July 2001 - Test - lists.nanog.org

Re: 'we should all be uncomfortable with the extent to which luck ..'
by Steven J. Sobol 29 Jul '01

29 Jul '01

On Sat, 28 Jul 2001, Mark Costlow wrote: > > Roeland> Maybe it is because MSFT and WU are in the same State? > > "Misery"? Washington U isn't in Washington, it's in Missouri. There's a reason their primary domain name is wustl.edu - they're in St. Louis. The University of Washington is in Washington. -- JustThe.net LLC - Steve "Web Dude" Sobol, CTO - sjsobol(a)JustThe.net Donate a portion of your monthly ISP bill to your favorite charity or non-profit organization! E-mail me for details.

1 0

RE: 'we should all be uncomfortable with the extent to which luck ..'
by Roeland Meyer 28 Jul '01

28 Jul '01

> From: k claffy [mailto:kc@ipn.caida.org] > Sent: Tuesday, July 24, 2001 10:36 PM > almost makes me wonder if some white hat might (should?) have > been behind CodeRed as some 'vaccination' attempt. Stop wondering. IMHO "White hats" that crack into systems should be treated the same as "black hats" that crack into systems. Throw them in jail and RO them from even thinking the word "computer" ever again (A few years, on a chain-gang, might do them some good ... sun ... excersize ... daylight ... fresh air ... they might lose that pasty complexion). <from someone whom has lost way too many days cleaning up the messes after>. > This assault also demonstrates that machines operated by home > users or small businesses (hosts less likely to be maintained > by a professional sysadmin) are integral to the robustness of > the global Internet. As is the case with biologically active Do you always let your stereotyping lead you by the nose like this ...? Home users ... maybe. Small businesses ... not. > From: CERT Advisory [mailto:cert-advisory@cert.org] > Sent: Tuesday, July 24, 2001 6:50 PM > CERT Advisory CA-2001-21 Buffer Overflow in telnetd > > Original release date: July 24, 2001 > Last revised: -- > Source: CERT/CC > Systems Affected > > Systems running versions of telnetd derived from BSD source. How many of us here run anything less than SSH and even allow telnetd to live on any of our hosts?

14 18

RE: 'we should all be uncomfortable with the extent to which luck ..'
by Roeland Meyer 28 Jul '01

28 Jul '01

Another great theory shot down in flames ... <sigh> I was yoking ... > -----Original Message----- > From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Saturday, July 28, 2001 4:41 PM > To: Roeland Meyer > Cc: nanog(a)nanog.org; caida(a)caida.org > Subject: Re: 'we should all be uncomfortable with the extent to which > luck ..' > > > On Sat, 28 Jul 2001 16:28:39 PDT, Roeland Meyer said: > > > Maybe it is because MSFT and WU are in the same State? > Maybe MSFT's attitude > > is geo-physically caused? > > MSFT moved their corporate offices to St. Louis? > > Washington University and the U of Washington are NOT the same school. > >

1 0

Re: product liability (was 'we should all be uncomfortable with the extent to which luck..')
by LBolton＠geiger.com 28 Jul '01

28 Jul '01

Your analogy is flawed. The question is, should Firestone be responsible for someone going around slashing the tires? No they shouldn't. Then why should Microsoft or any other software manufacturer be responsible for the damage done by third parties? You could make the argument that Microsoft should have designed more security into their products to prevent security breaches of this nature, but you could also argue that Firestone should make their tires out of kevlar to prevent people from slashing them. We shouldn't hold the software manufacturers responsible, unless they willingly and knowingly left the security flaw in place. We should hold the programmers that release malicious code responsible. William Allen Simpson To: nanog(a)nanog.org <wsimpson@greend cc: caida(a)caida.org ragon.com> Subject: product liability (was 'we should all be uncomfortable with the extent to which Sent by: luck..') owner-nanog@meri t.edu 07/25/01 02:42 AM Perhaps a different approach is in order -- product liability. When Firestone made a large number of bad tires, they compensated the purchasers by PAYING for replacement, including those that had not yet been injured. That included the upgrade, and the installation cost. Network operators have been injured by the distribution of buggy software from M$. We need to be compensated for our time and expenses. End users need to be compensated for their costs to upgrade. A check in the mail would be a better incentive to administrators than "automatic" updates. "Wayne E. Bouchard" wrote: > > On Tue, Jul 24, 2001 at 10:35:37PM -0700, k claffy wrote: > > ==> 5.4 billion people haven't selected an OS yet > > > > > > [k: maybe we can get them on OS-antioxidants > > before it's too late] > >... > Doing this, right now, can be difficult for many users to grasp (lets > face it, some software doesn't update well, if at all) and may require > more effort than even reputable administrators are willing to extend. > > How to go about making the public more secure, of course, is an > on-going debate and perhaps even a losing battle but still worth the > effort. > -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

