- NANOG - lists.nanog.org

Topics for SF
by Susan Harris 20 Apr '04

20 Apr '04

Greetings - here are the presentations we've lined up so far for San Francisco. Keep your eye on www.nanog.org for updates. Sunday Tutorials ---------------- - BGP Techniques for Service Providers Level: Introductory/Intermediate Philip Smith, Cisco - Using IPsec to Encrypt Your Wireless Traffic at NANOG Level: Introductory, Hands-on Duane Wessels, Measurement Factory - IS-IS Up to Date Level: Intermediate/Advanced Shankar Vemulapalli, Cisco General Session --------------- - Implications of Securing Backbone Router Infrastructure Ryan McDowell, Sprint - Panel: VoIP and Regulation - How Government and Telcos Expect to Regulate VoIP to the Disadvanatage of Smaller ISPs ... Or Not Bill Manning, moderator - Appropriate Layer 2 Interconnection Between IXPs Keith Mitchell, XchangePoint - Benefits of Negotiated Interdomain Traffic Engineering Ratul Mahajan, David Wetherall, and Thomas Anderson, University of Washington - Panel: Network Augmentation - Experiences in Adding IPv6 Services/Support to Existing IPv4 Networks Bill Manning, moderator - Verifying Wide-Area Routing Configuration Nick Feamster, MIT - Tulip: A Tool for Locating Performance Problems Along Internet Paths Ratul Mahajan, Neil Spring, David Wetherall, and Thomas Anderson, University of Washington - Case Studies in Intra-Domain Routing Instability Zhang Shu, Nat'l. Institute of Information and Communications Technology, Japan - Integrated Security for SNMP-Based Management Wes Hardaker, Sparta - Preparing RIR Allocation Data for Network Security Analysis Tasks Brian Trammell, CERT Research Forum -------------- - Predicting Public Internet Growth With Classical Economic Theory, or, The Wealth of Networks Tom Vest, AOL Monday Evening BOF ----------------- - ISP Security and NSP-SEC BOF VI Danny McPherson, Arbor, and Merike Kaeo, moderators

1 0

Re: Anyone from AT&T here? (AT&T bogus DNSBL answers)
by jlewis＠lewis.org 19 Apr '04

19 Apr '04

Steve Linford wrote: > AT&T customers have contacted us saying they can't reach any of our > DNSBLs, seems AT&T have defined a fake sbl.spamhaus.org zone in their > DNS servers so when AT&T customers ask AT&T's NS 12.149.189.2 for > sbl.spamhaus.org they get: > ... I was looking at this some more last night, and noticed this appears to have been some kind of mistaken identity issue. Check the whois and PTR for 12.149.189.2. It certainly doesn't appear to be an AT&T maintained DNS server. If there really are/were AT&T customers who couldn't resolve the various popular DNSBLs, I wonder, was the issue caused by something else? Are they setup to query the wrong DNS servers...perhaps 12.149.189.2 used to be an AT&T DNS server before 2001-09-05, but since then, it's been an AT&T customer's machine. Maybe that customer is getting hammered with queries from old AT&T customers and is trying to encourage them to go elsewhere for DNS service. ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

9 8

Re: Microsoft XP SP2 (was Re: Lazy network operators - NOT)
by Robert Boyle 19 Apr '04

19 Apr '04

At 02:27 PM 4/19/2004, you wrote: > > >I can burn a CD from ISO in about 5 minutes - how about you? > > >I'm talking about XP users who haven't even updated as far as SP1. > > >Win98 users who have never run an update in their life... > > >Win2k users are usually the most patched up that I've seen - because > > >that went into mostly business environments. > > > > > >This would at least get them up to the level of the playing field, > > >where the routine updates are not as much of a hassle. Sure, you'll > > >get the little old ladies and gentlemen who will drop by every month > > >for their service pack fix, but that's just customer service. > > > > Doesn't Windows XP automatically do this by default currently? > >No, but it will ask you if you want to configure automatic updates. >That's still not going to do much for the dialup user who has to >download SP1. And we're also talking about the majority of customers >who don't have WinXP - and won't be getting it. http://v4.windowsupdate.microsoft.com/en/default.asp?corporate=true You can download anything on Windows Update here. We make many of this update files part of our standard dialup install CD. Especially service packs. They aren't installed by default, but they are on the CD if they need them. No 24 hour downloads needed. R Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Good will, like a good name, is got by many actions, and lost by one." - Francis Jeffrey

