- NANOG - lists.nanog.org

RE: Operational impact of filtering SMB/NETBIOS traffic?
by Roeland Meyer 20 Nov '00

20 Nov '00

> From: woods(a)weird.com [mailto:woods@weird.com] > Sent: Sunday, November 19, 2000 12:19 PM > To: nanog(a)nanog.org > Subject: RE: Operational impact of filtering SMB/NETBIOS traffic? > [ On Sunday, November 19, 2000 at 10:56:03 (-0800), Roeland > Meyer wrote: ] > > Subject: RE: Operational impact of filtering SMB/NETBIOS traffic? > I have, finally, started to encounter access providers who filter > spoofed source addresses though (and three cheers to them!). Yes, I join your cheers. > > Say that to a dot-com VP and manage to keep your business > relationship > > (paycheck). If you can do that, I want you on my sales force. > > I think you're looking at this the wrong way around. If the > dot-com VP > who pays you isn't in fear of your superior technical capabilities and > your control over his or her network then you need to remind > that person > just how much they depend on you and just how little they > want to anger > you and that they'd better do things your way or they'll not have a > dot-com business to be VP of. Customer retention via fear mechanism has always been abhorent to me. They usually are intelligent enough to realize that removing the source of the fear is a good-thing<tm>. > Of course if you're just "selling" to the dot-com VP then yes, you're > not exactly going to be able to tell them to do things your way unless > you're able to present it as a solution to even more problems > than they percieve it will present to them. Exactly the case, most of the time. What many techies don't understand that a fearful customer is one whom will not be a repeat customer.

2 1

RE: Operational impact of filtering SMB/NETBIOS traffic?
by Roeland Meyer 19 Nov '00

19 Nov '00

> From: Shawn McMahon [mailto:smcmahon@eiv.com] > Sent: Sunday, November 19, 2000 10:08 AM > So you're hypothesizing that this customer will: > > 1) Be behind a firewall that blocks ssh. Sometimes ... been there ... too often. > 2) Be behind a firewall that DOESN'T block SMB. Usually the case. > 3) Not be in a position to have that policy changed. Almost always the case with a client. > 4) Not be violating his corporation's policies when he > connects through you. Covered by NDA ... no problem. Besides, corporate policy enforcement is not part of the transit provider contract.

2 1

RE: BGP testing?
by Irwin Lazar 19 Nov '00

19 Nov '00

Have a look at http://www.networkmagazine.com/article/DCM20000510S0017 It is a lab test performed by the old "Data Communications" magazine on the Juniper M40. In it, they detail how they used a tool from QOSnetics that was capable of generating up 520,000 unique routes (with a /22 prefix). Irwin ------ Irwin Lazar, Senior Consultant The Burton Group - www.tbg.com ilazar(a)tbg.com 703-742-9659 (office) 703-402-4119(cell) The Ultimate Resource For Network Architects > -----Original Message----- > From: Timothy Brown [mailto:tcb@ga.prestige.net] > Sent: Friday, November 17, 2000 7:17 PM > To: nanog(a)merit.edu > Subject: BGP testing? > > > > Hey folks, > > Does anyone have a script or a series thereof to do > large-scale BGP testing? > I'm looking for scripts that will generate and nail down > several hundred > networks of varying sizes, and/or fake peering relationships > with a similar > purpose, and/or do things that don't meet the BGP protocol > standards, etc. > > Thanks for any responses. > > Tim > >

2 1

RE: Operational impact of filtering SMB/NETBIOS traffic?
by Roeland Meyer 19 Nov '00

19 Nov '00

> From: Ethan Butterfield [mailto:primus@veris.org] > Sent: Sunday, November 19, 2000 11:45 AM > To: Jim Mercer > Cc: nanog(a)nanog.org > Subject: Re: Operational impact of filtering SMB/NETBIOS traffic? > > From: Jim Mercer <jim(a)reptiles.org> > > Subject: Re: Operational impact of filtering SMB/NETBIOS traffic? > > > > as i understand it, ipsec doesn't use ports. > > > > Yes and no. IPSec uses UDP port 500 for the ISAKMP key > exchange and the > tunnel setup, but all other traffic is IP Protocol 50 (ESP) > or 51 (AH). > Most firewalls I've seen block wierd (i.e., just about > everything that's > not standard TCP or IP Protocol 1 (ICMP)) by default, or at > least flag it > as strange. In shops that block SSH, this is also what they do and is exactly what I meant. I apologize for not communicating clearly and typing poorly (too many decades writing code). > It should not be hard to set up a persistent IPSec tunnel between UNIX > hosts in order to pass SMB/NETBIOS traffic. You could even do it > router-to-router in gateway mode and have the traffic be > cleartext on the > internal side of both networks, and 3DES/SHA-1 to the rest of > the world. When possible, I do this. The whole point of this is that transit providers should not be filtering unless specifically requested. > For the Road Warrior, though, it's going to be somewhat more difficult > without using a VPN, as the Win32 implementations of IPSec are > somewhat...lacking. (Or at least they were six months ago when I last > tried the SSH IPsec shim for NT4.) Win2K's built-in IPSec > makes life much > easier...if you've got clients using Win2K. Can't vouch for > interoperability between Win2K-UNIX, though. Never tried it myself. I did, just as soon as it came out. It sux! Active directory also does a number on the DOMAIN stuff in Samba. Fortunately, it allows backwards compatibility to old-style WinNT4SP5 hosts. In fact, and I am sure that MS did it to mess with the Samba folks, the entire DOMAIN stuff has been re-spec'd and re-written. --- I can't afford to have a preference, I must be agnostic.

