- NANOG - lists.nanog.org

More Gifts for a CTO who has everything ...
by Eric Brunner-Williams in Portland Maine 01 Apr '03

01 Apr '03

This week's puzzle ... What is symmetry? The mail relay for a defunct ISP with some 20k users has between 100k and 200k instances of sendmail journaled per day. At any point in time, there are about 1k entries in the host's proctable, 80% are the MTA, and a few connections/sec to port 25, with default MTA rules for open-relays, blacklists, etc. The host is an E250, running Solaris 2.6, with historically problematic roll-your-own-RAID. The load average is nearly zero. iostat and vmstat show nominal load, only 700 users are actually "getting mail", and with a multi-day delay observed anectdotally. ... Asymetric dns (forward and reverse paths with differing SOAs), plus rate limiting at the access router for all forward maps, can result in serious disfunction. Fixing the CTO's dns brought the proctable count down to sub-100. For what it is worth, this is the most horked machine I've ever seen. I decided not to try and explain this one. >From the post to nanog of the 25th, "Gifts for a CTO who has everything ..." (nmap 10.0.0.0/8 has side effects) "Does life get any better than this" Best humor reply: Setup peering with a new provider that PROXY ARPs all your destinations. Second place (tie): LART the sucker, and the perenial foam bat. Best psychology reply: ... find a high-intensity clueino source? But clueinos interact very weakly with that sort of matter... The CTO's actual reply was "Do we have load that high? Were we being attacked by some script kiddies?? Very, very weak interaction. Cheers, Eric

1 1

FC: Colorado state senate delays vote on "mini-DMCA" bill
by Gregory Hicks 01 Apr '03

