- NANOG - lists.nanog.org

Re: Hard data on network impact of the "Code Red" worm?
by Sean Donelan 30 Jul '01

30 Jul '01

On Mon, 30 July 2001, Sean Donelan wrote: > What do you think had more world-wide impact on the Internet? > > 1. The train accident in Baltimore > 2. The "code red" worm People, like Akamia, might have better data but I found the train wreck and "code red" worm had almost identical impacts on the packet loss, latency, reachability measurements average of the tens of thousands of networks measured by several performance measurement services on the world-wide Internet. I found the "code red" worm interesting because it did have a measureable impact on overall Internet performance on the scale of a significant fiber cut. Which makes it a bit of a rarity. Most "security incidents" don't show up on global network measurements. Even DDOS attacks, which are hell for the individual network, disappear into the general noise of the Internet's "normal" ebb-and-flow of traffic changes. You need to go back to the February 2000 DDOS attacks to find another security incident which had as large an impact on global Internet performance.

1 0

Southern Cross cable damaged
by Sean Donelan 30 Jul '01

30 Jul '01

The Southern Cross cable was damaged on Sunday about 20 kilometers off-shore from Sydney Australia. At the same time, the alternate path was undergoing maintenance near Oregon. The ETR is 12 days.

2 1

FYI - Last Call for IPv6 Allocation Comments
by Larry Diffey 30 Jul '01

30 Jul '01

<snipped from http://www.arin.net/announcements/ipv6_allocation_policy_rec.html > IPv6 Allocation Policy Last Call On July 19, 2001, the ARIN Advisory Council voted to forward to the ARIN Board of Trustees the following policy: "ARIN will allocate IPv6 addresses according to the Internet Draft http://www.arin.net/library/draft-iesg-ipv6-addressing-recommendations-02.t…. This policy will be regularly reviewed and modified subject to operational experience." This a last call for community comment on this policy prior to the ARIN Board of Trustees review of the proposed policy. This policy will be posted on the ARIN website and the ARIN Public Policy email list. Please send your comments to ppml(a)arin.net. This last call will expire on 23:59 EDT, August 3, 2001

1 0

Choosing ISP for T1 connectivity
by Alexander Avtsin 29 Jul '01

29 Jul '01

Hi, We've been using Earthlink (on ICG backbone) for 4 years for our connectivity. Recently, we started to experience a lot of downtime due to different problems with ICG network and response time was very slow. We're considering to switch to Genutiy, which came up as a first on our list after running comparative analysis of 13 big players in the industry. Did anybody have any BAD experience with Genuity/BBN backbone? Thank you. Alex Avtsin Network Engineer

2 1

Broadwing
by Hansel E. Lee Jr. 29 Jul '01

29 Jul '01

All, I'm considering using Broadwing for some IP transport and am interested in hearing feedback from anyone else who is currently using them. Reliable/Unreliable, Good service? Hansel E. Lee Jr. Director of IP Engineering Western Integrated Networks, LLC ( WINfirst <http://www.winfirst.com> ) 2000 S Colorado Blvd, 2-800 Denver, CO 80222 (303) 407-1685 (office) (303) 601-1174 (cell) (978) 246-0378 (fax)

7 6

RE: 'we should all be uncomfortable with the extent to which luck ..'
by Roeland Meyer 29 Jul '01

29 Jul '01

> From: Deepak Jain [mailto:deepak@ai.net] > Sent: Saturday, July 28, 2001 3:49 PM > > I am not sure why people complain about telnet-security when > many of these > same people have no qualms whatsoever using FTP on the same account -- > equally plain text and over the general internet. I 100% agree with you and we don't do in.ftpd either (ever since the first wu-ftpd exploit was published). All of those functions here use the various flavors of SSHscp. General downloads and publication are via httpd. Uploads are via JSP to non-executable directories. All of the above are front-ended with tcpd and detailed hosts-allow entries, which is all post-ipchains activity. Actually, we could talk a lot about nasty old MSFT. But, wu-FTP is just as bad, if not worse. How many years has it been and it *still* isn't fixed? I was on a recent HP-UX installation and they *still* had the vulnerability. Maybe it is because MSFT and WU are in the same State? Maybe MSFT's attitude is geo-physically caused? In many ways the open-source community is as bad. How many programmers don't know the difference between strcpy and strncpy and the relevent security implications? Also, why does strcpy/memcpy continue to exist? The fact that we still have buffer overflow problems is living proof that some should not be programming without a license. I recently found out that Emil Dykstra was no longer universally required reading in all Computer Science curriclulii. I stand amazed. No *wonder* we continue to have these problems.

