January 1999 - Test - lists.nanog.org

Re: IGP Comparison (Summary of Responses)
by Sean Donelan 06 Jan '99

06 Jan '99

randy(a)psg.COM (Randy Bush) writes: >> Most of the large ISPs in the US run IS-IS as their IP IGP. >> In europe a number of PTTs have chosen IS-IS as the IGP for their new >> IP Internet backbones. That might be an indication if IS-IS is dead. > >hypothesis: big isps talk less. except a few loudmouths <g>, and when jhawk >gets pissed off <g^2>. I know why most of the older large ISPs use IS-IS, because it was the only option that worked at the time. But now that some router vendors have come out with workable OSPF implementations, I've been wondering which road the new ISP competitors would take. So far, they've been hiring all the engineering staff away from the older ISPs. And then the engineers set up the new network with the same skills, meaning IS-IS. But what if you started from a clean slate... If you didn't have an installed base, and didn't already know one or the other, which would you choose? Or just punt, and use iBGP.... -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

5 4

Where's 209.240.157.34 ?
by John R Levine 05 Jan '99

05 Jan '99

Got a spam advertising a web page there, ARIN claims it's not allocated although all the space around it is. It routes through Tierranet. Do they often lose allocations? Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner Finger for PGP key, f'print = 3A 5B D0 3F D9 A0 6A A4 2D AC 1E 9E A6 36 A3 47

1 0

Something fishy at NetSol again...
by Rodney Joffe 05 Jan '99

05 Jan '99

I hate co-incidences. At the same time as this story appeared today http://www.news.com/News/Item/0,4,30366,00.html?st.ne.140.head whois queries started returning: * * WELCOME to InterNIC Registration Services * * Sorry, the system load is temporarily too heavy. * * Please wait a while and try again. Thanks * It's currently 12:34am EST. and the response is still mostly the same. A query still needs 5-10 attempts before a server responds. Dig used to (a couple of weeks ago) show a bunch of servers. Now there is only 1: 198.41.0.6 Is anyone else having this problem? Does anyone else have a solution? We're trying to track down the source of a dos attack, and this kind of screwing around to find contact data isn't helpful...

4 4

NANOG 15 Info Update
by Pam Ciesla 05 Jan '99

05 Jan '99

As in the past, Avi Freedman and Howard Berkowitz will be offering routing tutorials; this meeting we'll begin the tutorials at 1PM on Sunday, 1/31. Please plan you flights accordingly.(Other event info to be announced - stay tuned for more information). Friendly reminder the room block at the Hyatt ends on January 8th. Be sure to reserve your room early. Pam Ciesla Merit Network,Inc. 734-936-0172 - phone 4251 Plymouth Road 734-647-3185 Bldg.I, Suite C pam(a)merit.edu Ann Arbor, MI 48107

1 0

Tutorial topics for future meetings
by Avi Freedman 05 Jan '99

05 Jan '99

<I do not post this as a representative of Merit...> I'd be interested to get some feedback about topics, either general or specific, that people would like to see covered in pre-NANOG tutorials. This would include both "I would like to learn about X" and "Goddamn it, not enough people know that they should {not} do Y". Please respond privately. Thanks, Avi

