- NANOG - lists.nanog.org

Re: Packet Kiddies Invade NANOG
by Michael.Dillon＠radianz.com 17 Mar '04

17 Mar '04

People should be worried about stuff like this. Banetele is a facilities-based network operator in Norway and these guys are directly attacking their BGP sessions to put them off the air. Assuming that they are not sourcing the attacks in Banetele's AS, then you, the peer of Banetele are delivering the packet stream that kills the BGP session. How long before peering agreements require ACLs in border routers so that only BGP peering routers can source traffic destined to your BGP speaking routers? (08:48:02) <#sigdie!OseK_> i just collapsed banetele's BGP announcement (08:48:43) <#sigdie!p> i dunno banetele looks dead (08:48:48) <#sigdie!p> or maybe im just lagging (08:49:00) <#sigdie!OseK_> ... BitchX: Sent server ping to [irc.banetele.no] (08:49:00) <#sigdie!OseK_> ... Server pong from irc.banetele.no 0.8224 seconds (08:49:12) <#sigdie!p> bash-2.05a$ telnetirc.banetele.no 6667 (08:49:13) <#sigdie!p> Trying 213.239.111.2... (08:49:16) <#sigdie!OseK_> thats cuz I collapsed their BGP announcement by nailing their router head on(08:49:26) <#sigdie!OseK_> but they have a secondary route to efnet (08:49:30) <#sigdie!_mre|42o> BGP announcement? (08:49:31) <#sigdie!OseK_> thru their multihomed connection (08:49:32) <#sigdie!OseK_> yeah (08:49:37) <#sigdie!OseK_> they have a collapsable route (08:49:44) <#sigdie!OseK_> using the border gateway protocl (08:49:54) <#sigdie!OseK_> hey have to announce to a pool (08:49:58) <#sigdie!OseK_> in order to establish their route (08:50:07) <#sigdie!OseK_> but if thye get hit enough their router drops the announcements (08:50:10) <#sigdie!OseK_> and they lose their routes (08:50:14) <#sigdie!OseK_> its wierd (08:50:21) <#sigdie!OseK_> i dont quite understand how it works myself

7 6

RE: Firewall opinions wanted please
by Burton, Chris 17 Mar '04

17 Mar '04

Depends on many aspects; performance, management, and logging features. I personally recommend Checkpoint FW-1 Express for a smaller site if you want easy configuration and a great logging interface; though the pricing may not be what you are looking for. Cisco PIX is also great but the management and logging aspects in my opinion are not up to par with Checkpoint on the lower price end (i.e. Without investment in other management tools). It goes back to what you and anyone supporting the platform will be comfortable with. Chris Burton Network Engineer Walt Disney Internet Group: Network Services The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Nicole Sent: Tuesday, March 16, 2004 2:27 PM To: nanog(a)nanog.org Subject: Firewall opinions wanted please Hi I am looking for a good but reasonably priced firewall for a 40 or so server site. Some people swear by Pix, others swear at it a lot. Also I have heard good things about Netscreen. Or any others you would recommend for protecting servers on a busy network. Don't really need anything with VPN just the standard http, ftp, ssh, https, type traffic up to 100mb throughput. From what I have heard a proxy firewall would be best? Thanks in advance!! Nicole -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ " Daemons" will now be known as "spiritual guides" -Politically Correct UNIX Page

1 0

verisignmail.com RBL Contact
by Mark Foster 16 Mar '04

16 Mar '04

If anyone on here is from the powers-that-be behind the verisignmail.com RBL - or infact anyone from Verisign Security - could they please contact me offlist regarding an ongoing (2 month!) issue regarding mail delivery. Thanks, and sorry for the noise (again!). Mark.

1 0

RE: Cisco website www.cisco.com 403 forbidden?
by Robert A. Hayden 16 Mar '04

16 Mar '04

Still 404s on me now when I try to log into CCO or follow any of my bookmarks to case query, pricelist, or TAC Case generation. Todays excuse of the day is: <flip> <flip> <flip> SUNSPOTS! On Mon, 15 Mar 2004, Todd Mitchell - lists wrote: > > | Behalf Of Jay Hennigan > | Sent: March 15, 2004 3:19 PM > | > | Is it just me that they don't like? > > All fixed now, but load times are hella slow: > > phoenix:~# curl -I cisco.com > HTTP/1.1 200 OK > Date: Mon, 15 Mar 2004 20:40:53 GMT > Server: Apache/1.0 (Unix) > Set-Cookie: CP_GUTC=209.123.169.252.240801079383253714; path=/; expires=Fri, > 09-Mar-29 20:40:53 GMT; domain=.cisco.com > Connection: close > Content-Type: text/html > > Todd > > -- >

3 2

2001:590::/32 announced by both AS4436 (nLayer) and AS4474 (Global Village, no contact in whois, but seems to be nLayer...)
by Jeroen Massar 16 Mar '04

