October 2003 - Test - lists.nanog.org

Re: Transit and Paid Peering Exchanges
by Daniel Golding 08 Oct '03

08 Oct '03

Dennis, I'm not really looking at normal exchanges where some participants offer transit or partial transit. I'm looking at exchange fabrics specifically set up for the purpose of selling services, be they transit, partial transit, or paid peering. Most of these exchanges have web based administration, route servers, flow accounting, or some other combination of services. A good example is Equinix's Equinix Direct. Equinix maintains a series of exchange fabrics that are primarily for settlement free peering, but also has exchange fabrics set up, specifically, for buyers and sellers of services. Telehouse in NYC was doing something like this, as well. I'm not sure how far it has progressed. Thanks, Dan > From: "Dennis Jewth" <Dennis.Jewth(a)xchangepoint.net> > Date: Wed, 8 Oct 2003 10:03:41 +0100 > To: "Daniel Golding" <dgolding(a)burtongroup.com> > Cc: <nanog(a)merit.edu> > Subject: Re: Transit and Paid Peering Exchanges > > Hi Daniel > > Really you need to reword that as exchanges used for peering and transit > provision/delivery, over which some networks may be paying for peering > sessions. > > We run a MAN in London connecting 7 co-lo's (including THouse North) that is > used as the > delivery platform for transit from the Carriers to ISPs and hosting > companies. We are also a peering point. > > Paid peering is more common in the US. In Europe some of the larger networks > are talking about offering paid peering (and there may be already few doing > it). It's to > get that info out in the open from those doing it that's harder (hence your > mail > to Nanog, no doubt). > > Are you looking at partial transit as well? > > Dennis Jewth > XchangePoint Europe > www.xchangepoint.net > > > ----- Original Message ----- > From: "Daniel Golding" <dgolding(a)burtongroup.com> > To: <nanog(a)merit.edu> > Sent: Wednesday, October 08, 2003 9:31 AM > Subject: Transit and Paid Peering Exchanges > > >> >> >> Doing some research.... >> >> Anyone have a list of Transit and Paid Peering exchange fabrics? >> >> I am interested in both US and EU locations, particularly in interesting >> sites like 111 8th Ave (NYC), Telehouse North (London) and other major > telco >> hotel type facilities. >> >> I'll summarize for the list and repost. >> >> Thanks, >> -- >> Daniel Golding >> >> > > > ________________________________________________________________________ > This email has been scanned for all viruses by the MessageLabs Email > Security System. For more information on a proactive email security > service working around the clock, around the globe, visit > http://www.messagelabs.com > ________________________________________________________________________ >

1 0

Re: kooky BGP tricks
by E.B. Dreger 08 Oct '03

08 Oct '03

DG> Date: Wed, 08 Oct 2003 09:31:45 +0200 DG> From: Daniel Golding DG> 1) In a way, its fraudulent If not mutually agreed in advance between 65000 and 65100, yes. This is analogous to announcing more specifics from another provider's space. DG> 2) Some folks do BGP traffic engineering tricks using AS path. Other folks DG> do measurement stuff using AS-Path. Therefore, wrong AS paths are bad. True. Seeing "1239 $smallprovider 701" would be a bit bizarre, pretending for a moment that 1239 accepted "$smallprovider 701". DG> 3) Hacks are unscalable. This is a hack. In a sense. In another sense, it's like 65000 sending 65100 partial routes... except it's actually a subset of 65000 doing the talking. I should have been more clear in my post. I originally was addressing the issue of $smallprovider peering with a transit AS when $smallprovider's upstream wouldn't. Ghetto multihoming was a poorly-added afterthought, and probably muddled the question. :-/ DG> Why doesn�t AS65100 just advertise the routes as "65100 65100 i" or "65100 DG> i"? What is gained by doing "65100 65000 I" other than ensuring that if the DG> link between $downstream and AS65000 goes down, then $downstream becomes DG> unreachable from AS65000 due to BGP loop detection? I've always seen inconsistent origin ASNs as "evil". They work, but are generally frowned upon... perhaps it is the lesser of evils, though. DG> If I were AS65000, I might be disposed to complain to AS65100's upstream or DG> to the large community about 65100 stealing my AS. I would suspect some evil Again, I meant to indicate 65000 and 65100 agreed in advance. DG> intent. Also, if $downstream cant afford $500 for an AS, what makes anyone DG> think they can afford to pay either upstream? Very true. And ASNs are still plentiful; running out is far enough down the road not to worry... Eddy -- Brotsman & Dreger, Inc. - EverQuick Internet Division Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

