June 2007 - Test - lists.nanog.org

workshop on app classification
by Mark Allman 13 Jun '07

13 Jun '07

Folks- This is a bit off-topic, but I wanted to make folks aware of it and note that we'd love to hear some operational experience / opinion about this entire area of trying to figure out what app a given traffic flow involves. (Yes, I understand that at some level it doesn't matter.) allman IMRG Workshop on Application Classification and Identification (WACI) There is considerable interest in identifying network traffic by application to support network provisioning, network security, and service quality. Techniques that rely on a well-known port number to identify an application may give a gross notion of the spread of applications, but it is not a reliable means for application identification in the face of evasion. There has been work in using traffic characteristics to construct application equivalence classes, using techniques such as machine learning, principal component analysis, deep packet inspection and others. The Workshop on Application Classification and Identification (WACI) aims to bring together the most active researchers in this research area. The main objectives of the one-day workshop will be to discuss recent advancements in this field, discuss new approaches and their implications, and identify open problems that require further research. Topics of interest (include, but are not limited to): - Statistical methods for identifying application-layer protocols - Methods for finding application classes (file transfer, interactive, etc.) - Efficient schemes for using deep packet inspection to identify applications - Identifying applications within tunnels - Identifying rogue/nefarious applications - Peer-to-peer application identification - Peer-to-peer traffic characterization Submission instructions We invite interested researchers to submit a 1-2 page abstract or position statement. Abstracts will be chosen based on their relevance to the area of application identification, and on the diversity of the covered topics. There will be no full-paper submissions or proceedings. Authors of accepted abstracts however should plan to give a 25-minute presentation that will be posted at the workshop's web page (TBA). A significant part of the workshop will be given to discussions and interaction among participants. Submissions must be in electronic form, as plain-text or PDF (if graphs are included) documents, and they should be submitted by e-mail to: Tim Strayer (strayer(a)bbn.com) Registration Attendance at this workshop will be by invitation. Authors of submitted abstracts should commit that they will attend the workshop if their abstract is accepted. Others interested in attending should indicate this in email to Tim Strayer (strayer(a)bbn.com) There will be no registration fee. Important Dates - July 1, 2007 - submission of 1-2 pages abstract - August 15, 2007 - acceptance notification - October 3, 2007 - workshop at BBN Technologies Workshop Location WACI will be held at: BBN Technologies 10 Moulton Street Cambridge MA, USA Organizing and program committee - Tim Strayer, chair (BBN, strayer(a)bbn.com) - Mark Allman (ICIR-ICSI, mallman(a)acm.org) - Grenville Armitage (Swinburne University, garmitage(a)swin,edu.au) - Steve Bellovin (Columbia University, smb(a)cs.columbia.edu) - Shudong Jin (Case Western Reserve University, jins(a)case.edu) - Andrew Moore (CUCL, andrew.moore(a)cl.cam.ac.uk) Sponsors The workshop is sponsored by the IRTF's Internet Measurement Research Group and hosted by BBN Technologies.

2 1

china transit providers
by matthew zeier 12 Jun '07

12 Jun '07

While trying not to stray too OT, any recommendations on Chinese transit providers with "good" connectivity back to the US?

1 0

CableLabs issues CALEA specification
by Sean Donelan 12 Jun '07

12 Jun '07

CableLabs announced the release of its new Cable Broadband Intercept Specification. http://www.cablemodem.com/downloads/specs/CM-SP-CBI2.0-I01-070611.pdf While praising CableLabs, the FBI avoided saying the CableLabs specifications were acceptable. The FBI committed to working to further refine and develop future comprehensive solutions. http://www.fbi.gov/pressrel/pressrel07/calea061207.htm

