- NANOG - lists.nanog.org

RE: Sniffers/Analysers
by Brennan_Murphy＠NAI.com 20 Aug '02

20 Aug '02

For the list archives, this seems to be a moderately objective approach to that question: http://www.networkuptime.com/columns/guide/index.html -BM -----Original Message----- From: Dr. Mosh [mailto:nanog@zeromemory.com] Sent: Monday, August 19, 2002 6:29 PM To: nanog(a)merit.edu Subject: Sniffers/Analysers Anyone have recommendations for LAN analysers? (besides building a box and using tcpdump) Personal experiences, recommendations, etc...? Private reply works. Thanks -- -------------- http://www.zeromemory.com - metal for your ears.

1 0

Unrecognised packets
by cw 20 Aug '02

20 Aug '02

Hi there folks, sorry if you're on the securityfocus incidents list and have received another version of this but as this has protocol info I thought I might ask here. Background: Friday 9th I noticed my laptop running slowly and unstable. I assumed that applying SP3 had broken it so I reinstalled. Tue 13th I noticed logs in the firewall of my desktop which showed a prolonged scan of ports 50000-50099 on my desktop machine. The scan had originated from the ip of my laptop. After a bit of thinking, I remember my desktop firewall complaining about some other packets at the time. IIRC there were packets from my laptop set at ip protocol 60 hitting my desktop. I also remember some packets set at ip protocol 0 coming from external ip addresses (not of our network). I was busy with work at the time so I blocked the packets and subsequently forgot about them. Due to my wiping the laptop before noticing the firewall logs I was unable to figure out what had happened. The thing is, now I'm starting to see some activity I'm not expecting again. Prior to last week I was running Win2K on it with SP2 (upgraded to SP3 around the same time). When I reinstalled I put WinXP on. The laptop has been running Kerio as a firewall with as many services as possible turned off. Today my firewall has picked up another packet from my laptop that was ip protocol 60 (not port 60 but protocol 60). After spotting this I loaded up ethereal and started capturing. aa.bb.cc.dd = laptop ip dd.cc.bb.aa = desktop ip I'm not familiar with all the protocols involved, so if my searches are correct Q.931 is an ISDN control protocol. This is odd because this is coming over a lan and neither machines have any ISDN hardware or software. Secondly there is the IP packets with a header length of 0. I'm not sure if these are related but the reason I include them is because the source MAC addresses are only a slight variation on that of my laptop. That is my laptop starts 00:50 whilst these packets start 45:00. The rest is the same. All these packets were captured using the host aa.bb.cc.dd (where aa.bb.cc.dd eq laptop ip) filter (details in attachment). If anyone can advise me on the purpose of these packets I would appreciate it as to the best of my knowledge they have no valid purpose. Cheers.

2 2

Re: ASN registry?
by Philip Smith 20 Aug '02

20 Aug '02

Ralph, ARIN only handles the ASNs for North and South America, and the southern half of Africa. And has the records for most of the historical stuff from when before APNIC and RIPE NCC existed. Simple rule, if it isn't at ARIN, check APNIC and RIPE NCC databases. Telstra is in Australia, Australia is in the AP region, therefore not finding the entry in ARIN's db would sort of suggest to check APNIC next. Note that the delegation records for some of the ASNs assigned before APNIC and the RIPE NCC existed have been moved to the latter databases. Telstra is but one example. (I agree it might be more helpful if a query on whois.arin.net displayed a message saying "go look at whois.apnic.net" rather than saying "No match".) philip -- At 15:24 19/08/2002 -0400, Ralph Doncaster wrote: >I've always used whois.arin.net to check ASN registrations, and until now >it's always had information on those that I've checked. >It doesn't have anything for 1221, which according to >route-views.oregon-ix.net is Telstra. Is there a single complete database >that has ASN assignment info? > >Ralph Doncaster >principal, IStop.com

