- Test - lists.nanog.org

Two computers stolen with Motorola staff data
by Fergie (Paul Ferguson) 10 Jun '05

10 Jun '05

Hello, Motorola employees: http://www.reuters.com/newsArticle.jhtml?type=technologyNews&storyID=8759801 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Weekly Routing Table Report
by Routing Table Analysis 10 Jun '05

10 Jun '05

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 11 Jun, 2005 Analysis Summary ---------------- BGP routing table entries examined: 164762 Prefixes after maximum aggregation: 95367 Unique aggregates announced to Internet: 79285 Total ASes present in the Internet Routing Table: 19838 Origin-only ASes present in the Internet Routing Table: 17272 Origin ASes announcing only one prefix: 8102 Transit ASes present in the Internet Routing Table: 2566 Transit-only ASes present in the Internet Routing Table: 71 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 23 Prefixes from unregistered ASNs in the Routing Table: 19 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 15 Number of addresses announced to Internet: 1414830208 Equivalent to 84 /8s, 84 /16s and 152 /24s Percentage of available address space announced: 38.2 Percentage of allocated address space announced: 59.9 Percentage of available address space allocated: 63.7 Total number of prefixes smaller than registry allocations: 77669 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 34090 Total APNIC prefixes after maximum aggregation: 15849 Prefixes being announced from the APNIC address blocks: 31999 Unique aggregates announced from the APNIC address blocks: 15942 APNIC Region origin ASes present in the Internet Routing Table: 2293 APNIC Region origin ASes announcing only one prefix: 673 APNIC Region transit ASes present in the Internet Routing Table: 345 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 19 Number of APNIC addresses announced to Internet: 186651264 Equivalent to 11 /8s, 32 /16s and 18 /24s Percentage of available APNIC address space announced: 69.3 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 124/7, 126/8, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 88735 Total ARIN prefixes after maximum aggregation: 54041 Prefixes being announced from the ARIN address blocks: 69253 Unique aggregates announced from the ARIN address blocks: 25366 ARIN Region origin ASes present in the Internet Routing Table: 9992 ARIN Region origin ASes announcing only one prefix: 3658 ARIN Region transit ASes present in the Internet Routing Table: 940 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 18 Number of ARIN addresses announced to Internet: 249387008 Equivalent to 14 /8s, 221 /16s and 88 /24s Percentage of available ARIN address space announced: 70.8 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 31316 Total RIPE prefixes after maximum aggregation: 21599 Prefixes being announced from the RIPE address blocks: 28381 Unique aggregates announced from the RIPE address blocks: 19084 RIPE Region origin ASes present in the Internet Routing Table: 6737 RIPE Region origin ASes announcing only one prefix: 3543 RIPE Region transit ASes present in the Internet Routing Table: 1115 Average RIPE Region AS path length visible: 5.2 Max RIPE Region AS path length visible: 23 Number of RIPE addresses announced to Internet: 208011456 Equivalent to 12 /8s, 102 /16s and 0 /24s Percentage of available RIPE address space announced: 72.9 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 8935 Total LACNIC prefixes after maximum aggregation: 3106 Prefixes being announced from the LACNIC address blocks: 7326 Unique aggregates announced from the LACNIC address blocks: 4255 LACNIC Region origin ASes present in the Internet Routing Table: 623 LACNIC Region origin ASes announcing only one prefix: 192 LACNIC Region transit ASes present in the Internet Routing Table: 115 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 21 Number of LACNIC addresses announced to Internet: 19134496 Equivalent to 1 /8s, 35 /16s and 248 /24s Percentage of available LACNIC address space announced: 57.0 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 1661 Total AfriNIC prefixes after maximum aggregation: 772 Prefixes being announced from the AfriNIC address blocks: 1013 Unique aggregates announced