- Test - lists.nanog.org

Re: Security gain from NAT: Top 5
by Roger Marquis 27 Jun '07

27 Jun '07

Mark Smith wrote: > For all those people who think IPv4 NAT is quite fine, I > challenge them to submit RFCs to the IETF that resolve, without > creating worse or more even more complicated problems, the list > of problems here. All the IPv6 RFCs do ... > <http://www.cs.utk.edu/~moore/what-nats-break.html> These RFCs clearly have an agenda: selling IPv6. It is unfortunate they don't feel it necessary to make a balanced presentation of the pros and cons but instead appear to believe that spreading FUD about NAT is an effective method of promoting IPv6. Problem is that NAT will not go away or even become less common in IPv6 networks for a number of reasons. #1 NAT advantage: it protects consumers from vendor lock-in. Consider the advantage of globally unique public addressing to ISPs and telcos. Without NAT they have a very effective vendor lock-in. Want to change ISPs? It's only as easy as reconfiguring every device and/or DHCP server on your internal network. With NAT you only need to reconfigure a single device, sometimes not even that. #2 NAT advantage: it protects consumers from add-on fees for addresses space. Given the 100 to 10,000% mark-ups many telcos and ISPs already charge for more than a /29 it should come as no surprise they would be opposed to NAT. #3 NAT advantage: it prevents upstreams from limiting consumers' internal address space. Even after full implementation of IPv6 the trend of technology will continue to require more address space. Businesses will continue to grow and households will continue to acquire new IP-enabled devices. Without NAT consumers will be forced to request new netblocks from their upstream, often resulting in non-contiguous networks. Not surprisingly, often incurring additional fees as well. Follow the money and you'll end up with these three reasons why the technical arguments being made against NAT in opinion pieces like Keith Moore's (URL above) are so one sided and overtly biased. But there are still more reasons NAT will continue to increase in popularity regardless of IPv6. #4 NAT advantage: it requires new protocols to adhere to the ISO seven layer model. H.323, SIP and other badly designed protocols imbed the local address in the data portion of IP packets. This trend is somewhat discouraged by the layer-isolation requirements of NAT. #5 NAT advantage: it does not require replacement security measures to protect against netscans, portscans, broadcasts (particularly microsoft's netbios), and other malicious inbound traffic. The vendors of non-NAT devices would love to have you believe that their stateful inspection and filtering is a good substitute for the inspection and filtering required by NAT devices. Problem is the non-NAT devices all cost more, many are less secure in their default configurations, and the larger rulesets they are almost always configured with are less security than the equivalent NAT device. These are just some of the reasons why NAT is, and will continue to be, an increasingly popular technology for much more than address conservation. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

4 3

TransAtlantic Cable Break
by Roderick S. Beck 26 Jun '07

26 Jun '07

Well, despite all this talk about the Latin fiber break, the real news is that one of the TransAtlantic cables has had one of their two cables severed. Repair is not expected until after the US July 4th holiday. So none of the customers on that well known system have any ring protection at this point nor will they during the next two weeks. This is a lesson for those who put all their eggs in one basket. This cable system is also a major IP backbone player. So it shouldn't be too hard to guess their identity. Regards, Roderick S. Beck. Global Wholesale Bandwidth, LLC Manhattan & Paris email: info(a)globalwholesalebandwidth.com New York Landline: 212-942-3345 Paris Landline: 33-1-4346-3209 GSM Wireless: 1-212-444-8829 This e-mail and any attachment thereto may contain information which is confidential and/or protected by intellectual property rights and are intended for the sole use of the recipient(s) named above. Any use of the information contained herein (including, but not limited to, total or partial reproduction, communication or distribution in any form) by other persons than the designated recipient(s) is prohibited. If you have received this e-mail in error, please notify the sender either by telephone or by e-mail and delete the material from any computer.

