- Test - lists.nanog.org

Re: IP backbone numbering/naming
by Jahowering＠aol.com 16 Nov '02

16 Nov '02

The DOS attack should be a real concern when using RFC 1918. A (distributed) smurf attack, or one of it's derivatives, can cause the icmp echo replies to be sent to that src. address. Since the attackers just use blocks and blocks of spoofed addresses, you could become the sourced address victim. Of course, ingress and egress rfc 1918 filtering will prevent this...it's just something else to think about... -jake In a message dated 11/16/2002 12:19:36 AM Eastern Standard Time, mike(a)rockynet.com writes: > haesu(a)towardex.com wrote: > > >You could also use RFC1918 numbers for your point-to-point /30 > >aggregation blocks with the customers.. But.. since that would have > >effect on customer's premise equipment, it would be better to give > >them globally unique space as well, who knows if your customer comes > >back and yells at you for not being able to get to his router's serial > >interface IP. > > > > This practice was implemented here in the early days, before I came > along. There have been almost no requests to change by clients, and > very, very few who even noticed/cared enough to ask why. > > But as more VPNs are deployed, I've seen this break some > implementations. So for two reasons we've begun the (large) task of > renumbering all the /30 ptp links either public or unnumbered: > > 1) Ensures all clients who decide to implement VPN don't run into > frustration because of this practice. We want to encourage better > security practices, and VPN can be an integral part of that. > > 2) The script kiddies won't mistakenly assume that we're not doing > source address filtering. I'm sure that seeing a private address in > traceroute probably makes you a more desirable target in certain circles. > > There is only one case where I would recommend using a private address > on a public link. We have a client periodically attacked, and in some > cases the attackers have simultaneously attacked our own infrastructure. > They now have only one path to them here, and every hop past the border > is RFC1918. >

2 1

disconnected autonomous systems
by Ralph Doncaster 16 Nov '02

16 Nov '02

I've found there are many providers that have completely disconnected autonomous systems. For example Yipes (6517) uses L3 on the west coast and Williams on the east coast. 66.7.129.0/24 is advertised under their AS through WCG and 209.213.209.0/24 is advertised under their AS through L3. And the number of connected autonomous systems with de-aggregated prefixes appears to be even more common than a disconnected AS. It would seem that many (most?) network operators are just ignoring the more vocal opinions on NANOG. -Ralph

10 18

ASN VoIP Phones
by Feger, James 16 Nov '02

16 Nov '02

Does anyone have the URL documenting the ASN VoIP phone project that was talked about in Eugene? Thanks, James

2 1

IP backbone numbering/naming
by Steve Rude 16 Nov '02

16 Nov '02

Hi All, I am trying to collect information about using RFC 1918 space on an ISP backbone. I have read the RFC several times, and I don't see where it says that you cannot use 10/8 space to number your backbone links (/30s). I know this is an old thread that has been rehashed several times, but can anyone please send me links or information that I can use to convince my boss that we should use our arin alloc'd space on our backbone instead of using private space. Also if anyone has opinions on naming conventions for backbone such as why to or why not to even have dns resolution for your backbone and some conventions please let me know. TIA! -- Steve Rude steve(a)rudedogg.com

7 6

Re: PM3's crashing
by mikenoc＠mindspring.com 16 Nov '02

16 Nov '02

We have hundreds of PM3's across the country and we havent seen any problems. Mike F. Earthlink NOC On Sat, 16 Nov 2002 01:43:26 -0500 (EST) Brian Wallingford <brian(a)meganet.net> wrote: > > :> > :> Do you have SNMP enabled? We have a couple > of TNTs stop talking to the > :> ethernet periodically, apparently due to the > SNMP bugs (and someone > :> probing). Software upgrades are now > scheduled (of course, not an option > : > :Strange, as I recall the testing we did at the > last snmp 'event' showed > :the TNT's to actually be one of the best off > snmp-bug-wise, with no > :service impacting snmp bugs. > > Same here. > > Not that snmp bugs should matter - why should > such traffic be allowed > inbound? > >

1 0

BGP Dampening
by Mark V. A. Bown 16 Nov '02

16 Nov '02

Greetings, I pose this question do its puzzling major. Two nights ago at approximately 10:20 PM PST I started receiving enough invalid routes that it caused my processor on router B to reach 100 percent utilization for 30 second interval every 3 min. While doing a debug on updates I discovered that router A was injecting routes from two of my transit connections into my tables and then removing them. When I checked router A there was a dampening list being created, but still Router A passed these routes on to Router B, but stranger still not on to Router C. When I check router B there were no dampened paths in the tables. My question is why didn't Router B dampen the invalid routes, and two why did Router A pass them along to Router B, and not Router C? Background Router C: 7513, dual processor, full memory IOS; Version 12.1(5c)E12, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) Router B: 7507, dual processor, full memory IOS; Version 12.1(2)E, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) Router A: 12012, dual processor, full memory IOS; GS Software (GSR-P-M), Version 12.0(21)ST2, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) Route Sources: there are 4 full tables coming into Router A, 3 of equal preference and one of lesser preference. Yet the router still chose the flapping route???? If this is not worthy of the groups time could someone please contact me off list Mark V. A. Bown mark.bown(a)optigate.net Optigate Networks Inc. www.optigate.net

