February 2003 - Test - lists.nanog.org

AS852 - AS577 problems ?
by Mike Tancsa 26 Feb '03

26 Feb '03

Anyone know what is up between them in Ontario, Canada ? I am seeing pretty high latency and packet loss in both directions. Dont know if its a chronic capacity problem or just a dead/down circuit ? Bell's looking glass showed (prior to my prepending) BGP routing table entry for 199.212.134.0/24, version 89013385 Paths: (2 available, best #1) Not advertised to any peer 852 11647, (received & used) 206.108.96.231 (metric 2060) from 206.108.96.17 (206.108.96.17) Origin IGP, metric 1000, localpref 110, valid, internal, best Community: 577:55 577:4520 577:5602 577:10100 Originator: 206.108.96.231, Cluster list: 206.108.96.17, 206.108.96.1 852 11647, (received & used) 206.108.96.231 (metric 2060) from 206.108.96.18 (206.108.96.18) Origin IGP, metric 1000, localpref 110, valid, internal Community: 577:55 577:4520 577:5602 577:10100 Originator: 206.108.96.231, Cluster list: 206.108.96.18, 206.108.96.1 Type escape sequence to abort. Tracing the route to ns.sentex.ca (199.212.134.1) 1 bxsmc-fe5-0-0.in.bellnexxia.net (205.207.238.210) 20 msec 204 msec 200 msec 2 core2-toronto63-pos11-5.in.bellnexxia.net (206.108.98.141) 0 msec 0 msec 4 msec 3 core4-toronto63-pos6-0.in.bellnexxia.net (64.230.242.105) 0 msec 4 msec 0 msec 4 core4-toronto12-pos13-0.in.bellnexxia.net (64.230.242.181) 0 msec 0 msec 0 msec 5 core1-toronto12-pos0-1.in.bellnexxia.net (64.230.242.198) 0 msec 0 msec 0 msec 6 bx5-toronto12-so-0-1-0-0.in.bellnexxia.net (64.230.242.150) 0 msec 0 msec 0 msec 7 toroonnlgr00.bb.telus.com (154.11.3.25) [AS 852] 176 msec 180 msec 176 msec 8 toroonzddr00.bb.telus.com (154.11.6.3) [AS 852] 172 msec 176 msec 176 msec 9 * hespler155ATM-waterloo.sentex.ca (199.212.135.77) [AS 11647] 164 msec 172 msec 10 * ns.sentex.ca (199.212.134.1) [AS 11647] 160 msec * and a traceroute from telus' route server to Bell route-views.on>traceroute 206.108.111.125 Type escape sequence to abort. Tracing the route to bx5-toronto12-so-0-0-1-0.in.bellnexxia.net (206.108.111.125) 1 toroonxngr00.bb.telus.com (154.11.63.85) 0 msec 0 msec 0 msec 2 toroonnlbr00.bb.telus.com (154.11.11.37) 4 msec 0 msec 0 msec 3 toroonnlgr00.bb.telus.com (154.11.11.58) 0 msec 0 msec 0 msec 4 bx5-toronto12-so-0-0-1-0.in.bellnexxia.net (206.108.111.125) [AS 577] 164 msec 164 msec 164 msec route-views.on> route-views.on>show ip bgp 206.108.111.125 BGP routing table entry for 206.108.111.0/24, version 117710304 Paths: (2 available, best #1) Advertised to non peer-group peers: 198.32.162.100 198.32.162.102 577, (aggregated by 577 206.108.96.25) 154.11.0.147 from 154.11.0.150 (154.11.0.150) Origin IGP, metric 0, localpref 90, valid, internal, atomic-aggregate, best Originator: 154.11.0.147, Cluster list: 154.11.0.150 577, (aggregated by 577 206.108.96.25) 154.11.0.147 from 154.11.0.151 (154.11.0.151) Origin IGP, metric 0, localpref 90, valid, internal, atomic-aggregate Originator: 154.11.0.147, Cluster list: 154.11.0.151 route-views.on> i.e. as soon as it hits Bell's network, there is quite a jump in latency and packet loss. Some of the paths to 577 out of Telus actually go down via Sprint in Chicago which seems rather odd e.g. route-views.on>show ip bgp 198.235.69.11 BGP routing table entry for 198.235.69.0/24, version 239594939 Paths: (2 available, best #1) Advertised to non peer-group peers: 198.32.162.100 198.32.162.102 1239 577 154.11.0.155 from 154.11.0.150 (154.11.0.150) Origin IGP, metric 100, localpref 100, valid, internal, best Originator: 209.115.137.204, Cluster list: 154.11.0.150 1239 577 154.11.0.155 from 154.11.0.151 (154.11.0.151) Origin IGP, metric 100, localpref 100, valid, internal Originator: 209.115.137.204, Cluster list: 154.11.0.151 route-views.on> Anyone know whats up ? ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

