January 2001 - Test - lists.nanog.org

Re: UUNET peering policy
by Sean Donelan 11 Jan '01

11 Jan '01

On Mon, 08 January 2001, Deepak Jain wrote: > This makes it very clear for those networks that want to consolidate their > operations and reduce their overall transit costs. For example: a > midsized access and a midsized web host could easily meet these > requirements for AS701 peering; depending on your definition of a midsized > host. You'll find that meeting the peering "requirements" and actually obtaining a peering agreement are two different things. Sprint had several sets of peering requirements, nevertheless it didn't prevent them from not setting up a single new peering agreement with a variety of networks which met those requirements for over three years if you believe Sprint's product manager.

6 5

IP whois info
by Hank Nussbacher 11 Jan '01

11 Jan '01

When processing cflowd and wanting to resolve IP nets as well as ASNs as quickly as possible is there a trick to do the lookups rather than trying RIPE, ARIN, APNIC (and perhaps others) in a cyclical manner? Is there some static file that one can download that lists just the IP nets and ASN and who it belongs to (for all databases - not just ARIN)? Thanks, Hank

5 5

Re: UUNET peering policy
by smd＠clock.org 11 Jan '01

11 Jan '01

Rodney Joffe is being optimistic; the fact is that a network that exceeds the minimum requirements UUNET has published yet which has zero customers, is simply not going to get a no-settlement peering agreement with UUNET. "Zero" here is a relative term. Sean. | >If I understand the document correctly, anyone who meets their clear | >requirements will be able to exchange traffic with them at no charge. [...] | >Rodney Joffe | >CenterGate Research Group, LLC.

5 4

Re: DNS requests from 209.67.50.203
by Vern Paxson 10 Jan '01

10 Jan '01

> A good way to reduce this is to turn off recursion for > people not on your network for your dns server. This is fairly easy > to do with bind8/bind9. The attack isn't via recursive lookups (though recursion could help augment the attack). The reflection is in terms of the DNS reply to the purported requestor (really the victim). At lbl.gov, none of the requests result in further lookups from our nameserver. But the victim still receives the reply stream, which from a combined large number of name servers is very large. See my draft paper ftp://ftp.ee.lbl.gov/.vp-reflectors.txt for a discussion of reflector attacks. Vern

2 1

Re: net.terrorism
by Paul A Vixie 10 Jan '01

10 Jan '01

> After this mail, we contacted Above.net again. They basically told us it > was for our own protection no. > because that traffic from that host does not > comply to their AUP. yes. > We specifically told them we really don't mind them > blackholing that host but *announcing* a route for it. So far no response. you expect abovenet to cut uunet's /16 into pieces so as to avoid sending to its customers the parts which violate abovenet's acceptable use guidelines? even if this were a scalable approach (considering the number of /16's which have violating /32's inside them, or will in the future), it's something i'd expect the owner of the /16 to take issue with. why are we discussing this on nanog? Paul Vixie <pvixie(a)mmfn.com> CTO and SVP, MFN (NASDAQ: MFNX)

10 10

Exchange point peering
by Robbie Harrell 10 Jan '01

10 Jan '01

I have some questions regarding an IX point. If I go to PacBell and sign the multilateral peering agreement it anyone and everyone can peer with me and I can peer with everyone else. Now if I buy a DS3 UBR port then my cells/packets have to contend with everyone else who is trying to egress out to an upstream provider. If there is contention then my cells can be dropped and my packets are unable to be reconstructed by the router. Does anyone know how this works at the Chicago NAP? Is my PCR for my ATM port set at line speed for DS3 OC3 and OC12. How do they prevent random cell discard at the egress port to upstream providers, is there a graceful discard so that cells are dropped to maximize good "packets". How does Pacbell ensure that there is a level of fairness for packet traffic. I understand that it will be UBR, but if Pacbell is sending only cells to upstream that randomly make it through the egress queues, there is really no way to ensure that ANY packets can get through. All the cells could be partial packet info. Any insight into this would be helpful so that I do not purchase a service that is worthless.

