- Test - lists.nanog.org

Bogus route announcements
by Michael Dillon 01 Feb '97

01 Feb '97

This seems more appropriate here than on NAIPR. I took the liberty of removing the discussion that led up to it and leaving only Karl's words. This seems to tie in to the layer 2 filtering discussion here. ---------- Forwarded message ---------- Date: Fri, 31 Jan 1997 20:09:59 +73800 (CST) From: Karl Denninger <karl(a)Mcs.Net> To: Michael Dillon <michael(a)MEMRA.COM> Cc: naipr(a)lists.internic.net Subject: Re: Implied warranty of routability? Was: Re: US CODE: Title 15, ... [some discussion of bogus TLD's and bogus routes deleted] Balderdash. Just the other day 0.0.0.0/0 (yes, DEFAULT) was being propagated by a LARGE NUMBER of national providers -- from a rogue (and unintentional) announcement that came out of a particular firm in Virginia. This went on for well over SIX HOURS before it was stopped. It was transiting a large number of NATIONAL network provider's core hardware, and disrupting connectivity to a fair number of people, some of whom were completely clueless as to the cause. We found it because we run defaultless and ANY instance of default appearing in announcements or anywhere on our core is an instant five-alarm fire. When we finally called the guilty party (after informing peers and upstream links hours before with no effect), they had not heard ANYTHING about it as of yet, and the announcement was ALREADY a few hours old in our tables at that point. Filtered out quickly my tailfeathers. 99% of the companies out there don't filter ANYTHING at that kind of level. Try to maintain the filters on CISCO hardware to actually verify and prevent any rogue announcements -- good luck. You just can't do an EFFECTIVE job of this; the coordination you NEED to do so is completely non-existant between firms to make it possible, especially in the "swamp". Now you can get routes from only a route server, yes, and that does help. Quite a bit. But basically all providers of any significance have exchange point(s) where the RADB isn't used. If the address isn't something that someone else is using, and is of sufficient prefix size (in 206 and above) I bet it wouldn't be noticed for months -- if ever -- until someone tried to get a so-called "official" allocation of the same number and said "what the hell??" when they found it already in the tables. I bet I could announce a random "reserved" prefix and nobody would catch it for at least 30 days -- during which time it would work perfectly, and globally. Yes, doing that kind of thing would be highly antisocial. But don't think for an instant that anyone actually watches constructively for this kind of chicanery on the net. That would be a false assumption, as I think the little episode of the other day proves rather conclusively. -- -- Karl Denninger (karl(a)MCS.Net)| MCSNet - The Finest Internet Connectivity http://www.mcs.net/~karl | T1's from $600 monthly to FULL DS-3 Service | 99 Analog numbers, 77 ISDN, Web servers $75/mo Voice: [+1 312 803-MCS1 x219]| Email to "info(a)mcs.net" WWW: http://www.mcs.net/ Fax: [+1 312 248-9865] | 2 FULL DS-3 Internet links; 400Mbps B/W Internal

1 0

Re: Internet vs. Telephone company vs. cable company
by Tony Torzillo 01 Feb '97

01 Feb '97

I've wondered if the recent advent of cable modems could change our entire Internet/telecommunications strategy. Provided that the cable network becomes widely available, more internet users would shift from using telephone lines for access to cable lines. Couple that with the use of the internet phone, and the phone line would only be necessary for communicating with non-internauts. I can see a number of ramifications for this - companies making money from long distance usage would be rather upset - and backbone providers would have to upgrade existing circuits to handle the increase in traffic. Anyone have thoughts/comments in regard to this as well? Tony Torzillo ---------------------------------------------------------------- Network Specialist, UW Network Operations Center, 543-5128 EMAIL: ndc-noc(a)cac.washington.edu, torzillo(a)cac.washington.edu ---------------------------------------------------------------- On Fri, 31 Jan 1997, David Schwartz wrote: More than anything, the problem is due to a flat-rate monthly pricing plan for calls which are increasing in both number and length. David Schwartz On Fri, 31 Jan 1997, Tony Torzillo wrote: > My question is: Have other people heard of similar attempts by the > telephone companies to have "metered Internet access"? It seems they > would need a hardware level signal analyzer on their switching equipment > to differentiate between voice/data. Does anyone know by what means such > a technology could be implemented? What would be the legal ramifications? > > Also do people agree with the claims that our local lack of available > phone lines is due to Internet usage or just to lack of foresight in > growth management decisions?

