February 2004 - NANOG - lists.nanog.org

RE: T1 Customer CPE Replacement?
by Sean Crandall 23 Feb '04

23 Feb '04

We have tens of thousands of Netopia's in service for our T-1, SDSL and ADSL customers. Netopia has been a great company to work with. Their devices are fairly feature packed for what is needed on an edge device. They are missing advanced routing such as OSPF and BGP, however. The devices are either driven by an easy to use menu system or you can hit ctrl-n and jump to the CLI. If the unit is under warranty, then getting a replacement for a failed unit should not be an issue. I can't say what our failure rate has been, but I can say that with all of the options out there (cisco, efficient, etc), if they had been a problem, we would not still be shipping them. -Sean Sean Crandall VP Engineering Operations MegaPath Networks Inc. 6691 Owens Drive Pleasanton, CA 94588 (925) 201-2530 (office) (925) 201-2550 (fax) > -----Original Message----- > From: Scott McGrath [mailto:mcgrath@fas.harvard.edu] > > Have you tried a softnet depot maintenance agreement. This > entitles you to IOS upgrades but H/W replacement is some > negotiated percentage of list price. > > The other guys _may_ be cheaper in the short run but hardware > replacement is always like having a root canal cant speak for > Netopia but I have dealt with Adtran ended up buying a spare > DS3 CSU/DSU because of the experience. > > Cisco has many warts but they do honor their maintenance > contracts unlike some other vendors who I have had the > misfortune of dealing with. > > > Scott C. McGrath > > On Mon, 23 Feb 2004, Claydon, Tom wrote: > > > Hello, > > > > We're looking for a good replacement for fractional T1 > customers with > > Cisco > > 1600- & 1700-series routers as their CPE. They are good > routers, but > > the ongoing support costs are an issue, and we need to > replace them ASAP. > > > > Someone had mentioned several CPE vendors, such as Adtran > and Netopia. > > Are there any others, and does anyone have any pros/cons of what > > they're familiar with? > > > > > > Thanks, > > > > = TC > > > > -- > > Tom Claydon, IT/ATM Network Engineer > > Dobson Telephone Company > > phone: (405) 391-8201 cell: (405) 834-0341 > > > > >

1 0

RE: BL of Compromised Hosts?
by Michel Py 23 Feb '04

23 Feb '04

> Deepak Jain wrote: > Would anyone be interested in receiving a text or BGP > feed of IPs of hosts known/suspected to be compromised > and used as parts of DDOS attacks? Would anyone be > interested in contributing their BGP views? There is a regrouping of BGP feeds for various "questionable" hosts and networks around AS29467; read http://arneill-py.sacramento.ca.us/draft-py-idr-redisfilter-01.txt and feel free to contact the authors. The different sources have different but commonly known communities. Michel.

4 3

eBGP, iBGP, injecting networks
by isaac＠ravengate.net 23 Feb '04

23 Feb '04

greetings list, hoping someone can hook me up on the right way to do this. --- we have two ASN's we control. we have two border/edge routers (1 in each ASN) that talks to a different backbone provider. the two border routers peer with eachother over eBGP and also are in the same OSPF process. (we are working to merge them into the same BGP ASN) my question is this: how do we achieve router redundancy between these two routers? currently if we lose a transit link, the traffic will flow fine out the other pipe. but we don't have BGP network statements in router 2 that exist in router 1 and we don't have BGP network statements in router 1 that exist in router 2. so the routes injected into BGP from router 1 will get withdrawn right if router 1 dies? is it a problem to announce the same networks from two different eBGP peers to two different upstreams? ------ if you are still reading, thanks! to clearify some more- current setup: current setup: ASN 1 (we're not Genu!ty- just using for an example) :) ASN 1 injects all of its own space and announces this space to Above.net and ASN 2 ASN 2 injects all of its own space and announces this space to Savvis and ASN 1. so stuff out on the net looks like: 1 6461 etc etc and 1 2 6347 ------- 2 6347 etc etc and 2 1 6461 etc etc ------- so, you see we are prepending on of our AS's on the way out. the problem is tho, we only have 1 router in each respective Autonmous System injecting address space. if we lose that router, we lose announcing that ASN's space. is it totally going to cause probs to have routes originating from two different AS's? routing loops would be a real drag. what about having an iBGP router in AS 1 inject the same space as the border router in AS 1? this other router also peers with AS 2.... thanks a lot! jg

