- NANOG - lists.nanog.org

Re: Internic hosage (fwd) (The real end)
by Dean Anderson 26 Mar '98

26 Mar '98

At 5:23 AM -0500 3/26/98, Rich Sena wrote: >On Sun, 22 Mar 1998, Dean Anderson wrote: > >> Ah. Only girls with lowcut blouses and short skirts are raped. Since I >> don't wear lowcut blouses or short skirts, I have nothing to worry about, >> and shouldn't be concerned. Rape is OK, since it only happens to the sleazy >> girls. Uh Huh. When can I screw the interns? Say, you aren't hosting any >> porn or uncensored webcams are you? Boy, I think they're sick. Lets make >> sure we disconnect the entire lot, and any ISP/NSP who refuses to cooperate >> we'll just DoS them until they are pounded to dirt, like AGIS. Hey look, >> I think they are irresponsible. I'm justified in harassing them and >> publishing false routes etc. Right? >> >> I expect some kind of gaussian distribution of harassment develops where >> everyone gets harassed by some lunatic, and can't do anything about it. >> Eventually, somebody mails a bomb. To me? To you? To some kid in Vermont? >> You're smarter than that. I think. Besides, I react badly to coercion. So >> do most people. Thats why we need laws. Sensible ones at that. > >What type of crack are you on Dean? Your analogy is a mockery of the whole No crack. Just a cool, drug-free and relaxed guy, who thinks these anti-spammers need to get a life or maybe a dog to get rid of some stress. My analogy is a mockery of something. We just disagree on what it's a mockery of. Anti-spammer terrorists have no moral high ground. Even the Islamic fundamentalists believe they are doing Allah's work. Anti-spammers believe they are making the world what? More convenient? >Whose responsibility is YOUR dog - and if you don't curb your dog, and I >have to, I will definately make sure you do not enjoy and want to >avoid the experience in the future. Ok, here's a metaphoric response: Unfortunately, you don't get to kill the neighbors dog because it shit in your yard. True, in many big cities, there are ordinances which require dog owners to scoop up their dog shit, and keep all dogs on a leash. In most places places however, there aren't any such ordinances. You find shit in your lawn, tough. Go to the city council. Get an ordinance passed. Until you get an ordinance passed, and even if you do get an ordinace passed, it's going to be illegal to shoot your neighbors dog. I don't have any dogs. But I'm not going to stand idly by while you start shooting up the neighbhood trying to get rid of dog shit. I'm also not going to participate in your scheme to poison all the dogs in town. Dogs shit. Its what they do. You have to put up with a little shit in life. People act like the world is about to end because of a little dogshit. "Must... Stamp.... Out.... Dogshit... Kill... Dogs... At... All... Costs... Break... Gun... Laws... Shoot... Kill... Save... Humanity... From... Dogshit..." You're drooling. ;-) So, basically, I think anti-spammer terrorists are just like the jerks who run around trying to have dogs put to sleep, all because they are so terribly upset about a little dogshit in their lawn. Its not a big deal. After the next rain, its fertilizer, and their lawn grows greener. Some people are just over-reactive assholes. End of metaphor. How about that. Two issues we disagree on. On the other hand, there are some things about spam that should be regulated. There are postal service laws which apply to junk mailers, which prohibit things like pyramid schemes, a few other obscure crimes that happen via postal mail and could possibly happen over email. Junk mailers also must remove people from lists within 30 days. The post office maintains the list of who to remove, not the junk mailers. These are all quite reasonable things to apply to spammers. I'm for that. Just not for banning spam, nor violating laws to stop it, nor for vigilante activity in general. The paper or electronic media over which these crimes are committed shouldn't really matter. My proposal has been to make these laws essentially media-independent. It curbs the abuse legally. It just doesn't satisify the radicals who want to ban spam at any cost. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Access Lists
by Martin, Christian 26 Mar '98

26 Mar '98

Hello All, I have a customer who is being ping-flooded. His bandwidth is being sucked up due to these floods, and wishes me to block them on my router. I am somewhat reluctant to do this, since it goes against our policy; however, the customer has been very patient with us on this issue and his patience is running out. I would be implementing on a Cisco 7507, with 3 T-3s to the Internet, and the customer hangs off the router on a T-1. What is the general consensus on providing such a service, particularly in terms of processing overhead and manageability. Is there another way to prevent this type of attack, aside from watching packets go by and trying to trace it back through the source. The source IPs are spoofed. Thanks! Christian Martin

3 4

Ellipse - a new anonymous ftp server implementation
by ikuo＠ellipse.org 26 Mar '98

