- NANOG - lists.nanog.org

Colocation facilities in britian
by jgrajewski＠mandylionlabs.com 18 May '07

18 May '07

Does anyone have ballpark costs on what colo space costs in England. We are getting a quote for 7500 gbp per month For 19 square meters of space. In us we pay 3500 a month for 10x10 cage at a quest facility Also I'd anyone can recommend some british colo companies would appreciate it Sent from Wireless BlackBerry

7 6

How many others are nullrouting BT?
by Jo Rhett 18 May '07

18 May '07

We've long been aware that BT *never* deals with spammers or DoS attacks that originate from their network, but a new issue has come to light. BT has a number of users who are apparently testing out stolen credit card numbers from their network against stores of all flavors. 3 months of attempts by US banks, US police departments, FBI, etc to get any action taken on these issues has gone nowhere. BT is "protecting the interests of their users". Meanwhile the stolen credit card attempts continue unabated. We're considering null-routing all BT netblocks. I'm wondering how many others have already come to the same conclusion? -- Jo Rhett senior geek Silicon Valley Colocation Support Phone: 408-400-0550

5 7

Open DNS Operations Meeting, Chicago 27/28th July
by Keith Mitchell 18 May '07

18 May '07

OARC is pleased to announce the next DNS Operations meeting will take place immediately after the next IETF, in Chicago, IL, USA. The venue will be DePaul University's Loop Campus, just a few blocks from the IETF meeting hotel, on the afternoon of Friday 27th and all day Saturday 28th. We already have a number of notable DNS ops presentations lined up, but would like to invite anyone on this list who has material of interest to the DNS Operations community to please submit proposals for presentations. These should be submitted to <admin(a)oarc.isc.org>, no later than 29th June. Attendance is open to all, a registration form and more details will be published over the next few weeks. Keith Mitchell OARC Programme Manager

1 0

Re: Juniper M10i sufficient for BGP, or go with M20?
by Donald Stahl 18 May '07

18 May '07

> Strange. My rep always took pride in the fact that M- and T- series > devices have no overcommit at all.. Maybe things changed, we use no > quad-gig. Many of Junipers cards for the M7/M10 are oversubscribed- just look at their pdf's on the subject: http://www.juniper.net/products/modules/100044.pdf http://www.juniper.net/products/modules/100163.pdf > I'm very happy about the Juniper devices I manage. They're expensive but > very reliable, and their config interface has lots of unique features. Juniper's greatest asset over Cisco is the single software image for all their systems. In my latest purchase that didn't justify paying 4 times as much no matter how much I love the software. -Don

3 2

Re: How many others are nullrouting BT?
by Jo Rhett 17 May '07

17 May '07

Matthew Smith wrote: > What address did BT give you? 221b Baker Street, London You know, I am normally very against the over-the-top demands that law enforcement try to place on carriers. Certainly the non-standard format for delivery of data that CALCEA requires is a prime example. But situations like this, where BT gives US local, US federal and even UK police the runaround gives me a lot more sympathy for their situation. I do hope that when the UK police get tired of waiting, that they shut down everything in BT's data centre and take it all as evidence. BT deserves at least that, and frankly a whole lot more. A local fraud group is trying to determine if anyone whose card was stolen was a UK citizen so that a lawsuit against BT is possible. -- Jo Rhett senior geek Silicon Valley Colocation

