- NANOG - lists.nanog.org

RE: Attack/DoS
by Todd R. Stroup 04 Jun '98

04 Jun '98

Thanks for all of your responses... but 1) I don't really need the consultants replys saying that you will fix my problems for $100/hour. 2) This isn't the BIND 8.x.x problem for getting root. For this reason : interface Loopback10 ip address 209.115.17.65 255.255.255.224 ip access-group 113 out Its rather difficult to get BIND to run on a Cisco 7507, although some people probably have tried to get it to work. We are viewing this from a cisco router with an access-list that basically looks like this : access-list 113 permit ip any any log Example of the udp port 0 attack : list 113 permitted udp 38.9.202.2(0) -> 209.115.17.67(0), 1 packet list 113 permitted udp 194.66.96.2(0) -> 209.115.17.67(0), 1 packet list 113 permitted udp 199.191.128.106(0) -> 209.115.17.67(0), 1 packet list 113 permitted udp 194.62.44.10(0) -> 209.115.17.66(0), 1 packet Example of the DNS (53) attack : list 113 permitted udp 207.150.3.11(53) -> 209.115.17.66(53), 121 packets list 113 permitted udp 203.77.1.1(53) -> 209.115.17.67(53), 1 packet list 113 permitted udp 194.62.44.10(53) -> 209.115.17.67(53), 2 packets list 113 permitted udp 194.66.96.2(53) -> 209.115.17.67(53), 91 packets An interesting thing to note is who ever programed this attack used the same IP addresses in a round robin type fashion for both (or maybe it is just selectable in the DoS, who knows). Todd R. Stroup Fiber Network Solutions, Inc. > From: Todd R. Stroup [mailto:tstroup@FNSI.NET] > Sent: Wednesday, June 03, 1998 3:53 PM > To: BUGTRAQ(a)NETSPACE.ORG > Subject: Attack/DoS > > Don't know if it is just me. But over the last 10 hours we have been > seeing attacks on port 0 from port 0 (both tcp and udp) on several clients > networks. I have also seen the same attack on port udp 53(DNS). > > Anyone have any information on this? > > > Todd R. Stroup > Fiber Network Solutions, Inc. > > > > ---------- Forwarded message ---------- > > Date: Mon, 1 Jun 1998 21:58:17 -0500 > > From: "J.A. Terranson" <sysadmin(a)MFN.ORG> > > To: BUGTRAQ(a)NETSPACE.ORG > > Subject: (Admittedly Premature) Exploit (?) Warning. > > > > While I realize that this issue may not yet be "ripe", as I the folks involved > > (myself and at least three other sites) have not yet firmly established just > > *exactly* what is going on here, but... > > > > There appears to be some kind of exploit making the rounds that utilizes > > TCP packets from port "0" (yes, that's *zero*) to the IMAP port, 143. These > > packet traces are right now available only as historical log entries that are > > *loosely* associated with 2 successful "root" attacks against IMAP enabled > > servers, an unsuccessful attack against another (ours), and the possible > > compromise of another. > > > > In short, I dont know a lot, other than in the course of reviewing my > > daily logs, I saw a couple of freaky packets (above) addressed to my > > nameservers (both of them). They were rejected and logged at the routers, > > however, as a common courtesy, we notified the admin of the "sending" > > machine that they had a sick box. As it developed, this person had > > recieved other emails regarding this from other admins, 2 of which had > > suffered the successful attacks mentioned above - all of us seeing the > > originating machine as the same box. It is unknown if the source address was spoofed. > > > > Basically, I think this is just a "common-cause" warning to look out > > for weird packets of this nature, and to take notice if you see any. > > > > Rather than keep a running blow-by-blow going on the various lists, > > please address anything regarding this to me directly... > > > > Thanks > > J.A. Terranson > > sysadmin(a)mfn.org > > > > > > >