26 Mar '98

Hi all, We are very grad to announce an alpha release of the `Ellipse' which is a new anonymous ftp server implementation. A few Ellipse processes (one is the master and others are pre-forked processes) can handle a lot of ftp clients at a same time. So, it requires less memory or process resources to serve a large number of ftp sessions. Ellipse is designed to serve ANONYMOUS ftp services only. So it is VERY SECURE. For example, it calls chroot system call and leaves from any privilege mode before accepting connections. IPv6 extensions, such as LPRT, LPSV are also supported. We tested IPv6 extensions with INRIA and Hydrangea. For more details, see http://www.ellipse.org/ or README in a distribution. The newest distribution can be found in: ftp://ftp.ellipse.org/pub/net/ellipse Best regards, Ikuo Nakagawa

1 0

Re: Internic hosage (fwd)
by Dean Robb 26 Mar '98

26 Mar '98

At 10:54 3/19/98 -0500, Eric Eden wrote: >Dalvenjah, > >Thanks for your feedback. Network Solutions served over >35 million WHOIS queries in the month of January 1998. >The average response time for our WHOIS service is less >than 5 seconds per query. Thank you for the statistics. Not sure of their applicability, but it's nice to know just how heavily used this database is. Hmmm...one would think that if it's that heavily hit, maybe there would be some interest in keeping it accurate, yes? > >Please keep in mind that Network Solutions is not the >registry for the .to domain. We recommend you contact >the Tonic registry for information about .TO domain names. >Their web site is www.tonic.to And it's the Kingdom of Tonga's domain, for which Tonic is merely the Registry. However, the point has been completely missed here, Eric. The point Dal was making is that Perhaps.youwant.to FALSIFIED, LIED, FORGED, STOLE, MISAPPROPRIATED, and otherwise BS'd about their WhoIs entry: [No name] PERHAPS-HST Hostname: PERHAPS.YOUWANT.TO Address: 205.166.250.10 System: ? running ? Coordinator: HOST Networks-DNS Administration HNA-ORG hostmaster(a)HOST.NET 800-697-2437 Fax- 800-697-2437 Record last updated on 16-Mar-98. Database last updated on 20-Mar-98 04:11:54 EDT. [perhaps.youwant.to] Translated Name: perhaps.youwant.to IP Address: 207.89.50.3 Internet Gateway Connections (NETBLK-IGC-FL-BLK-1) 10011 Pines Boulevard - Suite 203 Pembroke Pines, Florida 33024 Netname: IGC-FL-BLK-1 Netblock: 207.89.0.0 - 207.89.127.255 Maintainer: IGCN Coordinator: Master, Host (HM511-ARIN) mike(a)WEB2000.NET 305-655-2955 (FAX) 305-652-5090 Domain System inverse mapping provided by: NS3.WEB2000.NET 207.89.0.10 NS4.WEB2000.NET 207.89.0.30 Record last updated on 17-Aug-96. Database last updated on 19-Mar-98 16:08:42 EDT. Traceroute confirms that youwant.to is hosted by Web2000.net. The WhoIs-listed IP is user.host.net, the machine on which Host.Net runs their webpage, FTP, et al. Not real likely they'd give that out for a hosted domain's IP. So....four days ago, youwant.to [side issue: Why does a machine, "perhaps", have a host entry in WhoIs, but the domain, "youwant.to" not?] updated their WhoIs record with a bunch of lies. THAT is the point, and the problem. What is NSI/InterNIC going to do about it, Eric? > >Regards, > >Eric Eden >Senior Analyst Network Solutions, Inc. >Phone: 703-925-6710 erice(a)internic.net Spam: it's not just for breakfast anymore.... Dean Robb PC-Easy On-site computer services (757) 495-EASY [3279]

14 30

Re: Hope it's operational enough....
by Chris MacFarlane 26 Mar '98

26 Mar '98

Send me some private mail and I will line you up with an account on Internet Canada/ACC. We have dialup in all major Canadian cities. Chris MacFarlane Manager, Data Operations ACC Telenterprises Canada 4162132023 cmacfarlane(a)acc.ca cjm(a)ican.net -----Original Message----- From: Randall S. Benn <rbenn(a)clark.net> To: Howard C. Berkowitz <hcb(a)clark.net> Cc: nanog(a)merit.edu <nanog(a)merit.edu> Date: Wednesday, March 25, 1998 9:20 PM Subject: Re: Hope it's operational enough.... >On Wed, 25 Mar 1998, Howard C. Berkowitz wrote: > >> I'm going to be in Canada a fair bit in the near term, but in a number of >> different cities. Are there any Canadian ISP's that have local dial access >> in most major cities? So far, from south of the border, I only find ones >> in specific cities. > >Howard, > >Check out IBM. They have by far more local dial numbers scattered around >the planet than anybody. For $20/month you can get a local connection >just about anywhere. At a quick glance, looks like they have almost 50 >numbers throughout Canada. > >Check out their list of local dial numbers at: >http://www.ibm.net/hlpctr/html/access_numbers_accessnum.html > >Randy > >-------------------------------------------------------------------- >"Cisco Systems In A Nuthsell" >http://www.clark.net/pub/rbenn/cisco.html >-------------------------------------------------------------------- > > >