1 1

Re: Network monitoring/IDS rant - What's hot what's not?
by Jeff Weisberg 26 Feb '03

26 Feb '03

Pete asked: | | > (traditionally) but they can normally monitor the heck | > out of 'decent' sized networks (less than 500 components | > was my last experience with OVW atleast, tivoli and CA | > we never got working correctly with less than 1 metric | > butt ton of LOE to keep it running) | | What are the options and recommendations for networks > 500 | components? back when I had a 'network > 500 components', I could never find any monitoring software that did what I wanted. so I wrote my own. over the years it's been through some re-writes, gathered features, (lost features), and become open-source. written by an ISP for an ISP[1]. find it here: http://argus.tcp4me.com --jeff [1] sorry, I mean "e-commerce solution provider". I can still hear the marketing people's voices in my head...

2 1

RE: 69.0.0.0/8 - Please update your filters
by Todd A. Blank 26 Feb '03

26 Feb '03

We were an early user of the 69/8 address space. I started the original thread on this subject back in Sept/Oct 2002. While I am very disturbed (but not surprised) to find out that there are still serious issues with networks acknowledging this allocation, this is one of the best suggestions I have seen for doing something to force the issue. Todd A. Blank IPOutlet LLC -----Original Message----- From: jlewis(a)lewis.org [mailto:jlewis@lewis.org] Sent: Tuesday, February 25, 2003 9:32 PM To: Haesu Cc: Stephen Sprunk; E.B. Dreger; North American Noise and Off-topic Gripes Subject: Re: 69.0.0.0/8 - Please update your filters On Tue, 25 Feb 2003, Haesu wrote: > And how quickly would those ASN's respond to or even comprehend the > bogon-filter update notices? If those ASN's are competent and > quick-responsive ones, we should not even be having these prroblems to > begin with. If the alternative is getting space, giving it to customers, and explaining why they can't reach X, Y, and Z on their connection to us, but they can on other internet connections, we're going to at least have to try. I like the idea of moving the gtld servers into such space. That way, the networks that are at fault will break, and they'll be well motivated to fix their filters. ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route System Administrator | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

2 1

Re: 69.0.0.0/8 - Please update your filters
by Geoff Huston 26 Feb '03

26 Feb '03

In return, would Covad please consider performing some meaningful form of route aggregation or other measures to reduce the amount of noise that is being passed across the global routing tables that originates from Covad? http://www.cidr-report.org/cgi-bin/as-report?as=AS18566&view=4637 suggests that Covad could withdraw some 483 BGP routing table entries, reducing the total number of entires originated by Covad from 490 to an equivalent set of 8 aggregate routes. Perhaps use of NO EXPORT when announcing the more specifics to your upstream transit providers would be a globally helpful action to consider. regards, Geoff Huston At 02:09 PM 2/25/2003 -0800, Hsu, Vicky wrote: -----Original Message----- From: Chan, KaLun Sent: Thursday, February 20, 2003 4:18 PM To: Chan, KaLun; DL NOC Managers; DL NOC-IP Services Cc: Eisenhart, William; Minter, Daniel; DL Neteng-core-ip Subject: RE: [ARIN-20030123.943] 69.3.0.0/Covad - who had this block before? All, It has recently come to our attention that many Internet routers are still filtering out IP addresses in the 69.0.0.0/8 range. If YOU are still filtering this block in your router, please modify your filters accordingly. Thank You IANA IPv4 Allocation List - <http://www.iana.org/assignments/ipv4-address-space> Bogon List - <http://www.cymru.com/Documents/bogon-list.html> Secure IOS Template - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Sincerely, Ka Lun Chan (KC) Security Operation Center COVAD Communication SOC#: 866-722-2602 Dir #: 408-434-4919 Fax #: 408-434-2191 Easy to do Business with

2 1

Comcast contacts?
by Temkin, David 26 Feb '03

26 Feb '03

Does anyone have any contacts at Comcast that I might speak to RE: an issue that multiple users from my network are having with their comcast.net email via the web. Basically, starting last week, numerous users have reported that they get 'session timed out' messages as soon as they open their mailbox via the comcast.net webpage. I have no other issues with any other services. Thanks, -Dave IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

1 0

69.0.0.0/8 - Please update your filters
by Hsu, Vicky 26 Feb '03

26 Feb '03

-----Original Message----- From: Chan, KaLun Sent: Thursday, February 20, 2003 4:18 PM To: Chan, KaLun; DL NOC Managers; DL NOC-IP Services Cc: Eisenhart, William; Minter, Daniel; DL Neteng-core-ip Subject: RE: [ARIN-20030123.943] 69.3.0.0/Covad - who had this block before? All, It has recently come to our attention that many Internet routers are still filtering out IP addresses in the 69.0.0.0/8 range. If YOU are still filtering this block in your router, please modify your filters accordingly. Thank You IANA IPv4 Allocation List - <http://www.iana.org/assignments/ipv4-address-space> Bogon List - <http://www.cymru.com/Documents/bogon-list.html> Secure IOS Template - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Sincerely, Ka Lun Chan (KC) Security Operation Center COVAD Communication SOC#: 866-722-2602 Dir #: 408-434-4919 Fax #: 408-434-2191 Easy to do Business with

