April 1995 - Test - lists.nanog.org

Non-Routing BGP Speakers
by sds＠jazzie.com 29 Apr '95

29 Apr '95

RFC 1771 says in part: The hosts executing the Border Gateway Protocol need not be routers. A non-routing host could exchange routing information with routers via EGP or even an interior routing protocol. That non-routing host could then use BGP to exchange routing information with a border router in another Autonomous System. The implications and applications of this architecture are for further study. Would anyone be willing to share their experiences with (or thoughts about) this approach? Given that 64 MB of RAM for routing tables woudl cost only around $2,000, this seems like a totally sensible way to build a small, multi-homed AS. Will finding a vendor-supported system for this be ... difficult? (I'm not exactly sure whether a BSD box running Cornell GateD counts as "vendor-supported". ;-) -- Sean Shapira sds(a)jazzie.com +1 206 443 2028 <a href="http://www.jazzie.com/sds/">Sean's Home Page</a> Serving the Net since 1990.

7 8

Re: Has PSI been assigned network 1?
by Vadim Antonov 28 Apr '95

28 Apr '95

>> I agree that one cpu does all is outdated monolithic design. >> Even hub vendors have two: one for hubbing, one for snmp and rmon. >> >> Mike >The existing route servers do this now... One CPU to compute routes and >then we forward the tables to ISP peers. The existing cisco 7000 does this now. Take a look at SP board someday. --vadim

2 1

Re: Has PSI been assigned network 1?
by Vadim Antonov 28 Apr '95

28 Apr '95

Karl, you obviously do not understand what global networking and policy routing mean. Right today we nearly killed all Internet by _not_ doing paranoid filtering on ANS route announcements (well we couldn't do it because of certain contractual obligations). ANS had trouble with generating configuration for ENSS 147, so they simply dropped all routes at our MAE-East+ box without filtering they usually do, which would be fine if we didn't do some upgrades at ICM, which involved changing preferences in ICM-SL routing, to the effect that SL started preferring AS 690 as path to many European networks. It resulted in SprintLink -> Europe traffic being moved from SL->ICM FDDI connection to SL->ENSS(147)->ANS core->Dante path; which at the daytime grew and turned out be enough to overload ENSSes along the path. This resulted in ENSS 147 delaying BGP keealives for so long that MAE-E peers (including SprintLink) were dropping their BGP sessions, only to reset them later. Since that causes route caches being flushed all _other_ ciscos were falling back to switching by CPU, became overloaded and started dropping their BGP sessions. Which resulted in snowball of real massive routing flap. I imagine how Internet would work if everybody listened to the enlightened advice of our esteemed sage: >Fascistic filtering breaks connectivity. > >So you trade a *risk* of broken connectivity for KNOWN broken connectivity? > >Sounds like a poor trade to me, and one which, undertaken consciously and >with knowledge of the repercussions, leaves you with being less than a full >Internet connectivity provider. > >After all, if you're filtering perfectly valid announcements then you are, >by definition, not providing connectivity to the "whole Internet" to the >best of your ability, are you? Sorry, Karl. Internet is lucky that people who run most big networks know better than to wait for shit to happen. In the system as large as Internet shit happens permanently. Somewhere, in the most unxpected places. If you persist in your dislike of filtering i guess i'll purely accidentally misconfigure a static route, so it will be the the same as your backbone address. RS won't save you. This is a joke, of course. --vadim

9 13

Re: Non-Routing BGP Speakers
by Sean Doran 28 Apr '95

28 Apr '95

| We have upgraded our box since then; Curtis, have you had a chance | to look at this yet? It is a disaster waiting to happen again Serpil Bayraktar tells me that ANS upgraded their boxes a while ago. I believe an announcement went out about this on the gated list or somesuch, and that the ANS fix also has been put into the gated consortium's code. Sean.

3 2

Re: Has PSI been assigned network 1?
by Sean Doran 28 Apr '95

28 Apr '95

You would think the words "Silicon Switch Processor" might clue people in that the board in question has nice little chips on it doing routing/switching, leaving the 68040 free to process BGP updates etc. Unfortunately, the 68040 is unable to keep up in ugly situations... Sean.

1 0

Re: Has PSI been assigned network 1?
by Hank Nussbacher 27 Apr '95

27 Apr '95

On Wed, 19 Apr 1995 18:49:39 -0400 you said: >>telent info.ripe.net to test it out. > >RIPE database does not control the actual routing. > >I'm not sure the current RADB project has any mention >of real-time updates of gated from the database. `With dozens of updates we do every day it nearly as good >as useless. CERN (as an example) picks up my routing updates daily and builds its new access filter based on mine and others routing updates. I'm not sure you want realtime updates to the actual routing. In any event, it is an improvement over the time lag of NACR updates. >>It should be secure. > >>I use a password on all AS updates to AS378. > >You call *that* secure? We have way too many people who >need to do changes for our AS-es. Check the contact >list for AS1800. You can assign as many users as you wish to control specific ASs. Currently it checks my email address and password. No match - and the maintainer of the AS gets a warning mail about the attempt to alter the routing within my AS - and I have gotten warning e-mails already. Adding in PGP authentication should not be too hard if it is not done already. >If i can't implement my existing policy, i cannot use RADB, ok? > >(Well, we _will_ use it -- to talk to people whose announcements >are loaded with garbadge). We simply cannot use it to talk >to major service providers because policies in place cannot >be represented in RIPE-81. So speak to the authors and get it improved. >--vadim Hank

