- Test - lists.nanog.org

"The internet is slow"
by Rick Ernst 31 Jul '03

31 Jul '03

Gah.. I hate these kind of vague problems. I have multiple users complaining about "the internet is slow"; specifically to sites such as aol, cnn, amazon. Our support folks are also having trouble getting to postini's admin pages. Things are excruciatingly slow. I don't see any indications on router load, link utilization, bouncing routes, etc. that jump up as obvious problems. I tried using the lookingglass at algx.net, but I'm getting null responses for all requests (ping, traceroute and BGP). I'm not, however, seeing any issues with traceroute servers getting to us. Anybody know of anything broken anywhere? I don't think the problem is us, but if somebody would like to respond off-list with any oddities you may see with AS6423, and/or traceroutes to 206.103.37.166, I'd appreciate it. Thanks, Rick

6 6

Re: WANTED: ISPs with DDoS defense solutions
by Paul Vixie 31 Jul '03

31 Jul '03

> However, since improvements are always welcome, please recommend tools > which would allow us to progress "above and beyond" C and it's deficencies. I've never been able to program a buffer overrun vulnerability in Modula 3, or Perl, or any version of Lisp or Scheme. It's possible that the physics has advanced enough that "low level programming" now costs more than it saves.

1 0

RE: "The internet is slow"
by St. Clair, James 31 Jul '03

31 Jul '03

tell ur user a gerbil got sick and the wheel isn't spinning as fast today....

1 0

RE: North America not interested in IP V6
by Michel Py 31 Jul '03

31 Jul '03

> Jeroen Massar wrote: > It has a timeline (slides 47-50) showing the US falling behind > for at least 3 years... come on US show what you are good for :) Show me where there is money to make with IPv6 first :-) There are some exceptions, but here v6 is somehow like ISDN: I Still Don't Need. Michel.

2 1

RE: WANTED: ISPs with DDoS defense solutions
by McBurnett, Jim 31 Jul '03

31 Jul '03

I tend to agree here. I have noticed so many attacks etc coming from APNIC as of recent that on our corp network we have an ACL to block a number of APNIC blocks. If there was a dynamic method to add null0 routes to identified zombies, I think that would help. IE. security company A provides a feed (BGP etc) to null route zombies that it has identified. But that opens a whole other can of worms..... J -----Original Message----- From: Petri Helenius [mailto:pete@he.iki.fi] Sent: Thursday, July 31, 2003 9:24 AM To: variable(a)ednet.co.uk; Rob Thomas Cc: NANOG Subject: Re: WANTED: ISPs with DDoS defense solutions I would say that because backdoored hosts are easily available in large quantities, spoofing does not make sense and usually alarms various systems more quickly than packets from legitimate addresses. Pete ----- Original Message ----- From: <variable(a)ednet.co.uk> To: "Rob Thomas" <robt(a)cymru.com> Cc: "NANOG" <nanog(a)merit.edu> Sent: Thursday, July 31, 2003 4:17 PM Subject: Re: WANTED: ISPs with DDoS defense solutions > > On Wed, 30 Jul 2003, Rob Thomas wrote: > > > I've tracked 1787 DDoS attacks since 01 JAN 2003. Of that number, > > only 32 used spoofed sources. I rarely see spoofed attacks now. > > Do you have any ideas as to why that is? Is it due to more providers > doing source filtering? It wouldn't make sense for attackers to become > less sophisticated unless they became more difficult to catch for other > reasons (e.g. botnets getting bigger). > > Rich > >

2 1

RE: North America not interested in IP V6
by Ben Buxton 31 Jul '03

31 Jul '03

> -----Original Message----- > From: Jeroen Massar [mailto:jeroen@unfix.org] > Ronald van der Pol wrote: > > > On Wed, Jul 30, 2003 at 12:30:25 -0400, Marshall Eubanks wrote: > > > > > > I'd be more interested in seeing how many customer connections > > > > are using IPV6. > > > > > > This question came up in discussions at IETF-57, without a > > good answer. > > > > I count 728 /48 entries in the RIPE database. These should > correspond > > to "sites" or customers (a couple of /48s are allocated to IXs). > > The bad news here, or actually good news, is that many ISP's don't > register their client /48's. The SixXS project for instance > has 515 subnets currently given out to it's users. > We've put a REFER in the remark line to our own whois database > which contains up to date and full informations. > This is done because delegations can and will change quite a lot. And further to this...will it be required (or wise at all) to register individual /48 delegations when it becomes commonplace to allocate them to standard home users? Some private home users might be unhappy that their full home address, etc is available to anyone who knows that their ip address(es) are... I recall reading somewhere that it would not be necessary to register individual /48 subnets into RIPE. For one, it'd probably breach European privacy rules. Plus, putting in and maintaining hundreds of thousands of entries (we have a lot of users) would be quite impractical. BB

1 0

Re: North America not interested in IP V6
by neil＠DOMINO.ORG 31 Jul '03

31 Jul '03

> Here at DE-CIX (www.de-cix.net) I can see that more and more ISP are joining > the IPv6 trial (http://www.de-cix.net/info/decix-ipv6/) . Currently already > 20% of all ~120 ISP at DE-CIX have IPv6 enabled. I'd be more interested in seeing how many customer connections are using IPV6. Regards, Neil.

9 11

Moving filters from edge to core
by Tay Chee Yong 31 Jul '03

31 Jul '03

Hi all, This might be quite a stupid question. But my management is looking at moving the filters from the edge to the core, so as to reduce adminstration of apply filters on all our edge routers, and minimizing the possibility of non-synchronized filters at the edge. Does anyone has any advise on this? I believe all the there are many larger ISP in this list that have a better way to manage your filters at the edge. Would appreciate all inputs/comments. Thanks. Regards, Cheeyong

3 4

public comment period for oisafety.org's vulnerability process
by Paul Vixie 31 Jul '03

31 Jul '03

http://www.oisafety.org/ announced the GA version of "guidelines for security vulnerability reporting and response process, v1.0", whose URL is http://www.oisafety.org/reference/process.pdf this is asynchronous to the NIAC presentation jim duncan gave at the last nanog, but it's related/similar, and there's a public comment period, and it's a worthwhile read, or an opportunity to flame somebody, or whatever. oisafety.org is the organization for internet safety, btw.

1 0

Is there a technical solution to SPAM?
by Michael.Dillon＠radianz.com 31 Jul '03

31 Jul '03

Anyone who believes that SPAM can be solved by technical means should try googling one of the following: sms spam i-mode spam IM spam It should be clear that spam is really a social problem, not a technical one and therefore the solutions will be found in the social, political and legal spaces, not in network engineering. Some combination of education and training, new laws, arrests and public trials will be needed to get rid of it. I'm betting that we get the biggest bang for the buck out of education and training. Part of it will come from teaching people network etiquette, part from teaching them that spam is not a way to make money, and part of it from teaching website owners how to provide effective advertising so that website ads can dominate the cheap mass advertising space and displace the spammers. In any case, I suggest that we should ban all future discussion of SPAM and spammers from this mailing list since it is not related to network engineering or operating an IP network. ------------------------------------------------------- Michael Dillon Capacity Planning, Prescot St., London, UK Mobile: +44 7900 823 672 Internet: michael.dillon(a)radianz.com Phone: +44 20 7650 9493 Fax: +44 20 7650 9030

7 6