August 2002 - Test - lists.nanog.org

Deaggregating for emergency purposes
by Phil Rosenthal 07 Aug '02

07 Aug '02

I am currently announcing only my aggregate routes, but I have lately thought about the possibility of someone mistakenly, or maliciously, announcing more specifics from my space. The best solution for an emergency response to that (that I can think of), is registering all of the /24's that make up my network, so if someone should announce a more-specific, I can always announce the most specific that would be accepted (assuming they don't announce the /24's too, it should be a problem avoided) Does anyone else have any other ideas on ways to quickly deal with someone else announcing your more specifics, since contacting their NOC is likely going to take a long time... --Phil

25 49

DDoS FUD
by Omachonu Ogali 07 Aug '02

07 Aug '02

*sigh* What could be better to back up the Homeland Hysteria DDoS warnings, than a broken monitoring site? http://www.internettrafficreport.com/cgi-bin/tr_chartpage.pl?NorthAmerica Go Opnix Go. And no, if you actually ping the routers experiencing "packet loss", they all respond as normal. -- Omachonu Ogali missnglnk(a)informationwave.net http://www.informationwave.net

1 0

69/8 allocated to ARIN
by Rob Thomas 07 Aug '02

07 Aug '02

Hi, NANOGers. IANA has allocated 69/8 to ARIN. I have updated my Bogon List and my sundry templates to reflect this change. You should modify your filters accordingly. IANA IPv4 Allocation List - http://www.iana.org/assignments/ipv4-address-space Bogon List - http://www.cymru.com/Documents/bogon-list.html Secure IOS Template - http://www.cymru.com/Documents/secure-ios-template.html Secure BGP Template - http://www.cymru.com/Documents/secure-bgp-template.html Secure BIND Template - http://www.cymru.com/Documents/secure-bind-template.html Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

DNS monitoring changes
by Rob Thomas 07 Aug '02

07 Aug '02

Hi, NANOGers. I have added two additional data collection points to my DNS root name server monitoring. I have also scaled the graphs (thanks, Howard!) and added a text only version. You will find it all here: http://www.cymru.com/DNS Comments and feedback are always welcome! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

2 1

Net attacks on CNN
by Martin Hannigan 07 Aug '02

07 Aug '02

Barely a dent, as reported. False Alarm. I wonder if they're going to start doing this to us a lot since people get too mad when they do this to bridges, trains, and plains? Got to admit, it's an easy pawn off. Keeps 'em in the press as "active". -M Regards, -- Martin Hannigan hannigan(a)fugawi.net

2 1

Re: If you have nothing to hide
by Dave Crocker 06 Aug '02

06 Aug '02

At 08:27 PM 8/4/2002 -0400, Sean Donelan wrote: >On Sun, 4 Aug 2002, Dave Crocker wrote: >There is a difference between technical/operational matters and policy >matters. I respectfully disagree this can be treated as a technical >problem. Yes, it's essential to be clear about technical spec. vs. policy spec, although they seem to have some overlap. Maybe a lot. But no, that does not make them the same. However the list of questions you asked, in the note I was responding to, looked like technical choices. My assumption was that the "policy" issue was in choosing between technologies. I consider the IETF Best Current Practises label as intended specifically for guidance in operations matters. Hence the suggestion to consider it. >What group is the best forum for developing consensus views on >Internet operation policy issues? In between pure tech specs and abstract policy discussion there is technically based consideration of tradeoffs, etc., for technical alternatives. That's not something to leave to purely policy folk and my sense is that the IETF venue can work for such discussion. >One of the Mr. Clarke's complaints in his speech was there is no group >the government can go to find out what the consensus view of Internet >operators is. IETF doesn't appear to want to take on that role. Hmmm. As soon as a policy becomes multi-operator, I'll bet it starts looking like a technical spec. d/ ---------- Dave Crocker <mailto:dave@tribalwise.com> TribalWise, Inc. <http://www.tribalwise.com> tel +1.408.246.8253; fax +1.408.850.1850

10 11

Re: NYT: Phone Network Is Vulnerable, Report Finds (fwd)
by David Lesher 06 Aug '02

