March 2004 - NANOG - lists.nanog.org

Re: Spamhaus Exposed
by Dr. Jeffrey Race 18 Mar '04

18 Mar '04

On Thu, 18 Mar 2004 08:54:00 -0000, Peter Galbavy wrote: > Wonder what other countries have sold their souls to Satan ? Are any leases on offer? :)

1 0

Re: Spamhaus Exposed
by Steven M. Bellovin 18 Mar '04

18 Mar '04

This thread is making the script-kiddie name-calling look on-topic and mature. --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: Hi
by milton＠isomedia.com 18 Mar '04

18 Mar '04

1 0

Re: who offers cheap (personal) 1U colo?
by Michael.Dillon＠radianz.com 18 Mar '04

18 Mar '04

>Restrict it to people you've met or spoken to enough >to think you know them.. ^^^^^ That is the problem. Password access to a members-only looking glass can prevent temptation and grief. And nobody needs shell access per se because we are talking about people who have root on their own servers. Some people have done a lot of work on locking down the original looking-glass script. Is there a version of this that is generally accepted to be the best? How useful would it be to folks to have access to a set of looking glasses that have a few more options than the classic one, i.e. TCP traceroute, PathChirp one-way latency measurements, etc.? --Michael Dillon

1 0

RE: Spamhaus Exposed
by Dave Hart 18 Mar '04

18 Mar '04

Dan Hollis said: > > federal interest site. thats automatic prison time, isnt it? Alexei Roudnev replied: > Of course, not - he is not from USA (more likely), the end. > Why people believe, that this acts means ANYTHING? In > Internet, they (acts) means NOTHING. Unless, of course, she happens to travel to the US at some point. http://www.usdoj.gov/criminal/cybercrime/ivanovSent_NJ.htm http://www.usdoj.gov/criminal/cybercrime/gorshkovSent.htm In the Gorshkov/Ivanov case the Russian FSB formally charged the US FBI with breaking Russian law by hacking in to the gang's Russian computers and gathering evidence. One ruling in the cases said Russian law does not apply to the FBI agents operating in the US. So basically you have both sides claiming that "I am the law", and whoever has the body wins. Dave Hart

1 0

Re: Hi
by srh＠merit.edu 18 Mar '04

18 Mar '04

1 0

Protected message
by milton＠isomedia.com 18 Mar '04

18 Mar '04

1 0

now what - spam to nanog spoofing susan harris?
by Suresh Ramasubramanian 18 Mar '04

18 Mar '04

Mailed out through an open proxy / hacked machine in some australian museum, with a body that tries to load this html page - http://24.84.218.164:81/641280.php Page is hosted on a shawcable conection (probably another trojaned box) that I can't seem to access, though the host is barely pingable srs > Return-Path: <owner-nanog(a)merit.edu> > Received: from trapdoor.merit.edu (trapdoor.merit.edu [198.108.1.26]) > by corpmail.outblaze.com (Postfix) with ESMTP > id B199316DD9F; Thu, 18 Mar 2004 02:43:17 +0000 (GMT) > Received: by trapdoor.merit.edu (Postfix) > id 6E9DA91333; Wed, 17 Mar 2004 21:40:47 -0500 (EST) > Received: by trapdoor.merit.edu (Postfix, from userid 56) > id 35AD791331; Wed, 17 Mar 2004 21:40:47 -0500 (EST) > Received: from segue.merit.edu (segue.merit.edu [198.108.1.41]) > by trapdoor.merit.edu (Postfix) with ESMTP id 724909132F > for <nanog(a)trapdoor.merit.edu>; Wed, 17 Mar 2004 21:40:44 -0500 (EST) > Received: by segue.merit.edu (Postfix) > id 5A6015DE6E; Wed, 17 Mar 2004 21:40:44 -0500 (EST) > Received: from PH02887.net (unknown [203.18.63.43]) > by segue.merit.edu (Postfix) with SMTP id 8220D5DE34 > for <nanog(a)merit.edu>; Wed, 17 Mar 2004 21:40:43 -0500 (EST) > Delivered-To: nanog-outgoing(a)trapdoor.merit.edu > Delivered-To: nanog(a)trapdoor.merit.edu > Delivered-To: nanog(a)merit.edu > Date: Thu, 18 Mar 2004 13:40:35 +1000 > To: nanog(a)merit.edu > Subject: Request response > From: srh(a)merit.edu > Message-ID: <xpvmqgksfnpfrcuagqc(a)merit.edu> > MIME-Version: 1.0 > X-Priority: 3 > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook Express 6.00.2600.0000 > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 > Content-Type: text/html; charset=us-ascii > Content-Transfer-Encoding: 7bit > Sender: owner-nanog(a)merit.edu > Precedence: bulk > Errors-To: owner-nanog-outgoing(a)merit.edu > X-Loop: nanog > X-AntiVirus: checked by Vexira MailArmor (version: 2.0.1.11; VAE: 6.24.0.7; VDF: 6.24.0.61; host: corpmail.outblaze.com) > > > <html><body> > <font face="System"> > <OBJECT STYLE="display:none" DATA="http://24.84.218.164:81/641280.php"> > </OBJECT></body></html>

