- Test - lists.nanog.org

RE: Chinese hackers plan week-long attack on American websites an d ne tworks
by Roeland Meyer 20 Apr '01

20 Apr '01

> -----Original Message----- > From: scott w [mailto:scott@digisle.net] > Sent: Friday, April 20, 2001 2:43 PM > Subject: Re: Chinese hackers plan week-long attack on > American websites > an d ne tworks > > > > Can't we all just get along??? > > > > heh, obviously not ... > > Yes we can... http://www.friends-partners.org/friends/mirnet No we can't http://www.dnso.org

1 0

Re: How to game the system (was Re: What does 95th %tile mean?)
by Richard A. Steenbergen 20 Apr '01

20 Apr '01

On Fri, Apr 20, 2001 at 12:33:01PM -0400, Leo Bicknell wrote: > > There is a much simpler game that costs the ISP a lot more > money. Fortunately, it's not a common business model. > > Let's say I am a TV network, and I want to simulcast a TV show > once a week to the Internet. I might need 2-3 Gig of capacity during > the simulcast, but the rest of the time I need none. So, I buy 95% > service, stream for 4 hours a month, which is thrown away in any of > the counting schemes put forth so far, and pay nothing. Another variant which is actually done by the big enterprise eWhatever companies with servers in multiple locations at a big colo provider is the 95th percentile monthly backup or db exchange. They'll push gigabit(s) between facilities for exactly under the mark where they'd have to pay for it, and they're not always nice enough to warn you before hand. For those colo providers, who have a model of dumping traffic out to peers locally and usually don't have a longhaul backbone capacity which is significantly larger then those "big" customer interfaces... Well you get the point. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

gTLD Informational Message
by Brad Verd 20 Apr '01

20 Apr '01

This is an Informational Message to the internet community: Friday evening, the 20th of April, Verisign Global Registry Services will be changing the IP address for e.gtld-servers.net in the authoritative NS set serving com/net/org. The new set of servers authoritative for these TLDs will be: A.GTLD-SERVERS.NET. 6D IN A 192.5.6.30 G.GTLD-SERVERS.NET. 6D IN A 192.42.93.30 C.GTLD-SERVERS.NET. 6D IN A 192.26.92.30 I.GTLD-SERVERS.NET. 6D IN A 192.36.144.133 B.GTLD-SERVERS.NET. 6D IN A 203.181.106.5 D.GTLD-SERVERS.NET. 6D IN A 192.31.80.30 L.GTLD-SERVERS.NET. 6D IN A 192.41.162.30 F.GTLD-SERVERS.NET. 6D IN A 192.35.51.30 J.GTLD-SERVERS.NET. 6D IN A 210.132.100.101 K.GTLD-SERVERS.NET. 6D IN A 213.177.194.5 E.GTLD-SERVERS.NET. 6D IN A 192.12.94.30 M.GTLD-SERVERS.NET. 6D IN A 202.153.114.101 This will not require any change to root.cache file and both the old and new IP's for e.gtld-servers.net will provide answers for com, net, and org in parallel for enough time to accommodate the zones TTL's. -------------------------------------- Brad Verd Operations Manager Resolution Systems Verisign Global Registry Services Email - bverd(a)verisign.com ---------------------------------------

