- Test - lists.nanog.org

New and interesting network abuse.
by Ejay Hire 11 Jan '05

11 Jan '05

My apologies if this strays off topic, but I wanted to share my recent experience. We had a collocation customer come in and request a t1 of pots lines for their servers, then complaints that their "security" software wasn't working because of our RPF checks. As it turns out they were dialing up to a local isp, and sending bulk email using our bandwidth, but the dial-up's ip.... And receiving the TCP ack on the dial up. Very ingenious imho, but I'm not sorry it didn't work out. Anyone else seen this before? -Ejay

3 2

Email Security Glossary
by william(at)elan.net 11 Jan '05

11 Jan '05

I recently created email security glossary out of the smaller one that was included in mta-signatures paper (its now > 5 times larger with almost 300 terms and abbreviations!), it includes primarily email and cryptography abbreviations and terms but number of related network and dns terms are also there. This glossary will be shared among several of my projects and websites, but currently its first official location is: http://www.metasignatures.org/glossary.htm Feel free to check this out and if you find any terms that you do not believe are accurately described, let me know. P.S. I sent the above info on Friday on couple other mail lists, but forgot to do this on nanog even though I did mention here before that I was working on this glossary when we were talking about botnets and even used portions of text that were sent to me when defining that term (and I would like to thank all those who answered me and helped with the glossary). -- William Leibzon Elan Networks william(a)elan.net

2 1

Re: Broken PMTUD for . + TLD servers, was: Re: Smallest Transit MTU
by Iljitsch van Beijnum 10 Jan '05

10 Jan '05

On 10-jan-05, at 17:15, Stephen J. Wilcox wrote: >>> Windows appears to always set DF, is there a reason why they did >>> that? >> Of course I wanted to see this for myself. I used Quicktime to >> generate >> some UDP, but no DFs, either on Win98 or XP. > ah i was meaning tcp, afaik it sets DF on at least win2k All OSes that I know of do this in order to do path MTU discovery. The PMTUD RFC encourages implementers to detect changes in the path MTU as fast as possible, which they took to mean "set the DF bit on ALL packets". Which is unfortunate, because in cases where PMTUD doesn't work, no communication is possible. Setting the DF bit on 50, 10, or 2 % would accomplish PMTUD fine too, but it would also allow the session to survive brokennes. > do any of those tiny resourced internet bootstrapping hosts exist? > perhaps we > can deprecate DF?! I've said I'd like to see this happen in the past. The trouble is without DF, current PMTUD doesn't work anymore, and router CPUs will be spending unnecessary CPU cycles on fragmentation. So some of the packets should trigger an ICMP too big, but others should just be fragmented. Figuring out the right mix probably requires some experimentation.

2 1

Re: soliciting agenda topics for the sunday night meeting
by Paul Vixie 10 Jan '05

10 Jan '05

here's the updated agenda, with two changes. 1. added steve feldman's talk. 2. added URL for golding-et-al (as provided by golding-et-al). ------------------------------------------------------------------ introduction martin hannigan 5 minutes & paul vixie (moderators) program committe steve feldman 20 minutes overview "reform proposal" dan golding (et al) 15 minutes http://nanog-reform.org/ Q&A and discussion will follow each presentation, with moderation but without specific time limits set in advance. ------------------------------------------------------------------ and as before... > anybody else got anything else? send to martin, myself, both of us, or > the nanog@ mailing list if you want to put something on the sunday night > agenda. (steve feldman clarified that he's speaking not moderating.) (we've not heard yet whether betty or susan from merit will also be speaking.) -- paul vixie martin hannigan (moderators)

4 4

Juno contact?
by Hosman, Ross 10 Jan '05

10 Jan '05

Does anyone have a Juno contact, preferably one in their mail department. If you do please contact me off list. Ross Hosman HSD Administrator E: ross.hosman(a)chartercom.com O: 314-543-5823 C: 314-898-3381

