- NANOG - lists.nanog.org

Re: routes to hit 50,000 soon? or filter AS 7007....
by Danny McPherson 25 Apr '97

25 Apr '97

> > Agreed. I thought the same thing. Also, oldest servers are usually in > the beginning of the block, since we tend to start from the beginning and > work towards the end (well, perhaps I speak for myself). The servers > around longest are also probably more likely to have more information on > them and be more useful: Take webservers, for example. As time passes, > I've seen more and more activity to our oldest webservers simply because > there are more links on the web, more content (I think it was Einstein who > first figured out time and content are related) and more entries in search > engines. > > And let's not forget our routers, which are usually .1 in the first /24 :) > although you can't filter your entire block from other providers, i'd suggest that you filter the routes that won't be allocated to customers (backbone, internal, etc..) .. else you have even bigger problems when things like this happen. -danny

1 0

Ingress Filtering
by Daniel Senie 25 Apr '97

25 Apr '97

I've been getting bombed for 3 days by someone who's using an RFC 1918 address as a source address and firing ICMP ECHO REPLY packets at a few addresses within our network. I've been trying to get some info on who is doing this, but haven't gotten anywhere yet. Seems a lot of folks are not yet doing any ingress filtering on their lines. This kind of stuff is easy to cure at the source, but a real pain at the target end... Please consider adding ingress filters if you don't already use them! Dan Daniel Senie mailto:dts@openroute.com Sr. Staff Engineer http://www.openroute.com/ OpenROUTE Networks, Inc. (a wholly owned subsidiary of Proteon, Inc.)

1 0

Re: routes to hit 50,000 soon? or filter AS 7007....
by Alex Rubenstein 25 Apr '97

25 Apr '97

out of 47000 routes from Agis, 7327 of them have 7007 in them. I spoke to them and they said that thier router broke.. They won't give us an answer, but when I said I was from Net Access, he said "nac.net?" like he knew me, and they were vague. They also claimed that they had 'turned thier router off', but the routes were still in for almost 25 minutes later. Not only that, it seemed mailcious to me, because the only announced the /24 of our name servers (207.99.0.0/24) and not our whole /17. VERY STRANGE. AND THEY WON'T ANSWER ANY QUESTIONS. [rs.internic.net] FL Internet Exchange (ASN-FLIX) 115 Walnut Avenue Revere, MA 02151-5125 US Autonomous System Name: FLIX Autonomous System Number: 7007 Coordinator: Bono, Vincent J. [1LT] (VB14) vbono(a)MAI.NET 703-734-8602 1-800-918-0524 (FAX) 1-703-506-1436 At 10:49 AM 4/25/97 -0600, Christian Nielsen wrote: > >sorry if someone thinks this is the wrong message for the group, but it does >effect us all... > >we are seeing lots of routes coming in > >sho ip bgp sum >BGP table version is 6699646, main routing table version 6699646 >49793 network entries (94886/99644 paths) using 8897576 bytes of memory >11894 BGP path attribute entries using 1541824 bytes of memory > >but the routes seem to be coming from AS 7007... They are advertising many >routes, even our own. Sorry, but email and phones to them isn't working. > >*> 156.5.0.0 137.39.167.29 50 701 701 701 1239 >1790 7007 ? >* 208.131.13.29 0 5650 6176 1239 1790 >7007 ? >*> 167.32.0.0 137.39.167.29 50 701 701 701 1239 >1790 7007 ? >* 208.131.13.29 50 5650 3561 3561 1239 >1790 7007 ? >*> 192.56.218.0 137.39.167.29 0 701 701 701 3561 >194 3909 1 1239 17 >90 7007 ? >*> 192.72.0.0 137.39.167.29 50 701 701 701 1239 >1790 7007 ? >* 208.131.13.29 50 5650 3561 3561 1239 >1790 7007 ? >*> 192.73.26.0 137.39.167.29 50 701 701 701 1239 >1790 7007 ? >* 208.131.13.29 50 5650 3561 3561 1239 >1790 7007 ? >*> 192.73.28.0 137.39.167.29 50 701 701 701 1239 >1790 7007 ? >* 208.131.13.29 50 5650 3561 3561 1239 >1790 7007 ? >*> 192.76.170.0 137.39.167.29 50 701 701 701 1239 >1790 7007 ? >* 208.131.13.29 0 5650 6176 1239 1790 >7007 ? >* 192.83.0.0 208.131.13.29 0 5650 6176 1239 1790 >7007 ? >*> 137.39.167.29 50 701 701 701 1239 >1790 7007 ? >* 192.83.64.0 208.131.13.29 0 5650 6176 1239 1790 >7007 ? > > > whois 156.5.0.0 >Unilever (NET-UNILEVER2) > Sprint International > > >Christian > >