1 0

Re: Microsoft XP SP2 (was Re: Lazy network operators - NOT)
by Jonathan M. Slivko 19 Apr '04

19 Apr '04

Sorry about the double sending - I wasn't subscribed to nanog-post from this address. -- Jonathan -----Original Message----- From: "Jonathan M. Slivko" <jonathan.slivko(a)earthlink.net> Sent: Apr 19, 2004 1:51 PM To: Jeff Shultz <jeffshultz(a)wvi.com>, "'nanog(a)merit.edu'" <nanog(a)merit.edu> Cc: jonathan.slivko(a)earthlink.net Subject: Re: Microsoft XP SP2 (was Re: Lazy network operators - NOT) -----Original Message----- From: "Jeff Shultz, WIllamette Valley Internet" <jeffshultz(a)wvi.com> Sent: Apr 19, 2004 1:39 PM To: "'nanog(a)merit.edu'" <nanog(a)merit.edu> Subject: Re: Microsoft XP SP2 (was Re: Lazy network operators - NOT) >I can burn a CD from ISO in about 5 minutes - how about you? >I'm talking about XP users who haven't even updated as far as SP1. >Win98 users who have never run an update in their life... >Win2k users are usually the most patched up that I've seen - because >that went into mostly business environments. > >This would at least get them up to the level of the playing field, >where the routine updates are not as much of a hassle. Sure, you'll >get the little old ladies and gentlemen who will drop by every month >for their service pack fix, but that's just customer service. Doesn't Windows XP automatically do this by default currently? If not, it's something that Microsoft should consider setting to "ON" automatically to help defend the users from hackers, and in the same turn, help defend the ISP's network from being maliciously attacked or used for illegitimate purposes. However - I do think that Windows needs some more improvements in the area of security (which UNIX/Linux already has). However - to Microsoft's credit, they seem to be doing a rather nice job of actually beefing up their security practices. Now, if only they could figure out how to make Outlook/Outlook Express more security-concious because as of the time of this writing, the Outlook Express/Outlook defaults are extremely unsafe. Does anyone have/care to post a URL that explains how to set Outlook Express/Outlook to be more secure? -- Jonathan -- Jonathan M. Slivko - jonathan.slivko(a)earthlink.net "Linux: The Choice for the GNU Generation" - http://www.linux.org/ - Don't fear the penguin. .^. /V\ /( )\ ^^-^^ He's here to help. -- Jonathan M. Slivko - jonathan.slivko(a)earthlink.net "Linux: The Choice for the GNU Generation" - http://www.linux.org/ - Don't fear the penguin. .^. /V\ /( )\ ^^-^^ He's here to help.

2 1

Re: Microsoft XP SP2 (was Re: Lazy network operators - NOT)
by John Neiberger 19 Apr '04

19 Apr '04

>Patches either need to be of a size that a dialup user doesn't have to >be dialed in for 24 hours to download and install them. Or .iso's >should be available for ISP's to download, turn into CD's and >distribute as appropriate. Wouldn't that be nice for a dialup user - >getting Windows Update on a CD-ROM from their ISP? Amen to that. My mom lives in a small town with very spotty Internet access. The fastest possible connection speed is 28.8 but her actual connection is usually slower than that, probably thanks to the quality of lines in the area. You wouldn't believe how long those patches take to download over 28.8. In fact, I've given up on it because the phone simply can't be tied up for that long and she's not going to get a second line for the sole purpose of downloading MS patches. Periodic Windows Update on a CD-ROM is a must-have until more of the world has high-speed access. John --

