October 2001 - Test - lists.nanog.org

route-views, current status
by David Meyer 26 Oct '01

26 Oct '01

After talking to many of you at NANOG, we came to the conclusion that the best course here was to leave the Cisco (route-views.oregon-ix.net) as it was, and to replicate some part (if not all) of the peerings on a zebra bgpd box that could do the MRT format export of RIBs and UPDATEs. Please check http://archive.routeviews.org and let me know what you think. Thanks, Dave

1 0

RE: Digital Island sponsors DoS attempt?
by Quibell, Marc 26 Oct '01

26 Oct '01

Hierarchial routing, not routing protocols: from far-end points to backbone and back out. Different interfaces support different MTU's. In this context, let's say your lowest common denominator starts at (A maximum of) 64000 MTU, from your GBit. Jumbo frames. Somewhere in that range I think. Let's say your pipe to the internet is an OC-3, an edge router. What is that, 9172 MTU? Your MTU has just been sliced and diced and PMTU-D, from it's return "Packet too big" ICMPs has cut it down to size. You basically said it already, and in fact the RFC defines this as well, though does not go into further detail. This is what I think is meant by hierarchial routing. Concerning ACLs, I don't see a problem filtering ICMPs using source and destination addresses. An admin's source and destination address or just his/her source being permitted? I believe there are also methods of filtering ICMP types as well, as defined in RFC1700? Yes Networks are private, and using firewalls help keep them that way. Can you login to a private network? Just because you can ping does not grant you access..And just because they have an internet line does not make them public domain. Marc -----Original Message----- From: Nicholas Bastin [mailto:nbastin@opnet.com] Sent: Friday, October 26, 2001 4:08 PM To: Quibell, Marc Cc: 'Valdis.Kletnieks(a)vt.edu'; nanog(a)merit.edu Subject: RE: Digital Island sponsors DoS attempt? On Fri, 2001-10-26 at 14:19, Quibell, Marc wrote: > > The answer is yes, that's what I'm saying. PMTU is fine on a LAN that could > be capable of Jumbo Frames, but is pretty much useless over the WAN or > internet since the PMTU has to use the lowest comon denominator MTU in the > path. Nobody I know, nor have I ever had a problem with "PMTU" and shutting > off ICMP routing. And no I do not believe it is used across the internet, > and if it does, it is probably hindering performance since it's probably > using a lower mtu than is allowed, such as 576 or smaller. It would also > have problems running across multi-level routing hierarchies. (I'll make the assumption here that PMTU really means PMTU-D in some cases) Using the lowest common denominator MTU in the path is exactly the point, and it's pretty hard to find out what that value is with PMTU-D. It *is* used across the internet, and while the MTU usually gets affected nearer to the edge than the core (PPPoE or other reasons), various forms of tunneling in the path can drop it below 1500 bytes. Also, I'd be interested in hearing any facts you might be able to present on why it would have any problem running across multi-level routing hierarchies, as I can't possibly see how the choice of routing protocol or hierarchy would affect the path MTU in the least. > No, there is a greater need for ICMP drops, and that is ping attacks. Still > happening to some of our customers. No one's going to sit there and filter > IP blocks. There are currently no viable uses or reasons for pinging into > private networks, except for possible troubleshooting, in which case the > admin would be involved. So, your ACLs can determine whether it's an admin or a user sending ICMP. That's an interesting piece of hardware you have there... And I don't know about everyone else, but if your network were truly 'private', I wouldn't be able to ping into it anyhow. As soon as you have users, connect to the internet, and expect to be able to reach the internet in a mostly unrestricted manner, your network doesn't fit my definition of 'private'. -- Nick Bastin OPNET Technologies