7 7

O/T: fake identity seal was: RE: M$ CD patches
by Michel Py 23 Feb '04

23 Feb '04

By popular demand, I put back the "fingerprint" version of the authentic fake identity seal; go to http://arneill-py.sacramento.ca.us/ move the mouse cursor over the yellow padlock on the left. Might look a little bright on some platforms, gamma 1.8. My HTML is not quite sophisticated enough so it can detect Macs and pop a 2.2 gamma image instead. Enjoy! Michel. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Michel Py Sent: Saturday, February 21, 2004 3:31 PM To: Sean Donelan Cc: nanog list Subject: RE: M$ CD patches > Sean Donelan wrote: > Regardless of the distribution method, geniune Microsoft > patches are always cryptographically signed by Microsoft. > Whether consumers can figure out how to check the signature > is a different question. Lots can't. I recently put a fake "identity seal" on my personal web site (go to https://arneill-py.sacramento.ca.us and put the mouse cursor over the padlock on the left). It's completely bogus: not only the artwork has been greatly inspired by Comodo's thing (view the real thing here: http://www.instantssl.com/ssl-certificate-products/ssl-certificate-trust logo.html) when the actual SSL certificate comes from freessl.com, but it also works even if you view the insecure page http://arneill-py.sacramento.ca.us/. Besides, I do not have a credit card processing system, although I do accept donations in cash and gold bullions. So, what you're looking at is nothing more than a little photoshop and javascript. Guess what: I have received many questions that say in substance "how much does it cost to get the same seal as yours and can you come install it on my web server?" Michel.

1 0

RE: BL of Compromised Hosts?
by Michel Py 23 Feb '04

23 Feb '04

> Robert E. Seastrom wrote: > [..] Keep in mind one thing: the draft is aimed at developing/standardizing the mechanism to propagate filtering info, _not_ to regulate nor recommend the way it should be done in production nor who should do it. I have not heard anything so far about this being unclear, as I presented it at the last IETF: http://arneill-py.sacramento.ca.us/redisfilter.ppt. It seems to me that you are jumping into the boat late without a complete understanding of the history behind it. You put the car before the horse: we don't have such a mechanism yet, how could you judge it? One step at a time: first, we need vendors to implement. So far, only Cisco has shown some interest in it (CSCed45744). Some of us have set aside a 7500 to monkey with the beta code when it finally arrives [hint]. Then, all interesting parties (an when I whois AS29467 I see some legitimacy here) will evaluate how good the extended BGP feed mechanism is. If you think it stinks, just don't use it. As of myself, I welcome the efforts of Deepak and Daniel and invite them to join their efforts to a diverse group that is willing to spend some time for the common good. Michel. -----Original Message----- From: Robert E. Seastrom [mailto:rs@seastrom.com] Sent: Sunday, February 22, 2004 3:20 PM To: Michel Py Cc: Deepak Jain; nanog(a)merit.edu Subject: Re: BL of Compromised Hosts? "Michel Py" <michel(a)arneill-py.sacramento.ca.us> writes: > There is a regrouping of BGP feeds for various "questionable" hosts and > networks around AS29467; read > http://arneill-py.sacramento.ca.us/draft-py-idr-redisfilter-01.txt and > feel free to contact the authors. It behooves the prospective user of said feed to read and understand draft-py, carefully research the pedigree of the data sources that go into the soup, and draw his own conclusions - taking as conservative and discriminating an approach as he deems necessary in terms of what he accepts. I anticipate wide variance in the quality of feeds provided, based on previous conduct of the proposed initial participants. As the primary author has said in a private communique, "it's like RBL mailing lists: there are good and bad ones". Unfortunately, my reading of draft-py is that in this case, they're to be rolled up into a single feed, discernable only by community. I believe that's a step away from goodness. Wait, you say, filtering routes is easily done by any experienced user, right? Well, yes. Not everyone's an experienced user, though. My primary concern here is one of education; the danger with a roll-up feed such as this one is that the default case is to accord equal credence to every blacklist; the naive end-user would discover that not only had he signed up for the spiritual equivalent of MAPS (conservative, responsive, and responsible) but also SPEWS (hard-to-reach, petty, vindictive, and probably going to list my home mail server or maybe my whole /24 in retalliation for casting them in a negative light in a public forum). Of course, the RBL-consumer will learn about this when his customers call. Surprise, surprise, surprise... > The different sources have different but commonly known communities. ... which are undocumented in draft-py itself, and among the URLs listed in Section 2 for more information, only Team Cymru offers a BGP community advisory on their web page. So, I must not be part of the "in-crowd" to know these "commonly known" communities... ---Rob

