May 2004 - NANOG - lists.nanog.org

RE: What percentage of the Internet Traffic is junk?
by Michel Py 06 May '04

06 May '04

Bill, > What percentage of the Internet traffic is junk? I think two things needs to be clarified: 1. What is "junk" (my $0.02: "junk" is what is as follows and associated by-product traffic of: - Viruses - Worms - Attacks of all kinds including DOS/dDOS - Spam - Crapware (which includes unwanted pop-up windows while surfing, challenging to measure) 2. Assuming that we a) have a clear definition of 1. and b) are able to netflow-measure it (both of which present challenges), how do you define "Internet traffic" and WHERE would you measure it (if it was technically possible to sniff/netflow everywhere). In other words, does "Internet traffic" include: - Peering traffic between tier-1s (at Equinix facilities, of course :-) - Transit traffic from/to tier-1s to smaller operators. - Peering between content providers and eyeballs. - Peering between eyeballs. - Peering between x and y (you should read Bill Norton's papers about peering, me thinks) - Internal traffic within eyeballs. - Non-data traffic (VOIP..)? - Etc? Michel.

1 0

RE: What percentage of the Internet Traffic is junk?
by Michel Py 06 May '04

06 May '04

> Steve Gibbard wrote: > If a few of you can stop being so pedantic for a second, > the definition looks pretty easy to me: traffic unlikely > to be wanted by the recipient. This looks good to me although it also needs to include _return_ traffic from junk traffic (say, you flood a target with ICMP echo request, and the target does not rate-limit the ICMP echo reply; in that case the reply is junk as well as the request although it is wanted by the destination which is the attacker). Another way at looking at the issue is to measure how much traffic is legitimate. Your mileage may vary and I made up the following figures as they can greatly vary depending on the network, but... Let's say there's 50% of p2p file sharing, 10% of downloading pr0n, 5% of downloading services packs and anti-virus signatures and 15% of misc HTTP surfing, all of which I would consider legitimate and would also match Steve's definition, this already makes for 80% legit. Legal != legit IMHO. Although 99% of p2p file sharing traffic is likely illegal, it is legitimate (the destination wants to receive it). Michel.

1 0

Yahoo Mail problems ? (queue issues in general)
by Mike Tancsa 05 May '04

05 May '04

Anyone else seeing Yahoo mail queue up today ? Some of their servers respond in about 10secs with the HELO banner, most others take more than 2m. Because of the recent increase in SPAM, I was looking to reduce the wait time for the initial HELO to 2m from 5m. However, the RFC calls for 5m on the HELO and another 5m for the MAIL command. Having a process block like that for up to 10m seems a bit excessive to deliver one email (and its probably a bounce to boot!). What are others doing? This problem seems to becoming more and more acute. ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

2 2

RE: BGP Exploit
by Smith, Donald 05 May '04

05 May '04

I have seen 3 pubic ally available tools that ALL work. I have seen 2 privately tools that work. A traffic generator can be configured to successfully tear down bgp sessions. Given src/dst ip and ports : I tested with a cross platform EBGP peering with md5 using several of the tools I could not tear down the sessions. I tested both Cisco and juniper BGP peering after code upgrades without md5 I could not tear down the sessions. Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Steven M. Bellovin > Sent: Tuesday, May 04, 2004 11:54 AM > To: Kurt Erik Lindqvist > Cc: kwallace(a)pcconnection.com; nanog(a)merit.edu > Subject: Re: BGP Exploit > > > > > In message > <C4E8C22A-9DA6-11D8-B28B-000A95928574(a)kurtis.pp.se>, Kurt > Erik Lindq vist writes: > > >> > >> Now that the firestorm over implementing Md5 has quieted > down a bit, > >> is anybody aware of whether the exploit has been used? > Feel free to > >> reply off list. > > > >Even more interesting, did anyone manage to reproduce it? > > > > I don't know if it's being used; I know that reimplementations of the > idea are out there. > > > --Steve Bellovin, http://www.research.att.com/~smb > > >

3 2

RE: Worms versus Bots
by Michel Py 05 May '04

05 May '04

> Matthew Crocker wrote: > We require a NAT device or true firewall on all DSL > customer connections. We sell cheap Linksys boxes > to customers or they can upgrade to a SonicWall. This makes a lot of sense to me. It's not a silver bullet, but it does help. > I still like PPPoE for customer authentication > because I can place individual packet filters or > re-assign users to different contexts based on > username/password authentication. PPPoE/NAT is a > good combination. Tends to be a non-issue now, but it's a lot easier to deal with PPPoE on the Linksys than have the customer install a more or less crummy PPPoE client on their PC. The cost of dealing with one customer that trashed their PC installing an early PPPoE client (with the help of helpdesk :-( is worth ten Linksys. Michel.

