- Test - lists.nanog.org

Re: Enterprise Multihoming
by John Neiberger 11 Mar '04

11 Mar '04

>>> Daniel Roesen <dr(a)cluenet.de> 3/11/04 9:13:04 AM >>> > >On Thu, Mar 11, 2004 at 09:04:57AM -0700, John Neiberger wrote: >> For the past few years it has been fairly common for non-ISPs to >> multihome to different providers for additional redundancy in case a >> single provider has problems. I know this is frowned upon now, >> especially since it helped increase the number of autonomous systems and >> routing table prefixes beyond what was really necessary. > >Who defines what is "really necessary"? What is your understanding >of "really necessary" when it comes to the desire to be commercially >and technically independent of your suppliers? > >It's this discussion again. That goes off in entirely the wrong direction but I guess I'll clarify that statement. :-) My point was that most companies could have met their connectivity requirements by simply getting multiple connections to the same provider from the beginning. However, among the less-technical managers it seemed to be popular to demand connectivity to multiple ISPs. It seems that me that this was not really necessary from a technical perspective in many cases, it just made people feel good. I don't really want to focus on that, though; I'm more interested in the situation as it stands today. If a company were going to add brand new Internet connectivity where it didn't exist before, what factors would you use to determine if multiple ISPs should even be considered? Given the stability of the larger ISPs and the general lack of true BGP expertise at many companies, is the potential benefit of multihoming to different ISPs worth the added risk and responsbility that comes with using BGP? Our BGP configuration isn't very difficult to understand but we do have a lack of BGP knowledge in the department and some additional training is in order. However, might it not be better to just simplify our connectivity and remove BGP altogether? Sure, I like BGP as much as the next guy but there's no sense in running it just because we can. :-) Thanks, John --

2 1

RE: Enterprise Multihoming
by McBurnett, Jim 11 Mar '04

11 Mar '04

Look at it this way: If Multi-homing to ensure maximum reliabilty was not a good thing: why would XYZ isp do it? Take this example: Remember last year (or year before?) when MCI had the routing issue on the east coast? I had a friend that had 2 T-1's to MCI, he lost all reachability for over 5 hours. I had another friend that had a T-1 from MCI and one from AT&T. He stayed up, and so did his ecommerce site. So the end questions is: Do you trust your upstream enough to bank your business, or more importantly your reputation as an IT professional, on the ability of everyone at your ISP to maintain their network and everything that gives you access 99.999% of the time? Jim ->-----Original Message----- ->From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of ->Gregory Taylor ->Sent: Thursday, March 11, 2004 11:41 AM ->To: John Neiberger; nanog(a)merit.edu ->Subject: Re: Enterprise Multihoming -> -> -> ->Mutli-homing a non-ISP network or system on multiple carriers ->is a good ->way to maintain independent links to the internet by means of ->different ->peering, uplinks, over-all routing and reliability. My ->network on NAIS ->is currently multi-homed through AT&T. I use a single ->provider as both ->of my redundant links via 100% Fiber network. Even though this is ->cheaper for me, all it takes is for AT&T to have some major ->outage and I ->will be screwed. If I have a backup fiber line from say, Global ->Crossing, then it doesn't matter if AT&T takes a nose dive, I ->still have ->my redundancy there. -> ->That is why most non-ISPs hold multihoming via different providers as ->their #1 choice. -> ->Greg -> ->John Neiberger wrote: -> ->>On another list we've been having multihoming discussions again and I ->>wanted to get some fresh opinions from you. ->> ->>For the past few years it has been fairly common for non-ISPs to ->>multihome to different providers for additional redundancy in case a ->>single provider has problems. I know this is frowned upon now, ->>especially since it helped increase the number of autonomous ->systems and ->>routing table prefixes beyond what was really necessary. It ->seems to me ->>that a large number of companies that did this could just have well ->>ordered multiple, geographically separate links to the same provider. ->> ->>What is the prevailing wisdom now? At what point do you feel ->that it is ->>justified for a non-ISP to multihome to multiple providers? I ask ->>because we have three links: two from Sprint and one from Global ->>Crossing. I'm considering dropping the GC circuit and adding another ->>geographically-diverse connection to Sprint, and then ->removing BGP from ->>our routers. ->> ->>I see a few upsides to this, but are there any real downsides? ->> ->>Flame on. :-) ->> ->>Thanks, ->>John ->>-- ->> ->> ->> ->> -> -> ->

