October 2000 - Test - lists.nanog.org

Re: IS-IS protocol implementation problem
by Sean Donelan 30 Oct '00

30 Oct '00

On Sun, 29 October 2000, smd(a)clock.org wrote: > P.S.: any chance you can be a bit more concrete about what's happening? When I'm concrete, providers complain I'm picking on them, and getting them bad press. But since you asked.... At approximately 7:37am EDT on Friday, about 258 Cisco 12000's on UUNET's primary backbone reloaded. This appeared to be isolated to routers in ASN 701. It disrupted reachability to about 15% of the world-wide Internet based on data from Matrix measurements. A contributing cause was a bad IS-IS packet which confused certain IOS versions in the 12.0 IOS software train. I haven't heard what the root cause was or what originated the bad IS-IS packet. The Cisco bug id is CSCdr05779. Any provider running the affected IOS version may be vulnerable depending on what the root cause turns out to be. Although the bad IS-IS packet didn't propagate to other providers, several other providers did report BGP resets and route flaps about the same time.

2 1

Re: IS-IS protocol implementation problem
by smd＠clock.org 29 Oct '00

29 Oct '00

| Because IS-IS is an IGP protocol, it does not propagate between | providers. This is not the reason why it will not propagate between separate ASes. The "saving factor" here is that nobody really routes CLNS natively, and therefore, the maximum hop-count of a CLNS datagram is 1. It would be possible to cascade an IS-IS problem across multiple separate ASes in the unfortunate event that more than one AS treated a single LAN (e.g. an IX) or point-to-point link as an internal one across which IS-IS is run, with the same key. This kind of mutual poisoning between separate ASes happens with some regularity, amusingly often with RIP as the IGP. An IGP based on a natively routed protocol (including routed CLNS) widens the scope for inter-AS poisoning. This is why it is important to have good authentication in one's IGP. Unfortunately, *no* IGPs currently in wide use have any such thing. :-( For clarity, a separate AS is really short hand for, "a collection of routers participating in a common IGP instantiation"; there are cases where different ASes (in the BGP sense) share a common IGP. Also, "propagating between providers" seems to ignore the fact that there are single providers who have multiple IGP instantiations. Sean. P.S.: any chance you can be a bit more concrete about what's happening?

1 0

IS-IS protocol implementation problem
by Sean Donelan 29 Oct '00

29 Oct '00

Network operators using IS-IS on Cisco should be aware of a problem which can result in their routers reloading unexpectedly when a corrupt IS-IS packet is received. Cisco has fixed the problem in various 12.0 software trains. The problem can cascade through a single provider's network. Because IS-IS is an IGP protocol, it does not propagate between providers. This has already affected a provider. I haven't found out what is originating the bad IS-IS packet, i.e. is this an inter-vender operability issue?

1 0

RE: Root registration
by Roeland M.J. Meyer 29 Oct '00

29 Oct '00

www.iana.org www.icann.org and if you want an over-view of TLD politics www.dnso.net > -----Original Message----- > From: Travis Grant [mailto:tgrant@kore.com] > Sent: Thursday, October 26, 2000 6:58 PM > To: 'nanog(a)merit.edu' > Subject: Root registration > > > > > How do I locate the the authority for root registration on behalf of a > foreign country? > > Travis Grant >

1 0

NMAP/TBIT
by Jitendra Padhye 27 Oct '00

27 Oct '00

Dear NANOG mailing list: We gave a talk at NANOG earlier this week in Washington, D.C., in which we reported on our development of TBIT (the TCP Behavior Inference Tool) for testing the TCP behavior of web servers in the Internet. We also raised the issue of running NMAP to help us correlate TCP behaviors with operating systems. The purpose of this correlation is so that any bugs identified by TBIT can be appropriately reported and fixed. One suggestion made at NANOG was that we send email to this mailing list to inform people when we are running large-scale NMAP scans. So the purpose of this email is to say that, over the weekend, we will be running NMAP against 20,000+ IP addresses from machines in bind.com domain, kindly provided to us by Aaron Hughes. If you have any problems with this, please contact us (padhye(a)aciri.org, floyd(a)aciri.org) instead of flaming Aaron :) Here are some URLs for more information: ACIRI: http://www.aciri.org/ TBIT: http://www.aciri.org/tbit/ NMAP: http://www.insecure.org/nmap/ Regards, - Jitendra Padhye and Sally Floyd. ---------------------- http://www.aciri.org/ ----------------------

1 0

RE: UO slashdotted
by Rishi Singh 27 Oct '00

27 Oct '00

Doesn't work. I got this message when I clicked on: http://people.oven.com/asr/carnivore.mpg 404 Not Found The requested URL '/asr/carnivore.mpg' was not found on this server. ---------------------------------------------------------------------------- ---- thttpd/2.19 23jun00 -----Original Message----- From: Adam Rothschild [mailto:asr@latency.net] Sent: Friday, October 27, 2000 4:21 PM To: nanog(a)merit.edu Subject: Re: UO slashdotted On Fri, Oct 27, 2000 at 10:29:40AM -0700, hardie(a)equinix.com wrote: > It looks like a slashdot link to the UO Carnivore files > has taken out the service. We've got a mirror up at: <http://people.oven.com/asr/carnivore.mpg> This may be subject to rate-shaping, but if so, the thresholds defined will be more than generous. Have fun! -adam

