- NANOG - lists.nanog.org

Re: Blocking certain terrorism/porn sites and DNS
by Jonathan M. Slivko 18 Aug '05

18 Aug '05

> Yeps, a sys admin could do that. Sure. But we dont want others also to > see that website. Is it possible by deleting that entery from the > whois database is my question. No - not without some high level intervention at the registry and seeing as they are in the US under US law, it's not very likely to happen (freedom of speech/press, etc.). You could also set the firewall policy company wide at the network distribution point (where the Internet comes into the facility from the outside). But, that's censorship which I don't support except in rare cases. -- Jonathan

1 0

Re: zotob - blocking tcp/445
by Fergie (Paul Ferguson) 18 Aug '05

18 Aug '05

Oh,no -- not the "Where will it end?" defense. I should just go ahead and invoke Godwin's Law now and put us all out of thread misery... - ferg -- routerg <routerg(a)gmail.com> wrote: Where will the filtering end? Is your NSP/ISP responsible for filtering virii, spam, phishing? I'm not saying it wouldn't be nice, but considering the types of attacks we see coupled with the fact that many enterprise customers are service providers themselves, providing service to yet other service providers, it is very difficult to take their decission making power away. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Microsoft Ships Zotob Worm Removal Tool
by Fergie (Paul Ferguson) 18 Aug '05

18 Aug '05

Ryan Naraine writes in eWeek: [snip] Microsoft Corp. late Wednesday shipped an update to its malware removal tool to detect and delete the fast-spreading "Zotob" worm family. Microsoft typically updates the free utility once a monthon Patch Tuesdaybut with at least a dozen "Zotob" variants squirming through unpatched Windows 2000 systems, the company added detections for 10 mutants to help with the cleanup process. The new version of the Malicious Software Removal Tool will now zap the following worms: Zotob.A, Zotob.B, Zotob.C, Zotob.D, Zotob.E, Bobax.O, Esbot.A, Rbot.MA, Rbot.MB and Rbot.MC. [snip] Article: http://www.eweek.com/article2/0,1759,1849456,00.asp Updated Malicious Software Removal Tool: http://www.microsoft.com/security/malwareremove/default.mspx - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

OT? Device to limit simultaneous connections per host?
by David Hubbard 18 Aug '05

18 Aug '05

Hello everyone, I'm curious if anyone knows of a device that can throttle or limit a remote host's simultaneous connections or requests per second for web traffic on a per-IP basis. So I don't want to say web server X can only have 100 simultaneous connections and 10 requests per second. I want to say that for any given IP connecting to web server X, any one IP can have no more than 5 open connections and should be throttled if it starts making more than ten requests per second. If it could even be url-aware in that it could only apply the rules to specific types of web requests, that would be even better. The motivation here is to find a piece of equipment that can protect compute-intensive, database-driven websites from overly aggressive proxies, firewalls, search engines, etc. which like to hammer a given site with 50+ simultaneous requests against pages that could potentially need a few seconds of processing time per request. I've looked at a Packeteer PacketShaper running in reverse of what it normally would, trying to throttle and shape requests against the server rather than optimizing traffic for a low speed link like it was designed, but that didn't really work out as it could not have the policies applied on a per remote IP basis. Thanks, David

3 2

Re: What application runs on port 8094?
by Fergie (Paul Ferguson) 18 Aug '05

18 Aug '05

Hi Joe, A quick Google search renders: Cisco SSG TCP Redirect http://www.cisco.com/en/US/products/hw/routers/ps133/products_configuration… ...but it apparently runs on tcp/8094, so no idea here. 4662 sounds like eDonkey2000, a P2P application, but... http://www.iana.org/assignments/port-numbers says: oms 4662/tcp OrbitNet Message Service oms 4662/udp OrbitNet Message Service # Roy Davies <rdavies(a)daq.net> August 2005 - ferg -- Joe Shen <joe_hznm(a)yahoo.com.sg> wrote: Hi, Using netflow based monitor tool, I noticed there is a lot of traffic on 8094/UDP and 4662/TCP( both exceed 1Gbps, and exist all the time) What application use that port? Is there any P2P application use UDP as transportation protocol? thanks in advance. Joe -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: OT? Device to limit simultaneous connections per host?
by Fergie (Paul Ferguson) 17 Aug '05

