September 2008 - Test - lists.nanog.org

Re: Atrivo/Intercage: Now Only 1 Upstream
by hobbit＠avian.org 17 Sep '08

17 Sep '08

you expect them to apply a null route? Well, I *have* been talking somewhat idealistically here and there with this crop of questions, but frankly I thought in the 2 or 3 years I was ignoring the list that the NETWORK OPERATORS ostensibly in custody of the intertubes would have pulled things together a little better and grown enough of a pair to firmly state "this crap stops here and now" and make it happen. I do see pockets of good progress and research here and there and have gotten a lot of good feedback from people, but the big picture [as I watch my logs roll by] is pretty grim. Especially when the big players don't play at all. I've been around long enough to have a good idea of what *can* be done, but totally lost sight of any sensible reason why it *isn't*. Besides quarterly revenue, which is pretty short-sighted. Fortunately, I still have the luxury of being able to have my mailsystems tell cpe-*.rr.com and pool-*.verizon.net and c-24-*.comcast.net, along with large swaths of offshore IP space, to take a powder. Hundreds of times a day. But it's still their trash flying onto my tiny little lawn, and shouldn't be my job to sweep up. I mentally extend that picture to the millions of recipients who possibly aren't able to implement unusual and/or draconian filtering, and wonder how anybody ever gets any productive work done. _H*

2 1

Re: Atrivo/Intercage: Now Only 1 Upstream
by hobbit＠avian.org 17 Sep '08

17 Sep '08

So in cases like this where the community appears to agree that there's a consistently bad apple, what's preventing everyone from simply nullrouting the netblocks in question and imposing the death penalty? Sorry if this seems naive, but if no legitimate purpose is shown it seems like the obvious thing to do. Maybe they could still *send* packets, but nothing would ever get back to them. _H*

5 4

RE: LoA (Letter of Authorization) for Prefix Filter Modification?
by Skywing 16 Sep '08

16 Sep '08

It is only a good audit trail if the audit log can be trusted, though. Given how "secure" things like faxes are, well, that's a thing for another day, I suppose. Very few things out there in today's interconnected world really provide "hard" security, instead of security theatre/CYA/minor deterrants/"keeping honest people honest". That is not to say that these things have zero inherent value, at least in my mind, but they are not IMO to be confused with high security (as in military grade versus making a few clever [socially engineered] phone calls). Even so, much of the modern day business world relies on these things to some degree or another. - S -----Original Message----- From: Joe Greco <jgreco(a)ns.sol.net> Sent: Tuesday, September 16, 2008 11:15 To: Jon Lewis <jlewis(a)lewis.org> Cc: Rodriguez Mauricio <Mauricio.Rodriguez(a)fpl.com>; nanog(a)nanog.org <nanog(a)nanog.org> Subject: Re: LoA (Letter of Authorization) for Prefix Filter Modification? > On Tue, 16 Sep 2008, Christian Koch wrote: > > I dont mind, i think it is another good step towards 'good filtering' > > but...i think the PITA part is > > downstream 'clueless' customers, who may need an explanation on prefix > > hijacking and the state > > of the internet today, and that these are all just combined efforts to > > minimize the risk of accepting allocations > > that don't belong to you. > > IMO, it's just an illusion of added security and is really just CYA for > the provider. When I fax TWTelecom an LOA that a customer faxed to me, > how does TWTelecom verify the authenticity of that LOA? I doubt they try. > I suspect it's just filed, and will only be pulled out if the > advertisement is challenged by some 3rd party. How do you verify the authenticity of anything? This is a common problem in the Real World, and is hardly limited to LoA's. How do you prove that what was on Pages 1 to (N-1) of an N page contract contained the words you think they said? I knew a guy, back in the early days, who habitually changed the SLA's in his contracts so that he could cancel a contract for virtually no reason at all ... the folly of mailing around contracts as .doc files in e-mail. But even failing that, it's pretty trivial to reprint a document, so where do you stop, do you use special paper, special ink, watermarking of documents, initial each page, all of the above, etc? Look at what people are willing to go through with paper checks to increase the chances of authenticity. Google Abagnale. The real world already has ways of dealing with fraud and forgery, and while the paper is certainly CYA for the provider, it does provide an actual trail back that can probably be followed to some party. To refer to it as an "illusion" is only vaguely true. It is an illusion in that it will not prevent all cases of hijacking. Of course. However, it is another step that makes it significantly more difficult for someone to just start announcing random bits of IP space. It's just like physical security, in many ways. Given a sufficiently determined attacker, any door can be broken. Wood door? May require only my boot. Steel door? Prybar. Bank vault? Explosives. Etc. The thing is, as you increase the level of protection, the ease of countermeasures typically decreases (I wear my boots almost 100% of the time, I may have a prybar nearby, but I am unlikely to be carrying explosives at any time.) So let's not trivialize improvements such as LoA's which reduce the ease of hijackings, eh. ... JG -- Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net "We call it the 'one bite at the apple' rule. Give me one chance [and] then I won't contact you again." - Direct Marketing Ass'n position on e-mail spam(CNN) With 24 million small businesses in the US alone, that's way too many apples.

