- Ris-int - mailman.ripe.net

Your Final Warning From eBay
by billing＠ebay.com 02 Jul '05

02 Jul '05

Dear eBay member, During our regularly schedule account maintenance and verification we have detected a slight error in your billing information on file with eBay. Your card will be used for identification only and will not be charged at any time. By having this type of identification from all users, eBay remains a safe place to buy and sell. Setting up a seller account necessitates valid credit or debit card and checking account information. For automatic payments, your credit card will normally be charged 5 to 7 days after you receive your invoice. Enter and submit the required information. Your account may be suspended for non-payment, and you may be responsible for collection costs. If you don't want to place your card on file, you can enter a different email instead (only certain types of emails can be used, such as those issued by companies, schools, and paid Internet Service providers). Your credit card on file with eBay Card number: XXXX-XXXX-XXXX-XXXX (Not shown for security purposes) Expiration date: 05/08 Please sign in to your eBay account and update your billing information: eBay ID eBay Password If your account information is not update, your ability to sell or bid on eBay will become restricted. Remember: Your personal information is protected by eBay's Privacy Policy. and encrypted by the industry standard SSL software. Thank you, eBay Billing Department

1 0

Monday morning RIS meeeting
by arife＠ripe.net 30 Jun '05

30 Jun '05

Hi all, For Monday morning RIS meeting, I have an agenda point: - Discuss the RIS performance study and also come up with a suggestion how to improve the available structure. Before the meeting, please read the following documentation, all suggestions/feedbacks are welcome. http://iii/sed/twiki/bin/view/SED/RISPerformance#Proposal BTW, if you have any other agenda item please let me know. Arife

1 0

[henk@ripe.net: [ris] Fwd: Bogon announcement mail]
by arife＠ripe.net 29 Jun '05

29 Jun '05

Hi James, Would you be interested in doing it? Arife ----- Forwarded message from Henk Uijterwaal <henk(a)ripe.net> ----- From: Henk Uijterwaal <henk(a)ripe.net> To: ris-int(a)ripe.net, ris(a)ripe.net Subject: [ris] Fwd: Bogon announcement mail Date: Wed, 29 Jun 2005 07:56:56 +0200 Cc: Folks, See below, can you please pick this up so things will be in place when the new /8's arrive. Thanks, Henk >Date: Tue, 28 Jun 2005 15:55:57 +0200 >From: leo vegoda <leo(a)ripe.net> >Organization: RIPE Network Coordination Centre >User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) >Gecko/20040910 >X-Accept-Language: en-us, en >To: henk(a)ripe.net >CC: Filiz Yilmaz <filiz(a)ripe.net>, RS Management <lsd(a)ripe.net> >Subject: Bogon announcement mail > >Hi Henk, > >I want to send a mail about the pilot prefix announcements from the new >IPv4 we're requesting. Before I get Comms to review the style, I'd be >grateful if you could review the content for me. In particular, I'm >concerned regarding the phrase "reachability tools". As far as I can tell, >neither the 'ping' nor 'traceroute' tools on >http://www.ris.ripe.net/cgi-bin/debogon.cgi actually work. Can you let me >know if that's right, and if so, what the schedule to fix them is? > >Thanks, > >-leo > >Dear Colleagues, > >This announcement is being sent to multiple lists. I apologise for >duplicates. > >The RIPE NCC received the IPv4 address range [insert] from the IANA in >June 2005. > >We expect to start making allocations from them within the next few weeks. > >We have started announcing two prefixes from each /8, which originate in >AS12654. > >[insert list of prefixes] > >Details of the BGP announcements, reachability tools and other information >are available on our web site at: > >http://www.ris.ripe.net/debogon/debogon.html > >You may want to update any filters you have in place. > >Kind regards, > > > >-- >leo vegoda "Good enough is not good enough" >RIPE NCC Axel Pawlik >Registration Services Manager 3 June 2005 ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine) ----- End forwarded message -----

1 0

Fwd: Bogon announcement mail
by Henk Uijterwaal 29 Jun '05

29 Jun '05

Folks, See below, can you please pick this up so things will be in place when the new /8's arrive. Thanks, Henk >Date: Tue, 28 Jun 2005 15:55:57 +0200 >From: leo vegoda <leo(a)ripe.net> >Organization: RIPE Network Coordination Centre >User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) >Gecko/20040910 >X-Accept-Language: en-us, en >To: henk(a)ripe.net >CC: Filiz Yilmaz <filiz(a)ripe.net>, RS Management <lsd(a)ripe.net> >Subject: Bogon announcement mail > >Hi Henk, > >I want to send a mail about the pilot prefix announcements from the new >IPv4 we're requesting. Before I get Comms to review the style, I'd be >grateful if you could review the content for me. In particular, I'm >concerned regarding the phrase "reachability tools". As far as I can tell, >neither the 'ping' nor 'traceroute' tools on >http://www.ris.ripe.net/cgi-bin/debogon.cgi actually work. Can you let me >know if that's right, and if so, what the schedule to fix them is? > >Thanks, > >-leo > >Dear Colleagues, > >This announcement is being sent to multiple lists. I apologise for duplicates. > >The RIPE NCC received the IPv4 address range [insert] from the IANA in >June 2005. > >We expect to start making allocations from them within the next few weeks. > >We have started announcing two prefixes from each /8, which originate in >AS12654. > >[insert list of prefixes] > >Details of the BGP announcements, reachability tools and other information >are available on our web site at: > >http://www.ris.ripe.net/debogon/debogon.html > >You may want to update any filters you have in place. > >Kind regards, > > > >-- >leo vegoda "Good enough is not good enough" >RIPE NCC Axel Pawlik >Registration Services Manager 3 June 2005 ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)