5 4

Time Frame...
by Joseph C. Lappa 25 Apr '97

25 Apr '97

Hi, When did the BGP announcements from AS7007 start and end? Thanks Joe

2 1

RE: Interesting social phenomenon...
by Sean Donelan 25 Apr '97

25 Apr '97

>As you should well know, it's fairly difficult to break the internet as a >whole. Obviously one can break sections of it, and the "break" may >appear differently from one site to another. Therefore, although some >people may have had sever outages, some of us only lost sections >of the routes to AS 7007 and our email between several of us worked. That assumes a fairly rich mesh of alternate paths between providers. Unfortunately it fails when you limit you choices to only a few connections between a few providers. Instead of being able to lop off a small misbehaving section of the network, you are forced in to lobotomizing large chunks of your connectivity. In this case, if you only connected with Sprint, you lost connectivity to everything 'behind' Sprint. 'Behind' being relative to which side of Sprint you were connected. On the other hand, if you additional possible paths, you may have been able to maintain connectivity to more of the Internet even if you needed to shut Sprint's connections off for a time. It may be a difference between a 60% outage, and a 30% outage. All those little extra paths add up to better connectivity. And every path you don't use, is a piece of connectivity you lose. Sprint is just the current example, the same thing is true for maintaining connectivity to anyone you only see from 'one' place/provider/etc. InternetMCI had a filtering oops last year, and I'm certain other providers will have them in the future. Just because you have a good connection today, doesn't mean it will always be there. I think I'm going to dust off my draft on Guidelines for Responsible Internet Service Providers. So far I've received three comments, if you would like to review it one more time, it is available at <http://dranet.dra.com/draft-donelan-rnmg-latest.txt>. I plan on updating the section on out-of-band verification, and submit it as an informational RFC. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: routes to hit 50,000 soon? or filter AS 7007....
by Justin W. Newton 25 Apr '97

25 Apr '97

At 09:08 PM 4/25/97 +0100, Adrian J Bool wrote: >Are your nameservers in the first class C of your CIDR block by any >chance??? They have been taking CIDR blocks and squirting out >Class C equivilents. > >Sadly, many poeple (including me) think, oooh, nice big CDIR block lets >put all my important boxes in it's first Class C... Seems to be a >very bad descision ;-( Thats actually a really good point. I have (accidentally) protected myself from this as I am using the first C of my CIDR block for interfaces which never need to be reached by the outside world (hmm, time to move them to net 10 I suppose). Phil, is this something that might make some form of sdense for that PIER doc you are writing? Justin Newton Network Architect Erol's Internet Services http://www.erols.com ISP/C Director at Large http://www.ispc.org

1 0

Re: routes to hit 50,000 soon? or filter AS 7007....
by Stephen A Misel 25 Apr '97

25 Apr '97

At 09:08 PM 4/25/97 +0100, Adrian J Bool wrote: >On Fri 25 Apr, Alex Rubenstein wrote: >> >> out of 47000 routes from Agis, 7327 of them have 7007 in them. >> >> I spoke to them and they said that thier router broke.. >> >> >> They won't give us an answer, but when I said I was from Net Access, he >> said "nac.net?" like he knew me, and they were vague. They also claimed >> that they had 'turned thier router off', but the routes were still in for >> almost 25 minutes later. Not only that, it seemed mailcious to me, >> because the only announced the /24 of our name servers (207.99.0.0/24) >> and not our whole /17. > >Are your nameservers in the first class C of your CIDR block by any >chance??? They have been taking CIDR blocks and squirting out >Class C equivilents. > >Sadly, many poeple (including me) think, oooh, nice big CDIR block lets >put all my important boxes in it's first Class C... Seems to be a >very bad descision ;-( Agreed. I thought the same thing. Also, oldest servers are usually in the beginning of the block, since we tend to start from the beginning and work towards the end (well, perhaps I speak for myself). The servers around longest are also probably more likely to have more information on them and be more useful: Take webservers, for example. As time passes, I've seen more and more activity to our oldest webservers simply because there are more links on the web, more content (I think it was Einstein who first figured out time and content are related) and more entries in search engines. And let's not forget our routers, which are usually .1 in the first /24 :) Steve

