- NANOG - lists.nanog.org

Ettiquette and rules regarding Hijacked ASN's or IP space?
by Christopher L. Morrow 12 Jun '03

12 Jun '03

So, with all this lifting the curtains on hijacked ASN's and ipblocks recently I have a few general question... 1) Should the rules be uniformly applied? 2) Should these rules be applied even when something 'bad' might happen? 3) How much involvment should ARIN have in enforcing these rules? Now, by 'rules' I mean: If you steal something you have to give it back, regardless of who you are. So, for an example, if I steal ASN 8143 (already stolen so its mute) and I'm 'a good guy', all I want to do is run a network no spam/abuse eminates from it, should I be subject to the 'witch hunt' that my fellow ASN stealer who does abuse/spam deals with? The same is asked for hijacked ip space. If I steal/hijack a large netblock, not from an active org so there is no 'damage' done, and I don't spam/abuse from it should I be compelled to return it also? Compelled in the same way that my brother stealer who spams/abuses is? I am not advocating one or the other, and to me the rules should apply to both groups (all theives treated equally)... I'm just curious as to the general thought on this subject. Additionally, how should ARIN go about verifying proper 'ownership' (that I am still me after all these years of 'inactivity'), how much is enough research on these issues? I know that at the ISP there is a measure of trust placed on the customer, and upstream/downstream, when it comes to ASN's and ip announcements. ARIN is in the same position as near as I can tell. They have to trust that the community both is trustworthy (to an extent) and conscientious. If there are bad actors out there that go to enough trouble they can make ASN's or ip blocks appear to be registered to themselves. There may be breadcrumbs of evidence if you look hard enough, perhaps there won't be. How hard should ARIN be looking at these issues and at specific instances? Should they apply their rules without prejudice? Sorry for the latenight not-completely-operational question :) but it seems as though there is some abmiguity in the current process/procedure/rules and I'd like to atleast start some discussion on the topic. Thanks. --Chris (chris(a)uu.net) ####################################################### ## UUNET Technologies, Inc. ## ## Manager ## ## Customer Router Security Engineering Team ## ## (W)703-886-3823 (C)703-338-7319 ## #######################################################

12 13

netrange->cidr script - too many replies... thank you all
by william＠elan.net 12 Jun '03

12 Jun '03

I received way too many replies on this request. I really appreciate everybody who did reply, but please no more I found what I'm looking for in duplicates and triplicates.... For those others also interested here is what I was pointed to (sorted by number of pointers - almost 10 for aggis and 2-5 for others): 1. aggis - http://www.utdallas.edu/~pconnally/aggis 2. Net::CIDR::range2cidr(), Net::CIDR::Lite - http://search.cpan.org/dist/Net-IP/ 3. sipcalc - http://www.routemeister.net/ 4. http://perlmonks.thepen.com/79663.html Also several people have sent me their own perl scripts that that can be adapted to do what I wanted as well (if I needed it, which does not seem necessary given number of alternatives). Thanks you for those as well. Nanog community is really very helpfull. Please keep it up! ------- William Leibzon Elan Communications Inc. william(a)elan.net

1 0

Re: Another hijacked range???
by william＠elan.net 12 Jun '03

12 Jun '03

> http://www.securityfocus.com/news/5654 > > Why didnt the County file charges? hijacking... thats terrorism right? :-) This is not the same "hijacking" and you know it! But they can file charges for identity fraud and theft of resources. For FBI to investigate they want $5000 of losses from the victim (or victims). Also when IP block is sold, this is profiting from illegally obtained goods (well not "goods" but they can classify it as such). This is fraud of different type (as somebody else pointed legally this would be "Pecunary fraud through misrepresentation of ownership") and they can also prosecute those who got the money but again highier amounts then $500 are needed for them to get really into this. Multiple confirmed cases of buying ip blocks from the same person/groupwould help there. (Note: I incidently posted reply to this email on another mail list, apologies to those who have see this twice) --- William Leibzon Elan Communications Inc. william(a)elan.net

2 2

Security Requirements Intnernet Draft (a request for comments)
by George M. Jones 12 Jun '03

12 Jun '03

I've published an Internet Draft on "Security Requirements for Devices Implementing IP". You can view it at: http://www.ietf.org/internet-drafts/draft-jones-opsec-00.txt This is an outgrowth of a document used by UUNET (my former employer) to sanity check/security qualify equipment for connection to the backbone. The point of publishing the document is to start discussion. There is a mailing list set up: opsec(a)ops.ietf.org. Subscribe by sending a message to "majordomo(a)ops.ietf.org" with "subscribe opsec" in the body. The point of the document is to create a useful list that network operators can use to communicate their securtiy requirements to vendors. Please have a look and comment. Thanks, ---George Jones

1 0

Another hijacked range???
by Roy 11 Jun '03

11 Jun '03

Found this note in another mailing list.

