- NANOG - lists.nanog.org

Re: WANTED: ISPs with DDoS defense solutions
by Paul Vixie 06 Aug '03

06 Aug '03

> I don't believe I ever said that the edges shouldn't filter... did I? nope. but you said that backbones couldn't/wouldn't/shouldn't, and i showed that "transitivity" => "laundering", which means backbones MUST filter, to within the best capabilities of current technology.

2 1

Re: testing bandwidth of big internet pipes
by Stewart, William C (Bill), RTSLS 06 Aug '03

06 Aug '03

I tend to think of T1 and E1 connections as small (STM1s are starting to be big :-). It's easy enough to test them if there's something fast enough to test to. The two kinds of tests your customers are likely to care about are - Is your connection to them really the speed it should be? - Do you have enough upstream bandwidth for your traffic load? There are lots of ways to get and measure a 2Mbps load - - Most Cisco routers have "ttcp" client/server code, http://www.cisco.com/warp/public/471/ttcp.html http://www.netcordia.com/tnm/tnm31/ttcp.htm and you can either talk to another Cisco or use a Windows or Linux PC. - FTP on a Sun 3/60 a decade ago, or a Linux box with FTP or HTTP today, and any medium-fast Windows machine with an FTP or HTTP client that shows you download speed is usually a good demonstration. (You need to ignore initial ramp-up time because of TCP slow-start.) If you've got a spare PC you can hang off one of your routers, run an FTP and HTTP server on it and keep a few "10MB.txt" type files on it. - Qcheck is a nice friendly free client for Windows and other platforms which does speed and latency tests using tcp, udp, and ping, and can also be driven by their non-free testing systems. http://www.ixiacom.com/enterprise/Qcheck.php (Qcheck does use more PC CPU than simpler tools - my 66MHz Pentium doorstop boxes could only do ~300-400 kbps, but anything over about 500 MHz should do just fine.) - A really *bad* method that's popular with some of my customers (:-) is to use really big pings on a Cisco router. There are lots of different reasons this tends to fail. The second question is harder to answer, because you need a site that's not in your network that can give a fast enough response that the customer will feel happy, and I've found that it's often hard to download files from public web sites at faster than 1-2 megabits per second, because either the web site is <= T1, or it's large and shared by many users. Linux distribution sites when there's nothing interesting being released are usually good, but unfortunately mirror sites often mirror lots of things, so you may have trouble finding a quiet one. I don't remember if BitTorrent has a fancy user interface that shows current download speed, but it's usually good at filling up any symmetrical Internet pipe if there's something popular to download.

2 1

Re: Edge 1 Networks/Williams Communications Group (fwd)
by william＠elan.net 06 Aug '03

06 Aug '03

I do believe you're right about edge1 being new front Nick Geyer (who just recently said he's done with ip hijackings and will be doing everything legit and proper now - wonder if this can really be believed...). About Nick Geyer and his associates, see http://www.completewhois.com/hijacked/gang_vmx.htm (and at http://www.completewhois.com/hijacked/ you can see list of all ip blocks they stole - that is a LOT of ip space!) Then again it is interesting if this was you being helpfull or was it inside information (the person providing this info is himself associated with hijackers listed at http://www.completewhois.com/hijacked/gang_wdh.htm) ---------- Forwarded message ---------- Date: Mon, 4 Aug 2003 18:14:22 -0400 From: "Booth, Michael (ENG)" <MBooth(a)corp.as26857.com> To: Jeff Kell <jeff-kell(a)utc.edu> Cc: nanog <nanog(a)nanog.org>, Michael.Winslow(a)wcg.com, blake.williams(a)wcg.com Subject: Re: Edge 1 Networks/Williams Communications Group > After several run-ins with Edge 1 Networks [69.44.28.0/22] having their > machines "hijack" victim machines on our networks infected with Jeem, > and then making their spam runs, I've had it. I have reported both to > Edge 1 and their parent Williams Communications Group [AS7911] with no > result and I will be blocking Edge 1 [in theory, AS29986, but no doubt > private spewage from WCG.NET) I smell a rat. I have a funny feeling Edge1 is a front for pro-spammer Nick Geyer. Look at their whois: Edge1 Networks Hostmaster Edge1 25 Broadway - 5th Floor New York, NY 10004 US Phone: 212-248-1121 Fax..: 212-248-0929 But if you call Verizon, they'll tell you these lines terminate on the sixth floor of 25 Broadway, an address I remember all too well from the VMX Networks hijackings. If you want the abuse to stop, call Nick at work (212-685-2009) or on his cellular phone (503-851-1963) and tell him to knock it off. If Nick is busy or at a meeting, as is often the case ask to speak to his boss, Paul Hodara, and see if he can track him down. The Williams NOC could care less, if you want to get anywhere, try contacting Blake Williams (blake.williams(a)wcg.com) or Michael Winslow (Michael.Winslow(a)wcg.com) who are capable of taking action, including ultimately denying service to Edge1 for AUP violations.