3 2

ASN registry?
by Ralph Doncaster 20 Aug '02

20 Aug '02

I've always used whois.arin.net to check ASN registrations, and until now it's always had information on those that I've checked. It doesn't have anything for 1221, which according to route-views.oregon-ix.net is Telstra. Is there a single complete database that has ASN assignment info? Ralph Doncaster principal, IStop.com

7 8

Re: Major Labels v. Backbones
by Jeff Ogden 20 Aug '02

20 Aug '02

I was looking at the text of the DMCA and came across the following which makes me much less optimistic that a court will toss out the RIAA's request for an injunction: Section 512(j)(1)(B) If the service provider qualifies for the limitation on remedies described in subsection (a [Limitation for Transitory Communications]), the court may only grant injunctive relief in one or both of the following forms: (i) An order restraining the service provider from providing access to a subscriber or account holder of the service provider's system or network who is using the provider's service to engage in infringing activity and is identified in the order, by terminating the accounts of the subscriber or account holder that are specified in the order. (ii) An order restraining the service provider from providing access, by taking reasonable steps specified in the order to block access, to a specific, identified, online location outside the United States. However, the following section may offer some hope: Section 512(j)(2) Considerations.-The court, in considering the relevant criteria for injunctive relief under applicable law, shall consider- (A) whether such an injunction, either alone or in combination with other such injunctions issued against the same service provider under this subsection, would significantly burden either the provider or the operation of the provider's system or network; (B) the magnitude of the harm likely to be suffered by the copyright owner in the digital network environment if steps are not taken to prevent or restrain the infringement; (C) whether implementation of such an injunction would be technically feasible and effective, and would not interfere with access to noninfringing material at other online locations; and (D) whether other less burdensome and comparably effective means of preventing or restraining access to the infringing material are available. I think a backbone provider could argue (A) that a requirement that it block a site would be a significant burden unless all other backbone providers are also required to block the same site, (C) that blocking a single IP address or even a small range of IP addresses isn't likely to be effective for very long and blocking larger IP address ranges or an entire AS is likely to interfere with access to noninfringing material at other online locations, and (D) that at least attempting to work with the network provider that is actually providing service to the infringing site or working through more traditional international copyright enforcement mechanisms are less burdensome and possibly more effective means of preventing access to the infringing material. -Jeff >Date: Sat, 17 Aug 2002 15:31:03 -0400 >To: NANOG(a)merit.edu >From: Jeff Ogden <jogden(a)merit.edu> >Subject: Re: Major Labels v. Backbones >Sender: owner-nanog(a)merit.edu > >At 11:23 PM -0700 8/16/02, Jim Hickstein wrote: >>--On Friday, August 16, 2002 10:03 PM -0400 John Ferriby >><john(a)ferriby.com> wrote: >>>If there are any legal eagles here, can a Common Carrier be a contributing >>>infringer? >> >>IANAL, but last I looked -- admittedly a long, long time ago -- >>ISPs were not afforded protection as common carriers (18 USC?), no >>matter how much they tried to act like them. Has this changed? > > >I agree that ISPs aren't common carriers in the legal sense, but an >ISP's liability under U.S. copyright law is limited for "transitory >communications". The following is taken from a December 1998 >publication "THE DIGITAL MILLENNIUM COPYRIGHT ACT OF 1998--U.S. >Copyright Office Summary" (page 10, >http://www.loc.gov/copyright/legislation/dmca.pdf ): > >Limitation for Transitory Communications > >In general terms, section 512(a) limits the liability of service providers in >circumstances where the provider merely acts as a data conduit, >transmitting digital information from one point on a network to >another at someone else's request. This limitation covers acts of >transmission, routing, or providing connections for the information, >as well as the intermediate and transient copies that are made >automatically in the operation of a network. > >In order to qualify for this limitation, the service provider's >activities must meet the following conditions: > --The transmission must be initiated by a person other than the provider. > --The transmission, routing, provision of connections, or copying must > be carried out by an automatic technical process without selection of > material by the service provider. > --The service provider must not determine the recipients of the material. > --Any intermediate copies must not ordinarily be accessible to anyone > other than anticipated recipients, and must not be retained for longer > than reasonably necessary. > --The material must be transmitted with no modification to its content.

