The Cidr Report

2002-07-05 Thread CIDR Report
This is an auto-generated mail on Fri Jul 5 23:00:01 PDT 2002 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. Check http:

Re: wcom overbilling

2002-07-05 Thread Mark Radabaugh - Amplex
> On Fri, 5 Jul 2002, Chris Beggy wrote: > > Wcom's overbilling will be investigated: > > Is there a single wcom customer on nanog that *hasn't* been overbilled? > > -Dan I really really shouldn't do this to myself but... Our UUNet invoice has been correct every month since the T1 circuit was i

RE: Internet vulnerabilities

2002-07-05 Thread jnull
Sean made some good points: the +6hr disruption is a far reach without serious physical damage.--Nearly as good a point as Eric's hallarious abstraction-- Disgruntled employees, script kiddies, and all but the most diabolical hate-group are only going to cost a moderate amount of cash in SLA vio

Re: wcom overbilling

2002-07-05 Thread Robert Boyle
At 08:47 PM 7/5/2002 -0400, you wrote: >I have not been at one company, not one, service provider or otherwise that >has not had major WCOM billing issues. No matter how large or small we >were. In dealing with them in one form or another since 1994 when I started Tellurian Networks (Garden Ne

Re: wcom overbilling

2002-07-05 Thread Gwendolynn ferch Elydyr
On Fri, 5 Jul 2002, Dave Stewart wrote: > At 08:42 PM 7/5/2002, Dan Hollis wrote: > >Is there a single wcom customer on nanog that *hasn't* been overbilled? > I heard once that there was, but I think it's actually an urban legend. I haven't been... yet ;> Reminds me of motorcycles - there's two

Re: wcom overbilling

2002-07-05 Thread Dave Stewart
At 08:42 PM 7/5/2002, Dan Hollis wrote: >Is there a single wcom customer on nanog that *hasn't* been overbilled? I heard once that there was, but I think it's actually an urban legend.

Re: wcom overbilling

2002-07-05 Thread Vincent J. Bono
I have not been at one company, not one, service provider or otherwise that has not had major WCOM billing issues. No matter how large or small we were. - Original Message - From: "Dan Hollis" <[EMAIL PROTECTED]> To: "Chris Beggy" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Frid

RE: Internet vulnerabilities

2002-07-05 Thread Rizzo Frank
Sean Donelan wrote: > Disrupting the Internet is a matter of scale and time. Quick show of hands. How many of you recently-laid-off engineers have automated router-pampering scripts still running on your old workstations, which nobody at your ex-employer knows about? How many of you still

Re: wcom overbilling

2002-07-05 Thread Dan Hollis
On Fri, 5 Jul 2002, Chris Beggy wrote: > Wcom's overbilling will be investigated: Is there a single wcom customer on nanog that *hasn't* been overbilled? -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

RE: Internet vulnerabilities

2002-07-05 Thread Sean Donelan
I don't understand many of the cyber-scare articles. If I was cynical, and I thought we had a clever government, I would say it was all a diversionary tactic to distract attackers from the more vulnerable infrastructures. Disrupting the Internet is a matter of scale and time. It is fairly triv

wcom overbilling

2002-07-05 Thread Chris Beggy
Wcom's overbilling will be investigated: http://www.ctnow.com/business/hc-worldcomcover0704.artjul04.story?coll=hc%2Dheadlines%2Dbusiness Chris msg03355/pgp0.pgp Description: PGP signature

Re: Internet vulnerabilities

2002-07-05 Thread Rodney Joffe
Bill Woodcock wrote: > > > Or, are you saying that an anycast host has to be a router running BGP ? > > No, typically they run OSPF. Perhaps a little further explanation may help Marshall... think: a *nix box running zebra, connected to a router. > > This works for DNS, but not for

RE: Internet vulnerabilities

2002-07-05 Thread Bill Woodcock
On Fri, 5 Jul 2002, Stephen J. Wilcox wrote: > Doesnt announcing the same routing prefix into BGP from multiple locations do > the same thing without needing a new range or enhancement in IGMP etc ? Correct. That's _all anycast is_. Nothing tricky here. At all.

Re: Internet vulnerabilities

2002-07-05 Thread Bill Woodcock
> Or, are you saying that an anycast host has to be a router running BGP ? No, typically they run OSPF. > So if it goes down, so would the service and the announcements? Correct. If a device wants to witdraw itself from a service pool, it withdraws the host route associated with that

RE: Internet vulnerabilities

2002-07-05 Thread Bill Woodcock
On Fri, 5 Jul 2002, Barry Raveendran Greene wrote: > http://www.cisco.com/public/cons/isp/essentials/ip-anycast-cmetz-03.pdf Yes, this document correctly described IPv4 anycast. It somewhat overstates the severity of the issue with TCP and the dynamicism of the underlying network topo

