December 1998 - Test - lists.nanog.org

New resource available!
by TTSG 25 Dec '98

25 Dec '98

Hi, New forum for discussing and alerting others to attacks of any type be they strobe, exploit, smurf, etc. This is a closed list, unmoderated. We hopefully expect a decent traffic level. hack-track(a)hack-track.com - Subscribe by sending: subscribe hack-track <Yourname> to listproc(a)hack-track.com A second list has been designed for low volume, critical information. Only confirmed multi-site attacks will be broadcast. This is a closed, moderated list. hack-track-announce(a)hack-track.com - Subscribe vy sending: subscribe hack-track-announce <Yourname> to listproc(a)hack-track.com A web site will also carry the archives, and any important information. You can find it at http://www.hack-track.com/ PLEASE, if you have ANYTHING to submit, or want to help admin the moderated list (I'd like to get atleast a few people around the world to help so that the fate of the internet doesn't rest completely on my shoulders), or if you want to help put together a FAQ, PLEASE, PLEASE (Can I beg enough) email me privately. (I have a self imposed restriction of 100000 bytes per email message, if you need to send something larger than that we can arrange for it to be FTP'd to me) Thanks, Tuc/TTSG

1 0

The Cidr Report
by Tony Bates 25 Dec '98

25 Dec '98

This is an auto-generated mail on Fri Dec 25 12:00:00 PST 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 25Dec98 0) General Status Table History ------------- Date Prefixes 181298 54712 191298 54745 201298 54631 211298 54716 221298 54845 231298 54811 241298 54847 251298 54839 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 4371 Number of ASes announcing only one prefix: 2158 (1151 cidr, 1007 classful) Largest number of cidr routes: 355 announced by AS3561 Largest number of classful routes: 1003 announced by AS701 1) Gains by aggregating at the origin AS level --- 25Dec98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 389 144 245 63.0% BCnet Backbone AS2493 325 178 147 45.2% iSTAR Internet, Inc. AS3749 222 77 145 65.3% TECNET AS701 1003 863 140 14.0% Alternet AS1785 541 403 138 25.5% NYSERNet Backbone AS174 667 544 123 18.4% Performance Systems International AS5668 133 36 97 72.9% Century Telephone Inc. AS4200 189 96 93 49.2% AGIS (Apex Global Information Ser AS4755 142 62 80 56.3% Videsh Sanchar Nigam Ltd. India AS1267 109 30 79 72.5% IUNET-AS AS4293 207 135 72 34.8% IMCI AS549 221 155 66 29.9% ONet Backbone AS4740 383 321 62 16.2% Ozemail Pty Ltd (ASN-OZEMAIL) AS1221 390 332 58 14.9% AARNET-AS AS8517 129 72 57 44.2% UNKNOWN AS7657 141 86 55 39.0% The Internet Group Limited AS7046 245 193 52 21.2% UUNET-CUSTOMER AS7545 115 65 50 43.5% TPG Internet Pty Ltd AS1239 534 485 49 9.2% SprintLink Backbone AS72 88 40 48 54.5% Schlumberger Information Network AS7496 73 28 45 61.6% Power Up AS577 211 166 45 21.3% Bell Canada Backbone AS10928 93 50 43 46.2% UNKNOWN AS852 174 132 42 24.1% AGT Advance Communication AS3221 84 42 42 50.0% RIPE-ASNBLOCK4 AS719 444 405 39 8.8% LANLINK-AS AS803 71 35 36 50.7% SaskNet Backbone AS7122 111 76 35 31.5% MTS ADVANCED Network Policy AS2707 65 32 33 50.8% WEC AS6897 46 14 32 69.6% RIPE-ASNBLOCK6 For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

AUTORESPONDERS : Gentle Reminder
by Rodney Joffe 24 Dec '98

24 Dec '98

Hello, A gentle reminder to those of you who use autoresponders when you go on vacation - are out of the office - go to the men's/ladies room etc. DON'T subscribe to NANOG and other lists from these accounts. Having just been bombarded by a bunch of "I'm out of the office on Vacation until January 5th - In case of emergency..." type messages after my prior message, I can tell you it's irritating as hell, and pretty rude. /rlj

10 10

Re: follow up on gigabit either
by George Herbert 24 Dec '98

24 Dec '98

K wrote: [useful summary of gigabit ether situation] >Steve also made exclnt point that the ATM vs 'promiscuous' medium > have other inherent distinction of potential interest > to ISPs with policy/privacy/security concerns I'm not quite sure I understand this bit; isn't switched ether (of any speed) equally secure as an ATM switch would be? -george william herbert gherbert(a)crl.com I speak only for myself

3 2

follow up on gigabit either
by k claffy 23 Dec '98

23 Dec '98

hi ok, summary as warranted: ================== who responded: ================== folks from following spaces answered (some to list so you saw) (forgot to ask for permission to use names so won't, but you who answered know who you are since you've been karma++'ed today) ic.gc.ca canarie.ca gxn.net (gx networks) cisco bluestar.net linx.net surfnet.nl shrubbery.net ================== upshot: ================== mostly all atm for now, though several folks pondering/aiming for gigE for connectivity to NAP's like CA*Net3. (usable (high density) gigether switches only recently available) 2.5 notable exceptions: LINX and AMS-IX, and CaNET3.soon ================== per instance details: ================== LINX does: http://www.linx.net/ http://www.linx.net/tickets/1998_migrate.html . 2 Packet Engines PowerRail 5200s 2 Extreme Summit 48s, linked w gigE . 2 physical locs in Docklands about 5km apart dark fibre between, gigE happily over it. . 2 redundant conns from two telcos to avoid backhoe risk. . interswitch traffic is >100Mbps on some links. no access >100Mbps to ISPs. no members even on at gigE yet, biggest LINX members only push ~40M/sec i/o each, --> no problem so far Amsterdam IX (AMS-IX) (since sept98) http://www.ams-ix.net/ . ISPs connect on 10BaseT and 100BaseTX . may add Fast EtherChannel and GigE. CANARIE . working w Nortel, Ameritech, UoIllinois and iCAIR to . build an "optical Internet exchange" in Chicago. . initally for HPC (research) network (MREN, CA*net 3, SuperNet) . peering connections at 2.5 Gbps (OC-48) using any desired protocol: e.g., GigE, ATM, SONET, etc Canarie has fine paper on this stuff, fwiw (tnx billStA) http://www.canet3.net/Optical/architectural.htm Steve also made exclnt point that the ATM vs 'promiscuous' medium have other inherent distinction of potential interest to ISPs with policy/privacy/security concerns hope this worth the aal5 headers it cost... tnx again for data k

