- NANOG - lists.nanog.org

NANOG 42 PGP signing...
by Joel Jaeggli 15 Feb '08

15 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just a quick note, The keysigning sessions are going to be during the morning breaks during the general session, and will be located in the Garden Room. Monday Feb 18th 11:30-12:00 Tuesday Feb 19th 11:30-12:00 Wednesday Feb 20th 10:30-11:00 If you haven't already done so and plan to participate, please add your key to the keyring at: http://biglumber.com/x/web?keyring=6341 If you have any further questions, feel free to contact me via email or corner one of the people with the pgp signing dots since they mostly know the score. While printouts will probably be available feel free to add your key to the keyring right up to the time of the last keysigning event. thanks joel -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFHtPbx8AA1q7Z/VrIRAijmAJ962VmdLvZI9cnI81XGgUjqAe3ztACgiFbf z1Lodg8es3d7KBezw4eXNQI= =KPYz -----END PGP SIGNATURE-----

1 0

IBM report reviews Internet crime
by michael.dillon＠bt.com 15 Feb '08

15 Feb '08

IBM has released a report on Internet crime in 2007 here <http://www.iss.net/documents/whitepapers/xforce_2007_annual_report.pdf> Some highlights from the Management summary with my comments in [square brackets]: Vulnerabilities * Although total vulnerability disclosures went down, the number of reported high severity vulnerabilities increased by 28 percent in comparison with 2006. * The busiest day of the week for vulnerability disclosures continued to be Tuesday, with 1,361 new vulnerabilities disclosed on this day of the week in 2007. * Of all the vulnerabilities disclosed in 2007, only 50 percent can be corrected through vendor patches. [suggests that ISPs need to be proactive about detecting and blocking compromised machines] * Nearly 90 percent of 2007 vulnerabilities could be remotely exploited, up one percentage point from 2006. Web Browser Exploitation * Most in-the-wild browser exploits are generated by Web exploit toolkits. * Critical vulnerabilities for Mozilla Firefox were dramatically lower in 2007 compared to 2006. [If you still distribute any kind of software kits that do not install FireFox, you are doing your customers a disservice and making your detection and blocking task that much bigger. When you contact customers with compromised machines you might want to make it mandatory to install Firefox from your servers before re-enabling Internet access] Spam and Phishing * Of the top 20 companies targeted by phishing in 2007, 19 are in the banking industry and one conducts recruiting. [This suggests keywords to look for in incoming email. Also, for local and regional ISPs, the number of companies in these two industries are low enough that you may want to consider establishing a direct relationship with them to configure stricter incoming email filters] Web Content * 9 percent of Internet content was classified as unwanted (criminal, pornography, etc) as compared to 12.5 percent in 2006. * The U. S. far outpaces other countries as the primary hosting source of adult, socially deviant and criminal content on the Internet, accounting for roughly 40-48 percent in each content category. * The U. S. and Germany were the only two countries consistently among the top three hosting sources for each type of "unwanted" Internet content monitored throughout 2007. [Suggests that NANOG members need to raise the bar considerably to clean up their own backyard. What do you know about your own Internet peering partners?] Malcode * Trojans represent the largest category of malware in 2007 - 109,246 varieties account for 26 percent of all malware. * The most frequently occurring malware on the Internet was Trojan.Win32.Agent - 26,573 varieties in 2007 account for 24 percent of all Trojans. * The most common worm in 2007 was Net-Worm.Win32.Allaple with 21,254 varieties. It is a family of polymorphic worm that propagates by exploiting Windows(r) vulnerabilities instead of using e-mail. [This suggests that targetting these specific attack vectors could clean up a significant amount of the problem and correspondingly recduce your costs for detection and blocking of compromised machines.] Make sure to download the report for the complete management summary and many more details. ------------------------------------------------------- Michael Dillon RadianzNet Capacity Forecast & Plan -- BT Design 66 Prescot St., London, E1 8HG, UK Mobile: +44 7900 823 672 Internet: michael.dillon(a)bt.com Phone: +44 20 7650 9493 Fax: +44 20 7650 9030 http://www.btradianz.com Use the wiki: http://collaborate.intra.bt.com/

