April 2003 - Test - lists.nanog.org

DoS and cable cuts take toll on entire country of Pakistan
by Sean Donelan 16 Apr '03

16 Apr '03

Guessing the motives of attackers is always difficult, but this probably has less to do with international politics and more with local politics and personal disputes. http://www.jang.com.pk/thenews/apr2003-daily/12-04-2003/business/b2.htm KARACHI: The Pakistan Telecommunication Company Limited has decided to isolate government websites from Pakistan Internet Exchange (PIE) to make internet browsers safe from Denial of Service attacks, which slow down the internet speed to a snail's pace, sources close to the company said on Friday. "The PTCL has decided to isolate these (government's) websites from PIE by providing a 2 megabyte IPLC link to National Telecommunications Corporation (NTC) and all sites are hosted at the server connected to this IPLC," sources added. "In this way, rest of Pakistan's internet could be safe from DoS attacks and only these 2 megabytes link would be effected," they added. Pakistani websites have been facing attacks by some hackers for over a month and thanks to DoS, the internet browsing is increasingly becoming a very trying job by the day. http://www.paktribune.com/news/index.php?id=22300 The Minister called up the presentation in the wake of strong reaction by the ISP community on the denial of service attacks on the Pakistan Internet Exchange for the last one month which also took its toll on the performance of entire internet infrastructure in the country. Earlier the company officials briefed the minister on the problems they had faced in the recent past on account of damage to their fiber optic cable as well as the incidents of denial of service attacks which slowed down the performance of all users.

1 0

Re: Dealing with ARIN.. my experiences & tips
by Jeff McAdams 15 Apr '03

15 Apr '03

Also Sprach Brian Johnson >OK. Let's all assume that Reform is necessary. >Please state, in detail, how you would reform ARIN and all of the >policy changes that you would instate (asside from giving you whatever >you want) to make ARIN "reformed" in the yes of it's membership. >I await, with baited breath, the answers form the Maha-Jeffy. :-) Alas...I agree with what some others have said. The answers aren't easy, and I don't have them all easily at hand. I think there are some steps that could be taken. Some comments off the top of my head... First and foremost...ARIN seems disconnected from the realities of running an ISP...particularly a smaller ISP. There needs to be more effort to understand the business needs of ISPs in general (again, particularly smaller ISPs) to understand *why* so many people (even those that do it on a regular basis and are "experts" in it) find dealing with ARIN to be such a PITA. They need to consider whether the policies that they have in place really and truly do accomplish the goals that they are supposed to accomplish. I think its pretty clear at this point that they don't. They need some common sense discussion about really how to accomplish the goals, the current policies clearly aren't doing it...even can be counter-productive wrt to the whole point of why ARIN was created (ie, more common sense policies would have resulted in me advertising half the number of routes in BGP than I am now...the goal of reducing routing table growth has most definitely not been accomplished in my case...and, as I've pointed out...I'm really *trying* to do the Right Thing...not all ISPs do). They need to "normalize" (for lack of a better word) their published policies...as well as "normalize" their actual policies with what's published. The feel that I get (this is a perception...not much hard evidence to back it up...but I'd be surprised if I'm alone in this) is that ARIN has put policies up on its web site, and then totally independantly, developed policies for operation...with the same basic set of goals in mind. The result being policies in real life that are similar, but not the same, as what's published. If there's a change in the real-life policy, that needs to be reflected on their website. As for some specific policy points that I think are bogus. Obviously, I feel the allocating for 3-months needs to be expanded...I'd say probably to a year would be reasonable. Basing it on past usage growth...ok...I don't have any inherent problems with that, but specific situations, such as a desire to renumber out of PA space, should be considered much more strongly than it is currently. Limiting SWIP to /29 or shorter prefixes doesn't seem to have much merit to me...I imagine a lot of ISPs wouldn't want to SWIP longer prefixes because of the administrative overhead (of which there certainly would be some)...our system allows us to do it pretty easily, so it wouldn't be a big deal here. And, as bdragon pointed out, circuit size (and I'll add network size) doesn't correlate precisely with ip address space consumption (ie, the idea that you can put a very large corporate network behind a single, or very small number of ip addresses). Certainly, large networks like that, should probably have their own records...even if only a single public IP address is in use. So, what guideline would I come up for this? As a discussion starting point, require anything shorter than /29 to be SWIP'ed, but leave longer up to the ISP...yes, not many ISPs would SWIP anything longer than /29, but we would, *particularly* if it made dealing with ARIN easier (which is should). Anyway...some starting points...I'm sure...with more thought and more experience dealing with ARIN, I could come up with some more suggestions...but I'll be the first to admit that I don't have all the answers. -- Jeff McAdams Email: jeffm(a)iglou.com Head Network Administrator Voice: (502) 966-3848 IgLou Internet Services (800) 436-4456

