- Test - lists.nanog.org

Re: New router feature - icmp error source-interface [was: icmp rpf]
by Fergie 26 Sep '06

26 Sep '06

Ah, but there's the rub... ISPs who are "discreet" in how they wish their infrastructure to be "viewed" will continue to engineer methods in which portions are not visible to the public at-large. Somehow, I don't think that will ever go away, so trying to tilt at windmils w.r.t. (paraphrased) "...what interface an ICMP foo is sourced from..." is, indeed... tiling at windmills, methinks. :-) Cheers! - ferg -- "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> wrote: On Tue, 26 Sep 2006, Fergie wrote: > Chris, > > So, I'm wondering: What happens when you have a traceroute tool > that shows you MPLS-lableled hops, too? :-) > :) depends on the network I guess... I'm not sure it's going to tell you anything about hops hidden by mpls lsp's that don't decrement ttl though... -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: TCP receive window set to 0; DoS or not?
by Fernando Gont 25 Sep '06

25 Sep '06

At 21:55 08/09/2006, Jim Shankland wrote: >Travis Hassloch <travis.hassloch(a)rackspace.com> writes: > > The part where it becomes a DoS is when they tie up all the listeners > > on a socket (e.g. apache), and nothing happens for several minutes until > > their connections time out. Whether intentional or not, it does have > > a negative effect. > >Ah, that makes sense. I was assuming a deliberate attack, which is >not actually implicit in the term "DoS". A deliberate denial of >service is not made easier by shrinking the window. But an implementation >that advertises a 0 window in lieu of sending FIN or RST can certainly >deny service inadvertently by tying up resources that should have been >freed. FYI, this issue was raised at the IETF TCPM WG mailing-list a month ago or so. The OP argued to reduce the amount of time for which a peer could advertise a 0 window. However, the problem is that if the goalis to perform a DoS attack, the attacker could advertise a 1-byte window (or ay other small window). Or he could advertise a 0-window for some time (less than the "threshold" the OP proposed), then increase the window to, say, one segment, and then go back to advertising a 0 window. The OP had suggested seeing this behaviour tying up all system resources, hence leading to the attacked system to not be able to service legitimate systems. There seemed to be agreement as at the TCPM WG that yu should handle these scenarios at the application layer. Kindest regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

Re: fyi-- [dns-operations] early key rollover for dlv.isc.org
by Gregory Hicks 25 Sep '06

25 Sep '06

> Date: Fri, 22 Sep 2006 19:55:39 -0400 > From: Joseph S D Yao <jsdy(a)center.osis.gov> > To: Fergie <fergdawg(a)netzero.net> > Cc: nanog(a)merit.edu > Subject: Re: fyi-- [dns-operations] early key rollover for dlv.isc.org > > > On Fri, Sep 22, 2006 at 11:39:51PM +0000, Fergie wrote: > > Hmmm. It wouldn't have anything to do with prime numbers, now would > > it? :-) > > > Well, yes, but there are an infinite number of them. > > Of course, 17 is the most prime of them all. isc.org announced the early key rollover just as a discussion about "exponent 3 damage spreads" on the cryptography list was heating up. This discussion started with a statement that: > I've just noticed that BIND is vulnerable to: > > http://www.openssl.org/news/secadv_20060905.txt > > Executive summary: > > RRSIGs can be forged if your RSA key has exponent 3, which is BIND's > default. Note that the issue is in the resolver, not the server. > > Fix: > > Upgrade OpenSSL. So I thought that the early key rollover was due to this. Yet it seems to me that this discussion is still recommending that "-e 3" be used. Regards, GRegory hicks ------------------------------------------------------------------- I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

2 1

Re: NANOG Thread
by Alexander Harrowell 25 Sep '06

25 Sep '06

Well, if anyone wants to add more to it, there are quite a few prominent 'noggers still to cast.

3 3

802.3ad/LACP between Administrative Domains
by Chris Costa 25 Sep '06

25 Sep '06

We have a GE link to another SP and bridge a single VLAN ID to connect multiple hosts on each side. We'd like to increase the BW between the two networks, but the other provider cannot support upgrading to 10GE. What are the issues w/ running 802.3ad LACP between two separately managed networks and binding Nx1GE links: - Does this require BPDU forwarding across the links, and share a common STP for the VLAN? We currently filter BPDU's across the single link. - Any known LACP negotiation issues between a Cisco (6500) and Foundry (unkn)? - Is there the potential for layer 2 loops if LACP fails and BPDU's are being filtered across the links? - Bad experiences w/ 802.3ad when loosing one of the two links? Thank you for your input.

