- NANOG - lists.nanog.org

Traffic statistic collector
by Jason Lixfeld 27 Nov '00

27 Nov '00

I'm working on a proposal to run some OCx circuits southbound to connect to the NAPs and IX's of the world. I need to calculate how much traffic I'm sending to each member and to each members' customers. I'm using cflowd to gather info from the routers but I'm wondering if anyone knows of a script/proggy/hack that can take an AS or a series of netblocks, run them against the multiple cflowd data files, parse it out and spit out a MB/sec figure of some sort.

5 4

RE: ISPs as content-police or method-police
by Mathew Butler 27 Nov '00

27 Nov '00

The use of the phone isn't that difficult, it's the use of the phone to get someone -clueful- enough to a) recognize the request as valid, b) log the request for their records, and c) disable the filter. Customer service at many of the Tier-2 and Tier-3 providers usually isn't, in my experience. -Mat Butler -----Original Message----- From: Stephen Sprunk [mailto:ssprunk@cisco.com] Sent: Tuesday, November 21, 2000 11:16 AM To: Roeland Meyer; 'Shawn McMahon'; nanog(a)merit.edu Subject: Re: ISPs as content-police or method-police Then again, nobody here seems to be suggesting mandatory filtering. Why is there such a strong objection to opt-out filters, where a single call or email can get the filters turned off? Is using a phone really that difficult?

1 0

RE: Carnivore Update - Washington Post 11/21/00
by Mathew Butler 27 Nov '00

27 Nov '00

The _NSAKEY symbol in Windows does not affect the keys used or generated for WinInet() or CryptoAPI calls. 128-bit open source is subject to a license exception, and can thus be examined to a fare-thee-well. I agree that the close-source nature of the CryptoAPI (and thus, crypto smart cards, and the underlying crypto libraries) is detrimental to its security evaluation. Thus, I am unwilling to state categorically that it is a secure implementation. But, Carnivore doesn't have the capability of decrypting anything, merely decoding the packet headers. It can capture all traffic by a suspect, including the SSL-encrypted payload; however, this means that the full protocol exchange must be analyzed and cracked, and any session renegotiations must be analyzed and cracked as well. SSLv2 was (and is) insecure. Now that the RSA patent has fallen out of protection, it's going to be more possible to use open-source (and other) software that implements SSLv3 and TLS1.0; regardless, old standards die hard. However, I could get into a debate over whether 'self-signed certificates are insecure'. This is not the place. Just clearing up some misapprehensions, -Mat Butler -----Original Message----- From: Philippe Landau [mailto:lists@A-Z-Internet.com] Sent: Thursday, November 23, 2000 1:26 PM To: nanog(a)merit.edu Cc: Eric Murray Subject: Re: Carnivore Update - Washington Post 11/21/00 >> of course carnivore has no problem decrypting SSL. >Source, please. (this seems obvious for the still widely distributed 40 bit versions. there are many sources discussing the NSA key in windows and apple is likely to have implemented similar backdoors. there could be a reason why 128 bit SSL encryption has been approved by the US for export in december 1999. the question is if we have to prove they can decrypt SSL communications or if the government agencies have to show they can't (don't hold your breath). how strong 128 bit encryption is is another question.) this discussion is probably getting off-topic on this list. i have just received some thoughts about it from security expert Eric Murray and while he is less pessimistic, please see below. kind regards philippe, http://A-Z-Internet.com --- *** --- http://remus.prakinf.tu-ilmenau.de/ssl-users/archive14/0158.html http://www.mail-archive.com/cryptography-digest%40senator-bedfellow.mit.edu/ msg02375.html http://www.tinhat.com/surveillance/code_breaking.html SSL Server Security Survey - A random sample of 8081 different secure web servers (servers running the SSL protocol) in active use on the Internet shows that 32% are dangerously weak. These weak servers either support only the flawed SSL v2 protocol, use too-small key sizes ("40 bit" encryption), or have expired or self-signed certificates. Data exchanges with all types of weak servers are vulnerable to attack. http://www.meer.net/~ericm/papers/ssl_servers.html --- *** --- On Thu, Nov 23, 2000 at 08:55:52PM +0100, Philippe Landau wrote: > Hello > > Is there a possibility that a government > has a backdoor to decrypt SSL communications ? > > kind regards philippe, http://A-Z-Internet.com Yes it is possible, in the code that calls SSL. It's not very possible in the SSL protocol itself since that has been well investigated by security researchers. It's a little more possible in open-source SSL implementations but still not very likely. It's most possible in closed-source implementations, where the code that calls SSL is only known to the author(s). A backdoor that say reduced the entropy going into session keys would be difficult to detect-- even decompiling the code and stepping through it might not show it. -- Eric Murray Consulting Security Architect SecureDesign LLC http://www.securedesignllc.com PGP keyid:E03F65E5

