February 2001 - Test - lists.nanog.org

The Cidr Report
by Tony Bates 04 Feb '01

04 Feb '01

This is an auto-generated mail on Fri Feb 2 12:00:00 PST 2001 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 02Feb01 0) General Status Table History ------------- Date Prefixes 260101 96902 270101 96353 280101 96304 290101 96277 300101 96520 310101 96571 010201 96527 020201 96787 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 91.16.23.0/24 from AS11770 AS Summary ---------- Number of ASes in routing system: 9790 Number of ASes announcing only one prefix: 5718 (3222 cidr, 2496 classful) Largest number of cidr routes: 957 announced by AS701 Largest number of classful routes: 1658 announced by AS701 1) Gains by aggregating at the origin AS level --- 02Feb01 --- ASnum NetsNow NetsCIDR NetGain % Gain Description For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

2 1

RE: Vixie doing his part to make people upgrade (was:Re: Reasons why BIND isn't being upgraded)
by Roeland Meyer 04 Feb '01

04 Feb '01

> Please go hassle UUNET for not filtering port 25 on their > dial pools or > something! <tsk, tsk> Not fair, invoking the dead.

1 0

BIND, djbdns, etc - ^Z. suspend. fini. kill -9.
by jamie rishaw 04 Feb '01

04 Feb '01

core1.nanog(config)# no ip pointless-debating Might I suggest that this whole BIND/djbdns/ISC thread is old, and should either 1) be taken privately, off list 2) be taken to a trashy mail list where people bicker about stupid things like this (no names mentioned but it sounds like "eyenet axis") or 3) be dropped alltogether. jamie -- i am jamie at arpa dot com .. and this is my .sig. core1.dns.microsoft.com# sho access-list 101 Extended IP access list 101 deny udp any any eq domain (874572345872345 matches)

1 0

Re: Reasons why BIND isn't being upgraded
by Jeffrey Meltzer 04 Feb '01

04 Feb '01

On Sat, Feb 03, 2001 at 08:34:58PM -0800, Joe Rhett typed: > Yes, and I'm sure that everyone sitting on their heels dealing with those > environments thanks you as well. Let's be rude to anyone that doesn't meet > our personal design philosophy, why don't we? First of all, you were the one with the negativity first. Second, Anyone who is running stock daemon binaries deserves to have problems. Yes, This is a personal opinion. Never said it wasn't. But, at least 15 people mailed me privately agreeing with me. Another personal opinion: If there's someplace that won't let the admin's they hire use their judgement when installing such important services as dns, mail and www, sounds like they don't have alot of confidence in their admins. Scenario: Paul Vixie emails NANOG on a friday night that there's a security issue with bind. If it took Sun a week to come out with a patch, you're going to just sit idly by? In fact, I may have missed it, but I don't think i've seen a Sun patch yet. A search on Access1 shows the same. Are you still running bind previous to 8.2.3, as you'll only install a vendor patch? If ISC gave Sun the information prior to last Friday, they sure haven't done anything with it, that I can tell. So why should they get preferential treatment? I agree with Paul. This has gotten way to non-operational. > Hang out with Greg Woods much? OK, you just lost all credibility. Kthnx. -- Jeffrey Meltzer Sr. Network Administrator VillageWorld.com, Inc. SolarisGuide: http://www.solarisguide.com

1 0

Re: Reasons why BIND isn't being upgraded
by Jeffrey Meltzer 03 Feb '01

03 Feb '01

>Just about every very large company that I've ever worked with. Also, >having spent numerous years working the NAVSEA and other Pentagon systems, >you are explicitly not permitted to install anything other than a >vendor-provided patch. >My god, are there really this many idiots out there that don't grasp how >the world works? See, i'm sitting here thinking the same thing. Have you ever maintained a (bind|sendmail|etc) machine in a production, internet connected environment? I'm not talking about a corporate LAN, beind PIX's, etc. Jeez. If I waited for Sun to issue patches and upgrades, I would have been hacked a long time ago....And, I feel sorry for anyone that does wait for them. I cannot believe that there are people that are really using (and not to pick on Sun at all) Sun's bind and sendmail (and now apache). Apparently you live in a very straightforward world, and have no need for customization. Must have a real easy job. (Sorry for the negativity). I'm done with this thread. Paul, Keep up the good work. Whatever you people decide to do, the masses will apparently have no choice but to follow :)

2 1

Speakers circuit, upcoming Internet security confabs
by Sean Donelan 03 Feb '01

03 Feb '01

Everyone wants to get into the Internet security business. Cybercrime Summit 2001 http://www.asisonline.org/pdf/cybercrime.pdf $815 New Technologies to Strengthen Internet Security http://www.srinstitute.com/pdf/cs163.pdf $1395

