- Test - lists.nanog.org

Security focus (aka bugtraq) reachability
by Mike Tancsa 13 Sep '02

13 Sep '02

Can anyone with a host in the IP range of 64.0.0.0/8 confirm if they can connect to the www.securityfocus.com or mail.securityfocus.com ? (i.e. the bugtraq people). I have tried from two separate networks (mine and a totally separate ISP nothing to do with my AS) and both cannot connect from different IP addresses in the 64.0.0.0/8 range. From IP addresses outside of 64/8 its fine. Its as if they dont have ip classless enabled or some rogue firewall rules / routes. e.g. quartz# telnet -s 199.212.134.17 www.securityfocus.com 80 Trying 66.38.151.10... Connected to www.securityfocus.com. Escape character is '^]'. ^] telnet> close Connection closed. quartz# telnet -s 64.7.128.97 www.securityfocus.com 80 Trying 66.38.151.10... telnet: connect to address 66.38.151.10: Operation timed out telnet: Unable to connect to remote host quartz# quartz# traceroute -s 199.212.134.17 www.securityfocus.com traceroute to www.securityfocus.com (66.38.151.10) from 199.212.134.17, 64 hops max, 40 byte packets 1 iolite (209.112.4.3) 1.206 ms 2.952 ms 3.377 ms 2 hespler-waterloo (199.212.135.65) 3.299 ms 0.497 ms 1.419 ms 3 waterloo-hespler (199.212.135.66) 2.839 ms 2.542 ms 1.740 ms 4 tor-wat (64.7.143.42) 8.786 ms 6.523 ms 9.926 ms 5 64.187.3.213 (64.187.3.213) 55.151 ms 49.215 ms 52.673 ms 6 h216-18-62-89.gtconnect.net (216.18.62.89) 53.744 ms 51.485 ms 52.029 ms 7 GE3-1.WANB-TOROON.IP.GROUPTELECOM.NET (216.18.63.13) 51.477 ms 51.297 ms 54.376 ms 8 POS9-2.WANB-CALGAB.IP.GROUPTELECOM.NET (216.18.32.165) 49.236 ms 52.984 ms 51.725 ms 9 216.18.32.6 (216.18.32.6) 52.931 ms 68.631 ms 47.683 ms 10 216.18.37.117 (216.18.37.117) 51.466 ms 51.354 ms 51.815 ms 11 216.18.37.117 (216.18.37.117) 54.124 ms !X *^C quartz# They are single homed out of GT (AS 6539). ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

1 1

ISPs who de-aggregate intentionally?
by Jeffrey Haas 13 Sep '02

13 Sep '02

As part of the process of making the latest BGP draft an IETF standard, the IDR working group is in the process of reviewing how the current draft reflects deployed code. As part of this effort, if anyone is aware of ISPs who intentionally de-aggregate routes and could contact me to share some of the reasoning and their methodologies behind this, I would greatly appreciate it. Please note - no names will be named, unless you want to be. A summary of the results will be posted back to this list. -- Jeff Haas NextHop Technologies

2 3

FW: Suspension of posting rights for Jim Fleming
by Jeroen Massar 13 Sep '02

13 Sep '02

And another time your 'friend' has been suspended on the IETF list Mr. Baptista. This one is for the record, so that everyone who finds your 'nice' one-sided story also gets to know the other side. Enough of this, back to ops. Greets, Jeroen -----Original Message----- From: owner-ietf(a)ietf.org [mailto:owner-ietf@ietf.org] On Behalf Of Harald Tveit Alvestrand Sent: Thursday, 12 September 2002 16:09 To: ietf(a)ietf.org Subject: Suspension of posting rights for Jim Fleming After having reviewed Jim Fleming's recent contributions to the IETF list, and having found no trace of modification to his behaviour after the warning he received on August 23, I have suspended his posting privilleges. This revocation will remain in effect for 2 months, until November 12. Harald Alvestrand IETF Chair