1 0

BL of Compromised Hosts?
by Deepak Jain 22 Feb '04

22 Feb '04

Would anyone be interested in receiving a text or BGP feed of IPs of hosts known/suspected to be compromised and used as parts of DDOS attacks? Would anyone be interested in contributing their BGP views? We have (and I'm sure we're not isolated) been seeing attacks from several thousand/tens of thousands of unique hosts generated >2Gb/s, >1Mpps attacks. I am not necessarily suggesting that providers use this list to blackhole at their edge, but its certainly a good candidate for that. It could alternatively be used by access providers to notify their customers or filter on their customers. I am sure it would also be a good list to use to deny traffic to SMTP servers from/to. I'm not really an activist, so if there is real interest, I will be glad to set it up and contribute our own significant list of sources. If this is already done and I don't have a good set of skills with Google, please let me know. Thanks in advance, Deepak Jain AiNET

6 5

Spam and the Law Conference Presentations Available (including Audio)
by Anne P. Mitchell, Esq. 22 Feb '04

22 Feb '04

All, The proceedings of last month's Spam and the Law conference are now available through us. They are available as individual sessions, or you can get the entire conference (broken out into individual sessions). Each presentation includes the full audio of the speaker's presentation (and the quality is excellent - our sound guy did a superb job), along with any handouts, PowerPoints, etc.. There is a 25% discount for list members (only! Please don't share the discount link! If you want to tell someone about the availability of the proceedings, please just give them our website address at http://www.isipp.com) To get the discount, use this link: http://www.1shoppingcart.com/app/adtrack.asp?AdID=68216 It will redirect you to our site, and when you check out it will automatically apply the discount. Anne

1 0

Verizon clients DOS own site?
by Elkind_Rob＠emc.com 22 Feb '04

22 Feb '04

Anyone else seeing this, it started up a few weeks ago. We have a number of home users that VPN to our corporate network who are using Verizon DSL as their Internet provider. While they are connected to the corporate network they are generating tons of hits to 'supportcenter.verizon.net' (206.46.187.54) Here's a basic trace: host.on.my.net -> 206.46.187.54 TCP 49980 > HTTP [ACK] host.on.my.net -> 206.46.187.54 HTTP GET /sbconfigservlet/sbconfigservlet HTTP/1.1 206.46.187.54 -> host.on.my.net HTTP HTTP/1.1 404 Not found Here's the text of the transaction: host.on.my.net GET /sbconfigservlet/sbconfigservlet HTTP/1.1 Accept: */* Accept-Language: en If-Modified-Since: Mon, 09 Feb 2004 22:49:47 GMT User-Agent: Motive HTTP Client Host: supportcenter.verizon.net Connection: Keep-Alive Cache-Control: no-cache reply from 206.46.187.54 HTTP/1.1 404 Not found Server: Netscape-Enterprise/6.0 Date: Tue, 10 Feb 2004 19:37:05 GMT Content-type: text/html Content-length: 292 <HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html;charset=ISO-8859-1"><TITLE>Not Found</TITLE></HEAD><H1>Not Found</H1> The requested object does not exist on this server. The link you followed is either outdated, inaccurate, or the server has been instructed not to let you have it. This repeates over and over again many times a second while the client is connected. My guess is that these client files are the ones that initiate the conversation from the client: C:\program files\verizon\online\supportcenter\bin\matcli.exe C:\program files\verizon\online\supportcenter\bin\mpbtn.exe I'm seeing millions of hits to this site from just our ~100 users using Verizon per week. I have to think that world wide, Verizon clients are generating enough traffic to DOS themselves. I've tried contacting Verizon via email but I haven't received a response and their tech support had no information on this. Although we're now blocking this site and trying to clean up the clients, this is still generation a lot of noise on our network. Any ideas on how to get Verizon to take a look at this? Any input is welcome. Thanks, > Rob Elkind Information Security Engineer > EMC² > where information lives > > Email: elkind_rob(a)emc.com > >

