- NANOG - lists.nanog.org

Re: Fwd: Re: Digital Island sponsors DoS attempt
by Paul Vixie 28 Oct '01

28 Oct '01

> > Intentions matter not at all. Only results of said traffic, the > > consequences of which are borne entirely by the receiver. If the > > receiver doesn't want it, the receiver should not have to receive it. > > This is not how things are done elsewhere, so I don't see why it would > have to be on the net. on the net, recipients pay for part of the transport of traffic to them. elsewhere, senders pay for all of the transport of traffic to them. that's why it has to be different on the net than elsewhere. > Also, how do you intend to inform everyone about > everyone else's wishes in this regard? that would be impractical, unscalable, and unnecessary. > > Unless you're willing to come out > > and state that being connected to the Internet is a de facto agreement to > > receive anything and everything somebody wishes to send you > > It is, "de facto". If you know that doing something has a certain result, > and you do it, you can't really be surprised that the result ensues. so if i have an IP address than i ought not be surprised when it's pingflooded? and if i have an e-mail inbox i ought not be surprised when it's spammed? elsewhere, this ideology is called "blame the victim", and is not respected.

1 0

Re: Thursday Hawaii telephone mishap
by Michael Painter 28 Oct '01

28 Oct '01

>>Do you get your ADSL line from Verizon or from a CLEC?<< Verizon. I'm not sure if we even have any CLECs.<g> --Michael ----- Original Message ----- From: "James" <james(a)james-web.net> To: "Michael Painter" <tvhawaii(a)shaka.com>; "Andy Walden" <andy(a)tigerteam.net> Cc: <nanog(a)merit.edu> Sent: Sunday, October 28, 2001 6:36 AM Subject: RE: Thursday Hawaii telephone mishap > >Oh btw, I wasn't using it during the entire outage, but my ADSL line > >worked fine for the 3 hours that I did use it. > > Do you get your ADSL line from Verizon or from a CLEC? > > If its a CLEC, their ATM fiber circuit out of your CO might (and probably > is) seperate from any Verizon fiber lines that were affected. > > - James >

1 0

RE: [SOT Rant] Non-hostile probes / opt-in/out
by Quibell, Marc 28 Oct '01

28 Oct '01

LOL! I believe that the question should be: Why are you pinging me? Tell me what admin who sees thousands of ping from one host does not investigation the nature? Do mean to say that if you were to log thousands of pings, you would ignore them? Also many ping attacks start with harmless ping probes. Marc -----Original Message----- From: James Thomason [mailto:james@divide.org] Sent: Friday, October 26, 2001 3:00 PM To: Patrick W. Gilmore Cc: nanog(a)merit.edu; Quibell, Marc Subject: RE: [SOT Rant] Non-hostile probes / opt-in/out If I did, and they responded negatively, I would tell them YOU said it was a good idea. Seriously, why should the administrators of *.army.mil care if I test packet response time between our networks? Is this an illegal activity I am unaware of? On Fri, 26 Oct 2001, Patrick W. Gilmore wrote: > > At 02:16 PM 10/26/2001 -0500, Quibell, Marc wrote: > > > >Maybe you should ping NS01.ARMY.MIL about 2400 times in 3 hour and see if > >you don't get a visit? Pinging a website 2 times means nothing.. > > How about 441 times in 2 hours? :) > > > >Marc > > -- > TTFN, > patrick > >

3 2

Gemini Fiber Cut in the NYC area
by Sean Donelan 28 Oct '01

28 Oct '01

Does anyone have the story about a Gemini fiber cut in New York City. Yeah, I know, things are still a bit messed up in NYC. But it seems Qwest, C&W and other carriers were affected by this.

1 0

Re: Fwd: Re: Digital Island sponsors DoS attempt?
by Paul A Vixie 28 Oct '01

28 Oct '01

i'd written: > > well, be careful with your acl's, because if you accidently disrupt > > nonabusive traffic as a side effect of protecting your network from > > abuse, you'll shortly be hearing complaints from EFF about how you've > > disenfranchised said nonabusers. someone answered: > You've got to be kidding me. no i am not. in http://www.eff.org/effector/HTML/effect14.31.html#II we see: | The focus of efforts to stop spam should include protecting end users and | should not only consider stopping spammers at all costs. Specifically, any | measure for stopping spam must ensure that all non-spam messages reach | their intended recipients. Proposed solutions that do not fulfill these | minimal goals are themselves a form of Internet abuse and are a direct | assault on the health, growth, openness and liberty of the Internet. | Email is protected speech. There is a fundamental free speech right to be | able to send and receive messages, regardless of medium. Unless that right | is being abused by a particular individual, that individual must not be | restricted. It is unacceptable, then, for anti-spam policies to limit | legitimate rights to send or receive email. To the extent that an anti-spam | proposal, whether legal or technical, results in such casualties, that | proposal is unacceptable. i never thought i'd feel a need to lecture shari or john on the nature of the protection in "protected speech", so, i have not even tried.

