November 1997 - Test - lists.nanog.org

Important: NANOG List Changes
by William B. Norton 25 Nov '97

25 Nov '97

Hi Guys - Glad to see that many of you have subscribed to the new nanog-post(a)merit.edu mailing list. We've now decided to wait until Monday, December 1, to switch over to the new posting process. After that date, you'll need to also be subscribed to nanog-post(a)merit.edu in order to post to the nanog(a)merit.edu list. (You'll still post your messages to nanog(a)merit.edu, but unless you've subscribed to nanog-post, your messages will rejected.) To subscribe, send e-mail to majordomo(a)merit.edu with 'subscribe nanog-post' (without the quotes) as the text of the message. You will receive a confirmation request, and once answered, you will be able to post to the nanog mailing list. Bill

1 0

Re: Land and Cisco question
by Hank Nussbacher 25 Nov '97

25 Nov '97

At 10:58 AM 11/22/97 -0800, John Bashinski wrote: I was *extremely* unclear in what I sent since I was running out the door. Most cisco routers run by ISPs (here on NANOG) have at least 50 interfaces (subinterfaces) and usually average 100. Each and every interface/subinterface has to be blocked. So it is either create an extended access list with all 100 individual interface addresses blocked (and update it as new customers get connected) or block by subnet, i.e if all interfaces come from a 255.255.255.252 (/30) subnetted block, then block the whole /24. But then the problem I discussed below creeps up. Any recommendations on how to block this by subnet (assuming the router side always has the same bit position in the subnet)? -Hank >-----BEGIN PGP SIGNED MESSAGE----- > >> Does BGP use TCP or UDP? > >TCP. > >> If TCP then we are in trouble. > >I don't think so. > >> Almost everyone >> has access to the Internet via BGP. The line IP address is usually made up >> of a pair of addresses in the same subnet. You can IP spoof block all your >> internal IP addresses but if you block the IP address of your BGP connection >> to your BGP peer and BGP uses TCP, then the examples jbash gave out will >> stop BGP updates as well. > >This was my example: > > interface ethernet 0 > ip address 1.2.3.4 255.255.255.0 > ip access-group 101 in > ! > interface ethernet 1 > ip address 5.6.7.8 > ip access-group 101 in > ! > access-list 101 deny tcp 1.2.3.4 0.0.0.0 1.2.3.4 0.0.0.0 > access-list 101 deny tcp 5.6.7.8 0.0.0.0 5.6.7.8 0.0.0.0 > access-list 101 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 > >That only blocks the router talking to itself, not talking to any other >host, whether on the same subnet or not. As far as I know, you don't have >to have a TCP connection to yourself to run BGP, just to your neighbors. > > -- John B. > >-----BEGIN PGP SIGNATURE----- >Version: None of your beeswax > >iQCVAwUBNHcrO3emvD4nAHb9AQHpsAP+OV+xm3uQ+N1Xoc6auDyKfM/j0L9JPqvL >n1pKNh73jqZz8vMzMWOkm8wcnGkW9u+JFQ0tSlkEtpkWrAG96f0kmSpXyfC6BRYo >RvpkXL4hHT0A+1HSbVNmOjGjfThdEyWOdhcE9jJc35PxzErzarsyFTPnjK6Fl5Rl >8wVsoHAPNYU= >=cAK5 >-----END PGP SIGNATURE----- > >

12 15

Re: Eugene Kashpureff's Defense Fund
by Tim Salo 25 Nov '97

25 Nov '97

> From: Marc Hurst <mhurst(a)fastlane.ca> > On Mon, 24 Nov 1997, Karl Denninger wrote: > > On Mon, Nov 24, 1997 at 06:42:35PM -0800, Paul A Vixie wrote: > > > How much do I have to pay to keep him in jail forever? > > That was MY question :-) > > As much as we all know the guy is not going to get a fair trial, the > concept of an anti-defence fund is a novel one. It may be called a "friend of the court" brief, (only probably in Latin). Some well-written papers (briefs) about the dangers posed by those who threaten the Internet infrastructure may be useful in this case. -tjs

3 2

Netflow IP accounting and IP protocol numbers
by steven hessing 25 Nov '97

25 Nov '97

The other day we started using Cisco netflow accounting software together with IP flow export feature of recent Cisco IOS versions. What we found was that although we put a lot of protocols in the nfknown.protocols file of the accounting software (everywthing we could find in the /etc/services file of Solaris and Linux), there is still a lot of traffic under TCP-Other and UDP-Other. This indicated that traffic is going over our network using ports that the software doesn't know about. This could for example be Real-audio, Cuseeme, Pointcast, Backweb etc traffic. Unfortunately, I don't have a list of these newer protocols together with their port numbers. Has anyone compiled such a list? There's the Assigned numbers RFC but the last version of it is RFC 1700 of October 1994. -- Steven

5 4

OPS: SECURITY new packet of death
by Sean Donelan 25 Nov '97

25 Nov '97

Good morning America (and good day or night to the rest of the world), I hope you got a good nights sleep. There is a new packet of death circulating. Sending a SYN packet with the source and destination address & port set to the same value causes some systems to lockup. One such system seems to include several versions of Cisco IOS. Details on Bugtraq. Have a nice day. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

12 11

RE: Eugene Kashpureff's Defense Fund
by Jim Browning 24 Nov '97

24 Nov '97

ROFL.. ---------- From: Bob Allisat [SMTP:tor@wtv.net] Sent: Monday, November 24, 1997 12:22 PM > Eugene Kashpureff's Defense Fund

1 0

RE: Sprint problems
by Michael Bostardi 24 Nov '97

24 Nov '97

For $0.10 a minute you could call their NOC. > -----Original Message----- > From: Dan Hubbard [SMTP:dhubbard@thepalace.com] > Sent: Monday, November 24, 1997 9:24 PM > To: nanog(a)merit.edu > Subject: Sprint problems > > We are having a great deal of packet loss to Sprint ? Any details... > --------------- > Dan Hubbard > The Palace Inc.

1 0

Re: Sprint problems
by cdavisso＠teir.com 24 Nov '97

24 Nov '97

According to the Sprint Technical number, they're having a "network event" in the Washington DC area. Don't have any other details yet. We do have an open trouble ticket. Chuck Davisson TEIR -- ================================= I've no doubt the devil grins, As seas of ink I spatter. Ye gods forgive my literary sins, The other kind don't matter. - Robert W. Service

1 0

Sprint problems
by Dan Hubbard 24 Nov '97

24 Nov '97

We are having a great deal of packet loss to Sprint ? Any details... --------------- Dan Hubbard The Palace Inc.

1 0

Switch-Based Interconnects
by Tim Salo 24 Nov '97

24 Nov '97

Does anyone have any analytic results about the amount of buffering required in 100 Mbps or gigabit Ethernet switches used for [wide-area] interconnects? For the various layer-three switches? -tjs

1 0