January 2003 - Test - lists.nanog.org

RE: Routing preferences question
by Senkow, John - CIPS 30 Jan '03

30 Jan '03

Depending on the scale of what you are trying to accomplish, you can also change the prefix length of the route. If you have a local static route that is a /20, you can route two /21's in OSPF. Most of the suggestions I have seen are options, but other mechanisms should be used because the scalability of these solutions are very limited. John Senkow -----Original Message----- From: Timothy R. McKee [mailto:tim@baseworx.net] Sent: Thursday, January 30, 2003 9:00 AM To: nanog(a)merit.edu Subject: RE: Routing preferences question You have to change the admin distances. Unfortunately for you, I don't think there is a way to change the admin distance for a connected interface which has a default of zero. Anyone know of a selective way to do that? OSPF is 110 by default, statics are 1 by default, but you can set their distance on a per route basis, 'ip route x.x.x.x y.y.y.y v.v.v.v distance'. What exactly are you trying to do? There may be other mechanisms to accomplish what you want. Tim McKee -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of william(a)elan.net Sent: Thursday, January 30, 2003 2:38 To: nanog(a)merit.edu Subject: Routing preferences question Hi, Does anybody know how/if I can force cisco router to consider ospf route (I'll consider other igp protocol if its possible) from particular source to be prefereble over connected and locally-entered static routes. This is needed for failover project I'm doing. Please note that especially big question is with "connected" route through subinterface, which I can't find any way to override with igp, for static I could at least make them learned igp routes. I'd apprecitate to know how somebody has done something this or at least find for sure that its impossible. If it matters, I'm trying to do it on 7500 running 12.0 ios and interfaces are ethernet isl vlans. --- William Leibzon Elan Communications william(a)elan.net

1 0

routing between provider edge and CPE routers
by Mike Bernico 30 Jan '03

30 Jan '03

Hi, I apologize if this has been asked before. I work for an ISP that started very small (hundreds of T1 and 56k customers) and has grown very large in the last few years (thousands of T1 customers, as well as DS3 customers and OC3 customers). We currently use an IGP to route between our distribution routers and the CPE routers we manage. This has historically worked very well. We have recently begun running into scalability issues however. We have some distribution routers that have over 1000 T1 interfaces on them. This is causing some problems with stability in that edge IGP. Does any other service provider use an IGP all the way to the customer for non BGP customers or are we the only one? I have a feeling we maybe are. If you do use an IGP, have you had any of the scalability issues we have had? How did you fix them? If you use statics/BGP to CPE routers have you had any issues doing that? In particular I'm wondering about the thousands of lines of configuration used to make static routes work. Thanks in advance for your advice. Mike Bernico

7 6

.org whois
by alex＠yuriev.com 30 Jan '03

30 Jan '03

Is there a new top-level whois server or did shared registry whois stop providing references to the appropriate whois servers for .org? At least a pair of domain registars cannot adjust any .org records claiming that the domains not exist. Alex --

15 18

Re: .org whois
by Roger Marquis 30 Jan '03

30 Jan '03

Jeff Godin wrote: > whois -h whois.publicinterestregistry.net unibrow.org Either that or "whoiss unibrow.org". <plug> Whoiss is wrapper for Unix' whois. It performs lookups for any number of domains, netblocks, handles, IPs, ... on a single command line without specifying the TLD server. It's available at <http://www.roble.com/docs/whoiss>. </plug> -- Roger Marquis Roble Systems Consulting http://www.roble.com/

1 0

Re: What could have been done differently?
by Steven M. Bellovin 30 Jan '03

30 Jan '03

In message <20030129014651.GB80965(a)darkuncle.net>, Scott Francis writes: > >There's a difference between having the occasional bug in one's software >(Apache, OpenSSH) and having a track record of remotely exploitable >vulnerabilities in virtually EVERY revision of EVERY product one ships, on >the client-side, the server side and in the OS itself. Microsoft does not >care about security, regardless of what their latest marketing ploy may be. >If they did, they would not be releasing the same exact bugs in their >software year after year after year. They do have a lousy track record. I'm convinced, though, that they're sincere about wanting to improve, and they're really trying very hard. In fact, I hope that some other vendors follow their lead. My big worry isn't the micro-issues like buffer overflows -- it's the meta-issue of an overall too-complex architecture. I don't think they have a handle on that yet. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

16 21

https man in the middle [was: routing between provider edge and C PE routers]
by Martin Renschler (EWU) 30 Jan '03

30 Jan '03

It's even worse, a fake certificate from a man in the middle causes a trustworthy warning! If a certificate is not co-signed by any of the Browser compiled-in authorities, the Browsers will just ask: "...do you want to trust <company>". The hacker is completely free to fill in <company> when he creates his own certificate on the server side (using plain openssl). This will be the only popup as the fake certificate will match the faked URL. Did M$ expect people to say "no" to the fake question "Do you want to trust Citibank" when they are in fact trying to connect to the real Citibank site? The default behavior of a browser should be to reject unsigned certificates and not even ask the question. Currently, there is even no warning that <company> was learned from an unsigned certificate. /Martin (disclaimer... does not necessarily reflect the opinion of my employer...) > Even supposedly secure things like SSL-protected websites and SSH logins > are vulnerable due to the simple fact that most people won't think twice > to say "yes" to SSH complaining that it detected a new host key; or notice > that they're really talking to a different website (or that the lock icon > is not showing) - if it looks the same, and its URL is similar-looking > (l->1, O->0, etc; and with newish Unicode URLs the fun is unlimited).