1 0

history of peering arrangements
by incoming-nanog＠hooked.net 03 Jun '98

03 Jun '98

Forwarded from a non-subscriber. Replies to her, please. >From jdepalma(a)cato.org Wed Jun 3 10:09:02 1998 >Date: Wed, 03 Jun 1998 13:23:03 -0400 >From: Jennifer DePalma <jdepalma(a)cato.org> >To: zorch(a)hooked.net >Subject: history of peering arrangements > > >I'm attempting to compile a history of peering agreements between >ISPs from the beginning, through UUNet's decision to charge small >providers, and up to the implications of the WorldCom merger. If you >know of any valuable sources (articles, persons I might speak with), >please let me know. I'd appreciate any guidance you might offer. > >Thanks, >Jennifer > > >***************************** >Jennifer A. DePalma >202.789.5226 >202.842.3490 (fax) > >Research Analyst >Telecommunications and Technology Studies >Cato Institute >1000 Massachusetts Ave., NW >Washington, DC 20001 >

2 1

NANOG 13 Final Logistics
by William B. Norton 03 Jun '98

03 Jun '98

Hi all - Just a few announcements regarding next week's NANOG. Pre-registration for pre-paid attendees --------------------------------------- Pre-registration will be held from Noon until 3PM Sunday in the Hubbard Foyer for those who have pre-paid. The NANOG 13 T-shirts won't be available until Monday morning though. Setup Volunteers Welcome ------------------------ We will be setting up the Hubbard Ballroom Sunday morning around 8AM. Several folks have volunteered in the past to help with setting up equipment, running and taping down wires, etc. If you would like to help, come on down Sunday morning; the folks wearing the blue NANOG Staff shirts will be glad to put you to work. Lunch Tickets ------------- As most hosts have done in the past, Merit Network is graciously providing lunch tickets for 300 attendees both Monday and Tuesday. Tickets will be available on a first-come first-serve basis at the registration desk Monday morning for Monday lunch and Tuesday morning for Tuesday lunch. In the 300 lunches, we specified 100 vegetarian and a bunch of Kosher as well. Bring your Laptops ------------------ As suggested on the survey forms, we have increased the number of laptop tables for this meeting. The terminal room (located in the Stutz-Bearcat Room) has a minimal # of PCs (about 20) running Unix. Another reason to bring your laptops is that many of the presentations will be on-line linked off the NANOG agenda web page so you can view the slides on your laptop while the presenter walks through them. (My ultimate goal is to be able to queue questions electronically so you can ask questions during Q&A through your laptop microphone, but we're not quite there yet.) Thanks to DEC for providing a half dozen or so wireless access points. Jake Khuon (Merit) will be working with Jeff Rizzo (DEC) and Jeff Schwartz (Cabletron/DEC) to loan a few wireless PCMCIA units as well. Thank to the many that have contributed to this NANOG ----------------------------------------------------- The NANOG counts on the support of the community for everything from agenda topics to loaner equipment and event sponsorship. We would like to again thank the following companies for their commitments to NANOG: +Bay Networks for providing the room connectivity. We will have dozens of hubs for over 400 wired ethernet ports for this meeting! +RBN for casting the meeting and providing storage and reply facilities +Cisco for providing the hardware and staff to cast the meeting on the MBone +University of Michigan Information technology Division for providing PCs for the terminal room +Aptis, Bay, and Cisco for providing the Beer-n-Gear event +Cabletron for providing Wireless transceivers and a handful of loaner PCMCIA cards +Merit MichNet for providing transit connectivity to the Hyatt Dearborn Thanks especially to Larry Blunk and Eric Sobocinski who have taken the lead on connectivity to and throughout the meeting space as well as getting the terminal room and servers set up at the Dearborn Hyatt. Thanks Guys! For those attending the meeting Physically rather than Virtually ---------------------------------------------------------------- Bring your appetite for the Monday evening beer-n-gear; there will be many varieties of great food, beer, and gear from Aptis, Bay and Cisco! Speaking of T-shirts...FYI, I have been forced to clean out the Merit closet of old NANOG T-shirts. In doing so, I found that I have enough left over T-shirts to make a small number of "NANOG Tshirt Collector's Sets, N8-N12". I will give away 2 of these Collector's sets away at the next NANOG to those who fill out (and identify themselves on) the survey forms (for lack of a better method). Thanks, and see you all in Dearborn. Bill -------------------------------------------------------------- William B. Norton <wbn(a)merit.edu> (734) 764-9430 (New Area Code)

