December 2005 - Test - lists.nanog.org

Re: QoS for ADSL customers
by Miquel van Smoorenburg 02 Dec '05

02 Dec '05

In article <cistron.e05f39290511290324l761e676dm2cf141344c966a99(a)mail.gmail.com>, Kim Onnel <karim.adel(a)gmail.com> wrote: >We have Juniper ERX as BRAS for ADSL >Our humble approach was to collect some p2p ports and police traffic to >these ports, but the traffic wasnt much, one other thing is rate-limiting >per ADSL customers IPs, but that wasnt supported by management, so we >thought of matching ADSL www traffic and doing exceed action is transmit, >and police other IP traffic. > >Doing so on the ERX wasnt a nice experience, so we're trying to do it on the >cisco. The ERX really has good CoS and QoS controls (not NBAR though AFAIK). It can do it all in hardware, I've heard a lot of good things about it from people who actually use it. If you have a support contract just ask if you can spend a day in a Juniper lab with an engineer to learn how it works (Juniper here in NL definitely does that). Mike.

1 0

The Cidr Report
by cidr-report＠potaroo.net 02 Dec '05

02 Dec '05

This report has been generated at Fri Dec 2 21:46:37 2005 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 25-11-05 172899 115145 26-11-05 172818 115065 27-11-05 172783 115147 28-11-05 173030 115171 29-11-05 173008 115448 30-11-05 172803 115438 01-12-05 173244 115396 02-12-05 173338 115423 AS Summary 20954 Number of ASes in routing system 8692 Number of ASes announcing only one prefix 1459 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91252992 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 02Dec05 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 173501 115410 58091 33.5% All ASes AS4323 1184 236 948 80.1% TWTC - Time Warner Telecom AS18566 879 8 871 99.1% COVAD - Covad Communications AS4134 1007 257 750 74.5% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1054 312 742 70.4% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 577 34 543 94.1% CCINET-2 - Cox Communications Inc. AS7018 1459 959 500 34.3% ATT-INTERNET4 - AT&T WorldNet Services AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS855 562 66 496 88.3% CANET-ASN-4 - Canadian Research Network AS3602 531 104 427 80.4% SPRINT-CA-AS - Sprint Canada Inc. AS6197 966 567 399 41.3% BATI-ATL - BellSouth Network Solutions, Inc AS11492 631 251 380 60.2% CABLEONE - CABLE ONE AS17676 470 101 369 78.5% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS6467 411 57 354 86.1% ESPIRECOMM - e.spire Communications, Inc. AS17488 434 82 352 81.1% HATHWAY-NET-AP Hathway IP Over Cable Internet AS812 370 27 343 92.7% ROGERS-CABLE - Rogers Cable Inc. AS4755 612 282 330 53.9% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS4766 616 289 327 53.1% KIXS-AS-KR Korea Telecom AS15270 342 25 317 92.7% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS9583 831 519 312 37.5% SIFY-AS-IN Sify Limited AS9498 411 107 304 74.0% BBIL-AP BHARTI BT INTERNET LTD. AS14654 292 6 286 97.9% WAYPORT - Wayport AS5668 485 212 273 56.3% AS-5668 - CenturyTel Internet Holdings, Inc. AS9929 319 56 263 82.4% CNCNET-CN China Netcom Corp. AS6167 324 63 261 80.6% CELLCO-PART - Cellco Partnership AS16814 295 37 258 87.5% NSS S.A. AS18101 271 23 248 91.5% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS6140 428 186 242 56.5% IMPSAT-USA - ImpSat AS1239 840 599 241 28.7% SPRINTLINK - Sprint AS19115 258 27 231 89.5% CHARTER-LEBANON - Charter Communications AS6198 484 255 229 47.3% BATI-MIA - BellSouth Network Solutions, Inc Total 17906 5812 12094 67.5% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.78.0/24 AS25994 NPG-001 - NPG Cable, INC 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.38.96.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 64.66.32.0/20 AS18864 STARTEC - Startec Global Communications 64.66.32.0/22 AS18864 STARTEC - Startec Global Communications 64.66.34.0/23 AS18864 STARTEC - Startec Global Communications 64.127.128.0/17 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.11.224.0/20 AS3356 LEVEL3 Level 3 Communications 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.0.0/21 AS30033 NHI-NETWORKS - NHI Networks 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.117.9.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.16.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.18.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.20.0/24 AS30085 NHI-COLOCATIONS - New Horizon Collocations 66.117.21.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.23.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.25.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.26.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.27.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.186.192.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.216.0.0/18 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 85.129.3.0/24 AS14585 CIFNET - CIFNet, Inc. 85.129.4.0/24 AS14585 CIFNET - CIFNet, Inc. 90.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 90.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.72.0.0/16 AS4780 SEEDNET Digital United Inc. 192.72.0.0/18 AS4780 SEEDNET Digital United Inc. 192.72.192.0/18 AS4780 SEEDNET Digital United Inc. 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 AFRINIC African Network Information Center 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.119.135.0/24 AS270 PSCNI-AS - National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.136.53.0/24 AS8346 SONATEL-AS Autonomous System 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.0.246.0/24 AS3303 SWISSCOM Swisscom Solutions Ltd 193.32.19.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.32.20.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.37.236.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.59.178.0/24 AS8481 TRANSNET transnet INTERNET Services 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.160.171.0/24 AS7046 UUNET-CUSTOMER - UUNET Technologies, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM - GT Group Telecom Services Corp. 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.131.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET - NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.46.0/23 AS17747 ZIML-AP ZEE INTERACTIVE MUTIMEDIA LTD., BANGALORE 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.133.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.138.0/24 AS9237 HUTCHCA-AS Corporate Access (HK) Ltd. 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.145.0/24 AS4637 REACH Reach Network Border AS 203.89.146.0/24 AS4637 REACH Reach Network Border AS 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.108.96.0/19 AS577 BACOM - Bell Advanced Communications Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 208.138.48.0/20 AS6971 ESCH - Eschelon Telecommunications, Inc. 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.97.64.0/19 AS6132 INGRESSNET - Ingress Enterprises, Inc w/ Ingress Communications, Inc. 209.112.224.0/20 AS19817 DSLEXTREME - DSL Extreme 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 209.251.0.0/19 AS11036 SISCOM - SISCOM, Inc 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.82.160.0/20 AS20481 CALYX-NL Calyx Internet B.V. Netherlands 216.96.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.178.37.0/24 AS3356 LEVEL3 Level 3 Communications 216.178.39.0/24 AS3356 LEVEL3 Level 3 Communications 216.178.42.0/24 AS3356 LEVEL3 Level 3 Communications 216.178.43.0/24 AS3356 LEVEL3 Level 3 Communications 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

