May 2001 - Test - lists.nanog.org

RE: ISP Filter Policies--Effect is what?
by Murphy, Brennan 08 May '01

08 May '01

On Tue, May 08, 2001, Stephen J. Wilcox wrote: > >if you have a /16 why would it be broken down to /24? i would assume the >> only reason you advertise /24 is because that is the size of your >> assignment from the NIC, in which case you cannot advertise the /16. > if you do own the /16 then yes of course you can advertise it. >Not necessarily. I've been in a position where I've had $LARGEBLOCK >and I've had to break it into smaller chunks for per-POP customers. >The trick there is trying to handle your network being split down >the middle and still have traffic flowing to each POP right. >The only real way to do that is to split the /16 up into smaller >per-POP chunks and announce them seperately. >Yes, then you run into provider filtering blackholing you. >So, the comprimise is to announce the /16 and the /24s that make >it up, and bite the bullet. I think this is the essence of the issue for this sitation. The desire is to have the traffic routed properly to the intl POPs. The /24s would be spread out geographically....all over. Furthermore, different providers are involved....one in Europe, one in Asia, etc. The address space I provided was theoretical...although in the real world example, the full /16 is owned by us. I am still reading through the responses but wanted to clarify the above. Also, one of the options being discussed is to use provider supplied Class C /24 space from providers in Europe and Asia and let our DNS algorithim take care of sending users to the right place. Basically, I've been told that the scenario would be far easier to work with if only 1 provider was supplying circuits at all of the locations around the world. Then they could advertise the full /16 and we would advertise the appropriate /24s from the particular site hosting them. Thanks for everyone's responses...most helpful!

1 0

Sorry
by Omachonu Ogali 08 May '01

08 May '01

Er, sorry, last e-mail was a mistake, ignore. -- Omachonu Ogali missnglnk(a)informationwave.net http://www.informationwave.net

1 0

RE: NYC Colo
by Omachonu Ogali 08 May '01

08 May '01

Yeah, no problem, I can secure two racks for you, either you or Nancy can give me a call later on today and I can schedule a tour, also when you have free time, check out: http://www.forked.com/test/pc.html. -- Omachonu Ogali missnglnk(a)informationwave.net http://www.informationwave.net

1 0

RE: black hat .cn networks
by Roeland Meyer 08 May '01

08 May '01

Thank you Franklin, for clarifying many things. Language is indeed a big issue for non-indo-europeans. Basically, anyone that uses a non-romance script (cyrillic, chinese, hiragana/katakana, arabic, cuniform, etc). The problem is that most folks don't realize that this goes both ways. We all face the same barriers in the other direction. Information gets distorted both ways. Add to this, the normal human tendency to speculate [negatively] in the absence of data and there is a huge potential for misunderstandings and myth-creation. The real problem is that we have to tame/banish these crackers on all sides. Hardening our own systems is not enough. We have to banish the vandals as well. Destroying someone else's property/hard work, simply because the opportunity presents itself, is/should be considered highly unacceptable/uncivilized behavior and punished accordingly, by every civilized person. -- ROELAND M.J. MEYER Managing Director Morgan Hill Software Company, Inc. TEL: +001 925 373 3954 FAX: +001 925 373 9781 http://www.mhsc.com mailto: rmeyer(a)mhsc.com > From: Franklin Lian [mailto:Franklin.Lian@globalone.net] > Sent: Tuesday, May 08, 2001 9:28 AM > > I found a myth on this list that hacking a computer system is a > death sentence. I really don't know where and when this mythin is > spreading on the Internet. > > I guess the myth came from a case that a hacker was executed, maybe > two years ago, and he was the first hacker sent on trial. I read > that news couple of years ago both in English and Chinese. The > hacker actually was executed for stealing millions of dollars from > a bank he used work for, NOT for HACKING. According to Chinese law, > any criminal commited to crime that evolves more than $100,000 > (the exact number might be wrong) can be sentenced to death. > > However, nobody noticed the crime behind of hacking but only hacking > itself.

1 0

RE: black hat .cn networks
by Rowland, Alan D 08 May '01

08 May '01

Haven't seen it brought up yet but since hacking is alleged to be a capital crime in China perhaps the non-response is the self-protection gene kicking in. :O Just my 2¢. -Al -----Original Message----- From: David Lesher [mailto:wb8foz@nrk.com] Sent: Tuesday, May 08, 2001 7:12 AM To: nanog(a)merit.edu Subject: Re: black hat .cn networks Unnamed Administration sources reported that Paul Lantinga said: > > > Why not decide on a workable message and have it translated by a competent > Chinese translator first? I'm sorry, but from my admittedly limited experience in that part of the world, I find it hard to believe messages are discarded unread for that reason. Too many people there read and speak English, especially those educated enough to be sysadms. They may not do so well enough to anchor the BBC World Service broadcast, but... I welcome enlightenment on this from people with more direct knowledge. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: ISP Filter Policies--Effect is what?
by Kevin Gannon 08 May '01

