- NANOG - lists.nanog.org

Re: OpenSSL
by Michael.Dillon＠radianz.com 18 Mar '03

18 Mar '03

> This is a new attack, not the one Schneier was talking about. It's > very elegant work -- they actually implemented an attack that can > recover the long-term private key. The only caveat is that their > attack currently works on LANs, not WANs, because they need more > precise timing than is generally feasible over the Internet. Hmmm... This means that it is safer for senior managers in a company to communicate using private ADSL Internet connections to their desktops rather than using a corporate LAN. Very interesting. Could IP Centrex be the wave of the future? Will ISPs offer random jitter insertion guarantees on such a service to foil people using timing attacks? --Michael Dillon

4 5

of marginal oper. interest [bgp reflecting actual traffic flow (or not)]
by k claffy 18 Mar '03

18 Mar '03

sent to e2e hoping thread pursued on only one mailing list but wasn't sure which one would hate it more. fwiw. critical feedback/corrections/thoughts welcome k ----- Forwarded message from k claffy <kc(a)caida.org> ----- Date: Mon, 17 Mar 2003 21:26:30 -0800 From: k claffy <kc(a)caida.org> Subject: bgp reflecting actual traffic flow (or not) To: end2end-interest(a)postel.org Cc: Rajesh Talpade <rrt(a)research.telcordia.com> 8 months may be my record for email latency impressive huh On Tue, Jul 02, 2002 at 09:27:50PM -0400, Rajesh Talpade wrote: > kc wrote: > would recommend against assumptions of either symmetric paths > or bgp reflecting actual traffic flow > unless you're writing science fiction always wondered about what new career i could launch into! :-) seriously, what's a good reference for your second point about bgp not reflecting actual traffic flow? preliminary tech report finally up, have not wanted to publish till we had more complete results but that might not be in community's best interest so here: http://www.caida.org/outreach/papers/2003/ASP/ (also linked from 'what's new' on caida.org) remark reckon it's not going to surprise any operators, and it's still only a piece of the interdomain alchemistry, but there we bgp k ----- End forwarded message -----

1 0

OpenSSL
by Len Rose 18 Mar '03

18 Mar '03

More OpenSSL (and SSH) fun. http://lists.netsys.com/pipermail/full-disclosure/2003-March/004524.html AND http://lists.netsys.com/pipermail/full-disclosure/2003-March/004529.html

3 3

RE: Nortel SHASTA
by Alan Sato 17 Mar '03

17 Mar '03

I use this product. I think they still sell this product especially in dsl enviroments. Good for the pptp and ppoe stuff. Alan You can contact me directly at asato(a)altrio.net. -----Original Message----- From: Petri Helenius [mailto:pete@he.iki.fi] Sent: Monday, March 17, 2003 11:01 AM To: nanog(a)merit.edu; Gerard White Subject: Re: Nortel SHASTA > > Is there anyone out there in the NANOG community who uses the Nortel SHASTA > box for aggregation that would like to technically chat offline? > Didn´t nortel more or less kill or suffocate the product quite quickly after the aquiring the company? (as they did Promatory) Pete

1 0

New MS and CERT Warning
by Eric Germann 17 Mar '03

17 Mar '03

CERT and MS have posted advisories and patches on a new vulnerability in IIS and Win2K. Particualrly interesting is that it took everyone by surprise (black hats had it first) and they selectively targeted .mil machines. More info on the below URL's. Everyone ready for the latest round of attack mitigation procedures? http://www.msnbc.com/news/886524.asp?0cv=CB10 http://www.cert.org/advisories/CA-2003-09.html http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/ bulletin/ms03-007.asp ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert OH 45801 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "The fact that there are actually ways of knowing and characterizing the extent of one’s ignorance, while still remaining ignorant, may ultimately be more interesting and useful to people than Yarkovsky" -- Jon Giorgini of NASA’s Jet Propulsion Laboratory

1 0

Re: OpenSSL
by Stewart, William C (Bill), SALES 17 Mar '03

17 Mar '03

Steve Bellovin wrote: > The only caveat is that their attack currently works on LANs, not WANs, > because they need more precise timing than is generally feasible over the Internet. On the other hand, many of the SSL servers on the web are located in hosting centers, which are LAN-connected to potential attackers who can get accounts on machines in the same hosting centers. The attackers' and targets' servers tend to have routers in front of them, as well as the switches provided by the hosting center, but it's still much more precise than the open net.

