March 2005 - NANOG - lists.nanog.org

How to identify interconnection relationship between AS?
by Joe Shen 08 Mar '05

08 Mar '05

Hi, I'm trying to identify how an AS is interconnected with other ASes. For example, I can access our border router which has BGP run, and I want to know how another AS ( e.g. 1234 ) is connected to internetwork ( e.g. as1234 interconnects with as1235, as1236, as1345 ....). How can I do it? thanks Joe __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

2 1

Re: www.nanog.org returning 403 Forbidden error?
by W.D.McKinney 08 Mar '05

08 Mar '05

>-----Original Message----- >From: Brent Chapman [mailto:Brent@GreatCircle.COM] >Sent: Monday, March 7, 2005 11:58 PM >To: nanog(a)merit.edu >Subject: www.nanog.org returning 403 Forbidden error? > > >I just tried accessing http://www.nanog.org/, and am getting back a >403 "Forbidden" error: > > Forbidden > You don't have permission to access / on this server. > >Did somebody break the web server? > Works here fine for me. Nice to see Seattle on it also! Dee

1 0

Is current DDoS detecting method effective?
by Joe Shen 07 Mar '05

07 Mar '05

Hi, I use flow-tools to monitor the link bandwidth utilization on three backbone interfaces. The total bandwidth utilized is about 11Gbps, and netflow data is analyzed to show statistics on some special port (e.g. port 0, port 445 etc.). I think this could give us some indication of possible DoS attach, but it's hard to monitor DoS attack on all hosts or all ports. In fact, I'm not sure whether traffic monitoring could REALLY help to identify some DoS attack, esp. in ISP networks. My questions include: 1) what should be protected in ISP networks? the ISP's own network or both ISP's network and its customers? I think the answer is, ISP should only care about the safety of its own network, which should be overprovisioned ( not only link bandwidth but also CPU/MEM etc.); we could use some technique like reverse route checking and ACL to immunize those core router/switch from DoS. 2) What's the cost should we take to identify any possible DoS in ISP network? I think it will cost a lot if we keep monitoring traffic on all edge routers ( both to backbone network and to customers), because we have to set up traffic monitoring on all interfaces and we have to set up analysis hosts whose ability have to be increased time to time. While the gainback is not obivious ( at least Botnet could not be crashed easily). 3) Is those technique use in current days really effective ? Where can I find some theretical analysis on the method Arbor used to identify DoS? To my experience, network attack is continuous. I do a experiment in our network, I put a Win2003 server on access layer. After 24 hours, the software firewall on it recorded about 10,0000 scan&attack attemps. Arbor says its product build up traffic model before identify DoS, while DoS may have been on its peak point when Arbor's box is building up its traffic model!! So, how can we do with DoS in ISP network? --- "David J. Hughes" <bambi(a)hughes.com.au> wrote: > > On 04/03/2005, at 5:17 AM, Chris Roberts wrote: > > I know you said not Arbor, but I'd second this > opinion. I used Arbor > > at a > > medium-sized European ISP and it was fantastic at > the job. Just in the > > trial > > period found a lot of smaller DoS attacks on our > network that we > > didn't even > > know were there, and this was without a particular > baseline. I think > > the > > development time you'd spend building something > like (we tried building > > similar with cflowd et al) would outweigh the > costs... This is always > > a moot > > point if you don't have the cash though I guess > :-) > > Another option on the commercial front is from > Esphion in New Zealand > (www.esphion.com) I've been involved with > deploying their products at > a large hosting provider in Australia and I've been > very impressed with > the performance and reliability. It's now an > integral part (if not the > corner stone) of our DOS mitigation procedure. Good > bit of kit. > > > David > ... > __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

