March 2003 - Test - lists.nanog.org

Abstract of proposed Internet Draft for Best Current Practice (please comment)
by Dr. Jeffrey Race 07 Mar '03

07 Mar '03

Interested parties are invited to provide comments to correct, elaborate or perfect my proposal, abstracted below, which I plan to offer as an Internet Draft momentarily. It relates to the activities of ISPs and backbones intimately. Comments or objections to the effect "This is going to be burdensome on $spam_enabler" are superfluous because such is the precise intention of the proposed Practice: to move the burden from victims to polluters and their enablers. <sociology jargon>Key to this proposal is the concept of "emergent structure"; if all (or even most) players expect other players to act in a certain way, a predictable pattern of behavior emerges which becomes compelling for all players. This is the way all organizations work. </sociology jargon> Key to this proposal is the idea "we all jump at once". I am also looking for volunteers to advance this proposal in appropriate bodies. I travel a great deal and don't expect to be able to give this project the push it deserves. Mail me privately. Thanks for all help. Jeffrey Race D_R_A_F_T BEST CURRENT PRACTICE FOR DUTY OF CARE OF INTERNET RESOURCES Pre-release version 1.33 Draft date: March 5, 2003 Drafted by Jeffrey Race <jrace[at]attglobal.net> Current draft version (4,000 words) available at <http://www.camblab.com/misc/univ_std.txt> ABSTRACT (long form, not per RFC2223) This document defines a Best Current Practice to minimize pollution of the Internet by various types of abuse, using the community's own measures in the absence of effective legal, regulatory and technical measures. The Internet's design and management were predicated on voluntary cooperation, self-imposed good behavior, and the non-profit motivational structure of participants extant at its inception. Current experience of constantly rising pollution invalidates these formative assumptions and demands prompt and effective curative measures. Present anti-pollution measures fall under four generic headings: (1) self-directed good behavior; (2) legal sanctions (3) passive ingress-control measures (principally filtering) and (4) active egress-control measures (principally blocklisting) intended to modify the behavior of polluters and enablers. The first three have definitively failed and will continue to fail for reasons specified in the document. The fourth is generally completely effective in warding off ingress of pollution and frequently results in reforming abuse enablers, but it has two major shortcomings: limited uptake due to fear of loss of competitive market position by early adopters, and sustained transmission outages ("collateral damage"). In view of the failure of (1), (2) and (3) and the effectiveness despite shortcomings of (4), the document proposes to apply to the Internet the same rules society applies to all other resources to deter antisocial behavior viz. proper behavior requires clear published standards, standards entail accountability, accountability entails multiple modes of enforceability, and enforceability entails traceability. The document details procedures and implementing mechanisms of behavior modification, using the only proven effective method: withdrawal of internet resources of identity and connectivity. Numerous tests have shown this sanction to work equally well against both the wilful and the negligent to halt pollution immediately, where prior efforts at polite persuasion to follow best practice were ignored with impunity. The proposal thus innovates in three respects to halt Internet pollution: (1) It makes explicit that every custodian of internet resources is responsible for preventing emission of pollution (2) Adopting a simultaneous universal practice of withdrawal of internet resources means that no provider will suffer competitive disadvantage. The Practice legitimates withdrawal of internet resources as the only method proven effective in halting abuse. (3) The burden of pollution now falls on the polluter and his enabler rather than on the victim, so conforming to the basic principle used everywhere else in society to maintain justice and good order. Well-managed, ethical members of the internet industry already conduct their businesses, successfully and profitably, according to the principles specified in the Practice. The proposed Practice simply aims to raise the entire industry to the level of today's best players. The Practice is intended to apply at every level of allocation, registration and usage of internet resources including but not limited to RIRs, LIRs, ISPs, webhosting firms, backbone connectivity providers, domain name registrars, and end-users. It defines internet resources, unsolicited bulk electronic messaging, and abuse, and specifies procedures progressively to penalize abuse after a period of public admonishment. In effect, the proposal implements the "user pays" paradigm in a completely new and clever way, without requiring any complicated metering technology all proposals for which have failed on issues of complexity, backward compatibility, absence of adequate hardware, and the need for universal adoption to be effective at all. The document embodies the only set of measures now on offer which will quickly end the spam menace internationally sans new legislation, with but small and transitory disruption, by abandoning the discredited "victim pays" model. Adoption will not only be cost-free for the Internet as a whole but will substantially reduce the current economic burden of abuse. It does this by transferring the economic burden from abuse victims to the polluters and their enablers, which is fair and feasible, and indeed the system used everywhere else in society. As such the anticipated vigorous objections to adoption from some parties may be seen in advance as self-serving attempts to perpetuate the discredited "victim pays" model by those now profiting from an Environmental Polluter business model or by their accessories and enablers. Finally, RFCs and Practices are often considered by Courts in adjudicating the existence or extent of tortious conduct. Therefore looking to the longer term, adoption of this Practice may be expected to bring a welcome rule of law to the Internet.

