December 1996 - Test - lists.nanog.org

RE: Policies affecting the Internet as a whole - Hitting where it hurts
by Chris A. Icide 27 Dec '96

27 Dec '96

There is a Gent in DC by the name of Thom Swink. He is with the Computer Crime Squad of the FBI, and is a member of the Internet group. He seems very knowledgeable as is many of his peers. Their phone number there is 212-384-1000 and his extension is X4505. This would definitely be a good place to start. We've been here quite a few times with more acceptable results than non. Chris ---------- From: Alan Hannan[SMTP:alan@mindvision.com] Sent: Friday, December 27, 1996 10:12 AM To: nanog(a)merit.edu Subject: Re: Policies affecting the Internet as a whole - Hitting where it hurts Hi. I wrote: ] > Did you contact a law enforcement agency? Did we comply with ] > their wishes? ] > It seems that you are asking for vigilantism, not cooperation. Kim wrote: ] What sort of law enforcement agency would contact uunet ? ] How about my local township police department ? Whatever law enforement agency has jurisdiction. If the attacked server is within their jurisdiction, that would be a good place to start. Potentially you will have to escalate this to the FBI, as they seem to be pretty savvy to computer crimes, on a relative scale. Law enforcement agencies _do_ contact providers, and do catch folk. Read any popular book about shimomura and mitnick to see an instance. (legal tramplings not withstanding) I make no bones about this being a difficult problem, and I don't mean to infer that Mr Hawn was attacking UUNET or advocating that an ISP "retaliate". I apologize that this came across this way. However, the more general theme seems to infer that providers of service should maintain some level of responsibility for what their users do. This scares me, in the "real world". -alan

1 0

Re: Policies affecting the Internet as a whole - Hitting where it hurts
by hcb＠clark.net 27 Dec '96

27 Dec '96

At 11:29 AM 12/27/96, David Schwartz wrote: >On Fri, 27 Dec 1996, Neil J. McRae wrote: > >> The last thing the Internet needs is some dodgy cartell deciding on >> who is allowed access and who isn't. Although I've had similair experience >> mostly from academic sites. > > I think a list of sites that refuse to deal with troublemakers >(with details) would be extremely useful. If people want to use it to >blackhole traffic, that would be their decision. > > Even more importantly, you could check it before choosing an ISP >or provider to be sure that your provider is running a clean ship. That >way you don't get inconvenienced by other provider's defensive acts >against your provider. > > As an added bonus, you have some more assurance that your provider >will come to your aid if you are mail bombed, ping flooded, or hacked in >some other way. Providers that deal effectively with their own customers >when they create trouble are much more likely to assist their own >customers when they are attacked. > > David Schwartz > WIZnet Perhaps the model we might examine is not so much a cartel that decides who gets access, but that of a credit reporting service. Each merchant that uses such a reporting service makes an independent decision whether or not to grant credit. If such a service were established, I certainly would want to avoid the secretiveness, and resistance to correction, that long affected -- and still affects some -- credit bureaus. Howard Berkowitz

1 0

Re: [Announce] traceroute sites
by Paul Ferguson 26 Dec '96

26 Dec '96

Very nicely done. - paul At 12:18 PM 12/11/96 -0500, gv wrote: >A traceroute utility has been added to the Cable and Wireless Internet >Exchange (CWIX) network. There are links to nodes worldwide; on and off >the CWIX network. >You are welcome to take advantage of this as the need arises. > >traceroute url: >http://www.cwix.net/cgi-bin/trace > > >-- >Gary vonErden >gv(a)cwix.net >http://www.cwix.net/ > -- Paul Ferguson || || Consulting Engineering || || Herndon, Virginia USA |||| |||| tel: +1.703.397.5938 ..:||||||:..:||||||:.. e-mail: pferguso(a)cisco.com c i s c o S y s t e m s

