October 2001 - Test - lists.nanog.org

black hat .cn networks
by Dan Hollis 08 Mar '02

08 Mar '02

http://wired.com/news/politics/0,1283,43437,00.html Time to drop AS4134. -Dan

16 17

Code Red -> Router Memory depletion?
by Mike Lewinski 22 Nov '01

22 Nov '01

We've seen two routers experiencing problems this AM that appear to be related to client swervers infected with the IIS Code Red virus. I say appear because of the timing with cpu profiles on downstream routers where infections broke out, but I don't have any direct evidence. The first one was a border router: Jul 19 08:00:47 5093: 2w5d: %SYS-2-MALLOCFAIL: Memory allocation of 65540 bytes failed from 0x603BF35C, pool Processor, alignment 0 Jul 19 08:00:47 5094: -Process= "BGP Router", ipl= 0, pid= 86 # sh ver uptime is 4 hours, 46 minutes System returned to ROM by bus error at PC 0x603BFCFC, address 0xFFFFFFF0 at 05:57:21 UTC Thu Jul 19 2001 The other one is a client aggregation router Jul 19 12:02:49 192: %SYS-2-MALLOCFAIL: Memory allocation of 1964 bytes failed from 0x314DA4A, pool Processor, alignment 0 Jul 19 12:02:49 193: -Process= "OSPF Router", ipl= 0, pid= 32 (This router is still functioning, but not allowing any incoming connections on telnet). -Mike

4 5

Re: Fwd: Re: Digital Island sponsors DoS attempt?
by Paul Vixie 10 Nov '01

10 Nov '01

> Philosophically I think the EFF is right. Blocking a single > legitimate e-mail is very bad, and should be avoided at all costs. Bad for whom? Only for the sender? Does this sender have rights which should supercede the property rights of recipients and of infrastructure owners? If so then who gets to decide whether mail is legitimate or not? The sender again? If so then why should anyone ever be allowed to filter out "spam", either as a recipient, or as an infrastructure owner? That way lies madness. Senders have no such rights, and the determination of a message's legitimacy lies with recipients (and perhaps infrastructure owners) NOT senders. A sender's rights are determined by their contract with their ISP, and an ISP's rights are determined by their contracts with their peers and transit providers. > Practically I think that the tactics of MAPS and ORBS and other > blacklists are necessary right now. I'd like nothing better than > to see them go away because better technology has come along. Agreed. (And note that I no longer have an operational role at MAPS.) > Legally (eg, if congress were going to pass a new law) I'm very > much on the side of the EFF, because the law must be pure and true, > because anything less impinges on our civil liberties. I also want the law to be pure and true, but there is no civil liberty involving the transmission of e-mail or any other traffic whose cost of delivery is paid in any way by anyone other than that sender.

18 28

Re: Fwd: Re: Digital Island sponsors DoS attempt?
by Paul A Vixie 10 Nov '01

10 Nov '01

> As an infrastructure owner, the important thing is that if you're > going to announce reachability, it should be real. If you blackhole > stuff in the middle of a netblock and distribute it as an untainted > netblock in your BGP, you're depriving people of clean routes. ok, so how do you handle a situation like orbs/abovenet as in late 1999? a /16 owned by a transit customer of as6461 had in it a /24 used by orbs. the orbs traffic violated as6461's aup, which the /16's owner had signed. the /16 owner had a less restrictive aup for its downstreams (including orbs) than as6461 had, and thus had a weak contractual basis for enforcing the as6461 aup on orbs. as6461 had three possible choices: (a) ignore it and hope the nonuniform enforcement of the aup didn't show up as a problem elsewhere at a later time; (b) disconnect orbs' upstream on the basis of their inability to conform to the aup they had signed; or (c) block traffic to/from the /24 in question after carefully notifying the /16 owner that this would be done and why. as we all know, (c) was chosen. great was the hue and even greater the cry. a recommendation was even made that if as6461 wasn't going to carry the whole /16 that it ought to chop it up and only advertise the parts it could reach, in spite of what these more-specifics would have done to the /16 owner's own routing policy (they were multihomed.) what would YOU have done? justify your answer. (show all work.)

