September 2002 - Test - lists.nanog.org

casual programming and network operations
by Adam Atkinson 08 Sep '02

08 Sep '02

Some of my colleagues appear to think that things like perl are so arcane that only I can do them. I have offered to do a _really_ basic introduction to perl (and unix shell stuff) tailored to what my colleagues might possibly use it for, and several people have expressed an interest. It has to be admitted that I only use quite basic features of perl myself, but my own experience has been that it's possible to do genuinely useful things knowing only tiny bits of it. (My experience with C has been otherwise, at least for the sorts of things I find myself wanting to do.) My intention is to try to get the message across using real-world examples which achieve something clearly useful, without using many features of the language. Preferably examples where doing it entirely by hand (or with a spreadsheet or editor) would be awkward enough that learning 3 things about perl and writing a script seems faster and/or more appealing. I would, for example, only (or initially?) use examples that use standard input and output, since you can achieve plenty that way. And no modules until/unless people are sold on the basic idea. And, to keep the scripts looking as undaunting as possible, no "die" statements, no checking of input, etc. (I know how daunting I find "simple" programs 3 pages long) Four examples which seem good to me would be: (i) going through Apache logs and listing the IP addresses from which Nimda attacks came. (via grep | cut | sort | uniq, and/or with perl) (ii) removing mysterious binary characters in otherwise clean log files (since this has actually happened to us) using tr (iii) reversing netmasks, so that lines of the form "120.1.0.0 255.255.128.0" can be turned into,say, "access-list 142 permit ip any 120.1.0.0 0.0.127.255" (iv) Using cron and expect to log in to a router periodically and do something to it. (to be concrete, get data from it and feed it to mrtg) Taking (iii) as a concrete example: I have upon occasion been given 200+ networks I needed to do this to, and it strikes me as a perfect applicaction for a perl script that uses only stdin and stdout for this audience, though not as a first example. It's a realistic task, and doing it by hand for 200 networks would be annoying. What are some other ways of doing (iii)? One person I asked said "load it into Excel and do search/replaces on the network masks until you've covered all those used". This isn't bad, it has to be said. I watched someone spend hours doing (ii) with Word, which doesn't feel right at all. To what extent do people feel that "casual grade" unix or Perl knowledge to this sort of level is useful in network operations? Even if experts are available, I wouldn't like to think it's necessary to disturb them for this sort of thing. Is it reasonable, when trying to sell some non-programmers on the idea that basic scripting is useful and possible, to deliberately omit -w, use strict, die, syslog and similar? In a 3-6 line script, that kind of stuff would take up more space than the actual "meat" and risk going against my "this isn't so hard, really" message. If forced to do (i)-(iv) without using scripting of any kind, I'd become quite annoyed. To be fair, (iv) clearly has to be scripted. Are there other reasonable non-scripting methods of doing (i)-(iii)? NB I'm not planning on claiming perl is uniquely wondrous. I just don't know enough tcl, python, ruby or rexx to show anyone how to do anything with them - and my own experience has been that you can use expect without knowing any tcl except some "lindex" stuff to read command-line parameters in. Does what I propose seem more useful or dangerous? I think my main aim is to show useful non-artificial examples as quickly as possible. Talking about loop structures, scalars vs arrays vs hashes etc. seems like exactly the wrong way to do. It seems to me that while (<>) { (stuff) } can be used as the basis of useful stuff. (Also, one of the main messages would be that the most important skill is taking an existing script and tweaking it, even if you don't know how some of it works.) Of course, I'd tell people that knowing other features as well might allow more to be done, but I wouldn't want to push people into using modules, objects, references, etc. -- Adam Atkinson (ghira(a)mistral.co.uk) Do not look into laser with remaining eye.

3 2

Re: Very large JoeJob in progress against Spamcop (fwd)
by J.A. Terranson 07 Sep '02