1 0

[arife: ANNOUNCEMENT: The RIS Project's Remote Route Collector is online at MSK-IX]
by Arife Vural 27 Jun '05

27 Jun '05

Hi guys, Could you put a link to the following announcement from news page? Thanks. Arife ----- Forwarded message from arife ----- To: ris-users Subject: ANNOUNCEMENT: The RIS Project's Remote Route Collector is online at MSK-IX Date: Thu, 23 Jun 2005 16:51:43 +0200 Dear Colleagues, We are pleased to announce the deployment of the Routing Information Service (RIS) Project's Remote Route Collector, RRC13, at MSK-IX, Moscow. We are now ready to peer with MSK-IX members. We would like to thank Evgueni Kouskevitch and MSK-IX for their help. RRC13 has been operating since April 2005. It has an interface on the shared MSK-IX network. It collects routing information from all exchange members who peer with us. - Our peering address is: 193.232.244.114 - Our AS Number is: 12654 - Our policy: http://www.ripe.net/projects/ris/docs/rrc13.html The RIS started as a RIPE NCC project in 1999. It has grown to over 450 IPv4 and IPv6 peers at 12 data collection points in Europe, Japan and North America. We collect and make available BGP routing information by devising tools that can help ISPs debug problems without being limited to a BGP view. We provide RIS raw data regarding the historical development of the Internet. If you want to peer with the RIS, please send an e-mail to <rispeering(a)ripe.net> or use the form that you can find at: http://www.ris.ripe.net/peerreg.cgi You can find more information about RIS at: http://www.ripe.net/ris/ You can find RIS tools at: http://www.ripe.net/projects/ris/tools/index.html If you have any questions or comments, please send an e-mail to <ris(a)ripe.net>. -- Regards, Arife Vural RIPE NCC ----- End forwarded message -----

3 2

[arife: ANNOUNCEMENT: The RIS Project's Remote Route Collector is online at PAIX.]
by Arife Vural 27 Jun '05

27 Jun '05

Same for this one please. Thanks. Arife ----- Forwarded message from arife ----- To: ris-users Subject: ANNOUNCEMENT: The RIS Project's Remote Route Collector is online at PAIX. Date: Thu, 23 Jun 2005 17:01:54 +0200 Dear All, It looks I forgot to send PAIX box announcement to ris-users lists. Please contact with us if you would be interested in peering with RIS at PAIX. Regards. Arife -- [Apologies for duplicate mails] Dear Colleagues, We are pleased to announce that we have relocated the RIS Project's second North American Remote Route Collector at PAIX, Palo Alto. We are now ready to peer with PAIX members. We would like to thank Paul Vixie and ISC for their help. RRC14, has been operating since December 2004. It has an interface on the shared PAIX network and runs both IPv4 and IPv6. It collects routing information from all exchange members who peer with us. - Our peering addresses are: IPv4: 198.32.176.6 IPv6: 3ffe:80a::9 - Our AS number is: 12654 - Our policy: http://www.ripe.net/projects/ris/docs/rrc14.html The Routing Information Service (RIS) started as a RIPE NCC project in 1999. It has grown to over 300 IPv4 and IPv6 peers at twelve data collection points in Europe, Japan and North America. We collect and make available BGP routing information by devising tools that can help ISPs debug problems without being limited to a BGP view. We provide RIS raw data regarding the historical development of the Internet. If you want to peer with the RIS, please send an e-mail to <rispeering(a)ripe.net> or use the web form that you can find at: http://www.ris.ripe.net/peerreg.cgi You can find more information about RIS at: http://www.ripe.net/ris/ You can find RIS tools at: http://www.ripe.net/projects/ris/tools/index.html If you have any questions or comments, please send an e-mail to <ris(a)ripe.net>. Regards. Arife Vural RIPE NCC ----- End forwarded message -----

1 0

Re: [Brett_Watson@isc.org: Comments regarding a new tool from the Route Views team]
by Rene Wilhelm 23 Jun '05

