- Test - lists.nanog.org

NANOG ANNOUNCEMENT: After NANOG Activities
by William B. Norton 27 Sep '96

27 Sep '96

Hi all - Good ideas - We have rescheduled the RA Tutorial and the Route Flap BOF to run in parallel from 1:30 until about 3:00. Thanks for the e-mail - We have the whirlyball courts for reserved for Thursday evening after dinner. It was suggested again that we should not allow the whirlyball superstars to team up, so we'll have to find a way to equitably split up teams. Maybe Metcalfe fans vs. Metcalfe Critics. Although that might be uneven as well.... Bill PS - We're going to have to close the NetSCARF workshop registration after this weekend; we have just about reached our 50 seat limit. Consider this a last call. ---------------------------------------------------------------------- William B. Norton <wbn(a)merit.edu> (313) 936-2656

1 0

Re: List of Attendees
by William B. Norton 27 Sep '96

27 Sep '96

Perhaps light, but not as atypical as one might think. We usually get a flurry of registrations at the last call, about two weeks before the meeting. Bill At 09:35 PM 9/26/96 -0400, Paul Ferguson wrote: >Hmm. About 120 people. Interestingly sparse. > >- paul > > >

1 0

Re: Advice on dealing with Sprint
by Vadim Antonov 27 Sep '96

27 Sep '96

When i was at Sprint it was customary to ask customers to provide some assurance that routing information Sprint takes from them is going to stay sane. That was usually achieved by asking customers to send in their border configurations for review by SL engineering, and some formal criteria (like "no unfiltered IGP to BGP redistribution") was applied and said configuration had problems worked out before the actual peering was enabled. Anyway, that automatically made every customer with BGP to go down SCA (Special Customer Arrangement) route. I think sales didn't like that, for whatever reason, and i saw several attempts to make BGP peering a regular sale during my tenure there. I guess they succeded after coming with some "guidelines", but without any understanding of the issues involved. Somehow i became a big fan of Dilbert back then. --vadim

3 2

Re: syn attack and source routing
by Vadim Antonov 27 Sep '96

27 Sep '96

John Hawkinson <jhawk(a)bbnplanet.com> wrote: > i should have been more specific. i don't like the idea (at all) of > breaking traceroute -g either. i guess in a more general sense i > should ask "just how dangerous *is* having backbone-wide/internet-wide > loose source routing enabled?". >As Curtis explained, "not very". Want to wait until SYN attacks are augmented with LSRR-enabled traffic randomization to the point of making it nearly impossible to trace? People knew about SYN flooding for years. Nothing happened until s*t hit the fan. I strongly suspect that LSRR is of the same category. >This is a very different case from that of SYN flooding, where the >victims are powerless to stop it. Now, providers being unable to trace would be a nice addition. >Please don't take our LSRR away from us, it is very useful. Per se, LSRR is not useful. traceroute -g is. Why not to implement something saner like traceroute servers? Or better yet, the ICMP TRACEROUTE message, which would go hop by hop and on every hop generates a response message. Augmented with PROXY TRACEROUTE which will cause the destination box to send out the ICMP TRACEROUTE. I can write RFC in my copious spare time if you think that this makes more sense than the UDP kludge. >Campaigning to remove something just because you suspect it might be >bad is really not nice -- it will result in random clueless people >believeing you when perchance they should not :-) Ah. I love the "the moozhik won't cross until thunder rolls" attitude. --vadim

6 5

Hints for tracing SYN flooders (and others) through Ciscos
by Jeff Rizzo 27 Sep '96