07 Sep '02

---------- Forwarded message ---------- Date: Sat, 7 Sep 2002 10:41:54 -0400 From: Ellen <deputies(a)admin.spamcop.net> To: J.A. Terranson <measl(a)mfn.org> Subject: Re: Very large JoeJob in progress against Spamcop (fwd) Thanks for the CC of your email to valueweb! Ellen ----- Original Message ----- From: "J.A. Terranson" <measl(a)mfn.org> To: <appeals(a)admin.spamcop.net> Sent: Saturday, September 07, 2002 9:53 AM Subject: Very large JoeJob in progress against Spamcop (fwd) > > > ---------- Forwarded message ---------- > Date: Sat, 7 Sep 2002 08:51:00 -0500 (CDT) > From: J.A. Terranson <measl(a)mfn.org> > To: incidents(a)securityfocus.com > Cc: abuse(a)valueweb.com, abuse(a)spamcop.net > Subject: Very large JoeJob in progress against Spamcop > > > I have received a boatload of these, from a Valueweb customer > impersonating Julian Haight/SpamCop. The subject lines vary among a > fixed list, including the below "Spam from your network", "Spamcop is > watching you", "Spamcop will shut down your website", etc. > > Valueweb is a home-user DSL provider, and the origin IP of these is > clearly not SpamCop. > > Yours, > > J.A. Terranson > sysadmin(a)mfn.org > > ---------- Forwarded message ---------- > Return-Path: <abuse(a)spamcop.net> > Received: from spamcop.net ([64.70.191.50]) > by cliff.mfn.org (8.11.1/8.9.3) with SMTP id g87AKkc12347 > for <abuse(a)convictedchildmolesters.org>; Sat, 7 Sep 2002 05:20:47 -0500 (CDT) > (envelope-from abuse(a)spamcop.net) > Message-Id: <eg1oqcdsl67apkbd.6l7i2p113n0(a)spamcop.net> > Reply-To: spam.reporting(a)reports.spamcop.net > To: abuse(a)convictedchildmolesters.org > X-Mailer: X-Mailer: Web Based Pronto > From: abuse(a)spamcop.net > MIME-Version: 1.0 > X-Encoding: MIME > Content-Type: multipart/alternative; > boundary="----=_NextPart_38663300828774" > Date: Sat, 07 Sep 2002 06:25:28 -0500 > Subject: Spam from your network > > SpamCop.net - protecting the internet through technology > > > Why Am I Getting This Email? > > You have recieved this email because spamcop.net has had recent complaints related to your network (convictedchildmolesters.org) > > > What Types of complaints? > > Open mail ports, violations of our acceptable use polices, and other various complaints. EMail us for specifics... > > > What do I need to do? > > Close any open relays on your network, enforce a anti spam A.U.P. (Acceptable USse Policy), and shut down abusive users. > > SpamCop's original spam reporting service will help you report spam quickly and accurately. Or choose from a variety of filtering options ranging from the easiest web-mail account to advanced network-wide spam blocking. > > Accused of spamming? > > Answers to most common questions. Like: My email was blocked! SpamCop got it wrong! How can I fix it? Falsely accused? What is spam? Find help here for internet and hosting providers, small and large-scale bulk mailers and advertisers. > > > Other Questions or Comments? > > SpamCop has several dedicated (and spam-free) news groups where you can get help, suggest new features or report bugs. Or you can search the entire site, FAQ and all support-forum content in one place. > > > Reporting and Filtering Options.. > > VISIT http://spamcop.net > > > > Copyright (c) 1998-2002 Julian Haight, All rights reserved. jane42(a)mail.julianhaight.com > > > >

2 1

Re: Vulnerbilities of Interconnection
by sgorman1＠gmu.edu 07 Sep '02

07 Sep '02

You also have the problem of cascading failures. Just because there are redundant paths and alternate peering locations does not mean those facilites have the bandwidth to handle all the redirected traffic. If A gets swamped you go to B if the redrected traffic is to much for B then you go to C and so on - each time the amount of traffic increases and the avialble bandwidth decreases. According to the analysis I've seen and run on the the Baltimore incident this is the jest of how a few cut lines rippled across the Internet. I would think Alex's scenario would have a bigger impact than that incident. sean ----- Original Message ----- From: alex(a)yuriev.com Date: Friday, September 6, 2002 10:29 am Subject: Re: Vulnerbilities of Interconnection > > > > > > > Lets bring this discussion to a some common ground - > > > > > > What kind of implact on the global internet would we see > should we observe > > > nearly simultaneous detonation of 500 kilogramms of high > explosives at N of the > > > major known interconnect facilities? > > > > N? Well, if you define N as the number of interconnect > facilities, such > > as all the Equinix sites > > Lets say that N is 4 and they are all in the US, for the sake of the > discussion. > > > (and I'm not banging on Equinix, it's just > > where we started all this) then I think globally, it wouldn't > make that > > much difference. People in Tokyo would still be able to reach > the globe > > and both coasts of the US. > > This presumes that the networks peer with the same AS numbers > everywhere in > the world, which I dont think they do. > > The other thing to think about is that the physical transport will be > affected as well. Wavelenth customers will lose their paths. Circuit > customers that rely on some equipment located at the affected > sites, losing > their circuits. > > Alex > > >

