June 2002 - Test - lists.nanog.org

Re: spare fibers
by blitz 17 Jun '02

17 Jun '02

Hi Daniel and all, Yes, multiple fiber in multiple conduits, traveling multiple paths is the best way to insure something's going to have connectivity. Ring topology is what I've seen mostly for best protection, if something goes down, restoration takes milliseconds and is automatic. Worst case, is some contractor digs up the place where your fiber enters your building and severs everything....not much you can do about that kind of outage. At 20:41 6/16/02 +0200, you wrote: >Hi blitz, > >I think that you talk about multiple outage in the Telefonica >Network in Spain cause by sabotage. (48 fibers in 4 points at the same >time) > >I see ok the interest of the ministry, is necessary to assure that outages >don't affect to the national infraestruture. > >In our case we build our network over diverse companys with diverse path >in their fiber network. I see ok, that all companys that operate basic >services do it and they will have backup and emergency plans. > >Regards, >Daniel >Intelideas > > >On Sun, 16 Jun 2002, blitz wrote: > > > > > The Spanish ministry of science and technology has asked > > telecommunications companies to activate a backup plan in the > > case of such emergencies in future. > > > > Spare fibers in the same duct ;-? > > > > Doesn't sound like it would be much protection from "backhoe fade"...heh > >

3 2

Re: Re: spare fibers
by Frank Coluccio 16 Jun '02

16 Jun '02

Almost without exception, "ring topology" implies a single-carrier doing physical layer provisioning and support. In the case where multiple points are under attack in a concerted effort to knock out service (including the failover capabilities), it's either an "inside job" or, at the least, one where intelligence relating to individual SONET backbones and rings has been obtained from various sources for the purpose of thwarting such _self-healing_ capabilities that are usually afforded by SONET/SDH. In the not too distant past (during the pre-sonet and early SONET days when N+1 automatic protection switching was used instead of counter-rotating recovery schemes) we saw this occur, albeit infrequently, during periods of labor unrest and other tense forms of situations relating to competition (where folks feared for their jobs) along the NY-NJ corridor and in certain parts of California, to name just two that I recall off the top of my head. Until recently (post 9-11), however, it was hardly a matter of overwhelming concern. Today it is becoming more so a matter of heightened concern. Meshing through the use of diverse providers' facilities may prove to be the ultimate means of protection, with the proviso being that those providers are not all sharing the same physical routes. fwiw. FAC > > > Hi Daniel and all, > Yes, multiple fiber in multiple conduits, traveling multiple paths is the > best way to insure something's going to have connectivity. > Ring topology is what I've seen mostly for best protection, if something > goes down, restoration takes milliseconds and is automatic. Worst case, is > some contractor digs up the place where your fiber enters your building and > severs everything....not much you can do about that kind of outage. > > > At 20:41 6/16/02 +0200, you wrote: > > > >Hi blitz, > > > >I think that you talk about multiple outage in the Telefonica > >Network in Spain cause by sabotage. (48 fibers in 4 points at the same > >time) > > > >I see ok the interest of the ministry, is necessary to assure that outages > >don't affect to the national infraestruture. > > > >In our case we build our network over diverse companys with diverse path > >in their fiber network. I see ok, that all companys that operate basic > >services do it and they will have backup and emergency plans. > > > >Regards, > >Daniel > >Intelideas > > > > > >On Sun, 16 Jun 2002, blitz wrote: > > > > > > > > The Spanish ministry of science and technology has asked > > > telecommunications companies to activate a backup plan in the > > > case of such emergencies in future. > > > > > > Spare fibers in the same duct ;-? > > > > > > Doesn't sound like it would be much protection from "backhoe fade"...heh > > > > >

3 2

spare fibers
by blitz 16 Jun '02

16 Jun '02

The Spanish ministry of science and technology has asked telecommunications companies to activate a backup plan in the case of such emergencies in future. Spare fibers in the same duct ;-? Doesn't sound like it would be much protection from "backhoe fade"...heh