08 May '01

><snip> >Site BGP Advertisement to ISP >Amsterdam 169.61.201.0/24 AMSISP >Austin 169.61.111.0/24 Genuity & Internap >SanFran 169.61.119.0/24 Genuity & Internap >Tokyo 169.61.202.0/24 TOKISP >Sydney 169.61.156.0/24 SYDISP > >1. Since Verio says they would not accept /24 nets drawn from Class B space, >I assume this means that they don't insert a /16 into their tables so that >the /24 nets appear to Verio customers as unreachable. In this case, a >design >that wants to extend connectivity to verio customers (and any >other ISP with similar policies) must include a /16 advertisement from at >least >one of the sites. > >2. Suppose a customer of a Verio-like ISP, wishes to go to ftp. foo.org. DNS >returns 169.61.201.155 (in amsterdam, see above). Verio passes the traffic >to the neighbor it received the /16 advertisement from. At this point, the >best thing that could happen >is if that neighbor has the /16 and /24 networks in its route table, right? >That >means, a path exists for that user to the amsterdam server and the only >problem >with routing to Amsterdam is that Verio possibly handed the traffic to a >sub-optimal >neighbor. Am I understanding this issue correctly? Yes the logic seems clean , also another situation which might happen is that Verio peers with ISP x and ISP x doesnt have a specific /24 route they will follow a static to somewhere. You want to be careful that the somewhere knows about the /24. This could easily happen if Verio peers with the ISP that is nearer and an ISP that also peers with this ISP. So verio might decide hey the "longer" path is better and the packet gets into the "longer" ISP and it wont have a /24 so it will follow the /16. Maybe if you could tell use who owns the addresses and how big the original block is ? A whois points to a swiss bank is this correct ? >I'm new to BGP. I've tried to get a handle on this issue on my own and by >working with Genuity, Internap and Cisco. No disrespect to those companies >but >each of them had this vague memory of Verio's policy but couldnt really tell >me >in plain language how it might affect the above scenario. Obviously, I >wasn't talking >to chief engineers. Someone from the CCIE mailing list suggested I browse >the archives of this list, which I did. But I didnt find a clear enough >answer to my questions--perhaps because they are too basic to be discussed >here or I'm not good at using this lists archive search engine. >Either way, any guidance on the above scenario is greatly appreciated. > >-BM *********************************IMPORTANT NOTICE****************************** All e-mails for technical support must be cc'd to support(a)lancomms.ie. This ensures that the call is logged with the support desk and the case is actively tracked which speeds up the response you will receive. If you have an urgent problem you _must_ contact the support desk directly on 01-4093030. *****************************************************************************************

1 0

Re: Cable & Wireless "de-peering"?!?
by Paul Vixie 08 May '01

08 May '01

albert(a)waller.net (Albert Meyer) writes: > Didn't UUNet try this back in 96? A quick search of Boardwatch failed to > find the article, but ISTR that John Sidgemore eventually slunk back to the > playground and agreed to play nice. If UUNet couldn't pull it off back > then, I doubt that CW can now. ... I am completely fascinated by your assessment (that UUNet didn't pull it off).

11 12

RE: black hat .cn networks
by Paul Lantinga 08 May '01

08 May '01

> On Tue, May 08, 2001, Adrian Chadd wrote: > > > So, how about we get imput as to the best English-Japanese > > translation service online, and then *cough* attempt to > > standardise on contacting chinese networks this way? Why not decide on a workable message and have it translated by a competent Chinese translator first? Something such as the following: Dear <Abusive Autonomous System>, The following unsolicited email apears either to have originated on and/or traversed your network, or to have come from a client of yours. If you simply have an open mail relay, please fix it. Please look into this. (and give us our plane back!) Regards, <insert_name> Aside from the plane crack, you get the idea. Do a little work up front for the Big5/SJIS encoding. Think about it, those that deal with abuse(a)yourhardworkingcompany.net are often either overhead or are trying to deal with spam while also doing a fulltime job. Translating email mesages is a pain and most people would rather not bother. So, any takers to translate the above message, or some other appropriate message, into Chinese and/or Korean and post it somewhere publicly available?[1] off to ride my flying pig, Paul LANtinga -- again, my opinions (even if they are wrong;) [1] the paranoid cells in my brain tell me that this would be a perfect opportunity for a real chinese attacker to burn us by posting something in Chinese that was inflammatory and the like.

3 2

Cisco DS3 performance specifications
by Bill Thomas 08 May '01

08 May '01

To any and all in earshot, I am engaged in setting up a sytems level test lab for the purposes of measuring among other items, DS3 performance and interoperability between Cisco 12000 series and several new and emerging edge switch devices. In order to set a baseline for performance expectations, I am attempting to gather historical data on earlier testing. The nasty rumor I am hearing is that Cisco DS3 interfaces at best deliver 50 - 60 % throughput. This is supposedly attributed to the way they apply their Traffic Shaping and Policing at the port level. I need to obtain documentation that either validates this, or presents the correct information. Many of the edge devices involved in the testing, support high levels of throughput even at the channelized subrate. An increased need to buffer the data, to compensate for a potential mismatch in bandwidth capabilities, would just add to the latency and sour the testing. Any and all information is valued and appreciated.

2 1

Re: black hat .cn networks
by Dan Hollis 08 May '01

08 May '01

On Tue, 8 May 2001, neil d. quiogue wrote: > Well there may be a myriad of reasons on why the admins of those ISPs do not > respond: > 1. abuse/postmaster goes to some mailbox no one reads like root which > contains a bunch of other messages. > 2. Language issue has been mentioned and it's a valid one. I don't think > many admins are aware of those translators. > 3. They don't know how to handle such cases. > 4. They don't care? Ive sent abuse mails to other asian countries (japan, taiwan, korea) with the same possible list of excuses and at least ive got some (poor) response, compared to a big fat zero from mainland china. Has anyone on this list *ever* received *any* response to abuse mails to mainland chinese networks? Other than bounces... -Dan

2 1