3 2

NY ranks #1 in Internet b/w
by Hank Nussbacher 05 Nov '01

05 Nov '01

Perhaps Sept 11 was no coincidence and perhaps they knew of these numbers as well. -Hank http://www.totaltele.com/view.asp?ArticleID=45236&pub=tt&categoryid=626 New York is the Internet capital - TeleGeography By Total Telecom staff 30 October 2001 New York is the world's Internet capital in terms of bandwidth connectivity, according to Washington DC-based research group TeleGeography Inc. With almost 150 Gbps of region-to-region bandwidth connectivity, the Big Apple is hooked up to more than two-thirds of all interregional Internet capacity worldwide. London comes a long way second, with just over 85 Gbps. According to the TeleGeography report, Packet Geography 2002, New York has direct connections into 71 other countries, 10 more than London. The report ranks global Internet cities according to their roles as "interregional hub cities," measuring how much Internet capacity links them to other world regions. After NY and London, Amsterdam, Paris, and San Francisco complete the Internet global city top five. In all, five of the top 10 cities are in the U.S., four are in Europe, and one, Tokyo, is in Asia. Although Europe and Asia each have major hub locations, most Internet traffic between Asia and Europe still traverses U.S. coast-to-coast routes. Indeed, according to the report, 13 of the top 25 companies providing international Internet connections in the U.S. are based outside of North America. The Top 10 in full is: 1. New York (149,989.5 Mbps of Internet bandwidth) 2. London (85,518.7 Mbps) 3. Amsterdam (24,479.6 Mbps) 4. Paris (22,551.8 Mbps) 5. San Francisco (20,813.6 Mbps) 6. Tokyo (16,745.5 Mbps) 7. Washington DC (13,261.2 Mbps) 8. Miami (11,912.4 Mbps) 9. Los Angeles (11,227.0 Mbps) 10. Copenhagen (10,417.0 Mbps) Note: Figures represent Internet bandwidth connected across international borders to Consolidated Metropolitan Statistical Areas or equivalents. Domestic routes are omitted. Data as of mid-2001. This report can be purchased through Total Telecom's 'Reports and Research' resource. Click here for more details.

19 26

Fwd: Q: Sizes of Existing and Planned Fully Meshed IPSEC VPN (Tunnel Mode)
by Rodney Thayer 04 Nov '01

04 Nov '01

I assume "fully meshed" means each node connects to each other node, so each node has 109 tunnels (110 total). I also assume "Cisco IPSEC based VPN" means IPsec (rfc 2401/2411/etc.) and not MPLS-only. In that case, 120 is not 'large' according to the vendor community -- 'large' starts at around 5000 tunnels. I suspect that, in nature (or in the land of the Nanogians) that under 1000 is more like a 'large' one. On the other hand, drop one box with 119 tunnels set up and restart it and time how long it takes to re-initiate all 119 tunnels, and you may very well be unhappy. >From: "Tim Bass" <bass(a)silkroad.com> >We have a Cisco IPSEC based VPN with over 110 edge routers >in a full tunnel-mode mesh, mostly 'big hunking routers' with >average CPU utilization under 15 percent. The VPN is >controlled by a single organization, under centralized admin.

3 2

Q: Sizes of Existing and Planned Fully Meshed IPSEC VPN (Tunnel Mode)
by Tim Bass 04 Nov '01

