- Test - lists.nanog.org

Re: Has PSI been assigned network 1?
by Dale S. Johnson 19 Apr '95

19 Apr '95

Vadim, > Well, there is a big _if_: if things will work w/o RADB (and they > will, for no sane provider will use RADB as the sole source of > exterior information at peering points, not for at least before > it became the proven and stable service) -- people will forget > to update things, cut the corners, etc. You're right: a database that is not used becomes out of date. There are a few things that will encourage ISPs to maintain up-to-date data in the IRR registries: 1) The availability of useful tools (such as prtraceroute) that will only work correctly across you network if your data is registered correctly. (Even if you don't use these tools, your neighbor ISPs may start sending you prtraceroutes across your network that show your routing or your policy description is wrong). 2) The registry is the method by which you specify your policy for the Route Servers (if you use them). 3) Some other major ISPs will not route nets that are not registered. (Note: the RADB is one portion of the Internet Routing Registry (IRR), which is composed of the RADB, RIPE, MCI, and CANET so far. Registering in one database will soon be sufficient for all purposes globally). > NACRs were so big headache that our implementation people dance > around when they hear that there won't be any NACRs. > > RADB got to be easy to use to become real. The e-mail interface > of NACRs is close to uselessness, and too big headache to deal with. The email interface to the RADB and IRR is one that has been running at RIPE for a couple of years (also an email/template interface). RIPE's user community lists improving the user interface as a rather low priority. Nonetheless, the code is structured in such a way that telnet, web, or other interfaces would be extremely easy to integrate (once authentication was established). What kind of interface would you like to see? > Waiting time on processing is simply ridiculous. > > There should be a host accepting telnet sessions for on-line > updates (which have to be installed *immediately*, so whoever > added a network can test connectivity and go ahead). Updates to the registries are processed and confirmed within a few seconds, and are immediately verifiable by whois query. How often ISPs choose to regenerate their config files is a separate question. (I think everyone is planning updates more frequently than twice per week now). If you want to add a net to the IRR and then have that change immediately reflected in the configuration files of all ISPs who do full net-based filtering, you may have to have some discussions with them. (But the data will be there and waiting in the registry). > There should be well-defined and useful interface to service > providers databases. I'm not sure what you mean by this. If you issue the command: "whois -h whois.ra.net <net>" right now, you get the registrations for that net from the PRDB, the RADB, the RIPE database, MCI's database, and CANET's database. If you register in the RADB (or the PRDB, for the moment), then your data is available at the other registries as well. > It should be secure. This has lots of aspects. We have implemented PGP for the interface (not yet released), and are working with the CERT to establish that other security concerns are addressed. More specific discussion is welcome on a smaller list. > RADB should be able to implement _existing_ routing policies, > not the subset which can be defined in RIPE-81 (it currently > can't, there are places which use a lot of _very_ hairy stuff). Yes, we were listening in Boulder. Some enhancements (to support AS-path expressions) have all ready been coded, and Cengiz Alaettinoglu and Daniel Karrenberg have all ready set up an IETF working group with an aggressive schedule for implementing for an enhanced language. (An early version of the implementation is started, I believe). > Without that i do not see RADB being successful or useful beyond the > point of filtering updates from particularly obnoxious peers. > > --vadim > > From: Guy Middleton <guy(a)ghost.uunet.ca> > To: avg(a)sprint.net, curtis(a)ans.net, jerry(a)fc.net > Subject: Re: Has PSI been assigned network 1? > Cc: nanog(a)merit.edu, prs(a)isi.edu > Message-Id: <95Apr18.213028edt.53028-1(a)ghost.uunet.ca> > Date: Tue, 18 Apr 1995 21:30:28 -0400 > > > Curtis, you are able to do that only because all others were > > legally bound to fill your database. > > > > I'm not sure people will be spending their resources on > > populating database for somebody else's benefit. > > > > (And RADB already has lots of garbadge in it). > > Once the RADB is in general use, we can expect that networks other than ANS > will use it to generate route-filters. There is an interconnect point already > using the CA*net registry, for example. Any active use of the RADB creates an > incentive to ensure that it is accurate. --Dale

