July 1998 - Test - lists.nanog.org

Backhoe news report (not operations related, maybe)
by Sean Donelan 13 Aug '98

13 Aug '98

Sorry, you can't configure your Cisco router with this, but it was too good to pass up. El Rito, NM -- The Taos News reports the Northern New Mexico Community College is offering a new course on operating backhoes. Prospective backhoe operators drove 800 miles to attend the class. The class includes one week with students practicing on three John Deer backhoes on projects near the school. Additional classes offered by NNMCC include global positioning systems, welding, computer applications and first aid. No word if NNMCC will be offering classes in fiber optic cable splicing. Backhoe operators trained in GPS, welding, and first aid. No fiber in the land will be able to hide from these trained backhoe warriors :-) -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2

Re: "Packet Shapers"
by Hank Nussbacher 05 Aug '98

05 Aug '98

At 11:28 AM 7/30/98 -0400, Scott Gifford wrote: I have been using a packet shaper (non commercial product) since 4/96 and have recently been reviewing/testing a number of commercial products on the market. I will ignore the options and features every product has but rather focus on those things to look at when checking these boxes: 1) alerts: a nice feature to have that no commercial product has yet is an alert feature when a bandwidth limiting policy has been exceeded. Example: You limit incoming icmp to 100kb and are suddenly hit by a Smurf eating up 2Mb/sec. You want an alert sent to the NOC via email or some other method. Or you have policy limiting single stream outgoing UDP to 256kb and suddenly see 4Mb/sec. You definitely want an alarm going off somewhere. We have found that email alerts are invaluable. Packeteer doesn't have it. 2) Bandwidth manipulation: some products do buffering, some play with the TCP window. You want both. Packeteer has both. 3) Bypass: you want a hardware and software bypass in the event something goes wrong. This is black box sitting in the data path. You now have a strip of boxes: firewall->packetshaper->router (and perhaps more). If something doesn't work, you don't want to start recabling to bypass the packet shaper. Software bypass via a Web interface is a must, and a hardware bypass is also critical. Packeteer has both. 4) Signon management: In a large ISP operation, many users will need to have access to modify the rules and policies. You will want a system that has individual user signon rather than a single user/pswd. Packeteer has only single user/pswd so therefore it is impossible to track who has done what changes. 5) Topflows: In RMON there is the concept of Top 10. When the network slows down, you want the ability to see a list of the Top n users consuming bandwidth in the past 1 minute/10 minutes/hour. Packeteer does not have that capability. 6) Flows: When a vendor says their box supports T3, one has to check a little deeper and determine the number of max flows allowed. For example, Allot (www.allot.com) supports a T3 box, but tops out at 5000 concurrent flows. Packeteer supports 20,000 concurrent flows. Current realtime numbers on my beta box show 2400 flows consuming 3.3Mb, and often 8000-9000 flows consuming 6.5Mb of bandwidth. Based on those numbers, I will hit 20,000 flows long before I hit 20Mb of bandwidth. I do not think the packet shaper vendors have much of an idea in the ISP market as to the large number of flows involved. They know corporate networks. 7) Platform: Look at the OS platform. Packeteer using a proprietary OS, others may package Linux or NT. None have done any OS hardening on the system so it is best to run something like ISS against the packet shaper to determine what security holes exist. Imagine you start using a packet shaper in production only to have the hackers hack it and set their own super-duper policies. 8) Audit trail: The product should have the ability to have some sort of syslog based on modifications done by personnel. Packeteer has something that is not accessible via the web and is more for debugging. 9) Filters & CPU: Look for products that can support CIDR notation and not the long masks. Packeteer doesn't support CIDR notation masking for filters. Some limit the size of the filter (also called policy, access- list, pipe rule, etc.). Packeteer limits it to 16 lines. The larger the filter the slower the box. Test it out. 10) ToD: All boxes have the ability to control based on source IP, destination IP and port. Not all have the ability to control based on time of day. Suppose you want incoming news to be limited to 128kb during the day but open it up from 2-8am to 800kb. Packeteer has a line command called "schedule". Look for GUI's to do this. 11) Flow limiting: sometimes you want the ability to not only control bandwidth but also the number of flows. Example: you allow IP phone via the Internet via port xxxx but want to guarantee 8kb/sec per flow, but you only have 64kb of bandwidth allocated for that port. You want to have the ability to state that a maximum of 8 flows can use that virtual pipe and the 9th won't get the service. Packeteer says they have this ability but I have not verified it. 12) Graphs: you want the ability for realtime graphs for each policy so you can see how your rule changes have affected the bandwidth. Packeteer has this capability. 13) Multihoming: this is the one *every* vendor fails on and is perhaps the one we need. These packet shaper boxes assume either one outgoing line from the router, or if there are multiple lines - that they are load balanced (NReality - www.nreality.com places their box on the FR line itself after the router - and last I checked only support FR). But in most ISP cases, you are multihomed with 3-4 outgoing lines - which are not fully balanced. Suppose one line is 90% and the others are 30%. The packet shaper can't see any of this and therefore the policy rules are not perfect. The line that is 90% satuarted is hearing 4,000 nets via BGP. How do you get that routing info the packet shaper? None have some sort of BGP import and when I tell them I want to import 52,000 prefixes and build policy rules based on that - they look at me like I am from Mars. In the near future we will be exploring this avenue for Internet-2 in Israel. 14) Transparent proxy: remember that line of boxes? firewall->packet shaper->router? Now add in a transparent proxy. Ugh. Look for a vendor that will include a transparent proxy capability in their box. I wouldn't be suprised if Alteon and Packeteer were to merge. These kind of mergers have to happen. Checkpoint already has packet shaping in their firewall via an addon product called Floodgate. Cisco bought up Classdata (www.classdata.com) so expect to see more of these capabilities in firewalls and routers. If you have read articles in Network World, Data Communications, etc. on this topic you will not find this level of detail there. This only comes with actually using and testing these boxes. Scott, these products do work and are not snake oil. I trust this helps you somewhat. -Hank >I was wondering if anybody out there has had any experience with "Packet >Shapers," which claim to be able to limit traffic to a particular host, >host+port, or host+port+url without dropping packets. They apparently watch >traffic flows and keep track of connections, then dink around with TCP >window size information to slow traffic down if needed. > >The one we have been looking at is called "The Packeteer" >(http://www.packeteer.com) but I have seen a few others (one of which had a >really good picture of a pig in the ad). > >Do these things work as advertised? Is anybody actively using them inside >their networks? I don't know enough down-and-dirty information about TCP to >know if this should work, or if it's just a plastic shell filled with >snake-oil... > >Thanks for any information. Email if you like, I will post a summary if >people are interested. > >------Scott. > >