2 1

JoeJob against Spamcop: Update
by J.A. Terranson 07 Sep '02

07 Sep '02

Having now received *thousands* of these gems from Valueweb, I finally called them... They ack'd being aware of this issue, however, they were under the impression it has been "resolved" (which, oddly enough, did not include the killing of the responsible user). They claimed this IP would be killed immediately, so if anyone gets any of these with a timestamp after this email, you need to contact Valueweb: +1-954-334-8080. ---------- Forwarded message ---------- Return-Path: <webmaster(a)spamcop.net> Received: from mx2.spamcop.net ([64.70.191.50]) by cliff.mfn.org (8.11.1/8.9.3) with SMTP id g87K6Ac14571 for <info(a)anthraxtheater.org>; Sat, 7 Sep 2002 15:06:10 -0500 (CDT) (envelope-from webmaster(a)spamcop.net) From: webmaster(a)spamcop.net To: info(a)anthraxtheater.org Reply-To: spam.reporting(a)reports.spamcop.net Message-Id: <4i37rkb0j84p312.6fsw4j814skj(a)mx2.spamcop.net> MIME-Version: 1.0 X-Encoding: MIME Content-Type: multipart/alternative; boundary="----=_NextPart_468383874800666524434" X-Mailer: X-Mailer: Microsoft Outlook Express 5.00.2615.200 Subject: Your network is being compromised Date: Sat, 07 Sep 2002 16:10:52 -0500 SpamCop.net - protecting the internet through technology Why Am I Getting This Email? You have recieved this email because spamcop.net has had recent complaints related to your network (anthraxtheater.org) What Types of complaints? Open mail ports, violations of our acceptable use polices, and other various complaints. EMail us for specifics... What do I need to do? Close any open relays on your network, enforce a anti spam A.U.P. (Acceptable USse Policy), and shut down abusive users. SpamCop's original spam reporting service will help you report spam quickly and accurately. Or choose from a variety of filtering options ranging from the easiest web-mail account to advanced network-wide spam blocking. Accused of spamming? Answers to most common questions. Like: My email was blocked! SpamCop got it wrong! How can I fix it? Falsely accused? What is spam? Find help here for internet and hosting providers, small and large-scale bulk mailers and advertisers. Other Questions or Comments? SpamCop has several dedicated (and spam-free) news groups where you can get help, suggest new features or report bugs. Or you can search the entire site, FAQ and all support-forum content in one place. Reporting and Filtering Options.. VISIT http://spamcop.net Copyright (c) 1998-2002 Julian Haight, All rights reserved. jane42(a)mail.julianhaight.com

1 0

SpamCop Forgeries
by Marius Strom 07 Sep '02

07 Sep '02

FYI, for those of you who get worried when you see mail from spamcop hitting your postmaster addresses: http://www.julianhaight.com/forgery.shtml It may be forged. -- /-------------------------------------------------> Marius Strom | Always carry a short length of fibre-optic cable. Professional Geek | If you get lost, then you can drop it on the System/Network Admin | ground, wait 10 minutes, and ask the backhoe http://www.marius.org/ | operator how to get back to civilization. \-------------| Alan Frame |---------------------->

1 0

Re: How about a game of chess? (was Re: Vulnerbilities of Interconnection)
by sgorman1＠gmu.edu 06 Sep '02

06 Sep '02

Actually I do not know how to play chess maybe *Risk*, but your point is well taken. The intent is not provide a public recipe for taking down the Internet, that would be the opposite goal of the research to begin with. Regardless it is difficult line to tread and it is best to err on the side of caution. As for sampling biases - that is why it is only anecdotal evidence and the need for it to be questioned. Reports of Vinny accidently announcing his router as AS701 do not make it to the media very often. That aside the suggestion of how to model the Internet are very useful and the closer these models can get to operational reality the better. The intent being methodology not revealing data. Waites' approach is a good first step, but what next. Also if you know capacties how do you model a cascading effect that encompasses intra- network and inter-network traffic flows. Also it might be easier to calculate transition probabilities by summing across the rows of the adjaceny matrix then dividing the row components by the sum. ----- Original Message ----- From: Sean Donelan <sean(a)donelan.com> Date: Friday, September 6, 2002 12:52 pm Subject: How about a game of chess? (was Re: Vulnerbilities of Interconnection) > > On Thu, 5 Sep 2002 sgorman1(a)gmu.edu wrote: > > Is there a general consensus that cyber/internal attacks are more > > effective/dangerous than physical attacks. Anecdotally it seems the > > largest Internet downages have been from physical cuts or failures. > > I think you have a sampling bias problem. > > The "biggest" national/international network disruptions have > generallybeen the result of operator error or software error. Its > not always easy > to tell the difference. It may be better for carrier PR spin > control to > blame a software/router/switch vendor. > > Until recently physical disruptions have been due to causes which > don'teffect the stock price, carriers were more willing to talk > about them. > Carriers usually don't fire people due to backhoes, hurricanes, > floods, or > train derailments. > > What does this say about the effect of an external or internal > cyber-attack? > > Not much. Naturally occuring physical and procedural disruptions have > different properties than a directed attack. Not the least is > hurricanesand trains don't read NANOG, and generally don't alter > their behavior > based on the "recommendations" posted. > > Wouldn't you prefer a good game of chess? > > >

