- Test - lists.nanog.org

Anyone from Xeex?
by Drew Weaver 03 Jun '05

03 Jun '05

Hit me offlist if you're monitoring. Thanks, -Drew

1 0

HUMOR: ICANN Announces ".polinc" TLD for politically incorrect and dangerous-opinion sites
by william(at)elan.net 03 Jun '05

03 Jun '05

---------- Forwarded message ---------- Date: Fri, 3 Jun 2005 14:48:12 -0400 From: David Farber <dave(a)farber.net> To: Ip ip <ip(a)v2.listbox.com> Subject: [IP] ICANN Announces ".polinc" TLD for politically incorrect and dangerous-opinion sites Begin forwarded message: From: Brad Templeton <btm(a)templetons.com> Date: June 3, 2005 2:43:04 PM EDT To: David Farber <dave(a)farber.net> Subject: ICANN Announces ".polinc" TLD for politically incorrect and dangerous-opinion sites (For those wishing to add comments, this post can also be found at my blog:) http://ideas.4brad.com/node/221 ICANN Announces ".polinc" TLD for politically incorrect and dangerous-opinion sites ICANN is pleased to announce that the independent evaluation process, which began last year, has resulted in a further sponsored Top Level Domain (sTLD) application moving to the next stage. As the process for selecting new sponsored Top Level Domain (sTLDs) continues from a pool of ten applications, ICANN has now entered into commercial and technical negotiations with an additional candidate registry, ICM Registry, Inc, (.POLINC). The .POLINC top level domain will be a voluntary arena for sites that wish to express ideas that are politically incorrect or inflammatory. Sites that promote ideas including racism, homosexual advocacy, embryonic stem cell harvesting, creationism, evolutionism, opposition to the war in Iraq, defence of the liberation of Iraq and other topics that are inflammatory can voluntarily register in the .POLINC domain to make it clear what sort of material can be found on the site. Were not trying to suprise anybody with the fact that our sites have unpopular an inflammatory opinions on them, said Brad Templeton, Chairman of the www.eff.org web site notorious for its opposition to the surveillance tools the Justice Dept. says are needed for the War on Domestic Terror. Templeton also operates the www.netfunny.com site, which contains jokes, some of which lampoon stereotypes of all manners. By giving us our own domain, people will know exactly what they are getting. Our views are for adults. Were not trying to push them on kids. Operators of .POLINC domains believe that by using this domain, they will have an answer to any user who complains about finding their material on the internet, in particular parents who dont want their children exposed to highly radical views. Internet filtering software, commonly sold to parents, schools and libraries, will be able to easily and reliably block access to .POLINC sites by children and library patrons. Use of .POLINC is entirely voluntary, says Stuart Lawley, chairman of ICM Registry, which will operate the domain. Sites with inflammatory opinions now have the opportunity to self-organize and self-regulate on a voluntary basis. Over 20% of new internet sites, known as blogs, contain dangerous and inflammatory opinions, with the number increasing every day. ICM outlined the following benefits of the .POLINC TLD on their release: * Online child safety and anti-child mind pollution will be promoted through best practice guidelines promulgated by a non-profit cross-sector foundation. This foundation will provide assistance through various online support organizations and the sponsoring of technology tools and education programs for parents. * The online radical blog industry wants to create an identifiable space with which its members can elect to associate themselves and wherein they can responsibly self-organize and create guidelines to promote credible self-regulation. * The voluntary .POLINC TLD will maximize and protect free speech both for content providers and Internet users. * Privacy protection and security will be promoted for online consumers. * The .POLINC TLD has potential to regularize business processes such as search-engine functionality, privacy, identity theft prevention measures, and security. * It creates a credible forum for representation and self-regulation where all stakeholders are able to discuss and actively respond to concerns about online inflammatory opinion. Registrations in .POLINC will be available for just $99.95 per year. ------------------------------------- You are subscribed as william(a)elan.net To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/