04 Nov '01

Lots of old and dear friends in NANOG to say HELLO!, it has been many, many years since I've posted here. Hopefully this very simply question will not be very controversial :) I did a search of the archives on VPN with keywords 'size' and 'mesh' only to find a thread debating the merits of MPLS. This was an interested thread and some of my old and dear friends were active in that discussion. Please allow me to ask a simple less-technical question. My apologies if this has been discussed and I missed it in the archives. We have a Cisco IPSEC based VPN with over 110 edge routers in a full tunnel-mode mesh, mostly 'big hunking routers' with average CPU utilization under 15 percent. The VPN is controlled by a single organization, under centralized admin. Are there larger fully meshed VPNs out there in ISP land? Are there any 'real-tangible issues' with a fully meshed VPN at the size we are talking (around 120 sites fully meshed)? The marketing hype tends to be great. I like -vadim's closing comments in: http://www.merit.edu/mail.archives/nanog/2001-08/msg00311.html as follows: "Sometimes older ways are simply better." --vadim This seems to be true regarding a simple fully-meshed IPSEC VPN in tunnel-mode, right NANOG geniuses? Is 110 fulled meshed edge routers considered big?? Finest Regards, Tim www.silkroad.com

2 1

slightly OT : versign complaint department
by beldridg＠best.com 04 Nov '01

04 Nov '01

i've been trying to add a pgp key to the verisign/netsol database for the past two weeks. i've sent four messages, opened three web help requests, and spent three hours on the phone with their helpdesk. they know less than their customers about their own procedures and web documentation for adding keys for PGP guardian auth. i guess this is the problem with government sanctioned monopolies. i'd like to do something about it. does anybody know if there is a formal board or governing group that i can send my grievances to? - brett

10 11

214/8 and 215/8
by smd＠clock.org 01 Nov '01

01 Nov '01

Hi - 214/8 and 215/8 seem to have been allocated to the U.S. DoD in ca. 1998. There does seem to be a few sizeable announcements (which overlap a few not-so-sizable ones), but I have to wonder if anyone can explain the grounds on which they were allocated these two /8s, and which body did the allocation. Anyone? Sean.

14 15

ISP-ISAC (was Re: New Alert :: Whens the 'Net the target?)
by Kelly J. Cooper 01 Nov '01

01 Nov '01

On Oct 30, 6:38am, Randy Bush wrote: > Subject: RE: New Alert :: Whens the 'Net the target? * *> I agree. But I'd rather set up a sacrificial neck for the government to *> wring instead of letting the beaucrats pick one at random. * *couldn't think of a better one than IOPS, years of hot air and doing *nothing real. Y'know, nothing ends a day better than being told that I've been toiling for years in vain. Ah, the good life. Let me try again to do something real, but this time with a little more context. A couple of weeks ago, I asked the NANOG mailing list for feedback on what ISPs (of every stripe) consider to be useful information feeds. The REASON I was asking is because we're about to get the ISP-ISAC started (hopefully before the year is out) and I was wondering what information would be useful enough for the us to collect, analyze, and provide to members that ISPs would consider it (the ISP-ISAC that is) valuable. So, instead of a bunch of hot air about the ISP-ISAC not doing anything when we haven't even started yet, howzabout ya'll give me some good solid feedback to this request? Because I only got 3 (serious) emails and a phone call last time I asked. (All with good suggestions, btw, but I'm hoping for more). --- Forwarded mail from <kcooper> ("Kelly J. Cooper") * From: "Kelly J. Cooper" <kcooper> * Date: Mon, 8 Oct 2001 22:54:39 +0000 * To: nanog(a)merit.edu * Subject: INFORMATION FEEDS What information feeds are the most useful to your NOC? To your Analysts? To your Engineers? To your Customers? Do you want them to see outage reports on the MAEs? Fiber cut reports from certain telcos/fiber providers? (If so, which ones?) Maintenance reports on NAPs? Maintenance plans from peers? Ticket-based updates from your upstreams/transit providers/peers regarding outages? Changes to registrar databases? Maintenance announcements on the root servers? Outages or degradation in availability for popular web sites? All of the above? None of the above? Many other subjects? (If so, which ones?) Thanks, Kelly J. (Not talking about Security just yet...) -- Kelly J. Cooper - Security Engineer GENUITY - Main # - 800-632-7638 3 Van de Graaff Drive - Fax - 781-262-2744 Burlington, MA 01803 - http://www.genuity.net ---End of forwarded mail from <kcooper> ("Kelly J. Cooper")

2 1