August 2010 - Test - lists.nanog.org

Weekly Routing Table Report
by Routing Analysis Role Account 27 Aug '10

27 Aug '10

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 28 Aug, 2010 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 329510 Prefixes after maximum aggregation: 151625 Deaggregation factor: 2.17 Unique aggregates announced to Internet: 161906 Total ASes present in the Internet Routing Table: 34686 Prefixes per ASN: 9.50 Origin-only ASes present in the Internet Routing Table: 30086 Origin ASes announcing only one prefix: 14608 Transit ASes present in the Internet Routing Table: 4600 Transit-only ASes present in the Internet Routing Table: 106 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 24 Max AS path prepend of ASN (41664) 21 Prefixes from unregistered ASNs in the Routing Table: 1590 Unregistered ASNs in the Routing Table: 797 Number of 32-bit ASNs allocated by the RIRs: 748 Prefixes from 32-bit ASNs in the Routing Table: 962 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 170 Number of addresses announced to Internet: 2293803456 Equivalent to 136 /8s, 184 /16s and 169 /24s Percentage of available address space announced: 61.9 Percentage of allocated address space announced: 66.1 Percentage of available address space allocated: 93.7 Percentage of address space in use by end-sites: 84.5 Total number of prefixes smaller than registry allocations: 156020 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 80080 Total APNIC prefixes after maximum aggregation: 27494 APNIC Deaggregation factor: 2.91 Prefixes being announced from the APNIC address blocks: 77020 Unique aggregates announced from the APNIC address blocks: 33981 APNIC Region origin ASes present in the Internet Routing Table: 4178 APNIC Prefixes per ASN: 18.43 APNIC Region origin ASes announcing only one prefix: 1167 APNIC Region transit ASes present in the Internet Routing Table: 640 Average APNIC Region AS path length visible: 3.7 Max APNIC Region AS path length visible: 15 Number of APNIC addresses announced to Internet: 541736480 Equivalent to 32 /8s, 74 /16s and 62 /24s Percentage of available APNIC address space announced: 76.9 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 55296-56319, 131072-132095 APNIC Address Blocks 1/8, 14/8, 27/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 135692 Total ARIN prefixes after maximum aggregation: 69900 ARIN Deaggregation factor: 1.94 Prefixes being announced from the ARIN address blocks: 108438 Unique aggregates announced from the ARIN address blocks: 42670 ARIN Region origin ASes present in the Internet Routing Table: 13878 ARIN Prefixes per ASN: 7.81 ARIN Region origin ASes announcing only one prefix: 5319 ARIN Region transit ASes present in the Internet Routing Table: 1380 Average ARIN Region AS path length visible: 3.4 Max ARIN Region AS path length visible: 22 Number of ARIN addresses announced to Internet: 732630688 Equivalent to 43 /8s, 171 /16s and 14 /24s Percentage of available ARIN address space announced: 62.4 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 107/8, 108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 75384 Total RIPE prefixes after maximum aggregation: 44003 RIPE Deaggregation factor: 1.71 Prefixes being announced from the RIPE address blocks: 68841 Unique aggregates announced from the RIPE address blocks: 45070 RIPE Region origin ASes present in the Internet Routing Table: 14722 RIPE Prefixes per ASN: 4.68 RIPE Region origin ASes announcing only one prefix: 7583 RIPE Region transit ASes present in the Internet Routing Table: 2207 Average RIPE Region AS path length visible: 3.9 Max RIPE Region AS path length visible: 24 Number of RIPE addresses announced to Internet: 436405504 Equivalent to 26 /8s, 3 /16s and 5 /24s Percentage of available RIPE address space announced: 76.5 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 196608-197631 RIPE Address Blocks 2/8, 25/8, 