- NANOG - lists.nanog.org

rr style scanning of non-customers
by Kuhtz, Christian 15 Jun '03

15 Jun '03

Hey gang, Some ISPs, such as RR, appear to be implementing what I personally would consider quite aggressive approaches to guarding their network by implementing "proactive" scanning of non-customers, similar to what's described at http://security.rr.com/probing.htm <http://security.rr.com/probing.htm> In this case, sending email to @rr.com appears to trigger this scanning business (mind you, this is not about the scanning their subs biz; I don't care to get into that in this thread). But, the question is.. How many people here are doing this sort of thing? And where does this stop, short of nmapping the entire box? Some time ago, when Code Red first came around, discussions raged as to how to deal with it and other infestations of customer owned/operated equipment. And this kind of is a different slant on the same issue. Except that it goes quite a bit further than your own prefixes. I'm not looking to start a flamewar, I'm interested in a discussion or consensus discovery of how far "proactive" tasks can/should/shouldn't go. Regards, Christian ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers."

7 9

Re: rr style scanning of non-customers
by John Brown 15 Jun '03

15 Jun '03

hope randy doesn't mind the xlate from private post to list post http://www.nsa.gov/snac/winxp/guides/wxp-1.pdf http://www.giac.org/practical/GSEC/Trevor_Cuthbert_GSEC.pdf http://www.microsoft.com/windowsxp/pro/using/itpro/default.asp#section6 john brown On Sat, Jun 14, 2003 at 10:28:42PM -0700, Randy Bush wrote: > > http://www.nsa.gov/snac/win2k/download.htm > > http://www.arstechnica.com/tweak/win2k/security/begin-1.html > > cool. how about xp? > > randy >

2 1

RE: Rescheduled: P2P file sharing national security and personal security risks
by McBurnett, Jim 14 Jun '03

14 Jun '03

HMMM... Well, in the US, there is even the threat of lawsuit from an Employee that get pornographic SPAM email... should the employer not make efforts to block it, the employee can sue.. BUT it is the same argument.. Do we take the bad with the good? do we allow P2P when it can create security issues? All this should be regulated by corporations not govermentt.. IE: Every business model is different.. A defense contractor should definately block p2p, but does a computer gaming company need to block it? The Entire issue goes back to the job description of security professional.... Balancing the operational needs of XYZ vs. the hassle of certain security needs.... That is all this is... Some Senator or Congress member got wind of a "potential" security issue, and in light of Sept 11, EVERYTHING is being scrutinized... Anyway.. I've said enuf..... J From: Stephen J. Wilcox Hmm where do you draw the line.. peer2peer file sharing, MS Networking, SMTP, telephones, snail mail, visiting foreign countries, meeting people at all.. ? Seems a bit silly to me to be having the conversation at all, its people who willingly leak this information not the mechanism used thats at fault Steve On Fri, 13 Jun 2003, Richard Irving wrote: > After all, how many meetings are there going to > be assessing the risk SMTP has on National Security ? > > Or, as you mentioned, MS file sharing... > > And, remember, SMTP is -already- proven guilty of said Risk, > and a far more -probable- culprit in future compromises... ! > > Reality Check. > > My .02c > > .Richard. > > My, what interesting times we live in, > and darn it, important people noticed me! :{ > > Sean Donelan wrote: > > > > June 10, 2003 > > > > NOTICE OF RESCHEDULED FULL COMMITTEE HEARING > > The Senate Committee on the Judiciary scheduled for Wednesday, June 11, > > 2003, at 2:00 p.m., on .The Dark Side of a Bright Idea: Could Personal > > and National Security Risks Compromise the Potential of P2P File-Sharing > > Networks?. has been rescheduled for Tuesday, June 17, 2003 at 2:00 p.m. > > in Room 226 of the Senate Dirksen Building. > > > > By order of the Chairman > > > > > > > > > > > > I wonder if anyone is going to mention that Microsoft Network Neighborhood > > file sharing is a form of P2P file sharing. > > >

2 1

RE: IPv6
by Daryl G. Jurbala 14 Jun '03

14 Jun '03

I was actually referring to the ASIC issue only. The VXR's are not traditional ASIC based....the ASIC (I think they actually call the device something else) code is loaded on the fly from the IOS and configuration. Daryl G. Jurbala Introspect.net Consulting Tel: +1 215 825 8401 Fax: +1 508 526 8500 http://www.introspect.net PGP Key: http://www.introspect.net/pgp -----Original Message----- From: David Luyer [mailto:david@luyer.net] Sent: Friday, June 13, 2003 11:04 AM To: Daryl G. Jurbala; nanog(a)merit.edu Subject: RE: IPv6 [...] The 7206VXR (along with all 7200/7400) supports IPv6 in IOS 12.2S, 12.2T and 12.3. [...]

