September 2004 - Test - lists.nanog.org

Equipment Shelter with Backup Generator
by Adi Linden 17 Sep '04

17 Sep '04

I am looking for ideas/suppliers for placing network equipment and satellite earth station equipment in remote locations. There are no suitable facilities to colocate but single phase power is available. Any ideas where to find a secure steel clad building, that fits a couple of rack, has environmenal conditioning, room for a UPS and generator backup? Thanks, Adi

1 0

NYSE
by Philip Lavine 17 Sep '04

17 Sep '04

Does anyone have experience in setting up a direct connection with NYSE, specifically SIAC or SFTI? __________________________________ Do you Yahoo!? Read only the mail you want - Yahoo! Mail SpamGuard. http://promotions.yahoo.com/new_mail

1 0

AS22534 Leaking, anybody alive their?
by Matt Levine 17 Sep '04

17 Sep '04

All attemps to reach them are have failed. Ticket open with MFN to request that maybe put a prefix-list on this customer..or maybe even max-prefixes.. Seems they're leaking their level3 transit routes to mfn: eg: prefix: 64.12.0.0/16 (AOL) 6461 22534 3356 1668 8176 I MFN in turn seems to be leaking it to all (or atleast most) peers. Sigh.

3 2

RE: Multi-link Frame Relay OR Load Balancing
by Mike Walter 17 Sep '04

17 Sep '04

I am using MLFR with MCI currently. I have a Cisco 7204 VXR and it works like a champ. I have had times where one T1 circuit was down and I had no problems besides seeing the bandwidth utilization change. When it came up everything went back to normal. I am looking into an Ethernet Handoff due to cost savings, however MCI does not offer that in Cincinnati, but that is a completely different story. My T1's terminate into ATL and I am seeing great responses. Mike Walter, MCP PCD Network Solutions, Inc. 3z.net a PCD Company <http://www.3z.net> -----Original Message----- From: Peering [mailto:Peering@xspedius.com] Sent: Friday, September 17, 2004 11:13 AM To: Scott McGrath; Bryce Enevoldson Cc: nanog(a)merit.edu Subject: RE: Multi-link Frame Relay OR Load Balancing Depending on your area, DS3 isn't necessarily cheaper than 8 T1s. I know in some markets, I have to buy 16 T1s from Bell before it matches their DS3 cost. It just depends on the tariffs. I've never used MLF before, just MLPPP, but in my experience, MLPPP works for my customers better than load-sharing. The only problems I've seen, and I'm working one this morning, is that Cisco has its usual bug issues. I had one customer on 12.3(6) and there's about 19 known bugs between 12.3(6) and MLPPP, a lot of which aren't resolved yet. One even made you reboot if you added or deleted a T1 from the bundle or the MLPPP bundle wouldn't come back up. Diane Turley Network Engineer Xspedius Communications Co. 636-625-7178 -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Scott McGrath Sent: Thursday, September 16, 2004 8:12 PM To: Bryce Enevoldson Cc: nanog(a)merit.edu Subject: Re: Multi-link Frame Relay OR Load Balancing In my experience the breakeven point for a Frame Relay DS3 is 6 DS1 circuits. DS3's tend to be more reliable than DS1's as the ILEC usually installs a MUX at your site instead of running to the nearest channel bank and running the T1's over copper with a few repeaters thrown in for good measure. Another nice thing about DS3's is that it is easy to scale bandwidth in the future by modifying the CIR on your link. Another feature is that since the link is faster the serialization delay is lower which will give you better latency and last but not least PA3+ for Cisco 7[2|5]xx routers are inexpensive and give you one call for service not a separate call for the CSU/DSU's and the serial line card you need to support a multilink solution. Scott C. McGrath On Thu, 16 Sep 2004, Bryce Enevoldson wrote: > > We are in the process of updating our internet connection to 8 t1's > bound together. Due to price, our options have been narrowed to AT&T > and MCI. I have two questions: 1. Which technology is better for > binding t1's: multi link frame relay > (mci's) or load balancing (att's) > 2. Which company has a better pop in Atlanta: mci or att? > > We are in the Chattanooga TN area and our current connection is 6 t1's > through att but they will only bond 4 so they are split 4 and 2. > > Bryce Enevoldson > Information Processing > Southern Adventist University > > >

