- NANOG - lists.nanog.org

Re: Routing Policy and http://rs.arin.net/ip-allocation.html
by Lehrer, Neil 06 May '98

06 May '98

i am very interested in this also. if you want to see how other isps handle that route you can go to http://www.boardwatch.com/isp/trace.htm and run tracerts from servers on different isps. `````````` To: nanog(a)merit.edu From: Mike Tancsa <mike(a)sentex.net> For the first time we have had to deal with Sprint's routing policy as defined by http://www.sprint.net/filter.htm. Here is the situation. One of our dialup customers wants to access his website in the 206.116.31.0/24 network at another provider. PSI is advertising it as a /24. According to Sprint's routing policy, they do not honour anything longer than a /19 in 206.0.0.0/8 . I am now in the position trying to explain to the very non-technical customer, why he cant reach that site, which from his point of view just seems like I am passing the buck... Anyways, my question is, are their any other ISPs/NSPs that follow the same guidelines. UUNet seems to honor it just fine, as does MCI. Is Sprint more hardnosed than most ? ---Mike ********************************************************************** Mike Tancsa (mike(a)sentex.net) * To do is to be -- Nietzsche Sentex Communications Corp, * To be is to do -- Sartre Cambridge, Ontario * Do be do be do -- Sinatra (http://www.sentex.net/~mdtancsa) * Regards +++++++++++++++++++++++++++++++++++++++ + Neil Lehrer + U.S. Information Agency + Networks and Systems Support Division + + voice 202 619-0903 + fax 202 619-3883 + internet nlehrer(a)usia.gov + + "oh what a tangled net we weave + when we seek to retrieve." + +++++++++++++++++++++++++++++++++++++++

1 0

Another major smurf run
by Karl Denninger 06 May '98

06 May '98

Hi Folks, If you're monitoring my page on this, you want to take a look in another 10-15 minutes. We were just hit by another major smurf attack, and I captured over a dozen new prefixes (which got added to our "bite me" list). http://www.mcs.net/smurf (update in process right now; give it 10-15 minutes) -- -- Karl Denninger (karl(a)MCS.Net)| MCSNet - Serving Chicagoland and Wisconsin http://www.mcs.net/ | T1's from $600 monthly / All Lines K56Flex/DOV | NEW! Corporate ISDN Prices dropped by up to 50%! Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL ACCOUNTS Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included at no cost

4 3

AS1853 announcing default
by Paul Ferguson 06 May '98

06 May '98

Forwarded for a colleague. - paul >Date: Wed, 06 May 1998 03:52:39 -0400 >From: "Paul G. Donner" <pdonner(a)cisco.com> >Subject: for NANOG > >Paul: > >I currently cannot send email to NANOG. Could you forward this for >me if you feel it is relevant to NANOG? > >I have found that at the Vienna Internet Exchange AS1853 is announcing >a default address. I didn't think this was very wise and it may not >affect much but it looks in error. > >>From Looking Glass: >------------------- > >Router: Service.ACO.net >Query: bgp >Addr: 209.58.48.0 > >BGP routing table entry for 0.0.0.0/0, version 530 >Paths: (1 available, best #1) > 1853 > 193.171.25.81 from 193.171.25.81 (193.171.23.241) > Origin IGP, localpref 100, valid, external, best > >-Donner >

