January 2008 - Test - lists.nanog.org

Dictionary attacks prompted by NANOG postings?
by Barry Shein 17 Jan '08

17 Jan '08

Once again shortly after posting a message to NANOG a fairly significant dictionary attack using Earthlink's mail servers fired up. The same thing happened around Nov 30th (I posted about it here.) Does this happen to anyone else posting here? It's pretty clearly a lame attempt to intimidate by some loser. Jan 17 01:29:16 pcls5 sendmail[6757]: NOUSER: ani5 relay=elasmtp-kukur.atl.sa.earthlink.net [209.86.89.65] Jan 17 01:29:19 pcls5 sendmail[7761]: NOUSER: anita2 relay=elasmtp-curtail.atl.sa.earthlink.net [209.86.89.64] Jan 17 01:29:19 pcls5 sendmail[8036]: NOUSER: ando relay=elasmtp-masked.atl.sa.earthlink.net [209.86.89.68] Jan 17 01:29:22 pcls5 sendmail[8036]: NOUSER: ando1 relay=elasmtp-masked.atl.sa.earthlink.net [209.86.89.68] Jan 17 01:29:25 pcls5 sendmail[8036]: NOUSER: ando2 relay=elasmtp-masked.atl.sa.earthlink.net [209.86.89.68] Jan 17 01:29:28 pcls5 sendmail[8036]: NOUSER: ando3 relay=elasmtp-masked.atl.sa.earthlink.net [209.86.89.68] Jan 17 01:29:31 pcls5 sendmail[8036]: NOUSER: ando4 relay=elasmtp-masked.atl.sa.earthlink.net [209.86.89.68] ...etc etc -- -Barry Shein The World | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Login: Nationwide Software Tool & Die | Public Access Internet | SINCE 1989 *oo*

3 2

RE: request for help w/ ATT and terminology
by Darryl Dunkin 16 Jan '08

16 Jan '08

If you want connectivity from both AT&T and Sprint with your one block, you have plenty of justification from ARIN to get your AS assigned assuming both feeds come into one location. However, it looks like you are asking two providers to announce the same block at two different locations (different origin AS on each). If this is the case, it won't happen, you'd be better off justifying an allocation of the additional space from AT&T. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Donahue Sent: Wednesday, January 16, 2008 13:37 To: nanog(a)merit.edu Subject: request for help w/ ATT and terminology Hi. I'm by no means an ip/networking expert, and we're having some difficulty communicating with the boffins at AT&T. Any input/advice/translation would be appreciated. We own our own class C netblock. Our previous provider, Sprint, had no problem "adding" it to their network/advertising it (that circuit is now disconnected). We've started using an AT&T colo facility, and we're having a lot of trouble trying to get AT&T to do the same thing there that Sprint was able to do for us. AT&T is refusing to advertise our netblock/path it to our cabinet unless we have an AS number. ARIN has refused to give us one on the grounds (rightly so) that we're not multi-homed. AT&T says they'll give us a temporary ASN, and want us to do eBGP for our netblock. They sent the technical information over today, and they want two distinct routers to act as the bgp peers... Anyway, it's all getting (for us) pretty complicated. We're a fairly small firm and just want an Ethernet handoff with our IP block on it. Sprint didn't blink at the request, but AT&T... We're getting a good rate from AT&T for the IP services because it's at their colo. Switching back to Sprint would definitely be more costly. Questions: 1. Is what we're asking for unusual/uncalled for? 2. What's the technical terminology for the request for AT&T to simply start advertising our netblock called? I'm wondering if they're not understanding our request. Any other comments/input/suggestions welcomed. Thanks in advance, Mike Donahue WATG