1 0

kooky BGP tricks
by E.B. Dreger 07 Oct '03

07 Oct '03

Greetings all, Time for the "kooky routing idea of the year" post... Scenario: AS65000 is a bandwidth provider. One of their downstreams wishes to peer with AS65100, or to multihome with AS65100 as a second upstream. The obvious and 100% correct answer is for $downstream to register their own ASN, that anyone ready to multihome or peer can afford $500 up front and a few bucks per year. We all know this. However, $downstream wishes to advertise the routes without registering an ASN. AS65100 decides to advertise $downstream's prefixes as 65100 65000 ? exactly as if 65000 were sending only $downstream's routes to 65100. From a technical perspective, this works. Yes, there are issues with more-specifics and perhaps loop detection. The question: What would your reaction be if you were AS65000? Note that this is a political/admin question, _not_ a technical one. My thoughts: >From an administrative perspective, this can get messy, but is doable iff 65000 and 65100 agree in advance. The IP space analog is done routinely. I'd not mind being either 65000 or 65100 -- _iff_ both ASNs agreed in advance. Cutting down on leaf ASNs without causing inconsistent ASNs seems like a reasonable goal. Wrapping self in flameproof insulation... Eddy -- Brotsman & Dreger, Inc. - EverQuick Internet Division Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

1 0

New virus
by Andrew Fried 07 Oct '03

07 Oct '03

I just received an email proporting to be from Symantec that contained an anti-virus signature update. The message originated in the Netherlands. The attachment has been submitted to Symantec and FortiNet for review, however, I thought the community might want a heads up since I do not know the degree to which this has been distributed. The full content of the message I received is below: X-Persona: <CIS> Return-Path: <updates(a)symantec.com> X-Original-To: afried(a)cis.fed.gov Delivered-To: afried(a)cis.fed.gov Received: from node0938.a2000.nl (node0938.a2000.nl [62.108.9.56]) by mailserver.cis.fed.gov (Postfix) with SMTP id 22868FD52 for <afried(a)cis.fed.gov>; Tue, 7 Oct 2003 06:22:19 -0400 (EDT) Message-ID: <20031026614.2874.qmail(a)symantec.com> Date: Tue, 7 Oct 2003 03:26:29 -0700 From: <updates(a)symantec.com> Subject: Last Update. To: <afried(a)cis.fed.gov> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------9D16FAF1684605E" X-UIDL: G]m!!l"d"!b\E"!\]5"! October 06, 2003 Intruder Alert 4.1 W32_Webb_Worm Policy This policy detects the propagation of the W32.SobigF.Worm through changes in the registry. W32.Webb.F@mm is a mass-mailing, network-aware worm that sends itself to all the email addresses it finds in various files. The worm uses its own SMTP engine to propagate and attempts to create a copy of itself on accessible network shares, but fails due to bugs in the code. In attachment you can find program that update your Norton Antivirus to Norton Antivirus 2004. [nav32.zip] Scanned by evaliation version of Dr.Web antivirus Daemon http://drweb.ru/unix/

2 1

Anyone at Level3?
by Kee Hinckley 07 Oct '03

07 Oct '03

Looking for someone at Level3. While this pales in comparison to Cisco's DoS situation, my home DSL connection is currently getting slammed by a Level3 customer who has in the past week attempted to send me 2.6 million email messages in bursts that are swamping my connection--even though I reject them before we get the DATA. I've sent messages to Level3 abuse and securityoperations addresses several times over the past week, and I've called them on the phone. They downloaded my log file, but they've done nothing to either respond, or deal with the problem. It's not like the guy is an unknown quantity, see: http://www.spamhaus.org/sbl/sbl.lasso?query=SBL6857 http://www.spamhaus.org/sbl/sbl.lasso?query=SBL5576 He's known for the fact that he ignores 5x SMTP codes. Which is all very fine, but it doesn't explain why he's trying to blast me off the net. Just rejected another 10,000 connection attempts as I wrote this. -- Kee Hinckley http://www.messagefire.com/ Next Generation Spam Defense http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's.

