- Test - lists.nanog.org

"Cisco gate" and "Meet the Fed" at Defcon....
by Fergie (Paul Ferguson) 04 Aug '05

04 Aug '05

No one ever said the Internet wasn't chock full of contradictions. One one hand, we have what some are now calling "Cisco gate": http://news.com.com/Hackers+rally+behind+Cisco+flaw+finder/2100-1002_3-5812… ...and on the other hand, we have the DOD Cyber Crime Center folks at Defcon looking to hire people: http://news.com.com/2061-10789_3-5812102.html Wow, what a world, huh? ;-) - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

18 30

Re: Traffic to our customer's address(126.0.0.0/8) seems blocked by pa cket filter
by Fergie (Paul Ferguson) 04 Aug '05

04 Aug '05

Mea culpa: I meant "a few /16's" as opposed to "2"... No flames, it's too late... - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: Philip, This sounds very much like a bully -- 2 /16's are a major problem, as opposed to a single /8? Where is the major heartburn in this particlualr case? I could understand if here were lots of farctured annnounced space (granted: I haven't checked this yet), but what's up with that? - ferg -- Philip Smith <pfs(a)cisco.com> wrote: mkawano(a)bb.softbank.co.jp said the following on 4/8/05 12:03: FWIW, if you don't announce your aggregate, do not be surprised if you experience continued disconnectivity to many parts of the Internet. Some SPs notice that SoftbankBB have received 126/8, so will likely filter as such. Leaking sub-prefixes may be fine for traffic engineering, but this generally only works best if you include a covering aggregate. Try including your /8 announcement and see if this improves reachability for you. Out of curiosity, why pick on a /16 for traffic engineering? Most people tend to analyse traffic flows and pick the appropriate address space size as a subdivision. Or do you have 256 links to upstream ISPs and need that level of fine-tuning? best wishes, philip

1 0

Re: Traffic to our customer's address(126.0.0.0/8) seems blocked by pa cket filter
by Fergie (Paul Ferguson) 04 Aug '05

04 Aug '05

Philip, This sounds very much like a bully -- 2 /16's are a major problem, as opposed to a single /8? Where is the major heartburn in this particlualr case? I could understand if here were lots of farctured annnounced space (granted: I haven't checked this yet), but what's up with that? - ferg -- Philip Smith <pfs(a)cisco.com> wrote: mkawano(a)bb.softbank.co.jp said the following on 4/8/05 12:03: FWIW, if you don't announce your aggregate, do not be surprised if you experience continued disconnectivity to many parts of the Internet. Some SPs notice that SoftbankBB have received 126/8, so will likely filter as such. Leaking sub-prefixes may be fine for traffic engineering, but this generally only works best if you include a covering aggregate. Try including your /8 announcement and see if this improves reachability for you. Out of curiosity, why pick on a /16 for traffic engineering? Most people tend to analyse traffic flows and pick the appropriate address space size as a subdivision. Or do you have 256 links to upstream ISPs and need that level of fine-tuning? best wishes, philip

1 0

RE: Traffic to our customer's address(126.0.0.0/8) seems blocked by packet filter
by mkawano＠bb.softbank.co.jp 04 Aug '05

