July 2002 - Test - lists.nanog.org

anyone have a genealogy of providers?
by k claffy 29 Jul '02

29 Jul '02

does anyone know of a concise genealogy of providers since 1990 (e.g., GTE + BBN begat GTE Internetworking; GTEI absorbed Genuity; GTE + BBN + Genuity + ... => Verizon; by ASes even better but we can do the mappings if needed) we're trying to integrate a little more semantic sanity to presentations of macroscopic infrastructure growth over time (notwithstanding the fact that semantic sanity in this space is a losing battle) and it would sure help to have the metabolic process codified in a single source. pointers muchly appreciated, k

1 0

RE: Bogon list or Dshield.org type list
by michael.dillon＠radianz.com 29 Jul '02

29 Jul '02

Having recently read David Moore's paper on backscatter analysis, http://www.caida.org/outreach/papers/2001/BackScatter/ this data is interesting because most of these filters seem to be blocking an amount of traffic proportional to their size. >Extended IP access list 120 (Compiled) > permit tcp any any established (243252113 matches) > deny ip 0.0.0.0 1.255.255.255 any (825328 matches) ^^^ ^^^^^^ The netmask is twice as large and it blocks twice the traffic as the following three blocks. > deny ip 2.0.0.0 0.255.255.255 any (413487 matches) > deny ip 5.0.0.0 0.255.255.255 any (410496 matches) > deny ip 7.0.0.0 0.255.255.255 any (413621 matches) > deny ip 10.0.0.0 0.255.255.255 any (1524547 matches) RFC 1918 space is different from the rest. <some deleted to save space> > deny ip 72.0.0.0 7.255.255.255 any (3300703 matches) ^^^ ^^^^^^^ Eight times as big blocks eight times as much traffic <some deleted to save space> > deny ip 224.0.0.0 31.255.255.255 any (13165320 matches) And the relationship holds even up here in the multicast range. However, since you are seeing this on your ingress filters, this can't be backscatter. It must be incoming attack traffic and since the traffic is evenly distributed over the entire IPv4 address space, you can calculate how much attack traffic is still getting through by adding up the amount of IPv4 address space that you aren't filtering. If you would look at the destination IP addresses from some of the netblocks in the above list, then you could identify which of your machines (or your customer machines) are being attacked. This now provides enough information to identify attack traffic close to its source. If you would publish the destination addresses and time periods of the attacks then other people could look in their netflow data for traffic from bogon addresses to your destination. A central repository like dshield.org for this data would be interesting. Other than for idle curiosity, I think this is interesting because there is the real possibility of being able to identify an attacker and victim soon enough after an attack begins that the victim could issue legal warnings to the attacker and possibly follow up in the courts. I would think that after a few well-publicised cases, the owners of compromised machines used to initiate DDOS attacks will begin to secure their machines the way they should have in the first place. -- Michael Dillon

4 3

Any people still with old filters?
by Roy 29 Jul '02

29 Jul '02

In a recent discussion with a company that owns a /16 and has it broken down further, the statement was made that there are ISPs that filter routes at /16 in what was traditional class B space. The example cited was Verio. Verio web pages state they don't do this any more (the filter is /21). Is there anyone that still filters routes longer than /8 and /16 in the traditional Class A and B space?

5 5

Bogon list or Dshield.org type list
by alsato 29 Jul '02

29 Jul '02

Im wondering how many of you use Bogon Lists and http://www.dshield.org/top10.html type lists on your routers? Im curious to know if you are an ISP with customers or backbone provider or someone else? I have a feeling not many people use these on routers? Im wondering why or why not? Ive never used them on my routers although I work for a new isp/cable provider. Im thinking it would make my users happy to use them though. alsato

