April 1999 - Test - lists.nanog.org

Re: IRRs
by Sean Donelan 15 Apr '99

15 Apr '99

>Don't let a route being registered in one of the routing registries lull >you into a false sense of security (sic), there is zero to very little >real authentication done on a route registration. It only takes an ounce >(or less) knowledge to register a route as being originated from any AS. I have no illusion about the security of the routing registries. However they do have a couple of nice properties. Route registries show duplicate, and overlapping route registrations. BGP only shows the "best" routes. This makes it a bit easier to notice there should be a "better" route. It also serves as a form of "double-entry accounting," so simple accidents can be detected. Most RRs also maintain some type of audit trail. Which, as you point out, may or may not have a lot of authentication. For the non-malicious accident, it tells you who to talk to. For the malicious event, having a second source of data is helpful. I agree though RRs are less useful for this purpose. I tend to be a fan of RRs for the double-entry bookeeping reason, not because of any true authentication. Computers are good at detecting differences between two sets of data. Computers are not good at deciding right and wrong. I'm certain the mailing list will now enumerate the large number of problems of route authentication, and the several proposals in that area. >Do I think this is a real problem? It hasn't been so far, probably due to >our cooperative and trusting nature >;). I think it would take quite some >resources and reputation killing stupidity (or malice) to inject 'illegal' >routes and then do something meaningful with them. I think the answer to this is it may not have been a problem to you, so far. It is however a continuing problem for others. False route announcements happen nearly every day. Most don't happen to attract much attention because many of the victims are small sites, and the false announcements tend to be transient in nature. So many people just think its the Internet being flaky again. Often I've found the victim doesn't even realize it happened to them. False route announcements are popular with some spammers and crackers because its covers their origins a bit better. If you do manage to track down a false announcement, the originator always claims it was an accident. Although an unusually large number of accidential route announcements seem to originate in Hong Kong. But that may just be an artifact of the backbone they use, which can't be effectively filtered due to a lack of route information. The same thing may happen in other places, but they get filtered out by the routing registry information. They seem to announce the route for only a few minutes, do their work, and are gone before anyone notices. The 'slowness' of the routing registry update process might cause people to notice their activities more. At the present time even when the backbone security people return my page a couple of hours later, the false route is gone, and the security folks say they don't see anything wrong when they look at the net 'now.' -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Spring 1999 NOC contact drill
by Sean Donelan 14 Apr '99

14 Apr '99

Geez, yesterday it was the east coast. Today its the west coast. Yes, I'm still trying to work my way through the NOC contact list, but I keep getting interrupted by fiber outages around the country. At this rate I'm never going to get through. Question: for those who have experienced my of my phone calls in the past, how disruptive is it? If I went ahead, and continued going down the list during these outages, if I called your NOC during a fiber cut, would that be too distracting? Or am I just better off waiting until the next quiet period? Thanks. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

4 3

NRIC: 4th quarter 1998 report
by David Lesher 14 Apr '99

14 Apr '99

Unnamed Administration sources reported that Sean Donelan said: > - 4Q98 had more outages than any prior fourth quarter ......... Clearly all these problems have been caused by allowing CLEC co-lo access; likely by allowing Those People to use the restrooms. [WSJ had an article recently on the ILEC's petty behaviour re: co-lo space...] -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

NRIC: 4th quarter 1998 report
by Sean Donelan 14 Apr '99

14 Apr '99

The Network Reliability and Interoperability Council met today at the FCC. I thought I would review a few highlights from the 4th Quarter 1998 Network Reliability Steering Committee report. http://www.atis.org/ No it wasn't just your imagination, the last three months of 1998 were worse than normal. - 4Q98 had more outages than any prior fourth quarter - The aggregate outage index was significantly higher, and second highest on record - The number of switch outages was significantly higher - More CO power outages were reported than any other fourth quater - Procedural Error outages were in the "red" region of the NRSC control chart - There is a significant increasing trened in both the number of facility outages, and the number of CO power outages - There is an increasing trend in DACS outages, close to being statistically significant - There is an significant increasing trend in both the frequency and impact of Procedural Errors as the root cause of outages Good news, the number of SS7 CCS outages continues to decline. The mean time between outages was 2.0 days, and the median outage duration was 3.3 hours. This is only based on those outages reported to the FCC. As most of you know I have a continuing problem with the definition of a reportable outage, particular as they affect digital/data services. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

S.F. Major Outage.
by Gregory A. Carter 14 Apr '99

14 Apr '99

We get experienced about a 30 minute cut on our DS1 and was informed that there was a major outage in the San Francisco area. Anyone have any more info on this? Greg +(Omni@Dynmc.Net)------------------------------------------------------+ | Dynamic Networking Solutions InterX Technologies | | Senior Network Administrator bits/keyID 1024/7DF9C285 | | omni(a)interx.net omni(a)itstudio.net omni(a)undernet.org omni(a)webpop3.com | +--------[ DC 50 57 59 C3 76 46 E8 EB 75 A8 94 FE 96 9E D3 ]----------+