1 0

Topicality perceptions
by J. Oquendo 25 Sep '06

25 Sep '06

One of the biggest issues with the list as I've seen from time to time from my perspective, is the definition of "operations". So on a quick breakdown of the logical definition of NANOG, I derive "Operations of the North American Network". The problem with this stems from far too many bastardizing their own definition of what it should be. If I'm experiencing issues on the "Network" in North America, where else should I look for assistance but from a group that manages (or at least portrays to manage) operations in North America? I've posted quite a few questions here and there, many have said they've made no sense. DoS attacks... Mork calling Olson come in Olson... These do affect networks... Botnets, worms and viruses... Mork calling... Get the point? How many posts have we seen on configuring a router that were multi-threaded into a long post of "my config is better than yours" or similar. These are off-topic but I wouldn't trade em for the world. I've learned much from them, as have I from all sorts of posts on topic or not. I can see where there would be annoyance from certain threads, but I see more annoyance from the whiners and complainers who spew the same message inserting nothing worth reading and for this I have filters in place. William Allen Simpson wrote: > > Especially as I'm not aware of any Network Operator worth their salt that > doesn't have regular contact with their support call centers. > Regular contact? As in finding the name of someone who actually has a clue? Not the contact information of some helpdesk goon who doesn't understand the output of a traceroute? As in some helpdesk goon who understands what an AS is? Getting (semi)back on topic, who decides what's on topic or not, it seems to be based on one's personal view of what is and isn't relevant. <SNIP> http://www.nanog.org/endsystem.html "The charter of the NANOG list was written to avoid being too specific and to not preclude useful network-relevent discussion" </SNIP> Botnets: Relevant Viruses and worms: Relevant DoS attacks: Relevant Mail/Spam: Relevant Router configuration: Semi-Relevant If someone's misconfiguration will affect your network, then router configurations are somewhat relevant. I recall having a fiber issue a while back (http://www.irbs.net/internet/nanog/0408/0563.html) and although it was not relevant to NANOG whatsoever, who else better to ask then the experienced engineers and I was thankful for the responses I received. I also recall talking about a possible huge DoS against the BGP protocol (which COULD affect hundreds) yet the response was... "You're off-topic, etc." not including the off-list responses I received. Looking back at some of the threads I see posted here, whenever I tend to see something "operational" that doesn't bode well with someone, I see people quick to shoot a "you're off-topic" response offering nothing more than wasted bandwidth. It is those quick to shoot off those responses who give me the impression that they're nothing more than lazy whiners incapable of offering assistance/solutions/tips/etc. BGP exploitation? (http://www.irbs.net/internet/nanog/0308/1018.html) was shot down and I quote: "this is almost certainly not a topic for Nanog". Really? To date I have not released plenty of stupid programs capable of wrecking havoc because they serve no purpose. My intentions when I posted this was to inform others "Hey did you know that X could possible break your neighboring..." It was sent with hopes of working with engineers to find a resolution. I'm sure if I shot off a program to the "black hat" community, I would have been an ass since I didn't properly notify the powers that be (whoever these are these days). Perhaps "Operations" need be dissected, re-defined and re-posted on NANOG. Laptop policies? http://www.merit.edu/mail.archives/nanog/msg01619.html How is/was this relevant? So in other news, has anyone in the south experienced issues with Time Warner (South Carolina, Louisiana, etc.) experienced issues with filtering? Specifically SIP? I have tons of people with issues regarding VoIP and (not suprisingly) they happen to all be related to Time Warner. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743 "How a man plays the game shows something of his character - how he loses shows all" - Mr. Luckey

4 3

Re: recap of nanog-futures on "on topic" and proposed compromise
by Fred Heutte 25 Sep '06

25 Sep '06

Creating consternation around boundary conditions and then proposing artificial self-serving "compromises" is one of the oldest games there is on mailing lists, going back pretty much to the invention of Usenet. At the risk of playing a small role in this instance, as a longtime lurker I simply point out the predictable failure pattern here. Fred ---------------- > >Basically, there is a crowd that says only network related stuff, say, >trasnit ISP's (as an example, not to say them alone) would be interested >in, is on topic. > >Others say there are other issues which are oprations related and >of interest to them. We are split. > >A compromise has now been suggested (by me). The only thing both sides >agree on is that in fact, the replies and flame wars on what is on topic >or isn't, and who should speak of what, are disruptive. > >Thus, the compromise idea is that for now and for a predetermined period >of time, we start with one small change. Debugging is done one step at a >time rather than in earthshattering moves. > >How about we, for now, only change one thing about NANOG - the specific >off topic posts that tell others to be quiet, or that they are >off-topic will be disallowed. This is really a concensus and a good way to >start making progress rather than escalating a conflict between people >who just want to get things done and see the NANOG community as a home. > >I believe it's a good temporary solution which will take us ahead, to >measure how things go, as well as be able to find out what we all agree >on afterwards. As well as increase the value of the list almost >immediately. > >This re-cap is from my perspective, naturally. We can keep arguing over >who said what or what's on or off topic forever. Consolidating on what we >all agree would be a change for the better and starting there sounds like >a good idea to me. > >Solving this in a civil fashion just became so much more attractive. > >Thanks, > > Gadi. > >