1 0

Re: Complaint of the week: Ebay abuse mail (slightly OT)
by neil＠DOMINO.ORG 05 Aug '03

05 Aug '03

I would have though people would have learned by now that there is no technical solution to spam. You can go ahead with all these wonderfully expensive authentication/filtration/insertantispambuzzword systems until the cows come home and you will +_still_+ recieve spam. Regards, Neil.

7 8

Edge 1 Networks/Williams Communications Group
by Jeff Kell 05 Aug '03

05 Aug '03

After several run-ins with Edge 1 Networks [69.44.28.0/22] having their machines "hijack" victim machines on our networks infected with Jeem, and then making their spam runs, I've had it. I have reported both to Edge 1 and their parent Williams Communications Group [AS7911] with no result and I will be blocking Edge 1 [in theory, AS29986, but no doubt private spewage from WCG.NET) They hijacked a Jeem proxy on July 17th, it was shut down. The help desk thought they had cleaned it up, but within 30 mins of placing it back online again, Edge 1 grabbed it again. I brought it into the lab with a sniffer, rebooted (new IP), and Edge 1 picked it up within 10 minutes and began spam/proxying. This past Sunday, a similarly Jeem'ed machine was hijacked by the same Edge 1 block (numerous machines in the Edge 1 block, mind you) and due to me being out of the office it wasn't noticed and shutdown until Tuesday, after a little over a half million proxied spams. Are these people just totally off-the-wall? Google searches seem to concur. I am awaiting confirmation that ALL the proxies originated from Edge 1 (takes a while to churn through those gigs of pix logs). Jeff Kell University of Tennessee, Chattanooga

3 2

clearblue part deux
by John Kinsella 05 Aug '03

05 Aug '03

So haven't seen anybody else mention it yet...Clearblue in SFO went off-net for 3ish hours today, again as the result of internal power issues as far as I can tell. Gennys didn't kick in. After gettin my stuff back up, went for a self-guided tour of the facility to find 3 guys gathered around one of their UPSes scratching their heads. I suspect something went *poof*. At least it was a Saturday... Personally, I'm looking forward to renegotiating my contract later this year. :) John

5 6

Re: testing bandwidth of big internet pipes
by Michael.Dillon＠radianz.com 05 Aug '03

05 Aug '03

>At the moment we are looking for a good badwidth test within your network to test the line and to see if the customer gets what he has asked/paid for. Have you tried pathload/pathrate? http://www.cc.gatech.edu/fac/Constantinos.Dovrolis/bw.html Pathchirp is another possibility http://www.spin.rice.edu/Software/pathChirp/ Both of these websites have documents that you may find useful, or you can google on pathrate or pathchirp to find additional documents. --Michael Dillon

1 0

Proper Protocol for Dealing with Unresponsive Contacts?
by Patrick Muldoon 05 Aug '03

05 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, What is the proper way to deal with a company that is unresponsive to any form of contact. IE they have outdated information on their ip assignments, bounce every piece of e-mail that I send? (including postmaster@ which is where the bounce message come from). Here is the situation I am facing. We just registered a new domain (tigerny.net/com) for a project we are working on . It appears that a company, in this case Tigerfund.com has a Microsoft Domain called TIGERNY. Well due to the the helpful setting in Windows that says register this connection in dns (Or something along those lines). We are now seeing 1000's of failed update attempts to our nameservers per day from all of the Tri-State area, mostly cable-modem networks, but also coming from AS5703, as these machines try in vain to update the dns information. As None of the contact information is correct, I have yet to be able to contact a human being, in an attempt to get this corrected. What should my next steps be? My thought is to go to their upstream (AS8112) and try to get contact through them. If it was just a a couple places that this traffic was being sourced from I would just null route them, but since it is all over the place, mostly coming from dynamic ip blocks in RR and Cablevision's cable modem networks, it makes blocking it at our edge rather difficult, if not impossible. Thanks in advance for any suggestions, - -Patrick - -- Patrick Muldoon Network/Software Engineer INOC (http://www.inoc.net) PGPKEY (http://www.inoc.net/~doon) Key fingerprint = 8F70 6306 F0A7 B8DA BA95 76C4 606A 7DC1 370D 752C "Back off Man!, I'm a scientist" Peter Vinkman -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (FreeBSD) iD8DBQE/L7uIYGp9wTcNdSwRAkP+AJwPsuxH/lu4MSr0mSNzW7edLPC4cwCgsaH0 VOhO3bUkmzd116UYakvJolw= =DiAR -----END PGP SIGNATURE-----