1 0

Weekly Routing Table Report
by Routing Table Analysis 17 Sep '04

17 Sep '04

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 18 Sep, 2004 Analysis Summary ---------------- BGP routing table entries examined: 146980 Prefixes after maximum aggregation: 87372 Unique aggregates announced to Internet: 70140 Total ASes present in the Internet Routing Table: 18068 Origin-only ASes present in the Internet Routing Table: 15701 Origin ASes announcing only one prefix: 7323 Transit ASes present in the Internet Routing Table: 2367 Transit-only ASes present in the Internet Routing Table: 75 Average AS path length visible in the Internet Routing Table: 4.6 Max AS path length visible: 22 Prefixes from unregistered ASNs in the Routing Table: 57 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 17 Number of addresses announced to Internet: 1338258084 Equivalent to 79 /8s, 196 /16s and 50 /24s Percentage of available address space announced: 36.1 Percentage of allocated address space announced: 58.3 Percentage of available address space allocated: 61.9 Total number of prefixes smaller than registry allocations: 67376 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 28143 Total APNIC prefixes after maximum aggregation: 14195 Prefixes being announced from the APNIC address blocks: 26407 Unique aggregates announced from the APNIC address blocks: 14209 APNIC Region origin ASes present in the Internet Routing Table: 2143 APNIC Region origin ASes announcing only one prefix: 638 APNIC Region transit ASes present in the Internet Routing Table: 324 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 22 Number of APNIC addresses announced to Internet: 161969792 Equivalent to 9 /8s, 167 /16s and 118 /24s Percentage of available APNIC address space announced: 73.9 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 23552-24575 APNIC Address Blocks 58/7, 60/7, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 83808 Total ARIN prefixes after maximum aggregation: 51188 Prefixes being announced from the ARIN address blocks: 64163 Unique aggregates announced from the ARIN address blocks: 22757 ARIN Region origin ASes present in the Internet Routing Table: 9550 ARIN Region origin ASes announcing only one prefix: 3415 ARIN Region transit ASes present in the Internet Routing Table: 926 Average ARIN Region AS path length visible: 4.4 Max ARIN Region AS path length visible: 18 Number of ARIN addresses announced to Internet: 232603392 Equivalent to 13 /8s, 221 /16s and 63 /24s Percentage of available ARIN address space announced: 69.3 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647,29695-30719, 31744-33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/7, 72/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 27264 Total RIPE prefixes after maximum aggregation: 19026 Prefixes being announced from the RIPE address blocks: 24104 Unique aggregates announced from the RIPE address blocks: 15851 RIPE Region origin ASes present in the Internet Routing Table: 5826 RIPE Region origin ASes announcing only one prefix: 3131 RIPE Region transit ASes present in the Internet Routing Table: 997 Average RIPE Region AS path length visible: 5.2 Max RIPE Region AS path length visible: 21 Number of RIPE addresses announced to Internet: 171318592 Equivalent to 10 /8s, 54 /16s and 29 /24s Percentage of available RIPE address space announced: 60.1 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-34815 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6459 Total LACNIC prefixes after maximum aggregation: 2272 Prefixes being announced from the LACNIC address blocks: 6247 Unique aggregates announced from the LACNIC address blocks: 3521 LACNIC Region origin ASes present in the Internet Routing Table: 393 LACNIC Region origin ASes announcing only one prefix: 119 