- NANOG - lists.nanog.org

large-scale IPSEC tunnel deployment
by Alex Yuriev 10 Oct '03

10 Oct '03

Hello, Does anyone have any experience with large scale production IPSEC tunnel deployment, where large scale is defined as over 100 net-to-net tunnels to different destination networks active at any time? If so, would such person(s) mind sharing any quirks/platforms/implementations for more or less automated topology testing/verification? Thanks, Alex

2 2

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Michael.Dillon＠radianz.com 10 Oct '03

10 Oct '03

>With all due respect, we have a *problem*. End user machines on >broadband connections are being misconfigured and/or compromised in >frightening numbers. These machines are being used for everything >from IRC flooder to spam engines, to DNS servers to massive DDoS >infrastructure. If the ability of a teenager to launch a gb/s DDoS, >or of someone DoSing mailservers off the internet with a trojan that >contains a spam engine is not operational, perhaps it's just me >that's confused. Why don't you come to the next NANOG in Miami in February and give a presentation on how people are doing these things? The trouble with a mailing list discussion is that it wanders all over the place. But at NANOG you could focus on the network operational issues of these networks of compromised machines. --Michael Dillon

2 1

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Michael.Dillon＠radianz.com 10 Oct '03

10 Oct '03

>I mentioned before that it doesn't really make much sense with web >hosting because the port can easily be changed so it's not very effective >at all. Stop thinking of policing the user and start thinking of providing a security service. The default setting of the security service might include a block on port 80 inbound, but if the user needs to enable this traffic, give them a web form that they can use to reconfigure their settings. Or, if you can't handle such a variety of individual ACLs on your equipment, give them the option of buying a broadband router with a recommended default config and un-blocked service. If the user has to intervene in order to enable a server type application to function, that makes it a lot harder for trojan exploits to take hold. --Michael Dillon

1 0

Wired mag article on spammers playing traceroute games with trojaned boxes
by Suresh Ramasubramanian 10 Oct '03

10 Oct '03

http://www.wired.com/news/business/0,1367,60747,00.html -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations

12 17

Finding ASN from IP address
by Avleen Vig 10 Oct '03

10 Oct '03

I want to create a mapping of IP addresses to ASN, for a specific like of IP addresses. Eg: 1.2.3.4 12.34.56.78 etc, gathered from my system logs. What is the best way of doing this? I thought about something along the lines of: install routing software (zebra?) pass software the IP's, get it to spit back a string from which I can grab the ASN Two problems being I don't know which software to install that can do that, or where to get a copy of the current routing table, so that I can feed that to the software. Suggestions appreciated. -- Avleen Vig Systems Administrator Personal: www.silverwraith.com EFnet: irc.mindspring.com

7 6

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Dr. Jeffrey Race 10 Oct '03

10 Oct '03

On Thu, 9 Oct 2003 18:40:35 -0400, John Capo wrote: > I spent >the rest of the day googleing for case law that might be applied >to the network operators providing connectivity to the trojaned >boxes being used for illegal activities, identity theft. Didn't >accomplish much except wasting the day. This is a trivial legal exercise and I remain surprised the infamous "plaintiff's bar" has not started suing these scum. Some of the obviously relevant legal bases are negligent enablement, unjust enrichment, attractive nuisance. Talk to any lawyer; he'll tell you. I am sure there are BIG BIG damages to be had for a little litigation. Jeffrey Race

1 0

Is there anything that actually gets users to fix their computers?
by Sean Donelan 10 Oct '03

10 Oct '03

Short of turning off their network access, why won't users fix their computers when the computer is infected or needs a patch? The University of Massachusetts posted bulletins, sent an email to all incoming students, included an alert when they connected. Nevertheless, almost three months after Microsoft released the critical patch and almost two months after the first Blaster worm was released over 1,600 students failed to patched their computers. Eventually, the University started shutting off network access for the students and charging $3 for the CD with the patch and $25/hour for support to clean the student's computers. http://www.dailycollegian.com/vnews/display.v/ART/2003/10/03/3f7cfeb12c8c2 "Some students told the staff that they thought the University gave their systems a virus. "By no means was this a UMass internet problem," said Fairey. "People were probably infected before they got to campus." One student threatened to sue OIT, arguing that the offices did not have the right to turn off her port. "We have policies that clearly state our right to shut off systems," mentioned Fairey. "It's not something that we want to do. It's a nightmare."

