May 2003 - Test - lists.nanog.org

Traffic broken down by application protocol?
by k claffy 01 May '03

01 May '03

apologies for latency On Wed, 23 Apr 2003, Matt Larson wrote: > I'm looking for statistics on the composition of Internet backbone > traffic broken down by application protocol. Ideally, I'd be > interested in a list showing the relative percentage of packets by TCP > and UDP destination port of some large sample of Internet traffic. > But I'll take any statistics related to application protocol traffic > distribution that I can get. > > If anyone has information that they would be willing to share publicly > or privately, I would be grateful for it. Alternately, if anyone is > aware of such information publicly available, I would be grateful for > pointers to that, too. When in doubt, if you are looking for statistics about or on the Internet start with www.caida.org. caida website is undergoing restructuring for easier navigation (yeah we'll be done any year now) so in the meantime let me make this easier on you also allow me to lower your standards (but raise your future expectations) because we are in the process of setting up a better system for regularly capturing and maintaining this type of data. (blocked on hardware and software and some cool methodology in development to do high speed flow estimation/analysis) anyway so you may want to try the 3 links under http://www.caida.org/analysis/workload/byapplication/ most recent in webpage form (not so recent) for high-capacity backbone (san jose, california): http://www.caida.org/analysis/workload/byapplication/oc48/20020305/apps_per… 20305/20020305_b.xml older: http://www.caida.org/analysis/workload/byapplication/oc48/20011029/apps_200… tabular view of same: http://www.caida.org/analysis/workload/byapplication/oc48/20011029/apps_per… finally it's academic-ish locations (but hey that's where all future application types start) and older data (1998-2001, we're trying to update it w newer data this spring, stay tuned) but try figure 7 of http://www.caida.org/outreach/papers/2003/nlanr/ (`Longitudinal study of Internet traffic from 1998-2001: a view from 20 high performance sites') sorry it's suboptimal but so is the current ability to measure this sort of thing at a large and arguably representative scale but you knew that already k

1 0

Backhoe + gas
by Timo Janhunen 01 May '03

01 May '03

It must be spring, as it appears that those fiber and gas main locating machines are out again. It doesn't get much worse than this: http://www.torontostar.com/NASApp/cs/ContentServer?pagename=thestar/Layout/…

1 0

Corecom / voyager
by Jeffrey Sharpe 01 May '03

01 May '03

Could someone from Corecom / Voyager on the list please contact me. Jeffrey Sharpe CyberLynk HelpDesk and Support CyberLynk Network, Inc. 10125 S. 52nd. Street Franklin, WI 53132 414-858-9335 or 1-800-862-5965 www.cyberlynk.net

1 0

DACS (DXC) failure disrupts service in 16 Ohio counties
by Sean Donelan 01 May '03

01 May '03

Has anyone come up with a solution for the DACS problem? Whenever a telco has a DACS failure, it usually disrupts telephone services for 8-12 hours across a large geographic area. http://www.marionstar.com/news/stories/20030501/topstories/223237.html

2 1

Re: Who is announcing bogons?
by Paul Vixie 01 May '03

01 May '03

> > the fun part is watching the bgp announce/withdraws in unallocated space. > > (no matter what microsoft may have learned from their survey, most isp's > > don't seem to care which prefixes their bgp-speaking customers advertise.) > > So which ISPs are confused? Bogon's don't spontaneously occur in BGP. > Some ASN must originate them, and ASNs must pass them to other ASNs. > BGP helpfully includes the ASNs in the path. geoff huston is the only person i know who's making formal progress on that question. i know from some zebra log files that iana's unallocated space gets advertised from time to time, then withdrawn. presumably an attack was launched during the announcement but i don't have any data showing this. > What should be done about ASNs which repeatedly announce false or > unauthorized routes? apparently, nothing. to the extent that peering is by agreement, the majority of such agreements now in force do not require the other party to route-filter their customers. which is funny, since they tend to drone on endlessly about the importance of a 24x7 NOC, which in operational practice, matters lots less. (btw, anybody signed a peering agreement which requires an abuse@ mailbox yet?)

