January 1998 - Test - lists.nanog.org

Agenda topics so far
by Susan R. Harris 13 Jan '98

13 Jan '98

Greetings - here are the topics we've lined up so far for Albuquerque: PRESENTATIONS ------------- - IPv6 Solutions/IPv4 Issues (Christian Huitema, Bellcore, & Yakov Rekhter, Cisco) - Technical Considerations in Preventing Mail Abuse: Presentation and Open Discussion (Paul Vixie, Vixie Enterprises) - Operational Use of a Multihomed NAT (Ed Kern, Digex) - A Route-Filtering Model for Improving Global Internet Routing: An IOPS Proposal (Jessica Yu, ANS) - Origin Authentication in BGP (Tony Li, Juniper, & Yakov Rekhter, Cisco) - IRR Security Issues (Dave Meyer, Univ. of Oregon) - Squid Caching Update (K Claffy, NLANR) - ARIN Update (Kim Hubbard, ARIN) - Monitoring your Network with Freely Available Statistics Reporting Tools: An Overview (Stan Barber, Academ Consulting Services) - SprintLink Backbone Architecture Evolution: IP Over Sonet (Vab Goel, Sprint) - Multihoming: Problems and Solutions from the Customer Point of View (Howard Berkowitz) - Recent Events in Inter-Provider Multicasting (Dave Meyer, Univ. of Oregon) - Massively Parallel Routing (Vadim Antonov, Pluris) TUTORIALS --------- BGP 101: An Introduction to the Border Gateway Protocol Paul Ferguson, Cisco BGP 102: A Mid-Sized Network Configuration Case Study Avi Freedman, Net Access Using BGP Communities and MEDs With GateD Sue Hares, Merit BOFs ---- Interprovider Operations Jake Khuon, Merit, Abha Ahuja, Merit, other speakers TBA GIGAswitch/FDDI to Gigabit Ethernet: Interoperability and Migration Strategies Speakers TBA from Celeritas/Digital

2 1

Out of Line ? [Was: UDP port 137 Question]
by Steve Carter 12 Jan '98

12 Jan '98

The following was intended to be a lighthearted, off-subject, quip, but may have been construed as off colour and may have offended some people. If this is the case then I publicly apologize. <snip> >> No Windoze on this side... How much garbage traffic is generated by MS >> products anyhow? >I thought most of it is....... >;) <snip> -- ====================================================== Steve Carter scarter(a)genuity.net GENUITY Inc. Phone: (602) 308 2386 ======================================================

1 0

Smurfing and other problems...
by Joe Shaw 12 Jan '98

12 Jan '98

Good morninig everyone, Does anyone have an operations contact at Flash Net? Around 4:30am CST Sunday morning I was in the office due to a fiber cut and got on IRC to talk to some of our tech support staff to give them a heads up on the situation. I ended up running into someone who started using all his k-r4d skr1ptz and decided to start smurfing, port scanning and trying some remote expoits. I captured everything and tried to notify flash.net's NOC, but haven't gotten a response yet. Anyone ever dealt with any sort of operational issue with this bunch or am I going to have to start talking to the Feds first? He only did it for a short time, but long enough that if Flash Net had someone on duty and their contact numbers in whois were to their NOC instead of their sales office I would have been able to track this kid down. Any help is appreciated. Regards, Joe Shaw - jshaw(a)insync.net NetAdmin - Insync Internet Services Fortune for today: "Life may have no meaning -- or worse, it may have a meaning of which you disapprove." Unknown.

2 1

Cisco question...
by Alex Rubenstein 12 Jan '98

12 Jan '98

What the hell is a !Q in a traceroute? nyc6#trace www.demon.net Type escape sequence to abort. Tracing the route to www.demon.net (193.195.0.1) 1 nac-wisper-10Mb.nac.net (207.99.122.4) 0 msec 0 msec 4 msec 2 nac-wisper-10Mb.nac.net (207.99.122.4) !Q * lth1-e1.uk-core.uk.wisper.net (193.164.160.10) [AS 6765] 92 msec 3 linx-1.router.demon.net (194.68.130.13) [AS 5459] 112 msec 108 msec 112 msec 4 telehouse-1.router.demon.net (194.159.252.51) [AS 2529] 112 msec 112 msec 104 msec 5 demon.www.demon.net (194.159.255.45) [AS 2529] 112 msec * 116 msec

