- Test - lists.nanog.org

Re: Has PSI been assigned network 1?
by Vadim Antonov 28 Apr '95

28 Apr '95

Karl, you obviously do not understand what global networking and policy routing mean. Right today we nearly killed all Internet by _not_ doing paranoid filtering on ANS route announcements (well we couldn't do it because of certain contractual obligations). ANS had trouble with generating configuration for ENSS 147, so they simply dropped all routes at our MAE-East+ box without filtering they usually do, which would be fine if we didn't do some upgrades at ICM, which involved changing preferences in ICM-SL routing, to the effect that SL started preferring AS 690 as path to many European networks. It resulted in SprintLink -> Europe traffic being moved from SL->ICM FDDI connection to SL->ENSS(147)->ANS core->Dante path; which at the daytime grew and turned out be enough to overload ENSSes along the path. This resulted in ENSS 147 delaying BGP keealives for so long that MAE-E peers (including SprintLink) were dropping their BGP sessions, only to reset them later. Since that causes route caches being flushed all _other_ ciscos were falling back to switching by CPU, became overloaded and started dropping their BGP sessions. Which resulted in snowball of real massive routing flap. I imagine how Internet would work if everybody listened to the enlightened advice of our esteemed sage: >Fascistic filtering breaks connectivity. > >So you trade a *risk* of broken connectivity for KNOWN broken connectivity? > >Sounds like a poor trade to me, and one which, undertaken consciously and >with knowledge of the repercussions, leaves you with being less than a full >Internet connectivity provider. > >After all, if you're filtering perfectly valid announcements then you are, >by definition, not providing connectivity to the "whole Internet" to the >best of your ability, are you? Sorry, Karl. Internet is lucky that people who run most big networks know better than to wait for shit to happen. In the system as large as Internet shit happens permanently. Somewhere, in the most unxpected places. If you persist in your dislike of filtering i guess i'll purely accidentally misconfigure a static route, so it will be the the same as your backbone address. RS won't save you. This is a joke, of course. --vadim

9 13

Re: Non-Routing BGP Speakers
by Sean Doran 28 Apr '95

28 Apr '95

| We have upgraded our box since then; Curtis, have you had a chance | to look at this yet? It is a disaster waiting to happen again Serpil Bayraktar tells me that ANS upgraded their boxes a while ago. I believe an announcement went out about this on the gated list or somesuch, and that the ANS fix also has been put into the gated consortium's code. Sean.

3 2

Re: Has PSI been assigned network 1?
by Sean Doran 28 Apr '95

28 Apr '95

You would think the words "Silicon Switch Processor" might clue people in that the board in question has nice little chips on it doing routing/switching, leaving the 68040 free to process BGP updates etc. Unfortunately, the 68040 is unable to keep up in ugly situations... Sean.

1 0

Re: Has PSI been assigned network 1?
by Hank Nussbacher 27 Apr '95

27 Apr '95

On Wed, 19 Apr 1995 18:49:39 -0400 you said: >>telent info.ripe.net to test it out. > >RIPE database does not control the actual routing. > >I'm not sure the current RADB project has any mention >of real-time updates of gated from the database. `With dozens of updates we do every day it nearly as good >as useless. CERN (as an example) picks up my routing updates daily and builds its new access filter based on mine and others routing updates. I'm not sure you want realtime updates to the actual routing. In any event, it is an improvement over the time lag of NACR updates. >>It should be secure. > >>I use a password on all AS updates to AS378. > >You call *that* secure? We have way too many people who >need to do changes for our AS-es. Check the contact >list for AS1800. You can assign as many users as you wish to control specific ASs. Currently it checks my email address and password. No match - and the maintainer of the AS gets a warning mail about the attempt to alter the routing within my AS - and I have gotten warning e-mails already. Adding in PGP authentication should not be too hard if it is not done already. >If i can't implement my existing policy, i cannot use RADB, ok? > >(Well, we _will_ use it -- to talk to people whose announcements >are loaded with garbadge). We simply cannot use it to talk >to major service providers because policies in place cannot >be represented in RIPE-81. So speak to the authors and get it improved. >--vadim Hank

