July 2002 - NANOG - lists.nanog.org

Fwd: Re: ELF/Scalper-A Spreading?
by senthil ayyasamy 26 Jul '02

26 Jul '02

--- Jeff Shultz <jeffshul(a)wvi.com> wrote: > Date: Fri, 26 Jul 2002 08:24:34 -0700 > From: "Jeff Shultz" <jeffshul(a)wvi.com> > To: "senthil ayyasamy" <mplsgeek(a)yahoo.com> > Subject: Re: ELF/Scalper-A Spreading? > > http://www.glocksoft.com/trojan_list/Kuang2_the_virus.htm > Apparently > not very new. (May 1999) > > Feel free to forward to NANOG - I don't have posting > priviliges. > > *********** REPLY SEPARATOR *********** > > On 7/25/2002 at 9:18 PM senthil ayyasamy wrote: > > >> > But activity in more across 17300. > >> > > >> > (http://www.dshield.org/port_report.php?port=17300) > >> > what might be the reason? > >> > >> yeah. > > > >I have read somewhere that 17300 is used by a new > >virus called *Kuang2 Virus*. Have anyone heard of > such > >names? > > > >__________________________________________________ > >Do You Yahoo!? > >Yahoo! Health - Feel better, live better > >http://health.yahoo.com > > > > -- > Jeff Shultz > Network Support Technician > Willamette Valley Internet > 503-769-3331 (Stayton) > 503-390-7000 (Salem) > tech(a)wvi.com > __________________________________________________ Do You Yahoo!? Yahoo! Health - Feel better, live better http://health.yahoo.com

1 0

Re: ELF/Scalper-A Spreading?
by Drew Linsalata 26 Jul '02

26 Jul '02

Doh! That was a typo in my original message. I meant UDP port 2001. Drew Linsalata The Gotham Bus Company Internet Server and Carrier Neutral Co-Location http://www.gothambus.com > Most of the 'I got flodoed by apache wormed machines' floods are udp/2001 > not 2100... you sure its 2100 in your acls? > >> >> Our border ACLs are catching about three thousand UDP/2100 hits every minute >> tonight. Is anyone else seeing this? It seems as if ELF/Scalper-A (the >> Apache/FreeBSD worm) is spreading. >>

1 0

ELF/Scalper-A Spreading?
by Drew Linsalata 26 Jul '02

26 Jul '02

Our border ACLs are catching about three thousand UDP/2100 hits every minute tonight. Is anyone else seeing this? It seems as if ELF/Scalper-A (the Apache/FreeBSD worm) is spreading. Drew Linsalata The Gotham Bus Company Internet Server and Carrier Neutral Co-Location http://www.gothambus.com

3 3

RE: Draft of Rep. Berman's bill authorizes anti-P2P hacking
by Rowland, Alan D 25 Jul '02

25 Jul '02

Yep. They don't like playing whack-a-mole any more than we do. Maybe we'd be better off asking if we could add spamming to this bill... =0 Best regards, _________________________ Alan Rowland -----Original Message----- From: Dean Anderson [mailto:dean@av8.com] Sent: Thursday, July 25, 2002 3:12 PM To: Rowland, Alan D Cc: nanog(a)merit.edu Subject: RE: Draft of Rep. Berman's bill authorizes anti-P2P hacking Best you can do is shutdown people on complaints. --Dean

1 0

Re: PASSIVE [D]WDM... Like, Cisco 15216.
by rs＠seastrom.com 25 Jul '02

25 Jul '02

Mikael Abrahamsson <swmike(a)swm.pp.se> writes: > There should be quite a few manufacturers making units like these, I know > the MRV people does it as well (or some company within MRV). here's another: http://www.opticalaccess.com/products-ld.shtml Disclaimer: I'm not affiliated with the company, I'm not even a satisfied customer, I'm just some guy who typed "optical transponder DWDM" into Google and shoveled through what came out. ---rob

1 0

RE: Draft of Rep. Berman's bill authorizes anti-P2P hacking
by Rowland, Alan D 25 Jul '02

25 Jul '02

First I agree that this is BAD on general principle but... IANAL but IMHO spewing cracked copies of say, Photoshop, or other copyright violations might be considered probable cause with the specific place/things being the share program and it's contents. Sharing the content of your favorite program/CD/DVD with the world has never met "fair use." I had significant input in my life regarding the difference between "can" and "may." IMHO significant numbers of net citizens have forgotten that difference. Just my 2¢. Best regards, _________________________ Alan Rowland -----Original Message----- From: Joseph T. Klein [mailto:jtk@titania.net] Sent: Thursday, July 25, 2002 12:16 PM To: Marshall Eubanks; nanog(a)merit.edu Subject: Re: Draft of Rep. Berman's bill authorizes anti-P2P hacking I would argue that my home computer is the repository of my papers and effects. No place in the below law does it limit the restriction to the government only. Indeed any law passed giving sanction to any party having the right IMHO is in direct violation of both the spiret and the letter of the Bill of Rights. Amendment IV The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. The dogs of stupidy have been unleashed. --On Wednesday, 24 July 2002 12:40 -0400 Marshall Eubanks <tme(a)multicasttech.com> wrote: > > Thought this would be considered on-topic as guess who would have to > clean up the resulting messes... > > Regards > Marshall Eubanks -- Joseph T. Klein jtk(a)titania.net "... preserve, protect and defend the constitution ..." -- Presidential Oath of Office

