- NANOG - lists.nanog.org

RE: Best practices inquiry: filtering 128/1
by WONG, Yuen-Fung 11 Jul '06

11 Jul '06

> Would anyone not filter those routes? Why wouldn't you filter to /7? > > Actually, I take that back. Why wouldn't you just get a feed from > Cymru <http://www.cymru.com/Bogons/index.html> ?? > We had some hesitation on putting in a 1/ le /7 filter as these are not mentioned in any document / recommendation that they are invalid / bogus routes... nor in the Cymru. Anyway, just spotted this in Cymru [Ingress Prefix Filter Templates, Loose and Strict (Cisco)] but it was not included / mentioned in their fltr-bogons: ! Block Prefixes less than /5. ! ip prefix-list ISP-Ingress-In-Loose seq 50 deny 0.0.0.0/0 le 5 ! ! Block /6 and /7 prefixes - We have this in as a marker to see if any of the ! large networks pull together any /8s into smaller blocks. Watch this hit ! counters with "show ip prefix". Tuned per Adriana Vascan <avascan(a)cisco.com> ! suggestion. ! ip prefix-list ISP-Ingress-In-Loose seq 55 deny 0.0.0.0/0 le 6 ip prefix-list ISP-Ingress-In-Loose seq 60 deny 0.0.0.0/0 le 7 ! -yf

