- NANOG - lists.nanog.org

MCI Contact
by Forrest W. Christian 07 Jan '98

07 Jan '98

Could someone from MCI Internet please drop me a personal e-mail? I need to get some contact information. I'll explain more off-list. No, I don't need the NOC number, as this is not something the NOC needs to deal with. Thanks. P.S. Sorry to everyone else on the list. Wish I would have appropriated a couple of business cards from someone from MCI last NANOG I attended. - Forrest W. Christian (forrestc(a)imach.com) ---------------------------------------------------------------------- iMach, Ltd., P.O. Box 5749, Helena, MT 59604 http://www.imach.com Solutions for your high-tech problems. (406)-442-6648 ----------------------------------------------------------------------

1 0

cisco FAQ UPDATE
by Dave Van Allen 07 Jan '98

07 Jan '98

Happy New Year! We have completed the move of the old CISCO-FAQ to its new home and final resting spot. ftp.fast.net/cisco This is the new semi-official site and directory of both the old (deferred) FAQ and soon the new revamped FAQ. There are a few announcement files in the directory that will go into detail on how we are working to get an up to date FAQ, at least started by end of January. Before the holidays, I asked if anyone would be kind enough to send me <dave(a)fast.net> config files (stripped of passwds and incriminating stuff) along with a brief explanation of the more advanced sections. I received a few - THANK YOU! However I need many more - Specifically I am interested in collecting complex BPG configs that exploit the more advanced attributes such as communities, MED's and route reflectors. We also need ATM and FDDI config examples, a touch of CLNS, a sprinkle of IS-IS and OSPF with just a splash of IPX. SMNP, ACL's and general IP interface examples will also go along way. I will keep all configs sent confidential, and will only use sections in the FAQ that are generic. I will run everything past the donator prior to public consumption, and of course you'll get a plug for the help. We need general questions and answers too. We have set up a LISTSERV for the sole and exclusive purpose of submitting info to the FAQ. Details are in the .ann file on the ftp site. A special cry goes out to the gurus, you know who you are. You run the Net or at least help keep it running. I'd really like to hear from you - with even a quick config snippet, anything. We have a small team set up and ready to finally get an updated FAQ out after many years. We're committed and we appreciate your help! Best regards, David Van Allen - FASTNET(tm) / You Tools Corporation dave(a)fast.net (888)321-FAST(3278) http://www.fast.net FASTNET - Business and Personal Internet Solutions

1 0

Re: UDP port 137 Question
by Joe Pruett 07 Jan '98

07 Jan '98

this is a wonderful feature of ms internet explorer. when it connects to an http server, it also tries to make an smb connection as well.

2 1

Re: UDP port 137 Question
by Joe Provo - Network Architect 06 Jan '98

06 Jan '98

>One would hope the backbones aren't passing 255.255.255.255 around to come >in via his Internet connection You would be surprised at the *source* addresses on packets that hit some of my borders: [typical 1918 addresses clipped] deny ip 127.0.0.0 0.255.255.255 any (56 matches) deny ip host 0.0.0.0 any (1818 matches) I find source 0/0 to be truly entertaining. Cheers, Joe -- Joe Provo, Network Architect 508.229.8400 x3006 Network Operations Center Fax 508.229.2375 UltraNet Communications, Inc. <jprovo(a)ultra.net>

1 0

Re: Deciding whose network block is whose?
by Sean M. Doran 06 Jan '98

06 Jan '98

Geoff Huston <gih(a)telstra.net> writes: > I am looking to the regional registeries to take some level of initiative > and provide clients of their address allocation service the ability to > sign the allocation and then the client can sign the routing request to the > provider which the provider can verify against the regional registry. > We went through this in discussion in the room at the time and it > looked like a viable and useful approach. Yes, but this is only part of the problem. I mean, fantastic idea, but then it's not exactly transitive. How do I know I can trust that Telstra's announcements have been authorized by the people responsible for the prefixes in question? Worse, since I do not talk directly with Telstra, how do I know I can trust the intermediary networks not to have performed (or fallen victim to) AS path surgery? Moreover, other than prefix-length filtering, what can I do to prevent falling victim to subnet-announcement attacks? Note that a larger CIDR block can still fall victim to announcements of /19s in networks which use The Satanic Filters. Perhaps you have some idea other than mine (prayer) for scalably solving these and similar issues? Sean.

2 1

Re: UDP port 137 Question
by gary flynn 06 Jan '98

06 Jan '98

> From: "C. Jon Larsen" <jlarsen(a)ford.ajtech.com> > > Is there any *valid* reason to see UDP traffic directed at a unix box's > port 137 coming from IP sources across the internet ? The unix servers in > question are most definitely *not* running samba, and there is absolutely > no NT anywhere on this customer's network (that is seeing the incoming UDP > traffic directed at an IP destination address on port 137). (A couple > of 95 boxes scattered across an Ethernet comprise the Micro$oft part of > the network). None of the 95 boxen are running any file or print serving > (sharing) resources. > > I can't think of any valid reason to see this traffic, personally. Anybody > out there that can present a scenario where I would expect to see these > UDP packets coming back in ? > > netbios-ns 137/tcp nbns > netbios-ns 137/udp nbns > netbios-dgm 138/tcp nbdgm > netbios-dgm 138/udp nbdgm > netbios-ssn 139/tcp nbssn Windows boxes will attempt name resolution using whatever protocols are configured...TCP/IP, Netbios, Netbios/TCP, Netbios/IPX, etc. Our name servers and some other public boxes are hit all the time because of this. (A campus WINS server would really cut down on this but we haven't got around to it yet.) I've seen a *LOT* of LAND attacks using these ports too. (i.e. 134.126.1.2 port 137 -> 134.126.1.2 port 137) Is the source address and port the same as the destination? I also seem to recall that using a Web browser (IE only?) on a Windows client with TCP and Netbios configured will hit these ports but I don't remember the details. If the Win95 boxes are browsing exterior NT based Web servers, those servers may be attempting name lookups for the Win95 boxes to the authoritative name servers. Or someone may just be scanning the network looking for someone with their C:, N:, etc. drives published to the world with no passwords :) Gary Flynn Network Analyst James Madison University

