- NANOG - lists.nanog.org

kooky BGP tricks
by E.B. Dreger 08 Oct '03

08 Oct '03

Greetings all, Time for the "kooky routing idea of the year" post... Scenario: AS65000 is a bandwidth provider. One of their downstreams wishes to peer with AS65100, or to multihome with AS65100 as a second upstream. The obvious and 100% correct answer is for $downstream to register their own ASN, that anyone ready to multihome or peer can afford $500 up front and a few bucks per year. We all know this. However, $downstream wishes to advertise the routes without registering an ASN. AS65100 decides to advertise $downstream's prefixes as 65100 65000 ? exactly as if 65000 were sending only $downstream's routes to 65100. From a technical perspective, this works. Yes, there are issues with more-specifics and perhaps loop detection. The question: What would your reaction be if you were AS65000? Note that this is a political/admin question, _not_ a technical one. My thoughts: >From an administrative perspective, this can get messy, but is doable iff 65000 and 65100 agree in advance. The IP space analog is done routinely. I'd not mind being either 65000 or 65100 -- _iff_ both ASNs agreed in advance. Cutting down on leaf ASNs without causing inconsistent ASNs seems like a reasonable goal. Wrapping self in flameproof insulation... Eddy -- Brotsman & Dreger, Inc. - EverQuick Internet Division Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

1 0

New virus
by Andrew Fried 08 Oct '03

08 Oct '03

I just received an email proporting to be from Symantec that contained an anti-virus signature update. The message originated in the Netherlands. The attachment has been submitted to Symantec and FortiNet for review, however, I thought the community might want a heads up since I do not know the degree to which this has been distributed. The full content of the message I received is below: X-Persona: <CIS> Return-Path: <updates(a)symantec.com> X-Original-To: afried(a)cis.fed.gov Delivered-To: afried(a)cis.fed.gov Received: from node0938.a2000.nl (node0938.a2000.nl [62.108.9.56]) by mailserver.cis.fed.gov (Postfix) with SMTP id 22868FD52 for <afried(a)cis.fed.gov>; Tue, 7 Oct 2003 06:22:19 -0400 (EDT) Message-ID: <20031026614.2874.qmail(a)symantec.com> Date: Tue, 7 Oct 2003 03:26:29 -0700 From: <updates(a)symantec.com> Subject: Last Update. To: <afried(a)cis.fed.gov> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------9D16FAF1684605E" X-UIDL: G]m!!l"d"!b\E"!\]5"! October 06, 2003 Intruder Alert 4.1 W32_Webb_Worm Policy This policy detects the propagation of the W32.SobigF.Worm through changes in the registry. W32.Webb.F@mm is a mass-mailing, network-aware worm that sends itself to all the email addresses it finds in various files. The worm uses its own SMTP engine to propagate and attempts to create a copy of itself on accessible network shares, but fails due to bugs in the code. In attachment you can find program that update your Norton Antivirus to Norton Antivirus 2004. [nav32.zip] Scanned by evaliation version of Dr.Web antivirus Daemon http://drweb.ru/unix/

2 1

Anyone at Level3?
by Kee Hinckley 08 Oct '03

08 Oct '03

Looking for someone at Level3. While this pales in comparison to Cisco's DoS situation, my home DSL connection is currently getting slammed by a Level3 customer who has in the past week attempted to send me 2.6 million email messages in bursts that are swamping my connection--even though I reject them before we get the DATA. I've sent messages to Level3 abuse and securityoperations addresses several times over the past week, and I've called them on the phone. They downloaded my log file, but they've done nothing to either respond, or deal with the problem. It's not like the guy is an unknown quantity, see: http://www.spamhaus.org/sbl/sbl.lasso?query=SBL6857 http://www.spamhaus.org/sbl/sbl.lasso?query=SBL5576 He's known for the fact that he ignores 5x SMTP codes. Which is all very fine, but it doesn't explain why he's trying to blast me off the net. Just rejected another 10,000 connection attempts as I wrote this. -- Kee Hinckley http://www.messagefire.com/ Next Generation Spam Defense http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's.

1 0

CCO/cisco.com issues.
by Roland Dobbins 07 Oct '03

07 Oct '03

Folks, We've been handling a multi-vector DDoS - 40-byte spoofed SYN-flooding towards www.cisco.com (198.133.219.25/32) as well as an HTTP-AUTH resource-exhaustion attack, and working these issues with our upstreams. Our apologies for any inconveniences, and our thanks to those who've assisted in tracing and blocking the spoofed traffic. We're continuing the work the issue, and would be grateful if operators would check for 40-byte spoofed TCP headed towards 198.133.219.25/32 and trace/block it as warranted. Your patience and understanding are greatly appreciated. Thanks! ------------------------------------------------------------- Roland Dobbins <rdobbins(a)cisco.com> // 408.527.6376 voice

16 20

Photos from today's ICANN SSAC meeting on SiteFinder in DC
by Declan McCullagh 07 Oct '03

07 Oct '03

They're here: http://www.mccullagh.org/theme/icann-verisign-meeting-oct03.html I double-checked everyone's names and affiliations but I could have made an error. If I did, please let me know. Thanks, Declan

