June 2001 - Test - lists.nanog.org

TorIX contact info
by Jim Mercer 05 Jun '01

05 Jun '01

i've gotten a number of queries about "how do i get in?" etc. www.torix.net is, well, functioning non-optimally. there is some statistical info at: http://torix.golden.net/~torix/ and an email to torix-info(a)torix.net will get you in contact with the existing members. -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Now with more and longer words for your reading enjoyment. ]

1 0

Re: small exchanges (was: Re: PSINet and C&W peering)
by Jim Mercer 05 Jun '01

05 Jun '01

On Tue, Jun 05, 2001 at 11:14:24AM -0700, Ehud Gavron wrote: > Similarly in Tucson we founded The Tucson Interconnect. > It worked for a long while (except for one ISP who still doesn't > understand what peering is, but they're just a stain on the > big isp carpet). > > Eventually the small ISPs were using DS3 uplinks, and then > a local interconnect became an expensive proposition... > T-1s were easy to justify but in town (read LEC) DS3s or > 100BTx is expensive... we lucked out, in that 151 Front Street in Toronto is sorta like 60 hudson, 25 broadway, ??? wilshire. so many ISP's had bandwidth going in that direction anyways. most of the peers are connected with a simple cat5 running back to their own closet/room in the building. there has been some talk about putting sister switches in other buildings,etc but that starts to get into real money, and then you have to work out how to split it and maintain it and SLA's, etc, etc, etc. right now the switch(es) are on loan/donated/sponsored? by cisco. extreme and other vendors have offered their hardware as well. the location of the first switch was picked up by one of the founding members. we have since made an arrangement with RACO in 151 Front whereby RACO will give the switches a place to live. works out pretty good. -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Now with more and longer words for your reading enjoyment. ]

1 0

Rooted boxen and the law
by Jamie Norwood 05 Jun '01

05 Jun '01

I am just curious, in these days where every script kiddie with a few spare hours is out cracking into every box in sight, what do you all do when it happens? I know the isolate/reinstall stuff, I am specifically more interested in administrative stuff. Do you log it? Report it to the police? FBI? Who? Basically, I just had a box cracked, and have time to kill before I get access to it to reinstall (Damn cheap colo provider...) and am wondering if I should just reinstall and get on with life, or if I should be covering my ass, since I have things on their that will make me unhappy if they are taken and released to the public domaine (Reg codes for software and the like.) Let me know! Jamie

4 4

Re: Rooted boxen and the law
by Scott Gifford 05 Jun '01

05 Jun '01

Jamie Norwood <jnorwood(a)adelphia.net> writes: > I am just curious, in these days where every script kiddie with a > few spare hours is out cracking into every box in sight, what do you > all do when it happens? I know the isolate/reinstall stuff, I am > specifically more interested in administrative stuff. Do you log it? > Report it to the police? FBI? Who? When we had a cracked box on our network, and a reasonable chance of catching the guy, we got absolutely zero help from the FBI. We were only able to get ahold of the agent handling our case once, and never got phone calls returned. That was from the Detroit office; you may have better luck depending on where you're at. Calling CERT might not be a bad idea; might make law enforcement more willing to listen, and somebody at CERT might be able to help apply pressure if needed. > Basically, I just had a box cracked, and have time to kill before I > get access to it to reinstall (Damn cheap colo provider...) and am > wondering if I should just reinstall and get on with life, or if I > should be covering my ass, since I have things on their that will > make me unhappy if they are taken and released to the public domaine > (Reg codes for software and the like.) I would back up the whole thing as it stands now, both to tell what happened and to provide evidence if it comes to that. Hell, hard drives are cheap enough; maybe you should just pull the HD from your cracked machine, and reinstall onto a fresh one. ----ScottG.

1 0

Re: PSI statement on C&W peering issue
by Morris, Gary 05 Jun '01

05 Jun '01

>>> Good for CW. Companies shouldnt cut off peering with >>> others and not think that one day it might just happen to them. What I find alarming about this is what is stopping CW from asking a prohibitive sum of money from other providers? Providers can't simply 'transit through somebody else' free of charge because ultimately somebody is paying for the transit rights.

3 2

C&W Peering Problem?
by Charles Scott 05 Jun '01

05 Jun '01

All: Just got off the phone with C&W's NOC trying to find out why NASA.GOV had fallen off the edge of the earth. When I asked if this had anything to do with the C&W peering policy, the answer was yes. Does anyone have any more information on this? Chuck

