- Test - lists.nanog.org

IETF Web site Down ?
by Marshall Eubanks 09 Jul '03

09 Jul '03

I have not been able to get to any www.ietf.org site for the last hour or so, nor can I ping it (4.17.168.6) from mulitple network locations . Is this maintenance, a server problem or a DOS attack ? Regards Marshall Eubanks

3 2

RE: Re: Backbone Infrastructure and Secrecy
by frank＠dticonsulting.com 09 Jul '03

09 Jul '03

Backbone routes cannot be concealed. How could they be? Prior to any plow ever hitting the ground or strand strung between poles there are (sometimes very lengthy) environmental impact assessments, permits issued, RFPs/RFQs and awards to have the work done, USGS surveys, ROW franchises issued, and more, that are all a matter of public record. Not to mention the hoards of gawkers lined up along roadsides supervising trenchers as they tear apart the countryside laying down conduit. The routes themselves cannot be concealed, but the tenants who reside in the conduits, and those who piggy-back atop primary providers, often can. --------- This tidbit concerning Sean's work and other documents regarding location was posted to my forum on Silicon Investor. You may find it of interest: http://www.siliconinvestor.com/stocktalk/msg.gsp?msgid=19094753 Frank Coluccio DTI Consulting Inc. frank(a)fttx.org -----Original Message----- From: Michael.Dillon(a)radianz.com Sent: Wed, 9 Jul 2003 10:13:40 +0100 To: nanog(a)merit.edu Subject: Re: Backbone Infrastructure and Secrecy >Are we going to throw a burlap sack over 60 Hudson, the Westin Building, One Wilshire, >or similar buildings and disavow knowledge of their existence? You can't hide major infrastructure. Yes. However we can work to spread out the infrastructure more so that it is harder for terrorists to find a single point of failure to attack. If they have to coordinate an attack on 3 or 4 locations, there is an increased probability that something will go wrong (as on 9/11) and one or more of their targets will escape total destruction. We all need to find ways to make our networks more resilient even if that means moving away from "comfortable" vendors like Cisco and Juniper. The costs of resilience are not immovable objects. Those costs arise because the routers and circuits we would use to implement resilience are the same things we use to carry paying traffic and the vendors price their products based on the expectation that we use them for paying traffic. Since the vendors can't tell whether or not the router/circuit earns revenue for us, they won't give up their margin on the sale. In both cases, the underlying components of the product are virtual commodities (fiber, wavelengths, circuit boards, chips) and are continually dropping in price. Perhaps it will require government regulations regarding diversity and resilience to change this but wouldn't it be nice if the industry could get together and solve this problem in a self-regulatory fashion? --Michael Dillon

1 0

Mark Allman: Internet measurement: what next?
by Mark Allman 09 Jul '03

09 Jul '03

Folks- I sent the following note out the Internet Measurement Research Group (of the IRTF) mailing list last week. I'd love to hear from operations folk on these sorts of question... i.e., what would you love to be able to measure that you can't do terribly effectivly today? If you're interested in participating the mailing list is imrg(a)ietf.org. You can see the archive, subscription info, etc. at http://imrg.grc.nasa.gov/. Thanks! allman -- Mark Allman -- BBN/NASA GRC -- http://roland.grc.nasa.gov/~mallman/ ------- Forwarded Message To: imrg(a)ietf.org From: Mark Allman <mallman(a)grc.nasa.gov> Reply-To: mallman(a)grc.nasa.gov Subject: Internet measurement: what next? Organization: BBN Technologies/NASA GRC Song-of-the-Day: Lucky Ones Date: Wed, 02 Jul 2003 12:30:00 -0400 Sender: mallman(a)guns.lerc.nasa.gov I am interested in seeing some discussion about the fairly generic topic of what sorts of outstanding problems exist in Internet measurement: What are the core problems we need to solve? What do we need to be able to measure that we cannot measure very well today? Why? What are the problems in taking measurements? What can be done about those problems? What are practical problems that prevent wide-scale network measurement? What new tools does the community need to take, use, share and store measurements? Please jump in with answers o any or all of the above. Or, even with additional big-picture sorts of questions of your own. Thanks! allman (imrg chair) - -- Mark Allman -- BBN/NASA GRC -- http://roland.grc.nasa.gov/~mallman/ ------- End of Forwarded Message