16 26

NZNOG 08 - Call for Participation and Papers
by Simon Lyall 26 Jun '07

26 Jun '07

NZNOG 08 - Call for Participation and Papers The next conference of the New Zealand Network Operators' Group is to be held in Dunedin, New Zealand between 23 January and 25 January 2008. Our host is WIC. NZNOG meetings provide opportunities for the exchange of technical information and discussion of issues relating to the operation and support of network services, with particular emphasis on New Zealand. The conference is low priced and has a strong technical focus with the aim and history of getting a strong turnout of technical personal from New Zealand Internet orientated companies. Conference Overview ------------------- NZNOG 2008 will consist of one day workshop and tutorial day followed by two days of conference presentations. There will also be opportunity for more informal and small lightening talks. These are typically around five minutes long and are organised closer to the actual conference. Important Dates --------------- Call for Papers opens: 25 June 2007 Deadline for speaker submissions: 6 August 2007 Responses to speaker submissions: 24 August 2007 Draft program published: 3 September 2007 Final program published: 1 November 2007 NZNOG 2008 Conference: 23 - 25 January 2008 SIG / Miniconf / Tutorials -------------------------- The first day of the conference will again be a workshop and tutorial day. It is usually run as one or more parallel 'interest group' streams and practical or interactive workshops of interest to Network Operators. This is a call for papers and activities for the first day of conference. Examples of past activities workshops include 'MPLS and fixed access networks for beginners', 'Mikrotik RouterOS Training', 'APNIC Internet Resource Management Essentials', and a System Administrators mini-conference which included talks on 'Using Debian packages for system administration' and '42 hosts in 1U: Using virtual machines'. Conference Presentations ------------------------ The main conference program for 2008 will be made up of two days with a single stream where possible. Presentations don't need to fit any particular fixed length and can be from 30 minutes to 3 hours in length. NZNOG conferences have traditionally spanned the entire operational spectrum, and then some. Proposals for conference presentations are invited for virtually any topic with a degree of relevance to the NZNOG community. Past years' talks have included the following: - Internet exchange operations - Global anycast networks and the building thereof - Peering, peering, and peering - Network security - 10GB ethernet operations - Advanced networks in NZ - Current Internet research in NZ - Wireless networking - QOS over carrier networks - Content distribution networks and media streaming - How we paid the construction guys 18 pints of beer and they gave us a free metro fibre network in Palmy North - Open Source VoIP Platform in Carrier Environments If you are interested in submitting a talk please fill out the questions at then end of this document and email them to prog08(a)nznog.org . Submission Guidelines --------------------- When considering a presentation or SIG, remember that the NZNOG audience is mainly comprised of technical network operators and engineers with a wide range of experience levels from beginners to multi-year experience. There is a strong orientation to offer core skills and basic knowledge in the SIGs and to address issues relevant to the day-to-day operations of ISPs and network operators in the conference sessions. The inclusion of a title, bio, topic, abstract, and slides with proposals is not compulsory but each will help us determine the quality of your proposal and increase the likelihood it will be accepted. Final slides are to be provided by 21 January 2008. Note: While the majority of speaking slots will be submitted by 6 August 2007, a limited number of slots may be available for presentations that are exceptionally timely, important, or of critical operational importance. The NZNOG conference is a TECHNICAL conference so marketing and commercial content is NOT allowed within the program. The program committee is charged with maintaining the technical standard of NZNOG conferences, and will therefore not accept inappropriate materials. It is expected that the presenter be a technical person and not a sales or marketing person. The audience is extremely technical and unforgiving, and expects that the speakers are themselves very knowledgeable. All sessions provide time for questions, so presenters should expect technical questions and be prepared to deliver insightful and technically deep responses. Funding and Support ------------------- NZNOG conferences are community run and funded events that try to keep the cost to attendees as low as possible so generally we are unable to pay the travel costs of speakers. There is a limited amount of funding available to international speakers. Conference presenters will not have to pay any registration fee for the day they are presenting. Discounts for SIG and lightning talk presenters may be available but are not automatic. Lightning talks --------------- Lightning talks are short talks/presentations that last no more than 10 minutes. This is a good opportunity to get your pet topic out there or perhaps to get some experience with presenting without having to go to a full talk. At NZNOG 2008 it is planned that there will be at least one hour long lightning talk session. Sponsors -------- There are opportunities remaining for organisations to sponsor various aspects of the NZNOG meeting. Please contact sponsorship(a)nznog.org for more information Contact ------- Website * http://2008.nznog.org General Enquiries * info(a)nznog.org Talks and Papers * prog08(a)nznog.org Talk Proposals -------------- Please send all talk proposals (including lightning talks) to prog08(a)nznog.org along with the requested information. Questions regarding talks can be sent to the same address. Sponsorship may be available for a limited number of overseas speakers to attend the conference, please indicate if you require assistance with travel and/or accommodation. Author's Full Name: Author's Email Address: Author's affiliation: Author's short biography: Title of Talk: Abstract: Length of talk: Please provide details if a version of this talk has previously been given: Will travel and accommodation assistance be required:

1 0

June 2007 DA Botnet Command and Control
by c2report＠isotf.org 26 Jun '07

26 Jun '07

The drone army (DA) research group surveys, conducted during random time intervals over the past 6 months, associated 3724 unique, apparently active hosts, which were, in some manner, associated with a suspect C&C domain. Naturally, any such association contains peculiarities of measurement such as false positives and attempted "Joe-Jobs" against legitimate hosts. None-the-less, the association is of some interest (probably only to crusty academics) in that unique IP counts combined with DA's monthly rankings reveal a more precise, and likely truer, picture of C&C network demographics. The DA monthly rankings, located on <http://isotf.org/ccreport.html> includes duplicate host reports resulting from multiple domains and ports mapping to a single host. This host duplication tends to inflate estimated host counts within a network. Comparing the "Open" count for a network contained in DA report "Top 20 ASNes by Total suspect domains" with the Uniq IP count contained in the included "Top Forty Unique IP" list should give a better indication of the overall effectiveness of the success of the network's C&C removal efforts. Top forty Unique IP counts within Autonomous System: ASN Uniq IPs Responsible Party 30058 113 FDCSERVERS - FDC Servers.net 25761 86 STAMINUS-COMM - Staminus Communications 23522 85 IPNAP-ES - Ecomdevel (CIT-FOONET) 19318 78 NJIIX-AS-1 - NEW JERSEY INTERN 4837 72 CHINA169-Backbone 4766 69 KIXS-AS-KR Korea Telecom 4134 66 CHINANET-BACKBONE No.31 13301 63 UNITEDCOLO-AS Autonomous System of unitedcolo.de 7132 59 SBC Internet Services 24989 47 IXEUROPE-DE-FRANKFURT-ASN IX Europe Germany AS NA** 43 (No applicable network - Mitigation Address space) 3462 39 HINET Data Communication Business Group 12832 39 LYCOS-EUROPE Lycos Europe GmbH 9318 36 HANARO-AS Hanaro Telecom Inc. 3320 33 DTAG Deutsche Telekom AG 14779 33 INKTOMI-LAWSON - Inktomi Corporation 28753 32 NETDIRECT AS NETDIRECT Frankfurt 8560 31 ONEANDONE-AS 1&1 Internet AG 9121 31 TTNET TTnet Autonomous System 35916 27 Multa 577 26 BACOM - Bell Canada 16265 26 OCOM OCOM AS 3786 25 LGDACOM LG DACOM Corporation 8972 23 INTERGENIA-ASN intergenia autonomous system 14780 21 INKTOMI-LAWSON - Inktomi Corporation 20115 21 CHARTER-NET-HKY-NC - Charter Communications 8376 20 GO-JOR Autonomous System 36420 20 ev1.net 174 19 COGENT Cogent/PSI 3269 19 ASN-IBSNAZ TELECOM ITALIA 10316 19 ABACUS-NET-AS - Abacus America Inc. 22927 19 Telefonica de Argentina 31103 19 KEYWEB-AS Keyweb AG 1668 18 AOL-ATDN - AOL Transit Data Network 2119 18 TELENOR-NEXTEL T.net 3561 18 SAVVIS - Savvis 9155 18 QualityNet AS number 9800 18 UNICOM CHINA UNICOM 19262 18 Verizon Internet Services 1659 17 ERX-TANET-ASN1 Tiawan Academic Network (TANet) Best regards Randy Vaughn gadi evron Randy_Vaughn (at) baylor.edu ge (at) linuxbox.org

1 0

OT: Moment of silence for Rod Beck
by Paul Reubens 25 Jun '07

25 Jun '07

I think we should now wind up the discussion on transoceanic bandwidth and extend our thoughts and prayers to the family in this time of need. >From CNN: Beck was discovered by police officers responding to a call to his home in suburban Phoenix, police department spokesman Andy Hill said Sunday. Foul play is not suspected, though the cause of death might not be known for several days.

