February 2004 - NANOG - lists.nanog.org

RE: Stopping open proxies and open relays
by Michel Py 07 Feb '04

07 Feb '04

> Vivien M. wrote: > Now, if hooking up an unsecured computer to a network was > punishable by a $1000 fine, and law enforcement somehow > had the staff to prosecute all offenders (or a > representative sample), I'm sure everybody would agree > that suddenly they'd be able to afford antiviruses. It's not that I don't like the idea, but it's been tried before. Making stupidity punishable by fines does not work; if it did we would not have a budget deficit issue. Michel.

7 9

Re: question on ptr rr
by Randy Bush 07 Feb '04

07 Feb '04

[ private email not quoted ] this is what i call shooting in the dark. what are OBJECTIVE METRICS? for example, can operators measure and publish alpha and beta error rates on a selection of sites of different flavors so we can decide when they are low enough for our flavor of site to enable rdns filters? randy

1 0

hotmail postmaster contact?
by Paul E 07 Feb '04

07 Feb '04

Sorry for the abuse of bandwidth but I've exhausted the standard options. I need a working mail alias that gets to a human postmaster at Hotmail. Have tried postmaster, hostmaster, security and abuse. The only response other than "this alias doesn't work" was from abuse, telling me that the spam didn't originate at hotmail... Sometime in the last 4 weeks or so, they upped the list of IP addr ranges they don't take mail from. In typical micro$quish standards non-compliance, they don't bounce it, they give "250 OK" and then silently trash it. So, I have no way of knowing what they don't like, how to fix it, etc.

1 0

RE: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or other vendor ?
by Alexander Hagen 07 Feb '04