4 3

The Cidr Report
by Tony Bates 09 Jan '98

09 Jan '98

This is an auto-generated mail on Fri Jan 9 12:00:00 PST 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 09Jan98 0) General Status Table History ------------- Date Prefixes 020198 47531 030198 47597 040198 35241 050198 47479 060198 47617 070198 47694 080198 47566 090198 47514 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 3094 Number of ASes announcing only one prefix: 1455 (749 cidr, 706 classful) Largest number of cidr routes: 463 announced by AS3561 Largest number of classful routes: 985 announced by AS701 1) Gains by aggregating at the origin AS level --- 09Jan98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS2493 668 376 292 43.7% iSTAR Internet, Inc. AS4293 414 202 212 51.2% IMCI AS174 890 681 209 23.5% Performance Systems International AS816 568 396 172 30.3% UUNET Canada (ASN-UUNETCA-AS4) AS3602 447 300 147 32.9% Sprint Canada Inc. AS3749 201 60 141 70.1% TECNET AS701 985 884 101 10.3% Alternet AS839 123 31 92 74.8% North West Territories Regional N AS3751 122 46 76 62.3% SNET-AS AS2048 164 92 72 43.9% LaNet AS5668 103 36 67 65.0% Century Telephone Inc. AS3804 203 139 64 31.5% Bell Solutions AS1 863 804 59 6.8% BBNPLANET AS3464 120 65 55 45.8% Alabama Research and Education Ne AS271 111 56 55 49.5% BCnet Backbone AS7545 115 63 52 45.2% TPG Internet Pty Ltd AS1239 581 529 52 9.0% SprintLink Backbone AS4763 127 76 51 40.2% Telstra New Zealand AS4648 196 146 50 25.5% NZIX 2 AS549 202 153 49 24.3% ONet Backbone AS72 84 36 48 57.1% Schlumberger Information Network AS719 506 460 46 9.1% LANLINK autonomous system AS1221 258 213 45 17.4% AARNET-AS AS3561 934 892 42 4.5% MCI AS684 83 43 40 48.2% Manitoba Regional Network Backbon AS4740 332 293 39 11.7% ASN-OZEMAIL (Ozemail Pty Ltd) AS2711 94 55 39 41.5% SUNBELT-AS AS1691 165 126 39 23.6% BCTEL AS6181 60 24 36 60.0% FUSE-NET AS1591 137 101 36 26.3% SAIC DISM For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Re: Deciding whose network block is whose?
by Sean M. Doran 09 Jan '98

09 Jan '98

Geoff Huston <gih(a)telstra.net> writes: > My point was that one direction of addressing Sean Donelan's > original problem was to clearly identify the point in the network > where the announcement is originated and clearly > identify the legitimacy of each advertisement incrementally > through the use of explicit signatures. Grand, so you have all these little signatures floating around. Are you going to process them at all your gateways, or are they there just in case something goes wrong? If the latter, how do you expect the signatures might be used in practice? > It does not address explicitly the issue of routing > policy at a distance, which you identify as a bloody big > scaling problem - and I agree that it is! Is the problem you are trying to solve not "does X have the right to announce prefix Y"? Perhaps I am missing something. Sean.