1 0

RE: BGP Exploit
by Smith, Donald 05 May '04

05 May '04

%tcp-6-badauth: No MD5 digest from SRC.IP.NET.HOST(portnumber) to DST.IP.NET.HOST(portnumber) Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: james [mailto:hackerwacker@cybermesa.com] > Sent: Tuesday, May 04, 2004 4:41 PM > To: Smith, Donald > Cc: nanog(a)merit.edu > Subject: Re: BGP Exploit > > > What would a Cisco log if the IP's for the BGP sessions were > attacked & MD5 was in place ? "No MD5 digest from <IP>", " > Invalid MD5 digest from <IP>" or something else ? So far, > grepping through my logs all I see for "MD5" are the the > times I set MD5 for my BGP sessions. > > -- > James H. Edwards > Routing and Security > At the Santa Fe Office: Internet at Cyber Mesa > jamesh(a)cybermesa.com noc(a)cybermesa.com > (505) 795-7101 > >

1 0

RE: "Network Card Theft Causes Internet Outage"
by Bil Herd 05 May '04

05 May '04

One time Agis (remember Agis) hired me to go down to the local Pennsauken NAP to find out what was wrong with their remote access to what was then a core router. Someone had swiped the $.10 silver satin cord for the modem. Had to be the cheapest theft with the highest consequences I have seen. Bil P.S. Damm networking business has screwed up my english, I keep wanting to type swip instead of swipe and swipped instead of swiped. -----Original Message----- From: jlewis(a)lewis.org [mailto:jlewis@lewis.org] Sent: Tuesday, May 04, 2004 10:04 AM To: nanog(a)merit.edu Subject: Re: "Network Card Theft Causes Internet Outage" On Tue, 4 May 2004, Andy Dills wrote: > http://www.eweek.com/article2/0,1759,1583347,00.asp > > "Law enforcement officials said four DS-3 cards were reported missing > from a Manhattan co-location facility owned by Verizon Communications > Inc. The theft at 240 E. 38th St. occurred just after 10:30 p.m. on > Sunday and is Is this part really surprising to anyone who's got gear in unsupervised LEC colos where everyone is in open relay racks in a large open space? > being investigated by New York City Police and members of the joint > terrorism task force, according to NYPD spokesman Lt. Brian Burke. " This seems a bit over the top. A couple years ago when we had a part stolen out of one of our routers in a WCOM colo facility, we couldn't get the local PD to do jack. A report was filed...but I think they filed it in the circular file, because nobody ever investigated, despite the fact that WCOM had just installed a card reader system to replace the simplex door locks, so in theory, they knew who was in the room when our stuff was stolen, but they refused to release the info to us. I guess we should have suggested it was an act of terrorism. > Trying to fix our terrorism problem like this is like trying to fix > the spam problem using IP-based blacklists. No...I'd say it's more like fighting the spam problem with nuclear weapons...now there's an idea. ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

RE: Security of Equipment in poorly-secured locations.
by Williams, Jeff 05 May '04

05 May '04

Although a webcam is cheaper, Netbotz has a slick rackmount camera that does envionmentals as well. On motion detection it snaps 5 frames off to a central server which can be tied into a NMS. In this particular case, the colo being open racks (apparently), physical security was lacking a lot. But, just as with spam, the measure - counter-measure struggle goes on. "Locks only keep honest people out." Jeff 'scuse the disclaimer below. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Bruce Campbell Sent: Tuesday, May 04, 2004 2:04 PM To: North American Noise and Off-topic Gripes Subject: Security of Equipment in poorly-secured locations. On Tue, 4 May 2004, Jay Hennigan wrote: > Subject: Re: "Network Card Theft Causes Internet Outage" > Of course, it's just as likely that a Verizon employee lifted them as > a colocation customer, and either is far more likely than terrorists. So, say that your equipment, sitting in a shared facility, suffered 'tampering' of some description. What would you do to prevent that happening in the first place, or failing that, to have a positive description to hand to the local authorities? To start off, what we've done with our gear thats located in a shared facility is to change the locks on our racks so the facility rack key (which everyone has a copy of) doesn't work. The administrators of the facility have a copy of our rack key in order to do any remote hands work that we need though. What has been suggested (but not implemented) for our gear is to have a network camera on the inside of each rack activated by the racks being opened (for some vague definition of 'opened'). Easily defeated by lifting the floor tiles and disconnecting the uplink cable of course, but reasonable peace of mind against the casual equipment lifter. -- Bruce Campbell. Sysadmin/Etc. ************************************************************** This message, including any attachments, contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, please contact sender immediately by reply e-mail and destroy all copies. You are hereby notified that any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited. TIAA-CREF **************************************************************

2 1

RE: FW: Worms versus Bots now religion host security vs firewall/nat/acl
by Michel Py 05 May '04

05 May '04

> Smith, Donald wrote: > Feel free to read the document and make suggestions > (within scope) for improvements. I would change the title to something like "install windows xp and all updates securely". The current title misleads the reader into thinking that (s)he could actually use the computer at the end of the first day. > " Steps outlined in this guide should be seen as > minimum due diligence to make it through the first > day of using Microsoft Windows XP." I disagree with this. Minimum due diligence _before_ using XP is IMHO something along the lines of the list I posted earlier. A Windows computer that does not have an antivirus is not ready to be used. A Windows computer that does not have a good software firewall is not ready to be used. Use != install. Michel.

1 0

Dial up goes boom
by J. Oquendo 05 May '04

05 May '04

Sorry for the premature message of: "Once, twice, three times... an outtage. TNT's just went bonkers" Anyone else in NYC, Westchester having issues? =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net 'Everything we hear is an opinion, not a fact. Everything we see is a perspective, not the truth.' -- Marcus Aurelius

1 0