1 0

sitefinder technical discussions
by Mark Kosters 07 Oct '03

07 Oct '03

In the interest in gaining more community review and comment, a discussion list has been setup to discuss factually-based technical issues and solutions surrounding the operational impact of wildcards in top-level domains on Internet applications. VeriSign technical people will participate in discussions that are within the scope for this mailing list. The list is sitefinder-tech-discuss(a)lists.elistx.com To subscribe or unsubscribe the usual "-request" convention works. Send a message to: sitefinder-tech-discuss-request(a)lists.elistx.com Put "subscribe" or "unsubscribe" in the body of the message. Regards, Mark -- Mark Kosters markk(a)verisignlabs.com Verisign Applied Research

6 5

Re: Photos from today's ICANN SSAC meeting on SiteFinder in DC
by John Neiberger 07 Oct '03

07 Oct '03

>>>> Declan McCullagh <lists(a)politechbot.com> 10/7/03 3:58:33 PM >>> > >They're here: >http://www.mccullagh.org/theme/icann-verisign-meeting-oct03.html > >I double-checked everyone's names and affiliations but I could have >made an error. If I did, please let me know. > >Thanks, >Declan Is it just me or does it look like most of the Verisign guys have bloodshot eyes? :-) Seriously, this reminds me of something I wanted to point out earlier. Unless I've missed some of his recent posts, it appears to me that Matt Larson from Verisign has been straightforward with us when he was allowed to be. I doubt he was required to post here so I'm guessing he felt that it was necessary to give us what details were available as soon as he was allowed to do so. I'm obviously not aware of his circumstances but I have a feeling that he's closer to being 'one of us' than 'one of them', and if that's the case then kudos go out to him for posting here at all. It wasn't necessary but he seems to have done it knowing that he'd take a lot of heat. If that is the case, someone should hire him away from Verisign and free him from his bondage. <g> John "Then again, I might be wrong, in which case there's always Purgatory..." --

1 0

[MEDIA] McLaughlin Defends Site Finder As 'Innovation'
by wayne 07 Oct '03

07 Oct '03

As seen on /. http://news.com.com/2010-1071-5086769.html Mark McLaughlin, senior VP of Verislime, has an editorial on news.com claiming that ICANN is stifling innovation and forcing the internet to stagnate. The PR machine is out in force and painting anyone who disagrees with them as anti-capitalistic loonies. -wayne

4 3

Verisign's public opinion play
by Kee Hinckley 07 Oct '03

07 Oct '03

Take your blood pressure medicine before reading this one. http://news.com.com/2010-1071-5086769.html Apparently our objections stem from our lingering resentment over the commercial use of the internet. In case you're wondering who the author is, since neither the bio on the page or Verisign's site is helpful. Mark McLaughlin is a former lawyer who moved into Marketing and Biz Development (Caere, Gemplus, Signio and then Verisign payments). -- Kee Hinckley http://www.messagefire.com/ Next Generation Spam Defense http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's.

13 15

fyi: an example individual response to Verisign spin
by Jeff.Hodges＠KingsMountain.com 07 Oct '03

07 Oct '03

Subject: [IP] Yesterdays WJS article on Versign http://www.interesting-people.org/archives/interesting-people/200310/msg000… tml ------- Forwarded Message Date: Tue, 07 Oct 2003 04:45:48 -0400 To: ip(a)v2.listbox.com From: Dave Farber <dave(a)farber.net> Subject: [IP] Yesterdays WJS article on Versign >Date: Mon, 06 Oct 2003 15:17:34 -0700 >From: Dave Crocker <dcrocker(a)brandenburg.com> >Subject: Today's WJS article on Versign >To: newseditors(a)wsj.com >Cc: Nick Wingfield <nick.wingfield(a)wsj.com>, Dave Farber <dave(a)farber.net> > >Re: Nick Wingfield's article ><http://online.wsj.com/article/0,,SB106519977252395300,00.html?mod=dartTecht… ay> > > >Hello, > >"VeriSign's critics, of course, see it differently, accusing VeriSign of >undermining the collectivist culture of the Internet, through which engineers >hash out key changes to the network through standards groups. Unlike the Web >and e-mail, which have become thoroughly commercialized through advertising, >the low-level Internet routing software that VeriSign altered with its new >service has remained relatively insulated from efforts to make a profit." ... > >Although notably better than most of the articles on this topic, Mr. Wingfield >still managed to buy Verisign's spin, both its erroneous facts and its >erroneous perspective. > >First of all, the service that Verisign runs has been for profit for as long >as it has run it. That's roughly ten years. In addition the problems caused by >Verisign were not just in the eyes of "technologists". > >Second of all, consider the service they suddenly changed in terms of its >equivalent in the world of telephone. Imagine dialing a non-existent number or >asking 411 for the number of a non-existent entry, and not being told that >there is no listing. Instead, you are given a phone number that feeds you >advertising. Would you view this as "a valuable navigational aid for users who >might otherwise hit an online dead-end?" Probably not. > >The problem, here, is not a culture-clash between commercial ventures and >naive technologists. Verisign contracted to provide a critical infrastructure >service that maps domain names to Internet addresses. The only "clash" is >between responsible and irresponsible approaches to providing that service. If >Verisign cannot operate it at a profit, without breaking it, there are others >quite willing and able to do the job. > >d/ >-- > Dave Crocker <dcrocker-at-brandenburg-dot-com> > Brandenburg InternetWorking <www.brandenburg.com> > Sunnyvale, CA USA <tel:+1.408.246.8253> -------------------------------------- Archives at: http://www.interesting-people.org/archives/interesting-people/ ------- End of Forwarded Message

2 1