1 0

Re: Smallest Transit MTU
by Sabri Berisha 10 Jan '05

10 Jan '05

On Wed, Dec 29, 2004 at 05:04:11PM -0500, Joe Abley wrote: > > > On 29 Dec 2004, at 16:33, Tony Rall wrote: > > >But that only affects tcp traffic - it does nothing to help other > >protocols. > > Are there any common examples of the DF bit being set on non-TCP > packets? [root@bofh sabri]# host -t ns verisign.com 192.5.6.30 Using domain server 192.5.6.30: verisign.com name server bay-w1-inf5.verisign.net [root@bofh root]# tcpdump -Xn host 192.5.6.30 tcpdump: listening on fxp0 17:37:53.124955 217.69.153.39.55058 > 192.5.6.30.53: 58565+ NS? verisign.com. (30) 0x0000 4500 003a 5f10 0000 4011 e312 d945 9927 E..:_...@....E.' 0x0010 c005 061e d712 0035 0026 8ac9 e4c5 0100 .......5.&...... 0x0020 0001 0000 0000 0000 0876 6572 6973 6967 .........verisig 0x0030 6e03 636f 6d00 0002 0001 n.com..... 17:37:53.216656 192.5.6.30.53 > 217.69.153.39.55058: 58565- 3/0/3 NS[|domain] (DF) 0x0000 4500 00ca 0000 4000 3111 1093 c005 061e E.....@.1....... 0x0010 d945 9927 0035 d712 00b6 1b79 e4c5 8100 .E.'.5.....y.... 0x0020 0001 0003 0000 0003 0876 6572 6973 6967 .........verisig 0x0030 6e03 636f 6d00 0002 0001 c00c 0002 0001 n.com........... 0x0040 0002 a300 001a 0b62 6179 2d77 312d 696e .......bay-w1-in 0x0050 6635 f5 Here you go. A root-nameserver setting the DF-bit on its replies :) -- Sabri Berisha, SAB666-RIPE - I route, therefore you are http://www.cluecentral.net - http://www.virt-ix.net http://www.bash.org/?78486

5 8

Re: Broken PMTUD for . + TLD servers, was: Re: Smallest Transit MTU
by Iljitsch van Beijnum 10 Jan '05

10 Jan '05

On 10-jan-05, at 12:26, Stephen J. Wilcox wrote: > Shifting topic a little.. any idea why DF is used anyway? I've never > understood what the purpose of not fragmenting is, and if DF didnt > exist we wouldnt experience the PMTU missing icmp issues Good question. According to RFC 791: If the Don't Fragment flag (DF) bit is set, then internet fragmentation of this datagram is NOT permitted, although it may be discarded. This can be used to prohibit fragmentation in cases where the receiving host does not have sufficient resources to reassemble internet fragments. One example of use of the Don't Fragment feature is to down line load a small host. A small host could have a boot strap program that accepts a datagram stores it in memory and then executes it. > Windows appears to always set DF, is there a reason why they did that? <msbash> Greed, what else? </msbash> Of course I wanted to see this for myself. I used Quicktime to generate some UDP, but no DFs, either on Win98 or XP.