17 Aug '05

WFQ/wRED? :-) - ferg -- "David Hubbard" <dhubbard(a)dino.hostasaurus.com> wrote: Hello everyone, I'm curious if anyone knows of a device that can throttle or limit a remote host's simultaneous connections or requests per second for web traffic on a per-IP basis. So I don't want to say web server X can only have 100 simultaneous connections and 10 requests per second. I want to say that for any given IP connecting to web server X, any one IP can have no more than 5 open connections and should be throttled if it starts making more than ten requests per second. If it could even be url-aware in that it could only apply the rules to specific types of web requests, that would be even better. The motivation here is to find a piece of equipment that can protect compute-intensive, database-driven websites from overly aggressive proxies, firewalls, search engines, etc. which like to hammer a given site with 50+ simultaneous requests against pages that could potentially need a few seconds of processing time per request. I've looked at a Packeteer PacketShaper running in reverse of what it normally would, trying to throttle and shape requests against the server rather than optimizing traffic for a low speed link like it was designed, but that didn't really work out as it could not have the policies applied on a per remote IP basis. Thanks, David

1 0

recommendations for 3rd party web site monitoring
by Matt Bazan 17 Aug '05

17 Aug '05

In need of external 3rd party site monitoring solution. Nothing fancy. Need to be alerted if site (HTTP/S, SMTP, TCP connect based) goes down (email, pager). Off list fine, thanks. Matt

3 2

RE: zotob - blocking tcp/445
by Erik Amundson 17 Aug '05

17 Aug '05

I've always been kind of conflicted with this issue. I mean, providers blocking traffic at all. On the one hand, I'm a corporate customer, and if I'm being DOSed or infected, I would want to be able to call my ISP and have it blocked. On the other hand, I truly feel that I pay my ISPs to pass traffic, not block it. I guess it only bugs me when something is blocked and I didn't even ask for it to be blocked...and then other stupid things are seeping through, but are not blocked even when I ask! If ISPs really wanted to make the Internet better for Corporate America, I guess they'd unplug most of Asia...not block a port here and there (but that isn't exactly acceptable). Anways, like I said, I'm conflicted...I change my mind every now and then because both arguments make logical sense. - Erik -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gadi Evron Sent: Tuesday, August 16, 2005 12:58 AM To: Christopher L. Morrow Cc: nanog(a)merit.edu Subject: Re: zotob - blocking tcp/445 [snip arguments] > Do not become the internet firewall for your large customer base... > it's bad. > Okay, so please allow me to alter the argument a bit. Say we agreed on: 1. Security is THEIR (customers') problems, not yours. 2. You are not the Internet's firewall. That would mean you would still care about: 1. You being able to provide service. 2. Your own network being secure (?) In a big outbreak, not for the WHOLE Internet, I'd use whatever I can. It can easily become an issue of my network staying alive. Blocking that one port then might be a viable solution to get a handle on things and calm things down. Naturally though you are right again, it is a case-by-case issue and can not be discussed in generalities. Gadi.

7 6

FCC Rules For VoIP E911 Challenged
by Eric A. Hall 17 Aug '05

17 Aug '05

http://www.advancedippipeline.com/168602003?cid=RSSfeed August 16, 2005 FCC Rules For VoIP E911 Challenged Nuvio files appeal of FCC's order for VoIP providers to implement emergency calling systems. By The Associated Press WASHINGTON (AP) -- A provider of Internet phone calls is challenging new Federal Communication Commission rules requiring the company to ensure reliable 911 emergency call service. Nuvio Corporation, which has about 10,000 subscribers, has filed a motion with the U.S. Court of Appeals for the District of Columbia asking the court to hear the case, company spokeswoman Heather Carmichael said Monday. ``We have worked diligently to provide our users with 911 access,'' said Jason Talley, president and chief executive of Nuvio. But, he said, ``the 120-day requirement imposed by the FCC is arbitrary and capricious and without support in the record.'' Nuvio, based in Overland Park, Kan., is a provider of Voice over Internet Protocol, also known as VoIP. The company asked the court to expedite the case and rule by Nov. 7. If there's no decision by then, Nuvio warned it will have no choice but to start suspending some customers. In May, the FCC ordered Nuvio and other providers of Internet-based phone calls to certify that their customers will be able to reach an emergency dispatcher when they call 911. Dispatchers also must be able to identify the caller's phone number and location. The companies were given until Nov. 28 to comply. The FCC declined to comment on Nuvio's appeal. -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

1 0

Re: India cites security concerns, blocks Huawei bid to expand their indian ops
by Brandon Butterworth 17 Aug '05

17 Aug '05

> The Huawei probe illustrates the uneasy relationship between China and > India. They don't have much choice who to trust when India owns most of the fibre and China supplies most of the kit brandon

1 0