[Sidr] Re: S-BGP and IP prefix aggregation
by william(at)elan.net 02 Dec '05

02 Dec '05

I'm reposting my email reply that did not make it to nanog (it made it fine to ietf list though as did Tony's reply to my email that went to both sidr and to nanog). I suspect nanog maybe using special filtering rules [aka amavisd] that did not non-ascii characters in "To" field (that is the only thing I can think of that in how that post was different from others) - I can't think of a good reason to have this filtering rule though... ---------- Forwarded message ---------- Date: Fri, 2 Dec 2005 00:22:44 -0800 (PST) From: "william(at)elan.net" <william(a)elan.net> To: ÍõÄÈ <wn(a)ndsc.com.cn> Cc: nanog(a)merit.edu, sidr(a)ietf.org Subject: [Sidr] Re: S-BGP and IP prefix aggregation [I'm cross-posting this to SIDR BOF (future SIDR WG) list as that seems to be the most appropriate forum to discuss this issue] On Fri, 2 Dec 2005, <wn(a)ndsc.com.cn> wrote: > I have a question about S-BGP. When IP prefix is aggregated, and a S-BGP > speaker receives a route announcement with the aggregated ip prefix, > > how does it verify the authority of the AS to announce the IP prefix. The > aggregated IP prefix should have not address attestation. With rare exceptions almost all aggregation happens by ISP that has been allocated larger block and which it sub-allocated to its customers (or decided to break of and announce subparts from multiple datacenters), so in this case ISP (ASN) would obviously be able to provide a permission [sign cert] to announce that larger block. There are however some rare exceptions, for example I know of ip block in legacy class-c space that UUNET is announcing as /16 aggregate but where it actually consists of a number of smaller ip blocks assigned (direct assignment from RIR) to several different organizations. I always assumed myself that those running SIDR aware routers in such cases would not be doing aggregation - i.e. no aggregation if each ip block in the aggregate has permission for announcement from different entity. An alternative for sbgp design could be that aggregating ASN would create special self-signing cert for such aggregate block and that cert would have special attribute(s) indicating list of all sub-blocks and reference to all certs that "make" this aggregate block. Then verifying router in such a case would go through and verify each one of those sub-block certs (and those sub-block certs would have to be such that they give permission for announcing the block from that sub-block owner to aggregating ASN). -- William Leibzon Elan Networks william(a)elan.net

