March 2009 - Test - lists.nanog.org

Looking Glass script
by Andy BIERLAIR 02 Mar '09

02 Mar '09

I was wondering if somebody knows where to find a decent looking glass script (PHP or Perl) that is compatible with Cisco 6500 Routers and can parse the results (bgp, bgp summary, ping, traceroute) so that they can easily be integrated into good looking HTML tables. I know there are plenty of good scripts available, but they all generate raw output. Parsing this data is a lot of coding work and I was hoping that I did not have to reinvent the wheel. Thanks, Andy

4 3

23456 without AS4_PATH?
by Saku Ytti 02 Mar '09

02 Mar '09

Anyone else seeing this: *> 91.196.186.0/24 62.237.167.25 0 3292 3549 15703 43531 23456 i http://www.ietf.org/rfc/rfc4893.txt 6. Transition An OLD BGP speaker MUST NOT use AS_TRANS as its Autonomous System number. -- ++ytti

5 6

Legislation and its effects in our world
by Jim Willis 02 Mar '09

02 Mar '09

After having a brief conversation with a friend of mine over the weekend about this new proposed legislation I was horrified to find that I could not dig anything up on it in NANOG. Surely this sort of short minded legislation should have been a bit more thought through in its effects on those that would have to implement these changes. My major concern is not just for myself but for a much broader picture. "Republican politicians on Thursday called for a sweeping new federal law that would require all Internet providers and operators of millions of Wi-Fi access points, even hotels, local coffee shops, and home users, to keep records about users for two years to aid police investigations." http://www.cnn.com/2009/TECH/02/20/internet.records.bill/index.html I understand and agree that minors should be protected and I think child pornography is awful, however I think how the government is going about catching these criminals with this new legislation will not really be any more efficient than there current methods. Having a log of all IP's that come across my or anyone in America's "home" Wi-Fi for two years is not going to help "police investigations" but will cause me to have to go buy a more expensive router. So I'm just wondering, how would this legislation effect some of you on the NANOG list? -Jim

8 9

Hostile probe recording
by Lou Katz 02 Mar '09

02 Mar '09

I happen to have some non-standard applications running on port 80 on one of my machines. From time to time I get log messages noting improper syntax (for my app) of the form: 'GET /roundcube/CHANGELOG HTTP/1.1' 200.19.191.98 'GET /mail/CHANGELOG HTTP/1.1' 200.19.191.98 'GET /webmail/CHANGELOG HTTP/1.1' 200.19.191.98 'GET /roundcubemail/CHANGELOG HTTP/1.1' 200.19.191.98 'GET /rcmail/CHANGELOG HTTP/1.1' 200.19.191.98 'GET //CHANGELOG HTTP/1.1' 200.19.191.98 'GET /rc/CHANGELOG HTTP/1.1' 200.19.191.98 'GET /email/CHANGELOG HTTP/1.1' 200.19.191.98 'GET /mail2/CHANGELOG HTTP/1.1' 200.19.191.98 'GET /Webmail/CHANGELOG HTTP/1.1' 200.19.191.98 'GET /components/com_roundcube/CHANGELOG HTTP/1.1' 200.19.191.98 'GET /squirrelmail/CHANGELOG HTTP/1.1' 200.19.191.98 'GET /vhcs2/tools/webmail/CHANGELOG HTTP/1.1' 200.19.191.98 'GET /round/CHANGELOG HTTP/1.1' 200.19.191.98 (200.19.191.98 is the IP address of the attacking machine, not me) Is this sort of information of use to anyone here? Is the above an old vulnerability - since I don't run whatever it is probing for, I have not paid much attention to these. -- -=[L]=- Organization: entropic