from the AfriNIC address blocks: 779 AfriNIC Region origin ASes present in the Internet Routing Table: 128 AfriNIC Region origin ASes announcing only one prefix: 36 AfriNIC Region transit ASes present in the Internet Routing Table: 17 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2289664 Equivalent to 0 /8s, 34 /16s and 240 /24s Percentage of available AfriNIC address space announced: 6.8 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 913 5150 192 CHINANET-BACKBONE 9583 755 55 63 Sify Limited 1221 754 1453 540 Telstra Pty Ltd 4755 604 246 122 Videsh Sanchar Nigam Ltd. Aut 4766 595 3412 278 Korea Telecom (KIX) 7545 501 104 71 TPG Internet Pty Ltd 17676 436 6589 75 Softbank BB Corp. 9443 374 77 76 Primus Telecommunications 9929 364 221 48 China Netcom Corp. 10036 340 56 306 C&M Communication Co. Ltd. 2907 338 1805 315 SINET Japan 9498 321 83 62 BHARTI BT INTERNET LTD. 17557 317 22 152 Pakistan Telecom 7474 312 271 216 SingTel Optus Pty Ltd 4808 310 250 172 CNCGROUP IP network: China169 4802 279 47 159 Wantree Development 18302 269 108 146 SK Global co., Ltd 17974 264 65 14 PT TELEKOMUNIKASI INDONESIA 703 253 276 207 UUNET - Commercial IP service 2764 253 238 199 AAPT Limited ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1497 6460 973 AT&T WorldNet Services 174 1249 5615 1071 Cogent Communications 4323 1118 647 217 Time Warner Telecom 721 1111 21787 313 DLA Systems Automation Center 701 1018 8171 855 UUNET Technologies, Inc. 6197 920 498 438 BellSouth Network Solutions, 1239 896 2873 648 Sprint 2386 858 533 639 AT&T Data Communications Serv 18566 817 224 7 Covad Communications 209 630 3505 496 Qwest 20115 616 492 311 Charter Communications 3356 567 10824 434 Level 3 Communications, LLC 27364 565 43 18 Armstrong Cable Services 3602 543 123 100 Sprint Canada, Inc. 3561 533 2384 421 Savvis 852 526 1094 389 Telus Advanced Communications 22773 490 1188 23 Cox Communications, Inc. 5668 488 115 25 CenturyTel Internet Holdings, 7725 484 60 15 MediaOne 6198 466 386 221 BellSouth Network Solutions, RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 594 1999 487 UUNET - Commercial IP service 3320 305 3232 241 Deutsche Telekom AG 3301 296 1081 284 TeliaNet Sweden 8220 269 469 265 COLT Telecommunications 680 252 2041 238 DFN-IP service G-WiN 8708 232 254 215 Romania Data Systems S.A. 3246 225 489 220 Song Networks 1257 198 712 174 SWIPnet Swedish IP Network 5515 179 778 129 Sonera Solution Autonomous Sy 786 176 1794 176 The JANET IP Service 719 168 340 101 LANLINK autonomous system 6746 168 47 146 Dynamic Network Technologies, 3269 166 1496 69 TELECOM ITALIA 5400 163 285 137 BT Ignite European Backbone 8866 158 21 11 Bulgarian Telecommunication C 3300 154 184 86 AUCS Communications Services 6830 138 529 28 UPC Distribution Services 3352 131 1240 33 Ibernet, Internet Access Netw 9051 131 8 33 INCONET Autonomous System 9121 131 269 41 TTnet Autonomous System LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 380 600 149 UniNet S.A. de C.V. 16814 264 16 12 NSS, S.A. 11172 221 98 53 Servicios Alestra S.A de C.V 6147 197 110 21 Telefonica Del Peru 11664 197 19 23 Keytech SA 14117 152 9 5 Telefonica del Sur S.A. 7303 150 69 19 Telecom Argentina Stet-France 6505 134 90 90 Global One Communicaoes Ltda 22047 131 96 6 VTR PUNTO NET S.A. 11556 129 64 2 Cable-Wireless Panama 13999 113 52 9 Mega Cable S.A. de C.V. 19632 108 14 5 Metropolis Intercom S.A. 18822 107 7 13 TELEFONICA MANQUEHUE 6503 106 146 72 AVANTEL, S.A. 19169 105 7 20 Telconet 10481 101 40 7 Prima S.A. 22927 97 73 25 TELEFONICA DE ARGENTINA 21826 95 13 20 INTERCABLE 23216 95 24 23 RAMtelecom Telecomunicaciones 5639 94 12 9 Telecommunications Services o AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 266 637 223 The Internet Solution 5536 119 15 17 Internet Egypt Network 20928 94 16 2 Noor Advanced Technologies AS 2018 91 295 86 Tertiary Education Network 8452 82 28 6 TEDATA 2905 74 266 66 The Internetworking Company o 24835 64 34 6 RAYA Telecom - Egypt 6713 59 54 8 Itissalat Al-MAGHRIB 9129 45 3 3 UUNET Kenya 12455 40 6 3 Jambonet Autonomous system 5713 36 142 29 Telkom SA Ltd 15475 32 84 4 Nile Online 15706 31 8 3 Sudatel Internet Exchange Aut 8524 25 1 4 AUCEGYPT Autonomous System 16637 22 10 19 Johnnic e-Ventures 33765 