1 0

APRICOT 2007 Call for Papers
by Jonny Martin 11 Jul '06

11 Jul '06

Hi All. The APRICOT 2007 call for papers is now open, as per the following. Cheers, Jonny Martin APRICOT Program Committee --- Asia Pacific Regional Internet Conference on Operational Technologies (APRICOT) Bali, Indonesia 21st Feb - 2nd March 2007 http://www.2007.apricot.net Call for Papers The APRICOT 2007 Program Committee is now seeking contributors to the program. This is the main call for Presentations & Tutorials before the final program is fixed. We would like to give people the opportunity to submit their proposals early and to encourage people in the Asia Pacific region who have not previously presented their work to do so. We are looking for people who would like to: * Offer a technical tutorial on an appropriate topic; and/or * Participate in the technical conference sessions as a speaker; and/or * Convene and chair a Birds of a Feather (BOF) session. CONFERENCE MILESTONES --------------------- Call for Papers Opens: 1 July 2006 Deadline for Speaker Submissions: 30 October 2006 First Draft Program Published: 15 November 2006 Final Program Published: 15 January 2007 PROGRAM MATERIAL ---------------- APRICOT 2007 will be arranged into six operational streams, each of which will contain a number of conference tracks and related tutorials. This streamed approach is designed to foster operational communities within the Asia Pacific region. Each stream will take place in the same area providing opportunity for people do further discuss and network with peers. Streams for APRICOT 2007 are: 1. Routing Operations IPv4 and IPv6 Routing, APNIC Routing and IPv6 Technical SIG, MPLS, Backbone operations. 2. Services Operations DNS, VOIP, ENUM, IDN, IDC, content and other services, APNIC DNS SIG. 3. Security Operations NSP-Sec, DDoS, Security Operations, Anti-SPAM, Anti-Malware. 4. Internet Provider Relationships IXP Operations, Peering, APNIC IX SIG. 5. Access Technologies Wireless, WiMax, Metro Ethernet, DSL, Broadband access aggregation. 6. APNIC Stream APNIC's NIR, Database, Policy SIGs. TUTORIALS Tutorials are full-day workshops which focus on a particular subject in-depth. They may be presented by a single Instructor, or a team of instructors working together. Tutorial Instructors are encouraged to also sign up to be a Speaker in the Technical Conference Program as well. You can sign up to give a tutorial and/or conference session presentation by following the instructions at the end of this message for signing up as a speaker or instructor. Tutorial topics which have successful in the past, or have been requested for this year are: - Network security, IPSec, Auditing/Forensics, DDoS Mitigation, VoIP Security - Address planning, conservation, responsibility and migration to IPv6 - High performance IP backbone routing and management - BGP MultiHoming - MPLS - IPv6 implementation - Network planning, management and traffic engineering - Internet exchanges, construction, peering and collocation - Operations, NOC, Helpdesk and other support aspects - BIND, DNSSEC, Split Horizon DNS, and Reverse and multilingual DNS - Broadband first/last mile access technologies - Mobile and wireless technologies - Content, Applications, streaming and multimedia infrastructure - VoIP, Unified messaging, scaling e-mail infrastructure, Asterisk, etc. - Hosted Essential Services (mail, DNS, etc), Server scaling, Open source - Quantitative Analysis for Internet Public Policy The program committee will consider proposals for tutorials in any of these areas, and also in new areas. There will be two days of Tutorials. Tutorials last 1/2 day or a full day and can cater to beginner through to advanced audiences. Tutorial days are typically split into four 1.5 hour sessions. If you have an idea for a tutorial subject that is not listed, please feel free to submit it to us. TECHNICAL CONFERENCE SESSIONS The Main Conference Program for 2006 will be made up of two days, with three streams each day. In addition there will be a stream focused on local (Indonesian) internet issues. Each stream will consist of four 1.5 hour sessions, with each having three or four presentations. This allows 20-30mins per presenter. Sessions are chaired by persons of appropriate expertise in the subject matter of the session and will include ample time for questions from the audience. Successful presentations from past APRICOTs have covered topics relevant to current operational deployments or new technologies not yet in wide deployment. Proposals for conference presentations are invited for topics fitting into the six streams outlined above. If you would like to give a presentation at one or more of the sessions, follow the instructions at the end of this message for signing up as a speaker or instructor. CFP SUBMISSION -------------- When considering a presentation or tutorial, remember that the APRICOT audience is mainly comprised of technical network operators and engineers with a wide range of experience levels from beginners to multi-year experience. There is a strong orientation to offer core skills and basic knowledge in the tutorials and to address issues relevant to the day-to-day operations of ISPs and network operators over the next 12 - 18 months in the conference sessions. The deadline for submissions is 30 October, 2006. Draft slides for both tutorials and conference sessions MUST be provided with CfP submissions. Final slides are to be provided by 15 January, 2007. While the majority of speaking slots will be submitted by 30 October 2006, a limited number of slots may be available for presentations that are exceptionally timely, important, or of critical operational importance. IMPORTANT NOTE -------------- APRICOT is a TECHNICAL conference so marketing and commercial content is not allowed within the program. The program committee is charged with maintaining the technical standard of APRICOT, and will therefore not accept inappropriate materials. It is expected that the presenter be a technical person and not a sales or marketing person. The audience is extremely technical and expects that the speakers are themselves very knowledgeable. All sessions provide time for questions, so presenters should expect technical questions and be prepared to deliver insightful and technically deep responses. FUNDING AND SUPPORT ------------------- APRICOT is a not-for-profit event that tries to keep the cost to attendees low so we are unable to pay the travel costs of speakers. Speakers from developing countries may be eligible for the APRICOT Fellowship Program which provides basic assistance to successful fellows to cover local living and registration expenses associated with attending the conference. Of course, Tutorial instructors will not have to pay any registration fee to attend the conference or tutorials, and Conference Speakers do not have to pay for registration to the Technical Conference. SIGNING UP AS A SPEAKER, INSTRUCTOR OR BOF Convener If you would like to be considered as a tutorial instructor, session speaker, or a convener of a BOF, please fillin the form at http:// submission.apricot.net/ More information on the conference is available at http:/www.2007.apricot.net Thanks, APRICOT Program Committee program(a)apricot.net

