April 1998 - Test - lists.nanog.org

Re: SMURF amplifier block list - READ THIS
by Joe Provo - Network Architect 14 Apr '98

14 Apr '98

[snip] > What we were talking about was forbidding external connections to the > class-C broadcast addresses on a net, and why that useful process made > addressing hosts on .255 boundaries A Bad Idea. You misspelled "useless process". I also think you dropped the final phrase "if you want to talk to my network." [many previous posts in previous discussion on the topic omitted here. see the archives.] Assuming someone else's topology is stupid; we have dynamic protocols to tell our gear things for good reason. you want a dynamic process? get your head out of the cisco rut: use your rbl-like bgp sessions between gated boxen that then squirt the updates into ACLs. feed these ACLs into your configuration update method (if you have one). That one was free. Cheers, Joe

1 0

Re: AT&T outage (was: the whole world disappeared)
by Sean Donelan 14 Apr '98

14 Apr '98

>Well, it's made the news, at least: > >http://www.wired.com/news/news/technology/story/11648.html >http://www.news.com/News/Item/0,4,21061,00.html?st.ne.fd.mdh AT&T has finally put some press releases up on its web page http://www.att.com. Unfortunately, the 1-800 number AT&T lists to hear the chairman's explaination is experiencing heavy calling volume, so I haven't been able to get through. The press release was delayed long enough to miss most of the deadlines for this morning's newspapers. But those reporters are sure going to be mad in tomorrow's editions. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2

Re: SMURF amplifier block list
by Jeff Weisberg 14 Apr '98

14 Apr '98

| | Then again, filtering any packets to or from x.x.x.255 would have a | similar but more profound effect. Anyone who actually uses a .255 | address for a host is asking for trouble anyways. around here, we use 'em (.0 too). 'course ARIN makes me justify my utilization before they give me more, so I try to use addresses as efficiently as possible. do others not have this constraint? --jeff ---- Dear Mr. Arin, Thank you for the addresses you gave me previously. I now need more. I have efficiently used the ones you gave me. Sort of. I skipped over addresses ending with .0 and .255. Oh, and those ending in .13 too. Thank you, Mr. Isp Guy

1 0

Re: the whole world disappeared?
by Sean Donelan 14 Apr '98

14 Apr '98

> All AT&T InterSpan North American frame services are down. Our 200 > site WAN just went dark. No ETA for repair. I'm starting to feel jinxed. Two months ago Worldcom was in the office explaining how wonderful their network was, a few days later they lost most of their west coast connectivity. Last month SPRINT was in the office explaining how wonderful their network was, that weekend the Sprint network suffers software upgrade meltdown. This afternoon AT&T was in the office explaining how wonderful their network was, and tonight the AT&T network falls over. I think the only thing saving MCI is their salesperson hasn't been able to tell me how wonderful their network is. Anyone else care to try their luck and schedule an appointment to tell me how wonderfull their network is :-) To keep Randy from yelling at me, I am working on a protocol for reporting alerting users to network and other failures. I've decided no one will implement management guidelines, so lets write some software. And someday you may even be able to configure your Cisco, Ascend, etc to grok the protocol. I think it would be a cool addition to lucky IOS release 13. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

9 8

Re: SMURF amplifier block list
by kline＠uiuc.edu 14 Apr '98

14 Apr '98

> there have been several documented problems over the years with using > these addresses with certain OSes, and it's fairly sure that they will > continue to have problems. One can also make a reasonable case that > it's worth the administrative benefits to not use these addresses. The only subset of documented problems I'd agree with is trying to supernet class C's into larger blocks. But that wasn't what I was talking about. It's a shame that we went through so much trouble to remove classfulness and artificial byte boundaries in address space only to have them be reinserted and carried forth forever with ad hoc policy like this. I understand your point about tradeoffs of administrative benefits, but in this case it seems particularly ill-advised to promulgate brain- damage and justify it by saying "well, broken hosts didn't get fixed fast enough, so we may as well continue the tradition." /cvk

1 0

Re: backbone question
by Curt Howland 14 Apr '98

14 Apr '98

So that the backbone is never a source of problems, and the backbone network operations can point back to the LAN folks and say, "Nya nya!" > Why should the performance of a backbone network generally be higher then > that of the networks it interconnects. > > i would appreciate a reply > > thank you > > salvatore amico >

1 0

NANOG 13 HOTEL RATE
by Pam Ciesla 14 Apr '98

14 Apr '98

To clear up the $99 room rate. Ford Motor has a exclusive rate of $99 at the Hyatt Regency Dearborn (Ford Motor ownes the hotel). Our rate of $125 is suppose to be the lowest available (except for a few rooms at the government rate(which usually are not available)). If you have any hotel questions please let me know. Thanks xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Pam Ciesla 734-936-0172 - phone Merit Network, Inc. 734-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Reminder: The NANOG Meeting room rate expires on May 6.

1 0

backbone question
by Salvatore Amico 14 Apr '98

14 Apr '98

Why should the performance of a backbone network generally be higher then that of the networks it interconnects. i would appreciate a reply thank you salvatore amico

1 0

Re: SMURF amplifier block list
by Hank Nussbacher 14 Apr '98

14 Apr '98

At 03:31 AM 4/14/98 -0600, Forrest W. Christian wrote: >On Tue, 14 Apr 1998, Hank Nussbacher wrote: > >> All outgoing pkts to 220.88.192.128/27 now should go to Null0. I am sure >> one can improve on the logic even more. > >Exactly. All OUTGOING packets. Not Incoming. Not the smurf attack >packets which are swamping your downstream customer, which have a source >address from 220.88.192.128/27. My textual mistake - this snippet is to send pkts to dev/null for all pkts *sourced* from 220.88.192.128/27. -Hank > >I will concede that shutting off connectivity to a site by a large enough >chunk of the net should get someone to fix stuff.... But part of the >advantage of the MAPS RBL BGP feed is that it helps to cut down spam >coming into your network. A BGP feed TODAY won't block a ping >amplification attack aimed at your network or a downstream. All it will >do is prevent your customers from using the ping amplification networks to >launch an attack. And, if you have the appropriate anti-spoofing filters >in place, they shouldn't be able to attack anything other than the valid >source addresses you have in your outbound filter set. > >- Forrest W. Christian (forrestc(a)imach.com) >---------------------------------------------------------------------- >iMach, Ltd., P.O. Box 5749, Helena, MT 59604 http://www.imach.com >Solutions for your high-tech problems. (406)-442-6648 >---------------------------------------------------------------------- > > >

1 0

Re: SMURF amplifier block list
by shields＠crosslink.net 14 Apr '98

14 Apr '98

In article <Pine.BSF.3.96.980414033154.4326B-100000(a)workhorse.iMach.com>, "Forrest W. Christian" <forrestc(a)iMach.com> wrote: > On another note, could someone please mention again which IOS has the cool > "drop all packets from an interface which we don't have a matching route > pointing the other direction" feature? 11.1CC. I think the command is `ip verify unicast reverse-path' in the interface config. It works on the CEF table, so you *must* enable CEF, or it will just drop all packets. -- Shields, CrossLink.

1 0