- NANOG - lists.nanog.org

kudo's to netops security people
by John M. Brown 15 Aug '02

15 Aug '02

since this list bashes on people/orgs for NOT dealing with security matters, I thought I'd be contrary.. Qwest.net, FNSI.net, online-mac all sent swarms of bad packets towards a client lastnite. all where 100 percent responsive in solving / fixing the problem puppies quickly, no hassle, no fuss. Magic words were " I have a security issue with one of your users, may I please talk to your network security people". click click click, Hello, <name> Security person... I now return you to your normal NANOG SN john brown

2 1

Re: Microslosh vision of the future
by David Howe 14 Aug '02

14 Aug '02

at Monday, August 12, 2002 2:17 AM, David Schwartz <davids(a)webmaster.com> was seen to say: > Microsoft can have whatever vision of the future they want and can > use any resources at their disposal to bring their vision to light. > Everybody has that right. Nope, monopolies don't - the rules for a monopoly are tighter for the very good reason the customer *can't* go somewhere else, he has to decide to buy from them or go without (and in a world where not accepting MS-formatted documents can lock you out of contracts you need to keep in business, the pressure to go with the crowd is very high indeed. There *is* a gun pointed at their head, but it is financial (and smoking :)

6 7

Routing Protocol Security
by Jeff Doyle 14 Aug '02

14 Aug '02

HI, Can any of you cite cases where an attack has been carried out against a network's routing protocol (BGP or OSPF in particular)? My apologies if this question is too far off-topic, but if anyone knows of such incidents it would be the members of this group. Jeff

8 8

E Djikstra Paases Away
by Martin, Christian 14 Aug '02

14 Aug '02

Not sure how many are aware of this... http://www.cs.utexas.edu/users/UTCS/notices/dijkstra/ewdobit.html

1 0

NSPs filter?
by Abdullah Bin Hamad - Arabian 14 Aug '02

14 Aug '02

Good day, What NSPs do filter packets, and can really deal with DoS and DDoS attacks? UUNet? Best Regards, -Abdullah Bin Hamad A.K.A Arabian http://www.ArabChat.Org arabian(a)ArabChat.Org ___________________________________________________________ Chat with us yet? Try http://Chat.ArabChat.Org Make new friends, with ArabChat Now! Get your Free ArabMail http://Mail.ArabChat.Org

18 25

disa
by hostmaster 14 Aug '02

14 Aug '02

I need somebody from DISA, NETBLK-STDN3, to contact me off list. thx Bertil Fortrie hostmaster(a)nso.org

1 0

Re: AS path fugliness?
by Michael Lewinski 13 Aug '02

13 Aug '02

It's back, same source as last time: Aug 13 14:06:07 Insufficient chunk pools for aspath, requested size 268 Aug 13 14:06:11 Insufficient chunk pools for aspath, requested size 268 Aug 13 14:07:29 Insufficient chunk pools for aspath, requested size 270 Aug 13 14:09:44 Insufficient chunk pools for aspath, requested size 270 Aug 13 14:09:52 Insufficient chunk pools for aspath, requested size 268 *> 205.139.72.0 208.172.167.21 100 0 3561 23037 {80,1239,1785,2379,2711,4181,4323,4513,4546,5006,5676,5778,6181,6253,6347, 6395,6453,6467,6571,6580,6993,7132,7381,7431,7633,7795,10346,10625,10674,10726, 10851,10877,10910,10937,10957,11101,11134,11169,11235,11589,11657,11853,12082, 12156,12163,12179,12180,12261,13371,13443,13488,13568,13576,13578,13641,13790, 13815,13882,13904,13919,14021,14289,14359,14381,14412,14452,14549,14564,14625, 14677,14685,14787,14793,14929,14990,15062,15215,16477,16504,16640,16707,16759, 16782,16852,17033,17060,17064,17142,17304,18548,18586,18618,18886,19024,19541, 20303,20316,20333,20357,20457,20458,21536,22184,22191,22242,22299,22319,22389, 22728,22912,23087,23181,23195,23269,23306,23365,23453,23502,23547,25639,25707, 25905,25943,26004} ? *> 205.139.73.0 208.172.167.21 100 0 3561 23037 {80,1239,1785,2379,2711,4181,4323,4513,4546,5006,5676,5778,6181,6253,6347, 6395,6453,6467,6571,6580,6993,7132,7381,7431,7633,7795,10346,10625,10674,10726, 10851,10877,10910,10937,10957,11101,11134,11169,11235,11589,11657,11853,12082, 12156,12163,12179,12180,12261,13371,13443,13488,13568,13576,13578,13641,13790, 13815,13882,13904,13919,14021,14289,14359,14381,14412,14452,14549,14564,14625, 14677,14685,14787,14793,14929,14990,15062,15215,16477,16504,16640,16707,16759, 16782,16852,17033,17060,17064,17142,17304,18548,18586,18618,18886,19024,19541, 20303,20316,20333,20357,20457,20458,21536,22184,22191,22242,22299,22319,22389, 22728,22912,23087,23181,23195,23269,23306,23365,23453,23502,23547,25639,25707, 25905,25943,26004} ? (plus a bunch of others for the same AS) FYI, after the Jul 03 incident I received this response from C&W: > Thank you for notifying us of the problem. We have put a filter in place > and I believe we have been in touch with our customer. > > Best Regards, > Cable & Wireless US-IPGSOC Mike