1 0

Re: Best practices inquiry: filtering 128/1
by Patrick W. Gilmore 11 Jul '06

11 Jul '06

On Jul 10, 2006, at 10:18 PM, Valdis.Kletnieks(a)vt.edu wrote: > On Mon, 10 Jul 2006 22:00:11 EDT, "Patrick W. Gilmore" said: >> >> On Jul 10, 2006, at 9:48 PM, WONG, Yuen-Fung wrote: >> >>> Sometimes earlier this year someone announced this 128/1 and caused >>> heavy loading to our routers to rebuild the CEF. >>> Would anyone filter out this route (and other similar routes such >>> as 0/1, 128/1, 0/2, 64/2, .... up to /4, for example) as bogus >>> routes? >> >> Would anyone not filter those routes? Why wouldn't you filter to /7? > > Every growing season, a new crop of network engineers falls fresh from > the tree, and must be picked up, polished, and clue imparted on the > way to market..... Well, then don't snip the most important clue in the post: > Actually, I take that back. Why wouldn't you just get a feed from > Cymru <http://www.cymru.com/Bogons/index.html> ?? :-) -- TTFN, patrick

1 0

Fridays are always good for shock headlines...
by Fergie 10 Jul '06

10 Jul '06

Nothing new here, but just an FYI -- I figured some of you might want to be aware new pressures being exerted in the CALEA arena. Via C|Net. [snip] The FBI has drafted sweeping legislation that would require Internet service providers to create wiretapping hubs for police surveillance and force makers of networking gear to build in backdoors for eavesdropping, CNET News.com has learned. [snip] More: http://news.com.com/2100-1028_3-6091942.html - ferg p.s. When did the FBI start drafting legislation? ;-) -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

Best practices inquiry: tracking SSH host keys
by Phillip Vandry 10 Jul '06

10 Jul '06

We all know that the weakest link of SSH is key management: if you do not confirm by a secure out of band channel that the public host key of the device you are connecting to is correct, then SSH's crypto will not help you. SSH implements neither a CA hierarchy (like X.509 certificates) nor a web of trust (like PGP) so you are left checking the validity of host keys yourself. Still, it's not so bad if you only connect to a small handful of well known servers. You will either have verified them all soon enough and not be bothered with it anymore, or system administrators will maintain a global known_hosts file that lists all the correct ones. But it's quite different when you manage a network of hundreds or thousands of devices. I find myself connecting to devices I've never connected to before on a regular basis and being prompted to verify the public host keys they are offering up. This happens in the course of something else that I am doing and I don't necesarily have the time to check a host key. If I did have time, it's hard to check it anyway: the device is just one of a huge number of network elements of no special significance to me and I didn't install it and generate its key and I don't know who did. >From time to time I also get hit with warning messages from my SSH client about a changed host key and it's probably just that someone swapped out the router's hardware sometime since the last time I connected and a new key got generated. But I'm not sure. Worst of all, my problem is repeated for every user because each user is working with their own private ssh_known_hosts database into which they accept host keys. A possible solution is: - Maintain a global known_hosts file. Make everyone who installs a new router or turns up SSH on an existing one contribute to it. Install it as the global (in /etc/) known_hosts file on all the ssh clients you can. Pro: The work to accept a new host key is done one, and it's done by the person who installed the router, who is in the best position to confirm that no man in the middle attack is taking place. Con: You need to make sure updates to this file are authentic (its benefit is lost if untrusted people are allowed to contribute), and you need to be sure it gets installed on the ssh clients people use to connect to the network elements. Con: If a host key changes but it is found to be benign (such as the scenario I describe above), users can't do much about it until the global file is corrected and redeployed (complicated openssh options which users will generally not know to bypass the problem notwithstanding). I'm looking for information on best practices that are in use to tackle this problem. What solutions are working for you? Thanks -Phil

