- NANOG - lists.nanog.org

Re: Copyright Enforcement DoS/DDoS Attacks
by khatfield＠socllc.net 09 Sep '10

09 Sep '10

No matter how they spin it, it isn't legal. Likely he won't be touched in India but in the U.S. he and the industry paying him would be facing a judge. The guy is a moron. Wanna be elitist. ------Original Message------ From: Michael Painter To: nanog(a)nanog.org Subject: Re: Copyright Enforcement DoS/DDoS Attacks Sent: Sep 9, 2010 12:13 AM Brandon Galbraith wrote: > http://www.smh.com.au/technology/technology-news/film-industry-hires-cyber-… > > <http://www.smh.com.au/technology/technology-news/film-industry-hires-cyber-…>Has > anyone dealt with this in the wild? I wasn't aware DoS/DDoS attacks were > suddenly legal. It's gotta' be tough reading that when you're in the slammer, eh? http://www.theregister.co.uk/2010/05/25/second_scientology_ddoser_jailed/

1 0

Speakeasy Contact
by Paul Norton 08 Sep '10

08 Sep '10

Someone from Speakeasy please contact me off-list. This is for business T-1 service. I've been seeing major packet loss on one of your peering nodes for a week now and am experiencing degraded service due to this. Support has been unable to resolve and has been unresponsive for the past 24 hours. Also, Account Manager has been non-responsive for 6 days now. -- Paul Norton Systems Administrator Neoverve -www.neoverve.com Neoverve Blog -http://blog.neoverve.com/

2 1

RE: NANOG Digest, Vol 32, Issue 25
by Scott Weeks 08 Sep '10

08 Sep '10

--- M.Hotze(a)hotze.com wrote: From: Martin Hotze <M.Hotze(a)hotze.com> I have a private website; I don't want the site to be listed or content found via a search engine. I want to be able to give the URL out to friends etc. but I don't want all of the world hotlink or whatever[...] -------------------------------------------------- Don't put links on the main page. Put up example.com with only <html> </html> or nothing even. Then your friends have to know to go to example.com/mypage.html but the web crawlers never know about mypage.html because there's no link on the top page. scott

1 0

RE: NOC Automation / Best Practices
by Martin Hotze 08 Sep '10

08 Sep '10

> -----Original Message----- > Date: Wed, 08 Sep 2010 08:54:20 -0700 > From: Charles N Wyble <charles(a)knownelement.com> > Subject: NOC Automation / Best Practices > To: nanog(a)nanog.org > > NOGGERS, > > (...) > The way I see it, an ounce of prevention is worth a pound of cure. > Along > those lines, I'm putting in some mitigation techniques are as follows > (hopefully this will reduce the number of incidents and therefore calls > to the abuse desk). I would appreciate any feedback folks can give me. > > A) Force any outbound mail through my SMTP server with AV/spam > filtering. > B) Force HTTP traffic through a SQUID proxy with SNORT/ClamAV running > (several other WISPs are doing this with fairly substantial bandwidth > savings. However I realize that many sites aren't cache friendly. > Anyone > know of a good way to check for that? Look at HTTP headers?). Do the > bandwidth savings/security checking outweigh the increased support > calls > due to "broken" web sites? > C) Force DNS to go through my server. I hope to reduce DNS hijacking > attacks this way. > > Thanks! For either A, B or C you won't get my business, let alone a combination of all 3. *wah!* There is too much FORCE here. :-) #m