4 9

Re: Network Abuse - Netblock x.x.x.x - IMPORTANT
by Jay Stewart 03 Aug '98

03 Aug '98

-----Original Message----- From: James Rishaw <jamie(a)dilbert.ais.net> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Thursday, July 30, 1998 10:20 AM Subject: FW: Network Abuse - Netblock x.x.x.x - IMPORTANT >A coworker's friend forwarded this to me.. kinda funny.. Kinda lame.. > > >-----Original Message----- >Sent: Thursday, July 30, 1998 7:36 AM >Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT > > >---------- >From: Andrew Shoemaker[SMTP:wrath@jerky.net] >Sent: Thursday, July 30, 1998 6:43 AM >Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT > >Hello > >My name is Andrew Shoemaker and I am the head security consultant at JNS. We >recently were the target of a denial of service attack that saturated our >Internet connection. This attack, known as a 'smurf' attack, uses unknowing >relays to source the at >tack. By relaying the attack through your network the attack is made >anonymous and increases in strength. This type of attack causes degraded >performance on both the attacked and relay networks and is the result of an >improperly configured router at you >r site. I urge you to fix your routers. If you are unable to do so, or do >not know how I suggest you call a security consultant. JNS is willing to >fix your router permanently for a one time fee of $100 US. If you are >interested in this deal please co >ntact me and I will send you a copy of our security contract and an invoice. > >Netblock de.le.te.d was found to produce 11 replys for each packet sent. >This means if the attacker is sending at T1 speeds the amount of your >bandwidth used in relaying > the attack is equivalent to 11 T1s > >regards, >Andrew Shoemaker >JNS Security >wrath(a)jerky.net >617.442.5408 Did anyone take the time to look at this goober's web page? Here is a *nice* snippet. Jay Stewart Vice President OlyWa.Net - "Olympia's Premier Internet Service Provider" -=-=-=-=- from: http://www.jerky.net/smurf.html The Smurf Relay List This is a list of subnets that can be used for the "smurf" attack. If you find your subnet on this list FIX YOUR FUCKING ROUTERS! If you have subnets you wish to add to this list please email the wrath-mon. Once you fix your router email the above address to get your subnet removed. Until then....everyone feel free to completely FUCK these networks...and remember stupidity should never be tolerated. Updated: 07.29.98