23 Jun '05

Daniel, To answer your question from June 16th: no this is not exactly riswhois: >> The Route Views team is developing an application to map the changes >> in Origin-AS of IP prefixes over time. RISwhois doesn't keep history, only looks at the latest available RIB dumps, it cannot answer questions on changes in Origin-AS over time. >> The changes in Origin-AS will >> be based on data from current RIR databases. If I get this right, what Route Views intend to do is compare the origin AS data from prefixes seen in BGP feeds with what has been registered in the various routing registries ("RIR databases") and provide random access to the resulting data set. > I wanted to know if what they propose is not covered already by the RIS. > > - I am sure we have the data this needs. > - Do we have a UI that provides what they want? > - Does RISWHOIS provide part of it? > - can we make something like this quickly ourselves? We could modify RISwhois to (when asked with a flag) query a Routing Registry and compare the BGP origin with the registered origin, but that still wouldn't provide history. The current RIS DB does have history and could at least answer the question if the BGP origin AS has changed in the time period covered by the DB. However, it does not have any info on the *registered* origin AS; also the 3 months usually covered by RIS DB might be a bit short when looking back in history. As I see it, to provide the desired functionality, we'd need a DB with tables for RIS and IRR storing for each prefix a time series of origin AS (prefix_id, originAS, first, last). For convenience, you could add a flag indicating whether or not the origin matched the IRR during the whole (first,last) time period. Things get a bit tricky when RIS reports multiple origins. One could either do "majority voting" (origin seen by most RIS peers wins) or list both (all) origins seperated by e.g. a / Also, the odd cases of origin being an AS-set (like 84.205.73.0/24, 84.205.89.0/24 :) can be handled in several ways. -- Rene > ----- Forwarded message from Daniel Karrenberg <daniel.karrenberg(a)ripe.net> ----- > > From: Daniel Karrenberg <daniel.karrenberg(a)ripe.net> > To: RIPE NCC RIS Project People <ris(a)ripe.net> > Subject: [ris] [Brett_Watson(a)isc.org: Comments regarding a new tool from the > Route Views team] > Date: Thu, 16 Jun 2005 09:21:24 +0200 > Cc: > Mail-Followup-To: RIPE NCC RIS Project People <ris(a)ripe.net> > > Isn't this riswhois or do we not already have that? > > ----- Forwarded message from brett watson <Brett_Watson(a)isc.org> ----- > > Date: Wed, 15 Jun 2005 14:45:48 -0700 > From: brett watson <Brett_Watson(a)isc.org> > To: all(a)oarc.isc.org > Subject: Comments regarding a new tool from the Route Views team > X-RIPE-Spam-Level: > X-RIPE-Spam-Tests: BAYES_00 > X-RIPE-Spam-Status: N 0.000000 / -2.6 > > We received a request from Dave Meyer (part of the U. of Oregon Route > Views team) for feedback on a new tool they are building. For those > that don't know, the Route Views team (www.routeviews.org) collects, > logs, and provides real-time access to global routing data. We (the > OARC Secretariat) wanted to float this to the general membership for > any input you all might have regarding the current features of this > tool, or enhancements you believe OARC members might find useful. > > The Route Views team is developing an application to map the changes > in Origin-AS of IP prefixes over time. The changes in Origin-AS will > be based on data from current RIR databases. The Route Views team > envisioned this as a useful tool for providers to use until some form > of s*BGP is deployed, to help track down "hi-jacked" routes, and for > spam mitigation. The data may be searched via: > > - specific time/date > - time/date range > - frequency of changes (ie. last 10 origin-as changes for a > specific prefix) > > In addition, the Route Views team is considering using MRT to > visualize the output. The team asked for input on the questions > included below, and we would love to hear any member input/comments > on these questions/answers before we respond to Dave. Feel free to > send this to the all@ list for general discussion, or to me > personally and I will tabulate everything and send back to the list > one last time. > > > Questions from Route Views team > =========================== > > (i). Would you find this type of application useful, and for what > purposes? > > We envision a tool like this being useful for the DNS-OARC community > in several areas: > > DNS Anycast Experimentation - Visualizing the changes in Origin-AS > during an anycast experiment where an anycast prefix is announced/ > withdrawn over the course of several days, in order to better > understand the impact of anycast on the DNS. > > DSC Data Correlation - We have a recent example of how this kind of > tool would be useful. Several months ago, F-root saw a large "spike" > in queries that lasted for several days. After the spike subsided, > we were able to identify the source IP address of the spike but no > route existed in the global routing tables for the source IP. By > manually downloading historical data from route-views, we ascertained > that the source IP address was indeed announced by a different ISP > than current whois data would indicate should be announcing it. The > implications of having the ability to query for Origin-AS changes in > near real-time are obvious in this case. > > General DNS Data Correlation - Any statistics obtained about the DNS > (such as RIPE's dnsmon) could be correlated with changes in Origin-AS > to either validate or invalidate theories on DNS behavior. > > > (ii). What other features would you like to see? > > The usefulness of comparing actual Origin-AS data with RIR database > information is questionable, given the historical inaccuracies in RIR > data but in some cases the RIR data may give us a useful baseline. > > It seems that overall changes in the AS *path* may also be useful, in > addition to just the Origin-AS. > > > (iii). How would you like to see the output visualized? > > MRT seems like a fine method for visualizing the data. The BGPlay > application is a great way to visualize data from the RIPE RIS and > route-views data. > > > > -b > -- > Brett Watson > DNS Operations, Analysis, and Research Center > > ----- End forwarded message ----- > > ----- End forwarded message -----

2 1

RIS meeting on Monday
by Henk Uijterwaal 22 Jun '05

22 Jun '05

Arife, others, Can we please have a RIS meeting next Monday (20/6)? I have 2 agenda topics: - Outcome of discussion with LACNIC to install an RRC at their site. This came up during RIPE50. They wanted to install TB's in Brazil and during the discussion, we realized that an RRC in Brazil (at the Sao Paolo IX) would be useful as well. I want to summarize the discussion and see if our plans have any sense of reality. - myASN feature requests. I got a few of them. Thanks, Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)

5 6

[simon@limmat.switch.ch: [ris-int] Suggestion for improvement of myASN alarms]
by arife＠ripe.net 20 Jun '05