1 0

RE: Operational impact of filtering SMB/NETBIOS traffic?
by Roeland Meyer 19 Nov '00

19 Nov '00

The scenario that you miss is Win2K lap-tops and workstations with Unix servers. Our policies are unix-unix = local-only NFS, and win-unix = Samba. This is mainly because of known flaws with NFS over internet security, but also because of the expense and difficulty of getting win-anything to do NFS. > -----Original Message----- > From: Jim Mercer [mailto:jim@reptiles.org] > Sent: Sunday, November 19, 2000 9:29 AM > as far as samba working better than NFS, that is a religious argument. No it isn't, NFS has known exploits. I've had a server owned three times in the past four years, twice via BIND and once via NFS. None via Samba. > if you are using SMB to share files between unix systems, > then i have a bit > of trouble with that last line of the above. see: above > personally, i can't think of any applications where i would > attempt to do > any kinda filesystem sharing across the internet. How about collaboration servers? > i suspect the widespread use of SMB on the internet is again, > because of the > brain-dead applications produced by a braindead company and software > produced by lazy programmers working in the braindead company's API's. > > why does the application need a "share"? can it not just > negotiate the > information needed without mounting the entire office over a > 33.6K connection? You ARE joking, right? I haven't seen a 33.6K connection in years. A part of every deal is LAN access that usually shares, at the least, a T1. Also, you are ignorant of the way Win PDCs operate. I DHCP connect to the local LAN and log into my home PDC, from the clients site. Otherwise, the client has to give me access to their PDC and their PDC winds up owning my lap-top and I have to re-configure this for every client (sometime three per day). Everytime my profile gets blown away. At the end of the day, my lap-top would be a useless piece of junk and I would have to re-install the OS...not! > > > geez, if the filter was there, are you saying that people who > > > _need_ SMB shares are too brain-dead to come up with a straight > > > forward way to make it get around the filter? > > > > There is no straight-forward way around a filter, by definition the > > straight-forward way is to not have the filter! > > no, the brain-dead easy way around the filter is to have no > filter at all. > > i'm not an SMB user (outside a few LAN's where we explicitly > drop it all > on the floor before it gets out of the network). You just told me that you are not in marketing/management, you don't do docs, you don't collaborate on docs, and/or you never leave your corporate site to do any of the above. > could you not use an IPSec tunnel from one LAN to another, > then run SMB > over that tunnel? > > is it not possible to use ssh port forwarding to move the > packets through > a secure tunnel that way? When I can, that's what I do, via F-Secure port forwarding. However, many shops explicitly block port 22. This kills IPsec as well.

4 3

RE: Operational impact of filtering SMB/NETBIOS traffic?
by Roeland Meyer 19 Nov '00

19 Nov '00

> From: Jim Mercer [mailto:jim@reptiles.org] > Sent: Sunday, November 19, 2000 10:38 AM > > On Sun, Nov 19, 2000 at 10:25:18AM -0800, Roeland Meyer wrote: > > > why does the application need a "share"? can it not just > > > negotiate the information needed without mounting the entire > > > office over a 33.6K connection? > > > > You ARE joking, right? I haven't seen a 33.6K connection in years. > > well, you live a sheltered life. > > i'm kinda getting tired of people who design/implement wide > area applications > while wearing blinders. So am I. Transit providers shouldn't be filtering without specific request. > > > could you not use an IPSec tunnel from one LAN to another, > > > then run SMB over that tunnel? > > > > > > is it not possible to use ssh port forwarding to move the > > > packets through a secure tunnel that way? > > > > When I can, that's what I do, via F-Secure port forwarding. > However, many > > shops explicitly block port 22. This kills IPsec as well. > > if many shops are explicitly blocking port 22, but allowing > SMB, then they > need their heads examined. We agree there. I prefer the SSH connection. That's why we went to the trouble to set it up in the first place. > i'm not sure how port 22 effects IPsec. Kills it dead, just like SSH. > it seems that you are arguing that filtering SMB will > inadvertantly effect > a bunch of boneheads that don't know what they are doing > beyond point and > click. Say that to a dot-com VP and manage to keep your business relationship (paycheck). If you can do that, I want you on my sales force. > i don't have a problem with that. sure would clear off a > bunch of bandwidth > from my networks to further enable the users who aren't boneheads (or > being managed by boneheads). The "A" students work in research labs, run by the "B" students, in companies, that are managed by the "C" students, for the owners, that were the "D" students. They may be boneheads, but who has the money?

