- Test - lists.nanog.org

Hints for tracing SYN flooders (and others) through Ciscos
by Jeff Rizzo 27 Sep '96

27 Sep '96

Apologies to those to whom what I present here is blindingly obvious; I'm killing some time while waiting for a response from an ISP that we've traced an attack on one of our customers to, and I thought I'd share a tip: Since virtually everyone who has a Cisco has at least fast switching, if not cbus switching, enabled, the "debug ip packet [access-list] detail" suggested here the other day won't show much, as the processor (which is doing the debugging) won't actually see the whole packet. You can sit there for quite some time without results. :) Obviously it makes no sense from a performance perspective (at least if you have even moderate traffic) to turn off fast switching, you *can* clear the ip cache for the attacked network. This forces the processor to look at a number of packets to rebuild a cache entry. Now, if you're especially lucky, your debug may catch the packets you're looking for right off, and tell you the ingress interface. More likely, however, is you'll need to clear the cache entry a number of times to get a hit. You're still on your own when you get to a shared IXP fabric, and you'll need a sniffer there, but it can help. (Hey Cisco! Any chance of putting a source MAC address in the "detail" information? :) At least, if the attacker's sending rapidly enough to be noticeable. Hope this helps someone. +j -- Jeff Rizzo nc0005(a)noc.netcom.net NETCOM Sr. Network Administrator Guy +1 415 758 1457

2 1

Re: List of Attendees
by Paul Ferguson 27 Sep '96

27 Sep '96

At 04:32 PM 9/26/96 -0400, Pam Ciesla wrote: > >Is on the web at http://www.merit.edu/~nanog/NANOG.html. This list is >as of 9/26 3:00PM. The following people have responded since & will >be added at a later time. Bill Simpson, Brent Felder & Michael Patton. > Pam > Hmm. About 120 people. Interestingly sparse. - paul

2 1

Re: List of Attendees
by Bill Woodcock 27 Sep '96

27 Sep '96

> McCauley, Bill > Meyer, David, Does the fact that we go from MCC to MEY without passing through MET mean that we won't have to wear suits, or pre-boot our laptops? :-) -Bill ________________________________________________________________________________ bill woodcock woody(a)zocalo.net woody(a)applelink.apple.com user(a)host.domain.com

1 0

Nanog Advice
by None 26 Sep '96

26 Sep '96

Fri, 07 Sep 1996 08:26:53 -0500 From: Zachary DeAquila <zachary(a)zachs.place.org> Sender: owner-nanog(a)merit.edu Given all the recent advice and info here, how about making an 'Advice from Nanog' page off of the main NANOG web site? It could contain kind of a 'NANOG FAQ' and provide a place to point people who have questions at. The advice should be individualy attributed so you know whose views you're getting, so we can tell a Freedmanbit from a Metzgerbit from a Denningerbit from a Postelbit from a Doranbit... and also to give credit where it's due, of course :) --Z

2 1

List of Attendees
by Pam Ciesla 26 Sep '96

26 Sep '96

Is on the web at http://www.merit.edu/~nanog/NANOG.html. This list is as of 9/26 3:00PM. The following people have responded since & will be added at a later time. Bill Simpson, Brent Felder & Michael Patton. Pam

1 0

RE: Advice on dealing with Sprint
by Chris A. Icide 26 Sep '96

26 Sep '96

Yes, I'm extremely suprised that this is their stance. I'm pressed to find a technical reason behind such a requirement. The 7000 is a Motorola 68XXX based system, and the 4500/4700 is a risc based system. There have been performance tests that have shown that the 45/47 boxes out perform the 7000 boxes. I'd be very interested in hearing Sprints' reasoning on this. Chris ---------- From: Neil J. McRae[SMTP:neil@EASYNET.NET] Sent: Thursday, September 26, 1996 11:11 AM To: Deepak Jain Cc: Steve Mansfield; Rob Liebschutz; hank(a)rem.com; jon(a)worf.netins.net; nanog(a)merit.edu; neil(a)EASYNET.NET Subject: Re: Advice on dealing with Sprint On Thu, 26 Sep 1996 10:36:56 -0400 (EDT) Deepak Jain <deepak(a)jain.com> alleged: > > Steve - > > I think he means Sprint told him they would not BGP4 peer with > him if he didn't have a Cisco 7000 series router. Not that it wasn't > possible. :) > You have to vote with your feet on this and take your money elsewhere. Regards, Neil. -- Neil J. McRae. Alive and Kicking. E A S Y N E T G R O U P P L C neil(a)EASYNET.NET NetBSD/sparc: 100% SpF (Solaris protection Factor) Free the daemon in your <A HREF="http://www.NetBSD.ORG/">computer!</A> BTnet support reply regarding 45 minutes of no service: "BGP FNF, BGP A OK, BT ISP A OK, MFI NO GO!!" -- Bill.Peters(a)bt.net