LACNIC Region transit ASes present in the Internet Routing Table: 77 Average LACNIC Region AS path length visible: 5.1 Max LACNIC Region AS path length visible: 15 Number of LACNIC addresses announced to Internet: 16039680 Equivalent to 0 /8s, 244 /16s and 191 /24s Percentage of available LACNIC address space announced: 47.8 LACNIC AS Blocks 26592-26623, 27648-28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1252 Total AfriNIC prefixes after maximum aggregation: 688 Prefixes being announced from the AfriNIC address blocks: 830 Unique aggregates announced from the AfriNIC address blocks: 664 AfriNIC Region origin ASes present in the Internet Routing Table: 92 AfriNIC Region origin ASes announcing only one prefix: 20 AfriNIC Region transit ASes present in the Internet Routing Table: 12 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 16 Number of AfriNIC addresses announced to Internet: 2060544 Equivalent to 0 /8s, 31 /16s and 113 /24s Percentage of available AfriNIC address space announced: 12.3 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 834 4193 156 Data Communications Bureau 1221 810 1184 583 Telstra Pty Ltd 4766 545 3408 266 Korea Internet Exchange for " 9583 531 41 103 Satyam Infoway Ltd., 4755 367 133 49 Videsh Sanchar Nigam Ltd. Aut 9443 355 70 81 Primus Telecommunications 2907 350 1840 324 SINET Japan 17676 350 5212 41 XTAGE CORPORATION 9929 347 161 33 China Netcom Corp. 17557 313 22 155 Pakistan Telecom 703 311 342 240 UUNET 2764 283 274 232 connect.com.au pty ltd 7474 271 269 200 Optus Communications Pty Ltd 9942 234 73 130 COMindico Australia 4802 232 28 142 Wantree Development 9800 229 372 66 CHINA UNICOM 9498 223 49 49 BHARTI BT INTERNET LTD. 4837 202 2264 106 chinanet IDC center beijing n 10036 202 18 185 C&M Communication Co. Ltd. 9304 189 160 26 Hutchison Telecom (HK) ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1411 6737 977 AT&T WorldNet Services 701 1267 8422 910 UUNET Technologies, Inc. 1239 944 2882 628 Sprint 2386 829 545 594 AT&T Data Communications Serv 4323 773 613 211 Time Warner Telecom 18566 739 208 6 Covad Communications 6197 720 362 350 BellSouth Network Solutions, 721 713 21011 295 DLA Systems Automation Center 209 620 3464 493 Qwest 3356 592 10923 452 Level 3 Communications, LLC 20115 578 422 291 Charter Communications 3561 518 2487 369 Cable & Wireless USA 852 509 1141 396 Telus Advanced Communications 7843 489 676 100 Adelphia Corp. 7132 434 8157 376 SBC Internet Services 6198 431 396 199 BellSouth Network Solutions, 705 429 163 271 UUNET Technologies, Inc. 6347 398 158 93 SAVVIS Communications Corpora 22773 397 960 18 Cox Communications, Inc. Atla 27364 395 36 19 Armstrong Cable Services RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 634 2031 526 UUNET - Commercial IP service 3320 300 2470 237 Deutsche Telekom AG 3301 282 1098 272 TeliaNet Sweden 8220 274 460 261 COLT Internet - International 21502 268 40 3 NUMERICABLE is a cabled netwo 680 251 2025 239 DFN-IP service G-WiN 3246 217 475 214 Song Networks 13083 217 51 8 Mannesmann Datenverarbeitung 1257 211 745 180 SWIPnet Swedish IP Network 8708 204 113 183 Romania Data Systems S.A. 5515 198 842 144 Sonera Solution Autonomous Sy 3215 184 876 77 France Telecom Transpac 786 176 1794 176 The JANET IP Service 719 157 288 102 LANLINK autonomous system 6746 155 29 132 Dynamic Network Technologies, 5400 154 209 124 BT Ignite European Backbone 25186 153 154 109 France Telecom Transpac's Tra 3303 148 610 130 Swisscom Ltd 3269 145 1195 66 TELECOM ITALIA 8866 138 16 20 Bulgarian Telecommunication C LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6140 364 138 65 ImpSat 11172 358 99 53 Servicios Alestra S.A de C.V 8151 302 455 134 UniNet S.A. de C.V. 16814 212 13 7 NSS, S.A. 6147 191 86 19 Telefonica Del Peru 11664 154 11 21 Keytech