4 3

Re: 'we should all be uncomfortable with the extent to which luck ..'
by Steven J. Sobol 29 Jul '01

29 Jul '01

On Sat, 28 Jul 2001, Mark Costlow wrote: > > Roeland> Maybe it is because MSFT and WU are in the same State? > > "Misery"? Washington U isn't in Washington, it's in Missouri. There's a reason their primary domain name is wustl.edu - they're in St. Louis. The University of Washington is in Washington. -- JustThe.net LLC - Steve "Web Dude" Sobol, CTO - sjsobol(a)JustThe.net Donate a portion of your monthly ISP bill to your favorite charity or non-profit organization! E-mail me for details.

1 0

RE: 'we should all be uncomfortable with the extent to which luck ..'
by Roeland Meyer 29 Jul '01

29 Jul '01

> From: k claffy [mailto:kc@ipn.caida.org] > Sent: Tuesday, July 24, 2001 10:36 PM > almost makes me wonder if some white hat might (should?) have > been behind CodeRed as some 'vaccination' attempt. Stop wondering. IMHO "White hats" that crack into systems should be treated the same as "black hats" that crack into systems. Throw them in jail and RO them from even thinking the word "computer" ever again (A few years, on a chain-gang, might do them some good ... sun ... excersize ... daylight ... fresh air ... they might lose that pasty complexion). <from someone whom has lost way too many days cleaning up the messes after>. > This assault also demonstrates that machines operated by home > users or small businesses (hosts less likely to be maintained > by a professional sysadmin) are integral to the robustness of > the global Internet. As is the case with biologically active Do you always let your stereotyping lead you by the nose like this ...? Home users ... maybe. Small businesses ... not. > From: CERT Advisory [mailto:cert-advisory@cert.org] > Sent: Tuesday, July 24, 2001 6:50 PM > CERT Advisory CA-2001-21 Buffer Overflow in telnetd > > Original release date: July 24, 2001 > Last revised: -- > Source: CERT/CC > Systems Affected > > Systems running versions of telnetd derived from BSD source. How many of us here run anything less than SSH and even allow telnetd to live on any of our hosts?

14 18

RE: 'we should all be uncomfortable with the extent to which luck ..'
by Roeland Meyer 29 Jul '01

29 Jul '01

Another great theory shot down in flames ... <sigh> I was yoking ... > -----Original Message----- > From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Saturday, July 28, 2001 4:41 PM > To: Roeland Meyer > Cc: nanog(a)nanog.org; caida(a)caida.org > Subject: Re: 'we should all be uncomfortable with the extent to which > luck ..' > > > On Sat, 28 Jul 2001 16:28:39 PDT, Roeland Meyer said: > > > Maybe it is because MSFT and WU are in the same State? > Maybe MSFT's attitude > > is geo-physically caused? > > MSFT moved their corporate offices to St. Louis? > > Washington University and the U of Washington are NOT the same school. > >

1 0

Re: product liability (was 'we should all be uncomfortable with the extent to which luck..')
by LBolton＠geiger.com 28 Jul '01

28 Jul '01

Your analogy is flawed. The question is, should Firestone be responsible for someone going around slashing the tires? No they shouldn't. Then why should Microsoft or any other software manufacturer be responsible for the damage done by third parties? You could make the argument that Microsoft should have designed more security into their products to prevent security breaches of this nature, but you could also argue that Firestone should make their tires out of kevlar to prevent people from slashing them. We shouldn't hold the software manufacturers responsible, unless they willingly and knowingly left the security flaw in place. We should hold the programmers that release malicious code responsible. William Allen Simpson To: nanog(a)nanog.org <wsimpson@greend cc: caida(a)caida.org ragon.com> Subject: product liability (was 'we should all be uncomfortable with the extent to which Sent by: luck..') owner-nanog@meri t.edu 07/25/01 02:42 AM Perhaps a different approach is in order -- product liability. When Firestone made a large number of bad tires, they compensated the purchasers by PAYING for replacement, including those that had not yet been injured. That included the upgrade, and the installation cost. Network operators have been injured by the distribution of buggy software from M$. We need to be compensated for our time and expenses. End users need to be compensated for their costs to upgrade. A check in the mail would be a better incentive to administrators than "automatic" updates. "Wayne E. Bouchard" wrote: > > On Tue, Jul 24, 2001 at 10:35:37PM -0700, k claffy wrote: > > ==> 5.4 billion people haven't selected an OS yet > > > > > > [k: maybe we can get them on OS-antioxidants > > before it's too late] > >... > Doing this, right now, can be difficult for many users to grasp (lets > face it, some software doesn't update well, if at all) and may require > more effort than even reputable administrators are willing to extend. > > How to go about making the public more secure, of course, is an > on-going debate and perhaps even a losing battle but still worth the > effort. > -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

14 21