1 0

Internet Security tutorials
by stonem＠farnet.org 19 Apr '95

19 Apr '95

FARNET (the Federation of American Research Networks) and CERT (Computer Emergency Response Team) are sponsoring two tutorials on Internet Security. Both of these events will be held at the Radisson Hotel South and Plaza Tower in Minneapolis, MN 55439. on May 10 and May 11. Send information request to seminars(a)farnet.org. Wednesday, May 10 "Internet Security for Managers" _____________________________________________________________ Description: This tutorial helps managers understand what needs to be done to ensure that their computer systems and networks are as securely managed as possible when operating within the Internet community. Attendees are provided with information that will enable them to formulate realistic security policies, procedures, and programs specific to their operating environment. The tutorial addresses the following issues relevant to computer security in the Internet community. - Understanding and recognizing computer security threats - Designing gateway solutions - Developing security procedures - Establishing security programs - Understanding legal issues. Audience: This seminar is designed for managers of computing centers/facilities, individuals tasked to evaluate/initiate Internet connectivity, senior system administrators, and others interested in computer security within the Internet community. Thursday, May 11 Internet Security for UNIX System Administrators _____________________________________________________________ Description: The information presented in this tutorial is based on incidents reported to the CERT Coordination Center. The topics covered include defensive and offensive strategies for system administration, site-specific security policies, and incident handling. This tutorial addresses the following issues relevant to computer security in the Internet community: - Understanding today's security problems: current Internet threats and trends, review of packet sniffer activity, and overview of the potential for real losses. - System administration strategies for securing systems: systems and service configurations, password management, and system administration tools and techniques - Network administration strategies for securing the perimeter: design considerations for firewalls, understanding and planning for network connectivity - Incident Response: how to prepare for and respond to security incidents when they occur - Site security policy: the glue that holds everything together Audience: This tutorial is designed for users and system administrators of hosts using the UNIX Operating System. It is especially suited for system administrators of systems connected to a wide area network based on TCP/IP such as the Internet. Some system administrator experience is assumed. ************************************************************************* Martha Stone-Martin Program Director FARNET...."The Internet Builders" (617) 273-5423 stonem(a)farnet.org

1 0

Re: Has PSI been assigned network 1?
by jgs＠aads.net 19 Apr '95

19 Apr '95

I assume one of the RA folks will respond to this if they see fit. However: At 1:50 PM 4/19/95, Vadim Antonov wrote: >Well, there is a big _if_: if things will work w/o RADB (and they >will, for no sane provider will use RADB as the sole source of >exterior information at peering points, not for at least before >it became the proven and stable service) -- people will forget >to update things, cut the corners, etc. You appear to be conflating the RADB and the RSes. The two are separable. You can use the RADB (or, more generally, the IRR) w/o having to trust the RSes. I think this is a really important point, and one which a lot of people seem to be confused about. >NACRs were so big headache that our implementation people dance >around when they hear that there won't be any NACRs. No comment. >RADB got to be easy to use to become real. The e-mail interface >of NACRs is close to uselessness, and too big headache to deal with. >Waiting time on processing is simply ridiculous. > >There should be a host accepting telnet sessions for on-line >updates This has long existed for the NACR process. >(which have to be installed *immediately*, so whoever >added a network can test connectivity and go ahead). Point granted. >There should be well-defined and useful interface to service >providers databases. > >It should be secure. Is PGP secure enough for you? >RADB should be able to implement _existing_ routing policies, >not the subset which can be defined in RIPE-81 (it currently ^^^^^^^ RIPE-181; it's different. Some people have complained that RIPE-181 is also incapable of expressing their policies; perhaps someone from the RA team can comment on how they intend to address that. >can't, there are places which use a lot of _very_ hairy stuff). > >Without that i do not see RADB being successful or useful beyond the >point of filtering updates from particularly obnoxious peers. Which is already a big win, seeing as how there are a good number of particularly obnoxious peers out there, some of them quite large. >--vadim I have to ask if you have actually looked at the RADB and surrounding pieces at all. I think it addresses a number of the gripes you have raised. --John

1 0

Re: Has PSI been assigned network 1?
by Vadim Antonov 19 Apr '95

19 Apr '95

> We don't trust our peers. We only accept routes which they are > registered as providing transit for in the PRDB. When the RADB is in > use, unless PSI has a route object for 1.0.0.0/8 in the RADB, we still > won't trust them when they try to pass us 1/8. Curtis, you are able to do that only because all others were legally bound to fill your database. I'm not sure people will be spending their resources on populating database for somebody else's benefit. (And RADB already has lots of garbadge in it). --vadim

3 2

NANOG REGISTRATION
by lnguyen＠sprint.net 19 Apr '95

19 Apr '95

REGISTRATION FORM NANOG - MAY 22 & 23, 1995 NANE:____LAN NGUYEN________________________________________ ORGANIZATION:______SPRINT__________________________________________________ E-MAIL:_____LNGUYEN@SPRINT.NET______________________________________________ ___________ ATTENDANCE: MONDAY______X___ TUESDAY_____X_____ LUNCH: __________YES ___X________NO $10.00 SELECTION: ____________VEGGIE ____________ROAST BEEF _________TURKEY __________CORNED BEEF _____________TUNA ===============================================================================

