- Test - lists.nanog.org

Use squid cache at NANOG29
by John Kristoff 19 Oct '03

19 Oct '03

NANOG29 attendees, Help make my SSH sessions more responsive, use the squid cache. :-) <http://www.nanog.org/squid.html> John

1 0

Upcoming change of source AS for i.root-servers.net
by Johan Ihren 19 Oct '03

19 Oct '03

Friends, As part of the long term ambition to provide the Internet root nameservers with extremely stable homes in all possible respects we plan to change the source autonomous system for i.root-servers.net from AS8674 (NETNOD INTERNET EXCHANGE) to AS29216 (dedicated as I.ROOT-SERVERS.NET) We hope that after this change i.root-servers.net will never have to change source AS again. We intend to implement this change next week during the NANOG29 conference. Please note: a) This is a planned operation, not an emergency. b) We will not change the IP adress of the i.root-servers.net service, only the source AS. c) We will not change any of the several servers providing the i.root-servers.net service in any way. It will be the same servers at the same locations providing exactly the same service as usual. Regards, Johan Ihrén Autonomica

1 0

Verio outage
by Alex Yuriev 19 Oct '03

19 Oct '03

There is a aparently a major outage in Verio-land between Boston and Baltiore, touch as far away as Pitts. Alex

1 0

Re: IAB concerns against permanent deployment of edge-based filtering
by bmanning＠karoshi.com 19 Oct '03

19 Oct '03

> On 18 okt 2003, at 23.28, bmanning(a)karoshi.com wrote: > > and if they are useful to the folks on my network, the ports > > will be opened up. > > This is where we are disagreeing. > > Remember: > > - The Robustness Principle: "Be conservative in what you do, be liberal > in what you accept from others." [Jon Postel, RFC 793] > - The Principle Of Least Astonishment: A program should always respond > in the way that is least likely to astonish the user. [Traditional, > original source unknown] yup. remember those. > Because of this, if not the overall explicit stated (by IETF) goal is > that filtering should NOT happen, it will happen. its happend for years and is implicitly allowed. > Yes, it is an ISP, regardless of transit or edge, which is responsible > for their network. thank you. > It is my belief that statements like this from the IAB will help, as > ISP's and customers of ISP's both can see what the IAB think the goal > of operations is. Customers can say "hey, IAB says this, why don't you > run your network that way". The ISP can then explain (and in some cases > it of course makes sense what the ISP say). Such a statement from the IAB might be construed improperly, in much the same way as you claim RFCs are "improperly" interpreted by various and sundry ISP/commercial folks. If I get a customer who says "hey, IAB says this, why don't you run your network that way" and my response will be someing along the lines "vendors bugs e.g. the cisco IOS attacks via chargen, daytime et.al. or Microsoft RCP weaknesses - FIRST/CERT/SANS recommendations to mitigate DDOS. We can have a working, productive network or we can have an IAB compliant network." Now its not the IAB's fault that implementations make local optimizations or overlook coding weaknesses. The IAB should provide a sound architectural framwork and direct the IESG/IETF to advance robust, well defined protocols done the standards track (they should also encourage publication and development of novel ideas, via experimental/informational RFCs, but that is another topic). However, in the absence of the network police, (you know, the interoperability squad) it is impossible for me to put a whole lot of credence on the IAB telling me that it would be best if I would ensure that filters are only transitory. Thats nearly the same a telling me that being healthy is good. That said, no filters are permenant, some just last longer than others, depending on when problems are fixed. Cast in a different light, let me ask you this, is it better to ship products with "security" turned off or turned on? > paf >

1 0

Re: IAB concerns against permanent deployment of edge-based filtering
by bmanning＠karoshi.com 18 Oct '03