07 Feb '04

Montara is between Pacifica and Half Moon Bay. Everyone has a different perspective - but all valid. However I would say if you are going to go Cisco - and you have no other BGP gear under Smartnet - you might look at the 3725 maxed out. It is new and you will get support and available for 5,000.00 online, equipped with two onboard Fast Ethernet ports. You are likely to buy only single FE modules at 350.00 rather than 2FE's which are hard to find for cheap, and upgrading memory to 256 Megs DRAM is only an addl 150.00. With that said.... I found a rather stupid article that gave the Riverstone high marks. http://www.nwfusion.com/reviews/2003/0714rev.html?page=1 http://research.mwjournal.com/data/jspdetail?id=1025118725_252&type=PROD &src=mwave&x=841473789 The RS 3000 has 20 gbps non blocking. I am likely to go with the Riverstone. I think I can get it for under 2K with 24 10/100 ports, 256 MB of memory, and 20 gbps non blocking switching fabric. Although I will likely place a Cisco box behind it (eventually) for IPSec and the like. Platform Features Feature-rich Wire-speed Services IP routing, unicast, and multicast Routing in hardware on each line card LSR and LER MPLS support in hardware RSVP-TE and LDP label distribution and signaling MPLS traffic engineering support Security (ACLs, L2 filters) Layer 4 application-flow switching and QoS Network Address Translation (NAT) Hardware-based Rate Limiting Jumbo Frame support VLANs based on port or protocol Server Load Balancing (LSNAT) Highly Fault Tolerant Redundant power supplies (RS 3000) Hot-swappable media modules Standards-based VRRP Layer 2 and 3 redundant protocol support Extensive Management Wire-speed full RMON/RMON2 SNMP manageable SSH RADIUS TACACS+ RS-232 (out-of-band management) Command Line Interface (CLI) Interfaces 10/100 Base-TX 100 Base-FX 1000 Base-SX 1000 Base-LX 1000 Base-TX 1000 Base-LH (70Km) T1/E1 T3/E3 ATM-OC-3c Up to 4,096 VLANs Up to 256,000 routes Up to 20,000 security/access control filters Up to 512,000 Layer 4 application flows Up to 256,000 Layer 2 MAC addresses RS 1000: 12 Gbps non-blocking switching fabric RS 1000: 4.6 million packets per second routing throughput RS 3000: 20 Gbps non-blocking switching fabric RS 3000: 9.5 million packets per second routing throughput MTBF (predicted) > 200,000 hours Physical Dimensions: 3.25" H x 17" W x 18.5" D (8.25 cm x 43.2 cm x 47 cm) Weight: 20 lbs. (9.1 kg) Environmental Specifications Operating Temp: +0º to +40ºC (32º to 104ºF) Non-operating Temp: -40º to +70ºC (-40º to 158ºF) Operating Relative 10% to 90% (non-condensing) Humidity: Non-operating 5% to 95% maximum Relative Humidity: (non-condensing) Altitude, Operating 10,000 ft (3,000 m) maximum and Non-operating: Shock and Vibration:GR63 Power Requirements AC Input current: 3.0 A - 1.5 A AC Input voltage: 100 to 240 VAC AC Frequency: 50 to 60 Hz DC Input current: 8.0 A DC Input voltage: -48 to -60 VAC Agency Standards and Specifications Safety: Certified UL1950, CSA C22.2 No. 950, EN60950, IEC950, and 72/73/EEC Electromagnetic Compliant with the requirements of compatibility: FCC Part 15, CSA C108.8, EN55022, VCCI, EN50082-1, and 89/336/EEC Standards Supported IETF Standards Support RFC No. Title RFC 768 UDP RFC 783 TFTPv2 RFC 791 IP RFC 792 ICMP RFC 793 TCP RFC 826 ARP RFC 854 Telnet RFC 951 BootP RFC 1058 RIP v1 RFC 1075 DVMRP RFC 1112 Host Extensions for IP Multicasting RFC 1157 SNMPv1 RFC 1195 Use of OSI IS-IS for Routing in TCP/IP and Dual Environments RFC 1245 OSPF Protocol Analysis RFC 1246 Experience with the OSPF Protocol RFC 1256 ICMP Router Discover Message RFC 1265 BGP Protocol Analysis RFC 1266 Experience with the BGP Protocol RFC 1267 BGP-3 RFC 1269 Definitions of Managed Objects for BGP-3 