1 0

Weekly Routing Table Report
by Routing Table Analysis 10 Jan '05

10 Jan '05

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 08 Jan, 2005 Analysis Summary ---------------- BGP routing table entries examined: 153319 Prefixes after maximum aggregation: 89967 Unique aggregates announced to Internet: 73706 Total ASes present in the Internet Routing Table: 18741 Origin-only ASes present in the Internet Routing Table: 16272 Origin ASes announcing only one prefix: 7627 Transit ASes present in the Internet Routing Table: 2469 Transit-only ASes present in the Internet Routing Table: 78 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 20 Prefixes from unregistered ASNs in the Routing Table: 7 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 16 Number of addresses announced to Internet: 1362623528 Equivalent to 81 /8s, 55 /16s and 252 /24s Percentage of available address space announced: 36.8 Percentage of allocated address space announced: 59.4 Percentage of available address space allocated: 61.9 Total number of prefixes smaller than registry allocations: 71007 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 30236 Total APNIC prefixes after maximum aggregation: 14760 Prefixes being announced from the APNIC address blocks: 28293 Unique aggregates announced from the APNIC address blocks: 14546 APNIC Region origin ASes present in the Internet Routing Table: 2175 APNIC Region origin ASes announcing only one prefix: 643 APNIC Region transit ASes present in the Internet Routing Table: 329 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 15 Number of APNIC addresses announced to Internet: 171180032 Equivalent to 10 /8s, 52 /16s and 0 /24s Percentage of available APNIC address space announced: 78.1 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 23552-24575 APNIC Address Blocks 58/7, 60/7, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 86049 Total ARIN prefixes after maximum aggregation: 52107 Prefixes being announced from the ARIN address blocks: 65837 Unique aggregates announced from the ARIN address blocks: 23938 ARIN Region origin ASes present in the Internet Routing Table: 9789 ARIN Region origin ASes announcing only one prefix: 3533 ARIN Region transit ASes present in the Internet Routing Table: 964 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 16 Number of ARIN addresses announced to Internet: 236672000 Equivalent to 14 /8s, 27 /16s and 84 /24s Percentage of available ARIN address space announced: 70.5 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647,29695-30719, 31744-33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/7, 72/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 28899 Total RIPE prefixes after maximum aggregation: 20012 Prefixes being announced from the RIPE address blocks: 25851 Unique aggregates announced from the RIPE address blocks: 17003 RIPE Region origin ASes present in the Internet Routing Table: 6194 RIPE Region origin ASes announcing only one prefix: 3307 RIPE Region transit ASes present in the Internet Routing Table: 1056 Average RIPE Region AS path length visible: 5.1 Max RIPE Region AS path length visible: 20 Number of RIPE addresses announced to Internet: 183979200 Equivalent to 10 /8s, 247 /16s and 76 /24s Percentage of available RIPE address space announced: 64.5 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-34815 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6814 Total LACNIC prefixes after maximum aggregation: 2387 Prefixes being announced from the LACNIC address blocks: 6668 Unique aggregates announced from the LACNIC address blocks: 4044 LACNIC Region origin ASes present in the Internet Routing Table: 412 LACNIC Region origin ASes announcing only one prefix: 121 LACNIC Region transit ASes present in the Internet Routing Table: 77 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 15 Number of LACNIC addresses announced to Internet: 17046016 Equivalent to 1 /8s, 4 /16s and 26 /24s Percentage of available LACNIC address space announced: 50.8 LACNIC AS Blocks 26592-26623, 27648-28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1314 Total AfriNIC prefixes after maximum aggregation: 701 Prefixes being announced from the AfriNIC address blocks: 868 Unique aggregates announced from the AfriNIC address blocks: 686 AfriNIC Region origin ASes present in the Internet Routing Table: 95 AfriNIC Region origin ASes announcing only one prefix: 23 AfriNIC Region transit ASes present in the Internet Routing Table: 12 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 2103808 Equivalent to 0 /8s, 32 /16s and 26 /24s Percentage of available AfriNIC address space announced: 12.5 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 876 4610 167 Data Communications Bureau 1221 787 1184 562 Telstra Pty Ltd 9583 581 47 29 Satyam Infoway Ltd., 4766 561 3413 275 Korea Internet Exchange for " 4755 433 176 80 Videsh Sanchar Nigam Ltd. Aut 17676 390 5852 60 XTAGE CORPORATION 9443 362 71 77 Primus Telecommunications 9929 356 164 41 China Netcom Corp. 2907 355 1856 328 SINET Japan 703 320 343 252 UUNET 17557 307 22 150 Pakistan Telecom 10036 294 27 270 C&M Communication Co. Ltd. 2764 283 256 226 connect.com.au pty ltd 7474 272 267 202 Optus Communications Pty Ltd 9800 238 383 76 CHINA UNICOM 7545 232 86 66 TPG Internet Pty Ltd 9498 232 81 53 BHARTI BT INTERNET LTD. 4802 231 28 140 Wantree Development 4814 226 232 6 China Telecom (Group) 7563 226 48 158 Korea Internet Infrastructure ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1415 6587 962 AT&T WorldNet Services 721 1099 21730 306 DLA Systems Automation Center 701 1050 8327 904 UUNET Technologies, Inc. 1239 932 2881 623 Sprint 2386 847 523 601 AT&T Data Communications Serv 4323 828 670 225 Time Warner Telecom 6197 824 381 369 BellSouth Network Solutions, 18566 760 208 6 Covad Communications 209 655 3439 501 Qwest 3356 610 10887 447 Level 3 Communications, LLC 20115 568 470 302 Charter Communications 3561 549 2369 416 Cable & Wireless USA 852 527 1126 401 Telus Advanced