27 Sep '96

Apologies to those to whom what I present here is blindingly obvious; I'm killing some time while waiting for a response from an ISP that we've traced an attack on one of our customers to, and I thought I'd share a tip: Since virtually everyone who has a Cisco has at least fast switching, if not cbus switching, enabled, the "debug ip packet [access-list] detail" suggested here the other day won't show much, as the processor (which is doing the debugging) won't actually see the whole packet. You can sit there for quite some time without results. :) Obviously it makes no sense from a performance perspective (at least if you have even moderate traffic) to turn off fast switching, you *can* clear the ip cache for the attacked network. This forces the processor to look at a number of packets to rebuild a cache entry. Now, if you're especially lucky, your debug may catch the packets you're looking for right off, and tell you the ingress interface. More likely, however, is you'll need to clear the cache entry a number of times to get a hit. You're still on your own when you get to a shared IXP fabric, and you'll need a sniffer there, but it can help. (Hey Cisco! Any chance of putting a source MAC address in the "detail" information? :) At least, if the attacker's sending rapidly enough to be noticeable. Hope this helps someone. +j -- Jeff Rizzo nc0005(a)noc.netcom.net NETCOM Sr. Network Administrator Guy +1 415 758 1457

2 1

Re: List of Attendees
by Paul Ferguson 27 Sep '96

27 Sep '96

At 04:32 PM 9/26/96 -0400, Pam Ciesla wrote: > >Is on the web at http://www.merit.edu/~nanog/NANOG.html. This list is >as of 9/26 3:00PM. The following people have responded since & will >be added at a later time. Bill Simpson, Brent Felder & Michael Patton. > Pam > Hmm. About 120 people. Interestingly sparse. - paul

2 1

Re: List of Attendees
by Bill Woodcock 27 Sep '96

27 Sep '96

> McCauley, Bill > Meyer, David, Does the fact that we go from MCC to MEY without passing through MET mean that we won't have to wear suits, or pre-boot our laptops? :-) -Bill ________________________________________________________________________________ bill woodcock woody(a)zocalo.net woody(a)applelink.apple.com user(a)host.domain.com

1 0

Nanog Advice
by None 26 Sep '96

26 Sep '96

Fri, 07 Sep 1996 08:26:53 -0500 From: Zachary DeAquila <zachary(a)zachs.place.org> Sender: owner-nanog(a)merit.edu Given all the recent advice and info here, how about making an 'Advice from Nanog' page off of the main NANOG web site? It could contain kind of a 'NANOG FAQ' and provide a place to point people who have questions at. The advice should be individualy attributed so you know whose views you're getting, so we can tell a Freedmanbit from a Metzgerbit from a Denningerbit from a Postelbit from a Doranbit... and also to give credit where it's due, of course :) --Z

2 1

List of Attendees
by Pam Ciesla 26 Sep '96

26 Sep '96

Is on the web at http://www.merit.edu/~nanog/NANOG.html. This list is as of 9/26 3:00PM. The following people have responded since & will be added at a later time. Bill Simpson, Brent Felder & Michael Patton. Pam

1 0

RE: Advice on dealing with Sprint
by Chris A. Icide 26 Sep '96

26 Sep '96

Yes, I'm extremely suprised that this is their stance. I'm pressed to find a technical reason behind such a requirement. The 7000 is a Motorola 68XXX based system, and the 4500/4700 is a risc based system. There have been performance tests that have shown that the 45/47 boxes out perform the 7000 boxes. I'd be very interested in hearing Sprints' reasoning on this. Chris ---------- From: Neil J. McRae[SMTP:neil@EASYNET.NET] Sent: Thursday, September 26, 1996 11:11 AM To: Deepak Jain Cc: Steve Mansfield; Rob Liebschutz; hank(a)rem.com; jon(a)worf.netins.net; nanog(a)merit.edu; neil(a)EASYNET.NET Subject: Re: Advice on dealing with Sprint On Thu, 26 Sep 1996 10:36:56 -0400 (EDT) Deepak Jain <deepak(a)jain.com> alleged: > > Steve - > > I think he means Sprint told him they would not BGP4 peer with > him if he didn't have a Cisco 7000 series router. Not that it wasn't > possible. :) > You have to vote with your feet on this and take your money elsewhere. Regards, Neil. -- Neil J. McRae. Alive and Kicking. E A S Y N E T G R O U P P L C neil(a)EASYNET.NET NetBSD/sparc: 100% SpF (Solaris protection Factor) Free the daemon in your <A HREF="http://www.NetBSD.ORG/">computer!</A> BTnet support reply regarding 45 minutes of no service: "BGP FNF, BGP A OK, BT ISP A OK, MFI NO GO!!" -- Bill.Peters(a)bt.net

4 3