SA 6505 137 90 94 Global One Communicaoes Ltda 6503 132 171 88 AVANTEL, S.A. 7303 122 55 18 Telecom Argentina Stet-France 11992 90 9 31 Integrated Systems 10620 86 12 5 TVCABLE BOGOTA 14420 85 6 35 ANDINATEL S.A. 6535 84 5 18 Chilesat Servicios Empresari 10481 81 32 7 Prima S.A. 11556 81 41 3 Cable-Wireless Panama 11311 80 7 20 Sinectis S.A. 5639 77 8 8 Telecommunications Services o 15311 76 21 36 Telefonica Empresas 10292 71 6 27 TELECOMMUNICATIONS OF JAMAICA 14117 71 6 4 Telefonica del Sur S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 251 631 218 The Internet Solution 5536 114 16 4 Internet Egypt Network 2018 94 297 92 Tertiary Education Network 2905 92 276 81 The Internetworking Company o 20928 59 16 1 Noor Advanced Technologies AS 14988 48 16 1 Botswana Telecommunications C 24835 36 34 7 RAYA Telecom - Egypt 6713 32 42 10 Itissalat Al-MAGHRIB 9129 31 3 4 UUNET Kenya 5713 26 125 24 Telkom SA Ltd 8524 25 1 4 AUCEGYPT Autonomous System 16637 24 10 19 Johnnic e-Ventures 10798 18 1 12 Standard Bank of South Africa 12258 18 3 12 Vodacom Internet Company 12455 17 4 2 Jambonet Autonomous system 21491 16 1 3 UTL On-line is RF broadband I 8346 15 7 14 SONATEL-AS Autonomous System 15706 15 4 2 Sudatel Internet Exchange Aut 21280 14 2 3 Swift Global Kenya Ltd.Is an 15808 13 1 2 Communication Solutions Ltd i Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 18566 739 733 Covad Communications 4134 834 678 Data Communications Bureau 4323 773 562 Time Warner Telecom 9583 531 428 Satyam Infoway Ltd., 721 713 418 DLA Systems Automation Center 7843 489 389 Adelphia Corp. 22773 397 379 Cox Communications, Inc. Atla 27364 395 376 Armstrong Cable Services 5668 393 375 Century Telephone 6197 720 370 BellSouth Network Solutions, 6467 389 359 E.Spire Communications, Inc. 701 1267 357 UUNET Technologies, Inc. 22909 368 331 Comcast Cable Corporation 4755 367 318 Videsh Sanchar Nigam Ltd. Aut 1239 944 316 Sprint 9929 347 314 China Netcom Corp. 17676 350 309 XTAGE CORPORATION 6347 398 305 SAVVIS Communications Corpora 11172 358 305 Servicios Alestra S.A de C.V 6140 364 299 ImpSat List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 23456 UNALLOCATED 62.241.160.0/19 25346 Pipex Internet UK IS 65115 PRIVATE 64.28.115.0/24 20385 AccessLine Communica 23456 UNALLOCATED 81.86.0.0/16 25346 Pipex Internet UK IS 23456 UNALLOCATED 81.178.0.0/15 25346 Pipex Internet UK IS 64513 PRIVATE 164.78.128.0/17 7610 SINGAPORE ADVANCE RE 64513 PRIVATE 164.78.249.0/24 7610 SINGAPORE ADVANCE RE 64513 PRIVATE 164.78.252.0/24 7610 SINGAPORE ADVANCE RE 65217 PRIVATE 192.102.236.0/24 217 University of Minnes 1877 UNALLOCATED 192.108.199.0/24 1876 Southern Methodist U 22750 UNALLOCATED 196.44.64.0/19 3741 The Internet Solutio 22750 UNALLOCATED 196.44.86.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.224.0/20 3741 The Internet Solutio 64572 PRIVATE 219.146.96.0/21 17633 ASN for Shandong Pro 64572 PRIVATE 219.146.96.0/20 17633 ASN for Shandong Pro 64572 PRIVATE 219.146.104.0/21 17633 ASN for Shandong Pro 64573 PRIVATE 219.146.112.0/21 17633 ASN for Shandong Pro 64573 PRIVATE 219.146.112.0/20 17633 ASN for Shandong Pro 64573 PRIVATE 219.146.120.0/21 17633 ASN for Shandong Pro 64576 PRIVATE 219.146.128.0/21 17633 ASN for Shandong Pro 64576 PRIVATE 219.146.128.0/20 17633 ASN for Shandong Pro 64576 PRIVATE 219.146.136.0/21 17633 ASN for Shandong Pro 64582 PRIVATE 219.146.144.0/22 17633 ASN for Shandong Pro 64582 PRIVATE 219.146.144.0/21 17633 ASN for Shandong Pro 64582 PRIVATE 219.146.148.0/22 17633 ASN for Shandong Pro 64584 PRIVATE 219.146.176.0/22 17633 ASN for Shandong Pro 64584 PRIVATE 219.146.176.0/21 17633 ASN for Shandong Pro 64584 PRIVATE 219.146.180.0/22 17633 ASN for Shandong Pro 64575 PRIVATE 219.146.192.0/22 17633 ASN for Shandong Pro 64575 PRIVATE 219.146.192.0/21 17633 