Re: BCP38 making it work, solving problems

2004-10-13 Thread Iljitsch van Beijnum
On 12-okt-04, at 7:30, Fred Baker wrote: From an ISP perspective, I would think that it would be of value to offer *not* ingress filtering (whether by ACL or by uRPF) as a service that a customer pays for. So what is our collective position on ISPs filtering their peers? Both the position that

Re: short Botnet list and Cashing in on DoS

2004-10-13 Thread David Barak
--- Andrew D Kirch [EMAIL PROTECTED] wrote: ... and anyone posting from yahoo/gmail/hotmail should have their posting rights immediately revoked because obviously they have no claim whatsoever to any critical Network Operations. You had me until then: has it not occurred to you that some

Re: I-D on operational MTU/fragmentation issues in tunneling

2004-10-13 Thread Iljitsch van Beijnum
On 11-okt-04, at 10:12, Pekka Savola wrote: The document is about to be IETF Last Called for Informational RFC, but prior to that, I'd like to solicit comments/feedback/review from the people here because I'm 100% sure a lot of people have been faced with these issues (we certainly have..). Well,

Re: short Botnet list and Cashing in on DoS

2004-10-13 Thread william(at)elan.net
On Wed, 13 Oct 2004, David Barak wrote: and anyone posting from yahoo/gmail/hotmail should have their posting rights immediately revoked because obviouslythey have no claim whatsoever to any critical Network Operations. You had me until then: has it not occurred to you that some of

Re: BCP38 making it work, solving problems

2004-10-13 Thread Randy Bush
For the week starting Sept 12, our dark space telescope saw 1675 spoofed DDOS attacks. any idea why someone(s) is ddosing dark space? seems a bit silly. randy

Re: BCP38 making it work, solving problems

2004-10-13 Thread Hank Nussbacher
At 04:59 AM 13-10-04 -0700, Randy Bush wrote: For the week starting Sept 12, our dark space telescope saw 1675 spoofed DDOS attacks. any idea why someone(s) is ddosing dark space? seems a bit silly. No one is DDOSing dark space. The dark space telescope picks up the richochets caused by DDOS.

Re: BCP38 making it work, solving problems

2004-10-13 Thread Suresh Ramasubramanian
Randy Bush wrote: For the week starting Sept 12, our dark space telescope saw 1675 spoofed DDOS attacks. any idea why someone(s) is ddosing dark space? seems a bit silly. Something like this I rather fancy ... http://lists.planet-lab.org/pipermail/announce/2004-April/12.html

Re: BCP38 making it work, solving problems

2004-10-13 Thread Steven Champeon
on Wed, Oct 13, 2004 at 07:09:10AM +0530, Suresh Ramasubramanian wrote: [EMAIL PROTECTED] [12/10/04 13:16 -0400]: If I, and my little 7-man company, can afford to have me solve the problem on our end, why the heck can't you do the same? You can do it because you are a 7-man

Re: BCP38 making it work, solving problems

2004-10-13 Thread Stephen J. Wilcox
On 13 Oct 2004, Paul Vixie wrote: How many people have seen forged spoofed IP addresses being used for DOS attacks lately? syn-flood protection, and random TCP ISS, are now common enough that spoofed-source isn't effective for TCP flows. if you want to bring down somebody's web server

NANOG Posting

2004-10-13 Thread Husan Sarris
NANOG, It is with great sadness that I inform you that Richard Steenbergen, long-time NANOG contributor and colleague, has been censored by Dr. Harris this morning. Richard will be barred from posting to this list until such a time when the Doctor deems it appropriate. Those who take issue

Re: NANOG Posting

2004-10-13 Thread Christian Malo
FREE RICHARD -chris On Wed, 13 Oct 2004, Husan Sarris wrote: NANOG, It is with great sadness that I inform you that Richard Steenbergen, long-time NANOG contributor and colleague, has been censored by Dr. Harris this morning. Richard will be barred from posting to this list until such

Re: NANOG Posting

2004-10-13 Thread Randy Bush
FREE RICHARD so really low capex but high opex? randy

aggregation table entries

2004-10-13 Thread bmanning
i've never seen a dns attack that didn't have 50% or more packets coming from spoofed sources, though due to loose-mode uRPF, most spoofed sources in the last year or so have been from addresses for which a route exists. -- Paul Vixie reiterating a sometimes heretical idea...