11 19

Re: Independent space from ARIN
by Jeff McAdams 15 Apr '03

15 Apr '03

Also Sprach bdragon(a)gweep.net >> Yes...following policy over common sense. Exactly as I feared. >Or some would say that the policy _is_ common sense. Uhm...only someone on the moon, maybe. Their (unpublished) policies are seriously lacking in common sense...I think that's been shown in my postings...and acknowledged by any of the number of people here that are much more expert at dealing with ARIN than I am. >Sometimes it makes things harder, you deal with it, or in your case, >you whine about it on mailing lists. Or, you try to reform the situation by shedding light on the inadequacies of the institution. >You claimyou were efficiently utilizing the space, but of course ARIN >can't defend themselves, so we are left to believe you. Even if you >_are_ telling the truth, the number of folks on this list who have >stated that they've advocated lying, or have helped people lie seems to >tell me that ARIN shouldn't believe you. I haven't seen anyone in this thread advocate lying...though I don't follow all nanog posts, so I don't know if it may have happened in other threads...if so, I find that reprehensible. More than that I can't say. >> Again, we had greater than 80% utilization on *all* of our >> blocks...not just the most recently allocated one, and closer to 90% on most >> of them. The documentation that we gave to ARIN in support of our >> request showed this as well. >So you say. So...at this point, your defense of ARIN is to assume that *I'm* lying. Great. >>My "error" was that I expected ARIN would give me enough space to >>renumber out of my current space as their documentation on their >>website seems to indicate is necessary. Silly me. >So, you did absolutely nothing. This is a common problem with many on >nanog. If I can't do something 100% my ay, I'ld rather do nothing. I did nothing because I was told by ARIN that I wasn't expected to re-number...that it wasn't a consideration in the allocation. I offered to renumber in the initial allocation because I was under the impression that it was required, not because we wanted to do it at that time. When they said it wasn't expected, or a consideration, no, we didn't renumber. Then we find out, much later, that it *is* a consideration, and that we're partially screwed because we didn't read their mind that it was a consideration when they were verbally telling us that it wasn't. >>Yeah, it would be silly of ARIN to actually abide by the documentation >>that they post on their website...so silly. >I've read their documentation. It sounds like they abided with their >policies to me. Depends on when you ask, apparently. (Actually, neither explanation I got from ARIN, either after the initial allocation, nor the one I got in the process of the most recent allocation, line up with what's on their website). >Oof, so even _you_ translate circuit size into eligibility for address >space? Actually...if you really want to get pedantic, we translate how much money a customer pays us into partial eligibility for address space. We still require justification, but if a customer doesn't have a certain size account, they won't get the address space even if they *are* justified for it. Again, we're going above and beyond what ARIN requires as far as address space requirements...despite your attempt to spin this into being my problem (why you're so emotionally invested in ARIN, I haven't a clue). >How stupid indeed, since circuit size has no bearing on need for >addresses (either in support or against). There is a correlation there...not strict, I'll acknowledge, but generally, larger circuits will end up using larger numbers of IP's. To deny that is as absurd as saying the correlation is strict, or to have a policy of certain size circuits automatically get certain sized allocations. Again, we try to do the Right Thing. I've turned down allocations from upstreams that weren't needed in an effort to prevent address space fragmentation and routing table polution, etc. >If I were ARIN I'ld definately look at your documentation with a close >eye. Again, your defense of ARIN seems to be accusing me of under-handed actions. >Well, good for you. However, if you think you can do this once and be >done, you are sorely misinformed. We haven't had to go back and redesign and renumber our network, because we learned from the first experience and have followed good allocation practices since then. I've gone back and audit'ed our network usage (informally) and it still falls within good allocation guidelines. So, no, I *don't* have to go back and do this more than once...as long as the allocations made, going forward, follow best practices, which we have. >In any event, it all comes down to: you had the opportunity to begin >readdressing. You failed to do so on anything but your own terms. Now >you (presumably) still have not readdressed and are still whining about >it. You just don't get it. As I mentioned earlier, we offered to re-number at the initial allocation because we thought it was necessary, but ARIN themselves told us it wasn't, that *IT WASN'T A CONSIDERATION*...you seem to keep skipping over this very important point...ARIN told us we didn't need to renumber. They lied to us, full stop. Had they been up-front and said that re-numbering would be a consideration at our next allocation, we would have (grudgingly) worked towards renumbering...again...since they didn't give us sufficient space to renumber, we would not have been able to do so completely, but we would have started the process. Let's be clear on this. Our decision not to start the renumbering process was informed by ARIN telling us it wasn't a consideration. I know I'm repeating myself here, but this is a critically important point that you have repeatedly ignored. >This thread has sapped too much of my time, and the brain cells of the >community. Hopefully you'll just go and renumber and quit your >bitching. No, as long as ARIN's policies and actions are ill-founded, they (and likely other relevant...at least tangentially) fora such as nanog will continue to hear about it...from me, and no doubt from others who have to tolerate this charade of trying to protect the public interest. ARIN has failed. -- Jeff McAdams Email: jeffm(a)iglou.com Head Network Administrator Voice: (502) 966-3848 IgLou Internet Services (800) 436-4456

