- NANOG - lists.nanog.org

Directed Broadcast~ Petition
by Peter Giza 13 Aug '97

13 Aug '97

Netizens If you don't care about the 'directed broadcasts' thread hit 'd' now :) Please excuse the interruption from real work, but as it stands I have a whopping 12 entries including myself on the petition. One of which is a dup due to a TLD association. If there are more of you who would like to be added to the petition to get a "no directed broadcast" as default action to Cisco IOS and other vendor equipment please respond *asap*. Given that there are 4K+ ISPs and NSPs my guess is that we ought to be able to come up with 50-100 names. I would like to get this off to Cisco before I leave for the other coast for a week. Please supply in the format as follows: Your Name, Full Company Name, email Thanks... -pete Peter E. Giza ADSmart Corporation http://www.adsmart.net

1 0

FW: Dial-in access
by jan.novak＠aliatel.cz 13 Aug '97

13 Aug '97

---------- Od: NovakJ Odesláno: 13. srpna 1997 12:12 Komu: 'nanog(a)merit.edu' Předmět: Dial-in access Sorry for problems with long lines... Hi, I have a question, which is not really operational but rather technological one. It concerns the Internet dial-in access. I hope there are several dial-in ISPs, not only transit ones, among you. Let me explain the situation. We are an "emerging" LEC in Czech Republic. Our aim is to build a wireless access network for data and telephony services. The wireless base stations will be connected to the voice and data switches, which will be interconnected via SDH network together. The problem is following: We expect a huge amount of Internet dial-in users, which will connect to the ISPs via our regular telephony service. We need to find a device, which will be placed between the base station and voice switch and capable to detect (based on the called number) the call to the ISPs, terminated it (e.g. completely bypass the voice switch) and provide some data interface, which will be connected to the ISP on the ordinary IP level. We know, in US you are facing the same problems with this kind of un-needed voice switches overload, your help will be very usefull for us. My question is: Do somebody of you use some kind of this rerouting or DXCs bypass and with which devices or is this functionality included directly in the voice switch ??? Only pointers to vendors are quite sufficient - Nortel´s "Internet Thruway" can be a example. Thanks very much.

1 0

Trans-Atlantic Traffic
by Stuart Bryant 13 Aug '97

13 Aug '97

Hi, Does anyone know the kind/amount of data currently being moved either way over the Atlantic links ? Stuart Bryant stuartb(a)ourworld.net Founding Member : System/Network Administrator Level 7 The Fellowship of Ourworld Global Network 77 Castlereagh Street Beer. +61 9 9223 2777 Sydney, 2000

1 0

Re: [nsp] known networks for broadcast ping attacks
by rja＠corp.home.net 13 Aug '97

13 Aug '97

Folks who want vendors to change the default changed so that routers don't - by default - forward directed broadcast should contact their vendors. If lots of ISPs speak up, the vendors generally _will_ listen and make changes/fixes. I've already been leaning on cisco to do this. So far, cisco is indicating "limited customer demand" to change this default. Those others of you who are using cisco and want this change made should speak up to your sales folks and other contacts in cisco. Ran rja(a)home.net

5 4

Filtering Source Addresses on gw-internet
by C. Jon Larsen 13 Aug '97

13 Aug '97

In response to the many requests and comments on this list for all NetworkOps to install filtering to prevent IP spoofing attacks . . . On my internet router (gw-internet) I had set up filtering to attempt to block all outgoing source addresses that do not have my network (a.b.c.0/24) as their source some time ago. Then, I had to modify the acl 120 to prevent the default route for our internal network from leaking the occasional packet with an RFC 1597 private destination address out to our ISP. (We use Cisco 11.2 NAT to hide several medium sized networks behind a couple af legit IPs. I took another spare router, and slapped 1.1.1.1/8 on a secondary interface, and tried to ping out, and my acl seems to be O.k. I'm just trying to be responsible for my users (some of whom are @ unsupervised and remote sites via dialup & ISDN) and prevent any other network ops from experiencing problems caused by ignorant / malicious users that may find their way onto my network ! Any comments / suggestions / improvements / warning / something I have missed ??? Thanks ! gw-internet#show access-lists 120 Extended IP access list 120 deny ip any 10.0.0.0 0.255.255.255 log deny ip any 172.16.0.0 0.0.255.255 log deny ip any 172.17.0.0 0.0.255.255 log deny ip any 192.168.0.0 0.0.255.255 log permit ip a.b.c.0 0.0.0.255 any (27429 matches) deny ip any any log gw-internet# %SEC-6-IPACCESSLOGDP: list 120 denied icmp 1.1.1.1 -> 205.161.206.4 (8/0), 1 packet ICMP: dst (205.161.206.4) administratively prohibited unreachable sent to 1.1.1.1 ICMP: dst (205.161.206.4) administratively prohibited unreachable sent to 1.1.1.1 ICMP: dst (205.161.206.4) administratively prohibited unreachable sent to 1.1.1.1 ICMP: dst (205.161.206.4) administratively prohibited unreachable sent to 1.1.1.1 ICMP: dst (205.161.206.4) administratively prohibited unreachable sent to 1.1.1.1