1 0

Re: Has PSI been assigned network 1?
by Martin L. Schoffstall 18 Apr '95

18 Apr '95

there are about a dozen ISP's extensively using ascend's which have this hole. our original RFP to them dealt with this issue but they did not execute they keep trying to fix this, but so far no go we have tried to keep this quiet so that microsoft/uunet/psinet/etc..... don't get extensively hacked we have had two occurences of this so far in one year that I know of though there are probably more marty > PSI allows people to negotiate PPP addresses, and then > propagates everything everywhere w/o even token filtering. I.e. any > idiot can subscribe to PSI service and kill the Internet. > > --vadim > > Date: Sun, 16 Apr 95 21:02:04 MET DST > >From: Peter Lothberg <roll(a)Stupi.SE> > To: schoff(a)psi.com, nanog(a)merit.edu, postel(a)isi.edu Subject: Has PSI > been assigned network 1? > > Or why are they announcing it to the rest of the Internet through > their box at MAE-East??? > > bash$ whois 1.0.0.0 > No match for "1.0.0.0". > > The InterNIC Registration Services Host contains ONLY Internet > Information (Networks, ASN's, Domains, and POC's). > Please use the whois server at nic.ddn.mil for MILNET Information. > > > traceroute 1.1.1.1 > traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 40 byte packets > 1 sl-dialup-2.sprintlink.net (192.157.36.128) 252 ms 245 ms 223 > ms 2 192.157.36.1 (192.157.36.1) 251 ms 250 ms 251 ms 3 sl-dc-1- > S3-T1.sprintlink.net (144.228.0.225) 252 ms 262 ms 253 ms 4 > icm-dc-1-F0/0.icp.net (144.228.20.101) 275 ms 269 ms 252 > ms 5 psi-mae-east-1.psi.net (192.41.177.235) 268 ms 254 ms 241 > ms 6 washington2.dc.isdn.psi.net (38.146.99.110) 261 ms 271 ms 262 > ms 7 1.1.1.1 (1.1.1.1) 457 ms 1284 ms 543 ms > > bash$ traceroute 1.1.1.2 > traceroute to 1.1.1.2 (1.1.1.2), 30 hops max, 40 byte packets > 1 sl-dialup-2.sprintlink.net (192.157.36.128) 253 ms 253 ms 246 > ms 2 192.157.36.1 (192.157.36.1) 246 ms 243 ms 228 ms 3 sl-dc-1- > S3-T1.sprintlink.net (144.228.0.225) 249 ms 447 ms 313 ms 4 > icm-dc-1-F0/0.icp.net (144.228.20.101) 274 ms 251 ms 278 > ms 5 psi-mae-east-1.psi.net (192.41.177.235) 265 ms 257 ms 266 > ms 6 core.net228.psi.net (38.1.2.7) 286 ms 278 ms 276 > ms 7 core.net99.psi.net (38.1.2.10) 338 ms 370 ms 279 > ms 8 core.net228.psi.net (38.1.2.7) 306 ms 326 ms 290 > ms 9 core.net99.psi.net (38.1.2.10) 335 ms 308 ms 325 ms > 10 core.net228.psi.net (38.1.2.7) 372 ms 353 ms 341 ms 11 > core.net99.psi.net (38.1.2.10) 376 ms 385 ms 377 ms 12 > core.net228.psi.net (38.1.2.7) 438 ms 375 ms 365 ms 13 > core.net99.psi.net (38.1.2.10) 384 ms 441 ms 371 ms 14 > core.net228.psi.net (38.1.2.7) 394 ms 426 ms 474 ms 15 > core.net99.psi.net (38.1.2.10) 427 ms 540 ms 565 ms 16 > core.net228.psi.net (38.1.2.7) 521 ms 500 ms 489 ms 17 > core.net99.psi.net (38.1.2.10) 530 ms 483 ms 527 ms 18 > core.net228.psi.net (38.1.2.7) 567 ms 493 ms 561 ms 19 > core.net99.psi.net (38.1.2.10) 779 ms 462 ms 670 ms 20 > core.net228.psi.net (38.1.2.7) 531 ms 620 ms 613 ms 21 > core.net99.psi.net (38.1.2.10) 562 ms 728 ms 598 ms 22 > core.net228.psi.net (38.1.2.7) 812 ms 566 ms 835 ms 23 > core.net99.psi.net (38.1.2.10) 661 ms 678 ms 574 ms 24 > core.net228.psi.net (38.1.2.7) 647 ms 820 ms 666 ms 25 > core.net99.psi.net (38.1.2.10) 649 ms 625 ms 628 ms 26 > core.net228.psi.net (38.1.2.7) 900 ms 634 ms 733 ms 27 > core.net99.psi.net (38.1.2.10) 648 ms 659 ms 656 ms 28 > core.net228.psi.net (38.1.2.7) 776 ms 979 ms 834 ms 29 > core.net99.psi.net (38.1.2.10) 715 ms 689 ms 734 ms 30 > core.net228.psi.net (38.1.2.7) 782 ms 785 ms 677 ms > > > ---Peter > >