13 17

RE: M$ CD patches
by Michel Py 21 Feb '04

21 Feb '04

> Sean Donelan wrote: > Regardless of the distribution method, geniune Microsoft > patches are always cryptographically signed by Microsoft. > Whether consumers can figure out how to check the signature > is a different question. Lots can't. I recently put a fake "identity seal" on my personal web site (go to https://arneill-py.sacramento.ca.us and put the mouse cursor over the padlock on the left). It's completely bogus: not only the artwork has been greatly inspired by Comodo's thing (view the real thing here: http://www.instantssl.com/ssl-certificate-products/ssl-certificate-trust logo.html) when the actual SSL certificate comes from freessl.com, but it also works even if you view the insecure page http://arneill-py.sacramento.ca.us/. Besides, I do not have a credit card processing system, although I do accept donations in cash and gold bullions. So, what you're looking at is nothing more than a little photoshop and javascript. Guess what: I have received many questions that say in substance "how much does it cost to get the same seal as yours and can you come install it on my web server?" Michel.

1 0

MS can't live with it can't live... with it
by J. Oquendo 21 Feb '04

21 Feb '04

> In the future you may be able to obtain patches through other > distribution channels, e.g. your ISP or consumer electronics chain or > original equipment manufacturer. Perhaps MS should pay a fee to companies such as ISP's (would never happen) to distribute their fixes. Judging from my experience now working at an ISP, I can tell you it is a nightmare dealing with their flaws. > Regardless of the distribution method, geniune Microsoft patches are > always cryptographically signed by Microsoft. Whether consumers can > figure out how to check the signature is a different question. Not to kick a horse when its down, but to think that users who have (and most continually) become infected - because they decided to read Hello! and Hi! messages from someone they don't even know, over and over, and constantly wonder why their attachments look funny - will understand or even care what a signature is, is boggling. Maybe MS should take some time and make a "RTFM for Dummies" interactive video so their users can learn a thing or two. Understanding what an MS cert if and why you need it. Why are MS Updates (all 6! per week) are important to install, etc. > Perhaps more significant is Mail Fraud is a well tested law, which has > trained, sworn law enforcement active the United States Postal > Inspection Service. Unlike ISP abuse departments, the USPIS has > badges, carries guns and the legal authority to arrest people. > I wouldn't want to get into a shoot out over this, but if someone were going to do something on this scale, depending on the setup, the US government wouldn't be able to do much if it were set up properly. Regardless of how many guns whoever is carrying. Not to give out suggestions nor get myself in any trouble answering a question, but it could be done to such an extent the USPS, would be null. FBI, on the other hands, depends. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "Men have been taught that it is a virtue to agree with others. But the creator is the man who disagrees. Men have been taught that it is a virtue to swim with the current. But the creator is the man who goes against the current. Men have been taught that it is a virtue to stand together. But the creator is the man who stands alone." -- Ayn Rand

1 0