5 5

Overcoming IPv6 Security Threat
by Joe Baptista 13 Sep '02

13 Sep '02

Thanks to everyone who helped out. cheers joe baptista >http://www.circleid.com/articles/2533.asp > >Overcoming IPv6 Security Threat > >September 12, 2002 | By Joe Baptista > >Technology rags and industry pundits see IPv6 (Internet Protocol version >6) as the future of networking, but Daniel Golding a participant of the >North American Network Operators' Group (NANOG) thinks it's a "solution in >search of a problem". Many others have argued IPv6 is a problem in itself >and it is unlikely the protocol will gain wide acceptance in the short >term. > >IPv6 does solve many of the problems with the current version of IPv4 >(Internet Protocol version 4). Its purpose is to expand address space and >fix the IPv4 address depletion problem, which many techies claim, was due >to mismanagement. The industry's goal is to use the very large address >allocation pool in IPv6 to expand the capabilities of the Internet to >enable a variety of peer-to-peer and mobile applications including >cellular phone technology and home networking. > >IPv6, a suite of protocols for the network layer, uses IPv4 gateways to >interconnect IPv6 nodes and comes prepackaged with some popular operating >systems. This includes almost all Unix flavors, some Windows versions and >Mac OS. Some vendors offer upgrades to older operating systems. Trumpet >Software International in Tasmania Australia manufactures a Trumpet >Winsock version that upgrades old Windows 95/98 and NT systems to the >current IPv6 standard. > >IPv6 has suffered bad press over privacy issues. Jim Fleming, the inventor >of IPv8, a competing protocol, sees many hazards and privacy flaws in >existing IPv6 implementations. IPv6 address space in some cases uses an ID >(identifier) derived from your hardware or phone "that allows your packets >to be traced back to your PC or cell-phone" said Fleming. Potential abuse >to user privacy exists as a hardware ID wired into the IPv6 protocol can >be used to determine the manufacturer, make and model number, and value of >the hardware equipment being used. Fleming warns users to think twice >before they buy themselves a used Laptop computer and inherit all the >prior surfing history of the previous user! > >IPv6 uses 128 bits to provide addressing, routing, and identification >information on a computer interface or network card. The 128 bits are >divided into the left 64 and the right 64. Some IPv6 systems use the right >64 bits to store an IEEE defined global identifier (EUI64). This >identifier is composed of company id value assigned to a manufacturer by >the IEEE Registration Authority. The 64-bit identifier is a concatenation >of the 24-bit company identification value and a 40-bit extension >identifier assigned by the organization with that company identification >assignment. The 48-bit MAC address of your network interface card may also >be used to make up the EUI64. > >In the early stages of IPv6 development, Bill Frezza a General Partner >with the venture capital firm, Adams Capital Management warned software >developers that if privacy issues are not properly addressed, the >migration to IPv6 "will blow up in their face"! Leah Gallegos agrees that >while "expanding the address space is necessary the use of the address for >ID and tracking is horrific". Gallegos the operator of the top-level >domain .BIZ and a Director of the Top Level Domain Association cautions >network administrators that they should refuse to implement IPv6 unless >these issues are properly addressed. > >Privacy concerns prompted the creation of new standards, which provide >privacy extensions to IPv6 devices. Thomas Narten and Track Draves of >Microsoft Research published a procedure to ensure privacy of IPv6 users. >Narten, IBM's technical lead on IPv6 and an Area Director for the Internet >Engineering Task Force (IETF), agrees "IPv6 address can, in some cases, >include an identifier derived from a hardware address". But Narten points >out that a hardware address is not required. "In cases where using a >permanent identifier is a problem", said Narten "RFC 3041 addresses should >be used". > >RFC 3041 titled "Privacy Extensions for Stateless Address >Autoconfiguration in IPv6" was published this past January 2001 by the >IETF. It is an algorithm developed jointly by Narten and Draves which >generates randomized interface identifiers and temporary addressees during >a user session. This would eliminate the concerns privacy advocates have >with IPv6. > >Unfortunately RFC 3041 is not widely implemented. But Narten expects major >vendors to incorporate his privacy standard and offered that Microsoft >implemented privacy extensions "and apparently intends to make it part of >their standard stuff". Narten also assisted in the drafting of >recommendations for some second and third generation cellular phones >recently approved for publication by the Internet Engineering Steering >Group. That document recommends that RFC 3041 be implemented as part of >cellular phone technology but he did not know what direction cell phones >manufacturers were taking. "I suspect that client vendors will generally >implement it because of the potential bad PR if they don't" said Narten. > >Another obstacle raised by NANOG operators is that there is currently no >commercial demand for IPv6 at this time. Dave Israel, a Data Network >Engineer and regular participant on NANOG lists, sees no immediate demand >for IPv6 services. "The only people who ask me about IPv6", said Israel >"are people who have heard something about it from some tech-magazine and >want the newest thing". Israel says he sees no commercial demand for a v6 >backbone. > >Daniel Golding, another NANOG participant agrees, "v6 deployment is being >encouraged by some countries, and the spread of 3G (cellular technology) >is helping things along, but we have yet to see really widespread v6 >deployments anywhere". Golding sees major backbone networks deploying IPv6 >when it makes economic sense for them to do so. "Right now", said Golding >"there is no demand and no revenue upside. I don't expect this to change >in the near future". > >Most on NANOG agree the roadblock seems to be a lack of ISPs that offer >IPv6 services. Stephen Sprunk, a Network Design Consultant with Cisco's >Advanced Services group sees the "greater adoption of always-on broadband >access will be the necessary push" to get IPv6 off the ground. "Enterprise >networks will not be the driver for ISPs to go to IPv6" said Sprunk and >"NAT is too entrenched". Network Address Translation (NAT) is a method of >connecting multiple computers to the Internet (or any other IP network) >using one IPv4 address. > >Vint Cerf senior vice president of architecture & technology at WorldCom >has been using IPv6 for about four years. IPv6 has been a key element for >some of WorldCom's Government customers. Cerf thinks IPv6 supporters have >a lot of work ahead to achieve successful deployment of the protocol. He >expects "that over the next several years we will see a lot of consumer >devices set up to work with IPv6" and "cell phones are likely candidates, >as are radio-enabled PDAs". > >-EOF The dot.GOD Registry, Limited http://www.dot-god.com/

