May 2004 - NANOG - lists.nanog.org

RE: Worms versus Bots
by Michel Py 13 May '04

13 May '04

> Jonathan M. Slivko > Uh... they have. It's called a Snapgear card :) Same as the 3com card, this is not for the consumer market. First, the consumer is generally afraid of opening the PC. Second, it costs many times more than a Linksys or other el-cheapo external box. Michel.

1 0

RE: Worms versus Bots
by Michel Py 13 May '04

13 May '04

> Chris Woodfield wrote: > I stand corrected, they're out there. I'm advised that > 3com has a on-NIC firewall product as well. > However, at $299 and $329 respectively, I don't anticipate > wide adoption in the consumer market... No danger, as it is not worth jack as a standalone product; requires a centralized server to tell it what to do. Not for the consumer market in the first place. Even for the corporate market, $300 + the server + managing the whole enchilada == to much $$$ per port. Michel.

1 0

nsp-sec BoF agenda
by Merike Kaeo 12 May '04

12 May '04

Hello all. Danny and I will be moderating (facilitating) the upcoming nsp-security BoF at NANOG. Below is the agenda..... >================================================== >NSP Security BOF >Monday Evening, May 24, 2004 >Chairs: Merike Kaeo & Danny McPherson > >AGENDA: > >Barry Dykes/Viawest: DOS/Security Incident Handling (~10 minutes) >Roland Dobbins/Cisco IT: DOS/Security Incident Handling (~10 minutes) >Michael Bailey & Evan Cooke/UoM: IMS (~15 minutes) >Blaine Christian/MCI:TTL Filterings (~15 minutes) >Dave Ward/Cisco: BGP over IPSEC (~15 minutes) >Wendy Garvin/Cisco PSIRT: TCP Vulnerability (~15 minutes) >Chairs/Open Discussion: TCP Vulnerability Q & A (~15 minutes) >Patrick Gilmore/Open Discussion: Responding to Vulnerability Rumors (~15 >minutes) >Open Floor for Discussions - merike and danny - merike

1 0

RE: BGP Exploit
by Mark Johnson 12 May '04

12 May '04

Hi, > What would a Cisco log if the IP's for the BGP sessions were > attacked & MD5 > was in place ? What if sessions were attacked without MD5 in place. We would just see session resets. As these happen anyway frequently at peering points is there any straightforward way to determine if the vulnerability caused the reset? Kind regards, Mark