2 1

Vietnam arrests alledged fiber-optic cable thieves
by Sean Donelan 25 Jun '07

25 Jun '07

http://www.thanhniennews.com/society/?catid=3&newsid=29347 Police arrested two more people Saturday for stealing undersea fiber-optic cables off the southern coast of Vietnam, including the group.s suspected leader. Ten have been apprehended in the case so far. [...] Eleven kilometers of the TVH (Thailand-Vietnam-Hong Kong) line and 32 km of the APCN (Asia Pacific Cable Network), linking nine Asian countries, have been stolen.

1 0

it was damp in belleview
by Randy Bush 24 Jun '07

24 Jun '07

the network at the belleview meeting was fantastic, thanks to the host, xkl, and the usual suspects (merit, tony, ...). but there was one outage. as best i know, that outage was caused by one of the two upstream transit isps bouncing (at least) the nanog prefix on one of their routers far over the water in seattle. of course, that is why we had two upstreams. but, flap amplification and dear old route flap damping caused our prefix to be damped by a number of global isps. yes, our prefix, not just the path. for those who want to read up on route flap damping and why this caused problems, please see <http://www.nanog.org/mtg-0210/flap.html> "Route Flap Damping: Harmful?" from the 2002 nanog eugene meeting. for those wishing historical perspective on route flap damping, document ripe-378 (may 2006) says 1.1 Background In the early 1990s the accelerating growth in the number of prefixes being announced to the Internet (often due to inadequate prefix-aggregation), the denser meshing through multiple inter-provider paths, and increased instabilities started to cause significant impact on the performance and efficiency of the Internet backbone routers. Every time a routing prefix became unreachable because of a single line-flap, the withdrawal was advertised to the whole core Internet and handled by every single router that carried the full Internet routing table. It was soon realized that the increasing routing churn created significant processing load on routing engines, sometimes sufficiently high load to cause router crashes. To overcome this situation RFD was developed in 1993 and has since been integrated into most router BGP software implementations. RFD is described in detail in RFC 2439. RFD is now used in many service provider networks in the Internet. for reasons described in the 2002 preso cited above, and demonstrated by the network outage in belleview, ripe-378 goes on to conclude 4.0 Recommendation This Routing Working Group document proposes that with the current implementations of BGP flap damping, the application of flap damping in ISP networks is NOT recommended. The recommendations given in ripe-229 and previous documents [2] are considered obsolete henceforth. i.e., it's time to turn it off. you are damaging your customers and others' customers. randy

3 3

Re: TransAtlantic Cable Break
by Keith 24 Jun '07

24 Jun '07

> However, if you put 15G down your "20G" path, you have no redundancy. > In a cut, dropping 5G on the floor, causing 33% packet loss is not > "up", it might as well be down. > > If your redundancy solution is at Layer 3, you have to have the > policies in place that you don't run much over 10G across your dual > 10G links or you're back to effectively giving up all redundancy. This can be a valid solution. Our company has some multimedia traffic that can be axed if a catastrophe befalls our tubes. Obviously we'd prefer not to drop (or ax, as it were) any type of traffic, but it's a monetary decision.