04 Aug '05

Hi, >Just out of curiosity... are you going to continue to announce each >individual /16 or will you consolidate to a single /8 announcement? We aren't going to consolidate to a single /8 announcement. We are going to continue to announce each individual /16 for incoming traffic engineering. Best regards & Thanks in advance, -- Makoto Kawano <mkawano(a)bb.softbank.co.jp> SOFTBANK BB Corp. Yahoo!BB Network Operation Center -----Original Message----- From: John Payne [mailto:john@sackheads.org] Sent: Thursday, August 04, 2005 4:02 AM To: 河野　誠(ネットワーク運用本部) Cc: nanog(a)merit.edu; joelja(a)darkwing.uoregon.edu Subject: Re: Traffic to our customer's address(126.0.0.0/8) seems blocked by packet filter On Aug 3, 2005, at 7:45 AM, <mkawano(a)bb.softbank.co.jp> wrote: > > Hi > > Thank you for your reply. > >> Makoto san, can you provide an ip-address within your assigned range >> that people can ping to test? > You can ping to 126.66.0.30/8. Just out of curiosity... are you going to continue to announce each individual /16 or will you consolidate to a single /8 announcement? > > regards, > -- > Makoto Kawano <mkawano(a)bb.softbank.co.jp> > SOFTBANK BB Corp. > Yahoo!BB Network Operation Center > > -----Original Message----- > From: Joel Jaeggli [mailto:joelja@darkwing.uoregon.edu] > Sent: Wednesday, August 03, 2005 8:22 PM > To: 河野　誠(ネットワーク運用本部) > Cc: nanog(a)merit.edu > Subject: Re: Traffic to our customer's address(126.0.0.0/8) seems > blocked by packet filter > > > On Wed, 3 Aug 2005, mkawano(a)bb.softbank.co.jp wrote: > >> >> Dear Network Operators and whom it may concern >> >> I hope you are doing well, We are facing a difficult problem and we >> would like to ask your assistance! > > Makoto san, can you provide an ip-address within your assigned range > that people can ping to test? > > regards > joelja > >> The following address blocks were allocated from IANA to APNIC on the >> 27th of JAN of 2005. Please refer to the following link. >> http://www.cymru.com/Documents/bogon-list.html >> --- >> Changes in version 2.6 (27 JAN 2005) >> 124/8, 125/8 and 126/8 allocated to APNIC (JAN 2005). >> Removed from the bogon lists. >> --- >> >> Softbank BB (AS17676) was allocated 126/8 from APNIC, and Softbank BB >> (AS17676) immediately tried to use 126/8. >> However Softbank BB could not access the famous site using 126/8, It >> seems some of ISPs are blocking 126/8 due to outdated filter. >> >> Ladies and gentlemen, please check the following URL! >> http://www.cymru.com/Documents/bogon-list.html >> >> and if you find out you have outdated filter, please update the >> filter immediately. >> >> Please let me know if you have any problem, concern or doubt >> regarding opening a filter for 126/8, please let me know. >> >> Best regards & Thanks in advance, >> -- >> Makoto Kawano <mkawano(a)bb.softbank.co.jp> SOFTBANK BB Corp. >> Yahoo!BB Network Operation Center >> > > -- > ----------------------------------------------------------------------- > --- > Joel Jaeggli Unix Consulting > joelja(a)darkwing.uoregon.edu > GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F > 56B2 >

2 1

RE: Traffic to our customer's address(126.0.0.0/8) seems blocked by packet filter
by mkawano＠bb.softbank.co.jp 04 Aug '05

04 Aug '05

Hi Thank you for your reply. >Makoto san, can you provide an ip-address within your assigned range that people can ping to test? You can ping to 126.66.0.30/8. regards, -- Makoto Kawano <mkawano(a)bb.softbank.co.jp> SOFTBANK BB Corp. Yahoo!BB Network Operation Center -----Original Message----- From: Joel Jaeggli [mailto:joelja@darkwing.uoregon.edu] Sent: Wednesday, August 03, 2005 8:22 PM To: 河野　誠(ネットワーク運用本部) Cc: nanog(a)merit.edu Subject: Re: Traffic to our customer's address(126.0.0.0/8) seems blocked by packet filter On Wed, 3 Aug 2005, mkawano(a)bb.softbank.co.jp wrote: > > Dear Network Operators and whom it may concern > > I hope you are doing well, We are facing a difficult problem and we > would like to ask your assistance! Makoto san, can you provide an ip-address within your assigned range that people can ping to test? regards joelja > The following address blocks were allocated from IANA to APNIC on the 27th of JAN of 2005. Please refer to the following link. > http://www.cymru.com/Documents/bogon-list.html > --- > Changes in version 2.6 (27 JAN 2005) > 124/8, 125/8 and 126/8 allocated to APNIC (JAN 2005). > Removed from the bogon lists. > --- > > Softbank BB (AS17676) was allocated 126/8 from APNIC, and Softbank BB (AS17676) immediately tried to use 126/8. > However Softbank BB could not access the famous site using 126/8, It seems some of ISPs are blocking 126/8 due to outdated filter. > > Ladies and gentlemen, please check the following URL! > http://www.cymru.com/Documents/bogon-list.html > > and if you find out you have outdated filter, please update the filter immediately. > > Please let me know if you have any problem, concern or doubt regarding opening a filter for 126/8, please let me know. > > Best regards & Thanks in advance, > -- > Makoto Kawano <mkawano(a)bb.softbank.co.jp> SOFTBANK BB Corp. > Yahoo!BB Network Operation Center > -- -------------------------------------------------------------------------- Joel Jaeggli Unix Consulting joelja(a)darkwing.uoregon.edu GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F 56B2

9 9

Re: an economics lesson for the FCC chairman Re: FCC delays meeting 't il Friday....
by Fergie (Paul Ferguson) 04 Aug '05

