August 1998 - Test - lists.nanog.org

The Cidr Report
by Tony Bates 07 Aug '98

07 Aug '98

This is an auto-generated mail on Fri Aug 7 12:00:00 PDT 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 07Aug98 0) General Status Table History ------------- Date Prefixes 310798 52941 010898 52807 020898 52843 030898 52915 040898 52856 050898 52828 060898 52871 070898 52903 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 3804 Number of ASes announcing only one prefix: 1844 (971 cidr, 873 classful) Largest number of cidr routes: 343 announced by AS3561 Largest number of classful routes: 1137 announced by AS701 1) Gains by aggregating at the origin AS level --- 07Aug98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS3602 551 320 231 41.9% Sprint Canada Inc. AS701 1137 934 203 17.9% Alternet AS271 333 143 190 57.1% BCnet Backbone AS4293 438 254 184 42.0% IMCI AS2493 406 240 166 40.9% iSTAR Internet, Inc. AS3749 222 69 153 68.9% TECNET AS174 719 587 132 18.4% Performance Systems International AS4200 192 100 92 47.9% AGIS (Apex Global Information Ser AS2685 243 157 86 35.4% IBM Global Network - US AS5668 129 47 82 63.6% Century Telephone Inc. AS4755 121 45 76 62.8% Videsh Sanchar Nigam Ltd. India AS3221 112 42 70 62.5% EENet Autonomous System AS7046 226 160 66 29.2% UNKNOWN AS3804 220 155 65 29.5% Bell Solutions AS4740 403 342 61 15.1% ASN-OZEMAIL (Ozemail Pty Ltd) AS10928 101 46 55 54.5% UNKNOWN AS3403 181 127 54 29.8% TIAC AS549 204 153 51 25.0% ONet Backbone AS8517 122 72 50 41.0% ULAKNET-ASN AS6335 68 19 49 72.1% NTRNET AS72 85 37 48 56.5% Schlumberger Information Network AS719 459 412 47 10.2% LANLINK autonomous system AS1239 532 485 47 8.8% SprintLink Backbone AS4539 70 27 43 61.4% NETROPOLIS AS1785 298 255 43 14.4% NYSERNet Backbone AS852 156 116 40 25.6% AGT Advance Communication AS6181 66 26 40 60.6% FUSE-NET AS10921 57 19 38 66.7% KIHNETWORK AS762 117 80 37 31.6% WELLFLEET-AS AS10459 47 10 37 78.7% WANSASN For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Re: NANOG Channel Archives and Editorializing
by Richard Thomas 07 Aug '98

07 Aug '98

-----Original Message----- From: Sam Hayes Merritt, III <harter(a)feeding.frenzy.com> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Thursday, August 06, 1998 1:31 PM Subject: Re: NANOG Channel Archives and Editorializing >Yes. View it the same as Bugtraq. If you find a problem, let the owner >know and give them ample time to respond and fix it. If it is not quickly >taken care of, add them to the list. That is the only way you will ever >get things done. If telling them privately doesn't work, telling the >world and embarrasing them in front of peers might. So the spammers get >the list... it might get the problem fixed quicker. And maybe if we smurfed broadcasts with other broadcasts we could get them fixed faster... <g>

1 0

Re: Strange BGP announcement.
by Andrew Staples 06 Aug '98

06 Aug '98

> >What I meant to add was, did anyone else see something like this? I saw this on one bay box. It started at 11:45 Aug 5 and ended 8:40 Aug 6. Apparently, it's due to the way some cisco bgp router originated notification msg's with confederation extensions. Bay does not support this, and drops the session. I was told it is cisco's implementation of rfc1965. I saw problems from some cisco peers, but not all. No problems from bay peers. Now there's a DoS..... FWIW, Andrew

1 0

Archive Editing - Summary
by Eric Germann 06 Aug '98

06 Aug '98

UNCLE! It will stay put, which was my first inclination anyways. 42-0 (so far) to keep it intact. Eric ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert, OH 45891 http://www.cctec.com Ph: 419 968 2640 Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider

1 0

RE: Strange BGP announcement.
by Martin, Christian 06 Aug '98

06 Aug '98

This capability negotiation is only seen on the CC train. Thus, if you have CEF, you have the problem. Ironically, a colleague of mine mentioned this problem last night during a maintenance session. A foreshadowing??? -Chris- -----Original Message----- From: Craig A. Huegen [mailto:chuegen@quadrunner.com] Sent: Thursday, August 06, 1998 2:05 PM To: Brett Frankenberger; nanog(a)merit.edu Subject: Re: Strange BGP announcement. Egads. I suppose I should have had more coffee, then read the update. =) The problem I mentioned is a separate case. Never mind me. /cah On Thu, Aug 06, 1998 at 09:39:50AM -0700, Craig A. Huegen wrote: ==>On Thu, Aug 06, 1998 at 10:48:53AM -0500, Brett Frankenberger wrote: ==> ==>==>Bays don't crash (at least not in the general case ... for example, ==>==>mine stayed up this time and the last time this happened), but they do ==>==>send a NOTIFY and bring down the BGP session, as required by the RFC. ==>==>(I believe gated does this also.) ==>==> ==>==>The reason this issue causes problems is that Cisco violates the RFC ==>==>and passes the bad announcement around, so it eventually reaches most ==>==>non-Cisco routers who properly terminate the BGP connection. If Cisco ==>==>would do the NOTIFY upon receipt of the announcement, then the ==>==>information wouldn't spread, and only one router's worth of peerings ==>==>(i.e. the guy who "started" the bad annoucnement) would be lost. ==> ==>The "bad announcement" that you're talking about is capability negotiation ==>for RFC 2283, multi-protocol extensions to BGP--used for MBGP. It's not ==>a bad announcement, but an OPEN message intended to support multiple ==>NLRI types. ==> ==>The intended behavior for 11.1(20)CC is that when it sees a NOTIFY ==>of code 2, subcode 4 (unknown authentication parmeter), it backs off ==>and uses the unicast IPv4 NLRI type only (and the OPEN format without the ==>options). Unfortunately, there is a case where the Cisco will respond ==>to the TCP session close by tearing down the peer before it ever sees ==>the NOTIFY message. ==> ==>CSCdk30915 addresses this, and it will be fixed in an early interim ==>of 11.1(20)CC. A temporary workaround is to enable "neighbor x.x.x.x ==>dont-capability-negotiate" on the Cisco. ==> ==>/cah

