March 2008 - NANOG - lists.nanog.org

Re: Customer-facing ACLs
by Scott Weeks 11 Mar '08

11 Mar '08

---------- sean(a)donelan.com wrote: ---------- On Mon, 10 Mar 2008, Scott Weeks wrote: > The hard part is I now always take over networks that have been in > operation a long time and enabling these policies can be very painful > after the fact. Establishing them when the network is new is a > different story. Whatever you decide, whether you know what the policies are or not, there are always have a set of default network policies. The question is do you explain to you customers just as carefully what your default policy doesn't do, as well as what it does. Do you take just as much time to carefully explain the risks and what may break to your customers of allowing that traffic as you would of not allowing that traffic. It seems to be very painful whatever decision is made. ------------------------------------------------- The default policy is we allow eveything. It takes no explaining. I understand the port 25 issue and am reconsidering it for dynamic addresses on outbound traffic, but at least one person on NANOG showed me a use of that. Like network engineers at many other companies, I'm spread so thin that it's hard to find the time to do work like this and I keep putting it on the back burner. VZ had it completely open and I have followed that as we seperated this network from their network, as I can't take on the extra work of fixing brokenness that would result from applying the filter. scott

2 1

Customer-facing ACLs
by mack 11 Mar '08

11 Mar '08

> ------------------------------ > > Date: Tue, 11 Mar 2008 07:58:01 +0800 > From: Ang Kah Yik <mailinglist(a)bangky.net> > Subject: Customer-facing ACLs > > Hi Justin (and all others on-list) > > I understand your grounds for blocking outbound SMTP for your customers > (especially those on dynamic IP connections). > It probably will do good to block infected customers that are spewing > spam all over the world. > > However, considering the number of mobile workers out there who send > email via their laptops to corporate SMTP servers, won't blocking > outbound SMTP affect them? > > Since these corporate types (I'm guessing here) are probably unaware of > how to change their email client's SMTP configurations, chances are > that > blocking outbound SMTP will probably cause quite a lot of pain. > > After all, there are also those who frequently move from place to place > so they're going to have to keep changing SMTP servers every time they > go to a new place that's on a different ISP. > > Cheers > - -- > ANG Kah Yik (bangky) > > ------------------------------ One would hope mobile commuters are using something more secure than just raw SMTP to send e-mail if their network admins have any sense. The usual combination requires a POP connection first or uses a port other than 25 to send. As a customer my home DSL service provider (SBC) blocks port 25 by default. Many firewalls can be programmed to allow 'related' connections. Ie. if a POP connection is opened then allow the SMTP connection. The real solution is to move to imap or msa (port 587) or the latest MS exchange protocol (whatever it is). As for blocking FTP and SSH, it would depend A LOT on your customer base. As a content provider we do not allow raw NetBios into our network. Anyone that wants to use remote file sharing to work on their windows server is encouraged (Whips and Chains if necessary) to use a VPN tunnel. If you are going to block something, block port 135 both directions. -- LR Mack McBride Network Administrator Alpha Red, Inc.

1 0

ARIN & CAIDA IPv6 Survey
by Member Services 10 Mar '08

10 Mar '08

The American Registry for Internet Numbers (ARIN), in cooperation with the Cooperative Association for Internet Data Analysis (CAIDA), is conducting a survey to gather data regarding the current and future use of IPv6 throughout the ARIN Region. For a complete list of countries go to: http://www.arin.net/community/ARINcountries.html We encourage all organizations in the ARIN region to participate in the survey so we can establish a comprehensive view of present IPv6 penetration and future plans of IPv6 deployment. The survey will open on 10 March and remain available until noon ET on 24 March. The results of the survey will be presented and discussed at the ARIN XXI Public Policy and Members Meeting to be held in Denver 6-9 April 2008, and the survey data will support ongoing research. The survey is composed of 20 questions that can be answered in a few minutes. When you complete the survey you will be entered in a drawing for prizes. You must provide your contact information to win. This is a secure survey and all data will be presented in summary form only, and kept confidential between ARIN and CAIDA. Please take a few moments to complete the survey located at: https://www.surveymonkey.com/s.aspx?sm=2x5j2OlJl0cq44iYfQadrw_3d_3d Regards, Member Services American Registry for Internet Numbers (ARIN)

1 0

Tools to measure TCP connection speed
by Joe Shen 10 Mar '08

10 Mar '08

hi, is there any tool could measue e2e TCP connection speed? e.g. we want to measue the delay between the TCP SYN and receiving SYN ACK packet. Joe ______________________________________________________________________ Search, browse and book your hotels and flights through Yahoo! Travel. http://sg.travel.yahoo.com

8 8

bandwidth providers and pricing in China
by matthew zeier 10 Mar '08

10 Mar '08

Looking for anyone who has experience deploying a network in China. I'm getting 1500RMB/Mbps with a 10Mbps commit that I'm already bumping up against. Moving to 20Mbps is going to drop me to 1200RMB/Mbps or about $3400 USD a month which seems excessive compared to my US pricing (or even what I'm seeing in Amsterdam). Are these prices what others see? Where can I get better pricing?