5 6

NANOG 34: Call for Presentations
by Steve Feldman 07 Mar '05

07 Mar '05

* * * * * * * * * * * * * * * * * CALL FOR PRESENTATIONS NANOG 34 May 15-17, 2005 * * * * * * * * * * * * * * * * * The North American Network Operators' Group (NANOG) will hold its 34th meeting May 15-17, 2005, in Seattle, Washington. The meeting will be hosted by Switch and Data and held at the Westin Seattle. NANOG conferences provide a forum for information exchange among network operators, engineers, and researchers. Meetings are held three times each year, and include presentations, tutorial sessions, and BOFs. The meetings are informal, with an emphasis on relevance to current engineering practices. NANOG solicits presentations highlighting issues relating to technology already deployed or soon to be deployed in the Internet. Vendors are encouraged to work with operators to present deployment experiences with the vendor's products and interoperability. The community is invited to present talks or tutorials on: - VOIP architectures and deployment - Peering/collocation coordination issues - Security attacks/mitigation, tools, and analysis - Content provider issues - MSO IPTV deployment and operations - Backbone operational case studies - Exchange point technologies and implementation - Non-telco, last-mile technologies (metro/rural, broadband, radio, and optical) - Implementation experience with Ethernet, e.g., TLS, VPLS, Ethernet private line, and VPWS. - Wavelength use by enterprises - Large-scale wireless deployment - Experiences with native IPv6 transport rollout - State of OAM tools for IP and MPLS networks - Options for blackhole and discard routing - BGP/MPLS layer 3 VPNs - Other interesting network technologies Topics for short (10-20 minute) lightning talks will be solicited on-site in Seattle. Researchers are invited to present short (10-minute) summaries of their work for operator feedback. Topics include routing, network performance, statistical measurement and analysis, and protocol development and implementation. Studies presented may be works in progress. Researchers from academia, government, and industry are encouraged to present. How to Present -------------- Submit an abstract and draft slides for the presentation in email to nanog-support(a)nanog.org. See http://www.nanog.org/presentations.html for submission guidelines. The deadline for abstracts and slides is April 4, 2005. While the majority of speaking slots will be filled by April 4, a limited number of slots may be available after that date for topics that are exceptionally timely, important, or critical to the operations of the Internet. Submissions will be reviewed by the NANOG Program Committee, and presenters will be notified of acceptance by April 18. Final drafts of presentation slides are due by May 4, and final versions May 11.

1 0

DNS Blackhole attack
by william(at)elan.net 07 Mar '05

07 Mar '05

[forward from namedroppers ietf dns wg mail list, of interest to nanog] This just appeared on the SANS list. Time to stop arguing and get DNSSEC deployed. Global DNS cache poisoning attack?; Update... We are currently investigating a report from several sites that indicate users being re-directed to malware sites. At this time it appears to be a DNS cache poisoning attack (not a spyware, adware, or browser hijack) and we are seeking more information. Popular domain names such as google.com, ebay.com, and weather.com are being directed to the following servers. Of course when connecting to these servers, "bad things" (tm) will happen, so don't go to them. www.7sir7.com (217.160.169.87) 123xxl.com (217.160.169.87, 207.44.240.79, 216.127.88.131) abx4.com (217.160.169.87, 207.44.240.79, 216.127.88.131) If your site has been affected, please submit the following information: 1. When the attack was first noticed and whether it is still occurring. 2. What DNS server software you having facing the Internet. This information will be kept in strictest confidence. 3. If you identified any other sites that users were being re-directed to (besides the ones listed above). Updates will be made to this diary as we find out more information. Update at 23:40 UTC There appear to be two issues at hand. The first is the DNS cache poisoning. At this time, it appears to be affecting Symantec firewalls with DNS caching. If you recall, there was a vulnerability back in July that made these products very succeptable to DNS cache poisoning. Some victims have responded that they applied the patch, but were still affected. So this could be a different vulnerability or the patch didn't work properly. Maybe someone at Symantec could enlighten us? http://securityresponse.symantec.com/avcenter/security/Content/2004.06.21.ht ml The second issue is the ABX toolbar spyware that gets loaded onto the machine when visiting the target servers. This appears to happen using an ActiveX control. Users running Windows XP SP2 or a web browser that does not support ActiveX will probably not get hit with the spyware if they visit the server. Unfortunately, information on the ABX toolbar spyware is very limited at this time and it doesn't seem to be detected yet by the normal toolset of spyware/antivirus tools. In the meantime, we have been working to get the IP addresses and DNS servers supporting this attack shutdown. Some of the IP addresses are already blackholed. [eof]

