- NANOG - lists.nanog.org

Re: Network Abuse - Netblock x.x.x.x - IMPORTANT
by Jay Stewart 03 Aug '98

03 Aug '98

-----Original Message----- From: James Rishaw <jamie(a)dilbert.ais.net> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Thursday, July 30, 1998 10:20 AM Subject: FW: Network Abuse - Netblock x.x.x.x - IMPORTANT >A coworker's friend forwarded this to me.. kinda funny.. Kinda lame.. > > >-----Original Message----- >Sent: Thursday, July 30, 1998 7:36 AM >Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT > > >---------- >From: Andrew Shoemaker[SMTP:wrath@jerky.net] >Sent: Thursday, July 30, 1998 6:43 AM >Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT > >Hello > >My name is Andrew Shoemaker and I am the head security consultant at JNS. We >recently were the target of a denial of service attack that saturated our >Internet connection. This attack, known as a 'smurf' attack, uses unknowing >relays to source the at >tack. By relaying the attack through your network the attack is made >anonymous and increases in strength. This type of attack causes degraded >performance on both the attacked and relay networks and is the result of an >improperly configured router at you >r site. I urge you to fix your routers. If you are unable to do so, or do >not know how I suggest you call a security consultant. JNS is willing to >fix your router permanently for a one time fee of $100 US. If you are >interested in this deal please co >ntact me and I will send you a copy of our security contract and an invoice. > >Netblock de.le.te.d was found to produce 11 replys for each packet sent. >This means if the attacker is sending at T1 speeds the amount of your >bandwidth used in relaying > the attack is equivalent to 11 T1s > >regards, >Andrew Shoemaker >JNS Security >wrath(a)jerky.net >617.442.5408 Did anyone take the time to look at this goober's web page? Here is a *nice* snippet. Jay Stewart Vice President OlyWa.Net - "Olympia's Premier Internet Service Provider" -=-=-=-=- from: http://www.jerky.net/smurf.html The Smurf Relay List This is a list of subnets that can be used for the "smurf" attack. If you find your subnet on this list FIX YOUR FUCKING ROUTERS! If you have subnets you wish to add to this list please email the wrath-mon. Once you fix your router email the above address to get your subnet removed. Until then....everyone feel free to completely FUCK these networks...and remember stupidity should never be tolerated. Updated: 07.29.98

4 3

Re: Q:Why router with ATM interface comes out earlier than pure SONET interface?
by Sean Donelan 03 Aug '98

03 Aug '98

>Then my question is: why 155M ATM interface is easier to make than 155M POS >interface? Although the net capacity of 155M ATM is less than 155m POS, >their capacity for IP packet is really close. I think its nearly the same >challenge to pump up a 155M ATM pipe as a 155M POS pipe with IP packet for >a router. The marketplace isn't always a neat and tidy place. When companies were trying to make business decisions how they should expend their resources, ATM appeared to be a much larger marketplace. The POS marketplace was viewed as just a few niche markets like ISPs, while ATM was viewed in terms of huge telecommunications market. So many companies first put their resources into making ATM interfaces. ATM interfaces can be much more complicated, but if the marketplace is larger you can afford to spend more money and still come out with a less expensive product. So even though an ATM interface may be 10%-20% less efficient, if the pricing was 30% better, ATM could still be a good choice. On the other hand, if you are paying the same price for the underlying physical facilities, you probally want to optimize for the goodput of user data. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

RE: "Packet Shapers"
by Christian Kuhtz 01 Aug '98

01 Aug '98

> > i'm not stating that the value is only at the edge. i'm stating that i > > don't think it is realistic to be sticking transparent devices that hold > > detailed state information on flows in the core. > > Inktomi's CTO has publicly stated that this is their objective, although > the phrase used was "super aggregation nodes" and not "core". If you're > interested, ask him for his 3W3 paper submission wrt handling 100 Gbs > links. I have seen Paul Gauthier's paper. Last time I spoke with Paul & Vince (VP Field Ops) when I was out in the bay area, that is precisely what we discussed, among other things. Sure, they can theoretically scale to those types of links. Their suggestion is to use policy based routing (PBR) instead of Alteon (or similiar L2/L4 technology) and the reliance of an Ethernet being avaiable for drop in of their technology. Anyone who knows anything about PBR knows that PBR is neither fault tolerant nor scalable nor something I want to be force to use for this type of stuff. Anyone who knows anything about technologies like WCCP knows that it is more than just plain PBR, because state is maintained in the L3 switching engine. The Alteon does maintain state of its cache farm memebers, but not of the sessions themselves. Other major issues (aside from their problematic network deployment strategy) that I see around Inktomi are in the current platform choice. It is neither cost effective nor does it make sense from a performance standpoint. I have discussed these with numerous people at Inktomi over the past months and not gotten a solution. > > there is enormous value in the core: some people get it right, > some get it > > horribly wrong. but lets face it - the core of a networks > primary function > > is to move packets fast, and move them well. > > Violently agree with this. Ditto. You need to do much more than just push packets fast. You need to be able to distinguish services on the network, perhaps on a per flow basis, and make sure your mission critical services or high end customers don't get trampled on. You need to be able to push packets fast _and_ do better than just plain best effort. You need to be able to do this fault tolerant and/or highly available. Cheers, Chris -- Christian Kuhtz, BellSouth Corp., Sr. Network Architect <ck(a)bellsouth.net> 1100 Ashwood Parkway, Atlanta, GA 30338 <ck(a)gnu.org>

