November 2003 - NANOG - lists.nanog.org

Fw: [Full-Disclosure] Gates: 'You don't need perfect code' for good security
by james 01 Nov '03

01 Nov '03

One word.... HA ! james ----- Original Message ----- From: "Jeremiah Cornelius" <> To: <full-disclosure(a)lists.netsys.com> Sent: Friday, October 31, 2003 11:32 AM Subject: [Full-Disclosure] Gates: 'You don't need perfect code' for good security : -----BEGIN PGP SIGNED MESSAGE----- : Hash: SHA1 : : FLAME ON! : : http://www.itbusiness.ca/index.asp?theaction=61&sid=53897 : : "But there are two other techniques: one is called firewalling and the other : is called keeping the software up to date. None of these problems (viruses : and worms) happened to people who did either one of those things. If you had : your firewall set up the right way - and when I say firewall I include : scanning e-mail and scanning file transfer -- you wouldn't have had a : problem. But did we have the tools that made that easy and automatic and that : you could really audit that you had done it? No. Microsoft in particular and : the industry in general didn't have it." : : "The second is just the updating thing. Anybody who kept their software up to : date didn't run into any of those problems, because the fixes preceded the : exploit. Now the times between when the vulnerability was published and when : somebody has exploited it, those have been going down, but in every case at : this stage we've had the fix out before the exploit. So next is making it : easy to do the updating, not for general features but just for the very few : critical security things, and then reducing the size of those patches, and : reducing the frequency of the patches, which gets you back to the code : quality issues. We have to bring these things to bear, and the very dramatic : things that we can do in the short term have to do with the firewalls and the : updating infrastructure. " : -----BEGIN PGP SIGNATURE----- : Version: GnuPG v1.2.3 (GNU/Linux) : : iD8DBQE/oqq3Ji2cv3XsiSARAlkdAJ0aGkBViYkoE193iZycTmQZohzwbQCg1KDA : SjPLY1EEzamQCtIGKwJT1Vk= : =mIsY : -----END PGP SIGNATURE----- : : _______________________________________________ : Full-Disclosure - We believe in it. : Charter: http://lists.netsys.com/full-disclosure-charter.html James Edwards Routing and Security Administrator jamesh(a)cybermesa.com At the Santa Fe Office: Internet at Cyber Mesa Store hours: 9-6 Monday through Friday 505-988-9200 SIP:1(747)669-1965

6 6

RE: IPv6 NAT
by Kuhtz, Christian 01 Nov '03

01 Nov '03

> Or you could simply call it what it is -- a firewall -- since > that's what most consumers think NAT is anyways. > > While I disagree with the general sentiment that NATs create > security, the standard usage of such devices is certainly > that of a stateful firewall. All hairsplitting aside, given that the term NAT these days is mostly used in a PAT (particularly in a customer connecting to the I) context, what isn't secure about? ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers.61"

9 14

OT: Midco.net
by joej＠Rocknyou.com 01 Nov '03

01 Nov '03

Sorry for the off topic post, but has anyone dealt with Midco.net? I recently reported a Scan from a node belonging there and have met with nothing but side steps. Please contact me off list if you have any contacts there. Would like to get this resolved. http://www.rocknyou.com/midco.html Cheers -Joe

4 3

RE: Yankee Group declares core routing obsolete (was Re: Anybodyu sing GBICs?)
by Martin, Christian 01 Nov '03

01 Nov '03

Stephen, > I've always stated that "switch" is a marketing term meaning > "fast". Thus a > "L2 switch" is a "fast bridge" and a "L3 switch" is a "fast > router". In this light, the Yankee Group is just now > catching on to something we all knew a decade ago -- slow > (i.e. software) routers are dead. As you are probably more aware than I, software-based-forwarding routers will die when people stop running the so-called "desktop protocols", and even then, most next-gen routers will continue to need functions that can only be provided economically and perhaps thermodynamically (in terms of heat dissipation) in the form of sw "services" running on purpose-built and/or general-purpose CPUs. Examples are VOIP call processors, some FW ALGs as new protocols emerge, etc. The concept of L2 switching based on L3 information tends to be viable only when one can transparently bridge between the L2 protocols - otherwise, you are making L3-only decisions, and doing all sorts of L2 rewrite which many traditional Ethernet switches can't necessarily do. Things are getting better, but "L3-switches" pale in comparison to today's high-end routers on almost all fronts. If you take GigE out of the equation, modern "L3 Switches" are just as expensive as modern "core routers" - and routable, "mpls-able" L3 GE ports are _more_ expensive on "switches" than "routers" (see 4xGE OSM vs 4xGE GSR 'tetra' pricing). Media diversity, queuing performance, and FIB density is what really differentiates the two at this point, IMO. I am unaware of a traditional switch-turned-router (and I use these terms here as most do who draw a distinction) that can exceed the forwarding capacity of a core router when the media is largely WAN-based, there are complicated classification and filtering rules that are very dense, when complex queuing policy needs to be applied, and when the routing table is huge. Or perhaps my earlier experience with these switches-trying-to-be-routers has left me a bit jaded.... > There's a more interesting level to the discussion if you > look at what carriers are interested in for their backbone > hardware today; while I'm obviously biased based on my > employer, I've seen a lot more emphasis on $20k-per-10GE-port > "L3 switches" than $200k-per-10GE-port "core routers" in the > current economic climate. Of course, a "routable" 10GE port does NOT cost $20k - sure you can do MLS or whatver it is called - but things like label imposition/disposition is not possible. Also, last I saw, my MLS-enabled MSFCs weren't able to gather "vlan interface" statistics - they were all embedded in some L2 asic that I had to glean from the "switch." Further, Ethernet has the worst OAM capabilities of any modern media. BFD will help detect failures when it is available, but will never be able to tell me "why". SONET is clearly superior in the aspect. So, for enterprise switching, "L3 switches" are mostly fine - barring any funky bridging requirements (Blue protocols). But for carrier backbones, I suspect we will continue to see the majority of implementations usng modern "core routers". And we haven't even begun talking ATM and FR, and what device better suits these applications. Judging from your company's position on this front, I suspect that "core routers" may be our best bet here, given that many who could do switching well were unable to "bolt on" a usable, stable routing implementation. But that is another religious discussion for another day! My .02 chris > S > > Stephen Sprunk "God does not play dice." --Albert Einstein > CCIE #3723 "God is an inveterate gambler, and He throws the > K5SSS dice at every possible opportunity." --Stephen Hawking >