1 0

Re: Routing Protocol Security
by Danny McPherson 13 Aug '02

13 Aug '02

I know of several incidents where invalid routing announcements were maliciously employed in order to cause reachability problems to the destination prefix network. It still bugs me that router vendors don't provide the capability to support inter-provider filters (read: 10s or 100s of thousands of instances). But heck, some providers still don't even filter routing announcements for customer prefixes explicitly. This is a HUGE vulnerability. Likewise, employing the same set of inter-provider filters at the data plane as ingress source filters would suppress the bulk of these cheesy spoofed-source address attacks. This is another HUGE vulnerability (providing a solution in hardware is a bit more difficult -- though not impossible!). But heck, some providers still don't employ customer ingress filtering. Of course, then the vulnerability would be the registries, and subsequent components therein. The again, at least the former was done many moons ago, though wasn't real successful given the network, 24 hour turnarounds, etc.. However, things like BGP Route Refresh and the like could alleviate most of the offshoots of the time. Now, back to the router vendor support issue, if that's what you were soliciting input on...? -danny

1 0

Palm OS SNMP client... need some input
by Brian Smith 13 Aug '02

13 Aug '02

I'm working on ideas for an SNMP client for Palm OS. So far, I can't find any that exist, and there's been at least one request made out there for such a thing. The basic idea would be to have a database with IPs, names, descriptions and community names for different SNMP agents you want to work with. You'd define the list, then select an agent and do things with it. I'm also looking at doing a trap monitor type of function. While I'm thinking through the design, I'm coming up with some questions that I need to ask potential users. I figured this would be the best place to look. If you reply, please do it directly to me so as not to clutter the list. Thanks. Here they are... How useful would you consider such a thing? Would it be worthwhile to implement SNMP versions 1 & 2, or just the latter? If both, then how/where/if to switch between the two? Would it be sufficient to only support the standard, RFC-defined MIB, or should there be the ability to handle custom MIBs? The problem with the latter is mainly in presentation. It would be simple enough to do a simple text-based UI for setting and querying values (a la snmpget/put), but personally I'd consider that a bit raw. To do anything better would require more work to either enable a dynamic UI or creating custom forms and code in a plugin-style system. Any other comments or suggestions? ----------------------------------------------------------------------- Brian Smith // avalon73 at arthurian dot nu // http://www.arthurian.nu/ Software Developer // Gamer // Webmaster // System Administrator If man did not exist, God's job would be easier.

1 0

Re: Microslosh vision of the future
by blitz 13 Aug '02

13 Aug '02

I just hope the anti-trust people are looking into this....i can't see a bigger case for them to spring into action... At 18:43 8/11/02 -0700, you wrote: >Microsoft already duped the software consumers into buying into fully >proprietary software. Given the prevalent time horizon of average IT >manager's thinking I fully expect Microsoft to get that stuff deployed >before the poor saps start realizing they're being ripped. After that >Microsoft will leverage their market power to exclude any competition. >Exactly like they did it before on numerous occasions. > >Their PR budget is bigger than GDP of some nations. They're ruthless and >show remarkable lack of respect to the notions of fairness or common good. >Be afraid. > >--vadim

4 3