June 2005 - Ris-int - mailman.ripe.net

Monday morning RIS meeeting
by arife＠ripe.net 30 Jun '05

30 Jun '05

Hi all, For Monday morning RIS meeting, I have an agenda point: - Discuss the RIS performance study and also come up with a suggestion how to improve the available structure. Before the meeting, please read the following documentation, all suggestions/feedbacks are welcome. http://iii/sed/twiki/bin/view/SED/RISPerformance#Proposal BTW, if you have any other agenda item please let me know. Arife

1 0

[henk@ripe.net: [ris] Fwd: Bogon announcement mail]
by arife＠ripe.net 29 Jun '05

29 Jun '05

Hi James, Would you be interested in doing it? Arife ----- Forwarded message from Henk Uijterwaal <henk(a)ripe.net> ----- From: Henk Uijterwaal <henk(a)ripe.net> To: ris-int(a)ripe.net, ris(a)ripe.net Subject: [ris] Fwd: Bogon announcement mail Date: Wed, 29 Jun 2005 07:56:56 +0200 Cc: Folks, See below, can you please pick this up so things will be in place when the new /8's arrive. Thanks, Henk >Date: Tue, 28 Jun 2005 15:55:57 +0200 >From: leo vegoda <leo(a)ripe.net> >Organization: RIPE Network Coordination Centre >User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) >Gecko/20040910 >X-Accept-Language: en-us, en >To: henk(a)ripe.net >CC: Filiz Yilmaz <filiz(a)ripe.net>, RS Management <lsd(a)ripe.net> >Subject: Bogon announcement mail > >Hi Henk, > >I want to send a mail about the pilot prefix announcements from the new >IPv4 we're requesting. Before I get Comms to review the style, I'd be >grateful if you could review the content for me. In particular, I'm >concerned regarding the phrase "reachability tools". As far as I can tell, >neither the 'ping' nor 'traceroute' tools on >http://www.ris.ripe.net/cgi-bin/debogon.cgi actually work. Can you let me >know if that's right, and if so, what the schedule to fix them is? > >Thanks, > >-leo > >Dear Colleagues, > >This announcement is being sent to multiple lists. I apologise for >duplicates. > >The RIPE NCC received the IPv4 address range [insert] from the IANA in >June 2005. > >We expect to start making allocations from them within the next few weeks. > >We have started announcing two prefixes from each /8, which originate in >AS12654. > >[insert list of prefixes] > >Details of the BGP announcements, reachability tools and other information >are available on our web site at: > >http://www.ris.ripe.net/debogon/debogon.html > >You may want to update any filters you have in place. > >Kind regards, > > > >-- >leo vegoda "Good enough is not good enough" >RIPE NCC Axel Pawlik >Registration Services Manager 3 June 2005 ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine) ----- End forwarded message -----

1 0

Fwd: Bogon announcement mail
by Henk Uijterwaal 29 Jun '05

29 Jun '05

Folks, See below, can you please pick this up so things will be in place when the new /8's arrive. Thanks, Henk >Date: Tue, 28 Jun 2005 15:55:57 +0200 >From: leo vegoda <leo(a)ripe.net> >Organization: RIPE Network Coordination Centre >User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) >Gecko/20040910 >X-Accept-Language: en-us, en >To: henk(a)ripe.net >CC: Filiz Yilmaz <filiz(a)ripe.net>, RS Management <lsd(a)ripe.net> >Subject: Bogon announcement mail > >Hi Henk, > >I want to send a mail about the pilot prefix announcements from the new >IPv4 we're requesting. Before I get Comms to review the style, I'd be >grateful if you could review the content for me. In particular, I'm >concerned regarding the phrase "reachability tools". As far as I can tell, >neither the 'ping' nor 'traceroute' tools on >http://www.ris.ripe.net/cgi-bin/debogon.cgi actually work. Can you let me >know if that's right, and if so, what the schedule to fix them is? > >Thanks, > >-leo > >Dear Colleagues, > >This announcement is being sent to multiple lists. I apologise for duplicates. > >The RIPE NCC received the IPv4 address range [insert] from the IANA in >June 2005. > >We expect to start making allocations from them within the next few weeks. > >We have started announcing two prefixes from each /8, which originate in >AS12654. > >[insert list of prefixes] > >Details of the BGP announcements, reachability tools and other information >are available on our web site at: > >http://www.ris.ripe.net/debogon/debogon.html > >You may want to update any filters you have in place. > >Kind regards, > > > >-- >leo vegoda "Good enough is not good enough" >RIPE NCC Axel Pawlik >Registration Services Manager 3 June 2005 ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)