1 0

Hope it's operational enough....
by Howard C. Berkowitz 26 Mar '98

26 Mar '98

I'm going to be in Canada a fair bit in the near term, but in a number of different cities. Are there any Canadian ISP's that have local dial access in most major cities? So far, from south of the border, I only find ones in specific cities. TIA... Howard

2 1

RE: Access Lists
by Martin, Christian 26 Mar '98

26 Mar '98

It is more of a case of at all. My associates feel that if a downstream ISP pissed someone off, it is their problem to solve, not ours. We do filter traffic not destined for our IP space at our borders, but, for the same reasons you stated, do nothing outbound, except on our BGP sessions where we don't want certain netblocks routed in the Internet. My concern is, if a perpetrator is persistent enough, he can write a ping flood program that uses some obscure ICMP type that is rarely used, say net-tos-redirect, and get in that way. Even if we were to block ICMP completely, which would take away source-quench, he could use UDP, or perhaps even TCP syn floods and the like to get at this guy. Either way, it is a difficult situation. Moreover, it is difficult to trace this stuff back through, because I have to get every ISP, NSP, etc, etc involved in order to trace spoofed IP addresses. Ho do you block spoofed IP addresses? I am already blocking ICMP redirects and IP source routed packets. Is there a better way, or should I just tell my customer to deal? I want to prevent this from consuming my bandwidth as well. Thanks! -Chris Deepak Wrote Are you trying to avoid a precedent of filtering at all or just filter at a whim? I don't think its really possible nowadays to be responsible and not do _any_ filtering. I'd love to be able to not, but sometimes we have to. We also block source routed packets at our borders. We filter all inbound traffic to make sure it is destined for IPs that we route for (we can't filter outbound both by policy and technical difficulty). -Deepak. On Wed, 25 Mar 1998, Martin, Christian wrote: > That is what I am going to do. But with over 100 downstream customers, > and IOS 11.1 (sans named access lists) I don't want to start a > precedent. > > Thanks! > > > > On Wed, 25 Mar 1998, Jain Depak Wrote > > Why not just filter all ping traffic to his T1 until the attack > subsides? > > -Deepak. > > On Wed, 25 Mar 1998, Martin, Christian wrote: > > > Hello All, > > > > I have a customer who is being ping-flooded. His bandwidth is being > > sucked up due to these floods, and wishes me to block them on my router. > > I am somewhat reluctant to do this, since it goes against our policy; > > however, the customer has been very patient with us on this issue and > > his patience is running out. > > > > I would be implementing on a Cisco 7507, with 3 T-3s to the Internet, > > and the customer hangs off the router on a T-1. What is the general > > consensus on providing such a service, particularly in terms of > > processing overhead and manageability. Is there another way to prevent > > this type of attack, aside from watching packets go by and trying to > > trace it back through the source. The source IPs are spoofed. > > > > Thanks! > > Christian Martin > > >

3 2

RE: Access Lists
by Martin, Christian 26 Mar '98

26 Mar '98

That is what I am going to do. But with over 100 downstream customers, and IOS 11.1 (sans named access lists) I don't want to start a precedent. Thanks! On Wed, 25 Mar 1998, Jain Depak Wrote Why not just filter all ping traffic to his T1 until the attack subsides? -Deepak. On Wed, 25 Mar 1998, Martin, Christian wrote: > Hello All, > > I have a customer who is being ping-flooded. His bandwidth is being > sucked up due to these floods, and wishes me to block them on my router. > I am somewhat reluctant to do this, since it goes against our policy; > however, the customer has been very patient with us on this issue and > his patience is running out. > > I would be implementing on a Cisco 7507, with 3 T-3s to the Internet, > and the customer hangs off the router on a T-1. What is the general > consensus on providing such a service, particularly in terms of > processing overhead and manageability. Is there another way to prevent > this type of attack, aside from watching packets go by and trying to > trace it back through the source. The source IPs are spoofed. > > Thanks! > Christian Martin >

