August 2002 - Test - lists.nanog.org

FYI: CIDR Report changes
by Philip Smith 26 Aug '02

26 Aug '02

Hi, As most of you know, the CIDR Report was conceived by Tony Bates in 1995 as a means to monitor and inform the community about the amount of CIDRisation activities being carried out by Internet Service Providers. The CIDR Report has been highly successful, much referred to and well respected snapshot of the growth in the Routing Table, as well as providing information on the level of aggregation being carried out in our community. In recent years it has become more of a challenge to maintain the software to keep up with the rapid growth in the Internet. Philip Smith, who has produced a widely published Routing Table Report since late 1998, has helped to keep the Report up to date with current allocation and assignment information. But with the large number of views of the routing table, and with the numerous requests many individuals and organisations have been making for enhancements to the CIDR Report, we have agreed that the future of the CIDR Report now rests alongside the very comprehensive BGP Table Analysis which Geoff Huston has been running for the last year. This Friday's CIDR Report (23rd August) was the last one posted from Tony's original system. As from the coming Friday (30th August), the CIDR Report will come from Geoff Huston's new implementation. The e-mail will go to the same operations mailing lists, will look very similar in layout, and will have greatly updated information compared with the original. Furthermore, the routing table view will be the summary from the RouteViews project. The supporting website for the CIDR Report has been vastly improved, with greater detail, the ability to search on aggregation effort per AS, and so on. A snapshot of Geoff's implementation can be found at http://bgp.potaroo.net/cidr/. Regular users of the information contained in the CIDR Report should check out the website and the new features in the report. As ever, comments and feedback are most welcome; these should be sent to <cidr-report(a)potaroo.net>. Tony Bates, Geoff Huston, Philip Smith

1 0

DNS "attack"
by Mark Kent 25 Aug '02

25 Aug '02

FYI, I'm seeing a lot of DNS lookups for all the three letter domain names for which we are listed as authoritative (we have five). The requests look like this: req: nlookup(foo.com) id 64450 type=255 class=255 212.100.232.17.domain > myserver.domain: 31881+ ANY ANY? foo.com. (25) 4500 0035 1e38 0000 ed11 e20a d464 e811 c7f5 4909 0035 0035 0021 0000 7c89 0100 0001 0000 0000 0000 0365 6f73 0363 6f6d 0000 ff00 ff We get about 400 requests per minute, per "attacking" machine, per authoritative name server, per domain. This happened on July 25 with these two sources: 194.186.87.197 130.94.23.70 and today, August 25, with this source: 212.100.232.17 Clearly, this is not a problem right now. But if the number of attacking machines grows, then any machine that serves many three-letter domain names might notice. And who knows, maybe the cretins will get creative and move to four letter domains! Just FYI, -mark P.S. I mentioned the two dates above (7/25, 8/25) purely for entertainment purposes. Consistent with the NY Times article last weekend about putting too much weight in events that are merely coincidences, I don't mean to imply that there is a "25th of the month" conspiracy afoot.

1 0

RE: Measuring BGP routes
by Frank Scalzo 25 Aug '02

25 Aug '02

Be cautious not to rely on a show ip bgp sum many IOS versions (I don't remember specifically) have a bug that makes that number inaccurate. Most of the tools I have seen have basically done a show ip bgp collected the whole table and parsed it. I know I wrote a tool like that when I was a wcom. As for tracking update packets/sec vs prefixes updated/sec, one of the juniper trace options I think flag update, gives a summary of how many prefixes were updated. -----Original Message----- From: Paul Donner [mailto:pdonner@cisco.com] Sent: Friday, August 23, 2002 2:52 PM To: Ezequiel Carson; Dr. Mosh Cc: nanog(a)merit.edu Subject: Re: Measuring BGP routes I believe there is pointer a screen-scraper script at the route-views web site that might give you this and more info you are looking for. Don't have the info right now but if you can't find it ping me and I'll dig it up. At 12:18 PM 8/23/2002, Ezequiel Carson wrote: >Hi, > > I have tried to search this some time ago ,but i have never found > it. > > I have seen that there is a updates/seconds. > > If you want to get numbrer of prefixes you could use rsh and write a >simple perl/shell script. > > > >Ezequiel > >On Thu, 2002-08-22 at 20:07, Dr. Mosh wrote: > > > > Wonder if anyone of you have come across the need for this. > > > > I'm basically looking for a Cisco IOS MIB that tells me the > > number of BGP routes a router currently has, for graphing > > purposes to keep track over time. > > > > Anyone know the mib handy? > > > > Thanks > > private reply works > > > > > > -- > > -------------- > > http://www.zeromemory.com - metal for your ears. > >

5 4

Measuring BGP routes results
by Dr. Mosh 24 Aug '02

24 Aug '02

Well, seems the best response is to rip it from perl or use expect scripts. Anyone thought of perhaps using Zebra/bgpd since the code can be modified and can live on the server doing the graphing/calculations? I'll have to look into this. Thanks for all replies. -- -------------- http://www.zeromemory.com - metal for your ears.

