May 1998 - Test - lists.nanog.org

RE: Cable & Wireless buys MCI Internet
by Pete Farmer 28 May '98

28 May '98

curtis(a)lamere.net wrote: >Excuse me for posting this here, but this is from news.com. It >basically says CWIX.NET gets the whole shooting match. Layer and all. Not quite. The joint press release (from MCI: http://www.mci.com/news-news/headline-896341261.shtml ; from C&W: http://www.cwplc.com/press/1998/p98may28.htm ) both state that Initially, MCI will provide the underlying telecommunications transport services supporting the Cable & Wireless backbone and will provide additional services as required by Cable & Wireless. Pete ______________________________________________________________________ Peter J. Farmer E-mail: pfarmer(a)strategies-u.com Strategies Unlimited Voice: +1 650 941 3438 201 San Antonio Circle, Suite 205 Fax: +1 650 941 5120 Mountain View, CA 94040 WWW: http://www.strategies-u.com

1 0

ingress filtering
by Mr. Dana Hudes 28 May '98

28 May '98

Who *does* do ingress filtering? I have it on our border routers and customer connect ports. We have transit from MCI and UUNET. Neither has ingress filters -- see below message from MCI on this. The result of course is that spammers and other bad guys can try to attack your systems with forged source IP addresses. Random strange people in the 'net send "NETBIOS name service" (port 137) packets to my unix mail relay, which of course ignores them. Other such fun things continue to be seen in the logs. Subject: Re: RFC1918 addresses from MCI Date: Thu, 28 May 1998 08:16:23 -0700 From: security(a)mci.net To: dhudes(a)graphnet.com CC: security(a)mci.net Mr. Hudes, Thank you for your note. MCI does not currently source filter address space at it's ingress points. Addresses sourced from non-routable or invalid addresses are not blocked or filtered. Addresses destined to non-routable addresses spaced are not routed. If you think it is a security issue and it is on-going then please contact us with the target address so we can investigate. Regards, -Julian Min

2 1

RE: Cable & Wireless buys MCI Internet
by Gregory Soo 28 May '98

28 May '98

> -----Original Message----- > From: Pete Farmer [mailto:pfarmer@strategies-u.com] > Sent: Thursday, May 28, 1998 1:10 PM > To: NANOG (E-mail) > Subject: RE: Cable & Wireless buys MCI Internet > > 1) MCI will continue to provide raw transport (think of it as Layer 1 > stuff) for the traffic associated with its Internet wholesale > ("backbone") services, at least for now. Doesn't C&W have extensive North American fibre with more to come? Anyone care to guess how quickly C&W could move the traffic across to their own transport?

1 0

RE: Cable & Wireless buys MCI Internet
by Pete Farmer 28 May '98

28 May '98

I've tried parsing the original press release http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/www/story/0 5-28-1998/0000666960&EDATE= . Here's what I come up with. Think of the services being provided as existing in three chunks: raw transport, wholesale, and retail. Under this deal, 1) MCI will continue to provide raw transport (think of it as Layer 1 stuff) for the traffic associated with its Internet wholesale ("backbone") services, at least for now. 2) C&W will take over (own) the routers, the connection agreements, and the service agreements for providing wholesale services to ISPs. Looks like this applies worldwide. C&W will be a customer of MCI for raw transport. 3) MCI will continue to own the service agreements and be the service provider to end users (to corporate customers for access and/or Web hosting, plus dial-up internetMCI consumers.) For some period (they say 2 years), MCI will be a customer of C&W for backbone services. MCI and C&W bravely say in their press release that this deal "should clear the way for the swift approval of the MCI WorldCom merger." We'll see. I expect that the EC will require that C&W have an explicit "out" on the transport piece (i.e. be able to take in-house or contract with others for the big transport pipes as it chooses.) Pete ______________________________________________________________________ Peter J. Farmer E-mail: pfarmer(a)strategies-u.com Strategies Unlimited Voice: +1 650 941 3438 201 San Antonio Circle, Suite 205 Fax: +1 650 941 5120 Mountain View, CA 94040 WWW: http://www.strategies-u.com