18 Oct '03

> >> why the heck does the IAB think they should tell me how to run my > >> network? > > > > ... part of the INTERnet, and we > > would like it all to interoperate end to end. that must be the royal "we"... > > you have been here > > long enough to remember when the internet was a cooperation between > > operators, yes? Sure. and why the ARPAnet evolved into MILnet/CSnet/BITnet, the NSF regionals, NSI et.al. That whole "trust but verify" threat model. And then the "evolution" into more specialized architectures, w/ folk focusing on edge & core - content and eyeballs etc. > Absolutely correct. What I personally am afraid of is if we get a > network where we by choice (yes, your choice as the operator) get > vertically oriented services instead of horisontal. Where you only can > connect to a service if you get IP packets of a specific flavor from a > specific ISP. here in is the nut. Internet Protocols should, by design, presume a fully end2end, always on model. Packets should be emitted w/ the presumption that they can reach their target. If not, its not reachable. period. If my node is in a MANET, then I should be able to reach all the nodes in that MANET. If its on Mars, then DTN should take care of packet delivery. If the transit ISP filters my prefix and throws the bits on the floor, I should complain. If the transit ISP filters the port and throws the bits on the floor, I should complain. But that is the transit ISP choice. Local Optimizations - trying to be smart about what is reachable over what transport by some "middle-box" - that is harmful. Operationally, I may chose to take links down, filter out some traffic, groom for specific network performance -over infrastructure i pay for- the whole "middle-box, firewall, NAT, or generic tunneling techniques are in play to allow end-users to circumvent network policy ... and that is bad. if there is really a concern that port filtering is inherently bad and should only be exercised as a temporary expediant, then why not open up all ports on the end systems? blocking ports 5, 7, 9, 11 and 19 are fairly common these days. is the IAB seriously suggesting that ISPs remove the filters on/for these ports? I'll stand by this mantra for -EDGE- networks: "allow what you use, block what you don't." when new, inovative applications evolve, I expect they should have thier own port(s) assigned, just like has occured in the Internet over the last 25 years. and if they are useful to the folks on my network, the ports will be opened up. stuff that tunnels w/o authorization, will be found and squashed. > The INETRnet works because as soon as you get IP packets from The > INTERnet somewhere, you can access any service which runs on top of IP > because of the transparent peering/transit agreements which exists. But where is the presumption made that -operationally- all transport substrates are interconnected? > Because of this, it is a bad thing, and really the start of a very > slippery slope, if AS:es start filtering at their edges. It can be done > for various practical reasons in short term (as you say, you are > responsible for YOUR network, YOUR part of The INTERnet), but as a long > term thing, nope. You might want to consider why EGP protocols were built in the first place... :) EGP/BGP have -policy- constraints designed in to restrict traffic. > paf -- speaking personally, but member of the IAB --bill -- speaking as devils advocate and w/o having taken my meds today. ... granted it is nice to see the IAB take an interest and take a stance. I'm more afraid that such a document will aquire the patina of "gospel" by ISPs who won't think for themselves as to why some choices should be made.

2 1

AOL E.mail issues..
by Robert Mathews 18 Oct '03

18 Oct '03

Is anyone experiencing E.mail weirdness, specifically bounces from AOL today at all? I have spoken to a number of others from various parts of CONUS, who seem to have a similar issue.. Regards.

4 4

/8 blocks allocation statistcs and current use data
by william＠elan.net 18 Oct '03

18 Oct '03

As by-product of bogons project I just posted about, we also got some interesting statistics on how much ip space is allocated and used in each /8 block. This is all available in nice graphical format at: http://www.completewhois.com/statistics/ip_statistics.htm The data above is updated every day and I'm also entering this all into rrd database and once I have enough samples rrd graphs of how much this statistics change will also be made available (but before such graphs provide really good view there must be year worth of samples or more...) -- William Leibzon Elan Networks william(a)elan.net