3 2

Re: 6500 Supervisor IOS/Native mode (RE: 12000 ACL issue)
by Rubens Kuhl Jr. 28 Oct '01

28 Oct '01

>So, just curious if there's a large crowd going towards 6500 >"native" mode (using Supervisor IOS instead of CatOS >"hybrid" dual-headed monster). Probably not because of POS modules lack of support in Supervisor IOS. People doing DFC and SLB are required to run Supervisor IOS; people that doesn't like the vlan/port metaphor tend to run Sup IOS. >I've heard of a few enterprise- and metro-area networks >migrating from a 7500+GSR platform to 6500's, but none are >running 6500 native mode. > >Seems like native mode is pretty new, maybe 18 months old >now. Not many IOS versions to choose from, but plenty of >bug-fix releases (5 since Aug '01). Curious whether anyone The Sup-IOS releases are usually paired with CatOS or MSFC IOS upgrades, correcting similar bugs and adding similar funcionality. Very few bugs were SupIOS-related, as far as can I tell from the release notes (which doesn't always include all that have changed). >is testing or operational with it, and what your experience >has been. Most of the times we hit a CatOS bug we also tried the current SupIOS release on lab, and the same bug was also present... it would probably make no difference to run either of them, unless you use something exclusive to SupIOS that would have its own bugs. Rubens Kuhl Jr.

1 0

ICANN's new role: It's about keeping people from being killed by terrorist plots hatched over the net says Mike Roberts
by Gordon Cook 27 Oct '01

27 Oct '01

http://atlargestudy.org/forum_archive/msg01113.shtml With apologies to the non-US members of this list, I'd like to make some comments that are inevitably US-centric. Today marked a watershed day in the history of the Internet. In some sense, the real date was September 11, when the leadership role of the United States in world peace, in economic development, and in technology innovation was challenged by a group of determined religious fanatics using our own technology on us to cause the death of thousands of innocent people. But the legal date between the "old" Internet and the "new Internet was today, October 26, 2001,when President George Bush signed the anti-terrorism bill that was passed by the upper house of Congress yesterday with one dissenting vote. This legislation brings the Internet and its developers, providers and users directly into the new war on terrorism. It extends extensive new power to law enforcement to find, capture, and punish those who use the network for terrorism or other criminal activity. It removes the previous barriers between foreign and domestic anti-terrorism investigations and establishes the principle that whoever you are, wherever you are, if you use the net for terrorism, you are in the sights of the FBI, the CIA, the NSA and their foreign counterparts. In the New York Times this morning, under the heading "We are All Alone," widely respected columnist Tom Friedman said, "Focus instead on the firemen who rushed into the trade center towers without asking, 'How much?' Focus on the thousands of U.S. reservists who have left their jobs and families to go fight in Afghanistan without asking, 'What's in it for me?' Unlike the free-riders in our coalition, these young Americans know that September 11 is our holy day - the first day in a just war to preserve our free, multi-religious, democratic society. And I don't really care if that war coincides with Ramadan, Christmas, Hanukkah, or the Buddha's birthday - the most respectful and spiritual thing we can do now is fight it until justice is done." After a week of tough fighting in Afghanistan where the battle is rapidly deteriorating to the same "take no prisoners" ethic that prevailed on September 11, the same week that professionally prepared anthrax kept showing up in new places everyday on the U.S. east coast and killed two postal workers, there is a determined and deadly resolve to follow the Friedman advice. A resolve that will affect many if not most institutions, among them ICANN. It's different now for ICANN. What started out as your typical ritual White House privatization effort; one that parroted the young Clintonites' "Agenda for Action" of 1993; the Al Gore "Information Superhighway" speech; that provided a last hurrah for Clinton advisor Magaziner at the end of the second term. A sly political move that solved, or maybe solved, the National Science Foundation's honest mistake in giving Network Solutions and SAIC a billion dollar monopoly. That is not the ICANN of post-Sept 11. It's different now. It's not world government because national governments are evil; it's not Internet governance because national laws are unjust; it's not a response to some abstract imagining of the global popular will; it's not solving poverty, famine, infanticide, drug abuse and political oppression in the DNS. It's serious. It's first things first. It's about keeping people from being killed by terrorist plots hatched over the net. All of a sudden it matters that you know what you are talking about. If you are an Internet engineer, what about nailing down the RFC's needed for secure new functionality in the DNS? If you are a root server host organization CEO, all of a sudden being a volunteer in Jon Postel's army takes on new meaning. If you're the manager of a top level domain name registry, it's not a pc in a closet time anymore. Important people are watching, people who have the ability to nationalize you overnight if you're not carrying your weight in making the Internet more secure. The Japanese government and the United States government are sending cabinet level officers to speak at the November ICANN meeting about how serious this really is. So what does this have to do with At Large? First, don't expect to get the attention of the study committee, your fellow stakeholders in ICANN, the dedicated members of the Board, or the governments whose sanction makes this privatization effort possible, with a continuation of the shallow rhetoric that has characterized the postings on this list. Second, think seriously about constructive improvements in the recommendations of the ALSC. Nobody cares that you don't like a particular recommendation, they want to know whether you have a better idea, an idea that is good enough to gather the support of a lot of other interested parties that may not share your individual political or social or economic background but are nevertheless interested in the future welfare of ICANN. Third, be prepared to compromise your goals in the interests of forging an At Large organization that contributes to an ICANN that is going to operate in a far different environment than its founders envisaged. The study committee has worked hard. It doesn't deserve the abuse it has received on this list. The several points of the action plan are reasonable, centrist, and provide a basis for moving forward. They deserve your support. - Mike Roberts -- ======================================================== The COOK Report on Internet, 431 Greenway Ave, Ewing, NJ 08618 USA (609) 882-2572 (phone & fax) cook(a)cookreport.com Go to http://cookreport.com for info on new features, updated mission statement, contents of Dec 2001 issue, subscription info and prices at http://cookreport.com/subscriptions.shtml -- summary of content for nearly 10 years at http://cookreport.com/past_issues.shtml

