- NANOG - lists.nanog.org

Moving filters from edge to core
by Tay Chee Yong 31 Jul '03

31 Jul '03

Hi all, This might be quite a stupid question. But my management is looking at moving the filters from the edge to the core, so as to reduce adminstration of apply filters on all our edge routers, and minimizing the possibility of non-synchronized filters at the edge. Does anyone has any advise on this? I believe all the there are many larger ISP in this list that have a better way to manage your filters at the edge. Would appreciate all inputs/comments. Thanks. Regards, Cheeyong

3 4

public comment period for oisafety.org's vulnerability process
by Paul Vixie 31 Jul '03

31 Jul '03

http://www.oisafety.org/ announced the GA version of "guidelines for security vulnerability reporting and response process, v1.0", whose URL is http://www.oisafety.org/reference/process.pdf this is asynchronous to the NIAC presentation jim duncan gave at the last nanog, but it's related/similar, and there's a public comment period, and it's a worthwhile read, or an opportunity to flame somebody, or whatever. oisafety.org is the organization for internet safety, btw.

1 0

Is there a technical solution to SPAM?
by Michael.Dillon＠radianz.com 31 Jul '03

31 Jul '03

Anyone who believes that SPAM can be solved by technical means should try googling one of the following: sms spam i-mode spam IM spam It should be clear that spam is really a social problem, not a technical one and therefore the solutions will be found in the social, political and legal spaces, not in network engineering. Some combination of education and training, new laws, arrests and public trials will be needed to get rid of it. I'm betting that we get the biggest bang for the buck out of education and training. Part of it will come from teaching people network etiquette, part from teaching them that spam is not a way to make money, and part of it from teaching website owners how to provide effective advertising so that website ads can dominate the cheap mass advertising space and displace the spammers. In any case, I suggest that we should ban all future discussion of SPAM and spammers from this mailing list since it is not related to network engineering or operating an IP network. ------------------------------------------------------- Michael Dillon Capacity Planning, Prescot St., London, UK Mobile: +44 7900 823 672 Internet: michael.dillon(a)radianz.com Phone: +44 20 7650 9493 Fax: +44 20 7650 9030

7 6

FW: User negligence?
by Genzoli, William 30 Jul '03

30 Jul '03

Which goes back to the root of the *real* problem here. Banks are mainly concerned with physical security. Internet security has always been handled as more of an afterthought and mainly for reasons of due diligence. The real problem is the banks have a known security flaw with a simple password login for account access. That, as has been discussed here, is a significant flaw in the overall design of what should be a secure system and access method. The underlying issue here is that the bank, whom should be the subject matter expert, clearly is not. They offer one way, and one way only to access, arguably, our most sacred information. Furthermore, they offer very little, if any, training to their clients, the end-user. A quick thirty second blurb is not due diligence for an organization that values it's customers. The bottom line is if they offered a SecureID sort of setup, or any other of a number of methods out there that *would* circumvent a key logger or similar hack, the customer would more times than not, comply. Even at the customer's expense. Customers may not be technically savvy overall, but they value their own money above even the bank. If it's explained that the added cost/benefit is there, and is a real, tangible issue, a ten or twenty dollar nominal fee is just that, nominal. Until banks realize this, they are undoubtedly and unequivocally at fault. Bill G. -----Original Message----- From: Peter Galbavy [mailto:peter.galbavy@knowtion.net] Sent: Monday, July 28, 2003 3:13 AM To: ken emery; North American Noise and Off-topic Gripes Subject: Re: User negligence? ken emery wrote: > I'm not sure what needs to be done, but the security as now > implemented > is not even close to enough IMHO. Networkwise (to bring this back on > topic) I'm not sure there is really much that can be done. Don't forget the desperate need for user *and* staff education. I have now multiple time got calls from my bank asking to discuss my account. Could I just verify my details ? they asked. Er, you first, I said. They didn't get it. They didn't understand why, as someone who is lightly paranoid and understand more about security than they do, I was concerned that they couldn't prove they were from the bank... Peter

