September 2002 - Test - lists.nanog.org

RE: BGP Default Route
by Lupi, Guy 14 Sep '02

14 Sep '02

I see what you are saying, and I understand that the default route would be originated per neighbor, or per peer group for all neighbors within that peer group. My biggest concern is that if the aggregation router with this configuration was to lose connectivity back to the routers which provide it with external routing information, it would still announce the default to that neighbor. Do you feel that this is an acceptable risk, taking into consideration that the aggregation router has redundant connectivity to those routers that provide it with it's external routing information and it is highly unlikely that the router would lose it's view of the world? -----Original Message----- From: Mike Leber [mailto:mleber@he.net] Sent: Saturday, September 14, 2002 4:19 PM To: Lupi, Guy Cc: 'nanog(a)merit.edu' Subject: Re: BGP Default Route On Sat, 14 Sep 2002, Lupi, Guy wrote: > I was wondering how people tend to generate default routes to customers > running bgp. Typically you would only originate default via BGP to a customer that isn't taking a full view. neighbor 10.10.10.2 default-originate neighbor 10.10.10.2 filter-list 9 out ip as-path access-list 9 deny ^.*$ > Is it from the aggregation router that customers are directly > connected to, or from one or more core/border routers? In the example above the default originate is done via a specific BGP session, so it isn't router wide on either core or border routers. > If one is using a default route to null 0... I'll leave the rest of this for somebody else to answer. Mike. +----------------- H U R R I C A N E - E L E C T R I C -----------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +-----------------------------------------------------------------------+

3 2

Pre-NANOG 26 Oregon Rafting Adventure
by Daniel Golding 14 Sep '02

14 Sep '02

Hello! We would like to announce the Pre-NANOG 26 Oregon Rafting Adventure. When: October 26th, the day before NANOG 26 starts. Where: The Upper Mckenzie River, www.hcexpeditions.com What about a Hotel: Many of us are staying the nights before and after at Holiday Farm Resort (Preferred due to the large number of rooms and availability) 800-823-3715 http://www.holidayfarmresort.com/, then caravanning to Eugene on Sunday morning. There are additional places to stay in the immediate area - we'll send you full information when you RSVP. Please plan on making your room reservations as early as possible as many of these are filling up due to various golfing promotions. How Far: About 50 miles from Eugene Where should I fly into: PDX Airport - Portland. This should be less expensive than trying to fly into Eugene. Who is running this?: This trip is being coordinated by Mitchell Rose and Daniel Golding. Ren Nowlin ordinarily runs these things, but she's in China, so we have been left in charge. Fear it. :) Who can come: Anyone who wants to. This trip is not being sponsored by vendors or employers. The trip: we will pass most of the possible hotel accommodations on our raft trip. All of the places are within a 10 mile radius of where we will meet (begin and end) on Sat. for rafting (Belknap Resort). The stretch of river will range from a slow float to class 2-3. We will go through protected forest and secluded areas, past large log jams (this is Oregon, lots of timber). We will have a nice BBQ on the river for lunch and end with a grand raft surfing finale! We will then head to Belknap to soak in an outdoor 104 degree hot spring next to the river. This should be a VERY memorable trip. What to bring: a change of cloths for after the trip (you might get wet ;)), and preferably non-cotton cloths for wearing under the splash gear on the trip. All other clothing and gear will be provided. Check the web site for more details. What's included: All day rafting, lunch, and use of the Hot Spring at the Belknap Resort. How Much: $75 for the raft trip, but there may be discounts if we can get enough folks. How do I sign up?: Three simple steps - Send email to Mitchell Rose (mrose(a)cw.net) or Dan Golding (dgolding(a)yahoo.com) We'll get back to you with more detailed information on the trip and area hotels, and answer any questions you might have. At the same time, you should register for the raft trip at http://www.highcountryexpeditions.com/ under Cost/Booking. Please include "NANOG" as the group name, your Shoe size (M/W), Splash top size (Sm, Med, Large, XL, XL2), and any special needs - vegan, vegetarian, food allergies, etc. The cutoff date for this adventure is 9/30/02. After that, it's purely "space available". Finally, book the hotel room of your choice - we'll send you a full list, but Holiday Farm Resort is recommended. Transportation: None, but we can all carpool there and back. Please let us know if you need or want a ride, or can provide one. Is fun guaranteed?: Yes. Thanks, Daniel Golding and Mitchell Rose

