- Test - lists.nanog.org

Re: In case you didn't notice: Virtual protest
by Eric Brunner-Williams in Portland Maine 26 Feb '03

26 Feb '03

My partner tells me that WH, Senate, and House in-bound voice has had load above capacity for some of the day. The call volume is in excess of 10^^6.

3 2

Re: In case you didn't notice: Virtual protest
by Eric Brunner-Williams in Portland Maine 26 Feb '03

26 Feb '03

The C-SPAN site may be under significant load. Ari Flisher got laughed off the stage today by the WH Press Corps. Start at an offset of :28 and listen for the phrase "laughed off the stage".

1 0

turning up a juniper OC-3 interface
by Daniel Abbey 26 Feb '03

26 Feb '03

What is the command to administratively turn up a Juniper OC-3 interface? I don't seem to be getting it right.

1 0

RE: 69.0.0.0/8 - Please update your filters
by Todd A. Blank 26 Feb '03

26 Feb '03

In my original thread, I referred to the "orphaned" equipment in use in many networks. I am sure it does not help when organizations have massive layoffs and the people that put these filters in place or originally managed the offending devices are no longer employed by the organization in question. As once told to me by a prior employer of mine (right before he eliminated my job): "After all, once the network is up and running, who needs all those "extra" people to manage it?" :-) Todd -----Original Message----- From: Sameer R. Manek [mailto:manek@ecst.csuchico.edu] Sent: Wednesday, February 26, 2003 10:58 AM To: Todd A. Blank; jlewis(a)lewis.org; haesu(a)towardex.com Cc: stephen(a)sprunk.org; eddy+public+spam(a)noc.everquick.net; nanog(a)nanog.org Subject: RE: 69.0.0.0/8 - Please update your filters > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Todd A. Blank > > We were an early user of the 69/8 address space. I started the original > thread on this subject back in Sept/Oct 2002. While I am very disturbed > (but not surprised) to find out that there are still serious issues with > networks acknowledging this allocation, this is one of the best > suggestions I have seen for doing something to force the issue. > Filters once in place are rarely removed, unless the maintainers of the filters are notified about a specific problem. Even then the filters never completely go away. There is always a device or two in everyone's network that have been forgotten about, with outdated filters. Sameer

2 1

RE: 69.0.0.0/8 - Please update your filters
by Roldan, Brad 26 Feb '03

26 Feb '03

Geoff, Thanks for your concern. We are well aware of the problem and expect to make changes in the coming months. Feel free to contact me off-list if you would like to discuss this further. Regards, Brad -- Covad Communications 3420 Central Expressway Santa Clara, CA 95051 +1-408-616-6830 broldan(a)covad.com -----Original Message----- From: Geoff Huston [mailto:cidr-report@potaroo.net] Sent: Wednesday, February 26, 2003 6:57 AM To: Hsu, Vicky; nanog(a)merit.edu Cc: pfs(a)cisco.com Subject: Re: 69.0.0.0/8 - Please update your filters In return, would Covad please consider performing some meaningful form of route aggregation or other measures to reduce the amount of noise that is being passed across the global routing tables that originates from Covad? http://www.cidr-report.org/cgi-bin/as-report?as=AS18566&view=4637 suggests that Covad could withdraw some 483 BGP routing table entries, reducing the total number of entires originated by Covad from 490 to an equivalent set of 8 aggregate routes. Perhaps use of NO EXPORT when announcing the more specifics to your upstream transit providers would be a globally helpful action to consider. regards, Geoff Huston At 02:09 PM 2/25/2003 -0800, Hsu, Vicky wrote: -----Original Message----- From: Chan, KaLun Sent: Thursday, February 20, 2003 4:18 PM To: Chan, KaLun; DL NOC Managers; DL NOC-IP Services Cc: Eisenhart, William; Minter, Daniel; DL Neteng-core-ip Subject: RE: [ARIN-20030123.943] 69.3.0.0/Covad - who had this block before? All, It has recently come to our attention that many Internet routers are still filtering out IP addresses in the 69.0.0.0/8 range. If YOU are still filtering this block in your router, please modify your filters accordingly. Thank You IANA IPv4 Allocation List - <http://www.iana.org/assignments/ipv4-address-space> Bogon List - <http://www.cymru.com/Documents/bogon-list.html> Secure IOS Template - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Sincerely, Ka Lun Chan (KC) Security Operation Center COVAD Communication SOC#: 866-722-2602 Dir #: 408-434-4919 Fax #: 408-434-2191 Easy to do Business with

1 0

Network monitoring/IDS rant - What's hot what's not?
by Christopher J. Wolff 26 Feb '03