1 0

[arife: ANNOUNCEMENT: The RIS Project's Remote Route Collector is online at MSK-IX]
by Arife Vural 27 Jun '05

27 Jun '05

Hi guys, Could you put a link to the following announcement from news page? Thanks. Arife ----- Forwarded message from arife ----- To: ris-users Subject: ANNOUNCEMENT: The RIS Project's Remote Route Collector is online at MSK-IX Date: Thu, 23 Jun 2005 16:51:43 +0200 Dear Colleagues, We are pleased to announce the deployment of the Routing Information Service (RIS) Project's Remote Route Collector, RRC13, at MSK-IX, Moscow. We are now ready to peer with MSK-IX members. We would like to thank Evgueni Kouskevitch and MSK-IX for their help. RRC13 has been operating since April 2005. It has an interface on the shared MSK-IX network. It collects routing information from all exchange members who peer with us. - Our peering address is: 193.232.244.114 - Our AS Number is: 12654 - Our policy: http://www.ripe.net/projects/ris/docs/rrc13.html The RIS started as a RIPE NCC project in 1999. It has grown to over 450 IPv4 and IPv6 peers at 12 data collection points in Europe, Japan and North America. We collect and make available BGP routing information by devising tools that can help ISPs debug problems without being limited to a BGP view. We provide RIS raw data regarding the historical development of the Internet. If you want to peer with the RIS, please send an e-mail to <rispeering(a)ripe.net> or use the form that you can find at: http://www.ris.ripe.net/peerreg.cgi You can find more information about RIS at: http://www.ripe.net/ris/ You can find RIS tools at: http://www.ripe.net/projects/ris/tools/index.html If you have any questions or comments, please send an e-mail to <ris(a)ripe.net>. -- Regards, Arife Vural RIPE NCC ----- End forwarded message -----

3 2

[arife: ANNOUNCEMENT: The RIS Project's Remote Route Collector is online at PAIX.]
by Arife Vural 27 Jun '05

27 Jun '05

Same for this one please. Thanks. Arife ----- Forwarded message from arife ----- To: ris-users Subject: ANNOUNCEMENT: The RIS Project's Remote Route Collector is online at PAIX. Date: Thu, 23 Jun 2005 17:01:54 +0200 Dear All, It looks I forgot to send PAIX box announcement to ris-users lists. Please contact with us if you would be interested in peering with RIS at PAIX. Regards. Arife -- [Apologies for duplicate mails] Dear Colleagues, We are pleased to announce that we have relocated the RIS Project's second North American Remote Route Collector at PAIX, Palo Alto. We are now ready to peer with PAIX members. We would like to thank Paul Vixie and ISC for their help. RRC14, has been operating since December 2004. It has an interface on the shared PAIX network and runs both IPv4 and IPv6. It collects routing information from all exchange members who peer with us. - Our peering addresses are: IPv4: 198.32.176.6 IPv6: 3ffe:80a::9 - Our AS number is: 12654 - Our policy: http://www.ripe.net/projects/ris/docs/rrc14.html The Routing Information Service (RIS) started as a RIPE NCC project in 1999. It has grown to over 300 IPv4 and IPv6 peers at twelve data collection points in Europe, Japan and North America. We collect and make available BGP routing information by devising tools that can help ISPs debug problems without being limited to a BGP view. We provide RIS raw data regarding the historical development of the Internet. If you want to peer with the RIS, please send an e-mail to <rispeering(a)ripe.net> or use the web form that you can find at: http://www.ris.ripe.net/peerreg.cgi You can find more information about RIS at: http://www.ripe.net/ris/ You can find RIS tools at: http://www.ripe.net/projects/ris/tools/index.html If you have any questions or comments, please send an e-mail to <ris(a)ripe.net>. Regards. Arife Vural RIPE NCC ----- End forwarded message -----

