January 2008 - Test - lists.nanog.org

Creating demand for IPv6, and saving the planet
by Daniel Senie 24 Jun '08

24 Jun '08

A number of people have bemoaned the lack of any IPv6-only killer-content that would drive a demand for IPv6. I've thought about this, and about the government's push to make IPv6 a reality. What occurred to me is there is a satellite sitting in storage that would provide such content: http://en.wikipedia.org/wiki/Triana_(satellite) Al Gore pushed for this satellite, Triana, to provide those on earth with a view of the planet among its scientific goals. The Republicans referred to it as an "overpriced screen saver," though the effect even of just the camera component on people's lives and how they treat the planet could be considerable. By combining the launch of Triana with feeding the still images and video from servers only connected to native IPv6 bandwidth, the government would provide both a strong incentive for end users to want to move to IPv6, and a way to get the people of this planet to stop from time to time and ponder the future of the earth. Of course getting this done any time soon would require getting the present administration to reverse its bias against Triana and global warming. But it seemed to me an interesting way to advance two goals in synergy. Dan -- ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com "Our lives begin to end the day we become silent about things that matter." -- Martin Luther King, Jr.

26 54

Re: v6 subnet size for DSL & leased line customers
by Brian Dickson 24 Mar '08

24 Mar '08

>> As to "there must be better knobs" I think it may be a little late for that; by design (or as a consequence of it) the set of IPv6 knobs is the same as the set of IPv4 knobs. > The trouble is that BGP doesn't have a meaningful inter-AS metric. (Although there is something that is called that.) If I want to increase my path length by 10% through a certain neighboring AS, I don't get to do that. I only get to double or triple it. (Unless I was doing very heavy prepending to begin with.) Actually, while it isn't a true metric as such, there *is* just such a knob. The "origin" attribute, can act as a fractional AS-path-length. It's mandatory and transitive. It gets evaluated after as path length, but before other attributes. It has three possible values (internal, external, unknown), and as such, gives the limited ability to influence path choice at third-party locations quite distant. The only caveat is, that some parties may mess with it on prefixes they receive. I've used it in the past, with considerable success. Brian Dickson

6 6

Blackholes and IXs and Completing the Attack.
by Ben Butler 04 Feb '08

04 Feb '08

Hi, I have been working away on remote trigger blackholing and community based client initiated blackholing into transit ASes. It got me thinking that while this works great with a handful of upstream transit peers it does not really scale very well at an Internet Exchange with a high overhead configuring things for many peers. Plus if your IX connection is saturated that means legitimate traffic must be getting degraded - even if your router is coping and blackholing the interconnect is still flat lined. The only ways into an AS are via transit, public IX or private interconnects. If we want to extend the blackholing to secure IXs peers as well as into transits. So my idea.... Is to have an IX route reflector configured with ACLs locking it down to exclusively BGP with the IX peer IP of the member. The IX route reflector would be configured to have per peer prefix filters per peer auto generated from registered AS macro for each peer from the RIPE,ARIN,APNIC etc databases. This should mean the router will not accept announcements for any /32 that is not part of the routes announced by that AS (it would be even better to tie it down to a match on origin AS as well). Plus the router will only talk to IX peers - no global transit. This hopefully will ensure a relatively protected router that is only accessible from the edge routers we want and also secured to only accept filtered announcements for black holing and in consequence enable the system to be trusted similar to Team Cymaru. Then all a member AS of the exchange does is announce any /32 from their IP block that they would like other members to Null route in their AS to this reflector. There are people way smarter than me on this list and the above is not implemented at any of the IXs I am connected to, so why is the above a dumb idea / what have I missed that makes the above unworkable because it does seem kind of obvious now I have done some work with this. Kind Regards Ben Butler ++++++++++++++++++++++++++++++++++++++++++ C2 Internet Ltd Globe House, The Gullet, Nantwich, Cheshire, CW5 5RL E mailto:ben.butler@c2internet.net W http://www.c2internet.net/ B1 http://c2internet.blogspot.com/ B2 http://c2noc.blogspot.com/ T +44-(0)845-658-0020 F +44-(0)845-658-0070 All quotes & services from C2 are bound by our standard terms and conditions which are available on our website at: http://www.c2internet.net/legal/main.htm#tandc C2 Internet Limited is a company registered in England and Wales with company number 03910154 Our VAT Registration number is GB 752 7650 17