2 1

Creating a visual Map of a network?
by castellan2004-nsm＠yahoo.com 16 Sep '08

16 Sep '08

I am being tasked to map a network. In the past I have used nmap to find the systems on the local LAN and remote LANs (same enterprise). This time I want to create a visual map of the LAN. With cheops, I reasonably good results but cannot be documented for managers with certainty. What are some good tools now that will create visual maps of the networks? What is the best way to map a network when ICMP echo has been turned off? Thank you in advance for any help. Subba Rao

4 3

community real-time BGP hijack notification service
by Gadi Evron 16 Sep '08

16 Sep '08

Hi, WatchMy.Net is a new community service to alert you when your prefix has been hijacked, in real-time. Following the discussion on NANOG a couple of weeks ago on what to do if your prefix is hijacked, people mentioned that detection-wise, free services are limited (to certain communities or by not being real-time). The current fully public and free services will alert you with a few hours delay. Over labor day weekend we built a free real-time service. We invite people to try it out during our beta stage. Register for alerts at: http://www.watchmy.net/ We hope you find it useful, Avi Freedman, Andrew Fried && Gadi Evron.

13 27

IPv6 Penetration Survey: Your Participation Requested
by Member Services 16 Sep '08

16 Sep '08

The American Registry for Internet Numbers (ARIN), in cooperation with the Cooperative Association for Internet Data Analysis (CAIDA), is conducting a new survey to gather data regarding current and future use of IPv6. We have expanded the scope of the survey to seek IPv6 penetration data from around the world. We cordially invite and encourage all organizations in the AfriNIC, APNIC, ARIN, LACNIC, and RIPE NCC regions to participate in the survey so we can establish a comprehensive view of present IPv6 penetration and future plans for IPv6 deployment. The survey opened on 8 September and remains available until 17:00 EDT on 1 October. The results of the survey will be presented and discussed at the ARIN XXII Public Policy and Members Meeting to be held in Los Angeles, CA 15-17 October 2008. Additionally, the summary results will be shared with all the RIRs for further distribution within their respective regions. The survey data will support ongoing research. The survey is composed of 22 questions that can be answered in a few minutes. This is a secure survey and all data will be presented in summary form only, and kept confidential between ARIN and CAIDA. When you complete the survey you will be entered in a drawing for prizes, one raffle per RIR region. You must provide your contact information to win. Please take a few moments to complete the survey located at: https://www.surveymonkey.com/s.aspx?sm=loMM8qu18yFoKyi0rTUpQg_3d_3d Regards, Member Services American Registry for Internet Numbers (ARIN)