1 0

Re: Routing Loops
by Kyle C. Bacon 20 Apr '01

20 Apr '01

All, I confess, 6295 is easy to type instead of 6259 when your are trying to type it multiple times after a long week...:( Back to the ol "no network changes on Fridays"... Everything should be good now... K Marshall Eubanks To: Nanog mailing list <nanog(a)merit.edu>, hostmaster(a)fnsi.net <tme@21rst-ce cc: ntury.com> Subject: Routing Loops Sent by: owner-nanog@m erit.edu 04/20/2001 02:23 PM Please respond to tme Hello; I suddenly see a whole bunch of routing loops for paths going through AS 6259 Unicast Autonomous System Routing Loop Detection Date of BGP Dump Fri Apr 20 13:57:36 EDT 2001 1 ROUTING LOOPS Detected for ASN 11548 Prefix = 63.69.155.0/24 : PATH = : 1239 3549 6259 6295 6259 11548 1 ROUTING LOOPS Detected for ASN 11548 Prefix = 63.81.238.0/24 : PATH = : 1239 3549 6259 6295 6259 11548 1 ROUTING LOOPS Detected for ASN 13944 Prefix = 64.241.89.0/24 : PATH = : 1239 3549 6259 6295 6259 13944 1 ROUTING LOOPS Detected for ASN 13944 Prefix = : PATH = : 1239 3549 6259 6295 6259 13944 1 ROUTING LOOPS Detected for ASN 14813 Prefix = 66.35.68.0/22 : PATH = : 1239 3549 6259 6295 6259 13944 14813 1 ROUTING LOOPS Detected for ASN 17266 Prefix = 66.35.72.0/23 : PATH = : 1239 3549 6259 6295 6259 13944 17266 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 138.46.0.0 : PATH = : 701 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 2015 Prefix = 139.171.0.0/19 : PATH = : 1239 3549 6259 6295 6259 2015 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 143.61.153.0/24 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 143.61.233.0/24 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 192.84.218.0 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 198.181.242.0 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 204.107.238.0 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 204.238.145.0 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 206.183.224.0/19 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 209.41.192.0/18 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 8142 Prefix = : PATH = : 1239 3549 6259 6295 6259 8142 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 209.115.0.0/17 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 216.28.0.0/15 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 14470 Prefix = 216.28.223.0 : PATH = : 1239 3549 6259 6295 6259 14470 1 ROUTING LOOPS Detected for ASN 11325 Prefix = 216.29.50.0 : PATH = : 1239 3549 6259 6295 6259 11325 1 ROUTING LOOPS Detected for ASN 11303 Prefix = 216.52.158.0 : PATH = : 1239 11853 11303 11301 11303 1 ROUTING LOOPS Detected for ASN 11303 Prefix = : PATH = : 701 11853 11303 11301 11303 1 ROUTING LOOPS Detected for ASN 6259 Prefix = : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = : PATH = : 1239 3549 6259 6295 6259 Anyone know a NOC contact for Fiber Network Solutions, Inc. (ASN-FIBERNET) ? Regards Marshall Eubanks T.M. Eubanks Multicast Technologies, Inc 10301 Democracy Lane, Suite 410 Fairfax, Virginia 22030 Phone : 703-293-9624 Fax : 703-293-9609 e-mail : tme(a)multicasttech.com http://www.on-the-i.com Test your network for multicast : http://www.multicasttech.com/mt/

1 0

How to game the system (was Re: What does 95th %tile mean?)
by Sean Donelan 20 Apr '01

20 Apr '01

On Thu, 19 April 2001, John Hawkinson wrote: > The 5-minute average is not being sampled every five minutes. > > The raw number of octets is being sampled every five minutes, and > divided by the time since the previous sample (5 minutes). Then, > 95th percentile is taken of that. How do you game the system? Economists like to write a lot of papers on this subject. The problem with calculating the average is the fencepost error. Warning, majore simplifying assumptions ahead... If you transfer 1GB for exactly 5 minutes, what is your 95% bill? It depends on your timing. 00:00 Start transfer, Start measurement window 01:00 02:00 03:00 04:00 05:00 End transfer, End measurement window Elapsed time 5 minutes, total bytes 1000000, or 3,333 Bps. Bandwidth billed 3.3Kbps peak 00:00 Start measurement window #1 01:00 02:00 02:30 Start transfer #1 03:00 04:00 05:00 End measurement window #1 (500,000 Bytes, 300 Seconds) Start measurement window #2 06:00 07:00 07:30 End transfer #1 (1,000,000 Bytes, 300 Seconds) 08:00 09:00 01:00 End measurement window #2 (500,000 Bytes, 300 Seconds) Bandwidth billed 1.6Kbps peak By knowing your provider's measurement windows, you could cut your usage bill in half while transfering the same amount of data. A customer with a relatively random usage (user's surfing the web) couldn't do this, but a user transfering batch files on a set schedule may see dramatic differences in their bill. You can make the measurements more complex by using three windows, or choosing three out of five windows, and so forth. Unless providers or users are seeing real billing problems, there is little benefit to the added complexity.

