May 2001 - Test - lists.nanog.org

Re: black hat .cn networks
by Adrian Chadd 11 May '01

11 May '01

On Wed, May 09, 2001, Ehud Gavron wrote: > "Europeans have this knack..." > > OFF-TOPIC and stupid. > > Europeans have this knack of taking a perfectly good on-topic > operational problem and turning it into a whine about how > Americans don't try and speak their N languages. Referring to me? God, I hate being flamed. > Welcome to the Internet. We speak English. Welcome to > telecommunication carriers. We speak English. Welcome to > the International Space Station. We speak English. Welcome > to maritime SOS. We speak English. Welcome to my backyard. > > We speak English. You don't have to like it, but it's not > xenophobic, xenocentric, Americentric, Anglocentric, or anything > other than REALITY created through EXPEDIENCY. Thats strange. I see lots of work with the free unices in an attempt to get internationalisation to work. I see lots of commercial software applications and operating systems which have localisation and internationalisation options. And, on mailing lists with a subscriber base that is non technical and non-English-subscriber-limited, I frequently get emails sent by people in some other language[1]. In fact, I could say that a lot of foreign users can get away being on the internet without a decent understanding of English. The internet != telco != ISS != Maritime SOS != any other internationally agreed upon and perhaps regulated area where English has been accepted as being the "language of choice". The internet has no regulations, and as such you must understand that not everyone on the internet - admin or user - is required to speak English. Adding to that, the intelligence level required to pilot an airplane, operate telco infrastructure, fly a spacecraft or sail a boat is _NOT_ being dumbed down so any idiot user that can read can use. Now, if it were me, I'd force any company with an internet connection and a BGP connection to have a NOC/sysadmin(s) capable of speaking a common language. I'd prefer it to be English because I don't speak any other languages (yes, I'm Australian, and as my dutch friends will be quite happy to point out _i do not speak any other languages_) but I'd be happy with some form of standard. The internet has a bunch of technical standards which we loosely agree to. There's no law stating "thou shalt speak English if connected via BGP4 to thy internet". Live with it. Adrian [1] Generally they are french. :-) -- Adrian Chadd "How could we possibly use sex to get <adrian(a)creative.net.au> what we want? Sex _IS_ what we want!" -- Fraser

13 16

Connectivity from 60 Hudson to NYIIX
by Randy Neals 11 May '01

11 May '01

Has anyone used an Ethernet LAN extension service to get from 60 Hudson to NYIIX? Perhaps you could email me off-list and tell me what layer 1, 2, 8, or 9 issues you ran into getting the circuit installed/working. Trying to decide if that is a workable alternative to dropping a router at NYIIX and using a conventional telco circuit. Thnx Randy Neals Manager, Engineering GT Group Telecom Inc. 20 Bay, Suite 700 Toronto, Ontario.

2 1

Traffic generator for loadbalancer test
by Arnold Nipper 10 May '01

10 May '01

I am looking for a traffic generator for stresstesting load balancers. Has anyone an idea if there is software or anything else? I'm particularly interested in testtraffic for DOMAIN and WHOIS. Thanks, Arnold -- Arnold Nipper / nIPper consulting mailto:arnold@nipper.de Heilbronner Str. 34b Phone: +49 700 NIPPER DE D-76131 Karlsruhe Mobile: +49 172 2650958 Germany Fax: +49 180 505255469743

4 3

RE: ISP Filter Policies--Follow Up--Verio Verification
by Murphy, Brennan 10 May '01

