November 2005 - Test - lists.nanog.org

L3 having issues on the west coast?
by Jon Lewis 03 Nov '05

03 Nov '05

I was trying to get some IOS and compare a few images in FN, and found I cisco.com was being sluggish, and FN wouldn't load at all. Packets Pings Hostname %Loss Rcv Snt Last Best Avg Worst ... 6. ge-6-2-0.mp1.Orlando1.Level3.net 0% 44 44 5 4 13 120 7. ae-0-0.bbr1.SanJose1.Level3.net 14% 38 44 75 74 75 77 8. ge-11-1.ipcolo1.SanJose1.Level3.net 23% 34 44 75 75 75 76 9. p1-0.cisco.bbnplanet.net 10% 40 44 75 75 81 160 10. sjce-dmzbb-gw1.cisco.com 0% 44 44 77 75 82 292 11. sjck-dmzdc-gw2.cisco.com 25% 33 44 76 76 76 77 12. www.cisco.com 59% 18 44 76 76 77 78 That doesn't look right. Anyone know what's going on out there? ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

3 2

Call for Volunteers for Mailing List Administration Panel
by Randy Bush 03 Nov '05

03 Nov '05

There is an opening on the NANOG Mail List Administration Panel. According to the draft charter[1]: "... The NANOG list will be administered and minimally moderated by a panel selected by the Steering Committee." Accordingly, the Steering Committee is soliciting nominations for this open position, from now through 17:00 GMT Thursday, November 17, 2005. ** Procedure ** To volunteer yourself or nominate someone else, please send mail to nanog-admin(a)nanog.org with the following information, no later than 17:00 GMT Thursday, November 17, 2005: - Your name - Nominee's name (if not you) - Nominee's email address - Nominee's phone number - Nominee's employer - Reasons why you believe the nominee is qualified to serve on the Mail List Panel. A panel member will contact each of the nominees to verify interest and possibly request additional information. Once all nominations have been received, the Steering Committee, in cooperation with the Mailing List Panel, will select the new member from among the nominees. The result will be announced on the nanog-announce mailing list. ** Eligibility ** Anyone actively reading the nanog(a)nanog.org mailing list is eligible. A nominee may not be a member of the NANOG Program Committee or the NANOG Steering Committee. ** Duties ** Basic duties include reading the mailing list and assisting with keeping things on-topic. The team also deals with abuse issues as they arise. ** Length of term ** The charter does not specify ML Panel member term lengths. Open discussion of this is being led by the NANOG Steering Committee. If you have any questions, please post to the meta-discussion list, nanog-futures(a)nanog.org, or email nanog-admin(a)nanog.org and steering(a)nanog.org. Finally, on behalf of the Mailing List Panel and the Steering Committee, we would like to thank the outgoing panel member, Steve Gibbard, for his dedication to the mailing list and the reform process as a whole. Chris Malayter for the Mailing List Panel Randy Bush for the Steering Committee [1] The draft charter is available at http://www.nanog.org/charter05.html -30-

1 0

SBC/AT&T + Verizon/MCI Peering Restrictions
by Daniel Golding 03 Nov '05

03 Nov '05

Any thoughts on this: http://www.convergedigest.com/Bandwidth/newnetworksarticle.asp?ID=16437 --- <snip> The applicants committed, for a period of three years, to maintain settlement-free peering arrangements with at least as many providers of Internet backbone services as they did in combination on the Merger Closing Dates. The applicants committed for a period of two years to post their peering policies on publicly accessible websites. During this two-year period, the applicants will post any revisions to their peering policies on a timely basis as they occur. ---- </snip> Published SFI peering policies are nice, but the overlap in SFI peering between each pair of merging carriers may require them to peer with additional networks. For example, there is some overlap between SBC and AT&T in regards to SFI peers. This might require the combined network to interconnect with additional networks to MAINTAIN the overall number of SFI peers. I guess its a good time to apply to 701 for SFI, although it appears the number of slots are limited to some unknown (and probably low) number. Gentlefolk, start your engines :) Can anyone else think of regulatory restrictions previously placed on SFI relationships in North America? I realize this is more like a consent decree than true regulation, but its an interesting move by the regulators. Regulation is generally a bad thing, but publishing SFI requirements - and even SFI relationships - won't hurt anyone, IMHO. -- Daniel Golding

