- Test - lists.nanog.org

Use of IPv6 /127 prefixes
by Mike Leber 01 May '01

01 May '01

I've run into an interesting question regarding the widespread practice of using /127 prefixes under IPv6. I'm posting this to nanog instead of 6bone because I want to ask nanog IPv6 people. Allocating a /127 is a common convention under IPv6 to provide globally routable addresses for a point to point connection, such as a tunnel. Many tunnel brokers use it, etc. I know that its use is widespread on the links between cisco routers at the core the IPv6 Internet without obvious trouble. However, it would appear to be in conflict with anycast addresses (btw, anycast addresses are not the same as IPv4 broadcast addresses). RFC 2373 section 2.6.1 regarding "Required Anycast Address": The "subnet prefix" in an anycast address is the prefix which identifies a specific link. This anycast address is syntactically the same as a unicast address for an interface on the link with the interface identifier set to zero. Packets sent to the Subnet-Router anycast address will be delivered to one router on the subnet. All routers are required to support the Subnet-Router anycast addresses for the subnets which they have interfaces. So what is anycast used for? I've see lots of links where the the addresses used are NNNN:NNNN:NNNN:NNNN:NNNN:NNNN:NNNN:000E/127 and NNNN:NNNN:NNNN:NNNN:NNNN:NNNN:NNNN:000F/127 which works, yet shouldn't if the 000E address is allways anycast on both sides of the link. Why do /127s work for point to point links? Mike. +------------------- H U R R I C A N E - E L E C T R I C -------------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +---------------------------------------------------------------------------+

3 2

California ISO announces new notification service
by Sean Donelan 01 May '01

01 May '01

Things change. The California Independent System Operator, the folks in charge of the electric transimission grid in california, announced today they've established a new notification service. In case the ISO implements rotating outages or electrical emergencies, they will send e-mail to newsrooms. >From the media release, it appears this is only for members of the media. For the public, the ISO will add outage information during rotating blackouts to their System Status web page http://www.caiso.com/ Local power companies also have evolving notification policies. As the number of rotating blackouts increase this summer, I expect all of them will provide notification. The Internet will be one of the primary methods for transmitting notifications to the media, which will in turn inform the public.

4 4

OT: GUI ACL Editor?
by SMcGrath＠dhhs.state.nh.us 01 May '01

01 May '01

Look at CiscoSecure policy manager it is fairly resource intensive however it does rule checking and sanity checking of the generated rulesets and provides a means via IPSec of deploying the ACL's in a secure manner Scott ---------------------- Forwarded by Scott McGrath/InformationSystems/Hazen/DHHS on 05/01/2001 12:11 PM --------------------------- David Brousseau <brou(a)enterasys.com>@merit.edu on 05/01/2001 10:59:02 AM Sent by: owner-nanog(a)merit.edu To: nanog(a)merit.edu cc: Subject: OT: GUI ACL Editor? I am currently tasked to evaluate graphical ACL editors for possible use. A web search has not turned up many options that will edit a router's ACLs. Does anyone have any experience with such a tool or know where I might find out more? Thanks for your time, --Dave (See attached file: brou.vcf)

1 0

RE: GUI ACL Editor?
by Irwin Lazar 01 May '01

01 May '01

Howdy, There used to be a very simple shareware tool for creating ACLs Cisco routers at Mentortech.com, but I don't see it anymore. CiscoWorks 2000 also has an ACL management module (Access Control List Manager (ACLM)) See: http://www.cisco.com/warp/public/cc/pd/wr2k/caclm/prodlit/index.shtml Of course, there is always notepad or vi (they're graphical, aren't they?). :-) Irwin > -----Original Message----- > From: David Brousseau [mailto:brou@enterasys.com] > Sent: Tuesday, May 01, 2001 10:59 AM > To: nanog(a)merit.edu > Subject: OT: GUI ACL Editor? > > > I am currently tasked to evaluate graphical > ACL editors for possible use. A web search > has not turned up many options that will edit > a router's ACLs. Does anyone have any > experience with such a tool or know where > I might find out more? > > Thanks for your time, > --Dave

