- NANOG - lists.nanog.org

Re: New N.Y. Law Targets Hidden Net LD Tolls
by Robert Bonomi 18 Aug '05

18 Aug '05

> From owner-nanog(a)merit.edu Thu Aug 18 01:47:56 2005 > Date: Thu, 18 Aug 2005 02:44:59 -0400 > From: "Eric A. Hall" <ehall(a)ehsco.com> > Cc: nanog(a)merit.edu > Subject: Re: New N.Y. Law Targets Hidden Net LD Tolls > > > > On 8/17/2005 10:04 PM, Fergie (Paul Ferguson) wrote: > > > A new law that's apparently the first in the nation threatens to > > penalize Internet service providers that fail to warn users that some > > dial-up numbers can ring up enormous long-distance phone bills even > > though they appear local. > > aka, make ISPs liable for other people's fraud. What's the thinking here, > anybody know? *NOT* "other people's fraud". Just when you have 'intra-LATA' toll charges for some numbers within a single area-code. If the user is on one side of the area-code, and the provider's POP is on the far side of it, you can have a what appears to be a 'local' number, that does incur non-trivial per-minute charges. Without knowing _where_ a particular prefix is, you can't tell whether there will be toll charges for that call, or not, from any given call origin. Of course, this is true for *every* call in such an area -- if the new law is actually singling out ISPs (and ISPs -only-), I expect it could be successfully challenged as 'discriminatory'. The excessive 'local toll charge' situation is most visible on calls to ISPs, because those calls tend to be somewhat lengthy -- and frequent -- thus, the 'unexpected' charges can reach significant dollar value before the phone customer gets their first bill. Life gets _really_ messy, when the ISP gets phone service from a CLEC, because there is "no telling" _where_ the ILEC uses as the 'rate point' for handing the calls off to that CLEC. And the CLEC bills their customers based on distance from the caller's location to that hand-off point. The ISP equipment may be across the street from the caller, but the ILEC-CLEC hand-off is on the far edge of the area-code. and the 'local toll charges' are applied. The CLEC can't tell you (and thus, neither can the ISP) which prefixes are a 'non-toll' call to their numbeers. And trying to get an authoritative answer from the ILEC about what charges are to the CLEC's prefix can be _very_ difficult.

6 6

Re: zotob - blocking tcp/445 (fwd)
by Bill Nash 18 Aug '05

18 Aug '05

Resent to address formatting misbehaviour: Source proto dstPort count 62.149.195.129 6 42 13018 203.69.204.250 6 445 12889 213.123.129.237 1 2048 12693 70.17.255.43 6 443 12685 217.132.56.139 6 4899 11056 209.181.111.12 6 135 8148 221.210.149.97 6 4899 7368 212.24.201.220 6 135 6451 172.131.83.244 6 135 6025 209.188.172.66 6 445 5055 80.177.36.162 6 445 4982 64.121.65.197 6 4899 4262 64.32.117.250 6 135 3954 213.144.99.241 6 445 3493 64.231.44.65 6 135 3157 213.123.129.237 6 139 2988 222.84.236.98 6 1023 2414 222.84.236.98 6 9898 2398 64.228.209.103 6 135 2305

1 0

Community Update
by Betty Burke 18 Aug '05

18 Aug '05

All: As per the NANOG Charter, the first Steering Committee meeting, via conference call, was held on August 11th. Randy Bush has been selected to serve as chair. The community can post messages to the SC, via steering(a)nanog.org. Steering Committee information, including meeting minutes, is available at <http://www.nanog.org/sc.html> The NANOG support staff and I, welcome the new SC members. We remain excited about the NANOG evolution process. We encourage the community to continue to dialogue with the newly formed Steering Committee, the existing Program Committee, and Mail List Administrators. There is a wonderful group of people working to improve the process, and they value your input. Sincerely, Betty NANOG Project Manager Merit Network

1 0

India cites security concerns, blocks Huawei bid to expand their indian ops
by Suresh Ramasubramanian 18 Aug '05