3 2

The Cidr Report
by cidr-report＠potaroo.net 07 Mar '03

07 Mar '03

This report has been generated at Fri Mar 7 21:46:45 2003 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 28-02-03 119708 85685 01-03-03 119794 85736 02-03-03 119902 85774 03-03-03 119905 85881 04-03-03 120066 86042 05-03-03 120121 86071 06-03-03 120244 86209 07-03-03 120289 86173 AS Summary 14703 Number of ASes in routing system 5787 Number of ASes announcing only one prefix 1586 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 72916992 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 07Mar03 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 120335 86155 34180 28.4% All ASes AS3908 1085 567 518 47.7% SUPERNETASBLK SuperNet, Inc. AS18566 507 9 498 98.2% COVAD Covad Communications AS701 1586 1146 440 27.7% ALTERNET-AS UUNET Technologies, Inc. AS4151 532 106 426 80.1% USDA-1 USDA AS4323 537 170 367 68.3% TW-COMM Time Warner Communications, Inc. AS7843 590 232 358 60.7% ADELPHIA-AS Adelphia Corp. AS7018 1380 1024 356 25.8% ATT-INTERNET4 AT&T WorldNet Services AS6197 498 157 341 68.5% BATI-ATL BellSouth Network Solutions, Inc AS1221 1113 809 304 27.3% ASN-TELSTRA Telstra Pty Ltd AS1239 973 691 282 29.0% SPRINTLINK Sprint AS4355 401 120 281 70.1% ERMS-EARTHLNK EARTHLINK, INC AS22927 295 14 281 95.3% AR-TEAR2-LACNIC TELEFONICA DE ARGENTINA AS705 450 196 254 56.4% ASN-ALTERNET UUNET Technologies, Inc. AS4814 263 15 248 94.3% CHINANET-BEIJING-AP China Telecom (Group) AS6198 450 203 247 54.9% BATI-MIA BellSouth Network Solutions, Inc AS1 662 436 226 34.1% GNTY-1 Genuity AS22291 243 31 212 87.2% CHARTER-LA Charter Communications AS27364 240 29 211 87.9% ACS-INTERNET Armstrong Cable Services AS17676 230 26 204 88.7% GIGAINFRA XTAGE CORPORATION AS2386 483 282 201 41.6% INS-AS AT&T Data Communications Services AS4134 304 113 191 62.8% CHINANET-BACKBONE No.31,Jin-rong Street AS209 532 342 190 35.7% ASN-QWEST Qwest AS690 500 310 190 38.0% MERIT-AS-27 Merit Network Inc. AS6347 370 190 180 48.6% DIAMOND SAVVIS Communications Corporation AS2048 259 87 172 66.4% LANET-1 State of Louisiana AS17557 359 206 153 42.6% PKTELECOM-AS-AP Pakistan Telecom AS7303 240 90 150 62.5% AR-TAST-LACNIC Telecom Argentina Stet-France Telecom S.A. AS22773 182 32 150 82.4% CCINET-2 Cox Communications Inc. Atlanta AS6140 284 136 148 52.1% IMPSAT-USA ImpSat AS11492 322 174 148 46.0% CABLEONE CABLE ONE Total 15870 7943 7927 49.9% Top 30 total Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Re: [Re: Abstract of proposed Internet Draft for Best Current Practice (please comment)]
by Dr. Jeffrey Race 07 Mar '03

