- NANOG - lists.nanog.org

RE: 92 Byte ICMP Blocking Problem
by Mark Segal 15 Sep '03

15 Sep '03

When I checked last week 1 in 4 packets was an ICMP message, so we rate limited ICMP ECHO and ICMP ECHO-REPLY messages.. And it only bugged PING'ers and windows traceroute users.. All those low memory alarms are now no longer plaguing our NMS. Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: John Souvestre [mailto:johns@sstar.com] Sent: September 13, 2003 11:53 PM To: jlewis(a)lewis.org Cc: nanog(a)nanog.org Subject: RE: 92 Byte ICMP Blocking Problem Hi. I've been running with the service policy version and haven't seen any problem either. I did notice that it seems to block DOS traceroutes, however. John John Souvestre - Southern Star - (504) 888-3348 - www.sstar.com -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of jlewis(a)lewis.org Sent: Saturday, September 13, 2003 10:18 PM To: William Devine, II Cc: Nanog Subject: Re: 92 Byte ICMP Blocking Problem Importance: High That's really weird. I've been running with route-map nachiworm permit 10 match ip address nachilist match length 92 92 set interface Null0 ip access-list extended nachilist permit icmp any any echo permit icmp any any echo-reply ip policy route-map nachiworm on transit interfaces and the virtual-templates of all our access servers that can do it properly (just blocking echo/echo-reply on the older ones that can't do the policy) and haven't heard about any customer complaints other than "I can't ping" in the places where we've blocked all echo/echo-reply. The routers doing this (7200/7500)'s are all running 12.2(1-3)S. Access servers are running mostly 12.1M or 12.2XB code.

1 0

RE: Cisco IOS Failure due to Virus
by Mark Segal 15 Sep '03

15 Sep '03

We are seeing the same problem on all of the 6400-nrp aggregation boxes we have in the network. Here is the IOS bug ID - CSCec12495.. Actually by rate limiting icmp on our network the problems have stopped/slowed down a lot. Sorry for the delay.. Was out of the country for a while.. Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Richard J.Sears [mailto:rsears@adnc.com] Sent: September 11, 2003 12:26 AM To: Robert Blayzor Cc: Nanog Subject: Re: Cisco IOS Failure due to Virus Hi Robert, Thanks for the info. We are running dCEF...routers show about 4% CPU load and the following memory: BR02#sh mem Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 613AE340 247798976 106515996 141282980 140653360 134546752 Fast 6138E340 131080 37240 93840 93840 93788 Also, we are not blocking 92 byte ICMP due to the traceroute problems on customers networks... Thanks On Wed, 10 Sep 2003 23:17:01 -0400 Robert Blayzor <rblayzor(a)inoc.net> wrote: > > On 9/10/03 10:58 PM, "Richard J.Sears" <rsears(a)adnc.com> wrote: > > > %SYS-2-MALLOCFAIL: Memory allocation of 704 bytes failed from > > 0x60329F00, alignment 0 > > Pool: Processor Free: 92744 Cause: Memory fragmentation Alternate > > Pool: None Free: 0 Cause: No Alternate pool -Process= "Pool > > Manager", ipl= 0, pid= 6 -Traceback= 6038049C 60382200 60329F08 > > 6038DEDC > > > > %TCP-6-NOBUFF: TTY0, no buffer available > > -Process= "BGP Router", ipl= 0, pid= 132 > > > > %% Low on memory; try again later > > Did you enable CEF? > Are you dropping 92 byte ICMP packets where needed? > > -- > Robert Blayzor, BOFH > INOC, LLC > rblayzor(a)inoc.net > PGP: http://www.inoc.net/~dev/ > Key fingerprint = A445 7D1E 3D4F A4EF 6875 21BB 1BAA 10FE 5748 CFE9 > > "I don't need parents. All I need is a recording that says, 'Go play > outside!" - Calvin and Hobbes > ****************************************** Richard J. Sears Vice President American Digital Network ---------------------------------------------------- rsears(a)adnc.com http://www.adnc.com ---------------------------------------------------- 858.576.4272 - Phone 858.427.2401 - Fax ---------------------------------------------------- I fly because it releases my mind from the tyranny of petty things . . "Work like you don't need the money, love like you've never been hurt and dance like you do when nobody's watching."

1 0

Microsoft announces new ways to bypass security controls
by Sean Donelan 15 Sep '03

15 Sep '03

For those not keeping up with Microsoft, because so many people have started blocking Netbios, RPC, SMB, etc; Microsoft announced yet another way to bypass security. On August 1, Microsoft introduced Exchange 2003. With Outlook 2003 this introduces an new implementation fo Exchange's MAPI protocol over HTTP allowing clients to natively connect to Exchange servers without using a virtual private network (VPN). Steve Conn, Microsoft's Product manager was quoted as "Since we have got a good implementation, we're going to keep supporting it." Microsoft will evangelise the new protocol, and developers of other mail clients and servers will be encouraged to implement it. http://www.microsoft.com/office/ork/xp/beta/three/ch8/OutC07.htm "Outlook 2003 now offers a better alternative to VPN connections -- RPC over HTTP. With this feature, users can have security-enhanced access to their Exchange Server accounts from the Internet when they are working outside your organization's firewall. Users do not need any special connections or hardware, such as smart cards and security tokens, and they can still get to their Exchange accounts even if the Exchange server and client computer behind the firewall are on different networks." By the way, Microsoft's RPC-Over-HTTP uses one of the ports in another Microsoft security advisory concerning RPC vulnerabilities. Extending the list of dangerous ports to include 593, RPC-over-HTTP. A suggested work around, use a virtual private network (VPN). Of course, Microsoft isn't the only one with mail protocol security weaknesses. POP3 is probably responsible for more cleartext passwords being transmitted over the Internet than any other network protocol.

