- Test - lists.nanog.org

Ascend and TTL
by Dennis Simpson 26 Jul '97

26 Jul '97

I apologize for not including any business or philosophical perspectives on either DNS or fiber management, but I have just learned something about the little Ascend pipeline boxes that some of our clients use which bothers me. I was wondering if anyone has run across this one before. I checked their web site for tech support, but the goofs don't even provide a search func for technical information. The nanog archive at Merit returns nothing useful for this topic when searched by me. Why do packets going through the pipeline products have their ttl chopped drastically? For example: traceroute to pc1.va.connex.net (205.210.187.50): 1-30 hops, 38 byte packets 1 pro1.barrie.connex.net (205.189.201.1) 1.10 ms 0.795 ms 0.753 ms 2 p25.va.connex.net (205.210.187.49) 28.2 ms (ttl=63!) 27.6 ms (ttl=63!) 67.7 ms (ttl=63!) 3 pc1.va.connex.net (205.210.187.50) 28.7 ms (ttl=30!) 37.6 ms (ttl=30!) 28.9 ms (ttl=30!) The pc on this user's site is a typical win95 box. pro1 happens to be a livingston pm3, but we see this with cisco 1005, 2501 as well. The drop always happens at the Ascend. Another customer has a connection to a different provider and his provider uses an Ascend to connect to my client's ascend, and both routers in the path do this, so his reach onto the net appears to have a very limited distance (hop-wise). Code revs in the pipelines is 4.6C in one case, 4.5patch something in the other. Both exhibit similar behaviour. I don't use Ascend's and have no manuals (learned a long time ago they give me heartburn), so I was hoping someone on this list would be familiar with this behaviour and might be able to suggest how to correct it. Any takers? Thx, dennis

1 0

Kim, where are youuuuuuuuuuu!
by Eric Germann 26 Jul '97

26 Jul '97

Fitting... Maybe they yanked their own blocks. Kim, send me an address where I can forward the study to. Sorry for the noise. >From: kimh(a)internic.net >Date: Fri, 25 Jul 97 19:16:56 PDT >To: ekgermann(a)cctec.com >Subject: Your mail to Kim Hubbard <kimh(a)internic.net> > >Your message was delivered to an email destination which is >no longer in service. > >Please contact Energetic Systems <info(a)energetic.com> for more information. > ============================================================================ ==== Eric Germann Computer and Communications Technologies ekgermann(a)cctec.com Van Wert, OH 45891 Phone: 419 968 2640 http://www.cctec.com Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider

2 1

RE: nanog mailing list
by Steve Carter 26 Jul '97

26 Jul '97

I have no real idea why this is, but this industry seems to breed more than it's fair share of arrogant idiots. I saw, at least, one of the offensive responses to your request and I assume, having a naive inflated opinion of human nature, that this person has an esoteric sense of humour and wasn't meaning to be arrogant or offensive at all. Even this person, who obviously knows more about everything than everyone else, had to start somewhere and I hope he got a better welcome than you. > My apologies to the wide variety of people aparently offended by my > request for subscription, and many thanks to the people who pointed me > > towards the proper subscription channels. > > I recall being told this list was private and required references, my > mistake. > > Jason Storm

2 1

7k extra prefixes?
by Alec H. Peterson 25 Jul '97

25 Jul '97

Can someone explain this: BGP table version is 4043818, main routing table version 4043818 52606 network entries (146045/157874 paths) using 11039224 bytes of memory 12848 BGP path attribute entries using 1589828 bytes of memory 27663 BGP route-map cache entries using 442608 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory Dampening enabled. 245 history paths, 46 dampened paths Note the second line. That's up about 7k prefixes from what it was last time I looked. I'm looking through the routing table now and haven't found anything obvious yet. Anybody? Alec -- +------------------------------------+--------------------------------------+ |Alec Peterson - ahp(a)hilander.com | Erols Internet Services, INC. | |Network Engineer | Springfield, VA. | +------------------------------------+--------------------------------------+

1 1

Re: Fiber Cut In Sterling VA.
by Steve Miller 25 Jul '97

25 Jul '97

Hey... Get back to work! How's life in ISP land? Hope all is well. Steve At 10:18 AM 7/25/97 -0400, Henry Clark wrote: >At 04:18 AM 8/25/97 -0400, Shaun S. Amini wrote: >>And the trend continues... We had 2 major fiber cuts here @ 1:00 P.M. >>thanks to Joy Construction who was digging for MCI Metro. > >duck season >rabbit season >duck season >rabbit season >duck season >rabbit season > ><evil look> > >backhoe season :-) > >

