October 2003 - Test - lists.nanog.org

Re: IAB concerns against permanent deployment of edge-based filtering
by bmanning＠karoshi.com 18 Oct '03

18 Oct '03

> >> why the heck does the IAB think they should tell me how to run my > >> network? > > > > ... part of the INTERnet, and we > > would like it all to interoperate end to end. that must be the royal "we"... > > you have been here > > long enough to remember when the internet was a cooperation between > > operators, yes? Sure. and why the ARPAnet evolved into MILnet/CSnet/BITnet, the NSF regionals, NSI et.al. That whole "trust but verify" threat model. And then the "evolution" into more specialized architectures, w/ folk focusing on edge & core - content and eyeballs etc. > Absolutely correct. What I personally am afraid of is if we get a > network where we by choice (yes, your choice as the operator) get > vertically oriented services instead of horisontal. Where you only can > connect to a service if you get IP packets of a specific flavor from a > specific ISP. here in is the nut. Internet Protocols should, by design, presume a fully end2end, always on model. Packets should be emitted w/ the presumption that they can reach their target. If not, its not reachable. period. If my node is in a MANET, then I should be able to reach all the nodes in that MANET. If its on Mars, then DTN should take care of packet delivery. If the transit ISP filters my prefix and throws the bits on the floor, I should complain. If the transit ISP filters the port and throws the bits on the floor, I should complain. But that is the transit ISP choice. Local Optimizations - trying to be smart about what is reachable over what transport by some "middle-box" - that is harmful. Operationally, I may chose to take links down, filter out some traffic, groom for specific network performance -over infrastructure i pay for- the whole "middle-box, firewall, NAT, or generic tunneling techniques are in play to allow end-users to circumvent network policy ... and that is bad. if there is really a concern that port filtering is inherently bad and should only be exercised as a temporary expediant, then why not open up all ports on the end systems? blocking ports 5, 7, 9, 11 and 19 are fairly common these days. is the IAB seriously suggesting that ISPs remove the filters on/for these ports? I'll stand by this mantra for -EDGE- networks: "allow what you use, block what you don't." when new, inovative applications evolve, I expect they should have thier own port(s) assigned, just like has occured in the Internet over the last 25 years. and if they are useful to the folks on my network, the ports will be opened up. stuff that tunnels w/o authorization, will be found and squashed. > The INETRnet works because as soon as you get IP packets from The > INTERnet somewhere, you can access any service which runs on top of IP > because of the transparent peering/transit agreements which exists. But where is the presumption made that -operationally- all transport substrates are interconnected? > Because of this, it is a bad thing, and really the start of a very > slippery slope, if AS:es start filtering at their edges. It can be done > for various practical reasons in short term (as you say, you are > responsible for YOUR network, YOUR part of The INTERnet), but as a long > term thing, nope. You might want to consider why EGP protocols were built in the first place... :) EGP/BGP have -policy- constraints designed in to restrict traffic. > paf -- speaking personally, but member of the IAB --bill -- speaking as devils advocate and w/o having taken my meds today. ... granted it is nice to see the IAB take an interest and take a stance. I'm more afraid that such a document will aquire the patina of "gospel" by ISPs who won't think for themselves as to why some choices should be made.

2 1

AOL E.mail issues..
by Robert Mathews 18 Oct '03

18 Oct '03

Is anyone experiencing E.mail weirdness, specifically bounces from AOL today at all? I have spoken to a number of others from various parts of CONUS, who seem to have a similar issue.. Regards.

4 4

/8 blocks allocation statistcs and current use data
by william＠elan.net 18 Oct '03

18 Oct '03

As by-product of bogons project I just posted about, we also got some interesting statistics on how much ip space is allocated and used in each /8 block. This is all available in nice graphical format at: http://www.completewhois.com/statistics/ip_statistics.htm The data above is updated every day and I'm also entering this all into rrd database and once I have enough samples rrd graphs of how much this statistics change will also be made available (but before such graphs provide really good view there must be year worth of samples or more...) -- William Leibzon Elan Networks william(a)elan.net

2 3

as6198 aggregation event
by James Cowie 18 Oct '03

18 Oct '03

On Friday, we noted with some interest the appearance of more than six hundred deaggregated /24s into the global routing tables. More unusually, they're still in there this morning. AS6198 (BellSouth Miami) seems to have been patiently injecting them over the course of several hours, between about 04:00 GMT and 08:00 GMT on Friday morning (3 Oct 2003). Here's a quick pic: http://www.renesys.com/images/6198.gif I can share more details offline. Usually when we see deaggregations, they hit quickly and they disappear quickly; nice sharp vertical jumps in the table size. This event lasted for hours and, more importantly, the prefixes haven't come back out again, an unusual pattern for a single-origin change that effectively expanded global tables by half a percent. Can anyone share any operational insight into the likely causes of this event? Has it caused any operational problems for anyone? Thanks! ---------- James Cowie Renesys Corporation

