- NANOG - lists.nanog.org

NASA DNS contact
by Chris Layton 13 Nov '03

13 Nov '03

I am having an issue with accessing the nasa.gov zone. It looks like either a routing or firewalling issue that is unique to my network. Does anyone have a good contact for either their NOC or the dns server group? thanks, -chris

1 0

FW: Cost of Worm Attack Protection
by Braun, Mike 13 Nov '03

13 Nov '03

The old saying of "you get what you pay for" seems to be well directed when it comes to this topic. If you're willing to allocate $100K more than you currently spend to mitigating the effects from Worms and Viruses, I'm sure you will have some increased success. If you allocate 1 mill more, your success will increase substantially. The true cost really boils down to what you are trying to protect, such as how many servers, users, network segments, and other critical devices you are willing to encompass in your protection plan. Also, you may be able to mitigate the cost by using the functionality built into devices you may already own. A good protection schema needs to address the use and benefits from the following: Firewalls, VPN tunnels and policies, HIDs, NIDs, Antivirus software, and a good network security policy that grows with your network. You may already have most of this in place and need only a little extra funding allocated to give you the protection level you feel comfortable with. If you're looking for pricing on each component, they will vary widely depending on the brand and model you go with. You should shop around for components that suit your budget. An example of this price variance can be found by looking at a Net Forensics project priced at $500k compared to a similar solution going will Network Intelligence at $40K. The Network Intelligence solution may not have all the functionality offered by Net Forensics, but it may be enough for your needs. Best of luck in fighting this ever growing problem, Mike Braun -----Original Message----- From: sgorman1(a)gmu.edu [mailto:sgorman1@gmu.edu] Sent: Thursday, November 13, 2003 7:59 AM To: Joel Jaeggli Cc: nanog(a)merit.edu Subject: Re: Cost of Worm Attack Protection Good point - then what is the cost of attempting to mitigate or handle attacks vs. doing nothing? ----- Original Message ----- From: Joel Jaeggli <joelja(a)darkwing.uoregon.edu> Date: Thursday, November 13, 2003 10:14 am Subject: Re: Cost of Worm Attack Protection > I haven't seen any network or customer site that has protected > itself from > worms... only mitigated them. > > joelja > > On Thu, 13 Nov 2003 sgorman1(a)gmu.edu wrote: > > > > > > > I was hoping to get some estimates from folks on the costs of > defending> networks from various worm attacks. It is a pretty > wide open question, > > but if anyone has some rough estimates of what it costs per edge, > > manpower vs. equipment costs, or any combination thereof it > would be of > > great assistance. We are doing some simulations of attack and > defense> strategies and looking for some good metrics to plug into > a cost benefit > > model. We'd be happy to share the results if anyone is > interested as > > well. > > > > Thanks in advance, > > > > sean > > > > -- > ------------------------------------------------------------------- > ------- > Joel Jaeggli Unix Consulting > joelja(a)darkwing.uoregon.edu > GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB > B67F 56B2 > > > "MMS <firstam.com>" made the following annotations on 11/13/2003 12:03:21 PM ------------------------------------------------------------------------------ "THIS E-MAIL MESSAGE AND ANY FILES TRANSMITTED HEREWITH, ARE INTENDED SOLELY FOR THE USE OF THE INDIVIDUAL(S) ADDRESSED AND MAY CONTAIN CONFIDENTIAL, PROPRIETARY OR PRIVILEGED INFORMATION. IF YOU ARE NOT THE ADDRESSEE INDICATED IN THIS MESSAGE (OR RESPONSIBLE FOR DELIVERY OF THIS MESSAGE TO SUCH PERSON) YOU MAY NOT REVIEW, USE, DISCLOSE OR DISTRIBUTE THIS MESSAGE OR ANY FILES TRANSMITTED HEREWITH. IF YOU RECEIVE THIS MESSAGE IN ERROR, PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND DELETE THIS MESSAGE AND ALL COPIES OF IT FROM YOUR SYSTEM." ==============================================================================