1 0

Re: [nanog] Re: "Packet Shapers"
by Hank Nussbacher 01 Aug '98

01 Aug '98

On Fri, 31 Jul 1998, Stephen Balbach wrote: > > > 5) Topflows: In RMON there is the concept of Top 10. When the network > > slows down, you want the ability to see a list of the Top n users > > consuming bandwidth in the past 1 minute/10 minutes/hour. Packeteer > > does not have that capability. > > Packeteer has a "TopTalkers" and "Top Listeners" table for I believe the > last 5-minutes, and graphs can be generated on the fly for the past hour. That is correct, but from what I understood from their tech sales, you can't have TopTalkers and Top Listeners on *all* the bandwidth, but only on a per policy filter (i.e. if a pipe is defined for all port 80 you will see all the top www'ers but you won't see the top ftp'ers or the top GREs as well). > > Hank Nussbacher

1 0

New router technology you'll want to look into
by Michael Dillon 01 Aug '98

01 Aug '98

Here's some new router technology that I think you'll want to look into. http://www.difference.com/tech.html -- Michael Dillon - Internet & ISP Consulting Memra Communications Inc. - E-mail: michael(a)memra.com Check the website for my Internet World articles - http://www.memra.com

2 1

Re: "Packet Shapers"
by shields＠crosslink.net 31 Jul '98

31 Jul '98

In article <2.2.32.19980731064343.006a171c(a)max.ibm.net.il>, Hank Nussbacher <hank(a)ibm.net.il> wrote: > 7) Platform: Look at the OS platform. Packeteer using a proprietary OS, > others may package Linux or NT. None have done any OS hardening on the > system so it is best to run something like ISS against the packet shaper > to determine what security holes exist. Imagine you start using a > packet shaper in production only to have the hackers hack it and set > their own super-duper policies. The risk is worse than that -- a malicious party having access to a box which can view and modify 100% of your outside traffic is a very ugly scenario. There is of course much more to security than running ISS. > 10) ToD: All boxes have the ability to control based on source IP, > destination IP and port. Not all have the ability to control based on > time of day. Suppose you want incoming news to be limited to 128kb > during the day but open it up from 2-8am to 800kb. Packeteer has a line > command called "schedule". Look for GUI's to do this. I would hope anything with this suppport also runs NTP. > 12) Graphs: you want the ability for realtime graphs for each policy so > you can see how your rule changes have affected the bandwidth. > Packeteer has this capability. And hopefully all the data would be SNMPable so you can do your own graphs as well. As with all networking products, the key for an ISP environment is not to provide an all-in-one solution but to provide something with good plugs so it integrades well with the rest of your network. -- Shields, CrossLink.