1 0

Re: [Sidr] Re: S-BGP and IP prefix aggregation
by Tony Li 02 Dec '05

02 Dec '05

> > An alternative for sbgp design could be that aggregating ASN would > create special self-signing cert for such aggregate block and that > cert would have special attribute(s) indicating list of all sub- > blocks and reference > to all certs that "make" this aggregate block. Then verifying router > in such a case would go through and verify each one of those sub-block > certs (and those sub-block certs would have to be such that they > give permission for announcing the block from that sub-block owner > to aggregating ASN). > Advertising an aggregate that is not specifically assigned to you is known as "proxy aggregation". William has given a good description of what's required above, but it needs a further enhancement in that proxy aggregation will frequently need to happen in several locations for the aggregate to have any true impact on routing. In graph theoretic terms, proxy aggregation must form a "cut set" topologically around the longer prefixes to contain them and prevent them from being distributed throughout the network. Thus, any security mechanism needs to provide some means for indicating that an entire set of ASes may legitimately be advertising a proxy aggregate prefix. How one determines the appropriate set of ASes that are authorized is another interesting administrative issue that needs to be resolved. Tony

1 0

S-BGP and IP prefix aggregation
by 王娜 02 Dec '05

02 Dec '05

I have a question about S-BGP. When IP prefix is aggregated, and a S-BGP speaker receives a route announcement with the aggregated ip prefix, how does it verify the authority of the AS to announce the IP prefix. The aggregated IP prefix should have not address attestation. wn(a)mail.ndsc.com.cn

1 0

Re: GoDaddy DDoS
by Sam Crooks 02 Dec '05

02 Dec '05

the source I have seen so far is: http://news.com.com/GoDaddy.com+suffers +outage/2110-7349_3-5977187.html?tag=nefd.hed So I was looking for more details.... On Wed, 2005-11-30 at 23:11 +0000, Christopher L. Morrow wrote: > On Wed, 30 Nov 2005, Sam Crooks wrote: > > > Does anybody have information regarding to size and scale of the DDoS > > attack purported to have happened against GoDaddy today? > > nope... but against their: > 1) dns servers? > 2) web servers? > 3) mail servers? > 4) networking equipment? > 5) none of the above? > > > CONFIDENTIALITY NOTICE: This message, and any attachments, are intended only for the lawful and specified use of the individual or entity to which it is addressed and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that you are STRICTLY PROHIBITED from disclosing, printing, storing, disseminating, distributing or copying this communication, or admitting to take any action relying thereon, and doing so may be unlawful. It should be noted that any use of this communication outside of the intended and specified use as designated by the sender, may be unlawful. If you have received this in error, please immediately notify us by return e-mail, fax and/or telephone, and destroy this original transmission and its attachments without reading or saving in any manner.

9 8

Cisco Security Advisory: IOS HTTP Server Command Injection Vulnerability
by Cisco Systems Product Security Incident Response Team 01 Dec '05