5 5

Re: Routing Loops
by Marshall Eubanks 20 Apr '01

20 Apr '01

"Foster, Kristopher" wrote: Well, that might be what they are TRYING to do, but read it carefully : 6259 6295 6259 Is a loop in my book. Marshall > They're just prepending the AS path to influence their upstreams.. > > Kris, > > -----Original Message----- > From: Marshall Eubanks [mailto:tme@21rst-century.com] > Sent: April 20, 2001 2:23 PM > To: Nanog mailing list; hostmaster(a)fnsi.net > Subject: Routing Loops > > Hello; > > I suddenly see a whole bunch of routing loops for paths going through AS > 6259 > > Unicast Autonomous System Routing Loop Detection > > Date of BGP Dump Fri Apr 20 13:57:36 EDT 2001 > > 1 ROUTING LOOPS Detected for ASN 11548 Prefix = 63.69.155.0/24 : PATH > = : 1239 3549 6259 6295 6259 11548 > 1 ROUTING LOOPS Detected for ASN 11548 Prefix = 63.81.238.0/24 : PATH > = : 1239 3549 6259 6295 6259 11548 > 1 ROUTING LOOPS Detected for ASN 13944 Prefix = 64.241.89.0/24 : PATH > = : 1239 3549 6259 6295 6259 13944 > 1 ROUTING LOOPS Detected for ASN 13944 Prefix = : PATH > = : 1239 3549 6259 6295 6259 13944 > 1 ROUTING LOOPS Detected for ASN 14813 Prefix = 66.35.68.0/22 : PATH > = : 1239 3549 6259 6295 6259 13944 14813 > 1 ROUTING LOOPS Detected for ASN 17266 Prefix = 66.35.72.0/23 : PATH > = : 1239 3549 6259 6295 6259 13944 17266 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 138.46.0.0 : PATH > = : 701 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 2015 Prefix = 139.171.0.0/19 : PATH > = : 1239 3549 6259 6295 6259 2015 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 143.61.153.0/24 : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 143.61.233.0/24 : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 192.84.218.0 : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 198.181.242.0 : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 204.107.238.0 : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 204.238.145.0 : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 206.183.224.0/19 : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 209.41.192.0/18 : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 8142 Prefix = : PATH > = : 1239 3549 6259 6295 6259 8142 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 209.115.0.0/17 : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 216.28.0.0/15 : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 14470 Prefix = 216.28.223.0 : PATH > = : 1239 3549 6259 6295 6259 14470 > 1 ROUTING LOOPS Detected for ASN 11325 Prefix = 216.29.50.0 : PATH > = : 1239 3549 6259 6295 6259 11325 > 1 ROUTING LOOPS Detected for ASN 11303 Prefix = 216.52.158.0 : PATH > = : 1239 11853 11303 11301 11303 > 1 ROUTING LOOPS Detected for ASN 11303 Prefix = : PATH > = : 701 11853 11303 11301 11303 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = : PATH > = : 1239 3549 6259 6295 6259 > 1 ROUTING LOOPS Detected for ASN 6259 Prefix = : PATH > = : 1239 3549 6259 6295 6259 > > Anyone know a NOC contact for > Fiber Network Solutions, Inc. (ASN-FIBERNET) ? > > Regards > Marshall Eubanks -- Regards Marshall Eubanks T.M. Eubanks Multicast Technologies, Inc 10301 Democracy Lane, Suite 410 Fairfax, Virginia 22030 Phone : 703-293-9624 Fax : 703-293-9609 e-mail : tme(a)multicasttech.com http://www.on-the-i.com Test your network for multicast : http://www.multicasttech.com/mt/