2 2

FYI: Cease And Desist Flaming
by Jon Stevens 13 Aug '97

13 Aug '97

This is a good one...anybody seen this before? They are spamming about spamming. Maybe it is a plot by this lawyer to get more clients... -jon ---------------- Begin Forwarded Message ---------------- >From filer Mon, 11 Aug 1997 12:22:35 -0800 Received: from www.kia.co.kr (1Cust59.max43.los-angeles.ca.ms.uu.net [153.34.91.187]) by www.kia.co.kr (8.6.12h2/8.6.9) with SMTP id FAA07648; Sat, 9 Aug 1997 05:03:06 +0900 From: webmaster(a)sailahead.com Received: from mips-1.sailahead.com (mips-1.sailahead.com [199.107.95.10]) by sailahead.com (8.8.5/8.6.5) with SMTP id GAA05402 for <suspected_flamer(a)somewhereincyberspace.com>; Fri, 08 Aug 1997 12:11:33 -0600 (EST) Date: Fri, 08 Aug 97 12:11:33 EST To: suspected_flamer(a)somewhereincyberspace.com Subject: Cease And Desist Flaming Message-Id: <5.0.52.19970526663666.666a6e97(a)sailahead.com> Reply-To: khskllp(a)aol.com X-Pmflags: 34666848 0 X-Uidl: 3273376668a65eb1890m0762123a Comments: Authenticated sender is <webmaster(a)sailahead.com> Status: RO On behalf of our client, Samsung America Inc., ("Samsung") we hereby request that you cease and desist all inflammatory internet hacking, telephone hacking, flaming, jamming, and other illegal activities. If you have responded aversely to a recent bulk email message from our client, Samsung America, Inc., or from any of its subsidiary companies, then you may be one of the people who has performed fraudulent and actionable transgressions, thereby causing severe harm to our client. Your email name was provided as being suspected of connection to various acts of internet terrorism. Your acts are illegal. Several messages have suggested that Samsung and/or its subsidiaries, including but not limited to Sailahead Global Emporium, www.sailahead.com, and Samsung Electronics, www.sosimple.com, violated US Federal Laws through activities commonly called "spamming." This allegation is unfounded in the law, as spamming is a protected activity under the laws of free speech. Our client has asked us to inform you that all of your future correspondences should be directed to their counsel: Russell L. Allyn, Attorney at Law California Sate Bar Number (SBN) 143531 Katz, Hoyt, Seigel & Kapor LLP Los Angeles, CA khskllp(a)aol.com 310-473-1300 310-473-7138 (fax) All incidents of internet terrorism will be prosecuted where possible, and reported to appropriate law enforcement authorities as warranted. Please consider this as your notice to cease all attempts to harm multi-national corporations who conduct legitimate commerce on the internet. Russell L. Allyn, Attorney at Law ----------------- End Forwarded Message -----------------

8 7

NANOG 11 UPDATE
by Pam Ciesla 12 Aug '97

12 Aug '97

Airfare discount & alternate hotel info is available on the NANOG Web page www.nanog.org. If you need any other info please contact me. I am looking into international airline discounts, but not sure if this will be available for this meeting. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Pam Ciesla 313-936-0172 - phone Merit Network, Inc. 313-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