1 0

RE: TransAtlantic Cable Break
by W.D.McKinney 23 Jun '07

23 Jun '07

_____ From: Rod Beck [mailto:Rod.Beck@hiberniaatlantic.com] To: Sean Donelan [mailto:sean@donelan.com], Hank Nussbacher [mailto:hank@efes.iucc.ac.il] Cc: nanog [mailto:nanog@merit.edu] Sent: Fri, 22 Jun 2007 10:14:20 -0800 Subject: RE: TransAtlantic Cable Break Protected 10 gig waves NYC/London are extremely expensive. Say $60K or more per month. Not bad as DS3's between Alaska & Seattle used to cost that much. -Dee So it usually makes sense for the Layer 3 guys to lease diversely routed 10 gig waves and do the protection themselves using MPLS or load balancing or some other protocol about which I know little ... Roderick S. Beck Hibernia Atlantic 1 Passage du Chantier, 75012 Paris http://www.hiberniaatlantic.com Wireless: 1-212-444-8829. Landline: 33-1-4346-3209 rod.beck(a)hiberniaatlantic.com rodbeck(a)erols.com ``Unthinking respect for authority is the greatest enemy of truth.'' Albert Einstein. -----Original Message----- From: owner-nanog(a)merit.edu on behalf of Sean Donelan Sent: Fri 6/22/2007 4:56 PM To: Hank Nussbacher Cc: nanog Subject: Re: TransAtlantic Cable Break On Fri, 22 Jun 2007, Hank Nussbacher wrote: >> Tell that to the 10 gig wave customers who lost service. Very few cable >> systems provide protection at the 10 gig wave level. > > If you don't pay the extra amount for a protected circuit, why should your > circuit get protection for free when others have to pay for it? Now, if > there are 10G customers with protected circuits who lost service, then > hopefully they have in their contract hefty penalty clauses against the > carrier. If not, then they are just plain stupid. Is paying for "protected circuits" actually worth it. Or are you better off just buying two circuits and using both during normal conditions. Use switching at layer 3 to the remaining circuit during abnormal conditions. Most of the time, you get twice the capacity for only twice the price instead of a "protected circuit" where you only get the once the capacity for twice the price. Of course, there is still the problem some facility provider will "groom" both your circuits on to the same cable. If you are buying pre-emptable circuits, hopefully you understand what that means.

1 0

Re: TransAtlantic Cable Break
by Frank Coluccio 23 Jun '07

23 Jun '07

To clarify my last post, and to partly correct it, I was referring to VZ's new TPE China cable, where I mentioned pending pricing and T&C information. Of course, VZ already meshes its IP backbones, as a matter of course today, in existing systems. Frank A. Coluccio DTI Consulting Inc. 212-587-8150 Office 347-526-6788 Mobile On Fri Jun 22 23:59 , Frank Coluccio sent: > >Interestingly, some major transoceanic undertakings have begun looking very >favorably towards a meshed topology solution, eschewing rings. Verizon is >championing this approach at the present time as a consortium partner in the >Trans-Pacific Express (TPE) cable laying venture to China, and offers >justifications for doing so in several interviews and PPT prezos I've come >across. Makes sense. From: http://preview.tinyurl.com/yqcrzm > >May 2007 Issue of Lightwave Magazine > > >"Last year, Verizon also took steps to improve the reliability of the >transatlantic portion of its global IP network. In the past, traffic moved across >the Atlantic over SONET rings, which provided redundant paths. However, such >architecture only protects against a single failure in a given ring. A failure or >service interruption on two or more segments of the same network required the >deployment of a cable ship-the nautical equivalent of the truck roll-to restore >service. Today, Verizon Business operates a mesh network, using Ciena >CoreDirectors (www.ciena.com) to move traffic between six diverse paths that can >be routed onto other undersea networks in the event of a network failure." > > >Of course, these offerings are still being "productized," so it remains to be >seen what terms and conditions they carry, and how they will be priced. > >Frank >== > >On Fri Jun 22 11:56 , Sean Donelan sent: > >> >>On Fri, 22 Jun 2007, Hank Nussbacher wrote: >>>> Tell that to the 10 gig wave customers who lost service. Very few cable >>>> systems provide protection at the 10 gig wave level. >>> >>> If you don't pay the extra amount for a protected circuit, why should your >>> circuit get protection for free when others have to pay for it? Now, if >>> there are 10G customers with protected circuits who lost service, then >>> hopefully they have in their contract hefty penalty clauses against the >>> carrier. If not, then they are just plain stupid. >> >>Is paying for "protected circuits" actually worth it. Or are you better >>off just buying two circuits and using both during normal conditions. >>Use switching at layer 3 to the remaining circuit during abnormal >>conditions. Most of the time, you get twice the capacity for only twice >>the price instead of a "protected circuit" where you only get the once >>the capacity for twice the price. >> >>Of course, there is still the problem some facility provider will "groom" >>both your circuits on to the same cable. If you are buying pre-emptable >>circuits, hopefully you understand what that means. >> >> >> > >

1 0