1 0

RE: Carnivore Update - Public Does Not Care
by Roeland Meyer 27 Nov '00

27 Nov '00

> From: Quark Physics [mailto:meuon@highertech.net] > Sent: Sunday, November 26, 2000 6:43 AM > > > extra trouble to install it. The proof is the market > penetration of PGP. > > Only the geeks tend to use it and SSH is only used by SA > geeks. The general > > market DOESN'T CARE! The following parallels what our marketing department found out (after launch, unfortunately <sigh>). > We see roughly several levels of clients: > > 70% - "Huh? We're secure, only I have the root password" > (actual quote) > > 10% - Encryption is hard, how about we ZIP the file we send via FTP? > (not bad, it helps...) These guys, 80% of the market, will not pay for it either. They will not buy software packages and they will not buy services either. They don't see a problem. Can we say "myopic"? > 10% - SSL encrypted XML posts. > > 5% - SCP (SSH) file transfer, known keys on each side + passwords. This last 15%, are mostly self-serve and actually know that there is a problem. But, they wont puchase, they don't need to, they're self-serve. This is where most of us, on this list, fall. > 5% - Hardware encryption, leased line, keys for hardware encryption > and passwords delivered in seperate parts by different people > after identity verification. No physical connections to gateway > systems. (Federal Reserve, Chase Manhatten Bank...) The unknown tier, many of them are banks where minimum security is a regulatory thing. It's a part of doing business. I'm not sure, that if left to their own devices, that they wouldn't join the majority in in their apathy. > Until real data encryption is built into the Operating Systems and all > software... --mike-- As long as we have Federal Export restrictions, on encryption products, this will continue to be an optional add-on (Win2K high-encryption pack ain't that bad. But, it is an add-on, one has to use the update service to install it).

3 2

Re: Sun Storm
by Spencer.Wood＠dot.state.oh.us 26 Nov '00

26 Nov '00

This might really sound crazy, but everytime there is a Solar Storm, we usually have at least on of our Cisco 2600's NVRAM become corrupt. I'm not saying that the solar storm causes the memory corruption, but I've seen stranger things happen... **************************************************** Spencer Wood, Network Administrator Ohio Department Of Transportation 1320 Arthur E. Adams Drive Columbus, Ohio 43221 E-Mail: Spencer.Wood(a)dot.state.oh.us Phone: 614.644.5422/Fax: 815.361.0714 **************************************************** Steve Sobol <sjsobol(a)NorthShoreTechnologies.net> Sent by: owner-nanog(a)merit.edu 11/26/2000 11:35 AM To: Dennis Dayman <ddayman(a)mail-abuse.org> cc: Nanog <nanog(a)merit.edu> Subject: Re: Sun Storm Dennis Dayman wrote: > The sun could be causing some more immediate problems overnight and into > next week. A major solar storm is bombarding the earth's atmosphere with > low-dose radiation that scientists say is no real danger to people on the > ground. Respected Internet professionals say that the solar storm may cause other irregularities - for example, on-topic posts to the NANOG mailing list such as the one I am replying to. -- Steve Sobol, BOFH, President 888.480.4NET 866.DSL.EXPRESS 216.619.2NET North Shore Technologies Corporation http://NorthShoreTechnologies.net JustTheNet/JustTheNet EXPRESS DSL (ISP Services) http://JustThe.net mailto:sjsobol@NorthShoreTechnologies.net Proud resident of Cleveland, Ohio

1 0

Looking Glass
by Ariel Biener 26 Nov '00

26 Nov '00

Hi guys/gals, I am looking for looking-glass software that is secure (i.e., that people wont be able to fiddle with the web server it's on). The security factor is critical. I have written such software myself, but as my boss points out, software that was already tested by alot of people, and that has been running for a while is better security wise than anything I can write and only visually test. There are quite a few LG on the web, some Perl based, some PHP based, and I even saw one in C (!!). I just want to know which is mostly used. My personal feeling is that alot of sites just wrote their own, am I mistaken ? thanks, --Ariel -- Ariel Biener e-mail: ariel(a)post.tau.ac.il PGP(6.5.8) public key http://www.tau.ac.il/~ariel/pgp.html

