- Test - lists.nanog.org

who is using RPF on peers?
by R.P. Aditya 13 Mar '99

13 Mar '99

Almost a month ago, certain nets of ours (AS10368) lost connectivity to a major provider. The problem was tracked down to the major provider having enabled RPF, or "ip verify unicast reverse-path" in IOS-speak, on one of their private peers with one of our upstreams to whom we don't announce those nets. At the time, I decided not to post a warning to nanog as it appeared to be a mistake and an isolated case. Apparently, the same major provider had/has RPF enabled on other peering interfaces also and one more instances were tracked down in the last 24 hours. Enabling RPF on the "backbone" is not a good idea as long as path-asymmetry exists -- unless you are trying to send a message to an unresponsive peer who is sending you source-spoofed packets. Please take this as an appeal to double-check your use of RPF and restrict it to the "edges" of your network. Thanks, Adi

2 1

Re: (!) Vint Cerf designing network for solar system (!)
by Steve Feldman 13 Mar '99

13 Mar '99

This leads to the obvious (for me, anyway) question of NAP placement. It seems to me that multiple providers on Mars wouldn't want to backhaul traffic all the way to Earth just to talk across the canal... MAE-Mars? Sorry, it's Friday afternoon. :) Steve

6 5

Re: Smurf amp notification script?
by Jeff Weisberg 13 Mar '99

13 Mar '99

| > Does anyone have a script that takes a list of IP addresses, looks | > them up in whois, and mails the contact for them and tells them | > they're a smurf amp (with appropriate pointers to self-help files, | > etc)? | > | > If it can read sorted output from Cisco "sh ip cache flow", that'd be | > a bonus. | | No, but we'd be interested in this if you come across one. Ronald Guilmette's | ipw (www.e-scrub.com/ipw/) is the closest I've seen, and it's unreliable at | best. The enclosed hack worked last time I tried it (but no garuntees). Change occurances of OpNet/op.net to your own name. --jeff #!/usr/local/bin/perl while( <> ){ chop; $net = $_; $email = lookup($net); while( !$email ){ sleep 5; $email = lookup($net); } print "$net <$email>\n"; email( $net, $email ) if $email; sleep 2; } exit; sub lookup { my($net) = @_; my($email, $coord, $netblock); open(W, "whois -h whois.arin.net $net |"); $email = ''; $netblock = ''; $coord = 0; while( <W> ){ chop; if( $coord ){ $coord = 0; ($email) = /.*\)\s*(.*)/; last; } $coord = 1 if /Coordinator/; if( /NETBLK-/ ){ $netblock = $_; $netblock =~ s/.*$//; $netblock =~ s/$.*//; } } return $email if $email; return lookup( $netblock ) if $netblock; ''; } sub email { my($net, $email) = @_; open(E, "|sendmail -t"); if( $email =~ /NOWHERE/ ){ print "**** NOWHERE ****\n"; return; } print E <<EOF To: $email From: OpNet NOC <noc\(a)YOURDOMAIN.net> Reply-To: OpNet NOC <noc\(a)YOURDOMAIN.net> Subject: Denial of Service attacks launched through your machines. Netblock: $net Your machines were being used to mount a denial of service attack against one of our machines. This not only uses up our bandwidth but yours. The exact type of attack is typically called a `smurf' attack : A "smurf attack" is a denial-of-service attack which is launched from a network, frequently a dial-up connection, with the intention of burying the victim's network access with packets beyond their ability to carry the traffic load presented. This is accomplished by sending a forged ICMP packet to a smurf amplifier destination, on the broadcast address, bearing the source address of the victim's computer. The smurf amplifier network dutifully responds from all network hosts on that segment, amplifying the transmitted packet by up to 200-fold. These packets are then returned to the victim's computer, swamping its connection and rendering it useless. It is possible to completely destroy host connectivity even on ethernet-speed connections (6x a T1) with just a modem connection to the Internet using this technique. A T1 customer using this technique can bury an OC3 (155mbps) circuit, assuming sufficient amplifier bandwidth can be found. { from http://www.mcs.net/smurf } Some simple changes to your router configurations can keep your machines from being used as smurf amplifiers. More information on smurfs, including what to do about them, can be found at : http://www.quadrunner.com/~chuegen/smurf.txt and http://www.mcs.net/smurf You're receiving this email because you're listed with an IP registry as being the maintainer of one of the networks where I'm seeing ICMP echo requests coming from. I'd greatly appreciate it if you could fix your routers so your networks cannot be abused in this manner. Thanks. -- OpNet Network Operations Staff EOF ; close E; }

2 1

disa.mil or dla.mil contacts?
by Eric Kozowski 13 Mar '99

13 Mar '99

does anyone know a voice contact for disa.mil or dla.mil? i can't get through to whois.nic.mil or the disa.mil or dla.mil mail servers. and, yes randy, this isn't noc(a)disa.mil, but since their servers aren't reachable, noc is the mil nic, i thought i'd ask here.