1 0

RE: Digital Island sponsors DoS attempt?
by Quibell, Marc 26 Oct '01

26 Oct '01

The answer is yes, that's what I'm saying. PMTU is fine on a LAN that could be capable of Jumbo Frames, but is pretty much useless over the WAN or internet since the PMTU has to use the lowest comon denominator MTU in the path. Nobody I know, nor have I ever had a problem with "PMTU" and shutting off ICMP routing. And no I do not believe it is used across the internet, and if it does, it is probably hindering performance since it's probably using a lower mtu than is allowed, such as 576 or smaller. It would also have problems running across multi-level routing hierarchies. No, there is a greater need for ICMP drops, and that is ping attacks. Still happening to some of our customers. No one's going to sit there and filter IP blocks. There are currently no viable uses or reasons for pinging into private networks, except for possible troubleshooting, in which case the admin would be involved. Finally, I do not believe PMTU uses pings to discover the PMTU. I believe it uses TCP or UDP packets at the layers above IP, and it DOES use "ICMP Packet Too big" responses (from the receiver) to cut it's packet size. So in reality, a router blocking ICMP from being routed through can still send these ICMP messages PMTU needs. Is this how you understand it? Marc -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Friday, October 26, 2001 12:22 PM To: Quibell, Marc Cc: nanog(a)merit.edu Subject: Re: Digital Island sponsors DoS attempt? On Fri, 26 Oct 2001 12:01:38 CDT, "Quibell, Marc" said: > That's all fine Valdis, but no one does MTU check on the internet or pmtu > checks. This is all LAN-based... Umm.. I'm confused. What's all LAN-based? Or you saying that PMTU Discovery isn't used *at all*? Or that it's not *widely* used, mostly because a large chunk of the net *is* stuck at 1500-byte MTUs, and a large fraction of the rest has broken PMTU discovery because of boneheaded ICMP filtering? -- Valdis Kletnieks Operating Systems Analyst Virginia Tech

4 3

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

Don't be insulting Happy Gilmore. You said, "Certainly would not want someone to upgrade from a DS3 to an OC3 to "enhance internet traffic" from their site to me, or multi-home to make sure if one provider / line dies their site is still available. And forget about using load balancers, Content Distribution Networks, etc." Talk about silly! Ever notice why STANDARD (hint) upgrades are warranted, while not even remotely connected to the subject at hand? S-T-A-N-D-A-R-D-I-Z-E-D. We all can use our brains and tell the difference between standard upgrades and standard load-balancing, as defined by numerous RFCs, and non-standard, uninformed haphazard methodology! I made a point that basically said DI's unorthodoxed methodologies are not your choice (at least not until you discover them). You addressed that point by saying I misinterpreted that, that "using a gizmo was my choice" and I said that the difference is that one is a choice, your choice, the other is not. And I must also add that one affects only you while the other affects the entire Internet. Big difference, see it? Now take back that 'silly' comment! :) Marc -Trying to find the silliness... -----Original Message----- From: Patrick W. Gilmore [mailto:patrick@ianai.net] Sent: Friday, October 26, 2001 3:47 PM To: nanog(a)merit.edu; Quibell, Marc Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt At 03:29 PM 10/26/2001 -0500, Quibell, Marc wrote: >You said, "If I feel like using..(someone's) performance improving gizmo, >it's my decision." The problem with this is, in the DI example, it is not >your choice. I suppose if you're confortable with the idea of rogue >companies trying to enhance internet traffic on their own, whether you agree >with the methodology or not and giving you no choice, then that is your >perogative. Somehow I knew you would misinterpret what I said. Allow me to help you out a bit. You completely missed this part: <quote> And the IETF, IEEE, RFC-editor, NANOG, EFF, PTA, SPCA, or any other alphabet organization has nothing to say about it. (Assuming, of course, I am not violating standards, attacking people, etc.) [...] Unfortunately, it *MAY* be that DI is violating that "assuming, of course" part above. </quote> As for "rogue companies trying enhance internet traffic on their own", well, we better make sure everyone has the same routers, same transit provider, same BGP config, same web server software, etc., etc. Certainly would not want someone to upgrade from a DS3 to an OC3 to "enhance internet traffic" from their site to me, or multi-home to make sure if one provider / line dies their site is still available. And forget about using load balancers, Content Distribution Networks, etc. Marc, I have tried to be nice, but your replies just get more & more silly as time goes on. Please read the whole post & think before (if) you reply.... >Marc -- TTFN, patrick P.S. I wonder if Keynote has permission from every web page they test?

