- Test - lists.nanog.org

rfc1918 ignorant
by Muir, Ronald 23 Jul '03

23 Jul '03

I have been busy today and not monitoring the list. I hate it when I miss the start of an rfc1918 rant. It feels like old news when you have to go back and read the email string and miss out on the name calling and ranting in real time. -Ron

1 0

RE: rfc1918 ignorant (fwd)
by Dave Temkin 23 Jul '03

23 Jul '03

---------- Forwarded message ---------- Date: Wed, 23 Jul 2003 07:53:26 -1000 From: DOUGS(a)oceanic.com To: oberman(a)es.net Cc: dave(a)ordinaryworld.com Subject: RE: rfc1918 ignorant There's a common misconception reflected here that I wanted to correct. I don't have nanog-post, so I apologize if its not appropriate to reply directly. You may repost my comments if you'd like. [Kevin Oberman <mailto:oberman@es.net> wrote on Wednesday, July 23, 2003 7:07 AM:] > Comcast and many others seem to > blithely ignore this for convenience sake. (It's not like they need a > huge amount of space to give private addresses to these links.) ARIN required cable operators to use RFC 1918 space for the management agents of the bridge cable modems that have been rolled out to the millions of residential cable modem customers. Doing so obviously requires a 1918 address on the cable router, but Cisco's implementation requires that address to be the primary interface address. There is also a publicly routable secondary which in fact is the gateway address to the customer, but isn't the address returned in a traceroute. Cisco has by far the lead in market share of the first gen Docsis cable modem router market so any trace to a cable modem customer is going to show this. In fact, Comcast and others _do_ need a huge amount of private IP space because of this. We didn't "blithely ignore" the RFC, but didn't have a choice in implementation. Perhaps Cisco will improve their implementation for the next round of CMTS development... Filtering of RFC 1918 space by cable ISPs is of course another topic. -Doug- [Kevin Oberman <mailto:oberman@es.net> wrote on Wednesday, July 23, 2003 7:07 AM:] >> Date: Wed, 23 Jul 2003 08:59:18 -0400 (EDT) >> From: Dave Temkin <dave(a)ordinaryworld.com> >> Sender: owner-nanog(a)merit.edu >> >> >> Is this really an issue? So long as they're not advertising the >> space I see no issue with routing traffic through a 10. network as >> transit. If you have no reason to reach their router directly (and >> after Cisco's last exploit, I'd think no one would want anyone to >> reach their router directly :-) ), what's the harm done? >> >> RFC1918 merely states that it shouldn't be routed on the global >> internet, not that it can't be used for transit space. > > That's not what is in my copy of 1918. > > "In order to use private address space, an enterprise needs to > determine which hosts do not need to have network layer connectivity > outside the enterprise in the foreseeable future and thus could be > classified as private. Such hosts will use the private address space > defined above. Private hosts can communicate with all other hosts > inside the enterprise, both public and private. However, they cannot > have IP connectivity to any host outside of the enterprise. While not > having external (outside of the enterprise) IP connectivity private > hosts can still have access to external services via mediating > gateways (e.g., application layer gateways)." > > As I read this, packets with a source address in 19298 space should > NEVER appear outside the enterprise. Comcast and many others seem to > blithely ignore this for convenience sake. (It's not like they need a > huge amount of space to give private addresses to these links.)

3 2

Re: rfc1918 ignorant
by Kevin Oberman 23 Jul '03

23 Jul '03

> Date: Wed, 23 Jul 2003 08:59:18 -0400 (EDT) > From: Dave Temkin <dave(a)ordinaryworld.com> > Sender: owner-nanog(a)merit.edu > > > Is this really an issue? So long as they're not advertising the space I > see no issue with routing traffic through a 10. network as transit. If > you have no reason to reach their router directly (and after Cisco's last > exploit, I'd think no one would want anyone to reach their router directly > :-) ), what's the harm done? > > RFC1918 merely states that it shouldn't be routed on the global internet, > not that it can't be used for transit space. That's not what is in my copy of 1918. "In order to use private address space, an enterprise needs to determine which hosts do not need to have network layer connectivity outside the enterprise in the foreseeable future and thus could be classified as private. Such hosts will use the private address space defined above. Private hosts can communicate with all other hosts inside the enterprise, both public and private. However, they cannot have IP connectivity to any host outside of the enterprise. While not having external (outside of the enterprise) IP connectivity private hosts can still have access to external services via mediating gateways (e.g., application layer gateways)." As I read this, packets with a source address in 19298 space should NEVER appear outside the enterprise. Comcast and many others seem to blithely ignore this for convenience sake. (It's not like they need a huge amount of space to give private addresses to these links.) -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

2 1

RE: rfc1918 ignorant
by Daryl G. Jurbala 23 Jul '03

23 Jul '03

Ahhh...but this all comes down to how one defines "enterprise" and it's network scope. IANALBPSB (I am not a lawyer but probably shoud be) Daryl PGP Key: http://www.introspect.net/pgp [...] > That's not what is in my copy of 1918. > > "In order to use private address space, an enterprise needs > to determine which hosts do not need to have network layer > connectivity outside the enterprise in the foreseeable future > and thus could be classified as private. Such hosts will use [...]