31/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 176/8, 178/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 29777 Total LACNIC prefixes after maximum aggregation: 7078 LACNIC Deaggregation factor: 4.21 Prefixes being announced from the LACNIC address blocks: 28269 Unique aggregates announced from the LACNIC address blocks: 15311 LACNIC Region origin ASes present in the Internet Routing Table: 1338 LACNIC Prefixes per ASN: 21.13 LACNIC Region origin ASes announcing only one prefix: 414 LACNIC Region transit ASes present in the Internet Routing Table: 237 Average LACNIC Region AS path length visible: 3.9 Max LACNIC Region AS path length visible: 18 Number of LACNIC addresses announced to Internet: 76818560 Equivalent to 4 /8s, 148 /16s and 40 /24s Percentage of available LACNIC address space announced: 57.2 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 262144-263167 plus ERX transfers LACNIC Address Blocks 177/8, 181/8, 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 7369 Total AfriNIC prefixes after maximum aggregation: 1886 AfriNIC Deaggregation factor: 3.91 Prefixes being announced from the AfriNIC address blocks: 5717 Unique aggregates announced from the AfriNIC address blocks: 1722 AfriNIC Region origin ASes present in the Internet Routing Table: 397 AfriNIC Prefixes per ASN: 14.40 AfriNIC Region origin ASes announcing only one prefix: 125 AfriNIC Region transit ASes present in the Internet Routing Table: 91 Average AfriNIC Region AS path length visible: 3.7 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 20112896 Equivalent to 1 /8s, 50 /16s and 230 /24s Percentage of available AfriNIC address space announced: 59.9 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 1866 8412 498 Korea Telecom (KIX) 4755 1482 302 162 TATA Communications formerly 7545 1385 234 86 TPG Internet Pty Ltd 17488 1342 153 130 Hathway IP Over Cable Interne 17974 1168 295 81 PT TELEKOMUNIKASI INDONESIA 9583 1017 76 490 Sify Limited 24560 998 303 179 Bharti Airtel Ltd., Telemedia 4808 917 1692 247 CNCGROUP IP network: China169 9829 818 689 36 BSNL National Internet Backbo 4134 785 22475 418 CHINANET-BACKBONE Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3843 3668 277 bellsouth.net, inc. 4323 2701 1115 393 Time Warner Telecom 19262 1802 4626 276 Verizon Global Networks 1785 1791 698 131 PaeTec Communications, Inc. 20115 1493 1529 653 Charter Communications 7018 1470 5734 953 AT&T WorldNet Services 6478 1308 274 118 AT&T Worldnet Services 2386 1289 554 907 AT&T Data Communications Serv 11492 1239 214 119 Cable One 22773 1180 2858 61 Cox Communications, Inc. Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 3292 449 2026 390 TDC Tele Danmark 30890 443 99 211 Evolva Telecom 702 407 1870 324 UUNET - Commercial IP service 8866 403 117 18 Bulgarian Telecommunication C 8551 401 353 46 Bezeq International 3320 376 7329 325 Deutsche Telekom AG 3301 374 1416 329 TeliaNet Sweden 34984 367 89 185 BILISIM TELEKOM 12479 350 576 5 Uni2 Autonomous System 31148 326 17 80 FreeNet ISP Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1526 3049 246 UniNet S.A. de C.V. 10620 1102 246 148 TVCABLE BOGOTA 28573 1025 833 111 NET Servicos de Comunicao S.A 6503 835 187 257 AVANTEL, S.A. 7303 791 408 101 Telecom Argentina Stet-France 14420 553 35 76 CORPORACION NACIONAL DE TELEC 22047 551 310 15 VTR PUNTO NET S.A. 3816 477 210 100 Empresa Nacional de Telecomun 7738 477 922 30 Telecomunicacoes da Bahia S.A 11172 445 99 76 Servicios Alestra S.A de C.V Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 8452 1145 445 10 TEDATA 24863 725 147 39 LINKdotNET AS number 36992 661 279 185 Etisalat MISR 3741 267 907 225 The Internet Solution 33776 209 12 12 Starcomms Nigeria Limited 2018 197 277 64 Tertiary Education Network 6713 195 186 16 Itissalat Al-MAGHRIB 29571 193 19 11 Ci Telecom Autonomous system 24835 190 78 9 RAYA Telecom - Egypt 16637 147 440 96 MTN Network Solutions Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3843 