5 11

dns servers responding w/ nxdomain for aaaa/any queries
by Jared Mauch 01 May '03

01 May '03

Does someone know where some good resources are to help people that have misconfigured dns servers that respond to NXDOMAIN for ANY or AAAA dns queries? One of the financial institutions that I do business with needs some technical clue as in the past 24 hours they've managed to make their dns/website go away. Believe it or not there was someone with clue that answered the number listed in whois, I am just looking for a good set of information to pass along to them to help explain the issue. Preferably some help with the EAG-2001-10-15 dns server if anyone knows what that is. version.bind. 0S CHAOS TXT "EAG-2001-10-15" Thanks, - Jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

Re: Who is announcing bogons?
by sthaug＠nethelp.no 01 May '03

01 May '03

> > >net 39 was left in my care by my previous boss. > > > > If so then: > > http://www.iana.org/assignments/ipv4-address-space > > should be updated to reflect that. > > It did reflect that and still should. All it says is 039/8 Apr 95 IANA - Reserved Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

2 1

RE: level(3) issues in phl
by Temkin, David 01 May '03

01 May '03

>From Yipes (who's a big L3 customer) Dear Yipes Customer, Please be aware that we are experiencing network problems in Philadelphia that may affect your connection or ability to route to Internet sites. Our Network Engineers are currently investigating the cause of this issue. We will continue to keep you updated with the status of our investigation. Trouble ticket 39815 has been created for this issue. Yipes will monitor your port status for 24 hours and close this trouble ticket if we do not receive a response from you or a request for an official Reason for Outage(RFO). If you have any further questions, please do not hesitate to contact us. -----Original Message----- From: alex(a)yuriev.com [mailto:alex@yuriev.com] Sent: Wednesday, April 30, 2003 8:52 PM To: nanog(a)merit.edu Subject: level(3) issues in phl Is anyone seeing any Level(3) issues in Philadelphia right now? Alex IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

1 0

Re: Re[2]: The in-your-face hijacking example, was: Re: Who is announcing bogons?
by emil＠atrivo.com 01 May '03

01 May '03

Hello Everyone, Let's see if we can clarify this once and for all. ISD owner was a good friend of mine and helped me when I ran a computer store. Without him I couldn't run the store and over the years I have repaid him for his contributions. A few years ago I closed the computer store and started Atrivo. At first we acquired /24's direct from the providers themselves and was statically routing everything. We did this for a few years until recently when we upgrade our routers and decided to BGP. We have grown to the point that we have to prepare for the future. After discussing our expansion plans to Rob, I came to find out that he did posses a /16 which his now defunct company wasn't using anymore. >From that point I found out what it would take from Arin to have us use the space. We followed all the steps that Arin had told us to do. We of course wanted to update contact information to reflect the new change and so we can respond to any issues that may arrive running a ISP. All our providers and vendors know us as a respectable company. There is nothing wrong that we have done and all this witch hunting is unjust and unfair. Might I mention that Spews, SpamHaus or anyone that has made these claims has not even attempted to give me a call. I have even tried to make arrangements to meet up at the colo and to show anyone that we are for real. Of course this has been always declined. Well I don't know how much this will help, since it's seems that no matter what I offer or do is just not enough. Maybe I have to give my DNA just to prove who I am? Thanks! Atrivo - Web Innovation Emil Kacperski Phone: 925-550-3947 E-mail: emil(a)atrivo.com ICQ: 23531098

3 2

RE: Re: Get as much IP space as you ever dreamed of, was: Re: Looking to buy IPv4 addresses from class C swamp
by Stewart, William C (Bill), RTSLS 01 May '03

01 May '03

[Let's try this again without fat-fingering the Send button :-)] Seems like an obvious case for using IPv6. RFC2373 site-local addresses assign a /48, with 16 bits of subnet ID and 64 bits of host ID. The average location probably doesn't have 2**16 extranets on one DMZ; picking a random value usually yields one that nobody you're talking to is also talking to, so almost nobody needs to use NAT for this kind of thing, assuming you plan to tunnel them.

5 5