1 0

RE: Counter DoS
by Pendergrass, Greg 11 Mar '04

11 Mar '04

By "The Art of War on the Internet" I didn't mean information warfare, that's been with us as long as there's been information and the internet is certainly going to be a major part of that. What I am against is anyone trying to popularize the idea of the internet as a battleground where one uses force and deception to "gain ground". It's just another case of people wrongly attempting to fit somthing that they don't understand into a framework that they do understand, thereby creating a fallacy. Trying to base a product off of a flawed idea is bound to fail but also likely be a major irritation before it does. GP -----Original Message----- From: Etaoin Shrdlu [mailto:shrdlu@deaddrop.org] Sent: 11 March 2004 14:58 To: Nanog Subject: Re: Counter DoS "Pendergrass, Greg" wrote: > > I can see now that it's only a matter of time before some nut writes "The > Art of War in the Internet". I read the whitepaper, it goes on a lot about > how defensive policies are ineffective but doesn't really say why active > response has never been tried: Ask, and ye shall receive. http://btobsearch.barnesandnoble.com/textbooks/booksearch/isbnInquiry.asp?us erid=2XH986JPUE&btob=Y&isbn=1581128576&TXT=Y&itm=1 I thought that someone mentioned that Mr. Forno was reputed to be on staff with these folk. > Their proposition is a terrible idea and their "rules of engagement" would > be funny instead of frightening if it wasn't serious I note that he also has a title from last year, which seems applicable here: Weapons of Mass Delusion (ISBN 158961111X) I will point out that I cannot take seriously a company (Symbiot) that depends on a shockwave plugin to put up a web page. Pity that they came out so aggressively; it might have been an interesting product. Hype can kill as well as sell. -- It is by caffeine alone I set my mind in motion. It is by the beans of Java that thoughts acquire speed, the hands acquire shaking, the shaking becomes a warning. It is by caffeine only I set my mind in motion. Vodafone Global Content Services Limited Registered Office: Vodafone House, The Connection, Newbury, Berkshire RG14 2FN Registered in England No. 4064873 This e-mail is for the addressee(s) only. If you are not an addressee, you must not distribute, disclose, copy, use or rely on this e-mail or its contents, and you must immediately notify the sender and delete this e-mail and all copies from your system. Any unauthorised use may be unlawful. The information contained in this e-mail is confidential and may also be legally privileged.

1 0

RE: Counter DoS
by Pendergrass, Greg 11 Mar '04

11 Mar '04

I can see now that it's only a matter of time before some nut writes "The Art of War in the Internet". I read the whitepaper, it goes on a lot about how defensive policies are ineffective but doesn't really say why active response has never been tried: A. Most of the time dDOS traffic is from spoofed sources anyway so whichever machine you "return fire" on is probably not the one that attacked you. B. NAT translation means a hacker has a tailor-made defense against any active repsonse. C. Even if you can directly attack a machine being used against you it's almost certainly not the perpetrator's box, he/she is sitting half a world away. The box you intentionally destroy is likely some innocent family PC that was taken over using some unplugged windows security hole. D. Widely deployed active defense will give an attacker a new form of dDOS attack, spoof the source of the one you want to hit in attacking several "active defense" systems and watch them attack your target for you. Their proposition is a terrible idea and their "rules of engagement" would be funny instead of frightening if it wasn't serious GP -----Original Message----- From: Joshua Brady [mailto:jbrady@neoins.com] Sent: 11 March 2004 01:27 To: isp-chat(a)isp-chat.com Cc: nanog(a)merit.edu Subject: Counter DoS http://news.zdnet.co.uk/internet/security/0,39020375,39148215,00.htm Comments? Vodafone Global Content Services Limited Registered Office: Vodafone House, The Connection, Newbury, Berkshire RG14 2FN Registered in England No. 4064873 This e-mail is for the addressee(s) only. If you are not an addressee, you must not distribute, disclose, copy, use or rely on this e-mail or its contents, and you must immediately notify the sender and delete this e-mail and all copies from your system. Any unauthorised use may be unlawful. The information contained in this e-mail is confidential and may also be legally privileged.

