- NANOG - lists.nanog.org

question about BGP default routing
by Kai Chen 06 Jan '09

06 Jan '09

Hi all I have a question: I see very few prefixes in a routing table and combining the prefixes does not cover addresses space, for example, {78.41.184.0/21, 91.103.239.0/24, 91.103.232.0/22, 82.138.64.0/23, 91.103.232.0/21, 77.95.71.0/24} are all prefixes I observed from a BGP speaking router, I am just asking is this router using a default routing for all the other destinations? Thanks a lot

4 6

Hirschmann Switches?
by Paul Wall 06 Jan '09

06 Jan '09

I'm looking for feedback from users of the Hirschmann (Belden) ethernet switches in a service provider environment. Private or public appreciated. Drive Slow, Paul Wall

4 3

? how cisco router handle the out-of-order ICMP echo-reply packets
by Zhao Ping 06 Jan '09

06 Jan '09

Hi, Does someone happen to know how the Cisco IOS handle the out-of-order ICMP echo-reply packets? print it as success or lose? Thanks, Zhao Ping

5 6

Where there's a nanog thread there'll be a vendor solution .. Re: Ethical DDoS drone network
by Suresh Ramasubramanian 06 Jan '09

06 Jan '09

On Mon, Jan 5, 2009 at 10:24 PM, BATTLES, TIMOTHY A (TIM), ATTLABS <tmbattles(a)att.com> wrote: > There are some assumptions here. First are you considering volumetric > DDOS attacks? Second, if you plan on harvesting wild bots and using them > to serve your purpose then I don't see how this can be ethical unless > they are just clients from your own network making it less distributed. I cant believe this .. http://www.iprental.com Looks like anonymizer combined with what looks almost like a "rent a botnet", legit nodes (you sign up to download a client that makes you part of this botnet, etc) http://www.iprental.com/technical/ Speaking of a "commercial botnet"", there was something similar earlier - but that was a "download this bulk mailer" type operation, guys called Atriks, who got tracked so extensively by spamhaus that they seem to have kind of disappeared now. --srs

4 5

Security team successfully cracks SSL using 200 PS3's and MD5 flaw.
by Rodrick Brown 06 Jan '09

06 Jan '09

A team of security researchers and academics has broken a core piece of Internet technology. They made their work public at the 25th Chaos Communication Congress in Berlin today. The team was able to create a rogue certificate authority and use it to issue valid SSL certificates for any site they want. The user would have no indication that their HTTPS connection was being monitored/modified. http://hackaday.com/2008/12/30/25c3-hackers-completely-break-ssl-using-200-… http://phreedom.org/research/rogue-ca/ -- [ Rodrick R. Brown ] http://www.rodrickbrown.com http://www.linkedin.com/in/rodrickbrown

34 73

IPv6: IS-IS or OSPFv3
by devang patel 05 Jan '09

05 Jan '09

Hello, I do have some confusion about which one is better for IPv6 in Service Provider networks as far as IP routing and MPLS application is concern! 1. Which protocol should i use to support the IPv6 in network: ISIS or OSPFv3? As ISIS has multi-topology feature that can give us capability to run IPv4 network separate from IPv6 right! and same thing with OSPF: OSPFv2 will be used for IPv4 routing and OSPFv3 will be used for IPv6 routing! again Its look like resource utilization for both the protocol will be same as they are going to use separate database for storing the routing or topology information. ISIS still has advantage over OSPF as it does use the TLV structure which can help in expanding network to support the new feature! 2. MPLS is not distributing label for IPv6 protocol so again there will not be any IGP best path calcuated for any MPLS related application for IPv6! 3. what if i have already running OSPFv2 for IPv4 in the network then should i think for migrating to ISIS? if yes then what are the advantages that I can look at for migrating my network to IS-IS? regards Devang Patel