ASN for Shandong Pro 64575 PRIVATE 219.146.196.0/22 17633 ASN for Shandong Pro 64580 PRIVATE 219.146.208.0/21 17633 ASN for Shandong Pro 64581 PRIVATE 219.146.216.0/21 17633 ASN for Shandong Pro 64585 PRIVATE 219.146.224.0/21 17633 ASN for Shandong Pro 64586 PRIVATE 219.146.232.0/21 17633 ASN for Shandong Pro 64582 PRIVATE 219.147.0.0/24 17633 ASN for Shandong Pro 64572 PRIVATE 222.173.128.0/20 17633 ASN for Shandong Pro 64572 PRIVATE 222.173.128.0/19 17633 ASN for Shandong Pro 64572 PRIVATE 222.173.144.0/20 17633 ASN for Shandong Pro 64573 PRIVATE 222.173.160.0/20 17633 ASN for Shandong Pro 64573 PRIVATE 222.173.160.0/19 17633 ASN for Shandong Pro 64573 PRIVATE 222.173.176.0/20 17633 ASN for Shandong Pro 64576 PRIVATE 222.173.192.0/20 17633 ASN for Shandong Pro 64576 PRIVATE 222.173.192.0/19 17633 ASN for Shandong Pro 64576 PRIVATE 222.173.208.0/20 17633 ASN for Shandong Pro 64582 PRIVATE 222.173.224.0/20 17633 ASN for Shandong Pro 64582 PRIVATE 222.173.224.0/19 17633 ASN for Shandong Pro 64582 PRIVATE 222.173.240.0/20 17633 ASN for Shandong Pro 64584 PRIVATE 222.174.96.0/20 17633 ASN for Shandong Pro 64584 PRIVATE 222.174.96.0/19 17633 ASN for Shandong Pro 64584 PRIVATE 222.174.112.0/20 17633 ASN for Shandong Pro 64575 PRIVATE 222.174.160.0/20 17633 ASN for Shandong Pro 64575 PRIVATE 222.174.160.0/19 17633 ASN for Shandong Pro 64575 PRIVATE 222.174.176.0/20 17633 ASN for Shandong Pro 64580 PRIVATE 222.174.224.0/19 17633 ASN for Shandong Pro 64581 PRIVATE 222.175.0.0/19 17633 ASN for Shandong Pro 64585 PRIVATE 222.175.32.0/19 17633 ASN for Shandong Pro 64586 PRIVATE 222.175.64.0/19 17633 ASN for Shandong Pro Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 111.0.0.0/24 7563 Korea Internet Infrastructure 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.43.230.0/24 4738 South Australian Academic Res 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.172.11.0/24 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:6 /11:15 /12:63 /13:134 /14:306 /15:541 /16:8041 /17:2217 /18:3849 /19:9808 /20:10328 /21:7755 /22:10699 /23:12325 /24:80141 /25:237 /26:196 /27:105 /28:49 /29:31 /30:75 /31:0 /32:37 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 724 739 Covad Communications 2386 595 829 AT&T Data Communications Serv 6197 572 720 BellSouth Network Solutions, 7018 555 1411 AT&T WorldNet Services 702 388 634 UUNET - Commercial IP service 27364 379 395 Armstrong Cable Services 1239 372 944 Sprint 9583 370 531 Satyam Infoway Ltd., 4766 363 545 Korea Internet Exchange for " 701 356 1267 UUNET Technologies, Inc. 5668 343 393 Century Telephone 6198 317 431 BellSouth Network Solutions, 6347 297 398 SAVVIS Communications Corpora 20115 292 578 Charter Communications 6467 287 389 E.Spire Communications, Inc. 9929 278 347 China Netcom Corp. 6517 269 296 Yipes Communications, Inc. 21502 265 268 NUMERICABLE is a cabled netwo 13609 263 306 Choice One Communications Inc 3320 246 300 Deutsche Telekom AG Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:4 8:3 12:1395 13:1 15:5 16:2 17:3 20:9 24:723 32:66 33:2 38:80 40:54 44:4 52:3 55:1 56:3 57:17 60:6 61:499 62:488 63:1838 64:2332 65:2055 66:2476 67:390 68:535 69:719 70:70 80:525 81:549 82:316 83:146 84:26 111:1 128:109 129:169 130:87 131:188 132:25 134:182 135:17 136:134 137:55 138:169 139:35 140:184 141:107 142:120 143:67 144:156 145:41 146:294 147:94 148:424 149:107 150:87 151:70 152:153 153:68 154:2 155:127 156:58 157:71 158:143 159:161 160:57 161:70 162:379 163:79 164:210 165:159 166:118 167:223 168:292 169:115 170:270 171:9 192:5585 193:2896 194:2127 195:1481 196:587 198:3674 199:3255 200:3797 201:16 202:4836 203:5646 204:3237 205:2070 206:2316 207:2543 208:2141 209:3044 210:1484 211:626 212:1075 213:1186 214:132 215:31 216:3718 217:1003 218:177 219:101 220:249 221:37 222:40 End of report

