- NANOG - lists.nanog.org

RE: Security on a home DSL Line
by Mathew Butler 03 Nov '00

03 Nov '00

Actually, I think it'd be nice if there was an "Expert Settings" mode that you were told how to get into in the manual... and that only that menu would be able to set it to ultra-paranoid (i.e., debugging) level. The default user interface should only be able to set it up to 'mildly paranoid'. (Incidentally, there was a roaring discussion about this over on grc.com's newsgroups, about a month back. Since Steve Gibson configured his newsserver to archive all messages into the archive.* hierarchy, you might/should be able to find it all... if you want to spend the time to do so.) -Mat Butler -----Original Message----- From: Joe Shaw [mailto:jshaw@insync.net] Sent: Friday, November 03, 2000 2:11 PM To: Rishi Singh Cc: 'Dennis Dayman'; 'nanog(a)merit.edu' Subject: RE: Security on a home DSL Line It still doesn't do things like list the source port of the offending attack. It still reports things like traceroutes as suspicious activity. It's not so much that BlackIce is a bad product, it's the fact that most of the users who use it and the other software packages like it are generally not very clued and will fly off the handle reporting all sorts of things as attacks or attempts to access their computer. I've actually spent an entire weekend being paged by our NOC to deal with someone who had BlackIce, and another program that would e-mail abuse@ for the IP address it considered to be attacking, in this case what it was saying was a UDP flood coming from various IP's of equipment we have. One thing led to another, and it turned out he was being UDP flooded by streaming media servers (RTSP anyone?), and his automated reporting facility was mailing these complaints out to the NOC. We had another person who was screaming bloody murder about being hacked, when he was tracerouted to twice over a 24 hour period. That hardly counts as an intrusion. Generally, if someone is having an issue and all they have to go in is BlackIce output, we need pretty evident proof that there's an actual problem. One cool feature is the fact that BlackIce can detect certain types of traffic, like nmap scans, queso, snmp queries, and the like. But if all I've got to go on is a 5 packet 'UDP flood,' the source IP, the destination IP, and the destination port, it gets old quick. Couldn't it just look at the source port and say "This looks like RTSP," or "This is only 5 packets, probably not a big deal." It really depends on how sensitive the person who has it sets it, but I've yet to see anyone who doesn't set it as high as it will go. A warning that says it might be as ultra-paranoid as a strung out conspiracy theorist at the highest settings might not be a bad idea. I think the last version we looked at was the latest version available in July/August. We were looking at it to use as a firewalling solution for our mobile users, but we just couldn't deal with the amount of calls people would make to us saying they were being scanned by all the local windows machines on the network while they were in the office, or countless other issues. We're still looking at other solutions, but few really have any sort of centralized monitoring/reporting ability. -- Joseph W. Shaw Sr. Network Security Specialist for Big Company not to be named because I don't speak for them here. I have public opinions, and they don't. On Fri, 3 Nov 2000, Rishi Singh wrote: > That was a very old version of BlackIce Defender you are referring to. I > know exactly which version you are talking about as I had similar problems > with it. However NetworkIce seems to be a pretty responsive company when it > comes to complaints and I beta test their products for them. > > All of the dev/null stuff has been eliminated in the last few releases, > including erroneous reports and extraneous information. You should try it > now, I think you will be more impressed than the experiences you had with > the older version.

1 0

RE: Security on a home DSL Line
by Rishi Singh 03 Nov '00

03 Nov '00

Dennis, That was a very old version of BlackIce Defender you are referring to. I know exactly which version you are talking about as I had similar problems with it. However NetworkIce seems to be a pretty responsive company when it comes to complaints and I beta test their products for them. All of the dev/null stuff has been eliminated in the last few releases, including erroneous reports and extraneous information. You should try it now, I think you will be more impressed than the experiences you had with the older version. -----Original Message----- From: Dennis Dayman [mailto:ddayman@mail-abuse.org] Sent: Friday, November 03, 2000 11:21 AM To: nanog(a)merit.edu Subject: RE: Security on a home DSL Line > Hmm.. Zone Alarm is a nice product, but I'd prefer to use > BlackIce Defender > for all my Wintel boxes. When I was Director at SBCIS we dev/null complaints coming in from BlackICE. It tends to report unnecessary information or attempts. It said things about TCP 80, it would report customers other windows boxes on the same home DSL line doing netbios, and sometimes depending on their mail client setup's would report them check their own E-Mail. --------------------------- Thanks Dennis Dayman Senior Consultant Consulting Services Group at MAPS http://www.mail-abuse.org ddayman(a)mail-abuse.org Voice/FAX 972-682-7556 ---------------------------------------------------------------------------- -- What goes up, must come down. Ask any system administrator. ---------------------------------------------------------------------------- --

