December 2003 - NANOG - lists.nanog.org

RE: MTU path discovery and IPSec
by Arjan Hulsebos 04 Dec '03

04 Dec '03

> On Wed, 03 Dec 2003 16:05:39 GMT, jgraun(a)comcast.net said: > > > 1) I assume MTU path discovery has to been in enabled on > each router in the path in order for it work correctly?! > > Actually, no. All that's required is that: You also need an OS that does not set the DF-bit on every packet it sends out. IIRC, out-of-the-box Solaris 8 is excellent at doing that. No matter how many icmp messages it gets, it happily ignores them by insisting on sending out frames of 1500 bytes with the DF-bit set. Makes trouble-shooting IPSec connections, uhm.... interesting. Cheers, Arjan H --- This message is confidential and may be privileged. Any review, retransmission, dissemination or other use of, or taking any action with reference to this information by persons other than the intended recipient is prohibited. If you received this message in error, please notify the sender by reply e-mail and delete this message from all computers. Please note that e-mails are susceptible to change. The sender will not accept liability for the improper or incomplete transmission of the information contained in this message.

1 0

Re: [Re: Firewall stateful handling of ICMP packets]
by joshua sahala 04 Dec '03

04 Dec '03

Sean Donelan <sean(a)donelan.com> wrote: > > Did news stories about this get other people in New Zealand to fix their > computers, apply patches, use anti-virus? Or were were lots of stories > about the "evil" telco ruining grandmothers and orphans? and the telco > eventually waived the charges? probably a little of each - and each will likely be temporary. users will keep updated for the near-term, and telcos/isps might waive charges. however, relying on either will lead to further problems (as we have seen, and will continue to see). > Toll charges do encourage PBX owners and cordless phone makers to > improve the security of their products? Most cordless phones (unlike > WiFi) now have automatic authentication between the handset and base > (not encryption, just authentication). Most PBX's block outside to > outside phone connections (the telephone version of proxy/relay) by > default now. enough pain will eventually cause a change (and/or a higher pain tolerance). so far, pain tolerance by most users is rising, but not much is changing. users are still ignorant as to what is wrong or how to fix it (as you have pointed out to me in previous emails), no matter how many news stories there are, or how many 'helpful' emails are sent by isps or manufacturers. > If ISPs charged customers $0.000001/email message, would it cure spam > or would the spammers just continue to use third-party victims to spam > and there would be lots of news stories about grandmothers and orphans > getting huge ISP bills? IANAL, but many spammers are already breaking > a law by using victim machines without authorization; but would law > enforcement be more likely to do something if the victims now had a > $50,000 bill from their ISP due to the unauthorized traffic? it still comes down to figuring out who is doing it, and then getting enough evidence to 'stop' them. even the ones we know are spammers have gotten pretty good at using fronts for their operations: and when you have tens-of-thousands of vulnerable computers with 'fast' connections, you don't have to try very hard. we keep beating this same horse from different angles and hoping for different results. unless someone out there has a crystal ball and can predict the next exploit (and then magically fix it), we will beat it again next week...so until then, i am off to remind my less clueful friends and family members, again, not to apply the 'newest security patch' email from foo(a)microsoft.com (not even worth $0.02 today) /joshua "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

Standard/recommended formats for network information
by Bruno Quoitin 04 Dec '03

04 Dec '03

Looking for advice. I would like to know if there are standard or widely used file formats to represent the following information: * intradomain topology (including IGP costs, bandwidths, delays, SRLG) * BGP peerings * traffic matrices Thanks in advance Bruno -- CSE Dept. UCL, Belgium - http://www.info.ucl.ac.be/~bqu

1 0

Re: new nasty email virus trick to bypass scanners
by Damian Gerow 04 Dec '03

04 Dec '03

On Wed, 3 Dec 2003, Steven M. Bellovin wrote: > Is this in the wild yet? Any other details worth looking for? > Symantec's AV site apparently has nothing on it. I would say so - I got it in my inbox earlier this afternoon, and I traditionally get about three viruses a month. The virus itself is *exactly* like Mmimail.M, as reported by Symantec. Except that wendy.zip was definitely password protected. - Damian