7 9

AS286 effectively no more..
by Huopio Kauto 29 Jul '02

29 Jul '02

Interesting how quietly one of the powerhouses in Europe has been shut down yesterday evening. Any notes on increased latency / routing issues wrt AS286 shutdown? --kauto Kauto Huopio - kauto.huopio(a)ficora.fi Information Security Adviser Finnish Communications Regulatory Authority / CERT-FI tel. +358-9-6966772, fax. +358-9-6966515 CERT-FI duty desk +358-9-6966510 - http://www.cert.fi

10 13

NIST & Wireless ...
by W.D.McKinney 28 Jul '02

28 Jul '02

NASA has had this out for over a year. http://www.nas.nasa.gov/Groups/Networks/Projects/Wireless/index.html /Dee -- W.D.McKinney (Dee) http://3519098920

2 1

verio arrogance
by Ralph Doncaster 27 Jul '02

27 Jul '02

http://info.us.bb.verio.net/routing.html#PeerFilter It seems if I were one of their customers they would accept my 66.11.168/23 announcement and re-announce it to their peers, but they won't accept it from any of their peers. Announcing a covering /20 along with the regional more specifics I have will only serve to increase the size of the routing table for most backbones, and lead to sub optimal routing in some cases since I'm announcing the more specifics due to geographical diversity. Ralph Doncaster principal, IStop.com

19 43

Understanding BGP misconfiguration
by Sean Donelan 27 Jul '02

27 Jul '02

A nice academic paper looking at the causes of BGP errors. They found configuration errors are pervasive, with 200-1200 prefixes experienceing problems due to misconfigurations every day. But they also found the Net is relatively robust, with only one in twenty-five misconfigurations affect connectivity. http://www.acm.org/sigcomm/sigcomm2002/papers/bgpmisconfig.html

2 1

Re: routing table size
by Stephen J. Wilcox 27 Jul '02

27 Jul '02

On Sat, 27 Jul 2002, David Schwartz wrote: > > On Sat, 27 Jul 2002 23:04:02 +0100 (BST), Stephen J. Wilcox wrote: > > >I've a feeling that the fact that everyone shares at least the view that a > >/24 > >is minimum helps to contain the routing table. (even if there are still > >thousands of /24 announcements) > > > >If a significant number of providers starting accepting any prefix then the > >others would need to follow (else they'd get no transit traffic as it will > >always prefer the most specific). This really would lead to route explosion! > > > >I guess the counter argument is that you'd still get the same number of > >announcements at longer prefixes as there are only lots of /24s as its the > >current shortest (if you catch my drift here). But I doubt it is quite that > >straight forward and there would be a growth in announcements.. > > > >Steve > > My point is simply that only those who felt the /32s were worth carrying > would carry them. And those who chose to announce them would have to factor > the effects of selective carrying into their decisions. But nobody would be > imposing any unwanted costs on anyone else. Yes, you said that before and my above comments still apply! > That's the difference. Nothing you can possibly do with a customer can > impose unwanted costs on you or the customer. If you don't want the costs, > don't do it. If the customer won't pay you the cost of doing it, don't do it. > it's only in the relationship between ISPs and non-customers that there's a > pollution and inequitable cost distribution issue. But it costs me nothing to accept my customers announcements.... ? > Practicing what you preach does not require treating fundamentally different > situations as the same. How is it different? The cash (customer) bit isnt relevant.. its how many providers allow it which is. Steve > > DS > > >

1 0

Re: routing table size
by Ralph Doncaster 27 Jul '02

27 Jul '02

> Off your network, your legal rights are pretty limited. I (and I'm sure > lots of other admins) block at the /24 boundry. Anything you announce > from /25 to /32 will be ignored on my network. Some providers choose to > block according to RIR allocation sizes. To me, that's not worth the > maintenance hassle. To them, it may mean the difference between having to > upgrade or replace large numbers of routers last year or sometime in the > next few years. I've never suggested accepting /25's thru /32's. I'm wondering if the people saying I should not de-aggregage my /20 actually practice what they preach and filter /24's and don't globally announce /24's from their customers. -Ralph

2 1