June 2002 - Test - lists.nanog.org

Corporate PGP for network operators
by Sean Donelan 19 Aug '02

19 Aug '02

Ok, extremely dumb question. But I'm sure lots of other people have already solved this one. Network operators have been using various PGPs to exchange confidential information for many years. I have my own personal PGP key for my own use and a nice Unix box of my own. There are licensed versions, freeware versions, guerilla versions, and so forth. NAI is no longer selling a commercial version of PGP Desktop for Microsoft Windows/NT. Phil Zimmerman points people to the OpenPGP alliance http://openpgp.org/members/ What do commercial network operators, who are required to use Microsoft, use for business PGP mail besides NAI? I.E. if we need to exchange PGP mail, what package is least likely to crash Outlook and Windows.

3 3

Re: Sprint peering policy
by Vijay Gill 02 Jul '02

02 Jul '02

Mike Leber <mleber(a)he.net> writes: > Sprint's peers aren't equal to Sprint or each other when considered by > revenue, profitability, number of customers, or geographical coverage. A good proxy for the above is to ask the question: Do X and Y feel they derive equal value (for some value of equal) by interconnecting with each other? If they think they do, then an interconnection is set up between X and Y. However, if one party feels that they do NOT derive equal value by interconnecting with the other, than that party usually balks. X states that they would only feel equal value is derived by both parties if traffic between X and the other party is n mb/s with a ratio of p:q. Y disagrees. They do not interconnect. This causes pain. Usually the pain for one party is greater than the pain for the other, unless they are really peers of each other, in which case settlement free interconnections happen. However, if there isn't equal amounts of pain being felt on both sides, then normally the party with the more hurt tries to redress the issue. Usually this imbalance in perceived value is redressed by one of the parties offering to make up the difference by some form of a transfer of money. > This is ridiculous elitism. see above. > to make sense of their peering policy, just accept the fact that each > company has policies that they believe to be in their best interests and > omit the pretense of justifying this by the movement of heavenly bodies in > the spheres. I think we are in agreement here. /vijay

20 36

Network Security Requirements draft
by George Jones 02 Jul '02

02 Jul '02

We (UUNET) have an internal document that we've been using for a few years as the basis for tests of security features of equipment to be connected to our backbone. We're interested in making it public so that it can be improved and so that others can use it. You can view the current draft at: http://www.port111.com/docs/draft-jones-netsec-reqs-00.html (HTML) or http://www.port111.com/docs/draft-jones-netsec-reqs-00.txt (text) the overall goal is an improvement in the security features of devices implementing IP. The means that this document tries to provide is a clear definition of security requirements that consumers/operators of networking gear can point to (in RFPs) to say "see, we want security and this is what it means". The current list of requirements is skewed to the needs of large networks (consider the source), but it does provide a means of defining "profiles" for specifying subsets of requirements for different classes of devices (core, edge, ... toasters.). Most of the requirements specify features that are generally implemented today (logging, aaa), though some of the requirements specify highly desirable features that are not implemented in current products (stealthing, monitoring, sampling, etc.) What we're requesting here is feedback network operators and vendors on how to make this document useful in achieving actual improvements in security. Specifically, we're requesting feedback/discussion on: * The requirements listed * Important requirements that are missing * Document structure * How to make it useful. The next step will likely be submission of an Internet draft- c.a. July 2. Input prior to that date stands a much better chance of being included :-) Feel free to reply to me <george(a)uu.net> or reply to the list. Thanks, ---George Jones

3 4

how is cold-potato done?
by Ralph Doncaster 01 Jul '02

01 Jul '02

If I peer with network X in cities A and B, and receive the same route in both cities with an AS-path of X, how do I know which city to use for an exit? I can understand how if X uses communities to tag the geographic origin of the traffic, but I'm not aware of many networks that do this. Lots of networks claim to use cold-potato routing though, so how do they do it? Ralph Doncaster principal, IStop.com