7 7

IPPM mailing list preload.
by Matt Mathis 26 Apr '95

26 Apr '95

The IPPM (IP Provider Metrics) mailing list was only partially preloaded from the NANOG list. There were a number of entries on the NANOG list which were not included. In general, individuals and downstream exploders of the form "staff@site", "site-eng@site", and "admin@site" were included. However, downstream exploders mentioning other lists WERE NOT INCLUDED. For example "nanog@site", "nanog-dist@site", "iwg@site" were not included. If you receive this message, but not the IPPM kickoff, please consider adding yourself or your organization by sending mail to ippm-request(a)psc.edu. Thanks, --MM-- ------- Forwarded message Return-Path: mathis Received: from mailer.psc.edu by zippy.psc.edu via SMTP (931110.SGI/930416.SGI.AUTO) for mathis id AA03741; Wed, 26 Apr 95 15:49:46 -0400 Received: from zippy.psc.edu by mailer.psc.edu (5.65/Ultrix3.0-C 11/12/92 nydick) id AA04083; Wed, 26 Apr 1995 15:39:19 -0400 Message-Id: <9504261939.AA04083(a)mailer.psc.edu> To: ippm(a)psc.edu Cc: mathis(a)psc.edu Subject: IPPM Kick off message Date: Wed, 26 Apr 1995 15:39:17 -0400 From: "Matt Mathis" <mathis> This is kickoff message for the IP Provider Metrics mailing list. If you do not want to receive any further messages, send a note to ippm-request(a)psc.edu. However, be forewarned that this list has been pre-loaded with precisely the people who are mostly likely to be effected by our actions. >From the draft charter: The IPPM WG will develop a set of standard metrics that can be applied to the the quality, performance and reliability of an IP datagram service. These metrics will be designed such that they can be performed by the providers themselves, customers, potential customers or independent testing groups. There is now a home page at http://www.psc.edu/~mathis/ippm, including pointers to the minutes, etc. I am still looking for candidates to co-chair the working group. Thanks, --MM--

1 0

Re: Has PSI been assigned network 1?
by Sean Doran 26 Apr '95

26 Apr '95

Hi - All our junior people are immediately deployed to projects. One such person was brought into our engineering group and practically immediately was given responsibility for making all of NYSERNET work and handling whatever escalations he could. Another is deployed in dialup and in assisting with routing matters. Another is busy dealing with research and resource planning for how we want to scale. I can think of innumerable engineering and operations tasks that need doing before deploying a junior engineering type to writing documentation. OTOH, we have been working with marketing on the customer handbook (http://www.sprintlink.net/ has various drafts), so I imagine that if we had a clever tech writer remarkably skilled at finding the right moment to talk to busy engineering folk, we could produce something. Funnily enough, that's what Vadim and I have already asked management for, however that's with a view to documenting our internal procedures so that we can scale up our own engineering and operations, not to mention all the other documentation that we need doing internally. So, to extend the point that Geoff made earlier -- any resource a busy operator has will get deployed into making that operator's part of the global Internet _work_, not into helping out other people. This is not due to a mean lack of altruism, but rather to the realities of life in a global network that doubles in size and traffic severy six-to-nine months or so. Now, if you go talk to our marketing about the possibilities of increasing revenue via some of the in-house documentation we're planning, you might have a big operator actually produce a book along the lines you are thinking, or putting together a page for beginning Internet operators. Try bouncing some ideas off our marketing types; I'd be happy to pass you on to one in private email. Sean.

2 1

Re: Has PSI been assigned network 1?
by Hank Nussbacher 25 Apr '95

25 Apr '95

On Sun, 23 Apr 1995 12:33:54 -0500 (CDT) you said: >Hank, > >Enduser filtering (CERN) is in principle completely different from what we >(might if not possible else) do: > >I am not supposed to filter anything between meetpoints and customers, >because I agree to some people who pay for it to provide Internet access. > >I would filter nothing at all (curretnly do filter nothing), which does >not mean that my suport hosts and networks are open. >Filtering comes alo into place when customers want only access between >certain networks, >but in general > >NSPs/ISPs are not supposed to filter at all. > >Routing is different. We filter routing updates (not access filters) to >accelerate BGP convergence. We filter what we announce to the outside >world (of course not all the trash we get in). I don't filter outgoing routing updates to speed BGP convergence. I do it so as not to pollute the Internet with leaked bad nets. It has happened to me and has happened to everyone. Just look at the recent nets that Australia was leaking. If the routing access lists were automatically created every day based on the data in the routing DB, then this would not happen. Of course, no one can force you but your service provider can filter what he/she hears from you based on the same rules. Then you have a double secure routing scheme. > >Mike >Michael F. Nittmann >nittmann(a)wis.com Hank Nussbacher