RFC 1332 PPP IPCP RFC 1349 Type of Service in the Internet Protocol Suite RFC 1397 Default Route Advertisement in BGP-2 and BGP-3 RFC 1403 BGP OSPF Interaction RFC 1519 CIDR: an Address Assignment and Aggregation Strategy RFC 1542 Clarifications and Extensions for the Bootstrap Protocol RFC 1552 PPP IPXCP RFC 1570 PPP LCP Extensions RFC 1586 Guidelines for Running OSPF Over Frame Relay Networks RFC 1587 OSPF NSSA Option RFC 1631 IP NAT RFC 1638 PPP BCP RFC 1657 Definitions of Managed Objects for BGP-4 using SMIv2 RFC 1661 PPP RFC 1662 PPP in HDLC-like Framing RFC 1745 BGP-4/IDRP for IP and OSPF Interaction RFC 1765 OSPF Database Overflow RFC 1771 BGP-4 RFC 1772 Application of BGP in the Internet RFC 1773 Experience with the BGP-4 Protocol RFC 1774 BGP-4 Protocol Analysis RFC 1793 Extending OSPF to Support Demand Circuits RFC 1812 Router Requirements RFC 1918 Address Allocation for Private Internet Space RFC 1923 RIPv1 Applicability Statement for Historic Status RFC 1930 Guidelines for creation, selection, and registration of an AS RFC 1966 BGP Route Reflection Alternative to full mesh IBGP RFC 1990 PPP MLP RFC 1997 BGP Communities Attribute RFC 1998 BGP Community Attribute in Multi-home Routing RFC 2082 RIP-2 MD5 Authentication RFC 2131 DHCP RFC 2225 Classical IP and ARP over ATM RFC 2236 Internet Group Management Protocol, Version 2 RFC 2270 Using a Dedicated AS for Sites Homed to a Single Provider RFC 2328 OSPFv2 RFC 2329 OSPF Standardization Report RFC 2236 IGMP-2 RFC 2338 VRRP RFC 2362 PIM-SM RFC 2370 OSPF Opaque LSA Option RFC 2385 Protection of BGP Sessions via the TCP MD5 Signature Option RFC 2390 Inverse Address Resolution Protocol RFC 2391 LSNAT Load Sharing using IP Network Address Translation RFC 2427 Multi-protocol Interconnect over Frame Relay RFC 2439 BGP Flap Damping RFC 2547 BGP/MPLS VPNs RFC 2453 RIPv2 RFC 2519 A Framework for Inter-Domain Route Aggregation RFC 2570 Introduction to Version 3 of the Internet-standard Network Management Framework RFC 2571 An Architecture for Describing SNMP Management Frameworks RFC 2572 Message Processing and Dispatching for the Simple Network Management Protocol (SNMP) RFC 2573 SNMP Applications RFC 2574 User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3) RFC 2575 View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP) RFC 2576 Coexistence between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework RFC 2578 Structure of Management Information Version 2 (SMIv2) RFC 2579 Textual Conventions for SMIv2 RFC 2580 Conformance Statements for SMIv2 RFC 2615 PPP over SONET/SDH RFC 2684 Multi-protocol Encapsulation over ATM Adaptation Layer 5 RFC 2702 Requirements for Traffic Engineering over MPLS RFC 2763 Dynamic Hostname Exchange Mechanism for IS-IS RFC 2796 BGP Route Reflection Alternative to full mesh IBGP RFC 2842 Capabilities Advertisement with BGP-4 RFC 2858 Multi-protocol Extensions for BGP-4 RFC 2865 Remote Authentication Dial In User Service (RADIUS) RFC 2866 RADIUS Accounting RFC 2918 Route Refresh Capability for BGP-4 RFC 2925 Definitions of Managed Objects for Remote Ping, Traceroute, and Lookup Operations RFC 2963 Dynamic Hostname Exchange Mechanism for IS-IS RFC 2966 Domain-wide Prefix Distribution with Two-Level IS-IS RFC 2973 IS-IS Mesh Groups RFC 3031 Multi-protocol Label Switching Architecture RFC 3032 MPLS Label Stack Encoding RFC 3036 LDP Specification RFC 3065 Autonomous System Confederations for BGP RFC 3137 OSPF Stub Router Advertisement RFC 3209 RSVP-TE Extensions to RSVP for LSP Tunnels RFC 3210 Applicability Statement for Extensions to RSVP for LSP Tunnels IETF Standards MIB Support RFC No. Title RFC 1471 PPP-LCP-MIB RFC 1472 PPP-Sec-MIB RFC 1473 PPP-IP-NCP-MIB RFC 1474 PPP-Bridge-NCP-MIB RFC 1493 Bridge-MIB