06 Aug '02

Unnamed Administration sources reported that Martin Hannigan said: > > > > If you get the report, I'd be interested, but they'd have to encase the entire > country, poles, manholes, generators, central offices, etc into concrete > and steel to make it secure. With enough knowledge, it's easy, and the > terrorists aren't all stupid. Mostly. All Ridge has to do is classify every cable map, LERG, CLLI list, and telco office guide in the country. Paint all the telco trucks black, to go with the helicopters. And/or, federalize the whole beast, like the railroads during WWI. Remember when the FBI Wiretap Act/GAK folks wanted most/all telco employees to get clearances? This should make that look trivial. Is "system admin" anyone with root access? We better serial-number all Linux downloads. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

3 3

U.S. monitoring Internet attacks (fwd)
by Christopher X. Candreva 06 Aug '02

06 Aug '02

Anyone have any specifics on this ? I haven't seen anything. >From the Aug 6 2002 Chicago Tribune -- http://www.chicagotribune.com/technology/sns-internetattack.story U.S. monitoring Internet attacks By Ted Bridis WASHINGTON -- The government was monitoring a series of electronic attacks launched early today against U.S. Internet providers, hours after European authorities passed warnings to the FBI predicting the attacks. The impact from the attacks appeared limited, and there were no reports of outages or even delayed e-mails. A flood of data, spiking nearly 700 percent more than usual traffic, was aimed at Internet providers and Web sites on the East coast starting about 2 a.m. EDT, then shifted toward providers and sites on the West coast, said a U.S. official, speaking on condition of anonymity. But unlike some recent so-called "denial of service" attacks, which employed hundreds or thousands of computers to overwhelm Web sites, this latest attack appeared to be coming from a relatively small number of machines, the official said. That has allowed Internet providers to protect their networks more easily by filtering data from the attacking computers. The FBI issued a dramatic warning hours before the attacks started, based on information from Italian authorities, the U.S. official said. The alert cited "credible but non-specific information that wide-scale hacker attacks" were planned against U.S. Web sites and Internet providers, "possibly emanating from Western Europe." The earliest attacks targeted East Coast companies, including some in Virginia and Maryland, then shifted to target sites in Seattle, the official said. The White House and FBI's National Infrastructure Protection Center were monitoring the attacks. Some experts indicated the attacks were so easily foiled that they did not register any impact on the health of the Internet. "We haven't seen anything out of the ordinary," said Chris Rouland of Atlanta-based Internet Security Systems Inc., which sells protective software to thousands of companies. "We're paying attention to any sites that may go down." Copyright 2002, The Associated Press

6 5

Any issues with AADS Chicago NAP?
by Matthew Sweet 06 Aug '02

06 Aug '02

Hey, is anyone having peering issues with AADS/Chicago NAP? Our circuit is up, but all the PVCs dropped. Waiting on Ameritech to answer the phone now... Thanks, Matt

1 0

Re: Deaggregating for emergency purposes
by Omachonu Ogali 06 Aug '02

06 Aug '02

On Tue, Aug 06, 2002 at 10:16:41PM +0000, bmanning(a)karoshi.com wrote: > > > > On Tue, 6 Aug 2002 bmanning(a)karoshi.com wrote: > > > > > > Typical response: You're not our customer, who are you? > > > > I'm Omachonu Ogali with XYZ Networks, and I'd like to speak to > > > > a network engineer regarding a routing problem. > > > Hum. I take ~4 calls each day for things that are some other > > > ISPs problem. Folks are -politely- told that the issues > > > are either with their ISP or someone upstream of their ISP. > > > When they get pushy, I offer them a service contract. 99.999% > > > (hey Sean, there are your five 9's!) of them then choose to > > > work with thier ISPs. I suspect that you have more than enough > > > clue to never have to give me a call, but if you do, be prepared > > > to be re-directed... :) > > > > I hope you pay better attention on the phone then you do on lists. :) > > > > The point was calling up the upstream of the AS who is generating bogus > > routes. The upstream of the caller is not at all involved. > > > > But the upstream of the caller is involved. They passed > the route(s) on, no? > > --bill Not necessarily, I could be the victim of a leak calling up an ISP to report it. Or some bored person connected to route-server.* constantly checking prefixes. -- Omachonu Ogali missnglnk(a)informationwave.net http://www.informationwave.net

2 1