2 1

Re: IP whois info
by Sean Donelan 10 Jan '01

10 Jan '01

On Wed, 10 January 2001, Hank Nussbacher wrote: > When processing cflowd and wanting to resolve IP nets as well as ASNs as > quickly as possible is there a trick to do the lookups rather than trying > RIPE, ARIN, APNIC (and perhaps others) in a cyclical manner? Is there some > static file that one can download that lists just the IP nets and ASN and > who it belongs to (for all databases - not just ARIN)? IANA, as the ultimate "owner" of all ASN and IPs, used to publish such a list on an irregular basis buried deep on the ISI ftp site. However I haven't seen an updated list since Jon Postel passed away.

1 0

Re: Traffic Analizer
by Robert Beverly 10 Jan '01

10 Jan '01

Junipers with Internet Processor IIs and JunOS >= 4.2 also support exporting netflow records (version 5 or 8). Unfortunately they do it by sampling each Nth packet (where N is configurable) and sending to the SCB (the juniper routing engine). The connection to the SCB is only 100Mb while the router supports much higher speed interfaces, so we have had to use low sampling rates to avoid saturating the SCP connection. In practice we optically split trunks and use passive monitors (up to OC12, working on OC48). http://www.juniper.net/techpubs/software/junos42/swconfig-interfaces42/html… rob On Tue, Jan 09, 2001 at 11:15:14PM -0500, jlewis(a)lewis.org wrote: > > On Tue, 9 Jan 2001, Chris Adams wrote: > > > > NetFlow and related tools. Cisco's own NetFlow and CAIDA's cflowd tools are > > > the two I'm familiar with. > > > > > > <URL:http://www.cisco.com/warp/public/732/Tech/netflow/> > > > <URL:http://www.caida.org/tools/> > > > > What kind of additional load (CPU, RAM) does NetFlow put on a router > > (say a 7505 or 7513)? How does it work with CEF (along side it or in > > place of it)? > > I recently turned it off on one of our 7206's where it was using about 6mb > of RAM and increasing the CPU load by about 20 points. 128mb doesn't go > as far as it used to.

1 0

PSI as transit carrier
by Jason Lixfeld 10 Jan '01

10 Jan '01

I've been approached by PSI who seem to be taking a rather aggressive approach at selling their transit service as an alternative to the 3 major players in Canada (Sprint Canada, UUNet and Teleglobe). Their pricing is very aggressive but I'm just a router nazi and care more about knowing what the service is like and wether or not PSI is as well connected as the aforementioned competitors. Should I spend the money and buy from them or just peer with them, and get all their local and customer routes at only the price of a local loop? Anyone out there use them? Comments? Regards, Jason A. Lixfeld Senior Network Engineer Look Communications Inc. -- jlixfeld(a)team.look.ca .

6 5

RE: net.terrorism
by Roeland Meyer 10 Jan '01

10 Jan '01

> Yes, its above.net's network. They can do what they want. But > guys, the > box in question isn't at an _above.net customer_. Think about > this before > you think Sabri is smoking crack. You would have a point; if the box in question wasn't an ORBS box. if ORBS didn't invite script kiddies to attack AboveNet customers that may have open sendmail relays. if ORBS RelayTest was part of a "nice" system. This whole thing is skirting around the ORBS issue. It is clear that Sabri wants AboveNet to allow ORBS into their system. This "net terrorism" thingy is simply a sham. Otherwise, why would Sabri want access to the ORBS system? Of course, my bias wrt ORBS is well-known. However, it is not accidental that the ORBS relay test box is exactly the box that Sabri is complaining about. He said so clearly. What's Sabri's connection to BigFoot.Com (whom recently came out supporting ORBS)? This whole thread is about getting back-door support for ORBS.

2 1