4 3

Re: Advice on dealing with Sprint
by Jay Stewart 26 Sep '96

26 Sep '96

> I spoke to a sprint salesperson about 2 weeks ago and was told that I > could not get any kind of BGP4 peering with Sprint unless I had a > Cisco 7000 series router. This is my experience also, althought I was able to get my sales weasel to say that they might except a 45xx series if it had sufficient memory, as some "exceptions" had been granted on a "case by case" basis. As a reseller of IP services they will not manage my router for me, but said I still had to have a Cisco(tm) router, even if I'm not peering BGP. Jay Stewart Vice President Olympia Networking Services - "Olympia's Premier Internet Access" Phone (360) 753.3636 Fax (360) 357.6160 http://www.olywa.net/

6 6

NANOG Announcement
by Pam Ciesla 26 Sep '96

26 Sep '96

Hi all - Just a few announcements about the upcoming NANOG meeting. The meeting is less than one month away so be sure to register as soon as possible at http://www.nanog.org. For those of you would do not want to prepay please be sure to register now. We need info for name badges and head count. On a related note, hotel rooms are going fast so don't delay too long! Several of you have requested the Agenda - The agenda will e-mailed out in a couple of days after we confirm the speakers and topics. To allow time for all the presentations we're hoping to include, we may need to run the meeting until 1:00 p.m. on Friday; please plan your flight schedules accordingly. We're also planning to offer a tutorial on RA tools and use of the Internet Routing Registry, and there will be a route flap BOF on Friday afternoon. And there's a NetSCARF workshop preceding NANOG: NetSCARF Workshop 1-5PM Wednesday Oct 23rd, register required at www.merit.edu/~netscarf RA Tutorial 2-3:30 Friday Oct 25th Route Flap BOF 3:30-4:30 Friday Oct 25th If folks express an interest (send e-mail to wbn(a)merit.edu) we will reserve a whirlyball court for Thursday evening. Also note that the meeting will be at the Michigan Union in the Ballroom 2nd floor. If you have questions, please contact Pam Ciesla (313) 936-0172 or pam(a)merit.edu. Thanks!

2 1

Advice on dealing with Sprint
by Jon Green 26 Sep '96

26 Sep '96

Hi folks- I have a problem that I need some advice on, and figured this was a good place to turn. We are attempting to connect a T1 to Sprint in order to multi-home our network. Currently we are connected to multiple points on MCI's backbone, and have just installed a T1 to UUnet. We heard back from Sprint today.. they are rejecting us as a customer because we do not use Cisco routers. Apparently they feel that Bay Networks routers are not capable of routing Internet traffic, ignoring the fact that they already peer with ANS and several other providers using Bay routers. OK, Cisco bigots (hi Craig!), quit laughing at me for a second and give me some help here. Is there any technical justification for what Sprint is telling me? I have downstream customers using Bay, Cisco, HP, 3com, Compatible Systems, and even Proteon routers. All of them are able to connect with me just fine. I've been running BGP4 peering with MCI for over a year now, it also works fine. I can't find a single valid reason that Sprint should even need to "approve" my router vendor, except that some short-sighted engineer at Sprint doesn't understand that we live in a multi-vendor world. I'm obviously not going to force Sprint to accept my money, but this screws up a lot of the plans we have made in building our network. Any suggestions welcome. Anyone from Sprint who'd like to comment, please do so. -Jon ----------------------------------------------------------------- * Jon Green * Wide-Area Networking Technician * * jon(a)netINS.net * Iowa Network Services, Inc. * * Finger for Geek Code/PGP * 312 8th Street, Suite 730 * * #include "std_disclaimer.h" * Des Moines, IA 50309 * -------------------------------------------------------------------------

6 6

Re: Advice on dealing with Sprint
by Mark Borchers 26 Sep '96

26 Sep '96

> Perry E. Metzger writes: > >Not, you understand, that I think the global routing table should be > >kept in control, but I find it to be extraordinarily annoying that in > >a world where cheap PCs have been able to take 128meg on their > >motherboards for years (indeed, many can take far more!) and in which > >workstations frequently have 64M of memory in them, there are routers > >(many still sold!) which lack the slots to take more than 32M of > >memory. > > Cisco has been repeatedly abused for this. They have learned, a bit, > over the years. The non-M 45xx/47xx boxes are I think no longer being > sold, and the "M" replacements are upgradeable to 64MB. > > (of course, I suspect you'll never be able to get more than 64 MB of > memory for a 7000. Someday they will get abused for that, too.) > I believe the official line here will probably be that by the time you need 128 MB in your 7000, you also need to install the RSP7000 upgrade, which allows the additional memory. Mark Borchers InfiNet Network Engineering NOC: (757) 624-2295 ext. 3007

1 0