July 2000 - Test - lists.nanog.org

Re: More on black-holed reserved/8 block.
by Paul Vixie 20 Jul '00

20 Jul '00

Valdis.Kletnieks(a)vt.edu writes: > Is it the case that above.net is black-holing packets with a *destination* > in the RBL, but *not* filtering packets with a *source* address from > the RBL? Please tell me how to automatically rebuild an ACL in real time based on advertisements and withdrawals in a BGP feed, and I'll recommend that everybody to that. Meanwhile, the RBL BGP feed only affects destinations. > If so, this would still allow RPC-based attacks (and TCP as well, > if the victim's box had bad sequence number prediction). Yes.

1 0

Re: someone RBL'd a reserveD-8 number from IANA
by Paul Vixie 20 Jul '00

20 Jul '00

jlewis(a)lewis.org writes: > I thought they had put all reserved IP space on the RBL to prevent it from > being announced and used by spammers, then unannounced to make it harder > to track the source. Yup. And every time IANA hands another /8 to some RIR, MAPS has to unblock it. Has that happened with 98.0.0.0/8? Doesn't appear so: IANA (RESERVED-8) Netname: RESERVED-8 Netblock: 96.0.0.0 - 126.255.255.255 Coordinator: Internet Assigned Numbers Authority (IANA-ARIN) iana(a)IANA.ORG (310) 823-9358 Fax- (310) 823-8649 Record last updated on 03-Nov-1998. Database last updated on 20-Jul-2000 06:58:05 EDT. I've thought sometimes that a BGP feed that only included iana-reserved and rfc1918 space, not spammers or other policy violators, would be a popular thing. I've also thought that if routers could filter based on lookup up source addresses in a BGP-made RIB, rather than just destination addresses, that the whole filtering-by-remote-control industry would appreciate the hell out of it. I'm pretty sure that both the 12016 and M160 have the hardware it would take to do this at wire speed, but I'm also pretty sure that the market for this feature is perceived by both vendors as "small."

1 0

Re: More on black-holed reserved/8 block.
by Richard A. Steenbergen 20 Jul '00

20 Jul '00

On Thu, 20 Jul 2000 Valdis.Kletnieks(a)vt.edu wrote: > (And yes, I understand that many routers can route to a blackhole destination > a lot faster than they can apply an ACL on the source). With CEF, you can route to a down interface faster then you can get to Null0. :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

someone RBL'd a reserveD-8 number from IANA
by Henry R. Linneweh 20 Jul '00

20 Jul '00

98.100.32.32 traceroute to 98.100.32.32 (98.100.32.32): 1-30 hops, 38 byte packets 1 main.bungi.com (207.126.97.9) 2.15 ms 1.73 ms 1.86 ms 2 above-gw2.above.net (207.126.96.217) 4.41 ms 4.88 ms 3.67 ms 3 core5-main2-oc3.sjc.above.net (216.200.0.205) 3.62 ms 4.56 ms 7.53 ms 4 core3-core5-oc48.sjc2.above.net (208.184.102.206) 6.34 ms 5.7 ms 5.3 ms 5 iad-sjc2-oc48.iad.above.net (216.200.127.25) 73.0 ms 79.7 ms 72.6 ms 6 hat.address.is.on.the.rbl.see.www.mail-abuse.org.for.more.information.above… (208.185.0.26) 72.7 ms 73.6 ms 105 ms 7 * * * -- Thank you; |--------------------------------| | Thinking is a learned process. | | ICANN member @large | | Gigabit over IP, ieee 802.17 | |--------------------------------| Henry R. Linneweh

5 4

Re: someone RBL'd a reserveD-8 number from IANA
by Richard A. Steenbergen 20 Jul '00

20 Jul '00

On Thu, 20 Jul 2000, Henry R. Linneweh wrote: > 98.100.32.32 > > traceroute to 98.100.32.32 (98.100.32.32): 1-30 hops, 38 byte packets > 1 main.bungi.com (207.126.97.9) 2.15 ms 1.73 ms 1.86 ms > 2 above-gw2.above.net (207.126.96.217) 4.41 ms 4.88 ms 3.67 ms > 3 core5-main2-oc3.sjc.above.net (216.200.0.205) 3.62 ms 4.56 ms 7.53 ms > 4 core3-core5-oc48.sjc2.above.net (208.184.102.206) 6.34 ms 5.7 ms 5.3 ms > 5 iad-sjc2-oc48.iad.above.net (216.200.127.25) 73.0 ms 79.7 ms 72.6 ms > 6 that.address.is.on.the.rbl.see.www.mail-abuse.org.for.more.information.abov… (208.185.0.26) 72.7 ms 73.6 ms 105 ms > 7 * * * RBL lists everything you shouldn't be getting packets from, including reserved IANA-reserved IP space, and AboveNet subscribes to a full BGP feed. If you could null route based on source using this information it would actually be a pretty effective method of maintaining a network wide filter setup with little to no maintenence. :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