3 2

RE: bandwidth providers and pricing in China
by Neil J. McRae 10 Mar '08

10 Mar '08

Going rate in Asia and India is much higher than US and Europe. -----Original Message----- From: matthew zeier <mrz(a)velvet.org> Sent: 07 March 2008 18:22 To: nanog(a)nanog.org Subject: bandwidth providers and pricing in China Looking for anyone who has experience deploying a network in China. I'm getting 1500RMB/Mbps with a 10Mbps commit that I'm already bumping up against. Moving to 20Mbps is going to drop me to 1200RMB/Mbps or about $3400 USD a month which seems excessive compared to my US pricing (or even what I'm seeing in Amsterdam). Are these prices what others see? Where can I get better pricing?

3 2

Re: Customer-facing ACLs
by Scott Weeks 08 Mar '08

08 Mar '08

--------------------------------------- > What kind of customer-facing filtering do you do (ingress and > egress)? This of course is dependent on the type of customer, so > lets assume we're talking about an average residential customer. --------------------------------------- >From a port-blocking point of view, some companies give access to the entire internet (good and bad) to their customers. Mine are mostly residential. scott fire + gasoline = religious argument on this issue that we've had *many* times in the past... ;-)

4 3

RE: Customer-facing ACLs
by Scott Weeks 08 Mar '08

08 Mar '08

--- Jason.Carpenter(a)citadelgroup.com wrote: That's the problem isn't it? Who decides what can and cant go through. I think the tier approach is better, a basic user account where everything is blocked and a Sysadmin type account where everything is open. If the price is different enough then only people who are going to use those extra ports will actually pay for it. ---------------------------------------------------- We need to take this off-line. All long timers are groaning, rolling their eyes and putting this in their kill file. Try convincing your product managers to create a new product just to appease 'sysadmin types'. scott

3 2

RE: Customer-facing ACLs
by Paul Ferguson 08 Mar '08

08 Mar '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Scott Weeks" <surfer(a)mauigateway.com> wrote: >We need to take this off-line. All long timers are groaning, rolling >their eyes and putting this in their kill file. > >Try convincing your product managers to create a new product just to >appease 'sysadmin types'. > Or perhaps engage the discussion on a security-related mailing list. A couple of suggestions: The DShield list: http://lists.dshield.org/mailman/listinfo/list Funsec: https://linuxbox.org/cgi-bin/mailman/listinfo/funsec - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFH0fhsq1pz9mNUZTMRAkIxAKDs7DqstE6bDyNmAbRkqrCW78pAtwCdH1hm gKrRg7ZAkEat2zx7XzRG+Nk= =SRGz -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Rogue traffic commonly perceived as "noise" (was: Scan traffic from 121.8.0.0/16)
by Justin Shore 07 Mar '08

07 Mar '08

Yeah, much of it is noise. However there is a a lot of coordination to much of what I'm seeing. Many of the scans stop at hosts with accessible SSH daemons and pound on them for minutes to hours. Others are more subtle. I'll see one host scan our ranges and pick out the IPs running SSH. Then, a short time later, those specific hosts are directly targeted from a different compromised host implying that there is communication on the back-end about IPs w/ SSH daemons. I tested the theory by disabling SSH on a few of the hosts picked up in earlier mass scans. The targeted attacks are still aimed at those hosts learned in the earlier scan even though their SSH daemons we effectively offline. Some scans are so slow they're barely noticeable (as was reports on the SANS ISC site recently). Even though much of this is simply noise and typical life on the Internet, I have to wonder how much of this noise is actual reconnaissance against SPs and their customers. A certain large SE Asian country's military is widely reported to be performing recon and attacks against IP resources around the globe. How much of what people believe is noise is actually malicious traffic or a prelude to some future event? Frankly the scans on my network have been significantly reduced by being a little more proactive with my monitoring. I've found that network generating SSH scans are also being used for telnet, MS-SQL and SMTP scans. Unfortunately the processes I'm utilizing are very labor intensive and I can't keep doing this forever. I would love to find a tool that could help me automate some of this process and hopefully react faster than I can. While typing this 69.13.181.99 just scanned one of our /19s. The flood of packets was so fast I wouldn't have been able to null route it even if I'd been actively watching the flows. The only way I could have slowed it down would have been to rate-limit SYNs. That leads to a good question for NANOG at large which I'll post separately. Justin Martin Hannigan wrote: > Scans are really a dime a dozen and noise that buries good data on > real problems. Be careful! > > > > On 3/6/08, Justin Shore <justin(a)justinshore.com> wrote: >> Rich Sena wrote: >>> Anyone seeing anything similar - trying to determine if this is spoofed >>> etc... >> I haven't picked up any SSH or telnet scans from that network. That's >> what I'm looking for at the moment. The amount of scans we're getting >> are quite impressive at times. I wish there was an easy way to automate >> the care and feeding of my RTBH with this data (and some sanity checks). >> >> Justin

1 0