1 0

Re: ** Forged spamming going on
by Paul Vixie 23 Dec '98

23 Dec '98

wsimpson(a)greendragon.com ("William Allen Simpson") writes: > Has ngti.com been added to the RBL for relaying faked spam? no. had a maps rbl volunteer, or someone else who follows the protocol described by http://maps.vix.com/rbl/reporting.html, actually received any of this spam and analyzed it and made a case, well, perhaps ngti would have been blackholed. but this particular tempest has brewed up only inside nanog's teapot, and not in the maps rbl's. -- Paul Vixie <paul(a)vix.com>

1 0

Re: ** Forged spamming going on
by Dean Anderson 23 Dec '98

23 Dec '98

At 11:08 AM 12/23/1998 -0800, Patrick Greenwell wrote: >On Tue, 22 Dec 1998, Dean Anderson wrote: > >> I have argued in the past that the RBL will not acheive its desired goals. >> And I don't think it will, or has. But I don't deny it certainly does have >> effective power to coerce and influence the industry. It can clearly move >> big players like earthlink and others. > >If it is an effective power to move big players, it would seem that it has >been at least moderately successful in acheiving its' desired goals. Except that the goal was to stop spam, not just make people jump through hoops. I haven't seen any change in spam volume. So I think it has been ineffective at achieving its goals. A gun has effective power too. Except that it should be used by Police Officers to stop crime, and not by random vigilantes to shoot whomever they please and ask questions later. And like any powerful tool, there should be some responsibility for its use and misuse. Paul has none. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3 2

Re: ** Forged spamming going on
by Dean Anderson 23 Dec '98

23 Dec '98

At 12:08 PM 12/23/1998 -0800, Patrick Greenwell wrote: >So what you are saying is that with marked increase in people getting on >the Internet since the time that the RBL was created, that you haven't >seen an increase in spam volume? I think most reasonable would consider >that at least a marginal success in containment. Volume as been argued previous on other venues, is exactly the same issue as used in the 70's against bulk postal mailers: 'If it isn't banned you'll be literally buried by junk mail.' Well, actually, there are market constraints on the volume of (postal or email) mail totally independent and unrelated to the RBL. Economics and psychology control the volume. And the economics aren't related much to the cost. Spam costs less than direct mail which costs less than radio, which is less than TV. There are saturation points which aren't related to the system capacity to deliver advertising. So no matter what the system capacity, you aren't ever going to be overwhelmned by advertising. But for some, any is too much. Those people are generally categorized as being on the fringe. RBL hasn't really contained anything. Except cause pain to ISP's who get caught in the crossfire. >> A gun has effective power too. Except that it should be used by Police >> Officers to stop crime, and not by random vigilantes to shoot whomever they >> please and ask questions later. > >It is heartening to see someone with such a high regard for the >governments abilities in this area. Here I was labouring under the >misconception that the government has been largely ignorant in these >matters and ineffective in addressing them. Thanks for clearing that up >for me. Well, its people like Vixie who abuse their power and abilities that make it necessary for governments to intervene. I would hope that the industry could police itself. But it doesn't seem to be able to come up with an alternative other than a single capricious individual. There used not be any gun laws either. Not that spammers are in any way faultless. Certainly not. But as the saying goes, two wrongs don't make a right. >> And like any powerful tool, there should be some responsibility for its use >> and misuse. Paul has none. > >A lot of reasonable people would disagree with you. Reasonable people who support power without responsibility? I doubt it, except they are the ones trying to wield the power. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

poll: are any sizable exchange points using gigabit ether?
by k claffy 23 Dec '98

23 Dec '98

or are folks pretty much (ATM?)-switch tech'ed? or do folks have plans to migrate to gig ether (or to definitely Not to, for some reason?) (or change 'gig ether' to some other imminent.technology.that.might.be. compelling.enuf.to.displace.atm) if u wanna send messages 2 me i'll compile/post to save b/w (which presumably saves much more b/w if am posting via atm switches but etc) k

7 6

NANOG 15
by Pam Ciesla 23 Dec '98

23 Dec '98

Update on hotel info. I spoke with the people at the Hyatt in Denver. The Hyatt is full during the NANOG Meeting. If you are planning on attending make hotel reservations early. The NANOG hotel block is available until January 8. Also for those registering with credit card info. Credit cards will not be run until late January and receipts will be available at the meeting in your name badges. The nanog-support staff will be off for the holidays (possible checking e-mail), back in the office on 1/4/99. Have a safe and happy holiday. See you at NANOG 15 next year. Pam Pam Ciesla Merit Network,Inc. 734-936-0172 - phone 4251 Plymouth Road 734-647-3185 Bldg.I, Suite C pam(a)merit.edu Ann Arbor, MI 48107

1 0