6 8

Re: 69.0.0.0/8 - Please update your filters
by Stephen Gill 25 Feb '03

25 Feb '03

As a brief reminder and in addition to the URLs below folks are also welcome to peer with the Team-Cymru's bogon route server which will automatically and securely update your bogon filters for you. Instructions are available at: http://www.cymru.com/Bogons/index.html Cheers, -- steve team-cymru(a)cymru.com -----Original Message----- From: Chan, KaLun Sent: Thursday, February 20, 2003 4:18 PM To: Chan, KaLun; DL NOC Managers; DL NOC-IP Services Cc: Eisenhart, William; Minter, Daniel; DL Neteng-core-ip Subject: RE: [ARIN-20030123.943] 69.3.0.0/Covad - who had this block before? All, It has recently come to our attention that many Internet routers are still filtering out IP addresses in the 69.0.0.0/8 range. If YOU are still filtering this block in your router, please modify your filters accordingly. Thank You IANA IPv4 Allocation List - <http://www.iana.org/assignments/ipv4-address-space> Bogon List - <http://www.cymru.com/Documents/bogon-list.html> Secure IOS Template - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Sincerely, Ka Lun Chan (KC) Security Operation Center COVAD Communication SOC#: 866-722-2602 Dir #: 408-434-4919 Fax #: 408-434-2191 Easy to do Business with

1 0

untied
by Randy Bush 25 Feb '03

25 Feb '03

could someone else please check the dns for www.united.com? the servers for united.com seem to delegate www.united.com, but the delegatee seems not to return an soa. i get very confusing results. randy, feeling stoopid

9 11

[ISN] SIP weakness could expose VoIP gear to attacks
by Bram Shirani 25 Feb '03

25 Feb '03

(forwarded from ISN) http://www.nwfusion.com/news/2003/0224sip.html By Phil Hochmuth Network World Fusion 02/24/03 A glitch in some vendors' Session Initiation Protocol (SIP) software could leave SIP-enabled devices - such as IP phones, IP PBXs and instant messaging clients - vulnerable to denial-of-service attacks, the CERT Coordination Center said last week. The Oulu University Secure Programming Group (OUSPG) discovered that when a certain SIP test suite (PROTOS c07-sip) is applied to SIP clients devices or proxy servers, it caused "impacts ranging from unexpected system behavior and denial of services to remote code execution," according to the CERT warning. The vulnerably relates to the "invite" messages SIP devices send to each other to initiate sessions such as VoIP calls, text chat or video. SIP is an emerging VoIP protocol used to establish sessions among SIP "agents," such as IP phones, softphones, text chat clients, and video applications. Industry observers have called text-based SIP the successor to the H.323 protocol, used widely in IP-based telephony and videoconferencing equipment. Vendors with IP PBX and phone products that use SIP include Alcatel, Avaya, Cisco, Mitel, Nortel, Pingtel, Ploycom, and Siemens. Microsoft Windows Messenger - a Web telephony, chat and video client included in Windows XP - also uses SIP. According to CERT and Cisco's Web site, Cisco's 7940 and 7960 models of IP phones running SIP images prior to version 4.2 are vulnerable, as well as Cisco routers running Cisco IOS 12.2T and 12.2X. PIX firewalls running software versions with SIP support - beginning with version 5.2(1) and up to, but not including versions 6.2(2), 6.1(4), 6.0(4) and 5.2(9) - are also affected, Cisco says. Fixes to these products are available from Cisco's Web site. Microsoft says its SIP-based software is not affected by the vulnerability. Nortel says its Succession Communication Server 2000 and Succession Communication Server 2000 - Compact are affected by the vulnerability only when SIP-T has been enabled on the IP PBX products. Patches for these products are available at Nortel's Web site. Other vendors with SIP-based products have not posted comments on the CERT Coordination Center Web site. - ISN is currently hosted by Attrition.org

1 0

Thanks for the heads-up.
by tbolling＠vger.com 25 Feb '03

25 Feb '03

>> Voyager IP http://www.vger.com/products.shtml#v_ip >Where did you see a demo? Any idea what it costs? I just sent them an >email. Not much info on their web site, and their contact submission form >is broken. Sorry about the broken link, should be fixed now. Your e-mail should get a reply shortly if you haven't gotten one already.

1 0