9 11

Sun Storm
by Dennis Dayman 26 Nov '00

26 Nov '00

FYI: The sun could be causing some more immediate problems overnight and into next week. A major solar storm is bombarding the earth's atmosphere with low-dose radiation that scientists say is no real danger to people on the ground. A major flare erupted off the sun's surface when many of us were sitting down to Thanksgiving dinner. Forecasters expect the shockwaves, moving at one to three million miles an hour, will hit the earth's atmosphere Saturday night and last through Sunday. Strong geomagnetic storms can do a number on our growing, global web of communications technologies from satellites, to pagers, to high-frequency radios. As most of you remember a smaller storm in 1998 knocked out one satellite that, in turn, shut down gas pumps and ATMs. --------------------------- Thanks Dennis Dayman Senior Consultant Consulting Services Group at MAPS http://www.mail-abuse.org ddayman(a)mail-abuse.org Voice/FAX 972-682-7556 ------------------------------------------------------------------------------ What goes up, must come down. Ask any system administrator. ------------------------------------------------------------------------------

2 2

RE: Carnivore Update - Washington Post 11/21/00
by Roeland Meyer 26 Nov '00

26 Nov '00

The only answer is the same one for CALEA, absolute mil-grade encryption on every single packet! Given that, it won't matter if they capture packets, they wont be readable. However, as MHSC has found out the hard way, folks don't want to pay for it. Even when it is freeware, they wont go through the extra trouble to install it. The proof is the market penetration of PGP. Only the geeks tend to use it and SSH is only used by SA geeks. The general market DOESN'T CARE! At one time, MHSC offered VPN software and an SSL-based web mail product, for a very nominal $10/month. We had lottsa queries, but few buyers. Folks would rather use a free, unsecured, hotmail/juno/etc than a non-free SSL-based one. BTW, you can't have banner ads on an SSL page. I figure that this market has at least three years to go before it is real. > -----Original Message----- > From: Frater M.A.Ch.H. 999 [mailto:azoth@occult.net] > Sent: Wednesday, November 22, 2000 6:03 PM > To: nanog(a)merit.edu > Subject: Re: Carnivore Update - Washington Post 11/21/00 > > > > nanog: > > Do what thou wilt shall be the whole of the law. > > I still have to say that the Carnivore program is potentially the most > disgusting domestic surveillance program ever proposed. > > To Hell with the 4th Ammendment, eh, FBI? > > I don't know what the FBI's oaths of service are, but my > oaths upon entering > the US Armed Forces were to protect the Constitution of the > United States > from all enemies, foreign and domestic. > > Furthermore, our motto in Special Forces is 'De Oppresso > Liber' --- Liberate > from Oppression. > > Perhaps they just want to ruffle some feathers and get some domestic > resistance popping up by all of this... or on the flip-side see if the > citizens actually would resist an attempt to eradicate the > 4th Ammendment. > > I've noticed that national ammunition sales are soaring over > the past few > weeks. > > Amen! And so they should be. > > Carnivore needs to find a resting point before someone takes too much > offense to it. > > And personally, I always like to use the good ole 'Meta-x spook' lisp > built-in command in emacs as often as possible for just this sort of > occasion. > > e.g.: > -------------------------------------------------------------- > -------------- > NSA kibo Waco, Texas counter-intelligence smuggle DES Mossad terrorist > class struggle security CIA explosion Noriega Marxist Kennedy > > DES genetic strategic NSA smuggle FBI World Trade Center FSF Panama > SDI Honduras Ft. Meade Treasury counter-intelligence class struggle > -------------------------------------------------------------- > -------------- > > For everyone who didn't know that command existed in the distribution, > enjoy! ;) > > Love is the law, love under will. > > Frater M.A.Ch.H. 999 > > ~~~^^O^^~~~ > > MTH/HE/SX/TA/EN S++(*) W N+++(++) PEG++(XX) Dr+ A>++ a++ C G+ QH+++ > 666++ Y++(+++) Z+ > > > >

