P. Rudnev [mailto:alex@Relcom.EU.net] > Sent: Monday, January 25, 1999 10:55 AM > To: nanog(a)merit.edu > Subject: SMURF amplifiers > > > Hi > > Someone here have collected the list of smurf amplifiers? I > have got a > list used by the working hacker (and can send this list by > e-mail) if you > need more addresses into your collection. > > Alex. > > Aleksei Roudnev, Network Operations Center, Relcom, Moscow > (+7 095) 194-19-95 (Network Operations Center Hot Line),(+7 > 095) 230-41-41, N 13729 (pager) > (+7 095) 196-72-12 (Support), (+7 095) 194-33-28 (Fax) > >

1 0

RE: Byte Counters on Ciscos
by Martin, Christian 25 Jan '99

25 Jan '99

32 bits unsigned. 4294967296 MAX. Chris > -----Original Message----- > From: alex(a)nac.net [mailto:alex@nac.net] > Sent: Monday, January 25, 1999 10:47 AM > To: nanog(a)merit.edu > Subject: Byte Counters on Ciscos > > > > > I am working on some byte counting stuff, and have a odd question. > > I noticed on my of my routers: > > 2403558863 packets input, 2476827328 bytes > > thats: > > 2,403,558,863 packets input, > 2,476,827,328 bytes > > > which when divided out, comes to 1.03 bytes per packet, which without > saying is obviously in error. > > So, when does a Cisco counter 'flip' ? How many bits is it? > > > -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- > -- -- -- -- -- > Atheism is a non-prophet organization. I route, therefore I am. > Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member > Father of the Network and Head Bottle-Washer > Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 > Don't choose a spineless ISP; we have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

1 0

Byte Counters on Ciscos
by alex＠nac.net 25 Jan '99

25 Jan '99

I am working on some byte counting stuff, and have a odd question. I noticed on my of my routers: 2403558863 packets input, 2476827328 bytes thats: 2,403,558,863 packets input, 2,476,827,328 bytes which when divided out, comes to 1.03 bytes per packet, which without saying is obviously in error. So, when does a Cisco counter 'flip' ? How many bits is it? -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP; we have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

3 2

Re: Incompetance abounds at the InterNIC
by Dean Anderson 25 Jan '99

25 Jan '99

At 08:06 AM 1/25/1999 -0500, Rich Sena wrote: >Screw the speculators - (simply put) - they are leaches - if they did not >register the domain in the first place then that company that they "watch >the news for" would simply register their own frikken domain and not be >gouged by them for their "finders fee". All speculators are leeches. Stock speculators leech on the profits of companies. Land speculators leech the value of farmers and developers. I'm not saying speculators aren't leeches. What I'm saying is that you can't get rid of them without killing your own services. [by metaphor, leeches grow in warm water--poison the water, and you poison yourself] On this, I'm already proven right. NSI took out on-hold information. Who got hurt? Speculators? No. People who service customers domains? (like ISPs)? Yes. You think that by setting up an account with NSI, you can stop speculation. But you can't. I've already shown that you can't get rid of speculation with the changes proposed. I think there is general agreementt that the changes won't eliminate speculation. Further, everyone is in agreement that the real problem is NSI's services, legacy systems, etc. Eliminating speculators doesn't fix this problem. Don't be a sucker for foolish solutions to problems which can't be fixed. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: aads renumbering rumor and implications
by howland＠Priss.com 25 Jan '99

25 Jan '99

The issue of reverse DNS is the only reason for having "unique" exchange point addressing. The fact as I see it is that the exchange point is not a destination. The exchange point addresses are used solely as a transit "space", and it's nice to know what you're hopping accross. The only time that the exchange point as routable space has been and issue for me is when reachability to those network blocks is being readvertized by a peer. There is NO reason that a service provider needs to readvertise an exchange point network block. It's not a destination. Eliminating this specific abuse would be a Good Thing(tm). Since there is no technical reason for an exchange point to be routable, it comes down to whim. I *like* having unique exchange point addresses for troubleshooting purposes, for all the reasons below. That does not mean it's not perfectly reasonable for an exchange point operator to make it non-routable addressing, since it's their exchange point. If it weren't for the RA's, the ATM environment has no need to be a shared network anyway. Might as well make the VC's individually numbered /30's, or 10.254.254.0/24. Why not? Curt- ------------------------------ On Sun, Jan 24, 1999 at 09:35:13PM -0800, Randy Bush wrote: > >> o does anyone see why the exchange address space needs to be globally > >> routable? > > Traceroute. > > as the fabric is used for peering under bi-lats, if we each announce the > mesh to our customers and not to our peers, then i believe you will have > your tracroutes and yet the prefix does not have to be globally routable, > e.g. could be 209.666.42/24. > > randy Holdon, i don't even see the need for that; if you traceroute out, the packets will cross the exchange irregardless of whether you're announcing it to your customers, and a message of TTL exceeded will be generated from the exchange's address.. The important question is, should they be globally UNIQUE for troubleshooting purposes? I think so. Mike ------------------------------

