- NANOG - lists.nanog.org

RE: Vulnerbilities of Interconnection
by Kurtis Lindqvist 18 Sep '02

18 Sep '02

> I know that the capacity throughout the network I was working on > at the time was designed to handle peak loads with a comfortable > margin, and I would surmise that that is the case on many, if not > most networks. It seems obvious that the scope of the analysis of > this issue must include datacenters and servers, not only the net. > > Other than the electrical power issue in NYC, I don't recall any > loss of communications on 9/11/2001 that related directly to the > network. We where providing emergency transit services to operators in Europe during that day who lost parts or all of their transatlantic services. At the same time people where obviously relaying on the net for information (or we wouldn't have seen the congestions) but the net failed to deliver (congestions at the servers). So, perhaps it's time to start re-thinking what we did - to some extent I think that we already have. - kurtis -

1 0

How do you stop outgoing spam?
by Hank Nussbacher 18 Sep '02

18 Sep '02

Please try to keep this discussion technical and not diverge to opinions. I am not looking for opinions or religion. I am trying to find automated tools/systems/boxes that will stop spam from going *out* from an ISP. The ISP has no servers and allocates IP address space to downstream customers who spam. Yes, I know all about ACLs to block offending IPs. The ISP is willing to buy any box or system to stop outgoing spams and thereby stop constantly playing with ACLs. The spamming is usually done (but not only) from an Internet cafe where the spammer inserts a "spammer CD" and blasts away at open mail relays. When SMTP is blocked for that IP, they switch to HTTP and send the spam via MSN, Yahoo, Hotmail, Kukamail, Outblaze, Safe-mail, etc. to name just a few. Blocking port 80 is harder since it requires maintaining an ever larger list of free public web based mail systems or just block port 80 entirely. Technical solutions welcome. Thanks, Hank

29 76

Re: How do you stop outgoing spam?
by Dave Crocker 18 Sep '02

18 Sep '02

At 02:11 PM 9/16/2002 -0400, Greg A. Woods wrote: > > 2. The issue with email is authentication, not privacy. Authentication can > > be achieved can be achieved easily over port 25, without encryption. > >Well, no, not securely it can't. You cannot have a secure authenticated >service running over a raw TCP circuit across public networks. 1. You are adding to the requirement. No matter how reasonable or advisable, encryption (privacy) is a separate function from authentication. And the rationale for doing port 25 port blocking has to do with accountability, not privacy. 2. Just so there is no confusion, I meant encryption as in privacy (content encryption) rather than as part of an authentication mechanism. 3. SMTPAUTH does not require an alternate port, yet it is sufficient for ensuring accountability. Hence it is sufficient for dealing with the reason that port 25 is blocked, without requiring that it be blocked. > > Hence, blocking port 25 blocks legitimately validated email, > > as well as possible spam. > >Well, yes, but obviously that doesn't matter. This is the real world Dave. Thanks for noticing that. That is why I keep citing the impact on real, mobile users and the implication for such minor opportunities such as wireless hotspots. d/ ---------- Dave Crocker <mailto:dave@tribalwise.com> TribalWise, Inc. <http://www.tribalwise.com> tel +1.408.246.8253; fax +1.408.850.1850