1 0

Re: Re: Anyone know Wiltel's EWAN service
by 정치영 16 Sep '08

16 Sep '08

Sorry, it is Los Angeles. I don't know whether our circuit is ralative to ATT oc12 ============================================= Chi-Young Joung SAMSUNG NETWORKS Inc. Email: lionair(a)samsung.com Tel +82 70 7015 0623, Mobile +82 17 520 9193 Fax +82 70 7016 0031 ============================================= ------- Original Message ------- Sender : charles(a)thewybles.com<charles(a)thewybles.com> Date : 2008-09-16 22:44 (GMT+09:00) Title : Re: Anyone know Wiltel's EWAN service La as in Los Angeles? Or Louisiana? There we're numerous strange issues last night in Los Angeles with T-Mobile that were caused by att loosing some oc12 circuits. That could have affected other carriers I'm sure. ------Original Message------ From: ChiYoung Joung To: nanog ReplyTo: lionair(a)samsung.com Subject: Anyone know Wiltel's EWAN service Sent: Sep 16, 2008 12:40 AM I have EWAN circuits of Wiltel(currently same company with Level3 you know) as my backbone circuit in LA. About 2 months ago, there were some packet loss on L2 circuit, but I didn't get any clear answer from Level3 support center. It became okey without any action, but now, same problem happen again. I feel bored, I need your help. Anyone know if there are any problems of WilTel's L2 circuit on LA area ? or Could anyone advice me the contact person who know well EWAN configuration of Wiltel ? Frankly, I felt Level3 guys seems to be unfamiliar with EWAN circuit of Wiltel. Best regards, Chiyoung ============================================= Chi-Young Joung SAMSUNG NETWORKS Inc. Email: lionair(a)samsung.com Tel +82 70 7015 0623, Mobile +82 17 520 9193 Fax +82 70 7016 0031 ============================================= Sent via BlackBerry from T-Mobile

1 0

Re: Anyone know Wiltel's EWAN service
by charles＠thewybles.com 16 Sep '08

16 Sep '08

La as in Los Angeles? Or Louisiana? There we're numerous strange issues last night in Los Angeles with T-Mobile that were caused by att loosing some oc12 circuits. That could have affected other carriers I'm sure. ------Original Message------ From: ChiYoung Joung To: nanog ReplyTo: lionair(a)samsung.com Subject: Anyone know Wiltel's EWAN service Sent: Sep 16, 2008 12:40 AM I have EWAN circuits of Wiltel(currently same company with Level3 you know) as my backbone circuit in LA. About 2 months ago, there were some packet loss on L2 circuit, but I didn't get any clear answer from Level3 support center. It became okey without any action, but now, same problem happen again. I feel bored, I need your help. Anyone know if there are any problems of WilTel's L2 circuit on LA area ? or Could anyone advice me the contact person who know well EWAN configuration of Wiltel ? Frankly, I felt Level3 guys seems to be unfamiliar with EWAN circuit of Wiltel. Best regards, Chiyoung ============================================= Chi-Young Joung SAMSUNG NETWORKS Inc. Email: lionair(a)samsung.com Tel +82 70 7015 0623, Mobile +82 17 520 9193 Fax +82 70 7016 0031 ============================================= Sent via BlackBerry from T-Mobile

1 0

Internet Traffic Begins to Bypass the U.S.
by Hank Nussbacher 16 Sep '08

16 Sep '08

http://www.nytimes.com/2008/08/30/business/30pipes.html?partner=rssuserland… -Hank

14 25

confusing packet data
by Jim Popovitch 16 Sep '08

16 Sep '08

This is something has been bugging me lately.... Etherape is a Linux tool that graphs packets arriving at your host, and shows paths of connectivity. I captured the graphs, at the URL below, from my Linux laptop connected to a Linksys wifi router that is hooked to a Comcast cable modem. Why is it that I can see packet data from IPs all over the place? http://picasaweb.google.com/jimpop/Public# Any insight is much appreciated. -Jim P.

4 5