March 1998 - Test - lists.nanog.org

RE: Access Lists
by Martin, Christian 26 Mar '98

26 Mar '98

It's not that I don't want to protect my customers. But, most of them are ISPs, who are doing web hosting and the like. They find out that a warez ftp site is on their network, most likely consuming a ton of bandwidth, and to protect themselves, they boot the guy. Usually, warez guys have methods to retaliate. Jeez, anyone with a web browser and a C compiler can launch a land.c attack! I am very willing to help my customers, but there is a tradeoff in terms of what it costs me. If it is a good customer, or more importantly, a big one, then I will write a 200 line access list, no problem! But say I implement this type of service for a few customers, and word spreads that we are doing it, then everyone wants that type of service. How many of you out there have 50, 60, 80 + extended access lists on your border routers? What if I go over 99? Get IOS 11.2? This has been my point all along. creating an access list and applying it to a BGP distribute list on my outbound advertisements solves the attack problem, but that is useless because the customer cannot get out to the Internet( cannot be reached from, actually). NetFlow is a viable tracking tool, however, I still need help from my peers. Say it comes from one ISP, who delivers it to, say, MAE-West, where it is picked up and carried over to MAE-East, picked up again and dropped of over here. Tha is four providers, four NOCs to tassle with, to catch an attack that lasts usually no more than an hour. I suppose my biggest question was this. Has anyone got themselves into a hole by providing ICMP filtering on their routers to protect downstream customers, be it in terms of manageability, processor overhead, packet discarding. Also, where is the best place to do this, ingress, egress, or a combination? Do buffers need to be increased? What about queueing strategy? How does NetFlow affect access-list processing? I know these questions may be best answered by Cisco, but I want some real answers, from real people in the field. No offense to any Cisco employees, but you do have a company bias, just as we all do. Guys, thanks for all of the replies. You've all been a great help!!!! -Chris Jain Depak wrote > Why not just filter all ping traffic to his T1 until the attack > subsides? Christian Martin replied > That is what I am going to do. But with over 100 downstream customers, > and IOS 11.1 (sans named access lists) I don't want to start a > precedent. You don't want to start a precedent of protecting customers from DoS attacks? -- Steve Sobol, Tech Support Guru, NACS.NET [http://www.nacs.net/support] (The address I use on Usenet is a valid address - don't try to unmunge it!) Moderator, alt.religion.afterburner [http://antispam.nstc.com/ara] 1997 AL and 1998 World Series Champions: [http://www.indians.com]