1 0

New Service Models Coming - Or, All About Bypass
by Jim Fleming 03 Jun '98

03 Jun '98

---- New Service Models Coming - Or, All About Bypass --- In my opinion, the ION announcement by Sprint is only the tip of the iceberg. North American network operators may also want to look at the following press release from Lucent and note that MCI is mentioned as the company testing the new products. http://www.lucent.com/press/0598/980527.nsa.html There is a certain irony that AT&T is not part of these activities...yet... The Internet has captured the imagination of a wide range of people. The Internet has been constructed around the edges of the existing telecommunications infrastructure. Many people have leveraged small investments into large empires and are now resting on their winnings. While they are resting and as the Internet becomes as insular as the old telecommunication cliques, others are busy building new structures around the edges of the existing IPv4 infrastructure. The following is just one example. Some of the ideas put forth in the Sprint annoucements confirm they have been thinking beyond the current legacy Internet. Other large companies are clearly looking down the road and as you can see above Lucent is ready with serious products for serious companies. @@@@ http://www.aiag.org/anx/pilotend.html AIAG PUBLISHES ANX? RELEASE 1 DOCUMENT FOR ISPs; DEFINES CERTIFICATION PROCESS & REQUIREMENTS FOR ANX? SERVICE ... ISP Certification Process Opens Beginning Thursday, May 21, ISPs may apply for certification of their network environment to meet the business quality internet service specified by ANX Release 1. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Some people feel that these new service models signal the end of the good old days of the Internet. This reminds me of people claiming that early computer store chains signalled the end of people experimenting with PCs. This was not the case, what happened was that the rest of the industry (boring PC usage) grew and it overshadowed the people building Altairs, IMSAIs, and Cromemco systems. It also helped to bring the price of floppy drives down to $18 from the $1,800 we paid for the some of the early drives. In my opinion, these new service models signal the beginning of an exciting time of expansion for the Internet and telecommunications in general. This growth will eventually bypass the legacy IPv4 Internet as we know it. People will have a choice whether to remain with the old-school legacy systems which they can operate as transport networks as long as someone is willing to pay to have some bits hauled, or people can switch and work on the new service models that are going to rapidly grow around the edges. There is a need for both types of people. Hopefully, people will be free to pursue either path. While it is clear that most of the people interested in NANOG fall into the legacy camp, I have a feeling that eventually some people will step out and try some new horizons. When you do, you might be surprised at how much is going on at the leading edge of those horizons... Jim Fleming Unir Corporation - http://www.Unir.net IS Coordinator for the AM Radio Station Registry - http://www.DOT.AM

1 0

industry filtering rules
by Lehrer, Neil 03 Jun '98

03 Jun '98

hi, sprintlink's filter policy for non sprintlink customers is shown below. do other large providers have similar policies? i am a sprintlink customer and am trying to understand how these policies are implemented in the industry. thanks. ip nums cidr RFC 1918 Reserved Addresses Disallow 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 0-126 /8 Allow no subnets of historical addresses that were not announced in July 1995 127-191 /8 Allow nothing longer than /16 (i.e., /17, /18, /19, etc.) 192-205 /8 Allow nothing longer than /24 (i.e., /25, /26, /27, etc.) 206-223 /8 Allow nothing longer than /19 (i.e., /20, /21, /22, etc.) 195 /8 Allow nothing longer than /19 (i.e., /20, /21, /22, etc.) 24 /8 Allow nothing longer than /19 (i.e., /20, /21, /22, etc.) *The principal change is that we used to disallow /19s in 206/8-223/8 and 195/8, and this was not; in line with the minimal allocation units performed by the three primary registries Regards +++++++++++++++++++++++++++++++++++++++ + Neil Lehrer + U.S. Information Agency + Networks and Systems Support Division + + voice 202 619-0903 + fax 202 619-3883 + internet nlehrer(a)usia.gov + + "oh what a tangled net we weave + when we seek to retrieve." + +++++++++++++++++++++++++++++++++++++++