7 10

Re: Seeking NJ-NYC connectivity
by Michael.Dillon＠radianz.com 09 Jul '03

09 Jul '03

>The situation is that we'd need to take a DS3 backhaul for DSL in northern >Jersey somewhere, and find a cheap way to cross the Hudson and have it >land at Telehouse. Free space optical, perhaps? http://www.isp-planet.com/cplanet/business/piscitelloaug01.html --Michael Dillon

1 0

Re: [Backbone Infrastructure and Secrecy]
by Joshua Sahala 09 Jul '03

09 Jul '03

i think that that is the point of the article - mr gorman is 'the one' ;) he mapped something that those who put it together hoped was unmappable. now it seems that they are blaming their incompetance on his skills. could his work be used to better our 'critical' infrastructure? sure. could it be used to render it useless? probably. will it be used to fix things? doubtful. if the ministry of homeland secrecy sucedes in getting it classified, it will sit in a locked buliding somewhere, while another enterprising individual or group uses the same tools that mr gorman used...but whom will they be showing it to? /joshua Adam Kujawski <adamkuj(a)amplex.net> wrote: > > NANOG's Sean Gorman is in the news: > > http://www.washingtonpost.com/wp-dyn/articles/A23689-2003Jul7.html > > I would find GIS like the one described *very* usefull in finding transport > providers. If I could see who has what where, I would know who to go to for > quotes. As it stands, most of this information is hard to get ahold of. > > Who, besides Sean, has maps like this? The state PUC? If so, is that > information available to the public? Do you have to go thorugh a background > check and/or sign an NDA? Or is it only the providers themselves that have the > maps for this stuff? > > -Adam > "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

5 4

Seeking NJ-NYC connectivity
by Charles Sprickman 09 Jul '03

09 Jul '03

Hi, Hopefully this isn't too far off, but besides shopping I need some input on what it is I actually want... The situation is that we'd need to take a DS3 backhaul for DSL in northern Jersey somewhere, and find a cheap way to cross the Hudson and have it land at Telehouse. I know I can find a co-lo in Jersey somewhere, put a Redback there, and pay lots of money for a DS3 to Telehouse and pay for a mostly empty rack. I'm looking for something a little more clever and cost-effective. For example if someone has excess capacity on an atm circuit across the river, using their atm switches at both ends to do the handoff. I'm no atm guru, so I don't know if that's something that really makes any sense... Any ideas/suggestions/don't-do-that-because-flames are welcome. Thanks, Charles -- Charles Sprickman spork(a)inch.com