1 0

RE: Open-Source Network Management Tools
by Michael Smith 17 Sep '04

17 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Alexei Roudnev [mailto:alex@relcom.net] > Sent: Friday, September 17, 2004 12:53 AM > To: Michael Smith; nanog(a)merit.edu > Subject: Re: Open-Source Network Management Tools > > I always tried to avoid any deal with SNMP TRAPS as most unreliable > and unconvenient way of alerting (unfortunately, it can not be > avoided totally). > We use 'syslog' (syslog-ng + home written syslog analyzers + > copmmercial soft, sometimes) when possible. > Unfortunately, SNMP TRAPS are what is available on the SONET transport side of the network. There is no useful data to be gotten from polling. In addition, the fact that TRAPS are proactive instead of reactive means I have am immediately aware of network events whereas I might miss something with a poll. In addition, we have dry contact closures on these devices that TRAP only, no polling. Thankfully, the number of these events is small enough that syslog functions quite well. Syslog has not been up to the task of working with the sheer volume of TRAPS generated when there is a significant event on the optical network. Sometimes we see the notification but not the resolution, sometimes we see all but the last line of a TRAP message, and sometimes we get nothing. Thanks, Mike -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQA/AwUBQUscOZzgx7Y34AxGEQK3oQCgg6bP3O4Pt5GyOPXsi+1tSvLrt2AAnjqs BeYnYocvvNjP1RqqfH2dq+HT =JrJP -----END PGP SIGNATURE-----