11 15

FW: BGP TTL Security
by Ben Butler 15 Feb '08

15 Feb '08

Hi Danny, Thanks for you help - no problems. I would agree 192 vs 63/64 it is to much of a coincidence for it not to be related somehow. Weirder and weirder - presumably people trying to hack the BGP session below: neighbor 212.121.34.1 ttl-security hops 192 And the session is up and we get: Extended IP access list ACL-MATCH-TTL-0/254 (Compiled) 10 permit ip any any ttl eq 0 (869 matches) 20 permit ip any any ttl eq 1 (1 match) 260 permit ip any any ttl eq 25 (1 match) 580 permit ip any any ttl eq 57 (1 match) 590 permit ip any any ttl eq 58 600 permit ip any any ttl eq 59 610 permit ip any any ttl eq 60 620 permit ip any any ttl eq 61 (2 matches) 630 permit ip any any ttl eq 62 (2 matches) 640 permit ip any any ttl eq 63 (1 match) <- presumably the foundry 1210 permit ip any any ttl eq 120 (2 matches) 1220 permit ip any any ttl eq 121 (2 matches) 1230 permit ip any any ttl eq 122 (1 match) 1240 permit ip any any ttl eq 123 (1 match) 1250 permit ip any any ttl eq 124 (1 match) 2500 permit ip any any ttl eq 249 (6 matches) 2510 permit ip any any ttl eq 250 (3 matches) This is connected to an ethernet IX and all peers are one hop away. Kind Regards Ben -----Original Message----- From: Danny McPherson [mailto:danny@tcb.net] Sent: 15 February 2008 01:16 To: Ben Butler Cc: Hank Nussbacher Subject: Re: BGP TTL Security On Feb 14, 2008, at 6:12 PM, Ben Butler wrote: > Hi, > > I have put a route map on the interface and matched every TTL from 0 > to > 254 and I am only getting matches on TTL 0. Is the ttl-security check still in place? I believe the way Cisco implemented that is that if the TTL doesn't match the prescribed value then they expire the TTL to drop the packet in the fast path. > The box on the other side in this particular instance is a high end > Foundry. > > I don't really care about the 192 thing because I will never have > mutlihop peers that far away - it was simply an observation. Well, that's quite a coincidence because Foundry's default IP TTL value is 64, which is quit suspicious. > The problem is needing to configure both sides of the peering and > consequently on a per session basis / cordinatition which means a lot > of work and inertia of organising other people to roll out the change. Hrmm... On other thought.. Is the Foundry a multi-hop peer? If so, perhaps in their configuration they're specifying ebgp multli-hop 1, which is triggering this behavior? But I'd suspect the above rather than this, because of the 192 behavior. Thoughts? -danny

1 0

BGP TTL Security
by Ben Butler 15 Feb '08

15 Feb '08

Hi, I am trying to implement BGP TTL security between one of my routers and an eBGP peer that is one hop away over a layer 2 IX. As soon as I add: neighbor 212.121.34.1 ttl-security hops 2 or neighbor 212.121.34.1 ttl-security hops 1 The peer drops to active/open sent with entries in syslog for hold time expired. I have validated via trace in both directions as being 1 hop. I have read another article that implies the default behaviour at the other end will to be send TTL 1 not 255 and consequently I need to configure both ends to get the session to come back up. An access list reveals all the packets I am receiving have a TTL of 0. The session re-establishes if I configure: neighbor 212.121.34.1 ttl-security hops >=192 <=191 and the session stays down. Which is proper bizarre! Is it necessary to configure this on both side for the session to re-establish. Is this a Cisco bug? Kind Regards Ben Butler ++++++++++++++++++++++++++++++++++++++++++ C2 Internet Ltd Globe House, The Gullet, Nantwich, Cheshire, CW5 5RL E mailto:ben.butler@c2internet.net W http://www.c2internet.net/ B1 http://c2internet.blogspot.com/ B2 http://c2noc.blogspot.com/ T +44-(0)845-658-0020 F +44-(0)845-658-0070 All quotes & services from C2 are bound by our standard terms and conditions which are available on our website at: http://www.c2internet.net/legal/main.htm#tandc C2 Internet Limited is a company registered in England and Wales with company number 03910154 Our VAT Registration number is GB 752 7650 17