2 1

Weekly Routing Table Report
by Routing Table Analysis 03 Jun '05

03 Jun '05

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 04 Jun, 2005 Analysis Summary ---------------- BGP routing table entries examined: 163814 Prefixes after maximum aggregation: 94933 Unique aggregates announced to Internet: 78989 Total ASes present in the Internet Routing Table: 19783 Origin-only ASes present in the Internet Routing Table: 17224 Origin ASes announcing only one prefix: 8080 Transit ASes present in the Internet Routing Table: 2559 Transit-only ASes present in the Internet Routing Table: 73 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 26 Prefixes from unregistered ASNs in the Routing Table: 18 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 14 Number of addresses announced to Internet: 1414258528 Equivalent to 84 /8s, 75 /16s and 223 /24s Percentage of available address space announced: 38.2 Percentage of allocated address space announced: 59.9 Percentage of available address space allocated: 63.7 Total number of prefixes smaller than registry allocations: 77173 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 33699 Total APNIC prefixes after maximum aggregation: 15728 Prefixes being announced from the APNIC address blocks: 31597 Unique aggregates announced from the APNIC address blocks: 15795 APNIC Region origin ASes present in the Internet Routing Table: 2284 APNIC Region origin ASes announcing only one prefix: 668 APNIC Region transit ASes present in the Internet Routing Table: 348 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 19 Number of APNIC addresses announced to Internet: 186078080 Equivalent to 11 /8s, 23 /16s and 83 /24s Percentage of available APNIC address space announced: 69.0 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575 APNIC Address Blocks 58/7, 60/7, 124/7, 126/8, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 88409 Total ARIN prefixes after maximum aggregation: 53883 Prefixes being announced from the ARIN address blocks: 69080 Unique aggregates announced from the ARIN address blocks: 25401 ARIN Region origin ASes present in the Internet Routing Table: 9978 ARIN Region origin ASes announcing only one prefix: 3655 ARIN Region transit ASes present in the Internet Routing Table: 941 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 18 Number of ARIN addresses announced to Internet: 249193216 Equivalent to 14 /8s, 218 /16s and 99 /24s Percentage of available ARIN address space announced: 70.7 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 31152 Total RIPE prefixes after maximum aggregation: 21491 Prefixes being announced from the RIPE address blocks: 28231 Unique aggregates announced from the RIPE address blocks: 18967 RIPE Region origin ASes present in the Internet Routing Table: 6708 RIPE Region origin ASes announcing only one prefix: 3530 RIPE Region transit ASes present in the Internet Routing Table: 1103 Average RIPE Region AS path length visible: 5.2 Max RIPE Region AS path length visible: 26 Number of RIPE addresses announced to Internet: 207269312 Equivalent to 12 /8s, 90 /16s and 173 /24s Percentage of available RIPE address space announced: 72.7 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 8871 Total LACNIC prefixes after maximum aggregation: 3068 Prefixes being announced from the LACNIC address blocks: 7267 Unique aggregates announced from the LACNIC address blocks: 4207 LACNIC Region origin ASes present in the Internet Routing Table: 620 LACNIC Region origin ASes announcing only one prefix: 192 LACNIC Region transit ASes present in the Internet Routing Table: 118 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 21 Number of LACNIC addresses announced to Internet: 19063584 Equivalent to 1 /8s, 34 /16s and 227 /24s Percentage of available LACNIC address space announced: 56.8 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 1659 Total AfriNIC prefixes after maximum aggregation: 763 Prefixes being announced from the AfriNIC address blocks: 1004 Unique aggregates announced from the AfriNIC address blocks: 777 AfriNIC Region origin ASes present in the Internet Routing Table: 126 AfriNIC Region