April 2005 - Test - lists.nanog.org

Paul Wilson and Geoff Huston of APNIC on IP address allocation ITU v/s ICANN etc
by Suresh Ramasubramanian 27 May '05

27 May '05

http://www.circleid.com/article/1045_0_1_0_C/ That's a must read article, I'd say. -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

15 22

FCC To Require 911 for VoIP
by Fergie (Paul Ferguson) 04 May '05

04 May '05

A rather important turn of events. http://www.newsfactor.com/story.xhtml?story_id=33733 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

26 45

Slashdot: Providers Ignoring DNS TTL?
by Fergie (Paul Ferguson) 03 May '05

03 May '05

Interesting thread on /. -- http://ask.slashdot.org/article.pl?sid=05/04/18/198259&tid=95&tid=128&tid=4 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

26 61

Re: Slashdot: Providers Ignoring DNS TTL?
by sthaug＠nethelp.no 03 May '05

03 May '05

> > First of all, let's ditch the term "PPLB." The usual alternative to per > > packet load balancing (what's been being talked about here) is per prefix > > load balancing, which would also be "PPLB." The abbreviation is therefore > > more confusing than anything else. > > Err. No, that would be worse. "Per prefix" load balancing is an artifact > of the Cisco route cache. The route engine (ie the route table) isn't > queried for every packet. Instead the route in the route cache is used. > One doesn't configure "per prefix" load balancing. One configures load > balancing, which adds multiple routes into the route table. Modern Cisco routers do not use a "route cache", they use a fully populated forwarding table. And load balancing is automatic if you have several equal cost routes. > The route > cache then causes only one of these routes to be used. On cisco, to > enable PPLB, you turn off the route cache. Many modern Cisco routers can perform per-packet load balancing without doing process switching (but this needs to be explicitly configured). > On Juniper, you configure it > to put multiple routes in the route table. Its actaully more likely to > happen on Junipers, because unless you configure additonal policies, you > get load balancing on divergent links as well as non-divergent links. On Modern Juniper routers cannot do per-packet load balancing *at all*. It is correct that the configuration statement says "per-packet", however it is really per-flow (and this is well documented). See for instance the description of Internet Processor II ASIC load balancing at http://www.juniper.net/techpubs/software/junos/junos70/swconfig70-policy/ht… I'm afraid your statements show a certain lack of knowledge about modern router architectures. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

5 6

Schneier: ISPs should bear security burden
by Fergie (Paul Ferguson) 02 May '05

02 May '05

I've been there -- I know how I feel about it -- but I'd love to know how ISP operations folk feel about this. Links here: http://www.vnunet.com/news/1162720 ...and, of course, here: http://fergdawg.blogspot.com/2005/04/schneier-isps-should-bear-security.html Off list, if you'd like. Or not. - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

26 59

Re: Schneier: ISPs should bear security burden
by Fergie (Paul Ferguson) 01 May '05

01 May '05

Oh, please. If you think that the Internet should remain an "every man for himself", wild wild west, Ok Corral, situation (not my words, mind you), then you better get with the powers that will steam-roll all of us if we let it -- money and marketing. This ain't no science project anymore. Bruce is right -- right as rain -- I don't give two damns whether you think it is an issue of marketing, or protecive self-advertising. The issue is that the _consumers_ want it, that's what they'll pay for, and it is the ISP's perogative to either honor that wish, or lose the business. We owe to our customers, and we owe it to ourselves, so let's just stop finding excise to side-step the issue. Sound about right? - ferg Owen DeLong <owen(a)delong.com> writes: So much for any sort of journalistic ethic, fact checking, or, unbiased reporting. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

14 18

Re: Schneier: ISPs should bear security burden
by dlr＠bungi.com 01 May '05

01 May '05

[In the message entitled "Re: Schneier: ISPs should bear security burden" on Apr 28, 10:20, "Steve Sobol" writes:] > There are some basic rules of thumb you can use. The problem is that they're > not guaranteed to work. The best solution was created years ago (Gordon > Fecyk's DUL, which lists IP ranges the ISPs specifically register as > dynamic/not supposed to host servers) and eventually came under the purview of > Kelkea/MAPS, but there wasn't a ton of ISP buy-in. If we could create a > similar list and actually get ISPs to register the appropriate netblocks (and > not mix in IPs where servers are allowed, and IPs where they aren't, in the > same block), that'd be great. Dunno what a ton of ISP buy-in is, but the MAPS DUL now contains about 190,000,000 entries. We've been working on it very hard for the last year or two. Most ISP-level subscribers figure it stops a pretty large percentage of the compromised-home-computer spam. --

