August 2001 - Test - lists.nanog.org

Cisco 6160 and 6400
by Bill Clary 22 Aug '01

22 Aug '01

Hello, Is anyone on this list using the Cisco 6160 Dslam and 6400 Access concentrator? If so and wouldn't sending me a sample configuration off list I would appreciate it. Best Regards

1 0

Re: Routescience?
by Paul Vixie 21 Aug '01

21 Aug '01

> > The PathControl product does *not* add routes to anyone's table; > > it merely provides multihomed "leaf AS's" the ability to make > > informed decisions about how to use the routes that their service > > providers give to them. > > So it can only optimize outbound traffic? not nec'ily "traffic". but anything which optimizes the outbound route chosen by tcp segments has the potential to increase the performance of both the outbound tcp flow and the symmetrical inbound tcp flow. > Hmm... Sometimes that can be useful, too. as i indicated back in 1997 at ftp://ftp.vix.com/pub/vixie/ifdefault/: @Overhead @Title { Outbound Route Balancing } @Begin @List @LI { @S{TCP} is @S{ACK}-timed @Eq{arrowright} path symmetry is good. } @LI { Symmetry in the intermediate system is really hard. } @LI { First hop symmetry is most of what you want anyway. } @LI { @S{BGP} path selection is hard to defeat. } @EndList @End @Overhead

1 0

Internet traffic analysis
by Bradley Dunn 21 Aug '01

21 Aug '01

FWIW, this study claims backbone traffic in the US is doubling every six months. http://www.caspiannetworks.com/pressroom/press/08.15.01.shtml http://www.caspiannetworks.com/library/presentations/traffic/Internet_Traff… (We've reached the day when PowerPoint and press release constitute a scientific study.) Bradley

5 4

MPLS TE/GB-TE tunnel traffic priority against normal traffic
by Yu Ning 20 Aug '01

20 Aug '01

Hi nanog, When MPLS TE is partially deployed in an AS, in a given interface, there is coexistence between TE tunnel traffic, and normally per-hop routed traffic. Since the TE tunnel bandwidth was "booked" in advance via RSVP, I wonder if this part of TE bandwidth promise can be kept strictly by the router via build-in queuing mechanism when actually tunnel traffic comes in? Or on the contrary, the bandwidth reservation is only an planning step, no actual priority queuing protection on them against normal traffic ? If normal MPLS-TE didn't handle my question, will Cisco's new GB-TE(two pools) handle it ? Note, my question is different from the 8 preemption levels defined in MPLS-TE, the 8 preemption priority is used at the admission control phase, not when actual traffic comes in. thanks for any input. Yu Ning ____________________________________________ (Mr.) Yu Ning, Chief Engineer ChinaNET(AS4134) Sr. Sup.& New Sev. R&D Internet Product Dep. DCB, China Telecom Beijing, P.R.China +86-10-62072357/62072354 ____________________________________________

2 1

Re: Routescience?
by Vaul Pixie 20 Aug '01

20 Aug '01

>Is anyone out there familiar with a company called "routescience"? I >caught the below press release at and wanted to find out if anyone can >relay any real-world experiences with their system? It almost sounds >like they are using something like a Keynote Systems performance >monitoring tool to inject BGP path preference information. I'd put my money on yet another in a long line of optimized routing frauds. Let us not forget the quality internet routing that has been brought to us by Savvis, InterNap, Opnix, and AboveNet's ASAP. Who could forget all their wonderful phrases like "Tier 0" and "routing around the congestion". Routing around the brain cells is more like it. Now we have a whole new breed of .bombs who's goal is to sell you something which will magically improve your corporate T1s. If they spent 1/2 as much time actually coming up with a product as they have spent marketing their bullshit, they might be worth looking at. The only interesting thing to come out of these companies so far is the ability to change their business plans and names at the drop of a hat. Speedtrak -> Route Science iVMG -> netVmg iPeer -> Method Networks Arriva -> Sockeye Does anyone else see a pattern? _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

