- Test - lists.nanog.org

Re: Clearwire May Block VoIP Competitors
by Robert Bonomi 28 Mar '05

28 Mar '05

> From owner-nanog(a)merit.edu Sat Mar 26 12:37:15 2005 > Date: Sat, 26 Mar 2005 13:35:31 -0500 > From: Eric Gauthier <eric(a)roxanne.org> > To: "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> > Cc: nanog(a)merit.edu > Subject: Re: Clearwire May Block VoIP Competitors > > > > http://www.advancedippipeline.com/news/159905772 > > > > "...In what the company claims is an effort to preserve the performance > of its pre-standard WiMAX network, Clearwire says it reserves the right > to prohibit the use of a wide range of bandwidth-hungry applications, a > list that apparently includes VoIP as well as the uploading or > downloading of streaming video or audio, and high-traffic Web site > hosting." > > Hrm... Isn't a VoIP call realtively low bandwidth? "*ALL* things are relative." <grin> > I haven't studied > this, but Vonage's site seems to imply that the maximum data rate is 90Kbps > (http://www.vonage.com/help_knowledgeBase_article.php?article=190) I > typically see speeds greater than this from my web browser... There's a big difference. web browser activity is typically *very* bursty. 'Average' data rate for a any single user is probably in the range of 1%-3% of the burst peaks. VoIP, on the other hand, has an "average" utilization that approximates 50% of the burst rate. In _both directions. I suspect that that latter factor is a fair part of the "problem". That the cable company has allocated fairly limited bandwidth for the 'upstream' direction (from the customer to the head-end). That that 'available' bandwidth is *grossly* over-subscribed, on the "presumption" that traffic in that direction would generally be "small", and "infrequent". When those assupmtions get violated, _everything_ goes to h*ll. <wry grin> Not just for 'he who' commits the violation, but everybody else who is sharing that over-subscribed link. This is what happens when you sell "up to $BIGNUM" connectivity, without discussing a minimum CCIR promise. IF a customer does get throttled/blocked, they might have some fun with a false advertising assertation.

2 1

[feldman@twincreeks.net: NANOG 34: Call for Presentations]
by Steve Feldman 28 Mar '05

28 Mar '05

Reminder: program submissions for NANOG 34 are due by Monday, April 4. If you have any questions or comments, feel free to ask the program committee at nanogpc(a)nanog.org or the administrative staff at nanog-support(a)nanog.org. We look forward to hearing from you! * * * * * * * * * * * * * * * * * CALL FOR PRESENTATIONS NANOG 34 May 15-17, 2005 * * * * * * * * * * * * * * * * * The North American Network Operators' Group (NANOG) will hold its 34th meeting May 15-17, 2005, in Seattle, Washington. The meeting will be hosted by Switch and Data and held at the Westin Seattle. NANOG conferences provide a forum for information exchange among network operators, engineers, and researchers. Meetings are held three times each year, and include presentations, tutorial sessions, and BOFs. The meetings are informal, with an emphasis on relevance to current engineering practices. NANOG solicits presentations highlighting issues relating to technology already deployed or soon to be deployed in the Internet. Vendors are encouraged to work with operators to present deployment experiences with the vendor's products and interoperability. The community is invited to present talks or tutorials on: - VOIP architectures and deployment - Peering/collocation coordination issues - Security attacks/mitigation, tools, and analysis - Content provider issues - MSO IPTV deployment and operations - Backbone operational case studies - Exchange point technologies and implementation - Non-telco, last-mile technologies (metro/rural, broadband, radio, and optical) - Implementation experience with Ethernet, e.g., TLS, VPLS, Ethernet private line, and VPWS. - Wavelength use by enterprises - Large-scale wireless deployment - Experiences with native IPv6 transport rollout - State of OAM tools for IP and MPLS networks - Options for blackhole and discard routing - BGP/MPLS layer 3 VPNs - Other interesting network technologies Topics for short (10-20 minute) lightning talks will be solicited on-site in Seattle. Researchers are invited to present short (10-minute) summaries of their work for operator feedback. Topics include routing, network performance, statistical measurement and analysis, and protocol development and implementation. Studies presented may be works in progress. Researchers from academia, government, and industry are encouraged to present. How to Present -------------- Submit an abstract and draft slides for the presentation in email to nanog-support(a)nanog.org. See http://www.nanog.org/presentations.html for submission guidelines. The deadline for abstracts and slides is April 4, 2005. While the majority of speaking slots will be filled by April 4, a limited number of slots may be available after that date for topics that are exceptionally timely, important, or critical to the operations of the Internet. Submissions will be reviewed by the NANOG Program Committee, and presenters will be notified of acceptance by April 18. Final drafts of presentation slides are due by May 4, and final versions May 11.