07 Mar '03

Thank you Josh, please see inline comments which let me clarify points On Thu, 06 Mar 2003 13:17:35 -0500, Joshua Smith wrote: >is there a forthcoming section on criterium for demonstrating reformation >by the sp and/or 'offending' user? The criterion is stated: no more complaints > >the proposal does not take in to account the global differences in sp >business models or ideals. are the same standards to be applied to >developing countries, or will they have a less rigorous set of criteria, >a la current environment policies? The Internet is worldwide so the same behavioral standard should apply, just as do the same technical standards. An RFC-compliant SMTP message is the same at every point on the compass > >if there were 1000 compromised nodes that took place in a ddos, would you >accept the larger dos caused by blacklisting those networks/hosts? The only get blacklisted until they fix their spew. Could take a couple of hours. First step is RTFM which most don't. how >long would the sp's be expected to shoulder the 'collateral damage' >caused by the blacklisting (see first question)? They'd be expected to be blacklisted until they ceased being a danger to the internet, just as dangerous planes aren't allowed to take off until they pass the inspection checklist, and bad risks can't borrow money until they develop sound financial behavior. Same principle. suppose that the next >day, 500 nodes took place in another ddos, the policy imposed dos becomes >even larger. a skillful hacker could potentially cause a larger, and >longer lasting dos. > Sounds like a good reason to get going on the problem. >legislating morality does not work (think of the 'drug war' in america). >you cannot correct social ills with a purely technical solution. Well I don't understand the relevance of the above comment. I propose no legislation and indeed specifically state that legislation is useless and unnecessary. I also say this is not a technical solution. All technical solutions will fail, always, because the spammers are as smart as the anti- spammers but more motivated. This is a behavioral solution. It is the only one that will work. Everything else will fail. Jeffrey Race

1 0

Re: Abstract of proposed Internet Draft for Best Current Practice (please comment)
by Dr. Jeffrey Race 07 Mar '03

07 Mar '03

Thank you Andy for making my points so clearly. See inline comments On Thu, 6 Mar 2003 12:30:11 -0500 (EST), Andy Dills wrote: >Some comments, after reading the draft: >>Under 2.1, Form of Practice, where you finally talk about what it is >you're propsing: >>"The withdrawal of IR (use of blocklists, cancellation of routing, >withdrawal of IP addresses and domain names) may in its early months of >adoption split the Internet into oceans of purity and islands of >pollution. As withdrawal expands, polluters will be pushed into ever >smaller and less connected domains, which grow ever more blocked. This >cumulative process will end quickly, with residual polluted islands >populated by those lacking a need to communicate with oceans of purity." >> >That's the primary flaw. This will never get implemented due to the >cavalier attitude towards collateral damage. Whether it is implemented is not my business. I am the doctor diagnosing the illness and prescribing the scientifically validated cure, and warning the patient of the quack remedies on the market. My job is done now (almost, I just have to reformat and submit as I-D, maybe a few more hours). By way of background, I wrote a very famous book (War Comes to Long An) on a matter of transcendent national importance, in 1972. It also (by inference) prescribed some medicine. It got a lot of criticism at the time, but it is now the canonical analysis of that problem, used in universities and military/diplomatic training institutions worldwide. It took several years for this to happen. I know, from talks with friends in the White House, that MANY people are alive today who would be dead had I not spent three years of my life writing that book. I have spent three years developing this draft BCP. It is a cure, in fact the ONLY cure, for the spam menace. It will work. Whether people want to take the cure is up to you and your colleagues. I am just a drive-by spamming victim who got sick of the pointless debate and decided to analyse the problem based on what I know of technology and of human behavior (having studied both professionally; I am trained as a social scientist from a well-known institution in Cambridge Massachusetts but have spent most of my recent adult life in technology; I was in the Army signal corps before that). This is just a charitable effort on my part. I am not selling anything. My apologies for the personal discussion which I would not ordinarily go into, but it is germane here so you all can understand I have no vested interest in pushing software or hardware. This effort is completely unrelated to my life work except in the sense that I am a spam victim. > >Like you said, you need everybody to jump at the same time. >Unfortunately, there is almost zero chance of that happening It's up to you people on this list, not me. This is the medicine; if you want to get well, take it. >that IPv6 will ever replace IPv4 (at least until we truly run out of >address space...which is looking less likely with time). To ostracize >those who disagree by lableing them abuse-supporters is to diminish your >chances even further. You'll end up with an island of purity in the middle >of an ocean of pollution..."and the cumulative process will end quickly" >when your customers come to your NOC with pitchforks and shotguns. In the >end, we're here to serve the customer, not the other way around. There are lots of well-run networks that don't accept inbound spam and don't enable outgoing spam. Their customers are happy and they are making money. The firms bankrupt or circling the drain are the ones with dishonest managements who committed financial fraud and/or ramped their shares based on revenue streams from spammers, like .. whoops! I almost said it again, sorry, I got spanked last time for mentioning the industry's leading US spam-enabler. > > >Remember, it's a fine line. The network operators don't advocate >abuse; Some do and gain lots of revenue from it. See the sad truth at <www.camblab.com/nugget/spam_03.pdf> >the business end of cash-desperate networks are the driving >force in this industry, not us. You have elegantly stated the Environmental Polluter business model: internalize the revenue streams from the customers, and externalize the losses imposed by spam-enabling actions and negligence. GE used to work on that business model. They are no longer dumping effluents into the ground in Pittsfield Mass. This could happen to the Internet! (with your help--go for it!) Kind regards to all Jeffrey Race