3 2

RE: How secure should it be? (was RE: password stores?)
by Rowland, Alan D 25 Jul '02

25 Jul '02

Ah, There's the rub. Access has a range from open to closed. The point you choose along that line directly effects cost and ease of use. Put another way, "Careful what you ask for, you may get it." Best regards, _________________________ Alan Rowland To quote another NANOG poster's sig file that applies to this discussion: "Wrong questions are the leading cause of wrong answers." -----Original Message----- From: Sean Donelan [mailto:sean@donelan.com] Sent: Wednesday, July 24, 2002 10:19 PM To: nanog(a)merit.edu Subject: How secure should it be? (was RE: password stores?) snip... Should we secure routers better, worse or the same as burglar alarms? While I agree there are settings which are insecure, its seems like we haven't figured out the optimum level of security yet. Which may be less than what the experts think.

1 0

proposed changes in national "cyber security"
by Fred Heutte 25 Jul '02

25 Jul '02

http://www.cdt.org/publications/pp_8.15.shtml#2 (2) NEW DEPARTMENT LIKELY TO GAIN AUTHORITY OVER CYBER SECURITY AND INFRASTRUCTURE PROTECTION Both House and Senate bills would grant the Department of Homeland Security authority over cyber security and infrastructure protection. Specifically, the bills would transfer to the new department the functions of the following entities: * the National Infrastructure Protection Center of the Federal Bureau of Investigation (excluding the Computer Investigations and Operations Section); * the National Communications System of the Department of Defense; * the Critical Infrastructure Assurance Office of the Department of Commerce; * the National Infrastructure Simulation and Analysis Center of the Department of Energy; * the Federal Computer Incident Response Center of the General Services Administration. Following objections by the high-tech industry and others, the House bill would not transfer the Computer Security Division of the National Institute of Standards and Technology. The Senate bill as introduced would transfer that NIST component, along with the Energy Security and Assurance Program of the Department of Energy and the Federal Protective Service of the General Services Administration. Both bills would leave the FBI and CIA untouched by the reshuffling (with the exception of the FBI's NIPC, as noted above).

