- NANOG - lists.nanog.org

Trust in cyberspace
by Sean Donelan 16 Jan '00

16 Jan '00

I visited the bookstore (you know, those places you bought books before Amazon.com) and picked up a copy of "Trust in cyberspace." Although much of the book is concerned with "security," I was pleased to see some coverage of other problems which reduce people's confidence in network systems. The chapter on the "Public Telephone Network" (PTN) and the Internet trustworthiness has a very good overview of the design decisions, types of failures and attacks. Unlike many cyber-assurance studies which only focus on the "hacker" attack; congestion, link failure (aka Backhoe attack), and operator error are included in this book. Most of us are aware of the security weakness with the current Internet, but this book is one of the first I've seen to list several weaknesses in the Public Telephone Network in on place. One oversight is the book doesn't really explain the definition of "failure" or "outage" varies between the PTN and the Internet. So you can't easily compare reliability measurements between them. The famous 99.999% reliability of the PTN doesn't translate to the Internet because the Internet measurements include things normally excluded by the PTN measurements, e.g. congestion. One important buzzword I would call your attention to is "Minimum Essential Information Infrastructure." This is a creation of a RAND researcher in 1995, and is percolating around the cyber-assurance groups.

1 0

Re: Fw: Administrivia: ORBS [LONG]
by Randy Bush 16 Jan '00

16 Jan '00

> People who object to their networks being scanned for SMTP vulnerabilities > on occasion (with an interval that ranges from a couple of weeks to a > couple of months) have something to hide. thank you joe mccarthy randy

1 0

Re: Fw: Administrivia: ORBS
by Paul Vixie 15 Jan '00

15 Jan '00

patrick(a)ianai.net (I Am Not An Isp) writes: > What do other open relay lists (e.g. MAPS/RSS) do when they are filtered at > the network level? That's a misleading question. MAPS RSS doesn't probe for relay openness unless spam has been received from the relay in question. OTOH, if there is spam receipt and if the relay doesn't appear to be reachable, a human operator can decide that a firewall might be involved and block the relay in spite of our inability to test it. MAPS RSS never blocks whole address ranges, only /32's. ORBS is apparently blocking whole /16's belonging to Abovenet only because Abovenet refuses to have whole /16's probed for SMTP servers and then having each such server probed for relay openness. (I can't say as I blame them.) -- Paul Vixie <vixie(a)mibh.net> >> But what *IS* the internet? > It's the largest equivalence class in the reflexive transitive > symmetric closure of the relationship "can be reached by an IP > packet from". --Seth Breidbart

5 5

Re: Fw: Administrivia: ORBS
by Paul A Vixie 15 Jan '00

15 Jan '00

> I don't have much of a problem about Abovenet having a policy of not > allowing spam across their network, as you say it is theirs. What is bad, > however, is that Abovenet still advertise the prefix surrending hosts they > block, blackholing these hosts for their BGP mutilhomed customers - this is pretty hard for abovenet to fix, since no router i'm aware of is able to take in a /13 from some customer, blackhole a smattering of /32's inside of it, and only send the remnants of the /13 to its downstreams. what MIBH does, as a transit customer of abovenet among others, is to take an RBL BGP feed just for the purpose of route-mapping all of its contents toward one of our other transit providers. (MIBH is the transit provider for MAPS, among other things, and MAPS has web servers which *must* be able to be reached by people listed on its RBL. is that funny, or what?) i agree that this is painful, and if it were my network i'd find some way to let abovenet's multihomed customers automatically avoid abovenet for things which aren't going to work.