01 Apr '03

FYI... ------------- Begin Forwarded Message ------------- Date: Tue, 01 Apr 2003 10:15:36 -0500 To: politech(a)politechbot.com From: Declan McCullagh <declan(a)well.com> Subject: FC: Colorado state senate delays vote on "mini-DMCA" bill ---- Date: Mon, 31 Mar 2003 15:39:14 -0700 To: Declan McCullagh <declan(a)well.com> From: Charles Oriez <coriez(a)oriez.org> Subject: state DMCA - delayed in Colorado Thanks to the publicity on the politech list over the weekend, a couple of state senators heard from their constituents yesterday, and the Colorado version of the legislation (HB1303) was laid over for a week. It had been scheduled for final passage in the State Senate today. Of course now the folks who raised the issue in the first place have to finish the job. It isn't dead, merely delayed. http://www.leg.state.co.us/2003a/inetcbill.nsf/fsbillcont/A2F0DA113DF2BFC08… charles oriez coriez(a)oriez.org 39 34' 34.4"N / 105 00' 06.3"W ** --- Date: Mon, 31 Mar 2003 00:10:40 -0500 From: Peter Olsen <pcolsen(a)comcast.net> Subject: RE: An analysis of Michigan and Colorado "mini-DMCA" bills In-reply-to: <5.1.1.6.0.20030330100203.01f1db70(a)mail.well.com> To: declan(a)well.com Cc: balunis(a)buffnet.net, Charles Loukus <cloukus(a)earthlink.net>, Jon Christopher Olsen <joncolsen(a)bigfoot.com>, Eric Carl Olsen <olsenec(a)valero.com>, Seth Olsen <solsen(a)students.uiuc.edu>, Jeff Olsen <jolsen(a)c-hmfg.com>, Randy Olsen <rolsen(a)c-hmfg.com>, James Beaupre <beaupre(a)mit.edu>, Lou Marinelli <lmm1442(a)yahoo.com>, Ruben William Duran <duranr(a)umich.edu> Message-id: <000a01c2f743$df899340$0301a8c0@waldo> Declan, Although I'm not (and never have been) a lawyer, I think there is a danger of these laws becoming "charges of opportunity" Suppose someone is accused of another crime for which there is not sufficient evidence to sustain a charge, but law enforcement finds evidence of a VPN or a router employing network address translation. Would this evidence be enough to sustain a further search warrant? Suppose law enforcement authorities gain access to a computer for another purpose and find encrypted files. Could those files be construed as an attempt to conceal the "origin or destination of a communication service"? This last example brings up the problem of "If you're not guilty, prove your innocence. Just decrypt the files for us." I understand that this is a common tactic, even though it seems to fly in the face of my (engineering) understanding of the Fifth Amendment Take these comments for what they're worth. I have an agreement with some of my lawyer friends: I don't practice law and they don't practice engineering. We all believe the public is safer for both sides of the understanding. Peter Olsen, P.E. pc_olsen(a)yahoo.com --- Date: Sun, 30 Mar 2003 15:13:04 -0800 To: declan(a)well.com From: "A.Lizard" <alizard(a)ecis.com> Subject: Re: FC: An analysis of Michigan and Colorado "mini-DMCA" bills At 10:02 AM 3/30/03 -0500, you wrote: Sounds like making sure that this law is rigorously enforced against its biggest violators would be the fastest way to get it off the books and to make sure it doesn't get reintroduced anywhere else. The options for the organizations in violation would be either to close down or move to somewhere where they can do business. The biggest violators would be large corporations and the Michigan state government. Are there any IT shops of substantial size that *don't* violate this law? Collecting proof should be easy enough, but some organization to systematically tell the rest of us what to look for and where to send it would be helpful. Forcing government to act on this might be more difficult. Perhaps the EFF or one of the other activist organizations might have some ideas about that. A.Lizard --- Date: Sun, 30 Mar 2003 22:44:55 -0500 From: Dave Emery <die(a)die.com> To: Declan McCullagh <declan(a)well.com> Cc: cypherpunks(a)lne.com Subject: Re: FC: An analysis of Michigan and Colorado "mini-DMCA" bills On Sun, Mar 30, 2003 at 10:02:12AM -0500, Declan McCullagh wrote: There is another side to the MPAA's super-DMCA state legislation. In addition to its impact on use of encryption, vpns, firewalls and so forth it also sets forth new non-federal restrictions on possession and used of radio receiving equipment. While some of your readership may have different perspectives on this, it appears that several of these mini=DMCA bills might well be read to ban ownership or use of Big Ugle Dish (BUD) type TVRO satellite dish setups, or at least those used for private viewing of unscrambled sports backhauls and newsfeeds as opposed to being subscribed to scrambled programming services. This private viewing has been generally legal under federal law (Satellite Viewers Rights Act), but very few of the program providers have actually given any kind of express consent for the public to watch and thus the mini-DMCA provisions requiring such consent would possibly render even possession of such dishes illegal in states where such laws are in effect. And while the argument is more stretched, it also seems that someone might argue that police scanners used to monitor public safety communications (expressly permitted under federal law) might fall under this rubric too, as the public safety agencies may not have give express consent. Under the Mass. bill this would criminalize mere possession of such radio equipment. -- Dave Emery N1PRE, die(a)die.com DIE Consulting, Weston, Mass 02493 PGP fingerprint 1024D/8074C7AB 094B E58B 4F74 00C2 D8A6 B987 FB7D F8BA 8074 C7AB ------------------------------------------------------------------------- POLITECH evening reception in New York City at 7 pm, April 1, 2003 at CFP: http://www.politechbot.com/events/cfp2003/ ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ Declan McCullagh's photographs are at http://www.mccullagh.org/ Like Politech? Make a donation here: http://www.politechbot.com/donate/ ------------------------------------------------------------------------- ------------- End Forwarded Message ------------- ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3400 San Jose, CA 95134 | Internet: ghicks(a)cadence.com "The trouble with doing anything right the first time is that nobody appreciates how difficult it was." When a team of dedicated individuals makes a commitment to act as one... the sky's the limit. Just because "We've always done it that way" is not necessarily a good reason to continue to do so... Grace Hopper, Rear Admiral, United States Navy

1 0

RE: State Super-DMCA Too True
by Kuhtz, Christian 01 Apr '03

01 Apr '03

> > In other words, you reasoning is quite flawed the way I see it, and > > blocking DoS is indeed legitimate and legally supportable. Excesses > > are rarely protected by any legal statutes. > > To the extent a customer attacks or defrauds the carrier itself, protection > measures are allowed. But you cannot "protect" the public at large without > a court order to do so. I think that's what I said. "excesses are rarely protected by any legal statutes." Any response must be measured by a given cause. ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers."