origin ASes announcing only one prefix: 35 AfriNIC Region transit ASes present in the Internet Routing Table: 16 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2280192 Equivalent to 0 /8s, 34 /16s and 203 /24s Percentage of available AfriNIC address space announced: 6.8 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 910 5146 190 CHINANET-BACKBONE 1221 753 1438 542 Telstra Pty Ltd 9583 751 55 61 Sify Limited 4755 608 246 123 Videsh Sanchar Nigam Ltd. Aut 4766 595 3413 279 Korea Telecom (KIX) 7545 501 88 72 TPG Internet Pty Ltd 17676 436 6589 75 Softbank BB Corp. 9443 370 77 76 Primus Telecommunications 9929 364 221 48 China Netcom Corp. 2907 338 1805 315 SINET Japan 10036 322 29 290 C&M Communication Co. Ltd. 17557 314 22 151 Pakistan Telecom 7474 310 271 213 SingTel Optus Pty Ltd 4808 308 250 169 CNCGROUP IP network: China169 9498 306 83 61 BHARTI BT INTERNET LTD. 4802 286 48 163 Wantree Development 17974 265 65 14 PT TELEKOMUNIKASI INDONESIA 18302 264 108 148 SK Global co., Ltd 17488 256 16 7 Hathway IP Over Cable Interne 2764 254 238 199 AAPT Limited ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1488 6459 967 AT&T WorldNet Services 174 1196 5611 1025 Cogent Communications 4323 1123 647 217 Time Warner Telecom 721 1109 21787 313 DLA Systems Automation Center 701 1016 8186 855 UUNET Technologies, Inc. 6197 918 498 436 BellSouth Network Solutions, 1239 890 2869 645 Sprint 2386 856 532 636 AT&T Data Communications Serv 18566 814 224 7 Covad Communications 209 653 3505 496 Qwest 20115 615 507 314 Charter Communications 3356 572 10842 437 Level 3 Communications, LLC 27364 564 43 18 Armstrong Cable Services 3561 533 2384 419 Savvis 852 528 1095 390 Telus Advanced Communications 3602 527 123 101 Sprint Canada, Inc. 5668 489 115 25 CenturyTel Internet Holdings, 22773 488 1188 23 Cox Communications, Inc. 7725 482 60 15 MediaOne 6198 465 386 220 BellSouth Network Solutions, RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 594 2001 486 UUNET - Commercial IP service 3320 304 3232 241 Deutsche Telekom AG 3301 297 1085 285 TeliaNet Sweden 8220 273 469 267 COLT Telecommunications 680 252 2041 238 DFN-IP service G-WiN 8708 230 254 214 Romania Data Systems S.A. 3246 228 490 223 Song Networks 1257 198 712 174 SWIPnet Swedish IP Network 5515 178 778 128 Sonera Solution Autonomous Sy 786 176 1794 176 The JANET IP Service 719 170 340 102 LANLINK autonomous system 6746 167 47 146 Dynamic Network Technologies, 3269 166 1496 69 TELECOM ITALIA 5400 160 285 136 BT Ignite European Backbone 8866 156 21 11 Bulgarian Telecommunication C 3300 153 184 86 AUCS Communications Services 6830 137 513 27 UPC Distribution Services 25186 135 137 95 France Telecom Transpac's Tra 1273 131 170 94 Cable & Wireless Deutschland 9051 131 8 30 INCONET Autonomous System LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 390 599 152 UniNet S.A. de C.V. 16814 265 16 7 NSS, S.A. 11172 221 98 53 Servicios Alestra S.A de C.V 11664 195 19 22 Keytech SA 6147 190 102 20 Telefonica Del Peru 7303 149 68 21 Telecom Argentina Stet-France 14117 136 9 5 Telefonica del Sur S.A. 6505 133 90 89 Global One Communicaoes Ltda 22047 131 96 6 VTR PUNTO NET S.A. 11556 130 64 3 Cable-Wireless Panama 13999 113 52 9 Mega Cable S.A. de C.V. 6503 107 146 73 AVANTEL, S.A. 19632 107 14 5 Metropolis Intercom S.A. 18822 106 7 12 TELEFONICA MANQUEHUE 19169 102 6 17 Telconet 10481 101 40 7 Prima S.A. 22927 97 73 25 TELEFONICA DE ARGENTINA 23216 95 24 23 RAMtelecom Telecomunicaciones 21826 93 12 19 INTERCABLE 11311 89 8 18 Sinectis S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 266 637 223 The Internet Solution 5536 119 15 17 Internet Egypt Network 2018 91 295 86 Tertiary Education Network 20928 91 16 2 Noor Advanced Technologies AS 8452 78 28 6 TEDATA 2905 74 266 66 The Internetworking Company o 24835 63 34 6 RAYA Telecom - Egypt 6713 59 54 8 Itissalat Al-MAGHRIB 9129 40 3 2 UUNET Kenya 12455 38 6 3 Jambonet Autonomous system 5713 36 142 29 Telkom SA Ltd 15475 32 84 4 Nile Online 2609 31 26 3 Tunisia BackBone AS 15706 31 8 3 Sudatel Internet Exchange Aut 8524 24 1 4 AUCEGYPT Autonomous System 16637 22 10 19 Johnnic e-Ventures 