10 May '01

I wanted to follow up on my query below. I found a real-world case where a company advertises /16, /19 and /24 nets from the same Class B space....yet all are reachable from Verio's network (I tested this with Verio's Traceroute Server). A phone call to Verio verified for me why all 3 nets are reachable. (interestingly, the traceroutes themselves sort of masked how this was working--hence, the need to talk to Verio) Basically, it was as I had thought--because at least one of the sites advertises /16, this is enough to get traffic off of Verio's net, ie, all traffic destined for any piece of the /16 is passed to its "nearest" neighbor. If that neighbor in turn has the /19 & /24 in addition to the /16, the routing from that point on will be optimal. If not, it passes it to the neighbor from which it received the /16...and so on, until someone has the full /19 or /24 net. So, when I originally posted the note below, I was worried that Verio customers might not be able to reach certain networks with prefixes longer than /16, ie, sort of blackholing the routes to those destinations. (Remember, I'm new to Internet routing.) That would indeed seem to be the case if there were no /16 advertisement in addition to the more specific announcements. That's the generic BGP/Verio lesson I drew. The more specific lesson is that if your working with a large provider like Internap or Genuity in all your sites, traffic destined for your location is going to get back to you as long as they are advertising the /16 in addition to the more specific nets. ...even if the source hosts are on networks like Verio's. Any further comments appreciated. -----Original Message----- From: Murphy, Brennan [mailto:Brennan_Murphy@NAI.com] Sent: Tuesday, May 08, 2001 12:07 PM To: 'nanog(a)merit.edu' Subject: ISP Filter Policies--Effect is what? I'm trying to figure out to what degree the existence of these policies should be accounted for in a BGP design which includes sites around the world. I've read through a few of the threads having to do with Verio's Filtering Policy. And I read the policies listed here: http://www.nanog.org/filter.html Consider the following theoretical scenario: Site BGP Advertisement to ISP Amsterdam 169.61.201.0/24 AMSISP Austin 169.61.111.0/24 Genuity & Internap SanFran 169.61.119.0/24 Genuity & Internap Tokyo 169.61.202.0/24 TOKISP Sydney 169.61.156.0/24 SYDISP 1. Since Verio says they would not accept /24 nets drawn from Class B space, I assume this means that they don't insert a /16 into their tables so that the /24 nets appear to Verio customers as unreachable. In this case, a design that wants to extend connectivity to verio customers (and any other ISP with similar policies) must include a /16 advertisement from at least one of the sites. 2. Suppose a customer of a Verio-like ISP, wishes to go to ftp. foo.org. DNS returns 169.61.201.155 (in amsterdam, see above). Verio passes the traffic to the neighbor it received the /16 advertisement from. At this point, the best thing that could happen is if that neighbor has the /16 and /24 networks in its route table, right? That means, a path exists for that user to the amsterdam server and the only problem with routing to Amsterdam is that Verio possibly handed the traffic to a sub-optimal neighbor. Am I understanding this issue correctly? I'm new to BGP. I've tried to get a handle on this issue on my own and by working with Genuity, Internap and Cisco. No disrespect to those companies but each of them had this vague memory of Verio's policy but couldnt really tell me in plain language how it might affect the above scenario. Obviously, I wasn't talking to chief engineers. Someone from the CCIE mailing list suggested I browse the archives of this list, which I did. But I didnt find a clear enough answer to my questions--perhaps because they are too basic to be discussed here or I'm not good at using this lists archive search engine. Either way, any guidance on the above scenario is greatly appreciated. -BM

1 0

Draft agenda for Scottsdale
by Susan Harris 10 May '01

10 May '01

DRAFT AGENDA - NANOG 22 SUNDAY TUTORIALS 1:30 - 3:00 p.m. BGP Techniques for Service Providers (Phil Smith, Cisco) 1:30 - 3:00 p.m. Basic ISP Traffic Engineering Tools and Practices (John Brown, Chagres Technologies) 3:00 - 3:30 p.m. BREAK 3:30 - 5:00 p.m. BGP Techniques (cont'd.) 3:30 - 5:00 p.m. ARIN Policies and Guidelines (Richard Jimmerson, ARIN) MONDAY GENERAL SESSION 9:00 a.m. Welcome, Introductions (Susan Harris, Merit, Rodney Joffee, CenterGate) 9:15 a.m. Estimating Global Denial-of-Service Activity (Stefan Savage, UCSD/Asta Networks, David Moore, CAIDA/CAIMIS, Geoff Voelker, UCSD) 9:45 a.m. Observations and Experiences Tracking Denial-Of-Service Attacks Across a Large Regional ISP (Rob Malan, Farnam Jahanian, Jon Arnold, Matthew Smart, Univ. of Mich.; Paul Howell, Russell Dwarshuis, Jeff Ogden, Jon Poland, Merit) 10:15 a.m. An Anomaly-Based Approach to Identifying and Stopping DDoS Attacks (Massimiliano Poletto, Mazu Networks) 10:45 a.m. BREAK 11:05 a.m. A Fine-Grained View of High-Performance Networking (Steve Casner, Cengiz Alaettinoglu, Chia-Chee Kuan, Packet Engines) 12:00 p.m. LUNCH 1:30 p.m. IPv4 Address Space Allocation and Usage Trends (Scott Marcus, Genuity) 1:50 p.m. Progress With the DNS Security Extensions (Edward Lewis, TISlabs) 2:20 p.m. A View of the Future Internet (Peter Lothberg, Stupi LLC) 3:00 p.m. BREAK MONDAY BREAKOUT SESSIONS (3:30 - 5:00 p.m.) Track A: Introduction to IP Multicast Practice (Bill Nickless, Argonne National Lab) Track B: SNMP Update (Jeff Case, SNMP Research) Track C: More on Network Policy--Sequel to a BOF, Prelude to a Tutorial (Stephen Stuart, MFN) ================= 5:30 - 7:30 p.m. Beer 'n Gear! ================= Monday Evening BOF 7:30-9:00 p.m. Internet Routing Registry Coordination (Jerry Winters, Cisco) TUESDAY GENERAL SESSION 9:00 a.m. The New IETF Sub-IP Area: A Brief Summary for Service Providers (Curtis Villamizar, Avici) 9:30 a.m. MPLS Enhancements to Support Layer 2 Transport Services (Jeremy Brayley, Laurel Networks) 10:00 a.m. Very Pleasant/Painful Networking: The Highs and Lows of Building and Maintaining VPNs (Matt Baker, Intel) 10:30 a.m. BREAK 10:50 a.m. OSPF for a Broadband Wireless Campus Backbone (Joseph Hui, Arizona State University) 11:20 a.m. Operational Experience with IPv6 Migration (Bill Manning and Akira Kato, ISI) 11:40 a.m. An Information Sharing and Analysis Center for the Internet (Kelly Cooper, Genuity) 12:10 p.m. Inter-Domain Content Networking (Brad Cain, Cereva Networks) 12:40 p.m. Closing Remarks (Susan Harris, Merit) 12:45 p.m. Adjourn