6 10

Re: Has PSI been assigned network 1?
by Guy Middleton 18 Apr '95

18 Apr '95

> Curtis, you are able to do that only because all others were > legally bound to fill your database. > > I'm not sure people will be spending their resources on > populating database for somebody else's benefit. > > (And RADB already has lots of garbadge in it). Once the RADB is in general use, we can expect that networks other than ANS will use it to generate route-filters. There is an interconnect point already using the CA*net registry, for example. Any active use of the RADB creates an incentive to ensure that it is accurate.

1 0

Re: Final transition steps
by rrv＠uiuc.edu 18 Apr '95

18 Apr '95

At 12:08 PM 4/18/95, Elise Gerich wrote: >129 NCSA networkMCI > CICnet networkMCI > MSC Sprintlink > UIRnet CICnet > UIUC networkMCI 129 NCSA CICnet CICnet networkMCI MSC Sprintlink UIRnet CICnet UIUC CICnet

2 1

Re: Has PSI been assigned network 1?
by sob＠academ.com 18 Apr '95

18 Apr '95

prs-request(a)isi.edu appears to be a non-functional address. On Apr 18, 6:39pm, Mail Delivery Subsystem wrote: } Subject: Returned mail: User unknown } This is a MIME-encapsulated message } } --SAA01554.798248343/owlman.academ.com } } The original message was received at Tue, 18 Apr 1995 18:39:02 -0500 } from sob@localhost } } ----- The following addresses had delivery problems ----- } prs-request(a)isi.edu (unrecoverable error) } } ----- Transcript of session follows ----- } ... while talking to isi.edu.: } >>> RCPT To:<prs-request(a)isi.edu> } <<< 550 <prs-request(a)isi.edu>... User unknown } 550 prs-request(a)isi.edu... User unknown } } ----- Original message surpressed ----- } }-- End of excerpt from Mail Delivery Subsystem -- Stan | Academ Consulting Services |internet: sob(a)academ.com Olan | For more info on academ, see this |uucp: bcm!academ!sob Barber | URL- http://www.academ.com/academ |Opinions expressed are only mine.

1 0

Final transition steps
by Elise Gerich 18 Apr '95

18 Apr '95

We are approaching the last weeks of the NSFNET Backbone Service. Despite good intentions, only seven (7) organizations have completely severed their relationship with the NSFNET Backbone service. Those seven (7) are: Argonne National Laboratory CA*net Cornell Supercomputer Center DARPA Michnet NYSERnet SURAnet Many other organizations depend on a new service provider and they continue to maintain the NSFNET connectivity for backup purposes. Merit has encouraged organizations who maintain redundant connectivity to voluntarily discontinue connectivity to the NSFNET service in advance of April 30,1995. The reason prompting this request is that it is difficult to identify outstanding reachability issues as long as there are still dependencies on the NSFNET Backbone service. If an organization can confirm reachability to all destinations that are currently reachable, the chances for an uneventful changing of the guard on April 30 increase. To this aim, Merit is encouraging all organizations which will lose direct access to AS 690 on April 30, 1995 to decommission their peering sessions with AS 690 before April 21, 1995. On April 21, 1995 at 09:00 EDT, Merit will terminate peering sessions with all organizations still attached to the NSFNET Backbone service. The goal of this action is to identify where there are pockets of unreachable destinations. At the NSFNET Executive Committee meeting which took place on April 12, 1995, the committee expressed concern over the large amount of traffic still traversing the NSFNET service. Based on this concern, the committee requested that Merit take the actions described in this message. If an organization identifies a reachability problem between April 21 and April 28, it should send a message to merit-ie(a)merit.edu. We will work with the organization to resolve the problem and will reestablish temporary access to the NSFNET service as necessary. On April 28, 1995, all sessions with the NSFNET service will be permanently terminated and ANS will terminate operation of the NSFNET Backbone service on April 30, 1995. The following locations where access to the NSFNET service is provided will be impacted by this discontinuation of service on April 21, 1995: Ann Arbor, MI Argonne, IL Boston, MA Boulder, CO Champaign, IL College Park, MD (FIX-East) Houston, TX Ithaca, NY Lincoln, NE Palo Alto, CA Pittsburgh, PA Princeton, NJ Salt Lake City, UT Seattle, WA San Diego, CA Please send any questions regarding this plan to merit-ie(a)merit.edu. Thank you. --Elise Gerich Manager, Internet Engineers Merit Network Inc.

2 2