26 Feb '03

Tivoli, Openview, Unicenter, ipmonitor, mrtg, nagios? There are many network monitoring options but each option has its pitfalls. I'm rapidly coming to the conclusion that any software Computer Associates publishes is designed for the criminally insane. However, there 'has' to be something that offers more visibility into a major WAN than MRTG/RRDTOOL. Perhaps I'm on a Computer Associates rant today but can anyone share any positive experiences with E-trust intrusion detection? 5 MB of traffic flow paralyzes a dual P3 with gobs of ram and it still misses signatures that Snort does not miss. Originally I was going to blame this lousy performance on application tuning; however, it was a CA engineer that set this box up. Any IDS suggestions would be greatly appreciated as well. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

7 9

AS852 - AS577 problems ?
by Mike Tancsa 26 Feb '03

26 Feb '03

Anyone know what is up between them in Ontario, Canada ? I am seeing pretty high latency and packet loss in both directions. Dont know if its a chronic capacity problem or just a dead/down circuit ? Bell's looking glass showed (prior to my prepending) BGP routing table entry for 199.212.134.0/24, version 89013385 Paths: (2 available, best #1) Not advertised to any peer 852 11647, (received & used) 206.108.96.231 (metric 2060) from 206.108.96.17 (206.108.96.17) Origin IGP, metric 1000, localpref 110, valid, internal, best Community: 577:55 577:4520 577:5602 577:10100 Originator: 206.108.96.231, Cluster list: 206.108.96.17, 206.108.96.1 852 11647, (received & used) 206.108.96.231 (metric 2060) from 206.108.96.18 (206.108.96.18) Origin IGP, metric 1000, localpref 110, valid, internal Community: 577:55 577:4520 577:5602 577:10100 Originator: 206.108.96.231, Cluster list: 206.108.96.18, 206.108.96.1 Type escape sequence to abort. Tracing the route to ns.sentex.ca (199.212.134.1) 1 bxsmc-fe5-0-0.in.bellnexxia.net (205.207.238.210) 20 msec 204 msec 200 msec 2 core2-toronto63-pos11-5.in.bellnexxia.net (206.108.98.141) 0 msec 0 msec 4 msec 3 core4-toronto63-pos6-0.in.bellnexxia.net (64.230.242.105) 0 msec 4 msec 0 msec 4 core4-toronto12-pos13-0.in.bellnexxia.net (64.230.242.181) 0 msec 0 msec 0 msec 5 core1-toronto12-pos0-1.in.bellnexxia.net (64.230.242.198) 0 msec 0 msec 0 msec 6 bx5-toronto12-so-0-1-0-0.in.bellnexxia.net (64.230.242.150) 0 msec 0 msec 0 msec 7 toroonnlgr00.bb.telus.com (154.11.3.25) [AS 852] 176 msec 180 msec 176 msec 8 toroonzddr00.bb.telus.com (154.11.6.3) [AS 852] 172 msec 176 msec 176 msec 9 * hespler155ATM-waterloo.sentex.ca (199.212.135.77) [AS 11647] 164 msec 172 msec 10 * ns.sentex.ca (199.212.134.1) [AS 11647] 160 msec * and a traceroute from telus' route server to Bell route-views.on>traceroute 206.108.111.125 Type escape sequence to abort. Tracing the route to bx5-toronto12-so-0-0-1-0.in.bellnexxia.net (206.108.111.125) 1 toroonxngr00.bb.telus.com (154.11.63.85) 0 msec 0 msec 0 msec 2 toroonnlbr00.bb.telus.com (154.11.11.37) 4 msec 0 msec 0 msec 3 toroonnlgr00.bb.telus.com (154.11.11.58) 0 msec 0 msec 0 msec 4 bx5-toronto12-so-0-0-1-0.in.bellnexxia.net (206.108.111.125) [AS 577] 164 msec 164 msec 164 msec route-views.on> route-views.on>show ip bgp 206.108.111.125 BGP routing table entry for 206.108.111.0/24, version 117710304 Paths: (2 available, best #1) Advertised to non peer-group peers: 198.32.162.100 198.32.162.102 577, (aggregated by 577 206.108.96.25) 154.11.0.147 from 154.11.0.150 (154.11.0.150) Origin IGP, metric 0, localpref 90, valid, internal, atomic-aggregate, best Originator: 154.11.0.147, Cluster list: 154.11.0.150 577, (aggregated by 577 206.108.96.25) 154.11.0.147 from 154.11.0.151 (154.11.0.151) Origin IGP, metric 0, localpref 90, valid, internal, atomic-aggregate Originator: 154.11.0.147, Cluster list: 154.11.0.151 route-views.on> i.e. as soon as it hits Bell's network, there is quite a jump in latency and packet loss. Some of the paths to 577 out of Telus actually go down via Sprint in Chicago which seems rather odd e.g. route-views.on>show ip bgp 198.235.69.11 BGP routing table entry for 198.235.69.0/24, version 239594939 Paths: (2 available, best #1) Advertised to non peer-group peers: 198.32.162.100 198.32.162.102 1239 577 154.11.0.155 from 154.11.0.150 (154.11.0.150) Origin IGP, metric 100, localpref 100, valid, internal, best Originator: 209.115.137.204, Cluster list: 154.11.0.150 1239 577 154.11.0.155 from 154.11.0.151 (154.11.0.151) Origin IGP, metric 100, localpref 100, valid, internal Originator: 209.115.137.204, Cluster list: 154.11.0.151 route-views.on> Anyone know whats up ? ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