3 2

Re: Schneier: ISPs should bear security burden
by James Baldwin 01 May '05

01 May '05

On 27 Apr 2005, at 17:51, Pakojo Samm wrote: > Give me a *clear* unobstructed line (that stays up) at > the cheapest price please. Your attitude is very much the norm, however your requirements on connectivity are more stringent. All customers want unobstructed access and, we as an ISP, want to provide it. Obstructions to service, regardless of fault or utility, generate call volume. The vast majority of subscribers, measured in millions, are not obstructed by filtered internet services. Subscribers do not understand the benefits of complete end-to-end connectivity nor do they perceive filtered connections as less valuable than other services. For those subscribers who do notice these obstruction, we offer more robust connections at a different price point. The reasoning is simple: in order to provide the best connectivity possible, measured by least obstructions perceived by the user at the lowest price point, at the highest margin possible we need to relocate the operating cost to the appropriate party. Providing all users with unfiltered transit increases our operating expense without providing the customer with any added benefit. Providing a subset of users with unfiltered transit when necessary pushes that expense onto the users requesting additional service. As you said, customer desire the cheapest stable connection they can locate. Value added services aid in retention when cheaper rates are offered by competitors and we are not willing to match that price point. Subscribers are willing to pay more for connectivity instead of incurring the cost of replacing their email address, their ISP associated software, etc. On 28 Apr 2005, at 00:55, Owen DeLong wrote: > Who are you to decide that there is no damage to blocking residential > customers? The customer makes the decision when they subscribe to a service whether or not filtered service will meet their needs. Who are you to decide that unfiltered service is required to meet the needs of all customers? > Why should an ISP decide what a residential > customer can or can't do with their internet connection. The service provider should be able to decide what services they wish to offer. If a provider of any service chooses to differentiate services based on utility and the customer is made aware of these characteristics, how is this in anyway unfair? If your objection is that, in single provider markets, it may not be financially viable to obtain your desire service level i.e. the local cable provider does not offer unfiltered connectivity and there are no other residential high bandwidth options available then I suggest you encourage diversity in the market place. You are not entitled to unfiltered internet connectivity. If you want to be entitled to unfiltered internet connectivity then petition your local government to make transit a privatized utility with all the government oversight and bureaucracy that entails. --- James Baldwin hkp://pgp.mit.edu/jbaldwin@antinode.net "Syntatic sugar causes cancer of the semicolon."

5 7

RE: Schneier: ISPs should bear security burden
by Olsen, Jason 01 May '05

01 May '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Dan Hollis > To: Owen DeLong > Subject: Re: Schneier: ISPs should bear security burden > > You must not have used it much in those 20 years. I can > definitely say worms, trojans, spam, phishing, ddos, and > other attacks is up several orders of magnitude in those 20 > years. The userbase has also increased by several orders of magnitude beyond that. 1% "bad" traffic at 100 users: 1 1% "bad" traffic at 1,000,000 users: 10,000 -JFO

3 2

Re: Schneier: ISPs should bear security burden
by Owen DeLong 01 May '05

01 May '05

> We know that almost all users are too stupid to know what they really > need or how to get it, and that they need to be protected from their own > stupidity -- as well as protecting the rest of the world from their > stupidity. Not only do I not know this, I find it to be patently false. Yes, I think a high percentage of users is too ignorant to know what they need or how to get it. However, protecting them from that ignorance only propogates and perpetuates it. Pain is one of natures most effective educators. Allowing people to experience the full (as long as it's non-fatal) effect of their ignorance often creates a strong desire for education. This incredible expansion of "We must protect people from themselves" philosophy is wasteful, expensive, and, worst of all, highly destructive to society in the long run. Government or any other regulatory body should protect people from each other, not from themselves. Similarly, while knowingly producing a dangerous product should carry some civil and criminal liabilty, the fact that we have effectively made companies and professionals liable for any act of stupidity comitted by their consumers unless they specifically disclaimed or warned (and sometimes even if they did) the consumer is about 2/3rds of the cost of medicine today. It's about 1/2 of the cost of an airline ticket. It's about 3/4 of the cost of aircraft parts. The list goes on. Owen -- If it wasn't crypto-signed, it probably didn't come from me.

2 1