July 2000 - Test - lists.nanog.org

Re: whois databases and null fields
by Nathan Lane 26 Jul '00

26 Jul '00

A few nights ago it was worse. Instead of nulls, the registrar fields were incorrect indicating a completely different server and registrar (many of which did not exist or were non-functional.) The registrant and nameservers appeared correctly. Hopefully they will become driven to operational excellence and I've seen a few steps that way, but money, not process and service, seems to be driving them for the short term. -Nathan Lane Network Engineer

1 0

Re: Sonet protection usage
by smd＠clock.org 26 Jul '00

26 Jul '00

Bill Simpson writes to the "expertise list": | > This is typically 50ms, but one has to add the one-way delay to that. | > | I haven't seen anything about adding one-way delay to make it longer, | could you cite, please? My reading was that the 50 milliseconds | included delay, as 50 milliseconds would include a one-way trip | around the world, and section regenerators are much closer together | than that.... Your photons seem pretty damn fast to me. An ADM doing LSR will listen to N different copies of the same data, and buffers the first-arriving data so that it can compare at least one subsequent copy as a means of verifying data integrity. If the data checksums do not compare identically, then the ADM must make a decision about which copy to send onwards (if any). If both sets of data are sane, the frames received on the working interface are forwarded, the others are discareded, and an alarm is raised. If the working copy is not sane, then a protection switch is negotiated using the K1/K2 bytes in BLSR mode, or via other means if the receiver is not the K1/K2 master in unidirectional mode. The comparison threshold is 50ms, which gives ample wiggle room for large path-propagation-delay mismatches, while bounding the per-section delay inherent in this type of protection switching. It seems natural to me that the _fastest_ a receiving ADM can even in theory make an informed decision about whether to force a line switch is the difference in propagation delay between a working and protect pair. ADMs are not psychic! Finally, with a given comparison threshold, even a conceptually zero-length fibre, with zero propagation delay, will incur a time penalty between a physical cut and a line-switch. | Now, it appears to me that the question was about metro-area circuits | (recalling that these are usually called "intermediate" in the | specification) -- not short circuits inside a single facility, and | not transoceanic -- for "router redundancy". OK? Yes, and I answered Steve privately (because it was him). I merely intervened in this not to impart expertise upon competitors, but rather to correct your conflating ADM between a pair of routers and a single ADM with actual 1+1 protection along a multi-hop LSR-protected trail. As has been noted by other people in the thread, there are sound reasons why one might want to set up the latter, even on a circuit which is otherwise completely unprotected. Likewise, a higher-order container can be protected in the two router + one ADM scheme, even if the lower-order containers within it are otherwise wholly unprotected and only loosely related. | In giving a cogent answer, I've noted the carrier problems, and given | examples and rationale. In my experience, multiple circuits with | diverse topology is the best answer Protecting 12 DS3-mapped STS-1s inside an OC12 is cheaper and protects against a much more common failure mode than the kind of failures having 24 unprotected DS3s additionally protects against, and has the advantage of not making token-bucket-style or DSU-to-DSU style rate limiting much more difficult to implement in pay-for-available-bandwidth environments. This is independent of the length or locality of the DS3-mapped STS-1s (or, indeed, DS3-bearing VC3s (hi Neil!)). No charge for the partial implementation suggestion. Consult your vendor for further details. Sean.

1 0

Re: Internet FUD Abound
by Sean Donelan 26 Jul '00

26 Jul '00

On Wed, 26 July 2000, Andrew Bender wrote: > Another lapse in editorial integrity... this time, Reuters: > > http://www.techweb.com/wire/story/reuters/REU20000726S0007 The Reuters article skips over some of the important qualifiers in the Nature letter. Read the entire letter on the Nature website. http://www.nature.com/ The conclusions are interesting, but I think missing a few pieces of data. Every major public NAP has had service affecting incidents, and so far we have not seen the partioning effect Albert et al write about. I've also followed a fair number problems in the private connections, also without major network partion beyond those networks. Further, the source data from NLANR doesn't pick up every possible connection between networks. You should view source data as a floor(), not a ceil(), on the connectivity. And finally, coordinating a physical attack on more than a few physical locations is hard, even with perfect information. Of course, this is a false argument because it has never happened doesn't mean it can never happen. But I think its important to understand why such an attack is hard, as well as understanding why it is possible. On the other hand, there have been accidents (and perhaps some attacks) on the logical layer which have severely disrupted the Internet. The interesting thing about logical attacks is you don't need perfect information about the network because the critical points of the network almost act as natural gravity wells pulling the attack towards them (using a physical analogy in cyberspace).