3 2

ANNOUNCEMENT: NANOG Registration
by William B. Norton 24 Dec '96

24 Dec '96

Hi all - The NANOG 9 (Feb 97) Registration form is on-line today (www.nanog.org) More information about the hotel, local logistics, and initial agenda will be put up on the web in January. Merry Christmas! Bill -------------------------------------------------------------- William B. Norton <wbn(a)merit.edu> (313) 764-9430

1 0

cisco-nsp mailing list
by dave o'leary 23 Dec '96

23 Dec '96

Dorian Kim and his associates at CICnet have been gracious enough to create and host a list for discussion of cisco equipment, services, etc. as we relate to the service provider market. This list is intended to be much like the cisco(a)spot.colorado.edu list, except focused on service providers. This should help remove some of the cisco-specific chatter from the NANOG list (at least it provides a convenient place to redirect it which is potentially more appropriate). Here is the charter that we (actually Paul Ferguson) came up with: The cisco-nsp mailing list provides a forum for Internet Service Providers to discuss issues specific to cisco Systems product line implementations, both hardware and software related. While this list is not an official support vehicle of cisco Systems, Inc., both general and specific discussions are encouraged. Support issues should be directed at the usual support channels (cisco Technical Assistance Center, etc.) Subscriptions are via majordomo to cic.net, i.e. send mail to <Majordomo(a)cic.net> with the following command in the body of your email message: subscribe cisco-nsp <your email address> Alternatively, you can send to <cisco-nsp-request(a)cic.net>: with the command "subscribe" in the body of the message. thanks, dave

2 1

APRICOT '97
by David R. Conrad 22 Dec '96

22 Dec '96

Hi, Apologies if inappropriate and if you've seen this before (but quite a few NANOG people indicated they wanted to attend, so...) -- The Asia Pacific Regional Internet Conference on Operational Technologies (APRICOT, http://www.apricot.net) is a conference and series of tutorials targetted primarily at people who run (or want to run) large networks, particularly Internet Service Providers. This year, there are 13 tutorials ranging from DNS to Perl Programming and a 3 track conference consisting of 2 two day tracks on network operations and services & applications, and 2 one day tracks, one on legal and policy issues in cooperation with the Asia Pacific Policy and Legal (APPLe) Forum and the other, the Business of the Internet, in cooperation with the Asia Pacific Internet Association (APIA). For more information on the conference program and the tutorials, see http://www.apricot.net/program.html. To register for the conference, see the APRICOT registration page at http://www.apricot.net/registration.html (note that the web page uses SSL for secure transfers so you can safely send your credit card numbers over the Internet). If you do not have access to the web, please contact me and I'll send or fax an email form. Dates: APRICOT Tutorials: Jan 27 - 28 APRICOT Conference: Jan 29 - 30 APNIC Meeting: Jan 31 Fees: Conference Registration: US $275 Tutorials: US $275/tutorial If you have any questions, feel free to contact me or the organizing committee (apricot-oc(a)apricot.net) Note that space is quite limited... Regards, -drc

1 0

Re: Keepalives, WAS: NAP/ISP Saturation
by William Allen Simpson 22 Dec '96

22 Dec '96

> From: Vadim Antonov <avg(a)pluris.com> > William Allen Simpson <wsimpson(a)greendragon.com> wrote: > >So, since we designed PPP LQM for the 56K, T1 and (new) T3s of 5-6 > >years ago (at least a generation in Internet lifetimes), why isn't > >everyone already running it? > > Because Morning Star is not cisco? (I'm well aware of PPP features, > btw, having written one implementation myself :) > I do not understand this rationale. Could you please elaborate? Are you saying that the reason we are not using ubiquitous LQM is because Cisco decided as a company policy not to interoperate with other vendors? BTW, I have never worked for Morning Star in any paid capacity; or I'd be a millionare today :-). I just have an email address there, as I do at several other sites, both commercial and non-commercial. WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32 BSimpson(a)MorningStar.com Key fingerprint = 2E 07 23 03 C5 62 70 D3 59 B1 4F 5E 1D C2 C1 A2