13 21

New Rules On Internet Wiretapping Challenged
by Vicky Rode 03 Nov '05

03 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 http://www.washingtonpost.com/wp-dyn/content/article/2005/10/25/AR200510250… or By Arshad Mohammed Washington Post Staff Writer Wednesday, October 26, 2005; Page D01 New federal wiretapping rules that would make it easier for law enforcement to monitor e-mails and Internet-based phone calls were challenged by privacy, high-tech and telecommunications groups in federal court yesterday. The groups argued that the rules would force broadband Internet service providers, including universities and libraries, to pay for redesigning their networks to make them more accessible to court-ordered wiretaps. The groups also said the Federal Communications Commission rules, scheduled to take effect in May 2007, could erode civil liberties and stifle Internet innovation by imposing technological demands on developers. "It's simply a very bad idea for privacy and for free speech for the government to design any technology, much less the Internet, to be surveillance-friendly," said Lee Tien, a senior staff lawyer with the Electronic Frontier Foundation, a nonprofit privacy rights group. The government was trying to "build tentacles of control throughout telecommunications networks," Tien said. The FCC rules make broadband Internet providers and voice over Internet protocol companies subject to a 1994 federal law that requires telecom companies to assist law enforcement agencies in carrying out court-ordered wiretaps. The Communications Assistance for Law Enforcement Act requires telecom carriers to design their networks so they can quickly intercept communications and deliver them to the government when presented with a court order. In adopting the rules, the FCC said it wanted to ensure the government could carry out wiretaps as more communications move from the traditional telephone system to the Internet. "It is clearly not in the public interest to allow terrorists and criminals to avoid lawful surveillance by law enforcement agencies," the commission wrote in its order. Opponents argued the law was tailored for a simpler, earlier era of traditional telephone service and could cripple the evolution of the Internet by forcing engineers to design products so they can be easily monitored by the government. The 1994 law "will have a devastating impact on the whole model of technical innovation on the Internet," said John Morris, staff counsel for the Center for Democracy and Technology in Washington, which filed an appeal of the rules with the U.S. Court of Appeals for the District of Columbia Circuit yesterday. "The Internet evolves through many tens of thousands, or hundreds of thousands, of innovators coming up with brand new ideas," he said. "That is exactly what will be squelched." Morris said his group did not dispute the idea that the government should be able to carry out court-ordered wiretaps, but rather argued that the 1994 law was a blunt instrument ill-suited for the Internet age. He said the matter should be referred to Congress, which "can tailor the obligations to the Internet context as opposed to importing the very clumsy [telephone system] obligations and imposing them on the Internet." The American Council on Education, a higher-education trade group, separately asked the court Monday to review the rules. "We fear that doing what they want will require every router and every switch in an IT system to be replaced," said Terry W. Hartle, the council's senior vice president. He estimated that the upgrades could cost colleges and universities $6 billion to $7 billion. "Our quarrel with them is fairly specific," Hartle said. "We are concerned about the cost, and the complexity, and the schedule on which they want this accomplished." Spokesmen for the FCC and the Justice Department declined comment on the court challenges. - ------- end ------- ...Raising my hand. My question is on Terry Hartle's comments, maybe someone with more insight into this could help clear my confusion. Why would it require to replace every router and every switch when my understanding is, FCC is looking to install *additional* gateway(s) to monitor Internet-based phone calls and emails. I can see some sort of network redesign happening in order to accodomate this but replacing every router and every switch sounds too drastic, unless I mis-understood it. Please, I'm not advocating this change but just trying to understand the impact from an operation standpoint. Any insight will be appreciated. regards, /virendra -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFDX/AApbZvCIJx1bcRAktgAKDzp+GaIDlpp5vdYT61jOWzEciClACfRkkW uQBPWQSzNpsw1M80tUQgWdI= =4t1U -----END PGP SIGNATURE-----