1 0

Safety Alert: Fwd: Company Recalls DVM's
by blitz 20 Aug '02

20 Aug '02

SRI FOR THE OT, but this is a Safety Alert! PASS IT ON... >Company Recalls Electrical Meters >Mon Aug 19, 2:37 PM ET > >WASHINGTON (AP) - About 40,000 digital multimeters are being recalled >because they can put users at risk of shock, >thermal burns and even electrocution. > >The meters, which measure voltage, resistance and current, can take >longer than normal up to 18 seconds to display >readings of voltages over 500 volts. The delay could be misinterpreted >to mean there is not a high voltage. > >Fluke Corp., of Everett, Wash., has received a total of four reports >from Canada and Australia in which meters gave a >delayed response, although no injuries have been reported, the Consumer >Product Safety Commission said Monday. > >More than 17,000 of the meters were sold in the United States. Those >included in the recall are yellow and black, have the >numbers 175, 177 or 179 written on the front and have a serial number of >79,000,000 or below. > >Meters should be returned for a free repair. The company can be reached >at 1-800-260-4819.

1 0

Broadview Networks
by Mike Moglin 20 Aug '02

20 Aug '02

Has anyone else had the unpleasant experience of dealing with Broadview?? I'd love to hear some horror stories....

1 0

Fwd: Re: Secure Cabinets
by Andrew Dorsett 20 Aug '02

20 Aug '02

> Andrew Dorsett <zerocool(a)netpath.net> said: > Hey everyone, I know this is slightly off topic but I'm hoping that someone > from Verisign or the like will respond. I am looking for a VERY secure > computer cabinet to replace an open rack I have now. I'm looking for > almost > vault like qualities. Is anyone willing to make recommendations on a > vendor? Whoops I guess I wasn't clear enough. I am not looking for hosting services, I am looking for a cabinet that I can install in my own server room to protect my machines from prying fingers and other illegal access. This cabinet needs to have vault like qualities and not just be some glass and metal thrown together. Maybe something like two key opening procedures, etc. Thanks, Andrew -- <zerocool(a)netpath.net>

2 1

Corporate PGP for network operators
by Sean Donelan 19 Aug '02

19 Aug '02

Ok, extremely dumb question. But I'm sure lots of other people have already solved this one. Network operators have been using various PGPs to exchange confidential information for many years. I have my own personal PGP key for my own use and a nice Unix box of my own. There are licensed versions, freeware versions, guerilla versions, and so forth. NAI is no longer selling a commercial version of PGP Desktop for Microsoft Windows/NT. Phil Zimmerman points people to the OpenPGP alliance http://openpgp.org/members/ What do commercial network operators, who are required to use Microsoft, use for business PGP mail besides NAI? I.E. if we need to exchange PGP mail, what package is least likely to crash Outlook and Windows.

3 3

RE: Sniffers/Analysers
by Stanley, Jon 19 Aug '02

19 Aug '02

Ethereal - free, and decent. Shomiti Surveyor - expensive, requires special hardware for line rate (and excess) traffic generation, and difficult as could be to use. But very powerful. Basically, it depends on what you want to do with it. If you want to analyze what's going on on the LAN, I see nothing wrong with Ethereal/tcpdump/<insert free package here>. But for actual testing, you need Surveyor or something similar. Just my $0.02 Jon -----Original Message----- From: Dr. Mosh [mailto:nanog@zeromemory.com] Sent: Monday, August 19, 2002 5:29 PM To: nanog(a)merit.edu Subject: Sniffers/Analysers Anyone have recommendations for LAN analysers? (besides building a box and using tcpdump) Personal experiences, recommendations, etc...? Private reply works. Thanks -- -------------- http://www.zeromemory.com - metal for your ears.

1 0