3 3

Re: Vulnerbilities of Interconnection
by sgorman1＠gmu.edu 06 Sep '02

06 Sep '02

Quite a few researchers have looked at the topology of AS interconnection. They have found that AS connectivity follows a power law - i.e. the vast majority have a few connections while a small minority has the majority of connections. Same as an earthquake - most are small and not noticable but a few are huge, smash a boulder and you get the same thing. Lots of dynamic networks follow this topology. The upside is that they are incredibly robust to random failures but very susceptible to targeted failures. For details see: http://www.physicsweb.org/article/world/14/7/09 ----- Original Message ----- From: Jared Mauch <jared(a)puck.Nether.net> Date: Friday, September 6, 2002 2:20 pm Subject: Re: Vulnerbilities of Interconnection > > On Fri, Sep 06, 2002 at 01:55:40PM -0400, batz wrote: > > On Fri, 6 Sep 2002, Pawlukiewicz Jane wrote: > > :would be difficult to reach. I'd have to run a model to be > sure, but > > :every one of the major seven have rerouting methodologies that > would> :recover from the loss. And I don't think they exclusively > peer at > > > > ASN's to "fail", then see who is still connected, but we are > > still dealing with connectivity relatve to us and our peers, > > even 5+ AS-hops away. > > > > I would imagine this is one of the tasks CAIDA.org is probably > > working on, as it seems to fall within their mission. > > Coming up with the as interconnection data is actaully fairly > easy if you parse route-views data. This obviously doesn't cover > every possible interconnection that exists but it does provide > a large swath of data to review for the interconnection > postulation. > > Looking at that data, (this is an old snapshot) the top ten > networks are: (in #10->#1 order) > > conn ASN > ----+---- > 161 3356 > 229 1 > 242 2914 > 248 209 > 274 6461 > 277 3561 > 295 3549 > 328 7018 > 484 701 > 493 1239 > > - Jared > > -- > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > clue++; | http://puck.nether.net/~jared/ My statements are > only mine. > >