1 0

Re: NAP/ISP Saturation WAS: Re: Exchanges that matter...
by Vadim Antonov 22 Dec '96

22 Dec '96

Craig Nordin <cnordin(a)vni.net> wrote: >Interesting. An ICMP packet dropped when busy. Well, it seems as >if there is only a hair's difference between when an ICMP packet is >dropped and when an IP packet is dropped. Well, cisco (and all other known fast routers, for that matter) handles ICMP in software, unlike vanilla IP packets, which are routed with significant hardware assistance. I.e. a lot of ICMPs will overload CPU. It won't interfere with routing of IP packets (though it can wreck havoc with of routing and network management protocols). So cisco limits the rate at which ICMPs are processed. >If you are busy, you are busy, right? Not. Different pieces of hardware are busy in those cases. >I know that I was getting zero packet loss for many many basic routes >this time last year that are now losing packets. I think that a network >is in great shape when the packet loss is at a sheer minimum. Even one >percent packet loss can be felt as substantially more degraded than >perfect transport. Er. There's no such thing as perfect transport as long as TCP is concerned. If end-hosts support large windows, even a single TCP session will load the network to the point where it'll lose packets. >Just like ra.net, I use pings to monitor one aspect of overall performance. >Me and ra.net are not alone. Pings are ok, as long as you realize what exactly is being measured. If you're pinging ciscos, you aren't measuring IP packet loss. --vadim

20 32

Re: NAP/ISP Saturation WAS: Re: Exchanges that matter...
by Brett D. Watson 22 Dec '96

22 Dec '96

> > On Fri, 20 Dec 1996, Tony Li wrote: > > > You should be more specific about _why_ you want a MUCH bigger CPU. IMHO, > > the box needs more packet switching capacity (and more backplane > > bandwidth), but there's enough CPU there for the OS. > > Recomputing larger route tables, especially OSPF. Tunneling. > Encryption. Acess list filtering. Finer grain accounting (I'd love to see > usage stats for each interface over a day or so right from the router). > And most important to me, not becoming unusuable during a major routing > change. well, there is netflow. not quite the granularity you're probably looking for but it helps. and since frontier has signed an exclusive deal with cisco i suspect they might start moving more of the "probe" functionality into the routers and switches. the cat5k now supports a mini-rmon in the box. -brett

1 0

Re: HOW DO I GET IP'S?
by Marcos Della 21 Dec '96

21 Dec '96

> > Can anyone suggest a good way to get a CIDR block from the > > internic? We are two separate isps with separate ASNs, merged under one > > corporation, > > with one of them currently getting addresses from an upstream provider > > (/20). The problem is that in that location we are out of addresses, are > > multi-homed, and > > dissatisfied with our current provider. We need addresses before we can > > switch over, but the internic refuses to release any to us until we have > > used another /20 from our current provider. Thus, the internic has > > forced us to use one carrier with poor service. Legally, is this a > > monopoly? Has anyone started a class action suit? Can anyone help us? > > > > Get new IP's from your new provider. Renumber fast. Change your DNS TTL > very low. Maybe have your new provider hold primary DNS in the meantime. This is a pretty funny response. I'm still locked into an original T1 from one of my original providers who is charging me almost half of the cost for one of my typical DS3 lines for connectivity. Trying to renumber is impossible. Once you get to a certain number of customers, the game is over. As far as getting more addresses. I still have the same problem as others, however I can get by a little longer while trying to prove need. I know that unfortunately I cannot help too many smaller providers below me since the InterNic has restricted my site so much that I can't "slow start" another ISP under my network. Definately biased towards the big 6 providers. But then again, thats been the way business goes in every market. Someone holds 90% of the cards and the rest scramble to stay alive... Marcos

1 0