1 0

Re: Security focus (aka bugtraq) reachability
by Scott Gifford 14 Sep '02

14 Sep '02

Mike Tancsa <mike(a)sentex.net> writes: > Can anyone with a host in the IP range of 64.0.0.0/8 confirm if they > can connect to the www.securityfocus.com or mail.securityfocus.com ? > (i.e. the bugtraq people). I can reach it, but it's not working, and this is sure strange: $ telnet www.securityfocus.com 80 Trying 66.38.151.10... Connected to www.securityfocus.com. Escape character is '^]'. HEAD / HTTP/1.0 HTTP/1.1 200 OK -> Server: Microsoft-IIS/5.0 Content-Location: http://66.38.151.10/Default.htm Date: Sat, 14 Sep 2002 04:20:27 GMT Content-Type: text/html Accept-Ranges: bytes Last-Modified: Fri, 13 Sep 2002 18:00:33 GMT ETag: "50d4ae744f5bc21:9db" Content-Length: 606 Netcraft says they ran Apache on Linux until today. I wonder what's going on over there?... ----ScottG.

4 3

FW: OpenSSL worm
by Avery Buffington 13 Sep '02

13 Sep '02

passing this along for those who may have not seen it yet -----Original Message----- From: Hal Flynn [mailto:flynn@securityfocus.com] Sent: Friday, September 13, 2002 12:23 PM To: focus-linux(a)securityfocus.com Subject: OpenSSL worm For those of you not aware, there has been a report of an OpenSSL worm in the wild. Discussion is on Bugtraq currently. Cheers, Hal Flynn Symantec Corp. "....You guys are the Marine's doctors; There's no better in the business than a Navy Corpsman...." -- Lieutenant General Lewis B. "Chesty" Puller, U.S.M.C.

2 1

Re: Vulnerbilities of Interconnection
by sgorman1＠gmu.edu 13 Sep '02

13 Sep '02

Or you cut the lines coming into the city - i.e Chicago has about 5 diverse routes for fiber into the city. No explosives required and you get the same effect. ----- Original Message ----- From: Dave Israel <davei(a)algx.net> Date: Friday, September 13, 2002 10:52 am Subject: Re: Vulnerbilities of Interconnection > > On 9/13/2002 at 10:30:47 -0400, alex(a)yuriev.com said: > > > > > > > > > > Yet, it is reasonable that people expect x % of their > traffic to > > > > use IX's. If those IX"s are gone then they will need to > find another > > > > path, and may need to upgrade alternate paths. > > > > > > > > I guess the question is. > > > > > > > > At what point does one build redundancy into the network. > > > > > > No, it doesnt necessarily use IX's, in the event of there > being no peered path > > > across an IX traffic will flow from the originator to their > upstream> > "tier1" over a private transit link, then that "tier1" > will peer with the > > > destination's upstream "tier1" over a private fat pipe then > that will go to the > > > destination via their transit private link. > > > > > > I'm only aware of a few providers who transit across IX's and > I think the > > > consensus is that its a bad thing so it tends to be just small > people for whom > > > the cost of the private link is relatively high. > > > > I think you are missing a one critical point - IX in this case > is not an > > exchange. It is a point where lots of providers have lots of > gear in a > > highly congested area. However they connect to each other in > that area does > > not matter. > > > > Now presume those areas are gone (as in compeletely gone). What > is the > > possible impact? > > They're all completely gone? Then we have a bigger issue than the > Internet not working, because lots of us are dead. A lot of the > exchange areas are city-wide, in a literal sense. Take DC, for > example. Lots of folks connect in DC, not just at MAE-East, but also > via direct cross-connects between providers, following a large variety > of fiber paths owned by a variety of carriers. A single event that > removed all the connectivity from DC would either have to devastate > the city and surrounding suburbs, or at a minimum, distrupt > electronics (EMP airburst) or hit every power plant in the area (and > yeah, that kills folks, too, especially in winter.) > > Now, having destroyed civilization in DC (so to speak), we have > removed a major exchange point, but also all traffic generated in DC. > The rest of the Internet is fine. To break the rest of the exchanges, > we'd have to do the same to New York, Dallas, Boston, Chicago, > Atlanta, San Francisco, San Jose... And that's just in the States. > > If you were to hit a telco hotel (usually a hard target, but we'll > grant you the necessary firepower), you would inconvenience the > Internet in that area until another well-connected site could be > chosen and filled with equipment. Internet infrastructure is > logically mapped to telco infrastructure, and telco infrastructure is > ubiquitous. You're looking for a weakness where it isn't. If you > wanted to hurt the Internet, you wouldn't hit a city. You'd hit the > cross country fiber paths, out in the middle of nowhere. > > -Dave > > >

