- Test - lists.nanog.org

RE: Pitfalls of annoucing /24s
by Forrest 15 Oct '03

15 Oct '03

This is just one of the many reasons why we need ARIN proposal 2002-3 to be approved. So that small networks that wish to multihome don't have issues with networks filtering out their /24 along with all the other garbage /24's that are announced. http://www.arin.net/policy/2002_3.html If you support 2002-3 I urge you to get on the ARIN Public Policy Mailing List (PPML) and voice your opinion. http://www.arin.net/mailing_lists/index.html Forrest -----Original Message----- From: H. Michael Smith, Jr. [SMTP:michael@awtechnologies.com] Sent: Wednesday, October 15, 2003 4:24 PM To: 'Phil Rosenthal'; 'John Palmer' Cc: nanog(a)merit.edu Subject: RE: Pitfalls of annoucing /24s What about the /24's that many ISPs (especially tier 2-3) are assigning to multi-homed customers? What about an IX or "critical infrastructure providers" that may be issued a /24 from ARIN (Policy 2001-3)? Although it may be rare that a large aggregate would become unreachable to a "large" network, doesn't the possibility exist that a customer with a /24 would become unreachable (to some) due to the aggregate dropping out even though the /24 should still be reachable? That scenario may not be very likely, but the question of assymetric routing and one's ability to balance traffic become issues. Assigning a lower preference to /24's would be a lot friendlier than just throwing them away. If I am way off base, I fully expect to be corrected (with volume). My flame retardant suit is in place. Michael -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Phil Rosenthal Sent: Wednesday, October 15, 2003 4:47 PM To: John Palmer Cc: nanog(a)merit.edu Subject: Re: Pitfalls of annoucing /24s http://info.us.bb.verio.net/routing.html#PeerFilter That's how Verio does it, and I assume, that's how most people who filter by length do it as well. --Phil On Oct 15, 2003, at 4:40 PM, John Palmer wrote: > > Good question. > > You know there are thousands of legacy /24's out there that were > allocated by > IANA as /24's How can you aggregate them up if all you have is the /24? > > To those who filter out /24's - how is this done - just by the netmask > size? > > ----- Original Message ----- > From: "Jean-Christophe Smith" <jsmith(a)vitalstream.com> > To: <nanog(a)merit.edu> > Sent: Wednesday, October 15, 2003 15:34 > Subject: Pitfalls of annoucing /24s > > >> >> >> In current practice would there be serious jeopardy of portions of the >> internet not being able to reach this address space due to bgp >> filters or >> other restrictions? What is the smallest acceptable block of IPs that >> can be >> announced without adverse or unpredictable results? Verio would most >> likely >> be picking up these routes from us. I don't want to cause a religious >> debate, but I am interested in what the industry consensus is. >> >> I'm just doing some research, any comments would be appreciated. >> >> Thanks, >> Jean-Christophe Smith >> >> > > --Phil Rosenthal ISPrime, Inc.

1 0

Fw: Re: Block all servers?
by Fred Heutte 15 Oct '03

15 Oct '03

The new issue of Network Magazine has a cover story that may be worth a look: "SSL VPNs: Remote Access for the Masses," by Andrew Conry-Murray, which makes a pretty convincing case for the use of SSL VPNs instead of IPSec. A lot of this is still-emerging stuff and the author, to his credit, doesn't pull any punches saying so. But it does make the point that, although IPSec has many admirable design ideas, deployment is sticky. http://www.networkmagazine.com/shared/article/showArticle.jhtml?articleId15… In a similar vein is Lisa Phifer's "VPNs: Tunnel Visions, How do SSL VPNs match up with their older IPSec cousins?" in the August issue of Information Security: http://infosecuritymag.techtarget.com/ss/0,295796,sid6_iss21_art83,00.html Naturally, given the audience, she focuses much more on the security specifics. Of particular interest: IPSec prevents packet modification to thwart man-in-the-middle attacks. However, this strong security feature also generates operational problems. NAT frequently breaks IPSec because it modifies packets by substituting public IP addresses for private ones. Many IPSec products implement NAT traversal extensions, but support for this feature isn't universal, and interoperability is still an issue. SSL is almost as tough against man-in-the-middle attacks, without IPSec's NAT conflict. SSL rides on TCP, so it's insulated from IP and port modifications, and thus passes easily through NAT. SSL carries sequence numbers inside encrypted packets to prevent packet injection, and TLS uses message authentication to detect payload changes. And Phifer notes later that one of the critical issues with SSL VPNs is whether you want to "Webify" everything. For all of us (I hope), the net is much more than just port 80. fred

3 2

Any RBLs still alive that list DSL/Dialup/Cable Modem dynamic addr ranges?
by John Palmer 15 Oct '03

15 Oct '03

Are there any RBLs still out there that list cable modem, dialup and dsl IPs? (anything dynamically assigned or home users)? DIALUPS.MAIL-ABUSE.ORG does not seem to be functioning.