2 1

Re: [nsp] known networks for broadcast ping attacks
by Dennis Simpson 12 Aug '97

12 Aug '97

> Here's a sorted list of the networks used to attack FDT (pulled from my > 1.5mb of tcpdump data which was just a brief sample of the data from our > attack Sunday. If any of them belong to you, shame on you. > > 207.107.244 You are being hit through Sprint Canada. Four /30's from this class c are the addresses assigned to the 4 T1's we have with Sprint Canada. What specific addresses on this net hit you? We do source address filtering, and do not permit packets to leave our net which do not have source addresses on our nets. Having said that, the /30's I am concerned about do not appear anywhere but our core router. If your attack is coming from there, then I would likely to know what the h*ll our router is doing sending those packets, and who the h*ll has that kind of access to our router that we don't know about. Please confirm the actual source IP's on the 207.107.244 network. I also know of a Toronto ISP who has a /30 from this network for their link to Sprint Canada. Thx, dennis

2 1

Samsung
by dhudes＠graphnet.com 12 Aug '97

12 Aug '97

Sir: Spamming as normally practiced involves the theft of services through the use of one or more third party's mail servers to send the spam on behalf of the spammer. Should Graphnet, an FCC-licensed carrier, in reviewing its message logs from months of spamming which we have finally ended through technical means, find that your clients have directly or through the contracted services of a third-party bulk e-mail service used our systems without permission we will most assuredly seek heavy damages as permitted under laws of Interstate Commerce and also to ask the FCC to sanction Samsung and its subsidiaries. As any first-year law student knows, the First Amendment does not cover illegal acts. One cannot yell 'fire' in a crowded theater nor can one incite to riot. Use of one's own mail system to individually deliver unsolicited commercial messages to e-mail boxes is arguable; hijacking systems that don't belong to one, is theft of services. Impersonating the system you are stealing services from, over Interstate telephone lines (which as all know is what the Internet runs over) is wire fraud. Every criminal is entitled to counsel. That is the basis of the American system of Jurisprudence. Threatening the operators of the Internet is not a smart move, it just raises the profile of your client and ensures its bad name. You have, with your letter, lumped Samsung in with the sleaziest of pornographers. They should discharge you for incompetence. Dana Hudes Manager, Internet Engineering Graphnet p.s. Samsung is officially on my black-list as of this moment. As you can imagine, Graphnet buys lots and lots of electronic gear. No more Samsung for us.

3 2

Samsung
by Harris Schwartz 12 Aug '97

12 Aug '97

Working for one of the largest ISP's in North America, we have received our share of complaints regarding this message from the attorney on behalf of Samsung. I have also contacted the attorney and was told that they did not send the message and that they are investigating. All I know, is that this message has caused alot of problems. >Date: Tue, 12 Aug 1997 15:18:44 -0400 >From: dhudes(a)graphnet.com (Dana Hudes) >Organization: Graphnet Inc. >X-Mailer: Mozilla 4.01 [en] (Win95; U) >To: khskllp(a)aol.com >CC: nanog(a)merit.edu >Subject: Samsung >Sender: owner-nanog(a)merit.edu > >Sir: >Spamming as normally practiced involves the theft of services >through the use of one or more third party's mail servers to send >the spam on behalf of the spammer. Should Graphnet, an >FCC-licensed carrier, in reviewing its message logs from months >of spamming which we have finally ended through technical means, >find that your clients have directly or through the contracted >services of a third-party bulk e-mail service used our systems >without permission we will most assuredly seek heavy damages as >permitted under laws of Interstate Commerce and also to ask the >FCC to sanction Samsung and its subsidiaries. > >As any first-year law student knows, the First Amendment does not >cover illegal acts. One cannot yell 'fire' in a crowded theater >nor can one incite to riot. Use of one's own mail system to >individually deliver unsolicited commercial messages to e-mail >boxes is arguable; hijacking systems that don't belong to one, is >theft of services. Impersonating the system you are stealing >services from, over Interstate telephone lines (which as all know >is what the Internet runs over) is wire fraud. > >Every criminal is entitled to counsel. That is the basis of the >American system of Jurisprudence. Threatening the operators of >the Internet is not a smart move, it just raises the profile of >your client and ensures its bad name. You have, with your letter, >lumped Samsung in with the sleaziest of pornographers. They >should discharge you for incompetence. > >Dana Hudes >Manager, Internet Engineering >Graphnet >p.s. Samsung is officially on my black-list as of this moment. As >you can imagine, Graphnet buys lots and lots of electronic gear. >No more Samsung for us. > > > >

1 0