3 2

Re: vonage routing issues
by John Neiberger 07 Mar '05

07 Mar '05

>>> Jon Lewis <jlewis(a)lewis.org> 3/4/05 1:17:11 PM >>> > >Anyone else having reachability issues with Vonage? The past two days, >about this time (~2pm), we've been unable to reach www.vonage.com and >customers with vonage phones have lost their service. > >My traces to them end with: > >13. 64.200.88.173 0% 8 8 32 31 33 42 >14. nycmny2wcx2-pos1-0-oc192.wcg.net 0% 8 8 37 37 70 176 >15. ??? Interesting. I can't get to them, either. A trace from my site to theirs (via Sprint) ends here: border23.ge2-0-bbnet1.nyc.pnap.net (209.191.128.92) [AS 10910] John --

15 21

public accessible snmp devices?
by Vicky Rode 07 Mar '05

07 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi there, Just wondering if there are any pool of public accessible (read-only) snmp enabled devices that one can access for testing purposes (such as snmpwalk, polling devices via oid/mib, graphing chart..etc)? I'm looking for a pool of devices that I run my test on. Any pointers will be appreciated. regards, /virendra -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFCJzLfpbZvCIJx1bcRAqLcAJ95PzxXE4v51JgzTpeqfuEDZG6ibgCaAg20 WJxjcsJYroHriTPr635QOBE= =SV3b -----END PGP SIGNATURE-----

6 12

Vonage service suffers outage
by Fergie (Paul Ferguson) 07 Mar '05

07 Mar '05

Amidst all the hoopla w.r.t. "port blocking" their service, this outage couldn't have come at a worse time, methinks. The outage on Friday "left about half of its 500,000 subscribers without phone service for about 45 minutes" and "... was caused by a glitch with a software upgrade on Thursday night." http://www.detnews.com/2005/technology/0503/07/tech-109316.htm - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

3 2

RE: US slaps fine on company blocking VoIP
by Network.Security 07 Mar '05

07 Mar '05

Do you also offer premium "80" traffic? Or guaranteed delivery of UDP? Unbundled services will give the best price, and good service. Maybe we won't get the service anytime soon, but 2 out of the magical 3 isn't bad. bradley.swanson(a)target.com -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Adi Linden Sent: Monday, March 07, 2005 8:46 AM To: Bill Nash Cc: Robert Blayzor; nanog(a)nanog.org Subject: Re: US slaps fine on company blocking VoIP > If VOIP doesn't run on your network because you've oversold your > capacity, no amount of QoS is going to put the quality back into your service. > People will find better ISPs. If you deliberately set QoS to favor > your services over a competitor, whom your customers are also paying > for service, you'll be staring down prosecutors, at some point. It's > anti-competitive behavior, as you're taking deliberate actions to > degrade the service of a competitor, simply because you can. Let's say I sell a premium VoIP offering for an additional fee on my network. I apply QoS to deliver my VoIP offering to my customers but as a result all other VoIP service is literally useless during heavy use times you'd consider this anti-competitive behavior? Adi

1 0

Utah considers law to mandate ISP's block "harmful" sites
by Fergie (Paul Ferguson) 07 Mar '05

07 Mar '05

"The Utah governor is deciding whether to sign a bill that would require Internet providers to block Web sites deemed pornographic and that could also target e-mail providers and search engines." http://news.com.com/Utah+governor+weighs+antiporn+proposal/2100-1028_3-5598… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

14 14