3 2

Re: Complaint of the week: Ebay abuse mail (slightly OT)
by Michael.Dillon＠radianz.com 05 Aug '03

05 Aug '03

>> The web of trusted email servers would use a new and improved mail >> transfer protocol (NIMTP) that would only be used to exchange email >> between trusted servers. Users could continue to use authenticated SMTP to >> initiate the sending of email, but nobody would accept any unauthenticated >> SMTP servers any more. >And this would deploy how? In particular, consider the following questions: A few of the larger user sites such as AOL and MSN would deploy it between themselves. Once it is proven, they would analyse their logs and invite the large email sender sites to begin using the protocol. Once it is clear that NIMTP can be deployed easily and cheaply, they begin to impose rate limiting on email senders using SMTP which will cause queues to build at the email sender sites. Eventually running NIMTP will be recognized as the right thing to do and everyon will use it. >1) What *immediate* benefits do you get if you are among the first to deploy? >(For instance, note that you can't stop accepting "plain old SMTP" till >everybody else deploys). You can replace complex and buggy spam filtering software with simple rules on your NIMTP servers. Since the spammer cannot spoof their identity, you simply rate limit them based on the volume of attempts. I.e. if a sender attempted to send 10 messages in one hour, you might limit him to 2 per hour but if he attempted to send 100 per hour you would limit him to 1 per hour. And if he attempted to send 1000 per hour you would limit him to 1 every 4 hours. >2) Who bears the implementation cost when a site deploys, and who gets the >benefit? (If it costs *me* to deploy, but *you* get the benefit, why do I want >to do this?) The site owners pay all the costs and reap all the benefits. Just like today with spam filtering. >3) What percentage of sites have to deploy before it makes a real difference, >and what incremental benefit is there to deploying before that? (For any given >scheme that doesn't fly unless 90% or more of sites do it, explain how you >bootstrap it). The incremental benefit is there if NIMTP deployment starts with large email sites. >4) Does the protocol still keep providing benefit if everybody deploys it? >(This is a common problem with SpamAssassin-like content filters - if most >sites filter phrase "xyz", spammers will learn to not use that phrase). Of course it keeps providing benefits. The two key elements of NIMTP (New Improved Mail Transfer Protocol) are that the receiver will only receive email messages from a known sender site and the sender site will certify the identity of the message sender. In order to know the sender site, there needs to be an authentication handshake for a session and it needs to be based on some kind of prearranged agreement and key exchange. In order to certify the message sender, all messages will need to be relayed through an NIMTP relay site and the message sender will need to authenticate themself, i.e. using something like AuthSMTP. But AuthSMTP will only be used between mail clients and their email service provider. NIMTP is intended to be used between email service providers. Some of these NIMTP sites will be relaying email for smaller NIMTP sites that cannot afford the complexity of prearranging keys with all other NIMTP sites. To summarize, the NIMTP core will have NIMTP peering arrangements with every other member of the NIMTP core, but many NIMTP sites will only have NIMTP peering with one or two other sites. In order for anyone to send email within the NIMTP world they will need to hand the email to any NIMTP site who will relay it to its destination. But the NIMTP site will only accept email if it can certify the sender's identity. >If you have a *serious* proposal that actually passes all 4 questions (in >other words, it provides immediate benefit to early adopters, and still >works when everybody does it), bring it on over to 'asrg(a)ietf.org'. I've just joined the ASRG list and if I can find the time I will try to write this up as a draft architecture and post it. But feel free to copy these emails to ASRG if you feel it would be worth discussing there. --Michael Dillon

2 1

Electrical Engineering Firm Recommendation
by Dan Lockwood 05 Aug '03

05 Aug '03

Can someone recommend an electrical engineering firm in the middle to north part of California that has experience with NOC design? TIA Dan Lockwood

1 0