6 6

Re: New Rules On Internet Wiretapping Challenged
by Vicky Rode 03 Nov '05

03 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 in-line: Adam Chesnutt wrote: > This whole thread is silly! It's not hard to trap and trace a suspect. > It doesn't require a "Whole new generation of routers and switches" - -------------- That was exactly my understanding but I think it goes beyond that. > > Correct me if I'm wrong here, but it seems to me that it's a fairly > trivial task to mirror and upstream, and isolate the traffic required. > I've performed such taps before and usually find it to easily performed > with a single FreeBSD box, and a mirrored port on the router. - --------------- true enough. > > Or maybe I'm just missing the point of this thread. - --------- You might want to take a look at rfc 2804 for some background. regards, /virendra > > Flounder > > > Vicky Rode wrote: > > > comments in-line: > > > Peter Dambier wrote: > > > >>Vicky Rode wrote: > > > > >>>...Raising my hand. > >>>My question is on Terry Hartle's comments, maybe someone with more >>>insight into this could help clear my confusion. > >>>Why would it require to replace every router and every switch when my >>>understanding is, FCC is looking to install *additional* gateway(s) to >>>monitor Internet-based phone calls and emails. >>> > > >>In a datacenter you have lines coming in and lines going out. And you >>have internal equippment. > >>You have to eavesdrop on all of this because the supposed terrorist >>might come in via ssh and use a local mail programme to send his email. > > > > -------------- > How do you differentiate between a hacker and a terrorist? > > For all you know this so called "terrorist" might be coming from a > spoofed machine(s) behind anyone's desk. > > > > > >>So you have to eavesdrop on all incoming lines because you dont know >>where he comes in. Via aDSL? via cable modem? Via a glass fiber? > >>And you have to monitor all internal switches because you dont know >>which host he might have hacked. > >>Guess a cheap switch with 24 ports a 100 Mbit. That makes 2.4 Gig. >>You have to watch all of these. They can all send at the same time. >>Your switch might have 1 Gig uplink. But that uplink is already in >>use for your uplink and it does not even support 2.4 Gig. > > > > ------------- > There are ways to address over-subscription issues. > > > > > >>How about switches used in datacenters with 48 ports, 128 ports, ... >>Where do you get the capacity for multiple Gigs just for eavesdropping? > >>On the other hand - most switches have a port for debugging. But this >>port can only listen on one port not on 24 or even 48 of them. > >>So you have to invent a new generation of switches. > > > > ---------------- > I don't believe this is the primary reason for replacing every router > and every switch. > > I think (correct me if I'm wrong) it has to do with the way wiretap > feature (lack of a better term) that .gov is wanting vendors to > implement within their devices, may be at the network stack level. > > I guess it's time to revisit rfc 2804. > > > > > >>How about the routers? They are even more complicated than a switch. > >>As everybody should know by now - every router can be hacked. So >>your monitoring must be outside the router. > >>The gouvernment will offer you an *additional* gateway. >>I wonder what that beast will look like. It must be able to take >>all input you get from a glass fiber. Or do they ask us to get >>down with our speed so they have time to eavesdrop. > > > > ----------------- > powered by dhs w/ made in china sticker :-) > > I'm not being smarty pants about this...it is actually happening. That's > all I can say. > > > > regards, > /virendra > > > > > > > >>>I can see some sort of >>>network redesign happening in order to accodomate this but replacing >>>every router and every switch sounds too drastic, unless I >>>mis-understood it. Please, I'm not advocating this change but just >>>trying to understand the impact from an operation standpoint. > >>> > > >>Yes, it is drastic. But if they want to eavesdrop that is the only >>way to do it. > > > > > >>>Any insight will be appreciated. > > > >>>regards, >>>/virendra > >>> > > >>Here in germany we accidently have found out why east germany had >>to finally give up: > >>They installed equippement to eavesdrop and tape on every single >>telefone line. They could not produce enough tapes to keep up >>with this :) > >>Not to mention what happened when they "recycled" the tapes and >>did not have the time to first erase them :) > > >>Kind regards, >>Peter and Karin > > > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFDakYzpbZvCIJx1bcRAv2XAKDxgQqfs+nZMrUCR7zyKATJjfEBbgCg9/lu N7waCSlgruy6yecfnFwO17M= =1vBJ -----END PGP SIGNATURE-----

2 1

OT: Cisco Patches 'Black Hat' IOS Flaw
by Henry Linneweh 03 Nov '05

03 Nov '05

http://www.eweek.com/article2/0,1895,1881303,00.asp Apparently now all the bluster about people capable of fixing problems with the internet without a congressional mandate worked still..... -Henry