1 0

RE: Sprint's New ION products (fwd)
by David Lesher 03 Jun '98

03 Jun '98

Tom Walton sez: > > The most troubling thing to me about the ION plan is that it > seems to revolve around the idea of using LEC local loops to > deliver service to home customers. The LECs are not going to > be enthusiastic about providing an unbundled loop to > facilitate being cut out of their long-distance termination > fees. This could be a very slow roll for Sprint. Count on SPRINT being their own CLEC; why would they give away the gravy? > This problem will not become acute until they begin > deploying residential service, as many/most business > customers (the initial targets) will be "on-net" with CLECS > who are already interconnected with Sprint. It might be that > Sprint is hoping/praying for regulatory/statutory > intercession before they try to penetrate the residential > market en masse. True. Sprint's legal muscle [irony; it's MCI that was oft-called "The law firm with the antenna on top" not Sprint] may help pry entry into COLO space in/near CO's, but that is far from a universal solution. What about SLC[tm-Lucent]'ed lines, real copper loops too long to be viable [know of several 40Kft ISDN loops], offices with no COLO space, etc. (And even when successful, that means a COLO cage in every CO in the country....) And *will* businesses want to go to all-metered calling? Outside of NYC, Chicago, Gnu Joisy, Califunny {and any I don't know of..}, most US business POTS is flat rate or per-call, not per minute|bit. So they'll split the difference; using Least Cost Routing to try and guess which way is better. Buy PBX stock, and count on the ILEC's fighting this tooth and nail, down to the last T-75 staple and pole spike. > I love the telecommunications business... Amem, Brother.... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

Re: Sprint's New ION products
by Peter Leppik 03 Jun '98

03 Jun '98

At 10:46 AM 6/3/98 , kbrown(a)primelink.com wrote: [...] >Has anyone heard any additional information or have any more insight into >this announcement? I am curious how this might affect the remainder of the >industry. > >Kevin Brown >Huber & Associates, Inc. >Networking Technologies >kbrown(a)primelink.com >http://www.primelink.com/haa/lanwan > I listened to Sprint's press conference yesterday. I came away with a few solid observations/facts: 1) The press conference was an hour-long commercial for ION. 2) The service will be based on an all-ATM network, doing voice over ATM, and IP over ATM. 3) It will be at least a year before ION is deployed to residential customers. 4) It isn't clear that Sprint knows how to solve the last mile problem in the face of RBOC stonewalling. Finally, in the interest of historical perspective, I would like to point out that, if dramatic carrier announcements are to be believed, by today most everyone in the country should be able to order AT&T local service deployed over a 128 Kbps wireless link, and most people in U.S. West territory should be able to buy DSL-based Internet access for $40/month. These things have a way of not going as planned. ----------- Peter U. Leppik, Senior Research Associate Dain Rauscher Wessels, Equity Capital Markets pleppik(a)dainrauscher.com http://www.dainrauscher.com/

2 1

Sprint's New ION products
by kbrown＠primelink.com 03 Jun '98

03 Jun '98

I'm pretty sure I'm not the first to read about this in our local paper, but Sprint announced their new strategy for integrating voice, data, video over "standard phone lines." They are calling this the Integrated On-Demand Network or ION for short. It sounds an awful lot like ISDN services from perhaps an ESS switch (8 viable bonded channels max) versus the DMS100 (2 bonded channels max). Our local Sprint outlet, to whom I am contracted to administer several pieces of their local dial in access project has just about finished installed the DMS100 switch (yep...we don't have ISDN yet around here). According to the Sprint Internal press release "Sprint today" they intend to completely change their local technologies (scrap the old, in with the new) instead of upgrading their existing network like other carriers. Announced also was the fact that Cisco Systems has been designing/testing/developing the hardware to make this project work, with BellCore doing the software for the project. Rollout to major business is expected to happen in large markets sometime yet this year with residential offerings happening sometime in 1999. Has anyone heard any additional information or have any more insight into this announcement? I am curious how this might affect the remainder of the industry. Kevin Brown Huber & Associates, Inc. Networking Technologies kbrown(a)primelink.com http://www.primelink.com/haa/lanwan

