- NANOG - lists.nanog.org

Re: it's here
by Eric Brandwine 13 Feb '02

13 Feb '02

>>>>> "th" == Tony Hain <alh-ietf(a)tndh.net> writes: th> Eric Brandwine wrote: >> Please, tell your vendors you want line-rate filtering up to layer 4. th> And when you do so, be prepared to pay what it will cost to deliver th> that. Absolutely! And it'll be well worth it too. The up-front cost is higher, but economy of scale will bring it down. Having routers that can protect themselves, protect devices behind them, track attacks, and provide vastly improved visibility into your network will pay for itself quickly. Imagine, a router that cannot be knocked over! I have this argument with Chris any my management all the time. Up through layer 4, headers are well defined, bit fields, 16/32 bit ints, etc. Filtering at this point is just making a decision to do so, and designing it into hardware. Juniper did it from the beginning (mostly), and does it well. More recent Cisco GSR line cards (Engine 4, etc) come close. It's just another ASIC. Filtering past layer 5 is open to argument, that's a much harder job, but up till 4, it's almost free. When we installed CF chips in all our M40s, the amount of extra information that we gained about our network was amazing. We regularly see multi-gigabit attack flows in the network, and are now able to mitigate/filter/track them. It's a good thing, and with general purpose filtering capabilities, you're always finding new uses for them. ericb -- Eric Brandwine | Doing what little one can to increase the general stock UUNetwork Security | of knowledge is as respectable an object of life, as one ericb(a)uu.net | can in any likelihood pursue. +1 703 886 6038 | - Charles Darwin Key fingerprint = 3A39 2C2F D5A0 FC7C 5F60 4118 A84A BD5D 59D7 4E3E

1 0

RE: port 139 scans?
by Steve Smith 13 Feb '02

13 Feb '02

There is a new trojan called ANTZ that scans this port. We have seen a ton of these. -----Original Message----- From: Jasper Wallace [mailto:jasper@ivision.co.uk] Sent: Wednesday, February 13, 2002 5:38 AM To: nanog(a)merit.edu Subject: port 139 scans? Is anyone else seing lots of packets being thrown at port 139? We're getting 5 or 6 packets a sec, mostly from 80.0.0.0/8 (and all tcp syn's). -- Internet Vision Internet Consultancy Tel: 020 7589 4500 60 Albert Court & Web development Fax: 020 7589 4522 Prince Consort Road vision(a)ivision.co.uk London SW7 2BE http://www.ivision.co.uk/

1 0

port 139 scans?
by Jasper Wallace 13 Feb '02

13 Feb '02

Is anyone else seing lots of packets being thrown at port 139? We're getting 5 or 6 packets a sec, mostly from 80.0.0.0/8 (and all tcp syn's). -- Internet Vision Internet Consultancy Tel: 020 7589 4500 60 Albert Court & Web development Fax: 020 7589 4522 Prince Consort Road vision(a)ivision.co.uk London SW7 2BE http://www.ivision.co.uk/

3 3

CERT CA-2002-3 (Cisco)
by German Martinez 13 Feb '02

13 Feb '02

Cisco has just released their Field Alert in their web site. We will see couple of reboots Router#reload http://www.cisco.com/warp/public/707/cisco-malformed-snmp-msgs-pub.shtml German ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * THE DILBERT FUTURE * * Thriving on Stupidity in the 21st Century * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "Internet capacity will increase indefinitely to keep up with the egos of the people using it"

3 2

Configuring Linux Box as Router
by tarun banka 13 Feb '02

13 Feb '02

2 1

Bulk WHOIS Dump
by ginny listman 12 Feb '02

12 Feb '02

ARIN has enacted a policy to provide a bulk copy of the WHOIS database, minus point of contact information, to any organization who signs ARIN's acceptable use policy for that data. This policy was brought about through discussions via the ARIN public policy mailing list and public policy meeting. The requirements and decisions to enact this policy came from the Internet community. For further information, visit: http://www.arin.net/announcements/2001-7.html Ginny Listman Director of Engineering ARIN

1 0

it's here
by Alex Rubenstein 12 Feb '02

12 Feb '02

http://www.cert.org/advisories/CA-2002-03.html -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

3 2

operator requirements for network management
by Steve Feldman 12 Feb '02

12 Feb '02

For those of you at the NANOG meeting, my slides are now avaialble in http://www.twincreeks.net/~feldman/Presentations/ in powerpoint, HTML, and PDF formats. They should also be on the NANOG web site soon. For those of you not at NANOG, we're (still) soliciting input from network operators on requirements for network management. Please read the slides and the internet-draft http://www.ietf.org/internet-drafts/draft-ops-operator-req-mgmt-01.txt and let us know what you think. There's a discussion list for this, mail ops-nm-request(a)ops.ietf.org to join. Steve

2 1

Re: Reducing Usenet Bandwidth
by Stephen Stuart 12 Feb '02

12 Feb '02

> You are now in defiance of reality, I think. Well, of course; I was talking about USENET, after all. Stephen

1 0

GigE tariffs
by Mike Duckett 12 Feb '02

12 Feb '02

There was some discussion during the exchange provider presentations around GigE tariffs. In answer to that (not a sales pitch, just an FYI), BellSouth has offerings now and others planned in that area. You may want to check out http://cpr.bst.bellsouth.com/ Obervation: notifications posted for point to point (non-switched) service in certain areas. Tariffs (GSST) exist in Fl, Ga, and NC (switched platform).

1 0