- Test - lists.nanog.org

Re: Access to the Internic Blocked -- LSRR, traceroute with ICMP
by owen＠DeLong.SJ.CA.US 22 Aug '96

22 Aug '96

> > Speaking of which, is anyone going to implement traceroute > >for UNIX which using icmp echo requests, instead of (semi-)random > >udp packets, as the ammo? This is one way which I think Microsoft out > >did the old UNIX implementations. > Then how come UNIX traceroute works in so many places where MSloth's traceroute falls flat on it's face? Remember, an ICMP packet doesn't generate TIME EXCEEDED messages in many applications. It's listed as something the system MAY implement, not SHOULD or MUST. Time exceeded messages are a MUST for UDP and TCP packets. > They're not semi (or quasi) random udp packets. They're sequential > packets. > > Secondly, current router vendors' decisions to prioritize ICMP echo > request as dung-level packets means that traceroute's UDP packets > actually get through at times when pings don't. > This is both good and bad. > Third, I'd be happy to implement it... but I'm not sure this would > be a win. I can see the loss (see paragraph 2), but WHAT is the > big win??? > Compatibility with Whine-Doze? :-) > E > p.s. The original question was based on Vadim's rhetorical query > as to router vendors. Learn to differentiate between WISHFUL > THINKING and routing reality. When router vendors pledge to > not drop, and properly route lsrr icmp echo request/reply > that code will be online within 24 hours. > > :-) Owen > > The combination of the above and the below would give us > >the usefulness we want and the security we want. (I don't think > >the below would work with Van Jacobsen's traceroute 1.2) > > >On Wed, 21 Aug 1996, Vadim Antonov wrote: > > >> On itself, LSRR is a godsend to hackers (i can think of about > >> a dozen of very nasty attacks using general LSRR). The only > >> useful application for it is traceroute. > >> > >> Why don't router vendors provide an option to turn it > >> off for everything but ICMP ECHO? > >> > >> --vadim > >

3 2

Re: Access to the Internic Blocked
by Vince Fuller 22 Aug '96

22 Aug '96

So now I need to hack my traceroute to send ICMP_ECHO_REQUESTS instead of high-port udp packets? You'll also need to pursuade your router vendor to violate the ICMP spec, which says that ICMP error messages (i.e. TTL exceeded) are never sent in response to ICMP messages... I suspect that this restriction is precisely the reason that "traceroute" uses high-port UDP packets. --Vince

1 0

NANOG Registration
by Pam Ciesla 22 Aug '96

22 Aug '96

Please NOTE the only credit cards that we are accepting for NANOG are VISA & MasterCard. We also are accepting checks made out to the Universtiy of Michigan. See the registration form on the Merit Web Page. Pam Ciesla

1 0

Re: Access to the Internic Blocked
by Vadim Antonov 22 Aug '96

22 Aug '96

On itself, LSRR is a godsend to hackers (i can think of about a dozen of very nasty attacks using general LSRR). The only useful application for it is traceroute. Why don't router vendors provide an option to turn it off for everything but ICMP ECHO? --vadim

4 3

Re: Access to the Internic Blocked
by John Hawkinson 22 Aug '96

22 Aug '96

> >On itself, LSRR is a godsend to hackers (i can think of about > >a dozen of very nasty attacks using general LSRR). The only > >useful application for it is traceroute. > > > >Why don't router vendors provide an option to turn it > >off for everything but ICMP ECHO? > > Personally I find this an excellent suggestion. So now I need to hack my traceroute to send ICMP_ECHO_REQUESTS instead of high-port udp packets? Oh well, I guess we can put this right next to the patches to have traceroute send TCP SYNs to get through stupid firewalls. --jhawk

1 0

Re: Access to the Internic Blocked
by Geoff Huston 21 Aug '96

21 Aug '96

The number of transit providers who turn off lsrr is growing daily. Quite frankly turning it off it simply makes everyones life harder. The only justification I hear when I question this is a) "this is some kind of proxy security mechanism for our clients" (really!) or b) "whats loose source routing anyway?" Geoff Huston gih(a)telstra.net >To: Michael Dillon <michael(a)memra.com> >cc: nanog(a)merit.edu >Subject: Re: Access to the Internic Blocked >Date: Wed, 21 Aug 1996 13:41:50 -0400 >From: "Jeff Young" <young(a)mci.net> > >perhaps if folks would just take the time to loose source route >in both directions instead of only one... > >was the web page in response to complaints to those who turn off lsrr? > >Jeff Young >young(a)mci.net

