- NANOG - lists.nanog.org

CanSecWest/core05 Call for Papers - May 4-6 2005 - Deadline December 6 2004
by Dragos Ruiu 26 Oct '04

26 Oct '04

CALL FOR PAPERS CanSecWest/core05 Network Security Training Conference http://cansecwest.com May 4-6 2005 Vancouver, B.C. Canada CanSecWest would like to announce the call for papers of the spring, sixth annual, CanSecWest/core05 network security training conference and the announcement of the final set of presentations for the PacSec.jp/core04 conference. The CanSecWest/core05 conference will be held on May 4-6 at the Mariott Renaissance in downtown Vancouver, British Columbia, Canada. The conference focuses on emerging information security tutorials and technology. Please submit all proposals for presentations by December 6. This year we will continue to also have two kinds of presentations, the normal one hour tutorials, and there will again be a session of the popular "lightning talks": 5 minutes max (BigHook/Gong enforced) and 1-3 slides. Selected "lightning talk" presenters will receive registration discounts (or rebates) - travel and accomodations are their responsibility. "Lightning talk" submissions should follow the same submission guidelines below. Deadline for "lightning talk" submissions is January 17th, 2005. The conference is responsible for travel and accomodations for the tutorial speakers. If you have a proposal for a tutorial session then please email a synopsis of the material and your biography, papers, and speaking background to core05(a)cansecwest.com. Tutorials are one hour in length. Only slides will be needed for the April paper deadline, full text does not have to be submitted. The CanSecWest/core05 conference consists of tutorials on technical details about current issues, innovative techniques and best practices in the information security realm. The audiences are a multi-national mix of professionals involved on a daily basis with security work: security product vendors, programmers, security officers, and network administrators. We give preference to technical details and education for a technical audience. The conference itself is a single track series of presentations in a lecture theater environment. The presentations offer speakers the opportunity to showcase on-going research and collaborate with peers while educating and highlighting advancements in security products and techniques. The focus is on innovation, tutorials, and education instead of overt product pitches. Some commercial content is tolerated, but it needs to be backed up by a technical presenter - either giving a valuable tutorial and best practices instruction or detailing significant new technology in the products. Paper proposals should consist of the following information: 1) Presenter, and geographical location (country of origin/passport) and contact info (e-mail, postal address, phone, fax). 2) Employer and/or affiliations. 3) Brief biography, list of publications and papers. 4) Any significant presentation and educational experience/background. 5) Topic synopsis, Proposed paper title, and a one paragraph description. 6) Reason why this material is innovative or significant or an important tutorial. 7) Optionally, any samples of prepared material or outlines ready. Please forward the above information to core05(a)cansecwest.com. to be considered for placement on the speaker roster. The selected papers for PacSec.jp/core04 are: George Kurtz - Google Hacking: Searching for ways to stop hackers. Shane "K2" Macaulay & Dino Dai Zovi - Wireless vulnerabilities from rogue access points. Nico Fischbach - Voice Over IP Security Maximillian Dornseif - 0wn3d by an iPod: Firewire/1394 Issues Nico Fischbach & Toby Kohlenberg - Best methods for detecting anomalies in global networks David Meltzer - Hybrid approaches for optimized network discovery Nicolas Brulez - Windows virus executable file infections and heuristic detection. Ivan Arce - Analyzing exploit code quality. Hiroaki Etoh - Stack Protection Systems (ProPolice, XP SP2...). Laurent Oudot - Countering Attack Deception Techniques. Greg Smith - Security Tutorial for Administrators. Ejovi Nuwhere - Inside Jyukinet: The Audit. More information on the PacSec.jp/core04 conference in Tokyo on November 11-12 can be found at http://pacsec.jp Advance discount registration is now open for CanSecWest/core05 at http://cansecwest.com thanks, --dr -- World Security Pros. Cutting Edge Training, Tools, and Techniques Tokyo, Japan Nov 11-12 2004 http://pacsec.jp pgpkey http://dragos.com/ kyxpgp