2 1

Q&E
by Per Gregers Bilse 26 Mar '98

26 Mar '98

You may have seen this, then again you may not. In any case, somewhat off-topic for NANOG (but unquestionably of interest), please direct all speculation to com-priv. Needless to say, both parties feel very good. http://www.EU.net/cinfo/news/press980326qwest.html QWEST ENTERS EUROPEAN DATA MARKET IN 13 COUNTRIES THROUGH ACQUISITION OF EUNET INTERNATIONAL LTD Denver - Amsterdam - March 26, 1998 Qwest Communications International Inc. today announced it has agreed to acquire Amsterdam-based EUnet International in a cash and stock transaction valued at approximately $154 million. EUnet is a leading European Internet service provider (ISP) with business units operating in 13 countries - Austria, Belgium, Finland, France, Spain, Portugal, Norway, Sweden, Luxembourg, Czech Republic, Switzerland, Romania and Estonia. EUnet had revenues in 1997 of approximately $55 million, and 1998 revenues are expected to reach $16 million in the first quarter and over $75 million for the entire year. EUnet has over 400 employees and serves approximately 60,000, primarily business, customers throughout Europe. In addition, Qwest will fund EUnet's recent acquisition of a 50 percent interest in X-Link, a leading German Internet service provider. The board of directors of each company has approved the acquisition and the requisite number of EUnet shareholders have agreed to the transaction. EUnet shareholders will receive approximately $135.5 million in newly issued shares of Qwest common stock, approximately $4.5 million in cash, and approximately $14.4 million in cash or additional Qwest shares at Qwest's option. The acquisition will be accounted for as a purchase. The closing is subject to the satisfaction of certain customary conditions, including the receipt of applicable securities law approval. The parties expect to consummate the acquisition within 30 days. "The European data market is exploding to an estimated $55 billion by the year 2000. The Internet is the driving force behind this trend," said Joseph P. Nacchio, president and CEO at Qwest. "EUnet has extensive Internet expertise and an understanding of Europe's diverse national markets and regulatory issues. The liberalization of the European telecommunications market and our recently acquired transatlantic capacity, combined with the EUnet acquisition, allow Qwest to provide business customers with high performance and cost effective end-to-end data and Internet services between North America and Europe." "EUnet recognizes that the future of Internet usage rides on the ability to move large amounts of data and images quickly and without error. Partnering with Qwest allows the two companies to capitalize on their expertise in IP data networking products and to leverage the superior Qwest network infrastructure to deliver a leading edge American-European data strategy," said Jim Omand, chairman of the board at EUnet International. "Joining Qwest will allow us to further expand our presence in Europe and to continue to deliver to our customers the data network services that have made EUnet a market leader." The Qwest shares will be issued in a private placement exempt from registration under the Securities Act of 1933. Qwest has agreed to register the shares for resale under the Securities Act within three weeks after the closing of the previously announced merger between Qwest and LCI International, Inc. or by September 30, 1998, if earlier (or under certain circumstances as late as October 31, 1998). The Qwest Macro CapacitySM Fiber Network Qwest's planned domestic 16,250 mile network will serve more than 125 cities, which represent approximately 80 percent of the data and voice traffic originating in the United States, upon its scheduled completion in the second quarter of 1999. Currently, nearly 3,750 miles are activated from Los Angeles to Cleveland; and from Dallas to Houston. Qwest is also extending its network 1,400 miles into Mexico with completion slated for late third quarter 1998. The Qwest Macro Capacity Fiber network is designed with a highly reliable and secure bi-directional, line switching OC-192 SONET ring architecture. Upon completion, the network will offer a self-healing system that provides the ultimate security and reliability by allowing instantaneous rerouting in the event of a fiber cut. About EUnet Established in 1982 and the first European provider of Internet services for business use, EUnet was instrumental in creating Europe's Internet infrastructure. Today, EUnet International provides, via subsidiaries, affiliated companies and business partners, one-stop shopping for corporate Internet access in Europe with a network spanning over 42 countries and more than 400 PoPs (Points of Presence). Via its transit-free backbone, EUnet International offers the business community a wide range of turnkey solutions from full-service, centrally-managed connectivity and Intranets to mobile access, Webcasting, Web Storefront and Electronic Commerce solutions. For more information, please visit EUnet's website at www.EU.net. About Qwest Qwest Communications International Inc. (NASDAQ:QWST) is a multimedia communications company building a high-capacity, fiber optic network for the 21st century. With its cutting-edge technology, Qwest will deliver high-quality data, video and voice connectivity securely and reliably to businesses, consumers and other communications service providers. Further information is available at www.qwest.net. ### This release may contain forward-looking statements that involve risks and uncertainties. These statements may differ materially from actual future events or results. Readers are referred to the documents filed by Qwest with the SEC, specifically the most recent reports filed under the Securities Exchange Act of 1934, which identify important risk factors that could cause actual results to differ from those contained in the forward-looking statements, including potential fluctuations in quarterly results, dependence on new product development, rapid technological and market change, failure to complete the network on schedule, failure to consummate the proposed merger with LCI International timely or at all, volatility of stock price, financial risk management and future growth subject to risks. Information regarding EUnet (including forecasts of results of operation for 1998 or portions thereof) have been provided by EUnet and have not been verified by Qwest or its representatives. No assurance can be given with respect to such information or that such forecasts will be realized. This announcement is not an offer to sell or a solicitation to buy any securities of Qwest. Any offering securities will be make only pursuant to a prospectus prepared by Qwest. The Qwest shares to be issued in the transaction have not been registered under the Securities Act and, unless so registered or an exemption from registration is available, may not be offered or sold in the United States or its territories and possessions or to any "U.S. Person" (within the meaning of the Securities Act) and hedging transactions involving such shares may not be conducted unless in compliance with the Securities Act. The Qwest logo is a registered trademark of Qwest Communications International Inc. in the U.S. and certain other countries. -- ------ ___ --- Per G. Bilse, Director Network Eng & Ops ----- / / / __ ___ _/_ ---- EUnet Communications Services B.V. ---- /--- / / / / /__/ / ----- Singel 540, 1017 AZ Amsterdam, NL --- /___ /__/ / / /__ / ------ tel: +31 20 5305333, fax: +31 20 6224657 --- ------- 24hr emergency number: +31 20 421 0865 --- Connecting Europe since AS286 --- http://www.EU.net e-mail: bilse at domain