1 0

Re: aads renumbering rumor and implications
by Danny McPherson 25 Jan '99

25 Jan '99

> do i want to find out if ciscos and junipers can handle a hundred+ secondary > addresses? i'd guess neither vendor would have problems with this. however, several routing protocols have problems with secondary addresses. while BGP does not, folks are likely doing other "interesting" things at exchanges that this would effect. not to mention administrative overhead with adding new secondary address and such when adding additional peers. > and do we want to maintain such configurations?? not particularly. i'd think for the price of local loop, co-location and port fees, they'd be able to pick up the tab for the subnet... yet another reason to avoid public exchanges altogether, i suppose. -danny

1 0

SMURF amplifiers
by Alex P. Rudnev 25 Jan '99

25 Jan '99

Hi Someone here have collected the list of smurf amplifiers? I have got a list used by the working hacker (and can send this list by e-mail) if you need more addresses into your collection. Alex. Aleksei Roudnev, Network Operations Center, Relcom, Moscow (+7 095) 194-19-95 (Network Operations Center Hot Line),(+7 095) 230-41-41, N 13729 (pager) (+7 095) 196-72-12 (Support), (+7 095) 194-33-28 (Fax)

1 0

Re: Incompetance abounds at the InterNIC
by Dean Anderson 24 Jan '99

24 Jan '99

At 02:37 PM 1/22/1999 -0600, Phil Howard wrote: >Since many speculators actually do not pay, the claim can stand up very well. But they do pay. They get money sent to Internic sooner in the case of a lapsed registration. [or they motivate people to pay before they lapse] They get people to purchase domains they might not otherwise purchase, or that they might not otherwise purchase NOW. The costs of the non-completed registrations is trivial. So speculators make a net-profit for NSI. > But if the crunch of templates is blocking _my_ couple of >templates from getting processed in under a week, then I really do want >them to apply some temporary fix now to _this_ system so that do have the >breathing room to put a better system into place. Except that you (and everyone) get worse service after the proposed changes. It will take everyone longer to get domains registered. And you will have less information that you need to work (like on-hold status). [point gun at foot, pull trigger] >This war has probably resulted in "registration spam" where the speculator >submits repeated templates, perhaps once per day, to re-register that domain >hoping to narrow the window in which it is available to others. This makes no sense. I don't believe they re-register the same domain the next day. Once registered, its good for at least 30 days, and the creation date is on the record. Re-registering sooner than creation + 30 wouldn't have any effect unless NSI starts trying to ignore speculator registrations. Then I could see them trying to register it again the next day with a different name. But if that is the case, then NSI caused the flood by their own stupidity. That cannot be blamed on speculators. >My registrations are taking many days because the system is flooded. Because the system is slow/not working. I really doubt the system is flooded. I think the root nameserver updates would fail before the registration system would fail. I can't tell without being at Internic. But I don't think this sounds right. >I could throw together a script in a few minutes that could submit to InterNIC >more templates in a few hours than they get in a week. I could totally flood >InterNIC. But it would also be a denial of service, to InterNIC, and to all >of us, too. Except it doesn't sound like this is happening. Such a script would cause .com to increase by millions in a week. It hasn't. Therefore, I don't think this is happening. >The costs to speculators is on par with the costs to spammers. Computers make >it easy to do. Actually, all you are saying is that the cost of an email message is on par with the cost of a database transaction. I'll agree, and won't argue spam costs, because a bunch of us promised not to. While the comparision to spam is very obvious in many ways, please don't make spam comparisons. We can argue this without reference to spam. Enough said about that. Computers make it easy for NSI, too. $35.00 pays for a lot of computer cycles. There really can be hundreds of thousands of misses per one good registration. >> And if they generate a net-gain for Internic, thats a good thing. > >Up front payment probably will do that. Speculators won't go away. But at >least they get to help pay for the systems we have to use. Not having delayed/canceled payment, immediate registration