1 0

Tech contact for IXEurope/ixsolutions?
by Danny 06 Mar '03

06 Mar '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Does any one on the list have a technical/routing contact for these guys? I stumbled across a routing loop while trying to access theregister.co.uk and I'd like to let them know. 22 fe-1-4-03-ed1.ixsolutions.net (195.188.19.242) 217.896 ms * 182.564 ms 23 195.188.19.241 (195.188.19.241) 121.052 ms 116.785 ms 122.748 ms 24 fe-1-4-03-ed1.ixsolutions.net (195.188.19.242) 238.639 ms * 205.135 ms 25 195.188.19.241 (195.188.19.241) 90.321 ms 89.061 ms 89.200 ms 26 fe-1-4-03-ed1.ixsolutions.net (195.188.19.242) 185.404 ms * * 27 195.188.19.241 (195.188.19.241) 115.105 ms 107.824 ms 109.199 ms 28 * fe-1-4-03-ed1.ixsolutions.net (195.188.19.242) 273.697 ms 242.660 ms 29 195.188.19.241 (195.188.19.241) 108.626 ms 124.919 ms 105.269 ms 30 * * fe-1-4-03-ed1.ixsolutions.net (195.188.19.242) 216.152 ms 31 195.188.19.241 (195.188.19.241) 110.281 ms 105.542 ms 104.929 ms 32 fe-1-4-03-ed1.ixsolutions.net (195.188.19.242) 256.130 ms * 262.425 ms Cheers Danny Network Security Engineer Drexel University PGP Print: C6AD B205 E3C6 38AB 0164 6604 66F5 CCFC F4ED F1E0 PGP Key: http://akasha.irt.drexel.edu/danny.asc -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPmgTpmb1zPz07fHgEQLkTACfdH6F5B9r1ikYj6KHJflnnKVNA/EAoLzh wTRZFgn1ilsZuKO6vfJVXq8R =BsNf -----END PGP SIGNATURE-----

1 0

60 Hudson
by Jeffrey Meltzer 06 Mar '03

06 Mar '03

If anyone is having trouble getting a hold of your folks in 60 Hudson, word is there was an electrical fire in the basement and the building was evacuated. -- Jeffrey Meltzer ICS/VillageWorld 631-218-0700 x100

1 0

Re: [Re: Abstract of proposed Internet Draft for Best Current Practice (please comment)]
by Joshua Smith 06 Mar '03

