- NANOG - lists.nanog.org

Re: Thanks for your help
by Sean Donelan 26 Feb '97

26 Feb '97

>Several of you responded earlier today with information that was helpful in >resolving the problem of a bad route to one of our networks being propagated. > >So, collected gurus of the net, how do we keep this from happening again? Its called MAD, Mutual Assured Destruction. Even if we discount deliberate sabotoge, mistakes happen. By their nature, mistakes by large providers are more spectacular. But the reality is providers of all sizes are one typo away from the dreaded routing blackhole. People can use things like route registeries to match and filter routes against the registered information. It doesn't really solve the problem, just moves it to a different place. People can still register annoying route objects, i.e. the universal default route, and trash connectivity for hours. Its tough to tie particular networks back to valid AS origins since they are allocated/assigned independently. Worse, if a provider doesn't tell the rest of us what the valid network/AS combinations are, how will we ever know when someone announces an invalid network/AS combination. He who lives by the ANY will one day die by the ANY. I guess that is what the telephone is for. But when someone blackholes 198.41.0, I hope you have the phone numbers memorized. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: demon.co.uk spam policies? [sorry if off-topic]
by Ehud Gavron 26 Feb '97

26 Feb '97

From: Scott Call <scall(a)ccnet.com> >Subject: demon.co.uk spam policies? [sorry if off-topic] >... >In light of the recent spam/nospam discussions on the list, I thought >I'd share something one of my customers got with the rest of you: > > >>From info(a)senora.demon.co.uk Fri Feb 21 17:29:07 1997 >Received: from home.glasscity.net (home.glasscity.net [208.13.0.1]) by 208.13.0.0/24 is on Vixie's Blackhole list. I know my customers aren't going to be receiving this sort of harassment. Ehud ccnet4.ccnet.com (8.7.1/8.6.12) with SMTP id RAA05294; Fri, 21 Feb 1997 17:29:06 -0800 (PST) From: info(a)senora.demon.co.uk Received: from home.glasscity.net (194.72.198.24) by home.glasscity.net (EMWAC SMTPRS 0.81) with SMTP id <B0000772250(a)home.glasscity.net>; Fri, 21 Feb 1997 20:28:01 -0500 Date: Fri, 21 Feb 1997 20:28:01 -0500 Message-ID: <B0000772250(a)home.glasscity.net> Subject: Dear spam hater. X-UIDL: 23485792837498720384760912734067 Priority: normal X-Flags: PXU2-4R65-2264:R Apparently-To: <anon(a)anon.net> X-Status: Status: RO HA HA HA HA You are on a published list of peolple who hate commercial mail! How STUPID can you get! Commercial email is just taking off - and I'm going to distribute this list everywhere I can to shut you whining people with nothing better to do than complain up! It's BASTARDS like you who got me shut down last time - but demon won't touch me! HA HA HA! I can go thru DIFFERENT servers! ANYTIME........... Alan -- Alan K Baker (MailWurliTzer Willy) www.senora.demon.co.uk alan(a)senora.demon.co.uk -- ___ / ~-. Scott Call | \ TCP/IP Network Administrator/Holder of Past Knowledge \\j`j; / , CCnet, Inc http://www.ccnet.com/ (^, )bxr~ Walnut Creek, CA ---' http://www.devolution.com/ 46. Outrageous vehicles only make the hero cooler. 101. Mallets can be stored anywhere on anybody. -All I Need to Know I Learned From Anime --Boundary_[ID_yl2sh+mR3ABtx3znZG6+4g]--

1 0

Re: BGP announcements and small providers
by sob＠academ.com 26 Feb '97

26 Feb '97

I would expect this to be on the NANOG notes page when I get that part done. -- Stan | Academ Consulting Services |internet: sob(a)academ.com Olan | For more info on academ, see this |uucp: {mcsun|amdahl}!academ!sob Barber | URL- http://www.academ.com/academ |Opinions expressed are only mine.

1 0

Re: BGP announcements and small providers
by Chris Phillips 26 Feb '97

26 Feb '97

At 02:51 PM 2/25/97 -0500, you wrote: >At 10:50 AM 2/25/97 -0500, Paul Ferguson wrote: >>Well, without naming names, the prefix-length based filtering is >>done on non-customer routes. A byproduct of this is it grudgingly >>encourages aggregation. > >Well, yes, but now that multiple providers are doing this the fact that >they are non-customer filters affects anyone who is not a customer of BOTH >providers, thus further encouraging people to aggregate. I would not mind >seeing these filters become more prevalent, making it unreasonable for >people to become customers of everyone who filters to get around the >filters. Renumbering is NOT that hard folks, and it DOES help. > We service hundreds of dedicated customers and some customers don't mind renumbering (if they are small) but most of our larger customers who have more than 100-200 hosts on their network have expressed GREAT opposition to any such notion of renumbering. Its not that they don't want to do it because they are lazy, on the contrary, many companies cannot the afford the downtime or cost asociated with renumbering their LAN/WAN. I agree that renumbering is an important aspect of address grooming for better agregation but there are some real $$$ costs to some end-user networks to do so. Also, how many times can you ask a customer to renumber before they bail and go elsewhere? -- Christopher K. Phillips Chief Technical Officer Rocky Mountain Internet, Inc ckp(a)rmi.net 303.672.0799 http://www.rmi.net

