- Test - lists.nanog.org

The Cidr Report
by cidr-report＠potaroo.net 08 Nov '02

08 Nov '02

This report has been generated at Fri Nov 8 21:47:30 2002 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 01-11-02 115442 82842 02-11-02 115409 82853 03-11-02 115133 82798 04-11-02 115076 82886 05-11-02 115280 82945 06-11-02 115314 82968 07-11-02 115370 82934 08-11-02 115262 82976 AS Summary 13984 Number of ASes in routing system 5472 Number of ASes announcing only one prefix 1726 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73138176 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 08Nov02 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 115332 82897 32435 28.1% All ASes AS3908 1082 564 518 47.9% SUPERNETASBLK SuperNet, Inc. AS701 1726 1253 473 27.4% ALTERNET-AS UUNET Technologies, Inc. AS7843 787 338 449 57.1% ADELPHIA-AS Adelphia Corp. AS7018 1341 990 351 26.2% ATT-INTERNET4 AT&T WorldNet Services AS6197 453 107 346 76.4% BATI-ATL BellSouth Network Solutions, Inc AS18566 341 4 337 98.8% COVAD Covad Communications AS4323 512 176 336 65.6% TW-COMM Time Warner Communications, Inc. AS1221 1193 868 325 27.2% ASN-TELSTRA Telstra Pty Ltd AS209 627 331 296 47.2% ASN-QWEST Qwest AS6347 358 81 277 77.4% DIAMOND SAVVIS Communications Corporation AS7046 588 312 276 46.9% UUNET-CUSTOMER UUNET Technologies, Inc. AS4355 398 134 264 66.3% ERMS-EARTHLNK EARTHLINK, INC AS4151 337 90 247 73.3% USDA-1 USDA AS705 441 207 234 53.1% ASN-ALTERNET UUNET Technologies, Inc. AS1239 893 662 231 25.9% SPRINTLINK Sprint AS6198 409 179 230 56.2% BATI-MIA BellSouth Network Solutions, Inc AS852 694 468 226 32.6% ASN852 Telus Advanced Communications AS1 656 438 218 33.2% GNTY-1 Genuity AS4814 233 15 218 93.6% CHINANET-BEIJING-AP China Telecom (Group)Beijing Telecom CompanyBeijing China AS6140 262 65 197 75.2% IMPSAT-USA ImpSat USA, Inc. AS22927 216 20 196 90.7% AR-TEAR2-LACNIC TELEFONICA DE ARGENTINA AS17676 227 32 195 85.9% GIGAINFRA APNIC ASN block AS17557 317 126 191 60.3% PKTELECOM-AS-AP APNIC ASN block AS6595 246 56 190 77.2% DODDSEUR DoD Education Activity Network Assistance Center AS4134 296 114 182 61.5% ERX-CHINALINK Data Communications Bureau AS690 513 336 177 34.5% MERIT-AS-27 Merit Network Inc. AS2048 263 88 175 66.5% LANET-1 State of Louisiana AS7132 241 70 171 71.0% SBIS-AS Southwestern Bell Internet Services AS2548 410 249 161 39.3% ICIX-MD-AS Business Internet, Inc. AS174 291 134 157 54.0% PSINET PSINet Inc. Total 16351 8507 7844 48.0% Top 30 total Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)lists.apnic.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Rain storm in Northern California
by Sameer R. Manek 08 Nov '02

08 Nov '02

There's a really strong rain storm in the Bay Area (California) with the usual thunder, lightning and strong wind. The only kicker is that approximately 300,000 customers are without power. So expect some data centers and businesses to be on UPS right about now. Crossing the Benicia bridge tonight was a bit scary, the car was getting pelted with strong wind, rain and I think hale, or gravel? Sameer ------------------------------------------------------------------------- Sameer R. Manek Email: manek(a)ghur.net "What one has not experienced, one will never understand in print." --Isadora Duncan -------------------------------------------------------------------------

1 0

High Processor Rates on Routers.
by internetguy205＠hotmail.com 08 Nov '02

08 Nov '02

Ladies & Gentleman. Was wondering if it is common for processor rates on higher end Crisco boxes to race from 1 or 2 % show on the 5 second processor rate interval, to anywhere from 70 to 90 %, instanteously, then drop back down to 1 or 2 % after 10 seconds. The above mentioned scenario would happen every 30 seconds. The higher end boxes are very lightly loaded, with total traffic throughput of maybe 100 Meg, in some cases. Think that if these boxes are loaded more, to the point where the aggragated throughtput approaches a Gig, this will cause the processors to run at high levels constantly, driving the CPU rates indicators on the box for 1 & 5 minute intervals up to the values mentioned above. ( 70 to 90 % ). Higher end devices would be something like 7200, 7500, 12xxx series routers. This scenerio would be in a large ( very large network, atleast a tier 2 OR tier 1 provider )... possible rebutals to the fact that processors could race like mentioned above on lightly loaded devices of a higher end nature would be that BGP scanner is causing the problem, Telnet to the devices, show config when on the devices... So what happens to the processor rates when the devices are more heavily loaded ( 1 G aggragated throughput opposed to 100 Meg throughtput )? Will the devices work worrectly AND would a large internet be stable ? Is it also common for BGP Routing tables to be changing version every 1/2 second ? Same high end routers, lightly loaded, large Autonomous System. Thank-you for your time on this query.