3 3

Re: How do you stop outgoing spam?
by Dave Crocker 18 Sep '02

18 Sep '02

At 01:09 PM 9/18/2002 -0400, Greg A. Woods wrote: > > I guess the last 20 years of Internet use have been entirely invalid > > then. >Not necessarily -- it's a matter of what level of risk is acceptable in >a given scenario. Thank you. That was my point. It therefore is essential to pay attention to fixing only real-world problems that have an operational basis -- or an extraordinarily unacceptable downside -- before imposing significant change on a large installed base of users. >However we've now reached a point where spammers resort daily to theft >of service against remote mail server and to direct attacks against >target remote mail servers. As bad as that is, it is a long way from stealing connections. Entirely different technical basis. The current situation is technically trivial. Stealing connections is not. Perhaps that is why the former happens all the time and the latter does not. >You're pointing out that some users don't want to live with that more >restrictive framework. I am pointing out that there is a balancing act to perform, and that 100 million users is more than "some". And lest you note that all 100 million are not mobile, and that some mobile users are not inconvenienced, I'll respond that whatever the number is, the impact on mobile hotspot users should finish the question about scale of the impact. >I.e. you can do what you want to do if you use the right tools, but you >can't do it over TCP port 25. If you think a bit harder about your assertion, you will realize that the port number neither creates nor restricts the protection. All that changing the port number does is to impose guaranteed inconvenience on the entire population of mobile users. > > Too bad the 100 million current Internet users do not know that. >Indeed it is. Your kind of F.U.D. doesn't help any either. Noting the impact on the installed base of Internet users is FUD? And by the way... For all the supposed benefit of port blocking -- eg, we don't see as much dial-in spam sourcing -- do we have less spam in the world? Is spam less of a problem? So the inconvenience to mobile users has not solved or even reduced the global problem. Mechanisms for controlling globe-scaled misbehaviors need to be surgical in the care with which they are chosen and applied. Outbound port blocking is a blunt instrument and it is swung blindly. d/ ---------- Dave Crocker <mailto:dave@tribalwise.com> TribalWise, Inc. <http://www.tribalwise.com> tel +1.408.246.8253; fax +1.408.850.1850

1 0

Re: How do you stop outgoing spam?
by Dave Crocker 18 Sep '02

18 Sep '02

At 11:27 AM 9/18/2002 -0400, Greg A. Woods wrote: >NO. Remote port-25 access, with or without SMTPAUTH, implies raw >unencrypted plain old TCP/IPv4, in which case there is no connection >integrity and thus no accountability. I guess the last 20 years of Internet use have been entirely invalid then. Too bad the 100 million current Internet users do not know that. d/ ---------- Dave Crocker <mailto:dave@tribalwise.com> TribalWise, Inc. <http://www.tribalwise.com> tel +1.408.246.8253; fax +1.408.850.1850

1 0

IPv6 revisited - I am building a list of IPv6 capable ISP's
by Joe Baptista 18 Sep '02

18 Sep '02

Hello: I am writing a second article on IPv6. My first article is indexed at http://www.circleid.com/articles/2533.asp I have tested IPv6 with the assistance if freenet6.net. It seems to work. In my second article I would like to include a list of ISP's who offer IPv6 to their customers. If you are an ISP that is IPv6 capable please drop me a line and I will include you in a list which will accompany the followup article. regards joe baptista The dot.GOD Registry, Limited http://www.dot-god.com/

2 2

N.I. Observer
by hostmaster 17 Sep '02

17 Sep '02

Anybody willing to share with me (off list) some experiences with Network Instruments' Observer and Analyst packs ? Rating A-E (A=best) perhaps ? As always obliged. Bert Fortrie hostmaster(a)nso.org

1 0

Port 2002
by Scott Call 17 Sep '02

17 Sep '02

Thanks for the quick response everyone, searching for "udp 2002" found way to many things at first, and then I found the info (within 1 minute of sending my email, of course). My apologies again for the time wasting :) -S

1 0

UDP Port 2002 DDOS?
by Scott Call 17 Sep '02

17 Sep '02

I apologize if this is an obvious question, but I've search bugtraq and other sources... I've had two customers complain today about massive amounts of incoming UDP traffic on port 2002. They appear to be some kind of DDOS or spoofed attack since the origin IPs on each packet are different. Is anyone else seeing something similar? Thanks -S -- Scott Call Router Geek, ATGi, home of $6.95 Prime Rib "Copyright Law is not a tool of repression granted to an unaccountable corporation by a corrupt congress at the expense of an ignorant public." -WW

1 0

RE: Testing BGP with real UPDATEs
by Vandy Hamidi 17 Sep '02

17 Sep '02

If you are testing the receipt of routes and inbound filtering, I just block all outbound advertisements and connect to an ISP or one of my border routers. That way you can test your filters and inbound access-lists and manipulate the BGP tables before putting the router into production. Hope that helps some, -=Vandy=- -----Original Message----- From: Sathya Perla [mailto:sperla@netplane.com] Sent: Tuesday, September 17, 2002 4:12 AM To: 'nanog(a)merit.edu' Subject: Testing BGP with real UPDATEs Hi, How is a BGP implementation tested with real Internet routing data (BGP UPDATEs)? Are there any experimental/test networks that can be connected to for testing a BGP implementation? Thanks, -Sathya

1 0