1 0

The Cidr Report
by Tony Bates 31 Jul '98

31 Jul '98

This is an auto-generated mail on Fri Jul 31 12:00:00 PDT 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 31Jul98 0) General Status Table History ------------- Date Prefixes 240798 52857 250798 52796 260798 52635 270798 53086 280798 53322 290798 52992 300798 52883 310798 52941 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 218.218.180.0 from AS701 AS Summary ---------- Number of ASes in routing system: 3786 Number of ASes announcing only one prefix: 1835 (963 cidr, 872 classful) Largest number of cidr routes: 348 announced by AS3561 Largest number of classful routes: 1134 announced by AS701 1) Gains by aggregating at the origin AS level --- 31Jul98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS3602 534 316 218 40.8% Sprint Canada Inc. AS701 1134 933 201 17.7% Alternet AS271 338 144 194 57.4% BCnet Backbone AS4293 454 265 189 41.6% IMCI AS2493 420 244 176 41.9% iSTAR Internet, Inc. AS3749 222 69 153 68.9% TECNET AS174 711 581 130 18.3% Performance Systems International AS2685 249 157 92 36.9% IBM Global Network - US AS5668 126 48 78 61.9% Century Telephone Inc. AS3221 112 42 70 62.5% EENet Autonomous System AS4755 118 50 68 57.6% Videsh Sanchar Nigam Ltd. India AS3804 220 155 65 29.5% Bell Solutions AS7046 223 165 58 26.0% UUNET-CUSTOMER AS4740 397 339 58 14.6% ASN-OZEMAIL (Ozemail Pty Ltd) AS549 207 152 55 26.6% ONet Backbone AS10928 101 46 55 54.5% UNKNOWN AS3403 180 126 54 30.0% TIAC AS6335 68 19 49 72.1% NTRNET AS72 85 37 48 56.5% Schlumberger Information Network AS719 455 408 47 10.3% LANLINK autonomous system AS1239 537 490 47 8.8% SprintLink Backbone AS4539 71 26 45 63.4% NETROPOLIS AS4200 142 97 45 31.7% AGIS (Apex Global Information Ser AS237 95 50 45 47.4% MichNet Primary AS AS1785 294 253 41 13.9% NYSERNet Backbone AS852 155 115 40 25.8% AGT Advance Communication AS6181 66 26 40 60.6% FUSE-NET AS7122 120 82 38 31.7% MTS ADVANCED Network Policy AS10921 57 19 38 66.7% KIHNETWORK AS762 117 80 37 31.6% WELLFLEET-AS For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

CIDR on 3Com Netbuilder
by Martin, Christian 31 Jul '98

31 Jul '98

All, Anyone know how to configure a 3Com NetBuilder to support classless routing? Here is the scenario. I have a class B that is being split up into 24s and 26s. All are being statically routed over the respective WAN interfaces to the customer prem. Most default back to our WAN interfaces (some downstream BGP peers, but not in this scenario). Customer A has a 3Com Netbuilder, with an LAN IP of x.x.200.1 /24. Customer B has a Cisco 2501 with a LAN IP of x.x.23.1 /24. This customer is configured for classless routing using the 'ip classless' IOS global command. All customers can see into this network (cust B), even within the same x.x classfull class B space. But no one in the classfull x.x can see into customer A's network. Actually, their traffic gets there, but the return traffic never leaves, because the NetBuilder is looking at the first 3 bits and ignoring it, thinking that it is local. 3Com thinks that there needs to be static routes in place. I think that this is ridiculous, and that CIDR support is necessary in today's Internet. It would entail me having to ask a customer to add over 25 static routes for networks that the default rtr (me) knows about. Does anyone know how to do this without having a CIDR-aware routing protocol like OSPF running? I have had three 3Com guys on the this ticket for over a week, with no resolution. 3Com employees can redeem their company by supplying a working solution...Anyone? Regards, -Chris

2 1

exchange point in-addrs
by john heasley 31 Jul '98

31 Jul '98

how does one manage to get PTR RRs changed for exchange point addresses? we've tried using the form below and submitting the resulting email template as instructed, but received no response. http://www.isi.edu/div7/naps/ipadd-req.html tried sending mail to hostmaster(a)ep.net (from the SOAs) which stuck in our mail queue because the single MX for ep.net (flag.ep.net) is a laptop (or so we were told). the one time that our queue happened to run and the laptop was accessible; mail to hostmaster bounced w/ user unknown. then, a second MX was added (and has since disappeared), but that host refused to relay for ep.net. is there another path that i have missed? any ideas? TIA, -heas

2 1

"Packet Shapers"
by Scott Gifford 30 Jul '98

30 Jul '98

I was wondering if anybody out there has had any experience with "Packet Shapers," which claim to be able to limit traffic to a particular host, host+port, or host+port+url without dropping packets. They apparently watch traffic flows and keep track of connections, then dink around with TCP window size information to slow traffic down if needed. The one we have been looking at is called "The Packeteer" (http://www.packeteer.com) but I have seen a few others (one of which had a really good picture of a pig in the ad). Do these things work as advertised? Is anybody actively using them inside their networks? I don't know enough down-and-dirty information about TCP to know if this should work, or if it's just a plastic shell filled with snake-oil... Thanks for any information. Email if you like, I will post a summary if people are interested. ------Scott.

2 1