2 1

Re: Access to the Internic Blocked
by Geoff Huston 21 Aug '96

21 Aug '96

The number of transit providers who turn off lsrr is growing daily. Quite frankly turning it off it simply makes everyones life harder. The only justification I hear when I question this is a) "this is some kind of proxy security mechanism for our clients" (really!) or b) "whats loose source routing anyway?" Geoff Huston gih(a)telstra.net >To: Michael Dillon <michael(a)memra.com> >cc: nanog(a)merit.edu >Subject: Re: Access to the Internic Blocked >Date: Wed, 21 Aug 1996 13:41:50 -0400 >From: "Jeff Young" <young(a)mci.net> > >perhaps if folks would just take the time to loose source route >in both directions instead of only one... > >was the web page in response to complaints to those who turn off lsrr? > >Jeff Young >young(a)mci.net

1 0

RE: [NIC-960710.6343] INVOICE (hardcopy) (01-jul-1996 - 07-jul-1996)
by Bill Woodcock 21 Aug '96

21 Aug '96

We haven't seen too many mis-bills, but quite a few uncredited payments... i.e. our customer gets a cancelled check back, but then the InterNIC either cancels the domain or refuses to acknowlege payment, or both. I'd say this is happening in 1%-2% of cases, which seems pretty high. -Bill Woodcock

2 1

Access to the Internic Blocked
by Golan Ben-Oni 21 Aug '96

21 Aug '96

Network Solutions has decided to filter our CIDR addr, 169.132 / 16 since about 5 PM yesterday from reaching the internic. Below is a forwarded copy of email exchange between myself, and MCI -- It appears that there is no backup routing engineer at the Internic which troubles me greatly. MCI has been attempting to contact them every 30 minutes since yesterday to no avail. This is the second time in a month or so that this has happened. Since I was unable to contact Mark Kosters, I felt it might be helpful to contact Kim Hubbard - To my dismay, she refused to acknowledge our problem and hung up on me with an attitude. <sigh> Of course, this pleases me to no end. ---------- Forwarded message ---------- Date: Mon, 19 Aug 1996 17:11:32 -0400 From: Nour Elouali <nour(a)mci.net> To: markk(a)netsole.com, allwync(a)rs.internic.net Cc: bnite(a)tremere.ios.com, trouble(a)mci.net Subject: Access Denied Hi there, One of our peers _idt.net_ cannot reach your site, see the forwarded traceroute.. They cannot route to you from any IP Address within their CIDR Block 169.132.0.0/16. According to my traceroute, I see that they get filtered out at network-solutions which is your provider. Will you be able to assist? Thanks... -Nour Elouali MCI NOC ****** border7.wtn#tr 198.41.0.6 Type escape sequence to abort. Tracing the route to rs1.internic.net (198.41.0.6) 1 network-solutions.Washington.mci.net (204.70.77.42) 8 msec 8 msec 4 msec 2 rs1.internic.net (198.41.0.6) [AS 6245] 8 msec 4 msec 4 msec ****** ------- Forwarded Message Delivery-Date: Mon, 19 Aug 1996 17:27:36 -0500 Received: from postoffice.Reston.mci.net by carbon.cary.mci.net (8.6.12/kaw-mci.net/feb95) id NAA02326; Mon, 19 Aug 1996 13:27:24 -0400 Received: from tremere.ios.com (tremere.ios.com [169.132.32.250]) by postoffice.Reston.mci.net (8.7.5/8.7.3) with ESMTP id NAA28560 for <trouble(a)mci.net>; Mon, 19 Aug 1996 13:27:21 -0400 (EDT) Received: (from bnite@localhost) by tremere.ios.com (8.7.5/8.6.9) id NAA08739 for trouble(a)mci.net; Mon, 19 Aug 1996 13:27:11 -0400 (EDT) Date: Mon, 19 Aug 1996 13:27:11 -0400 (EDT) From: Golan Ben-Oni <bnite(a)tremere.ios.com> Message-Id: <199608191727.NAA08739(a)tremere.ios.com> To: trouble(a)mci.net Subject: Traceroute to Internic traceroute rs.internic.net traceroute to rs.internic.net (198.41.0.6), 30 hops max, 40 byte packets 1 eth-3.gw-4.hck.idt.net (169.132.32.254) 2.907 ms 2.026 ms 3.068 ms 2 eth-0.gw-1.hck.idt.net (169.132.34.250) 107.054 ms 121.335 ms 77.012 ms 3 10.255.255.1 (10.255.255.1) 82.342 ms 70.764 ms * 4 192.41.177.181 (192.41.177.181) 55.270 ms 48.858 ms 42.972 ms 5 core2-hssi2-0.Washington.mci.net (204.70.1.213) 40.422 ms 40.915 ms 43.822 ms 6 border7-fddi-0.Washington.mci.net (204.70.74.51) 33.906 ms 78.689 ms 75.278 ms 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * 13 * * * 14 * * * ------- End of Forwarded Message

10 13

How connect to a NAP ?
by James R. Fisher 703-648-7026 20 Aug '96

20 Aug '96

Quick question from a lurker: If a Federal Agency wanted to connect directly to a NAP (e.g., MAE-East, MAE-West), how would they start the process, who are the contacts ? P.S. Does FIX still exist ? Thanks. -jrf

3 2