- Test - lists.nanog.org

Re: RE: Vulnerbilities of Interconnection
by sgorman1＠gmu.edu 05 Sep '02

05 Sep '02

That is one of the reasons research is being done at universities, they are not answerable to FOIA's. While the university environment is not the Fort Knox of security for special projects a high level of security and confidentiality can be ensured. Trying to sort out publications is the headache. ----- Original Message ----- From: "Daniel Golding" <dgolding(a)yahoo.com> Date: Thursday, September 5, 2002 1:27 pm Subject: RE: Vulnerbilities of Interconnection > > The crux of the issue are FOIA requests. The government won't make > thesetypes of vulnerability reports immmune to FOIA requests - > thus a foreign > terrorist or home-grown "farmbelt fuhrer" could simply order up a > list of > the most vulnerable sites, and select some to attack. > > Due to the distributed nature of the internet, and the routing > protocolsthat regulate it's traffic flow, there is no single point > of failure. > However, we have seen how concerted attacks can be made at multiple > locations, almost simultaneously. > > If the government could agree to allow this information to remain > confidential, it would greatly expedite the process of hardening > appropriatefacilities, and identifying weaknesses. > > - Daniel Golding > > > Sean Donelan Said... > > > > > > > > On Thu, 5 Sep 2002 sgorman1(a)gmu.edu wrote: > > > very much like to avoid doing the research in a vaccuum. I > was hoping > > > a discussion on NANOG wold be a good first step. The project > is quite > > > hot with the politicos and I very much want to make sure to best > > > recommendations are made. Formal industrsy cooperation is one > side of > > > this, but I think a lot of information can be gained from an > informal> > approach as well. Any and all feedback is greatly > appreciated> > > > http://www.infosecuritymag.com/2002/sep/2002survey/voices/verylarge.sht ml> > > On security reporting... > > "Since Sept. 11, state, local and federal authorities have tried > to get > > their arms around the potential threats to the nation's > > infrastructure--including the telecommunications infrastructure. > They have > > asked us questions like, 'What are your 100 most vulnerable > places in the > > network?'" > > > > "As much as we would like to help the government in its attempt > to help > > us, we believe it would be counterproductive to share such > information> widely because if it were released, it would provide > a terrorist with a > > roadmap to our key locations. Unless the government agrees that > it can > > protect our information, we will continue to respectfully > decline such > > blanket requests." > > > > Bill Smith > > CTO and President of Interconnection Services, BellSouth > > > > > > >

1 0

RE: IP address fee??
by Owens, Shane (EPIK.ORL) 05 Sep '02

05 Sep '02

Forgive my use of the term Class C, we do assign CIDR blocks to customers and make them justify their addresses. I just finished a call with sales and a customer where the customer said they won't pay for additional addresses beyond a /24 and I was asked to see what other carriers are doing in these situations. Shane -----Original Message----- From: Richard A Steenbergen [mailto:ras@e-gerbil.net] Sent: Thursday, September 05, 2002 1:48 PM To: Derek Samford Cc: 'Owens, Shane (EPIK.ORL)'; nanog(a)nanog.org Subject: Re: IP address fee?? On Thu, Sep 05, 2002 at 01:36:27PM -0400, Derek Samford wrote: > Shane, > There is a practice on that (At least here.). Generally we > provide a Class C to our customers at no additional charge, but we > have Why in this day and age, 9 years after the invention of CIDR, are we still refering to "class C"'s? -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Re: Vulnerbilities of Interconnection
by sgorman1＠gmu.edu 05 Sep '02

05 Sep '02

As a side note the thanks for responses on Equinix were off list responses - was not meant to be sarcasm since there were not any on list responses. Back to the topic - the first question is the cost of protecting an asset less than the cost of loosing the asset. If the answer is yes then there is economic justification for protection. I believe the issue will not be one of the government deciding what assets are ciritcal, but more likely the insurace industry. At the end of the day the insurance industry has to come to terms with how to deal with network downage. The value they put on assets for insurance and reassurance will most likey be the trigger. Then you can start get an answer to your question of who is most critical - who has the most loose finacially from downage. From the examples you listed I'd say NASDAQ. The question becomes what infrastructure is that critical node or sector most dependent on. It is the interdependecies that causes the rub, who is responsible, who is left holdig the bag, who has the ability to pay etc. ----- Original Message ----- From: batz <batsy(a)vapour.net> Date: Thursday, September 5, 2002 4:36 pm Subject: Re: Vulnerbilities of Interconnection > On Thu, 5 Sep 2002 sgorman1(a)gmu.edu wrote: > > :I completely agree with statement. It is not a matter of wanting > to > :know where the importants hubs are - we have a pretty good handle > on > :that, but what the impacts would be of a hub loss from an > operational > :stand point. Maybe this is a discussion that needs to be off- > line. > :My goal is to provide some context and validation for the > research > :that is being carried out. > > The vulnerability is relative to the priority and value of the asset > being protected. Without definition of those assets from the > government, > or whatever stakeholder needs to know, it is difficult to explain. > > > Operationally, you can talk about various meet-me points, hubs, > exchangesand routes as being critical, but the sites those links > service will be > the metric by which their importance is measured. > > Until our various political masters decide what sites they think > are > truely critical, any assessment will be relative to shifting > prioritiesof participants in the discussion. > > Who is more critical; Nasdaq, Google, WCOM or the GSA? You can see > how this becomes relative pretty quickly. > > -- > batz > > >

1 0

Apologies.
by Derek Samford 05 Sep '02

05 Sep '02

Just wanted to publicly apologize for posting HTML to the list. Thanks to Robert Seastrom for pointing it out to me. Still not sure why it posted as html. Derek