cisco IOS bug/exploit?
by Jim Mercer 20 Aug '01

20 Aug '01

i have a couple 2501's holding up a T1 line. static routing config, no RIP/OSPF/BGP, no httpd. router A is Version 11.0(16) router B is Version 11.1(5) starting saturday night, i noticed that snmp queries were failing to one or both of the routers at various points. i tried to log into the routers, but telnet was failing. using the console access to one of the units, i found that memory was exhausted. after a reload, the memory would be exhausted again, and i noted that "show mem" indicated numerous of "Packet header" or some such hanging around in memory. whatever was happening did not seem to effect the packet flow through the router, as the connections and volumes were normal. i figured either some kinda bug or exploit was being sent against the unit, but nothing in my tcpdumps indicated abnormal traffic to any of the interface addresses. i was planning on upgrading the IOS today, but this morning, i found that everything had returned to normal, with a normal amount of free memory, and no real amount of extraneous junk in memory. can anyone point me at what might have been the cause, and/or a solution so that it doesn't happen again? -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Now with more and longer words for your reading enjoyment. ]

6 5

2 BGP links with different path to the same ASes question
by Adam Obszynski 20 Aug '01

20 Aug '01

Hello nanog, Supose that we got network: AS 1 ---- iBGP ---- AS 1 | link 1 | link 2 | | AS 2 ---- iBGP ---- AS 2 and now, we want on one of those links (link 1) - setup only peering session and on (link 2) - start normaln internet tranis and if we pay for internet transit and not pay for peering, our idea is: - send peering IP packets via link1 - send packets from internet via link2 only way that i can see is the usage of source-route PS: assume that networks of AS1 and AS2 are big and meshed networks and there is need for set up a lot of acls and routemaps and take them all up of date! any better hints ? -- Adam Obszyński

2 2

PSInet help please...
by Rich Sena 20 Aug '01

20 Aug '01

Can someon at PSI- net contact me directly - I need to bend a favor... -- Richard Sena The Mitre Corporation e: rsena(a)mitre.org Lead Engineer 202 Burlington Road v: +1-781-271-3712 Dept: R10N; MS C020 Bedford, MA 01730-1420 f: +1-781-271-2600