2 1

RE: Counter DoS
by Michael.Dillon＠radianz.com 11 Mar '04

11 Mar '04

>I wonder, are they planning to launch these DDoS attacks from >compromised hosts belonging to unwitting accomplices like the >bad guys do? Could they be the people behind NetSky? We know now that Bagle and MyDoom come from spammer gangs but I haven't heard if anyone has identified a motive behind Netsky yet. I suppose that Symbiot is the logical next step. Now that there is a market for compromised hosts to build distributed networks for DoS, DNS, or anonymous hosting the logical next step is for a legitimate company (or semi-legitimate) to step into that market and try to dominate it. If the ISP and the vendor community won't work together to build the tools and systems needed to identify and block DDoS emitters then this is the inevitable result. If it goes much further then ISPs risk being sued for blocking DDoS because they will also be blocking somebody's revenue stream as well. --Michael Dillon

1 0

Re: Counter DoS
by Brandon Butterworth 11 Mar '04

11 Mar '04

> The Symbiot whitepaper on their service describes a process with a > little more imagination Like hooking it up to DARPA Grand Challenge winners? http://abcnews.go.com/sections/SciTech/WorldNewsTonight/robot_race_darpa_04… > I applaud the idea of a outsourced department that will manage the > denial of service, and "hordes of script kiddie" trouble with sending a droid round to kick ass is you've just made Skynet V0.1 brandon

2 1

Re: Counter DoS
by Baldwin, James 11 Mar '04

11 Mar '04

http://www.symbiot.com/media/iwROE.pdf The Symbiot whitepaper on their service describes a process with a little more imagination and use than simply flooding attacking nodes with packets. It describes a process which appears to require human intervention through an Operations Center to aid in tracking down offending nodes and notifying the offenders service providers prior to an deployment of active defenses. That being said, it also specifically mentions "distributed denial of service counterattacks" as a not quite so last resort, and possibly automated response gesture for multiple identified offenders with whom intervention from service providers and other authorities has not been forth coming. I applaud the idea of a outsourced department that will manage the denial of service, and "hordes of script kiddie" (nod to Ranum) problems that plague modern networks. Anything that keeps me from being distracted from more interesting lines of thought, rather than constantly following up on outside nuisances is a Good Thing (tm). However, the deployment of "active defenses" in response to a failure of service providers to adequately secure their egress and ingress points is not a choice any reasonable person would make. Vigilante justice might be rewarding in the short term, but I choose not to leave the judgment of friend and foe in the hands of someone with large amounts of bandwidth at the tips their itchy trigger fingers. James Baldwin WorldWide Technology, Services, and Operations Operations Center Electronic Arts, Inc.

2 1

Check Your Routing Table! Production Use of 84/8 Imminent.
by Daniel Karrenberg 11 Mar '04

11 Mar '04

The first allocation out of 84/8 has happened. It is *now* high time to check whether you see the pilot prefixes 84.192/16 and 84.255.248/21. If you do not see both of these prefixes it is extremely likely that you will have a connectivity problem very shortly. We also suggest that you check any packet filters you may be responsible for. Regards Daniel Karrenberg RIPE NCC ------ Notes: 84/8 has been allocated by the IANA on November 17th 2003, almost 4 months ago. The fact has been announced on this list a couple of times since. Routing decisions are fully within the responsibility of the network operators. The IANA and the RIRs will only announce which parts of the address space are currently in use. They have no authority whatsoever over routing decisions taken by you and other network operators. More details about the pilot prefixes can be found at http://www.ripe.net/ripe/draft-documents/deboganising-draft.html A visibility comparison of the pilot prefixes with some production prefixes can be found at http://www.ris.ripe.net/debogon/debogon.html Those interested in history, see http://www.ris.ripe.net/debogon/ More information on how to do Bogon filtering efficiently and reliably can be found at Team CYMRU: http://www.cymru.com/Bogons/index.html Unfortunately we are not currently able to provide a host within the pilot prefixes that can reliably answer pings, nor are we able to do connectivity checks from there. The allocation had to happen before we were ready with this part of the pilot prefix pilot.

1 0

AT&T Outage 01:25-01:50 AM EST
by pr＠isprime.com 11 Mar '04

11 Mar '04

Anyone else notice that little AT&T outage just now? All of their routes just flapped, and pinging their side of /30's from level3 and Teleglobe in NYC, I had ~1.0sec ping times. Curious to know what went wrong... --Phil

8 8

Greetings
by Gregory Taylor 11 Mar '04

11 Mar '04

Hello Everyone, I'm new to this mailing list and as such I would like to introduce myself. My name is Gregory Taylor. Some of you know who I am and some of you don't. For those who don't, I am a network and systems engineer up here in the rainy northwest. I'd just like to say hello to everyone and I hope that I can contribute to any discussions you may have constructively and be as helpful as I possibly can. Thank You, -- N E T W O R K A T L A N T I S Premium Internet Services ========================================= Gregory Taylor = Network Engineer ========================================= Email: taylog(a)networkatlantis.com ========================================= Visit us at http://www.networkatlantis.com

1 0