1 1

Re: [Re: [Backbone Infrastructure and Secrecy]]
by Joshua Sahala 09 Jul '03

09 Jul '03

Adam Kujawski <adamkuj(a)amplex.net> wrote: > [cut] > > Exactly. I think we all agree that this kind of information would be > usefull for a variety of reasons (locating available resources, > ensuring path redundancy, identifying critical points of failure, > etc). I think we all agree that this information, in the wrong hands, > can also be used for naughty purposes. what information can't? as a long running american psa said "knowledge is power" > How do we balance these opposing factors? I like the idea of a > clearinghouse where one can access the data after a background check > and a NDA. how many spies have gone through this same process? since when does an nda matter to someone who is already breaking a law/rule? i believe it was jared who pointed this out earlier. > At the state level, the logical place would be the PUC. They have all > the data, but do they have it all in a single GIS database? They > should, but I doubt they do. the puc is the last two states the i have lived in had trouble keeping track of my bill payments and name, so why should i think that they can handle something this big and important? but, i do think that they are working on something like it - there are (or were) a lot of postings for gis programmers.... > At the national level, is there any department or agency to go to? It > certainly doesn't sound like it. What would it take to get a project > such as Mr. Gorman's done by the federal government so that there > would be a single place to go? well it took forming the ministry of homeland secrecy to get the disparate agencies to talk to one another </sarcasm> > Does the government already have this information locked up behind > closed doors? It seems like they would. Is there any reason not to > make it available to interested parties that have a valid reason to > access it? total information awareness? > > Would the infrastructure owners oppose such a system being publically > available? i think that they would say no > After all, they don't want their competitors to copy their good > design or take advantage of underserved markets revealed by the maps. > But it seems they would have much to gain as well - potential > customers will know who to go to for service. or their bad designs (which is part of the root of this issue). competition (or lack thereof) would be another motivator to keep it suppressed. good for customers != good for the monoplizing companies who control much of this infrastructure > It sounds like the current trend is toward supressing this kind of > information. > But as an industry, it is in our best interest to compile this > information and make it available to the proper parties. better yet, make it widely available and subject to a lot of scrutiny and work to fix the problems (think openbsd - one remote compromise in how many years...) > -Adam /joshua "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

2 1

RE: Why can't I default Originate?
by Vandy Hamidi 08 Jul '03

08 Jul '03

Thanks HC, Two things. I was told this was not a topic for this list. Sorry about that. Since I've already posted, I think I should post what the problem was. Problem=I'm stupid. I wasn't looking in the right place for what I was advertising. I ran: router#sh ip bgp nei 10.99.200.75 adv BGP table version is 43, local router ID is 10.1.80.44 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Originating default network 0.0.0.0 Network Next Hop Metric LocPrf Weight Path *> 1.2.3.0/24 1.2.3.3 0 32768 i router# I was looking for the network, but not the line that stated: Originating default network 0.0.0.0 So it was advertising and I've verified it on the remote peers (which I should have done first!). Still doesn't answer why CISCO says you apply default orig to the peer, not the peer group (which we've proven is backwards). It shouldn't be this way since you may want to use the peer group as a template for multiple customers, but they may not all want 0/0 sent to them. ALSO I didn't need to have 0/0 in my local routing table nor did I need to add the BGP command "Synchronization." According to CISCO (which is actually accurate), it will originate default UNCONDITIONALLY, which it does. I'm still concerned about applying the command to the peer vs. the peer group issue. Sorry about having posted this to Nanog, I'll filter my future questions more carefully. Thanks for everyone who answered! -=Vandy=- -----Original Message----- From: Haesu [mailto:haesu@towardex.com] Sent: Tuesday, July 08, 2003 2:04 PM To: nanog(a)merit.edu Subject: Re: Why can't I default Originate? After you applied default-originate to peer-group, have you done soft-clear of your bgp session? It usually takes a little while for changes in config to propagate, unless you force an update using soft clear... -hc -- Sincerely, Haesu C. TowardEX Technologies, Inc. WWW: http://www.towardex.com E-mail: haesu(a)towardex.com Cell: (978) 394-2867 On Tue, Jul 08, 2003 at 12:43:35PM -0700, Vandy Hamidi wrote: > > Platform: > Cisco 7206VXR > SW: > Version 12.2(15)T2 > > router#sh run | b bgp > router bgp 65011 > no synchronization > bgp log-neighbor-changes > bgp confederation identifier 12345 > bgp confederation peers 65001 65021 > bgp deterministic-med > bgp dampening > network 1.2.3.0 mask 255.255.255.0 > neighbor Confed-Peer-Group peer-group > neighbor Confed-Peer-Group update-source FastEthernet1/1 > neighbor Confed-Peer-Group next-hop-self > neighbor Confed-Peer-Group version 4 > neighbor Confed-Peer-Group soft-reconfiguration inbound > neighbor Confed-Peer-Group filter-list 2 in > neighbor Confed-Peer-Group filter-list 1 out > neighbor 10.1.2.75 remote-as 65001 > neighbor 10.1.2.75 peer-group Confed-Peer-Group > neighbor 10.1.2.75 password 7 05211F2C105211F2C1666B > neighbor 10.1.2.76 remote-as 65001 > neighbor 10.1.2.76 peer-group Confed-Peer-Group > neighbor 10.1.2.76 password 7 05211F2C105211F2C1666B > no auto-summary > > > router#conf t > Enter configuration commands, one per line. End with CNTL/Z. > > router(config)#router bgp 65011 > > router(config-router)#neighbor 10.1.2.75 default-originate > % Invalid command for a peer-group member > router(config-router)# > > According to Cisco: > All members of a peer group must share identical outbound announcement policies (such as distribute-list, filter-list, and route-map), except for default-originate, which is handled on a per-peer basis even for peer group members. > > I've also tried to apply to the peer group. The command is accepted, but no default origination of 0/0 is advertised to the peer(s). > Thanks in advanced for any help, > > -=Vandy=-