1 0

ARE YOU BEING INVESTIGATED?
by pafeze55＠afa.asso.fr 15 Jan '00

15 Jan '00

******************************************************* This list is opt-in only. We are linked to many web sites that offer free subscriptions to our opt-in list. You will be removed from this list at any time by following the simple instructions that can be found at the end of this email. THIS IS NOT SPAM! You are on our mailing list because you subscribed or someone you know subscribed for you at one of our associate web sites. ******************************************************* Cyber Investigator "EASY WAY TO FIND OUT ANYTHING ABOUT ANYONE" http://www.angelfire.com/ab2/jones2285 Cyber Investigator TAKES YOU BEYOND WHAT SEARCH ENGINES CAN DO! Cyber Investigator is an amazing new tool that allows you to find EVERYTHING you ever wanted to know about your EMPLOYEES, FRIENDS, RELATIVES, SPOUSE, NEIGHBORS, even your BOSS! You can check out ANYONE, ANYTIME, ANYWHERE, right on the internet... Here's the best part: With our SECURE ORDER SYSTEM you can have this amazing tool in your hands right away and you can be doing your own on-line investigations IMMEDIATELY. To find out more about what Cyber Investigator can do for YOU! CLICK HERE: http://www.angelfire.com/ab2/jones2285 Thanks, P.J. Software Company Security Software Developers Since 1995 P.J. Software Company respects others right to privacy. To help us insure quality control, you may inform P.J. Software Company management directly at bmdwe2(a)coldmail.com if you have any concerns regarding the delivery of this message. This message has been delivered by a third party marketing agency in compliance with federal guidelines. You may rcmove your name from our opt-in list by sending an e-mail to the address below with the word remove in the subject. rem -- r2d2cy2(a)excite.com 7803088229010294870

1 0

Re: Fw: Administrivia: ORBS
by Paul Vixie 15 Jan '00

15 Jan '00

> > Nope, they'll list anyone who blocks them, regardless of open > > relay status. > > If that's true, they're going too far, and won't be able to become > widespread enough to matter. Right. MAPS narrowly dodged that same bullet several times in the early days, and both ORBS and IMRSS were created as direct responses to our well-learned conservatism about who we will blackhole and why. > That's a damn shame. Not really. Failure is a natural consequence of any nonscalable activity. -- Paul Vixie <vixie(a)mibh.net> >> But what *IS* the internet? > It's the largest equivalence class in the reflexive transitive > symmetric closure of the relationship "can be reached by an IP > packet from". --Seth Breidbart

1 0

NANOG 18
by Pam Ciesla 14 Jan '00

14 Jan '00

The DoubleTree has extended the room block to 1/18/00. After that rooms will no longer be available at the $149 rate. Please let me know if you have any problems with the hotel. I have also sent e-mail to folks that I added from the wait list to the attendee list. If you are on the attendee list and are not able to attend the meeting please let me know. I have alot of folks on the wait list that would like to go. No walkin at the meeting. Thanks Pam Ciesla Events Coordinator Merit Network,Inc. 734-936-0172 - phone 4251 Plymouth Road 734-647-3185 - fax Bldg.I, Suite 2000 pam(a)merit.edu Ann Arbor, MI 48105