14 31

Re: Ethical DDoS drone network
by deleskie＠gmail.com 05 Jan '09

05 Jan '09

Super risky. This would be a 99% legal worry plus. Unless all the end points and networks they cross sign off on it the risk is beyond huge. -jim ------Original Message------ From: Jeffrey Lyon Sender: To: nanog(a)merit.edu Subject: Ethical DDoS drone network Sent: Jan 4, 2009 10:06 PM Say for instance one wanted to create an "ethical botnet," how would this be done in a manner that is legal, non-abusive toward other networks, and unquestionably used for legitimate internal security purposes? How does your company approach this dilemma? Our company for instance has always relied on outside attacks to spot check our security and i'm beginning to think there may be a more user friendly alternative. Thoughts? -- Jeffrey Lyon, Leadership Team jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net Black Lotus Communications of The IRC Company, Inc. Look for us at HostingCon 2009 in Washington, DC on August 10th - 12th at Booth #401. Sent from my BlackBerry device on the Rogers Wireless Network

11 17

Seeking AIM/ICQ security contact
by Thomas Kernen 05 Jan '09

05 Jan '09

I'm looking for an AIM/ICQ security contact. If someone has any names I can direct my requests to please contact me unicast so we can keep the S/N as low as possible. Thanks Thomas

1 0

RE: Ethical DDoS drone network
by Ray Corbin 05 Jan '09

05 Jan '09

Until you get hit at 8GB/s and then don't have a nice 'off' button.. -r -----Original Message----- From: Michael Gazzerro [mailto:mike.gazzerro@nobistech.net] Sent: Monday, January 05, 2009 1:14 PM To: 'Jeffrey Lyon'; nanog(a)merit.edu Subject: RE: Ethical DDoS drone network You could just troll people on IRC until you get DDOS'd. All the fun, none of the work! -----Original Message----- From: Jeffrey Lyon [mailto:jeffrey.lyon@blacklotus.net] Sent: Monday, January 05, 2009 11:54 AM To: nanog(a)merit.edu Subject: Re: Ethical DDoS drone network FWIW, I'm primarily concerned about testing PPS loads and not brute force bandwidth. Best regards, Jeff On Mon, Jan 5, 2009 at 12:51 PM, Edward B. DREGER <eddy+public+spam(a)noc.everquick.net> wrote: > RD> Date: Mon, 5 Jan 2009 15:54:50 +0800 > RD> From: Roland Dobbins > > RD> AUPs are a big issue, here.. > > And AUPs [theoretically] set forth definitions. > > Of course, there exist colo providers with "unlimited 10 Gbps bandwidth" > whose AUPs read "do not use 'too much' bandwith or we will get angry", > thus introducing ambiguity regarding just _for what_ one is paying... > > Perhaps "abuse" is best _operationally_ defined as "something that > angers someone enough that it's at least sort of likely to cost you some > money -- and maybe even a lot"? > > Were the definition clear, I doubt there'd be such a long NANOG thread. > (Yes, I'm feeling optimistic today.) > > > Eddy > -- > Everquick Internet - http://www.everquick.net/ > A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ > Bandwidth, consulting, e-commerce, hosting, and network building > Phone: +1 785 865 5885 Lawrence and [inter]national > Phone: +1 316 794 8922 Wichita > ________________________________________________________________________ > DO NOT send mail to the following addresses: > davidc(a)brics.com -*- jfconmaapaq(a)intc.net -*- sam(a)everquick.net > Sending mail to spambait addresses is a great way to get blocked. > Ditto for broken OOO autoresponders and foolish AV software backscatter. > > -- Jeffrey Lyon, Leadership Team jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net Black Lotus Communications of The IRC Company, Inc. Look for us at HostingCon 2009 in Washington, DC on August 10th - 12th at Booth #401.

2 2

Looking for verification that Google and Akamai have the geo-ip for 96.31.0.0/20 set correctly
by Frank Bulk - iName.com 05 Jan '09

05 Jan '09

We were assigned a new block from ARIN two weeks ago and are getting several reports from end users that the Spanish and German versions of Google's search page are coming up. IP2Location and Maxmind are mostly correct, but there appears to be no way for me to verify that Google and Akamai have 96.31.0.0/20 listed correctly. Perhaps someone can point me in the right direction so I can make an authoritative check. Thanks, Frank

7 8