- Test - lists.nanog.org

Re: updated root hints file (fwd)
by bill 06 Feb '04

06 Feb '04

> Date: Fri, 30 Jan 2004 11:39:40 -0500 > To: bill <bmanning(a)karoshi.com> > Subject: Re: updated root hints file > > I thought the RSSAC site was www.root-servers.org. > root-servers.org is -NOT- the rssac site. --bill

5 6

RE: Verizon Mail Troubles
by Curtis Maurand 06 Feb '04

06 Feb '04

Hello all, Thanks to all who responded to my request for help with verizon email issues. Someone from Verizon did contact me and clued me in as to what was happening. It turns out procmail is rewriting a header with a fqdn for the mail server which doesn't have a specific mx record set for it. Again, Thanks to all who responded. Curtis Maurand Principal Maine Line Systems

1 0

RE: ISS X-Force Security Advisories on Checkpoint Firewall-1 and VPN-1
by Ingevaldson, Dan (ISS Atlanta) 06 Feb '04

06 Feb '04

ISS notified Check Point on 2/2/2004, and Check Point made their update for the FW-1 HTTP issue on 2/4/2004. It is our policy to only release public information when the affected vendor has published information and/or released a fix. Check Point only released one fix on 2/4/2004, not two fixes to address both issues. As stated in the ISS VPN-1 Advisory, Check Point no longer supports the VPN-1 4.1 line, and recommends that customers upgrade to NG. ------------------ Daniel Ingevaldson Director, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Steven M. Bellovin Sent: Thursday, February 05, 2004 2:56 PM To: Rubens Kuhl Jr. Cc: nanog(a)merit.edu Subject: Re: ISS X-Force Security Advisories on Checkpoint Firewall-1 and VPN-1 In message <02e501c3ec1f$9a833fe0$020ba8c0@NOTEBOOK>, "Rubens Kuhl Jr." writes: > > > >Isn't it curious that two unrelated issues have been reported to >CheckPoint at the same day and the patches came out on the same day ? >Am I too paranoid, or it seems that CheckPoint had previous knowledge >of the bugs and they agreed with ISS which date would be stated as >notification to CP to make it appears that a quick response (two days) >has been achieved on those issues ? Why is that bad? I have no objection to giving vendors a reasonable amount of time to fix problems before announcing the whole. Or is your point that two days hardly seems like enough time to develop -- and *test* -- a fix? --Steve Bellovin, http://www.research.att.com/~smb

1 0

Are SW upgrades needed in MPLS core networks?
by Pekka Savola 06 Feb '04

06 Feb '04

Hi, Just taking a quick poll, as we don't use MPLS and I think this is an interesting thing to know. One of the many (maybe misguided) arguments for MPLS is that you don't need to perform softwqare (or other similar) upgrades in the core network, and the "intelligence" is pushed to the to the edges of the MPLS cloud. I'd like to get a feel how correct this "argument" is in practice. So, if you have had to upgrade the core equipment, please tell. If you haven't (due to the "MPLS design"), that might be interesting as well. If you had to upgrade, please also indicate the reason for that (fixing bugs ("minor upgrade")? providing new features, if so which features? etc.?) Please respond off-list if you feel so. Thanks. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

6 14

Re: Are SW upgrades needed in MPLS core networks?
by Rubens Kuhl Jr. 06 Feb '04

06 Feb '04

> > I don't get why Juniper and Cisco trie-lookup forwarding would differ in > > comparing IPv4 and IPv6; Juniper does a 8+1+1+1+1+... search until a leaf > > node is found, while Cisco does 16+8+8 (or something near it but still with > > 3 phases); for both architetures, IPv6 longer addresses implies walking more > > deeply into the tree in order to find where to route. > > ahhh. you have been watching marketing architecture presentations. Usually it's a good way to learn about the architecture of the competitor's(i.e, not the company of the presenter) router; watch both of them and you get a pretty good image of what they are. > otoh, we have been using real routers. Those real routers have real architetures with what behaviour regarding prefix-length ? Rubens

1 0

ev1.net security contact
by John Obi 06 Feb '04

06 Feb '04

Hello, Can I get someone from ev1.net contact me off the list? it's security/hacking issue. Thanks, -J __________________________________ Do you Yahoo!? Yahoo! Finance: Get your refund fast by filing online. http://taxes.yahoo.com/filing.html

