March 1998 - Test - lists.nanog.org

RE: Asymmetric routing with tunnel.
by Geoff Huston 31 Mar '98

31 Mar '98

I can provide details .. We are using a 45M satellite circuit operating from Teleglobe to Telstra. The circuit is configured as a unidirectional circuit with no direct return path. We use BGP as the link keepalive protocol as well as the route peering protocol, using the two lookpack addresses as the peering points for the BGP TCP session. The circuit is now operating in production mode successfully. A description of the initial test rig including template router configs can be found at http://www.telstra.net/ops/unid. The work was undertaken with the support of Telstra, Teleglobe and Intelsat. Thanks, Geoff Huston Telstra >From owner-nanog(a)merit.edu Tue Mar 31 06:59:37 1998 >From: "Bill St. Arnaud" <bill.st.arnaud(a)canarie.ca> >To: <nanog(a)merit.edu>, "Jaeho Yang" <jhyang(a)nuri.net> >Cc: "Yves Poppe" <ypoppe(a)teleglobe.ca> >Subject: RE: Asymmetric routing with tunnel. >Date: Mon, 30 Mar 1998 15:20:46 -0500 >X-Priority: 3 (Normal) >X-MSMail-Priority: Normal >Importance: Normal >X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 > >Teleglobe is providing a similar type of service to Telstra's Internet >Service in Australia. > >Contact Bob Collett at Teleglobe for more details > >Bill > >------------------------------------------- >Bill St Arnaud >Director Network Projects >CANARIE >bill.st.arnaud(a)canarie.ca >http://www.canarie.ca/bstarn > > > > > >> -----Original Message----- >> From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of >> Jaeho Yang >> Sent: Sunday, March 29, 1998 2:27 AM >> To: nanog(a)merit.edu >> Subject: Asymmetric routing with tunnel. >> >> >> We have terrestrial link between korea and us. But we have many down >> traffic (US -> Korea), >> we consider satellite for getting more incoming bandwidth. I contacted >> serveral satellite service >> providers, but the major concern is integration with existing >> terrestrial link. >> >> Our connection point is located in PAIX(Digital IX). But one candidate >> is located in Mae-east. >> >> My idea is transmitting some traffic into Mae-east via making tunnel. >> >> The border router sends incoming mail, ftp, and news traffic into VPN >> box, which is connected >> with other port of router. The traffic was encapulated by VPN box. VPN >> box makes a tunnel >> with one of Mae-east, which has the similar VPN box configured with our >> one. >> >> The router of mae-east sends traffic into the router of Satellite >> Service provider. >> The satellite transmit our traffics... >> >> I'll verify my idea is feasible, and there are some reference sites.. >> >> Thanks in advance. >> >> --J >> > > >

1 0

RE: NSI Bulletin 098-008 | New Registration Agreement
by Joffe, Rodney 30 Mar '98

30 Mar '98

No. Posted here 3/18/98 NSF AND NSI END INTERNET INTELLECTUAL INFRASTRUCTURE FUND PORTION OF DOMAIN NAME REGISTRATION FEES The National Science Foundation (NSF) and Network Solutions, Inc. (NSI) today announced the end of the Internet Intellectual Infrastructure Fund portion of domain name registration charges. As a result, the annual fee for domain name registration, which has been $50 since fees were imposed in 1995, will decline to $35, reducing the cost of domain name registration by 30 percent. *The change will be effective April 1, 1998.* > -----Original Message----- > From: dirk(a)power.net [SMTP:dirk@power.net] > Sent: Monday, March 30, 1998 12:27 PM > To: nanog(a)merit.edu > Subject: Re: NSI Bulletin 098-008 | New Registration Agreement > > > So, are we going to get refunds? > > Dirk > > On Mon, Mar 30, 1998 at 01:54:22PM -0500, Jay R. Ashworth wrote: > > On Mon, Mar 30, 1998 at 01:11:25PM -0500, Chuck Gomes wrote: > > > Effective immediately, Network Solutions is introducing > > > Domain Name Registration Agreement version 4.0 that will > > > replace version 3.5. The new agreement reflects fee changes > > > for domain name registrations and renewals following the > > > elimination of the Intellectual Infrastructure Fund portion > > > of the fee on April 1, 1998, pursuant to an amendment to > > > Network Solutions' Cooperative Agreement with the > > > National Science Foundation. > > > > Cool. > > > > So, is NSI going to abide by _this_ version any better than they > have > > with previous versions? > > > > Cheers, > > -- jra > > -- > > Jay R. Ashworth > jra(a)baylink.com > > Member of the Technical Staff Unsolicited Commercial > Emailers Sued > > The Suncoast Freenet "Two words: Darth Doogie." -- Jason > Colby, > > Tampa Bay, Florida on alt.fan.heinlein +1 > 813 790 7592 > > > > Managing Editor, Top Of The Key sports e-zine ------------ > http://www.totk.com