4 3

Re: Operational impact of filtering SMB/NETBIOS traffic?
by Ethan Butterfield 19 Nov '00

19 Nov '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > From: Jim Mercer <jim(a)reptiles.org> > Subject: Re: Operational impact of filtering SMB/NETBIOS traffic? > > as i understand it, ipsec doesn't use ports. > Yes and no. IPSec uses UDP port 500 for the ISAKMP key exchange and the tunnel setup, but all other traffic is IP Protocol 50 (ESP) or 51 (AH). Most firewalls I've seen block wierd (i.e., just about everything that's not standard TCP or IP Protocol 1 (ICMP)) by default, or at least flag it as strange. It should not be hard to set up a persistent IPSec tunnel between UNIX hosts in order to pass SMB/NETBIOS traffic. You could even do it router-to-router in gateway mode and have the traffic be cleartext on the internal side of both networks, and 3DES/SHA-1 to the rest of the world. For the Road Warrior, though, it's going to be somewhat more difficult without using a VPN, as the Win32 implementations of IPSec are somewhat...lacking. (Or at least they were six months ago when I last tried the SSH IPsec shim for NT4.) Win2K's built-in IPSec makes life much easier...if you've got clients using Win2K. Can't vouch for interoperability between Win2K-UNIX, though. Never tried it myself. - -- "By four o'clock, I've discounted suicide in favor of killing everyone else in the entire world instead." - Spider Jerusalem, "Transmetropolitan" -----BEGIN PGP SIGNATURE----- Comment: For info see http://www.gnupg.org iD8DBQE6GC2u36NTGsm+2Z4RArBVAJwPWUyTX9fzVctkx+RkVzPtdonzUgCeNaVY s/0K1mD1Vvd/xM+/4kyHzzk= =UwTF -----END PGP SIGNATURE-----

1 0

RE: Operational impact of filtering SMB/NETBIOS traffic?
by Roeland Meyer 19 Nov '00

19 Nov '00

> From: Jim Mercer [mailto:jim@reptiles.org] > Sent: Saturday, November 18, 2000 8:49 PM > > On Sat, Nov 18, 2000 at 08:19:12PM -0800, Roeland Meyer wrote: > > You are considering killing off a whole bunch of legitimate > use because > > some are too brain-dead to not have unintentional shares on > the internet? > > well, maybe if there was a global filter on SMB then the > brain-dead company > that produces the brain-dead software will wake up and > realize that maybe > it shouldn't produce software that by default leaves their users open > to intrusion or viruses. You are assuming (wrongly) that microshit is the only one using that protocol. Have you never heard of the samba project? I remember explicitly referencing smb.conf files. That's Unix/Samba bud. I also mentioned that it works better than NFS. I don't recall microshit-anything shipping with NFS. Believe it or not, one or two of us actually know what we're doing. > geez, if the filter was there, are you saying that people who > _need_ SMB > shares are too brain-dead to come up with a straight forward > way to make > it get around the filter? There is no straight-forward way around a filter, by definition the straight-forward way is to not have the filter!

2 1

RE: Operational impact of filtering SMB/NETBIOS traffic?
by Roeland Meyer 19 Nov '00

19 Nov '00

You'd have LOTs of complaint from me and many of my clients. Many of us log into our external gateway PDCs from foriegn locations. We have shares because we want shares. You are considering killing off a whole bunch of legitimate use because some are too brain-dead to not have unintentional shares on the internet? We use SMB/Samba INSTEAD of NFS because we believe SMB to be more secure. smb.conf certainly gives more security options than exports does. > -----Original Message----- > From: Scott Call [mailto:scall@devolution.com] > Sent: Tuesday, November 14, 2000 12:21 PM > To: nanog(a)nanog.org > Subject: Operational impact of filtering SMB/NETBIOS traffic? > > > > > Due to an increasing number of intrusions into windows-based machines > through unprotected shares, I've started filtering both incoming and > outgoing traffic for our customers on ports 138/139. > > So far this has caught a fair amount of traffic coming from > customers, > but none have called to complain about a lack of connectivity. > > Because this traffic is IP traffic, I wanted to ask others on > this list > how they treat SMB traffic on their backbones? > > Thanks > -Scott > >

7 6

Re: [eggnog] Re: NANOG isn't NANOG anymore
by jamie rishaw 19 Nov '00

19 Nov '00

by the way.. in the immortal words of rbush.. "how do i configure my router for this?" jamie

1 0