11 13

Stopping TCP DDoS HOWTO
by John Obi 15 Apr '03

15 Apr '03

Hello Nanogers, What is the best way to stop TCP DDoS, I'm not talking about UDP or ICMP, just TCP attacks, and not spoofed too. I see alot of attacks coming from rr.com and attbi.com beside other cable and DSL providers. Thanks, -J __________________________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo http://search.yahoo.com

2 1

Re: Independent space from ARIN
by Eric Brunner-Williams in Portland Maine 15 Apr '03

15 Apr '03

> I am sure Microsoft would love to have this implemented. For them to drop, > say, $5b and buy up all remaining available IP address space is no big > deal. ... Howdy Hank, Back when I was contributing to "Working Group C" (ICANN New gTLDs), through the clutter of trademark zealots (no new tlds ever) and anarchists (zillions now) the insight swept over me one like-verisign-to-compeat-verisign evening. Everyone wanting "in" was an amature, or one of the six new registrars, and a cut above amature, and no one had deep pockets, except courtesy of the dot gone bubble. So who could sweep this market, and bundle a domain name into their product... It hasn't happened. My crystal ball has a crack. Eric

1 0

ARIN meeting virtual attendance
by jlewis＠lewis.org 15 Apr '03

15 Apr '03

As is pretty clear from recent threads, there are ARIN members who, for whatever reasons, don't or can't attend the public meetings, but would like to have some input into ARIN's policies as well as voice their concerns over the current state of ARIN <-> member interaction. Since we're a relatively high-tech group, has anyone ever looked into what it takes to setup virtual attendance? i.e. I'm guessing a good number of network operators have either participated DoveBid's auctions (getting the network and office goodies at auction from your failed telecom competitors) or know people who have. I've personally been to these both in person and virtually. In virtual mode, you get to listen in on the auction and speak when necessary (i.e. to bid). With a bit of hardware, I bet this could even be done with VOIP, removing the need for anyone (ARIN or the members) to pay for the long distance calls for virtual attenders. I don't know what hardware/software is involved in this (i.e. what DoveBid uses), but IIRC, ARIN does have several million in the bank. What better way to spend our money than to facilitate member participation? I think this would be a great way to get more member participation at the meetings...and (for personal reasons) it's the only way I can see myself getting to a meeting in the near future. ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route System Administrator | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

