- Test - lists.nanog.org

Re: Ping flooding (fwd)
by Dick St.Peters 09 Jul '96

09 Jul '96

> action source destination > ------ ------ ----------- > > allow 10.1.1.64/26 * > deny * * > > Of course, no one does this, Er ... we do this. -- Dick St.Peters, Gatekeeper, Pearly Gateway, Ballston Spa, NY stpeters(a)NetHeaven.com Owner, NetHeaven 518-885-1295/800-910-6671 Internet for Albany/Saratoga, Glens Falls, North Creek, & Lake Placid First Internet service based in the 518 area code

2 1

Re: InfoWorld Column on Netcom-Cisco & collapse
by Larry J. Plato 09 Jul '96

09 Jul '96

Mr Metcalfe, Did you really send this? The header indicates this came from some Kelmscott farms in Lincolnville, ME not infoworld.com. I find it hard to believe a journalist of your stature would descend to such a very LOW level, Just curious, Larry Plato ----- Forwarded message from Perry E. Metzger ----- > From nanog-owner(a)merit.edu Tue Jul 9 21:17:19 1996 > Message-Id: <199607091944.PAA14086(a)jekyll.piermont.com> > X-Authentication-Warning: jekyll.piermont.com: Host perry@localhost didn't use HELO protocol > To: nanog(a)merit.edu > Subject: Bob Metcalfe: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse > Date: Tue, 09 Jul 1996 15:44:33 -0400 > From: "Perry E. Metzger" <perry(a)piermont.com> > Sender: owner-nanog(a)merit.edu > Precedence: bulk > > > I thought folks might want to see this. > > ------- Forwarded Message > > Date: Tue, 9 Jul 1996 15:33:32 -0400 > X-Sender: bob(a)kelmscott.com > Message-Id: <v02130502ae082a519beb(a)[204.117.49.7]> > To: perry(a)piermont.com > From: bob_metcalfe(a)infoworld.com (Bob Metcalfe) > Subject: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse > > > Dear Mr. Piermont, > > Stay out of this. Since I'm such a creep, please ignore me in the future. > > /Bob Metcalfe > > [...] > > ------- End of Forwarded Message >

1 0

Re: Internet access and telco usage patterns
by Hong Chen 09 Jul '96

09 Jul '96

Eric, Well, as many people asked me the mailing list on IETF roaming group. The status is that it is setup today, and you can follow the following instructions to subscribe to it Enjoy, Hong ******************************************************************** Welcome to the roamops mailing list! If you ever want to remove yourself from this mailing list, send the following command in email to "roamops-request(a)ns2.rutgers.edu": unsubscribe Or you can send mail to "Majordomo(a)ns2.rutgers.edu" with the following command in the body of your email message: unsubscribe roamops hchen(a)aimnet.net Here's the general information for the list you've subscribed to, in case you don't already have it: Specifications for roaming ip network clients -------- Begin Included Message ------- > At 10:51 AM 7/5/96 -0700, Hong Chen wrote: > >As a matter of fact, it is quite doable. Aimnet developed a roaming > >server (check www.aimnet.com) that allows international ISPs to > >use each other's network to provide dialup services. A group of > >ISPs have joined a consortium GRIC (Global Reach Internet > >Consortium) lead by Aimnet. The roaming server is based > >on Radius protocol. > > > >A telco company can install modems and route the authentication to > >the specific ISP for authentication. > > Hong, > > I looked at this doing this about a year ago but the major stumbling block > was that if ISPs share the authentication responsibility using distributed > RADIUS, they have the capability of keeping each other's passwords for the > user's that used the global access service. > > Also, a service you likely know about, started up around the same time in > Vancouver, where I was living at the time, called GeoAccess > (www.globalexpo.com/goeaccess) was going to target this idea much more > aggressively than I (and plus I did not feel like competing with him in > particular), and decided on the model on centralized authentication, > effectivele becoming a worldwide access ISP without purchasing a single modem > or terminal server. But even ISPs participating in his "network" can log > the entered passwords. > > Telephone companies might have a problem with the legal ramifications of this > "roaming" service. > > >I just came back from Montreal INet 96 last week and a new roaming > >IETF group will be started. We are working on the IETF draft > >for the roaming and stay tuned. > > Please let me know what the name of working group is, and perhaps take this > to private email. I would be very interested to know how the password > access problem is worked around, or at very least, rationaly pushed aside, > and even contribute. > > Eric Woodward. > ejw(a)globecomm.net > > -------- End Included Message --------