1 0

Reminder: DC-ISOC Meeting This Monday Night
by Russ Haynal 06 May '98

06 May '98

If any of you are Near Washington DC, you might be interested in this meeting next Monday Night (it's free) Russ [ Note: This email contains several pieces of information: ] [ 1- Final Meeting Announcement for DC-ISOC (May 11) ] [ 2- Reminder for ISOC Board of Directors Elections ] [ 3- Netpreneur Announcement about E-commerce meeting ] - - - - Internet Governance - "Who's in Charge Here?" - - - - - Monday, May 11, 1998, 6:30-9:00 p.m. FINAL Meeting Agenda The Internet has continued to grow at an astonishing rate. This diverse expansion has attracted the interests of several regulating organizations and governments. Are the industry self-governing groups (e.g., ISOC, IAB, IANA, etc.) sufficient, or is there a role for governmental bodies (e.g., FCC, ITU, etc.)? Are new industry groups needed, as the White House's Green Paper suggests? If so, how will they come about? The final agenda includes the following speakers; * Ira C. Magaziner - Senior Advisor to The President for Policy Development http://www.ntia.doc.gov/ntiahome/domainname/domainname.htm * Barbara A. Dooley - Executive Director, Commercial Internet eXchange Association http://www.cix.org * David W. Maher - Chair of the Policy Oversight Committee (POC), Council of Registrars (CORE) http://www.gtld-mou.org/docs/core.html * Donald Heath - President/CEO of the Internet Society http://www.isoc.org Following the speaker presentations, there will be an open Q&A session with the audience. Meeting Location: Hyatt Dulles (Across Route 28 from Dulles Airport) 2300 Dulles Corner Blvd. Herndon VA 22071 USA Telephone: 1 703 713 1234 http://www.hyatt.com/pages/d/dullea.html Directions From Beltway: Take exit for Dulles Toll Road - West Take exit 10 from Dulles Toll Road Head South on Centreville Road Right on Fox Mill Road Hotel is 1 mile ahead on the right. As with all of our previous events, there is no charge to attend this event. Seating will be on a first-come, first-seated basis, though we expect that there should be room for all those interested. Please plan to arrive by 6:30 to "network", and to enjoy the refreshments (cookies & soft drinks) that are being provided by our sponsor. Speakers will begin at 7pm. ************* T H A N K S T O O U R S P O N S O R *********** * DC-ISOC wishes to thank InternetMCI for sponsoring this meeting. * * internetMCI offers Internet access options to fit every need * * and every budget. internetMCI Access Services provide * * you with a direct and reliable connection to the Internet * * through flexible options for dial-up or dedicated access. * * Please visit internetMCI at http://www.mci.com * ********************************************************************* To Sponsor a DC-ISOC Meeting, see http://www.dcisoc.org/sponsor.htm A short list of related links for this topic: * Internet Society http://www.isoc.org * Internet Architecture Board (IAB) http://www.iab.org/iab * Internet Assigned Numbers Authority http://www.iana.org/iana * Generic Top Level Domain Memorandum of Understanding http://www.gtld-mou.org/ * US Government's "green paper" on domain names http://www.ntia.doc.gov/ntiahome/domainname/022098fedreg.htm * Internet Society's web page relating to the "Green Paper" http://www.isoc.org/internet/news/greenpaper.shtml * MCI's formal response to the White House Green Paper on domain name system reform http://www.mci.com/mcisearch/aboutyou/interests/technology/ontech/DNSpaper.s html * FCC's Factsheet about ISP's and Access Charges http://www.fcc.gov/Bureaus/Common_Carrier/Factsheets/ispfact.html * International telecommunication Union http://www.itu.ch/ ========== ATTENTION ISOC MEMBERS... DON'T FORGET TO VOTE =============== Reminder - The 1998 Internet Society Board of Trustees Elections are underway. 11 candidates are running for 5 trustee Positions. As an Internet Society member, you are given 5 votes to distribute any way you choose among the candidates. For example, you could: - cast 1 vote each for 5 different candidates - cast all 5 of your votes for a specific candidate - cast 2 votes for candidate "A", 2 votes for "B", and 1 vote for "C" - etc. You should have received already your ballots in the mail. You can read about the candidates and CAST YOUR VOTE ONLINE at: http://www.isoc.org/members/vote/98election/98candinfo.shtml The deadline for Voting is May 29, but why not go to the online site NOW, and influence the Future of the ISOC and Internet. ======================================================================== Membership Information.... Individuals who are interested in becoming members of DC-ISOC can do so by joining the Internet Society. See Internet Society's web site at http://www.isoc.org for more information. The Washington DC Chapter of the Internet Society maintains its own web site at: http://www.dcisoc.org Please feel free to pass this announcement message along to other interested individuals. If this message was forwarded to you, you can join the DC-ISOC announcement mailing list through our web site ( http://www.dcisoc.org ) ============================================================= AN EVENING WITH THE STARS OF E-COMMERCE Presented by the Morino Institute June 3, Mayflower Hotel, Washington, D.C. 6:00 p.m. Registration & Pre-reception 7:00 p.m. Program 9:00 p.m. Post Reception To Register: http://netpreneur.org/ecommerce The Potomac KnowledgeWay Netpreneur Program invites you to spend An Evening with the Stars of E-Commerce. This is your opportunity to learn from and interact with five stellar entrepreneurs who founded some of the region's hottest electronic commerce businesses. Gary Arlen, who Advertising Age referred to as "one of the most visible and most quoted new media gurus" will moderate and lead the evening's discussion. Gary is President of Arlen Communications Inc. On June 3, find out what John Backus, President & Chief Executive Officer of Intelidata Technologies Corporation Bill Gorog, Chairman of the Board of Directors of Intelidata Technologies Corporation (also developer of Lexis-Nexis and former director of VeriFone) Jack McDonnell, President & Chief Executive Officer of Transaction Network Services, Inc. Bill Melton, Chief Executive Officer, CyberCash, Inc. Mark Walsh, President & Chief Executive Officer of VerticalNet, Inc. view as the keys to survival and success in an industry that is expected to explode in the next two years. With expertise in areas that include home banking software, vertical trade communities, data communications services for transaction-oriented applications, and the development of technologies of the caliber of Lexis Nexis, this group has the capacity to address the world of electronic commerce from all angles. The event will follow a town-hall format with brief six- to eight-minute presentations from the Stars, followed by extensive time for audience interaction. Mario Morino, Chairman of the Morino Institute, will wrap up the evening with his own views of the region and the netpreneur movement. Previous An Evening With Netpreneur events drew cumulative crowds of nearly 2,000. Only 700 seats are available for the June 3 program. To be assured of your seat to star gaze, sign up now at: http://netpreneur.org/ecommerce You may also email your registration to <ecommerce(a)netpreneur.org>. Please include your name, company, email address and a brief description of your company. ____________________________________________________________________ Russ Haynal - Internet Consultant, Instructor, Speaker "Helping organizations gain the most benefit from the Internet" russ(a)navigators.com http://navigators.com 703-729-1757 -------------------------------------------------------------------- Author:"Internet; A Knowledge Odyssey" (Top-rated CD-ROM Tutorial) See MindQ Publishing- http://www.mindq.com/cdt/company/products.html