RFC 1657 BGP4 using SMIv2-MIB RFC 1595 SONET/SDH Interface Type-MIB RFC 1695 ATM-MIB RFC 1757 RMON-MIB RFC 1724 RIPv2-MIB RFC 1850 OSPFv2-MIB RFC 1907 SNMPv2-MIB RFC 2011 IP-MIB RFC 2012 UDP-MIB RFC 2013 TCP-MIB RFC 2021 RMON2 using SMIv2-MIB RFC 2096 IP-Forward-MIB RFC 2115 Frame-Relay-MIB RFC 2233 IF using SMIv2-MIB RFC 2358 EtherLike-MIB RFC 2495 DS1, E1, DS2, E2 Interface Types-MIB RFC 2496 DS3/E3-MIB RFC 2618 Radius-Auth-Client-MIB RFC 2668 IEEE 802.3 Medium Attachment Units (MAUs)-MIB RFC 2674 P-Bridge-MIB, Q-Bridge-MIB RFC 2787 VRRP-MIB Standards and Protocols IP routing: RIPv1/v2, OSPF, BGP-4, IS-IS Multicast support: IGMP, DVMRP, PIM-DM, PIM-SM QoS: Application level, RSVP IEEE 802.1D IEEE 802.1p IEEE 802.1Q IEEE 802.1x IEEE 802.3 IEEE 802.3ad IEEE 802.3u IEEE 802.3x IEEE 802.3z Alexander Hagen Etheric Networks Incorporated, A California Corporation 527 Sixth Street No 371261 Montara CA 94037 Main Line: (650)-728-3375 Direct Line: (650) 728-3086 Cell: (650) 740-0650 (Does not work at our office in Montara) Home: (Emgcy or weekends) 650-728-5820 fax: (650) 240-1750 http://www.etheric.net -----Original Message----- From: william(a)elan.net [mailto:william@elan.net] Sent: Saturday, February 07, 2004 5:19 AM To: Alexander Hagen Subject: Re: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or other vendor ? 7500 is your best option indeed, I'm using several of these and have close to 300Mb passing through at max, primarily ethernet, but also have serial and ATM interfaces; multiple BGP feeds with full table and quite complex access lists - and its all WORKING! One thing to remember is that while 7500 line was started long ago, there have been new router cards and VIP cards released. So if you have 7500 with RSP4 or RSP8 and use VIP2-50 with newear PA modules, you're really not in 1995 any more... For VOIP you'll need different routers but I don't think you were talking about using your core router to provide voip handoffs. Traffic accounting is working fine with 7500 and external unix system that actually does it though SNMP. P.S. Where is Montara located? I see familar 650 area code and I though I knew all the cities nearby, but definetly never been to Montara... On Sat, 7 Feb 2004, Alexander Hagen wrote: > > I have been looking for a sub 5K router on the used market to support > around 30-50 megs peak traffic. > > I have found the 7507/7513 but these things appear to have been > manufactured in 1995 ! > > Then there is the 7206 and the 7206 VXR - I guess the 7206 itself is > just as old as the 7507 and 7513 and the same price at the least - > perhaps because of its form factor. > > The 7206 VXR makes me feel a little better - as it was manufactured in > 1999? > > We are looking at a pure Ethernet environment - but with the desire to > support a lot of value added services - such as IPSEC, VoIP, traffic > accounting. Cisco's have traditionally been good at PRI and T-1 and T-3 > type interfaces - which we don't really need -which leads me to think > Foundry might be an option. > > Juniper appears to be at least 7,000.00 - and I am worried about support > - based on other articles I have seen. > > So the question is would a layer 3 switch be a good idea with a lot of > memory - for example the Cat 6509 ? > > Perhaps foundry BigIron with Jetware ? > > Please give me your thoughts - it is hard to believe that the 7507 and > 7513 are my best options.... > > Alexander Hagen > Etheric Networks Incorporated, A California Corporation > 527 Sixth Street No 371261 > Montara CA 94037 > Main Line: (650)-728-3375 > Direct Line: (650) 728-3086 > Cell: (650) 740-0650 (Does not work at our office in Montara) > Home: (Emgcy or weekends) 650-728-5820 > fax: (650) 240-1750 > http://www.etheric.net