4 3

Re: "Packet Shapers"
by shields＠crosslink.net 31 Jul '98

31 Jul '98

In article <2.2.32.19980731064343.006a171c(a)max.ibm.net.il>, Hank Nussbacher <hank(a)ibm.net.il> wrote: > 7) Platform: Look at the OS platform. Packeteer using a proprietary OS, > others may package Linux or NT. None have done any OS hardening on the > system so it is best to run something like ISS against the packet shaper > to determine what security holes exist. Imagine you start using a > packet shaper in production only to have the hackers hack it and set > their own super-duper policies. The risk is worse than that -- a malicious party having access to a box which can view and modify 100% of your outside traffic is a very ugly scenario. There is of course much more to security than running ISS. > 10) ToD: All boxes have the ability to control based on source IP, > destination IP and port. Not all have the ability to control based on > time of day. Suppose you want incoming news to be limited to 128kb > during the day but open it up from 2-8am to 800kb. Packeteer has a line > command called "schedule". Look for GUI's to do this. I would hope anything with this suppport also runs NTP. > 12) Graphs: you want the ability for realtime graphs for each policy so > you can see how your rule changes have affected the bandwidth. > Packeteer has this capability. And hopefully all the data would be SNMPable so you can do your own graphs as well. As with all networking products, the key for an ISP environment is not to provide an all-in-one solution but to provide something with good plugs so it integrades well with the rest of your network. -- Shields, CrossLink.

1 0

The Cidr Report
by Tony Bates 31 Jul '98

31 Jul '98

This is an auto-generated mail on Fri Jul 31 12:00:00 PDT 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 31Jul98 0) General Status Table History ------------- Date Prefixes 240798 52857 250798 52796 260798 52635 270798 53086 280798 53322 290798 52992 300798 52883 310798 52941 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 218.218.180.0 from AS701 AS Summary ---------- Number of ASes in routing system: 3786 Number of ASes announcing only one prefix: 1835 (963 cidr, 872 classful) Largest number of cidr routes: 348 announced by AS3561 Largest number of classful routes: 1134 announced by AS701 1) Gains by aggregating at the origin AS level --- 31Jul98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS3602 534 316 218 40.8% Sprint Canada Inc. AS701 1134 933 201 17.7% Alternet AS271 338 144 194 57.4% BCnet Backbone AS4293 454 265 189 41.6% IMCI AS2493 420 244 176 41.9% iSTAR Internet, Inc. AS3749 222 69 153 68.9% TECNET AS174 711 581 130 18.3% Performance Systems International AS2685 249 157 92 36.9% IBM Global Network - US AS5668 126 48 78 61.9% Century Telephone Inc. AS3221 112 42 70 62.5% EENet Autonomous System AS4755 118 50 68 57.6% Videsh Sanchar Nigam Ltd. India AS3804 220 155 65 29.5% Bell Solutions AS7046 223 165 58 26.0% UUNET-CUSTOMER AS4740 397 339 58 14.6% ASN-OZEMAIL (Ozemail Pty Ltd) AS549 207 152 55 26.6% ONet Backbone AS10928 101 46 55 54.5% UNKNOWN AS3403 180 126 54 30.0% TIAC AS6335 68 19 49 72.1% NTRNET AS72 85 37 48 56.5% Schlumberger Information Network AS719 455 408 47 10.3% LANLINK autonomous system AS1239 537 490 47 8.8% SprintLink Backbone AS4539 71 26 45 63.4% NETROPOLIS AS4200 142 97 45 31.7% AGIS (Apex Global Information Ser AS237 95 50 45 47.4% MichNet Primary AS AS1785 294 253 41 13.9% NYSERNet Backbone AS852 155 115 40 25.8% AGT Advance Communication AS6181 66 26 40 60.6% FUSE-NET AS7122 120 82 38 31.7% MTS ADVANCED Network Policy AS10921 57 19 38 66.7% KIHNETWORK AS762 117 80 37 31.6% WELLFLEET-AS For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