1 0

OT: GUI ACL Editor?
by David Brousseau 01 May '01

01 May '01

I am currently tasked to evaluate graphical ACL editors for possible use. A web search has not turned up many options that will edit a router's ACLs. Does anyone have any experience with such a tool or know where I might find out more? Thanks for your time, --Dave

1 0

XO is broken
by Vadim Antonov 01 May '01

01 May '01

I mean it. XO Communications is a wonderful example of an organization so f*ed up that they cannot fix a simple static routing problem in a week. Anyway, it is very enlightening to be a real paying customer of an ISP, to see how much incredibly bad things are. Well, i guess i should start from the beginning - i've got my SDSL (finally) reconnected (another Northpoint casualty). Now, the lights are green, the signal is there, packets do not get in. Time to call Tech Support, The folks there are very polite and after the mandatory router config checkup i'm promised everything is going to be fixed the first thing tomorrow when the repair team shows up for work (hmmm... 9-to-5 repair? I've got a "business" service package, i expected somewhat better service). Tomorrow comes and goes, nothing happens. Calling XO Tech Support produces only yet another CPE config examination, and another promise. Next day -- nothing happens. Calling again, hearing apologies for the repair team inaction, more promises. Ok, next few days are spent explaining it excuriating details that yes, DSL side works, packets get out but incoming traffic goes to someplace nobody can positively identify. I'm asking to take a look at routing tables at the boxes A and B. Surprise! "Can't do it - we do not have access to these boxes". Closer examination shows that XO Tech Support cannot even tell if the customer link has a signal on it. Not because they don't know how to do it, but because "it is a highly expensive equipment and we are not given passwords so we won't break it". Yes, "highly paid certified engieers only" can look at the things. Tech support is administratively prohibited from LOOKING at the operational status and configs. I'm starting to wonder if they have an issue with trade unions but get no confirmation to that. Now, i ask to escalate. They oblidge. No useful result. I'm asking to put me in toch with someone who can actually do meaningful diagnostic, and told that no, sir, our policy is never let engineers to talk to customers. Well... Another escalation, supervisor promises to personally oversee the repair. Day later, packets are still routed to Elbonia. Talking to tech support completely lost any meaning - they're out of question, I exhausted all "options" to get hold of someone who can do things in that wretched organization. Along the way i'm lectured on how wonderful division of labour is, and how well it serves customers. So... Is there anyone in XO with a clue? Help? I do not need apologies, i need a working network. TT# 83008. Now, i'm still amazed by the humongous idiocy of an organization which prevents their front-line people from doing their job by taking away their tools; and lets their customers to be at a mercy of some shadowy group which never calls back and so has no chance to get any feedback. If i cannot even reach anyone in the _repair_ organization, i suspect that any really complex problem which needs a real engineer (not a certified monkey) won't be solved at all. --vadim PS. CEO of my employer also has a DSL line from XO. Also not working. Guess what chances XO has of getting our business (we're an ASP).

3 2

Web Based "BGP Toolkit" and "Peering Analysis"
by Randy Neals 01 May '01

01 May '01

I found this web site has some interesting tools which can generate routing reports and suggested BGP configs from a database containing Route Table, RADB and Registry Data. http://www.netconfigs.com/ The interesting stuff is under "AS Peering Analysis" and "Cisco BGP Config Toolkit". (I have no affiliation with this web page.) Regards, Randy ---------------------------------------------- Randy Neals Technology and Network Development Engineering GT Group Telecom Inc. Suite 800, 20 Bay Street Toronto, Ontario, Canada smtp://rneals@gt.ca/ voice://416.848.2693/ ---------------------------------------------- Group Telecom - Completely Connected (tm) http://www.gt.ca/ NASDAQ:GTTLB AS6539 ----------------------------------------------