2 1

Spamcop
by Vicky Rode 12 May '04

12 May '04

Hi there, Just wondering why was my e-mail thread (Hierarchical Credit-based Queuing (HCQ): QoS) dated 5/9/2004 9:36 PM reported as a spam? Just trying to understand so that I don't repeat it. Below is a cut and paste of the reported incident. Please advice. regards, /vicky ---- cut here ------ Return-Path: <988145978(a)bounces.spamcop.net> Received: from vamx01.mgw.rr.com ([24.28.193.148]) by acme-reston.va.rr.com (Post.Office MTA v3.5.3 release 223 ID# 0-59787U250000L250000S0V35) with SMTP id com for <abuse(a)rr.com>; Mon, 10 May 2004 10:42:14 -0400 Received: from vmx2.spamcop.net (vmx2.spamcop.net [206.14.107.117]) by vamx01.mgw.rr.com (8.12.10/8.12.8) with ESMTP id i4AEkwhn017175 for <abuse(a)rr.com>; Mon, 10 May 2004 10:47:01 -0400 (EDT) Received: from sc-app3.verio.ironport.com (HELO spamcop.net) (192.168.11.203) by vmx2.spamcop.net with SMTP; 10 May 2004 07:47:00 -0700 Received: from [68.13.211.63] by spamcop.net with HTTP; Mon, 10 May 2004 14:47:01 GMT From: 988145978(a)reports.spamcop.net To: abuse(a)rr.com Subject: [SpamCop (24.30.181.126) id:988145978]Hierarchical Credit-based Queuing (HCQ): QoS Precedence: list Message-ID: <rid_988145978(a)msgid.spamcop.net> Date: Sun, 9 May 2004 21:36:30 -0700 (PDT) X-SpamCop-sourceip: 24.30.181.126 X-Mailer: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705) via http://www.spamcop.net/ v1.3.4 X-Virus-Scanned: Symantec AntiVirus Scan Engine [ SpamCop V1.3.4 ] This message is brief for your comfort. Please use links below for details. Email from 24.30.181.126 / Sun, 9 May 2004 21:36:30 -0700 (PDT) http://www.spamcop.net/w3m?i=z988145978zab5cec781dcfa15ae459c11bd03b7bef z [ Offending message ] Return-path: <owner-x> Envelope-to: x Delivery-date: Mon, 10 May 2004 00:39:15 -0400 Received: from [198.108.1.26] (helo=trapdoor.merit.edu) by wilma.widomaker.com with esmtp (Exim 3.36 #1) id 1BN2ZP-000Jo6-00 for x; Mon, 10 May 2004 00:39:15 -0400 Received: by trapdoor.merit.edu (Postfix) id B68EC91206; Mon, 10 May 2004 00:36:37 -0400 (EDT) Delivered-To: x Received: by trapdoor.merit.edu (Postfix, from userid 56) id 8645591243; Mon, 10 May 2004 00:36:37 -0400 (EDT) Delivered-To: x Received: from segue.merit.edu (segue.merit.edu [198.108.1.41]) by trapdoor.merit.edu (Postfix) with ESMTP id 50AFD91206 for <x>; Mon, 10 May 2004 00:36:34 -0400 (EDT) Received: by segue.merit.edu (Postfix) id 3B3955914F; Mon, 10 May 2004 00:36:34 -0400 (EDT) Delivered-To: x Received: from ms-smtp-02-eri0.socal.rr.com (ms-smtp-02-qfe0.socal.rr.com [66.75.162.134]) by segue.merit.edu (Postfix) with ESMTP id EAB7358E5D for <x>; Mon, 10 May 2004 00:36:33 -0400 (EDT) Received: from [192.168.2.2] (cpe-24-30-181-126.socal.rr.com [24.30.181.126]) by ms-smtp-02-eri0.socal.rr.com (8.12.10/8.12.7) with ESMTP id i4A4aUce025659 for <x>; Sun, 9 May 2004 21:36:30 -0700 (PDT) Message-ID: <409F________0602(a)socal.rr.com> Date: Sun, 09 May 2004 21:36:41 -0700 From: Vicky Rode <vickyr(a)socal.rr.com> Reply-To: vickyr(a)socal.rr.com User-Agent: Mozilla Thunderbird 0.6 (Windows/20040502) X-Accept-Language: en-us, en MIME-Version: 1.0 To: x Subject: Hierarchical Credit-based Queuing (HCQ): QoS X-Enigmail-Version: 0.83.6.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: Symantec AntiVirus Scan Engine Sender: owner-x Precedence: bulk Errors-To: owner-nanog-outgoing(a)merit.edu X-Loop: nanog Hi there, Just wondering if anyone out there has either implemented or looked into this queuing method for quality of service implementation. This solution is offered (hardware solution) and patented by foursticks.com. According to foursticks, "HCQ achieves the efficiency and flexibility of first generation queuing systems, without the disadvantages." It compares HCQ (interesting reading) w/ Class-Based Queuing (CBQ), Random Early Discard (RED) and Weighted Random Early Discard (WRED),Weighted Fair Queuing (WFQ),Priority Queuing (PQ) & Low Latency Queuing (LLQ). Also can anyone recommend a qos forum which I can ping as well. Any insight will be appreciated. regards, /vicky

9 10

Announcing BGPlay - A Tool Hosted By the RIPE NCC that Visualises BGP Updates
by Matthew Williams 12 May '04