1 0

RE: Anyone from AT&T here? (AT&T bogus DNSBL answers)
by Eric Krichbaum 19 Apr '04

19 Apr '04

I've personally seen them blackhole a customer ip and never contact them. The excuse was that, normally, their customers can't get the mail because it's a mailserver that gets blacklisted. I'm not sure that it's an excuse. I don't even mind that they blackholed a security problem. It's the lack of contact in association with the action that I consider bad customer service. Eric Krichbaum, Chief Engineer Citynet -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Patrick W.Gilmore Sent: Monday, April 19, 2004 12:26 PM To: nanog(a)merit.edu Cc: Patrick W.Gilmore Subject: Re: Anyone from AT&T here? (AT&T bogus DNSBL answers) On Apr 19, 2004, at 11:54 AM, Michael.Dillon(a)radianz.com wrote: >>> "I finally talked to someone who knows what the problem is. Your >>> sbl > sites >>> have been blocked by the standard DNS forwarders supplied by ATT. >>> This > is >>> due to the workload being generated on them from mailservers." >> >> Duh! This is really dumb. > > It's not dumb at all. Yes, it is. It is not only dumb, it is a disservice to their customers. AT&T is intentionally distributing known bad information. Worse, they hid this fact from their customer. When customers called the AT&T support line to find out what happened, they were told nothing was wrong and it must be on the customer side. My understanding is this was an intentional lie. Lying to your customers is a Bad Thing [tm], IMHO. Perhaps it was just a bunch of front line people who did not know / understand, but considering that they made a change which they knew - they *KNEW* - would break things, they should have made damned sure each and every front line person was prepared for the customer calls. They did not, so they are at best guilty of pathetically poor customer service, and possibly guilty of outright lying to their customers. If I paid AT&T for name service (even as part of a larger package of offerings - e.g. transit), I would be *VERY* upset. > DNSBLs are using the DNS to do general purpose database > lookups instead of using a generic database lookup > protocol like LDAP. It's not surprising that this sort > of ugly hack has unintended side effects. After all, people > who build DNS infrastructure intend it to be used to > for generic DNS translations, not generic database lookups. A DNS query is a database lookup. It is probably the most widely distributed, robust database ever designed an implemented. But it is a database, and the DNSBL queries are well formed DNS queries. The only difference between a DNSBL query and a normal host lookup is the source zone file and rate. I wonder if Google gets too many DNS hits if AT&T will decide to filter that zone? > Funny thing is that most mailer software that uses > DNSBLs also supports LDAP database lookups so there is > really no good reason why DNSBLs exist in the first > place. Have the mailers always supported LDAP? Do all firewalls which work as MTAs in many 1000s of corporations allow LDAP queries by default? Perhaps the creators and maintainers of the DNSBLs like to use DNS and do not like LDAP? There are many, many possible "good reasons" for the DNSBLs to exist. > IMHO, the DNSBL experiment has proved the usefulness > of having a variety of blacklist/whitelist/greylist databases > for mail servers to query. It's high time that folks > shift these databases onto a protocol that does not interfere > with the Internet's critical DNS systems and I believe that > LDAP is that protocol. That is possible, and much more reasonable than claiming that they have no good reason to exist in the first place. If you believe this so fervently, perhaps you should put in effort to make it happen, instead of discarding out of hand the effort, time, and money the current maintainers have donated out to make the community better. -- TTFN, patrick

1 0

Re: Lazy network operators - NOT
by Paul Vixie 19 Apr '04

19 Apr '04

> >there's no choice at all, really. > > Are you suggesting to drop all traffic (which, if widespread would get > attention) or just email? at the moment i'm proposing just e-mail. but that's only because we should already be rejecting udp/137 and udp/138 and udp/139 from outside our campuses and there's no reason to selectively reject that stuff from "broadband" nets. in the future we may find ourselves rejecting all non-"pull" transactions of whatever protocol. these are fundamentally access networks, and statistically speaking, "everything" that's been done with service or p2p from a "broadband" network has been bad for somebody, somewhere. > If youŽre suggesting only email blocking, you'll promote email-peering > agreement, eventually with settlement, architechture. actually i'm not suggesting it, i'm letting you all know that it's coming; and, i'm not promoting settlements, but rather whitelists.