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Patrick W. Gilmore 26 Oct '01

26 Oct '01

At 03:29 PM 10/26/2001 -0500, Quibell, Marc wrote: >You said, "If I feel like using..(someone's) performance improving gizmo, >it's my decision." The problem with this is, in the DI example, it is not >your choice. I suppose if you're confortable with the idea of rogue >companies trying to enhance internet traffic on their own, whether you agree >with the methodology or not and giving you no choice, then that is your >perogative. Somehow I knew you would misinterpret what I said. Allow me to help you out a bit. You completely missed this part: <quote> And the IETF, IEEE, RFC-editor, NANOG, EFF, PTA, SPCA, or any other alphabet organization has nothing to say about it. (Assuming, of course, I am not violating standards, attacking people, etc.) [...] Unfortunately, it *MAY* be that DI is violating that "assuming, of course" part above. </quote> As for "rogue companies trying enhance internet traffic on their own", well, we better make sure everyone has the same routers, same transit provider, same BGP config, same web server software, etc., etc. Certainly would not want someone to upgrade from a DS3 to an OC3 to "enhance internet traffic" from their site to me, or multi-home to make sure if one provider / line dies their site is still available. And forget about using load balancers, Content Distribution Networks, etc. Marc, I have tried to be nice, but your replies just get more & more silly as time goes on. Please read the whole post & think before (if) you reply.... >Marc -- TTFN, patrick P.S. I wonder if Keynote has permission from every web page they test?

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

You said, "If I feel like using..(someone's) performance improving gizmo, it's my decision." The problem with this is, in the DI example, it is not your choice. I suppose if you're confortable with the idea of rogue companies trying to enhance internet traffic on their own, whether you agree with the methodology or not and giving you no choice, then that is your perogative. Marc -----Original Message----- From: Patrick W. Gilmore [mailto:patrick@ianai.net] Sent: Friday, October 26, 2001 3:17 PM To: nanog(a)merit.edu; Quibell, Marc Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt At 02:56 PM 10/26/2001 -0500, Quibell, Marc wrote: [...] >If a vendor uses ping times and hops to determine closest servers, where >does it ping from? Each M$ server? And then how does it tell the client or >server where to redirect the traffic? If I read the original post right, the >pings came from DI. How does this determine the location of off-site >servers? Is this the best way to do it and what is the total bandwidth >impact on the internet? While I agree there may be unintended consequences, even to the point of poor performance or effectively DoS'ing a site, this is not really relevant, or the province of the IETF. If I feel like using cisco's or DI's or Joe-The-Web-Guru's new wiz-bang load-balancer speeder-upper performance-improving reliability-enhancer on MY WEB PAGE, then that is MY decision. Period. And the IETF, IEEE, RFC-editor, NANOG, EFF, PTA, SPCA, or any other alphabet organization has nothing to say about it. (Assuming, of course, I am not violating standards, attacking people, etc.) >The original poster of this message stated afterwards, offline, he's now up >to over 2400 pings in three hours. Add this number of pings to the number of >servers and the number of clients being pinged. It grows exponentially. Do >you not think that there should be some Official Standards developed to >accomodate and support this? Unfortunately, it *MAY* be that DI is violating that "assuming, of course" part above. I honestly am not sure why they would need to send 2400 pings in 3 hours. But I am also not 100% certain that sending 2400 pings is excessive or "wrong". Suppose the end users on that network asked for 500 GB of data from 100 DI customers? Honest, I do not know the answer, and I doubt most people here do either. Without knowing the circumstances on both sides of the connection, it is a bit difficult to say "You did a BAAAAAAD thing". IMHO, of course. >Marc -- TTFN, patrick