1 0

Re: routes to hit 50,000 soon? or filter AS 7007....
by Alex Rubenstein 25 Apr '97

25 Apr '97

They claim a problem with BAY BGP code. >For example, if I had 172.16.0.0/14, 172.16.0.0/16 would have been >announced. I venture to take a guess that it's something nasty with >redistribution of BGP into a classful IGP and back into BGP again, but >since it's not my network, I can't tell you what happened. > >/cah > >

1 0

today's charlie foxtrot
by alan＠mindvision.com 25 Apr '97

25 Apr '97

Regarding today's Charlie Foxtrot: The problem that occured today appears to be caused by someone without clues redistributing their BGP (which contains a set of routes of people clueless enough to trust them to run an exchange point of sorts) into their IGP, back into the BGP tables. It is also possible that the lack of clues was involved in choosing a vendor that exhibited a bug similar to this. This caused the AS paths to be lost, allowing loopish things to occur. This caused router tables to flare, and improper paths to be propogated and used. Lots of churn for a stressed Internet. It seems to have propogated rather evilly by hiding in edge ASes and seeping back in via edge ASes to other providers (ie it comes in provider 1, and then goes out provider 2). This also seems to have been propogated by subasish behaviour of certain providers running confederations and multiple ASes. RSes mail re: email not being an effective mode for conversing is somewhat correct, nonetheless, I continued to receive email from NANOG through the issue. As well, several larger ISP folk were on the phone diagnosing the problem and taking action to minimize the effect. Enke's mail stating that filters could have prevented this is somewhat accurate, but it is not apparent that filtering folk were not at risk to this event. I'd be curious to hear what ANS saw. The duration appears to have been ~11:30 AM EDT to ~2:00 PM EDT. At no time was this a catestrophic Internet breaking event, so relax Bob. This could have been prevented by two things: 1/ Strict adherence to peer-peer filters. 2/ Someone not doing something stupid. I think we are getting too big to rely on 2 not happening. Yet the sense of liberty yearns for 1 not to happen. But it will. This will help accelerate it. -alan

1 0

Re: In case anyone hadn't seen this
by Enke Chen 25 Apr '97

25 Apr '97

The solution to this problem is filtering, which has been known for a long time. The provoders that have been filtering on the customer edge seem to have done much better in terms of providing sanitized routes. I am wondering how many such major outages need to occur in order to convince some providers to do customer filtering? -- Enke > * To: nanog(a)merit.edu > * Subject: In case anyone hadn't seen this > * From: "Alex.Bligh" <amb(a)xara.net> > * Date: Fri, 25 Apr 1997 17:41:43 +0100 > * cc: amb(a)xara.net > * Content-Type: text/plain; charset=us-ascii > * Sender: owner-nanog(a)merit.edu > > ---------------------------------------------------------------------- > > I haven't yet seen this on NANOG - Apologies if it's been there > 3 times by the time you read this or are one of those who doesn't > like NANOG used for large scale outage notification. > > > >Date: Fri, 25 Apr 1997 11:44:11 -0400 (EDT) > > >Reply-To: jun(a)wolfox.gsl.net > > >Originator: bulletin(a)gsl.net > > >Sender: bulletin(a)gsl.net > > >Precedence: bulk > > >From: Jun (John) Wu <jun(a)wolfox.gsl.net> > > >To: Multiple recipients of list <bulletin(a)gsl.net> > > >Subject: internet currently is partially down > > >X-Comment: Global IP Operational Bulletin > > >MIME-Version: 1.0 > > >Status: RO > > > > > > > > >There seems to be a major problem on the whole internet at this > > moment. > > >A network called FLIX (AS7007) is having a major routing > > malfunctioning, > > >and seems to have announced all major provider's blocks as more > > speficics. > > >(probably because of a classic mistake of redistricute BGP into IGP > > and > > >then IGP into BGP while the IGP does not know VLSM) > > > > > >This has currently brought SprintLink and UUNET to non-operating > > status, > > >perhaps other networks as well that I can not verify without > > connectivity. > > >(at the time this email is sent). I just called FLIX and they have > > >shut down al their peering sessions. The network should stablized in > > >a few hours. > > > > > >Jun > > >-- > > >Jun (John) Wu | Voice: (703)689-5325 > > >Supervisor - Global IP Systems & Services | Fax: (703)478-7852 > > >Global One Communications L.L.C. | Email: jun(a)gsl.net > > >Reston, VA 20196 | URL: > > http://wolfox.gsl.net/jun > > > > > ------- End of Forwarded Message >

3 3