33765 20 3 8 TANZANIA TELECOMMUNICATIONS C 10798 19 1 11 Standard Bank of South Africa 23889 18 5 6 MAURITIUS TELECOM 7460 17 3 5 LIA Internet Access Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1123 906 Time Warner Telecom 18566 814 807 Covad Communications 721 1109 796 DLA Systems Automation Center 4134 910 720 CHINANET-BACKBONE 9583 751 690 Sify Limited 27364 564 546 Armstrong Cable Services 4755 608 485 Videsh Sanchar Nigam Ltd. Aut 6197 918 482 BellSouth Network Solutions, 7725 482 467 MediaOne 22773 488 465 Cox Communications, Inc. 5668 489 464 CenturyTel Internet Holdings, 7545 501 429 TPG Internet Pty Ltd 3602 527 426 Sprint Canada, Inc. 6467 424 390 E.Spire Communications, Inc. 17676 436 361 Softbank BB Corp. 6140 405 328 ImpSat 4766 595 316 Korea Telecom (KIX) 9929 364 316 China Netcom Corp. 20115 615 301 Charter Communications 9443 370 294 Primus Telecommunications List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 65009 PRIVATE 69.39.0.0/20 21803 1st Class Internet S 65050 PRIVATE 168.96.148.0/24 6140 ImpSat 65004 PRIVATE 200.0.113.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.0.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.1.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.2.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.3.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.4.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.5.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.6.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.7.0/24 28477 Universidad Autonoma 64512 PRIVATE 200.61.32.0/23 11664 Keytech SA 64512 PRIVATE 200.61.48.0/20 11664 Keytech SA 64512 PRIVATE 200.61.62.0/23 11664 Keytech SA 64512 PRIVATE 200.80.154.0/23 11664 Keytech SA 65005 PRIVATE 203.200.197.0/24 4755 Videsh Sanchar Nigam 65444 PRIVATE 212.25.125.0/24 8551 Bezeq International 65024 PRIVATE 213.57.10.0/24 12849 Nonstop Internet Pro Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 50.160.0.0/13 1221 Telstra Pty Ltd 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.32.0.0/24 7011 Citizens Utilities 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.172.0.0/19 721 DLA Systems Automation Center 192.200.100.0/24 7018 AT&T WorldNet Services Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:8 /11:15 /12:72 /13:158 /14:308 /15:598 /16:8410 /17:2566 /18:4415 /19:10354 /20:11224 /21:9175 /22:12579 /23:13696 /24:89297 /25:319 /26:271 /27:140 /28:45 /29:31 /30:78 /31:0 /32:33 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 798 814 Covad Communications 6197 749 918 BellSouth Network Solutions, 7018 679 1488 AT&T WorldNet Services 2386 605 856 AT&T Data Communications Serv 9583 567 751 Sify Limited 27364 555 564 Armstrong Cable Services 4323 537 1123 Time Warner Telecom 7725 453 482 MediaOne 4766 412 595 Korea Telecom (KIX) 5668 403 489 CenturyTel Internet Holdings, 1239 374 890 Sprint 702 366 594 UUNET - Commercial IP service 6198 340 465 BellSouth Network Solutions, 10036 322 322 C&M Communication Co. Ltd. 7011 304 354 Citizens Utilities 6467 297 424 E.Spire Communications, Inc. 9929 283 364 China Netcom Corp. 6517 273 295 Yipes Communications, Inc. 15270 273 293 PaeTec.net -a division of Pae 11456 270 309 Carolina Online, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:15 12:1551 13:1 15:9 16:2 17:3 18:3 20:4 24:1159 30:2 32:69 33:4 38:122 40:53 44:3 47:2 52:4 55:2 56:3 57:21 58:88 59:41 60:49 61:815 62:611 63:1890 64:2752 65:2067 66:2859 67:575 68:526 69:1044 70:113 71:8 72:212 80:577 81:555 82:408 83:266 84:193 85:246 86:19 128:187 129:171 130:85 131:273 132:37 133:1 134:150 135:40 136:184 137:69 138:168 139:61 140:192 141:101 142:149 143:145 144:183 145:33 146:283 147:104 148:302 149:165 150:105 151:65 152:107 153:86 154:5 155:143 156:78 157:95 158:160 159:171 160:78 161:67 162:205 163:86 164:210 165:177 166:159 167:233 168:424 169:140 170:310 171:8 172:1 192:5721 193:3181 194:2407 195:1547 196:661 198:3934 199:3291 200:3979 201:142 202:5670 203:6241 204:3776 205:1998 206:2496 207:2808 208:2063 209:3302 210:1702 211:840 212:1205 213:1287 214:264 215:31 216:3452 217:1136 218:202 219:106 220:377 221:225 222:108 End of report