1 0

Re: North America not interested in IP V6
by Bill Owens 30 Jul '03

30 Jul '03

At 13:59 +0200 7/30/03, Marcel Lemmen wrote: >Well, now we are talking about IPv6, I can ask a question right here ;) > >Does anyone have any experiences with the Cisco IPv6 IOS (T or S >releases)? Can be either good or bad experiences. I heard there were some >issues (router freezes etc) with the T releases... We've been running 12.2(n)T for the past two years, always with both IPv4 multicast and IPv6 turned on. v6 support has always been good. We had problems early on with multicast bugs, including some that seemed to have been reintroduced into that train, but those have been squashed. And recent versions have improved v6 performance, at least on the 72xx and 75xx platforms (I haven't tested anything else). Our current standard version is 12.2(15)T5 and we have no outstanding issues with it. Our customers who use v6 are running T train and 12.3(1) on 75xx/72xx, and 12.0 S train on 12xxx. They all run v4 multicast as well. I've a test router on 12.3(1a) and it seems OK, but no extensive testing yet. BTW, we're an R&E network, not a commercial ISP, so we have different goals and different operational requirements. . . Bill. -- Bill Owens Manager, Network Development NYSERNet

1 0

Transformer takes out datacenter (Reno, NV)?
by Jeremy Gaddis 30 Jul '03

30 Jul '03

After being informed that my website was unreachable from a few people, I verified that I couldn't query the DNS servers for it. I waited a few hours and they still didn't respond. A call to my domain registrar (who runs the DNS) was answered by an machine. A call to the home of the DNS admin was answered. He said that apparently a transformer had blown up in or near a datacenter near Reno and, basically, that nothing was working. AFAICT, the datacenter itself had no connectivity to the Internet at large and everything there was inaccessible. He said he'd heard three different times that things were supposed to be fixed: Midnight, 2am, and 6am (GMT-8). Does anybody have any more (detailed) information on this? Thanks, j. -- Jeremy L. Gaddis <jgaddis(a)bob.ivytech.edu>

4 3

RE: North America not interested in IP V6
by Michel Py 30 Jul '03

30 Jul '03

> Does anyone have any experiences with the Cisco IPv6 IOS > (T or S releases)? Can be either good or bad experiences. > I heard there were some issues (router freezes etc) with > the T releases... In my experience with 12.2(T) the issues were not related to IPv6; I have been running it for two years for IPv6 peering. V6 is now part of 12.3 (non-T) anyway. On mid-range platforms (72xx) the IPv6 performance is sucky compared to IPv4 (which is why lots of people I know have separate routers for v6) but on 25xx/26xx/36xx no difference. Michel.

1 0

New IPv6 block allocated to RIPE NCC
by leo vegoda 30 Jul '03

30 Jul '03

Dear Colleagues, The RIPE NCC received the IPv6 address range 2001:1600::/23 from the IANA in July 2003. You may wish to adjust any filters you have in place accordingly. More information on the IP space administered by the RIPE NCC can be found on our web site at: <http://www.ripe.net/ripe/docs/smallest-alloc-sizes.html> Kind regards, -- leo vegoda RIPE NCC Registration Services Manager

1 0

France Telecom/Open Transit
by variable＠ednet.co.uk 30 Jul '03

30 Jul '03

Hi all, Does anyone have any good/bad experiences to share about France Telecom/Open Transit? Cheers, Rich

1 0

Re: Is there a technical solution to spam?
by Bohdan Tashchuk 30 Jul '03

30 Jul '03

> The solutions may well be found there but will be unimplementable > without much needed support from the operators - particularly the > major backbones - who currently turn a blind eye to protect their > revenue. Bingo. There's the crux of the problem. It needs to be elaborated on and emphasized, because most engineers have a blind spot about the business aspects of their industry (no matter what that industry is). There's a lot of wailing and gnashing of teeth, a lot of soul searching, a lot of angst here. All for naught. Many big network operators are selling bigger and bigger pipes to everyone so they can keep up with more and more spam. They make money on the increased traffic, even as they have these solemn terms and conditions in place about how they won't tolerate spam. The big network operators don't need to allow spammers to connect directly to their backbones. They make money by selling transit to other networks who sell transit to still other networks who then allow spammers to connect. Network operators are such a naive bunch of engineers. There's lots of money to be made just in transit for spam, and quite often the people who sign the paychecks for the engineers who post to this list are the very people who benefit. They understand this, why don't you? Every network operator should first try to get their own company to get serious about stopping spam. Top management has to be willing to do what it takes. E.g. de-peer, stop selling transit, etc. Until that happens the spam problem will keep getting worse. And if top management isn't interested, or won't agree to do anything meaningful, ask yourself why. And keep that in mind the next time you get paid.

1 0