1 0

Re: The grass is green? No! The sky is blue!
by Dave O'Shea 26 Oct '01

26 Oct '01

As an official representative* of the U.S. Department of Bad Analogies, I am here to help. When I'm on a freeway, I expect to see a lot of cars, and I expect a small number of them to be driven by idiots. I wear my seat belt and try to be aware of the idiots to make sure I keep my distance. But I don't let them distract me from my primary task. I also see, very rarely, someone truly dangerous, perhaps a drunk, or a truck that is unknowingly losing cargo on the road. Those very few are worth making note of and pointing out to The Proper Authorities. At home, living at the end of a cul-de-sac, I expect to see very few cars, and I expect to be familiar with the drivers of most of them. When I see one that doesn't look familiar, I will probably notice it. If I see the same car more than once, I would probably say hello to the driver, and determine why he's there. The few times I've done this, I've usually found that they're a contractor, or someone visiting a relative. Once I've done so, I'll go back to something productive like watching The Simpsons. Yes, I could make a stink about them parking on the street, but it would make my neighbors think I'm far more grumpy and weird than they already think, and they'll be less inclined to lend me a hand next time I need to move something heavy. Moral of the story: Things that are alarming in one context are harmless in another, and vice versa. The value is in that SJDLR ("something just don't look right") instinct that cops and similar professions, that allows them to spot trouble. *I'm lying, of course. I don't even claim to represent my own opinion, never mind anyone else's. > -----Original Message----- > From: Matt Levine [mailto:matt@deliver3.com] > Sent: Friday, October 26, 2001 2:43 PM > To: Simon Lockhart; Dan Hollis > Cc: Christopher Wawak; Alex Rubenstein; nanog(a)nanog.org > Subject: RE: EXAMPLE: ### xxx Canada detected a penetration > attempt from > 209.123.x.229. Incident# xxxx > > > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Wouldn't it be more appropriate to use "businesses" instead of > houses? Trying the front door to a business to see if they're open > (while no excuse for checking the windows, obviously) is a little > more appropriate IMO.. > > > Matt > > - -- > Matt Levine > @Home: matt(a)deliver3.com > @Work: matt(a)eldosales.com > ICQ : 17080004 > PGP : http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x6C0D04CF > "The Trouble with doing anything right the first time is that nobody > appreciates how difficult it was." > > - -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf > Of > Simon Lockhart > Sent: Friday, October 26, 2001 3:19 PM > To: Dan Hollis > Cc: Christopher Wawak; Alex Rubenstein; nanog(a)nanog.org > Subject: Re: EXAMPLE: ### xxx Canada detected a penetration attempt > from > 209.123.x.229. Incident# xxxx > > > > > > >On Fri, 26 Oct 2001, Christopher Wawak wrote: > >> Well, not exactly. Looking into the windows or checking the > >> doorknobs is more akin to looking at your directory structre on > >> your computer or file ... Scanning is more like going through the > >> phone book or looking at the names on mailboxes in a > >> neighborhood.... > > > >So you dont mind if people portscan your network? > > Stupid analogy # 54325235: > > pinging all hosts on a net: Walking down a street finding out which > houses > exist > > Portscan: Trying the doors, windows, etc on a house > > I know which one I don't mind... > > Simon > - -- > Simon Lockhart | Tel: +44 (0)1737 839676 > Internet Engineering Manager | Fax: +44 (0)1737 839516 > BBC Internet Services | Email: > Simon.Lockhart(a)bbc.co.uk > Kingswood Warren,Tadworth,Surrey,UK | URL: > http://support.bbc.co.uk/ > > > > -----BEGIN PGP SIGNATURE----- > Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> > > iQA/AwUBO9m8rsp0j1NsDQTPEQKtSwCfdo8BpdgJoUZ5kJlvptNB14UwTLgAn0yy > G6u7HTmDnKp9fAmJontSwdsd > =LpNH > -----END PGP SIGNATURE----- > >