1 0

RE: Non-ISP companies multi-homing?
by Eric Germann 25 Jul '97

25 Jul '97

At 11:22 AM 7/24/97 -0400, root(a)gannett.com wrote: >On Thu, 24 Jul 1997, Howard C. Berkowitz wrote: > >> Interesting approach. In general, the ISPs I know would be reluctant to >> run iBGP with a customer, unless they had total control of all BGP >> speakers. If I understand you correctly, the enterprise would have to tag >> its advertisements to the second ISP with the ASN of the first, since the >> enterprise doesn't have its own. Again, I think most ISPs would be >> reluctant to give up this amount of control. > >I think most of the companies running redundant links now have their own >address space and ASN. We got our primary address blocks back when a >company could still do that. I think there's going to have to be some >way to address that with semi-portable AS' in the near future though, as >more criticality transitions to the Net. > So how do you folks punch through the infamous /19 filters? I've got a couple of clients who would like to multihome, but can't get PI space cause they can't justify 8192 addresses. Not having "fully routable" PI space negates the whole purpose of multihoming from their perspective. Does Gannett or Pointcast have >= 8K hosts exposed on their DMZ networks? I'm beginning to think there is a market for a device which has 1 Ethernet port and responds to any RANGE of addresses, so you can scam Internic into thinking you have 100% utilization of your address space, right off the bat... Eric

6 5

RE: Non-ISP companies multi-homing?
by Eric Germann 25 Jul '97

25 Jul '97

At 02:12 PM 7/25/97 -0400, root(a)gannett.com wrote: >On Fri, 25 Jul 1997, Eric Germann wrote: > >> negates the whole purpose of multihoming from their perspective. Does >> Gannett or Pointcast have >= 8K hosts exposed on their DMZ networks? > >No, but we have around 8K devices using our legal address space. Just >because I don't currently expose my hosts doesn't mean I don't want the >option to be able to. When we registered, firewalls weren't the >up-and-coming thing, but then I've also got a /23 being routed via my AS. > I completely subscribe to your option theory, however, I've been told and seen ping sweeps to see if the space is in use. And the other response is if you don't want them seen now, give them 10.x or 192.168, and use a proxy. So it doesn't fall under the NIC's and presumably ARIN's allocations policies. If the next PointCast says we can do it all in a /23 and we want PI space and we want you to route it, do any ISP's or NSP's prostitute their allocation/filtering beliefs for the almighty dollar? Why? I have a municipality building out a comm infrastructure. They want PI space. A mini @Home, if you will. Reponsible use says we only take what we need. In the initial phase (infrastructure buildout), they need probably a /23 at most. Using reponsible and aggressive management of allocation policies, they will grow up within a year or two to a /19 or larger. But their early customers are SOL for anything on the far side of Sprint, unless of course, we pay Sprint. And every other NSP who has a /19 filter in place. So we can't multihome, buy transit from a couple of good NSP's and let the economics drive our decision. >Most of that comes from the fact that my addresses are pre-CIDR customer >registered ones. Once again, it's back to the whole aggragation of >routes vs. disaggragation of traffic. > So getting in early is a good thing I suppose. Day late and a dollar short for the rest of 'em. ============================================================================ ==== Eric Germann Computer and Communications Technologies ekgermann(a)cctec.com Van Wert, OH 45891 Phone: 419 968 2640 http://www.cctec.com Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider

2 1

FW: Denial of Service Attack - 3 p.m. - July 24 - Wrong Date - July 25
by Ron Muir 25 Jul '97

25 Jul '97

Sorry wrong date, it should be 3 p.m. - July 25 ---------- From: Ron Muir Sent: Friday, July 25, 1997 3:08 PM To: 'nanog' Subject: Denial of Service Attack - 3 p.m. - July 24 There is currently a Denial of Service attack being directed at several locations being sourced from an IP address of one of our customers. The address being sourced is 205.152.27.6. We are working with our customer and one of the locations being attacked. We have shut our customer interface down completely and the attack continues. We are asking that our customer - SuNet - address range 205.152.27 /24 not be blackholed after the attack is over. They are not the source of the attack. We are continuing to work on the problem. Thanks for your assistance, Ron Muir ------------------------------------------------------- Ron Muir NOC BellSouth.net ron.muir(a)bellsouth.net 770.677.0246

1 0

Fiber Cut In Sterling VA.
by Shaun S. Amini 25 Jul '97

25 Jul '97

And the trend continues... We had 2 major fiber cuts here @ 1:00 P.M. thanks to Joy Construction who was digging for MCI Metro. With Regards, Shaun S. Amini samini(a)diginetusa.net www.diginetusa.net

5 4

Denial of Service Attack - 3 p.m. - July 24
by Ron Muir 25 Jul '97

25 Jul '97

There is currently a Denial of Service attack being directed at several locations being sourced from an IP address of one of our customers. The address being sourced is 205.152.27.6. We are working with our customer and one of the locations being attacked. We have shut our customer interface down completely and the attack continues. We are asking that our customer - SuNet - address range 205.152.27 /24 not be blackholed after the attack is over. They are not the source of the attack. We are continuing to work on the problem. Thanks for your assistance, Ron Muir ------------------------------------------------------- Ron Muir NOC BellSouth.net ron.muir(a)bellsouth.net 770.677.0246

1 0