3 2

RFI: Intrusion Detection Systems
by kgraham＠rogers.com 13 Nov '03

13 Nov '03

My apologies to anyone that receives duplicates of this email stemming from it being cross posted. I have been asked to investigate an Intrusion Detection/Prevention System. Could anyone that has knowledge of the following products give me the good, bad or the ugly concerning them. Reply to myself online or off line If anyone would like a summary of the results please do not hesitate to ask. NIDS: Cisco Intrusion Detection Sensors Version 4.x 4235, 4250 NAI Intrusion Prevention Sensors IntruShield 2600, 4000 (IntruVert) HIPS: Cisco Security Agent Entercept Management Systems: Cisco VMS - VPN/Security Management System NAI: ISM Security Management System. Any thoughts would be appreciated. Kim

3 2

Re: Point of sale RAS hardware?
by Lanny Godsey 13 Nov '03

13 Nov '03

> Does anyone know of a good RAS product that supports the fast train > times needed for point of sale terminals (specifically the ability to > turn off data compression, error detection, and speed negotiation)? > Most every one I've seen is aimed at serving as-fast-as-possible > dialup > network access to normal modems, but I need something that will do > 1200bps (or even better yet, v.22FC) with no frills. > > Can anyone suggest a product or manufacturer? We use the Cisco AS5400 in which you can enable/disable any option as you see fit using resource pooling. We use it to support KFLEX modems which fail to connect properly w/ the v.92 tones. The way it deterimes which settings to use is based on called station id. We also find modems that try to to retain to highest speed tend to reach the limit and drop the connection. Most of our customers are in rural areas w/ poor quality phone lines. We found it was easier to create resource groups to lock people to 21000 baud via setting their connection number than giving the customer init strings to limit the connection that way. Sure there are probably better solutions, but this has solved nearly all connection problems we've seen. I realize you may end up not using cisco, but I'll include a small example just in case it's useful to anyone. IOS (tm) 5400 Software (C5400-IS-M), Version 12.3(1a), RELEASE SOFTWARE (fc1) resource-pool enable ! resource-pool group resource MICA-modems range port 1/0 1/107 range port 2/0 2/107 range port 3/0 3/107 range port 4/0 4/107 range port 5/0 5/107 range port 6/0 6/107 ! resource-pool profile customer any limit base-size all limit overflow-size all resource isdn-ports digital resource MICA-modems speech service any dnis group default ! resource-pool profile customer v90 limit base-size all limit overflow-size all resource MICA-modems speech service v90 dnis group v90 ! resource-pool profile customer k56flex limit base-size all limit overflow-size all resource MICA-modems speech service k56flex dnis group k56flex ! resource-pool profile customer v34-28800 limit base-size all limit overflow-size all resource MICA-modems speech service v34-28800 dnis group v34-28800 ! resource-pool profile service v90 modem min-speed any max-speed 56000 modulation v90 ! resource-pool profile service k56flex modem min-speed any max-speed any modulation k56flex ! resource-pool profile service v34-28800 modem min-speed any max-speed 28800 modulation v34 ! resource-pool profile service any dialer dnis group v90 number 2533219668 number 3605459668 [trimed] ! dialer dnis group k56flex number 3605429667 number 3605459667 [trimed] !