4 3

Looking for geo-directional DNS service
by Hank Nussbacher 16 Jan '08

16 Jan '08

I am looking for a commercial DNS service that provides geo-directionality. Suppose I have 4 data centers scattered thruout the world and want users to hit the closest data center based on proximity checks (pings, TTLs, latency, load, etc.). I know one can "roll their own", using various geo-locational data from companies like Maxmind. I am *not* interested in that. I am *not* interested in applicances like the Cisco ACE GSS 4400 either (that do this as well): http://www.cisco.com/en/US/products/hw/contnetw/ps4162/ What I am looking for is a commercial DNS service. Is the Akamai Edgescape service the closest to what I want: http://www.akamai.com/html/technology/products/edgescape.html Is anyone using it? Can you recommend it? Another service I know about is the Ultradns (now Neustar) Directional DNS: http://www.neustarultraservices.biz/solutions/directionaldns.html But this service is based on statically defined IP responses at each of their 14 sites so there is no proximity checking done. Thanks, Hank

8 10

RE: Network Operator Groups Outside the US
by Neil J. McRae 16 Jan '08

16 Jan '08

Swinog in switzerland is a great forum. -----Original Message----- From: Rob Gallagher <robert.gallagher(a)heanet.ie> Sent: 16 January 2008 14:46 To: nanog(a)merit.edu Subject: Re: Network Operator Groups Outside the US On Wed, 16 Jan 2008 12:09:48 -0000 "Rod Beck" <Rod.Beck(a)hiberniaatlantic.com> wrote: > > 6. I am not aware of any Dutch per se ISP conferences although that > market is certainly quite vibrant. I am also disappointed to see the > Canadians and Irish have next to nothing despite Ireland being the > European base of operations for Google, Microsoft, Amazon, and Yahoo. > And Canada has over 30 million people. Where is the National Pride? > There is an IENOG (www.ienog.org) however I believe it has been inactive for a long time. Much of the discussion occurs on the INEX (www.inex.ie) mailing lists and IRC channel. rg -- Rob Gallagher | Public Key: 0x1DD13A78 HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1. Registered in Ireland, no 275301 T: (+353-1) 6609040 F: (+353-1) 6603666 WWW: http://www.heanet.ie/

1 0

FW: ISPs slowing P2P traffic...
by Bailey Stephen 16 Jan '08

16 Jan '08

>From my experience, the Internet IP Transit Bandwidth costs ISP's a lot more than the margins made on Broadband lines. So users who rarely use their connection are more profitable to the ISP. We used the Cisco Service Control Engine (SCE) to throttle P2P bandwidth. Stephen Bailey IS Network Services - FUJITSU Fujitsu Services Limited, Registered in England no 96056, Registered Office 22 Baker Street, London, W1U 3BW This e-mail is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may be privileged. Fujitsu Services does not guarantee that this e-mail has not been intercepted and amended or that it is virus-free. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mikael Abrahamsson Sent: 14 January 2008 17:22 To: nanog list Subject: RE: ISPs slowing P2P traffic... On Mon, 14 Jan 2008, Frank Bulk wrote: > In other words, you're denying the reality that people download a 3 to 4 > times more than they upload and penalizing every in trying to attain a > 1:1 ratio. That might be your reality. My reality is that people with 8/1 ADSL download twice as much as they upload, people with 10/10 upload twice as much as they download. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