1 0

RE: routing between provider edge and CPE routers
by Ray Burkholder 30 Jan '03

30 Jan '03

A few I've found but not tried out yet: OpenSource: http://www.freeipdb.org/ http://www.brownkid.net/NorthStar/ Windows: http://myips.dzoul.com/main.asp http://www.enterpriseip.net/ I make no promises as to applicability or suitability. www.sourceforge.net www.freshmeat.net These two sites might yield some more hits. -----Original Message----- From: Vadim Antonov [mailto:avg@kotovnik.com] Sent: January 29, 2003 21:50 To: Mike Bernico Cc: nanog(a)merit.edu Subject: RE: routing between provider edge and CPE routers On Wed, 29 Jan 2003, Mike Bernico wrote: > Is there someplace I can find tidbits of information like this? I > haven't been alive decades so I must have missed that memo. Other than > this list I don't know where to find anyone with lots of experience > working for a service provider. Well, this list... in the old archives. The current backbone design issues were pretty much tossed around in 93-94, the "defensive networking" concept included. > I've never heard of software like that. Do you have a recommended > vendor? Is it typically developed in house? There's no sustainable market for those, so they're always home-built... Often it is just a collection of scripts and some RCS to keep configs in. > What can I say, I must work cheap! :) --vadim

1 0

RE: routing between provider edge and CPE routers
by Mike Bernico 30 Jan '03

30 Jan '03

> So, by accepting routes from CPE you create a huge security vulnerability > for your customers, and other parties. This practice was understood as a > very bad network engineering for decades. Is there someplace I can find tidbits of information like this? I haven't been alive decades so I must have missed that memo. Other than this list I don't know where to find anyone with lots of experience working for a service provider. > 1) for single-homed sites use static routing, period. Dynamic routing > does not add anything useful in this case (if circuit is down, it's down, > there are no alternative ways to reach the customer's network). I agree, and all the feedback I've gotten should help me convince my peers. > The "convinience" of having to configure only CPE box is no excuse. Invest > some resources in a rather trivial configuration management system, which > keeps track of what network addresses were allocated to which customer, > and produces corresponding bits of router configuration automatically. > Most respectable ISPs did that long time ago. That will also reduce your > tech support costs. I've never heard of software like that. Do you have a recommended vendor? Is it typically developed in house? > PS. They should really require a test in "defensive networking" before > letting anyone to touch provider's routers... What can I say, I must work cheap!

2 1

Re: Bell Labs or Microsoft security?
by Mathew Lodge 30 Jan '03

30 Jan '03

At 07:32 PM 1/29/2003 +0000, E.B. Dreger wrote: >s/compiler/programmer/ > >Now write programs to toss around buf_t* instead of char*. It's >not that difficult. No, it isn't, as is doing buf_t[x] rather than pointer arithmetic, but the *practical* problem is that you really need 1,$s/compiler/programmer/ :-) In other words, there are far fewer compilers, interpreters, Java Virtual Machines, libraries etc. in use than there are programmers using them. So working the tools angle gives you leverage across far more programmers and the programs they create. Cheers, Mathew

2 1

RE: Blocked by msn.com MX, contact for MSN.COM postmaster ?
by Mark Segal 29 Jan '03

29 Jan '03

Have you tried abuse(a)msn.com.. maybe abuse(a)hotmail.com (they could forward you).. They are quite responsive (hotmail, abuse), at least from a hotmail address :). mark -- Mark Segal Director, Data Services Futureway Communications Inc. Tel: (905)326-1570 > -----Original Message----- > From: Mark E. Mallett [mailto:mem@mv.mv.com] > Sent: January 29, 2003 5:44 PM > To: Miquel van Smoorenburg > Cc: nanog(a)merit.edu > Subject: Re: Blocked by msn.com MX, contact for MSN.COM postmaster ? > > > > On Tue, Jan 28, 2003 at 11:49:16AM +0000, Miquel van > Smoorenburg wrote: > > > > I found out that our outgoing SMTP servers have been blocked by the > > msn.com MXes. In a nasty way, too -- no SMTP error, the TCP > connection > > is simply closed by them immidiately after establishing it. > We're not > > listed on any RBL/DNSBL and have an active abuse desk. > > > > I mailed postmaster(a)msn.com, msnhst(a)msn.com, noc(a)microsoft.com, but > > didn't get a reply from any of them. Does anyone here know > who to talk > > to ? > > I'd be interested in knowing what you find out. We observed > the same thing a while ago from one of our mail servers-- but > just one. Connection drops immediately, no clue given as to > why. However, from another mail server just a few IP numbers > away (in the same /24), the connection goes through just > fine. The workaround was obviously to configure the first > mail server to relay mail for msn.com via the second one, and > to try to get Microsoft to tell us what was up. No luck on > that last front though. > > -mm- >

1 0