11 13

refresher - what's happening
by epg＠merit.edu 25 Apr '95

25 Apr '95

Hi, At 0700 EDT on Tuesday, April 25, all peering sessions on ENSSes: 128 129 130 131 133 134 135 137 139 140 141 142 143 145 will be commented out of the routing configuration files. If there is a catastrophic failure tomorrow morning, Merit will advise the ANS NOC to roll back to the previous configuration (the one installed on Tuesday morning). If it is determined that problems are isolated to individual autonomous systems, Merit will enable the sessions with those individual autonomous sytems. If there are individual routes from many sources which are unreachable, Merit will designate one emergency configuration time period at which all of the independent additions wil be made. If you are experiencing problems tomorrow after 0700 EDT, please call 1-800-456-6300 or 1-313-677-7333. The NOC operators will page a Merit engineer to help you. If you still have email access, you may send a message to trouble(a)ans.net. Thanks for your help in getting prepared for this day. --Elise

4 4

Re: Why Vadim likes statics
by Hank Nussbacher 25 Apr '95

25 Apr '95

On Mon, 24 Apr 1995 17:26:41 -0400 you said: >> This sounds a lot like the slippery slope of static routing being the >> most stable, so we should encourage its use Internet wide. I -know- >> Karl D. >> (and others that depend on dynamic routing for alternate provider >> fallback) will kick at this. > >On the contrary, Bill, being set up to propagate IGP information to your EGP >in situations where not absolutely necessary seems to be a perversion of the >whole intent of EGPs vs. IGPs. Perhaps it's time to rethink for a moment why >the whole Internet isn't just running one big IGRP or OSPF cloud. After getting burned numerous times by end node nets that polluted our IGRP cloud, we now connect all new single homed customers via static routes and filter out everything heard from them. If they are multihomed here we do IGRP and if they are multihomed across different ASs we do BGP. The customers also like it since it increases their bandwidth on their line rather than hearing routing updates all the time. For customers on 9.6kb and 19.2kb lines this made a difference. Remember when you bill on bandwidth used (ifInOctets/ifOutOctets) you are billing also for routing updates! Your customers will like you if you reduce their bill. >Robert E. Seastrom -- rs(a)digex.net Hank Nussbacher

1 0

Re: Why Vadim likes statics
by Robert E. Seastrom 25 Apr '95

25 Apr '95

> This sounds a lot like the slippery slope of static routing being the > most stable, so we should encourage its use Internet wide. I -know- > Karl D. > (and others that depend on dynamic routing for alternate provider > fallback) will kick at this. On the contrary, Bill, being set up to propagate IGP information to your EGP in situations where not absolutely necessary seems to be a perversion of the whole intent of EGPs vs. IGPs. Perhaps it's time to rethink for a moment why the whole Internet isn't just running one big IGRP or OSPF cloud. Kudos to the people who have realized that for singly-connected networks, the BGP advert. status of the network should change precisely as often as the policy (eg. ONCE, when you set the network up, and AGAIN if they change to another provider). Granted, there are a lot of people who are _not_ singly connected, but they (folks like Karl D.) are (a) running BGP themselves, and (b) sophisticated enough to pull up their own networks at the periphery of their cloud. The point I'm making is that you shouldn't be BGP peering with customers who are not multiply attached (that's what IGPs are for), and you should not be propagating your IGP information to your BGP except in rare cases. Let IGPs do what they are best at (dynamic information and reachability on a micro level) and EGPs do what they're best at (reachability and policy on the macro level) Simple, eh? By the way, yes, I am biased. I have been saying that this is the only sane way to do routing adverts to other providers for neigh unto two years now. ---Rob Robert E. Seastrom -- rs(a)digex.net Network Engineer, Digex International My posting, my opinions, not speaking for the company, etc. etc.

2 1