1 0

165.138.0.0
by Shawn David Solomon 28 May '98

28 May '98

---------- Forwarded message ---------- Date: Thu, 28 May 1998 10:46:54 -0500 (EST) From: Aaron Branham <abranham(a)ind.net> To: Sean Donelan <SEAN(a)SDG.DRA.COM> Cc: nanog(a)merit.edu Subject: 165.138.0.0 Sean, when I look at a full BGP table from MCI/Sprint/UUnet/and ANS I see a lot of /16 - /24's on the 12.0.0.0 (which also has a /8), 24.0.0.0 (which has no /8), 53.0.0.0, 62.0.0.0, etc.....Some of these have the classic /8 covering them and some don't. It's the same story for several /16's (class b networks) I see 132.155.204.0/23 (without a /16 anywhere), 134.128.52.0/24 (without a /16). Do you have problems getting to all of these? >From a router that has a customer connection to ANS, MCI, UUnet, and Sprint I see all of our routes even though we only have uplinks to MCI and Sprint. This router has direct connects with MCI and UUnet and iBGP peers with a router that has the connections to Sprint and ANS. Core#sh ip b reg _1767_ ...cut.... * i165.138.96.0/20 208.160.14.1 0 0 1239 1239 1767 i * i 208.160.14.1 0 0 1239 1239 1767 i *> 166.48.222.45 0 0 3561 3561 1767 i * 157.130.97.209 0 0 701 701 1239 1767 i ...cut.... This is the other router..... ...cut.... * i165.138.96.0/20 208.160.10.1 0 0 3561 3561 1767 i * i 208.160.10.1 0 0 3561 3561 1767 i * 192.103.62.121 0 0 1323 1673 3561 1767 i *> 144.228.13.229 0 0 1239 1239 1767 i ...cut.... The purpose of the /20's and /19's on our 165.138.0.0, 165.139.0.0 and 157.91.0.0 networks was to provide better service to our customers and to try and save IP address space for others. Like some of the class A's above we treated these as CIDR blocks instead of going to our upstream providers or the ARIN to get more addresses. Because our network has a dozen pops thoughout the state and each has at least one upstream connection to Sprint and MCI we advertise them as the /19's and /20's. This provides the greates redundancy for our customers. Sprint's policy does not apply to customer routes so they do not filter at the /16 level for classic B addresses. (They do for everybody else though....) Neither does MCI and it appears that ANS and UUnet do not filter with their connections to MCI and Sprint. We have run this way for several weeks now and this is the first call on the problem that we have gotten. But since the idea here is connectivity we'll re-announce the /16 from at least one of the POPs. But in order to make sure the /16 is always routable we'll have to advertise it from every POP that has a /20 or /19 sub address. Otherwise if the one POP advertising the /16 goes down our customers on the noted networks will loose connectivity to your network. (We'll also have to put in a /16 static route to overide the null0 that BGP will inject into our routing tables.) It was much cleaner to just advertise the /19's and /20's without the /16 but we can (and I guess will have to unless you change your filters) do it the other way. - - Aaron Branham [AKB8] (a(a)ind.net) <Phone# 317.263.8976>

1 0

PC Bozo's World bites again (CNN, too)
by Vadim Antonov 28 May '98

28 May '98

Check http://cnn.com/TECH/computing/9805/26/net.access.idg/index.html Those bozos are suggesting to reduce MTU from 1500 to 576 to "improve performance", so packets "won't fragment in backbones"! The bright idea to fix CTS/RTS setting didn't come along in their brilliant minds. Here goes the average packet size. Down the drain... Now what do we do to control the damage? I also think it's a good time to measure the gullibilty of the general public by measuring packet size distribution :) --vadim