5 4

yahoo crawlers hammering us
by Ken Chase 08 Sep '10

08 Sep '10

So i guess im new at internets as my colleagues told me because I havent gone around to 30-40 systems I control (minus customer self-managed gear) and installed a restrictive robots.txt everywhere to make the web less useful to everyone. Does that really mean that a big outfit like yahoo should be expected to download stuff at high speed off my customers servers? For varying values of 'high speed', ~500K/s (4Mbps+) for a 3 gig file is kinda... a bit harsh. Especially for an exe a user left exposed in a webdir, thats possibly (C) software and shouldnt have been there (now removed by customer, some kinda OS boot cd/toolset thingy). This makes it look like Yahoo is actually trafficking in pirated software, but that's kinda too funny to expect to be true, unless some yahoo tech decided to use that IP/server @yahoo for his nefarious activity, but there are better sites than my customer's box to get his 'juarez'. At any rate: >From Address To Address Proto Bytes CPS ============================================================================================================================================================================================== 67.196.xx.xx..80 67.195.112.151..44507 tcp 14872000 523000 $ host 67.195.112.151 8.8.8.8 151.112.195.67.in-addr.arpa domain name pointer b3091122.crawl.yahoo.net. CIDR: 67.195.0.0/16 NetName: A-YAHOO-US8 so that's yahoo, or really well spoofed. Is this expected/my own fault or what? A number of years ago, there were 1000s of videos on a customer site (training for elderly care, extremely exciting stuff for someone into -1-day movies to post on torrent sites). Customer called me to say his bw was gone, and I checked and found 12 yahoo crawlers hitting the site at 300K/s each (~30Mbps +) downloading all the videos. This was all the more injurious as it was only 2004 and bandwidth was more than $1/mbps back then. I did the really crass thing and nullrouted the whole /20 or whatever they were on per ARIN. It was the new-at-the-time video.yahoo.com search engine coming to index the whole site. I suppose they cant be too slow about it, or they'll never index a whole webfull of videos this century, but still, 12x 300K/s in 2004? (At the time Rasmus though it was kinda funny. I do too, now.) /kc -- Ken Chase - ken(a)heavycomputing.ca - +1 416 897 6284 - Toronto CANADA Heavy Computing - Clued bandwidth, colocation and managed linux VPS @151 Front St. W.

7 9

NOC Automation / Best Practices
by Charles N Wyble 08 Sep '10

08 Sep '10

NOGGERS, The recent thread on ISP port blocking practice mentioned a way to identify infected machines through a highly automated manner. This got me thinking about other ways to automate aspects of network/system operations when it comes to tier-1 end user support (is it plugged in/is your wireless working etc) and tier-2/3 NOC support (abuse desk/incident response/routing issues etc) . I'm putting in a very high degree of monitoring/healing in place to reduce the amount of end user support calls that come in, and only bother a human when it's a real issue. I'm in the process of launching a small regional wireless ISP / ad delivery network in Los Angeles CA. I have a small staff (I'm the only full time engineer, I have a couple NOC techs and 1 help desk tech who will provide escalation for any serious issues). My initial thoughts/questions on the matter: 1) Are people integrating their PBX with their OSS/CRM systems? So when a call comes in the tech has all the relevant information? (perhaps even things like traceroute/port scan/AV/security health status based on their phone number or customer number?). This way if I take a user offline because they are spewing spam/virii the tech can refer them to our IT support partner organization to clean up their PC. :) 2) What sort of automated alerting/reporting/circuit turn down/RADIUS lock out is done in regards to alerting customers or even taking them offline when they have a security issue? 3) What are folks doing in terms of frontline offloading? Do you have your PBX set to play a different recording when you have an outage so the NOC techs phones don't go crazy and leave them free to deal with the issue? 4) Your comments here. :) The way I see it, an ounce of prevention is worth a pound of cure. Along those lines, I'm putting in some mitigation techniques are as follows (hopefully this will reduce the number of incidents and therefore calls to the abuse desk). I would appreciate any feedback folks can give me. A) Force any outbound mail through my SMTP server with AV/spam filtering. B) Force HTTP traffic through a SQUID proxy with SNORT/ClamAV running (several other WISPs are doing this with fairly substantial bandwidth savings. However I realize that many sites aren't cache friendly. Anyone know of a good way to check for that? Look at HTTP headers?). Do the bandwidth savings/security checking outweigh the increased support calls due to "broken" web sites? C) Force DNS to go through my server. I hope to reduce DNS hijacking attacks this way. Thanks!