1 0

Sumbit Internet Account v1.1 (fwd)
by Dax Kelson 26 Mar '98

26 Mar '98

The bad part is this guy sounds like he really thinks he has made a "contribution" to the Internet at large. Even stating the savings in Internet access as a selling point. Dax Kelson Internet Connect, Inc. ---------- Forwarded message ---------- Date: Wed, 25 Mar 1998 10:59:23 -0700 From: Dax Kelson <dkelson(a)INCONNECT.COM> To: BUGTRAQ(a)NETSPACE.ORG Subject: Sumbit Internet Account v1.1 I just received a spam trying to sell me this lovely trojan for only $50. Another reason not to run programs emailed to you (even if it is punch_the_spice_girls.exe). I've mirrored (not the executable) the site in case it goes away: http://www.inconnect.com/~dkelson/SIA Dax Kelson Internet Connect, Inc. ======================================================================= http://www.germany.net/teilnehmer/100,92316/SIA/index.htm "SIA is the most powerfull util to get login names and passwords from other computers." "You give the program to a person and say its a game or something like this. Once started, the programm simulates a runtime error. People now think: "shity program don't work". They will uninstall it. But SIA installed itself on a secret place. The next time the person turns on his computer, SIA loads into the memory and waits until there is a Internet connection and then sends out all information from the "Dial-Up Networking" to your e-mail address. Turning of the computer won't help at all." =======================================================================

1 0

Re: IP over SONET considered harmful?
by Peter Lothberg 26 Mar '98

26 Mar '98

> As great as POS is, and as exciting as running IP on optical OC-48 onto WDM > gear sounds (no piece of cake, believe me...) It is a pice of cake, just belive me. > there is STILL room for > ATM. More than just the much-touted network traffic engineering value, too. This is not a pice of cake. -Peter