2 1

RE: Minimum prefix length?
by Ejay Hire 11 Jun '03

11 Jun '03

This doesn't seem to be much of a problem with prefixes less than or equal to /24. Domestically, Verio is the big exception. They seem to filter anything longer than a /20. -Ejay -----Original Message----- From: Temkin, David [mailto:temkin@sig.com] Sent: Wednesday, June 11, 2003 2:04 PM To: nanog(a)merit.edu Subject: Minimum prefix length? A few years ago I had an issue with a few of the larger carriers rejecting my routes (from a natural Class B space) because their prefix length was too short (at one point I simply had the /16 divided into two /17's and this still got rejected in some places). I can't remember which carriers exactly, but it may have been some larger transit providers like AboveNet/etc. Anyone know what the current attitude is by carriers about this? Nowadays with ever-growing memory and CPU it doesn't seem like it's as much of an issue. In an environment where we're all trying to conserve address space watching natural boundries doesn't seem all that smart. IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

2 1

FW: Minimum prefix length?
by Temkin, David 11 Jun '03

11 Jun '03

Randy - please stop sending these to me - you send me one every time I post to NANOG. If you don't like the signature that's appended to my emails (not by my choice), and the litigious society we live in, go ahead and block all email from me. Replies directly to you to stop sending me these emails have gone unanswered, which is why I am mentioning this here. -----Original Message----- From: Randy Bush [mailto:randy@psg.com] Sent: Wednesday, June 11, 2003 4:34 PM To: Temkin, David Subject: Re: Minimum prefix length? you have sent a message to me which seems to contain a legal warning on who can read it, or how it may be distributed, or whether it may be archived, etc. i do not accept such email, and have therefore deleted it. do not expect further response. randy IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

4 3

RE: FW: Minimum prefix length?
by Temkin, David 11 Jun '03

11 Jun '03

I'm glad to hear there is actually some precedent. As I mentioned to someone privately, I could go ahead and use a @yahoo.com or some other webmail service, but I prefer doing anything work related via email such as this "officially" rather than covertly. I may go ahead and switch at some point, though. Ironic, though, that you're 100% correct- that signature is going to be archived publically, which goes against what it claims. -----Original Message----- From: Stephen J. Wilcox [mailto:steve@telecomplete.co.uk] Sent: Wednesday, June 11, 2003 4:51 PM To: Temkin, David Cc: nanog(a)merit.edu Subject: Re: FW: Minimum prefix length? Whilst we're sidetracking... I took some counsel on this not so long ago to see whether these were just novelty signatures or if they were real legal stuff. Turns out they could actually be used legally, interesting I thought. Howevers its curious that signatures such as this claiming to be confidential are posted to a list which is very much public and archived in several public websites.. not sure how right it is to autoappend them to all your mails as well as the private ones! Steve On Wed, 11 Jun 2003, Temkin, David wrote: > > Randy - please stop sending these to me - you send me one every time I > post to NANOG. If you don't like the signature that's appended to my > emails (not by my choice), and the litigious society we live in, go > ahead and block all email from me. > > Replies directly to you to stop sending me these emails have gone > unanswered, which is why I am mentioning this here. > > > > -----Original Message----- > From: Randy Bush [mailto:randy@psg.com] > Sent: Wednesday, June 11, 2003 4:34 PM > To: Temkin, David > Subject: Re: Minimum prefix length? > > > you have sent a message to me which seems to contain a legal warning > on who can read it, or how it may be distributed, or whether it may be > archived, etc. > > i do not accept such email, and have therefore deleted it. do not > expect further response. > > randy > > > IMPORTANT:The information contained in this email and/or its > attachments is confidential. If you are not the intended recipient, > please notify the sender immediately by reply and immediately delete > this message and all its attachments. Any review, use, reproduction, > disclosure or dissemination of this message or any attachment by an > unintended recipient is strictly prohibited. Neither this message nor > any attachment is intended as or should be construed as an offer, > solicitation or recommendation to buy or sell any security or other > financial instrument. Neither the sender, his or her employer nor any > of their respective affiliates makes any warranties as to the > completeness or accuracy of any of the information contained herein or > that this message or any of its attachments is free of viruses. > > > IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

1 0

AS-701 multihop BGP peering session?
by Jeffrey Haas 11 Jun '03

11 Jun '03

I hate using NANOG as a NOC of last resort, but it looks like this is my best option. We recently migrated our IP connectivity to UU-Net/MCI/whatever you want to call them these days. I've migrated the majority of our BGP topology collection feeds to the new IP space (anyone want to give us your routes?) and decided that now we're a UU-Net customer, I'd try to get a feed from UU-Net. Apparently they only want to feed our border router, not the route collection host. If anyone has any suggestions on who to deal with at UU-Net that might have a little more clue on this type of situation, it would be appreciated. -- Jeff Haas NextHop Technologies

5 4

High Speed IP-Sec
by Leo Bicknell 11 Jun '03

11 Jun '03

I'm looking for a high speed (300-1000Mbps) IPSec solution. I need basic functionality only, a frame in one side pops out the other side. For the moment I don't care if this is a layer 2 or a layer 3 device. For the application in mind it's just between two points. I need a supported product, not some home-grown set of bits, and cost is the major factor. Most units at this speed do a lot of other stuff (firewall features, vpn clients, ids, other junk), and cost a lot of money as a result. Since there are FreeBSD/Linux boxes getting close to that throughput with accelerator cards I figure someone has to make the stripped down solution for a reasonable price. Any pointers welcomed. -- Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

4 4