5 4

Re: Where is the edge of the Internet? Re: no ip forged-source-address
by bdragon＠gweep.net 07 Nov '02

07 Nov '02

> fine now? u can put "loose"...its NO USE!! thats what i said..there will > always be a route to the source....all u may drop is 10.x/192.168 and > 172/16-31......that too if ur network isnt internally using it.... Oh, and if this ends up being the case, what's wrong with that? Less RFC1918 crap leaking between enterprises.

1 0

Re: Where is the edge of the Internet? Re: no ip forged-source-address
by bdragon＠gweep.net 07 Nov '02

07 Nov '02

> fine now? u can put "loose"...its NO USE!! thats what i said..there will > always be a route to the source....all u may drop is 10.x/192.168 and > 172/16-31......that too if ur network isnt internally using it.... > > and if u end up putting "loose" an OSPF router ull drop valid traffic if ur > not redistributing bgp etc..and if u are redistributing...well again the > above argument holds true...every registered network will be there in BGP > ..... > > -rgds > Alok Since you appear to have not looked into the various implementations of RPF, I'll help you out. RPF uses the FIB, the FIB is populated by all the RIBS, therefore OSPF vs. BGP is a red herring. In the case you describe, you can use semi-strict RPF, populated with all of the networks associated with the customer. This would allow sources from the customer, regardless of path back to those sources, still drop other paths from which there is no path back to the source via the customer, is more efficient than acls, and you already have the data if you are filtering their route announcements.

1 0

RE: Where is the edge of the Internet? Re: no ip forged-source-address
by H. Michael Smith, Jr. 07 Nov '02

07 Nov '02

One of my clients is currently a victim of an over-zealous ISP recklessly trying to implement rpf. One (of two) ISPs are trying to monitor my customer's circuit by watching the serial interface (IP address) of the cpe (customer owned and controlled) router (IP address is from ISP's block). Due to the fact that this customer has a T1 to one ISP and a DS-3 to another ISP, the return path of this monitoring traffic is sent via the 2nd ISP's link. This 2nd ISP (DS-3) is dropping the packets because they are being sourced from the serial interface (IP address of 1st ISP). Advertised routes != valid source addresses.... is this not obvious? I can think of MANY examples of different sets of prefixes being advertised across different links, while the routing decision for outbound packets does not consider what routes are being advertised. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of alok Sent: Thursday, November 07, 2002 3:00 PM To: Majdi S. Abbas; nanog(a)merit.edu Subject: Re: Where is the edge of the Internet? Re: no ip forged-source-address On Fri, Nov 08, 2002 at 01:01:33AM +0530, alok wrote: > there was a comment from chris saying..."never possible to knw what networks > an bgp customer uplinks via you" which is very true.. ..so i assume u mean > non-bgp customers? loose or strict, rpf will not work for aasymterically > connected bgp neighbouring AS.... How does loose not work in this scenario? If it's not in the global tables -at all-, it's not reachable, and might as well be discarded. ------> the scenario is this... a BGP customer uplinks network a.b.c.d via me, but advertises it via some place else (some other network he peers with) and some other bgp peer/router to bring that traffic back into his AS... this can also happen mainly due to BGP metrics blah blah.... now, essentially a.b.c.d can be anything...and he need not tell me what he uplinks from me, all he tells me are the networks he downlinks via me so as to tell me what routemaps to put with acls for bgp advertisements from him...... infact people tend to use this very often (also a way of providing link failure etc by multihoming) ..and they have the choice to uplink anything from anywhere and downlink it from another location...they certainly dont need to tell you what they uplink..as far as i know... now the point is that if you use loose rfp here.... what are u filtering on? you dont even know what he is uplinking to you... i assume the subject is still DDoS attacks...using spoofed ips... now when u dont know what he is uplinking from ur networks, how do u even know what to block? if u say "loose" simply means check if the entry for the network is there in the routing table..then the entire internet is there in the routing table...(thanks to bgp)....so it certainly work on bgp based "edges" the other point u made about not reachable...well not reachaable from where? from a ospf running node which uses 0.0.0.0 ? a lot of ones own networks etc may not be reachable from there i guess...as they are covered in default routes... for a bgp running router...all valid internet addresses are "reachable" , for an ospf router....all is reachable either via 0.0.0.0, and if u remove default any, it doesnt even know what the customer networks are.....so a lot "isnt" reachable.... i think as was rightly defined...the edge is the place where the end user/host gets onto the net...

