- Test - lists.nanog.org

Comcast latency Maryland area
by Mark Owen 30 Nov '05

30 Nov '05

Congested router? Tracing route to google.com [72.14.207.99] over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms 192.168.20.1 2 15 ms 6 ms 5 ms 73.138.40.1 3 7 ms 6 ms 26 ms ge-2-3-ur01.lanham.md.bad.comcast.net [68.87.131 .113] 4 6 ms 7 ms 7 ms te-9-1-ur01.bowie.md.bad.comcast.net [68.87.128. 177] 5 7 ms 8 ms 7 ms te-8-2-ar01.capitolhghts.md.bad.comcast.net [68. 87.128.182] 6 17 ms 23 ms 15 ms 68.87.16.153 7 92 ms 92 ms 91 ms pos-0-0-cr01.whitemarsh.md.core.comcast.net [68. 87.16.21] 8 250 ms 253 ms 254 ms 12.118.102.5 9 259 ms 263 ms 257 ms tbr1-p010101.n54ny.ip.att.net [12.123.3.82] 10 255 ms 252 ms 253 ms ggr2-p300.n54ny.ip.att.net [12.123.3.58] 11 294 ms 284 ms 275 ms so-7-1.car3.NewYork1.Level3.net [4.68.127.5] 12 283 ms 286 ms 283 ms ae-1-56.bbr2.NewYork1.Level3.net [4.68.97.161] 13 267 ms * 277 ms as-1-0.bbr1.Chicago1.Level3.net [64.159.0.237] 14 277 ms 286 ms 278 ms ae-12-51.car2.Chicago1.Level3.net [4.68.101.3] 15 253 ms 260 ms 263 ms unknown.Level3.net [209.247.34.26] 16 279 ms 278 ms 288 ms 64.233.175.97 17 274 ms 309 ms 289 ms 66.249.94.69 18 292 ms 272 ms 290 ms 66.249.94.73 19 275 ms 268 ms 293 ms 72.14.207.99 Trace complete. -- Mark Owen

2 2

Re: BGP Security and PKI Hierarchies
by Peter J. Cherny 29 Nov '05

29 Nov '05

On 29-Nov-2005, at 12:16, David Barak wrote: > Maybe my imagination just isn't good enough: could you > toss me an example-type of organization where that > would be problematic? If we consider non-operators e.g. medium sized commercial or NGOs ... APNIC have a mechanism in-place, but most of the denizens of the Swamp are suspicious that if we were to sign an agreement with APNIC, we'd be giving up some of our historical rights and exposing ourselves to the risk of reclamation. Annual account fee (historical resource maintenance) $100.00 http://www.apnic.net/docs/policy/historical-maintain-guide.html http://www.apnic.net/member/feesinfo.html#non_mem_fee Until (and if) an ipv6 multi-homed transition is possible, medium sized organizations here in Oz will continue to use a mixture of PA and PI space to isolate us from dependence on a single carrier. In a country as large as the US, but sparsely populated except for scattered cities, each with millions of people, reliable and cost effective service delivery requires that we retain direct control of routing policy i.e. have our own chunks of PI space, though having one or more ASs is not necessary. Back to lurking, pjc

1 0

Re: QoS for ADSL customers
by Frank Coluccio 29 Nov '05

29 Nov '05

2 1

AW: BGP Security and PKI Hierarchies
by John van Oppen 29 Nov '05

29 Nov '05

While I think $1250/year for a /24 of space seems a bit high, I see no reason that legacy allocations should remain free. Perhaps $100/year (like an ASN is) would be reasonable for small legacy allocations. This is especially important for end users who have these allocations as they would most likely be free from their upstream provider. That being said, if it is larger than a few /24s I see no reason to not have the regular rates apply. If you have a /16 and can't afford the fee, you can't possibly afford to fill it with machines and should simply be allowed to swap down to a smaller allocation. Such a scheme would be in the best interest of all as it would all for some reclamation of numbering resources. Charging something also seems as though it would help with the IP hording problem that is going on with legacy allocations. It would also help to "automatically" expire allocations which are not in use as users would be less willing to pay for resources they are not using. John :) -----Ursprüngliche Nachricht----- Von: Joe Abley [mailto:jabley@isc.org] Gesendet: Tuesday, November 29, 2005 11:20 AM An: David Barak Cc: nanog(a)nanog.org Betreff: Re: BGP Security and PKI Hierarchies On 29-Nov-2005, at 12:16, David Barak wrote: > Maybe my imagination just isn't good enough: could you > toss me an example-type of organization where that > would be problematic? Oh, my mistake -- you're talking about new organisations looking to acquire PI space. I was talking about organisations who have grandfathered (and hence zero-fee) PI space. I don't have any examples of the former, and I tend to agree with your assessment for that. Joe

1 0

Outbound mail filtering on large mail / web server farms - just an idea or two that I have
by Suresh Ramasubramanian 29 Nov '05