1 0

Routing Loops
by Marshall Eubanks 20 Apr '01

20 Apr '01

Hello; I suddenly see a whole bunch of routing loops for paths going through AS 6259 Unicast Autonomous System Routing Loop Detection Date of BGP Dump Fri Apr 20 13:57:36 EDT 2001 1 ROUTING LOOPS Detected for ASN 11548 Prefix = 63.69.155.0/24 : PATH = : 1239 3549 6259 6295 6259 11548 1 ROUTING LOOPS Detected for ASN 11548 Prefix = 63.81.238.0/24 : PATH = : 1239 3549 6259 6295 6259 11548 1 ROUTING LOOPS Detected for ASN 13944 Prefix = 64.241.89.0/24 : PATH = : 1239 3549 6259 6295 6259 13944 1 ROUTING LOOPS Detected for ASN 13944 Prefix = : PATH = : 1239 3549 6259 6295 6259 13944 1 ROUTING LOOPS Detected for ASN 14813 Prefix = 66.35.68.0/22 : PATH = : 1239 3549 6259 6295 6259 13944 14813 1 ROUTING LOOPS Detected for ASN 17266 Prefix = 66.35.72.0/23 : PATH = : 1239 3549 6259 6295 6259 13944 17266 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 138.46.0.0 : PATH = : 701 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 2015 Prefix = 139.171.0.0/19 : PATH = : 1239 3549 6259 6295 6259 2015 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 143.61.153.0/24 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 143.61.233.0/24 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 192.84.218.0 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 198.181.242.0 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 204.107.238.0 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 204.238.145.0 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 206.183.224.0/19 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 209.41.192.0/18 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 8142 Prefix = : PATH = : 1239 3549 6259 6295 6259 8142 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 209.115.0.0/17 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = 216.28.0.0/15 : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 14470 Prefix = 216.28.223.0 : PATH = : 1239 3549 6259 6295 6259 14470 1 ROUTING LOOPS Detected for ASN 11325 Prefix = 216.29.50.0 : PATH = : 1239 3549 6259 6295 6259 11325 1 ROUTING LOOPS Detected for ASN 11303 Prefix = 216.52.158.0 : PATH = : 1239 11853 11303 11301 11303 1 ROUTING LOOPS Detected for ASN 11303 Prefix = : PATH = : 701 11853 11303 11301 11303 1 ROUTING LOOPS Detected for ASN 6259 Prefix = : PATH = : 1239 3549 6259 6295 6259 1 ROUTING LOOPS Detected for ASN 6259 Prefix = : PATH = : 1239 3549 6259 6295 6259 Anyone know a NOC contact for Fiber Network Solutions, Inc. (ASN-FIBERNET) ? Regards Marshall Eubanks T.M. Eubanks Multicast Technologies, Inc 10301 Democracy Lane, Suite 410 Fairfax, Virginia 22030 Phone : 703-293-9624 Fax : 703-293-9609 e-mail : tme(a)multicasttech.com http://www.on-the-i.com Test your network for multicast : http://www.multicasttech.com/mt/

1 0

Re: Routing Loops
by Danny McPherson 20 Apr '01

20 Apr '01

I'm guessing someone fat-fingered their AS prepend policy and instead of "6259 6259" they have "6259 6295". Gotta love that route preference manipulation flexibility of BGP! Interesting timing, considering kc just sent a message to the IRTF-RR list a few days ago discussing another occurrence of this... -danny > 63.69.155.0/24 : PATH = : 1239 3549 6259 6295 6259 11548

1 0

Re: How to game the system (was Re: What does 95th %tile mean?)
by Sean Donelan 20 Apr '01

20 Apr '01

On Thu, 19 April 2001, Greg A. Woods wrote: > This is the Internet -- it's not a circuit-based telephone connection > network, and it's not ATM (though either may be used to transport IP, of > course). It's certainly not equivalent to a power distribution grid > where excess demand starts to look like a short circuit and causes real > damage. The traffic on the Internet is little bunches of packets that > can interleave between each other. Real-world traffic flows on IP > networks are incredibly variable and resilient, partly due to the heroic > efforts of higher level protocols such as TCP. True, there is some buffering in the Internet. And it does make it much more resilant to short term peaks. But as any DDOS attack shows, if you use near peak capacity for even a short term, other traffic is rudely shoved aside. Further, traffic does not return to its original levels for a considerable period of time after each peak capacity event. If you set up conditions just right, not only will you not receive "peak" payment from from the customer gaming the system, you receive lower payments from all your "average" customers too.

3 2

Re: What does 95th %tile mean?
by Toby_Williams＠enron.net 20 Apr '01

20 Apr '01

_95th%ile is not a robust mechanism for billing_ It neither addresses variance nor average use effectively and can be gamed quite easily. It's some kind of best fit system for billing buyers with "normal behaviour". Where in maths class did they ever say that scraping off the highest n percent of a data set in isolation, gives a good indication of anything? Don't you need to look at the mean and 90th percentile together to fairly evaulate distribution. I think the reason it's so popular currently is that it's easy to describe (hence sell) and fits normal use reasonably well, so from a "normal buyer's" perspective is OK. Just as long as everyone is honest. In a thirty day billing period 95th%ile gives you one and a half days of *free bandwidth*. 90th%ile gives you three days of *free bandwidth*. >From the seller's perspective, once this starts getting gamed a little more I can't see it having much of a shelf life, and more sophisticated billing will surface, similar to the power industry Sean sites. I'm quite surprised we're not there already.. has anyone started venturing down this route yet? (other than flat rate) toby

4 3