10 22

Blackholing traffic by ASN
by Justin Shore 01 Feb '08

01 Feb '08

I'm sure all of us have parts of the Internet that we block for one reason or another. I have existing methods for null routing traffic from annoying hosts and subnets on our border routers today (I'm still working on a network blackhole). However I've never tackled the problem by targeting a bad guy's ASN. What's the best option for null routing traffic by ASN? I could always add another deny statement in my inbound eBGP route-maps to match a new as-path ACL for _BAD-ASN_ to keep from accepting their routes to begin with. Are there any other good tricks that I can employ? I have another question along those same lines. Once I do have my blackhole up and running I can easily funnel hosts or subnets into the blackhole. What about funneling all routes to a particular ASN into the blackhole? Are there any useful tricks here? The ASN I'm referring to is that of the Russian Business Network. A Google search should turn up plenty of info for those that haven't heard of them. Thanks Justin

7 7

Re: Sicily to Egypt undersea cable disruption
by Paul Ferguson 31 Jan '08

31 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Martin Hannigan" <hannigan(a)gmail.com> wrote: >In the Med/IO cable case, a ship dropped an anchor on the cable, >something that is 1:1,000,000 shot, but happens. [...] Isn't that exactly what happened with the Pakistan fiber in 2005 with SEAMEWE-3? :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHoXPlq1pz9mNUZTMRAsP+AJ4zaz+98bTSJM2IzwFOurjbusbbawCaAlqY 2yqlHXkWgWJsZ043fF94mfc= =PqfR -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

8 14

Re: Sicily to Egypt undersea cable disruption
by Paul Ferguson 31 Jan '08

31 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Sean Donelan <sean(a)donelan.com> wrote: >If its not one cable, its another cable. > >http://www.guardian.co.uk/technology/2008/jan/30/asia.internet.outage > >Huge swathes of the Middle East and Asia have been left without internet >access after a vital undersea cable was damaged. > For what its worth, Todd Underwood has a very good overview of the countries affected by this outage over on the Renesys Blog here: http://www.renesys.com/blog/2008/01/mediterranean_cable_break.shtml - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHoSrHq1pz9mNUZTMRAiFhAJ9y8gg/gSbXmPnYJhGKn5ZmlHXz3gCgkL7d U19z4eSg5DsEvUjhfzo9J8E= =v3bo -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

5 4

potential hazards of Protect-America act
by michael.dillon＠bt.com 31 Jan '08

31 Jan '08

I wonder if this is on topic? <http://www.crypto.com/papers/paa-ieee.pdf> Among other things, it discusses technical hazards of the act. --Michael Dillon

6 8

Re: Blackholing traffic by ASN
by Paul Ferguson 30 Jan '08

30 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Paul Ferguson" <fergdawg(a)netzero.net> wrote: >-- Justin Shore <justin(a)justinshore.com> wrote: > >>The ASN I'm referring to is that of the Russian Business Network. A Google search should turn up plenty of info for those that haven't heard of them. >> > >Not possible anymore, sorry -- they have now diversified into many >different origin ASs. > >Up until late last year, they primarily operated out of AS40989, but >no more: > > http://www.cidr-report.org/cgi-bin/as-report?as=AS40898 > >Too much negative publicity forced them to fly lower under the >radar. :-) Sorry, make that: http://www.cidr-report.org/cgi-bin/as-report?as=as40989 - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHoQ4Wq1pz9mNUZTMRAo69AKCixuAjGYwoKOmuKRw8AuKciWPGYgCg6yLC Qy3ogTMN+BfqcJ+7JIFeyw4= =L5S+ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Blackholing traffic by ASN
by Paul Ferguson 30 Jan '08

30 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Justin Shore <justin(a)justinshore.com> wrote: >The ASN I'm referring to is that of the Russian Business Network. A Google search should turn up plenty of info for those that haven't heard of them. > Not possible anymore, sorry -- they have now diversified into many different origin ASs. Up until late last year, they primarily operated out of AS40989, but no more: http://www.cidr-report.org/cgi-bin/as-report?as=AS40898 Too much negative publicity forced them to fly lower under the radar. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHoQtlq1pz9mNUZTMRAreXAJ0aLASYfEpRmp2MDI3u8/nnT6oFbQCfYU0Q +Idq5R574HBUPFSXsqNewg0= =GKem -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

circuits to NASDAQ and NYSE
by Philip Lavine 30 Jan '08

30 Jan '08

Is there any problem with network connectivity to Nasdaq or NYSE. Specifically on Yipes. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0