2 2

Of interest to the community ..
by Robert Mathews 15 Jun '02

15 Jun '02

F Y I ... presently floating ... If you have seen it before, please excuse. ==> "Microsoft Warns of New Security Flaws" Reuters - 06/13/02 Microsoft disclosed a trio of critical software vulnerabilities on Wednesday. The company has issued a patch for a hole that can cause system shutdowns or enable hackers to run malicious code on a computer; the flaw affects users of Windows XP, Windows Routing and Remote Access Server, Windows NT 4.0, NT 4.0 Terminal server edition, and Windows 2000. The other security flaws include an Internet Explorer vulnerability that could allow intruders to commandeer computers via an old Internet protocol, and a hole in Microsoft's instant messaging and chat programs that would permit hackers to run their code on victim machines. The Wednesday announcement brings the total number of security bulletins Microsoft has released this year to 30, demonstrating the company has made little actual progress toward its target of more secure software since making it a primary goal about six months ago. Nevertheless, David Gardner of Microsoft's Security Response Center claims that the initiative has had positive effects--for one thing, engineers are detecting these flaws before they are identified and revealed by outside researchers. "Coding Flaw Might Assist Hackers" By Riva Richmond The Wall Street Journal - 06/13/02 P. B4 Computer-security specialists are exploring whether the Internet infrastructure could become a ripe target for hackers because of findings that faulty deployments of the Abstract Syntax Notation One (ASN.1) computer language makes Simple Network Management Protocol (SNMP) vulnerable to intrusions. At the core of the problem are certain versions of programming code used to read ASN.1, which fail when attempting to deal with very long or distorted messages, giving rise to system crashes or memory overflow that hackers could exploit. If such errors have widely proliferated, other protocols may be open to attacks that could shut down routers and switches, severely hampering online access. Such protocols are used by the telecom sector, and are also incorporated into nuclear-control systems, power-control systems, printer-job management, package tracking, secure communications, and online multimedia applications. Sourcefire founder Martin Roesch and other experts say that the problem is being investigated by tech firms, private researchers, and government agencies. The National Infrastructure Protection Board's Debbie Weierman notes that her agency has been collaborating with experts from the NSA, the Federal Computer Incident Response Center, CERT, private groups, and others since March to see how widespread the ASN.1 flaw is. Microsoft, Lucent, and Oracle are among the private-sector companies that have investigated or are investigating how their products may be affected by the ASN.1 problem. Meanwhile, TruSecure's Paul Robertson believes high-level hackers have devised malicious programs that exploit the flaw.

5 4

Routing table in a file
by Roy 15 Jun '02

15 Jun '02

Does anyone dump their copy of the routing table to a flat file regularly and make this available? I need do some queries. The web based versions don't accept modifiers like "lon" on the show ip bgp commands.

5 4

Re: LEAP Security Vulnerabilities??
by Steven M. Bellovin 15 Jun '02

15 Jun '02

In message <20020613212153.GN71564(a)overlord.e-gerbil.net>, Richard A Steenberge n writes: > >On Thu, Jun 13, 2002 at 02:34:29PM -0500, Stephen Sprunk wrote: >> >> WEP's only real failure was the failure to specify keying; vendors (and >> users) with less security experience interpreted this to mean static >> keys were sufficient. >> >> The choice of RC4 was unfortunate given the above problem, but the >> coming switch to AES should fix that. > >Most existing wireless APs cannot keep up with 802.11b doing RC4 (which is >EXTREMELY light on the cpu) at line rate. RC4 if used properly is light-weight. 802.11 is employing it in an unnatural environment, and that causes trouble, including performance issues. More specifically -- RC4 is a stream cipher, which means that it must be employed over a reliable underlying data stream. It's perfect above TCP, for example. But 802.11 is a packet environment, with no underlying stream. Accordingly, the base RC4 key -- 40 bits or 112 bits -- is combined with a 24-bit number (sometimes a counter, sometimes random, but in either case sent in the clear in the packet) to form an actual RC4 key that's used to encrypt just a single packet. The problem is that key setup is roughly as expensive as encrypting 300 bytes or thereabouts. So all those 40-byte TCP ACK packets are a lot more expensive for crypto processing than they should be. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com ("Firewalls" book)

