- NANOG - lists.nanog.org

Re: [da] news: Trend Micro launches anti-botnet service
by Fergie 26 Sep '06

26 Sep '06

First, I think that forwarding messages from a private list is something that is frowned upon. Secondly -- and speaking as a Trend employee and someone intimately involved in the ICSS/BASE project -- we don't talk/play in the BGP traffic stream. We simply reap potential target data from a BGP/Origina-AS/perfix-announce dataset, and then allow the ICSS/BASE subscribers to make polict decisions on their merit -- whether to allow their downstream hosts to reselve DNS queries to suspect hosts, or not. We do not, in any way, piss into the BGP traffic stream. :-) It's just an intelligence feed -- one of many. - ferg -- brett watson <brett(a)the-watsons.org> wrote: On Sep 25, 2006, at 9:04 PM, Jeff Kell wrote: >> >> Well, a prefix hijack either means a router has been pwned, as I >> suggested, >> or a router is (as Governor Tarkin put it) "far too trusting" of >> its peers. >> >> And anyhow, I was speaking of BGP flaps in the context of botnets >> - has anybody >> seen an in-the-wild botnet that played BGP games? > > No, but playing some BGP games could certainly help to *mitigate* > them. > Turn the C&C list into a community. I've thrown the idea around > several > times but can't get any takers... been there, tried that: http://www.mainnerve.com/security/darknet.html -b -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: [da] news: Trend Micro launches anti-botnet service
by brett watson 26 Sep '06

26 Sep '06

On Sep 25, 2006, at 9:04 PM, Jeff Kell wrote: >> >> Well, a prefix hijack either means a router has been pwned, as I >> suggested, >> or a router is (as Governor Tarkin put it) "far too trusting" of >> its peers. >> >> And anyhow, I was speaking of BGP flaps in the context of botnets >> - has anybody >> seen an in-the-wild botnet that played BGP games? > > No, but playing some BGP games could certainly help to *mitigate* > them. > Turn the C&C list into a community. I've thrown the idea around > several > times but can't get any takers... been there, tried that: http://www.mainnerve.com/security/darknet.html -b

1 0

decline of customer service
by Philip Lavine 26 Sep '06

26 Sep '06

Times have changed, My experience has been recently that ISP's and ASP's have dramatically malnourished their first level support staff which in turn has created a resentful and lazy second teir. I am sick of the "It must be your network/cabling/CPE" attitude that I am getting from some teir 1 ISP's. I sick of replacing CSU's and checking extended demarcs while some clown in the POP is re-seating cards in the mux. Moreover stop accusing my network of latency issues. I ran the packet capture 100 times and the client is still send a FIN. The reason your application is slow is because your programmers think sockets are something you plug a can opener into. Finally, YOU are my vendor. I pay you money for exceptional service. Thank you for your time.

1 0

Re: New router feature - icmp error source-interface [was: icmp rpf]
by Fergie 26 Sep '06

26 Sep '06

Chris, So, I'm wondering: What happens when you have a traceroute tool that shows you MPLS-lableled hops, too? :-) http://momo.lcs.mit.edu/traceroute/index.php The best (?) of both worls, but I digress... - ferg -- "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> wrote: [snip] What's interesting is that today, in many networks, the usefulness of traceeroute has bee degraded by other non-ip issues (<cough>mpls</cough>) not in ALL cases, but certainly in many you are not seeing quite what you'd expect from the traceroute :( -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

Re: New router feature - icmp error source-interface [was: icmp rpf]
by Fergie 26 Sep '06

26 Sep '06

Ah, but there's the rub... ISPs who are "discreet" in how they wish their infrastructure to be "viewed" will continue to engineer methods in which portions are not visible to the public at-large. Somehow, I don't think that will ever go away, so trying to tilt at windmils w.r.t. (paraphrased) "...what interface an ICMP foo is sourced from..." is, indeed... tiling at windmills, methinks. :-) Cheers! - ferg -- "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> wrote: On Tue, 26 Sep 2006, Fergie wrote: > Chris, > > So, I'm wondering: What happens when you have a traceroute tool > that shows you MPLS-lableled hops, too? :-) > :) depends on the network I guess... I'm not sure it's going to tell you anything about hops hidden by mpls lsp's that don't decrement ttl though... -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: TCP receive window set to 0; DoS or not?
by Fernando Gont 25 Sep '06

25 Sep '06

At 21:55 08/09/2006, Jim Shankland wrote: >Travis Hassloch <travis.hassloch(a)rackspace.com> writes: > > The part where it becomes a DoS is when they tie up all the listeners > > on a socket (e.g. apache), and nothing happens for several minutes until > > their connections time out. Whether intentional or not, it does have > > a negative effect. > >Ah, that makes sense. I was assuming a deliberate attack, which is >not actually implicit in the term "DoS". A deliberate denial of >service is not made easier by shrinking the window. But an implementation >that advertises a 0 window in lieu of sending FIN or RST can certainly >deny service inadvertently by tying up resources that should have been >freed. FYI, this issue was raised at the IETF TCPM WG mailing-list a month ago or so. The OP argued to reduce the amount of time for which a peer could advertise a 0 window. However, the problem is that if the goalis to perform a DoS attack, the attacker could advertise a 1-byte window (or ay other small window). Or he could advertise a 0-window for some time (less than the "threshold" the OP proposed), then increase the window to, say, one segment, and then go back to advertising a 0 window. The OP had suggested seeing this behaviour tying up all system resources, hence leading to the attacked system to not be able to service legitimate systems. There seemed to be agreement as at the TCPM WG that yu should handle these scenarios at the application layer. Kindest regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

Re: fyi-- [dns-operations] early key rollover for dlv.isc.org
by Gregory Hicks 25 Sep '06