1 0

Re: 10 gige experience
by Richard A. Steenbergen 10 May '01

10 May '01

On Thu, May 10, 2001 at 11:12:21AM -0400, Greg Maxwell wrote: > > On Thu, 10 May 2001, John Fraizer wrote: > > > > Anyone know any good articles on 10GB ethernet? I am specifically > > > intrested if they have removed some of the legacy requirements that > > > hamper gigabit ethernet (such as a default MTU of 1500, half-duplex, > > > etc.) > > > > Half-duplex? The last time I checked, my GigE equipment didn't default > > to half-duplex. > > No I wouldn't expect it to, nor did I state anything about defaulting > to half. There is no purpose for half-duplex in GIGE, even the few > GIGE hubs I've seen are buffered and user congestion control to allow > full duplex operation. The possibility of half-duplex mode just adds > unneeded cruft and additional failure modes. If it didn't support half-duplex, it wouldn't technically be 802.3 ethernet. Full duplex is what happens when you remove CSMA/CD. I'm sure 99% of people out there have absolutily no need or desire for half duplex gige or 10gige, and I'm also sure 99% of people out there would be far better served by a larger MTU. Unfortunantly it's the other 1% at IEEE who write the spec. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Sadmind/IIS hack from AS9800
by Erik Antelman 10 May '01

10 May '01

Our IIS/4 site was hacked early this morning by a Sadmind/IIS coming in from 211.96.252.251 Normally I would hesitate to admit publicly we practice unsafe systems management, but if the data helps others my ego will survive. for(;;); /* erik(a)cycletraders.com */

1 0

10 gige experience
by Mike Leber 10 May '01

10 May '01

Anybody out there have any experience with 10 gigabit ethernet? I'm looking for switches and routers that actually exist (heh, as opposed to the kind found in marketing literature). I've heard extreme is shipping 10 gige stuff. Any news when cisco or juniper will have something? +------------------- H U R R I C A N E - E L E C T R I C -------------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +---------------------------------------------------------------------------+

6 7

Sadmind/IIS Worm Defaces IIS Websites via Solaris.
by Petri Stephen 10 May '01

10 May '01

A number of Websites were defaced by this worm. Check your patches. http://www.securitywatch.com/newsforward/default.asp?AID=7476 ....Sadmind/IIS, which automatically slithers into Solaris and Microsoft IIS machines, has claimed a site associated with British TV news gang ITN. As per its payload, the worm revamped the site's home page to curse hacker PoizonBOx and the American government.......... According to The Register, it is the first major reported hack that uses the worm.........is programmed to sneak into a Solaris 7 based system, using an old sadmind buffer overflow trick. Having root access, it automatically uses a folder traversal hole to take over IIS machines. Read the CERT advisory: http://www.cert.org/advisories/CA-2001-11.html. Stephen Petri Enterprise Architect UNIFIED Technologies, Inc.

1 0

Re: 10 gige experience
by Greg Maxwell 10 May '01

10 May '01

On Fri, 11 May 2001, Chris Wedgwood wrote: > Anyone know any good articles on 10GB ethernet? I am specifically > intrested if they have removed some of the legacy requirements > that hamper gigabit ethernet (such as a default MTU of 1500, > half-duplex, etc.) > > Not answering your question, but GigE can use larger frames than 1500 > bytes, however, if you wish to send these outside your network, > you'll likely need to fragment them this somewhat less useful... of > course, Jumbo Frames are still useful within your network, but then > again most switches don't support them[1]. Which is why I said 'default' MTU of 1500. I think it should have been a requirement of all 100TX devices to be able to accept FDDI sized packets, a requirement of GIGE to switch FDDI sized packets, etc.. Thats not what happened. The problem is that there is no graceful way to handle mixed MTU's at that layer. As a result, the default is to use legacy sized MTUs, which results in new equpment which can not handle the larger MTUs, resulting in the further delay of end-to-end jumbogram support. At some point, they need to draw a line and say that reception and switching of large >1500 byte packets must be supported and generation of such packets should be an option. This will finally make is possible for people to jumbogram enable their networks.

1 0