2 1

Re: black hat .cn networks
by Kevin Day 01 May '01

01 May '01

> > whois -a AS 4134 > Data Communications Bureau (ASN-CHINALINK) > 40, Xue Yuan Lu > Beijing > 100083 > CN > > Autonomous System Name: CHINALINK > Autonomous System Number: 4134 > > Coordinator: > Wan, Jun (JW221-ARIN) dstanton(a)HQ.SI.NET > (861)-201-2994 (FAX) (861)-205-3995 > > Record last updated on 01-Dec-1994. > Database last updated on 28-Apr-2001 22:45:44 EDT. > > The ARIN Registration Services Host contains ONLY Internet > Network Information: Networks, ASN's, and related POC's. > Please use the whois server at rs.internic.net for DOMAIN related > Information and whois.nic.mil for NIPRNET Information. > > > craig Ok, that's freaky. # whois -a AS 4134 No match for "4134". %%%%%%%%%%%%%%%%%%% NO MATCH TIP %%%%%%%%%%%%%%%%%%%%%%%% % % % ALL OF THE POINT OF CONTACT HANDLES IN THE ARIN % % WHOIS END WITH "-ARIN", IF YOU ARE QUERYING A POINT % % OF CONTACT HANDLE PLEASE ADD -ARIN TO YOUR QUERY. % % % %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% The ARIN Registration Services Host contains ONLY Internet Network Information: Networks, ASN's, and related POC's. Please use the whois server at rs.internic.net for DOMAIN related Information and whois.nic.mil for NIPRNET Information. ARIN must be broken tonight. :) -- Kevin

3 2

In search of good data
by Sean Donelan 01 May '01

01 May '01

Gee, wouldn't it be nice if we had an information clearing house, so when the media gets on these kicks, someone could tell them.... CERT? Network Operators? Someone else? Web defacements were down today, DOS attacks continued at their normal rate and patterns. Internet traffic increased 0.1%, and 4 ccTLD's were off-line (as they've been for the last year). Currently, the "data" (aka Press Releases) are being generated by several security consulting firms, whose profitability depends on generating a lot of FUD Israel and Palestine based individuals (and perhaps groups) have been trashing each other's networks for the last year. Teenagers et al have been cracking things for decades. The WTO and the like have on-going protests. If you get mugged, its awful; but civilization doesn't end. So far the attacks appear to be nothing out of the ordinary. The cyber equivalent of throwing rotten eggs at the US Embassy. I suppose the fear in the "three-letter agencies" is it might provide cover for more crackers planting logic more sophisticated attacks. Imagine the headlines if this were to happen: "Chinese phreakers announce plans to call telephones in the USA and shout really, really loud. Security experts at iPhoneDefense warns people not to place the phone too close to their ears or permanent deafness may result. Because you never know if the next phone call might be from a Chinese phreaker ready to shout loudly in your ear, you should treat every call as potentially dangerous. iPhoneDefense also announced a new product, LoudPhone (tm). LoudPhone(tm) will assure customers of the latest in high-tech security by filtering not only Chinese, but also German and Italian shouts. This new, patent-pending, technology is exclusive to iPhoneDefense. A Ma Bell spokesperson assures country the telphone network can withstand loud phone calls. Ma Bell's spokesperson couldn't comment on iPhoneDefense's new LoudPhone(tm), however she did remind customers any unauthorized modification to a telephone could shutdown the entire phone network. And therefore, customers should use only Genuine Ma Bell phone accessories on their telephone. Genuine Ma Bell phone accessories are available in approved colors: black, green, ivory, and white.

1 0

RE: black hat .cn networks
by Segal, Mark 01 May '01

01 May '01

if it is actually based from there... Mark -- Mark Segal Director, Data and Internet Planning Axxent Corp. Tel: (416)907-2858 > -----Original Message----- > From: Dan Hollis [mailto:goemon@anime.net] > Sent: Monday, April 30, 2001 5:59 PM > To: 'nanog(a)merit.edu' > Subject: black hat .cn networks > > > > http://wired.com/news/politics/0,1283,43437,00.html > > Time to drop AS4134. > > -Dan > >

4 4