1 0

Re: Vulnerbilities of Interconnection
by sgorman1＠gmu.edu 06 Sep '02

06 Sep '02

The question is what if someone was gunning for your fiber. To date cuts have been unintentional. Obviously the risk level is much higher doing a phyisical attack, but the bad guys in this scenario are not teenage hackers in the parents basement. There is a good foundation of knowledge on the implications of cyber attacks, but the what-if of an intentional physical attack is an important question I believe. The context in this discussion has been very valuable and many thanks to everyone that has offered opinions. ----- Original Message ----- From: Dave Israel <davei(a)algx.net> Date: Thursday, September 5, 2002 3:50 pm Subject: Re: Vulnerbilities of Interconnection > > The thing is, the major cuts are not "attacks;" the backhoe operators > aren't gunning for our fiber (no matter how much it seems like they > are). If I wanted to disrupt traffic, intentionally and maliciously, > I would not derail a train into a fiber path. Doing so would be very > difficult, and the legal ramifications (murder, destruction of > property, etc, etc) are quite clear and severe. However, if I > ping-bomb you from a thousand "0wn3d" PCs on cable modems, I never had > to leave my parents' basement, I'm harder to trace by normal police > methods, and the question of which laws that can be applied to me is > less clear. > > -Dave > > On 9/5/2002 at 15:38:56 -0400, sgorman1(a)gmu.edu said: > > > > "Again, it seems more likely and more technically effective to > attack > > internally than physically. Focus again here on the cost/benefit > > analysis from both the provider and disrupter perspective and > you will > > see what I mean." > > > > Is there a general consensus that cyber/internal attacks are > more > > effective/dangerous than physical attacks. Anecdotally it seems > the > > largest Internet downages have been from physical cuts or failures. > > > > 2001 Baltimore train tunnel vs. code red worm (see keynote report) > > 1999 Mclean fiber cut - cement truck > > AT&T cascading switch failure > > Utah fiber cut (date??) > > Not sure where the MAI mess up at MAE east falls > > Utah fiber cut (date??) > > > > Then again this is the biased perspetive of the facet I'm > researching> > > Secondly it seems that problems arise from physical cuts not > because > > of a lack of redundant paths but a bottlneck in peering and > transit - > > resulting in ripple effects seen with the Baltimore incident. > > > > > > > > ----- Original Message ----- > > From: "William B. Norton" <wbn(a)equinix.com> > > Date: Thursday, September 5, 2002 3:04 pm > > Subject: Re: Vulnerbilities of Interconnection > > > > > > > > At 02:45 PM 9/5/2002 -0400, alex(a)yuriev.com wrote: > > > >This obviously would be a thesis of Equinix and other collo > space > > > providers,>since this is exactly the service that they > provide. It > > > won't, hower, be a > > > >thesis of any major network that either already has a lot of > > > infrastructure>in place or has to be a network that is > supposed to > > > survive a physical > > > >attack. > > > > > > Actually, the underlying assumption of this paper is that > major > > > networks > > > already have a large global backbone that need to interconnect > in > > > n-regions. The choice between Direct Circuits and Colo-based > cross > > > connects > > > is discussed and documented with costs and tradeoffs. > Surviving a > > > major > > > attack was not the focus of the paper...but... > > > > > > When I did this research I asked ISPs how many Exchange Points > > > they felt > > > were needed in a region. Many said one was sufficient, that > they > > > were > > > resilient across multiple exchange points and transit > > > relationships, and > > > preferred to engineer their own diversity separate from > regional > > > exchanges. > > > A bunch said that two was the right number, each with > different > > > operating > > > procedures, geographic locations, providers of fiber, etc. , > as > > > different > > > as possible. Folks seemed unanimous about there not being more > > > than two > > > IXes in a region, that to do so would splinter the peering > > population. > > > > > > Bill Woodcock was the exception to this last claim, positing > > > (paraphrasing) > > > that peering is an local routing optimization and that many > > > inexpensive > > > (relatively insecured) IXes are acceptable. The loss of any > one > > > simply > > > removes the local routing optimization and that transit is > always > > > an > > > alternative for that traffic. > > > > > > > > > > > > A couple physical security considerations came out of that > > > research:> > 1) Consider that man holes are not always > secured, > > > providing access to > > > > > metro fiber runs, while there is generally greater > security > > within > > > > > colocation environments > > > > > > > >This is all great, except that the same metro fiber runs are > used > > > to get > > > >carriers into the super-secure facility, and, since neither > those > > who > > > >originate information, nor those who ultimately consume the > > > information are > > > >located completely within facility, you still have the same > > > problem. If we > > > >add to it that the diverse fibers tend to aggregate in the > > > basement of the > > > >building that houses the facility, multiple carriers use the > same > > > manholes>for their diverse fiber and so on. > > > > > > Fine - we both agree that no transport provider is entirely > > > protected from > > > physical tampering if its fiber travels through insecure > > > passageways. Note > > > that some transport capacity into an IX doesn't necessarily > travel > > > along > > > the same path as the metro providers, particularly those IXes > > > located > > > outside a metro region. There are also a multitude of paths, > > > proportional > > > to the # of providers still around in the metro area, that > provide > > > alternative paths into the IX. Within an IX therefore is a > > > concentration of > > > alternative providers, and these alternative providers can be > > > used as > > > needed in the event of a path cut. > > > > > > > > > > > 2) It is faster to repair physical disruptions at fewer > > > points, leveraging > > > > > cutovers to alternative providers present in the > collocation > > > IX model, as > > > > > opposed to the Direct Circuit model where provisioning > additional> > > > capacities to many end points may take days or > months.> > > > > > >This again is great in theory, unless you are talking about > > > someone who > > > >is planning on taking out the IX not accidently, but > > > deliberately. To > > > >illustrate this, one just needs to recall the infamous fiber > cut > > > in McLean > > > >in 1999 when a backhoe not just cut Worldcom and Level(3) > > > circuits, but > > > >somehow let a cement truck to pour cement into Verizon's > manhole > > > that was > > > >used by Level(3) and Worldcom. > > > > > > Terrorists in cement trucks? > > > > > > Again, it seems more likely and more technically effective to > > > attack > > > internally than physically. Focus again here on the > cost/benefit > > > analysis > > > from both the provider and disrupter perspective and you will > see > > > what I mean. > > > > > > > > > >Alex > > > > > > > > > > > > > -- > Dave Israel > Senior Manager, DNE SE > >