1 0

Program survey results
by Steve Feldman 28 Mar '05

28 Mar '05

I have posted the final results of the 2005 program survey at http://www.nanogpc.org/public/pcsurvey.html There were a total of 85 responses. Steve

1 0

Re: DNS cache poisoning attacks -- are they real?
by Suresh Ramasubramanian 28 Mar '05

28 Mar '05

On Sun, 27 Mar 2005 18:22:15 +0100, Brad Knowles <brad(a)stop.mail-abuse.org> wrote: > > Abusing someone else's poorly configured resolvers is not the way > to solve this problem, and it's a bad habit to get into. > Er, I forgot to mention that it was my ISP whose resolver I used, and I have a perfect right to use their resolver when necessary. I try not to, when I am traveling, given the latency. But it is not like, for example, using an open relay, or even using John Gilmore's open by design relay at toad.com. I dont know how, but dns requests to those resolvers worked, whereas my local resolver got proxied through their dns .. if it was a transparent proxy that'd not be the case. -srs

1 0

Re: Sorbs.net
by Dean Anderson 27 Mar '05

27 Mar '05

> o could this be used as a dos and then become extortion? > has this actually happened, or is it just black heli? It has happened, in a legal sense anyway. See Exactis V. MAPS. One of Exactis' claims was civil extortion. (Claim 4 on complaint). Exactis also claimed that MAPS could block 40% of their email, an that this was a denial of service and interference with communications in violation of Colorado's electronic communication privacy act. MAPS moved for dismissal but was denied. Exactis was granted a temporary restraining order (TRO). This is significant, given the case was settled. The standard for granting such an order is that the stated case, if the asserted facts are assumed true, must be able to win on the stated law. In other words, it has state enough facts to fulfill the claimed statutory requirements. To explain TROs, let me put it this way: Imagine you have a washing machine where you have to put the right coins in the right slots to get it work. For the TRO, if they have all the right coins (assuming they are real), for all the right slots in the law, (and they pay bond), they get it. The trial is where the judge checks to see that the coins are real. Getting a TRO is a strong indicator of the technical merits of their case. If the defendant can't show some of the asserted facts false, they will almost certainly lose. > o the ts&cs would seem to indicate that the donation is > voluntary, and proportional to the spam generated. e.g., > if you generated no spam, no donation. do i understand > this correctly? Its "voluntary" except that the subscribers are misled as to the purposes of the blacklist. The abuse of by blacklist is not something subscribers voluntarily agreed to. No subscribers agreed to have their non-spam mail intentionally blocked. Demanding payment for "generated spam", in return for de-listing is pretty plainly extortion. Here is the Colorado statute: (Caps from state page) (1) A PERSON COMMITS CRIMINAL EXTORTION IF: (a) THE PERSON, WITHOUT LEGAL AUTHORITY AND WITH THE INTENT TO INDUCE ANOTHER PERSON AGAINST THAT OTHER PERSON'S WILL TO PERFORM AN ACT OR TO REFRAIN FROM PERFORMING A LAWFUL ACT, MAKES A SUBSTANTIAL THREAT TO CONFINE OR RESTRAIN, CAUSE ECONOMIC HARDSHIP OR BODILY INJURY TO, OR DAMAGE THE PROPERTY OR REPUTATION OF, THE THREATENED PERSON OR ANOTHER PERSON; AND (b) THE PERSON THREATENS TO CAUSE THE RESULTS DESCRIBED IN PARAGRAPH (a) OF THIS SUBSECTION (1) BY: (I) PERFORMING OR CAUSING AN UNLAWFUL ACT TO BE PERFORMED; OR (II) INVOKING ACTION BY A THIRD PARTY, INCLUDING BUT NOT LIMITED TO, THE STATE OR ANY OF ITS POLITICAL SUBDIVISIONS, WHOSE INTERESTS ARE NOT SUBSTANTIALLY RELATED TO THE INTERESTS PURSUED BY THE PERSON MAKING THE THREAT. Seems like the victim is induced against their will to perform or refuse to perform a lawful act, Seems like a blacklist is a 'substantial threat to cause economic hardship'. Thats a) I'm not sure I understand b)I. I don't know if an "Unlawful act" here means something that is civilly unlawful, such as unlawful participation in a group boycott, or unlawful interference in a contract. Or if it requires criminally unlawful act, like threatening physical harm. Seems like the actions of the subscribers of the blacklist fullfill b)II because their interests are different from those of the blacklist. Subscribers interests in in blocking spam, not ham. Spam doesn't usually come from companies that would sue for extortion, like Exactis. CAN-SPAM establishes a definition for what can be considered spam. --Dean -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000