1 0

Re: Two renumbering questions
by Joe Provo - Network Architect 05 May '98

05 May '98

> My ISP is changing upstreams for a variety of reasons around May 18th. > > 1. I have a /24 SWIPed to me, 205.238.207.0. The ARIN listing doesn't say > it's non-portable, so can I take it with me? The ARIN db lost all portable/non-portable atributes in the conversion. Unless folks have gone back and requested they get re-tagged, portability is unclear from the ARIN db. [snip] > rather than filtered for being too long? It's right in the middle of the old > upstream's block 205.238.192/18. If it is a singleton hole in a /18, your most net-friendly action would be to voluntarily renumber. The provider's most net-friendly action would be to indicate it was non-portable. [snip] > (There's other servers elsewhere that won't get renumbered.) If I tell the > Internic that ivan's host number has changed, will that update all the > domains served from it? Yes, that's the purpose of the HST record. Update the HST and you're all set. Joe -- Joe Provo, Network Architect 508.229.8400 x3006 Network Operations Center Fax 508.229.2375 UltraNet Communications, Inc., an RCN Company <jprovo(a)ultra.net>

6 5

Re: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!!
by philip bridge 05 May '98

05 May '98

Well, the ranges... >164.128.116.0 >164.128.119.0 >164.128.122.0 >164.128.123.0 >164.128.57.0 >164.128.81.0 ...are ours, and they are used in our backbone infrastructure. I was a bit surprised to see some of our backbone addresses on the list, because a few weeks back I went around all of the potential amplifiers and configured no ip directed-broadcast. I turns out that the ranges mentioned are all used to address serial access lines to customers - they are all /30 or /32. I have a bit of a problem with blocking of address ranges that really cannot be used as significant amplifiers. We take our responsibilities an ISP seriously: we have blocked all LANs that are connected by fat pipes and/or have large amplification factors, and we have started configuring 'no ip directed-broadcast' on ALL interfaces as a matter of standard. But we have several hundred legacy /30 interfaces that can't be reconfigured overnight. While I support the sentiment that ISPs responsible for large amplifiers should be blocked until they take action, I feel that the decision to block an address range should actually be tempered by an assessment of how damaging an amplifier the address block represents. If a smurf attack is detected from an address range, is it really that difficult to check what the amplification factor is before deciding if it should go onto a blocking list? I would certainly suggest that /30s should not be blocked, since they are so numerous and the damage they can cause is limited. How about a compromise: two lists - one of known smurf amplifier ranges > /30, which are blocked, and another of ranges where the amplifiers are =< /30, and which are no blocked, but simply publicised? As another thought, maybe what we need is a rough 'smurf effectivness metric' composed of amplification factor and access bandwidth. If address ranges only get onto the list because an attack has been sourced from them, then it should be possible to approximate these numbers. Phil At 08:11 PM 4/29/98 -0400, Martin, Christian wrote: >All, > >Here is my contribution to the block list. The script that generated >this will follow. It is 'public domain', in that it can be modified, >BUT, please give credit where credit is due! > >!!!!!NOTE: This script assumes that the offending bounce sites are /24 >blocks. It isn't that smart yet, but if someone can figure out a way to >glean more info, modify the script and repost. > ...previous message truncated... ______________________________________________________________ Philip Bridge ++41 31 688 8262 bridge(a)ip-plus.net www.ip-plus.ch PGP: DE78 06B7 ACDB CB56 CE88 6165 A73F B703

1 0

NANOG 13 REMINDER
by Pam Ciesla 04 May '98

04 May '98