1 0

Re: Deciding whose network block is whose?
by Sean M. Doran 06 Jan '98

06 Jan '98

Sean Donelan <SEAN(a)SDG.DRA.COM> writes: > Other than Sprint's global default for 0/1 (and then > SPRINT has the nerve to complain when people point > default at them) there is no information in the IRR > about valid origin ASNs for Net 3/8. I am a hypocrite. I have flexible opinions. However, I do not believe for an instant that Sprint actually advertised 0/1 to the people Sprint (whether you mean me, Peter or Hank by that) have complained about. (We did twice advertise 0/1 to InternetMCI and others, which was interesting in several ways.) > The problem of bogus routing has been getting worse. Is it going to > take a disaster to get the attention of various > provider's management? Uhm, what does manglement have to do with reality? Do you really think there is some manager out there who is preventing people from "fixing" this problem, or who could somehow cajole her or his staff into doing a "fix"? The address registries are believed because the address registries aggregate the routability policies of the various networks participating in the Internet routing system. They are authoritative because ISPs have made them so to prevent a large amount of bilateral negotiations about what really should be routed where. The problem is not the lack of a canon, but the lack of a cannon; there is no simple means by which to enforce completely correct routing with present technology, while preserving the flexibility of timely dynamic reconfiguration of the Internet. Sean.

1 0

Whats up?
by Leigh Porter 06 Jan '98

06 Jan '98

Hi, Did something just happen? There seem to be an awfull lot of damped routes right now? -- Leigh Porter Wisper Bandwidth.

2 2

Re: International Internet Connectivity
by steveb＠internet.netway.co.nz 06 Jan '98

06 Jan '98

I can give you the historical situation, although this is slowly changing as the Net is becoming slightly less 'US-centric'. The philosophy for international connection to 'the Internet' (ie USA) was exactly the same as with in the US itself. That is, those wishing to connect could do so at some financial cost levied by the US ISP/NSP in addition to the cost of the transport. In the international case, this means a huge cost to those wishing to connect as they must pay the whole cost of trans-oceanic capacity. In general, because of the fact that the Internet is still US-centric, this results in high traffic flows outgoing from the US compared with much smaller incoming traffic flows. In the the case of New Zealand, only aobut 20% of the total traffic is incoming at the US end. Traditionally (and I speak for Oceania only), there were virtually no peering agreements internationally, with the result that the cost of all traffic and all transport was borne by the country connecting to the USA. This is changing slowly as large US ISP's find the need to service their multi-national customers in countries other than the US. To answer your questions more specifically: 1) I'm not sure of the answer you want here, but in general the peering rules internationally are similar to those in the US; that is, the international connection would appear in a similar manner to any normal ISP connection. 2) Peering agreements are now being considered internationally and these are generally very much 'ad hoc'. There are no hard and fast rules and the agreements are generally based on the perceived benefit to each of the parties. This may be done purely on a 'guesstimate' of traffic ensuing from requests emanating from each of the parties and a settlement made on this basis. The peering arrangement may be at either end of the international links although the 'normal' situation is for the agreement to be held at the 'busy' end - normally the USA, in the case of that country. 3) The international connectivity (cables and satellites) is owned by various consortia and capacity is 'sold' to interested parties. This may be done on a 'wholly-owned', end to end basis (depending on connection and operation agreements in place between the countries) or on a 'half-circuit' basis where the purchase of the (say) cable would be made by one party. For example, New Zealand would purchase the capacity to half-way across the Pacific, in the case of a New Zealand-USA connection. The remainder, from that point in the Pacific to the US, say, would be purchased by some US ISP/NSP. Traditionally the American half would be leased back to the remote country, who would then effectively pay for the whole transport cost. Hope this helps... Steve Barr Netway Communications +64 9 357-1566 ______________________________ Reply Separator _________________________________ Subject: International Internet Connectivity Author: George McCormick <gmccormick(a)csmgusa.com> at internet Date: 06/01/98 09:09 I would be extremely appreciative if someone could explain to me how US ISPs and backbone operators address their international connectivity requirements: o How is their traffic routed? o How do peering relationships work and where do they take place? o Who pays whom for international transport(undersea cable and/or satellite) and services? Sincerely, George McCormick CSMG Cambridge, Massachusetts 617-864-0022

1 0

Internic contact?
by Alex Rubenstein 06 Jan '98

06 Jan '98

Who do I speak to at the internic in regards to a root-server not foing proper delegation for a domain? I called the 703.742.4777 #, and got a nobody, who transfered me to the 'second level tech'. He must be sleeping, cause they never answered the phone after abotu 30 rings. HELP!

1 0