10 9

Re: different thinking on exchanging traffic
by Tim Salo 03 Jun '98

03 Jun '98

> From: "Sean M. Doran" <smd(a)clock.org> > Subject: Re: different thinking on exchanging traffic > Date: Fri, 22 May 1998 17:38:12 -0700 > [...] > Meanwhile, you might find the Sprint response to the NSFNET > NAP solicitation ("National Virtual NAP") hanging around somewhere > online. You should read it and imagine why it didn't fly. I believe that all four of the winning NSFNET NAP submissions proposed nationwide "NAPs". I believe that the reason they didn't happen is that the NSF asked for and assumed it would get four geographically-focused solutions. I suspect that the notion of awarding four NAPs, all of which covered all of the country, provided the NSF a certain amount of heartburn. I believe that the nationwide NAP concept died, (or was killed), at the time for administrative, not technical, reasons. But, this is all speculation on my part... I have two conflicting notions about the the interesting possibilities offered by nationwide layer-two services: o Layer-two services with distance-insensitive pricing, such as ATM, create some interesting opportunities. If it doesn't cost any more to get across the country than to get across town, why should I build a local NAP rather than a nationwide NAP? (Unless, of course, I am a RBOC and am administratively constrained from offering inter-LATA service.) (I am also ignoring a comparison of a NAP-in-a-closet/POP/parking ramp versus a NAP-in-a-metropolitan-area; this is e-mail to nanog, not a paper for Sigcomm.) Perhaps more relevant today, why should I build a regional Gigapop, _if_ my ATM pricing is truly distance-insensitive? (There might be an answer to the last question, I really don't know. But, I keep asking.) In other words, if pricing is distance-insensitive, why do I need local exchanges? o Distance matters. It is easy to configure an IP network over a large layer-two service that bounces packets around the country, (because IP routing protocols generally think in terms of hop count, not [physical] distance). It would be nice if routing protocols thought about [physical] distance, rather than require the network designer to be responsible for designing the network such that considerations of physical distance were implicit in the network design. Of course, in the good old days before distance-insensitive-priced services, this wasn't such an issue. (I don't know whether there are very many copies of Sprint's "National Virtual NAP" proposals hanging around. I had to nearly sign my life away to get a copy at the time...) -tjs

8 13

RE: Why does Sprint have address filters again?
by Jamie Scheinblum 03 Jun '98

03 Jun '98

Suggestion: The initial ASN should be bundled with a /19 to create a "multi-home" package. Unbundled ASNs whould be unreasonably high to cover the administration of the initial ASNs of the world, and the cost associated with a /19. In reality it seems you need both, a /19 to make it past the route filters, and an ASN. This also save on the ARIN support side, since the ARIN employee tasked with making the call to verify the customer does in fact have 2 T-1s (or has 2 ISPs vouch he will have at least a T1 with each), can also verify they will accept the routes for the ASN. Seems like this would cut the administraion on ARIN's behalf a bit, and make it "more fair" to the smaller networks looking to multi-home (See Karl's proposal on IP allocation). -jamie(a)networked.org -----Original Message----- From: Michael Dillon [mailto:michael@memra.com] Sent: Saturday, May 30, 1998 12:02 AM To: nanog(a)merit.edu Cc: arin-council(a)arin.net Subject: Re: Why does Sprint have address filters again? On Fri, 29 May 1998, Karl Denninger wrote: > Now, let's look at the parallels: > > 1. Both are required to "do business" in a given sector (ie: announce > routes, sell to the Erate customer base) > > 2. Both are simple *technical* providers (assignment of a number, with > the important being that it is unique in both cases). > > 3. One is free to the ISP. > > 4. The other costs $500.00 5. One is financed by the government out of your taxes and is merely an accounting formality much like a customer ID number. The other is funded by a corporation that has no government funding and must support itself not unlike most businesses and the number is a critical infrastructure identifier something like an NPA-NXX. > What is going on here? ASNs didn't used to cost money until ARIN got its > claws into them. ASNs have always cost money to issue. It's just that in the past it was funded out of taxes funnelled through the NSF to a subcontractor and hidden somewhere in NSI's budget. Those days are gone, thank God. -- Michael Dillon - Internet & ISP Consulting Memra Communications Inc. - E-mail: michael(a)memra.com http://www.memra.com - *check out the new name & new website*

7 13