3 2

The Cidr Report
by Tony Bates 03 Nov '00

03 Nov '00

This is an auto-generated mail on Fri Nov 3 12:00:00 PST 2000 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 03Nov00 0) General Status Table History ------------- Date Prefixes 281000 89474 291000 89460 291000 89478 301000 89458 311000 89649 011100 90189 021100 91627 031100 90444 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 8951 Number of ASes announcing only one prefix: 5138 (2860 cidr, 2278 classful) Largest number of cidr routes: 921 announced by AS701 Largest number of classful routes: 1178 announced by AS701 1) Gains by aggregating at the origin AS level --- 03Nov00 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 431 150 281 65.2% BCnet Backbone AS1221 604 450 154 25.5% TELSTRA-AS AS2609 128 8 120 93.8% EUnet-TN AS4755 201 101 100 49.8% Videsh Sanchar Nigam Ltd. India AS174 538 453 85 15.8% Performance Systems International AS4293 340 258 82 24.1% Internal ASN for C&W AS13999 91 9 82 90.1% UNKNOWN AS3908 252 173 79 31.3% Supernet, Inc. AS577 244 174 70 28.7% Bell Backbone AS5106 101 37 64 63.4% AADS-COLUMBUS AS3749 119 58 61 51.3% TECNET AS226 167 106 61 36.5% USC/Information Sciences Institut AS16758 63 6 57 90.5% UNKNOWN AS376 132 76 56 42.4% RISQ AS1727 135 82 53 39.3% MRMS-WEST AS11252 90 37 53 58.9% Idaho State University AS3602 294 242 52 17.7% Sprint Canada Inc. AS5102 74 24 50 67.6% AADS-CHAMPAIGN AS4740 312 262 50 16.0% Ozemail Pty Ltd (ASN-OZEMAIL) AS6429 149 101 48 32.2% FirstCom Internet AS1 631 583 48 7.6% GTE Internetworking AS209 272 227 45 16.5% Qwest Communications AS549 192 148 44 22.9% ONet Backbone AS1239 483 441 42 8.7% SprintLink Backbone AS6082 145 105 40 27.6% HarvardNet, Inc AS4151 89 50 39 43.8% USDA Internet Access Network AS12235 43 4 39 90.7% Cove Software Systems Inc AS1267 60 23 37 61.7% Infostrada S.p.A. AS14 50 14 36 72.0% Columbia University in the City o AS637 55 20 35 63.6% PENS-NET-AS For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

RE: Security on a home DSL Line
by David Lesher 03 Nov '00

03 Nov '00

Shameless plug from a beta tester: the ZyXEL P312... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: Security on a home DSL Line
by Brandon Hume 03 Nov '00

03 Nov '00

>Otherwise, your idea is perfect; Linux or OpenBSD, whichever you're >more comfortable with, will give you the most flexibility, and Solaris x86 >might work but will be dog-slow and unless you have a lot of RAM, >completely unusuable. For such a weakly defined measure of "a lot of RAM", this statement is inaccurate. Solaris 8 x86 will run comfortably, without X and superfluous processes (to say: a rational firewall/NAT box configuration) within 12M of RAM. A passing knowledge of Solaris would not let a person know this to be true, however, since Sun states its memory requirements on the assumption you'd be using X. That being said, OpenBSD is probably the best choice. It requires more skill to install, but less skill to secure, and would probably run better *by default* on a minimal machine. After that I'd suggest Solaris, since it installs less crap than most of the Linux distributions (note: most). Driver issues might force your hand to the Linuxes, of course. I also place OpenBSD and Solaris above Linux because they both give you the use of IPFilter, which I believe to be just flat-out superior to IPChains. -- Brandon Hume - hume -> BOFH.Halifax.NS.Ca, http://WWW.BOFH.Halifax.NS.Ca/ -> Solaris Snob and general NOCMonkey

2 1

RE: If the network is always down, how come I can post a message
by Roeland Meyer 03 Nov '00