18 40

Re: Finding clue at comcast.net
by Howard C. Berkowitz 10 Oct '03

10 Oct '03

>----- Original Message ----- >From: "Howard C. Berkowitz" <hcb(a)gettcomm.com> >To: <nanog(a)merit.org> >Sent: Thursday, October 09, 2003 11:20 AM >Subject: RE: Finding clue at comcast.net > > >> >> At 9:29 AM -0500 10/9/03, Austad, Jay wrote: >> >Comcast's phone support department is the *worst*, WORST, I've ever dealt >> >with. I think they are outsourced, they have to go by a script, and many >of >> >them probably hardly know what a computer even is. Once I called because >of >> >a problem on their network, and I told the person on the phone that there >> >was a problem on their network, and I pinned it down to a couple of >routers >> >where the problem may be, and she responded, very sternly, "Sir, WE DON'T >> >HAVE ANY ROUTERS" >> >> Same thing here. Last night, I was told that no escalation personnel >> were available. >* Depending on how big a company is or how the outsourcing company staffs at >night this can be true. No escalation personnel may be physically present, >but this doesn't mean there isn't someone they can call. An outsourcing >companies call center agents have to first decide (policy?) that the issue >warrants escalation, and then they probably have to call THEIR manager (of >the outsourcing company). This manager then gets to decide if it REALLY >warrants escalation to their client (the cable company). They don't want to >call them after-hours unneccesarily. And cable companies are used to having >24-hours to resolve most outages, and if it doesn't affect a LOT of their >customers it isn't considered an outage worth escalating. A real world >example is: 6 calls in one cable node with the problem persisting for 15 to >30 minutes (calls keep coming in) would be a case for an on-call technician >to be called. Anything less just gets Service Calls placed in CableMaster on >AS/400. These things can wait for a scheduled (all-day) appointment unless >the customer insists on a time-frame. *sigh* Y'know, I could live with it if I could even have a mailbox to which I could send detailed trouble reports, even if no one looked at them on the next day. While their routing seems to be fairly stable these days, there would be times I'd traceroute from several sites I could reach and take views from multiple looking glasses, giving me a pretty fair idea where, and even what, the problem is. The customer disservice people that really drive me nuts are the first-levels that believe they are NEVER wrong. If you say there's an IP routing problem, they may say "how do you know there's a problem with our ippp(rhymes with pip)?" "We don't support SMTP or POP3. You have to use Outlook.." "You must remove your firewall and router so we can troubleshoot." "It's irrelevant that you can ping the access router. It must be your modem. Go to the local office and exchange it." "I'm sure the problem will be resolved, so there's no reason to give you a trouble ticket" "b'gop? bajop? We don't support bee-gee-pee in our network." "access router? We just have Windows servers." > >* Exactly what I described above. But I wouldn't accept "hopefully somebody >would respond". That is NOT acceptable. Someone should respond within 1 >business day at most. Again your not going to find many on-call or >higher-level support reading email after-hours and responding to things. >Even I couldn't do it ALL of the time. And I was the only one doing that in >a local cable company (not a national company) with 2 cities. I'd be happy, again, if they'd let me give them a trouble ticket. Oh, they have told me at times that I could do that at their website, which is an interesting problem when you don't have connectivity. I'd gladly pay extra for dial backup at low speed, but they don't offer that. > >> >> At the time, I was paying for their "Pro" service, intermediate >> between regular residential and full business. My contact said that >> while that was supposed to get better customer support, an early plan >> to route it to business Comcast failed, and there really was NO > > separate Pro support organization. I dropped the Pro service after I >> learned that residential service no longer insisted you remove any >> local routers and firewalls before deigning to troubleshoot. They >> still ask you to do that, but repeated NO responses can get them to >> proceed. >* Pro services, where I was working, gets escalated like the above >description I wrote. If you are not completely down you're probably not >going to see something done about it until the next business day (assuming >after-hours). They treated completely-down situations like that. > >> >> A few NANOGs back (Atlanta), I did a presentation on customer >> satisfaction, which, frankly, was in many respects a case study of >> how I'd reform customer support at my then ISP/DSL, cais.net. If >> NANOG ever did formal documents, I'd like to see a guideline on how >> to run customer support. >* I saw you powerpoint and I liked it. > >> >> > >> >In any case, if you manage to get the call escalated a couple of times >> >(after lying about rebooting your computer 47 times), >> >> You forgot reinstalling Windows. On a Mac. >> >* Typicall front line support (should) be able to figure out if you are >reporting a problem with your connection, e.g. your cable modem is not >"acquired" or you have no IP connectivity or DNS resolution, or if you are >reporting something else that needs escalation to a higher level of support >(or to the cable company on-call). Again the rules of engagement I described >above about number of calls on one cable node and how long it has been down >(need 15-30 minutes). [Some things in outside plant reset themselves >automatically]. > >A lot of cable companies are likely new to providing PRO services. Also >remember a lot of cable companies just recently took the ISP infrastructure >in-house after having outsourced for many years to companies like >Excite@Home and ISPChannel. Also some of these outsourced call centers >surely don't have the ISP support background they need. The one I was at, >wether they'd admit it or not, learned a lot from me. I came from small ISP >dial-up support where I was everything as well as working at a Latin >American Countries ISP aggregator. So I wasn't made from the same mold as >many of these newer personnel you will come across. Things may have to >escalate to a pretty high level to find someone with the kind of clue to >have dealt with knowledgeable customers ... especially Internet Core NSP >persons. A few times, mostly at 2nd level, someone recognizes my name from one of my books -- and gets helpful. Indeed, in some of those trouble calls, they set up a conference call and I did some tutorials.