1 0

RE: ISS X-Force Security Advisories on Checkpoint Firewall-1 and VPN-1
by McBurnett, Jim 06 Feb '04

06 Feb '04

-> ->> Why is that bad? I have no objection to giving vendors a reasonable ->> amount of time to fix problems before announcing the whole. -> Or is your ->> point that two days hardly seems like enough time to develop -- and ->> *test* -- a fix? HMMM, If I was a real hacker, and I found the problem, might I also know the fix? And if I was really nice, would I give that fix to the vendor? Or could it be that a former Checkpoint employee is now an ISS employee? Or .....? J

2 1

Re: MTUs - Was: Strange public traceroutes return private RFC1918 addresses
by Michael.Dillon＠radianz.com 06 Feb '04

06 Feb '04

>So there we are. Want to bet on whether 40 GigE will still have the 1522 >byte limit? Given the growing number of folks who will only buy xGigE equipment that supports 9000 byte MTUs I'd say the chances are very good that 40GigE will no longer have a 1522 byte limit. --Michael Dillon

3 2

The Cidr Report
by cidr-report＠potaroo.net 06 Feb '04

06 Feb '04

This report has been generated at Fri Feb 6 21:47:41 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 30-01-04 129929 90863 31-01-04 130004 91032 01-02-04 130080 91025 02-02-04 130010 91079 03-02-04 130093 91091 04-02-04 130207 91165 05-02-04 130288 91107 06-02-04 130549 91114 AS Summary 16505 Number of ASes in routing system 6640 Number of ASes announcing only one prefix 1383 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 AT&T WorldNet Services 73517312 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 06Feb04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 130505 91103 39402 30.2% All ASes AS4323 679 203 476 70.1% TW-COMM Time Warner Communications, Inc. AS6197 720 297 423 58.8% BATI-ATL BellSouth Network Solutions, Inc AS7018 1383 962 421 30.4% ATT-INTERNET4 AT&T WorldNet Services AS701 1350 957 393 29.1% ALTERNET-AS UUNET Technologies, Inc. AS7843 506 124 382 75.5% ADELPHIA-AS Adelphia Corp. AS27364 382 33 349 91.4% ACS-INTERNET Armstrong Cable Services AS6198 545 214 331 60.7% BATI-MIA BellSouth Network Solutions, Inc AS4134 653 329 324 49.6% CHINANET-BACKBONE No.31,Jin-rong Street AS22909 337 18 319 94.7% DNEO-OSP1 Comcast Cable Communications, Inc. AS22773 342 34 308 90.1% CCINET-2 Cox Communications Inc. Atlanta AS1239 949 664 285 30.0% SPRINTLINK Sprint AS4355 385 101 284 73.8% ERMS-EARTHLNK EARTHLINK, INC AS1221 899 642 257 28.6% ASN-TELSTRA Telstra Pty Ltd AS17676 294 41 253 86.1% GIGAINFRA Softbank BB Corp. AS6347 329 82 247 75.1% DIAMOND SAVVIS Communications Corporation AS9583 341 103 238 69.8% SATYAMNET-AS Satyam Infoway Ltd., AS6140 358 126 232 64.8% IMPSAT-USA ImpSat AS25844 243 16 227 93.4% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS6478 259 40 219 84.6% ATT-INTERNET3 AT&T WorldNet Services AS209 722 511 211 29.2% ASN-QWEST Qwest AS14654 214 3 211 98.6% WAYPORT Wayport AS13083 216 8 208 96.3% AS13083 Mannesmann Datenverarbeitung Autonomes System AS11305 242 41 201 83.1% INTERLAND-NET1 Interland Incorporated AS2386 417 229 188 45.1% INS-AS AT&T Data Communications Services AS20115 608 422 186 30.6% CHARTER-NET-HKY-NC Charter Communications AS5668 345 160 185 53.6% AS-5668 CenturyTel Internet Holdings, Inc. AS4519 202 19 183 90.6% MAAS Maas Communications AS6327 206 28 178 86.4% SHAW Shaw Communications Inc. AS9929 200 30 170 85.0% CNCNET-CN China Netcom Corp. AS15270 210 40 170 81.0% AS-PAETEC-NET PaeTec.net -a division of PaeTecCommunications, Inc. Total 14536 6477 8059 55.4% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 ANDARA-HSI Andara High Speed Internet c/o Halifax Cable Ltd. 64.62.126.0/23 AS25700 SWIFTDESK SWIFTDESK VENTURE 66.114.0.0/19 AS16526 BIRCH-TELECOM Birch Telecom, Inc. 66.114.28.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 66.114.29.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 66.114.30.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 66.114.31.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 69.8.128.0/17 AS7260 NORLIGHT Norlight Telecommunications 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.64.84.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.136.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.144.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.152.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.154.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.114.156.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.160.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.0.0/20 AS4658 NETFRONT-AS NETFRONT I.T. LIMITED (HONG KONG) 202.70.16.0/22 AS17888 SINGTEL-HK SingTel Hong Kong Limited 202.70.240.0/20 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.72.112.0/22 AS22351 INTELSAT-1 INTELSAT 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.128.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.142.0/24 AS30362 HPT-ASN Hawaii-Pacific Teleport 202.86.171.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.172.0/23 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.190.0/24 AS4750 loxley-th Loxley Information Co., Ltd. 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 203.32.4.0/23 AS7617 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.86.2.0/23 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.111.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 204.69.144.0/22 AS5668 AS-5668 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBIT Exobit Networks Inc. 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.5.208.0/20 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 210.213.0.0/19 AS6453 GIEUROPE Teleglobe America Inc. 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.36.46.0/24 AS7176 GENUITY-AS7176 Genuity 216.36.47.0/24 AS7176 GENUITY-AS7176 Genuity 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Re: MTUs - Was: Strange public traceroutes return private RFC1918 addresses
by Kevin Oberman 05 Feb '04