1 0

The Cidr Report
by Tony Bates 14 Jan '00

14 Jan '00

This is an auto-generated mail on Fri Jan 14 12:00:00 PST 2000 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 14Jan00 0) General Status Table History ------------- Date Prefixes 070100 69327 080100 69344 090100 69247 100100 69357 110100 69510 120100 69669 130100 69616 140100 69862 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 4739 Number of ASes announcing only one prefix: 2019 (480 cidr, 1539 classful) Largest number of cidr routes: 324 announced by AS6172 Largest number of classful routes: 953 announced by AS701 1) Gains by aggregating at the origin AS level --- 14Jan00 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS9269 134 21 113 84.3% Hong Kong CTI AS2609 124 18 106 85.5% EUnet-TN AS7545 153 60 93 60.8% TPG Internet Pty Ltd AS1653 129 38 91 70.5% SUNET Swedish University Network AS6429 194 117 77 39.7% RDC-INTERNET AS7496 111 36 75 67.6% Power Up AS3749 135 61 74 54.8% TECNET AS4200 171 105 66 38.6% AGIS (Apex Global Information Ser AS9304 82 21 61 74.4% Hutchcity AS4151 107 56 51 47.7% USDA Internet Access Network AS684 92 46 46 50.0% Manitoba Regional Network Backbon AS4755 113 73 40 35.4% Videsh Sanchar Nigam Ltd. India AS7568 54 16 38 70.4% C.S. Communications Co., Ltd. AS6528 46 8 38 82.6% WORLD-LYNX AS7029 78 41 37 47.4% ALLTELNET AS7390 50 14 36 72.0% NLSLAN AS6172 149 113 36 24.2% HOME-NET-1 AS1727 113 77 36 31.9% MRMS-WEST AS3549 147 112 35 23.8% Frontier GlobalCenter AS11127 117 82 35 29.9% UNKNOWN AS8013 124 91 33 26.6% PSINET-CA AS3737 96 63 33 34.4% PenTeleData Inc. (ASN-PTD) AS8390 42 10 32 76.2% Global One Communications and Inf AS549 192 160 32 16.7% ONet Backbone AS7745 40 9 31 77.5% BIGSKY-AS AS6629 62 31 31 50.0% NOAA-AS AS6607 33 2 31 93.9% HOMENET AS6458 32 1 31 96.9% EMPRESSA GUATEMALTECA DE TELEC AS4307 32 1 31 96.9% SVINET-1 AS12235 32 1 31 96.9% UNKNOWN For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Shock news - NANOG likely to carry less operational content
by Alex Bligh 14 Jan '00

14 Jan '00

I *believe* (really hope) this SPAM impersonating a NANOG poster replying to a thread (traceroute doesn't go through pacrim.net) Op content: If so, be prepared for all sorts of being accused of sending all sorts of other exciting messages about lesbians, cookie recipes etc. etc. Alternative explanation: Kai your machine has a really nasty worm virus Alex Bligh GX Networks (formerly Xara Networks) Delivery-date: Fri Jan 14 07:37:50 2000 Return-path: <kai(a)pac-rim.net> Envelope-to: amb(a)sapphire.noc.gxn.net Delivery-date: Fri, 14 Jan 2000 07:37:50 +0000 Received: from brimstone.global.net.uk ([194.126.80.70] helo=brimstone.noc.gxn.net) by sapphire.noc.gxn.net with esmtp (Exim 2.05 #2) id 1291Is-0000Fa-00 for amb(a)sapphire.noc.gxn.net; Fri, 14 Jan 2000 07:37:50 +0000 Received: from [168.212.244.134] (helo=mail.gxn.net) by brimstone.noc.gxn.net with smtp (Exim 3.02 #3) id 1291Gi-0004Sb-00 for amb(a)gxn.net; Fri, 14 Jan 2000 07:35:36 +0000 Mime-version: 1.0 Content-type: multipart/mixed; boundary="----=_NextPart_000_0007_01AF0E92.A4E9CDO0" Message-id: <E1291Gi-0004Sb-00(a)brimstone.noc.gxn.net> From: Kai Schlichting <kai(a)pac-rim.net> To: amb(a)gxn.net Subject: Re: Eeek - .NU Domains using Ö, Ä, Å, Ü, Date: Fri, 14 Jan 2000 07:35:36 +0000 1. There are alternative views of the following: (Invoke menu with right button.) View HTML contents with Mosaic 2. Lesbians.exe ---->8--------->8-------->8--------->8-------->8--------->8-------->8-------

5 5

Re: Shock news - NANOG likely to carry less operational content
by Sean Donelan 14 Jan '00

14 Jan '00

On Fri, 14 January 2000, William Allen Simpson wrote: > They are using the operational list persons as targets! Shall the > operational folks get together and find them? Bah Humbug, they can't get together to solve operational problems, why get together to solve none operational problems.

1 0