2 1

new nasty email virus trick to bypass scanners
by Mike Tancsa 04 Dec '03

04 Dec '03

OK, here is a nasty virus trick. The message gets sent in a password protected zip file. The text of the messages says here are my pics and enter in the passwd xxxx to view the archive. The big problem is that normal avscanners cannot open the zip file to scan the contents since it is password protected. However, the user can be easily socially engineered to open the file and blam. The text of the message is nice and enticing making it look like private email with dirty pictures accidentally sent to the user... ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

2 1

Re: new nasty email virus trick to bypass scanners
by J. Oquendoy 04 Dec '03

04 Dec '03

> However, the user can be easily socially engineered to open the file and > blam. The text of the message is nice and enticing making it look like > private email with dirty pictures accidentally sent to the user... <opinion> Someone should create some form of standard 'README' document for the layperson using the internet in regards to viruses, maybe template it and send it to ISP's, so when new users sign up, they'll have a `slight' clue as to why they're now getting those "RPC WARNING YOUR COMPUTER WILL SHUT DOWN IN 60 SECOND" messages. Then again many people wouldn't read it, unless of course an ISP stated something silly to the extent that 'You will be held responsible* * *", of which would be a horrible policy. It would be a nice thing for both the user, and the network engineers/admins to have something in place to minizmize the reach of viruses and trojans. Hell it would have been nice for MS to invest in creating safer products as opposed to paying `bounty hunters'. </opinion> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "I watch gangster flicks and root for the bad guy and turn it off before it ends because the bad guy dies" 50 Cents - 'Assassins' This is a farce confidential disclaimer intended to make you aware that even though this may be priveledged information, being it will become Google cache in the future, my original intentions of keeping this message restricted and/or private are thrown out the door. If you have received this e-mail in error, please enjoy this signature and destroy this message by dousing it in gasoline.

2 1

Re: Does any know where the link is for
by Richard Irving 04 Dec '03

04 Dec '03

John Starta wrote: > If you locate this, please forward the link along. I haven't found the original, it was dated about 97-99... NLANR, perhaps ???? But, there are more recent write ups... Here are two I encountered: <http://www.inetdaemon.com/tools/ping_is_not.html> This one explains why PING -may- be bad, but regular performance, OK... (Call it the end user explanation of ACL-CAR intervention) :) And this one,( more what I was looking for..) a detailed explanation of the caveats of clever tracerouting providing Bogus Data. <http://homepage.ntlworld.com/robin.d.h.walker/cmtips/traceroute.html> I needed something for a rookie tech who was "whining" about a site tracerouting with an intervening router - appearing - slow (An exchange BGP router, go figure), but an end to end of -38 ms-, -consistent- and with -no- loss. He didn't believe the explanation of the BGP rumble... and I was growing frustrated with the need for detail, when it just wasn't registering ! :( "When the Judge is a blind man, it can be -exasperating- trying defend your choice of the Winner of the Art fair." :P

1 1

Does any know where the link is for
by Richard Irving 04 Dec '03

04 Dec '03

I seem to recall someone doing a paper on ICMP and traceroute -at times-, as not always being indicative of actual network performance... Does anyone remember who, or where, that link is ? Thanks in Advance. :)

1 0

MTU path discovery and IPSec
by jgraun＠comcast.net 03 Dec '03

03 Dec '03

Two questions: 1) I assume MTU path discovery has to been in enabled on each router in the path in order for it work correctly?! 2) Anybody use this to solve application issues over an IPSec tunnel to due to large of a frame? any help would be great Thanks

4 4

Re: AOL rejecting mail from IP's w/o reverse DNS?
by Dave Temkin 03 Dec '03

03 Dec '03

You mean like Level3? -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Steven M. Bellovin Sent: Wednesday, December 03, 2003 2:27 PM To: Matthew Crocker Cc: Christopher X. Candreva; nanog(a)nanog.org Subject: Re: AOL rejecting mail from IP's w/o reverse DNS ? In message <01D22399-25C5-11D8-940C-000A956885D4(a)crocker.com>, Matthew Crocker >> > >AOL says the PTR record needs to be assigned. It doesn't specify it >has to match the @domain.com in the MAIL FROM: header. Wouldn't it be >enough to make sure every IP address you announce has a PTR and >matching A record? Hasn't this been a requirement for MANY services >for MANY years? Right -- and then folks will start creating wildcard PTR records... --Steve Bellovin, http://www.research.att.com/~smb -- David Temkin

2 1