5 7

Limits of reliability or is 99.999999999% realistic
by Sean Donelan 26 Nov '00

26 Nov '00

On Fri, 24 November 2000, Roeland Meyer wrote: > After all the discussion that we had on the Datacenter list, I am surprised > at this. You'd think that they'd have redundant PS's with redundant UPS's. There are interesting electrical faults which will kill redundant UPSes and redundant power supplies. However, I don't know if Sprint uses redudant power supplies, or had a failure affecting multiple power supplies on the STP. They use Compaq/Tandem NonStop hardware for their SCPs. After previous power problems at Sprint COs (i.e. Kansas City) which affected my service, I've asked my Sprint sales person what happened. He was never able to get anyone to call me back with an answer. > For the internet, I see an amazing number of systems with no redundancy > whatsoever. Of course, the first hardware failure usually corrects the > problem, at the cost of substantial down-time. But many second-tier ISPs and > dot-coms are still operating on brand-new equipment that hasn't started > hitting its MTBF specs yet and they don't even have a clue on their MTTR > ratings. In the next few years, I expect to see a lot more failures, as the > equipment starts to age. I'm not sure that is true. Brand new electronic equipment tends to have a period of infant mortality. If it survives, it tends to be reliable for a fairly long period of time. I had customers still using Proteon routers 10 years after Proteon discontinued the model. However scaling requires most dot-coms to replace/upgrade their equipment every few months, so they are always dealing with infant mortality. But back to my question. What is the real requirement? Amazon.COM had system problems on Friday, and their site was unusuable for 30 minutes, definitely not 99.999%. But what did that really mean? The FAA loses its radar for several hours in various parts of the country. What did that really mean? Essentially every system given as an example of "high- availability, high-reliability" I've looked at, doesn't hold up under close examination. Is 99.999% just F.U.D. created by consultants? Instead of pretending we can build systems which will never fail, should we work on a realistic understanding of what can be delivered?

2 1

The Cidr Report
by Tony Bates 24 Nov '00

24 Nov '00

This is an auto-generated mail on Fri Nov 24 12:00:00 PST 2000 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 24Nov00 0) General Status Table History ------------- Date Prefixes 051100 90552 061100 90504 071100 90705 081100 91061 091100 91153 221100 92414 231100 92419 241100 92527 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 91.16.23.0/24 from AS11770 *** Bogus 219.219.219.0 from AS2563 AS Summary ---------- Number of ASes in routing system: 9183 Number of ASes announcing only one prefix: 5305 (2973 cidr, 2332 classful) Largest number of cidr routes: 953 announced by AS701 Largest number of classful routes: 1360 announced by AS701 1) Gains by aggregating at the origin AS level --- 24Nov00 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS2563 430 135 295 68.6% KoRean Education Network AS1221 624 455 169 27.1% TELSTRA-AS AS9269 163 51 112 68.7% Hong Kong CTI AS701 1360 1248 112 8.2% Alternet AS2609 126 17 109 86.5% EUnet-TN AS7545 162 54 108 66.7% TPG Internet Pty Ltd AS8013 459 355 104 22.7% PSINET-CA AS271 209 112 97 46.4% BCnet Backbone AS6595 156 62 94 60.3% DODDSEUR AS4755 206 112 94 45.6% Videsh Sanchar Nigam Ltd. India AS13999 94 6 88 93.6% UNKNOWN AS7657 277 193 84 30.3% The Internet Group Limited AS705 334 253 81 24.3% ALTERNET-AS AS4293 343 262 81 23.6% Internal ASN for C&W AS174 527 446 81 15.4% Performance Systems International AS7496 102 25 77 75.5% Power Up AS4151 286 209 77 26.9% USDA Internet Access Network AS7046 323 248 75 23.2% UUNET-CUSTOMER AS724 238 165 73 30.7% DLA-ASNBLOCK-AS AS577 243 173 70 28.8% Bell Backbone AS3908 239 169 70 29.3% Supernet, Inc. AS7018 589 524 65 11.0% AT&T WorldNet Service Backbone AS5106 101 37 64 63.4% AADS-COLUMBUS AS3749 121 59 62 51.2% TECNET AS226 168 106 62 36.9% USC/Information Sciences Institut AS816 382 322 60 15.7% UUNET Canada (ASN-UUNETCA-AS4) AS376 141 81 60 42.6% RISQ AS3602 307 249 58 18.9% Sprint Canada Inc. AS16758 63 6 57 90.5% UNKNOWN AS11252 90 37 53 58.9% Idaho State University For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0