1 0

Re: (!) Vint Cerf designing network for solar system (!)
by Jeff Aitken 12 Mar '99

12 Mar '99

Steve Feldman writes: > This leads to the obvious (for me, anyway) question of NAP > placement. > > It seems to me that multiple providers on Mars wouldn't want to > backhaul traffic all the way to Earth just to talk across the > canal... > > MAE-Mars? > Of course, this raises another interesting issue; namely, that of exchange point nomenclature. As inter-planetary networks evolve, the term 'MAE' will become antiquated. I would suggest we use the term Galactic-Area Exchange, but I fear a vehement response from Jerry Falwell... ;-) Of course, if MFS runs them, the concept of a Planetary-Area Exchange is not without merit. --Jeff

2 1

The Cidr Report
by Tony Bates 12 Mar '99

12 Mar '99

This is an auto-generated mail on Fri Mar 12 12:00:00 PST 1999 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 12Mar99 0) General Status Table History ------------- Date Prefixes 050399 56665 060399 56702 070399 56723 080399 56793 090399 56901 100399 56823 110399 57143 120399 56938 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 123.217.230.0/24 from AS174 *** Bogus 124.188.32.0/19 from AS1239 AS Summary ---------- Number of ASes in routing system: 4654 Number of ASes announcing only one prefix: 2308 (1246 cidr, 1062 classful) Largest number of cidr routes: 372 announced by AS701 Largest number of classful routes: 863 announced by AS701 1) Gains by aggregating at the origin AS level --- 12Mar99 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 358 146 212 59.2% BCnet Backbone AS2493 268 151 117 43.7% iSTAR Internet, Inc. AS174 645 530 115 17.8% Performance Systems International AS11305 116 8 108 93.1% UNKNOWN AS4755 158 76 82 51.9% Videsh Sanchar Nigam Ltd. India AS3749 138 62 76 55.1% TECNET AS4293 210 139 71 33.8% IMCI AS1267 94 24 70 74.5% IUNET-AS AS4200 162 96 66 40.7% AGIS (Apex Global Information Ser AS7496 95 31 64 67.4% Power Up AS7545 109 46 63 57.8% TPG Internet Pty Ltd AS4740 386 323 63 16.3% Ozemail Pty Ltd (ASN-OZEMAIL) AS1221 423 362 61 14.4% AARNET-AS AS7046 266 206 60 22.6% UUNET-CUSTOMER AS1239 516 459 57 11.0% SprintLink Backbone AS10928 106 51 55 51.9% UNKNOWN AS72 90 38 52 57.8% Schlumberger Information Network AS7657 153 102 51 33.3% The Internet Group Limited AS3493 228 177 51 22.4% INTERLINK AS577 222 172 50 22.5% Bell Canada Backbone AS719 453 406 47 10.4% LANLINK autonomous system AS5674 79 35 44 55.7% PBI-NET-BLK AS852 175 135 40 22.9% AGT Advance Communication AS803 73 37 36 49.3% SaskNet Backbone AS701 863 827 36 4.2% Alternet AS7745 39 4 35 89.7% BIGSKY-AS AS7122 111 78 33 29.7% MTS ADVANCED Network Policy AS1785 248 216 32 12.9% NYSERNet Backbone AS1 508 476 32 6.3% BBNPLANET AS7390 36 5 31 86.1% NLSLAN For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Network and Server Management
by Derek Balling 12 Mar '99

12 Mar '99

If anyone has any experiences using CA/Unicenter with Empire Technologies' SystemEdge agent, could you please respond to me offlist? Please and thank you. D ====================================================================== Derek J. Balling | "Bill Gates is a monocle and a white dredd(a)megacity.org | fluffy cat from being a villain in the http://www.megacity.org/ | next Bond film." - Dennis Miller ======================================================================

1 0

Re: SAT OUTAGE: GE-3 service restored
by Avi Freedman 12 Mar '99

12 Mar '99

In article <99212.105836.26913(a)avi.netaxs.com> you wrote: : For those early morning risers wanting to check out how their : network stock options were doing on CCNfn this morning, the GE-3 : satellite spun out of control for several hours beginning : at 4am EST. This affected the Associated Press, PBS, several : Turner networks. I suppose I should start collecting which : Internet satellite providers are using which satellites for : their feeds. : GE doesn't have any information on their web page yet, but : CNN and the Associated Press have stories. Just talked with GE... Net Access's affiliate, isp-sat, does 4mb/sec of USENET news on GE3. isp-sat saw it down from 4AM, for a few hours. Unofficial word from GE is - 1) Unknown whether it's human or mechanical error. 2) All transponders are online, as well as all internal computers and navigational systems. 3) This is not the same kind of bird that PAS has had problems with (multiple satellites of the same kind losing some of their marbles). : Sean Donelan, Data Research Associates, Inc, St. Louis, MO Avi

1 0

SAT OUTAGE: GE-3 service restored
by Sean Donelan 12 Mar '99

12 Mar '99

For those early morning risers wanting to check out how their network stock options were doing on CCNfn this morning, the GE-3 satellite spun out of control for several hours beginning at 4am EST. This affected the Associated Press, PBS, several Turner networks. I suppose I should start collecting which Internet satellite providers are using which satellites for their feeds. GE doesn't have any information on their web page yet, but CNN and the Associated Press have stories. NetOps: most network operation centers use one or more Turner networks in their NOCs 24x7 for current information. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

MEDIA EVENT: New Star Wars trailer
by Sean Donelan 12 Mar '99

12 Mar '99

In case you were wondering why your network traffic patterns shifted. I guess Lucasfilm expected the trailer to end up on the web sites anyway, and wanted to beat them to the punch. Apple and Lucasfilm have put the final Star Wars I: The Phantom Menace trailer up on their official web sites 24 hours in advance of its release in theatres. Of course, hardcore geeks will want to see it on the big screen anyway. Especially since Apple's Quicktime player is not available for Unix. Yes, there is a freeware Quicktime, but I'm definately in unsupported land with my Alpha running Digital Unix MultiMedia AV300, serial number "NONE" :-(. ObNetOp: The fiber in Smyrna, GA has been spliced. I think CSX is still ahead of Qwest in number of cuts, but Qwest is catching up fast. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0