1 0

research request
by Irwin Lazar 05 Sep '02

05 Sep '02

NANOG Folks, I'm working on a research project to determine how network product end-users interact with the vendors to obtain technical support, software patches, tech notes, and configuration guidelines. If any of you have about 15-20 minutes to chat or fill out a short survey, please contact me off-list. Thanks, Irwin ------ Irwin Lazar Practice Manager, Burton Group www.burtongroup.com ilazar(a)burtongroup.com Office: 703-742-9659 Cell: 703-402-4119 "DrivingNetworkEvolution"

1 0

Network Routing without Cisco or Juniper?
by Deepak Jain 05 Sep '02

05 Sep '02

It has been a long time since I have seen this thread hashed out, so I figured I'd bring it up publicly. Is anyone comfortable using (in a network with > 5 routers) any non-Cisco or non-Juniper routers for BGP speaking? (Zebra/Gated boxes only count if customer traffic is carried through the device). Historically, some networks have been big fans of Gated boxes and such because they were cheap and scalable to a point. Now many BGP speaking platforms are extremely inexpensive (even from CSCO and JNPR). I was wondering if the consensus has changed. Boxes like Foundry, Extreme, Redback and many others all talk BGP (at least to a first approximation) but is their lack of use in the core/edge/CPE a lack of scale, stability, performance or just interest? Thanks, Deepak

13 15

IRR listing of IANA-reserved, a question..
by John M. Brown 05 Sep '02

05 Sep '02

First, standard disclaimers.. 1. This is a technical email. 2. I'm not speaking for any organization, other than ME. In the last 72 hours I've seen over 3GB of data hit a network I play with with source IP's of IANA-RESERVED space. Various people have reported seeing IANA-RSERVED get announced via BGP at different parts of the net. Various people maintain lists of IANA-RESERVED space and other such "special use or reserved" prefixes. These lists are used by others to generate filters, ACL's and the like. When IANA allocates a new prefix to a RIR, these lists have to be updated manually. Sometime after the space has been put into service and someone complains. Give the above, would it make sense for: A) The IANA to maintain a IRR/RADB type database that would allow for the auto generation of filters and ACL's based *purely* on RESERVED IANA space. No other prefixs would be listed. or B) For one or more of the RIR's (APNIC, ARIN, LACNIC, RIPE, etc) to maintain such a database, again only IANA-RSERVED space. or C) One of the existing well known IRR/RADB's to maintain the db ? If such a database was available, would YOU use it ? Would it help your network operations? Would it be of a possitive or negative nature to your network? Lets try to stay away from the obvious potential flames and other religous statements. Thank you. John Brown Speaking a single person

11 17

Equinix and Big 7??
by sgorman1＠gmu.edu 05 Sep '02

05 Sep '02

The latest Cooke Report made the following statement: "They are, he says, the Internet Core Networks that announced anonymously on December 5, 2001 their decision to move their peering to Equinix Exchanges. He identifies them as UUNET, Sprint, Cable and Wireless, Genuity, Level 3, Qwest, and AT&T." I was wondering if anyone could verify these seven networks moving their collective peering to Equinix and if so any specifics. Previous posts in the archive on participants at Equinix do not seem to bear this out. Any feedback is greatly appreciated. Thanks, sean

1 0

follow-up IANA-RESERVED IRR
by John M. Brown 04 Sep '02

04 Sep '02

A good number of private replies from people and their "day job" addresses. Most have asked for prior permission before quoting them. In general, three default-free global backbone providers stated they would love to see something like this available, from IANA is the prefered answer. Some would like to see more than just IANA address information, and other contend that would be a can of worms and opens some risk issues. It seems that there is general support and that people would use such a service if available and reliable. If you have comments on this, and can post publicly, please do. Thank you john brown speaking for himself

3 4

RE: AT&T NYC
by Martin, Christian 04 Sep '02

04 Sep '02

> >BGP is not a bug-free protocol. > >BGP is the easiest protocol to *debug* when the problem shows up. > >BGP does not help to accidently affect *unaffected* paths when >a problem shows up. While there is a recursion issue in the BGP<->IGP scenario, BGP would be just as "broke" if the only path between two nodes (and whatever nodes are behind them) had their BGP session removed. Misconfigurations do not imply bad network designs. Bugs are bugs (whether they be OSPF or ISIS or BGP). We have seen RSVP/SNMP/NTP/.*P bugs break routers. I also would think that it is a bit of a stretch to criticize the design of the largest networks in the world, which, were it not for bugs here and there, are running just fine. Further, and I think this is what is troubling people here, is how, without IBGP mesh reduction mechanisms, you could build a non-fully meshed network without an IGP and static routes? The only way this is possible is via a combination of meshing, confeds, and route-reflectors, the latter two which are busted by design. If you are building fully meshed networks, then they are small. And one last comment - ISIS is the easiest protocol to troubleshoot IMO. Even RIP is harder because of all the silly holddowns and poison-reverses, etc. BGP is pretty straightforward as well, but there is a lot in the sauce that you need to know from vendor to vendor, etc. With ISIS, you have one DB (or 2), 1 LSP per router, 1 decision point. Finally, you seem to have a problem with dependencies and recursion, philosophically. This surprises me from someone who I know writes code. Do you not use functions? Pointers? What you have said is that a program that breaks because one function relied on another (that failed) is a broken design. My .02 chris > >It looks like everyone forgot the reason for this discussion >to begin with. It is the outage caused by a mistake on a >single router that affected parts of the network that were >*NOT* affected by the original mess. > >Please not that this discussion tends to get restarted >whenever we have a real OSPF (or ISIS) caused mess. > > >Alex >

2 1