- Test - lists.nanog.org

Re: Advice in dealing with BGP prefix hijacking
by Scott Weeks 29 Sep '08

29 Sep '08

--- mikebenden(a)gmail.com wrote: From: "L. Gabriel Somlo" <mikebenden(a)gmail.com> I'm looking for advice on how to deal with a US ISP (names withheld to protect the guilty) which seems to repeatedly fat-finger our IP space into their BGP announcements, and then gives us the run-around when we call them on the phone, since we're not their clients... ------------------------------------------ Talk to their upstream(s) and ask them to filter the ISP properly. Show the upstreams evidence of the ISPs wrongful announcements from router commands, bgplay or other tools. scott

1 0

Re: Renesys Blog Article [Was: Re: the Intercage mess]
by Henry Linneweh 29 Sep '08

29 Sep '08

If a consensus can be reached here, we have seen a rise in this, that does raise concerns of a RIAA/MPAA type of mindset, which is detrimental vigilante Definition vigi·lante (vij′ə lan′tē, -län′-) noun 1. a member of a vigilance committee 2. any individual who acts outside of legal authority, often violently, to punish or avenge a crime, right a perceived wrong, etc. vigi·lan·tism (vij′ə lan′tiz′əm, -län′-; vij′ə lən tiz′əm) noun the lawless, violent methods, spirit, etc. of vigilantes vigilantism Related Forms vig′i·lan′·tist adjective vigilantism Usage Examples Noun used with modifier * 'Internet: But this has come under fire from many who see it as an example of 'Internet vigilantism ' that could destabilize Internet trading. Adjective modifier * self-appointed: We must, moreover, take action which is firm enough to pre-empt action by self-appointed vigilantes. ========================================================================= ----- Original Message ---- From: Gadi Evron <ge(a)linuxbox.org> To: Paul Ferguson <fergdawgster(a)gmail.com> Cc: nanog(a)nanog.org; nanog-post(a)rsuc.gweep.net Sent: Wednesday, September 24, 2008 6:02:21 PM Subject: Re: Renesys Blog Article [Was: Re: the Intercage mess] On Wed, 24 Sep 2008, Paul Ferguson wrote: > Just a side-note: Rensys has an interesting blog article up today on this > Atrivo/Intercage "mess": > > http://www.renesys.com/blog/2008/09/internet_vigilantism_1.shtml > > FYI, I have but one comment. There is a difference between Vigilantism as it is perceived today and Vigilantism as it is in the dictionary. It means neighborhood watch. When the Police is not around, that is something you need. "It's for the children". All in all, very nice blog post. While I feel I can not yet fully comment on the whole Atrivo / Intercage depeering movement, there is an underlying strategy to consider. I will comment at a later date. Gadi.

7 6

BGP for disaster recovery site
by CHRISTINE.M.BERNS＠sargentlundy.com 29 Sep '08

29 Sep '08

We currently have a routable block (class B) of IP addresses. We are in the process of designing a disaster recovery site. Our main site is already dual homed to two different Internet service providers via BGP. A consultant told us that in order to allow us to test access to the DR site without affecting the production environment, we should get another block of addresses from ARIN and advertise those addresses out the DR site's Internet connection. Can we even expect to get another block from ARIN if we already have a class B, and could we not accomplish the same thing by advertising a subnet of our existing Class B at the DR site? I would actually prefer to advertise a subnet of our class B, but am wondering if there are any reasons why this is not a good idea. Also, I have seen reference to some Internet service providers possibly not accepting /24 BGP routes and either dropping them or aggregating them to a /21 or /20 or /19. Are there recommendations as to what is the longest prefix that we should advertise to guarantee that the prefix will be advertised throughout the Internet? Chris

2 1

Advice in dealing with BGP prefix hijacking
by L. Gabriel Somlo 29 Sep '08

29 Sep '08

Hi, I'm looking for advice on how to deal with a US ISP (names withheld to protect the guilty) which seems to repeatedly fat-finger our IP space into their BGP announcements, and then gives us the run-around when we call them on the phone, since we're not their clients... Happened twice already, took several hours to fix each time, and I'm looking for any ideas, opinions, and war stories that would help me figure out how to discourage them from repeating this type of thing in the future... Thaks much, Mike