22 31

summary of ipflow/netflow appliance
by Stefan Hegger 16 Jan '08

16 Jan '08

Here a summary of the answers I got. Again thanks for your help. mail from Joe >-Try fprobe, open source: http://sourceforge.net/projects/fprobe reply from Samuel >-nProbe by ntop.org is pretty robust tool for generating v5/v9 flows and >fairly inexpensive. http://www.ntop.org/nProbe.html mail from Roland >-Lancope offer a productized version of this, I believe Endace too, too. I talked to Lancope, they might provide me in 1 or 2 years with a 10G interface. mail from Frank >I just had an extended briefing with a company called Xangati. Very >interesting stuff, but they didn't talk about ways to obtain netflows if >your router isn't able to natively generate them. answer from Adam >I can attest to this. nProbe is your best bet for a “virtual NetFlow >exporter”. It performs well and has tons of export formats and features. We >use it extensively for QA and testing. You do, however, have to pay a bit >or it whereas fprobe and others are free. I talked to Peter Shaw peter(a)npulsenetworks.com here his answer >Thanks for contacting us. Yes, our Probe can handle the traffic level you >describe. Our typical, hardware-accelerated Probe has 2 Gigabit ports, and >shows less than 10% CPU utilisation when generating NetFlow records at the >full 2Gbps. We can readily build a Probe using 10Gig ports, and do not >expect any performance challenge at the traffic level you describe. >I have a couple of further questions/comments for you; >1) what Collector system do you plan to send the NetFlow records to ? We >can work with any NetFlow-aware collector, but we do find that many of them >struggle to keep up with the high volume of records from our Probe. We are >working on our own Collector/buffer system to reduce this problem, and >expect this to be available in Q2'08. I talked also to Luca Deri <deri(a)ntop.org> here the answer >the nPulse appliance is based on an old version of nProbe I have >developed years ago. We offer nBox appliances (http://www.nmon.net/nBox.html >) with a new accelerated nProbe version not available to anyone but >us. Next month we plan to introduce a new model based on a accelerated >card developed with a a twin company, able to outperform existing >solutions but with a lower price. >for 10G at the moment we use the Endace platform (NinjaProbe) or >Tilera (see http://www.tilera.com/pdf/ProductBrief_TILExpress_V1.pdf >and search for nProbe) cards for wire rate. If you have a few Gbits, a >software nBox can also be enough, but if you go above a hardware card >is definitively needed. >In late 2008 we should have our custom 10G card available but until >then we rely on external hardware solutions. >unless you want to buy the appliance from Endace and the software from >me, I can currently offer an nbox with dual 10G capability featuring >software packet capture acceleration for about 6K Euro. This model is >suitable for monitoring 2-3 Gbit of traffic. As I have stated before, >10G hardware capture acceleration still needs some time. next mail from gert >Has any of you done a reality-check before recommending these tools, >whether one of them can actually *handle* a 10G-link? >Sniffing 10G without losing packets is *hard*. >Sniffing 10G and doing any sort of math with it is *very hard*. >Any "sniff packets and do flow exports from there" application that >aims to do better than the flow hardware on the PFC3 needs to be really, >really, *really* good. conclusion: It is not easy to find a device to capture a 10G interface and generate the netflow. When I have news, I will will inform you. Best Stefan -- Stefan Hegger Internet System Engineer Lycos Europe GmbH Carl-Bertelsmann Str. 29 Postfach 315 33312 Gütersloh Phone: Tel: +49 5241 8071 334 Fax: +49 5241 80671 334 Mobile: +49 170 1892720 Sitz der Gesellschaft: Gütersloh Amtsgericht Gütersloh, HRB 2157 Geschäftsführer: Christoph Mohn <http://www.lycos-europe.com/L/A/>