6 6

SECSAC Meeting on Verisign Sitefinder Service
by Brian Bruns 15 Oct '03

15 Oct '03

http://media.icann.org/ramgen/encoder/secsac.rm Live feed of the meeting. Having listened to just about 5 minutes so far, Verisign is fudging quite a bit on how many people like the sitefinder service. Its almost unreal to hear what they are saying. -------------------------- Brian Bruns The Summit Open Source Development Group Open Solutions For A Closed World / Anti-Spam Resources http://www.sosdg.org ICQ: 8077511

1 0

abuse from a user of this list
by Andrew D Kirch 15 Oct '03

15 Oct '03

Last night in conjunction with the attacks on my DSL line and the Summit Open Source Development Group, I received a threatening phone call on my home business line at 1:44 in the morning (GMT-5 CST Indiana-East). My roommate answered the call, and the dialog was simply "how's your DSL B----!", then the caller hung up. This evening my roommate informed me of the call, and told me that the caller had not blocked caller ID, the number in question being 320-282-5940. I tracked this number to a T Mobile cellphone in St Cloud, MN. Thinking this might be the kiddie responsible for the attack I made a *67 call back. I was greeted with the voice mail of Matthew Hallacy (AKA poptix) who has used this forum to take cheap shots at myself and my staff repeatedly. Now he has denigrated to simple threats and harassment off list that didn't even get to me but to my roommate who is entirely uninvolved in this. I must note that this incident greatly saddened me, as I would have thought that all on this list have suffered Denial of Service attacks, and understand the seriousness and severity of these attacks, obviously one of us doesn't get it. please contact me if you have questions regarding this incident. -- Andrew D Kirch | trelane(a)2mbit.com | Security Admin | Summit Open Source Development Group | www.sosdg.org

8 10

Blocking servers: Comcast accidently blocks gamers
by Sean Donelan 15 Oct '03

15 Oct '03

People use the Internet for a lot of different reasons. Its not all client/server access. End-to-end communications occurs between many applications. Its always interesting to watch what things break when ISPs start filtering ports, even if it happens accidently. http://news.com.com/2100-1043_3-5091176.html A Comcast representative confirmed that the problem was with the cable company. A routine upgrade of the software some Comcast routers use inadvertently blocked access to certain server ports, the representative said, adding that the problem was fixed late Monday. ISPs commonly use port-blocking rules to restrict access to a server that may be generating hacking attacks or other objectionable activity.

2 1

RIPE NCC allocations to African LIRs
by leo vegoda 15 Oct '03

15 Oct '03

Dear Colleagues, The RIPE NCC received the IPv4 address range 196.200.0.0/13 from ARIN in October 2003. This range will be used to make allocations and assignments to organisations based in African countries served by the RIPE NCC. This block is part of a /8 also used by ARIN. In order to reduce confusion the RIPE NCC will not assign prefixes longer than a /24 from it. You may wish to adjust any filters you have in place accordingly. More information on the IP space administered by the RIPE NCC can be found on our web site at: <http://www.ripe.net/ripe/docs/smallest-alloc-sizes.html> Kind regards, -- leo vegoda RIPE NCC Registration Services Manager

1 0

RE: Extreme BlackDiamond
by Michel Py 15 Oct '03

15 Oct '03

> Vivien M. wrote: > it does look like Randy hit the bounce option in pine A bounce that does not say "undeliverable"? Michel.

5 5

Re: ix's & prefix registration
by Suresh Ramasubramanian 15 Oct '03

15 Oct '03

Ayyasamy, Senthilkumar (UMKC-Student) writes on 10/15/2003 6:37 AM: > This is FUD. To my knowledge, your assertions have been clarified > by nixi folks. > https://ssl.cpsr.org/pipermail/india-gii/2003-June/004357.html you mean > (in fact...i can dare to add here that none of the connecting ISP's has > raised an issue on the multilateral peering clause...on the contrary some > ISP' want that..)..so there... Yeah, sure. *Some* ISPs want mandatory multilateral, I'm sure. > I agree with you that some of nixi exchange policies are not good. But, > they also dropped other dangerous policies ( e.g., nixi acting as a govt > mandated transit provider.) Also, in nixi case, exchange policies are set > by/to/for Indian ISPs (represented in nixi committee.) So, rather than > throwing clichés, you should participate in their mailing list and > convince them with constructive feedback. Man, a lot of us have given them our opinions, you know that. If they ask us (or better still, ask someone with clue like Bill Woodcock et al) then great. If they go on dancing to their own tune, very well then. The other "ideas" were dropped after a lot of hard work on several people's part. srs -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations

1 0

AOL DNS Queries?
by Deepak Jain 15 Oct '03

15 Oct '03

Over the last 6 weeks, we have been noticing an increase in the #/speed of AOL DNS queries from say dns-01.ns.aol.com and dns-02.ns.aol.com. (say ~6mb/s of udp 53 alone to a single name server of a cluster). Obviously, this could be spoofed UDP, but I'd like to know if this is something others are seeing or something we should configure around. Has anyone else been noticing anything of this sort? The traffic pattern only appears on a few of our name servers. Given the slope of the graph, it could be growth related, it just isn't distributed the way one would typically expect. If you are an AOL DNS person, I can send you more information. Thanks in advance, Deepak Jain AiNET

1 0