20 Jun '05

Hi Henk, It looks I got back this guy. You can check it out from here. http://www.ris.ripe.net/myasn/bugs.html There is also ticket number there. Arife ----- Forwarded message from Simon Leinen <simon(a)limmat.switch.ch> ----- From: Simon Leinen <simon(a)limmat.switch.ch> To: ris-int(a)ripe.net Subject: [ris-int] Suggestion for improvement of myASN alarms Date: Mon, 20 Jun 2005 09:57:00 +0200 Dear RIS team, I frequently receive alerts from MyASN, and I think it's because I have only specified our "transit" providers' ASNs in the "transit" alarm for 130.59.0.0/16. Unfortunately, these alerts don't contain the AS path that was seen (and that didn't match the regular expression I specified). So it's hard for me to fix the definition of the alarm. Please consider adding a column with the AS-path information to the table in the alert messages. Thanks & regards, -- Simon. Received: from chx400.switch.ch ([130.59.10.2]) by central.switch.ch with esmtp (Exim 3.20 #1) id 1CosTA-0006gM-00 for simon(a)switch.ch; Thu, 13 Jan 2005 01:04:08 +0100 Received: from postman.ripe.net ([193.0.0.199]) by chx400.switch.ch with esmtp (Exim 3.20 #1) id 1CosT9-0004Kg-00 for simon(a)limmat.switch.ch; Thu, 13 Jan 2005 01:04:08 +0100 Received: by postman.ripe.net (Postfix, from userid 8) id C27D525093; Thu, 13 Jan 2005 01:04:07 +0100 (CET) Received: from birch.ripe.net (birch.ripe.net [193.0.1.96]) by postman.ripe.net (Postfix) with ESMTP id A567D2509B for <simon(a)limmat.switch.ch>; Thu, 13 Jan 2005 01:04:05 +0100 (CET) Received: from diemen.ripe.net (diemen.ripe.net [193.0.0.213]) by birch.ripe.net (8.12.10/8.11.6) with ESMTP id j0D0458Q014871 for <simon(a)limmat.switch.ch>; Thu, 13 Jan 2005 01:04:05 +0100 Received: (from risops@localhost) by diemen.ripe.net (8.12.10/8.12.6) id j0CNWk6J030328; Wed, 12 Jan 2005 23:32:46 GMT Message-Id: <200501122332.j0CNWk6J030328(a)diemen.ripe.net> X-Authentication-Warning: diemen.ripe.net: risops set sender to myasn-bounce(a)ripe.net using -f X-RIPE-Spam-Level: X-RIPE-Spam-Tests: ALL_TRUSTED,BAYES_00 X-RIPE-Spam-Status: U 0.296466 / -5.9 X-RIPE-Signature: 51f508fc1c86c020a1ee9167b0580d07 X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on diotima.switch.ch X-Spam-Level: From: myASn Notifications <myasn(a)ripe.net> To: simon(a)limmat.switch.ch Subject: New alarms for 559 Date: Wed, 12 Jan 2005 23:32:46 GMT X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.2 Dear myASn contact, New alarms were detected for 559. Please find the details below. Depending on your detail level settings you might not see all the events. Please use the web interface for further details. -- myASn System Advanced alarm 1114 (Default), 130.59.0.0/16 (exceptions not shown), \b(3549|1299|3320)\s(559)\b, MinED: 1, MinEC: 1, ADW: 3600 .=------+---------------+----------------+-----------------+--------------------------+-------------------------=. | RRC | Prefix(es) | Peer(s) | Conflicting ASs | First Seen | Last Seen | |=------+---------------+----------------+-----------------+--------------------------+-------------------------=| | rrc05 | 130.59.0.0/16 | 193.203.0.7 | | Wed Jan 12 21:52:57 2005 | Wed Jan 12 21:53:23 2005 | |=------+---------------+----------------+-----------------+--------------------------+-------------------------=| | rrc03 | 130.59.0.0/16 | 195.69.144.63 | | Wed Jan 12 21:26:36 2005 | Wed Jan 12 21:28:25 2005 | | | | 194.153.154.84 | | | | '=------+---------------+----------------+-----------------+--------------------------+-------------------------=' ----- End forwarded message -----