1 0

Re: [Brett_Watson@isc.org: Comments regarding a new tool from the Route Views team]
by Rene Wilhelm 23 Jun '05

23 Jun '05

Daniel, To answer your question from June 16th: no this is not exactly riswhois: >> The Route Views team is developing an application to map the changes >> in Origin-AS of IP prefixes over time. RISwhois doesn't keep history, only looks at the latest available RIB dumps, it cannot answer questions on changes in Origin-AS over time. >> The changes in Origin-AS will >> be based on data from current RIR databases. If I get this right, what Route Views intend to do is compare the origin AS data from prefixes seen in BGP feeds with what has been registered in the various routing registries ("RIR databases") and provide random access to the resulting data set. > I wanted to know if what they propose is not covered already by the RIS. > > - I am sure we have the data this needs. > - Do we have a UI that provides what they want? > - Does RISWHOIS provide part of it? > - can we make something like this quickly ourselves? We could modify RISwhois to (when asked with a flag) query a Routing Registry and compare the BGP origin with the registered origin, but that still wouldn't provide history. The current RIS DB does have history and could at least answer the question if the BGP origin AS has changed in the time period covered by the DB. However, it does not have any info on the *registered* origin AS; also the 3 months usually covered by RIS DB might be a bit short when looking back in history. As I see it, to provide the desired functionality, we'd need a DB with tables for RIS and IRR storing for each prefix a time series of origin AS (prefix_id, originAS, first, last). For convenience, you could add a flag indicating whether or not the origin matched the IRR during the whole (first,last) time period. Things get a bit tricky when RIS reports multiple origins. One could either do "majority voting" (origin seen by most RIS peers wins) or list both (all) origins seperated by e.g. a / Also, the odd cases of origin being an AS-set (like 84.205.73.0/24, 84.205.89.0/24 :) can be handled in several ways. -- Rene > ----- Forwarded message from Daniel Karrenberg <daniel.karrenberg(a)ripe.net> ----- > > From: Daniel Karrenberg <daniel.karrenberg(a)ripe.net> > To: RIPE NCC RIS Project People <ris(a)ripe.net> > Subject: [ris] [Brett_Watson(a)isc.org: Comments regarding a new tool from the > Route Views team] > Date: Thu, 16 Jun 2005 09:21:24 +0200 > Cc: > Mail-Followup-To: RIPE NCC RIS Project People <ris(a)ripe.net> > > Isn't this riswhois or do we not already have that? > > ----- Forwarded message from brett watson <Brett_Watson(a)isc.org> ----- > > Date: Wed, 15 Jun 2005 14:45:48 -0700 > From: brett watson <Brett_Watson(a)isc.org> > To: all(a)oarc.isc.org > Subject: Comments regarding a new tool from the Route Views team > X-RIPE-Spam-Level: > X-RIPE-Spam-Tests: BAYES_00 > X-RIPE-Spam-Status: N 0.000000 / -2.6 > > We received a request from Dave Meyer (part of the U. of Oregon Route > Views team) for feedback on a new tool they are building. For those > that don't know, the Route Views team (www.routeviews.org) collects, > logs, and provides real-time access to global routing data. We (the > OARC