1 0

Live.com admin
by Childs, Aaron 29 Sep '08

29 Sep '08

If there is an admin/postmaster for live.com on this list could you please contact me off-list? Thank you, Aaron ------------- Aaron Childs Assistant Director, Networking Westfield State College http://www.wsc.ma.edu/it/ "I would rather write 10,000 notes than one letter of the alphabet." -- Beethoven

1 0

the Intercage mess
by hobbit＠avian.org 29 Sep '08

29 Sep '08

While it's good to see some community effort going toward slapping a lid on misbehaving sources, how about a little consistency in the bigger picture? Consider this sort of scenario: An ISP allows its infrastructure to emit spam and host compromised machines to harbor malware and facilitate crime and botnets. Its abuse mailbox is a black hole that is provably ignored. All reasonable efforts to get the problem fixed fail. Network operators band together and deroute the ISP's blocks, forcing them to either clean up their act or find something else to do with their time. Internet death penalty, simple enough. If this happened to some of the other major sources of crap that I'm thinking of, it would make the freaking NATIONAL NEWS. Where's the BACKBONE to go after the real high-volume sources, rather than continuing to kick sand in the face of some podunk little guy who can no longer defend himself? _H*

31 54

Routing issue between ICE and Level3
by Ken Gilmour 28 Sep '08

28 Sep '08

Good morning, Is there anyone on this list who works for ICE in Costa Rica? We are encountering some routing issues between you and Level 3 and Packet Exchange. Level3 ticket number is available on request. Please contact me off list. ¿Hay alguien en esta lista, que trabaja para ICE en Costa Rica? Estamos tropezando con algunos problemas de enrutamiento entre usted y Level3 y Packet Exchange. Level3 número de billete está disponible a petición. Gracias! Thanks and regards, Ken

1 0

Estonian Cyber Security Strategy document -- now available online
by Gadi Evron 27 Sep '08

27 Sep '08

Hello. The Estonian cyber security strategy document is now available online. I must say once again the concept of a national cyber security stance is quite interesting. I decided to send a message to NANOG as the "fields of activity" part of the document clearly mentions ISPs in relation to national security and infrastructure: " 12 The growing number of Internet services means that the dependence of our daily activities and lifestyle on the security and proper functioning of information technology increases incessantly. The Internet is an important element of Estonia's critical information infrastructure: it is used daily by the majority of Estonian enterprises and state agencies as well as by more than half the population. The key components of Estoniaâs critical information infrastructure, which constitute the IT infrastructure used by enterprises and agencies in the provision of e- services, include: Internet service providers, the name servers of the state, Estonia's root domain, network nodes, service servers and the firewalls of public and private organisations. The seamless operation of this infrastructure is vital to the daily functioning of the Estonian economy." Those who wish to download the document: http://www.mod.gov.ee/?op=body&id=518 My contact there specified she'd be happy to answer any questions. To avoid spam of her inbox, email me for her address. Gadi Evron.

