- NANOG - lists.nanog.org

RE: RBL-type BGP service for known rogue networks?
by Karyn Ulriksen 07 Jul '00

07 Jul '00

> Im not talking about spammer networks im talking about script kiddie > networks. We already have several systems for dealing with > spammers but > none for script kiddies. (I cant be the only person who sees a problem > with this picture?) What I was saying is that they had already set up some type of blackhole system that I was lead to believe they were doing at the router level (not mail system level). When they had us blackhole, we couldn't get past their core routers. I know your next thougt is that they just threw us into their route filter, but my understanding is that they offered a service that you subscribed to and the updated the filter on the fly. Which sounds like it would work for what you may be looking for in the "kiddie script network" scenario (which I assume means either IRC crapola or DOS crapola in general) or those wonderful .ru sites serving out that hardcore kiddie porn stuff via cgi calls. -----Original Message----- From: Mark Borchers [mailto:mborchers@splitrock.net] Sent: Thursday, July 06, 2000 12:30 PM To: 'nanog(a)merit.edu' Subject: RE: RBL-type BGP service for known rogue networks? The picture of a script-kiddie-tolerant network eludes me. Do you have data to show that they are NOT evenly dispersed around the Internet? > -----Original Message----- > From: Dan Hollis [mailto:goemon@sasami.anime.net] > Sent: Thursday, July 06, 2000 2:22 PM > To: Karyn Ulriksen > Cc: 'nanog(a)merit.edu' > Subject: RE: RBL-type BGP service for known rogue networks? > > Im not talking about spammer networks im talking about script kiddie > networks. We already have several systems for dealing with > spammers but > none for script kiddies. (I cant be the only person who sees a problem > with this picture?) > > -Dan > >

11 15

RE: LoadBalancing products: Foundry ServerIron
by Sutantyo, Danny 07 Jul '00

07 Jul '00

How about Local Director? -----Original Message----- From: Richard Colella [mailto:colella@aol.net] Sent: Thursday, July 06, 2000 5:38 AM To: nanog(a)merit.edu Subject: RE: LoadBalancing products: Foundry ServerIron Products are also available from Alteon, Cisco (Distributed Director) and Resonate. Last time I looked, none of these products does everything one wants, IMHO, but the set union of features comes pretty close. --Richard > > I believe BigIP has a product called DNS3 that serves a similar function. > One of our ".com's" uses it to support their dual co-lo set-up. > > -TY > > -----Original Message----- > From: Brantley Jones [mailto:bjones@redundant.net] > Sent: Wednesday, July 05, 2000 10:06 PM > To: nanog(a)merit.edu > Subject: RE: LoadBalancing products: Foundry ServerIron > > > > At 09:28 PM 7/5/2000 -0400, you wrote: > > >they also have the dns based solution > >available on serverirons. > >-- > >dima. > > Speaking of using a DNS proxy, does anybody know of anybody else doing this > besides Foundry?? > > Brantley > >