2 1

Security focus (aka bugtraq) reachability
by Mike Tancsa 13 Sep '02

13 Sep '02

Can anyone with a host in the IP range of 64.0.0.0/8 confirm if they can connect to the www.securityfocus.com or mail.securityfocus.com ? (i.e. the bugtraq people). I have tried from two separate networks (mine and a totally separate ISP nothing to do with my AS) and both cannot connect from different IP addresses in the 64.0.0.0/8 range. From IP addresses outside of 64/8 its fine. Its as if they dont have ip classless enabled or some rogue firewall rules / routes. e.g. quartz# telnet -s 199.212.134.17 www.securityfocus.com 80 Trying 66.38.151.10... Connected to www.securityfocus.com. Escape character is '^]'. ^] telnet> close Connection closed. quartz# telnet -s 64.7.128.97 www.securityfocus.com 80 Trying 66.38.151.10... telnet: connect to address 66.38.151.10: Operation timed out telnet: Unable to connect to remote host quartz# quartz# traceroute -s 199.212.134.17 www.securityfocus.com traceroute to www.securityfocus.com (66.38.151.10) from 199.212.134.17, 64 hops max, 40 byte packets 1 iolite (209.112.4.3) 1.206 ms 2.952 ms 3.377 ms 2 hespler-waterloo (199.212.135.65) 3.299 ms 0.497 ms 1.419 ms 3 waterloo-hespler (199.212.135.66) 2.839 ms 2.542 ms 1.740 ms 4 tor-wat (64.7.143.42) 8.786 ms 6.523 ms 9.926 ms 5 64.187.3.213 (64.187.3.213) 55.151 ms 49.215 ms 52.673 ms 6 h216-18-62-89.gtconnect.net (216.18.62.89) 53.744 ms 51.485 ms 52.029 ms 7 GE3-1.WANB-TOROON.IP.GROUPTELECOM.NET (216.18.63.13) 51.477 ms 51.297 ms 54.376 ms 8 POS9-2.WANB-CALGAB.IP.GROUPTELECOM.NET (216.18.32.165) 49.236 ms 52.984 ms 51.725 ms 9 216.18.32.6 (216.18.32.6) 52.931 ms 68.631 ms 47.683 ms 10 216.18.37.117 (216.18.37.117) 51.466 ms 51.354 ms 51.815 ms 11 216.18.37.117 (216.18.37.117) 54.124 ms !X *^C quartz# They are single homed out of GT (AS 6539). ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

1 1

ISPs who de-aggregate intentionally?
by Jeffrey Haas 13 Sep '02

13 Sep '02

As part of the process of making the latest BGP draft an IETF standard, the IDR working group is in the process of reviewing how the current draft reflects deployed code. As part of this effort, if anyone is aware of ISPs who intentionally de-aggregate routes and could contact me to share some of the reasoning and their methodologies behind this, I would greatly appreciate it. Please note - no names will be named, unless you want to be. A summary of the results will be posted back to this list. -- Jeff Haas NextHop Technologies

2 3

FW: Suspension of posting rights for Jim Fleming
by Jeroen Massar 13 Sep '02

13 Sep '02

And another time your 'friend' has been suspended on the IETF list Mr. Baptista. This one is for the record, so that everyone who finds your 'nice' one-sided story also gets to know the other side. Enough of this, back to ops. Greets, Jeroen -----Original Message----- From: owner-ietf(a)ietf.org [mailto:owner-ietf@ietf.org] On Behalf Of Harald Tveit Alvestrand Sent: Thursday, 12 September 2002 16:09 To: ietf(a)ietf.org Subject: Suspension of posting rights for Jim Fleming After having reviewed Jim Fleming's recent contributions to the IETF list, and having found no trace of modification to his behaviour after the warning he received on August 23, I have suspended his posting privilleges. This revocation will remain in effect for 2 months, until November 12. Harald Alvestrand IETF Chair