1 0

RE: [SOT Rant] Non-hostile probes / opt-in/out--BTW
by Quibell, Marc 26 Oct '01

26 Oct '01

BTW, I just tried pinging ns01.army.mil...no reply. :( Marc -----Original Message----- From: James Thomason [mailto:james@divide.org] Sent: Friday, October 26, 2001 3:00 PM To: Patrick W. Gilmore Cc: nanog(a)merit.edu; Quibell, Marc Subject: RE: [SOT Rant] Non-hostile probes / opt-in/out If I did, and they responded negatively, I would tell them YOU said it was a good idea. Seriously, why should the administrators of *.army.mil care if I test packet response time between our networks? Is this an illegal activity I am unaware of? On Fri, 26 Oct 2001, Patrick W. Gilmore wrote: > > At 02:16 PM 10/26/2001 -0500, Quibell, Marc wrote: > > > >Maybe you should ping NS01.ARMY.MIL about 2400 times in 3 hour and see if > >you don't get a visit? Pinging a website 2 times means nothing.. > > How about 441 times in 2 hours? :) > > > >Marc > > -- > TTFN, > patrick > >

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Patrick W. Gilmore 26 Oct '01

26 Oct '01

At 02:56 PM 10/26/2001 -0500, Quibell, Marc wrote: [...] >If a vendor uses ping times and hops to determine closest servers, where >does it ping from? Each M$ server? And then how does it tell the client or >server where to redirect the traffic? If I read the original post right, the >pings came from DI. How does this determine the location of off-site >servers? Is this the best way to do it and what is the total bandwidth >impact on the internet? While I agree there may be unintended consequences, even to the point of poor performance or effectively DoS'ing a site, this is not really relevant, or the province of the IETF. If I feel like using cisco's or DI's or Joe-The-Web-Guru's new wiz-bang load-balancer speeder-upper performance-improving reliability-enhancer on MY WEB PAGE, then that is MY decision. Period. And the IETF, IEEE, RFC-editor, NANOG, EFF, PTA, SPCA, or any other alphabet organization has nothing to say about it. (Assuming, of course, I am not violating standards, attacking people, etc.) >The original poster of this message stated afterwards, offline, he's now up >to over 2400 pings in three hours. Add this number of pings to the number of >servers and the number of clients being pinged. It grows exponentially. Do >you not think that there should be some Official Standards developed to >accomodate and support this? Unfortunately, it *MAY* be that DI is violating that "assuming, of course" part above. I honestly am not sure why they would need to send 2400 pings in 3 hours. But I am also not 100% certain that sending 2400 pings is excessive or "wrong". Suppose the end users on that network asked for 500 GB of data from 100 DI customers? Honest, I do not know the answer, and I doubt most people here do either. Without knowing the circumstances on both sides of the connection, it is a bit difficult to say "You did a BAAAAAAD thing". IMHO, of course. >Marc -- TTFN, patrick

1 0

Re: MIT network measurement probes
by Christopher Wolff 26 Oct '01

26 Oct '01

David, I respect your approach, letting us know about your bandwidth study and what each network operator can expect. The important part is that we get the opportunity to either opt-out, or find out a way to "opt-in" and help you acquire more information to complete your research. Too bad Digital Isle didn't follow the same approach. Regards, Christopher J. Wolff, CTO Broadband Laboratories ---------- Original Message ---------------------------------- From: "David G. Andersen" <dga(a)lcs.mit.edu> Date: Thu, 25 Oct 2001 23:51:44 -0400 (EDT) > >Given the current thread about unwanted network probe traffic, >I figured it would be a good idea to pre-announce this and >let people have a chance to put their netblocks on a deny >list in advance, if they so desire. > >(Note: We'd really appreciate it if you'd let our probes go >through! It's an important part of some of the research we're >doing). > >We're running some traceroutes and pings to observe the end-to-end >reachability of sites around the times of BGP route changes. >This means that if you have a stable network, you probably won't >see too many probes from us, but if you flap all the time, >you'll see up to a few probes per hour. >(One probe == one traceroute). > >The probes are extremely low-bandwidth and as non-invasive as >we can make them, but if you'd like to be put on an exclusion >list for this and any other probing experiments our >research group runs, please send mail to: > > mon-request(a)nms.lcs.mit.edu > >Include all of the netblocks that you'd like excluded, preferably >like: > >18.31.0.0/24 > >Thanks, > > -Dave Andersen > >-- >work: dga(a)lcs.mit.edu me: dga(a)pobox.com > MIT Laboratory for Computer Science http://www.angio.net/ >

7 6