March 2005 - NANOG - lists.nanog.org

Program survey -- extended
by Steve Feldman 14 Mar '05

14 Mar '05

Since I've been sick for the last few days, I won't be able to do anything with the survey results until mid-week. So I'm giving all of you procrastinators a reprieve: The survey will stay open until 21:00 PST, Wednesday 3/16. NANOG survey page: http://www.nanog.org/surveys.html Steve

1 0

Know your Enemy: Tracking Botnets
by Fergie (Paul Ferguson) 14 Mar '05

14 Mar '05

Ran across this paper this morning: http://www.honeynet.org/papers/bots/ Thanks to the folks at The Honeynet Project & Research Alliance, and the folks at the ISC for pointing out a fine paper. - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

history 101
by bmanning＠vacation.karoshi.com 14 Mar '05

14 Mar '05

something to listen too ... >Morning Edition, March 14, 2005 Â· Donald Knuth is legendary in the >computer science world for writing a series of must-have reference books >called The Art of Computer Programming. Part cookbook, part textbook, part >encyclopedia, these books are also considered by many to be technical and >personal works of art. > > >http://www.npr.org/templates/story/story.php?storyId=4532247A --bill

2 1

Re: Obsolete bogon filtering
by Joe Provo 13 Mar '05

13 Mar '05

> If you run any bogon filtering, can you please check your > border ACLs and BGP prefix filters to ensure that you're > no longer preventing access to 58.0.0.0/8 or 59.0.0.0/8 ? [snip] It is useful to point out that APNIC indicates the minalloc in 59/8 is /20 and 58/8 is /21. I see several prefixes 'in the wild' which are longer, so where you think you might be seeing old bogon filters you are potentially seeing registry minalloc filters. Cheers, Joe -- RSUC / GweepNet / Spunk / FnB / Usenix / SAGE

2 1

RE: IRC bots...
by Hannigan, Martin 13 Mar '05

13 Mar '05

> -----Original Message----- > From: Bill Nash [mailto:billn@billn.net] > Sent: Saturday, March 12, 2005 8:09 PM > To: Hannigan, Martin > Cc: Fergie (Paul Ferguson); nanog(a)merit.edu > Subject: RE: IRC bots... > > > On Sat, 12 Mar 2005, Hannigan, Martin wrote: > > > [ SNIP ] > > > > Who's got time for all that? Chase the controller, shut down > > the user until they buy some AV software. We've gone beyond > > "I didn't know" for endusers in most regions. > > Enterprise IT staff running from whip-cracking security > staff, that's who > has time for it. The botnet problem is in Internet policy land, FWIW. It's operational. For now. I think it's controllable at the 'security policy' level for corporations. My point regarding it being the same as spam is that many people are already not interested in it for the same reasons as spam. YMMV. [ SNIP ] -M<

1 0

Indian telecom regulator cuts upper limit on international bandwidth prices by up to 70%
by Suresh Ramasubramanian 13 Mar '05