06 Mar '03

building on andy's comments: is there a forthcoming section on criterium for demonstrating reformation by the sp and/or 'offending' user? without it, you will leave it up to individuals, which will cause inconsistancies. the proposal does not take in to account the global differences in sp business models or ideals. are the same standards to be applied to developing countries, or will they have a less rigorous set of criteria, a la current environment policies? if there were 1000 compromised nodes that took place in a ddos, would you accept the larger dos caused by blacklisting those networks/hosts? how long would the sp's be expected to shoulder the 'collateral damage' caused by the blacklisting (see first question)? suppose that the next day, 500 nodes took place in another ddos, the policy imposed dos becomes even larger. a skillful hacker could potentially cause a larger, and longer lasting dos. legislating morality does not work (think of the 'drug war' in america). you cannot correct social ills with a purely technical solution. my $0.02 usd joshua Andy Dills <andy(a)xecu.net> wrote: > > > Some comments, after reading the draft: > > Under 2.1, Form of Practice, where you finally talk about what it is > you're propsing: > > "The withdrawal of IR (use of blocklists, cancellation of routing, > withdrawal of IP addresses and domain names) may in its early months of > adoption split the Internet into oceans of purity and islands of > pollution. As withdrawal expands, polluters will be pushed into ever > smaller and less connected domains, which grow ever more blocked. This > cumulative process will end quickly, with residual polluted islands > populated by those lacking a need to communicate with oceans of purity." > > > That's the primary flaw. This will never get implemented due to the > cavalier attitude towards collateral damage. > > Like you said, you need everybody to jump at the same time. Unfortunately, > there is almost zero chance of that happening. Hell, I seriously doubt > that IPv6 will ever replace IPv4 (at least until we truly run out of > address space...which is looking less likely with time). To ostracize > those who disagree by lableing them abuse-supporters is to diminish your > chances even further. You'll end up with an island of purity in the middle > of an ocean of pollution..."and the cumulative process will end quickly" > when your customers come to your NOC with pitchforks and shotguns. In the > end, we're here to serve the customer, not the other way around. > > > Remember, it's a fine line. The network operators don't advocate > abuse; the business end of cash-desperate networks are the driving > force in this industry, not us. > > Andy > > xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx > Andy Dills 301-682-9972 > Xecunet, LLC www.xecu.net > xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx > Dialup * Webhosting * E-Commerce * High-Speed Access > "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

Re: billing systems
by Richard Welty 06 Mar '03

06 Mar '03

Richard A Steenbergen <ras(a)e-gerbil.net> wrote: >I prefer to pick a random number, then consult my Magic 8-Ball with the >question "Is this customer paying enough money?". If the answer is no, I >raise their bill by 10Mbit and try again. >Sometimes the billing department gets a little backed up when the results >are hazy, but other than that it's a great system. ISPs using a magic 8-ball based billing system may find that customizing the 8-ball is not only feasible but may make for better profit margins when the 8-ball is properly tuned: http://8ball.ofb.net/howto.html i might be persuaded to make a presentation on this at the next nanog meeting. cheers, richard -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Unix, Linux, IP Network Engineering, Security

10 11

ISP recommendation for Mumbai
by JMDejaInfo＠aol.com 06 Mar '03

06 Mar '03

We are looking at setting up a regional office in Mumbai and need E1 connectivity to the Internet. Any recommendations on an ISP? If you have further information on pricing, peering, services or support it would be greatly appreciated. tks

1 0

Why replicate the DNS?
by Michael.Dillon＠radianz.com 06 Mar '03

06 Mar '03

>> How would you feel about ARIN being the root of a registry hierarchy that >> works similar to the DNS? In that case, ARIN would not necessarily hold >> the route information, they would just be at the top of the search >> hierarchy just like the root name servers are at the top of the DNS >> hierarchy. ARIN would authoritatively identify the leaseholder of an >> address block and give you a pointer to that leaseholder's LDAP server >> where you could query for whatever info they have available. This could >> include route registry info. > I don't know that the other RIRs would be willing to promote ARIN > to the position once held by the IANA as the arbitor of all IP > address space. That said, why replicate the DNS? Once this improved IP address registry catches on, then I would expect the root to move up to IANA but for now, IANA has delegated large chunks of address space to ARIN to administer. In any case, I don't want to replicate the DNS. It works just fine as it is and I want to leave it alone. I especially don't want to expand the role of the DNS by adding features to it. LDAP is a more general purpose directory protocol. It's expandable and there are lots of tools available to work with it. If you want to integrate your directory to the DNS you simply use your domain name as base of your hierarchy. But there is no reason why we couldn't integrate it to the IP address allocation hierarchy as well. The easiest way to start this is to come up with a standard LDAP schema to replace rwhois and move forward from there. I'm not suggesting that we all start running LDAP servers instead of DNS, but some people may find it useful to integrate the two even tighter using something like ldapdns http://www.nimh.org/code/ldapdns/ or ldap2dns http://ldap2dns.tiscover.com/ --Michael Dillon

3 2