4 6

RE: LoadBalancing products: Foundry ServerIron
by Sutantyo, Danny 07 Jul '00

07 Jul '00

How about load balancing on the router? Any idea? I heard someone is using ospf method to load balance? -----Original Message----- From: tony bourke [mailto:tony@vegan.net] Sent: Friday, July 07, 2000 8:57 AM To: Roeland M.J. Meyer Cc: 'Sutantyo, Danny'; lb-l(a)vegan.net; nanog(a)merit.edu Subject: RE: LoadBalancing products: Foundry ServerIron True, thats why I don't particularly like LocalDirectors. Most of the other load balancing solutions do offer GigE, however. I prefer LB over clustering as it gives you more flexibility in what you use as far as your platform. Microsoft's clustering software limits you to microsoft, while I'm not sure if resonate will let you do both UNIX and Windows. The implementation is alot simpler as well, the LB is bascially acting as a glorified router in most cases, so its a very logical and elegant solutions. Clustering, at least in my experience, tends to be more combersome and complex to setup. But that is just my humble opinion. LB vs Clustering sounds like a possible religeous debate ;) Tony On Fri, 7 Jul 2000, Roeland M.J. Meyer wrote: > > Yeah, so why bother? As long as load balancers don't have GigE > ports, I can't use them and have to use something like Resonate. > Besides, LBs don't do site-site load balancing. If you want to do > distributed load sharing then there really isn't much choice. > Personally, I don't see benefits of LBs that proper clustering > wont give you. Component clusters work well, much better than > simple LB will give you. > > > From: tony bourke: Friday, July 07, 2000 8:01 AM > > > > you can do EtherChannel for more than 100 Mbps, but we all > > know how well > > that works. > > > > Tony > > > > On Fri, 7 Jul > > 2000, Roeland M.J. Meyer wrote: > > > > > > > > The last time I looked at one, I couldn't get it in > > > GigE...100baseTX only. Ergo, I couldn't run it on my > backbone. > > > > > > > Sutantyo, Danny: Thursday, July 06, 2000 8:37 AM > > > > > > > > How about Local Director? > > > > > > > > From: Richard Colella: Thursday, July 06, 2000 5:38 AM > > > > > > > > Products are also available from Alteon, Cisco (Distributed > > > > Director) and Resonate. Last time I looked, none of these > > > > products does everything one wants, IMHO, but the set union > > > > of features comes pretty close. > > -------------- -- ---- ---- --- - - - - - -- - - - - - - Tony Bourke tony(a)vegan.net

2 1

RE: LoadBalancing products: Foundry ServerIron
by Sutantyo, Danny 07 Jul '00

07 Jul '00

But if you take a look at the server itself (the log) it's not really load balancing, I use 'least conn' instead of 'round robin', and I thought the diff between 430 and 416 is just how many NIC card you can attach to the LD... -----Original Message----- From: Alberto Begliomini [mailto:aub@coldstone.com] Sent: Thursday, July 06, 2000 11:11 PM To: Karyn Ulriksen Cc: 'Sutantyo, Danny'; 'lb-l(a)vegan.net'; 'nanog(a)merit.edu' Subject: Re: LoadBalancing products: Foundry ServerIron It depends which Local Director. The 430 is screaming fast and the 416 in conjunction with a 6509 and ASLB is very fast too. I have been using both solutions at customers sites with peak traffic of around a million hits per day. -- Alberto U. Begliomini Email: aub(a)coldstone.com Coldstone Consulting, LLC Phone: 650-400-3990 Security, Data Centers Design and Management Fax: 650-654-5938 Karyn Ulriksen wrote: > > > How about Local Director? > > Everyone I've spoke to about LD is very unhappy with it's performance. > > -----Original Message----- > From: Richard Colella [mailto:colella@aol.net] > Sent: Thursday, July 06, 2000 5:38 AM > To: nanog(a)merit.edu > Subject: RE: LoadBalancing products: Foundry ServerIron > > Products are also available from Alteon, Cisco (Distributed > Director) and Resonate. Last time I looked, none of these > products does everything one wants, IMHO, but the set union > of features comes pretty close. > > --Richard > > > > > I believe BigIP has a product called DNS3 that serves a similar function. > > One of our ".com's" uses it to support their dual co-lo set-up. > > > > -TY > > > > -----Original Message----- > > From: Brantley Jones [mailto:bjones@redundant.net] > > Sent: Wednesday, July 05, 2000 10:06 PM > > To: nanog(a)merit.edu > > Subject: RE: LoadBalancing products: Foundry ServerIron > > > > > > > > At 09:28 PM 7/5/2000 -0400, you wrote: > > > > >they also have the dns based solution > > >available on serverirons. > > >-- > > >dima. > > > > Speaking of using a DNS proxy, does anybody know of anybody else doing > this > > besides Foundry?? > > > > Brantley > > > >

1 0

Re: scripts kiddie sites
by Hal Murray 07 Jul '00

07 Jul '00

[What is a scripts kiddie source network?] > A network which hosts machines which are used to root exploit other > systems. I think it's important to note that there are two types of hosts involved. One is the system where the cracker has a legitimate account. The other type is systems that have been broken into because their adiministrators either don't care or don't know how to run a secure system. This type of system can be used as a springboard to cause more mischief.