1 0

CCO/cisco.com issues.
by Roland Dobbins 07 Oct '03

07 Oct '03

Folks, We've been handling a multi-vector DDoS - 40-byte spoofed SYN-flooding towards www.cisco.com (198.133.219.25/32) as well as an HTTP-AUTH resource-exhaustion attack, and working these issues with our upstreams. Our apologies for any inconveniences, and our thanks to those who've assisted in tracing and blocking the spoofed traffic. We're continuing the work the issue, and would be grateful if operators would check for 40-byte spoofed TCP headed towards 198.133.219.25/32 and trace/block it as warranted. Your patience and understanding are greatly appreciated. Thanks! ------------------------------------------------------------- Roland Dobbins <rdobbins(a)cisco.com> // 408.527.6376 voice

16 20

Photos from today's ICANN SSAC meeting on SiteFinder in DC
by Declan McCullagh 07 Oct '03

07 Oct '03

They're here: http://www.mccullagh.org/theme/icann-verisign-meeting-oct03.html I double-checked everyone's names and affiliations but I could have made an error. If I did, please let me know. Thanks, Declan

1 0

sitefinder technical discussions
by Mark Kosters 07 Oct '03

07 Oct '03

In the interest in gaining more community review and comment, a discussion list has been setup to discuss factually-based technical issues and solutions surrounding the operational impact of wildcards in top-level domains on Internet applications. VeriSign technical people will participate in discussions that are within the scope for this mailing list. The list is sitefinder-tech-discuss(a)lists.elistx.com To subscribe or unsubscribe the usual "-request" convention works. Send a message to: sitefinder-tech-discuss-request(a)lists.elistx.com Put "subscribe" or "unsubscribe" in the body of the message. Regards, Mark -- Mark Kosters markk(a)verisignlabs.com Verisign Applied Research

6 5

Re: Photos from today's ICANN SSAC meeting on SiteFinder in DC
by John Neiberger 07 Oct '03

07 Oct '03

>>>> Declan McCullagh <lists(a)politechbot.com> 10/7/03 3:58:33 PM >>> > >They're here: >http://www.mccullagh.org/theme/icann-verisign-meeting-oct03.html > >I double-checked everyone's names and affiliations but I could have >made an error. If I did, please let me know. > >Thanks, >Declan Is it just me or does it look like most of the Verisign guys have bloodshot eyes? :-) Seriously, this reminds me of something I wanted to point out earlier. Unless I've missed some of his recent posts, it appears to me that Matt Larson from Verisign has been straightforward with us when he was allowed to be. I doubt he was required to post here so I'm guessing he felt that it was necessary to give us what details were available as soon as he was allowed to do so. I'm obviously not aware of his circumstances but I have a feeling that he's closer to being 'one of us' than 'one of them', and if that's the case then kudos go out to him for posting here at all. It wasn't necessary but he seems to have done it knowing that he'd take a lot of heat. If that is the case, someone should hire him away from Verisign and free him from his bondage. <g> John "Then again, I might be wrong, in which case there's always Purgatory..." --

1 0

[MEDIA] McLaughlin Defends Site Finder As 'Innovation'
by wayne 07 Oct '03

07 Oct '03

As seen on /. http://news.com.com/2010-1071-5086769.html Mark McLaughlin, senior VP of Verislime, has an editorial on news.com claiming that ICANN is stifling innovation and forcing the internet to stagnate. The PR machine is out in force and painting anyone who disagrees with them as anti-capitalistic loonies. -wayne

4 3