1 0

Network Level Content Blocking (UK)
by James Blessing 12 Jun '07

12 Jun '07

Hi all, Sorry for the cross posting to a number of lists but this is an important topic for many of you (especially if you get multiple copies). As many people are aware there is an 'expectation' that 'consumer' broadband providers introduce network level content blocking for specified content on the IWF list before the end of 07. Whilst this is seen by many as a honorable political crusade to 'protect the innocent' many with a strong technical background are concerned that the long term impact on network development will lead to major 'breakages' within the internet. So far the only debate has revolved around the legal concerns that the introduction of this technology imposes to problems on the ISP: 1. Revocation of mere conduit status; by inspecting certain content and preventing access to it the ISP is doing more that just passing packets and is getting involved in the content. 2. Thin end of the wedge; if we can block Child Abuse Content then we can block copyright infringement.... 3. Increased liability; by blocking the content at a network level outside of the control of the user the ISP is potentially opening it self to a lawsuit should content leak through the block (although many are saying that this is not going to be enforcable it could still tie up people in court going through the arguments with no guarantee of a win cf mere conduit issue above). LINX (the London Internet Exchange) and ISPA are looking to arrange a day to address the technical issues of placing such a block in the network. The topics are expected to include: 1. Implementation - how do you put this into place 2. Scalability - how do you provide a non-degrading service 3. Circumvention - how do you stop people getting round the block 4. Reverse Engineering - how do you hide the block (should you hide it?) 5. Messaging - what do you tell the person about what you just done 6. Legality - what is the legal impact of this 7. Security - who should have access to what 8. Sanity Checking - how to prevent poisoning of the block list 9. Testing - how do you make sure that the block is working 10. Reality - is this actually the best way to do this We have 13 companies involved so far but really want to get as many ISP's together to make sure that people understand the implications of the governments request. Whilst the intent is to focus the content on the technical side we are keen to make sure that the all parts of the ISP industry are brought up to date so may run multiple strands with different levels of technical content if we have the numbers. If you are interested please contact John Souter (john(a)linx.net) or Malcolm Hutty (malcolm(a)linx.net) for more details. Thx J -- COO Entanet International T: 0870 770 9580 W: http://www.enta.net/ L: http://tinyurl.com/3bxqez

29 59

NANOG 40 Peering BOF XV Meeting Notes now on-line
by William B. Norton 11 Jun '07

11 Jun '07

Hi all - We had a large and lively group discussion at the Peering BOF XV at NANOG 40 last week in Bellevue. I tried to capture the essence of the discussions embedded with Matt Peterson's photos of the event. For those who could not attend (or could not hear because we packed folks in all the way into the hallway), I hope these notes will give you a sense of what was discussed. NANOG 40 Peering BOF XV Meeting Notes: http://www.nanog.org/mtg-0706/Presentations/PeeringBOFXVMeetingMinutes.pdf Bill PS - I fully expect that there are errors, and that folks who presented their case to the group could provide some better text. Please send me your update(s), or, alternatively, it might be interesting to have the community edit the google docs file: http://docs.google.com/Doc?id=dddj3pds_22gqrdqs Send me email to bill.norton at gmail.com and I will add you as a collaborator to the document if you have updates to make. -- //------------------------------------------------ // William B. Norton <wbn at equinix.com> // Co-Founder and Chief Technical Liaison, Equinix // Skype, Y!IM: williambnorton AIM wbnorton

1 0

Level3/Broadwing Contact
by Brandon Galbraith 10 Jun '07

10 Jun '07

Can a BGP-knowledgeable Broadwing/Level3 contact please contact me off-list? I've been told that no one on call is currently returning calls to the NOC. Thanks, -brandon

1 0

Re: [uknof] Re: [members] Network Level Content Blocking (UK)
by Stephen Wilcox 10 Jun '07

10 Jun '07

[I have included the nanog list back here, as it was originally cross posted and there seem to now be divergent discussions in progress] On Sat, Jun 09, 2007 at 10:13:11PM +0100, Vince Hoffman wrote: > Ian Dickinson wrote: > > John Ekins wrote: > >> Some very big sites HAVE been on the list at times. This was clearly an > >> issue we took into account. Our system coped. > > > > Good for you. > > > >> I can't believe this is news to Pipex. This has been discussed at the > >> IWF and ISPA. And Pipex is a member of both. It has been discussed over > >> and over. The fact is small ISPs (like Brightview - 60,000 ADSL) and big > >> ISPs (BT, Virgin Media (NTL/Telewest) - millions) have implemented this. > >> They had the same issues and found a way to make it work. > > > > It's not news - I'm merely taking issue with your "zero-cost" stance, which I > > think is *potentially* misleading. > > > A colleague of mine informed me that receiving the IWF feed requires us > to be a member, a not totally insignificant cost (about £5k for us,) is > this correct? If so, combine it with colo, admin and hardware costs and > its certainly not "zero-cost" for us I think theres a bit too much focus being given to the implementation side of this problem. The Internet is currently a very cheap industry to set up in, compare to say becoming a telco in the 90s with large licensing fees and huge capex for startup. If the government says the Internet services need to provide X Y and Z at $ cost then so be it. I think the real issue is the technology and the perception it has. It is being imposed on operators to violate routing strategies and add these /32s which cannot scale, additionally inserting web caches many years after web caches ceased to be defacto with all the issues and reduced service level they come with. And after doing all this we are blocking on a tiny hand managed list, this doesnt even compare to early spam blocking systems and look how ineffectual they were! The scary part is this is being cited in parliamentary sessions as being the holy grail of child porn fighting. That is the real worry. Yes it is relatively expensive to implement, yes it can only be done through a series of hacks and violations to protocol and no it doesnt provide 1% of real protection or help to push forwards the anti child porn goals. So why are so many ISPs keen to sign up? Well any number of reasons - PR, political pressure, fear of being branded pro-child porn by the media. I think we as an industry can do so much better to find solutions to this problem without pandering to the first crazy idea that our PR mad government comes up with. Steve