18 Aug '05

By K.C. Krishnadas, EE Times Aug. 16, 2005 URL: http://www.informationweek.com/story/showArticle.jhtml?articleID=168602118 BANGALORE, India — Chinese telecom equipment maker Huawei Technologies' expansion plans here have again drawn the attention of Indian security agencies. For the second time in the last five years, Indian security agencies have moved to slow Huawei's expansion plans out of concern for India's strategic telecom network. In 2001, U.S. intelligence sources reportedly tipped off the Indian government about Huawei's activities here. Huawei has been embroiled in several high-profile intellectual property disputes with telecom rivals in recent years. Indian authorities are also concerned about Chinese links to India's neighbor and long-time adversary Pakistan. According to a report in The Times of India on Tuesday (August 16), the Indian government has put on hold Huawei's plans to use $60 million in new equity for its Indian subsidiary, Huawei Technologies India Pvt. Ltd. The report quoted the Research and Analysis Wing, an Indian intelligence agency, as saying Huawei "has been responsible for sweeping and debugging operations in the Chinese embassy [in India]. In view of China's focus on cyber warfare, there is a risk in exposing our strategic telecom network to the Chinese." The report said senior officials from Indian intelligence agencies recently discussed the matter and formed a committee to review guidelines for foreign companies involved in projects in sensitive industries. The committee will submit a report in September, when Huawei's case for increasing its equity is likely to be decided. The report quoted officials in the Indian Ministry of External Affairs as saying that Huawei attracted "adverse notice" from India's security agencies which expressed "reservations regarding the company's links with the Chinese military." A Huawei spokesperson here could not be reached for comment. Huawei launched a small Indian software development operation in 1999, but formally opened a development center in 2001. About a 1,000 people work for the company in India, making it Huawei's largest software development center outside China. Earlier this year it announced plans to set up a $60 million manufacturing unit in Bangalore, with plans to spend an additional $40 million to expand its existing R & D center here. Huawei is believed to have so far invested $100 million in the R & D center. Huawei's manufacturing plan is designed to cash in on India's expanding telecom infrastructure. The network expansion could eventually be worth billions of dollars to global telecom equipment suppliers. The Huawei probe illustrates the uneasy relationship between China and India. The regional rivals fought a war in 1962. Relations have improved over the last decade, but China's close military ties with Pakistan have fueled concerns here about Huawei's intentions. Meanwhile, a recent nuclear power deal between India and the United States has raised concerns in Beijing.

9 8

CESM over IP vendor recommendations
by Malayter, Christopher 18 Aug '05

18 Aug '05

Good Morning, I am looking for recommendations for CESM over IP devices, in particular, for carrying T1 traffic. Please contact me off-list. I will summarize all off-list responses if there is interest. Chris Malayter TDS Telecom - Network Services Data Network Engineering chris.malayter(a)tdstelecom.com Phone: (608) 664-4878 FAX: (608) 664-4644

1 0

Re: zotob - blocking tcp/445
by surfer＠mauigateway.com 18 Aug '05

18 Aug '05

NetBIOS was never meant to be a WAN protocol, so no problem in blocking it. For example: grc.com/su-techzone1.htm scott ----- Original Message Follows ----- From: Gadi Evron <ge(a)linuxbox.org> To: nanog list <nanog(a)merit.edu> Subject: zotob - blocking tcp/445 Date: Mon, 15 Aug 2005 21:51:43 +0200 > I heard from several different big ISP's that to stop the > spread of the worm they now block tcp/445. I suppose it > works. > > Gadi.

19 32

Re: Blocking certain terrorism/porn sites and DNS
by Miquel van Smoorenburg 18 Aug '05

18 Aug '05

In article <cistron.ce8d9033050818025539aefd62(a)mail.gmail.com>, Abhishek Verma <abhishekv.verma(a)gmail.com> wrote: >Okay, so i am not talking about blocking or removing a name server. I >am talking of removing that offending entry (like www.abc.com) from >the whois database or whereever the central database is mantained. The database you're talking about is DNS, not the WHOIS database. There is no central DNS database. The DNS database is distributed in a tree-like fashion. Mike.