1 0

Nortel SHASTA
by Gerard White 17 Mar '03

17 Mar '03

Greetings. Is there anyone out there in the NANOG community who uses the Nortel SHASTA box for aggregation that would like to technically chat offline? Regards, Gerard White Aliant

2 1

RE: Controlling outbound traffic in a multihomed BGP environment
by Ejay Hire 17 Mar '03

17 Mar '03

Routing based on source address is called "Policy Routing". IF you are on a cisco box, create an extended access-list specifying the source Ip's, and then match that access list in a route map to set the next hop. Apply the route map on ports facing that customer, building a chain from edge (facing the customer) to border (facing the internet. Good Luck, Ejay -----Original Message----- From: Daniel Abbey [mailto:dabbey@edeltacom.net] Sent: Monday, March 17, 2003 10:20 AM To: nanog(a)merit.edu Cc: cisco-digest(a)groupstudy.com; isp-outsourcing(a)isp-outsourcing.com Subject: FW: Controlling outbound traffic in a multihomed BGP environment How can you control outbound traffic from a single subnet - meaning forcing all its outbound traffic out a single bgp edge router in a multihomed environment. Here is the scenario: 1. Inbound traffic is engineered using prepends - meaning to force inbound traffic through a particular router, we are using prepends to make one path seem better than the other on the outside. 2. Local preferences are set to control general outbound traffic to specific ISPs - those that are one or two hops away. 3. Now, I have a customer whose traffic I'll prefer to force out a single bgp edge router - all his traffic, no specific ones. The IGP is OSPF, and there are several different distribution routers between the access IGP router and the core/edge bgp routers.

1 0

FW: Controlling outbound traffic in a multihomed BGP environment
by Daniel Abbey 17 Mar '03

17 Mar '03

How can you control outbound traffic from a single subnet - meaning forcing all its outbound traffic out a single bgp edge router in a multihomed environment. Here is the scenario: 1. Inbound traffic is engineered using prepends - meaning to force inbound traffic through a particular router, we are using prepends to make one path seem better than the other on the outside. 2. Local preferences are set to control general outbound traffic to specific ISPs - those that are one or two hops away. 3. Now, I have a customer whose traffic I'll prefer to force out a single bgp edge router - all his traffic, no specific ones. The IGP is OSPF, and there are several different distribution routers between the access IGP router and the core/edge bgp routers.

1 0

Re: Issue with 208.192.0.0/8 - 208.196.93.0/24?
by Dr. Jeffrey Race 17 Mar '03

17 Mar '03

On Mon, 10 Mar 2003 19:14:07 -0800, chuck goolsbee wrote: >Forgive the intrusion... Forgiven >We have a customer who uses some merchant services off of >208.196.93.204, which seems to be unreachable via any location I try. >Emails to UUnet's NOC are unaswered and the guy I talked to on the >phone @ UU wouldn't open a ticket because I'm not a customer (but his >traces were dying in the same place as mine: > >207.ATM6-0.GW11.NYC1.ALTER.NET (152.63.29.185)) > >Can anybody out there hit that IP (208.196.93.204) at the moment? Or >indeed much of anything in that /8 [C:\]ping 208.196.93.204 PING 208.196.93.204: 56 data bytes ----208.196.93.204 PING Statistics---- 7 packets transmitted, 0 packets received, 100% packet loss [C:\]tracerte 208.196.93.204 0 192.168.1.1 (192.168.1.1) 0 ms 0 ms 0 ms 1 192.168.1.1 (192.168.1.1) 0 ms 0 ms 8 ms 2 10.20.12.9 (10.20.12.9) 55 ms 55 ms 55 ms 3 ppp-203.144.161.5.revip.asianet.co.th (203.144.161.5) 39 ms 5 4 ppp-203.144.144.157.revip.asianet.co.th (203.144.144.157) 54 m ms 5 ppp-203.144.144.2.revip.asianet.co.th (203.144.144.2) 242 ms s 6 211.180.13.225 (211.180.13.225) 133 ms 133 ms 125 ms 7 210.120.192.136 (210.120.192.136) 133 ms 133 ms 132 ms 8 203.255.234.198 (203.255.234.198) 258 ms 203.255.234.210 (203. 266 ms 203.255.234.198 (203.255.234.198) 266 ms 9 203.255.234.36 (203.255.234.36) 250 ms 258 ms 258 ms 10 67.104.60.49 (67.104.60.49) 258 ms 258 ms 281 ms 11 p4-3-0.MAR2.Fremont-CA.us.xo.net (207.88.80.13) 258 ms 258 12 p4-0-0.RAR2.SanJose-CA.us.xo.net (65.106.5.137) 273 ms 266 13 p0-0-0-1.RAR1.SanJose-CA.us.xo.net (65.106.1.65) 266 ms 281 14 p0-0.IR1.PaloAlto-CA.us.xo.net (65.106.5.194) 273 ms 336 ms 15 206.111.12.150 (206.111.12.150) 265 ms 266 ms 258 ms 16 157.at-5-1-0.XR1.SAC1.ALTER.NET (152.63.51.58) 1031 ms 273 17 0.so-0-1-0.XL1.SAC1.ALTER.NET (152.63.53.241) 266 ms * 281 18 0.so-3-0-0.TL1.SAC1.ALTER.NET (152.63.53.250) 273 ms 274 ms 19 0.so-1-2-0.TL1.NYC9.ALTER.NET (152.63.10.77) 352 ms 335 ms 20 0.so-3-0-0.XL1.NYC1.ALTER.NET (152.63.27.29) 321 ms 321 ms 21 0.so-0-0-0.XR1.NYC1.ALTER.NET (152.63.19.85) 336 ms 336 ms 22 207.ATM6-0.GW11.NYC1.ALTER.NET (152.63.29.185) 360 ms 352 m 23 * * * 24 * [dies] [C:\]host 208.196.93.204 208.196.93.204 = ecobeauty.org Jeffrey Race

6 5