1 0

eBay == 2620:0:500::/41, oops (Was: IPv6 filterers watch out: eBay gets 2001:0:500::/41)
by Jeroen Massar 09 Jun '07

09 Jun '07

Eric Vyncke wrote: > Beware the subject line is wrong, it assumes that eBay is using Teredo ;-) > > (you scared me for a while!) Oops, indeed, some other people also noted this already. And it is good to see that people read subject lines, as due to recent nanog-banter I would almost have believed that nobody did. Of course it should not really matter which exact prefix they got, as long as folks keep their filters up to date. Greets, Jeroen (who blames the sunlight in his screen in the early morning :)

1 0

IPv6 filterers watch out: eBay gets 2001:0:500::/41
by Jeroen Massar 09 Jun '07

09 Jun '07

Hi, As the below is of course a 'good to see they are going at IPv6' thing this one is of course nice. But there is an additional point in it which might cause folks to check up on their filtering: it's a /41. Just to make clear again, ARIN IPv6 PI allocs can be of size /40 - /48. So better check your filters if this can get through when they get around doing so ;) My suggestion: use the relaxed filters (2000::/3 = /16 - /48). When crunch-time comes that there are 1m routes, you can always filter more specifically, but as we are still < 1000 routes, give yourself and your routers some slack... Enjoy the weekend (we have sun in Dublin *wow*, jump in garden :) ! Greets, Jeroen -- 8<--------------------------------------------------------------- OrgName: eBay, Inc OrgID: EBAY Address: 2145 Hamilton Ave City: San Jose StateProv: CA PostalCode: 95008 Country: US NetRange: 2620:0000:0500:0000:0000:0000:0000:0000 - 2620:0000:057F:FFFF:FFFF:FFFF:FFFF:FFFF CIDR: 2620:0000:0500:0000:0000:0000:0000:0000/41 OriginAS: AS11643 NetName: EBAY-6-0 NetHandle: NET6-2620-500-1 Parent: NET6-2620-1 NetType: Direct Assignment NameServer: SJC-DNS1.EBAYDNS.COM NameServer: SJC-DNS2.EBAYDNS.COM NameServer: SMF-DNS1.EBAYDNS.COM NameServer: SMF-DNS2.EBAYDNS.COM Comment: RegDate: 2007-06-08 Updated: 2007-06-08 --------------------------------------------------------------->8

1 0

RE: If there's a Symantec/Veritas admin lurking....
by Frank Bulk 09 Jun '07

09 Jun '07

David: Symantec/Veritas resolved the DNS issue mid-afternoon....I never found out the cause/reason. Frank _____ From: David Glosser [mailto:david_glosser@yahoo.com] Sent: Friday, June 08, 2007 6:09 PM To: frnkblk(a)iname.com; nanog(a)nanog.org Subject: Re: If there's a Symantec/Veritas admin lurking.... seer.support.veritas.com resolves here to 143.127.144.212. can you add it to your local hosts file and see what happens? Yeah, it's a band-aid, but maybe it can get you through your current issue... ----- Original Message ---- From: Frank Bulk <frnkblk(a)iname.com> To: nanog(a)nanog.org Sent: Friday, June 8, 2007 12:41:02 PM Subject: If there's a Symantec/Veritas admin lurking.... ...seer.support.veritas.com is not resolving. A check of two DNS propagation testers show that less than 15% of the DNS servers out there can resolve it. If you go to http://www.symantec.com/enterprise/support/knowledge_base.jsp?pid=15047 and search for any document (try 286144) you'll likely see timeouts for the popup windows. And I tried calling corporate and got nowhere....they shuttled me to enterprise product support. =( Frank

1 0