05 Feb '04

> From: Warren Kumari <warren(a)kumari.net> > Date: Thu, 5 Feb 2004 15:04:00 -0500 > Sender: owner-nanog(a)merit.edu > > > Ok, I know that this is getting away from the original thread, but I've > always wondered this... > > Why is the MTU on Ethernet 1500 bytes? I have looked through various > docs (eg IEEE Std 802.x) and can find where maxUntaggedFrameSize is > listed as 1518 octets, but there is no mention of why this was chosen. > I know where the minimum frame size comes from (CSMA/CD and propagation > times, etc), but the maximum frame size number sounds fairly arbitrary. It is based on the original 10Base5 (yellow hose) Ethernet and was largely "picked out of the air" to meet several design criteria. One was the cost of buffering on the card. Back then, 2K of buffer was expensive and the designers wanted to allow for $500 NICs. This was in the late 1970s and this was no trivial feat. Early Ethernet cards were several K and taps were typically over $200. And that awful AUI cable that always came loose (the designer has publicly apologized for that) was usually at least $50. Another issue was how long a system with a packet ready to transmit might have to wait for a transmission to end so that it could have a shot at the wire. (Remember that in the 10Base5 days it was not uncommon to see 50 or 100 taps on a single cable.) At 10 Mb/s, long frames would have been prohibitively time consuming. Also, a large percentage of network traffic in these pre-web days was telnet with huge numbers of 64 byte frames and few over 1K. So 1518 seemed reasonable. When FastEthernet was developed by Grand Junction, the idea of expanding the frame size first came up. At 100 Mb/s, 1500 bytes no longer took very long. But that made for problems in bridging between 10Base5 and 100Base-T networks. There was no good way to break up a 4K frame into 1518 byte frames in a switch and, while many schemes were suggested none proved practical and the idea faded. Then came GigE and 1518 bytes was getting to look very silly. But the issues of bridging and fragmentation remained and, after LOTS of debate, the 1518 byte frame limit was left in place. But the idea did not die and many companies started producing equipment that could handle larger frame sizes. It worked pretty well because most GigE links were point-to-point between end systems switching to slower speed links less common. Finally we got to 10GigE and 1522 (extended for vLANs) was absolutely ridiculous, but at least one large vendor fought had to retain the size and, in the end, the 10GigE spec specified the same maximum frame size. The only reason now was cost. At 10GigE, buffers already had to be very big as a great many frames had to be stored just to handle "normal" traffic was congestion. Some vendors were selling relatively cheap switches with VERY limited buffering. To move from 1520 to 4K or 9K would have required a significant increase in buffer size and that would have made the switches much more expensive. So there we are. Want to bet on whether 40 GigE will still have the 1522 byte limit? -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

3 3