1 0

Suggestion for improvement of myASN alarms
by Simon Leinen 20 Jun '05

20 Jun '05

Dear RIS team, I frequently receive alerts from MyASN, and I think it's because I have only specified our "transit" providers' ASNs in the "transit" alarm for 130.59.0.0/16. Unfortunately, these alerts don't contain the AS path that was seen (and that didn't match the regular expression I specified). So it's hard for me to fix the definition of the alarm. Please consider adding a column with the AS-path information to the table in the alert messages. Thanks & regards, -- Simon. Received: from chx400.switch.ch ([130.59.10.2]) by central.switch.ch with esmtp (Exim 3.20 #1) id 1CosTA-0006gM-00 for simon(a)switch.ch; Thu, 13 Jan 2005 01:04:08 +0100 Received: from postman.ripe.net ([193.0.0.199]) by chx400.switch.ch with esmtp (Exim 3.20 #1) id 1CosT9-0004Kg-00 for simon(a)limmat.switch.ch; Thu, 13 Jan 2005 01:04:08 +0100 Received: by postman.ripe.net (Postfix, from userid 8) id C27D525093; Thu, 13 Jan 2005 01:04:07 +0100 (CET) Received: from birch.ripe.net (birch.ripe.net [193.0.1.96]) by postman.ripe.net (Postfix) with ESMTP id A567D2509B for <simon(a)limmat.switch.ch>; Thu, 13 Jan 2005 01:04:05 +0100 (CET) Received: from diemen.ripe.net (diemen.ripe.net [193.0.0.213]) by birch.ripe.net (8.12.10/8.11.6) with ESMTP id j0D0458Q014871 for <simon(a)limmat.switch.ch>; Thu, 13 Jan 2005 01:04:05 +0100 Received: (from risops@localhost) by diemen.ripe.net (8.12.10/8.12.6) id j0CNWk6J030328; Wed, 12 Jan 2005 23:32:46 GMT Message-Id: <200501122332.j0CNWk6J030328(a)diemen.ripe.net> X-Authentication-Warning: diemen.ripe.net: risops set sender to myasn-bounce(a)ripe.net using -f X-RIPE-Spam-Level: X-RIPE-Spam-Tests: ALL_TRUSTED,BAYES_00 X-RIPE-Spam-Status: U 0.296466 / -5.9 X-RIPE-Signature: 51f508fc1c86c020a1ee9167b0580d07 X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on diotima.switch.ch X-Spam-Level: From: myASn Notifications <myasn(a)ripe.net> To: simon(a)limmat.switch.ch Subject: New alarms for 559 Date: Wed, 12 Jan 2005 23:32:46 GMT X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.2 Dear myASn contact, New alarms were detected for 559. Please find the details below. Depending on your detail level settings you might not see all the events. Please use the web interface for further details. -- myASn System Advanced alarm 1114 (Default), 130.59.0.0/16 (exceptions not shown), \b(3549|1299|3320)\s(559)\b, MinED: 1, MinEC: 1, ADW: 3600 .=------+---------------+----------------+-----------------+--------------------------+-------------------------=. | RRC | Prefix(es) | Peer(s) | Conflicting ASs | First Seen | Last Seen | |=------+---------------+----------------+-----------------+--------------------------+-------------------------=| | rrc05 | 130.59.0.0/16 | 193.203.0.7 | | Wed Jan 12 21:52:57 2005 | Wed Jan 12 21:53:23 2005 | |=------+---------------+----------------+-----------------+--------------------------+-------------------------=| | rrc03 | 130.59.0.0/16 | 195.69.144.63 | | Wed Jan 12 21:26:36 2005 | Wed Jan 12 21:28:25 2005 | | | | 194.153.154.84 | | | | '=------+---------------+----------------+-----------------+--------------------------+-------------------------='

1 0

create new alarm questions & bugs
by Andrew Partan 20 Jun '05

20 Jun '05

Is there any documentation on the regex in the expected ASpath? None of the alarm types seem to do what I want, so I figured I'd try out advanced & see what happened. I have no transit customers & I know what all of my upstream & peer ASs are, so I want an expected AS path of something like this: <start|anything> (as1|as2|as3) 3944 <end> I figure the regex is sorta like this: (^|\b)(2914|3066)\s(3944)$ but I'm not sure what the difference is between \b and \s nor if all of the ASs should be in () or not. When creating an alarm, I didn't put in any prefix, and when I hit the create, I got "Invalid chars in IP" and the alarm type reset to origin. The fields should have stayed all the same, the error message should have started with something like "Error: ", and the error message have mentioned which field had the error (the Prefix in my case). I was looking at managed alarms, hit edit to change one of my origin alarms, and the create alarm page changed the alarm type from origin to advanced & also cleared the my ASN field. --asp

1 0

alarm create error
by Andrew Partan 20 Jun '05

20 Jun '05

I was creating alarms for AS 3944 and got this: System error error: DBI connect('myasn;host=193.0.0.210;port=3306','myasn',...) failed: Can't connect to MySQL server on '193.0.0.210' (111) at /usr/local/lib/perl5/site_perl/5.8.0/Alzabo/Driver/MySQL.pm line 188 Stack: [/usr/local/perl5.8.0/lib/perl5/5.8.0/Carp.pm:191] [/usr/local/lib/perl5/site_perl/5.8.0/mach/DBI.pm:596] [/usr/local/lib/perl5/site_perl/5.8.0/mach/DBI.pm:646] [/usr/local/lib/perl5/site_perl/5.8.0/Alzabo/Driver/MySQL.pm:188] [/usr/local/lib/perl5/site_perl/5.8.0/Alzabo/Driver/MySQL.pm:35] [/usr/local/lib/perl5/site_perl/5.8.0/Alzabo/Runtime/Schema.pm:122] [/home/risops/myasn/lib/RIPE/NCC/myASn/Data.pm:134] [/export/risfsa13/www/ris/myasn/newalarm.html:146] [/export/risfsa13/www/ris/myasn/autohandler.html:69] [/export/risfsa13/www/ris/myasn/syshandler:29] code stack: I hit the back button & redid the create & it worked just fine the 2nd time. --asp

1 0

Re: R: RIPE-NCC Testbox Order
by Henk Uijterwaal 20 Jun '05

20 Jun '05

Hi, In a related discussion At 16:29 06/06/2005, Stefano Pasquini wrote: [...] >Also the RIS project for us is a lot interesting and would want to >participate, do you have some suggestions for this service? >Many thanks for your support. This is the Vatican city Internet office, obviously located in Rome. Perhaps we can set up peering with them in Milano. Can you contact him to sort this out? Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)