6 5

Internet FUD Abound
by Andrew Bender 26 Jul '00

26 Jul '00

Another lapse in editorial integrity... this time, Reuters: http://www.techweb.com/wire/story/reuters/REU20000726S0007 R/ Andrew Bender thrupoint.net

2 1

PGPKEY Reminder
by gerald＠merit.edu 26 Jul '00

26 Jul '00

On 7/30/00 between 5 AM - 8 AM EDT Merit will convert from 'PGP-FROM' to 'PGPKEY' authentication as described in RFC 2726. All maintainer object 'PGP-FROM' instances will be converted to a 'PGPKEY' instance and a 'key-cert' object will be created for each unique 'PGPKEY' instance. After the conversion all public keys used for signing DB submissions will be visible in the registry as 'key-cert' objects. Registering public keys allows users to verify a maintainer's identity and to submit, update and maintain their own public keys like any other DB object. Normal PGP signing of DB submissions will continue to work exactly as before the conversion. The conversion should be seamless to our DB user community and no action is required. Merit has sent email to all users who will be affected by the conversion. The new 'PGPKEY' scheme makes it easier for users to integrate PGP signing into their DB update process. It is our wish that into the future all registry users will PGP sign their DB submissions. Please see www.radb.net/docs/keyfaq.html for additional information on the conversion process and tutorial information regarding the use of 'PGPKEY' authentication. Please consult RFC 2726 for the authoritative specification. IRRd team --Gerald Winters

1 0

Re: Internet FUD Abound
by Martin Cooper 26 Jul '00

26 Jul '00

Danny McPherson <danny(a)tcb.net> writes: > Just another subtle reminder that prefix-filtering (@ access and > inter-provider -- at least well-known address space) could have > a significant impact -- if/when this does occur. Whilst I have no quarrel with the excellent positions espoused by the likes of Paul Ferguson et al. about ingress filtering of transit customers, or for that matter similar positions on ingress prefix-filtering of BGP customers, I wonder why it is that there is not more support amongst the transit ISP fraternity for the use of route-servers for implementing prefix- filtering. All I hear is, "But the routers aren't up to full prefix-filtering; AS-path based filtering (if that) is the best we can hope for" etc. What were route-servers invented for if it wasn't for implementing routing policy, and leaving core routers to the job of advertising and accepting prefixes according to local policy, and IP packet forwarding? Yes, I realise there are resiliancy issues to be considered here... M.

1 0

Multiple incidents (NYC, Illinois, N.California)
by Sean Donelan 26 Jul '00

26 Jul '00

There is a fiber cut in central illinois. Uunet has equipment problems in New York City. And there seems to be something down between San Jose and San Francisco (parts of Yahoo dailynews.yahoo.com and some frame-relay service are down).

1 0

71% of the outages were within the carrier's control
by Sean Donelan 26 Jul '00

26 Jul '00

Several people asked me for a citation for my report that 71% of the outages were within the carrier's control. See ftp://ftp.atis.org/pub/nrsc/2mins2q2000.pdf item #74. You can also see the corresponding debate over what "control" meant.

2 1

replacement for Patton 2715 (G.703->V.35) ?
by Jim Mercer 26 Jul '00

26 Jul '00

i'm in north america, so i don't have much experience to draw on for E1 gear. i've got a circuit running using a Patton 2715 to convert the G.703 E1 into a full 2mbit V.35 which is connected to a cisco HD60 connector. i recommended this to a new client, but they are saying they can't get the Patton unit. can i get a short list of recommended E1 -> V.35 converters? -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Reptilian Research -- Longer Life through Colder Blood ] [ Don't be fooled by cheap Finnish imitations; BSD is the One True Code. ]

1 0

Re: 71% of the outages were within the carrier's control
by Sean Donelan 26 Jul '00

26 Jul '00

On Wed, 26 July 2000, "Chris" wrote: > Is it just me or does the report you sight say. in his opinion, 71% of > outages where in the carrier's control. I think you kinda left that word > opinion out of your statement. In my opinion, the earth is round.

1 0