- NANOG - lists.nanog.org

Re: If you have nothing to hide
by Dave Crocker 07 Aug '02

07 Aug '02

At 08:27 PM 8/4/2002 -0400, Sean Donelan wrote: >On Sun, 4 Aug 2002, Dave Crocker wrote: >There is a difference between technical/operational matters and policy >matters. I respectfully disagree this can be treated as a technical >problem. Yes, it's essential to be clear about technical spec. vs. policy spec, although they seem to have some overlap. Maybe a lot. But no, that does not make them the same. However the list of questions you asked, in the note I was responding to, looked like technical choices. My assumption was that the "policy" issue was in choosing between technologies. I consider the IETF Best Current Practises label as intended specifically for guidance in operations matters. Hence the suggestion to consider it. >What group is the best forum for developing consensus views on >Internet operation policy issues? In between pure tech specs and abstract policy discussion there is technically based consideration of tradeoffs, etc., for technical alternatives. That's not something to leave to purely policy folk and my sense is that the IETF venue can work for such discussion. >One of the Mr. Clarke's complaints in his speech was there is no group >the government can go to find out what the consensus view of Internet >operators is. IETF doesn't appear to want to take on that role. Hmmm. As soon as a policy becomes multi-operator, I'll bet it starts looking like a technical spec. d/ ---------- Dave Crocker <mailto:dave@tribalwise.com> TribalWise, Inc. <http://www.tribalwise.com> tel +1.408.246.8253; fax +1.408.850.1850

10 11

Re: NYT: Phone Network Is Vulnerable, Report Finds (fwd)
by David Lesher 07 Aug '02

07 Aug '02

Unnamed Administration sources reported that Martin Hannigan said: > > > > If you get the report, I'd be interested, but they'd have to encase the entire > country, poles, manholes, generators, central offices, etc into concrete > and steel to make it secure. With enough knowledge, it's easy, and the > terrorists aren't all stupid. Mostly. All Ridge has to do is classify every cable map, LERG, CLLI list, and telco office guide in the country. Paint all the telco trucks black, to go with the helicopters. And/or, federalize the whole beast, like the railroads during WWI. Remember when the FBI Wiretap Act/GAK folks wanted most/all telco employees to get clearances? This should make that look trivial. Is "system admin" anyone with root access? We better serial-number all Linux downloads. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

3 3

U.S. monitoring Internet attacks (fwd)
by Christopher X. Candreva 07 Aug '02

07 Aug '02

Anyone have any specifics on this ? I haven't seen anything. >From the Aug 6 2002 Chicago Tribune -- http://www.chicagotribune.com/technology/sns-internetattack.story U.S. monitoring Internet attacks By Ted Bridis WASHINGTON -- The government was monitoring a series of electronic attacks launched early today against U.S. Internet providers, hours after European authorities passed warnings to the FBI predicting the attacks. The impact from the attacks appeared limited, and there were no reports of outages or even delayed e-mails. A flood of data, spiking nearly 700 percent more than usual traffic, was aimed at Internet providers and Web sites on the East coast starting about 2 a.m. EDT, then shifted toward providers and sites on the West coast, said a U.S. official, speaking on condition of anonymity. But unlike some recent so-called "denial of service" attacks, which employed hundreds or thousands of computers to overwhelm Web sites, this latest attack appeared to be coming from a relatively small number of machines, the official said. That has allowed Internet providers to protect their networks more easily by filtering data from the attacking computers. The FBI issued a dramatic warning hours before the attacks started, based on information from Italian authorities, the U.S. official said. The alert cited "credible but non-specific information that wide-scale hacker attacks" were planned against U.S. Web sites and Internet providers, "possibly emanating from Western Europe." The earliest attacks targeted East Coast companies, including some in Virginia and Maryland, then shifted to target sites in Seattle, the official said. The White House and FBI's National Infrastructure Protection Center were monitoring the attacks. Some experts indicated the attacks were so easily foiled that they did not register any impact on the health of the Internet. "We haven't seen anything out of the ordinary," said Chris Rouland of Atlanta-based Internet Security Systems Inc., which sells protective software to thousands of companies. "We're paying attention to any sites that may go down." Copyright 2002, The Associated Press

6 5

Any issues with AADS Chicago NAP?
by Matthew Sweet 07 Aug '02

07 Aug '02

Hey, is anyone having peering issues with AADS/Chicago NAP? Our circuit is up, but all the PVCs dropped. Waiting on Ameritech to answer the phone now... Thanks, Matt