Secretariat) wanted to float this to the general membership for > any input you all might have regarding the current features of this > tool, or enhancements you believe OARC members might find useful. > > The Route Views team is developing an application to map the changes > in Origin-AS of IP prefixes over time. The changes in Origin-AS will > be based on data from current RIR databases. The Route Views team > envisioned this as a useful tool for providers to use until some form > of s*BGP is deployed, to help track down "hi-jacked" routes, and for > spam mitigation. The data may be searched via: > > - specific time/date > - time/date range > - frequency of changes (ie. last 10 origin-as changes for a > specific prefix) > > In addition, the Route Views team is considering using MRT to > visualize the output. The team asked for input on the questions > included below, and we would love to hear any member input/comments > on these questions/answers before we respond to Dave. Feel free to > send this to the all@ list for general discussion, or to me > personally and I will tabulate everything and send back to the list > one last time. > > > Questions from Route Views team > =========================== > > (i). Would you find this type of application useful, and for what > purposes? > > We envision a tool like this being useful for the DNS-OARC community > in several areas: > > DNS Anycast Experimentation - Visualizing the changes in Origin-AS > during an anycast experiment where an anycast prefix is announced/ > withdrawn over the course of several days, in order to better > understand the impact of anycast on the DNS. > > DSC Data Correlation - We have a recent example of how this kind of > tool would be useful. Several months ago, F-root saw a large "spike" > in queries that lasted for several days. After the spike subsided, > we were able to identify the source IP address of the spike but no > route existed in the global routing tables for the source IP. By > manually downloading historical data from route-views, we ascertained > that the source IP address was indeed announced by a different ISP > than current whois data would indicate should be announcing it. The > implications of having the ability to query for Origin-AS changes in > near real-time are obvious in this case. > > General DNS Data Correlation - Any statistics obtained about the DNS > (such as RIPE's dnsmon) could be correlated with changes in Origin-AS > to either validate or invalidate theories on DNS behavior. > > > (ii). What other features would you like to see? > > The usefulness of comparing actual Origin-AS data with RIR database > information is questionable, given the historical inaccuracies in RIR > data but in some cases the RIR data may give us a useful baseline. > > It seems that overall changes in the AS *path* may also be useful, in > addition to just the Origin-AS. > > > (iii). How would you like to see the output visualized? > > MRT seems like a fine method for visualizing the data. The BGPlay > application is a great way to visualize data from the RIPE RIS and > route-views data. > > > > -b > -- > Brett Watson > DNS Operations, Analysis, and Research Center > > ----- End forwarded message ----- > > ----- End forwarded message -----