3668 277 bellsouth.net, inc. 4323 2701 1115 393 Time Warner Telecom 4766 1866 8412 498 Korea Telecom (KIX) 19262 1802 4626 276 Verizon Global Networks 1785 1791 698 131 PaeTec Communications, Inc. 8151 1526 3049 246 UniNet S.A. de C.V. 20115 1493 1529 653 Charter Communications 4755 1482 302 162 TATA Communications formerly 7018 1470 5734 953 AT&T WorldNet Services 7545 1385 234 86 TPG Internet Pty Ltd Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 2701 2308 Time Warner Telecom 1785 1791 1660 PaeTec Communications, Inc. 19262 1802 1526 Verizon Global Networks 4766 1866 1368 Korea Telecom (KIX) 4755 1482 1320 TATA Communications formerly 7545 1385 1299 TPG Internet Pty Ltd 8151 1526 1280 UniNet S.A. de C.V. 17488 1342 1212 Hathway IP Over Cable Interne 6478 1308 1190 AT&T Worldnet Services 8452 1145 1135 TEDATA Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 11946 UNALLOCATED 8.12.155.0/24 40913 Quality Technology S 33084 UNALLOCATED 8.15.195.0/24 3356 Level 3 Communicatio 16734 UNALLOCATED 8.18.204.0/24 26914 Global Netoptex, Inc 22015 UNALLOCATED 8.22.137.0/24 14989 Broadview Networks 46856 UNALLOCATED 8.22.184.0/22 3561 Savvis 26169 UNALLOCATED 8.225.177.0/24 20225 TelJet 32249 UNALLOCATED 8.225.178.0/24 3356 Level 3 Communicatio 16927 UNALLOCATED 12.0.252.0/23 7018 AT&T WorldNet Servic 46883 UNALLOCATED 12.4.222.0/24 7018 AT&T WorldNet Servic 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 31.0.0.0/16 12654 RIPE NCC RIS Project 31.1.0.0/21 12654 RIPE NCC RIS Project 31.1.24.0/24 12654 RIPE NCC RIS Project 41.222.79.0/24 36938 >>UNKNOWN<< 41.223.92.0/22 36936 >>UNKNOWN<< 41.223.189.0/24 6453 Teleglobe Inc. 41.223.196.0/24 36990 Alkan Telecom Ltd 41.223.197.0/24 36990 Alkan Telecom Ltd 41.223.198.0/24 36990 Alkan Telecom Ltd 41.223.199.0/24 36990 Alkan Telecom Ltd Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:21 /9:10 /10:25 /11:67 /12:198 /13:414 /14:721 /15:1314 /16:11254 /17:5413 /18:9271 /19:18630 /20:23332 /21:23461 /22:30502 /23:29899 /24:171828 /25:1059 /26:1198 /27:718 /28:115 /29:47 /30:6 /31:0 /32:7 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6389 2459 3843 bellsouth.net, inc. 4766 1488 1866 Korea Telecom (KIX) 4323 1365 2701 Time Warner Telecom 1785 1254 1791 PaeTec Communications, Inc. 11492 1091 1239 Cable One 17488 1084 1342 Hathway IP Over Cable Interne 18566 1068 1087 Covad Communications 8452 1036 1145 TEDATA 10620 1015 1102 TVCABLE BOGOTA 24560 897 998 Bharti Airtel Ltd., Telemedia Complete listing at http://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:56 2:2 4:13 8:303 12:2014 13:8 14:1 15:21 16:3 17:9 20:7 24:1436 27:289 31:1 32:61 33:22 38:695 40:97 41:2521 44:3 46:45 47:16 52:12 55:7 56:2 57:28 58:801 59:503 60:460 61:1074 62:1086 63:1975 64:3740 65:2323 66:4032 67:1839 68:1122 69:2788 70:743 71:372 72:1940 73:2 74:2320 75:274 76:327 77:882 78:624 79:437 80:1038 81:804 82:503 83:510 84:691 85:1043 86:481 87:696 88:317 89:1532 90:97 91:2989 92:423 93:985 94:1161 95:679 96:489 97:217 98:621 99:34 108:64 109:651 110:456 111:556 112:279 113:314 114:451 115:573 116:1095 117:658 118:484 119:895 120:141 121:708 122:1540 123:955 124:1119 125:1242 128:226 129:158 130:199 131:540 132:247 133:17 134:195 135:45 136:236 137:136 138:264 139:105 140:476 141:197 142:344 143:351 144:471 145:52 146:427 147:170 148:679 149:305 150:153 151:233 152:299 153:169 154:3 155:361 156:165 157:328 158:118 159:358 160:315 161:183 162:269 163:167 164:416 165:369 166:467 167:423 168:654 169:158 170:722 171:61 172:2 173:1008 174:502 175:155 176:1 177:1 178:435 180:586 181:1 182:234 183:237 184:204 186:565 187:453 188:797 189:757 190:3978 192:5764 193:4754 194:3427 195:2788 196:1172 198:3577 199:3579 200:5430 201:1580 202:8055 203:8300 204:4010 205:2398 206:2534 207:3077 208:3887 209:3469 210:2561 211:1297 212:1754 213:1683 214:658 215:67 216:4775 217:1576 218:478 219:379 220:1140 221:388 222:290 223:7 End of report