14 21

The Cidr Report
by CIDR Report 28 Jul '01

28 Jul '01

This is an auto-generated mail on Fri Jul 27 23:00:00 PDT 2001 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to GX Networks for giving me access to their routing tables once a day. Please send any comments about this report directly to CIDR Report <cidr-report(a)cisco.com>. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. NEW: Check http://www.employees.org/~tbates/cidr-report-region.html for the regional version of this report. ------------------------------------------------------------------------------ CIDR REPORT for 27Jul01 0) General Status Table History ------------- Date Prefixes 200701 100950 210701 101113 220701 101068 230701 101044 240701 101039 250701 101495 260701 101472 270701 101541 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 82.105.0.0/16 from AS3269 *** Bogus 82.105.128.0/17 from AS3269 AS Summary ---------- Number of ASes in routing system: 11297 Number of ASes announcing only one prefix: 6733 (3865 cidr, 2868 classful) Largest number of cidr routes: 869 announced by AS701 Largest number of classful routes: 1414 announced by AS701 1) Gains by aggregating at the origin AS level --- 27Jul01 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS1221 1330 989 341 25.6% Telstra Pty Ltd AS701 1414 1199 215 15.2% UUNET Technologies, Inc. AS4293 385 276 109 28.3% Cable & Wireless USA AS6595 167 60 107 64.1% DoD Education Activity Networ AS6429 200 101 99 49.5% RdC Internet AS13999 104 8 96 92.3% Mega Cable S.A. de C.V. AS705 237 142 95 40.1% UUNET Technologies, Inc. AS4755 215 121 94 43.7% VSNL India AS7018 723 633 90 12.4% AT&T AS2551 429 342 87 20.3% NETCOM On-Line Communication AS4151 164 80 84 51.2% USDA AS8013 295 216 79 26.8% PSINet Ltd. Canada AS724 232 159 73 31.5% DLA Systems Automation Center AS577 247 174 73 29.6% Bell Canada AS7046 314 247 67 21.3% UUNET Technologies, Inc. AS16473 127 60 67 52.8% Bell South AS6471 124 60 64 51.6% ENTEL CHILE S.A. AS3464 152 90 62 40.8% Alabama SuperComputer Network AS4200 120 60 60 50.0% Apex Global Information Servi AS1239 461 402 59 12.8% Sprint ICM-Inria AS16758 63 6 57 90.5% IKON Office Solutions AS12302 89 33 56 62.9% MobiFon S.A. AS1 567 511 56 9.9% BBN Planet AS226 143 90 53 37.1% Los Nettos AS6413 65 13 52 80.0% Southern Online Systems, Inc. AS3908 200 149 51 25.5% Supernet, Inc. AS17561 112 61 51 45.5% Internet Service West Austral AS852 214 164 50 23.4% Telus Advanced Communications AS9842 54 5 49 90.7% Lotte Data Communication Comp AS4323 235 186 49 20.9% Time Warner Communications, I For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

2 1

Choosing ISP for T1 connectivity -2
by Alexander Avtsin 28 Jul '01

28 Jul '01

Hello again, Thank you for all the information you sent to me after my original posting. After hearing some "not so good" opinions regarding Genuity, I'd like to slightly rephrase my question: There's a report at ispworld http://www.ispworld.com/isp/images/geometric_mean.gif >From the test one can see that first 14-20 positions are very similar in performance, so what's important for us is virtually no downtime (not in SLA, but in reality) and quick tech support response to troubleshoot the problem (ICG doesn't have tech in their POP in Newark...) Now aside from the test, would YOU recommend one provider or another based on your OWN experience? I don't think any public resource exists which compares reliability of backbones, including last mile link - how stable are the routers that handle your particular T1...If it does exist, I'll appreciate any pointers. We experienced a lot of problems when ICG Newark POP went down on couple of occasions and they don't have a redundant link to anywhere else.... Thank you very much for you help. Alex Avtsin Network Engineer 212-924-5400 Ext:1185