1 0

Re: Cost of Worm Attack Protection
by kgraham＠rogers.com 13 Nov '03

13 Nov '03

Back Ground: I come from a company of 5K users spread across a large campus with several remote sites. We have had various worms intrude on our day to day activities. Without anything other than up to date anti-virus and some simple PIX type configurations it has been unpleasant. Time cost: One attack slowing Internet traffic to a crawl. Manpower: 2-3 Network 2-3 Data fairly dedicated over the course of a few days. Do the math for the cost of 6 senior people finding and cleaning infected machines. Quotes todate to implement a NIDS solution that encompasses external, DMZ, internal, server farms, 6 mid range devices 100K. Quotes on HIDS solutions vary as per desktop and server but basically you are looking at 1-2K per server and 50-80 dollars per desktop licence. Kim > > From: sgorman1(a)gmu.edu > Date: 2003/11/13 Thu AM 09:35:47 EST > To: nanog(a)merit.edu > Subject: Cost of Worm Attack Protection > > > > I was hoping to get some estimates from folks on the costs of defending networks from various worm attacks. It is a pretty wide open question, but if anyone has some rough estimates of what it costs per edge, manpower vs. equipment costs, or any combination thereof it would be of great assistance. We are doing some simulations of attack and defense strategies and looking for some good metrics to plug into a cost benefit model. We'd be happy to share the results if anyone is interested as well. > > Thanks in advance, > > sean > >

1 0

Cost of Worm Attack Protection
by sgorman1＠gmu.edu 13 Nov '03

13 Nov '03

I was hoping to get some estimates from folks on the costs of defending networks from various worm attacks. It is a pretty wide open question, but if anyone has some rough estimates of what it costs per edge, manpower vs. equipment costs, or any combination thereof it would be of great assistance. We are doing some simulations of attack and defense strategies and looking for some good metrics to plug into a cost benefit model. We'd be happy to share the results if anyone is interested as well. Thanks in advance, sean

3 2

Re: The Internet's Immune System
by Jamie Reid 13 Nov '03

13 Nov '03

It would be useful if these sites allowed you to query them with CIDR ranges to see if your site had originated any traffic that triggered their sensor arrays. The IDS community never seems to have wrapped its collective head around routing information. Looking up single IP addrs is just cosmetic. A real service would allow for concerned sites to check their entire address allocations. The solution we have takes a massive amount of data munging of a routing table and is still experimental, but until attacks can be mapped to meaningful Internet topographical information, the real value of these distributed IDS efforts cannot be fully exploited. I can forsee the argument that people shouldn't be able to look up other sites which might be compromised, but if they are really so concerned, they should get their sites patched. -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324 >>> "Bryan Bradsby" <Bryan.Bradsby(a)capnet.state.tx.us> 11/12/03 04:25pm >>> > Devise a system that assumes owners of IP space WANT to know about problems. > report --open-proxy 192.168.1.1 <logfiles > and have a report sent to whoever needed to know about it. http://www.Incidents.org http://www.Dshield.org/howto.php http://www.MyNetWatchman.com -bryan bradsby

7 6

Re: Reachability problems for www.listen-to.com
by Fisher, Shawn 13 Nov '03

13 Nov '03

We received a 69.144/16 from ARIN and spent the following few months requesting numerous operators to take that space out of their filters. Apparently for various historical reasons many operators filter the entire 69. Block. That could be part of the problem. -------------------------- Sent from my BlackBerry Wireless Handheld

2 2

Reachability problems for www.listen-to.com
by Adam Atkinson 13 Nov '03

13 Nov '03

Some of my users are saying they cannot get to www.listen-to.com, www.talk-servers.com and www.electro-tech-online.com One of them claims he's observed a pattern and that things hosted by ev1servers.net aren't working. I can get to them from several different places, but I notice that e.g. www.listen-to.com has a 69.* address, which might still be listed as bogus by some people. -- Adam Atkinson Damovo UK What I say may or may not represent the opinion of Damovo UK: I wouldn't know.

1 0

Re: GFI Security Suite
by neil＠DOMINO.ORG 13 Nov '03

13 Nov '03

> Has anyone or does anyone currently or recently used any of the products by > GFI? What are your thoughts about these products if you have. > > Thanks for your input. I've not used the security suite but: I used the GFI fax suite on an exchange server and I couldn't believe how well it worked and how good the local support was, they proactively helped me resolve a number of modem issues that were not really an issue with GFI's software. They seem to understand how to properly interface to Exchange. Regards, Neil.

1 0