August 1997 - Test - lists.nanog.org

Re: Loadsa ICMP...
by Tony Li 13 Aug '97

13 Aug '97

jcgreen(a)netins.net (Jon Green) writes: > I'm not from a Cisco background, so forgive me, but.. What a strange > way to configure a router. You have to configure it in a non-intuitive > way because the intuitive way will blow up the router? I guess we should > be thankful that IOS lets us get around hardware limitations of the box, but > someone should really teach Cisco a concept called "SMP". Just an > observation.. You are correct. The intuitive way does the Right Thing, which is to send back an ICMP packet. The optimization to get that to happen at interrupt time never did happen... mostly due to lack of customer demand. As to the small matter of a Small Matter of Programming, well, it's a lot easier if you're the one asking for it than the one doing it. Tony

2 2

Re: Loadsa ICMP...
by Tony Li 13 Aug '97

13 Aug '97

jcgreen(a)netins.net (Jon Green) writes: > That's my point. The answer is to get rid of the concept of an > RSP completely. A box with a central CPU is never going to scale as well > as a distributed processor design no matter how many MHz you throw at it. Seems like the real answer is to get rid of the processor. Why are we still using generic hardware to do packet forwarding, anyways? Tony

1 0

Loadsa ICMP...
by Lyndon Levesley 13 Aug '97

13 Aug '97

Aug 13 18:35:58 permitted icmp 205.139.170.70 -> 192.41.177.255 (8/0), 9999 packets Aug 13 18:35:58 permitted icmp 193.132.24.178 -> 192.41.177.255 (8/0), 8819 packets Aug 13 18:36:38 permitted icmp 128.83.42.2 -> 192.41.177.255 (8/0), 225 packets Aug 13 18:39:59 permitted icmp 134.115.226.26 -> 192.41.177.255 (8/0), 9051 packets Aug 13 18:39:59 permitted icmp 194.128.134.47 -> 192.41.177.255 (8/0), 9327 packets Aug 13 18:43:59 permitted icmp 149.112.125.54 -> 192.41.177.255 (8/0), 8722 packets [ some others snipped out ] Now if only Cisco's let you obtain a "src_hardware_addr" :( Lyndon Levesley Xara Networks -- Penis Envy is a total Phallusy.

4 5

Directed Broadcast~ Petition
by Peter Giza 13 Aug '97

13 Aug '97

Netizens If you don't care about the 'directed broadcasts' thread hit 'd' now :) Please excuse the interruption from real work, but as it stands I have a whopping 12 entries including myself on the petition. One of which is a dup due to a TLD association. If there are more of you who would like to be added to the petition to get a "no directed broadcast" as default action to Cisco IOS and other vendor equipment please respond *asap*. Given that there are 4K+ ISPs and NSPs my guess is that we ought to be able to come up with 50-100 names. I would like to get this off to Cisco before I leave for the other coast for a week. Please supply in the format as follows: Your Name, Full Company Name, email Thanks... -pete Peter E. Giza ADSmart Corporation http://www.adsmart.net

1 0

FW: Dial-in access
by jan.novak＠aliatel.cz 13 Aug '97

13 Aug '97

---------- Od: NovakJ Odesláno: 13. srpna 1997 12:12 Komu: 'nanog(a)merit.edu' Předmět: Dial-in access Sorry for problems with long lines... Hi, I have a question, which is not really operational but rather technological one. It concerns the Internet dial-in access. I hope there are several dial-in ISPs, not only transit ones, among you. Let me explain the situation. We are an "emerging" LEC in Czech Republic. Our aim is to build a wireless access network for data and telephony services. The wireless base stations will be connected to the voice and data switches, which will be interconnected via SDH network together. The problem is following: We expect a huge amount of Internet dial-in users, which will connect to the ISPs via our regular telephony service. We need to find a device, which will be placed between the base station and voice switch and capable to detect (based on the called number) the call to the ISPs, terminated it (e.g. completely bypass the voice switch) and provide some data interface, which will be connected to the ISP on the ordinary IP level. We know, in US you are facing the same problems with this kind of un-needed voice switches overload, your help will be very usefull for us. My question is: Do somebody of you use some kind of this rerouting or DXCs bypass and with which devices or is this functionality included directly in the voice switch ??? Only pointers to vendors are quite sufficient - Nortel´s "Internet Thruway" can be a example. Thanks very much.

1 0

Trans-Atlantic Traffic
by Stuart Bryant 13 Aug '97

13 Aug '97

Hi, Does anyone know the kind/amount of data currently being moved either way over the Atlantic links ? Stuart Bryant stuartb(a)ourworld.net Founding Member : System/Network Administrator Level 7 The Fellowship of Ourworld Global Network 77 Castlereagh Street Beer. +61 9 9223 2777 Sydney, 2000

1 0

Re: [nsp] known networks for broadcast ping attacks
by rja＠corp.home.net 13 Aug '97

13 Aug '97

Folks who want vendors to change the default changed so that routers don't - by default - forward directed broadcast should contact their vendors. If lots of ISPs speak up, the vendors generally _will_ listen and make changes/fixes. I've already been leaning on cisco to do this. So far, cisco is indicating "limited customer demand" to change this default. Those others of you who are using cisco and want this change made should speak up to your sales folks and other contacts in cisco. Ran rja(a)home.net