The block on the hotel rooms ends Wednesday, 5/6. Be sure to reserve your room. All attendees need to register via the website, if you are unable to do this please contact me. The attendee list is current. The following is the agenda so far: SUNDAY AFTERNOON TUTORIAL: Introduction to RPSL (Cengiz Alaettinoglu, ISI, Curtis Villamizar, ANS) Find out about Routing Policy Specification Language, which will succeed RIPE-181 as the language used to express policy in the Internet Routing Registry. A description of the tutorial is available HERE. SUNDAY EVENING TUTORIALS Introduction to Multicast (Dave Meyer, Cisco) Interesting Things You Can Do With OSPF (Howard Berkowitz) After an introductory overview of the OSPF interior routing protocol, Berkowitz presents some interesting case studies of useful but non-obvious things one can do with OSPF, if one is willing to think "outside the box." The tutorial concentrates on determining requirements and network design, rather than detailed configuration, emphasizing ways that a high-powered OSPF domain can be a viable alternative to BGP for many customer and internal ISP applications. Also includes information about practical address management with OSPF. QoS and Ebone: Issues and Potential Solutions (Sean Doran, Ebone) Discussion of RED/QoS issues for the Ebone. Click here for a detailed overview of the talk. Network-based Denial of Service Attacks: Descriptions and How to Protect Your Network (Craig Huegen, Cisco) Recommendations on Queue Management and Congestion Avoidance in the Internet (Van Jacobson, Lawrence Berkeley National Laboratory) What Is a VPN? (Paul Ferguson, Cisco Systems) Definition of Virtual Private Networks and overview of approaches to building VPNs. Read the paper, by Ferguson and Geoff Huston, HERE. Dial-in VPN Using Layer 3 Tunneling (Gary Malkin, Bay Networks) Review of the Virtual Private Networking topology and problem space, overview of encapsulation and tunneling, and Bay Networks's DVS solution. Broadband VPNs - Outsourcing ISP services to Cable TV and XDSL Providers (Bruce Perlmutter, Bay Networks) Data over cable TV and xDSL are technologies that are experiencing enormous growth as a means to provide high speed Internet access to consumers. Most implementations of these technologies require the cable provider to become an Internet Service Provider (ISP) - a business for which they are often ill prepared. This presentation describes an architecture that allows cable providers to outsource the ISP function to a number of partner service providers. The cable provider installs and manages the physical plant, and bills the customer for services (voice, video, data) delivered over this plant. Data traffic from these customers arrives at the cable provider head end and is routed to an Internet Service Provider (or other data network) selected by the customer. Even though the customers are connected to a common access infrastructure (XDSL or cable TV), they appear as though they are connected only to their selected ISP. This approach can be called a Virtual Private Network. Issues discussed include: IP address allocation and packet routing, accounting and authorization mechanisms, and encryption and privacy issues. Roadmap to a Distributed Registry: Transition to RPSL (Routing Policy System Language) (Cengiz Alaettinoglu, ISI, Curtis Villamizar, ANS) Differentiated Services Panel: Working Group Update and Viewpoints From the Community (Kathleen Nichols, Bay Networks, moderator; Van Jacobson, Lawrence Berkeley National Laboratory, Fred Baker. Cisco, Peter Ford, Microsoft Building Large-Scale Internet Measurement Infrastructure (Vern Paxson, Lawrence Berkeley National Laboratory) Scaling and Other New BGP Features (Mark Turner, Cisco) Recent work on BGP scaling issues, including support for peer groups over multiple IP subnets, prefix lists, neighbor route count limits, and Cisco Express Forwarding/QoS interactions. ARIN Update (Kim Hubbard, ARIN) InterNIC Update (Mark Kosters, InterNIC) Path and Round-Trip Time Measurements: a New Project at CAIDA (Daniel McRobb) Implementing Simplex IP Bandwidth Augmentation and IP-Based News and HTTP Broadcast Services via Geosynchronous Satellite (Avi Freedman, Net Access) Covers details of implementing half-duplex satellite bandwidth augmentation and news/web cache broadcast over satellite. Net Access does all three on one signal; for bandwidth augmentation, a Cascade-based solution and a Cisco IP-tunneling-based solution will be presented. Introduction to the NETPERF.NET Inter-Provider Network Performance Monitoring Project (Avi Freedman, Net Access) Sponsored by Net Access, the project deploys pairs of servers (one web server, one query box) at each provider being studied, and generates semi-real-time NxN graphs of packet loss, latency, and throughput between the various providers. All info is available on the webpage http://www.nanog.org xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Pam Ciesla 734-936-0172 - phone Merit Network, Inc. 734-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1 0

