- NANOG - lists.nanog.org

Re: Interesting Announcements
by miltonningis＠hushmail.com 03 May '03

03 May '03

On Sat, 03 May 2003 06:45:50 -0700 Matthew McGehrin <mcgehrin(a)reverse.net> wrote: >I think the problem is with ARIN, even if you 'transfer' your IP >space to >another owner, the original Date still appears on the whois information. > I think the problem is that you don't understand what "stealing" means, and that you/your employer is actively engaged in doing it. >My point was, if you have enough money, for a fee, anything is possible >from >Arin. > >-- Matthew > >----- Original Message ----- >From: <miltonningis(a)hushmail.com> >To: <mcgehrin(a)reverse.net> >Sent: Saturday, May 03, 2003 9:41 AM >Subject: Re: Interesting Announcements > > >> I didn't get the annoucement from ARIN that you can just get as >much >> IP space as you want, so that you have extra... > > > Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

2 1

Re: Interesting Announcements
by miltonningis＠hushmail.com 03 May '03

03 May '03

Matthew McGehrin wrote: > I think your barking up the wrong tree on this paranoid rant. > > I did some consulting for this company, and I find it hard to believe with > 14 racks of equipment that they would have a 'stolen' /16 > > http://www.vmxnetworks.com/ You actually believe "14 racks of equipment" can justifiably use 65025 ips? Did you read william(a)elan.net's comments on this? I don't know it for fact, but I believe he's correct, and in the case that he's right, these IP's are the property of Lucent and are, in fact, stolen. Also, perhaps Internap (AS10910) might explain the story behind seemingly stolen ASN 8143 and their many seemingly stolen IP blocks... Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Re: Interesting Announcements
by Jeffrey Race 03 May '03

03 May '03

On Sat, 03 May 2003 05:15:35 -0400, Phil Rosenthal wrote: >Not only that, but this design is STOLEN from my company! >www.isprime.com > >Stolen so poorly, they even say "ISPrime" in a few places. You are going to file a police report, I trust? Jeffrey Race

1 0

It's Friday evening (in North America) so you know what to expect
by Richard Cox 03 May '03

03 May '03

This evening it appeared that AS 9929 (China Netcom Corporation) had started to BGP announce the netblock "HCV": 152.147.0.0/16 That netblock is assigned by ARIN to OrgName: Housing and Construction Victoria OrgID: HCV Address: GPO Box 1670N Address: Melbourne, Victoria 3001 Country: AU NetRange: 152.147.0.0 - 152.147.255.255 CIDR: 152.147.0.0/16 NetName: HOUSINGVIC NetHandle: NET-152-147-0-0-1 Parent: NET-152-0-0-0-0 NetType: Direct Assignment RegDate: 1991-08-23 Updated: 1991-08-23 TechHandle: TL152-ARIN TechName: Lewis, Terry TechPhone: +61 3 669 1028 Housing and Construction Victoria are most certainly not in China. Given the timing, the intention here hardly needs spelling out. Roland Verlander, who lives in Australia, very helpfully tells me: "The contact information is outdated, so I unfortunately cannot attempt to contact the original owner. I searched AUNIC for POCs with the name Terry Lewis but I only found other people named Terry Lewis. APNIC has no results on Terry Lewis." "The phone number isn't valid, all phone #s in Oz were changed to 8 digits a few years ago (that one's 7 digits) and old 7 digit numbers don't work anymore; +61 3 669 1028 would have been converted to either +61 3 8669 1028 or +61 3 9669 1028." (I checked - neither of those possibilities is a working number) "No entry in the phone book (white pages) for the name Terry Lewis. The organisation is not legally registered and I can't find a website for it, so I guess it no longer exists" From: http://www.cidr-report.org/cgi-bin/as-report?as=9929 Upstream Adjacent AS list for AS9929: AS4637 REACH Reach Network Border AS AS1 GNTY-1 Genuity AS7018 ATT-INTERNET4 AT&T WorldNet Services AS2516 KDDI KDDI CORPORATION AS3549 GBLX Global Crossing AS3356 LEVEL3 Level 3 Communications, LLC AS1239 SPRINTLINK Sprint AS3561 CWUSA Cable & Wireless USA AS701 ALTERNET-AS UUNET Technologies, Inc. Ladies and gentlemen, you may wish to adjust your routing. Richard Cox

3 3

realtime monitoring apps?
by Dan Hollis 02 May '03

02 May '03

Anyone know of decent realtime network monitoring applications similar to trafshow? Something can can realtime summarize traffic by originating ip (eg ip addresses of source hosts sorted by traffic volume) -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

4 4

Keeping track of those rascal spammers.
by just me 02 May '03

02 May '03

I've gotten a few emails curious about the MySQL output I sometimes refer to in posts. I just finished blowing the dust off a paper I wrote several months ago, documenting some of the antispam measures I've developed. I added some info about how I use a database to store historical info. It's been an invaluable tool not only for presenting clear evidence of abuse, but for efficiently maintaining access lists, as well. The paper is at http://www.snark.net/snarkspam.html It's not the most polished document, as its main purpose was for me to document the system for myself, but I hope it can provide some hints or techniques for other folks to deal with the spam problem. Matt Ghali On Thu, 1 May 2003, Jeremy T. Bouse wrote: Matt, I'm curious as I've seen you spitting out what seems to be MySQL query results as records of spam... I'd very much be interrested in what you have setup to allow you to do this... I'm using MySQL with my IDS but having spam attempts as well would be very helpful... Thanks in advance, Jeremy --mghali(a)snark.net------------------------------------------<darwin>< Flowers on the razor wire/I know you're here/We are few/And far between/I was thinking about her skin/Love is a many splintered thing/Don't be afraid now/Just walk on in. #include <disclaim.h>