3 2

RE: Yankee Group declares core routing obsolete (was Re: Anybodyu sing GBICs?)
by Martin, Christian 01 Nov '03

01 Nov '03

Steinar, Yes, the PL has pricing that has changed for us at least, and will be changing for others as well. Expect Tetra to be selling for less in short time (if not already). Looks as if the GE OSM has dropped in price too. As Deepak pointed out, YMMV based on application. For me, I must look across the gamut of services and cards, like 4-port OC-12c ATM, 4-port CHOC-12 to DS1, 4x OC-48 ports, while considering chassis density, etc. In the time I've spent with the 7609, and admittedly that has been fleeting, I have come away disappointed more than impressed, but I have a wider array of services to support. For many applications, I think it is phenomenal - for example, security services. But those aren't core routing services. I would be interested in seeing, say, a 7609-GSR or better yet 7609-T640 bakeoff. I think that would prove 2 things - 1) you get what you pay for, and 2) purpose-built routers are still better at routing heavy loads with diverse media. Sure, the loaded 640 will be more expensive, but it will most definitely knock the power supplies off the 7609 in general performance. Perhaps the SUP-720 will change that - I look forward to seeing it in our lab, where I may be reconvinced... c -----Original Message----- From: sthaug(a)nethelp.no [mailto:sthaug@nethelp.no] Sent: Friday, October 31, 2003 4:08 PM To: cmartin(a)gnilink.net Cc: nanog(a)merit.edu Subject: RE: Yankee Group declares core routing obsolete (was Re: Anybodyusing GBICs?) > Things are getting better, but "L3-switches" pale in comparison to > today's high-end routers on almost all fronts. If you take GigE out > of the equation, modern "L3 Switches" are just as expensive as modern > "core routers" - and routable, "mpls-able" L3 GE ports are _more_ > expensive on "switches" than "routers" (see 4xGE OSM vs 4xGE GSR > 'tetra' pricing). In *my* Cisco GPL, 4GE-SFP-LC is listed at $75,000 while OSM-2+4GE-WAN+ is listed at $44,000. But then I tend to think of the 6500/7600 as a router... Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

2 1

Re: IPv6 NAT
by Michael.Dillon＠radianz.com 01 Nov '03

01 Nov '03

>NAT also has the advantage that if packets do leak >bogon filters at the border will drop them. NAT is simply an algorithm which causes a firewall to drop all traffic which doesn't match an entry in a set of internal state tables. The NAT algorithm sets up these state tables based on outgoing traffic and based on specific operator configurations, i.e. static NAT mappings. This algorithm can be implemented in a trivial piece of software that runs on cheap, low-power devices commonly used in things like DSL routers. The IPv6 folks are claiming that you can very easily implement the same type of algorithm on IPv6 routers to drop all traffic which doesn't match an entry in a set of internal state tables. The IPv6 algorithm would set up these state tables based on outgoing traffic and based on specific operator configurations, i.e. static enabled addresses. The only difference is that the IPv6 device never changes the packet contents, i.e. never replaces source or destination addresses in the headers. The IPv6 version can still drop traffic and can still dynamically enable certain incoming traffic based upon detection of an outgoing TCP session starting up. It could even do port redirection if that was still useful to people. It could also allow operator configuration to enable incoming traffic to specific addresses. The IPv6 version would be just as secure as an IPv4 NAT device but it would not interfere with protocol functioning. Now, I'm not claiming that every device capable of IPv4 NAT is currently able to function in this way, but there are no technical barriers to prevent manufacturers from making IPv6 devices that function in this way. The IPv6 vendor marketing folks can even invent terms like NAT (Network Authority Technology) to describe this simple IPv6 firewall function, i.e. IPv6 NAT. It wouldn't be the first time that acronyms have been reinvented, e.g. RED, GSM. --Michael Dillon

5 4