- Test - lists.nanog.org

Re: IPV6 renumbering painless?
by Paul Vixie 12 Nov '04

12 Nov '04

> I don't care whether you want to call it PI space or not, the bottom line > is that it has all the same practical uses and effect as PI space, and, > this is exactly what the real world is likely to do with v6 for any > organization that wants to multihome without renumbering. They'll get > an AS and they'll get a /32, and, suddenly, each department within the > company will become a "customer" of the IT-ISP department. > > I'm not saying this is clean, friendly, nice, whatever. However, it is > what people are really going to do with the current v6 address allocation > policies. that's all true. i want to add a detail, but because i'm a member-elect of the arin board of trustees i have to put in the following disclaimer: I'm Speaking For Myself And Not For ARIN. that having been said, here's my view: the current policies that allow organizations as small as isc to get a /32 are clearly wrong for the long term -- it lets the ipv6 /32 do what the ipv4 /24 did: create a swamp. we will be dealing with an ipv6 swamp for as many years to come as we've already dealt with the ipv4 swamp. HOWEVER, i have two observations. #1 is that the ipv4 swamp was a huge motivator for ipv4 deployment in the early days, and its carrying costs today are still worth paying just because of the market size it helped enable. #2 is that the ipv4 swamp has stayed about the same absolute size since CIDRD was closed, and almost all growth since then has been of larger (PA) prefixes. extrapolating this for ipv6 ought to cause a number of you to go out and get ipv6 /32's today, before the swamp starts to fill up with other folks' prefixes, which will ultimately lead the members of ARIN and other RIRs to "raise the bar" for /32 allocations. and i do not expect there to be a provision for getting anything smaller than a /32 if you don't qualify for a /32. read this whole message more carefully if you are still unmotivated.

1 0

Probe dns service - anycast network
by Gere geomag 11 Nov '04

11 Nov '04

Hi, We are thinking of deploying anycast in our network for dns servers. I have the following scenario: - 10 server DNS (isc-bind) , linux and zebra for propagating ospf ip anycast. Are there someone who has developed a "solid scripts (perl/c/ecc..)" that is used to probe a dns service (udp/tcp port 53) and in case of failure (or max lookup query time problem) automatic shutdown ospf annunce or remove a server from a anycast network? Best regards Antony Findanno

2 1

Re: BGP question
by Robert Scott 11 Nov '04

11 Nov '04

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.69.68.231 4 7939 2462962 2213063 7460478 3 0 10w1d 148815 68.216.192.17 4 6380 3045064 102934 7460454 0 0 1d15h 147463 131.247.47.238 4 5661 336539 102895 7460478 0 0 4w2d 8964 AppleBees says "No Anheuser" Robert Scott says "NO APPLEBEES!" Join The Boycott! Robert D. Scott Associate Director Computer Services and Telecommunications Network Operations University of Central Florida Robert(a)mail.ucf.edu CSB-310 407-823-0662 Voice 407-823-5476 FAX 345-0662 Sun-Com 877-549-5390 Pager >>> Henning Brauer <hb-nanog(a)bsws.de> 11/11/2004 6:11:31 AM >>> * adrian kok <adriankok2000(a)yahoo.com.hk> [2004-11-10 21:32]: > 2/ I saw article. "a full BGP feed is about 110,000 > routes." we're at 140..150k these days. > Do you have experience that AMD64 with 3G memory in > Unix Box can handle it? I've done it on a soekris box, that is, a 266MHz Geode CPU with 128MB RAM, using OpenBSD and OpenBGPD... -- Henning Brauer, BS Web Services, http://bsws.de hb(a)bsws.de - henning(a)openbsd.org Unix is very simple, but it takes a genius to understand the simplicity. (Dennis Ritchie)

1 0

Cisco 6509 DC Power Supplies...
by Brian W. Gemberling 11 Nov '04

11 Nov '04

I have 2 6500 DC Power Supplies I don't need anymore. They are FREE to a good home! I'd prefer someone to just pick them up locally to me, they are in the Ashburn Equinix facility. If anyone is interested, drop me a line. They are pretty much brand new and work fine, they are not for shooting or blowing up (although I have a old switch if you are looking for something to destroy). Thank You, Brian W. Gemberling