1 0

since it's national pick-on-bob-metcalfe week anyway...
by Paul A Vixie 09 Jul '96

09 Jul '96

...i'd like to put in my two cents. the trouble with bob isn't that he's arrogant and self centered and unable to see anybody else's point of view. nor is it that he's rude, insensitive to the pain he causes others, and generally doesn't know how to act around people. bob is all of those things, as demonstrated here. but so am i, and so are 90% of the folks on the nanog mailing list. so i will not be seen here jumping on bob for being "normal" per the NANOG specifications. what's getting bob in trouble is that he has the attitude but the things he did to earn it aren't relevant to this audience. he can talk the talk but he hasn't walked the walk. if anybody on NANOG has ever listened to a thing i've said about anything, and has put forth the effort needed to overcome the natural aversion to my arrogant, self centered, rude, insensitive demeanor, it is because (and ONLY because) i carry a pager and have stayed up all night, many nights, working on broken routers, working on broken code for routers, and working to keep customers happy. bob's contribution to what we're doing here is larger than mine, and perhaps larger than almost anybody's. where would we be without Ethernet? however, that is not how to earn the right to walk around with a chip on your shoulder in the NANOG crowd. if you don't have tire tracks over 70% of your body and you've never worked 45 hours at a stretch renumbering an international class A net, nobody seems to care what you have to say. to attract that audience ANYWAY, you have to be a lot more polite than bob has been, or likely ever will be.

1 0

Bob Metcalfe: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse
by Perry E. Metzger 09 Jul '96

09 Jul '96

I thought folks might want to see this. ------- Forwarded Message Date: Tue, 9 Jul 1996 15:33:32 -0400 X-Sender: bob(a)kelmscott.com Message-Id: <v02130502ae082a519beb(a)[204.117.49.7]> To: perry(a)piermont.com From: bob_metcalfe(a)infoworld.com (Bob Metcalfe) Subject: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse Dear Mr. Piermont, Stay out of this. Since I'm such a creep, please ignore me in the future. /Bob Metcalfe [...] ------- End of Forwarded Message

3 2

InfoWorld Column on Netcom-Cisco Ampersand Collapse
by bob_metcalfe＠infoworld.com 09 Jul '96