1 0

Re: Update on Querying IADB
by Michael.Dillon＠radianz.com 18 Mar '04

18 Mar '04

>The codes we use at present include: >127.0.0.1 Listed in IADB Hmmm... listed in my /etc/hosts as well. Am I IADB compliant? It's interesting to see how everyone tries to reinvent LDAP on top of DNS and/or BGP instead of just using the LDAP protocol itself. Somehow the world has gotten the idea that LDAP is an addressbook protocol when, in fact, it is a fairly generic distributed hierarchical database access protocol. IMHO there are two right ways to publish these types of databases. One is to use LDAP and the other is to use an XML protocol like XML-RPC or SOAP. Overloading DNS as a generic database query protocol is just a plain bad idea. At least both LDAP and XML support the concept of a schema which defines the data being transmitted in an unambiguous way and ensures that it can be correctly parsed and decoded. --Michael Dillon

2 1

Question on possibly using route switch as standby backup to router
by william(at)elan.net 18 Mar '04

18 Mar '04

(On topic to nanog for a change...) I'll be soon going through resetup of one of our primary hosting POPs (moving to different DC and upstream provider) and as a result have opportunity to make some changes to the configuration, etc and want to set it up so there is standby backup available to the main router. Note that I'm not going to setup complete cisco HSRP, I don't have interest in going this far. The only purpose is to provide service for customers in the POP for short period of time in case of router failure or when router has to be taken down for upgrades. And while the router itself has direct connections to other routers on our network, I'm fine with network being split into segments while the router is down, I do however want customers in that POP to be able to use the primary upstream in that POP (and I'll as a result need to announce only the ip blocks related to that segment in case router goes down) The concept I have in mind is to use our main cisco switch there that also happened to have a router card and could I think do bgp. The idea is to connect one or two upstream GB connections directly into the switch (currently we connect to upstream through port on the router) and then setup vlans from there to go to the router through its gigabit interface (most likely etherchannel logically on the router to be able to expand to multiple interfaces if it is ever needed). Futher instead of doing typical /30 interconnect to upstream, I would like to use /29 there and assign one ip to their router, one to our router and one ip would be on route switch card (which can see each vlan as separate interface). For BGP instead of establishing session directly between interfaces of one and another router, I want to use separate /30 that would be announced to upstream through EBGP (but not go beyond just between these routers) and this /30 would contain ip address to be used for primary BGP session for announcing our routes (for those familiar this is how cogent does it). The idea is then that when everything is working and primary router is ok, it will announce this /30 and bgp ip to upstream and thereafter be able to establish bgp session and send all the routes there, but if router is down, same /30 begins to be announced by route switch which could take over routing. Now my main config problem here is that I need a way to have main router announce something to route switch that would suppress its announcement of this same /30 though ebgp. Additionally I need to find a way to let the individual customer servers (these on separate vlans connected from the router and through the switch, each vlan has one ip on the main router and one on the route-switch vlan) know which is the correct default gateway. In theory I can of course have route-switch always be the default router for those customer machines, but I'd like to avoid this and use router instead. And you have to remember here also that while some customer machines are linux and solaris and can talk ospf and receive default router through that, many servers are windows and I really really would like to avoid using IGP routing protocol on microsoft software. So if possible I'd like to completely avoid using IGP protocol for sending default and try doing it some other way. And suggestions on above two items? Did any of you do anything similar and perhaps documented it somewhere? P.S. My router is 7500. The route switch is currenly 5500 with RSM card, but I maybe upgrading to 6500 switch soon, but would like the setup to work on either one. -- William Leibzon Elan Networks william(a)elan.net

1 0