1 0

RE: BW Management solutions advice
by Albinati, Luis Martin 25 Oct '04

25 Oct '04

AFAIK, Allot boxes do have an option to decide whether or not to drop traffic above a certain definable number of connections, which is not really an attack recognition but its as close as it gets in their box. Anyway, as you say, they don't react automatically, you need to set it first :( > On Fri, 22 Oct 2004, Albinati, Luis Martin wrote: > > I am considering some bandwidth management solutions and > would like to > > know if some of you people have had some real world > experiences with > > this kind of boxes. More specifically I am looking at some > Large-ISP > > or Carrier-Grade solutions with at least the following > specifications: > > > > >= 1Gbps traffic capacity > > >500k simultaneous connections > > Layer 7 stateful packet inspection (via protocol signatures and/or > > protocol analysis) Traffic prioritization, shaping, QoS and > bandwidth > > provisioning based on custom defined policies (vlan id, ip ranges, > > tos, time of day, etc) possibility to easily update and > deploy new or > > modified protocol definitions without affecting availability. > > Add here: "automatic rate-limiter adaptation" / "attack > pattern recognition". > > Do we still have solutions on the table? I'd be interested > what kind of solutions are available in Gbit/s-grade which do > not need you to configure certain kind of rate-limiters a > priori, but can automatically react to most kinds of attacks, > even simple ones (e.g., TCP SYN floods). > > -- > Pekka Savola "You each name yourselves king, yet the > Netcore Oy kingdom bleeds." > Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings > >

1 0

ATM PNNI Idea bounce
by John Bittenbender 25 Oct '04

25 Oct '04

Nanogers, Sorry to bother, but I'm looking to bounce some ideas off someone that has experience in a large (150+) node ATM PNNI network. Please contact me offlist if you can spare a few moments to read a quick write-up and reply with thoughts. Thanks, John Bittenbender

1 0

Routing to external?
by joe 24 Oct '04

24 Oct '04

Greetings, I have an odd question that I'm faced with regarding routing to external address spaces. The senario is a large network (global) with multiple points, each POP has tail sites that home and default to that Ipop as a gateway of last resort. The question I'm wrestling with is at each pop I have a /24 range, would it be best practice to route internally to those address spaces versus routing through my pop to each? In otherwords, if say I have a network thats located in Russia and I'm attempting to get to it from North America, wouldn't it make more sense to route through my own WAN versus the internet? My thought is that since I have more control over my WAN than the internet, I can better anticipate the results, but one could argue that it may make more sense to use the internet from each pop. Any comments or thoughts are appreciated, Joe Blanchard

2 2

domain isn't registred, but does exist in root-servers?
by diederik＠dmclf.org 23 Oct '04

23 Oct '04

just wondering about the following: there is no whois-info for sedgq.com (response: No match for "SEDGQ.COM".) but, host sedgq.com sedgq.com has address 66.218.79.155 sedgq.com has address 66.218.79.147 sedgq.com has address 66.218.79.148 sedgq.com has address 66.218.79.149 how can this be? i mean, afaik a domein needs to be registred before its 'known' this because of an email i received like: ---- Received: from [66.179.231.27] (helo=ims-2.prv.ampira.com) by dmclf.com with esmtp (Exim 4.31) id 1CLSdk-0002yb-2c for dmclf(a)dmclf.com; Sat, 23 Oct 2004 22:37:28 +0200 Received: from cws-3.ampira.com ([66.179.231.35] helo=cws-3.prv.ampira.com) by ims-2.prv.ampira.com with esmtp (Exim 4.24) id 1CLSdc-0002q2-8O for dmclf(a)dmclf.com; Sat, 23 Oct 2004 16:37:20 -0400 Received: (from www@localhost) by cws-3.prv.ampira.com (8.11.7p1+Sun/8.11.7) id i9NKbGF19224; Sat, 23 Oct 2004 16:37:16 -0400 (EDT) Date: Sat, 23 Oct 2004 16:37:16 -0400 (EDT) From: auto-confirm(a)amazon.com To: dmclf(a)dmclf.com Subject: Amazon Security Request Dear Amazon User, During our regular update and verification of the accounts, we could not verify your current information. Either your information has changed or it is incomplete. As a result, your access to buy on Amazon has been restricted. To continue using your Amazon account again, please update and verify your information by clicking the link below : http://www.amazon.com@sedgq.com/exec/obidos/subst/home/?EnterConfirm&UsingSS L=0&pUserId=&us=445&ap=0&dz=1&Lis=10&ref=br_bx_c_2_2 Thank you very much for your cooperation! Amazon Customer Support Please note: This e-mail message was sent from a notification-only address that cannot accept incoming e-mail. Please do not reply to this message. Thanks again for shopping with us. Amazon.com Earth's Biggest Selection