1 0

NANOG BOF topic suggestion
by Pete Kruckenberg 05 Jan '99

05 Jan '99

I would like to get some idea of the interest in a BOF topic for the next NANOG meeting (Denver, January 31 - Feb 2). Please respond to me privately with your vote (for or against the idea), and I will post a summary to the list in a week. I'm also looking for people who are interested in being on a panel to discuss this topic (if there is enough interest, of course). BOF Topic --------- Discussion of problems associated with managing hundreds of frequently- changing access-lists and rate-limits, across multiple routers throughout a network and by multiple policy managers. Background ---------- There has been a lot of discussion on this list and the inet-access list about the increasing need for better traffic management through traffic shaping and filters. Whether the reason is for reducing the effects of smurf attacks, controlling use of services to prevent customers from putting a server up without authorization, or managing the priority and amount of bandwidth given to customers, today's networks are rapidly outgrowing traditional bandwidth management methods. A static configuration of access-lists and rate-limits works when you are only making changes to a single router on an infrequent basis. These management techniques worked just fine when bandwidth could be managed in great swaths. With more customers having access to higher bandwidths through DSL, cable modems and other technologies, network operators are having to build increasingly more complex bandwidth management policies that change more frequently and must be distributed throughout an entire network of routers. I would like to propose a BOF session to discuss this topic. It seems (just based on what I've seen on this mailing list and elsewhere) that this is a pretty new problem, and there is not much being done in this area yet. This seems more appropriate for a BOF session than a tutorial or presentation (which might be better for a future NANOG). The topics I can think of that would could be covered in a BOF would be: discussion of the problem, managing hundreds of frequently-changing access-lists and rate-limits, distributing a traffic-management policy throughout a network, debugging/diagnosing problems with the policies, distributing the policy management amongst multiple managers. If you would be interested in attending this BOF, please respond to me privately. If you have some ideas yourself about the topic, please don't hesitate to make them known, too. Also, if you would be interested in being on a panel to discuss this topic, whether it be with the work you've done in this area or ideas you have about it or just that you understand the problem, please contact me and volunteer. I will post a summary to this list of the responses I receive in a week or so. Thanks. Pete Kruckenberg

2 1

Digest version of this list now available
by John Hensley 05 Jan '99

05 Jan '99

To subscribe, send mail to majordomo(a)merit.edu with a body of "subscribe nanog-digest". -- John Hensley <hensley(a)merit.edu> Merit Network, Inc.

1 0

Re: 'nic whois warning
by Dean Anderson 05 Jan '99

05 Jan '99

At 09:48 AM 1/5/1999 -0800, bmanning(a)vacation.karoshi.com wrote: >> >> At 10:04 PM 1/4/1999 -0800, bmanning(a)vacation.karoshi.com wrote: >> > >> >24.in-addr.arpa has never been delegated. >> >> What do you mean? Address space has been assigned by ARIN: > > There is no 24.in-addr.arpa zone. There are specific delegations > underneith it. Ok, I understand now. I first read you to mean 24 was not assigned, as opposed to not delegated. Sorry for the confusion. > There are no nameservers for this zone, as demonstrated by your > nslookup query. Doh! This is what I was looking for: (I knew there were people using 24.something in boston) > set type=soa > 0.128.24.in-addr.arpa. Server: starship.av8.com Address: 198.3.136.10 0.128.24.in-addr.arpa origin = ns1.ne.mediaone.net mail addr = hostmaster.mediaone.net serial = 1999010513 refresh = 3600 (1 hour) retry = 900 (15 mins) expire = 864000 (10 days) minimum ttl = 1800 (30 mins) 0.128.24.in-addr.arpa nameserver = ns1.ne.mediaone.net 0.128.24.in-addr.arpa nameserver = ns2.ne.mediaone.net 0.128.24.in-addr.arpa nameserver = ns1.mediaone.net 0.128.24.in-addr.arpa nameserver = ns2.mediaone.net ns1.ne.mediaone.net internet address = 24.128.1.78 ns2.ne.mediaone.net internet address = 24.128.1.86 ns1.mediaone.net internet address = 24.128.1.80 ns2.mediaone.net internet address = 24.128.1.81 > > Also, ARIN records the registrations made by the IANA. This was > the process as of four months ago, which was up to the point > that Jon left us. Josh has told me that the IANA still approves > every 24.in-addr.arpa delegation since this is the range for > cable deployment and cable is not reserved for the ARIN service > area. (yes cable does exist in Europe and Asia !) I see. That makes more sense now. Thanks! --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Operational question: Building filters from IRRdbs
by Alex Bligh 05 Jan '99