2 3

as6198 aggregation event
by James Cowie 18 Oct '03

18 Oct '03

On Friday, we noted with some interest the appearance of more than six hundred deaggregated /24s into the global routing tables. More unusually, they're still in there this morning. AS6198 (BellSouth Miami) seems to have been patiently injecting them over the course of several hours, between about 04:00 GMT and 08:00 GMT on Friday morning (3 Oct 2003). Here's a quick pic: http://www.renesys.com/images/6198.gif I can share more details offline. Usually when we see deaggregations, they hit quickly and they disappear quickly; nice sharp vertical jumps in the table size. This event lasted for hours and, more importantly, the prefixes haven't come back out again, an unusual pattern for a single-origin change that effectively expanded global tables by half a percent. Can anyone share any operational insight into the likely causes of this event? Has it caused any operational problems for anyone? Thanks! ---------- James Cowie Renesys Corporation

8 11

[Fwd: [IP] VeriSign to revive redirect service]
by Suresh Ramasubramanian 18 Oct '03

18 Oct '03

Ouch. -------- Original Message -------- Subject: [IP] VeriSign to revive redirect service Date: Thu, 16 Oct 2003 02:38:14 -0400 From: Dave Farber <dave(a)farber.net> Reply-To: dave(a)farber.net To: ip(a)v2.listbox.com Delivered-To: dfarber+(a)ux13.sp.cs.cmu.edu Date: Wed, 15 Oct 2003 23:30:44 -0700 (PDT) From: Joseph Lorenzo Hall <jhall(a)SIMS.Berkeley.EDU> Subject: VeriSign to revive redirect service To: Dave Farber <dave(a)farber.net> --- http://news.com.com/2100-1038_3-5092133.html VeriSign to revive redirect service by Declan McCullagh VeriSign will give a 30- to 60-day notice before resuming a controversial and temporarily suspended feature that redirected many .com and .net domains, company representatives said Wednesday. Speaking before an unusual gathering of technical experts in Washington, D.C., VeriSign said its own re-evaluation of its Site Finder redirection service found "no identified security or stability problems." When it was active, Site Finder added a "wild card" for .com and .net domains that snared queries to nonexistent Internet sites and forwarded them to VeriSign's own servers. That confused some antispam filters and other network utilities, a side effect that VeriSign downplayed on Wednesday by arguing that Site Finder's benefits to end users--a search screen instead of a an error message--outweighed the costs to network administrators. "One of the segments of the community that has not been looked at in this whole issue, in my opinion, is the user community," VeriSign Vice President Chuck Gomes said. "They're very relevant." In a presentation, VeriSign said that 35 companies were confidentially briefed about Site Finder before its debut and they reported "no issues" or problems before its launch on Sept. 15. Its own expert group--including the chief technology officers of Brightmail and Morgan Stanley--reviewed Site Finder and decided that most issues were "minor or inconvenient," VeriSign said. Before resuming Site Finder, VeriSign said it would address specific criticisms by adding foreign language support to Site Finder and tweaking the way e-mail to nonexistent domains worked. [...] ----------------------------------------------------------------- Joseph Lorenzo Hall Graduate Student http://pobox.com/~joehall "When life gives you SARS, make sarsaparilla." --Cory Doctorow, http://www.craphound.com/ -------------------------------------

8 8

Tomatoes for Verisign at NANOG 29
by JC Dill 18 Oct '03

18 Oct '03

Dan and Owen, I nominate you two for the tomato acquisition and distribution committee. To recap: At NANOG 29 in Chicago, on Monday October 20th at 9:15 am a session on "VeriSign's Wildcard Record: Effects and Responses" will be held, with Mark Kosters and Matt Larson from VeriSign and Suzanne Woolf from ISC: <http://www.nanog.org/mtg-0310/dns.html> If you are attending NANOG 29, please attend this session and wear a red shirt. If possible, please buy/bring a tomato. Take your tomato to the front of the room and place them in a pile before Verisign, to make it absolutely clear how you feel about Verisign's wildcards and sitefinder. Please do not throw your tomatoes. I wish I could be there! Now to make sure that someone with clue from the Chicago Sun Times and the Chicago Tribune are both there, with photographers. Does anyone on this list have any contacts at either of these papers? jc

16 21