11 12

RE: Sprint peering policy
by Mitchell, Dan 01 Jul '02

01 Jul '02

Here's what I've "heard" about Sprint and peering... Sprint's minimum to peer is 6 x OC-12's. To peer with them, you have to undergo a 90-day trial period. At the end of the 90 days, they will determine whether or not they would like to peer with you. Here's the catch: During the 90-day trial period, there is a NON-REFUNDABLE $125k/port fee (for each OC-12). So, you're looking at laying out $750k per month for 3 months, or $2.25 MILLION over the 90-day "trial" period, and even then, they MIGHT peer with you. But that's just what I've "heard". On a side note: Folks should keep an eye on Allegiance Internet (the folks I work for). They picked up the old Digex / Intermedia Business Internet backbone and are in the process of integrating it (under AS2548). Financially solid company, very easy to work with, and have some strong uptimes. (Plan on seeing an SLA of 99.999%/99.75%/65ms with a guaranteed 15 minute response time for loss of connectivity to customer prem and a guaranteed 40 business day install). For peering, I'm pretty sure the policy is Tier 1 = 4 points OC-3 or better, Tier 2 = 4 points DS-3 or better (Tier 2 peer pays loop charge if applicable). Thanks, Dan Dan Mitchell Internet Systems Engineer - Boston AllegianceInternet / Hosting.com 781.478.1857 Direct Line dan.mitchell(a)hosting.com -----Original Message----- From: Jeff Nelson [mailto:jnelson@rackspace.com] Sent: Wednesday, June 26, 2002 1:04 PM To: Majdi S. Abbas; Ralph Doncaster Cc: nanog(a)merit.edu Subject: Re: Sprint peering policy http://www.sprintlink.net/policy/index.html --what they publish $$$$$--what they don't jeff "Be liberal in what you accept, and conservative in what you send." --Jon Postel ----- Original Message ----- From: "Majdi S. Abbas" <msa(a)samurai.sfo.dead-dog.com> To: "Ralph Doncaster" <ralph(a)istop.com> Cc: <nanog(a)merit.edu> Sent: Wednesday, June 26, 2002 11:57 AM Subject: Re: Sprint peering policy > > On Wed, Jun 26, 2002 at 12:39:11PM -0400, Ralph Doncaster wrote: > > While many other tier-1's have publicly listed their peering policies, > > I've never seen anything for 1239. Not that I'd stand a chance, but does > > anyone know what their peering requirements are? > > sprintlink.net# grep peering /etc/aliases > peering: /dev/null > sprintlink.net# > > --msa >

4 3

Routers supporting PPPoE + IPIP tunnel
by Cho Man Fai 01 Jul '02

01 Jul '02

Because of the recent shipment problem of Cisco, I am looking seriously for a cisco 827 substitution. What I need is a router which support PPPoE + IPIP tunnel with Ethernet (or DMT) WAN port. Do you have any idea for products other than cisco which support ipip tunnel? I've tried Netopia, however, it doesn't support ipip tunnel. Many thanks! Cho

3 3

Re: Vixie puts his finger squarely on the key issue Re: Sprintpeering policy
by kookreport＠hushmail.com 01 Jul '02

01 Jul '02

Gordon what did I tell you about posting to NANOG? Shouldn't you be busy uncovering ICANN conspiracies and interviewing Bill St. Arnaud for the 50th time? Can we look forward to a summary of this thread in your next report? Gordon Cook wrote: > Where is it possible to gain any reliable data on which networks are > lit with what equipment and offering how many actual lambdas? Or You friendly carrier sales rep? > even how many fibers in a given back bone are actually lit? We know Who cares. Rest assured Gordon, when it is profitable to light them they'll be lit. > there is huge unused capacity, yet because there are no reporting > requirements as to what networks are lit to what capacity, we very > likely don't know whether the fiber in the ground is being used to > one per cent of its potential or 10% or even 20%. Moreover we do not It's being used to 3.14159% of its capacity, but the photon acceleration effects of GMPLS have yet to be fully realised. You can quote me on it. > know the extent to which optical bandwidth is growing? Not knowing > this, how can anyone make any intelligent economic or policy or > investment decisions? The LECs must tell the FCC numbers of lines in Pop the stack Gordon. How can anyone make intelligent investment decisions when earnings reports are outright lies? Until that's straightened out counting the number of lit fibres is like counting the number of empty cages in an Exodus data centre. > use and numbers of access minutes. The IP industry must tell the FCC > essentially nothing. Why shoud such policy continue? What does this have to do with layer 3 peering? - Gordon "I wish I was George Gilder" Kook Communicate in total privacy. Get your free encrypted email at https://www.hushmail.com/?l=2 Looking for a good deal on a domain name? http://www.hush.com/partners/offers.cgi?id=domainpeople

2 1

Postmasters Anonymous
by Sean Donelan 30 Jun '02

30 Jun '02

Sorry for interrupting our quarterly peering debate, but I'd like to ask if there are any groups for people who are Postmasters (abuse, spam, dmca, etc)? I know there are many groups for people who want to complain about those subjects, but I was wondering if there are groups for people who have to handle the complaints.

2 1

Paix-NY and NYIIX -- link stil going to happen?
by Phil Rosenthal 30 Jun '02

30 Jun '02

Anyone know if the link-up is still going to happen? I've heard from a few people that given the financial issues at MFN, this is highly unlikely to still happen. Anyone know any different? Paul? --Phil

3 2

Re: Postmasters Anonymous
by Martin Hannigan 30 Jun '02

30 Jun '02

At 09:16 PM 6/29/2002 -0400, Sean Donelan wrote: >Sorry for interrupting our quarterly peering debate, but I'd like to >ask if there are any groups for people who are Postmasters (abuse, spam, >dmca, etc)? I know there are many groups for people who want to complain >about those subjects, but I was wondering if there are groups for people >who have to handle the complaints. There's a lot of them. A bunch are "under cover". Regards, -- Martin Hannigan hannigan(a)fugawi.net

2 1