1 0

Re: Deaggregating for emergency purposes
by Omachonu Ogali 06 Aug '02

06 Aug '02

On Tue, Aug 06, 2002 at 10:16:41PM +0000, bmanning(a)karoshi.com wrote: > > > > On Tue, 6 Aug 2002 bmanning(a)karoshi.com wrote: > > > > > > Typical response: You're not our customer, who are you? > > > > I'm Omachonu Ogali with XYZ Networks, and I'd like to speak to > > > > a network engineer regarding a routing problem. > > > Hum. I take ~4 calls each day for things that are some other > > > ISPs problem. Folks are -politely- told that the issues > > > are either with their ISP or someone upstream of their ISP. > > > When they get pushy, I offer them a service contract. 99.999% > > > (hey Sean, there are your five 9's!) of them then choose to > > > work with thier ISPs. I suspect that you have more than enough > > > clue to never have to give me a call, but if you do, be prepared > > > to be re-directed... :) > > > > I hope you pay better attention on the phone then you do on lists. :) > > > > The point was calling up the upstream of the AS who is generating bogus > > routes. The upstream of the caller is not at all involved. > > > > But the upstream of the caller is involved. They passed > the route(s) on, no? > > --bill Not necessarily, I could be the victim of a leak calling up an ISP to report it. Or some bored person connected to route-server.* constantly checking prefixes. -- Omachonu Ogali missnglnk(a)informationwave.net http://www.informationwave.net

2 1

Re: NYT: Phone Network Is Vulnerable, Report Finds
by Martin Hannigan 06 Aug '02

06 Aug '02

At 03:27 PM 8/6/2002 -0400, Sean Donelan wrote: >Sigh, I already have a copy of the news paper article. I was looking for >a copy of the report mentioned in the article. If you get the report, I'd be interested, but they'd have to encase the entire country, poles, manholes, generators, central offices, etc into concrete and steel to make it secure. With enough knowledge, it's easy, and the terrorists aren't all stupid. Mostly. Regards, -- Martin Hannigan hannigan(a)fugawi.net

1 0

RE: Deaggregating for emergency purposes
by Jeff S Wheeler 06 Aug '02

06 Aug '02

On Tue, 2002-08-06 at 14:59, Phil Rosenthal wrote: > > Yes, it is lovely when things work out like that. > My one experience with this problem was with Telia announcing my more > specifics, and their US NOC referred me to their Europe NOC, and there > no one spoke English. They are a tier1, so they don't have any upstream > to call. It took 20 phone calls and more than an hour to get to someone > who cared enough to do anything about it. > Surely, Phil, it will take longer than an hour for IRR updates to reach tier1 router filter configuration files. Are you advocating that we all pre-emptively populate the IRRs with /24s for all our mission critical networks? If that becomes fad, IRR growth will quickly become a serious concern, and its utility will be reduced. In addition, many networks will not accept /24s from the former B-class space which is now being assigned by the various regional registries. Advertising /24s might help the problem, or it might not. Cluttering up the IRRs is not the answer to someone blackholing your network. Rather, use administrative channels or forums such as NANOG to get the rogue advertisements withdrawn at their origin or filtered by their upstreams. -- Jeff S Wheeler

2 1

GBLX router upgrade breaks bgp sessions
by nanog 06 Aug '02

06 Aug '02

Subject says it all. GBLX upgraded some edge routers to a new JunOS release (possibly 5.3 rev 24)- and now our bgp sessions continually reset with: Jul 10 06:58:24 MST: %BGP-3-NOTIFICATION: sent to neighbor X.X.X.X 3/3 (update missing required attributes) 0 bytes Anyone clueful at GBLX listening? We've been down for about 4 hours, and the NOC (call center) people are less than helpful. bill

5 7

NYT: Phone Network Is Vulnerable, Report Finds
by Sean Donelan 06 Aug '02

06 Aug '02

Does anyone know where I could get a copy of the report mentioned in today's New York Times (registration required)? http://www.nytimes.com/2002/08/06/nyregion/06TELE.html

3 3

Re: If you have nothing to hide
by Simon Waters 06 Aug '02

06 Aug '02

> From: Sean Donelan <sean(a)donelan.com> > "Why is it that companies have sold products that they know are > insecure?" asked Richard Clarke, President Bush's chief cybersecurity > adviser. I would have though he might better concern himself with why is the Government still buying them. Market forces will ensure the supply of whatever is demanded, the US federal and state government is presumably the single largest purchaser in the IT market, yet still seems to be buying plenty of products with dubious security records. Government purchasing changes have and could improve security, where do you think Ctrl-Alt-Delete to login to NT came from, it wasn't the Microsoft usuability department I'm sure. Let him who is without sin.....

3 2