3 2

Akamai
by Robert Scott 23 Oct '04

23 Oct '04

Any body else having trouble with Akamai site this AM. Started about an hour ago. C:\>tracert www.symantec.com Tracing route to a568.d.akamai.net [69.45.79.30] over a maximum of 30 hops: 1 <10 ms <10 ms <10 ms 10.69.98.1 2 <10 ms <10 ms <10 ms 68.216.192.17 3 16 ms <10 ms <10 ms 205.152.111.94 4 <10 ms 16 ms 15 ms axr01mia-7-0-0-1.bellsouth.net [65.83.237.50] 5 * * * Request timed out. 6 * * * Request timed out. 7 * * * Request timed out. 8 * * * Request timed out. AppleBees says "No Anheuser" Robert Scott says "NO APPLEBEES!" Join The Boycott! Robert D. Scott Associate Director Computer Services and Telecommunications Network Operations University of Central Florida Robert(a)mail.ucf.edu CSB-310 407-823-0662 Voice 407-823-5476 FAX 345-0662 Sun-Com 877-549-5390 Pager

5 4

north american backbone network diagrams
by Matt Bazan 23 Oct '04

23 Oct '04

I know these may be scarce now due to terrorist concerns but does anyone know where I can dig up current maps of MCI's and AT&T's north american nets? MCI appears to have yanked their american diagram..Thanks

5 5

level3 security operations contact?
by Henry Yen 23 Oct '04

23 Oct '04

Is there a Level3 Security Operations contact listening? Your reporting script is returning a ticket value of [null]. -- Henry Yen Aegis Information Systems, Inc. Senior Systems Programmer Hicksville, New York

1 0

BW Management solutions advice
by Albinati, Luis Martin 23 Oct '04

23 Oct '04

Hi, I am considering some bandwidth management solutions and would like to know if some of you people have had some real world experiences with this kind of boxes. More specifically I am looking at some Large-ISP or Carrier-Grade solutions with at least the following specifications: >= 1Gbps traffic capacity >500k simultaneous connections Layer 7 stateful packet inspection (via protocol signatures and/or protocol analysis) Traffic prioritization, shaping, QoS and bandwidth provisioning based on custom defined policies (vlan id, ip ranges, tos, time of day, etc) possibility to easily update and deploy new or modified protocol definitions without affecting availability. In the past days I've been analyzing solutions from Allot and P-Cube, and some of them would seem to be fine, but I would like to know if you have had experiences with these or other products that might fit for the job. I would greatly appreciate all the advices, recommendations or suggestions that you may want to share about this. Thanks in advance. Regards, Luis M. Albinati Prima S.A. Argentina (AS10481)

3 2

RE: short Botnet list and Cashing in on DoS
by Hannigan, Martin 22 Oct '04

22 Oct '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Paul Vixie > Sent: Thursday, October 07, 2004 12:29 PM > To: nanog(a)merit.edu > Subject: Re: short Botnet list and Cashing in on DoS > > > > > > ..., a-la spamhaus. Bothaus anyone? > > > > The problem with that is the list rapidly updates and must > be maintained > > with some level of frequency and there's a level of trust > involved in it > > as well. > > i consider www.cymru.com to be an excellent beginning toward > that goalset. > > > Going after the bots is lesser effort. The controllers are > a priority. > > wide scale BCP38 conformity is the only way any of this will > ever happen. You mean the bots? The controllers are behind the bots. Also, in John's presentation..: http://www.nanog.org/mtg-0410/pdf/kristoff.pdf [..]we additionally request that they resolve the RR to 127.0.0.3 before they lock out and reload the zone. We picked 127/8 as the standard. RFC 1918 wasn't suitable for obvious reasons. -M

2 1