1 0

RE: Curing the BIND pain
by Michael.Dillon＠radianz.com 01 Apr '03

01 Apr '03

> and then send it to the IETF's DNS WG's as a request. >Tell them what you need to accomplish and not how to do it, >and they will build a protocol to satisfy this request Really!? "They" will build a protocol for us!?!?!? And just who do you think the IETF are, hmmm? Reminds me of the Pogo cartoonist Walt Kelly who said, "We have met the enemy and he is us!". May I suggest that all this advice about what "we" should be doing is rather out of place on the NANOG list. This list is to discuss Internet operational stuff that impacts North American Network Operators. Operational stuff is usually technical and it usually is here and now rather than some indeterminate point in the future. This isn't the rules of NANOG, it's just the way things are around here. Anything that falls too far outside of this core focus just doesn't get the list fired up enough to do anything beyond talk and complaining. If you want to change the world, create new protocols or build an working group on some topic or other, you really shouldn't try to do it on NANOG because it just ain't gonna work. You may think that NANOG is in a rut and that's quite true but it is a comfortable rut and one that provides enough benefit to the NANOG participants to keep it going more or less the same way as it has for years. There definitely is room in the world for all of the things that have been discussed recently, it's just that NANOG isn't a particularly fruitful place to discuss them because you won't find enough recruits here to form a critical mass. If you truly are serious about some of these things then you will take the discussion off the NANOG list and make a serious effort to create a working group with a real action plan. Anything else is just posturing and we've seen it all before. It does not impress us. Thanks, --Michael Dillon P.S. No, I'm not the NANOG police; I'm just stating my opinion.

2 1

RE: State Super-DMCA Too True
by Kuhtz, Christian 01 Apr '03

01 Apr '03

> From: Stephen Sprunk [mailto:stephen@sprunk.org] [..] > Common carrier status exists for this very reason. Unfortunately, it > probably means we'll have to stop filtering things like spam and DoS, since > filtering on content inherently violates common carrier protection -- see > the smut suit against AOL a few years ago. Come on, don't go lumping DoS and smut into the same basket. You can't be possibly serious about considering the two to be equals. In other words, you reasoning is quite flawed the way I see it, and blocking DoS is indeed legitimate and legally supportable. Excesses are rarely protected by any legal statutes. Thanks, Christian ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers."

5 9

Curing the BIND pain
by Michael.Dillon＠radianz.com 01 Apr '03

01 Apr '03

Let's assume that BIND has a way to know when it is dangerously out of date. The mechanism used would be up to ISC and I'll admit that it would probably involve some sort of DNS records in an ISC-run domain because that's the only way that has a high likelihood of working given the number of firewalls and caching nameservers that may be between a given BIND box and ISC. Seems to me that ISC has always maintained that there are two version numbers, one 4.x and one 8.x, that are always the oldest ones you can run and still be secure against known exploits. So the info stored in the ISC DNS server really doesn't need to be more than those two version numbers. OK, now assume that we have a BIND server which has detected that it is out of date and at risk of attack. What should it do? Well, first of all, what would a human being do if if realised that it was at risk of attack and they had no means of contacting their friends or the police. A child might cry out and an adult might yell for help in case someone was near enough to hear. BIND is in a similar situation. It doesn't know if there is anyone looking after it but it is hurting, so let's make it cry out. I suggest that an appropriate technique would be for the BIND server to originate traffic on it's local subnet that would look suspicious and possibly trigger intrusion alarms. Send out some packets to the broadcast address. Do some portscanning of all addresses on the subnet. Find any open port 80 and retrieve a URL containing BIND/server/at/10.7.7.1/has/security/vulnerability, find any open port 25 and send email to postmaster containing the same message, etc. Not enough traffic to be a DoS but enough to show up in various logs in case someone is looking at some of them. Even then, this is still a string and sealing wax solution. It's situations like this that demonstrate just how primitive our supposedly high technology really is. --Michael Dillon

4 3

Re: [internet.com]
by Joshua Smith 01 Apr '03

01 Apr '03

"Michael Painter" <tvhawaii(a)shaka.com> wrote: > > Anyone else having trouble with reaching internet.com via genuity? > i've heard that level3 is doing some work to re-AS genuity - didn't really pay attention to when it started or how long it would be going on, but it may be part of the reason > Pinging 63.236.73.147 with 32 bytes of data: > > Reply from 4.25.112.2: TTL expired in transit. > Reply from 4.25.112.2: TTL expired in transit. > Reply from 4.25.112.2: TTL expired in transit. > Reply from 4.25.112.2: TTL expired in transit. > > Ping statistics for 63.236.73.147: > Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), > Approximate round trip times in milli-seconds: > Minimum = 0ms, Maximum = 0ms, Average = 0ms > > "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

internet.com
by Michael Painter 01 Apr '03

01 Apr '03

Anyone else having trouble with reaching internet.com via genuity? Pinging 63.236.73.147 with 32 bytes of data: Reply from 4.25.112.2: TTL expired in transit. Reply from 4.25.112.2: TTL expired in transit. Reply from 4.25.112.2: TTL expired in transit. Reply from 4.25.112.2: TTL expired in transit. Ping statistics for 63.236.73.147: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms

5 6

Evil Intent
by Baldwin, James 01 Apr '03

01 Apr '03

ftp://ftp.rfc-editor.org/in-notes/rfc3514.txt Have a merry April NANOG.