2 2

Time Out 07.07.2005:09:00 - 14.07.2005:18:00
by Arife Vural 17 Jun '05

17 Jun '05

<<<DO NOT CHANGE THE TIME/DATE/TYPE OF TIMEOUT HERE>>> <<<THAT WON'T BE REFLECTED IN CTIME. IF YOU WANT TO>>> <<<MAKE SUCH CHANGES, CANCEL THE STT AND START OVER>>> Dear Colleagues, Please note the following time out: Who: Arife Vural First Day: 07.07.2005 Starts at: 09:00 Last Day: 14.07.2005 Ends at: 18:00 Working days: [6.00] Type: VAC Reason: [Turkey] If you have any further questions, please do not hesitate to contact me. Thank you, Arife Vural

1 0

Re: RRC13 & RRC14 announcements
by Rene Wilhelm 15 Jun '05

15 Jun '05

Hi Arife, Announcing to IX lists is one thing, but we also *used* to announce to the public at large! A news flash on RIPE NCC homepage, an item in the RIS news page, a mail to ris-users list etc. That hasn't happened since RRC12 last year. The RIS news at http://www.ripe.net/projects/ris/news.html mentions RRC08 leaving MAE WEST in september last year, but no word on it returning as RRC14 at PAIX. -- Rene > We announced RRC14, we sent the e-mail indiviually all the peers. > Since PAIX does not have IX maillinglist. At that time, when we discussed > to send it to NANOG mailling list but ISC guys somehow did not like > the idea I do not know remember the reason now. > > We did not announce RRC13 yet. I sent the announcement to Russian > guy, he would translate and forward to IX maillinglist, but I have not > heard from him. I will ping him. > > Arife

4 4

Draft announcement to nanog
by Lorenzo Colitti 15 Jun '05

15 Jun '05

Hi Henk, here's the announcement I was thinking of sending to nanog. What do you think? Cheers, Lorenzo ==========================8<-------------------------- From: lorenzo(a)ripe.net To: routing-wg(a)ripe.net, nanog(a)merit.edu Cc: henk(a)ripe.net, compunet(a)dia.uniroma3.it Hi, as part of our AS-set stuffing experiments (described, including links to in-depth information, in [1]), we will be announcing unusually large AS-sets on Thursday 16 June. The prefixes involved will be 84.205.73.0/24 and 84.205.89.0/24, both originating in AS12654. The AS-sets will consist of AS12654 repeated n times, thus, the paths will look like 12654 {12654, 12654, ..., 12654}. No other AS numbers will be used. The values of n we will use are 25, 50, 75 and 100. The announcements are designed to measure the effectiveness of our techniques in today's Internet with today's IPv4 operational practices. This is *not* a test to see if routers will fall over: we have successfully tested longer AS-sets in the lab on both Cisco and Juniper, and longer AS-paths and AS-sets have been observed in the wild [2,3]. See [1] for more information on the safety of these announcements. The proposed schedule is as follows: 84.205.73.0/24 84.205.89.0/24 14:00 UTC: 25-element AS-set 50-element AS-set 14:30 UTC: withdrawal withdrawal 16:00 UTC: 75-element AS-set 100-element AS-set 16:30 UTC: withdrawal withdrawal If anyone should see a problem during the announcements, please contact me and I will take immediate action. Regards, Lorenzo [1] http://www.merit.edu/mail.archives/nanog/2005-06/msg00210.html [2] http://www.ripe.net/projects/ris/Talks/0101_RIPE38_AA/sld003.html [3] http://www.ripe.net/maillists/ncc-archives/ris-users/2002/msg00044.html -- lorenzo(a)ripe.net colitti(a)dia.uniroma3.it www.ripe.net www.dia.uniroma3.it/~compunet RIPE NCC Roma Tre Computer Networks research group

2 1

Announcing new AS-set stuffing experiments?
by Lorenzo Colitti 13 Jun '05

13 Jun '05

Hi ris-int, since nanog's reaction to my post explaining our AS-set stuffing techniques generated fewer flames than expected, I was thinking of announcing AS-set stuffing experiments over IPv4 today or tomorrow. I would start with an experiment to determine how far large AS-sets penetrate into the Internet. Idea: announce progressively longer AS-sets containing only AS 12654 (so AS-paths like 12654 {n * 12654}) and see if the large AS-sets survive all the way to the RRCs or not. This would: a) provide results we need b) eliminate some opposition by showing that large AS-sets are safe c) not irritate people because we're only using our own ASn The values of n would be 5, 10, 20, 50, 75, 100. This is well below the safety limit we have seen with Ciscos (254). Once that is done, I would announce other experiments using other people's ASes, saying that people can opt-out if they don't want their AS to appear. Thoughts? Cheers, Lorenzo -- --------------------------------------------------------- Lorenzo Colitti Ph.D student Computer Networks research group Roma Tre University colitti(a)dia.uniroma3.it +39-0655173215 ---------------------------------------------------------

1 0

Re: [ris-int] Re: RRC13 & RRC14 announcements
by James Aldridge 10 Jun '05

10 Jun '05

Arife Vural wrote: > We did not announce RRC13 yet. I sent the announcement to Russian > guy, he would translate and forward to IX maillinglist, but I have not > heard from him. I will ping him. Email list for the MCK-IX is <msk-ix(a)ripn.net>. They also have a route server there which Evgueni Kouskevitch offered a peering with (this was all happenning just before RIPE50 so things were somewhat busy on the OPS side). James