4 3

Weekly lamer report
by Rob Thomas 15 Sep '03

15 Sep '03

Hi, NANOGers. While noshing on your morning bagel don't forget to check for lame DNS delegations. There are 21771 entries in the lamer report for the week ending 14 SEP 2003. These entries are often indicators of greater problems with name server configurations. <http://www.cymru.com/DNS/lame.html> This report does not include last week's filename typo. :) Thanks! Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

RE: Cisco introduced 'warm' reload...
by Michel Py 15 Sep '03

15 Sep '03

Rodney, > Rodney Dunn wrote: > Thanks for pointing that out. I'll have it removed > from the CLI for any platforms where it's not supported. Actually, there's nothing to remove. The > cisco7507#reload ? > LINE Reason for reload Is perfectly legitimate. > The currently supported platforms are: > 3660 and 3745 in 12.3(2)T > 7200 in 12.2(18)S > I'll also check on future platform implementations and > let you know. While at first the feature seems platform > independent it turns out there are some platform > dependencies. If I may, it would be a hell of a good idea to make it work on platforms such as the 7500 where one would think it is un-necessary. On paper, having a feature set with rpr/rpr+ would render this command un-necessary on a 7500 with dual RSPs. In practice, there are so many compatibility issues with rpr/rpr+ and other features that some 7500s that have dual RSPs run a non-rpr image and the second RSP is sitting in the router as a spare. Michel.

2 2

Re: Sabotage not backhoes: More cable cuts
by George William Herbert 14 Sep '03

14 Sep '03

>Someone climbed a 15-foot tower in Southern Arizona cutting a fiber optic >cable used by Broadwing and Tucson Electric Power. This was within five >feet of the 138,000-volt power line. The site was also guarded by barbed >wire. > >This is not your typical backhoe. > >Rural areas have long dealt with the occasional shotgun damaged cable or >microwave horn; or the farmer burying the dead cow in the back pasture. >But I don't recall two reported acts of sabotage in less than 30 days >before. > >http://www.fox11az.com/news/local/stories/KMSB_local_fiberoptic_091203.9d8b… Is there *anyone* systematically looking at the impact of physical security on network links and datacenters? A lot of people make noise about it, but I haven't seen any changes even since 9/11 which would make penetration exercises any less likely to succeed (and, presumably, actual hostile activity were there to be such). -george william herbert gherbert(a)retro.com

1 0

DS1 Question
by Dennis Dayman 14 Sep '03

14 Sep '03

I am thinking of using ElPaso (elpaso.com) global telecommunications for D1 access across the SBC territory in Texas. Any one have an opinion of them. Does anyone have a list of question I should be asking potential providers of my DS1 lines? -Dennis "Sometimes I don't understand the software, and sometimes I don't understand the hardware, but I can *see* the blinking lights!"

1 0

MIT still has over 900 network drops disabled
by Sean Donelan 14 Sep '03

14 Sep '03

Eight weeks after Microsoft's first announcement concerning RPC vulnerabilities, MIT still has over 900 network drops disabled due to infected machines on the campus. http://www-tech.mit.edu/V123/N39/39SoBig2.39n.html MIT is known for having very bright people. Imagine the difficulty people without an MIT education are having trying to fix their Microsoft computers. MIT is taking the conservative approach. MIT Network Security requires users to reformat their hard drive and re-install their operating system (and I assume install all the patches) before re-enabling the network connection. Could you find your original operating system disks? Did your computer even come with a disc copy of the original operating system? I had some computers which asked the user to "backup" the original operating system on 50-90 floppy disks because the vendor only shipped the OS "pre-installed." Very few people spent the time (or the discs). And you are still face with the problem the patches aren't available yet on physical media (CD, Floppy, etc). So you need to find a friend with a fixed computer to make copies of the patches for you.

1 0

92 Byte ICMP Blocking Problem
by Richard J.Sears 14 Sep '03

14 Sep '03

We started blocking 92 Byte ICMP packets on our ingress points on our core backbone routers. This was a recommendation from Cisco to help mitigate the effects of the Nachi worm. Since then, we have been hammered with customer complaints concerning the inability to talk to mail servers and ssh to their servers, as well as other weird network issues, all centering around the time we started blocking 92 Byte ICMP packets. Has anyone else seen this, and if so, is the only resolution to stop the blockage of 92 Byte ICMP Packets..? Thanks Richard

8 10

Rumor: Microsoft preparing a new patch/service pack CD
by Sean Donelan 13 Sep '03

13 Sep '03

BetaNews is reporting that Microsoft will release a new Service Pack on September 24 including the various security patches. Because Service Packs are also available as CD distributions (for a shipping charge), this may help customers without high-speed Internet connections obtain all the patches (over 30 Megabytes) needed for their system. Unfortunately, many brand-new PC's include old versions of the Windows Operating system and are immediately infected when connected to the Internet before they can download all the patches. This would be a welcome change from Microsoft's previous public statments that the Windows Update Service is the only way for retail consumers to obtain the patches. http://www.betanews.com/article.php3?sid=1063425644

1 0