1 0

rfc1918 ignorant
by Frank Louwers 23 Jul '03

23 Jul '03

Is there a site to "report" networks/isps that still leak rfc1918 space? By leaking I not only mean "don't filter", but actually _use_ in their network? If someone is keeping a list, feel free to add ServerBeach.com. All traceroutes to servers housed there, pass by 10.10.10.3. traceroute to www.serverbeach.com ... 20. 64-132-228-70.gen.twtelecom.net 21. 10.10.10.3 22. 66.139.72.12 Kind Regards, Frank Louwers -- Openminds bvba www.openminds.be Tweebruggenstraat 16 - 9000 Gent - Belgium

5 4

second call for an unbundled portable /24
by Henry Linneweh 23 Jul '03

23 Jul '03

We have attempted in the past tried to deal with Arin on this issue and they as usual deny anything that could potentially be useful, in thwarting these attacks. There have been some people with good idea's, however when you have a 1 gig bi-directional pipe and you have 2Gb/s incoming these idea's then only look good on paper with nice graphic's to match. I think all the oc48 shelves need to be checked and the passwords changed..... Henry R. Linneweh

1 0

RE: Cisco vulnerability and dangerous filtering techniques
by Austad, Jay 23 Jul '03

23 Jul '03

> How many thousands of "polls" do you think a looking glass can handle > simultaneously? I am all for the doomsday scenarios, but lets > make them a > little bit less sci-fi, shall we? How about "it would create > valid looking > OSPF packets with garbage in them?" or "create valid looking > STP packets" It was just a suggestion. I don't think it's plausible on a wide scale, but only a few queries would be needed to get an overview of the topology. Originally I was thinking traceroutes. It's not going to be exact, but it's going to glean enough information to cause more damage than without that info. If you were doing some sort of p2p, each host would simply need to perform many random traceroutes and correlate their data. The devices that appeared most often in that data would obviously be backbone routers, and the attack would start with those and work to the least frequent (with specific emphasis on the hops that were seen from the local trojan/worm/etc). Like I said, it's not going to be perfect, but it is better than blindly spewing out evil packets. Jay

4 3

Re: Cisco vulnerability and dangerous filtering techniques
by James Roten 23 Jul '03

23 Jul '03

>P.S. The only sure way of eradicating this Cisco bug from the Internet is >to convert the Internet to IPv6. The bug doesn't affect Cisco's IPv6 code >and older routers whose IOS cannot be upgraded also cannot do IPv6 so >they cannot be used in an IPv6 Internet. Food for thought... Quick solution to this bug, as well as any future bug(s) .... replace all routers with PCs running Zebra. James Roten Ninjas are sooooooooooo sweet that I want to crap my pants. I can't believe it sometimes, but I feel it inside my heart. These guys are totally awesome and that's a fact. Ninjas are fast, smooth, cool, strong, powerful, and sweet. I can't wait to start yoga next year. I love ninjas with all of my body (including my pee pee).

1 0

RE: rfc1918 ignorant
by Ben Buxton 23 Jul '03

23 Jul '03

Uhhh...PMTU-d can break as routers will send back icmp cant-frag packets from those link addresses and rpf, filtering, etc will bring tcp connections to a standstill. Don't filter rfc1918? umm good luck convincing the rest of the net to eliminiate their filters. The basic premise of building public networks is that you have to work around other peoples policies. If it's corporate nets, then sure you can control it all, but not here. Though the PMTU-d point is arguable (what are your internal links doing with crummy MTU, for example). BB > > Is this really an issue? So long as they're not advertising > the space I > see no issue with routing traffic through a 10. network as > transit. If > you have no reason to reach their router directly (and after > Cisco's last > exploit, I'd think no one would want anyone to reach their > router directly > :-) ), what's the harm done? > > RFC1918 merely states that it shouldn't be routed on the > global internet, > not that it can't be used for transit space. > > > > <---------------------------> > > Is there a site to "report" networks/isps that still leak > rfc1918 space? > By leaking I not only mean "don't filter", but actually _use_ in their > network? > > If someone is keeping a list, feel free to add ServerBeach.com. All > traceroutes to servers housed there, pass by 10.10.10.3. > > traceroute to www.serverbeach.com > ... > 20. 64-132-228-70.gen.twtelecom.net > 21. 10.10.10.3 > 22. 66.139.72.12 > > Kind Regards, > Frank Louwers > > -- > Openminds bvba www.openminds.be > Tweebruggenstraat 16 - 9000 Gent - Belgium > -- > David Temkin >

2 1

re: rfc1918 ignorant
by Vinny Abello 23 Jul '03

23 Jul '03

I agree... The only problem is if you filter all inbound RFC 1918 and inadvertently block ICMP messages from their routers on rfc1918 space. That could potentially cause issues with network connectivity related to MTU, etc... At 08:59 AM 7/23/2003, Dave Temkin wrote: >Is this really an issue? So long as they're not advertising the space I >see no issue with routing traffic through a 10. network as transit. If >you have no reason to reach their router directly (and after Cisco's last >exploit, I'd think no one would want anyone to reach their router directly >:-) ), what's the harm done? > >RFC1918 merely states that it shouldn't be routed on the global internet, >not that it can't be used for transit space. > > > ><---------------------------> > >Is there a site to "report" networks/isps that still leak rfc1918 space? >By leaking I not only mean "don't filter", but actually _use_ in their >network? > >If someone is keeping a list, feel free to add ServerBeach.com. All >traceroutes to servers housed there, pass by 10.10.10.3. > >traceroute to www.serverbeach.com >... >20. 64-132-228-70.gen.twtelecom.net >21. 10.10.10.3 >22. 66.139.72.12 > >Kind Regards, >Frank Louwers > >-- >Openminds bvba www.openminds.be >Tweebruggenstraat 16 - 9000 Gent - Belgium > -- >David Temkin Vinny Abello Network Engineer Server Management vinny(a)tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0 E935 5325 FBCB 0100 977A Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN There are 10 kinds of people in the world. Those who understand binary and those that don't.

1 0