29 Nov '05

On 11/20/05, Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > When you aggregate all .forward email out through a single box, stuff > that's slipping through your filters starts to stick out like a sore > thumb when you analyze the mail queues on that box, so you can tune > your inbound filters better. Quite a useful thing to do, really. I originally wrote this lot below as boilerplate for large webhosting providers that find themselves with several racks full of pizzabox colos running a web control panel like ensim or cpanel so that the people actually operating the colos may not have too much clue .. and these places are typically riddled with lots and lots of exploitable cgi / php scripts that are broken into and used to send spam using injection / xss etc holes .. Some of the ideas here might well apply to what I was talking about in this thread as well - the two kind of tie in together Comments welcome regards srs ------------------------------------------ First and most important thing to do - Please set your webserver up so that it uses suexec / phpsuexec to make sure perl and php scripts run as the uid/gid of the the user rather than the webserver's uid/gid like nobody or www-data. Never mind if your webhosting software like ensim or plesk inserts headers showing the spammer's uid/gid, path of the calling script etc - serves as a useful backup, and is especially useful when you are searching your logs for cgi scripts that that spammers upload onto your server and then use to proxy their spam from another server through your IP [so your IP shows up in our logs as sending spam, rather than the spammer's actual IP] I'd also strongly suggest something like this if you can manage it 1. Block port 25 outbound on all your webservers. Port 25 inbound as well if you happen to have a mailserver infrastructure for your users thats separate from the webservers they are on, rather than MX'ing your users domains onto the webserver they're hosted on. 2. Set your exim local installs to smarthost through a separate, filtered cluster of servers (spamassassin + bogofilter or something like that - possibly DCC for bulk email detection as well). Smarthosting - see http://www.hserus.net/exim.html For extra points you could do smtp auth on the filtered smarthost as well, to help you jump on issues faster. Set it up so the user's local uid/gid gets used to auth to the remote exim box .. centralized ldap or mysql userdb does the trick for that. That way spammers cant spam out direct through cgis - but peoples normal email and script generated traffic goes out just fine through your filtered gateways. -------------------------------------------

3 6

Re: BGP Security and PKI Hierarchies (was: Re: Wifi Security)
by Sandy Murphy 29 Nov '05

29 Nov '05

>the rir attests to the delegation of the prefix and an asn to the >identified isp. > >the isp signs, using their isp identity to > o originating from the asn > o originating that prefix (in sbgp, toward another isp) Looks to me like: proof of allocation: S(withRIRkey, Prefix_p_key, prefix_p) as Steve pointed out, there could be two of these, one with CA bit set for use in suballocation and one without the CA bit set for use in routing proof of identity S(withRIRkey, AS_A_key, AS_A) or S(withwebofttrustkeys, AS_A_key, AS_A) maybe Randy is saying this is two steps, not an "OR" proof of origination authorization: S(withPrefix_p_key, authr_origin_AS_#, prefix_p) proof of origination authentication: S(withAS_A_key, (AS_A,prefix_p)update) could be S(withAS_A_key, (AS_A,prefix_p)||proofoforiginationauthr) The binding between the proof of origination authorization and the proof of origination authentication is that the AS_A in the proof of identity mapping AS_A to the AS_A_key must be the same as the authr_origin_AS_# in the proof of origination authorization. [Future complication of this would have to decide what to do with ISPs that own more than one AS #. (make "authr_origin_AS_#" a list?)] --Sandy who really should be baking

3 2

IP Prefixes are allocated ..
by Glen Kent 28 Nov '05

28 Nov '05

to different Autonomous systems. Is there a central/distributed database somewhere that can tell me that this particular IP prefix (say x.y.z.w) has been given to foo AS number? I tried searching through all the WHOIS records for a domain name. I get the IP address but i dont get the AS number. Any clues on how i can get the AS number? Glen

11 15

Re: BGP Security and PKI Hierarchies
by Sandy Murphy 28 Nov '05

28 Nov '05

>Regardless of what the legacy space users think, if the >RIRs decided to sign certificates for use in BGP route >for a small fee to recover costs, and if those legacy >space holders wish to make use of this new service (like >a new version of Windows) then they have to sign up and >pay the fees. The fact that they once received a free >service does not entitle them to receive *ALL* services >for free *FOREVER*. (NOTE: I am speaking for others here, readers should be aware.) The/One difficulty is that signing up for this new service, for at least one registry, requires that you sign up for the same membership relationship as the non-legacy-holders. That means you submit to the registry authority over the address you were allocated for "free", and obligates you to paying the fee thereafter. And therefore risking having the address reclaimed if membership rules are not met. The question is whether the cert signing service is valuable enough to warrant the change in risk. If the cert signing service is put into use widely enough, then I hope people would see that as a value and buy in. (NOTE: I am not a registrar and any opinions here about registry behavior are hearsay and conclusions of the witness.) --Sandy

2 1

Re: BGP Security
by Sandy Murphy 28 Nov '05

28 Nov '05

>I am placing the module to test the >UPDATE message before the formation of Adj-RIB-out. So that the false / >malicious information wont go beyond my router >... >Would like to know ur views >about this approach. I think all the various published approaches have this goal in mind, so the approach is fine. The hard part comes in deciding how to test the UPDATE message to detect "false/malicious information". There's lots of debate about that. --Sandy

1 0

Re: BGP Security and PKI Hierarchies
by Sandy Murphy 28 Nov '05

28 Nov '05

> Do you suppose that if a Microsoft salesman had given me a free copy > of Windows back in 1990, I would have a right to use any version of > Windows for free forever? I don't think this analogy exactly fits. I'm pretty sure that the legacy space holders think of this as: a Microsoft salesman had given them a free copy of Windows back in 1990, and had returned many years later to say that MS had established a registry for all new recipients of Windows that charged a registration fee, and MS wanted them to start paying the fee for the free copy as well.

3 2