3 2

RE: Alpha test of MAE filtering capability
by Chris A. Icide 01 Feb '97

01 Feb '97

---------- From: Paul A Vixie[SMTP:paul@vix.com] But let me turn it around. With no means of detection, why do we suspect that it's a problem? That is, why doesn't the cause for suspicion also work as a means of detection? Well, here is the way I found mine. We keep usage information on all of our router ports, and one day, my FDDI interface to an exchange point jumps by 10Mbps. I haven't added any customers, and going back to examine my traffic patterns for customer ports, I have no cooinciding traffic increase. However, I do show this increase mainly passing from one Exchange point to the other. After isolation all traffic sources that would have created such a jump in traffic, I come up with a big goose egg. So, my next step was to log some flows from the router at the exchange point, and after pouring through quite a few flows, I begin to see traffic from an entity that my company has absolutely no relationship with. This all takes quite a bit of time. I would not want to judge anyone with partial data. Meanwhile bandwidth paid for by my customers, and engineered based upon my customer's needs is being chewed up. My customers are affected. I would prefer to prevent such events from affecting my customers, who I think would agree with this method. IMHO, as long as money is involved, and as long as someone thinks that they have a chance of getting away with something, they will try it. Chris

7 6

RE: Internet vs. Telephone company
by Robert Wilson 01 Feb '97

01 Feb '97

A couple observations: 1. Local and Long Distance phone companies stand to gain the most from the current Internet growth frenzy, yet seem to be the quickest to try to slow or defer its growth...They have the luxury of having enough a buaracracy surrounding them to play both ends AND the middle. One cannot say that they haven't profited from their growth....re-investment in infrastructure is simply par for the course when providing network services. 2. If they are NOT careful, TCI/@Home will have their lunch. Although ADSL may be viable, its cost model still looks high to the consumer when positioned against cable modems, and would offer no real tangible difference to the casual end user. My wish is that they begin to understand this at a macro level.... >---------- >From: Tony Torzillo[SMTP:torzillo@cac.washington.edu] >Sent: Friday, January 31, 1997 4:24 PM >To: nanog(a)merit.edu >Subject: Internet vs. Telephone company > >An interesting article was posted by the Seattle Times yesterday, it's at: > >http://www.seattletimes.com/topstories/browse/html97/inet_013097.html > >This was the Jan 30, 1997 issue. In it, Diedtra Henderson writes: > >"US West serves 2.2 million customers in Washington state and spent $340 >million improving its phone system here last year, a spokesman said. The >company blames a meteoric rise in Internet use for its phone-service woes. >[SNIP] >"For the next five years we are in big trouble. There is no clear, >intelligent way to expand the phone system to handle the Internet >demands," said Lu, who expects metered Internet access in the future - in >other words, you pay by the hour. " > >My question is: Have other people heard of similar attempts by the >telephone companies to have "metered Internet access"? It seems they >would need a hardware level signal analyzer on their switching equipment >to differentiate between voice/data. Does anyone know by what means such >a technology could be implemented? What would be the legal ramifications? > >Also do people agree with the claims that our local lack of available >phone lines is due to Internet usage or just to lack of foresight in >growth management decisions? > >Tony Torzillo >---------------------------------------------------------------- >Network Specialist, UW Network Operations Center, 543-5128 >EMAIL: ndc-noc(a)cac.washington.edu, torzillo(a)cac.washington.edu >---------------------------------------------------------------- > >