1 0

RE: Load Testing Util
by David Hubbard 03 Jun '05

03 Jun '05

Iperf works really well: http://dast.nlanr.net/Projects/Iperf/ It will do tcp/udp/multicast; you can pick the rate on the udp side and the client/server architecture lets you measure jitter, out of order packets, loss, etc. So you could load up a fixed rate of udp and then produce your burst using a second copy, etc. to see what happens. David > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Dan Mahoney, System Admin > Sent: Friday, June 03, 2005 1:49 PM > To: nanog(a)merit.edu > Subject: Load Testing Util > > > Hey all, > > Does anyone know of a (preferably opensource) tool that can generate > network loads of specific protocols and/or levels (for example, if I > wanted to see how much loss I got on a 1 meg spike, over time). I'm > hopefully looking for something client/server so I'm not necessarily > dependent on reply packets to measure the thoroughput. > > If anyone has any ideas, I'd love to hear them. Privately if > you like, as > I realize the potential for misuse of such things. > > -Dan > > -- > > --------Dan Mahoney-------- > Techie, Sysadmin, WebGeek > Gushi on efnet/undernet IRC > ICQ: 13735144 AIM: LarpGM > Site: http://www.gushi.org > --------------------------- > > >

1 0

Load Testing Util
by Dan Mahoney, System Admin 03 Jun '05

03 Jun '05

Hey all, Does anyone know of a (preferably opensource) tool that can generate network loads of specific protocols and/or levels (for example, if I wanted to see how much loss I got on a 1 meg spike, over time). I'm hopefully looking for something client/server so I'm not necessarily dependent on reply packets to measure the thoroughput. If anyone has any ideas, I'd love to hear them. Privately if you like, as I realize the potential for misuse of such things. -Dan -- --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org ---------------------------

2 1

RE: URPF on small BGP-enabled customers?
by Olsen, Jason 03 Jun '05

03 Jun '05

> couple prepends, or see if SprintLink supports the use of > communities to control advertisement (you want SprintLink to http://www.sprint.net/policy/bgp.html For those who haven't seen it (and for the archives), they do support communities for tuning some BGP parameters. Go about halfway down the page and they list the various communities and purposes. They also support remote-triggered blackholing. -jfo Jason "Feren" Olsen DeVry, Inc. Senior Network Engineer One Tower Lane Em: jolsen(a)devry.com Oakbrook Terrace, IL 60181-4624 Ph: 630.645.1607 Fx: 630.382.2929

1 0

Re: URPF on small BGP-enabled customers?
by christian.macnevin＠uk.bnpparibas.com 03 Jun '05