1 0

Major fiber cut in Tyson's Corner area
by Paul Ferguson 14 Apr '99

14 Apr '99

For what it's worth: I just heard on the local news that 3 fiber optic cables, as well as one large copper bundle was cut in the Tyson's Corner area (Northern Virginia). No idea what impact it may have on net traffic, although one fiber strand was reported as belonging to MCI. For those who may not know, MAE-East is in the Tysons Corner vicinity. - paul

2 2

Re: Major fiber cut in Tyson's Corner area
by David Lesher 13 Apr '99

13 Apr '99

TV Gnews is reporting that the villain is NOT (!!) a backhoe. Rather, it's a boring machine, the kind that rams a 10' length of rod into the ground, then backs up to accept another section. (MFS contractors used same here last summer. The nifty part is how the steer same 140' out and 20' down....) The strike is ~12' deep; Hell Atlantic & friends have 2 backhoes and considerable shoring on site at present. Servint.com was named as being knocked down by this. I am worried. Does this mean that OTHER kinds of machinery are now subject to Creutzfiber-Jakhoe disease? Is it being spread through Diesel fuel? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Hrrrmmmmm
by Richard Irving 13 Apr '99

13 Apr '99

> (OTOH, perhaps one should not use a >provider that is so big the provider's engineering staff cannot even >manage their own network.) :\

1 0

Re: FYI ONLY >> Non-Operational (at least directly)
by I Am Not A Lawyer Simpson 13 Apr '99

13 Apr '99

> From: I Am Not An Isp <patrick(a)ianai.net> > Naturally - they make a lot more money lying to you and then paying the > penalty when they get caught. Like 100% SLAs - a provider who offers a > 100% SLA *knows* they can't actually meet their guarantee, so they budget > in $X for payment of the penalties. And sometimes they even make the > process ridiculous to get your refund. > If they get caught, the penalty can be pretty high. When you sell a service that you don't actually provide, you can be changed with fraud and treble damages. Under the uniform commercial code, selling a product that works half as well as specified, you still have to refund the entire price, no half discount. As I understand it, after the Milan Michigan cut a few years ago, MCI had to refund (to a major auto company) the _entire_ amount of the contract from its beginning, as they had never provided the physically redundant circuits specified in the contract. No matter that they provided _some_ service that worked up until the cut -- they didn't provide the service specified in the contract. And to retain the rest of the contract, MCI had to put in a redundant fiber -- right down the center of Ann Arbor, at huge expense, including millions resurfacing some roads that had just been resurfaced a couple of years before, and (I've heard) paying 40 dollars per foot per year for the easements. NB: Too bad Merit doesn't have as good lawyers.... They were hit by the same cut, and I'm not sure they even got a refund. I guess the moral is, the contract is only as good as the amount of money that you are willing to spend on lawyers. WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

1 0

Re: FYI ONLY >> Non-Operational (at least directly)
by Sean Donelan 13 Apr '99

13 Apr '99

>It does not ease the situation WHEN your bits transit one provider's >backbone (whom you chose to assure redundancy) does ultimately receive >transit (at times such transit is not for long distances..) from a yet >another whose infrastructure is now effected. I am not suggesting however, >that is the case here.. AT&T is investigating. :) Yeah, that's one reason why I stopped including the name of the carrier in most fiber cuts. It was getting too hard to tell who was who with all the swapping, leasing, sub-leasing, etc. Cable&Wireless is paying Level 3 $670 million for pieces of its fiber. GTE/BBN paid Qwest a ton for pieces of its fiber. AT&T, Sprint, MCI/Worldcom fiber overlaps so much its hard to tell them apart in some places. Qwest and IXC keep digging up other people's fiber, which would indicate their new fiber is being placed very close to other fiber. The non-facilities based carriers sometimes do better if they can guess which carriers have non-overlapping facilities, and buy from multiple physical facilities. But its not uncommon to see a dozen large ISPs have problems when someone trashes an interesting SONET ring somewhere, like Herndon/Mclean this morning. All the good right-of-ways are already taken. Heck, last year I was on some beautiful Caribbean islands with populations less than 100 people. We found both a backhoe and a cut telephone cable on them. In ten years (I ordered my first circuit in 1989), I've never gotten a good, coherent answer why any of my diversely, redundent circuits were both out-of-service at the same time due to the same event. Lots of credits, lots of apologies, but never a straight answer why something that should never happen, modulo the end of the world, happened. Good luck on AT&T's investigation.... -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2