2 1

RE: QoS/CoS in the real world?
by Jeff Hancock 25 Jul '02

25 Jul '02

Steve, Hope this info helps answer your questions about QoS, implementations and customers. Forwarded from a product person person in our org... ------------------------------------------------------------------------ Sorry I didn't see this note earlier, but wanted to make you aware that Masergy Communications is actually offering such a service on a native MPLS based IP network. We provide differentiated IP services via customer DSCP marking at the network edge. QoS is supported end to end through the Masergy core via promotion to the MPLS EXP marking. Masergy closely manages its network by service class. This allows each marking to have its own end-to-end SLA, customized to the type of customer traffic sent with each marking. Customers see the need for QoS in two broad categories: 1) Prioritizing business applications for performance reasons 2) Providing guaranteed performance to real-time IP applications such as IP voice and IP videoconferencing Some real examples: A Masergy customer does file backups overnight. When the backups continued into the next morning performance of daily business activities suffered. By lowering priority of the backup traffic, acceptable performance for both the backups and day users can be provided at a lower cost to the customer. Most of our customers have similar stories (the p2p example mentioned previously is another good one). An interesting application is that customers can mark all outbound traffic as priority--this is a simple config and requires little smarts on the part of the edge router. Any traffic that originates and terminates on the Masergy network is prioritized. All traffic from outside, non-business sites (i.e. surfing, p2p, radio etc.) gets best-effort treatment. Note that many of the applications that need priority are not high bandwidth--MS Exchange for example is a low BW app, but notoriously sensitive to network quality issues. QoS in the manner described above can enhance performance even for lower BW applications. Another customer application is video conferencing - specifically replacing current ISDN video architectures with IP equivalents. IP QoS and MPLS allow Masergy to engineer a class of service for voice and video that provides low jitter and 100% guaranteed throughput across our core. MPLS fast fail-over improves application performance in the case of a core network link or hardware failure. Without differentiated QoS, we would not be able to guarantee this level of performance. One of the major issues with properly utilizing QoS is giving the customer the ability to view and manage performance. Masergy customers use the Service Control Center - a secure, web-based interface for managing their service. It provides per QoS level and application statistics on network utilization and performance. Customers can change their access bandwidth and enable additional QoS capabilities in real time. http://www.masergy.com ------------------------------------------------------------------------ -- ----------------------------------------------------------------------- Jeff Hancock P: 703-846-0161 Senior Engineer F: 703-846-0149 Masergy Communications, Inc. C: 2901 Telstar, Ct. E: mailto:jeff@masergy.com Falls Church, VA, 22042 W: http://www.masergy.com ----------------------------------------------------------------------- -----Original Message----- From: Stephen J. Wilcox [mailto:steve@opaltelecom.co.uk] Sent: Thursday, July 18, 2002 5:26 PM To: John Evans Cc: nanog(a)merit.edu Subject: RE: QoS/CoS in the real world? On Thu, 18 Jul 2002, John Evans wrote: > > I realise this is a US-centric list, however, a significant number of > providers in Europe have deployed Diffserv as a means of supporting > (and > selling) differential SLAs. Of these, some have deployed Diffsev at the > edge and some both the edge and core. See Clarence Filsfils presentation at > NANOG 25 for a description of typical core deployments. > > > 2. Hype aside, to what extent do customers actually want this > > Surely end customers want a service with SLAs that will support their > applications, and at low cost? It then becomes a provider cost > consideration as to whether these SLA assurances can most > competitively satisfied with mechanisms such as Diffserv or without. I have to say that the majority of users barely understand how their outlook client works let alone the difference between applications. I'm starting to think theres no demand for these services other than that which the hype says is there. THis is in line with what people said about using qos behind the scenes but customers dont know.. kind of what I thought to begin with STeve > > I conclude either the people doing this are successful and keep > > their secret safe or the world is yet to sell largescale QoS across > > IP. > > or perhaps they are just not on this list. > > cheers > > John > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf > > Of Stephen J. Wilcox > > Sent: 14 July 2002 00:47 > > To: nanog(a)merit.edu > > Subject: Re: QoS/CoS in the real world? > > > > > > > > Well, end of the week and the responses dried up pretty quickly, I > > think thats a response in itself to my question! > > > > Okay, heres a summary which was requested by a few people: > > > > Other people too are interested in my questions, they dont implement > > QoS in any saleable manner and wonder how it can be done and whats > > actually required. > > > > A number of people think QoS was interesting for a while but that > > its never either found its true use or is dead. > > > > There are unresolved questions from a customer point of view as to > > what they are actually going to get, what difference it will make > > and how they can measure > > their performance and the improvements from QoS. > > > > There is a real demand for guaranteed bandwidth, however this tends > > to be in the form of absolute guarantees rather than improvements > > above "normal" hence ATM remaining a popular solution. > > > > There is a requirement to differentiate voice traffic, however this > > is necessarily done by the network anyway in order to offer the > > service, this being the case the customer doesnt pay extra or gets > > to know much about how all the > > fancy bits are done. > > > > > > On the face of it this is all negative. Nobody has responded saying > > there are genuine requirements for services to be offered to > > customers. Nor has anybody > > responded with any descriptions of implementations. > > > > I conclude either the people doing this are successful and keep > > their secret safe or the world is yet to sell largescale QoS across > > IP. > > > > Steve > > > > > > On Mon, 8 Jul 2002, Stephen J. Wilcox wrote: > > > > > > > > Hi all, > > > I've been looking through the various qos/cos options > > available, my particular > > > area was in how IP (MPLS perhaps) compares and can be a > > substitute for ATM. > > > > > > Well, theres lots of talk and hype out there, from simple IP > > queuing eg cisco > > > priority queuing, rsvp, diffserv, mpls traffic engineering etc > > > > > > But two things are bugging me.. > > > > > > 1. To what extent have providers implemented QoS for their > > > customers > > > > > > 2. Hype aside, to what extent do customers actually want this > > (and by this I > > > dont just mean that they want the latest QoS because its the > > 'latest thing', > > > there has to be a genuine reason for them to want it). And this > > takes me back to > > > my ATM reference where there is a clear major market still out > > there of ATM > > > users and what would it take to migrate them to an IP solution? > > > > > > Also, how are people implementing bandwidth on demand (dynamic > > allocation > > > controlled by the customer) solutions to customers > > > > > > Cheers > > > > > > Steve > > > > > > > > > > > > > > > > > >

2 1

RE: AS286 effectively no more..
by Huopio Kauto 25 Jul '02

25 Jul '02

>> What is the legal position of an IRU deal if the cable owner goes belly >> up? >Unless someone buys the equipment and agrees to theke the IRU:s on - they >are worthless. How about duct IRU:s? --kauto

2 1