Re: aggregation table entries

2004-10-13 Thread Stephen Stuart
i've never seen a dns attack that didn't have 50% or more packets coming from spoofed sources, though due to loose-mode uRPF, most spoofed sources in the last year or so have been from addresses for which a route exists. -- Paul Vixie reiterating a sometimes heretical

Re: aggregation table entries

2004-10-13 Thread bmanning
or... why do people insist on injecting routes to non-existent things?a route table entry is a route table entry, regardless of the scope. Is this where you advocate that providers only announce the parts of their assigned blocks that are in use? seems like a

Re: Excessive DNS Requests

2004-10-13 Thread Cliff Albert
On Wed, Oct 13, 2004 at 07:49:03PM +0100, Anderson, Ian wrote: Anyone else seeing excessive DNS requests hammering their local forwarders this evening. We've just taken our residence network off-line owing to the level of port 53 traffic coming from it. Can't see anything in the usual

Re: Excessive DNS Requests

2004-10-13 Thread David A. Ulevitch
quote who=Anderson, Ian Anyone else seeing excessive DNS requests hammering their local forwarders this evening. We've just taken our residence network off-line owing to the level of port 53 traffic coming from it. Can't see anything in the usual places regarding this Things seem

website to display AS No and ip info also

2004-10-13 Thread adrian kok
Hi all ls there any websites to provide the information about AS no and IP? When typing the AS no, it can display all the information fo the company and IP belongs to this company also Thank you

Re: website to display AS No and ip info also

2004-10-13 Thread Bubba Parker
www.cidr-report.org On Thu, Oct 14, 2004 at 03:19:58AM +0800, adrian kok wrote: Hi all ls there any websites to provide the information about AS no and IP? When typing the AS no, it can display all the information fo the company and IP belongs to this company also Thank you --

Re: aggregation table entries

2004-10-13 Thread joshua sahala
On (13/10/04 18:43), [EMAIL PROTECTED] wrote: Is this where you advocate that providers only announce the parts of their assigned blocks that are in use? seems like a good lead in, so yes - i advocate folks only announce what they use. may play old-hob on the ISP that

Re: website to display AS No and ip info also

2004-10-13 Thread Bill Woodcock
On Thu, 14 Oct 2004, adrian kok wrote: ls there any websites to provide the information about AS no and IP? When typing the AS no, it can display all the information fo the company and IP belongs to this company also That's what whois does. There are web-sites

Re: website to display AS No and ip info also

2004-10-13 Thread Bubba Parker
Um, no. That site is a dud, and I have no idea why Crack would be related to ASNs. On Wed, Oct 13, 2004 at 03:29:04PM -0400, [EMAIL PROTECTED] wrote: http://www.smartwhois.net -Original Message- From: Bubba Parker [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 13, 2004 3:21

Re: website to display AS No and ip info also

2004-10-13 Thread Robert Boyle
At 03:19 PM 10/13/2004, you wrote: ls there any websites to provide the information about AS no and IP? When typing the AS no, it can display all the information fo the company and IP belongs to this company also http://www.fixedorbit.com/search.htm Have fun! -Robert Tellurian Networks - The

Re: website to display AS No and ip info also

2004-10-13 Thread Bubba Parker
A standard whois program can not tell you what IP addresses a particular AS is announcing. On Wed, Oct 13, 2004 at 12:21:34PM -0700, Bill Woodcock wrote: On Thu, 14 Oct 2004, adrian kok wrote: ls there any websites to provide the information about AS no and IP? When

Re: website to display AS No and ip info also

2004-10-13 Thread Bill Woodcock
A standard whois program can not tell you what IP addresses a particular AS is announcing. When typing the AS no, it can display all the information fo the company and IP belongs to this company also That's true, however, it's not what he asked. I loosely

Re: aggregation table entries

2004-10-13 Thread Kevin Oberman
Date: Wed, 13 Oct 2004 18:43:45 + From: [EMAIL PROTECTED] Sender: [EMAIL PROTECTED] or... why do people insist on injecting routes to non-existent things?a route table entry is a route table entry, regardless of the scope. Is this where you advocate that

Re: aggregation table entries

2004-10-13 Thread Randy Bush
The second is a harder problem, because of the business decisions of some providers to source packets from prefixes that they do not announce. i presume you are not intending to recommend that i drop packets that multi-homed customers hand me when they have also asked me to de-pref the prefix

Re: aggregation table entries

2004-10-13 Thread bmanning
On Wed, Oct 13, 2004 at 12:54:44PM -0700, Kevin Oberman wrote: Date: Wed, 13 Oct 2004 18:43:45 + From: [EMAIL PROTECTED] Sender: [EMAIL PROTECTED] or... why do people insist on injecting routes to non-existent things?a route table entry is a route table

Re: website to display AS No and ip info also

2004-10-13 Thread Ian Dickinson
Cliff Albert wrote: On Wed, Oct 13, 2004 at 02:33:53PM -0500, Bubba Parker wrote: A standard whois program can not tell you what IP addresses a particular AS is announcing. Actually it can tell you what IP adresses a particular AS SHOULD announce. whois -i origin -h whois.ripe.net AS28788 And what

Reminder: Who has VA INET GOD?