hurts everyone, including me. When I sell a web-host, they want it up today. I suppose if everyone else has to wait 30 days, it won't be any worse than, say leased line delays, and if everyone has the same constraint, the playing field is level, so it shouldn't cost business. [actually, thats not true, since selling something sooner means more revenue in a year--that's why we have those marketing/sales folks. They get people to buy things now instead of next month. That makes a big difference.] And you are complaining about delays. Presumably, everyone experiences the same delays. Yet, you propose increasing the delays, and then that still won't stop speculators. So what is the point? How is the system improved? It isn't. But then, speculators are just a scapegoat. By definition, eliminating the scapegoat doesn't fix the problem. It just diverts attention from the more embarrasing, real problem. That's how I conclude they are just a scapegoat. >Paying up front is not a contortion. It is annoying to lose some WHOIS >data (I've already had one customer who hadn't paid their bill and got put >on hold, but said that whois doesn't say it's on hold). Maybe if up front >payments go into place, the whois data can be restored for the most part. Actually, just last week before the change, I also had a customer call me and complain their nameservice was broken. A quick check allowed me to tell them that they hadn't paid for their domain, and estimate for them how long their outage would be, which allowed them to give their customers a story about when service would be restored. Now neither I nor anyone else can do that. ***That is a "BAD THING"*** So now we'll have to call NSI, and get to a customer service rep to find out what's up. Then another call to pay. Thats a *LOT* more expensive. This is an improvement? Whoever at NSI came up with this idea really, really needs to be walked out the door. Changing the system so that it doesn't allow "delayed payment/cancelation and immediate duplicate notification" is a "BAD THING". If it means we have to tolerate "free" speculation, then we have to do that. Are you really willing to go to your customers and say "Well, I don't see that yyy.com is registered, but it will cost you $50.00, and 30 days to find out if you can get it." "You want to try 6 domains and keep the best one that you get? Thats 300.00 and 30 days" That's insane. >> I certainly don't want to give up the current system that allows one to >> register domains with delayed or canceled payment and immediate duplicate >> notification. > >It's certainly convenient to pay later. But it's not that great of a >difference to me. Then why are you complaining that it takes weeks to register a domain? Clearly, if these so-called anti-speculation changes are made, it will always takes weeks to register a domain. You are shooting yourself in the foot because you are afraid someone might step on your toe. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

4 3

Re: Who uses RADB/IRR?
by Dean Anderson 24 Jan '99

24 Jan '99

Actually, we just became multihomed last month. I'm not aware of any problems getting to other parts of the net, and definitely no problems with C&W. [Also, my apologies if this a newbie BGP question] I started looking at the RADB, but haven't got ourselves setup yet. Does anyone actually deny routes which aren't listed in the RADB? I guess what I'm really asking is how important is it to be in the RADB? Does it get more important sometime soon? I would also tend to think [based on limited BGP knowledge] that it would only be a problem if your direct upstream used the RADB or if your upstream is RADB filtered by their peers. Is this true? --Dean At 11:39 PM 1/21/1999 -0500, Daniel Senie wrote: >I'd like to find out which networks use the RADB or IRR databases to >build their routing policies, and how to look at their current databases >or access looking glass or equivalent systems. > >It's becoming difficult to take a network multihomed without having >parts of the net appear to be black holed in other parts of the world. >It appears difficult to ascertain which networks are doing what with >policies. > >So far I am aware of CW.NET and ANS.NET using the routing databases to >build their policies, but am not aware of a way to look at their tables. >If anyone has pointers to their resources, or those of other nets using >the routing registries, please let me know. > >-- >----------------------------------------------------------------- >Daniel Senie dts(a)senie.com >Amaranth Networks Inc. http://www.amaranthnetworks.com > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3 2

