October 2004 - Test - lists.nanog.org

Another one bites the dust
by Husan Sarris 14 Oct '04

14 Oct '04

Stephen - although you have often been a valuable contributor to the NANOG list, you received your "last warning" about list AUP violations last spring. Because of your non-operational post below, and your gratuitous mention of Hitler, which could be offensive to some, we have removed your posting privileges from the NANOG list for a period of four months. Please refer to the AUP: http://www.nanog.org/aup.html Susan Harris, Ph.D. Merit Network/Univ. of Mich. On Wed, 13 Oct 2004, Stephen J. Wilcox wrote: > > On Wed, 13 Oct 2004, Christian Malo wrote: > > > FREE RICHARD > > Of course my understanding of revoking posting privileges is that you cant post > to the list.. not you are imprisoned in the merit dungeons, i think that > punishment is reserved for Bandy/Husan/etc > > However I do like some humor being injected onto the list, so long as the SNR > doesnt diminish too much it can help to inject some life inbetween the 'paging > bob smith' / 'anyone help me configure bgp' / path mtu / urpf cyclical debates.. > actually we've not had Hitler discussed for a while, perhaps I can start a > thread... ooops > > Steve

3 3

Contact
by Husan Sarris 14 Oct '04

14 Oct '04

BTW I've been told that Susan reports to bburke(a)merit.edu, so I'd suggest mailing her with any issues you may have with her censorship, and overall lack of diplomacy and technical knowledge needed to run the NANOG list and meetings.

1 0

Re: BCP38 making it work, solving problems
by Fred Baker 14 Oct '04

14 Oct '04

At 08:39 AM 10/12/04 +0530, Suresh Ramasubramanian wrote: >Yes I know that multihoming customers must make sure packets going out to >the internet over a link match the route advertised out that link .. but >stupid multihoming implementations do tend to ensure that lots of people >will yell loudly, and yell loudly enough for several tickets to be >escalated well beyond tier 1 NOC support desks, for ISPs to kind of think >twice before they put uRPF filters in .. You might want to take a glance at RFC 3704, which looks at a number of the issues that have been raised in this thread, including the routing of traffic to appropriate enterprise egress points. In my heart of hearts, I would like enterprises to (as a default) match layer 2 and layer 3 addresses on the originating LAN, and quarantine-as-busted any machine that sends an address other than assigned on an interface. It seems that the few cases where a device legitimately sends multiple addresses are exception cases that can be handled separately. Handling it that close to the source solves the problem for everyone. Practically, that is difficult. If you think getting all of the service providers (who wind up having to fix ddos attacks, and pay for bandwidth and services related to ddos attacks) to manage networks well is difficult, consider the prospect of getting all the edge networks to do so... As simple solution is, as someone suggested, pose an idiot tax and bill the customers for doing stupid things. Egress traffic filtering in the enterprise is relatively simple for the average enterprise - it has at most a few prefixes and can write a simple ACL on its upstream router. It can use the ACL either to discard offending packets or to route them to the right egress. It is also relatively simple for the average enterprises' ISP: it knows what prefix(es) it agreed to accept traffic from and can write an ACL. It gets a little dicier when the customer is a lower tier ISP. In that case, there are potentially many prefixes, and they change more frequently. That is the argument for something like uRPF. No, it is not a "sure fix", but it handles that case more readily, both in the sense of being a fast lookup and in the sense of maintaining the table. The problem is, of course, in the asymmetry of routing - it has to be used with the brain engaged. From an ISP perspective, I would think that it would be of value to offer *not* ingress filtering (whether by ACL or by uRPF) as a service that a customer pays for. Steve Bellovin wrote an April Fool's note suggesting an "Evil Bit" (ftp://ftp.rfc-editor.org/in-notes/rfc3514.txt) I actually think that's not such a dumb idea if implemented as a "Not Evil" flag, using a DSCP or extending the RFC 3168 codes to include such, as Steve Crocker has been suggesting. Basically, a customer gets ingress filtered (by whatever means) and certain DSCP settings are treated as "someone not proven to have their act together". Should a ddos happen, such traffic is dumped first. But if the customer pays extra, their traffic is marked "not evil", protected by the above, and ingress filtering may be on or off according to the relevant agreement. The agreement would need to include a provision to the effect that once a ddos is traced in part to the customer, their traffic is marked as "evil" for a period of time afterwards. What the customer is paying for, if you will, is the ability to do their thing during a ddos in a remote part of the network, such as delivering a service to a remote peer. Address spoofing is just one part of the ddos problem; to nail ddos, we also need to police a variety of application patterns. One reason I like the above is that it gives us a handle on what traffic might possibly be "not evil" - someone has done something that demonstrates that it is from a better managed source.