1 0

Traceroute from A to B
by Minseok Kwon 15 Nov '02

15 Nov '02

Is there a way or tool to find the route between two arbitrary hosts from one of my local machines? In other words, given two host IP addresses A and B, I would like to find the route between A and B. I can use a source route, 'traceroute -g', to approximate the route. I have tried this option. Lots of routers, however, do not accept source routes. Any help will be appreciated. Thanks.

3 2

Re: DirecPC Protocols
by Crist J. Clark 15 Nov '02

15 Nov '02

On Fri, Nov 15, 2002 at 04:41:10PM +0100, Jurian van der Knaap wrote: > You might get some info out of the Linux DirecPC driver, or maybe the > developers of the driver can help. > > Find it at http://sourceforge.net/projects/direcpc > > Hope this is of any help, Yeah, this helped. It showed me that their protocol is totally broken. They do an GRE- or IPIP-like encapsulation, but then set the protocol field to that of the encapsulated packet. Or if the encapsulated packet is not TCP, UDP, or ICMP, they set the outer protocol to TCP. This will totally break behind NAT when the NATing device changes the source IP address and then "fixes" the TCP or UDP checksum due to the pseudo-header change. Either the NATing device drops the packet when the intial checksum is wrong or it mangles the payload, which isn't really TCP. Who designs these things? And what were they smoking when they did? -- Crist J. Clark | cjclark(a)alum.mit.edu | cjclark(a)jhu.edu http://people.freebsd.org/~cjc/ | cjc(a)freebsd.org

2 1

Next NANOG meeting/stats
by Susan Harris 15 Nov '02

15 Nov '02

The next NANOG meeting will be held February 9-11, 2003, in Phoenix, Arizona, where it will be warm and sunny. Registration opens January 2. Our hosts for this meeting are Rodney Joffe and UltraDNS. Rodney, this is the third time you've hosted NANOG, and we are very grateful for your long-term support! Below are some stats from our last meeting and an update on the list. ====================================================================== NANOG 26 Eugene, Oregon, Oct. 27-29 Hosted by Sprint and the University of Oregon (thank you!) Total attendees: 505 Speakers: 35 (3 panels) Total attending both NANOG & ARIN 93 NAPs represented: 8 Univ/college/schools 16 Asia/Pacific/Africa 36 Europe 17 Attendees representing vendors 104 Attendees representing ISPs 213 R&E 63 Other (gov't., software vendor, content, consultant) 125 Wireless card loans: 49 Largest simultaneous # of wireless users: 400 Concurrent RealMedia viewers: up to 101 Concurrent multicast viewers: ~20 to 30 Unique multicast viewers: ~50 to 100 Meeting coordination: Merit Squid cache: Measurement Factory Sponsors: Foundry, Adlex, Arbor Cisco, Force10, Juniper Packet Design, Seranoa, Redback NANOG Email List Stats ---------------------- Direct NANOG subscribers 5927 nanog-post 4635 nanog-announce 533 nanog-digest 809

1 0

DirecPC Protocols
by Crist J. Clark 15 Nov '02

15 Nov '02

I've been looking for some technical descriptions on how DirecPC works from a TCP/IP point of view. Does anyone out there have some references? I have not been able to find anything too detailed, and from what I have been told, they are not too forthcoming when contacted directly. I know the rough outline. The customer sends out traffic over a normal PPP link (since the customer has no uplink to the DirecPC satellite) to a separate ISP. The traffic has a spoofed source address set to some DirecPC server at their ground site(s). Thus, the third-party target's response goes to DirecPC who send it over their satellite link back to the customer using the wide satellite pipe instead of the narrow PPP pipe. But I'm curious about the details. First things first, anyone know how the DirecPC link is established? That is, how the customer tells DirecPC what his IP address is? I assume this must all happen over the PPP-link, or at least the two-way PPP-link is used for bootstrapping. Now once things are going, what kind of predictive ACKing games does DirecPC play? The reason I am curious is that I'm trying to figure out what kinds of things ISPs, or any Internet access provider (say the user is dialing into a corporate RAS), can do to break or accomodate DirecPC. The obvious things that come to mind are egress filtering and NAT. In addition to any technical information that can help me figure this out for myself, experience others have had with these same problems would also be helpful. Thanks a lot for any help. -- Crist J. Clark | cjclark(a)alum.mit.edu | cjclark(a)jhu.edu http://people.freebsd.org/~cjc/ | cjc(a)freebsd.org

5 6