8 9

RE: engineering --> ddos and flooding
by Matt Zito 05 Jun '01

05 Jun '01

> Sorry but IMESHO null routing a /32 during a DoS attacck > doesn't exactly > strike me as engineering. It is more like dealing with the attack in > real-time. To mean engineering would mean desinging networks > to be resistant to DDoS and flooding in the first plsce. > > To that end no NSP should ever allow spoofed IP addresses outside of > their network. (not just RFC 1918 addresses but valid IPs that don't > belong to that NSP) > > e.e if I'm have a circut from C&W nd I try to spoof a packet > eith a source address of 216.35.172.135 it should be dropped as > close to the edge of C&W's network as possible. > > note on RFC 1918 addresses: These should never get past customer > edge routers IMESHO. > > Two NSPs should rate limit DoS traffic (ICMP & SYNs) within their > networks in such a way that it can never DoS a T-1 (or E-1 if you are > not in the US). [note: I'm not sure if ciso's are up for this workload > since I primarily work with Juniper.] > Rate-limiting ICMP is not so difficult - rate-limiting SYNs is basically useless. Syn floods work not because the amount of traffic they do, but because they fill up state tables or make them so horribly inefficient as to make the box cease responding on that port. Given that, say, a linux box has a default queue depth of 128, I can send 128 spoofed SYNs at a rate of one a second, and in two minutes that box will stop responding. The larger you make the queue, the longer it will stand up to a slow SYN attack, but the more costly each incoming SYN and SYN+ACK becomes, as the data structures become more and more unwieldy. Thanks, Matt -- Matthew J. Zito Systems Engineer Register.com, Inc., 11th Floor, 575 8th Avenue, New York, NY 10018 Ph: 212-798-9205 PGP Key Fingerprint: 4E AC E1 0B BE DD 7D BC D2 06 B2 B0 BF 55 68 99

2 1

ORBS go bye bye?
by Eric Whitehill 05 Jun '01

05 Jun '01

Anyone know what happened to ORBS? I can't get their web page - all I get is "Due to circumstances beyond our control, the ORBS website is no longer available. " I have my mail servers attempted at being used as relays and it becoming a spammers haven - some customers of mine are getting 1500+ messages and it's starting to become an issue. (From other people relaying to me) Any word? Ideas? I don't want to start a MAPS vs. ORBS thing here.... -Eric

7 8

PSI statement on C&W peering issue
by Sean Donelan 04 Jun '01

04 Jun '01

PSI statement from their website Cable & Wireless chose to terminate connectivity with PSINet on 2June01. Over 90% of the traffic that used to be routed through C&W is now being routed via other means through our robust global free peering infrastructure. The remaining 10% or so represents C&W customers that have been deliberately cut off from PSINet by C&W. While PSINet is ready and willing to re-establish connectivity with C&W at any time, it is up to C&W to choose to reverse their previous decision. In the meantime, PSINet can offer services directly to those C&W customers that are affected. http://www.psi.net/cgi-bin/netstatus.pl5 Does the 10% number mean C&W's network reach has shrunk, or that a growing number of networks are multihomed?

4 3

RE: 95th Percentile = Lame
by Andrew Odlyzko 04 Jun '01

04 Jun '01

The discussion over the last few days has been fascinating. I would like to inject a few remarks. The main one is that there is a huge literature on pricing of communication services and other utilities. The problem is that statements such as > Ideally, the price should match as closely as possible the actual cost to > provide the service. are very appealing, and even agree with conventional economic doctrine, but founder on the difficulty of determining what "the actual cost to provide the service" is. In addition, there are other conventional economic arguments that say prices should match not costs, but rather willingness to pay. Electricity pricing, which has been mentioned here several times, is an interesting case. Original pricing was flat rate (so many dollars or cents for each lightbulb for each month). That was discarded very quickly, largely because of a crucial factor that distinguishes electricity production from telecommunications, namely high marginal costs. Except for hydro (and to some extent nuclear) power, there is a measureable and substantial cost in paying for the fuel that provides each kilowatt-hour of "juice." Even that, though, does not deal with the issues of fixed costs (the generating plant and the transmission lines). How to allocate those costs to various consumers led to extensive discussions and experimentation about a century ago, far more sophisticated than anything that was done in telecommunications at that time or even now. What we have today is usually a combination of fixed rates (dependent on capacity of link) and usage charges (straight fees per kilowatt-hour). Experiments with time-of-day pricing have had mixed outcomes, and there is little of it going on. This might change with smarter appliances, but then it might not. The Internet does not have the high marginal costs that electricity involves. Hence the economic case is different, but even so, theory does not provide an unambiguous answer as to what the answer is. I have several papers that discuss pricing of Internet and other communications (and even more general) services. As a result of the investigations described in those papers, I do come down on a particular side of the debate (namely in favor of flat rates), but also provide extensive references for other arguments. There is a short, 6-page extended abstract entitled "Internet pricing in light of the history of communication," <http://www.research.att.com/~amo/doc/history.communications1.pdf>, (to appear in Proc. ITCom 2001), the full 40-page paper "Internet pricing and the history of communications," <http://www.research.att.com/~amo/doc/history.communications1b.pdf>, to appear in "Computer Networks," and a longer yet and more detailed 160-page manuscript "The history of communications and its implications for the Internet," <http://www.research.att.com/~amo/doc/history.communications0.pdf>. (Replace .pdf in the URLs above with .ps if you are a fan of PostScript.) These might provide some amusement and possibly even enlightenment. Andrew Odlyzko ************************************************************************ Andrew Odlyzko amo(a)research.att.com AT&T Labs - Research voice: 973-360-8410 http://www.research.att.com/~amo fax: 973-360-8178 ************************************************************************

1 0