- Test - lists.nanog.org

PATRIOT/USA technical problems, call to action
by William Allen Simpson 10 Oct '01

10 Oct '01

Democracy is not a spectator sport. The US House (hr.2975 PATRIOT) and US Senate (s.1510 USA) have introduced bills that will cost ISPs a lot of money -- potentially tens of thousands of dollars -- even for small ISPs. Unlike CALEA, there is no requirement that ISPs be reimbursed. This happened because the legislators are clueless about technical requirements. It is up to you to educate them! With the bombing started, it is thought that the bills will be pushed through this week, without going through the normal committee review. Each and every one of you MUST call your legislators, where you work and again where you live. Call your Senator, and then call your Representative. Do not send email, it won't get read soon enough! Since Monday is a legal holiday of sorts, you may have to wait until Tuesday morning, but try on Monday anyway. -- Urge your representatives in Congress to hold full hearings, and fix technical problems. 1. Call the White House switchboard at 202-224-3121, and ask to be connected to the office of your Congressional representative. -or- Look up the office numbers on the web at www.house.gov and www.senate.gov. 2. When you are put through, say "May I please speak to the staff member who is working on the anti-terrorism legislation?" If that person is not available to speak with you, say "May I please leave a message?" 3. Briefly explain that you work for an Internet Service Provider, and although you appreciate the efforts of your representative to address the challenges brought about by the September 11th tragedy, it would be a mistake to make any changes in the federal wiretap statute that do not respond to "the immediate threat of investigating or preventing terrorist acts." -- If they want to talk details, here they are: Both bills add "addressing" and "routing" to the list of activities that can be requested without a specific court order. So, just like call setup for the phone companies, every single address that you assign, via DHCP or otherwise, and every ARP, RIP, OSPF, and BGP routing table change, must be recorded for posterity -- just in case any state or federal agents want to review it someday. No time limits, and no statute of limitations. Some lawyers read this to extend to tracking every URL accessed through your POPs, and every email To: and From: transmitted over your networks, since they both can be considered "addressing" and your activity "routing". Obviously, the legislators don't quite understand what a dynamic packet connectionless Internet means! -- My solution, after talking to several Representatives and Senators staffs, is to add clarification to the definitions section 3127: (7) the term "addressing" means a numeric identifier that assists the delivery of electronic communications over a specific link, attached to the outermost encapsulation of the communication (but not including the contents of such communication). (8) the term "routing" means the numeric internetwork locator associated with a communication that facilitates its carriage between electronic communication services, contained within the internetwork communication encapsulation (but not including the contents of such communication). -- As you can see, my solution means you can do it with standard tools, like tcpdump or snort, and unlike phone call setup, there's nothing in the definitions that indicates the information has to be recorded for future requests.... -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

6 7

RE: Filtering Best Practices, et al (Was Verio Peering, Gordon's Knot)
by Hallgren, Michael 10 Oct '01

10 Oct '01

> > On Wed, Oct 10, 2001 at 10:54:03AM +0200, Stephane Bortzmeyer wrote: > > > > > I'm currently in the process of setting up a new border > router, and the > > > recent debate on the above topic got me wondering what > the best practice > > > filtering policy is? Is there one? > > > > I'm interested to see if people filter route anouncements > on the basis > > of registered routes in an Internet Routing Registry. In our area > > (Europe), the RIPE database typically contains less than half of the > > routes which are actually announced. I assume it is not better in > > ARINland. > > When I worked at Tiscali (World Online) Denmark, we did prefix > filtering on our peers, the results of that can be seen on > http://as8807.net/dixirrstats.txt (Though that is old, january this > year) > I believe that TeleDanmark also still do IRR filtering, and I know of > several providers in Denmark who are ready to follow suit as soon as > some of the "worst IRR-offenders" have updated their IRR > records (which > actually has happened already) > > If you decide to implement IRR filtering you may want to see how your > peers perform in the IRR area by using a small utility, which can be > downloaded from http://noc.tele.dk/util.html. This is the utility that > was used to produce the stats for Tiscali's router. Thanks. (Yes, successfully filtering peers wrt IRR sometimes require human interaction - asking peer not up-to-date to become so.) mh > > -- > Andreas Plesner Jacobsen >