1 0

re: Did your BGP crash today?
by Nick Olsen 27 Aug '10

27 Aug '10

No down time here, Would have been all over the news and everything if it really do "crash" the internet. Nick Olsen Network Operations (321) 205-1100 x106 ---------------------------------------- From: "Kasper Adel" <karim.adel(a)gmail.com> Sent: Friday, August 27, 2010 1:27 PM To: "NANOG list" <nanog(a)nanog.org> Subject: Did your BGP crash today? Havent seen a thread on this one so thought i'd start one. Ripe tested a new attribute that crashed the internet, is that true? Kim

3 2

Re: Did your BGP crash today?
by Nick Olsen 27 Aug '10

27 Aug '10

Well played, Sir. Nick Olsen Network Operations (321) 205-1100 x106 ---------------------------------------- From: Valdis.Kletnieks(a)vt.edu Sent: Friday, August 27, 2010 1:32 PM To: "Kasper Adel" <karim.adel(a)gmail.com> Subject: Re: Did your BGP crash today? On Fri, 27 Aug 2010 19:27:06 +0200, Kasper Adel said: > Havent seen a thread on this one so thought i'd start one. > > Ripe tested a new attribute that crashed the internet, is that true? If it in fact "crashed the internet", as opposed to "gave a few buggy routers here and there indigestion", you wouldn't be posting to NANOG looking for confirmation. :)

1 0

Fwd: Re: [oss-security] CVE Request -- Quagga (bgpd) [two ids] -- 1, Stack buffer overflow by processing crafted Refresh-Route msgs 2, NULL ptr deref by parsing certain AS paths by BGP update request
by Niko Thome 27 Aug '10

27 Aug '10

for those who missed it... kind regards, niko -------- Original Message -------- Subject: Re: [oss-security] CVE Request -- Quagga (bgpd) [two ids] -- 1, Stack buffer overflow by processing crafted Refresh-Route msgs 2, NULL ptr deref by parsing certain AS paths by BGP update request Date: Wed, 25 Aug 2010 10:21:59 -0400 From: Josh Bressers <bressers(a)redhat.com> Reply-To: oss-security(a)lists.openwall.com To: oss-security(a)lists.openwall.com CC: CERT-FI Vulnerability Co-ordination <vulncoord(a)ficora.fi>, Chris Hall <chris.hall(a)highwayman.com>, Denis Ovsienko <infrastation(a)yandex.ru>, "Steven M. Christey" <coley(a)linus.mitre.org> ----- "Jan Lieskovsky" <jlieskov(a)redhat.com> wrote: > Hi Steve, vendors, > > Quagga upstream has released latest vQuagga 0.99.17 version, > addressing two security flaws: > > A, Stack buffer overflow by processing certain Route-Refresh messages > > A stack buffer overflow flaw was found in the way Quagga's bgpd daemon > processed Route-Refresh messages. A configured Border Gateway Protocol > (BGP) peer could send a Route-Refresh message with specially-crafted > Outbound Route Filtering (ORF) record, which would cause the master > BGP daemon (bgpd) to crash or, possibly, execute arbitrary code with > the privileges of the user running bgpd. > > Upstream changeset: > [1] > http://code.quagga.net/?p=quagga.git;a=commit;h=d64379e8f3c0636df53ed08d5b2… > > References: > [2] https://bugzilla.redhat.com/show_bug.cgi?id=626783 > [3] http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100 Use CVE-2010-2948 for this one. > > B, DoS (crash) while processing certain BGP update AS path messages > > A NULL pointer dereference flaw was found in the way Quagga's bgpd > daemon parsed paths of autonomous systems (AS). A configured BGP peer > could send a BGP update AS path request with unknown AS type, which > could lead to denial of service (bgpd daemon crash). > > Upstream changeset: > [4] > http://code.quagga.net/?p=quagga.git;a=commit;h=cddb8112b80fa9867156c637d63… > > References: > [5] https://bugzilla.redhat.com/show_bug.cgi?id=626795 > [6] http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100 > Use CVE-2010-2949 for this one. Thanks. -- JB

1 0

Re: PacketShader
by nanogf . 27 Aug '10

27 Aug '10

--- Joel Jaeggli wrote: > What it really comes down to is packets per watt or packets per > dollar, if it's cheaper to do it this way then people will, if not > BFD. http://docs.google.com/viewer?url=http://ic.ese.upenn.edu/pdf/spice_fpl2009… Performance Comparison of Single-Precision SPICE Model-Evaluation on FPGA, GPU, Cell, and multi-core Processors _____________________________________________________________ Get your own *free* email address like this one from www.OwnEmail.com