09 Jul '96

Dear NANOG, You saw that Craig Huegen has caught me in ANOTHER error. He's of course right (way below) that: The Network Works. No Excuses. is Cisco's slogan, not Netcom's, as I incorrectly wrote in my current InfoWorld column. Netcom doesn't seem to have a slogan. I stand corrected AGAIN. A copy of my incorrect InfoWorld column is below FYI. Nothing slips by NANOG (;->). Not to get back at Mr. Huegen, but he should note that Cisco is not "cisco" anymore. Gotcha! By the way, Mr. Huegen, the well-known fact that the Internet offers no service guarantees has not, as you've written, escaped me. This well-known fact is one of those we are working to FIX. Also, tell us, what was the "original purpose" of the Internet? Not that it matters much. Ever your fan and loyal opposition, /Bob Metcalfe, InfoWorld --------------------------------- InfoWorld, July 8, 1996 (www.infoworld.com) Netcom-Cisco outage could foreshadow much bigger collapses ahead When a tropical storm grows large enough -- winds exceeding 75 mph -- we call it a hurricane and give it a name. It's time we do something similar with Internet outages. Borrowing a threshold used by our Federal Communications Commission in the reporting of telephone outages, when more than 50,000 people are denied their Internet access for more than an hour, let's call it an Internet collapse and give it a name. Let's call the threshold a 50Kx1 collapse, or a 50 kilolapse. Then we can say that, two weeks ago, the Internet suffered a 400Kx13 collapse, or a 5.2 megalapse. Beginning in the afternoon of June 18, the 400,000 customers of Netcom On-Line Communication Services Inc. (http://www.netcom.com) experienced not just the usual worsening afternoon Internet brownout but lost their Internet mail and Web access for 13 hours. (See "Netcom service forced into 12-hour shutdown," June 24, page 3.) Netcom says that this 5.2 megalapse was triggered by an engineer incorrectly typing an ampersand into a router made by Cisco Systems Inc. (http://www.cisco.com) This typo was followed by "a flood of non-Netcom BGP [Boundary Gateway Protocol] routes being introduced into our OSPF [open shortest path first] network backbone. This led to a chain reaction of routing protocol fluctuations, which in turn overloaded a majority of the gateway routers on the Netcom WAN. Our network support staff diagnosed the problem early and worked through the night rebuilding the routing tables of our hub and POP routers." So let's name this the Netcom-Cisco Ampersand Collapse. Netcom CEO Dave Garrison apologized to his customers on KGO talk radio in San Francisco. He explained that the collapse was caused by human error. He admitted that the Ampersand Collapse had overwhelmed Netcom's telephone support. He promised to meet with Cisco, maker of most of Netcom's 100 routers, about preventing future outages. Interviewed by The Boston Globe, Garrison explained the Internet is growing rapidly and there is plenty of room for competition. Then he said, "Internet companies face ruthless competition and don't have billions to spend on reliability upgrades." Uh-oh, this despite Netcom's trademarked slogan: The Network Works. No Excuses. Now, to err is human, and Internet fogies ask us to accept this latest megalapse as nothing new, no big deal. But Garrison's upcoming meeting with Cisco is important. Cisco should continuously improve the software with which its routers are programmed so that catastrophic human errors are less likely. Ed Kozel, Cisco's chief technology officer, writes that "network routing is quite susceptible to human error... complete flexibility is driving routing architecture development... in recent years a lot of work has gone into creating interdomain routing firewalls and untrusted routing gateway functions, the result being that, in general, routing misbehavior is usually confined to a specific domain." So we should be encouraged that the Netcom-Cisco Ampersand Collapse did not escape Netcom and go Internetwide, this time. While Netcom and Cisco are at it, they should find a way to make Internet error messages more informative. Throughout the Ampersand Collapse, Netcom customers were told that their user names and passwords were incorrect, their calls were failing, their network connections were lost, or nothing at all as their starting session screens hung. Now why has Netcom not offered each of its 400,000 customers a refund for the access lost during the megalapse? Let's see, that would be, say, half a day out of 30, or typically 33 cents each. Seems only fair. The Netcom-Cisco Ampersand Collapse and other major outages should