Re: Incompetance abounds at the InterNIC
by Dean Anderson 24 Jan '99

24 Jan '99

At 07:32 PM 1/21/1999 -0800, Patrick Greenwell wrote: >> But Internic isn't very forthcoming in how they manage their systems. Even >> so, I think I could run an automated database service for very little cost >> per transaction. On the order of hundreths of a cent per transaction. > >You and half a million other people claim to be able to do this. Running >code please? Running code on any of the dozens of discount brokerages. Actually, their code is much, much more complex than a domain registry. And much less automated. So charging 14.95 (E-Trade's fee) is probably too much, even with some "free" speculation. Stock brokerages are probably a bad example, because they are not completely analogous. They are way more complex, and much less automated, and probably less automatable. But it is significant that brokerages are LESS automated, MORE complex, and still charge LESS than Internic. [just want to insert some random upper case letters ;-)] Therefore, while its not such a good example, it still shows that Internic is getting a windfall by comparison. And it provides a real life example that one can run an automated database service for close to what I (and half a million others) claim to be able to do it for. >> You also assume that domain speculators are the only ones who register more >> domains than they pay for. They aren't. > >Yes, they are. ?? You contradict this in your next sentence. >> I'll bet many here have registered domains that they later didn't want >> and didn't pay for. > >So? That doesn't prove that non-speculators do this more often than >speculators. Why don't you check with NSI on this? I didn't say they do it more often. NSI wouldn't be able to answer this either. All they know is the total number of domains registered which aren't paid for. They may have identified a few speculators, such as the "on-hold" people. >> Further, speculators ultimately pay for the domains they sell. > >No, the purchaser pays for the domains they sell. The speculator often >does not. This doesn't make sense. Its like saying the customer of a hardware store pays for hardware, and hardware store does not. While I suppose it could be literally true, it isn't evidence that the hardware store "didn't pay". Likewise, Internic got paid for the domain, because the speculator got someone to pay for it. >It stand up quite well. Having worked for a registrar that employed both >models (post-pay and pre-pay) I can state unequivocally that our empirical >data showed that because of speculation a post-pay model was undesireable >as the speculators on the system at the time were not paying for the vast >majority of domains they registered. But they generate a net profit for the registry. Why? They cause more domains to be paid for than would otherwise be paid for. The revenue they create for the registry is greater than the infinitesimal cost of the domains which are never registered. >Demostratively false, that is why we are having this discussion. The >problems at NSI weren't caused from normal load that they expect. If you >want to argue that they have a shoddy, underpowered infrastructure, I >would tend to agree with you. Demonstration please? *CLAIMS* that they cause internic problems are why we have this discussion. However, those claims are false. Internic problems are due to poor management, and as you say "shoddy, underpowered infrastructure", not speculators. >> I think Internic can afford to scale with the volume regardless of >> speculation. Internic is a nearly fully automated process which charges > >> Speculators that actively try to sell their domains quite likely cause more >> domains to be registered, and so they increase the Internic sales revenue. >> I haven't seen any evidence that the costs of their non-completed >> transactions are more than cost of their completed transactions. > >Think about what you are saying. The cost of a completed transaction is >absored by the fees paid for that transaction. The cost of a non-completed >transaction is paid for by the fees *everyone else* pays for *their* >transactions. This isn't a sensible argument when you look closely. The total cost is subtracted from the total revenue. But if you are going to split up the costs, you must do it fairly. Speculator revenue less Speculator costs -------------------------------------------- = Net profit Normal revenue less normal costs. -------------------------------------------- = Net Profit Since the speculators are generating positive cash flow (the revenue they generate is greater than the costs they incur), "Normal" users aren't subsidizing speculators. What you are doing is this: Normal revenue less normal costs less speculator costs. --------------------------------------------- = Normal users subsidy You leave out speculator revenue, and draw an incorrect conclusion. >> The only speculators that might be able to register thousands of domains >> with little effort are the ones who register on-hold domains. But they are >> doing a favor for Internic, because they are collecting fees. > >Where do you get this wild idea? The only way this occurs is if the domain >is sold which occurs in the minority of cases, and then it is usually the >end purchaser, not the speculator that is paying for the domain. The >speculator serves no useful purpose in the transaction chain for anyone >involved save themselves. Speaking of wild ideas. I suppose that you think the marketing/sales department serves no useful purpose either. After all, it is the customer (end purchaser) who buys services, not the sales person. You are being most naive. The speculator is generating business that wouldn't otherwise be generated. Even the ones who register 'on-hold' domains. The reason speculators can be targeted is because Internic needs a scapegoat on which to blame their "shoddy, underpowered infrastructure", and the internic can easily survive without speculators. But lets not fall for this again. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1