2 2

Re: Network Notifcation - SMS via Verizon
by Henry Linneweh 15 Feb '08

15 Feb '08

I found this product of particular interest... http://www.scomobile.com/hipcheck/ -Henry ----- Original Message ---- From: "Bowman, Jonathan" <jbowman(a)virtela.net> To: nanog(a)merit.edu Sent: Tuesday, February 12, 2008 10:24:55 AM Subject: RE: Network Notifcation - SMS via Verizon I've used <10 digit number>@vtext.com with my Verizon phone for several years now without any issues or dropped SMS messages. Obviously that's an in-band solution, but it's simple to implement and fairly (in my experience) reliable. -Jonathan -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gregory Boehnlein Sent: Friday, February 08, 2008 7:03 PM To: nanog(a)merit.edu Subject: Network Notifcation - SMS via Verizon Hello, We have been discussing adding a wireless SMS based option to our TAP and SMTP delivery systems. We are running Nagios. In looking at the list archives, I found the following thread: http://www.irbs.net/internet/nanog/0408/0039.html Lots of great suggestions.. In looking at the options, it seems that Gnokii seems to be a well used solution to integrate a GSM or GPRS based phone/modem for text messaging. However, I am trying to determine if anyone is doing this with Verizon right now. Our existing Cell contract is w/ Verizon and so we want to avoid the potential of lost SMS messages in hopping from say T-mobile or Cingular to Verizon. So.. anyone doing SMS notification to Verizon w/ a wireless GSM/GPRS or Cell Phone solution? If so, you want to share how you are doing it? Thanks in advance..

1 0

remote hands / contractor / courier needed in Tokyo
by Alexander Koch 14 Feb '08

14 Feb '08

Folks, does anyone know or can refer to someone in Tokyo to do remote hands work, rack servers, fetch a server and bring from A to B etc? If no- one is coming to your mind, can someone refer to a courier service one can instruct/ sort things out with by email / credit card Ah, yeah, speaking English in a good way would be needed. If in doubt we also accept German, Dutch, French, or Italian, but that might get a bit more tricky. :-) Thanks in advance! Alexander

1 0

Re: Area Social Activity
by Gregory Hicks 14 Feb '08

14 Feb '08

> Date: Thu, 14 Feb 2008 11:20:53 -0800 > From: Jay Hennigan <jay(a)west.net> > To: nanog(a)merit.edu > Subject: Re: Area Social Activity > > > Rod Beck wrote: > > I am suggesting a Certified Drinkers Event in the hotel bar Sunday evening. > > Any Hash House Harriers in our midst? I partook whilst deployed to HongKong and Spain (some 12 years ago...). Haven't had occasion since then though. > > -- > Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net > Impulse Internet Service - http://www.impulse.net/ > Your local telephone and internet company - 805 884-6323 - WB6RDV ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 2655 Seely Ave M/S 9A1 San Jose, CA 95134 I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

173/8 and 174/8 allocated to ARIN
by Leo Vegoda 14 Feb '08

14 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The IANA IPv4 registry has been updated to reflect the allocation of two /8 IPv4 blocks to ARIN in February 2008: 173/8 and 174/8. You can find the IANA IPv4 registry at: http://www.iana.org/assignments/ipv4-address-space Please update your filters as appropriate. Kind regards, Leo Vegoda Manager, Number Resources - IANA -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin) iD8DBQFHtItTvBLymJnAzRwRAq4hAJsF7zELnkKFSHvGccPpoCK+ypwOLgCfZYgA YJOrIPDwVY2rkq7tQ+wXPAo= =Ame2 -----END PGP SIGNATURE-----

1 0

Novell DNS+DHCP server -- any experience?
by MARLON BORBA 14 Feb '08

14 Feb '08

Dear sirs, We are considering Novell Netware DNS+DHCP servers (over Netware 6.5) to replace our old ISC BIND and DHCP Linux servers. Could someone with experience in those products shed some light on their pros and cons? Please answer directly to my mailbox in order to keep NANOG clean. Abraços, Marlon Borba, CISSP, APC DataCenter Associate Técnico Judiciário - Segurança da Informação TRF 3 Região (11) 3012-1683 -- Practically no IT system is risk free. (NIST Special Publication 800-30) --

1 0

ride share
by Randy Bush 14 Feb '08

14 Feb '08

is there a ride share wiki or whatever? wiki.cluepon.net seems not to even have a nanog page this time. like how are we gonna log which remaining vietnamese restaurant is good? i'm getting in to sfo from tokyo about noon, by the time i get luggage, and do not like car rentals. randy

2 2