2 1

RE: Finding clue at comcast.net
by Austad, Jay 10 Oct '03

10 Oct '03

Comcast's phone support department is the *worst*, WORST, I've ever dealt with. I think they are outsourced, they have to go by a script, and many of them probably hardly know what a computer even is. Once I called because of a problem on their network, and I told the person on the phone that there was a problem on their network, and I pinned it down to a couple of routers where the problem may be, and she responded, very sternly, "Sir, WE DON'T HAVE ANY ROUTERS" In any case, if you manage to get the call escalated a couple of times (after lying about rebooting your computer 47 times), you'll get someone good. Also, there are some good people who read this list. But calling their phone support to get anything useful is like trying to squeeze blood from a rock. -jay > -----Original Message----- > From: Howard C. Berkowitz [mailto:hcb@gettcomm.com] > Sent: Wednesday, October 08, 2003 7:36 PM > To: nanog(a)merit.org > Subject: Finding clue at comcast.net > > > > I'm rapidly beginning to believe this is equivalent to finding the > pot of gold at the end of the rainbow. When my broadband alternative > is Verizon and it's looking better, this is scary. > > Sometime today, their SMTP server started bouncing messages with more > than 3 addressees. When I called customer support, I was told "we > only handle troubleshooting, not mail service." The operator > "guessed" they might be doing software updates on the mail service, > had no information, and said there was no person to which it could be > escalated. > > She insisted that I call my local cable office to find out when the > "server repair" would be completed, because "they schedule all > repairs." > > Is this a bad dream? >

7 6

RE: Qwest bgp communities
by Williams, Ken 10 Oct '03

10 Oct '03

Disregard, I thought they had allowed bgp queries on that site as well.... -----Original Message----- From: Haesu [mailto:haesu@towardex.com] Sent: Thursday, October 09, 2003 5:39 PM To: nanog(a)merit.edu Subject: Qwest bgp communities Hi, Anyone here know if Qwest operates a route server like GBLX, HE, ATT, that also shows AS209's communities? It would be useful for some bgp troubleshooting.. There is one peer in route-views.oregon-ix.net that shows 209 routes, but unfortunately, that particular peer strips off all 209's communities. I am trying to troubleshoot a problem where 209:70 set on a prefix doesn't seem to work/propagate, etc et al. Or does anyone know of any route-servers run by a Qwest customer/peer that receives communities? I know that http://stat.qwest.net has looking glass but it doesn't let you run any bgp commands; just ping and traceroute :-( If you can assist, please reply to me off-list. Thank you very much for your time, -hc -- Haesu C. TowardEX Technologies, Inc. Consulting, colocation, web hosting, network design and implementation http://www.towardex.com | haesu(a)towardex.com Cell: (978)394-2867 | Office: (978)263-3399 Ext. 170 Fax: (978)263-0033 | POC: HAESU-ARIN

1 0