3 2

Eat this RIAA (or, the war has begun?) - Why not all ISPs?
by Stewart, William C (Bill), RTLSL 24 Aug '02

24 Aug '02

Steve Bellovin's link to the Berman bill has expired, but you can search for it on thomas.loc.gov - it's HR 5211. The version on Berman's web site is http://www.house.gov/berman/p2p.pdf The EFF discussion is at http://www.eff.org/IP/P2P/20020802_eff_berman_p2p_bill.html

1 0

The Cidr Report
by CIDR Report 24 Aug '02

24 Aug '02

This is an auto-generated mail on Fri Aug 23 23:00:00 PDT 2002 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. NEW: Check http://www.employees.org/~tbates/cidr-report-region.html for the regional version of this report. NEW: Check http://www.employees.org/~tbates/autnums.html for a complete list of autonomous system number to name mappings as used by the CIDR-Report. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amount of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to GX Networks for giving me access to their routing tables once a day. Please send any comments about this report directly to CIDR Report <cidr-report(a)cisco.com>. ------------------------------------------------------------------------------ CIDR REPORT for 23Aug02 0) General Status Table History ------------- Date Prefixes 160802 112263 170802 112395 180802 112126 190802 112372 200802 112331 210802 112026 220802 112220 230802 112433 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 13481 Number of ASes announcing only one prefix: 8184 (4604 cidr, 3580 classful) Largest number of cidr routes: 736 announced by AS3908 Largest number of classful routes: 1196 announced by AS701 1) Gains by aggregating at the origin AS level --- 23Aug02 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS701 1196 967 229 19.1% UUNET Technologies, Inc. AS1221 1039 822 217 20.9% Telstra Pty Ltd AS17557 268 94 174 64.9% Pakistan Telecom AS6595 224 60 164 73.2% DoD Education Activity Network As AS852 522 379 143 27.4% Telus Advanced Communications AS16473 196 75 121 61.7% Bell South AS7018 774 662 112 14.5% AT&T AS4151 253 156 97 38.3% USDA AS19632 99 5 94 94.9% Metropolis Intercom S.A. AS12302 122 29 93 76.2% MobiFon S.A. AS16814 105 20 85 81.0% NSS, S.A. AS1239 501 419 82 16.4% Sprint AS226 170 89 81 47.6% Los Nettos AS4755 202 126 76 37.6% Videsh Sanchar Nigam Ltd. Autonom AS2048 178 103 75 42.1% State of Louisiana AS577 266 193 73 27.4% Bell Advanced Communications Inc. AS7046 291 221 70 24.1% UUNET Technologies, Inc. AS3464 163 103 60 36.8% Alabama SuperComputer Network AS19834 64 4 60 93.8% NetForce, Inc. AS10620 85 25 60 70.6% TVCABLE BOGOTA AS724 207 148 59 28.5% DLA Systems Automation Center AS6535 70 13 57 81.4% Chilesat Servicios Empresariales AS5515 243 186 57 23.5% Sonera Finland Autonomous System AS16758 63 6 57 90.5% IKON Office Solutions AS3908 285 230 55 19.3% Supernet, Inc. AS209 289 234 55 19.0% Qwest AS9051 82 28 54 65.9% INCONET Autonomous System AS9498 84 31 53 63.1% BHARTI BT INTERNET LTD. AS3233 105 53 52 49.5% RNC - Romanian Natioanal R&D Netw AS703 273 223 50 18.3% UUNET Technologies, Inc. Total 54880 42313 12567 22.9% For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Controlling RIAA's "hired guns"
by Nigel Clarke 23 Aug '02

23 Aug '02

I know that this has somewhat thoroughly discussed here as of late, but when has it ever been acceptable to allow hackers to break into a customer's computer? I thought that abuse and security teams were designed to stop this type of thing. -- Nigel Clarke Network Security Engineer Forever Networks