20 3 8 TANZANIA TELECOMMUNICATIONS C 10798 19 1 11 Standard Bank of South Africa 23889 19 5 8 MAURITIUS TELECOM 21491 18 1 2 UTL On-line is RF broadband I 7460 17 3 5 LIA Internet Access Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1118 901 Time Warner Telecom 18566 817 810 Covad Communications 721 1111 798 DLA Systems Automation Center 4134 913 721 CHINANET-BACKBONE 9583 755 692 Sify Limited 27364 565 547 Armstrong Cable Services 6197 920 482 BellSouth Network Solutions, 4755 604 482 Videsh Sanchar Nigam Ltd. Aut 7725 484 469 MediaOne 22773 490 467 Cox Communications, Inc. 5668 488 463 CenturyTel Internet Holdings, 3602 543 443 Sprint Canada, Inc. 7545 501 430 TPG Internet Pty Ltd 6467 423 389 E.Spire Communications, Inc. 17676 436 361 Softbank BB Corp. 6140 402 322 ImpSat 4766 595 317 Korea Telecom (KIX) 9929 364 316 China Netcom Corp. 20115 616 305 Charter Communications 9443 374 298 Primus Telecommunications List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 64512 PRIVATE 61.17.25.0/24 4755 Videsh Sanchar Nigam 65009 PRIVATE 69.39.0.0/20 21803 1st Class Internet S 65050 PRIVATE 168.96.148.0/24 6140 ImpSat 65004 PRIVATE 200.0.113.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.0.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.1.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.2.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.3.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.4.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.5.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.6.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.7.0/24 28477 Universidad Autonoma 64512 PRIVATE 200.61.32.0/23 11664 Keytech SA 64512 PRIVATE 200.61.62.0/23 11664 Keytech SA 64512 PRIVATE 200.80.154.0/23 11664 Keytech SA 65005 PRIVATE 203.200.197.0/24 4755 Videsh Sanchar Nigam 65444 PRIVATE 212.25.125.0/24 8551 Bezeq International 65529 PRIVATE 216.21.199.0/24 14697 VDot.Net 65529 PRIVATE 216.152.237.0/24 14697 VDot.Net Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 50.160.0.0/13 1221 Telstra Pty Ltd 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.32.0.0/24 7011 Citizens Utilities 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.169.0.0/23 3970 RGnet, Inc. 192.172.0.0/19 721 DLA Systems Automation Center 192.200.100.0/24 7018 AT&T WorldNet Services Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:8 /11:15 /12:71 /13:158 /14:308 /15:604 /16:8425 /17:2573 /18:4422 /19:10393 /20:11274 /21:9231 /22:12701 /23:13760 /24:89872 /25:331 /26:270 /27:147 /28:45 /29:29 /30:70 /31:0 /32:33 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 801 817 Covad Communications 6197 751 920 BellSouth Network Solutions, 7018 689 1497 AT&T WorldNet Services 2386 608 858 AT&T Data Communications Serv 9583 572 755 Sify Limited 27364 556 565 Armstrong Cable Services 4323 537 1118 Time Warner Telecom 7725 455 484 MediaOne 4766 413 595 Korea Telecom (KIX) 5668 402 488 CenturyTel Internet Holdings, 1239 380 896 Sprint 702 367 594 UUNET - Commercial IP service 6198 341 466 BellSouth Network Solutions, 10036 332 340 C&M Communication Co. Ltd. 7011 304 354 Citizens Utilities 6467 297 423 E.Spire Communications, Inc. 9929 283 364 China Netcom Corp. 15270 278 299 PaeTec.net -a division of Pae 6517 274 296 Yipes Communications, Inc. 11456 271 310 Carolina Online, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:15 12:1552 13:1 15:9 16:2 17:3 18:3 20:4 24:1166 30:2 32:69 33:4 38:126 40:53 44:3 47:2 52:4 55:2 56:3 57:24 58:90 59:44 60:55 61:809 62:603 63:1891 64:2744 65:2070 66:2877 67:581 68:525 69:1032 70:114 71:9 72:223 80:586 81:554 82:415 83:268 84:200 85:250 86:20 128:191 129:172 130:88 131:296 132:37 133:1 134:151 135:40 136:134 137:69 138:167 139:61 140:194 141:102 142:148 143:137 144:188 145:33 146:287 147:108 148:300 149:172 150:105 151:65 152:106 153:86 154:5 155:142 156:78 157:99 158:160 159:171 160:76 161:67 162:323 163:91 164:210 165:178 166:160 167:235 168:426 169:142 170:309 171:8 172:1 192:5720 193:3179 194:2418 195:1552 196:662 198:3930 199:3290 200:3988 201:156 202:5791 203:6332 204:3770 205:2018 206:2509 207:2828 208:2049 209:3315 210:1712 211:856 212:1214 213:1320 214:263 215:31 216:3455 217:1148 218:207 219:108 220:387 221:228 222:107 End of report