1 0

Re: classful routes redux
by Geoff Huston 03 Nov '05

03 Nov '05

At 01:16 PM 3/11/2005, Christopher L. Morrow wrote: >On Wed, 2 Nov 2005, Fred Baker wrote: > > > > > actually, no, I could compare a /48 to a class A. > > > >(someone might already have asked this, but...) why /48? Because the thinking at the time appears to be that to "ease' renumbering reduce the costs associated with address distribution functions (and associated network assessment tasks) and because there were heaps of addresses, all end-sites would get the same address allocation, and the uniform amount that was arrived at was a /48 . When asked whether this referred to _everything_ that may require subnets, the answer was "yes". When asked whether this encompassed everything from a mobile phone to a large corporate the answer given was, once more, "yes". Why /48 rather than /47 or /49? - alignment to nibble boundaries to make DNS delegation easier. Why /48 rather than /32 or /40? I really cannot say - I suspect that /48 is the largest end site number that meets the projected scope as described in RFC 3177. regards, Geoff

2 1

Re: classful routes redux
by Christopher L. Morrow 02 Nov '05

02 Nov '05

On Thu, 3 Nov 2005 bmanning(a)vacation.karoshi.com wrote: > > > > hostroute == /64 > > > > > > > > (and just think of all that spam than can originate from all those > > > > "loose" IP addresses in that /64 for your local SMTP server!!! Yummy) > > > > > > > > -- Oat Willie > > ok... so is it -just- me that gets the willies thinking of the > 2x64-1 available IPv6 addresses that can be forged as source > addresses for spam origination? i REALLY want to have a tidy but, but, but... ipv6 is more SECURE! :) I'm really not sure I understand why my LAN has to have more available ip space than the current Internet, but boy, it sure makes it easy to spam^H^H^H^Hfind available addresses! I view the 48/56/64 boundaries about like Woody does (and I suspect Mr. Narkins and Mr. Bush) they are in the documentation so people use them, it's not particularly a great idea, but it is an idea. (Oh, and some equipment won't do the lovely autoconfig unless you have a /64, someone should open a bug report on that)

1 0

cogent+ Level(3) are ok now
by Jared Mauch 02 Nov '05

02 Nov '05

http://biz.yahoo.com/prnews/051028/laf022.html?.v=27 The internet will not end on November(9)th :) - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

22 35

RE: FW: Using BGP to force inbound and outbound routing through particular routes
by Edward W. Ray 02 Nov '05

02 Nov '05

Yes, you are correct I have decided to go for my CCIE:Security and need some practice before the lab exam. My only choices for multi-homing at home are T1s/DS3s... And cable. I already have a 3-T1 setup where the Class C block is homed now. This is my main business line and hosts my DNS, Web, Mail servers and VPN connections. The ISP I use is has punched a hole in their Class B to allow my Class C block to leak through. At some point I may get a business class cable line. But since I do not know if what I am doing will violate Roadrunner's AUP and/or cause them to disconnect me, I decided to go with the $29.95 special. My ISP already peers with Level3, and Roadrunner peers with Level3 (AS3356) and AOL (AS 1668). My goal is to block all routes via Roadrunner/Level3 and force all inbound and outbound traffic via Roadrunner to go through AS 1668 only. Edward W. Ray -----Original Message----- From: Mike Damm [mailto:symetrix@gmail.com] Sent: Wednesday, November 02, 2005 12:22 PM To: spam Subject: Re: FW: Using BGP to force inbound and outbound routing through particular routes Let me see if I understand what you are saying... You have a real network with routers, T1 lines, all that jazz. And you'd like to multihome with a cable modem? Right? -Mike On 11/2/05, spam <spamjail(a)mmicman.com> wrote: > > I recently made a request to get a cable modem connection at my home. > I went for one of those $29.95 for three month specials in case I run > afoul of some rules prohibiting what I am going to do. I already have > a multi-T1 connection with a Class C block and BGP running on my Cisco > 3640 router, and was looking to become multi-homed. The cable > connection is via bridge/DHCP cable modem, and was going to hook it up > to the Cisco 3640. I have already done the research and know from > what block of IP addresses I will be assigned, and the BGP route tables/peers. > > I would like to use BGP to force inbound and outbound routing only > through particular peers, Sprint (AS 1239) and UUNET (AS 701). I have > been reading "Practical BGP" by Whate, McPherson and Sangli and this > appears to be possible. However, do my adjacent routers need to > support BGP in order for this to work? Could I use other routing > protocols to accomplish this, or would this require knowledge of all possible downstream router IP addresses? > > Edward W. Ray > >

1 0