1 0

RE: Filtering Best Practices, et al (Was Verio Peering, Gordon's Knot)
by Hallgren, Michael 10 Oct '01

10 Oct '01

Hi/Bonjour Stephane, > > > On Wed, Oct 10, 2001 at 10:22:09AM +0100, > Hallgren, Michael <michael.hallgren(a)Teleglobe.com> wrote > a message of 50 lines which said: > > > we - Teleglobe, that is - filter our customers wrt. as-path > and prefix... > > also in the RIPE area. If a customer isn't up-to-date with IRR, we > > Well, your customers, OK, but your peers (the ones without transit > traffic, which are supposed to announce only their networks) at > exchange points? In general, currently, yes, peers as well. mh >

1 0

RE: Filtering Best Practices, et al (Was Verio Peering, Gordon's Knot)
by Hallgren, Michael 10 Oct '01

10 Oct '01

Hi, we - Teleglobe, that is - filter our customers wrt. as-path and prefix... also in the RIPE area. If a customer isn't up-to-date with IRR, we advice/help him to become so. (The idea is, keeping filters on our customers is also of benefit to our peers, etc, etc.) mh > -----Message d'origine----- > De : Stephane Bortzmeyer [mailto:bortzmeyer@gitoyen.net] > Envoyé : mercredi 10 octobre 2001 10:54 > À : Grant A. Kirkwood > Cc : nanog(a)merit.edu > Objet : Re: Filtering Best Practices, et al (Was Verio > Peering, Gordon's > Knot) > > > > On Tue, Oct 09, 2001 at 07:58:19AM -0700, > Grant A. Kirkwood <grant(a)virtical.net> wrote > a message of 18 lines which said: > > > I'm currently in the process of setting up a new border > router, and the > > recent debate on the above topic got me wondering what the > best practice > > filtering policy is? Is there one? > > I'm interested to see if people filter route anouncements on the basis > of registered routes in an Internet Routing Registry. In our area > (Europe), the RIPE database typically contains less than half of the > routes which are actually announced. I assume it is not better in > ARINland. > > On the basis of inetnum objects (network addresses, not routes), it is > a bit better in coverage but you cannot use inetnum directly in a > comparison, you have to check that a BGP announce *includes* at least > one registered inetnum. > > To summary, I dropped the idea. Does anyone implemented it? > > >

2 1

Re: BGP noise tonight? (fwd)
by jlewis＠lewis.org 10 Oct '01

10 Oct '01

So who do you blame...the RFC or the vendor that ignores it? Dropping the session seems to break the "be conservative in what you send and liberal in what you accept" suggestion. If you know someone else will ignore the rules (there's always someone) breaking due to their error kind of sucks. -- ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route System Administrator | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________ ---------- Forwarded message ---------- Return-Path: <if(a)sil.at> Received: from mailhost.mmaero.com (mailhost.mmaero.com [208.152.224.3]) by redhat1.mmaero.com (8.11.6/8.9.3) with ESMTP id f984S0Z24869 for <jlewis(a)redhat1.mmaero.com>; Mon, 8 Oct 2001 00:28:00 -0400 Received: from waste.silverserver.co.at (waste.silverserver.co.at [194.152.178.7]) by mailhost.mmaero.com (8.11.2/8.11.2) with ESMTP id f984Rxp20147 for <jlewis(a)lewis.org>; Mon, 8 Oct 2001 00:28:00 -0400 Received: from ikarus (ikarus.sil.at [194.152.178.41]) by waste.silverserver.co.at (8.11.6/8.11.6) with ESMTP id f984Roi31471 for <jlewis(a)lewis.org>; Mon, 8 Oct 2001 06:27:50 +0200 Date: Mon, 8 Oct 2001 06:27:51 +0200 (MEST) From: Ingo Flaschberger <if(a)sil.at> X-Sender: chaoztc@ikarus To: jlewis(a)lewis.org Subject: Re: BGP noise tonight? In-Reply-To: <Pine.LNX.4.30.0110080010050.1854-100000(a)redhat1.mmaero.com> Message-ID: <Pine.SOL.4.21.0110080627120.15412-100000@ikarus> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Hi i could not post to nanog directly.. perhaps you could do it for me? our 2 uplinks, ebone and carrier1 went down (flapping routes at the borders). the problem was a malformed as-path (with a private confederation in it), which was distributed from netherland over the network... (over routers VendorX). rfc-compliant routers dropped the peering session after receiving this malformed route ebone has contaced the provider and he has already fixed this announcement. thnx & bye, Ingo -- "I worry about my child and the Internet all the time, even though she's too young to have logged on yet. Here's what I worry about. I worry that 10 or 15 years from now, she will come to me and say 'Daddy, where were you when they took freedom of the press away from the Internet?'" --Mike Godwin