5 5

Overcoming IPv6 Security Threat
by Joe Baptista 13 Sep '02

13 Sep '02

Thanks to everyone who helped out. cheers joe baptista >http://www.circleid.com/articles/2533.asp > >Overcoming IPv6 Security Threat > >September 12, 2002 | By Joe Baptista > >Technology rags and industry pundits see IPv6 (Internet Protocol version >6) as the future of networking, but Daniel Golding a participant of the >North American Network Operators' Group (NANOG) thinks it's a "solution in >search of a problem". Many others have argued IPv6 is a problem in itself >and it is unlikely the protocol will gain wide acceptance in the short >term. > >IPv6 does solve many of the problems with the current version of IPv4 >(Internet Protocol version 4). Its purpose is to expand address space and >fix the IPv4 address depletion problem, which many techies claim, was due >to mismanagement. The industry's goal is to use the very large address >allocation pool in IPv6 to expand the capabilities of the Internet to >enable a variety of peer-to-peer and mobile applications including >cellular phone technology and home networking. > >IPv6, a suite of protocols for the network layer, uses IPv4 gateways to >interconnect IPv6 nodes and comes prepackaged with some popular operating >systems. This includes almost all Unix flavors, some Windows versions and >Mac OS. Some vendors offer upgrades to older operating systems. Trumpet >Software International in Tasmania Australia manufactures a Trumpet >Winsock version that upgrades old Windows 95/98 and NT systems to the >current IPv6 standard. > >IPv6 has suffered bad press over privacy issues. Jim Fleming, the inventor >of IPv8, a competing protocol, sees many hazards and privacy flaws in >existing IPv6 implementations. IPv6 address space in some cases uses an ID >(identifier) derived from your hardware or phone "that allows your packets >to be traced back to your PC or cell-phone" said Fleming. Potential abuse >to user privacy exists as a hardware ID wired into the IPv6 protocol can >be used to determine the manufacturer, make and model number, and value of >the hardware equipment being used. Fleming warns users to think twice >before they buy themselves a used Laptop computer and inherit all the >prior surfing history of the previous user! > >IPv6 uses 128 bits to provide addressing, routing, and identification >information on a computer interface or network card. The 128 bits are >divided into the left 64 and the right 64. Some IPv6 systems use the right >64 bits to store an IEEE defined global identifier (EUI64). This >identifier is composed of company id value assigned to a manufacturer by >the IEEE Registration Authority. The 64-bit identifier is a concatenation >of the 24-bit company identification value and a 40-bit extension >identifier assigned by the organization with that company identification >assignment. The 48-bit MAC address of your network interface card may also >be used to make up the EUI64. > >In the early stages of IPv6 development, Bill Frezza a General Partner >with the venture capital firm, Adams Capital Management warned software >developers that if privacy issues are not properly addressed, the >migration to IPv6 "will blow up in their face"! Leah Gallegos agrees that >while "expanding the address space is necessary the use of the address for >ID and tracking is horrific". Gallegos the operator of the top-level >domain .BIZ and a Director of the Top Level Domain Association cautions >network administrators that they should refuse to implement IPv6 unless >these issues are properly addressed. > >Privacy concerns prompted the creation of new standards, which provide >privacy extensions to IPv6 devices. Thomas Narten and Track Draves of >Microsoft Research published a procedure to ensure privacy of IPv6 users. >Narten, IBM's technical lead on IPv6 and an Area Director for the Internet >Engineering Task Force (IETF), agrees "IPv6 address can, in some cases, >include an identifier derived from a hardware address". But Narten points >out that a hardware address is not required. "In cases where using a >permanent identifier is a problem", said Narten "RFC 3041 addresses should >be used". > >RFC 3041 titled "Privacy Extensions for Stateless Address >Autoconfiguration in IPv6" was published this past January 2001 by the >IETF. It is an algorithm developed jointly by Narten and Draves which >generates randomized interface identifiers and temporary addressees during >a user session. This would eliminate the concerns privacy advocates have >with IPv6. > >Unfortunately RFC 3041 is not widely implemented. But Narten expects major >vendors to incorporate his privacy standard and offered that Microsoft >implemented privacy extensions "and apparently intends to make it part of >their standard stuff". Narten also assisted in the drafting of >recommendations for some second and third generation cellular phones >recently approved for publication by the Internet Engineering Steering >Group. That document recommends that RFC 3041 be implemented as part of >cellular phone technology but he did not know what direction cell phones >manufacturers were taking. "I suspect that client vendors will generally >implement it because of the potential bad PR if they don't" said Narten. > >Another obstacle raised by NANOG operators is that there is currently no >commercial demand for IPv6 at this time. Dave Israel, a Data Network >Engineer and regular participant on NANOG lists, sees no immediate demand >for IPv6 services. "The only people who ask me about IPv6", said Israel >"are people who have heard something about it from some tech-magazine and >want the newest thing". Israel says he sees no commercial demand for a v6 >backbone. > >Daniel Golding, another NANOG participant agrees, "v6 deployment is being >encouraged by some countries, and the spread of 3G (cellular technology) >is helping things along, but we have yet to see really widespread v6 >deployments anywhere". Golding sees major backbone networks deploying IPv6 >when it makes economic sense for them to do so. "Right now", said Golding >"there is no demand and no revenue upside. I don't expect this to change >in the near future". > >Most on NANOG agree the roadblock seems to be a lack of ISPs that offer >IPv6 services. Stephen Sprunk, a Network Design Consultant with Cisco's >Advanced Services group sees the "greater adoption of always-on broadband >access will be the necessary push" to get IPv6 off the ground. "Enterprise >networks will not be the driver for ISPs to go to IPv6" said Sprunk and >"NAT is too entrenched". Network Address Translation (NAT) is a method of >connecting multiple computers to the Internet (or any other IP network) >using one IPv4 address. > >Vint Cerf senior vice president of architecture & technology at WorldCom >has been using IPv6 for about four years. IPv6 has been a key element for >some of WorldCom's Government customers. Cerf thinks IPv6 supporters have >a lot of work ahead to achieve successful deployment of the protocol. He >expects "that over the next several years we will see a lot of consumer >devices set up to work with IPv6" and "cell phones are likely candidates, >as are radio-enabled PDAs". > >-EOF The dot.GOD Registry, Limited http://www.dot-god.com/