2 2

Re: rackmount managed PDUs
by Henry Linneweh 27 Sep '08

27 Sep '08

Here is my contribution to the PDU/UPS list, Eaton has long been in this business http://www.powerware.com/UPS/Products.asp#large -henry ----- Original Message ---- From: Paul Stewart <pstewart(a)nexicomgroup.net> To: Andrew D Kirch <trelane(a)trelane.net> Cc: nanog(a)nanog.org Sent: Thursday, September 25, 2008 9:45:53 AM Subject: RE: rackmount managed PDUs We have a lot of APC managed power bars (zero U vertical, and 19" 1U rackmount) and they work great. We SNMP manage them and access them via web - they just work, and work well for our needs. Tripplite we've had issues with over time, especially their UPS units (SNMP sucks on them). Hope this helps a bit.. Take care, Paul -----Original Message----- From: Andrew D Kirch [mailto:trelane@trelane.net] Sent: Thursday, September 25, 2008 12:41 PM Cc: nanog(a)nanog.org Subject: Re: rackmount managed PDUs http://www.webpowerswitch.com/ I've used these quite a bit. Depending on the model you can get per port or per zone power management, and it sends alerts if it's not in the state it's supposed to be, and some of them can auto kickover things like routers if they suddenly cant route (might be dangerous, I don't use this one except at the CPE) Andrew Justin M. Streiner wrote: > As much as I hate to tear people away from the Intercage/Atrivo > debacle and semi-tangential rants, I'll take one for the team and do > it :) > > I have an opportunity coming up to rebuild an existing machine room > space to an extent. It's not a total gut-and-refit, but I'll at least > get to put in some new infrastructure. That said, I'd be interested > in hearing about peoples' experiences with various rackmountable > managed PDUs. > > I have some Tripp Lite PDUMH30NETs that work well and are reasonably > priced, but they have a few quirks (no RS-232 console port, web > interface seems to be a little shaky with Firefox, etc) that would > become more annoying when scaled up to several rows of new rack > footprints. I'm also open to using managed vertically mounted PDUs. > The plan is for each footprint to have "A" and B" feeds, so two > PDUMH30NETs would take up 4U per footprint, which is a bit much... > > I don't need to worry about distributing DC power - just AC. > > This site will be lights-out most of the time, so robust remote > management capabilities are a must. > > Any thoughts/insight are greatly appreciated. > > jms > ---------------------------------------------------------------------------- "The information transmitted is intended only for the person or entity to which it is addressed and contains confidential and/or privileged material. If you received this in error, please contact the sender immediately and then destroy this transmission, including all attachments, without copying, distributing or disclosing same. Thank you."

1 0

high latency ds3 issue on unloaded line
by mike 27 Sep '08

27 Sep '08

Hello, I have a ds3 from qwest which has daily issues with insane point-to-point latencies sometimes exceeding 1000ms for hours on end, and which suddenly disappear, and does not appear to correspond with actual measured link utilization (less than 20mbps most days). To make a long investigation short, the problem comes on during the day and then lets up late in the evening. I have tested and examined everything at the ip layer and no it's not high utilization, an ACL, router cpu or bad hardware, no line errors or other issues visible from interface or controller stats. yes I have flushed all hardware, and I have a 7204vxr/npe-400 with this single ds3. The only clue seems to be millions of 'output drops' from qwest's side. And at night I can hit popular ftp mirrors from a directly attached server and observe my interface reporting about %100 utilization combined with my users and customers, so yeah it really is a full line rate ds3. And historically Mrtg always shows around 20mbps or less utilization and it's only smokeping that goes off, usually in the afternoon when the point to point latencies between my router and qwest start heading north, and consistently at that. I also have another in house tool that takes 30 second snapshots of my ds3 interface in order to catch short bursts that would be smoothed out with mrtg's 5 minute average, but during these high latency times there aren't any spikes noted. And for added confusion (or fun!), the latency can start at any utilization level - I've observed it while we were pulling just 12mbps, and I have not had it while we were doing 34mbps, only the time of day seems to be the common factor. Qwest has not been able to identify the issue, only note that - yeah, this really is happening when there is otherwise no real load on the line - and I am certain we have done everything to rule out the ip layer. They have put in a 'request' to move me to another router, but I am not hopeful of a resolution that way as the router we're currently on doesn't appear otherwise to have the problem with any other subscriber. What I want to know, is it possible that the underlaying atm/sonet that carries my ds3 from my facility is somehow oversubscribed or misconfigured? We have an OC12 fiber entrance and this is the only circuit provisioned on it, and in our small tiny town the only other user on the ring with us is comcast (according to the att network engineer who installed this). I don't know enough about atm/sonet to imagine conditions that would cause the issues I am seeing here , but every ip layer tool I have only ever tells me there isn't an ip issue here. I can issue ping from my router directly to the attached qwest router and get > 1000ms and then other times (out of the problem window), I am getting 4ms. If anyone has laughs or beers to offer me, send 'em on cuz I could use both right about now.... Mike-

9 9