4 7

Broadband routers and botnets - being proactive
by Gadi Evron 17 May '07

17 May '07

In this post I'd like to discuss the threat widely circulated insecure broadband routers pose today. We have touched on it before. Today, yet another public report of a vulnerable DSL modem type was posted to bugtraq, this time about a potential WIRELESS flaw with broadband routers being insecure at Deutsche Telekom. I haven't verified this one myself but it refers to "Deutsche Telekom Speedport w700v broadband router": http://seclists.org/bugtraq/2007/May/0178.html If you all remember, there was another report a few months ago about a UK ISP named BeThere with their wireless router being accessible from the Internet and exploitable, as another example: http://blogs.securiteam.com/index.php/archives/826 Two issues here: 1. Illegitimate access to broadband routers via wireless communication. 2. Illegitimate access to broadband routers via the WAN. I'd like to discuss #2. Some ISPs which provide such devices (as in the example of #2 above) use them as bridges only, preventing several attack vectors (although not all). Many others don't. Most broadband ISPs have a vulnerable user-base on some level. Many broadband ISPs around the world distribute such devices to their clients. Although the general risk is well known, like with many other security issues many of us remained mostly quiet in the hope of avoiding massive exploitation. As usual, we only delayed the inevitable. I fear that the lack of awareness among some ISPs for this "not yet widely exploited threat" has resulted in us not being PROACTIVE and taking action to secure the Internet in this regard. What else is new, we are all busy with yesterday's fires to worry about tomorrow's. Good people will REACT and solve the problem when it pops up in wide-exploitation, but what we may potentially be facing is yet another vector for massive infections and the creation of eventual bot armies on yet another platform. My opinion is, that with all these public disclosures and a ripe pool of potential victims, us delaying massive exploitation of this threat may not last. I believe there is currently a window of opportunity for service providers to act and secure their user-base without rushing. Nothing in security is ever perfect, but actions such as changing default passwords and preventing connections from the WAN to these devices would be a good step to consider if you haven't already. My suggestion would be to take a look at your infrastructure and what your users use, and if you haven't already, add some security there. You probably have a remote login option for your tech support staff which you may want to explore - and secure. That's if things were not left at their defaults. Then, I'd also suggest scanning your network for what types of broadband routers your users make use of, and how many of your clients have port 23 or 80 open. Whether you provide with the devices or not, many will be using different ones set to default which may pose a similar threat. Being aware of the current map of vulnerable devices of this type in your networks can't hurt. It is not often that we can predict which of the numerous threats out there that we do not address currently, is going to become exploited next. If you can spare the effort, I'd strongly urge you to explore this front and be proactive on your own networks. The previous unaddressed threat which most of us chose to ignore was spoofing. We all knew of it for a very long time, but some of us believed it did not pose a threat to the Internet or their networks for no other reason than "it is not currently being exploited" and "there are enough bots out there for spoofing to not be necessary". I still remember the bitter argument I had with Randy Bush over that one. This is a rare opportunity, let's not waste it. We are all busy, but I hope some of you will have the time to look into this. I am aware of and have assisted several ISPs, who spent some time and effort exploring this threat and in some cases acting on it. If anyone can share their experience on dealing with securing their infrastructure in this regard publicly, it would be much appreciated. Thanks. Gadi Evron.

11 16

RE: [cacti-announce] Cacti 0.8.6j Released (fwd)
by michael.dillon＠bt.com 17 May '07

17 May '07

> how do you define your schema? > how long does it take to insert/index/whatnot the data? This is a much bigger deal than most people realize. Poor schema design will cause your system to choke bade when you try to scale it. In fact, relational databases are not the ideal way to store this kind of data so when you design your schema, you are really fighting against the database to wrestle it into something that will work. > this is a huge burden to figure it all out, implement > and then monitor/operate 24x7. miss enough samples or data > and you end up billing too little. this is why most folks > have either cooked their own, or use some expensive suite of > tools, leaving just a little bit of other stuff out there. Personally, I doubt that it is possible to build a workable system, even with plugins, that will do the job for a significant percentage of service providers. Different companies have different needs, different hot button items, etc. This is an area where breaking the problem down into well-defined separate problems with a well-defined linkage, will go a long way. But to start with, just solving the data storage problem is a good place to start. If someone can create a specialized network monitoring database that scales, then the rest of the toolkit will be much easier to deal with. Note that people have done a lot of research on this sort of time-series database. People working in high-energy physics also have to deal with massive sets of time-series data. There is plenty of literature out there to help guide a design effort. But Open-Source developers don't usually do this kind of up-front research before starting coding. Money and manpower won't solve that kind of problem. --Michael Dillon

13 16

Stop! Please! Re: Broadband routers and botnets - being proactive
by Scott Weeks 17 May '07

17 May '07

--- ge(a)linuxbox.org wrote: > try to educate those people. Write CEOs/CTOs/CSOs > educating them and push the security teams for these : I am unsure of where else to go with this, and if Are you reading and thinking before responding? scott Please stop this on nanog. Please continue it on nanog-futures. Please!

1 0

RTT from NY to New Delhi?
by Joe Maimon 17 May '07

17 May '07

What should I expect? I am seeing ~350 from a vendor provided mpls cloud to a site in Sukhrali Chowk, Gurgaon, Haryana, India Thanks, Joe

12 14

Re: Broadband routers and botnets - being proactive
by Fergie 16 May '07

16 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Suresh Ramasubramanian" <ops.lists(a)gmail.com> wrote: >On 5/12/07, Albert Meyer <from_nanog(a)corenap.com> wrote: > >> I and numerous others (including some whom any reasonable NANOG-L poster >> would respect and listen to) have asked you repeatedly to stop trolling >> NANOG-L with this botnet crap. It is off-topic here. The last time you >> pulled this (starting > >As frequent as Gadi is with his botnet posts, insecure and wide open >CPE getting deployed across a large provider is definitely >operational. Suresh is right -- if you don't think CPE compromises are an operational problem, then I'm not sure what is. :-) [changing gears] I'll even go a step further, and say that if ISPs keep punting on the whole botnet issue, and continue to think of themselves as 'common carriers' in some sense -- and continue to disengage on the issue -- then you may eventually forced to address those issues at some point in the not-so-distant future. I understand the financial disincentives, etc., but if the problem continues to grow and fester, and consumer (and financial institutions) losses grow larger, things may take a really ugly turn. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.1 (Build 1012) wj8DBQFGRXxaq1pz9mNUZTMRArMKAJ9r5LymJwHl70u7b3XU5XzvB88WugCfWRFO jWmj4+AadZTVBwQ6VGjUmHE= =oZYK -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

13 15