7 7

Re: IP address fee??
by Dave Israel 06 Sep '02

06 Sep '02

On 9/6/2002 at 13:18:54 -0400, Richard A Steenbergen said: > And half the internet's users type "u r kewl", and think that ethernet is > a broadband connection. > > Just because a misconception is popular doesn't mean we should indulge it. > :) > > Think of it as a public service, if you make an effort to say "/24", and > someone asks and you explain it, thats one less confused person > circulating around teaching others. Think of it as a service towards your own future, too. An awful lot of the new protocols and services arise out of college environments, and hence the proliferation of protocols that work fine in a campus network but somehow just don't fly in the "real" world.

1 0

Re: IP address fee??
by Ted Fischer 06 Sep '02

06 Sep '02

At 12:42 PM 9/6/02 -0400, you wrote: >Was this reply directed at me, particularly? > > >Joe Joe, Most definitely not. I felt that the two comments I included most closely represented the discussion and information I wanted to pass. No offense meant, I hope none taken, apologies if they were. Ted >On Fri, Sep 06, 2002 at 12:33:09PM -0400, Ted Fischer wrote: > > At 10:00 AM 9/6/02 -0400, Joe Abley postulated: > > > > >On Thu, Sep 05, 2002 at 01:13:27PM -0500, Stephen Sprunk wrote: > > >> Because "Cee" is easier to pronounce than "slash twenty-four". Ease of > > >use > > >> trumps open standards yet again :) > > > > > >Nobody was talking. "/24" is easier to type than "class C". No > > >trumps! Everybody loses! > > > > > >How many people learn about networks from certification courses or > > >in school, anyway? It was always my impression that people learnt > > >mainly by listening to other people. > > > > > >If networking on the front lines is an informal oral tradition more > > >than it is a taught science, then perhaps it's natural for obsolete > > >terminology to continue to be "taught" long after it stopped having > > >any relevance. > > > > > > > > >Joe > > > > The class of an address is determined by the bit-pattern of the first > > octet of the address. 10.0.0.0 will always be a Class A > > address. 172.16.0.0 will always be a Class B address, and 192.168.0.0 > will > > always be Class C address. I'm not aware of any RFC that rescinded the > > definition of the Class of an address. > > > > Masks, when associated with an address, enable one to determine (a), > > what network I'm on (if I'm an IP host) or (b) how many addresses exist > > within a given range of addresses (if I'm a routing table). > > > > Subnetting (robbing mask host bits (0's) to make network bits (1's) > > allowed one to more effectively use the decreasing amounts of networks > that > > required less than the default number of addresses (65,536 in the case > of a > > Class B) by more effeciently using the space one had been allocated. With > > subnetting, I can take one Classful network and make many (sub)networks > > from it. There was no way prior to 1993, however, to effectively > represent > > the range of addresses in more than one Classful network. > > > > CIDR, simply stated, says that one can use any address with any mask, > > regardless of the original class of the address, to represent a range of > > addresses (i.e. rob network bits to make host bits). It allows the > > properties of IP to be more effectively used for IP host addressing (only > > need a /23 to support 400 IP hosts (a very effecient 78% use of the > > allocated space), as well as (one of the original, primary reasons for > > CIDR) aggregate ("Supernet") "X" traditional Class C's into one routing > > statement (who today would advertise delivery to the range of 4,096 > > addresses from, for example, 192.168.192.0 through 192.168.207.255 with 16 > > individual traditional Class C statements?). > > > > Since NANOG is "the front line", then perhaps that is where the oral > > tradition should be teaching the history of IP addressing, from Classful > > addressing (default masks) to Subnetting (other than default) to > > Supernetting (ranges of addresses regardless of original - or legacy if > you > > will - class (Classless)). > > > > The prefix, of course, does not refer to the class of the address, but > > the number of contiguous ones in the mask. As far as pronounciation goes, > > I prefer "slash 24" to "two fifty five dot two fifty five dot two fifty > > five dot zero" :) > > > > $.02 > > > > Ted Fischer > >

1 0