1 0

RE: New N.Y. Law Targets Hidden Net LD Tolls
by Kristal, Jeremiah 18 Aug '05

18 Aug '05

> *NOT* "other people's fraud". Just when you have > 'intra-LATA' toll charges > for some numbers within a single area-code. If the user is > on one side of > the area-code, and the provider's POP is on the far side of > it, you can have > a what appears to be a 'local' number, that does incur > non-trivial per-minute > charges. Without knowing _where_ a particular prefix is, you > can't tell > whether there will be toll charges for that call, or not, > from any given > call origin. Pardon my ignorance, but don't most phone companies require 10 digit dialing for long-distance. We have similar situations in the rural area I live in, but the customers know if they dial more than 7 digits, it WILL be long distance. Not in densely populated urban areas. In NYC there are at least 5 area codes (212, 516, 917, 646, 347) that are local calls. You can also get extended local calling that adds several more area codes (914, 518, and I think one more). In fact you have to do 10-digit dialing for any call in NYC now, even if you're just calling next door. Things are very different in rural areas where each town has a single exchange. In the 80s I was still dialing only 4 digits to call people in the same town. The next town over has a different exchange, but was part of the same local telco coop, so it was 7 digit dialing but still local. The entire state had one area code (still does), but I think you had to use 1+ to call any toll number. > > Of course, this is true for *every* call in such an area -- > if the new law > is actually singling out ISPs (and ISPs -only-), I expect it could be > successfully challenged as 'discriminatory'. Agreed. It's silly to single out ISPs on this one. Any reasonable ISP is already warning customers that numbers that appear local may not be local. Way back in 95 I was working for a NY/NJ-based ISP that was trying to grow rapidly and we ran into this a lot, especially in NJ. After a handful of VERY irate customers called complaining about $500 phone bills, we got much better at knowing exactly where the toll lines were. We also worked with the Bell Atlantic to reduce the bills and started posting disclaimers. We would also do the work to ensure that a call was a local call if the customer asked, and explain to them how they could often get an expanded calling area for a small fee. > > The excessive 'local toll charge' situation is most visible > on calls to ISPs, > because those calls tend to be somewhat lengthy -- and > frequent -- thus, the > 'unexpected' charges can reach significant dollar value > before the phone > customer gets their first bill. Agreed, but is this really the ISPs fault, or is it the customer's fault. I think the fault lies with both. If an ISP is telling customers that they have local dialup numbers, the customer is likely going to believe the ISP. Sure mistakes happen, but if it keeps happening to a given ISP, maybe it is the ISP's fault. > > Life gets _really_ messy, when the ISP gets phone service > from a CLEC, > because there is "no telling" _where_ the ILEC uses as the > 'rate point' > for handing the calls off to that CLEC. And the CLEC bills > their customers > based on distance from the caller's location to that hand-off > point. The > ISP equipment may be across the street from the caller, but > the ILEC-CLEC > hand-off is on the far edge of the area-code. and the 'local > toll charges' > are applied. > > The CLEC can't tell you (and thus, neither can the ISP) which > prefixes are a > 'non-toll' call to their numbeers. And trying to get an > authoritative answer > from the ILEC about what charges are to the CLEC's prefix can > be _very_ > difficult. I have never come across this, but it may be more of a metro area thing. :-) I think in the end this is a typical government attempt to solve a non-problem. They can easily do public service announcements to inform their constituents, or ask the phone companies to deal with it as it really is a problem for them. It is a charge on the hone bill, right. :-) It's a very common problem in densely populated suburban areas. It's probably not much of a problem in North Dakota. I'm kind of perplexed why Mr. Spitzer is proposing this now though. It's not like dial-up is a growth market. I guess there are still people just getting their first internet connection and starting with dial-up. This might have had more traction 8-10 years ago, when people really were getting saddled with $500 phone bills. Jeremiah

1 0

New N.Y. Law Targets Hidden Net LD Tolls
by Fergie (Paul Ferguson) 18 Aug '05

18 Aug '05

Must be fun days in NY State with Eliot Spitzer as AG. Lots of "(mumble) war on cyber (mumble) crime (mumble) national security (mumble)".... :-) Actually, I kind of like the guy for taking some disreputable companies to task An AP newswire article by Michael Gormley, via Yahoo! News, reveals that: [snip] A new law that's apparently the first in the nation threatens to penalize Internet service providers that fail to warn users that some dial-up numbers can ring up enormous long-distance phone bills even though they appear local. A long distance call even within the same area code can cost 8 to 12 cents a minute, adding up to hundreds, even thousands of dollars a month. Companies face fines of up to $500 for each offense, and consumers could pursue civil action claiming an unfair business practice. The National Conference of State Legislatures said it knows of no similar law elsewhere. [snip] http://news.yahoo.com/news?tmpl=story&u=/ap/20050818/ap_on_hi_te/techbits_i… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

Re: What application runs on port 8094?
by Joe Shen 18 Aug '05

18 Aug '05

The situation here is, traffic on the two ports exists continuously. The total load on our egree link sums up to around 3Gbps (max) and 1.6Gbps(min). If both of the traffic is from P2P application, what is it? rebust file transmission over UDP? thanks --- Vulnerability Management <vulnerability(a)messagelabs.com> wrote: > Hi Joe, > > Joe Shen wrote: > > Hi, > > > > Using netflow based monitor tool, I noticed there > is a > > lot of traffic on 8094/UDP and 4662/TCP( both > exceed > > 1Gbps, and exist all the time) > > > > > > What application use that port? Is there any P2P > > application use UDP as transportation protocol? > > > > > Yes - eDonkey - it's listed on Dshield's "most > scanned ports": > > http://dshield.org/port_report.php?port=4662 > > Nothing listed for 8094 > > http://dshield.org/port_report.php?port=8094 > > but they do show a big spike in scans of this port a > couple of days ago. > Perhaps one of the recent MS worms calls home on > this port? UDP, > though... odd! > > \a > > Andrew Simmons > Messagelabs Security > > > > > > thanks in advance. > > > > Joe > > > > -- > "Only the paranoid survive." - Andy Grove (Intel) > > ______________________________________________________________________ > This email has been scanned by the MessageLabs Email > Security System. > For more information please visit > http://www.messagelabs.com/email > ______________________________________________________________________ > __________________________________ Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather http://asia.yahoo.com/meetic

1 0