1 0

Re: Internic hosage (fwd) (The real end)
by Dean Anderson 26 Mar '98

26 Mar '98

At 5:23 AM -0500 3/26/98, Rich Sena wrote: >On Sun, 22 Mar 1998, Dean Anderson wrote: > >> Ah. Only girls with lowcut blouses and short skirts are raped. Since I >> don't wear lowcut blouses or short skirts, I have nothing to worry about, >> and shouldn't be concerned. Rape is OK, since it only happens to the sleazy >> girls. Uh Huh. When can I screw the interns? Say, you aren't hosting any >> porn or uncensored webcams are you? Boy, I think they're sick. Lets make >> sure we disconnect the entire lot, and any ISP/NSP who refuses to cooperate >> we'll just DoS them until they are pounded to dirt, like AGIS. Hey look, >> I think they are irresponsible. I'm justified in harassing them and >> publishing false routes etc. Right? >> >> I expect some kind of gaussian distribution of harassment develops where >> everyone gets harassed by some lunatic, and can't do anything about it. >> Eventually, somebody mails a bomb. To me? To you? To some kid in Vermont? >> You're smarter than that. I think. Besides, I react badly to coercion. So >> do most people. Thats why we need laws. Sensible ones at that. > >What type of crack are you on Dean? Your analogy is a mockery of the whole No crack. Just a cool, drug-free and relaxed guy, who thinks these anti-spammers need to get a life or maybe a dog to get rid of some stress. My analogy is a mockery of something. We just disagree on what it's a mockery of. Anti-spammer terrorists have no moral high ground. Even the Islamic fundamentalists believe they are doing Allah's work. Anti-spammers believe they are making the world what? More convenient? >Whose responsibility is YOUR dog - and if you don't curb your dog, and I >have to, I will definately make sure you do not enjoy and want to >avoid the experience in the future. Ok, here's a metaphoric response: Unfortunately, you don't get to kill the neighbors dog because it shit in your yard. True, in many big cities, there are ordinances which require dog owners to scoop up their dog shit, and keep all dogs on a leash. In most places places however, there aren't any such ordinances. You find shit in your lawn, tough. Go to the city council. Get an ordinance passed. Until you get an ordinance passed, and even if you do get an ordinace passed, it's going to be illegal to shoot your neighbors dog. I don't have any dogs. But I'm not going to stand idly by while you start shooting up the neighbhood trying to get rid of dog shit. I'm also not going to participate in your scheme to poison all the dogs in town. Dogs shit. Its what they do. You have to put up with a little shit in life. People act like the world is about to end because of a little dogshit. "Must... Stamp.... Out.... Dogshit... Kill... Dogs... At... All... Costs... Break... Gun... Laws... Shoot... Kill... Save... Humanity... From... Dogshit..." You're drooling. ;-) So, basically, I think anti-spammer terrorists are just like the jerks who run around trying to have dogs put to sleep, all because they are so terribly upset about a little dogshit in their lawn. Its not a big deal. After the next rain, its fertilizer, and their lawn grows greener. Some people are just over-reactive assholes. End of metaphor. How about that. Two issues we disagree on. On the other hand, there are some things about spam that should be regulated. There are postal service laws which apply to junk mailers, which prohibit things like pyramid schemes, a few other obscure crimes that happen via postal mail and could possibly happen over email. Junk mailers also must remove people from lists within 30 days. The post office maintains the list of who to remove, not the junk mailers. These are all quite reasonable things to apply to spammers. I'm for that. Just not for banning spam, nor violating laws to stop it, nor for vigilante activity in general. The paper or electronic media over which these crimes are committed shouldn't really matter. My proposal has been to make these laws essentially media-independent. It curbs the abuse legally. It just doesn't satisify the radicals who want to ban spam at any cost. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Access Lists
by Martin, Christian 26 Mar '98

26 Mar '98

Hello All, I have a customer who is being ping-flooded. His bandwidth is being sucked up due to these floods, and wishes me to block them on my router. I am somewhat reluctant to do this, since it goes against our policy; however, the customer has been very patient with us on this issue and his patience is running out. I would be implementing on a Cisco 7507, with 3 T-3s to the Internet, and the customer hangs off the router on a T-1. What is the general consensus on providing such a service, particularly in terms of processing overhead and manageability. Is there another way to prevent this type of attack, aside from watching packets go by and trying to trace it back through the source. The source IPs are spoofed. Thanks! Christian Martin

3 4

Ellipse - a new anonymous ftp server implementation
by ikuo＠ellipse.org 26 Mar '98

26 Mar '98

Hi all, We are very grad to announce an alpha release of the `Ellipse' which is a new anonymous ftp server implementation. A few Ellipse processes (one is the master and others are pre-forked processes) can handle a lot of ftp clients at a same time. So, it requires less memory or process resources to serve a large number of ftp sessions. Ellipse is designed to serve ANONYMOUS ftp services only. So it is VERY SECURE. For example, it calls chroot system call and leaves from any privilege mode before accepting connections. IPv6 extensions, such as LPRT, LPSV are also supported. We tested IPv6 extensions with INRIA and Hydrangea. For more details, see http://www.ellipse.org/ or README in a distribution. The newest distribution can be found in: ftp://ftp.ellipse.org/pub/net/ellipse Best regards, Ikuo Nakagawa