5 4

Filtering Source Addresses on gw-internet
by C. Jon Larsen 13 Aug '97

13 Aug '97

In response to the many requests and comments on this list for all NetworkOps to install filtering to prevent IP spoofing attacks . . . On my internet router (gw-internet) I had set up filtering to attempt to block all outgoing source addresses that do not have my network (a.b.c.0/24) as their source some time ago. Then, I had to modify the acl 120 to prevent the default route for our internal network from leaking the occasional packet with an RFC 1597 private destination address out to our ISP. (We use Cisco 11.2 NAT to hide several medium sized networks behind a couple af legit IPs. I took another spare router, and slapped 1.1.1.1/8 on a secondary interface, and tried to ping out, and my acl seems to be O.k. I'm just trying to be responsible for my users (some of whom are @ unsupervised and remote sites via dialup & ISDN) and prevent any other network ops from experiencing problems caused by ignorant / malicious users that may find their way onto my network ! Any comments / suggestions / improvements / warning / something I have missed ??? Thanks ! gw-internet#show access-lists 120 Extended IP access list 120 deny ip any 10.0.0.0 0.255.255.255 log deny ip any 172.16.0.0 0.0.255.255 log deny ip any 172.17.0.0 0.0.255.255 log deny ip any 192.168.0.0 0.0.255.255 log permit ip a.b.c.0 0.0.0.255 any (27429 matches) deny ip any any log gw-internet# %SEC-6-IPACCESSLOGDP: list 120 denied icmp 1.1.1.1 -> 205.161.206.4 (8/0), 1 packet ICMP: dst (205.161.206.4) administratively prohibited unreachable sent to 1.1.1.1 ICMP: dst (205.161.206.4) administratively prohibited unreachable sent to 1.1.1.1 ICMP: dst (205.161.206.4) administratively prohibited unreachable sent to 1.1.1.1 ICMP: dst (205.161.206.4) administratively prohibited unreachable sent to 1.1.1.1 ICMP: dst (205.161.206.4) administratively prohibited unreachable sent to 1.1.1.1

2 2

FYI: Cease And Desist Flaming
by Jon Stevens 12 Aug '97

12 Aug '97

This is a good one...anybody seen this before? They are spamming about spamming. Maybe it is a plot by this lawyer to get more clients... -jon ---------------- Begin Forwarded Message ---------------- >From filer Mon, 11 Aug 1997 12:22:35 -0800 Received: from www.kia.co.kr (1Cust59.max43.los-angeles.ca.ms.uu.net [153.34.91.187]) by www.kia.co.kr (8.6.12h2/8.6.9) with SMTP id FAA07648; Sat, 9 Aug 1997 05:03:06 +0900 From: webmaster(a)sailahead.com Received: from mips-1.sailahead.com (mips-1.sailahead.com [199.107.95.10]) by sailahead.com (8.8.5/8.6.5) with SMTP id GAA05402 for <suspected_flamer(a)somewhereincyberspace.com>; Fri, 08 Aug 1997 12:11:33 -0600 (EST) Date: Fri, 08 Aug 97 12:11:33 EST To: suspected_flamer(a)somewhereincyberspace.com Subject: Cease And Desist Flaming Message-Id: <5.0.52.19970526663666.666a6e97(a)sailahead.com> Reply-To: khskllp(a)aol.com X-Pmflags: 34666848 0 X-Uidl: 3273376668a65eb1890m0762123a Comments: Authenticated sender is <webmaster(a)sailahead.com> Status: RO On behalf of our client, Samsung America Inc., ("Samsung") we hereby request that you cease and desist all inflammatory internet hacking, telephone hacking, flaming, jamming, and other illegal activities. If you have responded aversely to a recent bulk email message from our client, Samsung America, Inc., or from any of its subsidiary companies, then you may be one of the people who has performed fraudulent and actionable transgressions, thereby causing severe harm to our client. Your email name was provided as being suspected of connection to various acts of internet terrorism. Your acts are illegal. Several messages have suggested that Samsung and/or its subsidiaries, including but not limited to Sailahead Global Emporium, www.sailahead.com, and Samsung Electronics, www.sosimple.com, violated US Federal Laws through activities commonly called "spamming." This allegation is unfounded in the law, as spamming is a protected activity under the laws of free speech. Our client has asked us to inform you that all of your future correspondences should be directed to their counsel: Russell L. Allyn, Attorney at Law California Sate Bar Number (SBN) 143531 Katz, Hoyt, Seigel & Kapor LLP Los Angeles, CA khskllp(a)aol.com 310-473-1300 310-473-7138 (fax) All incidents of internet terrorism will be prosecuted where possible, and reported to appropriate law enforcement authorities as warranted. Please consider this as your notice to cease all attempts to harm multi-national corporations who conduct legitimate commerce on the internet. Russell L. Allyn, Attorney at Law ----------------- End Forwarded Message -----------------

8 7

NANOG 11 UPDATE
by Pam Ciesla 12 Aug '97

12 Aug '97

Airfare discount & alternate hotel info is available on the NANOG Web page www.nanog.org. If you need any other info please contact me. I am looking into international airline discounts, but not sure if this will be available for this meeting. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Pam Ciesla 313-936-0172 - phone Merit Network, Inc. 313-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

2 1