3 2

Re: [Tertiary or 2nd Secondary DNS?]
by Joshua Sahala 08 Jul '03

08 Jul '03

i personally point all of my 'secondary' servers at theirs for the 'primary' or master. having my box slave off another of my boxes that is a slave is sort of like rip routing - dns by rumour anyone... i prefer this method because then they are the 'only ones' who can screw up the zones...(not really, but it takes once piece out of the chain and makes troubleshooting easier for me) ymmv /joshua up(a)3.am wrote: > > > This question might be more suitable for inet-access, but it's down, so > I'm resending here: > > Silly question: > > If you have a customer who is doing their own primary DNS, but you are > doing their secondary DNS (on 2 of your name servers) for them, is it > better practice on your 2nd DNS server to xfer the zones directly from the > customer's primary DNS server (a second secondary DNS server) or xfer it > from your first server (the customer's secondary server) doing "true > tertiary" DNS? Or should the tertiary use multiple masters? > > Thinking about rewriting the scripts a bit... > > thanks, > > James Smallacombe PlantageNet, Inc. CEO and Janitor > up(a)3.am http://3.am > ========================================================================= > > > "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

Why can't I default Originate?
by Vandy Hamidi 08 Jul '03

08 Jul '03

Platform: Cisco 7206VXR SW: Version 12.2(15)T2 router#sh run | b bgp router bgp 65011 no synchronization bgp log-neighbor-changes bgp confederation identifier 12345 bgp confederation peers 65001 65021 bgp deterministic-med bgp dampening network 1.2.3.0 mask 255.255.255.0 neighbor Confed-Peer-Group peer-group neighbor Confed-Peer-Group update-source FastEthernet1/1 neighbor Confed-Peer-Group next-hop-self neighbor Confed-Peer-Group version 4 neighbor Confed-Peer-Group soft-reconfiguration inbound neighbor Confed-Peer-Group filter-list 2 in neighbor Confed-Peer-Group filter-list 1 out neighbor 10.1.2.75 remote-as 65001 neighbor 10.1.2.75 peer-group Confed-Peer-Group neighbor 10.1.2.75 password 7 05211F2C105211F2C1666B neighbor 10.1.2.76 remote-as 65001 neighbor 10.1.2.76 peer-group Confed-Peer-Group neighbor 10.1.2.76 password 7 05211F2C105211F2C1666B no auto-summary router#conf t Enter configuration commands, one per line. End with CNTL/Z. router(config)#router bgp 65011 router(config-router)#neighbor 10.1.2.75 default-originate % Invalid command for a peer-group member router(config-router)# According to Cisco: All members of a peer group must share identical outbound announcement policies (such as distribute-list, filter-list, and route-map), except for default-originate, which is handled on a per-peer basis even for peer group members. I've also tried to apply to the peer group. The command is accepted, but no default origination of 0/0 is advertised to the peer(s). Thanks in advanced for any help, -=Vandy=-

3 2