SMURF amplifier page
by Karl Denninger 04 May '98

04 May '98

As promised, we now have a web page for this. The current smurf list is at http://www.mcs.net/smurf This will be updated roughly weekly, or whenever major changes are made to the list of blocked networks. It contains, in addition to dialogue on the Smurf issue, a list of network numbers and "whois" lookups on the owners. IF YOU APPEAR ON THIS LIST YOU CANNOT TRANSPORT PACKETS INTO OUR INFRASTRUCTURE. Instructions for what you must do to get the block removed are contained within this page. Bitching and moaning is pointless - the only fix is to FIX THE PROBLEM. Thank you! -- -- Karl Denninger (karl(a)MCS.Net)| MCSNet - Serving Chicagoland and Wisconsin http://www.mcs.net/ | T1's from $600 monthly / All Lines K56Flex/DOV | NEW! Corporate ISDN Prices dropped by up to 50%! Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL ACCOUNTS Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included at no cost

11 16

Re: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!!
by Tim Salo 04 May '98

04 May '98

> Date: Thu, 30 Apr 1998 22:31:28 -0500 (CDT) > From: tim(a)alpha.net > Subject: Re: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!! > To: nanog(a)merit.edu > > It'd be nice if there were a more organized effort to collect these > addresses, but for the time being, here's my list. I've actually got > a bunch more, but these are hand-picked for having a large > amplification factor and also for not appearing on the mcs.net page. > > 194.47.135 > 194.47.136 > 164.156.26 > 204.30.35 > 204.199.101 It would be interesting to see if the use of these networks as smurf aplifiers increases once they are published on nanog. (Are we doing all the hard work for the smurfers, namely creating a consolidated list of all of the known smurf amplifiers?) -tjs

6 6

(Fwd) Re: More amplifier blocks (fwd)
by Chuck Davisson 04 May '98

04 May '98

Good point. TTSG in this case stands for Thomson Technical Services Group and has nothing to do with ttsg.com. Sorry if there was any confusion. Chuck Davisson > Hi folks, > > > 204.183.36 11 > > is mine and is now fixed. Sorry for the problem. Must have missed this > interface. > > Chuck Davisson > Network Engineer > TTSG > Ouch, TTSG, huh? Someone might think you work for us! Tuc/TTSG (ttsg.com) ---End of forwarded mail from TTSG <ttsg(a)ttsg.com>

1 0