2 1

RIS meeting on Monday
by Henk Uijterwaal 22 Jun '05

22 Jun '05

Arife, others, Can we please have a RIS meeting next Monday (20/6)? I have 2 agenda topics: - Outcome of discussion with LACNIC to install an RRC at their site. This came up during RIPE50. They wanted to install TB's in Brazil and during the discussion, we realized that an RRC in Brazil (at the Sao Paolo IX) would be useful as well. I want to summarize the discussion and see if our plans have any sense of reality. - myASN feature requests. I got a few of them. Thanks, Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)

5 6

[simon@limmat.switch.ch: [ris-int] Suggestion for improvement of myASN alarms]
by arife＠ripe.net 20 Jun '05

20 Jun '05

Hi Henk, It looks I got back this guy. You can check it out from here. http://www.ris.ripe.net/myasn/bugs.html There is also ticket number there. Arife ----- Forwarded message from Simon Leinen <simon(a)limmat.switch.ch> ----- From: Simon Leinen <simon(a)limmat.switch.ch> To: ris-int(a)ripe.net Subject: [ris-int] Suggestion for improvement of myASN alarms Date: Mon, 20 Jun 2005 09:57:00 +0200 Dear RIS team, I frequently receive alerts from MyASN, and I think it's because I have only specified our "transit" providers' ASNs in the "transit" alarm for 130.59.0.0/16. Unfortunately, these alerts don't contain the AS path that was seen (and that didn't match the regular expression I specified). So it's hard for me to fix the definition of the alarm. Please consider adding a column with the AS-path information to the table in the alert messages. Thanks & regards, -- Simon. Received: from chx400.switch.ch ([130.59.10.2]) by central.switch.ch with esmtp (Exim 3.20 #1) id 1CosTA-0006gM-00 for simon(a)switch.ch; Thu, 13 Jan 2005 01:04:08 +0100 Received: from postman.ripe.net ([193.0.0.199]) by chx400.switch.ch with esmtp (Exim 3.20 #1) id 1CosT9-0004Kg-00 for simon(a)limmat.switch.ch; Thu, 13 Jan 2005 01:04:08 +0100 Received: by postman.ripe.net (Postfix, from userid 8) id C27D525093; Thu, 13 Jan 2005 01:04:07 +0100 (CET) Received: from birch.ripe.net (birch.ripe.net [193.0.1.96]) by postman.ripe.net (Postfix) with ESMTP id A567D2509B for <simon(a)limmat.switch.ch>; Thu, 13 Jan 2005 01:04:05 +0100 (CET) Received: from diemen.ripe.net (diemen.ripe.net [193.0.0.213]) by birch.ripe.net (8.12.10/8.11.6) with ESMTP id j0D0458Q014871 for <simon(a)limmat.switch.ch>; Thu, 13 Jan 2005 01:04:05 +0100 Received: (from risops@localhost) by diemen.ripe.net (8.12.10/8.12.6) id j0CNWk6J030328; Wed, 12 Jan 2005 23:32:46 GMT Message-Id: <200501122332.j0CNWk6J030328(a)diemen.ripe.net> X-Authentication-Warning: diemen.ripe.net: risops set sender to myasn-bounce(a)ripe.net using -f X-RIPE-Spam-Level: X-RIPE-Spam-Tests: ALL_TRUSTED,BAYES_00 X-RIPE-Spam-Status: U 0.296466 / -5.9 X-RIPE-Signature: 51f508fc1c86c020a1ee9167b0580d07 X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on diotima.switch.ch X-Spam-Level: From: myASn Notifications <myasn(a)ripe.net> To: simon(a)limmat.switch.ch Subject: New alarms for 559 Date: Wed, 12 Jan 2005 23:32:46 GMT X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.2 Dear myASn contact, New alarms were detected for 559. Please find the details below. Depending on your detail level settings you might not see all the events. Please use the web interface for further details. -- myASn System Advanced alarm 1114 (Default), 130.59.0.0/16 (exceptions not shown), \b(3549|1299|3320)\s(559)\b, MinED: 1, MinEC: 1, ADW: 3600 .=------+---------------+----------------+-----------------+--------------------------+-------------------------=. | RRC | Prefix(es) | Peer(s) | Conflicting ASs | First Seen | Last Seen | |=------+---------------+----------------+-----------------+--------------------------+-------------------------=| | rrc05 | 130.59.0.0/16 | 193.203.0.7 | | Wed Jan 12 21:52:57 2005 | Wed Jan 12 21:53:23 2005 | |=------+---------------+----------------+-----------------+--------------------------+-------------------------=| | rrc03 | 130.59.0.0/16 | 195.69.144.63 | | Wed Jan 12 21:26:36 2005 | Wed Jan 12 21:28:25 2005 | | | | 194.153.154.84 | | | | '=------+---------------+----------------+-----------------+--------------------------+-------------------------=' ----- End forwarded message -----