10 14

Re: Equinix, AboveNet, Broadwing?
by woody＠zocalo.net 10 Oct '01

10 Oct '01

Equinix doesn't sell transit, unless they've had a sudden and drastic change of business model. ----Original Message---- From: Timothy Brown <timothy.brown(a)pobox.com.pager.zocalo.net> Subject: Equinix, AboveNet, Broadwing? Can those of you with equipment in the above facilities that are also using those providers for transit please contact me privately? I have a few questions. Tim

2 1

FBI warning to infrastructure owners
by Sean Donelan 09 Oct '01

09 Oct '01

According to news reports Attorney General Ashcroft, the FBI issued warnings to law enforcement agencies, corporate security officers and private-sector Information Sharing and Analysis Centers this week. As some of you may know, the Internet is not currently covered by any ISAC. So you may not receive these warnings. It is up to the private sector if, and under what terms, they want to participate in any information sharing activity.

2 3

Equinix, AboveNet, Broadwing?
by Timothy Brown 09 Oct '01

09 Oct '01

Can those of you with equipment in the above facilities that are also using those providers for transit please contact me privately? I have a few questions. Tim

1 0

wanted: 'beacon' hosts ?
by Peter Galbavy 08 Oct '01

08 Oct '01

I don't really know what to ask for or who, so redirection is welcome. I am setting up some monitoring from within our AS to a handful of sites scattered around the UK and the rest of the world. Now, I get annoyed when someone reads the same file off my web server evey five minutes, so I am not going to do it to anyone else without permission. Can anyone help (reciprocally would be fine) by providing permission to use ICMP Echo and HTTP GET requests against something on their network (that is well connected and reliable) so that I can build SLA-targetted averages for performance and packet loss ? I *DO NOT* want to get involved in buying this data from anyone please. I am very happy to provide this service in return, or even just for the sake of it without anything back. What I evisage is the 5-miutely 'GET'ing of a 20k-ish text file from a web server and a group of 5 ICMP Echos at about the same intervals... PS I know this is NANOG, but I am even more interested in hearing from UK and European networks. PPS If people are willing to offer this as a 'public' service, I will happily summarise back to the list and/or build a web site with details. Peter

8 11

INFORMATION FEEDS
by Kelly J. Cooper 08 Oct '01

08 Oct '01

What information feeds are the most useful to your NOC? To your Analysts? To your Engineers? To your Customers? Do you want them to see outage reports on the MAEs? Fiber cut reports from certain telcos/fiber providers? (If so, which ones?) Maintenance reports on NAPs? Maintenance plans from peers? Ticket-based updates from your upstreams/transit providers/peers regarding outages? Changes to registrar databases? Maintenance announcements on the root servers? Outages or degradation in availability for popular web sites? All of the above? None of the above? Many other subjects? (If so, which ones?) Thanks, Kelly J. (Not talking about Security just yet...) -- Kelly J. Cooper - Security Engineer GENUITY - Main # - 800-632-7638 3 Van de Graaff Drive - Fax - 781-262-2744 Burlington, MA 01803 - http://www.genuity.net

1 0