June 1999 - Test - lists.nanog.org

Re: C&W Outage, more info, sort of
by Sean Donelan 03 Jun '99

03 Jun '99

jmbrown(a)ihighway.NET (John M. Brown) writes: >It seems that 2 of C&W's core routers in SFO had BGP session problems >and they cleared the sessions and everything was ok... Its a "level >two issue" at this time and the ticket is still open. L2 folks are >looking into the problem to try and figure out what happened. > >From our perspective we had no conectivity to NetScape or Yahoo via >the C&W link. Sounds like the cisco bug which has affected several different providers over the last month or so. A route (almost always a high-interest destination) doesn't get added to the forwarding table correctly. Nothing appears wrong at the router, but traffic between individual destinations dies. Unless a customer calls, the provider may not even notice, because it only affects traffic on a particular path through the network. A quick temporary solution is clearing the route table. The router usually builds a fresh route table with the correct forwarding information. And it appears to work until some event tickles the bug later. So far this problem manifest itself only with certain IOS versions using CEF. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

CW has SFO Master Ticket 1091
by John M. Brown 03 Jun '99

03 Jun '99

Seems anything going to Yahoo or Netscape (the two biggest) via cw.net is broke. According to CW NOC there core routers in SFO are having some sort of BGP problem... No ETR

2 1

C&W Outage, more info, sort of
by John M. Brown 03 Jun '99

03 Jun '99

It seems that 2 of C&W's core routers in SFO had BGP session problems and they cleared the sessions and everything was ok... Its a "level two issue" at this time and the ticket is still open. L2 folks are looking into the problem to try and figure out what happened. >From our perspective we had no conectivity to NetScape or Yahoo via the C&W link. Our affected time period was around 2 hours jmbrown(a)ihighway.net On Wed, Jun 02, 1999 at 11:21:06PM -0500, Sean Donelan wrote: > >Seems about 8 months ago one of my folks put DRA.COM into our > >spamsites list for SendMail. > > Ok. So back to what I was originally going to ask before I got > distracted into hacking into your mail system .... > > What was the story with C&W in San Francisco? It seems to have > cleared up, and C&W wouldn't say much to me. >

1 0

Interesting in-addr for sprintlink, NO DUH (Non Op)
by John M. Brown 03 Jun '99

03 Jun '99

3 core3.Bloomington.cw.net (204.70.4.21) 23.067 ms 24.411 ms 30.238 ms 4 somerouter.sprintlink.net (206.157.77.42) 26.112 ms 26.53 ms 37.65 ms 5 sl-bb10-ana-2-2.sprintlink.net (144.232.1.17) 25.518 ms 46.323 ms 26.47 ms

1 0

Re: NIST: 5% of attacks against Internet infrastructure
by Sean Donelan 02 Jun '99

02 Jun '99

alex(a)Relcom.EU.NET (Alex P. Rudnev) writes: >More interesting could be the _reasons of attacks_. > >(through you should divide _before NATA / after NATA bobbings -:) ). I don't know about other people, CERT?, but I still see the biggest correlation between the school year and attacks. In particular, there still is the September effect (start of the North American school year) and a rise between spring break and the start of finals in May. But that may just be an artifact of my customer base, or I may be missing the signs. No, this is not a request or challenge to test my security. Serbia, china, nato, etc have gotten a bunch of press coverage. But for the most part they vanish into the noise of what goes on every day. If the FBI put up an IRC server, then I would worry and try to get as far away as possible.... I guess we now know why the FBI didn't come to Eugene last week. I found the NIST report on infrastructure attacks interesting because historically phreakers/crackers have rarely gone after the network infrastructure they used. They did go after the billing and fraud systems, but usually left the network elements operating (sometimes with improvements). Since the Internet didn't have billing or fraud systems built into the backbone infrastructure, that eliminated a normally attractive target. >From an operations point of view, are people seeing more attacks on the backbone infrastructure itself than in the past? Sure, routers have fallen over in the past due to denial of service attacks. Which were usually directed at a host system, and the router was just collateral damage. But the only backbone infrastructure I can think of ever being attacked directly was AGIS during the spam years. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