1 0

Topics for Salt Lake City
by Susan Harris 02 May '03

02 May '03

Here are the talks we've scheduled so far for June: Tutorials --------- - ISP Security: Deploying and Using Sinkholes Barry Raveendren Greene, Cisco, and Danny McPherson, Arbor - Introduction to MPLS Joe Soricelli, Juniper - BGP Multihoming Techniques Philip Smith, Cisco - Deploying Interdomain IP Multicast Mike McBride, Cisco General Session --------------- - Lawful Interception: Should There be Standards? Jeff Schiller, MIT - XML Router Configs - Progress and Predictions (Panel) Randy Bush, IIJ, moderator - @Home Cable Backbone Deployment Experiences Cathy Wittbrodt - BGP Attack Trees - Real World Examples Sue Hares, NextHop - MPLS-Based Synchronous Traffic Shunt Yehudah Afek, Riverstone, and Roy Brooks, Cisco - IPv4/IPv6 Dual-Stack on Abilene Grover Browning, Indiana University - Implementation of ARIN's Lame DNS Delegation Policy Ed Lewis, ARIN - NRIC Best Practices for ISP Security Ross Callon, Juniper RESEARCH FORUM -------------- - Inter-provider Coordination for Real-Time Tracebacks Kathleen M. Moriarty, MIT - Achieving Record Speed Trans-Atlantic End-to-end TCP Throughput Les Cottrell, Stanford University Monday Evening BOFs ------------------- - Device Discovery Protocols Dave Ward, Cisco, and Pedro Roque Marques, Juniper, moderators - ISP Security BOF III Barry Raveendran Greene, Cisco, moderator More info here: http://www.nanog.org/mtg-0306/ PS - the hotel block ends on May 10. See you soon!

1 0

Re: CAR remote-trigger..
by haesu＠towardex.com 02 May '03

02 May '03

some people asked me to share.. This is pretty much the concluded thought for remotely triggered CAR. I haven't tested this at all though. still thinking this through before i test it in the lab... Note: all numbers here such as ASN's and ip's are made up for testing purposes On Customer router: ! hostname customer-gw ! router bgp 10 network 10.1.10.0 mas 255.255.255.0 redist static route-map DoSed nei 172.16.10.2 remote 20 nei 172.16.10.2 send-commun ! ip bgp-commun new ! ip route 10.1.10.56 255.255.255.255 Null0 254 tag 666 ! route-map DoSed per 10 match tag 666 set commun 10:31337 no-expo ! route-map DoSed per 20 ! On ISP edge: ! hostname aggr0 ! interface Serial2/0 description serial circuit to Customer bgp-policy source ip-qos-map rate-lim input qos-group 50 1544000 8000 8000 conform transmit exceed drop ! router bgp 20 table-map DoS-evasive nei 172.16.10.1 remote 10 nei 172.16.10.1 desc Customer nei 172.16.10.1 ebgp 2 nei 172.16.10.1 update-so loop0 ! ip bgp-commun new ! ip community-list 1 per 10:31337 ! ! route-map DoS-evasive per 10 match commun 1 set ip qos-group 50 ! route-map DoS-evasive per 20 ! -hc On Fri, May 02, 2003 at 11:46:00AM -0400, Eric Oosting wrote: > > Would you mind summarizing to the list? Others may be interested. > > -- > Eric Oosting eoosting(a)sockeye.com office:781-693-7041 > Network Engineer Network Eng and Operations Sockeye Networks > > On Fri, 2 May 2003 haesu(a)towardex.com wrote: > > > > > Hi, this is now figured out. A lot of people have provided assistance off-list. Thank you! > > > > -hc > > > > On Thu, May 01, 2003 at 12:59:22PM -0400, Haesu D. Jeon wrote: > > > > > > Uhh just to clarify... hehe > > > > > > I was talking about CAR as in committed access rate (the rate-limit commands on Cisco) , not as in automobile :-D > > > > > > Thanks, > > > -hc > > > > > > On Thu, May 01, 2003 at 11:33:30AM -0400, haesu(a)towardex.com wrote: > > > > > > > > My apologies if this has been discussed before... > > > > > > > > Do any of you have any real-world 'practical' examples of setup for having CAR remotely-triggered via BGP? > > > > > > > > > > > > Thanks, > > > > -hc > > -- Sincerely, Haesu J. TowardEX Technologies, Inc WWW: http://www.towardex.com E-mail: haesu(a)towardex.com

1 0

Guardian for ARIN
by Sean Donelan 02 May '03

02 May '03

Once upon a time, NSI handled both domain names and network addresses. NSI originally only checked the sender of the e-mail address matched its database. Spoofing the sender of an e-mail address is/was trivial, and eventually several domain names were hijacked by other unauthorized individuals. NSI added "Guardian" to their template process. Guardian permitted the points of contact (NIC-Handle) for objects in the NSI database to add a password (and allegedly a PGP key) to their records. Only templates using the correct password would be processed. Since NSI handled both names and numbers, a password on NIC-Handle protected both names and networks. ARIN was formed, and the duties associated with IP numbers (AS and IP addresses) were transfered to the new ARIN. However, Guardian or some alternative didn't seem to get transferred. So we're back to anyone who can spoof the point of contacts e-mail address can make changes to the ARIN records. Is it time for ARIN to re-add security to their database update procedures?

7 6

CAR remote-trigger..
by haesu＠towardex.com 02 May '03

02 May '03

My apologies if this has been discussed before... Do any of you have any real-world 'practical' examples of setup for having CAR remotely-triggered via BGP? Thanks, -hc

3 3