3 3

RE: UO slashdotted
by Rishi Singh 27 Oct '00

27 Oct '00

Thank you very much for the effort Hans. I am now able to download the multicast viewer toolkit. -----Original Message----- From: Hans Kuhn [mailto:hak@oregon.uoregon.edu] Sent: Friday, October 27, 2000 4:46 PM To: Rishi Singh Cc: 'Lucy E. Lynch'; 'nanog(a)merit.edu' Subject: RE: UO slashdotted Rishi, I mirrored the IP/TV viewer and MIM client on another ftp server that is not mirroring the carnivore stuff. You should be able to get through to get the client at least and watch it on multicast. There is a link at http://videolab.uoregon.edu/download.html or you can go directly to the ftp site for the browser impaired. ;) ftp://denali.uoregon.edu/pub/videolab/iptv-30.zip Hans -- Hans Kuhn, Academic User Services office (541) 346-1714 University of Oregon, 233 CC fax (541) 346-4397 Key fingerprint = 1E BC 32 03 AC E9 82 6C 44 4A CD 63 BB 2D 51 89 On Fri, 27 Oct 2000, Rishi Singh wrote: : : Every single download link on the page for the MPEG videos are broken or : maybe the sites are too busy? : : In addition the link to get the IPTV software is also broken at: : : ftp://limestone.uoregon.edu/pub/videolab/iptv-30.zip : : : -----Original Message----- : From: Lucy E. Lynch [mailto:llynch@darkwing.uoregon.edu] : Sent: Friday, October 27, 2000 2:25 PM : To: hardie(a)equinix.com : Cc: nanog(a)merit.edu : Subject: Re: UO slashdotted : : : : We're also got a mirror up - the UO page: : : http://videolab.uoregon.edu/nanog/carnivore/ : : but point here would be that the multicast session is way : more effective - given the bandwidth, an MPEG capable : client already installed, and multicast turned up for your : site ;-) : : Lucy E. Lynch Academic User Services : Computing Center University of Oregon : llynch(a)darkwing.uoregon.edu (541) 346-1774 : Cell: (541) 912-7998 5419127998(a)mobile.att.net : Key fingerprint = 2C 80 2F 8C 5F 68 37 E3 AC 16 09 F1 36 E4 61 15 : : :

1 0

UO slashdotted
by hardie＠equinix.com 27 Oct '00

27 Oct '00

It looks like a slashdot link to the UO Carnivore files has taken out the service. Ted

4 4

RE: UO slashdotted
by Rishi Singh 27 Oct '00

27 Oct '00

Every single download link on the page for the MPEG videos are broken or maybe the sites are too busy? In addition the link to get the IPTV software is also broken at: ftp://limestone.uoregon.edu/pub/videolab/iptv-30.zip -----Original Message----- From: Lucy E. Lynch [mailto:llynch@darkwing.uoregon.edu] Sent: Friday, October 27, 2000 2:25 PM To: hardie(a)equinix.com Cc: nanog(a)merit.edu Subject: Re: UO slashdotted We're also got a mirror up - the UO page: http://videolab.uoregon.edu/nanog/carnivore/ but point here would be that the multicast session is way more effective - given the bandwidth, an MPEG capable client already installed, and multicast turned up for your site ;-) Lucy E. Lynch Academic User Services Computing Center University of Oregon llynch(a)darkwing.uoregon.edu (541) 346-1774 Cell: (541) 912-7998 5419127998(a)mobile.att.net Key fingerprint = 2C 80 2F 8C 5F 68 37 E3 AC 16 09 F1 36 E4 61 15

1 0

The Cidr Report
by Tony Bates 27 Oct '00

27 Oct '00

This is an auto-generated mail on Fri Oct 27 12:00:00 PDT 2000 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 27Oct00 0) General Status Table History ------------- Date Prefixes 201000 89411 211000 89037 221000 89088 231000 89255 241000 89314 251000 89441 261000 89651 271000 89717 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 8876 Number of ASes announcing only one prefix: 5070 (2831 cidr, 2239 classful) Largest number of cidr routes: 923 announced by AS701 Largest number of classful routes: 1138 announced by AS701 1) Gains by aggregating at the origin AS level --- 27Oct00 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 421 148 273 64.8% BCnet Backbone AS1221 590 439 151 25.6% TELSTRA-AS AS9269 180 47 133 73.9% Hong Kong CTI AS816 549 421 128 23.3% UUNET Canada (ASN-UUNETCA-AS4) AS2609 128 8 120 93.8% EUnet-TN AS6429 226 112 114 50.4% FirstCom Internet AS9304 130 17 113 86.9% Hutchcity AS8013 464 360 104 22.4% PSINET-CA AS7545 159 55 104 65.4% TPG Internet Pty Ltd AS4755 200 102 98 49.0% Videsh Sanchar Nigam Ltd. India AS705 356 259 97 27.2% ALTERNET-AS AS7657 312 217 95 30.4% The Internet Group Limited AS7046 347 255 92 26.5% UUNET-CUSTOMER AS7496 128 37 91 71.1% Power Up AS174 542 456 86 15.9% Performance Systems International AS701 1138 1055 83 7.3% Alternet AS4293 340 258 82 24.1% Internal ASN for C&W AS13999 91 9 82 90.1% UNKNOWN AS6595 138 57 81 58.7% DODDSEUR AS3908 251 172 79 31.5% Supernet, Inc. AS577 247 176 71 28.7% Bell Backbone AS724 218 151 67 30.7% DLA-ASNBLOCK-AS AS7018 582 516 66 11.3% AT&T WorldNet Service Backbone AS5106 100 37 63 63.0% AADS-COLUMBUS AS226 169 107 62 36.7% USC/Information Sciences Institut AS3749 118 57 61 51.7% TECNET AS1727 149 88 61 40.9% MRMS-WEST AS16758 63 6 57 90.5% UNKNOWN AS376 131 75 56 42.7% RISQ AS8151 180 126 54 30.0% UNINET-MX For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0