1 0

Automated Copyright Notice System
by Sean Donelan 19 Apr '04

19 Apr '04

Someone coming up with tools to solve Paul's problems. Anyone can send an XML formated notice to an ISP, and the user's Internet access is automatically restricted. Spoofing? Btw, the music industry has applied for a patent on the technique. Prior art anyone? http://news.com.com/2100-1027_3-5194341.html Known as the Automated Copyright Notice System (ACNS), the technology promises to ease copyright enforcement on peer-to-peer networks, saving schools and Internet service providers (ISPs) time and money. It would allow them to restrict or cut off Internet access for alleged infringers automatically on notice from a record label or movie studio. For example, universities using ACNS could instantly send notices of copyright infringement to students by e-mail and restrict their network access until they have removed the file. [...] "We're helping the ISP or university with policy enforcement, we're not dictating the policy but we're saying here's a tool to help with automating the process. We're the friends of the ISP," said Mark Ishikawa, chief executive officer of BayTSP, a Los Gatos, Calif.-based company that is using the system on behalf of copyright holders.

3 2

Re: Lazy network operators - NOT
by Paul Vixie 19 Apr '04

19 Apr '04

> Be careful about the slice and dice effect. Depending on how you divide > up the numbers you can make any thing come out on top. In some sense > the problem is a lot worse. Its not just spam, worms, viruses. Its not > just residential broadband users. Its not even just Microsoft Windows. while i agree, i think something i said earlier needs to get re-said: >> So-called "broadband" user populations (cable, dsl, fixed wireless, >> mobile wireless) are full time connected, or nearly so. They are >> technically unsophisticated, on average. The platforms they run >> trade convenience for security, and must do so in order to remain >> competitive/relevant. Margin pressure makes it impossible for most >> "broadband" service providers to even catalogue known-defect customer >> systems or process complaints about them. >> >> Those facts are not in dispute. [...] so, we know that a "broadband customer netblock" operator will not handle complaints, will not fix the systems that are known to be running third-hand malware, and that the only recourse against abuse from those places is blackholing them one (ipv4) /32 at a time, or blackholing them all at once and forcing mail servers (whether legit or not) to operate from a higher-rent neighborhood. there's no choice at all, really.

2 1

RE: why use IPv6, was: Lazy network operators
by Michel Py 19 Apr '04

19 Apr '04

> Patrick W.Gilmore wrote: > The point still stands - without real multi-homing > so I do not have to be dependent upon a single > vendor, IPv6 is simply not an option. > Quick Meta-Question: Why was was this even > considered when v6 was being engineered? Yes, although the magnitude of the problem has been way underestimated. Most people did not understand that it had to be built and validated both in the core of the protocol and in policies; collectively they promised to fix the problem "next year" and never delivered. Same as easy renumbering, WRT to multihoming IPv6 has run on vaporware for years. > Are the people who started the v6 movement > really that out-of-touch with reality? Some are, and some are not. Generally speaking, too many people had little experience with network operations, some had experience with little relevance to the real world with sheltered networks such as research. This is a generic structural issue though, same as hunger in the world and spam: no silver bullet. Retrospectively speaking, I'm not even sure less people out-of-touch with reality in the initial phases would have changed much. > Or were they arrogant enough to believe they > could limit control to a few entities and the > user base would just go along with it? To a large extent, no. Although it is true that a few people from large operators did see early on the advantages of "lock-in" addressing, the fact of the matter is that a small routing table had the favors of lots of people. 10 years ago, the big picture of the Internet was quite different than it is today and the renumbering issues were not nearly as complex as they are today. Michel.

1 0