1 0

Re: Q:Why router with ATM interface comes out earlier than pure SONET interface?
by Tony Li 06 Aug '98

06 Aug '98

wsimpson(a)greendragon.com (William Allen Simpson) writes: > Finally, a commercial vendor (NetStar) decided that they could build it. > And Cisco got wind of the project. Cisco hates to be second to market, > so they quickly came out with their own, beating NetStar by a few weeks. Actually, at the time that Cisco started working on it, they had NO idea of the NetStar project. Instead, they were being beaten up by one particular customer's engineer. Tony

1 0

Re: ISL Question
by owen＠DeLong.SJ.CA.US 05 Aug '98

05 Aug '98

The answer is "It depends..." If you configure both interfaces on the 2901 as trunks and you configure the trunks to forward all of the applicable VLANs, and you configure the interface on the 1900 as a Trunk, then it will work just fine. If you get any thing wrong, it will break. As to different ISL groups, I'm not sure what you mean. There are no ISL groups. ISL is ISL. It encapsulates a VLAN number onto each packet going onto the wire, and decapsulates the packet into the VLAN on the receiving switch. As such, you could do the following (which is what I think you're aiming for): Cisco Router Subinterfaces F0/0.2-500 == VLANs 2-500 Subinterfaces F0/0.501-999 == VLANs 501-999 2901 Trunk Port 1/1 == VLANS 1-1000 and connects to Cisco Router Trunk Port 1/2 == VLANS 1,501-999 and connects to 1900 1900 Trunk Port 1/1 == VLANS 1,501-999 and connects to 2901 Then you could put users on VLANs 2-500 on the 2901 and users on VLANs 501-999 on the 1900, and be just fine. Additionally, if you wanted to add a VLAN to the trunk between the 2901 and the 1900, say VLAN 250 (so that the new list would look like 1,250,501-999), you could even put some people in VLAN 250 on each switch and still have them talking to F0/0.250 on the router. Hope that helps. Owen > > Can you double-hop ISL? Suppose: > > > |cisco | > |router|------|Cat 2901|-------|Cat 1900| > > Can ISL run 'through' the 2901? The Cat 1900 Enterpise can do ISL; what I > am asking is can I assign interfaces off of the 1900 to sub-interfaces on > the router (ISL then would run through the 2901), and at the same time > have other interfaces on the 2901 act in other ISL groups? > > > > -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- > Atheism is a non-prophet organization. > I route, therefore I am. > Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member > Father of the Network and Head Bottle-Washer > Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 > Don't choose a spineless ISP! We have more backbone! http://www.nac.net > -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- > > > >

1 0

ISL Question
by alex＠nac.net 05 Aug '98

05 Aug '98

Can you double-hop ISL? Suppose: |cisco | |router|------|Cat 2901|-------|Cat 1900| Can ISL run 'through' the 2901? The Cat 1900 Enterpise can do ISL; what I am asking is can I assign interfaces off of the 1900 to sub-interfaces on the router (ISL then would run through the 2901), and at the same time have other interfaces on the 2901 act in other ISL groups? -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP! We have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

1 0

Noc Status/Contact Info page
by Tim Wolfe 05 Aug '98

05 Aug '98

I have updated the page with all the info everyone has sent me. I've also added a seperate column for NOC/Status pages to avoid the confusion and I've readded the AS column. This can now be found at http://www.clipper.net/noc/ Tim --------------------------------------------------- Tim Wolfe, Network Administrator ClipperNet Internet Access Services tim(a)clipper.net 541.431.3360 voice 541.431.1176 fax ...Across the Desktop and around the World... ---------------------------------------------------

1 0

Re: Possible scam: "Network Abuse"
by Richard Thomas 05 Aug '98

05 Aug '98

-----Original Message----- From: Ehud Gavron <GAVRON(a)ACES.COM> To: nanog(a)merit.edu <nanog(a)merit.edu> Cc: GAVRON(a)ACES.COM <GAVRON(a)ACES.COM> Date: Tuesday, August 04, 1998 11:59 PM Subject: Possible scam: "Network Abuse" >This "fellow" sent out this email. > >Unfortunately, our networks were not used to attack him (or anyone), >and upon request for NTP-stamped logs, he quit responding to email. > >I recommend warning your downstreams that this kind of scam is only >just begging. Imagine... $100 for "no ip direc...." --- 198.182.116.0 ping statistics --- 1 packets transmitted, 1 packets received, +13 duplicates, 0% packet loss round-trip min/avg/max = 201.1/207.5/216.3 ms Most likely running down SAR... I wonder if anyone actually paid? =)

1 0