10 15

Re: NANOG Spam?
by William Allen Simpson 10 Jul '06

10 Jul '06

Christian Seitz <chris(a)in-berlin.de> wrote: > In article <44AC3493.6010705(a)gmail.com> you wrote: > >> oarwind.info. >> AS | IP | Registry | AS Name >> 6724 | 81.169.143.178 | ripencc | STRATO Strato AG > > How did you resolve this? Is there something wrong with > my DNS or did you make a mistake resolving the adress? > > oarwind.info A 218.22.43.22 > > inetnum: 218.22.0.0 - 218.23.255.255 > netname: CHINANET-AH > country: CN > descr: CHINANET Anhui province network > descr: Data Communication Division > descr: China Telecom > admin-c: CH93-AP > tech-c: AT318-AP > status: ALLOCATED PORTABLE > mnt-by: APNIC-HM > mnt-lower: MAINT-CHINANET-AH > changed: hm-changed(a)apnic.net 20060322 > source: APNIC > At the time of resolution 3 days ago, multiple persons on this list resolved it to Strato.de. h613092.serverkompetenz.net (81.169.143.178) Apparently, it has since moved to China. That's the kind of thing that happens while you took a long weekend. Are you in a position to quarantine the German server? Or otherwise aid in investigating the problem? Such as getting German law enforcement to confiscate the server as compromised and containing personal identity theft?

1 1

Re: NANOG Spam?
by Gregory Hicks 10 Jul '06

10 Jul '06

> Subject: NANOG Spam? > Date: Wed, 5 Jul 2006 12:56:19 -0500 > From: "Joe Johnson" <joe(a)sendjoeanemail.com> > To: <nanog(a)merit.edu> > > > Am I the only one to get this email? Headers say merit.edu sent it. I > have NANOG whitelisted, though, so it came to my mailbox. > [...snip spam...] No, I got it as well but Postini caught it for me. So I hadn't seen it... Just a "joe-job" though. The headers are forged. See the IP address in thi FIRST "Received-by:" header. Came from Spain. [...snip later headers...] Received: from trapdoor.merit.edu (unknown [84.232.124.32]) by trapdoor.merit.edu (Postfix) with SMTP id AD0CF91265 for <nanog(a)trapdoor.merit.edu>; Wed, 5 Jul 2006 13:39:15 -0400 (EDT) From: "nanog(a)enterzone.net" <nanog(a)enterzone.net> To: nanog(a)trapdoor.merit.edu Content-type: text/html; Charset=Windows-1251 ------------------------------- % Rights restricted by copyright. % See http://www.ripe.net/db/copyright.html % Information related to '84.232.124.0 - 84.232.125.255' inetnum: 84.232.124.0 - 84.232.125.255 netname: TELELEPE-NET descr: Television Por Cable descr: Hermanos Ponce Garcia S.L. descr: Local TV and ISP Provider country: es admin-c: GPP18-RIPE tech-c: GPP18-RIPE status: ASSIGNED PA mnt-by: SERVIHOSTING-MNT source: RIPE changed: ripe(a)servihosting.es 20060126 person: Gregorio Ponce Pozuelo address: C/Niña, 31 address: 21440 Lepe (Huelva) SPAIN phone: +34 959645086 fax-no: +34 959158409 e-mail: cablehnosponcegarcia(a)hotmail.com nic-hdl: GPP18-RIPE notify: ripe(a)servihosting.es mnt-by: SERVIHOSTING-MNT changed: ripe(a)servihosting.es 20060126 source: RIPE % Information related to '84.232.0.0/17AS29119' route: 84.232.0.0/17 descr: ServiHosting Networks S.L. descr: First Allocation remarks: ********************************************** remarks: | For ABUSE/SPAM/SCANS issues | remarks: | send mail to abuse(a)servihosting.es | remarks: | or Fax at number +34.966982510 | remarks: ********************************************** origin: AS29119 mnt-by: SERVIHOSTING-MNT notify: m.tecles(a)servihosting.es changed: ripe(a)servihosting.es 20060113 source: RIPE Regards, Gregory Hicks --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 9B1 San Jose, CA 95134 I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