2 1

RE: IPv6 Services/Products
by Bulger, Tim 13 Jun '03

13 Jun '03

That would be Maxis Communications Berhad or www.maxis.com.my ... -----Original Message----- From: Irwin Lazar [mailto:ILazar@burtongroup.com] Sent: Friday, June 13, 2003 6:29 AM To: nanog(a)merit.edu Subject: IPv6 Services/Products Thanks to all who responded, below is what I've compiled so far (vendors/service providers): Hurricane Electric - http://www.he.net/ Maxis (IPv6 for 3G) - www.maxis.com Equinix (IPv6 exchange for Hurricane & Japan Telecom) - www.equinix.com BTExact (http://www.uk6x.com) NEC (IPv6 video content distribution system with China Netcom, Asia Netcom Japan, and Sky Perfect) 6Wind (IPv6 in China w/ BII Group) Internet Initiative Japan Inc (IIJ) - IPv6 Gateway Service Global Crossing (announce beta plans last year, haven't been able to find anything further) Also, ISS just released an IDS/IPS for IPv6 (the first one I believe?) Thanks for the feedback, Irwin

1 0

[afisnews_sender@DTIC.MIL: New Internet Protocol Version Slated For Debut]
by Alan B. Clegg 13 Jun '03

13 Jun '03

Since the use of IPv6 has been discussed.... ----- Forwarded message from Press Service <afisnews_sender(a)DTIC.MIL> ----- Date: Fri, 13 Jun 2003 15:39:01 -0400 From: Press Service <afisnews_sender(a)DTIC.MIL> Subject: New Internet Protocol Version Slated For Debut To: DEFENSE-PRESS-SERVICE-L(a)DTIC.MIL By Gerry J. Gilmore American Forces Press Service WASHINGTON, June 13, 2003 � An improved version of the Internet, featuring enhancements that improve system security and data delivery, will be part of DoD's integrated information-communications network, a senior U.S. defense official said here today. Users will realize improved service when Internet Protocol Version 6 is incorporated across DoD systems, John Stenbit, assistant secretary of defense for networks and information integration, remarked to reporters during a Pentagon press conference. DoD currently uses Version 4 of the Internet, Stenbit explained. That system, he noted, has some flaws. "There are lots of issues that have come up with Internet Version 4," Stenbit pointed out, noting many commercial "fixes" have been made to address some of those problems. One Version 4 fix, Stenbit said, concerns the number of Internet addresses that can be accessed. Yet, this issue, he pointed out, isn't of particular import to DoD. However, DoD is concerned about the lack of information security safeguards that are inherent in Internet Version 4, Stenbit noted. And the department is aware of the current Internet system's lack of dependability in delivering electronic "packages" of information, which, Stenbit points out, has a negative impact on quality of service. Today, "if you send a 'packet' on the Internet, nobody is guaranteeing you that it is going to get to the other end," Stenbit observed. For example, he noted, sometimes Internet provider-generated video or audio conferences may lose sight or sound during transmission. This, he explained, is caused by Version 4 limitations. Improvements addressing such quality of service issues are part of Internet Version 6, Stenbit explained. And Version 6 development "has gotten far enough along so that people now deliver hardware and software that are compatible with both standards," Stenbit noted. Version 6 "is what we're going to be using" as the standard for DoD, Stenbit declared, noting, "We're anticipating moving the department to the use of IP 6 in about 2008." Consequently, DoD acquisition officials must begin purchasing Version 6- compatible equipment now, Stenbit concluded. _______________________________________________________ NOTE: This is a plain text version of a web page. If your e-mail program did not properly format this information, you may view the story at http://www.defenselink.mil/news/Jun2003/n06132003_200306134.html Any photos, graphics or other imagery included in the article may also be viewed at this web page. ==================================================== Visit the Defense Department's Web site for the latest news and information about America's response to the Sept. 11, 2001, terrorist attacks and the war against terrorism: "Defend America" at http://www.DefendAmerica.mil. ==================================================== Visit the "Department of Defense Homeland Security" Web site at http://www.defenselink.mil/specials/homeland/ to learn more about the Department of Defense role in homeland security. ==================================================== Unsubscribe from or Subscribe to this mailing list: http://www.defenselink.mil/news/subscribe.html ==================================================== ----- End forwarded message ----- -- I must study politics and war that my sons | may have liberty to study mathematics and | alan(a)clegg.com philosophy. -- John Adams |

