- Test - lists.nanog.org

Re: Bogon list
by Miquel van Smoorenburg 05 Jun '02

05 Jun '02

In article <cistron.20020605144803.GB12164(a)overlord.e-gerbil.net>, Richard A Steenbergen <ras(a)e-gerbil.net> wrote: >On Wed, Jun 05, 2002 at 08:34:58AM +0000, Miquel van Smoorenburg wrote: >> >> I haven't seen a 'icmp source lo0' interface command yet. Hopefully >> it will be added for ipv6 so exchanges can use link-local addressing >> (ipv6 has no fragmentation, PMTUd is mandatory). > >I'm not terribly sure why you would want to make traceroutes lose all >information about the circuits you're traveling through. It would make >diagnostics an everloving nightmare, IMHO. With link-local addressing and ip verify unicast reverse you're not going to see any TTL exceeded traceroute packets from link-local addresses anyway. And no ICMP size exceeded packets either, which was my point. But indeed it should be 'ip icmp type <TYPE> source <IP|INT>', with at least a default 'ip icmp type 4 source lo0' or similar for interfaces with link-local addressing. Mike.

1 0

Re: Bogon list
by Miquel van Smoorenburg 05 Jun '02

05 Jun '02

In article <cistron.20020605013323.A7C1EC7936(a)cesium.clock.org>, Sean M. Doran <smd(a)clock.org> wrote: > >| Why treat exchange subnets differently to any other bit of backbone >| infrastructure? > >Oh, I wholeheartedly agree. I would love them all to use RFC 1918 >addresses, because it is VERY VERY VERY rare that anything outside >the scope in which the 1918 local use addresses are unique actually >has to communicate with backbone infrastructure of any type. And again Path MTU discovery gets broken. >What communication can your workstation have with an XYZNET router? Receive ICMP size exceeded packets ? I haven't seen a 'icmp source lo0' interface command yet. Hopefully it will be added for ipv6 so exchanges can use link-local addressing (ipv6 has no fragmentation, PMTUd is mandatory). Mike.

3 2

Meltdown somewhere?
by John Palmer 05 Jun '02

05 Jun '02

Is there some sort of a router meltdown somewhere this evening? I cant get through to most destinations, either with TELNET, http, ftp, DNS - nothing.

4 3

Its NAS again
by John Palmer 05 Jun '02

05 Jun '02

Update - it appears to be either NAS or COVAD that has melted down on the East coast. It seems to be affecting here as well. They even have a message on their customer service line.

2 1

Re: Bogon list
by smd＠clock.org 05 Jun '02

05 Jun '02

| Tweaking our Looking Glass software by itself would not fix the problem | (ours doesn't have this problem anyway). To fix the problem everyone | would have to tweak their Looking Glass software since the problem can | be seen when someone traceroutes from a peer or 3rd party's Looking | Glass into our customer (in the event they weren't receiving the IXP | blocks from us). You sort-of want to convince nth parties to launch their traceroutes _from_ your looking glass, rather than from random places. Targeting people who look up in-addr.arpa mappings, you could always emit pointers to would-be tracerouters -- get yer real data at http://... Points to the person who first puts such a thing into the DNS. | One better might be to have the Looking Glass participating routers | manipulate their source IP address for pings and traceroutes. Yes, this is a good idea. Sean.

2 1

Re: Bogon list
by smd＠clock.org 05 Jun '02

05 Jun '02

| Traceroute to www.foo.com, see it goes through an exchange. Ping | the router on the far end of the exchange, "host unreachable". How do you know the name of the thing at the far end of the exchange? Is it traceroute? Did the traceroute come from a looking glass, perhaps, or pass through a router controlled by the network participating in the exchange? If someone massaged or annotated the results of the traceroute, do you think you might a/ not ping that address, b/ ping an address which somehow corresponds to that router, c/ not know what the hell is going on at all -- maybe there's an MPLS tunnel across 15 routers! | Traceroute to it, "host unreachable" at the first default free | router. Not only will this confuse your customers, but often first | level support staff. The latter can be programmed to use an expert system that looks alot like a looking glass, but returns edited or annotated traceroutes instead. Hey, an in-house FAQ with hyperlinks for your support staff, that's too novel! Let's leak prefixes instead. | Also, you buy service from your favorite default free network. | They aren't present at an exchange. You want to traceroute/ping | a host on that lan. You can't, unless someone tranists the exchange. : macosx ; host some-router-at-mae-xyzzy.foo-bar.net <some loopback address> : macosx ; host some-router-at-mae-xyzzy-actual-interface-address.foo-bar.net <some RFC 1918 address> Which do you more likely ping? This is done all over the place now, unfortunately minus the 1918 addressing. Are there router implementations out there which ALWAYS do the wrong thing, and use the actual-interface-address when sending unreachables & exceededs? (Well, yes, I know there are. Sigh.) Sean.

1 0

Oh, I almost forgot...
by Rob Thomas 04 Jun '02

04 Jun '02

Hi, folks. If you are interested in yet another view of the global table size, you can take a look here: http://www.cymru.com/BGP/ I graph routing table size based on the data collected from my BGP peers. I also display any bogon prefixes, complete with origin ASN. Comments and feedback are always welcome! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

RE: route authentication
by Sean Donelan 04 Jun '02

04 Jun '02

How do you enable an IP interface because you need a unique address for your interfaces? When I say not part of the default configuration I mean the default configuration doesn't even have a space for "put key here." On Tue, 4 Jun 2002, Farhan Memon wrote: > How can u enable auth by default, since you would have to stick in a key > somehow, and if that was default then it could be exploited. > > rgrds > > Faz > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > batz > Sent: 04 June 2002 15:20 > To: Sean Donelan > Cc: Barbara Fraser; nanog(a)merit.edu > Subject: Re: route authentication > > > > On Tue, 4 Jun 2002, Sean Donelan wrote: > > :Some ISPs are practically religious about using them, usually the result > :of a single person at the ISP pushing it. But for the most part it hasn't > :really taken hold in the professional security consulting field. > > I would suggest that it is also ISP's who do not hire security consultants. > Consulting fees tend to come from departmental budgets, and almost > every network engineer I have ever met fancies themselves a security > expert. There isn't alot of incentive for them to get a third party > opinion, because of a lack of faith in the clue of most consultants, and > a general aversion to having anyone touch the delicate house of cards > many network engineers have constructed. > > Maybe Cisco could add this as a default requirement of the configuration > that had to be explicitly disabled? In fact, it would be nice if all > protocol configurations had to have their authentication manually > disabled. > > > > -- > batz > > > >

1 0

route authentication
by Barbara Fraser 04 Jun '02

04 Jun '02

I'm wondering just how many ISPs are using HMAC-MD5 to authenticate IS-IS route advertisements within their ASs, or MD5 on BGP peering sessions? I don't need a real number, just a sense of the community. Is usage increasing? is it dead? is it regional? etc. Any anecdotal info you have is appreciated. I don't need names of ISPs, just whether or not these technologies are being used. thanks, Barbara Barbara Fraser Consulting Engineer Cisco Systems, Inc. Phone: +1 (408) 525-1735

5 4

packet sniffers and protocol decoders used by isps
by Daniska Tomas 04 Jun '02

04 Jun '02

hi, this topic seems being at least semi-operational to me :) i'd like to make an idea of which sniffers and (the more important part) decoders are included in the arsenal of engineering tools used by network engineers at various isp sizes practical experience would be the most valuable information please feel free to reply privately if you feel this does not fit the list topics thanks much -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first.

2 1