25 Sep '06

> Date: Fri, 22 Sep 2006 19:55:39 -0400 > From: Joseph S D Yao <jsdy(a)center.osis.gov> > To: Fergie <fergdawg(a)netzero.net> > Cc: nanog(a)merit.edu > Subject: Re: fyi-- [dns-operations] early key rollover for dlv.isc.org > > > On Fri, Sep 22, 2006 at 11:39:51PM +0000, Fergie wrote: > > Hmmm. It wouldn't have anything to do with prime numbers, now would > > it? :-) > > > Well, yes, but there are an infinite number of them. > > Of course, 17 is the most prime of them all. isc.org announced the early key rollover just as a discussion about "exponent 3 damage spreads" on the cryptography list was heating up. This discussion started with a statement that: > I've just noticed that BIND is vulnerable to: > > http://www.openssl.org/news/secadv_20060905.txt > > Executive summary: > > RRSIGs can be forged if your RSA key has exponent 3, which is BIND's > default. Note that the issue is in the resolver, not the server. > > Fix: > > Upgrade OpenSSL. So I thought that the early key rollover was due to this. Yet it seems to me that this discussion is still recommending that "-e 3" be used. Regards, GRegory hicks ------------------------------------------------------------------- I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

2 1

Re: NANOG Thread
by Alexander Harrowell 25 Sep '06

25 Sep '06

Well, if anyone wants to add more to it, there are quite a few prominent 'noggers still to cast.

3 3

802.3ad/LACP between Administrative Domains
by Chris Costa 25 Sep '06

25 Sep '06

We have a GE link to another SP and bridge a single VLAN ID to connect multiple hosts on each side. We'd like to increase the BW between the two networks, but the other provider cannot support upgrading to 10GE. What are the issues w/ running 802.3ad LACP between two separately managed networks and binding Nx1GE links: - Does this require BPDU forwarding across the links, and share a common STP for the VLAN? We currently filter BPDU's across the single link. - Any known LACP negotiation issues between a Cisco (6500) and Foundry (unkn)? - Is there the potential for layer 2 loops if LACP fails and BPDU's are being filtered across the links? - Bad experiences w/ 802.3ad when loosing one of the two links? Thank you for your input.

1 0

Topicality perceptions
by J. Oquendo 25 Sep '06

25 Sep '06

One of the biggest issues with the list as I've seen from time to time from my perspective, is the definition of "operations". So on a quick breakdown of the logical definition of NANOG, I derive "Operations of the North American Network". The problem with this stems from far too many bastardizing their own definition of what it should be. If I'm experiencing issues on the "Network" in North America, where else should I look for assistance but from a group that manages (or at least portrays to manage) operations in North America? I've posted quite a few questions here and there, many have said they've made no sense. DoS attacks... Mork calling Olson come in Olson... These do affect networks... Botnets, worms and viruses... Mork calling... Get the point? How many posts have we seen on configuring a router that were multi-threaded into a long post of "my config is better than yours" or similar. These are off-topic but I wouldn't trade em for the world. I've learned much from them, as have I from all sorts of posts on topic or not. I can see where there would be annoyance from certain threads, but I see more annoyance from the whiners and complainers who spew the same message inserting nothing worth reading and for this I have filters in place. William Allen Simpson wrote: > > Especially as I'm not aware of any Network Operator worth their salt that > doesn't have regular contact with their support call centers. > Regular contact? As in finding the name of someone who actually has a clue? Not the contact information of some helpdesk goon who doesn't understand the output of a traceroute? As in some helpdesk goon who understands what an AS is? Getting (semi)back on topic, who decides what's on topic or not, it seems to be based on one's personal view of what is and isn't relevant. <SNIP> http://www.nanog.org/endsystem.html "The charter of the NANOG list was written to avoid being too specific and to not preclude useful network-relevent discussion" </SNIP> Botnets: Relevant Viruses and worms: Relevant DoS attacks: Relevant Mail/Spam: Relevant Router configuration: Semi-Relevant If someone's misconfiguration will affect your network, then router configurations are somewhat relevant. I recall having a fiber issue a while back (http://www.irbs.net/internet/nanog/0408/0563.html) and although it was not relevant to NANOG whatsoever, who else better to ask then the experienced engineers and I was thankful for the responses I received. I also recall talking about a possible huge DoS against the BGP protocol (which COULD affect hundreds) yet the response was... "You're off-topic, etc." not including the off-list responses I received. Looking back at some of the threads I see posted here, whenever I tend to see something "operational" that doesn't bode well with someone, I see people quick to shoot a "you're off-topic" response offering nothing more than wasted bandwidth. It is those quick to shoot off those responses who give me the impression that they're nothing more than lazy whiners incapable of offering assistance/solutions/tips/etc. BGP exploitation? (http://www.irbs.net/internet/nanog/0308/1018.html) was shot down and I quote: "this is almost certainly not a topic for Nanog". Really? To date I have not released plenty of stupid programs capable of wrecking havoc because they serve no purpose. My intentions when I posted this was to inform others "Hey did you know that X could possible break your neighboring..." It was sent with hopes of working with engineers to find a resolution. I'm sure if I shot off a program to the "black hat" community, I would have been an ass since I didn't properly notify the powers that be (whoever these are these days). Perhaps "Operations" need be dissected, re-defined and re-posted on NANOG. Laptop policies? http://www.merit.edu/mail.archives/nanog/msg01619.html How is/was this relevant? So in other news, has anyone in the south experienced issues with Time Warner (South Carolina, Louisiana, etc.) experienced issues with filtering? Specifically SIP? I have tons of people with issues regarding VoIP and (not suprisingly) they happen to all be related to Time Warner. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743 "How a man plays the game shows something of his character - how he loses shows all" - Mr. Luckey

4 3