1 0

Re: DNS cache poisoning attacks -- are they real?
by Florian Weimer 27 Mar '05

27 Mar '05

* Brad Knowles: > It only takes a little while to figure out that domains can be > fake-hosted using open caching recursive resolvers. Someone creates > a domain with very small TTLs for the real authoritative servers. > Within the zone, they do lame delegations to a lot of known public > caching recursive servers, with much longer TTLs. > > The lame delegators do what they think is their duty to serve the > data they are requested for, and they are the ones who effectively > serve that data to the world. In fact, the real IP addresses of the > authoritative servers could be changed every five minutes, with the > new policies and procedures in place from NetSol. I doubt this will work on a large scale. At least recent BIND resolvers would discard replies from the abused caching resolvers because they lack the AA bit, so only clients using the resolvers as actual resolvers are affected. You can more easily seed open resolvers, sure, but with a reasonably sized botnet, you can do the same thing with closed ones.

1 0

ICANN on the panix.com theft
by David Lesher 27 Mar '05

27 Mar '05

ICANN Blames Melbourne IT for Panix Domain Hijacking Panix had its domain hijacked over the weekend of January 15-16. Its domain was registered with Dotster, a registrar based in Washington. By January 17, the domain had been restored. Melbourne IT has admitted that it was to blame for the incident as one of its resellers failed to follow the process for seeking authorisation for a domain name transfer request. <http://www.smh.com.au/news/Breaking/ICANN-asked-to-probe-all-transfer-probl…> I used lynx to avoid registration hassles. obdisclaimer: Happy Panix customer... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

3 4

72/8 friendly reminder
by Chan, KaLun 27 Mar '05

27 Mar '05

We were recently assigned a 72.244/16 allocation from ARIN. Friendly reminder that ARIN started allocating 72/8 since Aug. If you have a static bogon filters, can you please make sure they are updated. Thank You Sincerely, Ka Lun Chan (KC) COVAD Communications <http://www.voipthemovie.com> www.voipthemovie.com

15 33

Please verify RFC1918 filters
by vijay gill 27 Mar '05

27 Mar '05

We here at AOL have noticed that there are still some people filtering 172.0.0.0/8, which is causing AOL subscribers to get blocked from some sites. As a matter of general IP route filtering hygene I thought it worth mentioning (again) to see if we can get this tamped down (or, better still, stamped out). For reference, RFC1918 20 bit block space is 172.16.0.0 - 172.31.255.255 (172.16/12 prefix) ARIN-assigned AOL block ranges that have 172 in the first octet are: 172.128.0.0/10 172.192.0.0/12 172.208.0.0/14 Please double check your filters to make sure you are not accidently blocking AOL in the non-RFC1918 space. It would be useful to pass this along to your downstreams as well. AOL is also working directly with the companies who have misconfigured firewalls where we notice problems with filters. /vijay

5 6

PKI for medium scale network operations
by Sean Donelan 26 Mar '05

26 Mar '05

Routers, IP phones, VPN, etc are starting to get reasonable support for certificates. So network operators may need some PKI as part of their infrastructure (rather than the traditional application-layer PKI such as Web/SSL). But there seems to be only two choices for Public Key Infrastructure. The do it yourself crowd which requires a lot of expertise just to keep running, and the we'll do everything for you crowd which is massive in scale and price. Have any network operators found something in between? Simple enough that after it is set up, an administrative person can handle the day to day operation. But not so expensive, you can justify the infrastructure for the relatively certificates being managed? Most network infrastructure is internal, so there is no need for a world-wide PKI for internal stuff. Microsoft is actually doing an impressive job building it into their systems. Is that the direction network operators are going?

3 4