1 0

IP characteristics for 3G and WiFi links
by Daniel Migault 26 Aug '10

26 Aug '10

Hi, We are testing protocols on our lab platform and we would like to simulate communication 2 types of communication : - From terminals to service platform using a 3G (HSPA / HSPA+) Access connection - From terminal to service platform using a WiFi Access connection We are using dummyNet to simulate the links so we are interested in IP characteristics layers for Packet loss Rate, bandwidth and latency. Values depends on multiple factors, but we would like to know what mean values are considered when services are deployed. Currently we are considering the following values. Packet Lost Rate for L2 seems 7% for Wifi and 5% for 3G. We are wondering how L3 is affected? Parameter | Wifi (802.11a/g) | 3G (HSDPA) Latency 100 ms 60 ms Bandwidth 5 Mbps 3 Mbps Packet Lost Rate XXX XXX Any comment links will be appreciated. Regards, Daniel -- Daniel Migault Orange Labs / Security Lab +33 (0) 1 45 29 60 52 +33 (0) 6 70 72 69 58

6 6

Enterprise Edge firewalls
by Lasse Birnbaum Jensen 26 Aug '10

26 Aug '10

Hi all We currently run Juniper NetScreen 5200 firewall and are looking for replacements, since these are doomed by Juniper and they are ready to be replaced. Their replacement is the SRX series, but since we need buy some replacements we feel that the rest of the market is worth looking at. Could any of you out there share experiences with other brand, specific models. Our setup will be implemented as described in the Cisco SAFE reference guide, with dedicated border routers and firewall behind those. The functional requirements we have is filtering and nat, ids/ips is a nice-to-have built-in feature. Stability and performance are off course also a demand. We currently have 10G ethernet both as peerings and core network. Contact me off the list if you want to remain anonymous. Thanks in advance Best regards Lasse Birnbaum Jensen Network Administrator University of Southern Denmark Denmark Email: lasse(a)sdu.dk Phone: +45 6550 2873

1 0

Should routers send redirects by default?
by Christopher Morrow 25 Aug '10

25 Aug '10

Polling a little bit here, there's an active discussion going on 6man@ietf about whether or not v6 routers should: o be required to implement ip redirect functions (icmpv6 redirect) o be sending these by default Essentially 12+ years ago in RFC2461 (http://www.ietf.org/rfc/rfc2461.txt) and later in RFC4861 (http://tools.ietf.org/html/rfc4861) there are a set of message types defined and use cases discussed which seem to lead to the idea that: routers should be reqiured to implement redirect logic/functionality routers should by default be enabled to send these redirect messages. In ipv4 there's a relatively widely used practice of disabling ip redirects. secure router and secure host templates disable this functionality, and have for quite some time. There are a host of reasons for this I don't really want to debate them though :) It would be instructive to get a sense of how many folks do NOT disable this sort of thing, or how many folks RELY on these functions working in their network build today. For the 6man discussion though, I presume that in ipv4 we take a set of configs/actions because of somewhat sane reasons, I suspect we would want to have the same config/end-state in v6? One proposal is to do this with: o routers are required to be able to send redirect messages o routers should NOT do this by default With the proviso that some consenting adults may choose to enable by default on certain platforms (cabl/dsl CPE, enterprise-LAN)... if that muddies the waters it'd be nice to just hear about the proposal there and leave the hinkiness of the rest out of the picture :) I hope that folks who currently run v6 network(s) might respond, there are quite a few v6 operators here... I'm looking at you owen/jjb/au-dsl-folk... :) thanks for your time, of couse if you want to chat more directly about this the 6man list is open and at: <http://www.ietf.org/mail-archive/web/ipv6/current/maillist.html> -Chris

21 55

how damp are your routes
by Randy Bush 25 Aug '10

25 Aug '10

a little contest here. what is the largest or most complex (measured in the number of parms) route flap damping confuration in actual use? send yours to me privately, and i will announce the winner in a few days (with their consent), and maybe show the config (with their consent). thanks for playing. and please, let's not get into the [de]merits of using rfd, how you should configure it, etc. this is research, and it is really about rfd parameter config complexity. randy

1 0

[NANOG-announce] PC Nominations are open!
by David Meyer 25 Aug '10

25 Aug '10

Folks, Its time to nominate those folks who you think will help the NANOG program committee continue to deliver great content to the NANOG community. Eligibility is outlined at http://nanog.org/governance/elections/2010elections. Please nominate those folks who you think can add perspective and energy to the PC, and remember that you can self-nominate. Thanks, Dave _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0