1 0

Re: BGP Filtering
by Robert Bonomi 16 Jan '08

16 Jan '08

> Date: Tue, 15 Jan 2008 15:16:04 -0500 > From: "William Herrin" <herrin-nanog(a)dirtside.com> > Subject: Re: BGP Filtering > > > On Jan 15, 2008 12:51 PM, Dave Israel <davei(a)otd.com> wrote: > > I think I understand what you want, and you don't want it. If you > > receive a route for, say, 204.91.0.0/16, 204.91.0.0/17, and > > 204.91.128.0/17, you want to drop the /17s and just care about the /16. But > > a change in topology does not generally result in a complete update of the > > BGP table. Route changes result in route adds and draws, not a flood event. > > So if you forgot about the /17s and just kept the /16, and the /16 was > > subsequently withdrawn, your router would not magically remember that it had > > /17s to route to as well. > > Dave, > > That's half-true. > > The "routing table" is comprised of two components: the Routing > Information Base (RIB) and the Forwarding Information Base (FIB). The > RIB sits in slow, cheap memory and contains routes and metrics for > every route as announced by every neighbor. The FIB sits in fast, > expensive memory and contains the currently "best" route for each > destination. The FIB is built by choosing the best routes from the > RIB. Packet-forwarding decisions are made by consulting the FIB. > > Opportunistically filtering routes from the RIB would have exactly the > problem you point out: routing updates are incremental. The knowledge > that the /16 has been withdrawn may not accompany the knowledge that > the /17s are available. > > Opportunistically filtering more-specific routes from the FIB, > however, could be very valuable at the edge of the DFZ. If Cisco > supported such filtering, those Sup2's could have another few years of > life left in them. With 512m ram in a two-transit provider scenario a > Sup2 could handle upwards of 1M routes in the RIB. Unfortunately, they > can only handle 244k routes in the FIB. > > > Ben, coming back to your question: I don't think there is a way to > make the software filter the routes inserted into the FIB. I don't see > a reason why it couldn't be programmed to do that. But the fine folks > at Cisco didn't see fit to write that software. Its a pity 'cause it > would be very useful. This leads to one 'obviuous' approach to the matter. a smart BGP 'proxy' that accepts 'full' data from all the peers, manages the RIB and outputs =only= the current 'most desired' subset of routes to the target router. In _that_ router the RIB and FIB are going to be equivalent, This gets the 'hog' part of things off into 'commodity' hardware, and where you can afford to burn CPU cycles implementing 'smarts' to compensate for other people's 'dumbs'. At a quick glance it looks like this would not be terribly difficult to build, using Quagga/Zebra as a base platform.

2 1

Re: [Fwd: Unstable BGP Peerings?]
by Paul Ferguson 15 Jan '08

15 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Interesting, given that TTNet sits atop this ranking: https://nssg.trendmicro.com/nrs/reports/rank.php?page=1 I wonder if this is somehow related? ;-) - - ferg - -- Sue Joiner <smj(a)merit.edu> wrote: Forwarding for Mohit Lad and Jonathan Park. -sue Sue Joiner Merit Network - -------- Original Message -------- Subject: Unstable BGP Peerings? Date: Sun, 13 Jan 2008 17:49:44 +0000 From: ParkJonathan <j13park(a)hotmail.com> To: <nanog(a)merit.edu> CC: <smj(a)merit.edu>, <mohit(a)cs.ucla.edu> During our recent study on BGP routing instability, we found cases where lots of routes changed from one subpath to another subpath, repeating this kind of behavior over a few months . We do not know the cause of this repeated instability, but suspect the BGP peering between routers in two AS was unstable or had some problems and this caused routing changes seen by many observation points. Specifically, the peerings in question are 174 (Cogent) and 9121 (TTNet) 3257 (Tiscali) and 9121 (TTNet) 9304 (Hutchison) and 15412 (Flag Telecom) 1273 (Cable&Wireless) 4651 (Thai Gateway) 6762 (Seabone) and 7473 (Singapore Telecom) For details of events and timings, please find a short summary on the link below. http://irl.cs.ucla.edu/pca/active-links.html We would really appreciate if somebody from the ISPs involved in this activity (or anybody who might know what happened) would contact us and throw some light on the reasons for this behavior. Thanks Mohit Lad, Jonathan Park UCLA -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHiqUVq1pz9mNUZTMRAkVEAJ0Y4u5AYr/CiG65e3e+Y88HCQJGjQCg723O P17FTAUFOw3Ms1KQW6v2+44= =013x -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

houston.rr.com MX fubar?
by Chris Boyd 15 Jan '08

15 Jan '08

We're bouncing email to houston.rr.com due to the MX being set to localhost. clb@countzero:~$ host -t mx houston.rr.com houston.rr.com mail is handled by 10 localhost. Setting the MX to 127.0.0.1 seems like an odd way to handle the switch. <http://www.chron.com/disp/story.mpl/business/silverman/4842611.html> --Chris

6 13

NANOG website unreachable?
by Daniele Arena 15 Jan '08

15 Jan '08

Hi, Am I the only one to get a 403 on http://www.nanog.org/ ? Regards, Daniele.

2 1