1 0

The Cidr Report
by CIDR Report 15 Jun '02

15 Jun '02

This is an auto-generated mail on Fri Jun 14 23:00:00 PDT 2002 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. NEW: Check http://www.employees.org/~tbates/cidr-report-region.html for the regional version of this report. NEW: Check http://www.employees.org/~tbates/autnums.html for a complete list of autonomous system number to name mappings as used by the CIDR-Report. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amount of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to GX Networks for giving me access to their routing tables once a day. Please send any comments about this report directly to CIDR Report <cidr-report(a)cisco.com>. ------------------------------------------------------------------------------ CIDR REPORT for 14Jun02 0) General Status Table History ------------- Date Prefixes 070602 111313 080602 111271 090602 111270 100602 111336 110602 111462 120602 111353 130602 111438 140602 111440 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 13109 Number of ASes announcing only one prefix: 7989 (4485 cidr, 3504 classful) Largest number of cidr routes: 646 announced by AS701 Largest number of classful routes: 1351 announced by AS701 1) Gains by aggregating at the origin AS level --- 14Jun02 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS701 1351 1084 267 19.8% UUNET Technologies, Inc. AS1221 1090 845 245 22.5% Telstra Pty Ltd AS17557 299 113 186 62.2% Pakistan Telecom AS852 569 415 154 27.1% Telus Advanced Communications AS7018 815 684 131 16.1% AT&T AS6595 181 58 123 68.0% DoD Education Activity Network As AS16473 194 76 118 60.8% Bell South AS705 305 205 100 32.8% UUNET Technologies, Inc. AS19632 98 4 94 95.9% Metropolis Intercom S.A. AS4151 233 140 93 39.9% USDA AS12302 120 27 93 77.5% MobiFon S.A. AS7303 151 65 86 57.0% Telecom Argentina Stet-France Tel AS16814 104 19 85 81.7% NSS, S.A. AS226 176 92 84 47.7% Los Nettos AS1239 501 417 84 16.8% Sprint AS7046 319 236 83 26.0% UUNET Technologies, Inc. AS4755 203 130 73 36.0% Videsh Sanchar Nigam Ltd. Autonom AS2048 180 107 73 40.6% State of Louisiana AS577 261 189 72 27.6% Bell Advanced Communications Inc. AS724 230 161 69 30.0% DLA Systems Automation Center AS4323 409 340 69 16.9% Time Warner Communications, Inc. AS3464 165 105 60 36.4% Alabama SuperComputer Network AS19834 64 4 60 93.8% NetForce, Inc. AS10620 83 23 60 72.3% TVCABLE BOGOTA AS209 317 260 57 18.0% Qwest AS16758 63 6 57 90.5% IKON Office Solutions AS3908 304 248 56 18.4% Supernet, Inc. AS1 446 390 56 12.6% GENUITY AS9051 81 26 55 67.9% INCONET Autonomous System AS6535 69 16 53 76.8% Chilesat Servicios Empresariales Total 55229 42614 12615 22.8% For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

DDos attack in progress?
by Scott Granados 14 Jun '02

14 Jun '02

Does anyone know anything about a DDos attack underway pointed at machines in 66.54.0.0/19 or AS 15217? I'd heard something about this from internal channels but was wondering if anyone else knew about one under way? Thanks Scott

3 2

KPNQWEST cease operation?
by 矢田部 14 Jun '02

14 Jun '02

Hi All: I heard that NOC of KPQWEST in Frankfurt would cease operation at 1400 hour (local time) today. Is there any additional information about this? Thanks Ryouichi Yatabe

6 7

RE: GigEth regenerators
by Daniska Tomas 13 Jun '02

13 Jun '02

a brief summary of responses up to now: - there are several vendors making some kind of sx-to-zx gbe converters (they call it gbe extenders), which gives an equivalent of a device with a zx gbic. these vendors include jdsu, luxn, extreme etc. - two companies were found making gbe optical regenerators - imcnetworks and transmode - other solution is to try with edfa mikael: which exact gbic did you use? i was comparing cisco-reselled gbics and their cwdm gbics seem to be more than 10dB better on power budget... anybody tried this in real life? thanks again -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first. > -----Original Message----- > From: Mikael Abrahamsson [mailto:swmike@swm.pp.se] > Sent: 12. júna 2002 17:48 > To: nanog(a)merit.edu > Subject: Re: GigEth regenerators > > > > On Wed, 12 Jun 2002, Daniska Tomas wrote: > > > but for gigeth in this case - we need to connect two sites > about 200km > > apart over dark fiber > > Check out the 7020 from Transmode > <http://www.transmode.se/products/sing_dual.htm> > > Btw, my personal best so far is 150km over dark fiber using a > extra long > haul GBIC, 32dB loss over the fiber and it worked perfectly. > Only tested > it for 10 minutes, but there were no CRC errors during that time. > > +4dB output from the GGBIC, now we have to worry to not look into the > laser :) > > -- > Mikael Abrahamsson email: swmike(a)swm.pp.se > >

3 2