03 Nov '00

For the telco, use www.dialpad.com ... it rocks! For the Internet, there are always portions that are not quite working. This will get worse, the larger it gets. I'm a CerfNet down-stream and ATT/Cerf digestion problems have been making me crazy for the past few months (routes going up, down, side-ways, you name it ...). In fact, it's getting to the point that I'm about to start recommending at least three different upstreams to clients (multi-home). The problem with that is that CIDR gets in the way. I plan to take it up, with ICANN/ASO in about a week. > -----Original Message----- > From: Alex Bligh [mailto:amb@gxn.net] > Sent: Friday, November 03, 2000 7:07 AM > To: Sean Donelan > Cc: nanog(a)merit.edu > Subject: Re: If the network is always down, how come I can post a > message > > > > Sean, > > This is because the phone system is considered down when the > subscriber > can dial no numbers. The internet is considered down when you can't > reach any particular web site (or collection thereof). If people > can't reach a given company by phone they say 'their phone line is > down'. I have given up counting the number of times I have spent > trying to dial the US from the UK and got fast busy (or worse). > > -- > Alex Bligh > VP Core Network, XO Communications - http://www.xo.com/ > (formerly Nextlink Inc, Concentric Network Corporation > GX Networks, Xara Networks) > > >

1 0

If the network is always down, how come I can post a message
by Sean Donelan 03 Nov '00

03 Nov '00

Discussing network reliability for the last week, I've been beating my head against the "phone system is 99.999% reliable, but the Internet crashes all the time." One anecdotal data point, I've been reporting about Internet problems for the last five years or so. Over the last 5 years no Internet network event has been so severe it prevented me from reporting about the problem on the net. In a strange way, my postings about the problems on the net are proof of the reliability of the same network. In the same time period, I've lost my telephone service several times. 1. The Ladue, MO central office was struck by lightning, and the generator failed 2. The Rochelle Park, NJ central office was flooded by a hurricane the week I started work in northern New Jersey 3. I moved to Pacific Bell country, enough said I've lost my pager service multiple times 1. Galaxy IV died 2. Pagenet network problems Even the Associated Press has gone down in the last five years. So I'm sick and tired about hearing the telephone network is 99.999% reliable and the Internet isn't.

3 2

Security on a home DSL Line
by J. Gilmore 03 Nov '00

03 Nov '00

I'm looking to beef up security on a home DSL line. Currently I am using ZoneAlarm (the freeware version). I'm thinking of taking an old Pentium 120, and setting that up as a firewall, but wanted to know if anyone else had a better idea. __________________________________________________ Do You Yahoo!? >From homework help to love advice, Yahoo! Experts has your answer. http://experts.yahoo.com/

10 9

Re: DoS attacks, NSPs unresponsiveness
by Sean Donelan 03 Nov '00

03 Nov '00

On Thu, 02 November 2000, Hank Nussbacher wrote: > We can write as many RFCs and BCPs as we want and discuss this item again > and again - the truth is - nothing we say or do will make a difference > until the government creates regulation on the matter. The same way every > phone company has to run a 911 number in event of emergencies, so too must > ISPs provide an abuse(a)xxxxx.net email address that not only gives an > auto-reply but actually has people behind it to handle the problem. People from at least three different US Government agencies have asked me if there is a need for government intervention in this precise area, either full-blown laws and regulations; or nudging such as including it in GSA and other government contracts (i.e. like the drug-free workplace requirements if you want to bid on a government contract). I'm old enough to remember the AUP NSF days (and I walked to school in the snow, up hill both ways). I'm afraid if we go down this path, the intervention won't be limited.

1 0

Fire protection in ISPs and collocation facilities
by Sean Donelan 03 Nov '00

03 Nov '00

What has been the fire experience for ISPs and collocation facilities? Other than the infamous Ascend incidents, I don't recall any ISP or collocation fire incidents during the last five years. Why am I asking, because some code officials seem to feel the need to develop a special code to cover collocation facilities popping up all over the place. But I think most collocation facilities are generally constructed to exceed the current codes anyway, and are generally much lower risk than the "normal" occupancies around them. The US Air Force is revising its design guidance for fire protection of computer-electronic equipment installations this year. In the most recent draft, the USAF has ultra sensitive air sampling smoke detection, wet-pipe automatic sprinklers and smoke exhaust systems in its design guidance. Based on a five year study, the USAF found the most significant fire and smoke threats have originated outside the computer-electronic equipment room. Two-thirds of the fires originate outside the computer-electronic room. One-third of the fires originated within the vicinity of the computer- electronic equipment. Less than 25% of the fires originate within the computer-electronic equipment. The single largest threat of fire to computer-electronic equipment is the electrical distribution system. Two-thirds of the dollar losses (1/3 of the fires) are caused by fixed wiring, transformers, power switching gear, light fixtures and extension cords. In over 50% of the fires, the first material ignited is some type of plastic, including electrical insulation.

1 0