1 0

Suggestion for improvement of myASN alarms
by Simon Leinen 20 Jun '05

20 Jun '05

Dear RIS team, I frequently receive alerts from MyASN, and I think it's because I have only specified our "transit" providers' ASNs in the "transit" alarm for 130.59.0.0/16. Unfortunately, these alerts don't contain the AS path that was seen (and that didn't match the regular expression I specified). So it's hard for me to fix the definition of the alarm. Please consider adding a column with the AS-path information to the table in the alert messages. Thanks & regards, -- Simon. Received: from chx400.switch.ch ([130.59.10.2]) by central.switch.ch with esmtp (Exim 3.20 #1) id 1CosTA-0006gM-00 for simon(a)switch.ch; Thu, 13 Jan 2005 01:04:08 +0100 Received: from postman.ripe.net ([193.0.0.199]) by chx400.switch.ch with esmtp (Exim 3.20 #1) id 1CosT9-0004Kg-00 for simon(a)limmat.switch.ch; Thu, 13 Jan 2005 01:04:08 +0100 Received: by postman.ripe.net (Postfix, from userid 8) id C27D525093; Thu, 13 Jan 2005 01:04:07 +0100 (CET) Received: from birch.ripe.net (birch.ripe.net [193.0.1.96]) by postman.ripe.net (Postfix) with ESMTP id A567D2509B for <simon(a)limmat.switch.ch>; Thu, 13 Jan 2005 01:04:05 +0100 (CET) Received: from diemen.ripe.net (diemen.ripe.net [193.0.0.213]) by birch.ripe.net (8.12.10/8.11.6) with ESMTP id j0D0458Q014871 for <simon(a)limmat.switch.ch>; Thu, 13 Jan 2005 01:04:05 +0100 Received: (from risops@localhost) by diemen.ripe.net (8.12.10/8.12.6) id j0CNWk6J030328; Wed, 12 Jan 2005 23:32:46 GMT Message-Id: <200501122332.j0CNWk6J030328(a)diemen.ripe.net> X-Authentication-Warning: diemen.ripe.net: risops set sender to myasn-bounce(a)ripe.net using -f X-RIPE-Spam-Level: X-RIPE-Spam-Tests: ALL_TRUSTED,BAYES_00 X-RIPE-Spam-Status: U 0.296466 / -5.9 X-RIPE-Signature: 51f508fc1c86c020a1ee9167b0580d07 X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on diotima.switch.ch X-Spam-Level: From: myASn Notifications <myasn(a)ripe.net> To: simon(a)limmat.switch.ch Subject: New alarms for 559 Date: Wed, 12 Jan 2005 23:32:46 GMT X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.2 Dear myASn contact, New alarms were detected for 559. Please find the details below. Depending on your detail level settings you might not see all the events. Please use the web interface for further details. -- myASn System Advanced alarm 1114 (Default), 130.59.0.0/16 (exceptions not shown), \b(3549|1299|3320)\s(559)\b, MinED: 1, MinEC: 1, ADW: 3600 .=------+---------------+----------------+-----------------+--------------------------+-------------------------=. | RRC | Prefix(es) | Peer(s) | Conflicting ASs | First Seen | Last Seen | |=------+---------------+----------------+-----------------+--------------------------+-------------------------=| | rrc05 | 130.59.0.0/16 | 193.203.0.7 | | Wed Jan 12 21:52:57 2005 | Wed Jan 12 21:53:23 2005 | |=------+---------------+----------------+-----------------+--------------------------+-------------------------=| | rrc03 | 130.59.0.0/16 | 195.69.144.63 | | Wed Jan 12 21:26:36 2005 | Wed Jan 12 21:28:25 2005 | | | | 194.153.154.84 | | | | '=------+---------------+----------------+-----------------+--------------------------+-------------------------='

1 0

create new alarm questions & bugs
by Andrew Partan 20 Jun '05

20 Jun '05

Is there any documentation on the regex in the expected ASpath? None of the alarm types seem to do what I want, so I figured I'd try out advanced & see what happened. I have no transit customers & I know what all of my upstream & peer ASs are, so I want an expected AS path of something like this: <start|anything> (as1|as2|as3) 3944 <end> I figure the regex is sorta like this: (^|\b)(2914|3066)\s(3944)$ but I'm not sure what the difference is between \b and \s nor if all of the ASs should be in () or not. When creating an alarm, I didn't put in any prefix, and when I hit the create, I got "Invalid chars in IP" and the alarm type reset to origin. The fields should have stayed all the same, the error message should have started with something like "Error: ", and the error message have mentioned which field had the error (the Prefix in my case). I was looking at managed alarms, hit edit to change one of my origin alarms, and the create alarm page changed the alarm type from origin to advanced & also cleared the my ASN field. --asp

1 0