NANOG17 (October 3 - 5, 1999)
by Craig Labovitz 02 Jun '99

02 Jun '99

NANOG will hold its 17th meeting in Montreal, Canada on October 3 - 5, 1999. This we be our first truly North-American (i.e. not United States) meeting. The local host for NANOG17 is Nortel Networks. More information on the meeting and conference hotel is available at http://www.nanog.org/mtg-9910/ Call for Presentations ---------------------- NANOG invites presentations on backbone engineering, coordination, and research topics. Presentations should highlight issues relating to technology already deployed or soon to be deployed in core Internet backbones and exchange points. Previous meetings have included presentations on: Backbone traffic engineering Coordination of inter-provider QoS Deployment experience with queueing disciplines (CAR, RED) Inter-provider security and routing protocol authentication Routing scalability in backbone infrastructures Security issues for the Internet core Routing policy specification and backbone router configuration Building large-scale measurement infrastructure Cooperative inter-provider caching Alternatives to hot-potato routing Recommendations on queue management and congestion avoidance Experience with differentiated services Reports from next-generation networks (Internet2, CA*net, etc) Inter-domain multicast deployment Backbone network failure analysis Inter-exchange point updates Tutorials have covered topics such as: BGP case studies Address allocation and renumbering External route selection IP multicast technologies How to Present -------------- Submit an informal one- or two-paragraph abstract describing the presentation in email to nanog-support(a)nanog.org. The proposal should be submitted well in advance of the conference. Notification of acceptance is rolling and is usually provided one or two days after receipt of the abstract. NANOG also welcomes suggestions/recommendations for tutorials, panels and other presentation topics.

1 0

NIST: 5% of attacks against Internet infrastructure
by Sean Donelan 02 Jun '99

02 Jun '99

Operational only in the sense that network operators will get asked about this fun statistic by their managers on Internet infrastructure attacks. NIST's ITL bulletin covered "Computer Attacks: What are they and how to defend against them" this month. NIST researchers estimated that 5% of the computer attacks they analyzed were against "Internet infrastructure" (which, in their analysis, includes both routers and firewalls). http://www.nist.gov/itl/lab/bulletns/may99.htm Instead of diverting your manager's attention by yelling "Watch where you step, the token fell out of the ethernet!" you might try soothing his concerns by reporting the bulletin also said most Internet infrastructure attacks were scanning and denial of service, and few involved penetration attacks. # config t (config)# ! too many commands to list here, ask the TAC for help securing (config)# ! your router -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

2 1

request for flow stats data
by Steve Feldman 01 Jun '99

01 Jun '99

About 18 months ago I collected some flow statistics summary data from busy routers and put the results in http://www.mae.net/flowstats/ There's interest in repeating the survey to see how things have changed and get more data points. If you are running cisco flow switching on a busy router and wouldn't mind sharing, please send me the top part of the output of a show ip cache flow (the summary info, not the individual flow information) and I'll include it. I'll keep the data source anonymous unless you explicitly give me permission to share it. As an alternative, if you are running cflowd the output 'artsprotos' on a 24-hour aggregate file would be useful. Also, please let me know approximately where in your topology the data comes from (e.g. exchange point, core, customer edge, etc.) and which part of the world it's in. Thanks for your help, Steve

1 0

DEW alert
by bmanning＠ISI.EDU 01 Jun '99

01 Jun '99

Hi, I appologize for duplicates. Its almost time for the next quarterly walk of the inverse tree of the DNS. For the last few quarters, I've been walking the in-addr tree looking for numbers of delegations, accurate delegations, and types and styles of error conditions. So... this is a heads up that you will be seeing zone transfers being generated by a couple of the collecter machines here. For those of you who utilize BINDs access controls, I'd appreciate your inclusion of the collector machines in allowed transfers. The expectation is that they will be the following IP addresses: 128.9.160.57 and 198.32.4.13 Past data is at: www.isi.edu/div7/people/bmanning.home/in-addr-audit.html The run is scheduled to start 01 July 1999. If there are any questions or concerns, I'd be happy to talk about them. Past data has been presented at IEPG, Apricot and RIPE meetings. The expectation is that future data will be presented in the same and similar forums. -- bill

1 0

Re: Oddities in a bad route announcement
by Sean Donelan 01 Jun '99

01 Jun '99

mdean(a)UU.NET (Michael Dean) writes: >We are doing this per the customer's request... It appears the customer finally decided it wasn't such a good thing to request. After being unreachable for several days from most networks, besides UUNET, the FCC returned to the Internet this morning. I sure hope Y2K doesn't happen on a holiday weekend :-) -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0