1 0

Denial of Service Attacks disguised as Spam...
by Barry Shein 09 Jan '98

09 Jan '98

[The purpose of this note is to change your thinking about Spam] Enormous amounts of this so-called "spam" is nothing of the sort, it is malicious people using mail ports to conduct denial of service attacks. And the sooner we wake up to this fact the better. We need a new word for this and to publicize this new attitude. Because as soon as someone says "spam" all that comes to mind is a Sanford Wallace type pathetically trying to make a buck with annoying advertising, and people (in particular law enforcement) just won't give "annoying advertising" a moment's thought. But I assert that we're dealing with crime and criminals here who aren't selling anything. Look at the several consecutive log entries attached below ("Spamf" and "PATMATCH" mean the msg was blocked by our spam filters.) We're receiving about *30,000* of these per day, non-stop, full-blast, every few seconds, for days. The fact that not one of these is getting past our filters doesn't seem to discourage this person, not even over a period of days. The network address of the mail relay source has been hacked (notice how it changes with every msg), the address ("billy(a)bingo.edu") is phony and forged. This person has gone to great length to hide their identity and to make it difficult to block them at the router level. Blocking the message itself is relatively easy, but I don't think they care, just so long as they can hammer at your mail port day and night. Dec 31 14:36:29 5C:world sendmail[3098]: SpamF: <billy(a)bingo.edu> (relay=po1.synapse.or.jp [202.208.174.131]) PATMATCH Dec 31 14:37:09 5C:world sendmail[3614]: SpamF: <billy(a)bingo.edu> (relay=www.dma.be [195.13.24.2]) PATMATCH Dec 31 14:37:10 5C:world sendmail[3623]: SpamF: <billy(a)bingo.edu> (relay=at.atnet.it [193.207.30.132]) PATMATCH Dec 31 14:37:22 5C:world sendmail[3765]: SpamF: <billy(a)bingo.edu> (relay=mail.vienna.at [194.158.143.44]) PATMATCH Dec 31 14:37:23 5C:world sendmail[3775]: SpamF: <billy(a)bingo.edu> (relay=seus.metoc.ns.doe.ca [131.235.30.50]) PATMATCH This person is not the only source of this, others are doing the same thing. I don't believe this person is actually selling anything. Can I repeat that? I DON'T BELIEVE THIS PERSON IS ACTUALLY SELLING ANYTHING I do believe this is a malicious person who has learned that if you stick some text in a message that appears to be selling something law enforcement's mind will go blank and nothing (effective) will be done. "It's just annoying advertising, ignore it". The analogy which comes to mind is a town where door to door salesman can't be considered trespassers on your doorstep. So a group of people who want to annoy you don what appear to be door to door salesmen accouterments (eg, a suitcase full of new household brushes) and stands and bangs and bangs and bangs on your door, day and night. And you tell themm to go away. And they ignore you, they keep banging. So you call the police, and they say "he's a door to door salesman, the law allows him to bang on your door! People bang on people's doors all the time. Stop calling us, we can't do anything, ask him to leave or ignore him." We're being fooled, we're allowing criminals to operate without challenge. -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.std.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo*

10 11

You know it's time to quit when...
by Matthew D. Lammers 09 Jan '98

09 Jan '98

This probably doesn't belong here, but this _could_ be considered humorous and we all like humor...I'm forwarding a bit of e-mail that the staff for our Dial In Internet Services received tonight... ----- BEGIN FORWARDED MESSAGE ----- < < The second question has to do with privacy. I noted that when < I went to "the Stalker's Home Page" the server could read < the Domain name for my IP address. Since my Domain name can < change every time I dial in, that's no big deal, but < I have read that credit card numbers and other such < information can be extrapolated from my machine even if I'm < using a temporary IP address. < ----- END FORWARDED MESSAGE ----- How do I 'splain to the user that his IP address is nothing too secretive and what DNS really is for? :) I think he thinks that his IP was read from his hard drive.... Although it is slightly possible that his HD can get "read" with HTML cookies and other methods, do I invoke the fear of God into this poor soul and tell him everything I can or just shut up and play dumb? Maybe some RFCs will clear things up for him...Nah, I'll just tell him it's all magic. And I just wonder how "temporary" IP address space is allocated? Afterall, I was hoping that we could play magical CIDR blocks and get all new ones next week...These /17s are all dirty now and I want new ones. -Matt. -- Matthew D. Lammers -- NetSet Internet Solutions, Inc. http://www.netset.com/

1 0

Attack of the Killer Spam
by Adam Rothschild 08 Jan '98

08 Jan '98

NANOG folk: Over the past few weeks, I have noticed an influx of SPAM(tm) transmitted by UUNet dynamic IP dial-up users (read: MSN, Earthlink, GTE, etc.) and relayed using Earthlink SMTP relays. Am I turning senile prematurely, or has anyone else noticed this influx? Also, how easy would it be for Earthlink and other nationwide "ISP's" (or more accurately, UU/PSI resellers) to do the following? This would not stop SPAM(tm) dead in its tracks, but I figure it would make it easier to hold spammers accountable at least... unless, of course, they use throw-away accounts, in which case there is not much that can be done... - institute anti-spam rules on their SMTP relays, i.e. only relay mail reporting to be from earthlink.net and the virtual domains they host - only allow SMTP relaying from IP's assigned to *their customers* dynamically (cross-reference Radius logs?) Constructive feedback would be greatly appreciated! Together, we CAN make a difference. Regards, Adam

9 11

RADB based filters
by Justin Newton 08 Jan '98

08 Jan '98

Hi all, I was wondering what those of you who are doing RADB/MCI-RR/ANS RA filtering were doing about large networks which do not register their networks in the RADB. It would seem unwise to simply trust their announcements, and even more unwise to simply ignore their announcements, so... Whats the common parctice in this scenario?

3 2