16 Mar '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [cc: to hostmaster(a)arin.net, maybe now it will get their attention instead of going into /dev/null] Hi, Here is some operational content, instead of Packet Kiddies trying to rape each other verbally ;) According to Toshikazu Saito (Powerdcom): > I know both ASs, 4436 and 4474 are yours, so > nlayer should resolve this problem or respond to this. But: OrgName: Global Village Communication, Inc. OrgID: GVC-8 Address: 1144 East Arques Avenue City: Sunnyvale StateProv: CA PostalCode: 94086 Country: US ASNumber: 4474 ASName: GVIL1 ASHandle: AS4474 Comment: The information for this ASN has been reported to Comment: be invalid. ARIN has attempted to obtain updated data, but has Comment: been unsuccessful. To provide current contact information, Comment: please e-mail hostmaster(a)arin.net. RegDate: 1995-03-08 Updated: 2003-07-31 The reason for the above was that we are currently seeing 2001:590::/32 announced by both AS4436 (nLayer) and AS4474 (Global Village Communication) but apparently this is the same company and apparently they are using the bogus ASN. Bogus as it has no valid contact information See telnet://grh.sixxs.net or http://www.sixxs.net/tools/grh/lg/?find=2001:590::/32 for the odd routes and who it goes over. As nLayer seems to be able to only send ticket responses but there seems to be no real user alive maybe it is time to start letting their peers ask them what to do with this and if they can't contact them to just start depeering? Unresponsive "NOC"'s is a real nightmare. Greets, Jeroen -----BEGIN PGP SIGNATURE----- Version: Unfix PGP for Outlook Comment: Jeroen Massar / http://unfix.org/~jeroen/ iQBGBAERAgAQCRApqihSMz58IwUCQFb4WAAAoTsAniiZQnM0LhXbVJD7keZCNu6f CM2OAKCPs2tdOfwt49m8/xLnugqyGRMnGA== =ePKi -----END PGP SIGNATURE-----

7 11

Re: Stateful Ethernet Bridging and it's effect on overall Internet topology.
by Gregory Taylor 16 Mar '04

16 Mar '04

I agree, however there are some implementations of this type of bridging that 'routing' would not be a good substitute for. Say mangling traffic going outbound for compression purposes (A La Redline (Yes I know redline does proxying and not bridging)). I guess my best question would be, is there a solution to the problem. Maybe a possible way of bridging the traffic without polluting the world with unnecessary broadcasts of MAC addresses and over-head ethernet frames. (Is there a way to strip that garbage from the outbound traffic generated by the bridge). Greg ---------- Original Message ---------------------------------- From: "Wayne E. Bouchard" <web(a)typo.org> Date: Tue, 16 Mar 2004 12:49:38 -0700 >This goes back to traditional bridging issues. > >The problems include: > >loops and ineffective or broken STP implementations > >arp and broadcast storms > >mac address collisions > >which version of bridging to use and their associated advantages and >disatvantages. > >I can't see that adding the capacity to do traffic shaping or >filtering changes any of these issues. It just adds to the complexity. >It still holds that, generally speaking, if you can route instead of >bridging, it's a better option. > >On Tue, Mar 16, 2004 at 01:36:48PM -0600, Gregory Taylor wrote: >> >> I have a question and would like all of your opinions on this matter, as I research heavily into stateful ethernet bridging, packet mangling and their advantages and disadvantages to local and wide area network topologies. >> >> Deployed in large volumes, what negative effects, if any, would ethernet and fiber bridges have on the Internet as a whole. >> >> Lets say I was to build a bridge designed to intercept and manipulate traffic coming in from an outside network into my 'colo site' to do traffic shaping, packet filtering, and ethernet frames manipulation. And I deployed 100s of these into the facility as a means to control overall traffic. Would these transparent bridges be detrimental in any way to the rest of the internet. I understand that since they are re-transmitting data that the possibility of their MAC addresses popping up every time a machine behind it pops up could be an issue when doing network monitoring. But I'd just like to know what everyone thinks about such products. >> >> (Excuse me if my statements seem a little incoherent, I just woke up) >> >> Greg > >--- >Wayne Bouchard >web(a)typo.org >Network Dude >http://www.typo.org/~web/ >

1 0

Cisco website www.cisco.com 403 forbidden?
by Jay Hennigan 16 Mar '04

16 Mar '04

Is it just me that they don't like? -- Jay Hennigan - CCIE #7880 - Network Administration - jay(a)west.net WestNet: Connecting you to the planet. 805 884-6323 WB6RDV NetLojix Communications, Inc. - http://www.netlojix.com/

20 24

Replacement for a Extreme Black Diamond 6808
by Drew Weaver 16 Mar '04

16 Mar '04

Can anyone suggest a good replacement for an Extreme Black Diamond 6808 switch, we use it for aggregation, however their support is abhorrant and every time we have an issue they require us to unconfigure the switch, reset it to defaults and manually reconfigure it, no matter what the problem is, the resolution is the same. Anyone have any suggestions? -Drew

5 4

Stateful Ethernet Bridging and it's effect on overall Internet topology.
by Gregory Taylor 16 Mar '04

16 Mar '04

I have a question and would like all of your opinions on this matter, as I research heavily into stateful ethernet bridging, packet mangling and their advantages and disadvantages to local and wide area network topologies. Deployed in large volumes, what negative effects, if any, would ethernet and fiber bridges have on the Internet as a whole. Lets say I was to build a bridge designed to intercept and manipulate traffic coming in from an outside network into my 'colo site' to do traffic shaping, packet filtering, and ethernet frames manipulation. And I deployed 100s of these into the facility as a means to control overall traffic. Would these transparent bridges be detrimental in any way to the rest of the internet. I understand that since they are re-transmitting data that the possibility of their MAC addresses popping up every time a machine behind it pops up could be an issue when doing network monitoring. But I'd just like to know what everyone thinks about such products. (Excuse me if my statements seem a little incoherent, I just woke up) Greg

1 0

Re: Packet Kiddies Invade NANOG
by sthaug＠nethelp.no 16 Mar '04

16 Mar '04

> Hmm, if someone (except masochists and security vendiors) still hosts > efnet... I can only send them my condoleences. > > I saw sthe same dialogs 6 years ago. Nothing changes. BaneTele hosts an EFnet IRC server. Caused no significant problems while I was working at BaneTele. That's probably because we *expected* DoS attacks on the IRC server, and engineered the network accordingly. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0