4 3

ISP network re-design feedback requested
by Steve Bertrand 01 Mar '09

01 Mar '09

Hi everyone, Hopefully my question is operational 'enough' to be asked here, as I don't know of any other place to ask... Still trying to redesign (as-I-go) our ISP network, I've realized that we are not large enough to deploy a full three layer approach (core, dist, acc), so I'm trying to consolidate, with the ability to scale if necessary. I also want full network reachability if I need to take any one router off-line for upgrade or replacement purposes. Given the following diagram (forgive me, it was drafted rather quickly with Visio, and just dumped onto a web box), I'm hoping for advice on whether I'm leaning the right way. http://ibctech.ca/p-ce.html What I want: - ability to take a router off-line for upgrade, and not be concerned about reachability issues if the lab-tested procedure fails miserably on production gear - a relatively easy way to keep traffic control measures at the access/edge (ACLs, uRPF, RTBH etc) - the 'core' free of interface ACLs (if possible), only running filtering ingress to the process-switch environment - the ability to scale without having to have a full mesh with all PE routers What I have: - numerous CPE routers connected to a CE switch that multi-homes into two different routers at two different locations in our access layer - an access layer that has no routers capable of a full BGP table (well, v4 that is) - a core layer that can handle full tables - a network access layer on the north side of the diagram that you can't see, with the same type of setup, but with full v4 routing tables being announced in - the access layer provides def-orig to CPE routers - the PE protects the CE from becoming transit What I am thinking - use the core routers as route-reflectors to the PE access routers, including a def-orig where it applies (to remain scalable, until PE can be replaced to hold full routes) - the PE routers send def-orig on to the CE sites - stop thinking about every network like it is an 'enterprise' network - look at most of my ISP environment as 'access clients', instead of always seeing my ISP as everything in my buildings. See the ISP as a 'network provider', and then realize the rest are just access 'clients': -- the 'hosting provider' -- the 'collocation provider' -- the 'Internet provider' -- the 'email provider' -- ect There is much, much more, but feedback on the above setup will get me going on the proper path... Steve

10 16

Clueful BGP Engineers
by Gregory Boehnlein 01 Mar '09

01 Mar '09

Can someone with a clue from the following two carriers please contact me off list? XO - ASN 2828 Level 3 - ASN 3356 I am currently experiencing a UDP/DNS DOS originating from 165.194.27.159 in Aisia. We have attempted to blackhole the subnet using BGP communities, but the requests are being filtered out at the X/O and L3 interfaces.

1 0

Can I know how this network works (resend)?
by Deric Kwok 28 Feb '09

28 Feb '09

Hi all main router- 3 static routes ip route 192.168.0.0/24 10.0.0.1 (routerA) ---- ip route 192.168.1.0/24 10.0.0.2 (routerB) ----same switch ---telecom company---client request ip route 192.168.2.0/24 10.0.0.3 (routerC) ---- Diagram ======= ---routerA--- main router ---switch ---routerB--- switch ---telecom company ---routerC--- dyname ip clients ip 192.168.0.0/24 and 192.168.1.0/24 static ip clients ip 192.168.2.0/24 This setting is fine when any dynamic ip clients sent from telcom company. But When telecom company sent request from static ip client (any ip in 192.168.2.0/24) but this client is sent to in routerA, how this work out? I really don't want to have 192.168.2.0 in routerC to routerB then routerA in loop as there will have big admin work if there is more than 3 routers and have increase new static ip client for the future Thank you for your help

1 0

Can I know how this network works out?
by Deric Kwok 28 Feb '09

28 Feb '09

Hi all main router- 3 static routes ip route 192.168.0.0/24 10.0.0.1 (routerA) ---- ip route 192.168.1.0/24 10.0.0.2 (routerB) ----same switch ---telecom company---client request ip route 192.168.2.0/24 10.0.0.3 (routerC) ---- Diagram ======= ---routerA--- main router ---switch ---routerB--- switch ---telecom company ---routerC--- dyname ip clients ip 192.168.0.0/24 and 192.168.1.0/24 static ip clients ip 192.168.2.0/24 This setting is fine when any dynamic ip clients sent from telcom company. But When telecom company sent request from static ip client (any ip in 192.168.8.0/22) but this client is sent to in routerA, how this work out? I really don't want to have 192.168.8.0 in routerC to routerB then routerA in loop as there will have big admin work if there is more than 3 routers and have increase new static ip client for the future Thank you for your help

1 0