7 7

IPPM mailing list preload.
by Matt Mathis 26 Apr '95

26 Apr '95

The IPPM (IP Provider Metrics) mailing list was only partially preloaded from the NANOG list. There were a number of entries on the NANOG list which were not included. In general, individuals and downstream exploders of the form "staff@site", "site-eng@site", and "admin@site" were included. However, downstream exploders mentioning other lists WERE NOT INCLUDED. For example "nanog@site", "nanog-dist@site", "iwg@site" were not included. If you receive this message, but not the IPPM kickoff, please consider adding yourself or your organization by sending mail to ippm-request(a)psc.edu. Thanks, --MM-- ------- Forwarded message Return-Path: mathis Received: from mailer.psc.edu by zippy.psc.edu via SMTP (931110.SGI/930416.SGI.AUTO) for mathis id AA03741; Wed, 26 Apr 95 15:49:46 -0400 Received: from zippy.psc.edu by mailer.psc.edu (5.65/Ultrix3.0-C 11/12/92 nydick) id AA04083; Wed, 26 Apr 1995 15:39:19 -0400 Message-Id: <9504261939.AA04083(a)mailer.psc.edu> To: ippm(a)psc.edu Cc: mathis(a)psc.edu Subject: IPPM Kick off message Date: Wed, 26 Apr 1995 15:39:17 -0400 From: "Matt Mathis" <mathis> This is kickoff message for the IP Provider Metrics mailing list. If you do not want to receive any further messages, send a note to ippm-request(a)psc.edu. However, be forewarned that this list has been pre-loaded with precisely the people who are mostly likely to be effected by our actions. >From the draft charter: The IPPM WG will develop a set of standard metrics that can be applied to the the quality, performance and reliability of an IP datagram service. These metrics will be designed such that they can be performed by the providers themselves, customers, potential customers or independent testing groups. There is now a home page at http://www.psc.edu/~mathis/ippm, including pointers to the minutes, etc. I am still looking for candidates to co-chair the working group. Thanks, --MM--

1 0

Re: Has PSI been assigned network 1?
by Sean Doran 26 Apr '95

26 Apr '95

Hi - All our junior people are immediately deployed to projects. One such person was brought into our engineering group and practically immediately was given responsibility for making all of NYSERNET work and handling whatever escalations he could. Another is deployed in dialup and in assisting with routing matters. Another is busy dealing with research and resource planning for how we want to scale. I can think of innumerable engineering and operations tasks that need doing before deploying a junior engineering type to writing documentation. OTOH, we have been working with marketing on the customer handbook (http://www.sprintlink.net/ has various drafts), so I imagine that if we had a clever tech writer remarkably skilled at finding the right moment to talk to busy engineering folk, we could produce something. Funnily enough, that's what Vadim and I have already asked management for, however that's with a view to documenting our internal procedures so that we can scale up our own engineering and operations, not to mention all the other documentation that we need doing internally. So, to extend the point that Geoff made earlier -- any resource a busy operator has will get deployed into making that operator's part of the global Internet _work_, not into helping out other people. This is not due to a mean lack of altruism, but rather to the realities of life in a global network that doubles in size and traffic severy six-to-nine months or so. Now, if you go talk to our marketing about the possibilities of increasing revenue via some of the in-house documentation we're planning, you might have a big operator actually produce a book along the lines you are thinking, or putting together a page for beginning Internet operators. Try bouncing some ideas off our marketing types; I'd be happy to pass you on to one in private email. Sean.

2 1

Re: Has PSI been assigned network 1?
by Hank Nussbacher 25 Apr '95

25 Apr '95

On Sun, 23 Apr 1995 12:33:54 -0500 (CDT) you said: >Hank, > >Enduser filtering (CERN) is in principle completely different from what we >(might if not possible else) do: > >I am not supposed to filter anything between meetpoints and customers, >because I agree to some people who pay for it to provide Internet access. > >I would filter nothing at all (curretnly do filter nothing), which does >not mean that my suport hosts and networks are open. >Filtering comes alo into place when customers want only access between >certain networks, >but in general > >NSPs/ISPs are not supposed to filter at all. > >Routing is different. We filter routing updates (not access filters) to >accelerate BGP convergence. We filter what we announce to the outside >world (of course not all the trash we get in). I don't filter outgoing routing updates to speed BGP convergence. I do it so as not to pollute the Internet with leaked bad nets. It has happened to me and has happened to everyone. Just look at the recent nets that Australia was leaking. If the routing access lists were automatically created every day based on the data in the routing DB, then this would not happen. Of course, no one can force you but your service provider can filter what he/she hears from you based on the same rules. Then you have a double secure routing scheme. > >Mike >Michael F. Nittmann >nittmann(a)wis.com Hank Nussbacher

11 13

refresher - what's happening
by epg＠merit.edu 25 Apr '95

25 Apr '95

Hi, At 0700 EDT on Tuesday, April 25, all peering sessions on ENSSes: 128 129 130 131 133 134 135 137 139 140 141 142 143 145 will be commented out of the routing configuration files. If there is a catastrophic failure tomorrow morning, Merit will advise the ANS NOC to roll back to the previous configuration (the one installed on Tuesday morning). If it is determined that problems are isolated to individual autonomous systems, Merit will enable the sessions with those individual autonomous sytems. If there are individual routes from many sources which are unreachable, Merit will designate one emergency configuration time period at which all of the independent additions wil be made. If you are experiencing problems tomorrow after 0700 EDT, please call 1-800-456-6300 or 1-313-677-7333. The NOC operators will page a Merit engineer to help you. If you still have email access, you may send a message to trouble(a)ans.net. Thanks for your help in getting prepared for this day. --Elise

4 4