be prominent agenda items at upcoming meetings of Internet service providers. Unfortunately, my favorite of such meetings, those of the North American Network Operators Group (NANOG), are not likely to take systematic outage analysis seriously. As one NANOG wag put it, "This is the 'net, people, deal with it." What's needed is for NANOG to deal with it. Another NANOG participant minimized the Netcom-Cisco 5.2 megalapse with this arithmetic: Since the Internet has 60 million users, the Netcom outage inconvenienced far fewer than 1 percent -- some collapse. He has a point. There is ample room for much bigger Internet collapses ahead, maybe eventually some gigalapses. (See what else the NANOG wags are writing about at http://www.merit.edu/mail.archives/html/nanog.) Bob Metcalfe invented Ethernet in 1973 and founded 3Com Corp. in 1979. He receives E-mail at bob_metcalfe(a)infoworld.com via the Internet. Copyright © 1996 by InfoWorld Publishing Company At 4:15 PM 7/8/96, Craig A. Huegen wrote: >Received: by ccmail from lserver.infoworld.com >>From c-huegen(a)quad.quadrunner.com >X-Envelope-From: c-huegen(a)quad.quadrunner.com >Received: from quad.quadrunner.com by lserver.infoworld.com with smtp > (Smail3.1.29.1 #12) id m0udR8U-000x1xC; Mon, 8 Jul 96 17:58 PDT >Received: from localhost (c-huegen@localhost) by quad.quadrunner.com >(8.7.5/8.7-quad) with SMTP id QAA12003; Mon, 8 Jul 1996 16:14:36 -0700 >Date: Mon, 8 Jul 1996 16:14:36 -0700 (PDT) >From: "Craig A. Huegen" <c-huegen(a)quad.quadrunner.com> >To: Michael Dillon <michael(a)memra.com> >cc: nanog(a)merit.edu, bob_metcalfe(a)infoworld.com >Subject: Re: Hurricanes redefined! >In-Reply-To: <Pine.BSI.3.93.960708104725.22916I-100000(a)sidhe.memra.com> >Message-ID: <Pine.QUAD.3.94.960708155947.11988A-100000(a)quad.quadrunner.com> >MIME-Version: 1.0 >Content-Type: TEXT/PLAIN; charset=US-ASCII > >On Mon, 8 Jul 1996, Michael Dillon wrote: > >==>The official definition of a hurricane is winds in excess of 5 km/hr >==>for a duration of at least 1 hour. Read all about it at >==>http://www.infoworld.com/cgi-bin/displayNew.pl?/metcalfe/metcalfe.htm > >Interesting as well is Bob's incorrectness once again: > > "Uh-oh, this despite Netcom's > trademarked slogan: The Network > Works. No Excuses. " > >See http://www.cisco.com/public/copyright.html, in which you'll find: > >"All rights reserved. No portion of this service may be reproduced in any >form, or by any means, without prior written permission from Cisco >Systems, Inc. [...], The Network Works. No Excuses. are service marks; >[...] of Cisco Systems, Inc.[...]" > >Bob also states that: > > "Cisco should > continuously improve the software with > which its routers are programmed so > that catastrophic human errors are less > likely. " > >Which gives the connotation that cisco Systems doesn't constantly improve >IOS; everyone who's worked with cisco's software knows it's constantly >being improved. > >Bob also states the following: > > "Unfortunately, my favorite of such > meetings, those of the North American > Network Operators Group (NANOG), > are not likely to take systematic outage > analysis seriously. As one NANOG > wag put it, "This is the 'net, people, deal > with it."" > >What Bob fails to mention is that no one has a service-level agreement >with the Internet. The Internet is designed this way--my network connects >to your network. It is _NOT_ under control of one body. It's very hard >to GUARANTEE outages to _anyone_ without monetary value involved. And >generally, "my networks connects to your network" does not have enough >monetary value to warrant SLA contracts of service. Bob, I challenge you >to find an Internet Service Provider that gives an END-TO-END service >level agreement for the Internet. That is, if my web site isn't fast >enough, you have escalation/remedy procedures. If Joe Blow's sendmail has >crapped out, you have escalation/remedy procedures. I'll buy you dinner >if you find one. > >Bob once again forgets the original purpose behind the Internet, and he >apparently has permanently doffed his engineer hat for his non-technical >businessperson hat long ago. > >/cah ______________________________________________ ______________________________________________ Dr. Robert M. ("Bob") Metcalfe Executive Correspondent, InfoWorld and VP Technology, International Data Group Internet Messages: bob_metcalfe(a)infoworld.com Voice Messages: 617-534-1215 Conference Chairman for ACM97: The Next 50 Years of Computing San Jose Convention Center March 1-5, 1997 ______________________________________________ ______________________________________________