1 0

BIND 9 vs djbdns
by Dave 'Duke of URL' Weiner 03 Feb '01

03 Feb '01

Long time reader, first time poster :) I've been following the recent thread about BIND. I have upgraded to the latest version, and I am not considering either an upgrade to BIND 9 or switching to djbdns. For those of you who have upgraded from 8.2.3 to 9.x, how difficult was it for you? Did you see a marked improvement in performance? For those of you who have switched from BIND 8.x to djbdns, how difficult was it for you? Are there any how-to's or detailed step-by-step walk through's that describe a reasonably sane way to upgrade? I've read all the docs on djbdns, and once the conversion is done, it looks pretty simple to administer, and work it into some of my automated setup tools. I'm more concerned with the conversion from BIND 8. I've been using DJB's qmail for 3 or 4 years now, so I'm very comfortable with his coding and restrictions, but I don't want to switch just because it's djb. I want to make an informed decision. So, please limit your comments to technical merit, ease of use, etc. This whole hub-bub about the security notifications, etc. is very low on my list as a factor in upgrading or changing. Thanks, Dave Weiner CTO, WebMasters, Inc. 800-472-9203 http://www.webmast.com

3 2

RE: Reasons why BIND isn't being upgraded
by Roeland Meyer 03 Feb '01

03 Feb '01

> From: Paul A Vixie [mailto:vixie@mfnx.net] > Sent: Saturday, February 03, 2001 3:03 PM > > The category "OS vendors" gets a little fishy... Do Linus > Torvalds and > > Alan Cox get on the list if they sign the NDA? How about Patrick > > Volkerding? > > If they're mature trustworthy people (I know Linus but not > those other guys) > and if they need some time to get patches ready for large > user bases, then I > feel sure that they'd be welcomed gladly. The catagory "OS vendors" may be a canard. MHSC is a Caldera VAR, but we also have live servers and so do our clients. We had already deployed BIND-8.2.3 before Caldera even made it available. That channel takes too long. I'm not a direct Sun customer, but I'll wager that Sun has yet to make it available to their customers. The same goes for HP and IBM.

1 0

RE: Reasons why BIND isn't being upgraded
by Mathew Butler 03 Feb '01

03 Feb '01

Paul, please pardon me while I guffaw, and then blame you (as representative for the ISC) for "passing the buck". "It's not our fault that the mechanism we use for notification is completely inadequate for the needs of the global community." Please think about the ramifications (PR, marketing, and sales) of that statement if a major corporation (such as Microsoft, Sun, Compaq, Dell, or any of the others) tried to state that. And then, please attempt to defend your position. Cordially, -Mat Butler -----Original Message----- From: Paul A Vixie [mailto:vixie@mfnx.net] Sent: Saturday, February 03, 2001 12:52 PM To: nanog(a)merit.edu Subject: Re: Reasons why BIND isn't being upgraded > I'm a bit confused. ... Yes. > Will the ISC implement similar policies with its INN and DHCP software > in the foreseeable future, or is this something unique to BIND? I don't see INN or DHCP as critical to the internet's infrastructure, so, no. > CERT has NEVER been the source of early warnings. By the time they release > information it has already been dissimenated in a variety of other forums. Nevertheless CERT is the mechanism ISC has always used to get critical bug notifications out to the industry, and there are no plans to change that. If you think CERT's methods are unsuitable, please take it up with them directly.

1 0

Re: BIND, djbdns, commercialization
by Jeffrey Meltzer 03 Feb '01

03 Feb '01

> I fail to see the point of discussing or arguing partial commercialization > of premium services -- I haven't seen one valid point yet. Point is, knowing how many organizations rely on their software, and outright saying that they will NOT let people know about bugs as soon as they do, even if they are willing to pay for it, just doesn't seem right. What makes Sun having this information more important than me? I'd have no problem if Vixie went the Allman route, saying "OK, we're going to start charging for support. If you want to know about bugs soon after we do, pay us $X. If not, use at your own risk." But, they're saying "We're only going to let people who we want to know about the bugs know about them. The rest of you can hear about it on the evening news." Even after they started sendmail.com, Allman and his crew have been very good about releasing new sendmail patches themselves, not making you wait for CERT Advisories, etc. Maybe The Sendmail Consortium just realizes that if it wasn't for the people using, breaking, and making suggestions about code updates for 10+ years, they wouldn't have the business they have now. Maybe ISC is forgetting that. Jeff -- Jeffrey Meltzer Sr. Network Administrator VillageWorld.com, Inc. SolarisGuide: http://www.solarisguide.com

4 3