1 0

Using snort to detect if your users are doing interesting things?
by Drew Weaver 10 Jun '05

10 Jun '05

Howdy, I am not sure if this is the proper place, if not I've noticed you guys know what to do so I'll put the fire retardant suit on now. Recently due to growth we have seen an influx of "different" and "interesting" types of characters ending up on our network. They like to do all sorts of things, port scan /8s spam, setup botnets with the controllers hosted on my network.. etc. I'm wondering what is the best way to detect people doing these things on my end. I realize there are methods to protect myself from people attacking from the outside but I'm not real sure how to pinpoint who is really being loud on the inside. I did have one somewhat silly question.. if you look at the statistics of a Fast Ethernet port, and it is doing both 2000 pps out, and 2000 pps in (pretty much equal in/out) but hardly any bandwidth at all can anyone think of a single application that would mimic that behavior? Sorry if this is elementary network school knowledge. -Drew

11 11

New block of AS Numbers to APNIC (37888-38911)
by Doug Barton 10 Jun '05

10 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, This is to inform you that the IANA has allocated the following block of AS Numbers to APNIC: 37888-38911 For a full list of IANA AS Number allocations please see <http://www.iana.org/assignments/as-numbers> - -- Doug Barton General Manager, The Internet Assigned Numbers Authority -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (MingW32) iD8DBQFCqNmowtDPyTesBYwRAq87AJ9vZylxVXcni50h2sKEebZLDpa1jQCcDU4a Uiryl1vEehaC/xj6rby0te0= =Q3MX -----END PGP SIGNATURE-----

1 0

Re: Outage queries and notices (was Re: GBLX congestion in Dallas area )
by Jay R. Ashworth 09 Jun '05

09 Jun '05

On Wed, Jun 08, 2005 at 07:11:21PM -0400, David Andersen wrote: > On Jun 8, 2005, at 4:46 PM, Jay R. Ashworth wrote: > > On Wed, Jun 08, 2005 at 06:30:50PM +0000, Fergie (Paul Ferguson) wrote: > >> What's the matter with simply using the mailing list? > >> Don't reinvent the wheel. > > > > For precisely that reason, I, personally, am on your side. > > It's not the *best* solution, but it's probably the least worst. > > As a comment from the research side - I know several people who've > ended up combing the NANOG mailing list archives for outage reports of > various sorts (myself included). Perhaps a great middle step on this > if people were to agree on a quasi-maybe-slightly-standard format for > reporting outages to the mailing list, so that the statistics gathering > types can mine through and get at the data. > > I'm not suggesting that all mail to nanog be XML-encoded goop, but some > loose text convention might help move things along nicely. Over time, > I suspect that a general consensus style would emerge. Probably RFC-822 style headers between ==BEGIN OUTAGE== and ==END OUTAGE== or something akin to that. It remains easy to parse, especially by the most likely subect, perl. A subject-line tag is probably not out of the question, either. But, of course, we're figuring out the best way to implement something that we haven't completely decided is the best idea. :-) Cheers, -- jra -- Jay R. Ashworth jra(a)baylink.com Designer +-Internetworking------+----------+ RFC 2100 Ashworth & Associates | Best Practices Wiki | | '87 e24 St Petersburg FL USA http://bestpractices.wikicities.com +1 727 647 1274 If you can read this... thank a system administrator. Or two. --me