03 Jun '05

At an old transit provider I was at, we had a pig of a time dealing with uRPF. It doesn't like asymmetric routing at all, which is commonplace when you've got customers homed at exchange points for one. I imagine the simplest and most foolproof way around directly connected providers blackholing your traffic is announcing more specific prefixes down the one you're currently favourint, and just the aggregates for same into the second. Good luck if you've only got a bunch of non-contiguous /24s.. Internet christopher.morrow@mci.com@merit.edu - 03/06/2005 14:21 Sent by: owner-nanog(a)merit.edu To: will cc: nanog Subject: Re: URPF on small BGP-enabled customers? not speaking on behalf of sprint... but On Fri, 3 Jun 2005 will(a)loopfree.net wrote: > > I am in the process of turning up a new transit connection with SprintLink. My > network is a multi-homed stub AS and I only announce 5 prefixes. Having the bright > idea to incrementally move some traffic onto the new line I didn't announce all 5 > immediately and I localpref'd ^1239$ to get some outbound traffic moving -- and the > result is of course that they drop any of my outbound traffic sourced from prefixes > I'm not announcing yet. This really smells like URPF but of course nobody at Sprint > has even confirmed that they are actually dropping packets. > They might not, or the person in tech support might not know what you are asking about... if its part of the 'standard config template' chances are high there are LOTS of folks who don't know what it is or does :( > If they're paranoid enough to manually filter my BGP announcements it's not much > more work to manually filter my source addresses too (nevermind the fact that I > already do it myself, but...) the want to avoid manually filtering source addresses is exactly why uRPF was brought into existence (one of the reasons atleast). It's lower impact, on some cards/chassis/os's, than actual filters and certainly lower management headache to maintain. Keep in mind that sprint has probably a few hundred interfaces on that one router, with a few thousand routers (atleast, again I'm not a sprint person) with similar interface counts... managing acls on a hundred thousand interfaces (non-standard acls) isn't a simple task. > > I'm working through the SprintLink noc/support process but I'm surprised this > hasn't happened to any of their other customers before now. > perhaps other customers just announce their /24 to each provider and don't care about traffic engineering? or they atleat announce the depref'd routes incase of failure? > Am I missing something obvious here? probably not This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. ********************************************************************************************** BNP Paribas Private Bank London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Securities Services London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Fund Services UK Limited is authorised and regulated by the Financial Services Authority.

4 4

OT:ANNOUNCE: MailDroid Spam Fighting MFG/MTA alpha release 0.01
by Geoff White 03 Jun '05