2 1

RE: Measuring BGP routes
by Paul Donner 23 Aug '02

23 Aug '02

http://antc.uoregon.edu/route-views/ At 01:05 PM 8/23/2002, Frank Scalzo wrote: >Be cautious not to rely on a show ip bgp sum many IOS versions (I don't >remember specifically) have a bug that makes that number inaccurate. > >Most of the tools I have seen have basically done a show ip bgp >collected the whole table and parsed it. I know I wrote a tool like that >when I was a wcom. > >As for tracking update packets/sec vs prefixes updated/sec, one of the >juniper trace options I think flag update, gives a summary of how many >prefixes were updated. > >-----Original Message----- >From: Paul Donner [mailto:pdonner@cisco.com] >Sent: Friday, August 23, 2002 2:52 PM >To: Ezequiel Carson; Dr. Mosh >Cc: nanog(a)merit.edu >Subject: Re: Measuring BGP routes > > >I believe there is pointer a screen-scraper script at the route-views >web >site that might give you this and more info you are looking for. Don't >have the info right now but if you can't find it ping me and I'll dig it >up. > >At 12:18 PM 8/23/2002, Ezequiel Carson wrote: > > >Hi, > > > > I have tried to search this some time ago ,but i have never >found > > it. > > > > I have seen that there is a updates/seconds. > > > > If you want to get numbrer of prefixes you could use rsh and >write a > >simple perl/shell script. > > > > > > > >Ezequiel > > > >On Thu, 2002-08-22 at 20:07, Dr. Mosh wrote: > > > > > > Wonder if anyone of you have come across the need for this. > > > > > > I'm basically looking for a Cisco IOS MIB that tells me the > > > number of BGP routes a router currently has, for graphing > > > purposes to keep track over time. > > > > > > Anyone know the mib handy? > > > > > > Thanks > > > private reply works > > > > > > > > > -- > > > -------------- > > > http://www.zeromemory.com - metal for your ears. > > >

1 0

RE: Measuring BGP routes
by Frank Scalzo 23 Aug '02

23 Aug '02

Depends on how much info you want. There is obviously more info in the network then outside. If you want to look at things in a confederated environment like how many routes are coming from each confederation, you need to be in the network. Same thing if you want to do any analysis on any attribute that doesn't cross an EBGP border. I think ideally it is preferable to be outside the network so you're not taxing a live box, but sometimes if you want the purest picture there is a reason to get it from in the network. Whether the box is in or out of the network the basic premise is still the same, get the table out, and parse away. -----Original Message----- From: Jeff S Wheeler [mailto:jsw@five-elements.com] Sent: Friday, August 23, 2002 3:34 PM To: nanog(a)merit.edu Subject: RE: Measuring BGP routes On Fri, 2002-08-23 at 15:05, Frank Scalzo wrote: *edited for length* > Most of the tools I have seen have basically done a show ip bgp > collected the whole table and parsed it. I know I wrote a tool like that Is there any reason this is preferable to establishing an eBGP multihop session with the box and receiving the information by that means? -- Jeff S Wheeler <jsw(a)five-elements.com>

1 0

Re: wireless access point accounting
by Spencer.Wood＠dot.state.oh.us 23 Aug '02

23 Aug '02

Yea, the LEAP process works really great..... I've also heard a rumor that Symbol will be licensing Cisco's LEAP software also... ************************************************************ Spencer Wood, Network Manager Ohio Department Of Transportation 1320 Arthur E. Adams Drive Columbus, Ohio 43221 E-Mail: Spencer.Wood(a)dot.state.oh.us Phone: 614.644.5422/Fax: 614.887.4021/Pager: 866.591.9954 ************************************************************* "Christopher L. Morrow" <chris(a)UU.NET> 08/23/2002 03:11 PM To: <Spencer.Wood(a)dot.state.oh.us> cc: Hugh Irvine <hugh(a)open.com.au>, <nanog(a)merit.edu> Subject: Re: wireless access point accounting On Fri, 23 Aug 2002 Spencer.Wood(a)dot.state.oh.us wrote: > If you have Cisco AP's, there LEAP Process works very well.....It > authenticates against a RADIUS Server, and provides good authentication > info, and some accounting...... > And it'll rotate the wep key on a timed basis, provided you have (I believe) cisco cards and drivers. This is a REALLY GOOD thing for wireless security, its one way this should have been done from the beginning... Go Cisco! (once in a while someone has to say it) > Spencer > ************************************************************ > Spencer Wood, Network Manager > Ohio Department Of Transportation > 1320 Arthur E. Adams Drive > Columbus, Ohio 43221 > E-Mail: Spencer.Wood(a)dot.state.oh.us > Phone: 614.644.5422/Fax: 614.887.4021/Pager: 866.591.9954 > ************************************************************* > > > > > Hugh Irvine <hugh(a)open.com.au> > Sent by: owner-nanog(a)merit.edu > 08/23/2002 10:35 AM > > > To: radiator(a)open.com.au > cc: nanog(a)merit.edu > Subject: wireless access point accounting > > > > > Hello Everyone - > > I have recently been investigating wireless access points for 802.1x. > > Is anyone out there using radius authentication and accounting with > these devices? > > If so could you please send me copies of the authentication requests and > the accounting starts and stops? > > Any war stories regarding different brands would also be welcome. > > many thanks > > Hugh > > > NB: I am travelling this week, so there may be delays in our > correspondence. > > -- > Radiator: the most portable, flexible and configurable RADIUS server > anywhere. Available on *NIX, *BSD, Windows 95/98/2000, NT, MacOS X. > - > Nets: internetwork inventory and management - graphical, extensible, > flexible with hardware, software, platform and database independence. > > > >

1 0