8 9

Re: Vulnerbilities of Interconnection
by Dave Israel 13 Sep '02

13 Sep '02

On 9/13/2002 at 10:30:47 -0400, alex(a)yuriev.com said: > > > > > > > Yet, it is reasonable that people expect x % of their traffic to > > > use IX's. If those IX"s are gone then they will need to find another > > > path, and may need to upgrade alternate paths. > > > > > > I guess the question is. > > > > > > At what point does one build redundancy into the network. > > > > No, it doesnt necessarily use IX's, in the event of there being no peered path > > across an IX traffic will flow from the originator to their upstream > > "tier1" over a private transit link, then that "tier1" will peer with the > > destination's upstream "tier1" over a private fat pipe then that will go to the > > destination via their transit private link. > > > > I'm only aware of a few providers who transit across IX's and I think the > > consensus is that its a bad thing so it tends to be just small people for whom > > the cost of the private link is relatively high. > > I think you are missing a one critical point - IX in this case is not an > exchange. It is a point where lots of providers have lots of gear in a > highly congested area. However they connect to each other in that area does > not matter. > > Now presume those areas are gone (as in compeletely gone). What is the > possible impact? They're all completely gone? Then we have a bigger issue than the Internet not working, because lots of us are dead. A lot of the exchange areas are city-wide, in a literal sense. Take DC, for example. Lots of folks connect in DC, not just at MAE-East, but also via direct cross-connects between providers, following a large variety of fiber paths owned by a variety of carriers. A single event that removed all the connectivity from DC would either have to devastate the city and surrounding suburbs, or at a minimum, distrupt electronics (EMP airburst) or hit every power plant in the area (and yeah, that kills folks, too, especially in winter.) Now, having destroyed civilization in DC (so to speak), we have removed a major exchange point, but also all traffic generated in DC. The rest of the Internet is fine. To break the rest of the exchanges, we'd have to do the same to New York, Dallas, Boston, Chicago, Atlanta, San Francisco, San Jose... And that's just in the States. If you were to hit a telco hotel (usually a hard target, but we'll grant you the necessary firepower), you would inconvenience the Internet in that area until another well-connected site could be chosen and filled with equipment. Internet infrastructure is logically mapped to telco infrastructure, and telco infrastructure is ubiquitous. You're looking for a weakness where it isn't. If you wanted to hurt the Internet, you wouldn't hit a city. You'd hit the cross country fiber paths, out in the middle of nowhere. -Dave

1 0