- Test - lists.nanog.org

Thanks
by Jeffrey Wheat 14 Feb '03

14 Feb '03

I'd like to thank everyone that emailed me information about IPv6 calculators. It was much appreciated! Regards, Jeff --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.449 / Virus Database: 251 - Release Date: 1/27/2003

1 0

The Cidr Report
by cidr-report＠potaroo.net 14 Feb '03

14 Feb '03

This report has been generated at Fri Feb 14 00:46:03 2003 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 07-02-03 118526 85124 08-02-03 118568 85173 09-02-03 118579 85149 10-02-03 118627 85137 11-02-03 118637 85198 12-02-03 118760 85310 13-02-03 118989 85108 14-02-03 119071 85326 AS Summary 14555 Number of ASes in routing system 5721 Number of ASes announcing only one prefix 1571 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73048064 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 14Feb03 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 119071 85433 33638 28.3% All ASes AS3908 1056 565 491 46.5% SUPERNETASBLK SuperNet, Inc. AS18566 474 7 467 98.5% COVAD Covad Communications AS4151 523 102 421 80.5% USDA-1 USDA AS701 1571 1161 410 26.1% ALTERNET-AS UUNET Technologies, Inc. AS7018 1425 1033 392 27.5% ATT-INTERNET4 AT&T WorldNet Services AS4323 528 169 359 68.0% TW-COMM Time Warner Communications, Inc. AS7843 569 240 329 57.8% ADELPHIA-AS Adelphia Corp. AS6197 476 157 319 67.0% BATI-ATL BellSouth Network Solutions, Inc AS1221 1130 824 306 27.1% ASN-TELSTRA Telstra Pty Ltd AS7046 566 274 292 51.6% UUNET-CUSTOMER UUNET Technologies, Inc. AS4355 405 119 286 70.6% ERMS-EARTHLNK EARTHLINK, INC AS1239 958 674 284 29.6% SPRINTLINK Sprint AS6347 368 85 283 76.9% DIAMOND SAVVIS Communications Corporation AS22927 295 14 281 95.3% AR-TEAR2-LACNIC TELEFONICA DE ARGENTINA AS705 446 196 250 56.1% ASN-ALTERNET UUNET Technologies, Inc. AS4814 261 15 246 94.3% CHINANET-BEIJING-AP China Telecom (Group) AS1 663 435 228 34.4% GNTY-1 Genuity AS6198 434 220 214 49.3% BATI-MIA BellSouth Network Solutions, Inc AS22291 242 32 210 86.8% CHARTER-LA Charter Communications AS17676 224 24 200 89.3% GIGAINFRA XTAGE CORPORATION AS690 498 308 190 38.2% MERIT-AS-27 Merit Network Inc. AS4134 306 119 187 61.1% ERX-CHINALINK Data Communications Bureau AS209 523 337 186 35.6% ASN-QWEST Qwest AS2386 439 259 180 41.0% INS-AS AT&T Data Communications Services AS2048 260 87 173 66.5% LANET-1 State of Louisiana AS852 606 446 160 26.4% ASN852 Telus Advanced Communications AS17557 339 188 151 44.5% PKTELECOM-AS-AP Pakistan Telecom AS22773 177 27 150 84.7% CCINET-2 Cox Communications Inc. Atlanta AS6140 285 136 149 52.3% IMPSAT-USA ImpSat AS6327 186 40 146 78.5% SHAWFIBER Shaw Fiberlink Limited Total 16233 8293 7940 48.9% Top 30 total Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)lists.apnic.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

[dmoore@caida.org: Re: Symantec detected Slammer worm "hours" before]
by k claffy 14 Feb '03

14 Feb '03

[david not on nanog list so am forwarding for him] ----- Forwarded message from David Moore <dmoore(a)caida.org> ----- Date: Thu, 13 Feb 2003 10:42:18 -0800 From: David Moore <dmoore(a)caida.org> Subject: Re: Symantec detected Slammer worm "hours" before To: k claffy <kc(a)caida.org> Cc: Sean Donelan <sean(a)donelan.com>, nanog(a)merit.edu, David Moore <dmoore(a)caida.org> > On Thu, Feb 13, 2003 at 11:59:48AM -0500, Sean Donelan wrote: > Wow, Symantec is making an amazing claim. They were able to detect > the slammer worm "hours" before. Did anyone receive early alerts from > Symantec about the SQL slammer worm hours earlier? Academics have > estimated the worm spread world-wide, and reached its maximum scanning > rate in less than 10 minutes. So actually thinking about this a bit more, our numbers count from when single well connected or a set of less well connected hosts are infected. If a single (or small number) of infected machines were on slow links (dsl/cable modem/etc) it might take them up to about an hour to find the next vulnerable host (also depending on luck and which cycle of the RNG they are in). So there might be a longer startup period than we suggested if the worm was launched in a poor environment. However, at those rates, the scanning by the worm (small number of hosts with tiny total bandwidth) would be well below the noise of even "normal" port scanning activity. I find it difficult to believe that that _at the time_ it would have been flagged as suspicious. Perhaps going back through their logs after the growth was over would have yielded something. If it was running at a rate which on average took it an hour to find the next vulnerable host, then if they had effective monitoring of a /8, then they would have only seen 100-300 packets in that hour (fewer the more vulnerable hosts that were out there; slower scanning to not find one in an hour). It's a little hard for me to believe that symantec would have noticed this level of traffic, figured out that it was bad (although perhaps some simple x86 code detector might have helped) and have told people about it at this rate. In any case, if they did, then it's because the worm was launched from a poor bandwidth environment, presumably something that symantec can't control in the future. -- david ----- End forwarded message -----