2 1

My Worm is Bigger Than Yours
by J. Oquendo 17 Sep '04

17 Sep '04

To give others further information on this sdbot.worm (continuing from my previous post http://www.merit.edu/mail.archives/nanog/msg01241.html) here are the main characteristics I've found on almost all variants I've come across. Obviously it seems to be a polymorphic form of worm meaning its characteristics are changing. Before I begin though I would hope no one would think its off topic since there may be one variant of this worm flooding your network with randomly generated MAC addresses, not good on those switches. Also I wouldn't think it's off topic since most of you are likely already seeing, or will be seeing more traffic generated on ports 445, 80, and 82. There seems to be one main executable, but I haven't found out which one this is. The names I've come across so far for most of the executables are somewhat synomous with standard Windows programs. Microsoft program Worm's program serv.exe serv32.exe services.exe services32.exe lsass.exe lsass32.exe The following is a list of the names of the executables I've come across which meet the criteria of this annoyance. Setver32.exe Regsrv32.exe Wmmon32.exe Mswinc.exe Mswincv.exe Mswinc32.exe Systemiom.exe Bling.exe Rzqodp.exe ftpd.exe Other programs have garbled names e.g., wetyr.exe, oiure.exe These programs typically tend to reside in: C:\temp C:\tmp c:\Windows c:\Windows\tmp c:\Windows\system32 c:\Windows\system32\config\systemprofile Along with the usual MSIE cache folder. The programs have been appearing in Windows' registry as follows: HKLM\SOFTWARE\MICROSOFT\OLE HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA Easiest thing to sort of do is ctrl-f for the names and you will usually seem them bundled, but if you have to remove it, you want to search for each individually since some mix things up. Name Data Setver32.exe Windows Secure Regserv32.exe Reg Service Mswinc.exe Remote Procedure Calls Mswinc32.exe Remote Procedure Calls Systemiom.exe System Updater Others have no Data associated with them. Now the I haven't managed to zero in on which is sending our random MAC addresses yet but eventually I will try maybe an antivirus company can do so before me. So let me explain a few quick oddities I've seen so far . Get a complain student is not connected, go to dorm, repunch his port, no dice, open the closet no dice. What was happening with his machine was his connection would come up, then go down the second it came up, then come right back up the second it went down. Same happened with a colleague Bizarre, bizarre. Another student "I can't get my Interweb" . Same thing repunch her, repatch her machine with the latest "Microsoft Fixitall Service Pack 7354738245" still no dice. Run through reinstalling drivers, swapping Ethernet cards, nothing. Redid some tweaks and she gets connected. Second she did get connected. "IP ADDRESS CONFLICT WITH FOO MAC" Only thing was after searching the network no MAC addresses with the number it was posting existed. This particular issue with the MAC "spoofing" if you want to call it that, I prefer random MAC generation, was being flooded out through ports 80, and 82. So what will happen if some worm has the characteristics built in to generate MAC's when it tries to send out your router's or servers MAC address? You do the math. (NOTE: Still looking into this port 80 82 issue so could be a false alarm but nevertheless I've come across some odd things this past week which I'd never seen.) Most of the worms that open the port 445 connections, tend to open up hundreds if not thousands of requests more than likely to infected machines. After the first few occurrences I came across, I would see a machine pop open a few hundred connections after seconds of their machine obtaining an address. The first thing I would notice via netstats would be some form of IRC connection going out, so the possibilities would be either a DdoS slave, or it's sending information somewhere. Bling is supposedly set to send "ALL_THINGS_RELATED_TO_LOGINS" as well as Paypal information to some server, if it is sending information I can't find where it would be storing it. Keep in mind the prior code I was able to find regarding this annoyance where it modified antivirus software to either kill it, or to avoid detection, as well as kill your ability to use regedit, taskmgr, and other tools. There is the possibility it is storing something somewhere, I haven't come across it yet. Finally (I think) the ftpd.exe which always seems to piggyback with the others, this little piggie more than likely may be the one turning the infected machine to a TFTP server whereby other infected machines ensure they stay infected. This seems to create a file called bla.txt This text file lists the following: Open 10.192.41.87 13501 User blah Pass blah Binary Get bot.exe Quit Bot.exe I'm gonna assume is probably an ircbot of sorts, unfortunately I cannot find this program anywhere, but the infected machine does connect to irc, it does open a TFTP server, and will attempt to connect to hundreds if not thousands of ports via 445. Most machines may have gotten infected via file sharing, Limewire, Kazaa, KazaaLite, BitTorrent, etc., along with probably viewing some porn related page since I've also come across dialer.exe's here and there. Sorry for the long mail, and apologies if it seems offtopic to some but remember, someone down the line is paying for this traffic. Let's hope it doesn't becomes an epidemic like Microsoft itself. At least you'd of been forewarned of some of the characteristics you're likely to see. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