1 0

RE: Internet vs. Telephone company
by Bharat Ranjan 01 Feb '97

01 Feb '97

> My question is: Have other people heard of similar attempts by the telephone companies to have "metered Internet access"? > It seems they would need a hardware level signal analyzer on their switching equipment to differentiate between voice/data. >Does anyone know by what means such a technology could be implemented? Check out a product called 'Internet Thruway" that routes a call based on the Called Number. The idea is for telcos to implement this product as a back-end to their access network so calls being made to a Thruway provider never reach the voice network. It is instead sent (via IP and L2F) directly to the ISP's network. SBC is already committed to deploying this in parts of Texas. Check out the full story at www.nortel.com and search on 'Internet Thruway' Attached is a piece of the press release mm mm sssss nnnnnn * Bharat Ranjan * m m m s nnnnnnn * Network Engineer * m m m sssss nn nn * MSN Network Services * m m s nn nn * (206)-936-0471 * m m sssss nn nn * bharatr(a)microsoft.com * ******************************************************* * The opinions/ideas in this memo are not necessarily * * those of Microsoft Corp. * ******************************************************* ______________________ Nortel Announces Internet Thruway for Public Carriers Research Triangle Park, NC -- Nortel has announced Nortel Internet Thruway, the industry's first high-performance, end-to-end solution to help public carriers more efficiently handle the impact of rapidly growing Internet and telecommuting traffic. Available today, Nortel Internet Thruway works in a multivendor switching network to elegantly groom long-duration data and Internet calls off the voice network to a data network, minimizing the impact of the traffic on the voice network and allowing carriers to offer new services to data users, Internet Service Providers (ISPs), and companies offering remote access and telecommuting. Internet Thruway recognizes data calls based on called number and totally redirects them away from the originating switch before they reach the voice network. These calls are converted to packet data format, encapsulated in IP packets using industry-standard Layer-2 Forwarding (L2F) protocol for security, and sent to the appropriate ISP or corporate LAN over a frame relay or asynchronous transfer mode (ATM) network. Voice calls proceed to the voice network over a standard TR303 link, an open interface to central offices.

1 0

so are we talking product opportunity here?
by Paul A Vixie 01 Feb '97

01 Feb '97

An Alpha and NNSTAT and GateD running as part of a DAS ring that otherwise just has an NSP router and a GIGAswitch port, with a lot of hand tuning to notice "bad" flows, would definitely help discover "unintended transit" situations. Surely there's got to be someone on this list who wants to tackle the opportunity to build and sell such a box.

2 1

Re: Internet vs. Telephone company
by ! Drive 01 Feb '97

01 Feb '97

>An interesting article was posted by the Seattle Times yesterday, it's at: > > http://www.seattletimes.com/topstories/browse/html97/inet_013097.html > >This was the Jan 30, 1997 issue. In it, Diedtra Henderson writes: > >"US West serves 2.2 million customers in Washington state and spent $340 >million improving its phone system here last year, a spokesman said. The >company blames a meteoric rise in Internet use for its phone-service woes. >[SNIP] >"For the next five years we are in big trouble. There is no clear, >intelligent way to expand the phone system to handle the Internet >demands," said Lu, who expects metered Internet access in the future - in >other words, you pay by the hour. " > >My question is: Have other people heard of similar attempts by the >telephone companies to have "metered Internet access"? It seems they >would need a hardware level signal analyzer on their switching equipment >to differentiate between voice/data. Who is to say that my data call is actually connecting to the Internet? >Does anyone know by what means such a technology could be implemented? >What would be the legal ramifications? > >Also do people agree with the claims that our local lack of available >phone lines is due to Internet usage or just to lack of foresight in >growth management decisions? I would say an intential lack of foresight in order to increase charges for higher profits.

1 0

Re: Alpha test of MAE filtering capability
by Tony Li 01 Feb '97

01 Feb '97

Entirely agreed. On the other hand I have what is turning out to be a unique (here) point of view about this. I don't want to prevent this kind of theft -- I want to discover it, and remove perpetrators from any IXP where they try it. I don't want to block it. I want to ensure that it is never tried twice. I appear to be in the minority wrt this view. Locks keep honest people honest. Tony

2 1

Re: Alpha test of MAE filtering capability
by salo＠msc.edu 31 Jan '97

31 Jan '97

Entirely agreed. On the other hand I have what is turning out to be a unique (here) point of view about this. I don't want to prevent this kind of theft -- I want to discover it, and remove perpetrators from any IXP where they try it. I don't want to block it. I want to ensure that it is never tried twice. I appear to be in the minority wrt this view. This sounds like a line of reasoning that would argue against filtering in routers: "I don't want to prevent [this activity, whatever it might be] -- I want to discover it..." What sort of filters do you put in your routers? -tjs

1 0

Blocking SPAM at the source?
by Michael Dillon 31 Jan '97

31 Jan '97

>From inet-access On Fri, 31 Jan 1997, Scott Hazen Mueller wrote: > One way to fix this would be for the sites that own large dialin pools to > firewall their dialins so that they can only do SMTP to their own servers. Is anyone doing this like IBM Advantis, InternetMCI, AT&T Worldnet, etc? If not, why not? Michael Dillon - Internet & ISP Consulting Memra Software Inc. - Fax: +1-250-546-3049 http://www.memra.com - E-mail: michael(a)memra.com

1 0