On Tue, Apr 10, 2007 at 10:30:32AM +0100, michael.dillon@bt.com wrote: ...

I also find it curious that you claim to have people on staff at your company who know what SWIP means. Perhaps you could ask them to share that information with us since I have never seen this documented anywhere. Do they really know what you claim they know? ...

http://www.swip.com/: Scottish Widows Investment Partnership http://www.uh.edu/~cfreelan/SWIP/: Society for Women in Philosophy http://www.sat-tel.com/Swip.html: Shared WHOIS Project http://www.swip.net/: The Swedish IP Network Note that there are far more entries for chapters of SWIP #2 than for any others. But one may assume that you refer to SWIP #3. Definitions on the Web found by Google do vary slightly. The referenced InterNIC policy appears to no longer be available on the InterNIC Web site. However, <http://www.arin.net/registration/guidelines/report_reassign.html> will do. There seem to have been more proposals on how to produce a better WHOIS then one can assume in a reasonable amount of time. ;-] -- Joe Yao Analex Contractor

Stephen Satchell wrote:

SWIPs are required for reallocations of /29 and larger if the allocation owner does not operate a RWhoIs server.

Of course, SWIP is a ARIN thing, and you work for BRITISH TELECOMMUNICATIONS PLC. As a US network operator, I was well aware of the requirements for SWIP, because ARIN rules make it clear that, as a netblock owner of an ARIN allocation, I'm required to do it.

Being I work at a US network operator and others who've been attacking my hosts come from US network operators, who can I complain to when some of the bigger fish not complying with these so called rules? Many network operators are required to do a lot of things, one of these things should be the mitigation of malicious traffic from LEAVING their network. If some of these companies can't follow the rules, then I see no need for me to discontinue "punishing" allocations on their CIDRs whenever my network is attacked since it seems to be the only method I found to 1) protect my networks and clients and 2) to get someone's attention.

Which numbering authority do you work with day to day?

Me? I work for an authority that many bigger provider should be following its guidelines and setting examples for smaller network operators. I shouldn't have to do the work for some of these bigger operators. I shouldn't have to send emails making them aware that 40 hosts on their /24 are sending out malicious traffic. Maybe ARIN staff should start re-writing policies and implementing out punishments. Guarantee you if operators were penalized for not following rules, for allowing filth to leave their networks, I bet you many maladies on the net would be cut substantially. Not going to be a popular stance to most of the bigger fish, but lets get real here, looking at normal everyday life, if a country were shipping rotten products, don't you think those in government would call for measures to halt these products else no business would occur with said country. Why not re-write policies to do the same with networks. I will always point to dampening/flapping on BGP as a baseline... Company X violates, null route them for a second or two until they comply. They still don't listen double the penalty and null route them twice the amount. Once their pockets start hurting, they'll get a clue. And if their engineers still don't get it, then management of that company would be fools to keep their lazy asses around. -- ==================================================== J. Oquendo http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743 sil . infiltrated @ net http://www.infiltrated.net The happiness of society is the end of government. John Adams

On Wed, 11 Apr 2007 07:07:19 EDT, "J. Oquendo" said:

these so called rules? Many network operators are required to do a lot of things, one of these things should be the mitigation of malicious traffic from LEAVING their network.

And I want a pony. We don't even do a (near) universal job of filtering rfc1918 addresses and spoofed addresses. We aren't filtering obvious bogon packets, how do you propose we filter less obvious malicious traffic (is that SYN packet legit, or part of a DDOS, or just a slashdotting of a suddenly popular site?).

On Apr 11, 2007, at 11:28 AM, J. Oquendo wrote:

Valdis.Kletnieks@vt.edu wrote:

...

* PGP Signed by an unverified key: 04/11/07 at 11:21:15

On Wed, 11 Apr 2007 07:07:19 EDT, "J. Oquendo" said:

...

these so called rules? Many network operators are required to do a lot of things, one of these things should be the mitigation of malicious traffic from LEAVING their network.