2 1

Re: Where is the edge of the Internet? Re: no ip forged-source-address
by alok 07 Nov '02

07 Nov '02

there was a comment from chris saying..."never possible to knw what networks an bgp customer uplinks via you" which is very true.. ..so i assume u mean non-bgp customers? loose or strict, rpf will not work for aasymterically connected bgp neighbouring AS.... ----- Original Message ----- From: <bdragon(a)gweep.net> To: alok <alok.dube(a)apara.com> Cc: <nanog(a)nanog.org> Sent: Friday, November 08, 2002 12:41 AM Subject: Re: Where is the edge of the Internet? Re: no ip forged-source-address > > I'm opposed to some of the suggestions where to put source address > > filters, especially placing them in "non-edge" locations. E.g. requiring > > address filters at US border crossings is a *bad* idea, worthy of an > > official visit from the bad idea fairy. > > What is bad about filtering facing non-customers, if loose rpf is > used? I'm assuming this is what you mean by "border crossings" rather than > the literal. > > --------->makes sense on the edge/aggregation but if you do it further up in > the network.....there maybe some cases where we have assymetric routing, > where the path of uplink is never the path the same as the downlink, and > infact the source network of the packet may never be present in the routing > table....(it is possible, after all its a packet switched network and the > routing is destination IP based) ... Right, which is why I specifically mentioned loose rpf, vs. strict rpf. Even further up the customer chain, you'll still have a list of customer networks (assuming folks are doing the right thing by filtering customer bgp announcements) which could be used as an input to strict rpf.

5 7

Re: Where is the edge of the Internet? Re: no ip forged-source-address
by alok 07 Nov '02

07 Nov '02

if what u mean by loose is "exist only" then yes on a bgp running router probably the WHOLE INTERNET IS EXIST ONLY...that surely gives u enuf ips to spoof with....?? how do u block by source????????? you could only know that "frrom that link between as-1 and as-2 there will be some traffic from a network IP of AS-1" etc...which still is a huge network..enuf to spoof lots of IPs..... =====> for clarification.....i mean "any *registered* netowrk of AS-1 can uplink via this link" ...this link may not be the downlink for this network into AS-1 but can still be an uplink..... fine now? u can put "loose"...its NO USE!! thats what i said..there will always be a route to the source....all u may drop is 10.x/192.168 and 172/16-31......that too if ur network isnt internally using it.... and if u end up putting "loose" an OSPF router ull drop valid traffic if ur not redistributing bgp etc..and if u are redistributing...well again the above argument holds true...every registered network will be there in BGP ..... -rgds Alok

1 0

RE: no ip forged-source-address
by H. Michael Smith, Jr. 07 Nov '02

07 Nov '02

A fundamental effect of spoofing addresses from your local subnet is that when the packets reach their target, the source addresses are meaningful. I realize that the traceability of these packets has already been mentioned, but I want to point out the profound difference between a DDoS attack with meaningful vs. meaningless source addresses. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Hank Nussbacher Sent: Wednesday, October 30, 2002 2:27 PM To: variable(a)ednet.co.uk Cc: nanog(a)nanog.org Subject: Re: no ip forged-source-address On Wed, 30 Oct 2002 variable(a)ednet.co.uk wrote: If every router in the world did this I could still use spoofed IP addresses and DDOS someone. My little program could determine what subnet I am on, check what other hosts are alive on the subnet and then when it decides to attack, it would use some neighbor's IP. The subnet I am on is a /24 and there very well may be a few dozen hosts. I could be real sneaky and alter my IP randomly to be any of my neighbors for every packet I send out. Traceback would get me instantly back to the offending subnet but then it would take a bit of digging on the network admin to track me down and applying RPF checking won't help. RPF checking can only go so far. You would need RPF checking down to the host level and I haven't heard anyone discuss that yet. -Hank > > Hi, > > I've been following the discussion on DDoS attacks over the last few weeks > and our network has also recently been the target of a sustained DDoS > attack.I'm not alone in believing that source address filters are the > simplest way to prevent the types of DDoS traffic that we have all been > seeing with increasing regularity.Reading the comments on this list have > lead me to believe that there is a lot of inertia involved in applying > what appears to me as very simple filters. > > As with the smurf attacks a few years ago, best practice documents and > RFC's don't appear to be effective.I realise that configuring and > applying a source address filter is trivial, but not enough network admins > seem to be taking the time to lock this down.If the equipment had > sensible defaults (with the option to bypass them if required), then > perhaps this would be less of an issue. > > Therefore, would it be a reasonable suggestion to ask router vendors to > source address filtering in as an option[1] on the interface and then move > it to being the default setting[2] after a period of time?This appeared > to have some success with reducing the number of networks that forwarded > broadcast packets (as with "no ip directed-broadcast"). > > Just my $0.02, > > > Richard Morrell > edNET > > [1] For example, an IOS config might be: > > interface fastethernet 1/0 > no ip forged-source-address > > [2] Network admins would still have the option of turning it off, but this > would have to be explicitly configured. > > >

13 27

Re: Where is the edge of the Internet?
by bdragon＠gweep.net 07 Nov '02

07 Nov '02

> -----------> so its a hardware limitation?....bigger cores needed The best place to filter is the edge of one's network, in the strictest manner possible. While possible to filter in the core of one's network, you lose the majority of the usefulness of RPF (no strict checking, can only check for sources which don't appear in the routing table at all).

1 0