5 4

Hyperion/Adelphia outage in NJ
by Alex 07 Jul '00

07 Jul '00

Adpelphia Communications (formerly Hyperion) has had some sort of failure in Northern NJ (they are being very unspecific, possible a OC48 ring failure) that has brought down a significant portion of their Northern NJ network. While this may not be earth-shattering news, it should be noted that Adelphia carries a very significant portion of ISP dial traffic (they are a large CLEC in the state). (As a side note, because we generally rely on them for our phone service, and most of our information has the failed-numbers on them, if you need to reach the NAC NOC for the next few hours you can use our Bell number at 973.451.9397.)

1 0

RE: RBL-type BGP service for known rogue networks?
by Karyn Ulriksen 07 Jul '00

07 Jul '00

Christian, They are one of my DS3 providers and I have been doing business with them for the past four years. Their NOC staff is great and their customer service has made great strides over the past year (since I no longer have to beg, plead, and grovel to get things done). But I have had problems with their abuse department being (non)responsive. You would think that pulling a full DS3 and several T1's (and potentially pulling more from them) would give me a leg to stand on with them! I don't think that I have ever received even acknowledgement on emails sent to abuse, I end up going through my own channels in Exodus to get anything close to a remedy. Karyn -----Original Message----- From: Christian Nielsen [mailto:cnielsen@nielsen.net] Sent: Thursday, July 06, 2000 4:09 PM To: Karyn Ulriksen Subject: RE: RBL-type BGP service for known rogue networks? On Thu, 6 Jul 2000, Karyn Ulriksen wrote: > > Q. Yeah, but do we really want to black hole Exodus?? :) > A. Ok, Yeah, we really do... but can we get away with it?!! :) :) um, why would you say that about exodus? you seem to buy from them route-server.exodus.net>trace publichost.com Type escape sequence to abort. Tracing the route to publichost.com (216.34.231.43) 1 dcr03-p0-2.sntc02.exodus.net (209.1.169.178) 0 msec 0 msec 0 msec 2 bbr02-g3-0.sntc02.exodus.net (216.33.154.100) 0 msec 4 msec 0 msec 3 bbr02-p5-0.sntc03.exodus.net (209.185.249.146) 0 msec 0 msec 0 msec 4 bbr02-p5-0.irvn01.exodus.net (216.32.173.206) 12 msec 12 msec 8 msec 5 dcr03-g6-0.irvn01.exodus.net (216.33.164.3) 12 msec 12 msec 8 msec 6 acr02-p5-1-0.irvn01.exodus.net (216.33.164.74) 12 msec 12 msec 8 msec 7 209.67.157.214 12 msec 12 msec 12 msec 8 gateway-04090.sitestream.net (64.7.192.1) [AS 13890] 16 msec 12 msec 12 msec 9 publichost.com (216.34.231.43) [AS 13890] 12 msec 16 msec 12 msec route-server.exodus.net>sho ip bgp reg 13890 BGP table version is 23783371, local router ID is 209.1.220.234 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *>i64.7.192.0/20 209.67.157.214 1000 0 13890 i * i 209.67.157.214 1000 0 13890 i *>i208.48.184.0 209.67.157.214 1000 0 13890 i * i 209.67.157.214 1000 0 13890 i *>i216.34.230.0/23 209.67.157.214 1000 0 13890 i * i 209.67.157.214 1000 0 13890 i

3 2

RE: RBL-type BGP service for known rogue networks?
by Karyn Ulriksen 07 Jul '00

07 Jul '00

Do you think that the car thief scenario comes into play here? Maybe an alarm system wont *really* keep a determined thief from stealing a car, but isn't he more likely to move onto something easier? And, yes, I do understand the mentality of the "bigger challenge". But, I've been able to identify the true source of a forged packet and filter it knowing that they could switch to attacking from another IP. However, I think only once or twice out of thirty or so incidents over the past few years have they come back in anytime soon from anywhere else. Karyn -----Original Message----- From: jlewis(a)lewis.org [mailto:jlewis@lewis.org] Sent: Thursday, July 06, 2000 2:35 PM To: Dan Hollis Cc: nanog(a)merit.edu Subject: Re: RBL-type BGP service for known rogue networks? On Thu, 6 Jul 2000, Dan Hollis wrote: > 1) Someone sets up server X on company Y network and starts rooting sites. > 2) company Y, once notified, refuses to shut down server X, even when its > been CONFIRMED server X is indeed rooting sites. > 3) company Y has a HISTORY of such attacks and refuses to take any action. > > tin.it obviously fits all 3 criteria and thus would be blackholed. it > might not get them to change their behaviour, but at least people who > subscribe to the blackhole list wouldnt be rooted by tin.it customers Except that any good script kid has root on numerous boxes. Just blocking a well known site full of rooted boxes probably won't do much good since they crack and scan from random boxes all over the world as they root them. ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route System Administrator | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