1 0

RE: Open-Source Network Management Tools
by Michael Smith 17 Sep '04

17 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > I'm looking for open-source alternatives for network management, > such as Nagios or Big Brother. We are currently using WhatsUp Gold, > and would like to move to something more flexible (and not running > on a Windows platform). Something that has email/paging > capabilities, and can process SNMP traps would be a plus for us as > well. > > > Recommendations? > > Thanks. > > I'd like to expand the question by asking, what Open-Source applications do people use for SNMP Trap collecting and alarming? We're very happy with Nagios for polling, but we have a lot of optical components that send information via Traps that then needs to be culled, trimmed and analyzed. Thanks, Mike -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQA/AwUBQUhq+Zzgx7Y34AxGEQJP6gCgh1KW5vvq2fRh4WBSik1Q7Ay31okAoIAh ZKUgPFi9PZhDpOGIAXXOIY9W =oD9A -----END PGP SIGNATURE-----

7 8

RE: Multi-link Frame Relay OR Load Balancing
by Peering 17 Sep '04

17 Sep '04

Depending on your area, DS3 isn't necessarily cheaper than 8 T1s. I know in some markets, I have to buy 16 T1s from Bell before it matches their DS3 cost. It just depends on the tariffs. I've never used MLF before, just MLPPP, but in my experience, MLPPP works for my customers better than load-sharing. The only problems I've seen, and I'm working one this morning, is that Cisco has its usual bug issues. I had one customer on 12.3(6) and there's about 19 known bugs between 12.3(6) and MLPPP, a lot of which aren't resolved yet. One even made you reboot if you added or deleted a T1 from the bundle or the MLPPP bundle wouldn't come back up. Diane Turley Network Engineer Xspedius Communications Co. 636-625-7178 -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Scott McGrath Sent: Thursday, September 16, 2004 8:12 PM To: Bryce Enevoldson Cc: nanog(a)merit.edu Subject: Re: Multi-link Frame Relay OR Load Balancing In my experience the breakeven point for a Frame Relay DS3 is 6 DS1 circuits. DS3's tend to be more reliable than DS1's as the ILEC usually installs a MUX at your site instead of running to the nearest channel bank and running the T1's over copper with a few repeaters thrown in for good measure. Another nice thing about DS3's is that it is easy to scale bandwidth in the future by modifying the CIR on your link. Another feature is that since the link is faster the serialization delay is lower which will give you better latency and last but not least PA3+ for Cisco 7[2|5]xx routers are inexpensive and give you one call for service not a separate call for the CSU/DSU's and the serial line card you need to support a multilink solution. Scott C. McGrath On Thu, 16 Sep 2004, Bryce Enevoldson wrote: > > We are in the process of updating our internet connection to 8 t1's > bound together. Due to price, our options have been narrowed to AT&T > and MCI. I have two questions: 1. Which technology is better for > binding t1's: multi link frame relay > (mci's) or load balancing (att's) > 2. Which company has a better pop in Atlanta: mci or att? > > We are in the Chattanooga TN area and our current connection is 6 t1's > through att but they will only bond 4 so they are split 4 and 2. > > Bryce Enevoldson > Information Processing > Southern Adventist University > > >

1 0

Re: Open-Source Network Management Tools
by Jeremy Kister 17 Sep '04

17 Sep '04

On Tuesday, September 14, 2004 3:48 PM, Tom Claydon wrote: > I'm looking for open-source alternatives for network management, such as > Nagios or Big Brother. We are currently using WhatsUp Gold, and would Argus: The World's Most Advanced Monitoring System: http://argus.tcp4me.com/ Jeremy Kister http://jeremy.kister.net/

1 0