1 0

Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or other vendor ?
by Alexander Hagen 07 Feb '04

07 Feb '04

I have been looking for a sub 5K router on the used market to support around 30-50 megs peak traffic. I have found the 7507/7513 but these things appear to have been manufactured in 1995 ! Then there is the 7206 and the 7206 VXR - I guess the 7206 itself is just as old as the 7507 and 7513 and the same price at the least - perhaps because of its form factor. The 7206 VXR makes me feel a little better - as it was manufactured in 1999? We are looking at a pure Ethernet environment - but with the desire to support a lot of value added services - such as IPSEC, VoIP, traffic accounting. Cisco's have traditionally been good at PRI and T-1 and T-3 type interfaces - which we don't really need -which leads me to think Foundry might be an option. Juniper appears to be at least 7,000.00 - and I am worried about support - based on other articles I have seen. So the question is would a layer 3 switch be a good idea with a lot of memory - for example the Cat 6509 ? Perhaps foundry BigIron with Jetware ? Please give me your thoughts - it is hard to believe that the 7507 and 7513 are my best options.... Alexander Hagen Etheric Networks Incorporated, A California Corporation 527 Sixth Street No 371261 Montara CA 94037 Main Line: (650)-728-3375 Direct Line: (650) 728-3086 Cell: (650) 740-0650 (Does not work at our office in Montara) Home: (Emgcy or weekends) 650-728-5820 fax: (650) 240-1750 http://www.etheric.net

2 1

Re: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 or othervendor ?
by sthaug＠nethelp.no 07 Feb '04

07 Feb '04

> I have been looking for a sub 5K router on the used market to support > around 30-50 megs peak traffic. ... > We are looking at a pure Ethernet environment - but with the desire to > support a lot of value added services - such as IPSEC, VoIP, traffic > accounting. Cisco's have traditionally been good at PRI and T-1 and T-3 > type interfaces - which we don't really need -which leads me to think > Foundry might be an option. With a pure Ethernet environment, a 7140-2FE with 256 MB should do the job wonderfully. I see a 7140-2FE on Ebay right now for $3000 - you'd probably need some more memory, but under $5000 should be easily doable (even if you want to do it legally and get an IOS license transfer from Cisco). Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

RE: Stopping open proxies and open relays
by Vivien M. 07 Feb '04

07 Feb '04

> -----Original Message----- > From: Randy Bush [mailto:randy@psg.com] > Sent: February 7, 2004 1:10 AM > To: Vivien M > Cc: nanog(a)merit.edu > Subject: RE: Stopping open proxies and open relays > > > > I have no objection to the electric chair for script kiddies > > an interesting position. and how do you feel about folk who > violate rfcs? I leave them in your more-than-capable hands to do as you best see fit? ;-)

1 0

RE: Stopping open proxies and open relays
by Michel Py 07 Feb '04

07 Feb '04

> Vivien M. wrote: > The day a couple of grandmothers get taken away in > handcuffs because a script kiddie took up residence > in her computer is the day a few people will wake > up to the fact that computers need regular maintenance... Indeed, but a) won't happen b) even if it could it would be faster to pass a low that allows worm and virus writers to be shot on sight, which won't happen either. Want to stop the problem? Make the bounty $250M instead of $250K. Gee, I'd probably turn myself in for that much. Michel.

1 0

RE: Stopping open proxies and open relays
by Michel Py 07 Feb '04

07 Feb '04

>>> There are valid reasons not to run antivirus software, >> And they are? > P90w/32MB running Win95 used for email only... > or insufficient finances to purchase anti > virus software... to name a couple. Anyone has a used Ford Pinto for sale? I wonder if it would be cheaper to operate than my current Toyota.

1 0

Re: Stopping open proxies and open relays
by Dr. Jeffrey Race 07 Feb '04

07 Feb '04

On Fri, 6 Feb 2004 22:43:39 -0600 (CST), Adi Linden wrote: >I am looking for ideas to stop the spam created by compromised Windows >PC's. This is not about the various worms and viruses replicating but >these boxes acting as open relays or open proxies. > >There are valid reasons not to run antivirus software, coupled with >clueless users, this results in machines that SPAM again just a few hours >after having been cleaned. First step is correctly to specify the system's properties. Yours is not a technical issue but one of user negligence. You have to build the solution around this fact. Curative measures that have worked elsewhere are: 1-Scan every client when it accesses 2-Disconnect compromised clients or route only to a warning page allowing access only to your tech support 3-First cleanup and advice to owner of compromised machine on how to be a good internet member is free; second costs $100; third results in permanent discontinuance of service and refusal to accept back as a client. These measures will fix your problem. Jeffrey Race

1 0