8 11

[Fwd: [IP] VeriSign to revive redirect service]
by Suresh Ramasubramanian 18 Oct '03

18 Oct '03

Ouch. -------- Original Message -------- Subject: [IP] VeriSign to revive redirect service Date: Thu, 16 Oct 2003 02:38:14 -0400 From: Dave Farber <dave(a)farber.net> Reply-To: dave(a)farber.net To: ip(a)v2.listbox.com Delivered-To: dfarber+(a)ux13.sp.cs.cmu.edu Date: Wed, 15 Oct 2003 23:30:44 -0700 (PDT) From: Joseph Lorenzo Hall <jhall(a)SIMS.Berkeley.EDU> Subject: VeriSign to revive redirect service To: Dave Farber <dave(a)farber.net> --- http://news.com.com/2100-1038_3-5092133.html VeriSign to revive redirect service by Declan McCullagh VeriSign will give a 30- to 60-day notice before resuming a controversial and temporarily suspended feature that redirected many .com and .net domains, company representatives said Wednesday. Speaking before an unusual gathering of technical experts in Washington, D.C., VeriSign said its own re-evaluation of its Site Finder redirection service found "no identified security or stability problems." When it was active, Site Finder added a "wild card" for .com and .net domains that snared queries to nonexistent Internet sites and forwarded them to VeriSign's own servers. That confused some antispam filters and other network utilities, a side effect that VeriSign downplayed on Wednesday by arguing that Site Finder's benefits to end users--a search screen instead of a an error message--outweighed the costs to network administrators. "One of the segments of the community that has not been looked at in this whole issue, in my opinion, is the user community," VeriSign Vice President Chuck Gomes said. "They're very relevant." In a presentation, VeriSign said that 35 companies were confidentially briefed about Site Finder before its debut and they reported "no issues" or problems before its launch on Sept. 15. Its own expert group--including the chief technology officers of Brightmail and Morgan Stanley--reviewed Site Finder and decided that most issues were "minor or inconvenient," VeriSign said. Before resuming Site Finder, VeriSign said it would address specific criticisms by adding foreign language support to Site Finder and tweaking the way e-mail to nonexistent domains worked. [...] ----------------------------------------------------------------- Joseph Lorenzo Hall Graduate Student http://pobox.com/~joehall "When life gives you SARS, make sarsaparilla." --Cory Doctorow, http://www.craphound.com/ -------------------------------------

8 8

Tomatoes for Verisign at NANOG 29
by JC Dill 17 Oct '03

17 Oct '03

Dan and Owen, I nominate you two for the tomato acquisition and distribution committee. To recap: At NANOG 29 in Chicago, on Monday October 20th at 9:15 am a session on "VeriSign's Wildcard Record: Effects and Responses" will be held, with Mark Kosters and Matt Larson from VeriSign and Suzanne Woolf from ISC: <http://www.nanog.org/mtg-0310/dns.html> If you are attending NANOG 29, please attend this session and wear a red shirt. If possible, please buy/bring a tomato. Take your tomato to the front of the room and place them in a pile before Verisign, to make it absolutely clear how you feel about Verisign's wildcards and sitefinder. Please do not throw your tomatoes. I wish I could be there! Now to make sure that someone with clue from the Chicago Sun Times and the Chicago Tribune are both there, with photographers. Does anyone on this list have any contacts at either of these papers? jc

16 21

Mail problems continued, AOL sprung back up
by Damian Gerow 17 Oct '03

17 Oct '03

Apologies for using this as a 'Please contact me' list, but can a postmaster from AOL please give me a call? Our outbound mail has (again) mysteriously started getting bounced, even while having a 30-day temporary whitelist on this server. Calls to the NOC line receive a fast busy after the automated prompter. -- Damian Gerow damian(a)sentex.net Systems and Networks Administrator work +1 519 651 3400 x213 Sentex Communications