1 0

Re: Internic hosage (fwd)
by Dean Robb 26 Mar '98

26 Mar '98

At 10:54 3/19/98 -0500, Eric Eden wrote: >Dalvenjah, > >Thanks for your feedback. Network Solutions served over >35 million WHOIS queries in the month of January 1998. >The average response time for our WHOIS service is less >than 5 seconds per query. Thank you for the statistics. Not sure of their applicability, but it's nice to know just how heavily used this database is. Hmmm...one would think that if it's that heavily hit, maybe there would be some interest in keeping it accurate, yes? > >Please keep in mind that Network Solutions is not the >registry for the .to domain. We recommend you contact >the Tonic registry for information about .TO domain names. >Their web site is www.tonic.to And it's the Kingdom of Tonga's domain, for which Tonic is merely the Registry. However, the point has been completely missed here, Eric. The point Dal was making is that Perhaps.youwant.to FALSIFIED, LIED, FORGED, STOLE, MISAPPROPRIATED, and otherwise BS'd about their WhoIs entry: [No name] PERHAPS-HST Hostname: PERHAPS.YOUWANT.TO Address: 205.166.250.10 System: ? running ? Coordinator: HOST Networks-DNS Administration HNA-ORG hostmaster(a)HOST.NET 800-697-2437 Fax- 800-697-2437 Record last updated on 16-Mar-98. Database last updated on 20-Mar-98 04:11:54 EDT. [perhaps.youwant.to] Translated Name: perhaps.youwant.to IP Address: 207.89.50.3 Internet Gateway Connections (NETBLK-IGC-FL-BLK-1) 10011 Pines Boulevard - Suite 203 Pembroke Pines, Florida 33024 Netname: IGC-FL-BLK-1 Netblock: 207.89.0.0 - 207.89.127.255 Maintainer: IGCN Coordinator: Master, Host (HM511-ARIN) mike(a)WEB2000.NET 305-655-2955 (FAX) 305-652-5090 Domain System inverse mapping provided by: NS3.WEB2000.NET 207.89.0.10 NS4.WEB2000.NET 207.89.0.30 Record last updated on 17-Aug-96. Database last updated on 19-Mar-98 16:08:42 EDT. Traceroute confirms that youwant.to is hosted by Web2000.net. The WhoIs-listed IP is user.host.net, the machine on which Host.Net runs their webpage, FTP, et al. Not real likely they'd give that out for a hosted domain's IP. So....four days ago, youwant.to [side issue: Why does a machine, "perhaps", have a host entry in WhoIs, but the domain, "youwant.to" not?] updated their WhoIs record with a bunch of lies. THAT is the point, and the problem. What is NSI/InterNIC going to do about it, Eric? > >Regards, > >Eric Eden >Senior Analyst Network Solutions, Inc. >Phone: 703-925-6710 erice(a)internic.net Spam: it's not just for breakfast anymore.... Dean Robb PC-Easy On-site computer services (757) 495-EASY [3279]

14 30

Re: Hope it's operational enough....
by Chris MacFarlane 25 Mar '98

25 Mar '98

Send me some private mail and I will line you up with an account on Internet Canada/ACC. We have dialup in all major Canadian cities. Chris MacFarlane Manager, Data Operations ACC Telenterprises Canada 4162132023 cmacfarlane(a)acc.ca cjm(a)ican.net -----Original Message----- From: Randall S. Benn <rbenn(a)clark.net> To: Howard C. Berkowitz <hcb(a)clark.net> Cc: nanog(a)merit.edu <nanog(a)merit.edu> Date: Wednesday, March 25, 1998 9:20 PM Subject: Re: Hope it's operational enough.... >On Wed, 25 Mar 1998, Howard C. Berkowitz wrote: > >> I'm going to be in Canada a fair bit in the near term, but in a number of >> different cities. Are there any Canadian ISP's that have local dial access >> in most major cities? So far, from south of the border, I only find ones >> in specific cities. > >Howard, > >Check out IBM. They have by far more local dial numbers scattered around >the planet than anybody. For $20/month you can get a local connection >just about anywhere. At a quick glance, looks like they have almost 50 >numbers throughout Canada. > >Check out their list of local dial numbers at: >http://www.ibm.net/hlpctr/html/access_numbers_accessnum.html > >Randy > >-------------------------------------------------------------------- >"Cisco Systems In A Nuthsell" >http://www.clark.net/pub/rbenn/cisco.html >-------------------------------------------------------------------- > > >

1 0

Hope it's operational enough....
by Howard C. Berkowitz 25 Mar '98

25 Mar '98

I'm going to be in Canada a fair bit in the near term, but in a number of different cities. Are there any Canadian ISP's that have local dial access in most major cities? So far, from south of the border, I only find ones in specific cities. TIA... Howard

2 1