2 1

APNIC new block of addresses
by John Tran 14 Feb '03

14 Feb '03

Dear colleagues APNIC received IPv4 address blocks 222/8 and 223/8 from IANA in February 2003 and will be making allocations from these ranges in the near future. This announcement is being made for the information of the Internet community so that network configurations such as routing filters may be updated as appropriate. For more information on the resources administered by APNIC, see: http://www.apnic.net/db/ranges.html For information on the minimum allocation sizes within address ranges administered by APNIC, see: http://www.apnic.net/db/min-alloc.html Kind regards Son ____________________________________________________________________ Resources Services Manager <Son(a)apnic.net> Asia Pacific Network Information Centre phone: +61 7 3858 3100 http://www.apnic.net fax: +61 7 3858 3199 Helpdesk phone: +61 7 3858 3188 email: helpdesk(a)apnic.net Please send Internet Resource Requests to <hostmaster(a)apnic.net> _____________________________________________________________________

1 0

FYI New IPv4 allocation ot APNIC
by John L Crain 14 Feb '03

14 Feb '03

Hello all, This is to let you know that the IANA has allocated 222/8 and 223/8 to APNIC for further distribution. A notation of the allocation has been made at <http://www.iana.org/assignments/ipv4-address-space>. If you are filtering these ranges you need to be aware that they will be bought into use and you may wish to adjust those filters. John Crain ============ Technical Operations Manager IANA/ICANN

3 2

BGP/OSPF configurations
by Patrick Felt 13 Feb '03

13 Feb '03

This is a little off the topic, but it still applies. As such, feel free to respond to me personally on this. I am working on some research for one of my university classes on TCP/IP. Later in the semester we will be discussing OSPF and BGP4. I am editing my teachers notes on the subject because I have more experience with them practically than does he. I have only run them in my own organization/configuration, and because of that, my knowledge is a little limited. I would very much like to know different configurations that are currently being used with both of these protocols, so that I might be able to add valuable "industry tested" information to his lecture notes. (Zebra, gated, cisco, nortel.... etc. info welcome). If any of you are using either of these protocols, and would not mind sending me information on it, I would be very thankful. Info that I am looking for... BGP: Use of loopback interfaces Confederations eBGP vs iBGP Reflectors # of upstream peers (non local-as peers) OSPF: Area configuration Virtual Links # of ABR # of ASBR stuff like that.. Thanks again for any help that can be given. I, my fellow students, and my teacher thank you. Patrick Felt pfelt(a)quintam.com Sr. Software Eng./Network Eng. Quintam Corporation (Senior at Utah Valley State College, Orem Utah)

1 0

Re: Symantec detected Slammer worm "hours" before
by hostmaster 13 Feb '03

13 Feb '03

DeepSight is SecurityFocus. Their claim may have some truth in it. But, so does the 19000+ partners. They mean customers....but not necessarily customers/ subscribers to DeepSight. (they may have 'accidentally' included all their SecurityFocus lists' subscribers in that number as well :). Though I do appreciate the SF team, I haste to add that this revelation smells seriously commercially tainted. All of the major networks would see such anomaly pretty fast, and at virtually the same time. This is however the right moment to underscore 'corporate fears', and bring attention to their relatively new service/product. cheers Bert director research nso/ft. myers