01 Dec '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: IOS HTTP Server Command Injection Vulnerability ======================================================================== Document ID: 68322 Advisory ID: cisco-sa-20051201-http http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml Revision 1.0 For Public Release 2005 December 01 2100 UTC (GMT) - ----------------------------------------------------------------------- Contents ======== Summary Affected Products Details Impact Software Versions and Fixes Workarounds Obtaining Fixed Software Exploitation and Public Announcements Status of This Notice: INTERIM Distribution Revision History Cisco Security Procedures - ----------------------------------------------------------------------- Summary ======= A vulnerability exists in the IOS HTTP server in which HTML code inserted into dynamically generated output, such as the output from a "show buffers" command, will be passed to the browser requesting the page. This HTML code could be interpreted by the client browser and potentially execute malicious commands against the device or other possible cross-site scripting attacks. Successful exploitation of this vulnerability requires that a user browse a page containing dynamic content in which HTML commands have been injected. Cisco will be making free software available to address this vulnerability for affected customers. There are workarounds available to mitigate the effects of the vulnerability. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml. Affected Products ================= This security advisory applies to all Cisco products that run Cisco IOS Software versions 11.0 through 12.4 with the HTTP server enabled. A system which contains the IOS HTTP server or HTTP secure server, but does not have it enabled, is not affected. To determine if the HTTP server is running on your device, issue the "show ip http server status" and "show ip http server secure status" commands at the prompt and look for output similar to: Router>show ip http server status HTTP server status: Enabled If the device is not running the HTTP server, you should see output similar to: Router>show ip http server status HTTP server status: Disabled Any version of Cisco IOS prior to the versions which will be listed in the Fixed Software section below may be vulnerable. Cisco IOS XR is not affected. To determine the software running on a Cisco product, log in to the device and issue the "show version" command to display the system banner. Cisco IOS Software will identify itself as "Internetwork Operating System Software" or simply "IOS". On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the "show version" command or will give different output. The following example identifies a Cisco product running IOS release 12.3(6) with an installed image name of C3640-I-M: Cisco Internetwork Operating System Software IOS (tm) 3600 Software (C3640-I-M), Version 12.3(6), RELEASE SOFTWARE (fc3) The next example shows a product running IOS release 12.3(11)T3 with an image name of C3845-ADVIPSERVICESK9-M: Cisco IOS Software, 3800 Software (C3845-ADVIPSERVICESK9-M), Version 12.3(11)T3, RELEASE SOFTWARE (fc4) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2005 by Cisco Systems, Inc. Additional information about Cisco IOS release naming can be found at http://www.cisco.com/warp/public/620/1.html. No other Cisco products are currently known to be affected by the vulnerability addressed in this advisory. Details ======= The Cisco IOS Web browser interface (which enables the device to perform as an HTTP server) allows configuration and monitoring of a router or access server using any web browser. This feature was introduced in IOS 11.0. A vulnerability exists in the IOS HTTP server in which HTML code inserted into dynamically generated output, such as the output from a "show buffers" command, will be passed to the browser requesting the page. This HTML code could be interpreted by the browser and potentially execute malicious commands against the device or other possible cross-site scripting attacks. In order to be vulnerable to the cross-site scripting attack, a user must browse and view the content during the same period of time the injected code exists in memory. On the other hand, if a user does not browse contaminated dynamic content on the device, then exploitation is not possible. A proof of concept exploit exists for this vulnerability, in which the exploit attempts to reset the enable password on the device. For the attack to work against the device itself, the user browsing tainted dynamic content on the router will only be able to execute commands at or below the privilege level for which they are authenticated and authorized for on the device. This vulnerability is documented in Cisco Bug ID CSCsc64976. Impact ====== Successful exploitation of the vulnerability may result in an attacker executing commands on the device, including the possibility of gaining full administrative privileges on the device which is dependent on the privilege level of the authenticated user. Software Versions and Fixes =========================== No software fixes are currently available. This section will be updated regularly as soon as software fixes are available. Workarounds =========== Disable the HTTP server +---------------------- If the HTTP server is not used for any legitimate purposes on the device, it is a best practice to disable it by issuing the following commands in configure mode: no ip http server no ip http secure-server Disable the HTTP WEB_EXEC service +-------------------------------- A feature was introduced in 12.3(14)T and later in which selective HTTP and HTTPS services could be enabled or disabled. Two typical services are WEB_EXEC and the IOS Certificate Server (SCEP). The WEB_EXEC service provides a facility to configure the box and retrieve current state of the box from remote clients. The IOS Certificate Server service provides a facility wherein remote clients can enroll and obtain Crypto Certificates. It is possible to disable the WEB_EXEC service while still leaving SCEP running to serve Certificates. If an installation requires the use of the SCEP service, the WEB_EXEC service may be disabled via the commands in configure mode: no ip http active-session-modules WEB_EXEC no ip http secure-active-session-modules WEB_EXEC Avoid the use of Web-based SHOW commands +--------------------------------------- Successful exploitation of this vulnerability requires an unsuspecting user to request dynamic content from the device via the "show" commands which are available. Avoiding the use of those commands via the web interface until an upgrade to fixed software is possible may be perfectly legitimate for some installations. Obtaining Fixed Software ======================== Cisco will make free software available to address this vulnerability for affected customers. This advisory will be updated as fixed software becomes available. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third-party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== This vulnerability was disclosed in a public posting to the Bugtraq mailing list, and at the following URL: http://www.infohacking.com/INFOHACKING_RESEARCH/Our_Advisories/cisco/index.…. The Cisco PSIRT is not aware of any malicious use of the vulnerability described in this advisory. Status of This Notice: INTERIM ============================== THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. CISCO EXPECTS TO UPDATE THIS DOCUMENT WITHIN FROM THE ORIGINAL DATE OF THIS NOTICE. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +----------------------------------------+ | Revision | 1-December-2005. | Initial | | 1.0 | | draft. | +----------------------------------------+ Cisco Security Procedures Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt/. - ----------------------------------------------------------------------- All contents are Copyright 1992-2005 Cisco Systems, Inc. All rights reserved. - ----------------------------------------------------------------------- Updated: Dec 01, 2005 Document ID: 68322 - ----------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFDj3udezGozzK2tZARAmkwAJ4xrlLCF75ryXyuX2/62peJ1YAUegCfYdUS jfZM0o9w1mRIAVF4C3uunRs= =A852 -----END PGP SIGNATURE-----

