February 1998 - Test - lists.nanog.org

Cisco Password recovery-HELP!
by Adam Rothschild 20 Feb '98

20 Feb '98

Hi. I'm trying to recover the enable pw on a 2501 with IOS 10.2 (bootstrap: 5.2(5) release) and I'm failing miserably. I boot the system up, and send it a break (i'm minicom; ctrl + 6 and ctrl + ^ work as a break on a cisco for me), yet it boots normally, rather than bringing me the ">" prompt. If someone could pleaes contact me ASAP (private e-mail is best) I'd greatly appreciate it! Thanks, Adam

4 4

SMTP spoofing ?
by John R Levine 20 Feb '98

20 Feb '98

Are there any routers currently available that can do port 25 spoofing for dialup users? That is, when the user attempts to connect to port 25 anywhere, he in fact connects to port 25 on your own SMTP server instead. In case it's not obvious, it's for spam management. Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner Finger for PGP key, f'print = 3A 5B D0 3F D9 A0 6A A4 2D AC 1E 9E A6 36 A3 47

5 5

NSI Bulletin 098-004 | Zone releases
by David H. Holtzman 20 Feb '98

20 Feb '98

Beginning this weekend, Network Solutions will update and release zone files seven days per week instead of only on Monday thru Friday. This applies to .com, .org, .net, .edu and the root zone when appropriate. This will result in a more timely propagation of desired changes, additions and deletions. _____________________________________ David H. Holtzman (dholtz(a)internic.net) Sr Vice President of Engineering Network Solutions, Inc.

3 2

NSI Bulletin 098-005 | Zone releases
by David H. Holtzman 20 Feb '98

20 Feb '98

Beginning this weekend, Network Solutions will update and release zone files seven days per week instead of only on Monday thru Friday. This applies to .com, .org, .net, .edu and the root zone when appropriate. This will result in a more timely propagation of desired changes, additions and deletions. _____________________________________ David H. Holtzman (dholtz(a)internic.net) Sr Vice President of Engineering Network Solutions, Inc.

1 0

Re: Bellovin sez...
by Sean M. Doran 20 Feb '98

20 Feb '98

Duh, Ran, you are in cable. What do you have against reruns? Sean.

1 0

Re: Bellovin sez...
by rja＠corp.home.net 20 Feb '98

20 Feb '98

Forgive my directness, but there was no _new_ data at all in what the referenced URL quoted Steve/Matt as saying. Much of this goes (in the public literature) at least back to Steve's paper in ACM CCR in the late 80s. Others of it has been documented elsewhere in the public literature since then. Also note that clever operators _are_ taking steps like: - pushing vendors towards SNMPv3 with real security - deploying OSPF MD5 authentication/RIP MD5 authentication - deploying the TCP MD5 option to protect BGP sessions - using route servers - deploying Kerberos/SSH/IPsec to secure login connections to servers & disallowing unprotected connections - deploying IETF OTP or Bellcore S/Key on routers - ... Ran rja(a)home.net

1 0

The Cidr Report
by Tony Bates 20 Feb '98

20 Feb '98

This is an auto-generated mail on Fri Feb 20 12:00:00 PST 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 20Feb98 0) General Status Table History ------------- Date Prefixes 050298 49484 140298 49400 150298 49226 160298 49509 170298 49589 180298 49307 190298 49418 200298 49181 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 3244 Number of ASes announcing only one prefix: 1560 (801 cidr, 759 classful) Largest number of cidr routes: 441 announced by AS3561 Largest number of classful routes: 1074 announced by AS701 1) Gains by aggregating at the origin AS level --- 20Feb98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS2493 707 435 272 38.5% iSTAR Internet, Inc. AS6235 525 261 264 50.3% Intermedia Communications, Inc. AS4293 434 210 224 51.6% IMCI AS816 585 420 165 28.2% UUNET Canada (ASN-UUNETCA-AS4) AS3602 458 305 153 33.4% Sprint Canada Inc. AS174 775 627 148 19.1% Performance Systems International AS3749 198 55 143 72.2% TECNET AS701 1074 950 124 11.5% Alternet AS3751 125 48 77 61.6% SNET-AS AS5668 109 37 72 66.1% Century Telephone Inc. AS3804 204 142 62 30.4% WORLDLINX AS1239 590 528 62 10.5% SprintLink Backbone AS3221 92 32 60 65.2% EENet Autonomous System AS271 112 56 56 50.0% BCNET-AS AS3464 121 66 55 45.5% Alabama Research and Education Ne AS72 84 36 48 57.1% Schlumberger Information Network AS1221 263 215 48 18.3% AARNET-AS AS549 205 158 47 22.9% ONET-AS AS4755 78 34 44 56.4% Videsh Sanchar Nigam Ltd. India AS2711 98 55 43 43.9% SUNBELT-AS AS7046 131 89 42 32.1% UUNET-CUSTOMER AS3561 883 842 41 4.6% MCI AS852 157 117 40 25.5% CANET-ASN AS684 86 46 40 46.5% MBNET-AS AS6335 63 23 40 63.5% NTRNET AS4740 348 308 40 11.5% ASN-OZEMAIL (Ozemail Pty Ltd) AS1 789 749 40 5.1% BBNPLANET AS6181 63 24 39 61.9% FUSE-NET AS3493 166 128 38 22.9% INTERLINK AS719 432 395 37 8.6% LANLINK autonomous system For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Re: Bellovin sez...
by Eric Sobocinski 20 Feb '98

20 Feb '98

They could, that is, unless everyone to whom the hacker attached was doing ingress BGP filtering for all peers/downstreams. I'm sure my Merit RA comrades would be glad to jump in with a plug that IRR and route servers could help facilitate this, as would the varied groups that are working on authenticating network allocations of incoming routes. But that of course was your point. :-) --eric <ducking in case he started a religious war> On Fri, 20 Feb 1998 at 09:29 PST, Michael Dillon <michael(a)memra.com> wrote: > > Here's a quote from this story > http://www.techweb.com/wire/story/TWB19980220S0001 > > Both Bellovin and his AT&T colleague Matt Blaze cited the vulnerability > of the Net's decentralized routing system, .... This routing > information has been accidentally corrupted several times, they said, > resulting in massive traffic flows being rerouted through single slow > machines or blocked altogether. > > They said a hacker could also cause this kind of corruption. > > -- > Michael Dillon - Internet & ISP Consulting > http://www.memra.com - E-mail: michael(a)memra.com

2 1

Bellovin sez...
by Michael Dillon 20 Feb '98

20 Feb '98

Here's a quote from this story http://www.techweb.com/wire/story/TWB19980220S0001 Both Bellovin and his AT&T colleague Matt Blaze cited the vulnerability of the Net's decentralized routing system, .... This routing information has been accidentally corrupted several times, they said, resulting in massive traffic flows being rerouted through single slow machines or blocked altogether. They said a hacker could also cause this kind of corruption. -- Michael Dillon - Internet & ISP Consulting http://www.memra.com - E-mail: michael(a)memra.com

2 1

Re: SMTP spoofing ?
by owen＠DeLong.SJ.CA.US 20 Feb '98

20 Feb '98

I believe some trickery with the NAT features in the AS5200 from Cisco might be a possibility. Owen > Are there any routers currently available that can do port 25 spoofing for > dialup users? That is, when the user attempts to connect to port 25 > anywhere, he in fact connects to port 25 on your own SMTP server instead. > > In case it's not obvious, it's for spam management. > > Regards, > John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", > Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner > Finger for PGP key, f'print = 3A 5B D0 3F D9 A0 6A A4 2D AC 1E 9E A6 36 A3 47 > >

1 0