6 6

165.138.0.0
by Aaron Branham 28 May '98

28 May '98

Sean, when I look at a full BGP table from MCI/Sprint/UUnet/and ANS I see a lot of /16 - /24's on the 12.0.0.0 (which also has a /8), 24.0.0.0 (which has no /8), 53.0.0.0, 62.0.0.0, etc.....Some of these have the classic /8 covering them and some don't. It's the same story for several /16's (class b networks) I see 132.155.204.0/23 (without a /16 anywhere), 134.128.52.0/24 (without a /16). Do you have problems getting to all of these? >From a router that has a customer connection to ANS, MCI, UUnet, and Sprint I see all of our routes even though we only have uplinks to MCI and Sprint. This router has direct connects with MCI and UUnet and iBGP peers with a router that has the connections to Sprint and ANS. Core#sh ip b reg _1767_ ...cut.... * i165.138.96.0/20 208.160.14.1 0 0 1239 1239 1767 i * i 208.160.14.1 0 0 1239 1239 1767 i *> 166.48.222.45 0 0 3561 3561 1767 i * 157.130.97.209 0 0 701 701 1239 1767 i ...cut.... This is the other router..... ...cut.... * i165.138.96.0/20 208.160.10.1 0 0 3561 3561 1767 i * i 208.160.10.1 0 0 3561 3561 1767 i * 192.103.62.121 0 0 1323 1673 3561 1767 i *> 144.228.13.229 0 0 1239 1239 1767 i ...cut.... The purpose of the /20's and /19's on our 165.138.0.0, 165.139.0.0 and 157.91.0.0 networks was to provide better service to our customers and to try and save IP address space for others. Like some of the class A's above we treated these as CIDR blocks instead of going to our upstream providers or the ARIN to get more addresses. Because our network has a dozen pops thoughout the state and each has at least one upstream connection to Sprint and MCI we advertise them as the /19's and /20's. This provides the greates redundancy for our customers. Sprint's policy does not apply to customer routes so they do not filter at the /16 level for classic B addresses. (They do for everybody else though....) Neither does MCI and it appears that ANS and UUnet do not filter with their connections to MCI and Sprint. We have run this way for several weeks now and this is the first call on the problem that we have gotten. But since the idea here is connectivity we'll re-announce the /16 from at least one of the POPs. But in order to make sure the /16 is always routable we'll have to advertise it from every POP that has a /20 or /19 sub address. Otherwise if the one POP advertising the /16 goes down our customers on the noted networks will loose connectivity to your network. (We'll also have to put in a /16 static route to overide the null0 that BGP will inject into our routing tables.) It was much cleaner to just advertise the /19's and /20's without the /16 but we can (and I guess will have to unless you change your filters) do it the other way. - - Aaron Branham [AKB8] (a(a)ind.net) <Phone# 317.263.8976>

1 0

Re: The Great Exchange
by Scott Huddle 28 May '98

28 May '98

On the international slide, I've seen a slide presentation from Deutche Telecom that said that half of all of its traffic stayed in country, which *I'd* label as "local". This is all WAG, tho. I'll argue that you can never measure this accurately from the network (how much traffic did you *not* count?, how much traffic was delivered on campus? is the site multihomed?), you have to measure it from the edge. To really test this you need sampling from the users, ala the Nielson method and knowledge of geography for IP addresses. Market opportunity anyone? -scott > From owner-nanog(a)merit.edu Wed May 27 16:36 EDT 1998 > Date: Wed, 27 May 1998 16:25:06 -0400 (EDT) > From: Al Reuben <alex(a)nac.net> > To: Tom Perrine <tep(a)SDSC.EDU> > cc: perry(a)piermont.com, dpickett(a)northc.com, nanog(a)merit.edu > Subject: Re: The Great Exchange > MIME-Version: 1.0 > Sender: owner-nanog(a)merit.edu > Content-Type> : > TEXT/PLAIN> ; > charset=US-ASCII> > Content-Length: 854 > > > I'd guestimate that local peering and stuff accounts for as much as 5 to > 15% of our traffic. > > > > Perhaps someone who is actually running a local exchange can report on > > how much traffic they are carrying that is now not being sent to a > > MAE-equivalent? I think that actual experience and hard data will > > surprise us all. > > > > --tep > > > > > > -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- > Atheism is a non-prophet organization. > I route, therefore I am. > Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member > Father of the Network and Head Bottle-Washer > Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 > Don't choose a spineless ISP! We have more backbone! http://www.nac.net > -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- > > > >

3 3

Re: The Great Exchange
by shields＠crosslink.net 28 May '98

28 May '98

In article <199805271744.NAA21312(a)jekyll.piermont.com>, "Perry E. Metzger" <perry(a)piermont.com> wrote: > In the long run, why are we assuming there will be locality of > traffic? > > It is true that the old PSTN has locality of traffic, but it doesn't > have flat rate pricing, or the usage patterns that the Internet has. Why are you assuming that the Internet will continue to have non-distance-sensitive pricing, when it clearly has distance- sensitive costs (ultimately)? -- Shields, CrossLink.

4 5

Re: Core router bakeoff?
by Brian Moore 28 May '98

28 May '98

This is going to sound mean, but it isn't intended to be :) Cisco's documentation on Kerberized telnet is actually pretty darn good. It's a three or four-step process. The docs even include sample KDC configs. Documentation for 11.2 is in the 'Security Configuration Guide' section on 'Configuring Network Access Security,' 'Establishing Kerberos-Authenticated Server-Client System.' Brian At 10:24 PM 5/8/98 -0500, Sam Birch wrote: >Not that I've done it, but you can use Kerberos to remotely manage a Cisco, >giving you an encrypted telnet. In fact, does anyone have any pointers >about how?

10 13