2 1

Broadwing
by johns＠sstar.com 27 Jul '01

27 Jul '01

Broadwing sold me two local PRI's for dial-in back in mid Sept. After missing two "firm completion dates" (with associated penalties) they decided that they couldn't deliver what the sold to me unless I was willing to pay them 5c per minute for all of the calls since they couldn't support my local phone number, only an 800 number. This was weeks after the PRI's were installed. The sales rep kept assuring me that everything was OK, right up to the end. All of their order processing people signed off on it too. In short, they wasted 5 months of my time (and about 40 hours personally which I spent with them troubleshooting the PRI installation which had 4 separate bugs on their end). They even had the nerve to send me a first month's bill, and it was at a higher rate than I had signed for! Now they are saying that they will be generous and let ME out of the contract. It seems that an addendum has surfaced in which I agreed to the long distance charges. Only problem is that the signature on the page is not mine. Three months after the whole affair was over, a lawyer called to collect on bills which they haven't even been sending to me. Bottom line: Totally incompetent sales rep, order processor, and office manager. Slowest internal processing I've ever seen (the 2nd "expedited" order took longer than the 1st!). Lots of technical problems. A billing department without a clue. And apparently someone who is willing to commit fraud to boot. Perhaps your luck will be better. John % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % John Souvestre Southern Star www.sstar.com % % johns(a)sstar.com 504-888-3348 New Orleans, LA % % % % % % % % % % % % % % % % % % % % % % % % % % % % % %

1 0

The large ISPs and Peering
by Peering Resistance 27 Jul '01

27 Jul '01

This is an interesting tale, and one that everyone involved with the ISP world should know about. Aproximately 8 months ago, several of the very largest ISPs, ones with names like WorldCom, Sprint, CW, Genuity, and others, came together to discuss the concept of peering. The all peered with each other, most with very large peering circuits - OC-12 or above. The problem was that the provisioning time and effort required for these circuits was getting quite out of control. Costs of interconnects were also high. So, these large providers did the "unthinkable". They decided to issue an RFP to 8 sites around the US, which they would jointly inhabit for purposes of peering. In order to avoid the appearence of collusion, they all issued similar RFPs, each originating from their own company, but otherwise almost identical. And the sites were choosen using essentially identical criteria. So, unsurprisingly, the same 8 sites were choosen, in such cities as Dallas, Chicago, San Francisco, New York, DC, and others. There are several rumors floating about as to which sites were choosen. This is unconfirmed and conjecture, so I won't go into it for this email. The key questions... 1) What are the selected sites? 2) How do the rest of us play? 3) Why wasn't this process more open? I know that this is a true situation, as I have confirmation from three different sources, and have seen copies of several of the RFCs. I eagerly await the comments of those providers involved with this effort, and hope that this will lead to a more open internet. - PR __________________________________________________ Do You Yahoo!? Make international calls for as low as $.04/minute with Yahoo! Messenger http://phonecard.yahoo.com/

15 23

Brokered Private Peering Group?
by Tim Irwin 27 Jul '01

27 Jul '01

Anybody been following the development of the Brokered Private Peering Group? Who are the current participants? What is the current status? There seemed to be a lot of info in the media a while back, but I can't seem to find much info that's recent. Thanks, Tim -- Tim Irwin, Sr. Engineer Architecture & Engineering BellSouth.net, Inc. e-mail: tim(a)eng.bellsouth.net office: 678.441.7951 "Whenever you find that you are on the side of the majority, it is time to pause and reflect." -Mark Twain

2 1

Relative ISP size (was Broadwing)
by David Barak 27 Jul '01

27 Jul '01

Quoth Karyn: >Just remember that Broadwing is not actually a Tier 1 >provider. They are a >Tier 2 striving to become a Tier 1. When I was >looking at them, I found >that you could obtain just as good or better pricing >from an actual Tier 1 >provider. Check out Exodus, Verio, and Genuity. Last >I checked they were >offering some seriously competitive pricing on OCs. I just thought your list of Tier 1 providers was interesting - that gets back to the (very) old argument about exactly what "Tier-1" means, and that tends to be a religious argument for many. I like the Skitter approach myself - www.caida.org - if they're in red or yellow, they're Tier 1, if purple, tier 2... David Barak "Quis custodes ipsos custodiet?" - Juvenal __________________________________________________ Do You Yahoo!? Make international calls for as low as $.04/minute with Yahoo! Messenger http://phonecard.yahoo.com/

2 1