4 5

Excessive DNS Requests
by Anderson, Ian 13 Oct '04

13 Oct '04

Anyone else seeing excessive DNS requests hammering their local forwarders this evening. We've just taken our residence network off-line owing to the level of port 53 traffic coming from it. Can't see anything in the usual places regarding this.... Cheers Ian -- Ian Anderson Network Support Lancaster University t: 01524 593393 ~ IP: 01524 510101 ~f: 01524 525125 mailto:i.anderson@lancs.ac.uk

4 3

can someone who runs AS 7018 contact me off list asap
by Richard Gross 13 Oct '04

13 Oct '04

Our space is hi-jacked at this moment, and I need some help. 207.182.224.0/19 does not belong to you. richg

1 0

RE: Verio Routing
by Joe Johnson 13 Oct '04

13 Oct '04

Everything did come back up before I sent the email (otherwise I wouldn't have been able to unless I dialed in). I was a little disappointed about their blanket "temporary major network issues" statement from Level 3 support. Normally they are really good about support. Joe Johnson JMDN.net -----Original Message----- From: Richard J. Sears [mailto:rsears@adnc.com] Sent: Wednesday, October 13, 2004 5:27 PM To: Joe Johnson Cc: nanog(a)merit.edu Subject: Re: Verio Routing We have an OC3 with Verio and took a hit as well.. On Wed, 13 Oct 2004 17:06:02 -0500 "Joe Johnson" <jjohnson(a)jmdn.net> wrote: > > Did anyone else just get a hiccup on Verio circuits? Lost routing in > small 2-5 second bursts incrementally over the past 10 minutes. > > Joe Johnson > JMDN.net ****************************************** Richard J. Sears Vice President American Digital Network ---------------------------------------------------- rsears(a)adnc.com http://www.adnc.com ---------------------------------------------------- 858.576.4272 - Phone 858.427.2401 - Fax INOC-DBA - 6130 ---------------------------------------------------- I fly because it releases my mind from the tyranny of petty things . . "Work like you don't need the money, love like you've never been hurt and dance like you do when nobody's watching."

1 0

Verio Routing
by Joe Johnson 13 Oct '04

13 Oct '04

Did anyone else just get a hiccup on Verio circuits? Lost routing in small 2-5 second bursts incrementally over the past 10 minutes. Joe Johnson JMDN.net

2 1

Updated monitoring pages from Team Cymru
by Rob Thomas 13 Oct '04

13 Oct '04

[ Apologies to those of you who receive this note in multiple forums. ] Hi, team. We are pleased to announce some updated monitoring, as well as some new monitoring, on our web site. This includes aesthetic fixes as well as increased visibility. Our DNS monitoring now has increased visibility as well as a new look and feel. Gone are the multiple pages for each zone, replaced with a single page that will have additional zones soon. You'll find it at the following URL. <http://www.cymru.com/DNS/dns.html> The times are DNS query response times, and the query responses are checked for correctness. Clicking on the query response time will bring you to a more detailed, graphical view of the query responses for the given pod and name server combination. We've updated our network monitoring to include several new components. This includes pod to pod ICMP, TCP, and UDP monitoring. It also includes traffic graphs for a select few Darknet pods, and our new Internet Garbage Meter. :) <http://www.cymru.com/Reach/index.html> For more on Darknets, from which our Darknet monitoring and Internet Garbage Meter are generated, please see our Darknet Project page at the following URL. <http://www.cymru.com/Darknet/> We hope you find this of use. Comments and suggestions are always welcome! Thanks! Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

FW: Verio Routing
by James Laszko 13 Oct '04

13 Oct '04

We saw a hiccup in San Diego. Routes towards a lot of our monitored customers vanished and starting going out other providers... James Laszko Pipeline Communications, Inc. james(a)pcipros.com -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Joe Johnson Sent: Wednesday, October 13, 2004 3:06 PM To: nanog(a)merit.edu Subject: Verio Routing Did anyone else just get a hiccup on Verio circuits? Lost routing in small 2-5 second bursts incrementally over the past 10 minutes. Joe Johnson JMDN.net

1 0

NANOG censorship
by Sichard Reenbergen 13 Oct '04

13 Oct '04

|On Wed, 13 Oct 2004, Husan Sarris wrote: |> |> NANOG, |> |> It is with great sadness that I inform you that Richard Steenbergen, |> long-time NANOG contributor and colleague, has been censored by |Dr. ETC. finally! i just want to say how disappointed I am that people have been posting notes using our names with the letters mixed around over the last few years. thanks doc for finally kicking one of these trangressors off the list. sincerely, -- Bandy Rush, Dean Soran, Husan Sarris, and Sichard Reenbergen 3 more to go!!

2 1