03 Jun '05

The MailDroid iso image is ready for download at http://www.maildroid.org. (at 130 MB, we'll try it for a few days to see if we can afford the traffic) MailDroid is a special "distro" of the popular OpenBSD** operating system that is optimized to provide a secure, spam fighting, virus killing, Mail Filtering Gateway, "right out of the box". System Administrators need only place the MailDroid distro CD into any modern x86 box (Pentium III class or above) and load the system as you would any OpenBSD install except you select the additional maildroid.tgz package. Once all the packages are installed, reboot… and the system will come up swinging! MailDroid comes equipped and configured with: • sendmail 8.13.8 - standard OpenBSD 3.7 release • smtp-vilter 1.1.9- connect several milter back-ends to filter your incoming mail • spamassassin 3.0.2- what more do we need to say? • cyrus-sasl 2.1.20 - SASL2 authentication daemon to use with sendmail • clamav 0.85.1- The open source anti virus milter • squirrelmail 1.4.4– SSL web mail front-end using an internal IMAP server • spamd - The OpenBSD offensive spam deferral daemon • pop3s - TLS based POP access (via stunnel 4.08 ) • OpenBSD firewall based on pf • Chrooted sendmail, apache, clamav, smtp-vilter, named, PHP4.3.10 and more • Secure Web-based management console We put all the work into building, integrating and debugging these tools so you can spend your time, not building packages, but fighting SPAM! While the system comes up, secure and ready to filter, reject, or label spam, we refrain from making any major policy decisions. The system is tunable, in a large-scale sense through the web interface, however you can edit the actual configuration files yourself without worrying that your changes will be lost... all config files changes are placed under version control so if you make a mistake, you can recover easily. MailDroid is Open Source, you are free to modify it, recompile it, use parts of it, even repackage and sell it ( see individual component licenses). If you choose to purchase a CD, you get one year of on-line automatic updates for the host that you decide to register. What this means is that if there are security vulnerabilities, or cool feature improvements available, you don't have to wait, re-compile or re-install, you just have to download the package, install, possibly reboot and your done. Even if you choose not to purchase a CD, you can still have read access to the MailDroid CVS tree, that will contain up to the minute security patches and many feature enhancements. MailDroid is a community effort, it is a effort of System and Network Administrators like yourselves, and we value your suggestions, patches and feature additions, should you choose to contribute them. We are here to make all of our lives a little nicer and to optimize the fun! MailDroid... Now there's a New Hope. Host requirements: • I32 (x86) machine 300MHz (Pentium III) or better (sorry no 64 bit support yet, dual CPU is OK!) • 128MB of memory (512 preferred) • 20 Gigabyte hard drive • CDROM (to load software) • keyboard, VGA monitor (serial support for the console in the BIOS) • 10/100 base-T Ethernet port We can also build custom MailDroids to your specifications and deliver them fully burnt-in, loaded and debugged. From super-fast, 1U, dual processor, bastion servers to small-office, paperback book size, low power units. E-mail us for details and price quotes. Info at maildroid.org * MFG = Mail Filtering Gateway which also doubles as an MTA (Mail Transporting Agent) ** OpenBSD and the “Mean Puffy logo are copyrighted 1997-2005 by Theo de Raadt

1 0

Re: URPF on small BGP-enabled customers?
by christian.macnevin＠uk.bnpparibas.com 03 Jun '05

03 Jun '05

>Why would that work? If I see a /16 from my customer and a /19 from a peer, I will still pick the /19, and strict uRPF should drop any packets from that /19 coming the customer interface, right? Ah yes, I wasn't thinking strict enough indeed :) Good point. This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. ********************************************************************************************** BNP Paribas Private Bank London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Securities Services London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Fund Services UK Limited is authorised and regulated by the Financial Services Authority.

1 0

RE: URPF on small BGP-enabled customers?
by Olsen, Jason 03 Jun '05

03 Jun '05

>My network is a multi-homed stub AS and I only announce 5 prefixes. Not much different from many of my networks here, then. > If they're paranoid enough to manually filter my BGP > announcements it's not much more work to manually filter my > source addresses too (nevermind the fact that I already do it > myself, but...) SprintLink has been filtering BGP announcements since we came online with them a few years ago. They'd probably been doing it for some time before then, too. I don't see it as paranoid, to me it's just good practice (if a bit difficult to manage when you're as large as SL is). Stupid questions I must ask: * Did you actually give them all five prefixes when you were setting up your BGP request (your statement is a little vague on that detail)? * Did you request a copy of the BGP filter they're applying to your circuit(s)? Do they look okay? * What do route servers say about your prefixes/AS? EG, does oregon-ix.net see it as hanging off Sprint? * You are announcing off a loopback address, right? > I'm working through the SprintLink noc/support process but > I'm surprised this hasn't happened to any of their other > customers before now. As has already been said, I'm sure it has... You just have to find the engineers who've dealt with those situations before. A lot of their staff is fairly clueful but they're highly departmentalized. BGP team only does their BGP thing, etc. It can be hard to do proper troubleshooting when one team can only go so far before you're forced to hand off and start the process anew. Your best bet is to start with the obvious (get the BGP config and ACLs they're applying for you) and work your way from there. -jfo Jason "Feren" Olsen DeVry, Inc. Senior Network Engineer One Tower Lane Em: jolsen(a)devry.com Oakbrook Terrace, IL 60181-4624 Ph: 630.645.1607 Fx: 630.382.2929

1 0