Communications 7843 483 730 100 Adelphia Corp. 6478 470 814 98 AT&T Worldnet Services 6198 450 388 200 BellSouth Network Solutions, 7132 449 8251 381 SBC Internet Services 27364 442 44 20 Armstrong Cable Services 5668 427 87 18 Century Telephone 22909 419 907 65 Comcast Cable Corporation RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 623 2023 514 UUNET - Commercial IP service 3320 292 2992 230 Deutsche Telekom AG 3301 288 1112 276 TeliaNet Sweden 8220 279 466 267 COLT Internet - International 21502 272 40 3 NUMERICABLE is a cabled netwo 680 254 2041 240 DFN-IP service G-WiN 3246 224 483 220 Song Networks 13083 217 51 8 Mannesmann Datenverarbeitung 8708 207 119 190 Romania Data Systems S.A. 1257 205 708 171 SWIPnet Swedish IP Network 5515 193 842 140 Sonera Solution Autonomous Sy 786 176 1794 176 The JANET IP Service 3215 176 998 76 France Telecom Transpac 6746 169 47 136 Dynamic Network Technologies, 8866 163 18 21 Bulgarian Telecommunication C 719 159 322 104 LANLINK autonomous system 3269 158 1360 69 TELECOM ITALIA 3300 152 165 77 AUCS Communications Services 25186 145 138 101 France Telecom Transpac's Tra 5400 136 216 118 BT Ignite European Backbone LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6140 355 140 69 ImpSat 8151 329 473 141 UniNet S.A. de C.V. 16814 234 14 6 NSS, S.A. 11172 214 99 54 Servicios Alestra S.A de C.V 11664 188 19 28 Keytech SA 6147 187 100 22 Telefonica Del Peru 7303 147 68 20 Telecom Argentina Stet-France 6505 140 90 96 Global One Communicaoes Ltda 6503 124 147 83 AVANTEL, S.A. 14117 114 7 5 Telefonica del Sur S.A. 11992 106 9 31 Integrated Systems 11556 97 48 3 Cable-Wireless Panama 14420 87 6 42 ANDINATEL S.A. 11311 86 8 22 Sinectis S.A. 13999 85 52 9 Mega Cable S.A. de C.V. 6535 84 7 25 Chilesat Servicios Empresari 10481 82 32 7 Prima S.A. 4270 81 18 9 Red de Interconexion Universi 5639 79 8 8 Telecommunications Services o 15311 78 25 37 Telefonica Empresas AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 268 636 226 The Internet Solution 5536 114 16 4 Internet Egypt Network 2018 102 297 98 Tertiary Education Network 2905 77 272 70 The Internetworking Company o 20928 76 16 2 Noor Advanced Technologies AS 24835 48 34 7 RAYA Telecom - Egypt 8452 47 20 5 TEDATA 6713 34 38 9 Itissalat Al-MAGHRIB 9129 33 3 2 UUNET Kenya 5713 27 141 24 Telkom SA Ltd 12455 27 7 4 Jambonet Autonomous system 8524 25 1 4 AUCEGYPT Autonomous System 16637 22 10 19 Johnnic e-Ventures 10798 18 1 12 Standard Bank of South Africa 12258 18 3 12 Vodacom Internet Company 21280 17 2 3 Swift Global Kenya Ltd.Is an 8346 15 7 14 SONATEL-AS Autonomous System 15706 15 4 2 Sudatel Internet Exchange Aut 21491 15 1 3 UTL On-line is RF broadband I 15808 13 1 2 Communication Solutions Ltd i Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 721 1099 793 DLA Systems Automation Center 18566 760 754 Covad Communications 4134 876 709 Data Communications Bureau 4323 828 603 Time Warner Telecom 9583 581 552 Satyam Infoway Ltd., 6197 824 455 BellSouth Network Solutions, 27364 442 422 Armstrong Cable Services 5668 427 409 Century Telephone 22773 417 394 Cox Communications, Inc. Atla 7843 483 383 Adelphia Corp. 6478 470 372 AT&T Worldnet Services 22909 419 354 Comcast Cable Corporation 4755 433 353 Videsh Sanchar Nigam Ltd. Aut 6467 372 341 E.Spire Communications, Inc. 17676 390 330 XTAGE CORPORATION 9929 356 315 China Netcom Corp. 1239 932 309 Sprint 13609 338 303 Choice One Communications Inc 4766 561 286 Korea Internet Exchange for " 6140 355 286 ImpSat List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 26422 UNALLOCATED 196.46.184.0/22 3741 The Internet Solutio 64512 PRIVATE 199.213.17.0/25 15296 Netera Alliance Inc. 64512 PRIVATE 199.213.17.128/25 15296 Netera Alliance Inc. 64512 PRIVATE 199.216.97.0/28 15296 Netera Alliance Inc. 65002 PRIVATE 208.179.184.0/24 11509 The Pajo Group 65529 PRIVATE 216.21.199.0/24 14697 VDot.Net 65529 PRIVATE 216.152.237.0/24 14697 VDot.Net Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.172.11.0/24 721 DLA Systems Automation Center 192.200.100.0/24 7018 AT&T WorldNet Services Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:7 /11:15 /12:59 /13:139 /14:313 /15:566 /16:8240 /17:2355 /18:4053 /19:10054 /20:10639 /21:8207 /22:11372 /23:12909 /24:83467 /25:252 /26:234 /27:127 /28:63 /29:37 /30:138 /31:0 /32:51 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 745 760 Covad Communications 6197 670 824 BellSouth Network Solutions, 2386 623 847 AT&T Data Communications Serv 7018 580 1415 AT&T WorldNet Services 27364 427 442 Armstrong Cable Services 9583 405 581 Satyam Infoway Ltd., 702 380 623 UUNET - Commercial IP service 4766 379 561 Korea Internet Exchange for " 5668 370 427 Century Telephone 1239 369 932 Sprint 6198 327 450 BellSouth Network Solutions, 13609 295 338 Choice One Communications Inc 10036 294 294 C&M Communication Co. Ltd. 6517 289 313 Yipes Communications, Inc. 9929 285 356 China Netcom Corp. 6467 283 372 E.Spire Communications, Inc. 4323 273 828 Time Warner Telecom 21502 269 272 NUMERICABLE is a cabled netwo 11456 259 304 Carolina Online, Inc. 701 254 1050 UUNET Technologies, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:4 8:10 12:1460 13:1 15:5 16:2 17:3 18:4 20:4 24:720 32:77 33:3 38:87 40:55 44:3 47:2 52:3 55:2 56:3 57:21 59:1 60:12 61:676 62:523 63:1854 64:2521 65:2082 66:2491 67:480 68:521 69:857 70:52 71:1 72:24 80:529 81:626 82:381 83:213 84:80 85:41 128:120 129:166 130:91 131:193 132:35 134:144 135:30 136:188 137:68 138:159 139:36 140:190 141:108 142:133 143:124 144:164 145:41 146:282 147:87 148:263 149:128 150:93 151:62 152:115 153:70 154:2 155:134 156:61 157:69 158:148 159:162 160:63 161:60 162:383 163:85 164:214 165:160 166:126 167:224 168:366 169:131 170:313 171:8 192:5652 193:3036 194:2232 195:1543 196:602 198:3865 199:3245 200:3950 201:43 202:5064 203:5886 204:3564 205:2108 206:2299 207:2530 208:2090 209:3052 210:1539 211:732 212:1153 213:1259 214:233 215:31 216:3732 217:1080 218:173 219:87 220:319 221:97 222:38 End of report