8 9

Re: Vulnerbilities of Interconnection
by Dave Israel 13 Sep '02

13 Sep '02

On 9/13/2002 at 10:30:47 -0400, alex(a)yuriev.com said: > > > > > > > Yet, it is reasonable that people expect x % of their traffic to > > > use IX's. If those IX"s are gone then they will need to find another > > > path, and may need to upgrade alternate paths. > > > > > > I guess the question is. > > > > > > At what point does one build redundancy into the network. > > > > No, it doesnt necessarily use IX's, in the event of there being no peered path > > across an IX traffic will flow from the originator to their upstream > > "tier1" over a private transit link, then that "tier1" will peer with the > > destination's upstream "tier1" over a private fat pipe then that will go to the > > destination via their transit private link. > > > > I'm only aware of a few providers who transit across IX's and I think the > > consensus is that its a bad thing so it tends to be just small people for whom > > the cost of the private link is relatively high. > > I think you are missing a one critical point - IX in this case is not an > exchange. It is a point where lots of providers have lots of gear in a > highly congested area. However they connect to each other in that area does > not matter. > > Now presume those areas are gone (as in compeletely gone). What is the > possible impact? They're all completely gone? Then we have a bigger issue than the Internet not working, because lots of us are dead. A lot of the exchange areas are city-wide, in a literal sense. Take DC, for example. Lots of folks connect in DC, not just at MAE-East, but also via direct cross-connects between providers, following a large variety of fiber paths owned by a variety of carriers. A single event that removed all the connectivity from DC would either have to devastate the city and surrounding suburbs, or at a minimum, distrupt electronics (EMP airburst) or hit every power plant in the area (and yeah, that kills folks, too, especially in winter.) Now, having destroyed civilization in DC (so to speak), we have removed a major exchange point, but also all traffic generated in DC. The rest of the Internet is fine. To break the rest of the exchanges, we'd have to do the same to New York, Dallas, Boston, Chicago, Atlanta, San Francisco, San Jose... And that's just in the States. If you were to hit a telco hotel (usually a hard target, but we'll grant you the necessary firepower), you would inconvenience the Internet in that area until another well-connected site could be chosen and filled with equipment. Internet infrastructure is logically mapped to telco infrastructure, and telco infrastructure is ubiquitous. You're looking for a weakness where it isn't. If you wanted to hurt the Internet, you wouldn't hit a city. You'd hit the cross country fiber paths, out in the middle of nowhere. -Dave

1 0

RE: IP over in-ground cable applications.
by sal.sabella＠hushmail.com 13 Sep '02

13 Sep '02

> I've been called a lot of things, but moron isn't one of them. Want to make a bet on it with your boss? Moron. Sal Sabella Get your free encrypted email at https://www.hushmail.com

2 1

RE: ISPs who de-aggregate intentionally?
by dalph＠hush.com 13 Sep '02

13 Sep '02

> As part of the process of making the latest BGP draft an IETF > standard, the IDR working group is in the process of reviewing how > the current draft reflects deployed code. > > As part of this effort, if anyone is aware of ISPs who intentionally > de-aggregate routes and could contact me to share some of the > reasoning and their methodologies behind this, I would greatly > appreciate it. It's great for traffic engineering. We have two different upstreams in two different cirites, and use it to avoid traffic on our core. We wanted to offer static IP dialups for roaming users, but had troubles with /32 prefixes being filtered by the big players. -Dalph Get your free encrypted email at https://www.hushmail.com

2 1

Updated BGP monitoring
by Rob Thomas 12 Sep '02

12 Sep '02

Hi, NANOGers. I have updated my BGP monitoring to include ASN analysis. This includes the count of unique ASNs, the count of ASNs that originate at least one prefix, the average path length, the maximum path length, and the bogus ASNs. You will find it all here: http://www.cymru.com/BGP/index.html The bogus ASN page, complete with a colorful graph, can be found here: http://www.cymru.com/BGP/asnbogusrep.html Comments and feedback are always welcome! My thanks to those who donate peering and gear to my monitoring efforts. :) Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

RE: IP over in-ground cable applications.
by sal.sabella＠hushmail.com 12 Sep '02

12 Sep '02

> I'm not a big fan of GE period; too many recalls. However you > might want to take a look at Jennair I had a bet with my boss that GE would bring good things to life. Please don't tell me I lost. Sal Sabella Get your free encrypted email at https://www.hushmail.com

2 1

RE: IP over in-ground cable applications.
by sal.sabella＠hushmail.com 12 Sep '02

12 Sep '02

>Thanks for the response. The 'Broadband' in Broadband Laboratories >actually refers to the Microwave That makes sense. I have a question you might be able to answer. I've got some Cerent and Sycamore boxes, and I'm trying to locate a GE Advantium line card. We're fixing to sell Advantium wavelenghts on the same glass as gig-e and OC-x's, catering primarily to the hospitality and food services industry, by Q1 2003. You could even say I bet on it with my boss. Know where I can buy one? Also, what type of performance have you seen with Advantium vs. conventional microwave-based transport technologies? Sal Sabella Get your free encrypted email at https://www.hushmail.com

2 1