13 Mar '05

International bandwidth has tended to be way overpriced in India for various reasons (poor routing policies locally, no peering till recently, incumbent telco which was the sole reseller for international bandwidth into the country and preferred maintaining an artificial shortage..) E1, DS-3 and STM-1 international bandwidth costs are now capped at INR 1.3 million, 10.4 million and 29.9 million pa respectively (INR 50 ~ USD 1) -- Suresh Ramasubramanian (ops.lists(a)gmail.com) http://www.trai.gov.in/pr11mar05.htm PDF DOWNLOAD Telecom Regulatory Authority of India Press Release No. 24/2005 11th March, 2005 TRAI Fixes Ceiling Tariff for International Bandwidth Tariff for International Bandwidth segment regulated TRAI found market failure in International Bandwidth market Ceiling Tariff for higher capacities is reduced by about 70% and for lower capacity by 35%. International Bandwidth is the medium of carriage of data and voice services across countries in the world. The International Bandwidth service is provided through international private leased circuits (IPLC). The International Bandwidth service in generally provided through submarine cable systems and through satellite media and in India submarine cable systems is the most predominant mode of delivery of IPLC services. The providers of the service are the International Long Distance operators. The main users of IPLC in India are Internet Service Providers, Informational Technology (IT) and IT-Enabled Service Enterprises like Business Process Outsourcing Units and International Long Distance Operators etc. The IPLC Leased rentals i.e. the charges for using the services of the international leased circuits were found to be higher in India than in many countries owing to lack of effective competition in the market. For instance, effectively in India there are only 3 operators who provide this service as against 14 operators in Korea, 24 in France and 32 in Germany and USA (New York). The Authority found that it is essential to make this key input available to various economic and social activities at a competitive price because the market forces are not effective. Also because the competitive advantage of the user industries can be enhanced in the global market. The Authority also found that a competitively priced IPLC Service is fundamental to achieve a higher rate of penetration of Broad Band in the country, which provides a basis for fundamentally transferring the socio-economic opportunities, particularly in rural India. The Authority had initiated a consultation process by issuing a consultation paper in the year 2004 with a view to examine the possibility of regulating the IPLC market. This consultation process has culminated in the issue of this Amendment (34th) to Telecommunication Tariff Order. Thus, for the first time the Authority is regulating the tariff for International Band Width. Briefly, the Authority has fixed ceiling tariff for three most commonly used capacities/speed i.e. E1 (speed of 2 Mega bits per second), DS-3 (speed of 45 Mega bits per second) and STM-1 (speed of 155 Mega bits per second). The salient features of the tariff fixed in respect of international bandwidth are as under:- * The ceiling tariff for IPLC half-circuit in respect of E1, DS-3 and STM-1 capacities are Rs. 13 Lakhs, Rs.104 lakhs and Rs.299 lakhs per annum respectively. Operators are at liberty to offer tariffs that are lower than the ceiling tariff fixed by the Authority. * These ceiling tariffs fixed result in a reduction of 35%, 71% and 70% in tariffs for E1, DS-3 and STM-1 capacities respectively (as compared to the existing listed price prevalent in the market for the distant destination i.e. India-USA). Thus, the reduction has been higher in higher capacities, which would be more in demand in future. * The prescribed ceiling tariff would be applicable for all destinations, capacities and types of cable systems used for carrying either voice or data. * The service providers are required to offer Standard Tariff Package containing tariff for half circuits for all routes/destinations for which circuits are offered. * The tariff for capacity/speed below E1 is kept under forbearance i.e. left to market forces as the demand in future will be mainly for higher capacities. * The tariff for IPLC offered through satellite media is kept under forbearance i.e. left to market forces as the submarine cable systems is the most predominant mode of delivery of IPLC service. * The ceiling tariffs prescribed by this Order will take effect from 1st April, 2005. The ceiling tariffs have been determined primarily on the basis of the incumbent. Forward-looking Long Range Incremental Costs (FL-LRIC) would be increasingly used from next year. In arriving at decisions at the end of the consultation process (as given above), the Authority inter-alia considered the existing market conditions in India for IPLC including prices, its market structure, the conditions prevalent elsewhere in the region and the practices governing regulation of IPLC in other jurisdictions. It has been found that the International market for Bandwidth has witnessed a deflationary spiral for more than five years owing to a number of factors. This did not happen in Indian IPLC market. For instance, as against 45% (CAGR) decline in the IPLC rentals elsewhere in the world, the decline in India was only to the extent of 10%, It is apparent that this has been due to lack of competition in the Indian market requiring regulatory intervention. Internationally also, it is common practice for the tariffs to be regulated until the competition in that market has developed to a level where the Regulator can safely withdraw and allow forced of competition to impose effective market discipline on prices. This appears to be the approach adopted by most overseas Regulatory Authorities prior to competition getting established in those markets. A major finding of the Authority is that the IPLC market lacks effective competition in India on account of various factors. While fixing the ceiling tariff based on costs, the Authority has also underlined the need to remove bottlenecks in cable landing facilities and enhance competition in the IPLC market, which would be subject matters of another consultation paper that the Authority would issue in due course. The Authority recalls the growth experienced in mobile telephony consequent upon tariffs declines witnessed in India. It would be reasonable to expect that the same story would be repeated in the growth of Broad Band/Internet and other data and voice services that are crucially dependent upon International Band Width. The growth in demand induced by the lower prices being mandated by the Authority will itself act as demand stimulant leading to higher utilization of capacities of the operators that would have secondary effects in pushing down the price levels. The Authority will, therefore, review the situation with regard to developments in the IPLC segment within a year. The Authority would shortly issue the Tariff orders revising the existing ceiling tariff in respect of domestic Leased Circuits (domestic bandwidth).

1 0

RE: IRC bots...
by Fergie (Paul Ferguson) 12 Mar '05

12 Mar '05

No duh. This is particulary _why_ I posted. It is an operational problem if I've ver seen one. - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: This problem turned into the spam problem faster than the spam problem did. -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

IRC bots...
by Fergie (Paul Ferguson) 12 Mar '05

12 Mar '05

Somewhat related to operational issues... It was interesting to read the "daily handler" log at the ISC which related their experiences with detecting (and disabling/disinfecting) a machine/network infected with several IRCbot drone computers. As someone who has had to deal with with this issue on several customer networks, it is sometimes intriguing at the length at which some of the developers of these damned things go through to accomplish their feats. :-) http://isc.sans.org/diary.php?date=2005-03-10 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

2 1

Vonage Being Blocked -- Again
by Fergie (Paul Ferguson) 12 Mar '05

12 Mar '05

Advance IP Pipeline: Company says "new instance" of service outages in the Midwest seems to indicate a port-blocking incident. http://www.advancedippipeline.com/159400156 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Obsolete bogon filtering
by Mark Newton 12 Mar '05

12 Mar '05

Hi. We've recently been allocated address space out of 59.0.0.0/8, which was released to APNIC by IANA about 11 months ago. Prior to that release, it was reserved, and appeared on all the public bogon filtering lists. It obviously isn't supposed to appear on them anymore. If you run any bogon filtering, can you please check your border ACLs and BGP prefix filters to ensure that you're no longer preventing access to 58.0.0.0/8 or 59.0.0.0/8 ? Thanks, - mark -- Mark Newton Email: newton(a)internode.com.au (W) Network Engineer Email: newton(a)atdot.dotat.org (H) Internode Systems Pty Ltd Desk: +61-8-82282999 "Network Man" - Anagram of "Mark Newton" Mobile: +61-416-202-223

9 9