05 Jan '99

Here's a couple of operational questions for those who build filters from IRRdb's. Background: * peval / rpsl.merit.edu *may* be incorrectly evaluating RIPE database entries currently - but this isn't my main thrust. The scary thing is suddenly what I'm 99% sure used to work (expanding AS Macros) now silently fails if they are in RIPE. [for details see the end] * I'm not saying the server is broken (I guess it has something to do with the 'server is running at low priority' line), but if I had this in an automatic filter generating run, it would generate the RADB stuff just fine, and silently filter out all RIPE based peerings. Even if it's working perfectly correctly, the questions are still interesting, at least to me. Questions: * Does anyone actually do build filters without running their own complete database mirror, i.e. do they rely real time on a database working. If so, which one? * Does anyone let this config their routers automatically? To peers customers, transits, or all three? Or do you rely on humans to reinstall the lists once autogenerated? * If it's just a fact of life that occasionally this thing turns up duff data, and if people are in general doing automatic installation, what data validation heuristics are used? I'll summarize to the list any off-list replies that are interesting. -- Alex Bligh GX Networks (formerly Xara Networks) Boring details: [ If anyone from merit/isi is interested this is peval (RAToolSet v4.3.1) binaries from the isi site running on Solaris 2.5.1 and I'm sure it was working a little while ago. I can't get peval to produce anything sensible at the moment for anything in a database other than RADB. For instance: opal[amb].158$ ./peval -no-as -T all AS-EUNET Whois: Open rpsl.merit.edu, 43, RADB,MCI,RIPE,ANS,CANET Whois: WriteQuery -V RAToolSet4.3.1 --single --silent -k -r -s RADB,MCI,RIPE,ANS,CANET -u -T as-set AS-EUNET Whois: Response % RIPEdb(3.0.0a13) with ISI RPSL extensions % Server is running at low priority for -M, -m and -k queries % No entries found in RADB, MCI, RIPE, ANS and CANET database. NOT ANY A 'whois -h whois.ripe.net AS-EUNET' demonstrates that this isn't in fact the case. Works for anything in RADB, including my macros which are in both. As I said, I'm not saying the server is broken (I guess it has something to do with the 'server is running at low priority' line), but if I had this in an automatic filter generating run, it would generate the RADB stuff just fine, and silently filter out all RIPE based networks ] -- Alex Bligh GX Networks (formerly Xara Networks)

3 2

RE: Cisco config checker
by S.J.Brannon 05 Jan '99

05 Jan '99

One other problem with the Cisco config is that you can not see the FULL config. Only the differences from the defaults. I have had a number of problems where option defaults have changed from one release to another. I is not possible to move a config from on software version to another (no new features used) and it guaranty to work. I can remember a problem with Apple Talk address gleaning. It was off by default in the old software but on by default in the new. It is not possible to see this by looking at the running config in either router. I would like to be able to get a FULL config from a router if only for reference. ---------- From: Phil Howard[SMTP:phil@whistler.intur.net] Sent: Monday, January 04, 1999 13:17 To: S.J.Brannon Cc: lad(a)inficad.com; nanog(a)merit.edu Subject: Re: Cisco config checker S.J.Brannon wrote: > We have suggest to Cisco that if this tool is to be usable it must be in step with the IOS releases and regression tested. IOS has inside a data representation of what it things the configuration is (or should be). It read it in and it can write it back out. It is that internal data structure, as complex and messy as it probably is, having parts of the data scattered in so many modules, that really could represent the delta. Perhaps the only reliable way to do this is to do it inside IOS itself. With a new semantic of a config load that would mean "replace the old config entirely with this config" (as opposed to the existing semantic "merge this config with the old config") and the IOS would do the right thing, this might work. It would be a little bit more black magic, but it would beat having to keep two different IOS config interpreters in sync (the real IOS and the external tools). > This tool can never tell if the real network will work I don't think this problem will ever be truly solved by any means other than the ones we use now (check it the best you can, have a fallback plan, and go for it at a time of least disruption). -- -- *-----------------------------* Phil Howard KA9WGN * -- -- | Inturnet, Inc. | Director of Internet Services | -- -- | Business Internet Solutions | eng at intur.net | -- -- *-----------------------------* philh at intur.net * --

1 0