2004-10-13 Thread Deepak Jain
I seem to remember someone telling me they had this license plate. Saw it today, not sure I recognized the driver. Would someone mind refreshing my poor little memory? Thanks, Deepak

Re: NANOG Posting

2004-10-13 Thread Stephen J. Wilcox
On Wed, 13 Oct 2004, Christian Malo wrote: FREE RICHARD Of course my understanding of revoking posting privileges is that you cant post to the list.. not you are imprisoned in the merit dungeons, i think that punishment is reserved for Bandy/Husan/etc However I do like some humor being

Re: aggregation table entries

2004-10-13 Thread Stephen Stuart
The second is a harder problem, because of the business decisions of some providers to source packets from prefixes that they do not announce. i presume you are not intending to recommend that i drop packets that multi-homed customers hand me when they have also asked me to de-pref the

NANOG censorship

2004-10-13 Thread Sichard Reenbergen
|On Wed, 13 Oct 2004, Husan Sarris wrote: | | NANOG, | | It is with great sadness that I inform you that Richard Steenbergen, | long-time NANOG contributor and colleague, has been censored by |Dr. ETC. finally! i just want to say how disappointed I am that people have been posting notes using

3 Mb question

2004-10-13 Thread Gerald
I've got what seems to me like an innocuous question for this list... Someone is requesting access to about 3 mb of traffic up/dn. I figure 2 T1s will give them the 3 Mb I need, but I'm looking for suggestions on either efficiently combining those 2 to get the most bandwidth for their buck or

Re: aggregation table entries

2004-10-13 Thread Randy Bush
The second is a harder problem, because of the business decisions of some providers to source packets from prefixes that they do not announce. i presume you are not intending to recommend that i drop packets that multi-homed customers hand me when they have also asked me to de-pref the

Re: 3 Mb question

2004-10-13 Thread Stephen J. Wilcox
multilinking t1s will work fine. but depending on your customer, there are lots of things between a T1 and DS3.. such as 10Mb ethernet Steve On Wed, 13 Oct 2004, Gerald wrote: I've got what seems to me like an innocuous question for this list... Someone is requesting access to about 3

Re: aggregation table entries

2004-10-13 Thread Stephen Stuart
yep. some times it is even less intentional and less understood; see tim's paper on bgp wedgies. and the management made me do it, is a bit disingenuous. it's part of what it means to have customers. My customers, back when I had them, must have been better-behaved than most.

Verio Routing

2004-10-13 Thread Joe Johnson
Did anyone else just get a hiccup on Verio circuits? Lost routing in small 2-5 second bursts incrementally over the past 10 minutes. Joe Johnson JMDN.net

Re: aggregation table entries

2004-10-13 Thread Randy Bush
yep. some times it is even less intentional and less understood; see tim's paper on bgp wedgies. and the management made me do it, is a bit disingenuous. it's part of what it means to have customers. My customers, back when I had them, must have been better-behaved than most. then why

Re: aggregation table entries

2004-10-13 Thread Stephen Stuart
yep. some times it is even less intentional and less understood; see tim's paper on bgp wedgies. and the management made me do it, is a bit disingenuous. it's part of what it means to have customers. My customers, back when I had them, must have been better-behaved than most.

FW: Verio Routing

2004-10-13 Thread James Laszko
We saw a hiccup in San Diego. Routes towards a lot of our monitored customers vanished and starting going out other providers... James Laszko Pipeline Communications, Inc. [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe

Re: NANOG censorship

2004-10-13 Thread Bill Woodcock
Bandy Rush, Dean Soran, Husan Sarris, and Sichard Reenbergen ^^ Clearly an imposter... Anyone who knows Dean S. Moran knows he would never misspell his own name. -Bill

Updated monitoring pages from Team Cymru

2004-10-13 Thread Rob Thomas
[ Apologies to those of you who receive this note in multiple forums. ] Hi, team. We are pleased to announce some updated monitoring, as well as some new monitoring, on our web site. This includes aesthetic fixes as well as increased visibility. Our DNS monitoring now has increased

Re: Verio Routing

2004-10-13 Thread Richard J. Sears
We have an OC3 with Verio and took a hit as well.. On Wed, 13 Oct 2004 17:06:02 -0500 Joe Johnson [EMAIL PROTECTED] wrote: Did anyone else just get a hiccup on Verio circuits? Lost routing in small 2-5 second bursts incrementally over the past 10 minutes. Joe Johnson JMDN.net

RE: Verio Routing

2004-10-13 Thread Joe Johnson
Everything did come back up before I sent the email (otherwise I wouldn't have been able to unless I dialed in). I was a little disappointed about their blanket temporary major network issues statement from Level 3 support. Normally they are really good about support. Joe Johnson JMDN.net

Re: 3 Mb question

2004-10-13 Thread Vicky
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ...also look into IMA (inverse multiplex atm). regards, /vicky Gerald wrote: | I've got what seems to me like an innocuous question for this list... | | Someone is requesting access to about 3 mb of traffic up/dn. I figure 2 | T1s will give them the 3

Re: aggregation table entries

2004-10-13 Thread Pekka Savola
On Wed, 13 Oct 2004, Randy Bush wrote: The second is a harder problem, because of the business decisions of some providers to source packets from prefixes that they do not announce. i presume you are not intending to recommend that i drop packets that multi-homed customers hand me when