And I want a pony.

We don't even do a (near) universal job of filtering rfc1918 addresses and spoofed addresses. We aren't filtering obvious bogon packets, how do you propose we filter less obvious malicious traffic (is that SYN packet legit, or part of a DDOS, or just a slashdotting of a suddenly popular site?).

* Valdis Kletnieks <valdis.kletnieks@vt.edu> * 0xB4D3D7B0 - Unverified

When you say we, speak for yourself and your own networks. There ARE some people who do take the time to properly design their networks.

And I would suggest that Valdis is one of them.... From my reading of his message I understood that: A: Some people filter bad stuff. B: Some people don't. I don't think that it is unreasonable that he used "we " to include all network engineers -- "we" as a community does include A and B

It is the same "Well since Billy didn't do it neither will I" attitude that makes me never think twice about blocking CIDR's.

So, I have always wondered -- how do you customers really react when they can no longer reach www.example.com, a site hosted a few IPs away from www.badevilphisher.net? And do you really think that you blocking them is going to make example.com contact their provider to get things fixed?

Since 'THEY' (your "WE") didn't properly configure their network, why should I think twice about letting it into my backyard. I guess its calling for too much for network operators to actually do their work though

Have you considered that being a little politer and not insulting everyone on the list might be a more constructive way of getting your point across -- if I were to call you a "big, fat, doodoo head" you would probably be less receptive than if I didn't...

and I guess considering IPv6 is like how many years away now, I can expect that much of a wait for people to implement what should have been done from the onset.

I don't care how filtering gets done from someone else. Like I said if I can watch and control what comes out of my networks using raw tools on nix machines, you cannot with a straight face/typing method tell me that someone at one of these big providers can't clue themselves in to getting malicious traffic controlled.

Should someone want to comment about "oh golly the cost is outrageous" I say bs... Its utter laziness from my eyes. So here I go politely pointing it out... If I can do it with a couple of thousand machines on my VERY OWN, not a "team", not a "department" but me, in a matter of minutes, situate my network to not send out crap, then why can't these companies?

Yes, it is great that you are doing your bit to help keep the net clean. Congratulations and thank you. Perhaps you could write a nice, simple, friendly guide explaining how you ensure that your network is never the source of malicious traffic? And how this can be scaled up to work in a large, backbone network where? Perhaps you could politely contact those who are not doing their bit and, in a helpful manner explain how they could improve -- educating and encouraging change in those who are not doing their bit is much more likely to make things better than screaming "You suck, I'm not going to accept your packets, nah nah nah."

I'd like to here something logical, not someone's opinion. Something like "According to ARIN/IEEE specifications of foobarfoo, operators are not allowed to view traffic entering or leaving their networks" which hinders this. There is no reason I could think of, no scenario I could imagine, that would prohibit network operators from putting the nail in the coffin with stuff LEAVING THEIR NETS.

Note the word LEAVING now. If it doesn't leave, you wouldn't have complaints from some other operator now would you.

-- ==================================================== J. Oquendo http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743 sil . infiltrated @ net http://www.infiltrated.net The happiness of society is the end of government. John Adams

I suspect that I should have just stayed out of this thread.... W -- "Go on, prove me wrong. Destroy the fabric of the universe. See if I care." -- Terry Prachett

As for documentation on this... There is PLENTY of it. Why should I write another document no one would follow.