1 0

Telcordia to sell for $1.3B: newspaper
by Fergie (Paul Ferguson) 11 Nov '04

11 Nov '04

"NEW YORK (CNN/Money) - Two investment firms are about to close a deal to acquire telecommunications software company Telcordia Technologies Inc. for about $1.3 billion, a newspaper reported Thursday." http://money.cnn.com/2004/11/11/news/midcaps/telcordia/index.htm - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Re: How to Blocking VoIP ( H.323)
by J. Oquendo 11 Nov '04

11 Nov '04

> 1) Your problem is a wonky broken H.323 that dies when it > gets a connection from outside. > > 2) Your problem is "corporate insider uses VoIP to call a > competitor and leak trade secrets". > > 3) Your problem is "VoIP users bypassing billing for telephone calls". > > All three will require different solutions, and there's probably > other scenarios as well..... Definitely sounds like there is little one can do to combat against VoIP. Anyway, along with Mr. Kletnieks' views on halting someone from using VoIP (or VoIP like services a-la Skype), looking at it from an "Internal Corp." level where as an admin you would want to block someone from using Skype or so, you can probably do some form of packet filtering based on port, but, what can you do if the user decided to use proxy settings. You would likely want to do some quick network packet analysis find some common criteria for whatever it is you want to block, and then block it right at the firewall or content filter level. E.g.: Taking the common (perhaps) header strings, and or some payload information and creating some form of rule to deny this. An analysis would probably do little though if the user has some VoIP tunneling going on though, or some form of method to manipulate outbound packet information since the data would be different (if encrypted) most of the time. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

1 0

BGP question
by adrian kok 11 Nov '04

11 Nov '04

Dear all Something I don't understand and would like you to help. 1/ for the url: http://www.oreillynet.com/pub/a/network/2002/08/12/multihoming.html I don't understand those 2 steps: - Register your routing policy in a Routing Registry. - Use looking glasses to see if your announcements are visible elsewhere on the Internet. How can I register the policy? and how can I use the looking glasses to check? 2/ I saw article. "a full BGP feed is about 110,000 routes." Do you have experience that AMD64 with 3G memory in Unix Box can handle it? Thank you very much and appreciate much for your help

6 5

Re: Important IPv6 Policy Issue -- Your Input Requested
by Randy Bush 11 Nov '04

11 Nov '04

> To the end user of address space it is absolutely irrelevant how large > the total space is or what the size of the routing table is. What > matters is how much cost/effort you need to expend to get your address > space, and what you need to use it for. A guarantee of global > uniqueness has an unavoidable (and, in fact, quite significant) cost; > some uses of address space don't require global uniqueness; therefore > there will be a market demand for non-unique space. then let them make up addresses. oh, you mean they don't want to collide with global addresses? so they want nat? i though a major goal of v6 was no nat. again, you want you cake or want to eat it?

7 8

RE: How to Blocking VoIP ( H.323) ?
by Fergie (Paul Ferguson) 11 Nov '04

11 Nov '04

One might also suggest that explicit "denials", as opposed to explicit "permits", as an access-control policy is fundamentally flawed security approach in the first place.... My $.02, - ferg -- "Scott Morris" <swm(a)emanon.com> wrote: Tcp/1719 is part of the H323 Gatekeeper default ports (which can be changed) Tcp/1720 is the H.225 call setup port, and I haven't heard of this being a configurable port. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Joe Shen Sent: Thursday, November 11, 2004 6:40 AM To: NANGO Subject: How to Blocking VoIP ( H.323) ? Hi, How could it be done to block VoIP at access router? I've thought about using ACL to block UDP port 1719,but this could be overcome by modifying protocol port number. regards Joe -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

RE: Important IPv6 Policy Issue -- Your Input Requested
by Network.Security 11 Nov '04

11 Nov '04

"Depending on putting devices on 1918 for security is dangerous. " - Simon J. Lyall. Agreed. RFC 1918 is a good idea, it's not the law, and with that ISP's are not required to do anything about 1918 addr's if they choose not to. We receive a disturbingly large amount of traffic sourced from the 1918 space destined for our network coming from one of our normally respectable Tier 1 ISP's (three letter acronym, starts with 'M', ends with 'CI'). This is particularly irritating since we pay for burstable service; nice that we are paying for illegitimate traffic to come down our pipes. Their answer to this issue was: our routers can't handle the additional load that filtering 1918 traffic would cause. That's odd, I didn't think routing to Null0 (or equivalent) was all that taxing, I don't want an ACL, I want it gone in the cheapest, fastest way possible. With that it our (the global collective, not just my company) responsibility to prevent RFC 1918 traffic from entering our exiting our border; makes for an interesting definition of "private address space."

10 16