Re: DNS was Re: Internet Vulnerabilities

2002-07-05 Thread Paul Vixie
> ... beyond that, security and anycast don't mix well without the data > being authenticated, e.g. dnssec. i won't disagree. anycast's cost:benefit analysis is compellingly against its use in most situations. root name service may be one of them. now, if the ops community can figure out a wa

Re: DNS was Re: Internet Vulnerabilities

2002-07-05 Thread E.B. Dreger
SW> Date: Fri, 05 Jul 2002 17:50:24 +0100 SW> From: Simon Waters SW> I think the gtld-servers.net are the target for a globally SW> disruptive and prolonged DDoS. Servers doing reverse lookup SW> might also be targets in more specialised attacks, as their SW> disruption would be continent wide

Re: DNS was Re: Internet Vulnerabilities

2002-07-05 Thread Randy Bush
> Now that we've seen enough years of experience from Genuity.orig, > UltraDNS, Nominum, AS112, and {F,K}.root-servers.net, we're seriously > talking about using anycast for the root server system. without dnssec, how do we differentiate this from a routing attack on the roots? the as112 anycas

anycast (Re: Internet vulnerabilities)

2002-07-05 Thread E.B. Dreger
ME> Date: Fri, 05 Jul 2002 12:28:46 -0400 ME> From: Marshall Eubanks ME> Let's go through this a little. ME> ME> Let's say that you and I are running the foo service in ME> anycast. You announce the foo IP address (say in a /24) ME> behind your AS, I announce the same /24 behind my AS. Now, if

DNS was Re: Internet Vulnerabilities

2002-07-05 Thread Simon Waters
> From: Paul Vixie <[EMAIL PROTECTED]> > > [EMAIL PROTECTED] (Mike Tancsa) writes: > > > ... Still, I think the softest targets are the root name > servers. I was > > glad to hear at the Toronto NANOG meeting that this was > being looked into > > from a routing perspective. Not sure what is

Re: Internet vulnerabilities

2002-07-05 Thread Marshall Eubanks
Dear Rodney; Thanks for the info. Rodney Joffe wrote: > Marshall, > > First, I hope you don't mind that I cut all the additional cc's. I don't > think any of the folks really needed extra copies ;-) > > Now... > > Marshall Eubanks wrote: > >>On Fri, 5 Jul 2002 13:36:49 +0100 (BST) >> "

Re: Internet vulnerabilities

2002-07-05 Thread Rodney Joffe
Marshall, First, I hope you don't mind that I cut all the additional cc's. I don't think any of the folks really needed extra copies ;-) Now... Marshall Eubanks wrote: > > On Fri, 5 Jul 2002 13:36:49 +0100 (BST) > "Stephen J. Wilcox" <[EMAIL PROTECTED]> wrote: > > > > Doesnt announcing the s

Re: Internet vulnerabilities

2002-07-05 Thread Randy Bush
> Ok, here is my master plan to take down the Internet. First, we > will spend two weeks writing up several hundred seemingly simple, > short questions and innane statements regarding ORBS, filtering > RFC1918 space, Peering, and all of Nanog's other favorite topics. > Then, we'll start posting

Re: Internet vulnerabilities

2002-07-05 Thread Eric Gauthier
:: Said in my best Dr. Evil voice :: Ok, here is my master plan to take down the Internet. First, we will spend two weeks writing up several hundred seemingly simple, short questions and innane statements regarding ORBS, filtering RFC1918 space, Peering, and all of Nanog's other favorite top

anycast DNS (Re: Internet vulnerabilities)

2002-07-05 Thread E.B. Dreger
ME> Date: Fri, 05 Jul 2002 09:05:44 -0400 ME> From: Marshall Eubanks ME> - it's static - no failover. If AS 701 and AS 1239 are both ME> announcing a route to foo, and your preferred route is ME> "through" AS701, and the AS701 foo goes down, then you do not ME> automatically switch over to the

Re: Internet vulnerabilities

2002-07-05 Thread Lars Erik Gullerud
Uhm it seems to me people are trying to make this whole AS112-thing sound more complex than it really is... We use the BGP anycast-method in our backbone, and have been doing so for a long time. Basically, we have multiple caching DNS-servers scattered around our network, but all of them use

Re: Internet vulnerabilities

2002-07-05 Thread Marshall Eubanks
On Thu, 4 Jul 2002 18:43:44 -0700 (PDT) Bill Woodcock <[EMAIL PROTECTED]> wrote: > > On Thu, 4 Jul 2002, Marshall Eubanks wrote: > > Is this the anycast based on MSDP ? > > Anycast, not multicast. > > -Bill > > But the only IPv4 anycast that I kno

Re: Internet vulnerabilities

2002-07-05 Thread Bill Woodcock
> But the only IPv4 anycast > that I know of does use MSDP : > http://www.ietf.org/internet-drafts/draft-ietf-mboned-anycast-rp-08.txt > Is there a different proposal ? What's the RFC / I-D name ? You seem to be confusing anycast with something complicated. It's not a protocol,