1 0

Thanks for your help
by Joseph C. Pistritto 26 Feb '97

26 Feb '97

Several of you responded earlier today with information that was helpful in resolving the problem of a bad route to one of our networks being propagated. So, collected gurus of the net, how do we keep this from happening again? We can wire down the route at the ISPs we take service from (and do), but what keeps some random person from propagating bad routes into the system and blowing away your network by accident? Surely there has been some thought given to this problem. I'm convinced today's incident wasn't malicious (at least until proven otherwise), but you can see the potential here. -jcp-

2 1

Re: Finding out where a bogus route is coming from?
by Dave Curado 25 Feb '97

25 Feb '97

> Any hints on how to do this? > > We have a situation where some person has broadcast a route which is > mapping one of our subnets to the wrong place. > I'm trying to track this at the Mae's to find out what's going on, but I'm > really interested in figuring out how > one can prevent this sort of thing or find out the original source of the > bad route. Resolving the issue should be straight forward: - traceroute to something on that subnet from a few places (see http://www.boardwatch.com/isp/trace.htm amongst others) - get a phone number for the noc or whatever of the org that announcing your routes, (try whois, or possibly their web page... (whatever, get creative)) - give them a call and explain the situation, open a ticket if they have a ticketing system, and move forward from there You may have to convince them that the problem exists, by forwarding on traceroute info or whatever. Hopefully their noc staff will be helpful, reasonable, and clueful. I have no suggestions for how to prevent this problem from occurring. Hope this helps, davec

1 0

Re: interface defaults again
by Paul A Vixie 25 Feb '97

25 Feb '97

> I attended your talk at NANOG. One question I have is - why use SQUID? > Why not have the web server directly connected? Originally it was because I used BGP and the Web server didn't have a strong enough kernel for (then) 38,000 routes. Now it's because the web server only has one Ethernet interface and on the BSD/OS system can have 12 (three Zynx PCI cards with 4 ports each), and the customer may get to the point where four or five providers (remember, this is DEC PAIX) seems like a good idea. In the future it'll be because there are more than one web server and we'll want to stash a whole farm behind a single or small number of Squids.

1 0

Finding out where a bogus route is coming from?
by Joseph C. Pistritto 25 Feb '97

25 Feb '97

Any hints on how to do this? We have a situation where some person has broadcast a route which is mapping one of our subnets to the wrong place. I'm trying to track this at the Mae's to find out what's going on, but I'm really interested in figuring out how one can prevent this sort of thing or find out the original source of the bad route. -jcp-

1 0

Start ISPs as Registries
by Jim Fleming 25 Feb '97

25 Feb '97

On Tuesday, February 25, 1997 2:06 AM, Avi Freedman[SMTP:freedman@netaxs.com] wrote: @ > But now we are receiving many petitions from much smaller ISP's @ > asking for BGP connections. These small customers are going to announce @ > few networks (a couple of /24, or some /23). We have no problems to @ > configure our routers with more BGP peerings, as our routers can support @ > it, but I'm a little bit concerned about the impact of such small @ > announcements to the whole Internet. @ @ I think the general feeling is that if the customer is multi-homed, there's @ going to be another route announcement for them anyway - whether it's a @ /23, /24, or /16 or /17. @ In my opinion, ISPs start at the wrong end of the business. We should try to encourage future ISPs to start as registries BEFORE they buy a lot of modems, routers and other stuff. If the airlines ran like the Internet, they would encourage pilots to buy their own planes, to transport customers, and after getting enough hours, they would teach them about air traffic control, navigation, weather, radios, etc. Because there has been a lack of emphasis on growing the IP address registries, and domain registries by the InterNIC, people do not get an opportunity to train in those important functions first, before jumping into the cockpit. As a net result of this, it is hard to find ISPs who are growing into the registry business. I suppose some ISPs do not see that there is any money in that end of the business. I also feel that there is a lack of education in this critical area. If NANOG members have any influence on the direction the Internet takes, I suggest that they help new ISPs first learn the registry end of the business. One way to do this is to help establish IP address registries in your area and the training programs needed to allow people to handle allocations as skilled professionals. There is not much capital required to launch someone as a registry, compared to the capital required to be an ISP. The key ingredient needed is education and NANOG seems like a natural group to help people get started. With the various charging models coming out of the ARIN discussions <http://www.arin.net>, there should be a lot of food for thought on how a few people in an office with some PCs, paper, pencils and telephones can become registries and support themselves. Once established as a registry, these skilled professionals could grow and branch out to add other services. Who knows, they could even become ISPs, and if they do, then they would have a firm foundation of registry training to support their growth and to better serve the Internet -- Jim Fleming Unir Corporation e-mail: JimFleming(a)unety.net JimFleming(a)unety.s0.g0 (EDNS/IPv8)

1 0

Re: BGP announcements and small providers
by Paul Ferguson 25 Feb '97

25 Feb '97

If the downstream customers are not multihomed, there's no reason to run BGP with them; a simple default/static will work just fine. Also, if you suballocate addresses to them from within your address space, you can aggregate them. This is generally considered a Good Thing. - paul At 08:06 AM 2/25/97 -0500, Avi Freedman wrote: > >I think the general feeling is that if the customer is multi-homed, there's >going to be another route announcement for them anyway - whether it's a >/23, /24, or /16 or /17. > >If the customer isn't multi-homed, and you're their only path, then: > >a) If you BGP with them and pass it on to the global 'net, that path > will flap if the line goes up or down. This is considered bad. > >b) There's no point, if that route is out of your address space, in > announcing the more specific if there's no extra path to them if > their connection to you goes down. >

4 3