19 25

Fwd: (RADIATOR) OSC hosts RadiusExpert Wiki
by Hugh Irvine 09 Jul '06

09 Jul '06

Hello Everyone - For those of you who may be interested in RADIUS and/or DIAMETER. regards Hugh > > Open System Consultants (OSC) has established a free resource for > the RADIUS > user community to collect and share information about configuring and > implementing RADIUS protocol devices and software. > > RadiusExpert:Community Portal at > http://www.open.com.au/wiki/index.php/Main_Page will become the > repository > for all the information that often resides only in the heads of system > administrators who manage and maintain the security access and > authentication requirements of their networks. > > We welcome contributions about such topics as configuring various > RADIUS > devices, load balancing with RADIUS servers and wireless > authentication tips > from our very active user community. > > If you can contribute any information on any RADIUS topic to the > benefit of > the entire community, please feel free. > > For more information about the Wiki, please contact me or go to: > > http://www.open.com.au/press_complete.html > > Best regards, > Nicola Wassell > Open System Consultants > 9 Bulbul Place, Currumbin Waters QLD 4223 Australia http:// > www.open.com.au > Phone +61 7 5598 7474 Fax +61 7 5598 7070 > -- Radiator: the most portable, flexible and configurable RADIUS server anywhere. Available on *NIX, *BSD, Windows, MacOS X. Includes support for reliable RADIUS transport (RadSec), and DIAMETER translation agent. - Nets: internetwork inventory and management - graphical, extensible, flexible with hardware, software, platform and database independence. - CATool: Private Certificate Authority for Unix and Unix-like systems.

1 0

Copper thefts in california
by Sean Donelan 09 Jul '06

09 Jul '06

In addition to the traditional backhoe threat, as the price of copper increased so has the threat of people stealing telephone trunk cables containing copper wire. http://www.dailybulletin.com/news/ci_4021500 Since Jan. 1, there have been 148 reports of copper wire theft in San Bernardino County, said sheriff's spokeswoman Jodi Miller. [...] Per pound, the metal has risen in price from about 70 cents in July 2001 to $3.60 this month, according to Kitco Inc., an international retailer of precious metals. [...] Anyone with information on the Verizon theft may call the Verizon Security Control Center, 1-800-997-3287. For the AT&T thefts, people may call security at (213) 633-2558 or (213) 633-2405. People with information on copper thefts may also contact their local law enforcement agencies.

5 4

CFP: DA Workshop - ISOI
by Gadi Evron 09 Jul '06

09 Jul '06

This is a call for papers for a DA Workshop (ISOTF/TISF DA). Its name is: Internet Security Operations and Intelligence Workshop or ISOI for short. DA stands for Drone Armies (botnets), which is the main subject of this workshop. I apologize for those who get this message multiple times. Introduction ------------ This workshop is for the purpose of bringing together members of the DA and MWP operational communities and share information, as well as plan our future operations. It is open to other operational communities as specified below. Among the attendees are: Professionals from ISPs, Anti Viruses, Anti Spam, CERTs, Law Enfrocement, Academia, etc. coming together to work on the most recent technology, intelligence and operations being done online today for the security of the Internet. This ISOI DA Workshop is being hosted by Cisco Systems, Inc., whom we would like to thank at this time. CFP --- The call for papers is open to the public. The main subject of interest is botnets. Secondary subjects are Denial of Service attacks and phishing. Submission is simple, email me directly with your topic and some data to back it up by July 23rd. Scope: ------ This year's workshop will be mainly on the subject of botnets. Secondary subjects include Denial of Service attacks and phishing. This workshop will provide with the usual benefits such as lectures and networking, but mostly we will discuss the latest occurrences, technology and intelligence and our future plans, as well as coordination and information sharing between other operational and research communities. Cooperation with law enforcement will also be covered. Details: -------- Date: Thursday, August 10, 2006 When: 9:30 a.m. - 5:00 p.m. Location: Cisco Systems, Inc. Building C 150 Tasman Drive San Jose, CA 95134 Attending Remotely: ------------------- A phone conference bridge and web conference will be available to share presentations for remote attendees. Intended Audience: ------------------ Hands-on people and decision makers. Attendance: ----------- The workshop is organized by the DA and MWP communities with the much appreciated help of Cisco Systems, Inc., and is closed to members of the following communities: DA, MWP (and sister communities such as routesec), OARC, NSP-SEC. FIRST and the honey-net project. If you are not a member and would like to attend, feel free to send a request. We would be happy to learn of your interest. The workshop is closed to reporters. Please verify your arrival by August 1st, space is limited. Costs: ------ Attendance is free. -- Gadi Evron, ISOI/DA Coordinator, ge(a)linuxbox.org.

3 4