1 0

RE: Voice over IP - performance
by Bender, Andrew 13 Feb '03

13 Feb '03

Don't forget that the signaling agents that drive the DSPs also contribute to load on the host / control CPU. We have found that this can be a very willing consumer of utilization on the platforms under discussion... folks with super low hold calls would be the ones likely to be challenged by this; particuarly with those boxes that still have the 4500-class processor in them. Regards, Andrew taqua.com > -----Original Message----- > From: Mathew Lodge [mailto:Mathew@CPlane.com] > Sent: Wednesday, February 12, 2003 6:46 PM > To: Charles Youse; Bill Woodcock > Cc: nanog(a)nanog.org > Subject: RE: Voice over IP - performance > > > > At 03:23 PM 2/12/2003 -0500, Charles Youse wrote: > >I'm assuming in the case of, e.g., a 2650 + dual T-1 PRI > interface can > >actually encode/decode 48 simultaneous g729a voice streams without > >issues? Any idea what the CPU utilisation is - or is this > handled in > >separate DSPs in the voice network module itself? > > On these particular Cisco boxes, the DSP does the all audio > filtering, > CODEC functions, echo cancellation, jitter buffering & > adjustment, silence > suppression (AKA voice activity detection, if you turned it > on), and also > prepends the RTP and IP headers. The router CPU just has to > forward the > packet that's generated by the DSP. > > Router CPU utilization is therefore a function of the number > of packets per > second that the voice card generates and the size of each > packet, plus > signaling overhead. The packet size and rate depend on the > CODEC itself > (higher compression CODECs generate smaller packets), the > sample size (20ms > is the Cisco default, reducing or increasing it makes the > packets smaller > or larger and the packet rate higher or lower, respectively), > and whether > voice activity detection is on (roughly halves the packet rate). > > If you leave the default settings in place (no VAD, 20ms > sample size), > you'll be OK with any of the CODECs. > > Mathew. > > > >C. > > > >-----Original Message----- > >From: Bill Woodcock [mailto:woody@pch.net] > >Sent: Wednesday, February 12, 2003 2:43 PM > >To: Charles Youse > >Cc: nanog(a)nanog.org > >Subject: Re: Voice over IP - performance > > > > > > > Does anyone have any real-world figures for VoIP > performance on > > > various platforms? In other words, how many calls > can an otherwise > > > unused e.g., Cisco 2600 be expected to handle if it's > the conversion > > > point from trunked voice calls to IP. Some rough numbers for > > > different codecs on different hardware would be very > useful. Most > > > specifically I'm interested in Cisco router platforms > but other > > > vendor stats would be appreciated as well. > > > >Actually I just ran the dollars-per-simultaneous-call numbers for > >different models for some friends. I'll append it. > Basically, if you run > >g711, you're limited by the number of PRI channels on the > box. If you run > >g729a, you're limited by the number of DSPs you can fit in > the box. The > >numbers I ran were assuming g729a. > > > > -Bill > > > > > > > > Cost > > per > >Package which can handle 23 simultaneous calls: call > >CISCO1760 10/100 Modular Router $1,595 > >VWIC-1MFT-T1 1-Port RJ-48 Multiflex T1 $1,300 > >PVDM-256K-12 3-DSP Module (9 calls) $1,200 > >PVDM-256K-20HD 5-DSP Module (15 calls) $4,000 > >Total $8,095 $352 > > > >Different package which can handle 23 simultaneous calls: > >CISCO2650 10/100 Modular Router $3,295 > >NM-HDV-1T1-24E Single-Port T1 Voice NM $9,100 > >Total $12,395 $539 > > > >Package which can handle 45 simultaneous calls: > >CISCO2650 10/100 Modular Router $3,295 > >NM-HDV-2T1-48 Dual-Port T1 Voice NM $9,800 > >Total $13,095 $291 > > > >Package which can handle 46 simultaneous calls: > >CISCO2650 10/100 Modular Router $3,295 > >NM-HDV-2T1-48 Dual-Port T1 Voice NM $9,800 > >PVDM-256K-20HD 5-DSP Module (15 calls) $4,000 > >Total $17,095 $372 > > > >Upgradeable package which can handle 46 simultaneous calls: > >AS535-2T1-48-AC-V AS5350-V/2T1 $18,900 $411 > > > >Package which can handle 92 simultaneous calls: > >AS535-4T1-96-AC-V AS5350-V/4T1 $33,600 $366 > > > >Package which can handle 184 simultaneous calls: > >AS535-8T1-192-AC-V AS5350-V/8T1 $58,700 $319 > > > >Upgradeable package which can handle 184 simultaneous calls: > >AS54HPX-8T1-192AC AS5400HPX/8T1 $65,500 $356 > > > >Package which can handle 644 simultaneous calls: > >AS54HPX-CT3-648AC AS5400HPX/CT3 $170,300 $265 > >

1 0

New IANA IPv4 allocations and bogon updates
by Rob Thomas 13 Feb '03

13 Feb '03

Hi, NANOGers. As announced by John Crain earlier today, IANA has allocated 222/8 and 223/8 to APNIC as of February 2003. The sundry bogon projects have been updated to reflect these allocations. You will find the catch-all Bogon Reference Page here: http://www.cymru.com/Bogons/index.html This includes links to the Secure IOS Template, Secure Juniper Template, bogon monitoring, and other associated references. Both 222/8 and 223/8 were withdrawn from the bogon route-server as of 13 FEB 02:01:00 US CST. Thanks! Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

IPv6 subnet calculators?
by Jeffrey Wheat 13 Feb '03

13 Feb '03

I am trying to find an IPv6 subnet calculator or even a "cheat sheet" that will help show how a /32 allocation is broken down into /40, /48 and /64 subnets. Has anyone found such a tool? I have been using the NorthStar web based database tool for dealing with my IPv4 allocations. While the author has mentioned support for IPv6 in the future, I am trying to get things rolling now. Any information is greatly appreciated. Best regards, Jeff --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.449 / Virus Database: 251 - Release Date: 1/27/2003

3 2