1 0

Efficient DoS filter
by Alex Bligh 29 Mar '98

29 Mar '98

I think this is an operational issue, at least for those running Cisco. Having just been hit by 10Mb/s of DoS attack and finding a 75xx has difficulty filtering it, here is quite a nice way (assuming we're talking a randomized source, single destination attack). Find your favorite ATM interface (sorry Sean). Set up a sub-interface covering the IP address concerned, put in a map-list to the duff interface, and put it on a VC that doesn't go anywhere through your ATM switch. This way the ATM switch foes the filtering. PLEASE can we have hardware assisted switching to null0: if anyone's listening at Cisco? Nothing else would filter this out (no convenient LANs nearby, serial type interface just sends the data anyway etc...). This would probably work on FR too. Alex Bligh GX Networks (formerly Xara Networks)

2 1

Re: consistency and cix
by Randy Bush 28 Mar '98

28 Mar '98

> I suppose the issue comes down to whether one considers the CIX > relationship to be one of transit provider or if it is considered an > exchange point. This is is the crux of the question I meant to be posing. > Again, this is a political issue, and should probably be worked out between > the two providers involved (hopefully through operational people and not > lawyers though ;). It is also a technical issue, as there are technical reasons why consistent routing announcements are usually specified, whether the CIX is an exchange or a for-fee transit provider is partially a technical judgement, ... The two providers did, for the moment, work it out at the engineering level. But we agreed the issue was interesting and the answer not obvious. randy

2 1

more directed broadcast attacks
by Kelly J. Cooper 28 Mar '98

28 Mar '98

Something on the order of 100 networks all tried to send as many echo response packets as possible down a little 56Kb pipe on my network today (from ~19:00 - 21:00 GMT today, 27 March 1998) and I couldn't reach a single network-owning site to get it shut down because ALL of the networks abused were in the Asian Pacific area, where it was NOT business hours. So the individual numbers listed with the various NICs were useless & the main numbers were rather difficult to find and/or parse from the POV of another country. Needless to say, I did not have any fun today. And, although it is very tempting to just post the list of networks that were abused I decided not to (instead, I contacted our peers who are upstream of the various networks and asked them to educate their downstreams because we've noticed an increase in attacks every time someone posts a list of vulnerable networks to NANOG). But I would like to forward this subset of the networks I pulled out of my accounting data during the attack and post them here as MY VOTE on why using RFC 1918 nets on an exterior net can be a Bad Idea: 10.15.1.254 10.21.1.11 10.21.1.90 10.21.1.191 10.21.1.193 10.21.1.195 10.21.1.196 10.21.1.197 10.21.1.199 10.21.1.200 10.21.1.201 10.21.1.202 10.21.1.203 10.21.1.205 10.21.1.206 10.21.1.207 10.21.1.208 10.21.1.209 10.21.2.53 10.21.2.100 127.0.0.2 172.16.31.3 172.16.31.10 172.16.31.11 172.16.31.249 172.16.71.11 172.16.71.12 172.16.71.180 192.168.1.1 Regards, Kelly J. -- Kelly J. Cooper - Internet Security Officer GTE Internetworking - Powered by BBN - 800-632-7638 150 Cambridge Park Drive Fax - 617-873-5508 Cambridge, MA 02140 http://www.bbn.com

1 0

consistency and cix
by Randy Bush 27 Mar '98

27 Mar '98

V peers with X at a number of points. V and X announce the same routes to each other at all these points. V and X are also members of the CIX and are announcing routes to the CIX router. X announces different routes to the CIX router than they announce directly to peer V because Y pays X to specifically announce Y's routes at the CIX. Should V be unhappy with X's inconsistent route announcements? Should X's announcement via the CIX be consistent with their announcements at the other points V and X meet? o yes, because the CIX is a peering point, though router-based (this in itself may be worth a different discussion). o no, because in realty V and X each are paying customers of the CIX, and the CIX is merely announcing their customers' routes to each other. My apologies for opening an operational issue in an inappropriate forum. randy

3 3

Re: consistency and cix
by Randy Bush 27 Mar '98

27 Mar '98

> Actually, sounds like a political issue to me. > > What do your peering contracts say? if the the cix relationship is mutual purchase of transit from a third party, then V and X have no contractual relationship. randy