5 6

RE: Independent space from ARIN
by Dave Israel 14 Apr '03

14 Apr '03

On 4/14/2003 at 17:27:20 -0400, Brandon Ross said: > On Mon, 14 Apr 2003, Dave Israel wrote: > > > There's a lot more available real estate than available v4 address > > space. That's the biggest one. > > Is there? How much address space would be available if it were utilized > efficiently by everyone? Once you put a price tag on it, organizations > become the models of efficiency in utilization. If you can use NAT, you > will, if you can't, you'll only assign unique addresses to > users/applications that absolutly require it. If you don't like those > options, maybe you'll move to v6. I just don't see a problem here. Ah, but when you buy address space, are you going to be happy about giving it back when you change providers? Will the provider give you a fair price on selling it back? Do you think sales departments won't insist you buy their address space when you connect? And if you can keep it, it makes the routing table more and more interesting. > > Second, groups that make the Internet go aren't necessarily the ones who > > can afford the address space. > > If they can't afford the address space, there's a very good chance it's > because they are inefficient and they should be done away with. Besides, > I just don't see address space being prohibitively expensive on an open > market, as a previous poster pointed out, only a minority of address space > is currently announced in the Internet. I'd bet at least half of that > isn't used at all, and I'd bet another half of that is unnecessary. That's a pretty brash thing to say on Merit's mail server. Much of the research and coordination of the Internet is done by research groups and universities. It isn't inefficiency that keeps their available cash for address space down; it is the nature of their business. > > But really, you just need the first one: small space. The relatively > > small pool means that a large company with lots of money could buy the > > whole ARIN chunk of the Internet. > > There are a large number of organizations with more addres space than they > need. The chances of any one company buying all the address space and > then just sitting on it are nil. Why would their investors allow them to > sit on a asset and not make any income on it? They would have to compete > with the likes of GE, ATT, MIT, and Genuity for sales of the address space > they already hold. Who said they would just sit on it? Why not make the Internet now "The Internet, Brought To You By Company X?" You need Company X's address space, so you have to provide Company X's services on Company X's operating system? It's this kind of thing that keeps areas of the radio spectrum licensed by the government. -Dave

4 3

Lata 670 connections
by Dan Hollis 14 Apr '03

14 Apr '03

Anyone bandwidth providers able to sell bandwidth over qwest ATM in lata 670? Please drop me a line. -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

1 0

Force 10 gear
by Dr. Mosh 14 Apr '03

14 Apr '03

Anyone have or work with Force 10 gear and have an opinion? Specifically on their L3 routing like BGP, OSPF, etc. Replies offline please. -D

1 0

Re: Independent space from ARIN
by Dave Israel 14 Apr '03

14 Apr '03

On 4/14/2003 at 18:13:35 -0500, Stephen Sprunk said: > Thus spake "Dave Israel" <davei(a)algx.net> > > That's a pretty brash thing to say on Merit's mail server. Much of > > the research and coordination of the Internet is done by research > > groups and universities. It isn't inefficiency that keeps their > > available cash for address space down; it is the nature of their > > business. > > While I'm sure we all value Merit's contributions to the Internet, both past > and present, you cannot seriously believe they are even remotely efficient > in their use of 35/8 -- nor can one expect them to be without financial > incentive. What boggles my mind is they managed to get allocated another > 668,424 addresses in CIDR land -- do a whois and see for yourself. I didn't say their usage was efficient; what I was expressing was the fear that they would have to go away entirely, in the face of companies with tons of cash buying into what was suddenly an unregulated pool of precious limited commodity that requires no maintenance or upkeep. > > It's this kind of thing that keeps areas of the radio spectrum > > licensed by the government. > > And the govt licenses that spectrum to the highest bidder, plus allows > owners to sell spectrum to each other as assets. Pretending the RIRs are > even remotely similar is disingenuous. (*sigh*) I guess I should have been more specific. When I said "areas of the radio spectrum," I was referring to the areas that were set apart before anybody learned how to get arbitrary amounts of bandwidth in a very small range. Specifically, the frequencies on your FM dial are meted out by the FCC, and while they, like ARIN, find a way to make gobs of dough off of it, they also make sure the usage is reasonably fair among the users and that the public airwaves are not excessively abused. While we can surely find flaws in both the FCC and in ARIN, that does not mean the work they do does not benefit the users of their domain immensely.

1 0