October 1997 - Test - lists.nanog.org

Syn flooding attacks
by Paulo Maffei 21 Oct '97

21 Oct '97

Hi, I had heard about a solution to Syn Floodind attack, but I'd like to be sure about it so I could keep researching about these solutions. I had heard that I could set up a filter in my router that would wait for the second ACK packet after the SYN request and SYN-ACK response before finish the whole connection with the server. Is it true? -- Paulo Maffei Email : Paulo.Maffei(a)br.global-one.net

5 4

Web Biz Universal Remove List Update
by postmaster＠thehitman.com 21 Oct '97

21 Oct '97

Dear NANOG Mailling List, Thank you for adding your address to the Universal Remove list This email is simply a notification that you have been added to or updated in our Universal Remove list(s). As a reminder, you submitted the following details to: www.thehitman.com NANOG Mailling List at nanog(a)merit.edu Responsible Direct Email DOES exist at Web Biz!

10 13

Does NANOG hate Microsoft?
by Jay R. Ashworth 21 Oct '97

21 Oct '97

On Tue, Oct 21, 1997 at 12:20:55PM -0400, Sandra Gittlen wrote: > Jay, is Nanog suggesting a freeze-out of Microsoft traffic? Not remotely. The NANOG mailing list connected a community of people who are involved in one way or another with the operations of public and private IP networsk in North America. The target topic on the list is operational issues, and some members have tighter filters on this than others. Randy Bush's are likely the tightest. The customary snide response to a posting to the list which someone considers to be too far off topic is "how do I configure my router for that?" Randy's posting was a clever, if somewhat obscure, allusion to that. I simply took the thought to it's logical conclusion -- but Microsoft _isn't_ real popular with many technical people, for reasons which aren't that difficult to research. MORAL: Journalists: always check with someone before sourcing anything from this mailing list. Members: always remember, the press is listening. Cheers, -- jra -- Jay R. Ashworth jra(a)baylink.com Member of the Technical Staff Unsolicited Commercial Emailers Sued The Suncoast Freenet "People propose, science studies, technology Tampa Bay, Florida conforms." -- Dr. Don Norman +1 813 790 7592

1 0

CNN - Justice seeks $1 million a day contempt fine against Microsoft - October 20, 1997
by Hagai Yardeny 21 Oct '97

21 Oct '97

http://www.cnn.com/TECH/9710/20/microsoft.ap/index.html

6 5

Re: Which pipe dream should we be smoking? (was Re: Possible topic?)
by Joseph Kucic 21 Oct '97

21 Oct '97

Hi, You can get info at: http://www.networks.digital.com/html/products_guide/hp-swch3.html The Gigaswitch/FDDI is a different product than the Gigaswitch/ATM. You can insert ATM uplinks into the Gigaswitch/FDDI. I won't discount Gigabit Ethernet to quickly (yet there are no router interface available). I believe Ether Channel has an opportunity depending on what happens with the GSR but there is no switch to take advantage of it (except maybe the Cat 5500). But I do agree that traffic shaping technology is critical to any long term design. I guess the ideal solution will be Gigabit Ether Channel (8Gbps) or Terrabit Ethernet with traffic shaping if its not ATM at OC-192. Thanks, Joe Kucic At 10:31 PM 10/21/97 -0700, Vadim Antonov wrote: >>Aren't all the Gigaswitches from DEC ATM backed anyway? (FDDI is an >>emulation on an OC3/12 card slot?) That's what the DEC literature seemed >>to say when I perused it last. > >Not. Gigaswitch is a crossbar-based _packet_ switch. I recall reading >fairly comprehensive article on its internals. Most likely it is still >available from somewhere on Internet. > >If i understand correctly, its ATM interfaces do packet shredding/reassembly. > >--vadim > >

1 0

Looking for "National" NAPs
by Sean Donelan 21 Oct '97

21 Oct '97

I'm updating my list of who is connected to what public exchange point. Here is my current list Exchange IP Network CIX 149.20 Sprint/NY NAP 192.157.69 AADS/Chicago NAP 198.32.130 PACBELL/SF NAP 198.32.128 MAE-East 192.41.177 MAE-West 198.32.136 http://dranet.dra.com/peeringpoints.html After last time I had requests to list several additional exchange points. To keep things manageble for myself, I'm limiting myself to "National" NAPs which meet the following three criteria: - Located in North America (USA, Canada, Mexico, Caribbean), my French and Spanish language abilities are limited - At least five different providers attached and operating - At least one attached provider with their headquarters in a non-adjacent state, province, island (Alaska and Hawaii can count any other state as non-adjacent, Rhode Island can't) I'm trying to automate this, so next time I'll try to get Europe and Asia exchange points; but for now this is the NANOG list. If you operate such an exchange point I'd like to add it to my exchange point connection cross-matrix. Please send me 1) a brief name for the exchange point, 2) IP network used for the exchange point, 3) the in-addr name server for the exchange point *OR* if you don't allow AXFR access a copy of the in-addr BIND file for the IP addresses. If you are attached *BUT DO NOT OPERATE* an exchange point, please let the exchange point operate contact me. Important: I must be able to independently verify that the connections exist at the exchange point. I normally do this by sending a few (10-20) PINGs at the ip addresses several times over 24 hours. If your router is down for more than 24 hours, I may not count it. Press releases do not count. Last time I got fooled by some old IP address being re-assigned to new providers; I've flushed my data so this will be based on fresh data. I want to complete this before the NANOG meeting, so I request you let me know before Wednesday, Oct 22, 1997. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2

CNN - Justice seeks $1 million a day contempt fine against Microsoft - October 20, 1997
by Hagai Yardeny 20 Oct '97

20 Oct '97

http://www.cnn.com/TECH/9710/20/microsoft.ap/index.html

2 1

Re: Syn flooding attacks
by Vern Paxson 20 Oct '97

20 Oct '97

> The router could discard the SYN, remembering it, and let pass the retry SYN > that usually occurs with valid connections and does not with invalid ones. This is no good - all the crackers have to do is modify their programs to send two bogus SYNs, spaced apart, instead of just one. Vern

3 2

Re: CNN - Justice seeks $1 million a day contempt fine against Microsoft - October 20, 1997
by Dennis Simpson 20 Oct '97

20 Oct '97

> On Mon, Oct 20, 1997 at 12:11:00PM -0800, Randy Bush wrote: > > > http://www.cnn.com/TECH/9710/20/microsoft.ap/index.html > > > > mae-west1#conf t > > Enter configuration commands, one per line. End with CNTL/Z. > > mae-west1(config)#http://www.cnn.com/TECH/9710/20/microsoft.ap/index.html > > ^ > > % Invalid input detected at '^' marker. Yeah, but the GRF can do it blazingly fast ... :-)

1 0

Re: Syn flooding attacks
by Jim Shankland 20 Oct '97

20 Oct '97

> I don't know of any routers that have these or other means of dealing with > the SYN attacks. We deal with them; see http://www.flyingfox.com/synflood_ann.html. Jim Shankland Flying Fox Computer Systems, Inc.

2 1