8 7

Re: Broken PMTUD for . + TLD servers, was: Re: Smallest Transit MTU
by Iljitsch van Beijnum 10 Jan '05

10 Jan '05

On 10-jan-05, at 1:54, Stephen J. Wilcox wrote: >> With a 296 byte MTU I don't get answers from >> (a|b|h|j).root-servers.net, *.gtld-servers.net, tld2.ultradns.net and >> some lesser-known ccTLD servers. > I thought 576 bytes was the minimum by way of largest initial packet > prior > to negotiating MSS must not exceed 576 bytes.. altho i guess that > doesnt > preclude fragmentation or pmtu? Hosts are expected to be able to handle 576 byte IP packets = be able to reconstruct packets of that size from fragments if they are behind a < 576 MTU. For a long time, the TCP MSS would default to 536 (576 - IP - TCP) or 512. However, there is no real requirement about the minimum link MTU apart from the 68 bytes in RFC 791. People often attribute a 296 byte MTU recommendation for slow links with header compression to RFC 1144. This isn't entirely unreasonable, but it's not explicitly in the text. In any case, doing PMTUD for UDP in IPv4 doesn't make much sense. And having the kernel set the DF bit and then expecting the application is completely wrong, as many UDP applications can't reduce their packet size, or can't do this without serious loss of functionality, and fragmentation at the source host also can't be controlled by applications.

1 0

Re: Tracking spoofed routes?
by David Meyer 09 Jan '05

09 Jan '05

Kevin, >> I am seeking avenues to investigate a possible case of IP address spoofing. >> >> I've recently received complaints which suggest that in the recent >> past (but not right now), somebody may have announced a more specific >> prefix, effectively hijacking "unused" address space within our >> allocated range. >> >> As it happens, the address space is not unused, just not visible on >> the public Internet. >> >> >> I am aware of route reflectors and other options to manually review >> what prefixes are currently announced, but have not been able to find >> a *searchable* archive of historical data, either overall BGP tables >> or just "unusual" announcements. The closest thing I've found so far >> is Route Views (http://www.routeviews.org/) however there is no >> obvious way to search the (huge) archived data files for substring >> matches? We're involved in trying to build database front ends for the data so you can do just this sort of thing. But right now, we're a little stuck. One thing you might try is using BGPlay to watch what happens to your prefix. >> Alternately, are there any existing mechanisms for monitoring route >> announcements which can provide near real-time alerting when any >> prefixes within specific subnet ranges are announced? Not that I know of. You can log into route-views.routeviews.org and use the cli to watch it, but that is a manual process. Hope this helps, Dave

5 5