route-reflector hierachies
by Lavelle, Neil 20 Jul '00

20 Jul '00

Hi All, I have a debate raging with one of my co-workers as to how one should deploy route-reflectors that has reached the point where I need some help from people that know lots about it ;-) If I have a number of clusters each with its own route-reflector(s) how should I peer between clusters ? >From reading RFC1966 ( and common sense ) it seems that the clusters should be fully meshed, and this is my opinion, however another opionion is that one should build a tree of route-reflectors with some route-reflectors not serving clusters but solely existing to reflect to other route-reflectors. Now I think the second idea would work and might be useful in some very specific cases, but would be madness given that each of the route-reflectors that form nodes of the tree represent single points of failure and that a failure of the root node would have catastophic results .... Any comments ? Thanks in advance Neil -- Neil Lavelle Orchestream Avon House Tel: +44 (0)20 7348 1500 Kensington Village Fax: +44 (0)20 7348 1501 Avonmore Road http://www.orchestream.com/ London W14 8TS, UK

1 0

Sendmail 8.11.0 is released.
by Valdis.Kletnieks＠vt.edu 20 Jul '00

20 Jul '00

OK.. I know a lot of you are running Sendmail, so.. ;) Valdis Kletnieks Operating Systems Analyst Virginia Tech

1 0

@home, toronto(?) outage?
by Jim Mercer 19 Jul '00

19 Jul '00

since about 10:am this morning, my @home connection (in my house) has not been able to get packets outside of the local network. my peering with @home at TorIX seems to be spotty at best, allowing some reachability, but not all. i've hear their peering with CanIX is in the same boat. pings work to some places, but traceroutes to the same places lock up. the noc number for @home toronto is busy (has been since i noticed the outage). anyone got any words? -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Reptilian Research -- Longer Life through Colder Blood ] [ Don't be fooled by cheap Finnish imitations; BSD is the One True Code. ]

2 1

Solaris load balancing?
by foo 19 Jul '00

19 Jul '00

What are the various options for load balancing across multiple interfaces which are connected to distinct switches/routers on a Solaris box? FEC/trunking wont work because the connections are to difference switches. Multiple default routes in Solaris appear to behave badly when one of the dest's is down, such that the route is not removed from the routing table and traffic is still sent in that direction (subject to TCP behavior), and it's round-robin versus something more interesting like MAC-hasing. I think I can do equal cost multipath with two default routes in Gated as well, but I'm not sure if Gated is any smarter about removing an unreachable route. Will eqmp work if I'm injecting two defaults with OSPF? Any other ideas? -Brian

3 2

Re: OK.. WHo's the wise guy?
by Valdis.Kletnieks＠vt.edu 19 Jul '00

19 Jul '00

On Wed, 19 Jul 2000 17:16:13 +0200, Daniel Karrenberg said: > Note that the set of nameservers for > .org and for . is not identical, i.e. the string 'ROOT' is > not the string 'GTLD': Damn.. Why do problems always crop up before caffeine, and never when you're NOT hurrying to get into a meeting you've been ordered to attend? ;) Anybody want to take guesses how many times I watched that same info scroll by and it didn't sink in? All I can say in my defense is the *last* time I had to check at the roots because I didn't trust them, root-servers and gtld-servers were the same set of machines. Having said that, does anybody who's (at least somewhat) unbiased have any information on the current state of the ORBS/MAPS/above.net pissing contest? It's pretty sad, because I thought that the ORBS and MAPS guys were at least on the same side (even if they DO disagree on tactics). There's been a lot of allegations/denials of blackhole routing for the ORBS DNS and WWW servers. Anybody seeing anything one way or another (i.e. "Yes, we're seeing a blackhole route", or "No, we can confirm that if there was one, we'd see it". -- Valdis Kletnieks Operating Systems Analyst Virginia Tech

1 0