1 0

LaBrea tarpit info and URL
by M. David Leonard 20 Aug '01

20 Aug '01

I have received a few requests for more information on LaBrea, so I am forwarding the e-mail describing it to the nanog list. I apologize if this is off-topic. David Leonard ShaysNet -------- Original Message -------- From: "Tom Liston" <tliston(a)premmag.com> (by way of Matt Fearnow <matt(a)incidents.org>) Subject: [unisog] New tool: LaBrea To: unisog(a)sans.org OK folks, the time has come to fight back... Following up on my original work on CodeRedneck, I'm pleased to announce a new tool to let us *ethically* take a stand. Come on... let's build us some tarpits. Announcing: LaBrea LaBrea is a Linux boot disk, based on the Trinux/Linux distribution (http://www.trinux.org) combined with the techniques used by CodeRedneck to set up a "tarpit" on your netblock. Essentially, what LaBrea does is to create "virtual machines" on your unused IP addresses, firewall them, and then latch onto any inbound traffic by using TCP/IP's tenacity against anyone who tries to connect. You have a bunch of unused IPs? Here's what you do: Get yourself an old machine and a generic NIC. The machine doesn't need to be a barn burner (see below). Heck, it doesn't even need a hard drive! LaBrea is run from a RAM disk. Hook your old doorstop machine up to the network, somewhere where the portscanners will be sure to find it... Download the LaBrea boot disk image from http://www.threenorth.com/LaBrea (Many, *many* thanks to Tim Rushing for hosting this for me!) Create a real, live boot disk from the image. See instructions at: http://trinux.sourceforge.net/install.html (Don't worry... it's easy. You can do it from Windows or Linux...) You'll need to pick a main IP address for the LaBrea machine. This IP address will temporarily need HTTP access to download the packages needed by Trinux to boot. You'll also need to know the netmask of the IPs you want to use, as well as your gateway address and the address of a DNS server. Now, using any text editor, create a list of the IPs (one per line) that you want to teergrube and save it on the boot floppy under /tux/config as a file named "LaBrea". (Note: DON'T include the "main" IP address in this list... it will be taken care of automatically.) Pop the LaBrea disk into your machine, and boot 'er up. It *should* recognize your NIC and fire off. If it doesn't... well, look around at the Trinux site for help. (I've fired it up on three machines here with three different NICs and it recognized every one of them...) It'll ask you some questions. First of all, DON'T DO DHCP ADDRESS RESOLUTION. It won't work, I disabled it, but I didn't feel like digging through the innards of the Trinux boot disk to remove the question. So just don't do it... OK? Since it can't use DHCP, here's where you'll need to know the IP address, netmask, gateway, etc... (Remember? I told you that you'd need to know that...) Answer the questions, and the boot disk will set up the network connection and then it'll go out and grab any additional files that it needs to set up and run. The machine will then alias itself to all of the IPs that you listed. It will use iptables to DROP all inbound TCP connections, and then it will launch LaBrea to teergrube ALL connection attempts to those IP addresses. *ALL* TCP CONNECTION ATTEMPTS. ON **EVERY** PORT. :-) :-) :-) To make the process more automatic the next time you boot, drop into BASH and run the command "savecfg". That'll save your IP address, netmask, etc... back out to the floppy so it won't have to ask you about it if you reboot. How well does it work? Well, currently I have a 50 IP "tarpit" running on an old Pentium 233 that was sitting around without a HDD. From the logfiles, I pulled the following information after booting it up and running it for about 45 minutes. I picked a pretty generic 10 minute "chunk" of time and followed all of the initial connections that came in: During my 10 minute sample, I had 54 inbound connections. Now remember, these are previously *UNUSED* IP addresses. There is no reason for anything to come after them. All inbound connections were to port 80. (Gee, I wonder what that's from ;-) I held onto those 54 connections for an average of 1 minute 41 seconds each. Therefore, in that 10 minute period, I wasted 1 hour 30 minutes and 32 seconds of CodeRed scanning time. But folks, CodeRed is running on NT, and NT has a *short* TCP time out. What this does to CodeRed connections ain't nothin' compared to what it'll do to a Linux based RPCPortmapper scanner: TWENTY FOUR MINUTES a connection! Did I mention that LaBrea is set up to minimize impact on your network? Using TCP window advertisement, LaBrea chokes down the inbound packets to 10 data bytes each. Let's see... I held onto that RPC scanner for 24 minutes, and all he got to send me was 170 bytes of data... This is fun.... Man, this is fun. I can't think of a time I've enjoyed my job more... Some background: My original proposal can be found here: http://www.incidents.org/archives/intrusions/msg01215.html Mihnea Stoenescu's validation of the idea is described here: http://www.incidents.org/archives/intrusions/msg01239.html The announcement of CodeRedneck: http://www.incidents.org/archives/intrusions/msg01262.html Many thanks to Mihnea Stoenescu, Donald Smith, and Tim Rushing for all of their help on this. -TL

3 2

Using 120k BGP routes on the Lucent AP-1000
by Martin Cholkowski 20 Aug '01

20 Aug '01

HI, I was wondering if anyone has setup the Lucent AP-1000 for 120k BGP routes. I have used the configuration commands to increase configured BGP routes to 120000 and configured paths to 40000. I have also increased the IP routes to 120000. When I tried to increase the IP route memory though, the BGP operational routes have reduced to 5000, so I had to leave the memory untouched. The router seems to operate BGP OK but crashes from time to time. This tells me that IP route memory needs to be increased. I have 128k of RAM onboard the router. I wonder if anyone is using the AP1000 for 120k BGP routes and has a working configuration that they can send me. Thanks in advance. Martin Cholkowski

2 1