04 Aug '05

Gordon, You should know better -- the edge, economically, always wins. This is where the money is. And this _is_ a busines, no longer a science experiment. But this eventual discussion does not belong here... - ferg -- Gordon Cook <cook(a)cookreport.com> wrote: But John Seely Brown, ex ceo of xerox parc doesn't believe it. He and john Hagel have a new book saying that capabilities for wealth creation are found at the edge. (The title is The Only Sustainable Edge.) If these guys are right, and i think they are, then edge based community owned and operated networks are the only way forward. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: NETGEAR in the core...
by Todd Vierling 04 Aug '05

04 Aug '05

On Thu, 4 Aug 2005, Mohacsi Janos wrote: > > Correct. You can create an in-memory startup script to do tunnel > > configuration, as well, with something like this: > PPPE over IPv6 also supported? You mean that the other way round -- IPv6 over PPPoE natively, without tunnelling? I don't know if the pppoe implementation in the firmware does the necessary IPv6CP negotiation to transit IPv6 natively (as I don't have an uplink where that is possible). -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

1 0

FCC delays meeting 'til Friday....
by Fergie (Paul Ferguson) 04 Aug '05

04 Aug '05

[snip] The Federal Communications Commission delayed its monthly meeting as its chairman worked Wednesday to build support for relaxing rules governing high-speed Internet services offered by phone companies. The meeting, scheduled for Thursday, was pushed back to Friday. [snip] http://news.yahoo.com/news?tmpl=story&u=/ap/20050803/ap_on_go_ot/fcc_broadb… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Traffic to our customer's address(126.0.0.0/8) seems blocked by packet filter
by mkawano＠bb.softbank.co.jp 04 Aug '05

04 Aug '05

Dear Network Operators and whom it may concern I hope you are doing well, We are facing a difficult problem and we would like to ask your assistance! The following address blocks were allocated from IANA to APNIC on the 27th of JAN of 2005. Please refer to the following link. http://www.cymru.com/Documents/bogon-list.html --- Changes in version 2.6 (27 JAN 2005) 124/8, 125/8 and 126/8 allocated to APNIC (JAN 2005). Removed from the bogon lists. --- Softbank BB (AS17676) was allocated 126/8 from APNIC, and Softbank BB (AS17676) immediately tried to use 126/8. However Softbank BB could not access the famous site using 126/8, It seems some of ISPs are blocking 126/8 due to outdated filter. Ladies and gentlemen, please check the following URL! http://www.cymru.com/Documents/bogon-list.html and if you find out you have outdated filter, please update the filter immediately. Please let me know if you have any problem, concern or doubt regarding opening a filter for 126/8, please let me know. Best regards & Thanks in advance, -- Makoto Kawano <mkawano(a)bb.softbank.co.jp> SOFTBANK BB Corp. Yahoo!BB Network Operation Center

6 5

DDoS attacks, spoofed source addresses and adjusted TTLs
by Mike Tancsa 03 Aug '05

03 Aug '05

I had a DDoS this morning (~ 130Mb) against one of my hosts. Packets were coming in all 3 of my transit links from a handful of source IP addresses that sort of make sense in terms of the path they would take to get to me. They were all large UDP packets of the form 09:08:58.981781 xx:xx:xx:xx:xx:xx yy:yy:yy:yy:yy:yy 0800 1514: 82.165.244.204 > ta.rg.et.IP: udp (frag 47080:1480@1480+) (ttl 54, len 1 500) 0x0010 yyyy yyyy 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBB 0x0020 4242 4242 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBBBBBB 0x0030 4242 4242 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBBBBBB 0x0040 4242 4242 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBBBBBB 0x0050 4242 4242 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBBBBBB 0x0060 4242 4242 4242 4242 4242 4242 4242 4242 BBBBBBBBBBBBBBBB The TTLs all kind of make sense and are consistent (e.g. if the host is 8 hops away, the TTL of the packet when it got to me was 56). Yes, I know those could be adjusted in theory to mask multiple sources, but in practice has anyone seen that ? I seem to recall reading the majority of DDoS attacks do not come from spoofed source IP addresses. Of the traffic snapshot I took, the break down seems to jive as well with the PTR records. i.e. PTR records that indicate a home broadband connection were less than PTR records suggesting a server in a datacentre somewhere. A few of the IPs involved capturing 1000 packets on one of my links at the time. 210 207.58.177.151 - server.creditprofits.com 287 65.39.230.20 - server4.xlservers.com 11 67.52.82.118 - rrcs-67-52-82-118.west.biz.rr.com 492 82.165.244.204 - u15178515.onlinehome-server.com It was pretty short lived as well -- about 8 min total. ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

2 3