2 1

NANOG Thread
by Alexander Harrowell 24 Sep '06

24 Sep '06

After recent events, may I propose the ultimate NANOG thread.. NANOG User: Message Richard A Steenbergen: Can we keep this off-topic crap off NANOG? Gadi Evron: That message is deeply relevant to us all. I can't understand what your porblme is. Sean Donelan: Fascinating, User. I suppose ISSUE would be different if you were running a NETWORK and using ROUTER. Christopher L. Morrow: I think you have a point, Sean, but can you try not to engage with this? ISSUE is definitely off topic. RAS: Only Auntie Jane on a crappy Windows box would have ISSUE anyway. Donelan/Evron/Morrow in chorus: But Jane is our customer. RAS/Bill Manning together: Get a clue! Valdis Kletnieks: NANOG User said: <<<<<< <<<<< <<<< <<<< <<< <<< << <snip> We had ISSUE on a DEVICE in our FACILITY back in 2004. Have you got the DATA? >>>. ... .>>> >>> >>> >> Of course all this wouldn't be a problem if STANDARDS BODY had got a clue and decided to implement PROPOSAL. NANOG User: *pastes 86 hop tracert, last week's BGP update log and half the CIDR report* Valdis/RAS/Evron/Bill/Morrow: Couldn't you have sent that offlist? Get a clue! NANOG User: I'm sorry if I offended your refined sensibilities. Who do you think you are? Random Lurker desperately seeking status: Bill is right. This is the Network Operators' list. RAS: Anyway, PROPOSAL would have been a good idea, but nobody was ever going to deploy it. We ought to go straight to IPVersionX. All: IP Version X?? Get a clue! Valdis: Only someone who thinks we ought to go back to ATM would support that Bellhead POS. From a network architecture perspective, it's plain stupid. Evron: You obviously have no idea of how the botnets would exploit that. Bill: Gadi, that's off topic. Morrow: No, it's not. Third-world ISP operator: Hello, I've got SERIOUS PROBLEM on my network in POOR COUNTRY and no money. Can anyone advise on how we can fix it? Thanks Randy Bush: I can't read your message. It's got capital letters in it. Anyway, I think we need to get back to some operational content. Fergie: Hey guys, this looks interesting - <a href="http://link.to.newsstory">Chinese scientists teach monkey to write technical manual</a> Randy Bush: I can't read your message. It's got HTML in it. Valdis: RFCx says you can have capital letters AND links in your e-mail. Randy: I don't care. Evron: Major security alert! Morrow: Bullshit. RAS: No, that is on topic. Donelan: Probably more suited to LIST, but it certainly has consequences for support costs. NANOG User: Why does Sean always take RAS's side like this? Peter Dambier: It's because of the 2004 Olympics that all e-mail has to be routed to the European Commission so the SS7 signalling can be screened for correct geopolitical routing. I can see this because my traceroute is broken! << <<< <<,<< ,<< <<< <, User, I think your ISSUE could be resolved by WILDLY IMPRACTICAL SOLUTION, as long as you use an alternate root server. Valdis: Peter, you're insane. Peter Dambier: The psychiatric-industrial complex denounces all victims of ICANN mind control as "mentally ill"! Resist the empire now! NANOG User: Is that on topic for NANOG? All: That is on topic/That is off topic! Bill: Well, I think he's got a point about ICANN. RAS: They're nowhere near as bad as ARIN, though. I only wanted another /8 and it took me three whole weeks! All: Swine! Donelan: ARIN's never been a problem for me. Another NANOG User: STUPID REMARK about evil state bureaucracies forcing their eurosexual communism on us. Buy guns! Evron: So who should assign IPs? AT&T? Get a clue! Randy Bush: You would say that. Anyway, I think WILDLY IMPRACTICAL SOLUTION is actually quite a good idea, except for the alternate root bit. Back at RESEARCH CENTRE in the 1970s, Vint Cerf and I tried something similar. Bill: Namedropper! Moderator(a)mitre.edu: I think this thread should be moved to NANOG-FUTURES. RAS: Why isn't there a NANOG-CRAP? Moderator(a)mitre.edu: Are you sure there isn't? Morrow: Anyone else seeing high latency to TELCO in CITY? Crickets: chirping Random Lurker, still hoping one of the silverbacks will show him some love: So, what about IPVersion Y? All: That's not operational! *thread peters out in howling clue vacuum*

2 1

Re: NANOG Thread
by Alexander Harrowell 24 Sep '06

24 Sep '06

This inspired me: http://highclearing.com/index.php/archives/2006/04/07/4991

1 0

Re: Telehouse North outage?
by Brandon Butterworth 24 Sep '06

24 Sep '06

> Does anybody have details about a power outage at Telehouse North today? There was no power to a fair proportion of it for around 5 minutes at approx 12:50BST brandon

2 1