2 1

RE: NANOG Digest, Vol 32, Issue 25
by Martin Hotze 08 Sep '10

08 Sep '10

> -----Original Message----- > Message: 3 > Date: Wed, 8 Sep 2010 10:24:38 +0000 > From: Nathan Eisenberg <nathan(a)atlasnetworks.us> > Subject: RE: yahoo crawlers hammering us > To: "nanog(a)nanog.org" <nanog(a)nanog.org> > Message-ID: > <8C26A4FDAE599041A13EB499117D3C28164AC3A7@ex-mb- > 1.corp.atlasnetworks.us> > > Customers don't want to deliver their content to search engines? That > seems silly. I have a private website; I don't want the site to be listed or content found via a search engine. I want to be able to give the URL out to friends etc. but I don't want all of the world hotlink or whatever - sure, I can password protect the site, but for now I have a ton of rewrite conditions in place. #m

1 0

CFP: COMSNETS 2011 (Deadline in five days!)
by Ramana Kompella 08 Sep '10

08 Sep '10

*** APOLOGIES IF YOUR RECEIVED MULTIPLE COPIES OF THE CFP *** COMSNETS 2011 The THIRD International Conference on COMunication Systems and NETworks January 4-8, 2011, Bangalore, India http://www.comsnets.org (In Co-operation with ACM SIGMOBILE) (Technically Co-Sponsored by IEEE COMSOC) The Third International Conference on COMmunication Systems and NETworkS (COMSNETS) will be held in Bangalore, India, from 4 January 2011 to 8 January 2011. COMSNETS is a premier international conference dedicated to addressing advances in Networking and Communications Systems, and Telecommunications services. The goal of the conference is to create a world-class gathering of researchers from academia and industry, practitioners, business leaders, intellectual property experts, and venture capitalists, providing a forum for discussing cutting edge research, and directions for new innovative business and technology. The conference will include a highly selective technical program consisting of parallel tracks of submitted papers, a small set of invited papers on important and timely topics from well-known leaders in the field, and poster sessions of work in progress. Focused workshops and panel discussions will be held on emerging topics to allow for a lively exchange of ideas. International business and government leaders will be invited to share their perspectives, thus complementing the technical program. Papers describing original research work and practical experiences/experimental results are solicited on topics including, but not limited to: Topics of Interest ------------------ Internet Architecture and Protocols Network-based Applications Video Distribution (IPTV, Mobile Video, Video on Demand) Network Operations and Management Broadband and Cellular Networks (3G/4G, WiMAX/LTE) Mesh, Sensor and PAN Networks Communication Software (Cognitive Radios, DSA, SDR) Wireless Operating Systems and Mobile Platforms Peer-to-peer Networking Cognitive Radio and White Space Networking Optical Networks Network Security & Cyber Security Technologies Cloud and Utility computing Storage Area Networks Next Generation Web Architectures Vehicular Networking Energy-Efficient Networking Network Science and Emergent Behavior in Socio-Technical Networks Social Networking Analysis, Middleware and Applications Networking Technologies for Smart Energy Grids Disruption/Delay Tolerant Networking Conference Highlights --------------------- Conference Inaugural Speaker: Prof. Pravin Varaiya, U. C. Berkeley, USA Banquet speaker: Dr. Rajeev Rastogi, Yahoo Research, India Keynote Speakers: Prof. Don Towsley, U. Mass Amherst, USA Dr. Pravin Bhagwat, AirTight Networks, India Dr. Jean Bolot, Sprint, USA Workshops WISARD (4, 5 Jan) NetHealth (4 Jan) IAMCOM (5 Jan) Mobile India 2011 (7 Jan) Technical Paper and Poster Sessions Ph.D Forum Panel Discussions Demos & Exhibits Important Deadlines ------------------- Paper submission: September 13, 2010 at 11:59 pm EDT (Sept 14, 9:29 am IST) Notification of Acceptance: November 8, 