Because you might be a better writer than those other folks. You might be able to present the right balance of technical detail and policy goals to be understood by a larger number of people. People often ask me to advise them which book they should buy to learn language X fast. X being French or Russian or German etc. I always give the same advice. Go to a good bookstore that stocks a large choice of books in your chosen language. In some cities that means the local university bookshop, in others there may even be a specialist bookshop that sells just language books. The important thing is that you go and look at several different books, compare them to one another and FIND THE ONE WHOSE AUTHOR SPEAKS TO YOU. Find the writer whose writing matches your way of thinking. Other than that, buy one dictionary that you can carry with you all day long, one beginners book, and one graded reader to start. Every 6 months, go back to this (or another) shop and look over the selection again because you may have advanced to the point where additional books/CDs will help. And always avoid beginners books which do not use the native alphabet of the language you are learning, a particular problem with Japanese. In the masses of content that is indexed by Google, we need MORE variety, not less. Please do try to write something if you can. --Michael Dillon

"SWIP is a process used by organizations to submit information about downstream customer's address space reassignments to ARIN for inclusion in the WHOIS database. Its goal is to ensure the effective and efficient maintenance of records for IP address space.

Lovely language but it ignores the existence of Rwhois and does not explain by what standard the effectiveness and efficiency is judged.

"SWIP is intended to: * Provide information to identify the organizations utilizing each subdelegated IP address block. * Provide registration information for each IP address block. * Track utilization of allocated IP address blocks to determine if additional allocations may be justified.

This clearly omits any mention of network abuse. It doesn't even directly mention that contact information is supplied or what the contact info may/should be used for. It is heavily slanted towards a bureaucratic process for counting addresses to support decision-making about applications for additional address space.

Of course, SWIP is a ARIN thing, and you work for BRITISH TELECOMMUNICATIONS PLC. As a US network operator,

BT is also a US network operator. And a global network operator and a global network and security consulting firm. And some other stuff too like the project to run the entire UK telephone network over IP, 21CN.

I was well aware of the requirements for SWIP, because ARIN rules make it clear that, as a netblock owner of an ARIN allocation, I'm required to do it.

Which numbering authority do you work with day to day?

ARIN. I have a long history with ARIN predating the existence of the organization and I was one of the founding members of the ARIN Advisory Council. I was not asking a typical dumb question here. The fact is that nobody really has a clear idea what SWIP is, why it exists, what it is for. What is the purpose and meaning of SWIP? Why is it different from RIPE or APNIC? All the answers I have ever seen boil down to "It's traditional!". And I have spent a lot of effort in trying to track down older documents to see if there was any more clarity back in the early days of SWIP and whois, but I failed to find anything other than some references to budget justifications by ealry ARPANET managers. On two occasions I tried to address this by proposing some policy language to ARIN which would define the purpose and scope of the whois directory but the members were not interested in messing with tradition. The fact is that SWIP/whois/rwhois suck badly. Different groups of people have different ideas of what these things mean and the different ideas do not match. If I ask a waitress for two eggs over-easy I do not want to receive a slice of Quiche Lorraine. But in the world of SWIP/whois/rwhois, this is what we deal with every day. Network operators have a CRYING need for a database to identify contacts for dealing with network abuse issues. They try to use the whois directory for this, but too often it fails them because the people stuffing the info into the directory are merely following tradition to make sure that the numbers come up right the next time they apply for additional IP addresses. By the way, as a holder of an ARIN netblock allocation, you are *NOT* required to do SWIP. That is just another myth propogated by the holders of tradition and net folklore. Whenever you ask "Why?" and someone says, "Because you are required to do it.", they are really telling you not to think. You pointed me to a page written by ARIN staff as justification for your views about SWIP but you somehow missed the line which said: SWIPs are required for reallocations of /29 and larger if the allocation owner does not operate a RWhoIs server. But, I take it a step further. Why should I believe what ARIN staff have written and why should I do what they tell me to do? What is their justification for writing this page? If you look in the ARIN policies it always uses the term SWIP in the context of "efficient utilization". So why do they publish it in the whois directory? Why do people think that whois contains valid contact info? Why do people think that whois should contain contacts who are ready, willing and able to act on network abuse issues? The only reason people think these things is because it is traditonal net folklore. It was never part of the purpose and scope of SWIP/whois/Rwhois. --Michael Dillon