1 1

Re: Network monitoring/IDS rant - What's hot what's not?
by Jeff Weisberg 26 Feb '03

26 Feb '03

Pete asked: | | > (traditionally) but they can normally monitor the heck | > out of 'decent' sized networks (less than 500 components | > was my last experience with OVW atleast, tivoli and CA | > we never got working correctly with less than 1 metric | > butt ton of LOE to keep it running) | | What are the options and recommendations for networks > 500 | components? back when I had a 'network > 500 components', I could never find any monitoring software that did what I wanted. so I wrote my own. over the years it's been through some re-writes, gathered features, (lost features), and become open-source. written by an ISP for an ISP[1]. find it here: http://argus.tcp4me.com --jeff [1] sorry, I mean "e-commerce solution provider". I can still hear the marketing people's voices in my head...

2 1

RE: 69.0.0.0/8 - Please update your filters
by Todd A. Blank 26 Feb '03

26 Feb '03

We were an early user of the 69/8 address space. I started the original thread on this subject back in Sept/Oct 2002. While I am very disturbed (but not surprised) to find out that there are still serious issues with networks acknowledging this allocation, this is one of the best suggestions I have seen for doing something to force the issue. Todd A. Blank IPOutlet LLC -----Original Message----- From: jlewis(a)lewis.org [mailto:jlewis@lewis.org] Sent: Tuesday, February 25, 2003 9:32 PM To: Haesu Cc: Stephen Sprunk; E.B. Dreger; North American Noise and Off-topic Gripes Subject: Re: 69.0.0.0/8 - Please update your filters On Tue, 25 Feb 2003, Haesu wrote: > And how quickly would those ASN's respond to or even comprehend the > bogon-filter update notices? If those ASN's are competent and > quick-responsive ones, we should not even be having these prroblems to > begin with. If the alternative is getting space, giving it to customers, and explaining why they can't reach X, Y, and Z on their connection to us, but they can on other internet connections, we're going to at least have to try. I like the idea of moving the gtld servers into such space. That way, the networks that are at fault will break, and they'll be well motivated to fix their filters. ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route System Administrator | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

2 1

Re: 69.0.0.0/8 - Please update your filters
by Geoff Huston 26 Feb '03

26 Feb '03

In return, would Covad please consider performing some meaningful form of route aggregation or other measures to reduce the amount of noise that is being passed across the global routing tables that originates from Covad? http://www.cidr-report.org/cgi-bin/as-report?as=AS18566&view=4637 suggests that Covad could withdraw some 483 BGP routing table entries, reducing the total number of entires originated by Covad from 490 to an equivalent set of 8 aggregate routes. Perhaps use of NO EXPORT when announcing the more specifics to your upstream transit providers would be a globally helpful action to consider. regards, Geoff Huston At 02:09 PM 2/25/2003 -0800, Hsu, Vicky wrote: -----Original Message----- From: Chan, KaLun Sent: Thursday, February 20, 2003 4:18 PM To: Chan, KaLun; DL NOC Managers; DL NOC-IP Services Cc: Eisenhart, William; Minter, Daniel; DL Neteng-core-ip Subject: RE: [ARIN-20030123.943] 69.3.0.0/Covad - who had this block before? All, It has recently come to our attention that many Internet routers are still filtering out IP addresses in the 69.0.0.0/8 range. If YOU are still filtering this block in your router, please modify your filters accordingly. Thank You IANA IPv4 Allocation List - <http://www.iana.org/assignments/ipv4-address-space> Bogon List - <http://www.cymru.com/Documents/bogon-list.html> Secure IOS Template - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Sincerely, Ka Lun Chan (KC) Security Operation Center COVAD Communication SOC#: 866-722-2602 Dir #: 408-434-4919 Fax #: 408-434-2191 Easy to do Business with

2 1