7 6

Re: Ping flooding (fwd)
by Justin W. Newton 09 Jul '96

09 Jul '96

At 11:57 AM 7/9/96 +0900, you wrote: >Hi, >About the only way you can stop this attack would be for ISPs to >filter out bogus source addresses from their customers. Of course, >then the mobile IP people would whine. However, given a future of >more attacks of this nature, I think the mobile IP people are going to >lose. As long as the mobile IP address stays inside of one provider then it isn't a problem. Justin Newton Internet Architect Erol's Internet Services

1 0

Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse
by Sean Doran 09 Jul '96

09 Jul '96

| Ever your fan and loyal opposition, The only thing you seem to fan is flames. Why don't you write something useful, like why is it that outage reporting is so spotty, and why is it that people don't seem willing to share technical details of outages such that other technical folks can learn from mistakes and disasters? I can tell you why outage(a)sprint.net isn't what it used to be: journalists and PR folks would turn detailed technical reports of the scope, cause, and cure for our outages into columns dedicated to bashing cisco, Sprint, or both. There is a disease on the Internet, and that disease is "us and them"ism. You are well-placed to help cure that disease, yet right now you are one of its biggest transmission vectors, Bob, and it's a huge pity. Sean.

1 0

Re: Ping flooding (fwd)
by Daniel W. McRobb 09 Jul '96

09 Jul '96

> On Mon, 8 Jul 1996, Daniel W. McRobb wrote: > > > The problem is not really a technical one. It's administrative. It's > > much more of a headache to backtrack through 30 routers that aren't in > > your own network than to backtrack to the ingress to your own network > > domain and filter it out there (which is the typical response to this > > kind of thing). Getting everyone in the path to cooperate with > > backtracking is difficult in many instances, impossible in others. > > I recall that people have cooperated in the past on some sort of > performance analysis tool that transported packets through a tunnel to > some remote point and initiated an analysis of some sort from that point > I believe this was done by NLANR and had something to do with vBNS. > > I don't think this is all that different. If some means existed for an NSP > to initiate a trace on a specific source address to backtrack it to the > real source then an easy to use tool could be built. Of course, first of > all router vendors need to make a quick and relatively painless way to > track down the interface that a packet comes in from, maybe There will likely never be a means for a single NSP to track down the real source of spoofed packets using IPv4. Service providers won't be letting other service providers track spoofed packets through their network. > set icmp-source-trace 148.32.45.67 on > > and later.... > > show icmp-source-trace > > IP address Interface > ---------- --------- > 148.32.45.67 NO TRACE > > Note that the source trace was active for a period of time and then > expired automatically with no new ICMP packets bearing the specified > source address in that period of time. If this facility is available an > easy to use tool could be built. In the case of a spoofed-source, denial of service attack, the source address is often of less use than the destination address/port/protocol in tracking down the real source. The attacker just switches the source address and walks right through your trace (or filters). Don't get me wrong; I think packet sniffing capabilities (even in their simplest forms) can be very useful and I wish there were more facilities in typical routers for tracking traffic via IP header information. > > that doesn't even take into account the cases where an attacker has > > multiple paths into your network and is using multiple forged source > > addresses, much less the fact that the attacker can turn off the attack > > when he/she chooses, thwarting your effort to track them. > > No doubt about it. Being a detective is hard boring plodding work and > sometimes you just never find the crook. But it's still worth trying. Define worth. I live in a capitalist society where catching a criminal is of little worth (particularly an ICMP bomber who's arguably not much worse than a USENET spammer) in it's own right and often only worthwhile if there's monetary compensation involved (either from a legal settlement, reward or just recovery of service and time spent fixing things that are broken by an attacker). :-) Daniel ~~~~~~

4 4

Re: since it's national pick-on-bob-metcalfe week anyway...
by avg＠ncube.com 09 Jul '96

09 Jul '96

>bob's contribution to what we're doing here is larger than mine, and >perhaps larger than almost anybody's. where would we be without Ethernet? Using some saner technology like today's full-duplex switched "ether"nets. It's like presuming that we'd be in deep trouble w/o benefits of MS-DOS. Not. --vadim

1 0