1 0

RE: SWIP and Rwhois in the Real World
by Greenhagen, Robin 01 Dec '05

01 Dec '05

Can someone summarize the alternatives to the ARIN recommended RWHOIS server bits (from rwhois.org)? A quick hit on Google and Freshmeat was fairly barren. Looking for one that is mostly or fully put together, or a cookbook to assemble one from parts (i.e. MySQL, PHP, Apache, 3 rubber bands, 2 gallons of perl, etc...). Regards, Robin Greenhagen GSI http://www.gsihosting.com/

4 3

Re: GoDaddy DDoS
by Sam Crooks 01 Dec '05

01 Dec '05

So anyway, back to the original post.... does anyone from GoDaddy have any information regarding the DDoS? -- On 12/1/05, Valdis.Kletnieks(a)vt.edu <Valdis.Kletnieks(a)vt.edu> wrote: > On Thu, 01 Dec 2005 01:47:17 PST, Jay Hennigan said: > > > Has the validity of such language ever been upheld in court? > > IANAL - but apparently the use of it on *some* faxes has stood up in court, > it hasn't been tested on e-mail yet, but a number of people who have written > on it think that the indiscriminate use of disclaimers will backfire badly > if the opposing legal staff can show the company can't tell the difference > between an e-mail discussing strategy for an upcoming trial and a request > for help with BGP. URLs I found the last time I researched this: > > http://www.wendytech.com/articlesemailandprivilege.htm > http://www.mcguirewoods.com/news-resources/publications/commercial_litigati… > http://partners.nytimes.com/library/tech/00/03/cyber/cyberlaw/17law.html > > > Nobody reads it anyway. You're not actually reading this, are you? > > I didn't think so. > > I love the ones that put "please discard without reading" at the *bottom* of > the e-mail. Bonus points for having a single unwrapped 3,487 character long > line so standard-compliant MUAs that don't flow text unless it *says* text/flowed, > so you have to use the horizontal scrollbar to find the "please discard without > reading" ;) > > ObNANOG: The ones that claim you are *required* to destroy *all* copies, > including the unlinked-but-not-yet-overwritten data blocks on that RAID > you use for a mail store, and the backup tapes. I mean, after all, if they > screwed up and they want it *destroyed*, they don't want it *destroyed* in the > half-assed, just-get-the-disk-copy way that eventually helped convict > Colonel Oliver North partly on the basis of the backup tapes: > > http://www.fas.org/spp/starwars/offdocs/reagan/chron.txt > > Figuring out how to do this right, and then invoice the responsible company for the > cost, thus creating a profit center for your company, is left as an excersize > for the reader. ;) > > > >