1 0

EXAMPLE: ### xxx Canada detected a penetration attempt from 209.123.x.229. Incident# xxxx
by Alex Rubenstein 27 Oct '01

27 Oct '01

Pursuant to my previous post, I just rec'd this. Not exactly the same, but very similar. Kind of my point; SO WHAT THAT THIS PERSON WAS SCANNED? Is scanning actually an illegal activity? Was anything actually hacked, cracked, or 0wn3d? It's an absurd waste of resources to be emailed by automagic systems every time someone sends a stray packet. -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net -- ---------- Forwarded message ---------- Date: Fri, 26 Oct 2001 04:50:27 -0600 (MDT) From: Super-User <root(a)xx.xx.net> To: "dnsadmin(a)NAC.NET" <dnsadmin(a)NAC.NET> Subject: ### xxx Canada detected a penetration attempt from 209.123.x.229. Incident# xxxx ### This email was generated by so-and-so Canada's network intrusion detection system. Please forward to your Internet security personnel if you are not the appropriate person to receive this notice. so-and-so Canada, located in Calgary, Alberta Canada, wishes to inform you that we experienced a probe or scan from your IP space. LOGGED INFORMATION: -------------------------- Source: 209.123.x.229 Destination: Host-x.x.19.254 Date: 26Oct2001 Time: 4:50:23 (Local Calgary Time GMT-7) Service/Protocol: http -------------------------- This notification has been sent to: alex(a)NAC.NET dnsadmin(a)NAC.NET abuse(a)NAC.NET Because we view this activity as possible intent to breach security, we ask you to review your logs and take appropriate action against the offending party responsible for this suspicious activity. Please respond to xx(a)xx.net for any issues concerning this. You may also visit our Intrusion Detection Information website at: http://x.x.19.11/intrusion_detection Thank you. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Jim bleh Senior Unix Network Analyst xxx Canada Calgary, AB Canada (403) xxx-yyyy

9 9

RE: 12000 ACL issue
by Rubens Kuhl Jr. 27 Oct '01

27 Oct '01

Why do you think 6500/7600 doesn't have the required performance ? 30 Mpps Sup 2 with fabric-enabled line-cards can perform incredibly well... Having FlexWAN and other non-fabric line-cards will slow down to 15 Mpps, which is usually enough. VLAN L3 interfaces are required only on CatOS (which is today required by POS modules, unfortunately), but not on Supervisor IOS. Rubens Kuhl Jr. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Pete Kruckenberg Sent: Friday, October 19, 2001 2:20 PM To: Mikael Abrahamsson Cc: nanog(a)merit.edu Subject: Re: 12000 ACL issue On Fri, 19 Oct 2001, Mikael Abrahamsson wrote: > I guess I cannot use the GSR as a serious GigE platform, > and now seeing the NTE prices on 10GE for the GSR and > the timeframe it's going to be available, the GSR is not > a viable 10GE platform either. I've been trying to figure out the same thing, while there are several other vendors very strong in L3 GigE, Cisco's strategy (if there is one) appears to be twine and bailing wire. 6500/7600 doesn't have the performance, and VLAN L3 interfaces are just too non-intuitive for me. GSR price/performance and availability is so dismal compared to other vendors, I am willing to bet on someone else and deal with any platform immaturity. Can't say my experience with GSR is so great, either, as far as stability, reliability, etc goes. Reminds me of the GFR, the number of times I have to reboot/reload... Pete.

2 2

Re: Fwd: Re: Digital Island sponsors DoS attempt?
by Paul Vixie 27 Oct '01

27 Oct '01

> 'course, a nice ACL at the borders reminds 'em who your network actually > belongs to well, be careful with your acl's, because if you accidently disrupt nonabusive traffic as a side effect of protecting your network from abuse, you'll shortly be hearing complaints from EFF about how you've disenfranchised said nonabusers.

2 1