2010 Camera-Ready Submission: December 8, 2010 Detailed conference information and paper submission guidelines will soon be available on the conference web site. Please see http://www.comsnets.org for detailed information from time to time. The conference email address is: comsnets2011(a)gmail.com General Co-Chairs ----------------- David B. Johnson, Rice University, USA Anurag Kumar, IISc Bangalore, India Technical Program Co-Chairs --------------------------- Jon Crowcroft, U. of Cambridge, UK D. Manjunath, IIT Bombay, India Archan Misra, Telcordia Tech., USA Steering Committee Co-Chairs ---------------------------- Uday Desai, IIT Hyderabad, India Giridhar Mandyam, Qualcomm, USA Sanjoy Paul, Infosys, India Rajeev Shorey, NIIT University, India G. Venkatesh, SASKEN, India Panel Co-Chairs --------------- Aditya Akella, U. of Wisconsin, USA Venkat Padmanabhan, MSR, India Ph.D Forum Chair ---------------- Bhaskaran Raman, IIT Bombay, India Publications Chair ------------------ Varsha Apte, IIT Bombay, India Demos and Exhibits Co-Chairs ---------------------------- Aaditeshwar Seth, IIT Delhi, India Ajay Bakre, Netapps, India Sponsorship Chair ----------------- Sudipta Maitra, Delhi, india Workshop Chairs --------------- Sharad Jaiswal, Alcatel-Lucent, India Ravindran Kaliappa, CUNY, USA Neelesh Mehta, IISc Bangalore, India Mobile India 2011 Co-Chairs --------------------------- Gulzar Azad, Google, India Gene Landy, Ruperto-Israel & Weiner, USA Rajaraghavan Setlur, SASKEN, India Sridhar Varadharajan, SASKEN, India Publicity Co-Chair ------------------ Augustin Chaintreau, TTL, France Kameswari Chebrolu, IIT Bombay, India Song Chong, KAIST, Korea Ramana Kompella, Purdue Univ, USA Nishanth Sastry, U. of Cambridge, UK Web Co-Chairs ------------- Santhana Krishnan, IIT Bombay, India Vinay Veerappa, SASKEN, India International Advisory Committee -------------------------------- K. K. Ramakrishnan, AT&T, USA Victor Bahl, Microsoft Research, USA Sunghyun Choi, Seoul National U., Korea Sajal Das, U. Texas at Arlington, USA B. N. Jain, IIT Delhi, India Anurag Kumar, IISc, Bangalore, India L. M. Patnaik, IISc, Bangalore, India Krithi Ramamritham, IIT Bombay, India Parmesh Ramanathan, U. Wisconsin, USA Krishan Sabnani, Alcatel-Lucent, USA Kang Shin, U. Michigan, USA Nitin Vaidya, U. Illinois, USA University Partners: -------------------- IIT Bombay, IIT Delhi, IISc Bangalore, IIT Hyderabad, NIIT University, IIIT Bangalore Patrons: -------- Mobile Monday Bangalore, Sasken, IBM Research, Alcatel Lucent

1 0

Fwd: [swinog] IP address are now personal data
by Thomas Mangin 08 Sep '10

08 Sep '10

FYI Begin forwarded message: > From: Pascal Gloor <pascal.gloor(a)spale.com> > Date: 8 September 2010 11:25:18 GMT+01:00 > To: "swinog(a)swinog.ch" <swinog(a)swinog.ch> > Subject: [swinog] IP address are now personal data > > Dear community, > > something important for us happened today that may have some impact on our daily business. > > Our Federal Court just decided that IP addresses are personal data and the federal law about data protection must also be followed also for IP addresses. Collecting IP adresses for private (corporate) investigation is not legal. Companies like Logistep have to stop their activities immédiately! > > As ISP be carefull not to publish traffic information containing IP addresses. > > see you, > Pascal > > _______________________________________________ > swinog mailing list > swinog(a)lists.swinog.ch > http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

3 3

Re: Looking Glass
by James Bensley 08 Sep '10

08 Sep '10

Hmm, Google says you could use http://www.zebra.org/ to set your box up as a route, and then you can just view the routes from there? Or look here; http://www.bgp4.as/tools -- Regards, James. http://www.jamesbensley.co.cc/ There are 10 kinds of people in the world; Those who understand Vigesimal, and J others...?

6 7