2 1

The Cidr Report
by Tony Bates 27 Mar '98

27 Mar '98

This is an auto-generated mail on Fri Mar 27 12:00:00 PST 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 27Mar98 0) General Status Table History ------------- Date Prefixes 200398 49893 210398 50064 220398 50031 230398 49930 240398 49998 250398 50244 260398 49981 270398 50071 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 3371 Number of ASes announcing only one prefix: 1596 (826 cidr, 770 classful) Largest number of cidr routes: 418 announced by AS3561 Largest number of classful routes: 1039 announced by AS701 1) Gains by aggregating at the origin AS level --- 27Mar98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS4293 437 213 224 51.3% IMCI AS2493 560 343 217 38.8% iSTAR Internet, Inc. AS816 653 448 205 31.4% UUNET Canada (ASN-UUNETCA-AS4) AS3602 465 300 165 35.5% Sprint Canada Inc. AS174 786 627 159 20.2% Performance Systems International AS3749 219 64 155 70.8% TECNET AS701 1039 885 154 14.8% Alternet AS11003 128 56 72 56.2% UNKNOWN AS5668 113 42 71 62.8% Century Telephone Inc. AS2048 160 92 68 42.5% LaNet AS3221 102 37 65 63.7% EENet Autonomous System AS3804 205 142 63 30.7% Bell Solutions AS1239 550 493 57 10.4% SprintLink Backbone AS271 110 54 56 50.9% BCnet Backbone AS10928 98 43 55 56.1% UNKNOWN AS549 211 160 51 24.2% ONet Backbone AS4755 84 34 50 59.5% Videsh Sanchar Nigam Ltd. India AS1221 272 223 49 18.0% AARNET-AS AS72 84 36 48 57.1% Schlumberger Information Network AS4763 122 76 46 37.7% Telstra New Zealand AS7046 146 102 44 30.1% UUNET-CUSTOMER AS6392 73 29 44 60.3% MidWest Communications, Inc. AS4740 355 313 42 11.8% ASN-OZEMAIL (Ozemail Pty Ltd) AS2711 98 56 42 42.9% SUNBELT-AS AS852 157 117 40 25.5% AGT Advance Communication AS6335 63 23 40 63.5% NTRNET AS3493 162 124 38 23.5% INTERLINK AS684 90 53 37 41.1% Manitoba Regional Network Backbon AS6332 83 46 37 44.6% TELNOR AS4200 127 90 37 29.1% AGIS (Apex Global Information Ser For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

NANOG 13 "broadcast"
by Forrest W. Christian 27 Mar '98

27 Mar '98

What are the current plans regarding multicasting and/or realvideo-ing NANOG 13 at this point? The last couple of meetings seem to have been plagued with problems related to the "broadcasting" of the session. I'm sure that this hasn't really been anyone in particular's fault, but instead a side effect of the unfortunate realities of the Data Communications world we all live in. Basically, I'd like to see what I can do to help make sure that this one goes more smoothly. Especially since it looks like I'm going to have to miss NANOG 13. Feel free to e-mail me directly if you feel that this doesn't need to be discussed on the whole list. - Forrest W. Christian (forrestc(a)imach.com) ---------------------------------------------------------------------- iMach, Ltd., P.O. Box 5749, Helena, MT 59604 http://www.imach.com Solutions for your high-tech problems. (406)-442-6648 ----------------------------------------------------------------------

2 1

AU Hacker/Credit Card Distributro gets 3years/18 months
by Adam Todd 27 Mar '98

27 Mar '98

Australian Computer Hacker and Credit Card distributor gets 18 months. This is "unoffical" news, I'm waiting for something more concrete, but certainlthe AU ISP list is reeling in on this matter. Skeeve Stevens wasn't the most "liked" person in the Internet Industry and is known for making very strong and critical comments - often abusive - towards other users. Brings me to question the "religious" bit ??? >From: Zed Connect Pty Ltd <isp(a)zed.org> >Subject: [Oz-ISP] SKEEVE GOT GOAL >To: aussie-isp(a)aussie.net >Date: Fri, 27 Mar 1998 13:28:37 +1100 (EST) > >SKEEVE STEVENS GOT GOAL >======================= > >Mr Skeeve Stevens, the alleged "Optik Surfer", has been gailed for the >crime of "altering data", which holds a maximum term of 10 years goal. > >During sentancing this morning, at the Downing Local Court, the Judge >announced that she had fully considered all the material and evidence >presented, and taking into account that the crime appeared to have been >done with malice. > >She disregarded his recent marriage, to Zita Gorman, and his religeous >beliefs, and the work he is doing with various religeous bodies. > >She also commented that although he had pleaded GUILTY to to crime, this >was done in the '11th hour', and appeared to show no remorse, and was just >a tactic to lighten the sentance. > >On final summation she announced that the only punishement that would fit >this crime would be 3 years goal, with reconnecance for 18 months. Which >means if he is a good boy he will be out in 18 months. > >He was then immediatley taken down by court security. > >Witnesses commented that this outcome was an unexpected blow by the Stevens >camp. Mr Stevens wife had appeared disrought at the decision. ------------------------------------------------------------------------- The advice offered in this email is not considered professional advice, or it would be accompanied by an invoice. No permission is granted for republication of comments, without written consent. ------------------------------------------------------------------------- Business Development, Technology Domain Registration and Network Advisory Telstra Convery Member AURSC http://www.aursc.ah.net Adam Todd Personal http://adamtodd.ah.net at@aus or at(a)ah.net http://adam.says.sheesh Phone +61 2 9729 0565 Network http://www.ah.net AU Internet News http://www.ah.net/lists/lwgate/INTERNET/ AU Internet User Mail List http://www.ah.net/lists/lwgate/OZ-USER/

1 0