1 0

Re: RRC13 & RRC14 announcements
by Henk Uijterwaal 10 Jun '05

10 Jun '05

Shane, Arife, See below, sorry for the Dutch. Bottom line: Rene noticed that we never announced the existence of RRC13 and 14, and thus do not have any peering sessions there yet. In particular after all the trouble to get the Moscow RRC running, that seems like a waste of time. Matthew used to do these announcements in the past, but he left. I guess I assumed that you'd do this, but then again I don't know if we ever agreed this. I'm happy to do this though. So, do you want to send an announcement or should we do this? Henk At 14:18 09/06/2005, Rene Wilhelm wrote: >Henk, > >Tijdens het werken aan ripe50 routing minutes vroeg ik me af of >RRC13 (moskou) en RRC14 (palo alto, former rrc08) ooit aangekondigd waren >aan de community. Matthew deed dat in het verleden. > >Zojuist heb ik even zitten rond kijken op www.ripe.net en voorzover ik kan >zien is er nooit iets gemeld over deze 2 route collectors. :( > >Het laatste news item over RIS in http://www.ripe.net/news/ >dateert van 20 july 2004, "announcing RRC12 / DE-CIX" > >http://www.ripe.net/projects/ris/news.html gaat ietsje verder maar heeft >ook niets over de RRC13/14, de laatste melding daar is van 30 sept 2004, >"BGPlay upgraded". > >In de ris-users lijst is de laatste RRC gerelateerde mail de aankondiging >van 1 september 2004, over de verhuizing van de RRC08/MAE-WEST. Hoewel >beloofd, is er nooit een follow up geweest waarin de activering van (nu) >RRC14 in PAIX werd aangekondigd. > >Tenslotte viel me op dat RRC13/Moskou tot nu toe geen enkele peering sessie >lijkt te hebben, alle ruwe data files op halfweg zijn (uncompressed) 0 bytes >lang. Toch wel zonde van alle inspanningen om die box aan de praat te >krijgen. > > >-- Rene ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)

2 1

Re: NCC#2002092793 [ris-int] RIS hijacking 195.80.239.0/24
by Rene Wilhelm 09 Jun '05