1 0

Re: Active BGP Probing and large AS-sets
by Lorenzo Colitti 09 Jun '05

09 Jun '05

Hannigan, Martin wrote: > Yes, but last time you said you were going to use > _other peoples_ ASN's to test with and allow these > announcements beyond your borders. > > Is this still the case? The probing AS (call it Z) announces one of its prefixes to the Internet with an AS-path that is not just Z but Z {a,b,c...}, where a,b,c,... are the numbers of other ASes in the Internet. For the technique to be useful, the numbers in the set must belong to ASes that actually receive Z's announcements. These ASes will not use or propagate the route, effectively "disappearing" from the Internet as far as the prefix is concerned. This causes alternate and backup paths, not normally visible, to become active for that prefix. By looking at RIS and RV and the looking glasses of other ASes, Z can then see who propagates the prefix, where its announcements go, if other ASes have particular preferences for particular paths to it, and so on. Apart from the different AS-path, the prefix is announced in the same way as all the other prefixes belonging to Z. So yes, the ASes inserted in the AS-set are operated by others, and yes, the announcements are sent out to the Internet at large. Regards, Lorenzo -- lorenzo(a)ripe.net colitti(a)dia.uniroma3.it www.ripe.net www.dia.uniroma3.it/~compunet RIPE NCC Roma Tre Computer Networks research group

4 4

Active BGP Probing and large AS-sets
by Lorenzo Colitti 09 Jun '05

09 Jun '05

Hi, our announcement on nanog a few months ago of experiments involving BGP updates containing large AS-sets [1] caused a few flames. Now we have an in-depth document with results on the subject and would like to explain what we intended to do. We have presented our techniques at RIPE 50, and there is a Web page on the project, with links to the full report and the slides, up at: http://www.dia.uniroma3.it/~compunet/bgp-probing/ What follows is a brief summary of what we do, why we believe it is safe, and why it shouldn't cause problems to current operational practices. For more details, see the presentation and the report. We will be happy to answer any further questions you might have. Regards, Lorenzo Colitti --- Active BGP Probing ================== What we do ---------- Existing topology discovery techniques are good at discovering topology but bad at discovering policy. However, to predict the effect of network faults, perform effective traffic engineering, develop peering strategies, and evaluate the quality of upstreams, it would be useful for ISPs to to know how their announcements can be propagated and how the policies of other ASes in the Internet affect their prefixes. No operational tools exist to do this. The principle is the following: an AS using our probing techniques can announce one of its prefixes with AS-paths including the numbers of other ASes. Due to loop detection, these "prohibited" ASes will not use or propagate the announcement. To avoid influencing AS-path length, the prohibited ASes are placed in an AS-set at the end of the path. Thus, to stop its announcement from being propagated by ASes 1, 2, and 3, an AS (say AS12654) might announce one of its prefixes with an AS-path of 12654 {1,2,3}. This allows AS 12654 to discover who propagates its announcements, find backup paths, and deduce the policies of other ASes with respect to its prefixes. To collect data it is possible to the RIS or ORV route collectors. However, since our methods operate in steady state, the results are visible from any looking glass on the Internet. Why it is safe -------------- We are confident that such announcements are safe, provided that the length of the AS-set announced is limited. We say this based on: 1. Equipment tests. Juniper routers seem to have no problems with long AS-paths, while Cisco routers reset the BGP session when the AS-path more than 512 bytes long (about 254 ASes). Cisco is aware of this issue and is in the process of fixing it; in any case, our techniques limit the length of the AS-sets announced to a suitable number to account for propagation (obviously, much smaller than 254). 2. IPv6 tests. We started testing our techniques on the IPv6 backbone in November. No problems were reported. The first report (of only two) we got of someone even noticing the unusually long paths arrived at the end of February. 3. Observation. Longer AS-sets (123 [2] and 124 [3] elements) and longer AS-paths have been observed in the wild with no ill effects that we know of -- at least, we know of no operators who reported problems. Why it doesn't impact routers ----------------------------- Route flap dampening limits our probing to the order of one update per hour. This is negligible compared to the over 15,000 updates/hour a typical Tier-1 router might receive. As regards impact on memory, the amount of RAM to store a 100-element AS-set for one prefix is of the order of hundreds of bytes, which is irrelevant for core routers which are already using tens of megabytes of memory for BGP. Why it doesn't hamper debugging ------------------------------- Prepending other AS numbers is to a certain extent already done today. Our techniques are similar, but foreign ASes are only in the AS-set at the end of the path, so it's immediately obvious which path the announcement has taken. Due to the size of the AS-set, we doubt that anyone seeing such an announcement would believe it was due to one of the ASes in the set, but would probably look at the first AS before the set. Furthermore, the prefix immediately identifies the source of the announcements. Finally, the routes can also be tagged with communities to help identify them. [1] http://www.merit.edu/mail.archives/nanog/2005-03/msg00029.html [2] http://www.ripe.net/projects/ris/Talks/0101_RIPE38_AA/sld003.html [3] http://www.ripe.net/maillists/ncc-archives/ris-users/2002/msg00044.html -- RIPE NCC Roma Tre Computer Networks research group www.ripe.net www.dia.uniroma3.it/~compunet lorenzo(a)ripe.net colitti(a)dia.uniroma3.it