3 2

Re: [load balancing] Re: LoadBalancing products: Foundry ServerIron
by tony bourke 07 Jul '00

07 Jul '00

couple of drawbacks to the LD that other products do not suffer from: * lack of cookie-based persistance support * only works when servers and LB instance are on the same subnet (having them on different subnets would have the LB acting as a router which is great for packet filtering) * lack of any other Layer 5 functionality * is a server-based LB (If you pop one open, you'll see a pentium chip inside) rather than ASIC based Tony On Fri, 7 Jul 2000, Dru Nelson wrote: > > I'm unhappy with the local director. The fact that it cannot route > is a major disappointment (it is more of a switch than a router). > > Dru Nelson > San Mateo, California > > > On Thu, 6 Jul 2000, Alberto Begliomini wrote: > > > It depends which Local Director. The 430 is screaming fast and the 416 > > in conjunction with a 6509 and ASLB is very fast too. I have been using > > both solutions at customers sites with peak traffic of around a million > > hits per day. > > > > -- > > Alberto U. Begliomini Email: aub(a)coldstone.com > > Coldstone Consulting, LLC Phone: 650-400-3990 > > Security, Data Centers Design and Management Fax: 650-654-5938 > > > > > > Karyn Ulriksen wrote: > > > > > > > How about Local Director? > > > > > > Everyone I've spoke to about LD is very unhappy with it's performance. > > > > > > -----Original Message----- > > > From: Richard Colella [mailto:colella@aol.net] > > > Sent: Thursday, July 06, 2000 5:38 AM > > > To: nanog(a)merit.edu > > > Subject: RE: LoadBalancing products: Foundry ServerIron > > > > > > Products are also available from Alteon, Cisco (Distributed > > > Director) and Resonate. Last time I looked, none of these > > > products does everything one wants, IMHO, but the set union > > > of features comes pretty close. > > > > > > --Richard > > > > > > > > > > > I believe BigIP has a product called DNS3 that serves a similar function. > > > > One of our ".com's" uses it to support their dual co-lo set-up. > > > > > > > > -TY > > > > > > > > -----Original Message----- > > > > From: Brantley Jones [mailto:bjones@redundant.net] > > > > Sent: Wednesday, July 05, 2000 10:06 PM > > > > To: nanog(a)merit.edu > > > > Subject: RE: LoadBalancing products: Foundry ServerIron > > > > > > > > > > > > > > > > At 09:28 PM 7/5/2000 -0400, you wrote: > > > > > > > > >they also have the dns based solution > > > > >available on serverirons. > > > > >-- > > > > >dima. > > > > > > > > Speaking of using a DNS proxy, does anybody know of anybody else doing > > > this > > > > besides Foundry?? > > > > > > > > Brantley > > > > > > > > > > > -------------- -- ---- ---- --- - - - - - -- - - - - - - Tony Bourke tony(a)vegan.net

1 0

APNIC REGION CIDR blocks - smallest allocations
by Anne Lord 07 Jul '00

07 Jul '00

Hi, In response to a request to this list, APNIC has now compiled information about the minimum allocation sizes for the APNIC region address blocks. You can find this information at the URL below. http://www.apnic.net/db/min-alloc.html I hope this information is useful. Regards, Anne Manager, Member Services -------------------------------------------------------------------- Asia Pacific Network Information Centre phone: +61 7 3367 0490 http://www.apnic.net fax: +61 7 3367 0482 _____________________________________________________________________ See you at the APNIC Meeting - Brisbane, Australia 25-27 October 2000

1 0