1 0

Re: internet.com
by Michael Painter 01 Apr '03

01 Apr '03

Tracing route to 63.236.73.147 over a maximum of 30 hops 1 31 ms 47 ms 32 ms adsl-linking.flex.com [10.20.124.1] 2 32 ms 31 ms 47 ms s5-9.hnllhi1-cr3.bbnplanet.net [4.25.157.41] 3 78 ms 94 ms 78 ms p3-0.lsanca2-cr3.bbnplanet.net [4.0.7.69] 4 78 ms 94 ms 78 ms p1-0.lsanca2-br1.bbnplanet.net [4.0.7.58] 5 93 ms 78 ms 79 ms p1-0.lsanca2-cr2.bbnplanet.net [4.25.112.1] 6 94 ms 78 ms 94 ms p0-0.lsanca2-br1.bbnplanet.net [4.25.112.2] 7 78 ms 79 ms 93 ms p1-0.lsanca2-cr2.bbnplanet.net [4.25.112.1] 8 93 ms 78 ms 79 ms p0-0.lsanca2-br1.bbnplanet.net [4.25.112.2] 9 94 ms 78 ms 78 ms p1-0.lsanca2-cr2.bbnplanet.net [4.25.112.1] [snip] 28 78 ms 93 ms 94 ms p0-0.lsanca2-br1.bbnplanet.net [4.25.112.2] 29 79 ms 93 ms 94 ms p1-0.lsanca2-cr2.bbnplanet.net [4.25.112.1] 30 78 ms 94 ms 78 ms p0-0.lsanca2-br1.bbnplanet.net [4.25.112.2] ----- Original Message ----- From: "Joe" <joej(a)rocknyou.com> To: "Michael Painter" <tvhawaii(a)shaka.com> Sent: Monday, March 31, 2003 5:38 PM Subject: Re: internet.com > Don't know about Genuity, but from ATT no expires but an unusual response: > ping internet.com > PING internet.com (63.236.73.147) from 192.168.1.2 : 56(84) bytes of data. > >From 63.236.93.180 icmp_seq=1 Packet filtered > > --- internet.com ping statistics --- > 16 packets transmitted, 0 received, +1 errors, 100% loss, time 15005ms > > Traceroute dies too: > 6 tbr1-p013401.cb1ma.ip.att.net (12.122.11.193) 13.934 ms 14.451 ms > 13.535 > ms > 7 tbr2-p013701.n54ny.ip.att.net (12.122.10.22) 17.536 ms 18.327 ms > 19.759 m > s > 8 gar4-p390.n54ny.ip.att.net (12.123.3.6) 22.599 ms 17.816 ms 18.772 ms > 9 att-gw.ny.qwest.net (192.205.32.170) 18.239 ms 19.638 ms 18.117 ms > 10 jfk-core-02.inet.qwest.net (205.171.230.22) 18.086 ms 18.516 ms > 18.724 ms > 11 ewr-core-01.inet.qwest.net (205.171.8.245) 17.110 ms 18.815 ms 22.078 > ms > 12 ewr-cntr-01.inet.qwest.net (205.171.17.146) 21.773 ms 20.730 ms > 17.912 ms > 13 msfc-22.ewr.qwest.net (63.146.100.34) 19.377 ms 17.880 ms 20.138 ms > 14 63.236.93.180 (63.236.93.180) 24.246 ms !X * * > 15 * > > Odd > -Joe > > ----- Original Message ----- > From: "Michael Painter" <tvhawaii(a)shaka.com> > To: <nanog(a)merit.edu> > Sent: Monday, March 31, 2003 10:21 PM > Subject: internet.com > > > > > > Anyone else having trouble with reaching internet.com via genuity? > > > > Pinging 63.236.73.147 with 32 bytes of data: > > > > Reply from 4.25.112.2: TTL expired in transit. > > Reply from 4.25.112.2: TTL expired in transit. > > Reply from 4.25.112.2: TTL expired in transit. > > Reply from 4.25.112.2: TTL expired in transit. > > > > Ping statistics for 63.236.73.147: > > Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), > > Approximate round trip times in milli-seconds: > > Minimum = 0ms, Maximum = 0ms, Average = 0ms > > >

1 0