4 5

RE: Pitfalls of annoucing /24s
by Ejay Hire 17 Oct '03

17 Oct '03

Am I the only one that has never had an issue multihoming with /24's? Ejay Hire -----Original Message----- From: H. Michael Smith, Jr. [mailto:michael@awtechnologies.com] Sent: Wednesday, October 15, 2003 4:24 PM To: 'Phil Rosenthal'; 'John Palmer' Cc: nanog(a)merit.edu Subject: RE: Pitfalls of annoucing /24s What about the /24's that many ISPs (especially tier 2-3) are assigning to multi-homed customers? What about an IX or "critical infrastructure providers" that may be issued a /24 from ARIN (Policy 2001-3)? Although it may be rare that a large aggregate would become unreachable to a "large" network, doesn't the possibility exist that a customer with a /24 would become unreachable (to some) due to the aggregate dropping out even though the /24 should still be reachable? That scenario may not be very likely, but the question of assymetric routing and one's ability to balance traffic become issues. Assigning a lower preference to /24's would be a lot friendlier than just throwing them away. If I am way off base, I fully expect to be corrected (with volume). My flame retardant suit is in place. Michael -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Phil Rosenthal Sent: Wednesday, October 15, 2003 4:47 PM To: John Palmer Cc: nanog(a)merit.edu Subject: Re: Pitfalls of annoucing /24s http://info.us.bb.verio.net/routing.html#PeerFilter That's how Verio does it, and I assume, that's how most people who filter by length do it as well. --Phil On Oct 15, 2003, at 4:40 PM, John Palmer wrote: > > Good question. > > You know there are thousands of legacy /24's out there that were > allocated by > IANA as /24's How can you aggregate them up if all you have is the /24? > > To those who filter out /24's - how is this done - just by the netmask > size? > > ----- Original Message ----- > From: "Jean-Christophe Smith" <jsmith(a)vitalstream.com> > To: <nanog(a)merit.edu> > Sent: Wednesday, October 15, 2003 15:34 > Subject: Pitfalls of annoucing /24s > > >> >> >> In current practice would there be serious jeopardy of portions of the >> internet not being able to reach this address space due to bgp >> filters or >> other restrictions? What is the smallest acceptable block of IPs that >> can be >> announced without adverse or unpredictable results? Verio would most >> likely >> be picking up these routes from us. I don't want to cause a religious >> debate, but I am interested in what the industry consensus is. >> >> I'm just doing some research, any comments would be appreciated. >> >> Thanks, >> Jean-Christophe Smith >> >> > > --Phil Rosenthal ISPrime, Inc.

2 1

some DNS data ...
by bmanning＠karoshi.com 17 Oct '03

17 Oct '03

We have finished the latest quarterly audit of the DNS <http://www.ep.net> and now include not only the reverse trees, but 64% of the forward map too. This is the rough cut, using version.server and version.bind replies. Presenting some preliminary numbers for your amusment. For the DNSsec junkies... we have some work to do - 0.1% penetration is really poor, but its better than last quarter. For the wildcard zelots - time to play catch-up w/ the latest ISC code. The bind 4.x tail off is dragging. :( Time to kill the beast. And for you folks w/ the user generated strings, the next pass will have some additional tests. ---------------------------------------------------- 164,395 unique servers user generated strings = 73034 ~44% bind 4.x = 1589 ~ 0.9% bind 8.x = 34792 ~21% bind 9.x = 54980 ~33% ------------------- summary detail ----------------- 1747 report " " 70433 report <various user-generated strings> 174 report 3.1415 (to 40 digits) 148 report x.x versions (where x.x is anything pre 4.8.3) 5 report 4.8.x 1584 report 4.9.x 317 report {5-8}.x 81 report 8.1.1 1219 report 8.1.2 48 report 8.2 92 report 8.2.1 2165 report 8.2.2 8701 report 8.2.3 2284 report 8.2.4 416 report 8.2.5 211 report 8.2.6 301 report 8.2.7 16855 report 8.3.x 2419 report 8.4.x 103 report 9.0.0x 1457 report 9.1.0x 382 report 9.1.1x 622 report 9.1.2x 2702 report 9.1.3x 2386 report 9.2.0x 33923 report 9.2.1x 11618 report 9.2.2x 2 report 9.2.3 214 report 9.2.3rc1 393 report 9.2.3rc2 101 report 9.2.3rc3 880 report 9.2.3rc4 27 report 9.3.0a0 (ISC internal release only) 3 report 9.3.0s20020328 2 report 9.3.0s20020703 11 report 9.3.0s20020722 2 report 9.3.0s20021004 1 report 9.3.0s20021115 151 report 9.3.0s20021217 (last "stable" DNSSEC release) ----------------------------------------------- --bill

1 0

False information: CEO of Versign facts are wrong
by Sean Donelan 17 Oct '03

17 Oct '03

http://news.com.com/2008-7347-5092590.html Quotes Stratton Sclavos: "The DDOS (distributed denial-of-service) attacks last October on the root system--hey, there are 13 global copies of that, and they're all operating. It should scare people that nine of the 13 went down. It's time for the Internet infrastructure to go commercial. On the core services of the infrastructure, it's time to pull the root servers away from volunteers who run them out of a university or lab or some other level. That's going to be an unpopular decision." This factoid has been proven false multiple times, in multiple forums over the last year. Its incredible that a CEO of a company that claims DNS expertise wouldn't know this was false. One particular "internet security" company was PINGing the root servers, and some of the root server operators turned off ping. The root servers themselves were unaffected (except maybe one operated by the US Military). Historically, the only wide-spread failures have been due to NSI operators screwing up the COM or NET zone files. Historically, the other network operators have needed to pick up the load when NSI fell down. NSI controls two root servers. Perhaps its time to split those up among different organizations. There is no reason why NSI must operate any root name severs. NSI moved all the COM and NET zones to seperate GTLD servers controlled SOLELY by NSI years ago.

6 8