1 0

Re: Rescheduled: P2P file sharing national security and personal security risks
by sgorman1＠gmu.edu 13 Jun '03

13 Jun '03

Not sure what is scarier the money to influence government or the money spent on litigation. The latest tactic is using a legal bit called self help. Usually self help is used if someone steals your car and you find it in their driveway, you can trespass on their property to retrieve your property. The RIAA version of this is they can hack into p2p systems and spike files, tamper with search results, and generally wreak havoc on anything that has a copyrighted file on it. Even scarier I was listening to a panel of lawyers who all thought this was a great idea. It did not seem to bother them at all that these actions would/could wreck the system for all the legitmate users or that the burden of proving that legit systems had been hacked/screwed would be on the system owner and not the RIAA. Maybe we should set up tire shredders on the interstate and then check all the wrecked cars to see if they were stolen or carrying drugs. ----- Original Message ----- From: Richard Irving <rirving(a)onecall.net> Date: Friday, June 13, 2003 2:19 pm Subject: Re: Rescheduled: P2P file sharing national security and personal security risks > > IMHO: > > No more, or less, than SMTP. > > It is -that- simple. > > (Of course, SMTP is how China got > Nuclear Secrets out of America :( ) > > FWIW: This is more tempestuous reactions at High Levels, > that would normally have been laughed off..... > > Except P2P's are annoying the Recording Industry execs, > and they have $$$ on the line, so..... > > $$$ has a way a bringing things to light that would > otherwise simply have been ignored.... > > But, for this to make it to the NS Risk Assessment groups just > demonstrates the licentious influence between the Current > Administration Policies and "Money Men". > > After all, how many meetings are there going to > be assessing the risk SMTP has on National Security ? > > Or, as you mentioned, MS file sharing... > > And, remember, SMTP is -already- proven guilty of said Risk, > and a far more -probable- culprit in future compromises... ! > > Reality Check. > > My .02c > > .Richard. > > My, what interesting times we live in, > and darn it, important people noticed me! :{ > > Sean Donelan wrote: > > > > June 10, 2003 > > > > NOTICE OF RESCHEDULED FULL COMMITTEE HEARING > > The Senate Committee on the Judiciary scheduled for Wednesday, > June 11, > > 2003, at 2:00 p.m., on .The Dark Side of a Bright Idea: Could > Personal> and National Security Risks Compromise the Potential of > P2P File-Sharing > > Networks?. has been rescheduled for Tuesday, June 17, 2003 at > 2:00 p.m. > > in Room 226 of the Senate Dirksen Building. > > > > By order of the Chairman > > > > > > > > > > > > I wonder if anyone is going to mention that Microsoft Network > Neighborhood> file sharing is a form of P2P file sharing. > > > >

1 0

RE: DNS resolution to Yahoo.
by Ejay Hire 13 Jun '03

13 Jun '03

Yahoo uses akamai technology (bgp path analysis) to determine what content server is "closest" to a given host and bases its' dns response on that data. You could contact Akamai and, explain your network, and see if they can make the necessary adjustments, or if you are large enough ask them to drop a couple of servers in your site. (or they may want you to send them a BGP feed) -Ejay -----Original Message----- From: Alan Sato [mailto:asato@altrio.net] Sent: Friday, June 13, 2003 12:17 PM To: nanog(a)merit.edu Subject: DNS resolution to Yahoo. So I got 2 dns servers that resolve www.yahoo.com <http://www.yahoo.com/> differently. Server A goes to 216.109.125.69. The Server B goes to 66.218.71.92. The 66.218.71.92 is a faster route for me. How do I get Server A to resolve to 66.218.71.92? Alan

2 1

DNS resolution to Yahoo.
by Alan Sato 13 Jun '03

13 Jun '03

So I got 2 dns servers that resolve www.yahoo.com <http://www.yahoo.com/> differently. Server A goes to 216.109.125.69. The Server B goes to 66.218.71.92. The 66.218.71.92 is a faster route for me. How do I get Server A to resolve to 66.218.71.92? Alan

3 3

IPv6
by Irwin Lazar 13 Jun '03

13 Jun '03

Excuse the off-topic question, but does anyone know if there is some sort of list anywhere of service providers who are running IPv6 in a production capacity, either to tunnel IPv4 or to offer native IPv6 services? I'm not looking for test or research networks but rather a list of IPv6 networks that are actually carrying customer traffic. Thanks, Irwin

15 25