2 2

RE: GBLX congestion in Dallas area
by Joel Perez 09 Jun '05

09 Jun '05

I totally agree with you Richard. But, in this case all im getting is the run-around from GBLX when calling them about it. I managed to open up a trouble ticket with them but their Techs weren't telling me anything other than they will look into it and call me back. Even though I am a customer, im not getting any answers so I tried the list as a last ditch effort to get some info. -------------------------------------------- Joel Perez | Network Engineer 305.914.3412 | Ntera -------------------------------------------- -----Original Message----- From: Richard A Steenbergen [mailto:ras@e-gerbil.net] Sent: Tuesday, June 07, 2005 12:28 PM To: Joel Perez Cc: nanog(a)merit.edu Subject: Re: GBLX congestion in Dallas area On Tue, Jun 07, 2005 at 12:09:26PM -0400, Joel Perez wrote: > > Is anybody seeing any congestion in the Dallas area for Global Crossing? > > I'm seeing packet loss to some of my equipment up there. There is a large fiber cut in the area (somewhere between Dallas and Houston), affecting a lot of capacity coming out of Dallas on several carriers (including GX and Qwest at the very least). Two of our OC48s on this path have been down since around 14:57 UTC. That said, this isn't the proper place to whine about congestion. Normally I would say that is what customer support numbers are for, but since there is nothing they can do to splice it any faster, I'm going to recommend a healthy dose of suck it up and deal. :) -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

12 14

Fwd: ICANN Board Designates VeriSign ...
by Eric Brunner-Williams in Portland Maine 09 Jun '05

09 Jun '05

ICANN's announcement is at: http://www.icann.org/announcements/announcement-08jun05.htm See also: http://icann.org/tlds/dotnet-reassignment/net-rfp-process-summary-08jun05.p… And so much for that. Eric

1 0

Re: Micorsoft's Sender ID Authentication......?
by Anne P. Mitchell, Esq. 09 Jun '05

09 Jun '05

> Wasn't there a lot of turmoil within the IETF last year > on sender authentication because Microsoft was trying to > push it's own sender ID authetication mechasnisms as a > draft standard? In part the problem was 'legal' (versus technical)...the folks involved in the working list from MS...technical people, offered ongoing reassurance that the as-yet-unpublished patent apps were benign, that it would always be available free, etc. etc... but once the patent apps were published, they were far over-reaching, included SPF aspects, etc.. (I have _zero_ doubt that the legal/corporate folks upstairs at MS were responsible for that, and that the good folks from MS on the working list were as surprised as were the rest of us). Anne Anne P. Mitchell, Esq. President/CEO Institute for Spam and Internet Public Policy IADB Email Sender Accreditation Database: http://www.isipp.com/iadb.php Professor of Law, Lincoln Law School of SJ Advisor, Kinar Secure Email Advisor, Relemail Email Privacy Certification Advisor, Virus Bulletin Asilomar Microcomputer Workshop Planning Committee

2 1