12 May '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear All, The Roma Tre University Computer Networks Research Group and the RIPE NCC are pleased to announce BGPlay, a new beta tool that can visualise BGP updates in the Routing Information Service's (RIS) database. Its animated, interactive graphical display makes it easier to interpret how BGP updates affect the routing of a specific prefix than by analysing the updates themselves. For an idea of what BGPlay can do, please visit the BGPlay web page at: http://www.ris.ripe.net/bgplay/ and click on the screenshot for an interactive help page. BGPlay was developed by the Computer Networks Research Group at Roma Tre University, and is hosted by the RIPE NCC, who provide direct access to the RIS database. Links to Respective Groups: * RIPE NCC Routing Information Service: http://www.ripe.net/ris/ * Roma Tre Computer Networks research Group: http://www.dia.uniroma3.it/~compunet/ Please note that BGPlay requires the Java browser plug-in version 1.4 or above (you can download it at http://www.java.com/en/download/ if you don't have it). If you have the Java plug-in installed, click on one of the links below for examples of BGPlay in action: 1. I.Net adds a new upstream: http://www.ris.ripe.net/cgi-bin/bgplay.cgi?prefix=194.185.0.0/16&start =2004-04-08+14:02&end=2004-04-08+14:04 2. Deutsche Telekom starts announcing a new network: http://www.ris.ripe.net/cgi-bin/bgplay.cgi?prefix=84.128.0.0/11&start= 2004-03-16+08:07&end=2004-03-16+08:10 3. A local instance of F root is leaked globally: http://www.ris.ripe.net/cgi-bin/bgplay.cgi?prefix=192.5.5.0/24&start=2 004-03-17+19:30&end=2004-03-18+22:00 4. An anycast prefix with multiple origin ASes: http://www.ris.ripe.net/cgi-bin/bgplay.cgi?prefix=192.88.99.0/24&start =2004-04-01+03:00&end=2004-04-01+20:00 For more information on BGPlay and to run queries of your own, visit the BGPlay web page at http://www.ris.ripe.net/bgplay/ Please send your comments to bgplay(a)dia.uniroma3.it and ris(a)ripe.net. Kind regards, Roma Tre University Computer Networks Research Group & the RIS Team at RIPE NCC --- > Matthew Williams (MW243-RIPE) > Customer Liaison Engineer > RIPE NCC - http://www.ripe.net/np/ -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBQKFudcHkFbJe+GdoEQKw+wCgtKBk1x7u243SphgxdF7ozyhqYRAAoLAw 6F+ERBNpTJyWGH0Voo0qggzF =RzQH -----END PGP SIGNATURE-----

1 0

WAN transfer rates
by Jeff Nelson 11 May '04

11 May '04

Possibly someone in this forum with a better understanding of tcp/ip can articulate this better than I.... I realize that transfer rates across the Internet diminish significantly with latency, but what's the good answer for someone shrunk down to <10Mbps when the smallest pipe between them is 100Mbps and latency is <40ms? Does anyone have reference to any study done in this area? I'm sure window tuning can alter this, but I'm interested in average statistics. Any reference would be appreciated. thanks, jeff

3 2

Re: WAN transfer rates
by Peter Lothberg 11 May '04

11 May '04

TCP is mostly a implemenation/parameter setting problem for resonable speeds, for high_speed, you can not drop packets. Have a look at proj.sunet.se/LSR2. 2 $1500 mail_order PC's, 40 router hops, almost around half of the earth. -Peter

2 1

Re: Spamcop
by Guðbjörn S. Hreinsson 11 May '04

11 May '04

> >. There have been no reminders from > > the mailing list since I signed up which I think is a good policy for a > > mailing list. The mailing list only uses "Precedence: bulk" to mark it as > > a mailing list. > > the list is pretty active, so i would dare say that reminders are > superfluous. an iq test at subscription time would probably work better to > prevent situations like this in the future. Right, the reminder may have no value for the intended recipient which is the one that signed up. However, in the case of an inherited email address this may be valuable. But an IQ test would be nice. What should be the I to test for? Rgds, -GSH

2 1

MightAnyone from swbell on the list? - large name scanning from your DSL
by Nicole 11 May '04

11 May '04

Well as the subject says.. 4 various mail servers (4 very different companies) are being heavily name guessing scanned via various machines on the xxxxxxx.dsl.rcsntx.swbell.net network. Been going on for a few days now. All from within this block and loads of it. Reported it but no response. Nicole -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ "The term "daemons" is a Judeo-Christian pejorative. Such processes will now be known as "spiritual guides" -Politicaly Correct UNIX Page http://www.nonsenseband.com *** Spam Sucks and I get tons of it. So I have some tight spam filters. If any email to me bounces, please use your secret decoder ring and send to blabgoo at yahoo dot. com :)

1 0