1 0

RE: QoS for ADSL customers
by Church, Chuck 01 Dec '05

01 Dec '05

But be careful about the CPU usage and platform support for NBAR. I don't think the sup720 will do NBAR, at least that's what I heard. Chuck Church Lead Design Engineer CCIE #8776, MCNE, MCSE Netco Government Services - Design & Implementation Team 1210 N. Parker Rd. Greenville, SC 29609 Home office: 864-335-9473 Cell: 864-266-3978 cchurch(a)netcogov.com PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4371A48D -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Ray Burkholder Sent: Thursday, December 01, 2005 8:52 AM To: Ejay Hire Cc: 'Kim Onnel'; 'NANGO' Subject: RE: QoS for ADSL customers There are a bunch of p2p and torrent custom classifier pdlm's at http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm Quoting Ejay Hire <ejay.hire(a)isdn.net>: > > I got an off-list reply about using Nbar, but I've never > seen a class map that would match torrent. > > -e > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > On > > Behalf Of Kim Onnel > > Sent: Thursday, December 01, 2005 7:12 AM > > To: Ejay Hire > > Cc: NANGO > > Subject: Re: QoS for ADSL customers > > > > Our ADSL customers traffic is 3 OC3 worth of traffic, I > dont > > think our management would buy the idea. > > > > thanks > > > > > > On 12/1/05, Ejay Hire <ejay.hire(a)isdn.net> wrote: > > > > Hello. > > > > Going back to your original question, how to keep > from > > saturating the network with residential users using > > bittorrent/edonkey et al, while suffocating business > > customers. Here goes. > > > > Netfilter/IpTables (and a slew of commercial > products I'm > > sure) has a Layer 7 traffic classifier, meaning it > can > > identify specific file transfer applications and set > a > > DiffServ bit. This means it can tell between a real > http > > request and a edonkey transfer, even if they are > both using > > http. It also has rate-limiting capability. So... > If you > > pass all of the traffic destined for your DSL > customers > > through an iptables box (single point of failure) > then you > > can classify and rate-limit the downstream rate on a > > > per-application basis. > > > > Fwiw, if you are using diffserv bits, you could push > the > > rate-limits down to the router with a qos policy in > it > > instead of doing it all in the iptables box. > > > > References on this.. The netfilter website (for > > classification info) and the Linux advanced router > tools > > (LART) (qos info/rate limiting) > > > > -e > > > > > > > -----Original Message----- > > > From: owner-nanog(a)merit.edu > [mailto:owner-nanog@merit.edu] > > On > > > Behalf Of Kim Onnel > > > Sent: Thursday, December 01, 2005 3:26 AM > > > To: NANGO > > > Subject: Re: QoS for ADSL customers > > > > > > Can any one please suggest to me any commercial or > none > > > solution to cap the download stream traffic, our > upstream > > > will not recieve marked traffic from us, so what > can be > > done ? > > > > > > > > > On 11/29/05, Kim Onnel <karim.adel(a)gmail.com> > wrote: > > > > > > Hello everyone, > > > > > > We have Juniper ERX as BRAS for ADSL, its > GigE > > > interface is on an old Cisco 3508 switch with an > old IOS, > > its > > > gateway to the internet is a 7609, our transit > internet > > links > > > terminate on GigaE, Flexwan on the 7600 > > > > > > The links are now almost always fully > utilized, we > > want > > > to do some QoS to cap our ADSL downstream, to give > room > > for > > > the Corp. customers traffic to flow without pain. > > > > > > I'm here to collect ideas, comments, advises > and > > > experiences for such situations. > > > > > > Our humble approach was to collect some p2p > ports > > and > > > police traffic to these ports, but the traffic > wasnt much, > > > > > one other thing is rate-limiting per ADSL > customers IPs, > > but > > > that wasnt supported by management, so we thought > of > > matching > > > ADSL www traffic and doing exceed action is > transmit, and > > > police other IP traffic. > > > > > > Doing so on the ERX wasnt a nice experience, > so > > we're > > > trying to do it on the cisco. > > > > > > Thanks > > > > > > > > > > > > > > > > > > > > > > -- > Scanned for viruses and dangerous content at > http://www.oneunified.net and is believed to be clean. > > -- Ray Burkholder http://www.oneunified.net ray(a)oneunified.net 441 505 7293 ------------------------------------------------- Sent from http://www.oneunified.net via IMP: http://horde.org/imp/ -- Scanned for viruses and dangerous content at http://www.oneunified.net and is believed to be clean.

1 0