2 1

RE: Building a NOC
by Bill Unsworth 26 Mar '98

26 Mar '98

At 08:52 AM 3/23/98 -0500, you wrote: >> Pocket protectors? Slide rules? Any other items nerd/engineers carry >> in their shirt pocket that falls out when they are head-first into the >> raised floor. > >We've found socks and cigarette butts. Needless to say the perp is no >longer with us :) > >> Like most disasters, you may not be able to prevent flooding, but you >> can mitigate some of its affects. Hit the E.P.O. and unfurl the plastic >> tarps you have stored & handy for just this emergency. > >We also put drip pans which cover the entire ceiling over the data center - >we were burnt 2 years ago in a pre-war office building in NYC. (avoid space >with wc's above!) The pans drain outside of the machine room into a >high-traffic hallway (with a drain). Any drips get noticed very quickly, >and we don't have to test the water alarm. > I guess that flooding by the mains water is seriousl worth thinking about. For example we just realised that because the "mens room" (and the "ladies) lavatory cistern overflows go into the room (they are in the middle of the building) if something goes wrong we have a little flood. So any mains water installations (dishwashers, kitchens, showers) are a potential hazzard - solution a) install mains water cutoff valves with sensors in the floors b) get everyone not involved in the NOC out of the building. We are just doing both! I suppose that all the wiring could be in the ceiling although that would not help in multistorey building. Rambling a bit but what about the film Inferno with all that water stored at the top of the building. :-)) Bill > -- U-NET Ltd "Just Internet" mailto:bill@u-net.net http://www.u-net.net/ Tel 01925 484444 Fax 01925 484466

6 6

Re: Building a NOC
by Sean Donelan 25 Mar '98

25 Mar '98

>Some urban archaeologist is going to take up a research project that >investigates why certain artifacts predominate under raised floors. In Pocket protectors? Slide rules? Any other items nerd/engineers carry in their shirt pocket that falls out when they are head-first into the raised floor. >Do think of underfloor drains. They are your friend. In close to 30 years >of working with computer rooms, with all the emphasis on fire protection, >I've never had a computer room fire. I have, however, had several major >floods related to fire protection -- a couple from water running downhill >from a fire fought on a higher floor, two from burst sprinkler lines >(improperly protected from freezing), and more from ordinary plumbing >emergencies such as clogged and overflowing toilets. Floor drains are good. But once again, you need to have a chat with your designer & inspector about what, why, when. Anti-backflow valves, and floor sink traps are mandatory. Automatic trap primers seem to lead to flooding. For example, St. Louis County recently opened a new jail. However it was delayed three months because the week before opening when they discovered if all the toilets were flushed at the same time on the eighth floor, as prisoners are known to do, the sinks exploded on the bottom floor. The plumbing designer had followed normal industry practice for commercial buildings, but forgot jails house a user population that is different from a normal commercial building. Like most disasters, you may not be able to prevent flooding, but you can mitigate some of its affects. Hit the E.P.O. and unfurl the plastic tarps you have stored & handy for just this emergency. >Putting equipment on high, rather than low, floors can protect it. Pick your disaster scenario, low-flying airplanes or high-flowing water. >Another local factor that MUST be considered in certain cities, and can be >far worse to deal with than building inspectors, is the local electrical >union. Some are great craftsmen and incredibly helpful. But there are >also cities where a union may perceive the data people running low-voltage >circuits as under their jurisdiction...and cables have been known to be >cut. Some of my New York friends have worked out very specific personal >procedures to get on good terms with the shop steward Local 3 of the IBEW >before starting a specific project. Competent union electricians are a joy to work with. Incompetent craftsmen are not. Incompetent union craftsmen are [expletive deleted]. Just because the NEC includes Article 800, doesn't mean the typical electrician has a clue how to properly install communication wiring. On the other hand, I've found the same thing to be true of a lot of data people. A fun factoid, in 100% of the power audits conducted by American Power Conversion (http://www.apcc.com/) they found violations of the NEC. Admitly this is a self-selected sample. People don't normally have a power quality audit done, unless they are having power problems. But it does show using union electricians, and passing a building inspection doesn't always mean a top-quality job. >I wonder if any of the TEMPEST manuals have been declassified? THey never >were at a terribly high level, and had some very nice general engineering >in them. Not yet. Although I've been trying to figure out how to buy the old MCAUTO (McDonnell-Douglas Automation) Data Center and turn it in to the Mid-West high-tech co-location space. In addition to a three-story, multi-football field long data center, and a backup power plant a small city would envy, it is rumored to have so-called black-project rooms with TEMPEST/EMP/EMF/RFI/TLA... shielding. InterNIC and PSI could co-locate in the same building, and not run into each other even in the parking lot. I've only seen one cafeterria in the building, so that could be a problem :-). -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2