09 Jun '05

Hi Arife, I understand it's a difficult issue; fortunately we're left with only 1 debogon prefix: whois -h riswhois -F -M 87/8 |grep 12654 12654 87.255.248.0/21 1 The other one, 87.192.0.0/16, is now announced by AS25441 and seen by 64 RIS peers. Perhaps all it takes to clear the bogus debogon is for a new owner to insert a fresh announcement? If you want to continue contacting every AS which according to the routing tables sees the debogon route, you could also check route-views' routers for info. For example, @oregon-ix: x27$ telnet route-views.oregon-ix.net [...] route-views.oregon-ix.net>sh ip bgp 87.255.248.0/21 BGP routing table entry for 87.255.248.0/21, version 60855137 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 3277 6820 3246 5400 5400 3257 28747 12654 194.85.4.55 from 194.85.4.55 (194.85.4.55) Origin IGP, localpref 100, valid, external, best Community: 3277:6820 3277:65361 Only the "5400 3257 28747 12654" part is in common with RIS, the other ASNs are different. Cheers, -- Rene > Hi Mike, > > I'm chasing those guys who still think we announce that prefix. But I have > not got any useful info from them. Last, I contacted with AS9177, but I > have not got any reply back. > > I attached the e-mail that I got from Tiscali, it looks this route still > is hanging there because of a Cisco bug or maybe other vendor OS bugs. > I do not know what else I could do be honest ... > > Arife > > -- > > From: Alexander Koch <koch(a)tiscali.net> > To: Arife Vural <arife(a)ripe.net> > Subject: Re: Need a favor > Message-ID: <20050608120049.GA21021(a)shekinah.ip.tiscali.net> > References: <20050608120017.GC22290(a)ripe.net> > Mime-Version: 1.0 > Content-Type: text/plain; charset=us-ascii > Content-Disposition: inline > In-Reply-To: <20050608120017.GC22290(a)ripe.net> > Organization: Tiscali International Network B.V. > X-NCC-RegID: eu.nacnet > User-Agent: Mutt/1.5.9i > X-RIPE-Spam-Level: > X-RIPE-Spam-Tests: BAYES_00 > X-RIPE-Spam-Status: U 0.298951 / -2.6 > X-RIPE-Signature: f24e950eeaafece3eb369dee26ae860b > Status: RO > Content-Length: 1707 > Lines: 50 > > Hello Arife, > > what you see is probably comparable to IPv6 ghosts routes > where a /35 more specific route sticked in the routing table > long after it was theoretically withdrawn. > > We currently do not see the route from RealROOT, but then, > AS28747 was changed to AS 9009 two weeks ago or so. Also > seeing the AS path I believe you can safely assume AS5400 > (BT's backbone) is not seeing it either... your best bet > might be to contact bgp(a)sunrise.net and/or AS9177 directly. > > Does that help? > > Best regards, > Alexander > > On Wed, 8 June 2005 14:00:17 +0200, Arife Vural wrote: > > Hi Alexander, > > > > Part of De-bogonising project we were announcing 87/8. We stopped it > > for a while, but it's seen in routing tables. Be honest, I could not > > explain why this route was still in the routing tables even if we do > > not have any entries in our config file for that prefix. > > > > On rrc00, it's seen like that, > > > > rrc00> sh ip bgp 87.255.248.0/21 > > BGP routing table entry for 87.255.248.0/21 > > Paths: (1 available, best #1, table Default-IP-Routing-Table) > > Not advertised to any peer > > 9177 6730 5400 3257 28747 12654 > > 212.47.190.1 from 212.47.190.1 (213.193.66.42) > > Origin IGP, localpref 100, valid, external, best > > Last update: Wed Jun 8 10:20:46 2005 > > > > I contacted with AS28747, but could not get any reply back to check > > whether they get this prefix from us or not. > > > > I would like to ask you to check whether you get this prefix from AS28747. > > If so, not sure but resetting the session with AS28747 would make any help? > > > > Kind regards. > > > > Arife > > -- > Alexander Koch <koch(a)tiscali.net> / ako4-ripe > Tiscali Int., Peering Coordination > Phone +49 6103 916 480, Fax +49 6103 916 464 > > On Tue, Jun 07, 2005 at 10:13:17AM +0200, RIPE NCC Hostmaster wrote: > > Dear Colleagues, > > > > It's quiet in this ticket for quite a while, while on the Net it's not > > so quiet: the ranges are still (again?) announced and visible > > (in case you don't know): > > > > route: 87.255.248.0/21 > > origin: AS12654 > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > lastupd-frst: 2005-06-05 14:10Z 212.47.190.1@rrc00 > > lastupd-last: 2005-06-05 14:10Z 212.47.190.1@rrc00 > > seen-at: rrc00 > > num-rispeers: 1 > > source: RISWHOIS > > > > We are still curious when is it going to stop. > > > > > > -- > > Sincerely, > > > > Mike Petuschak > > RIPE NCC > > > > > > > > > Hi Arife, > > > > > > Thanks for the update. > > > > > > Today RISwhois only sees 1 (one) peer at rrc00 forwarding the > > > old debogon announcments from 87/8: > > > > > > route: 87.192.0.0/16 > > > origin: AS12654 > > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > > lastupd-frst: 2005-06-01 10:11Z 212.47.190.1@rrc00 > > > lastupd-last: 2005-06-01 10:11Z 212.47.190.1@rrc00 > > > seen-at: rrc00 > > > num-rispeers: 1 > > > source: RISWHOIS > > > > > > route: 87.255.248.0/21 > > > origin: AS12654 > > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > > lastupd-frst: 2005-06-01 10:11Z 212.47.190.1@rrc00 > > > lastupd-last: 2005-06-01 10:11Z 212.47.190.1@rrc00 > > > seen-at: rrc00 > > > num-rispeers: 1 > > > source: RISWHOIS > > > > > > > > > The last update is yesterday, 10:11 UTC (14:11 local time) > > > is that when you reset the session with AS28747? > > > > > > -- Rene

2 1

Re: updated libbgpdump
by Arife Vural 09 Jun '05

09 Jun '05

Hi Larry, Thanks getting back to me quickly. This week I will look at the changes you made and submit to CVS, also my plan is to put this lib into our public CVS. I will let you know about the progress. Regards. Arife On Tue, May 24, 2005 at 05:19:07PM -0400, Larry J. Blunk wrote: > Hi all, > Good to see you at NANOG. I've attached our updates to > the libbgpdump code. Here's a list of our changes -- > > 1) Fixed memleak in bgpdump_free_mp_info() > 2) Created new_bgpdump_open_dump() library interface with > option flags to control desired level of parsing of data. > 3) Improved efficiency of mstream code (added macros). > 4) Added support for older MRTD format BGP messages (used > for early RIPE RIS collection). > 5) Added length field sanity check for corrupted data. > 6) Improved tracking of truncated messages (Zebra bug). > > > -Larry Blunk > Merit > >

2 2

Re: [ris-int] RIS hijacking 195.80.239.0/24 NCC#2002092793
by Rene Wilhelm 08 Jun '05

08 Jun '05

Hi Arife, Last friday I wrote: > Something still seems wrong, riswhois still sees the prefix in the dumps > and presumably looking glass will also report them. (no time to check > those right now): Checking looking glasses today, 195.80.239.0/24 is no longer seen. RISwhois still sees it, but that's due to rrc12 raw data not making it to halfweg.ripe.net since thursday May 26th. (subject of another ris(a)ripe.net ticket) However, the debogon prefixes 87.192.0.0/16 and 87.255.248.0/21 are still seen in the RRC looking glasses: http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC051&query=1&arg=87.192.… http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC051&query=1&arg=87.255.… http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC001&query=1&arg=87.255.… http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC001&query=1&arg=87.192.… If you or James or someone else took specific action to make 195.80.239.0/24 go away, you may want to do the same for these prefixes under 87/8. Cheers, -- Rene

4 9

Urgent Notification
by Paypal Security Center 08 Jun '05

08 Jun '05

1 0

TKO Notice: ***Urgent Safeharbor Department Notice***
by aw-confirm＠eBay.com 07 Jun '05

07 Jun '05

1 0

Urgent Notification
by Paypal Security Center 03 Jun '05

03 Jun '05

1 0