CIDR on 3Com Netbuilder
by Martin, Christian 31 Jul '98

31 Jul '98

All, Anyone know how to configure a 3Com NetBuilder to support classless routing? Here is the scenario. I have a class B that is being split up into 24s and 26s. All are being statically routed over the respective WAN interfaces to the customer prem. Most default back to our WAN interfaces (some downstream BGP peers, but not in this scenario). Customer A has a 3Com Netbuilder, with an LAN IP of x.x.200.1 /24. Customer B has a Cisco 2501 with a LAN IP of x.x.23.1 /24. This customer is configured for classless routing using the 'ip classless' IOS global command. All customers can see into this network (cust B), even within the same x.x classfull class B space. But no one in the classfull x.x can see into customer A's network. Actually, their traffic gets there, but the return traffic never leaves, because the NetBuilder is looking at the first 3 bits and ignoring it, thinking that it is local. 3Com thinks that there needs to be static routes in place. I think that this is ridiculous, and that CIDR support is necessary in today's Internet. It would entail me having to ask a customer to add over 25 static routes for networks that the default rtr (me) knows about. Does anyone know how to do this without having a CIDR-aware routing protocol like OSPF running? I have had three 3Com guys on the this ticket for over a week, with no resolution. 3Com employees can redeem their company by supplying a working solution...Anyone? Regards, -Chris

2 1

exchange point in-addrs
by john heasley 31 Jul '98

31 Jul '98

how does one manage to get PTR RRs changed for exchange point addresses? we've tried using the form below and submitting the resulting email template as instructed, but received no response. http://www.isi.edu/div7/naps/ipadd-req.html tried sending mail to hostmaster(a)ep.net (from the SOAs) which stuck in our mail queue because the single MX for ep.net (flag.ep.net) is a laptop (or so we were told). the one time that our queue happened to run and the laptop was accessible; mail to hostmaster bounced w/ user unknown. then, a second MX was added (and has since disappeared), but that host refused to relay for ep.net. is there another path that i have missed? any ideas? TIA, -heas

2 1

"Packet Shapers"
by Scott Gifford 30 Jul '98

30 Jul '98

I was wondering if anybody out there has had any experience with "Packet Shapers," which claim to be able to limit traffic to a particular host, host+port, or host+port+url without dropping packets. They apparently watch traffic flows and keep track of connections, then dink around with TCP window size information to slow traffic down if needed. The one we have been looking at is called "The Packeteer" (http://www.packeteer.com) but I have seen a few others (one of which had a really good picture of a pig in the ad). Do these things work as advertised? Is anybody actively using them inside their networks? I don't know enough down-and-dirty information about TCP to know if this should work, or if it's just a plastic shell filled with snake-oil... Thanks for any information. Email if you like, I will post a summary if people are interested. ------Scott.

2 1

RE: Network Abuse - Netblock x.x.x.x - IMPORTANT
by Martin, Christian 30 Jul '98

30 Jul '98

I guess the fella doesn't realize that smurfers monitor this group... And I thought it was dying down. :( -C -----Original Message----- From: Jay Stewart [mailto:cosmo@olywa.net] Sent: Thursday, July 30, 1998 1:28 PM To: jamie(a)ais.net Cc: nanog(a)merit.edu Subject: Re: Network Abuse - Netblock x.x.x.x - IMPORTANT -----Original Message----- From: James Rishaw <jamie(a)dilbert.ais.net> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Thursday, July 30, 1998 10:20 AM Subject: FW: Network Abuse - Netblock x.x.x.x - IMPORTANT >A coworker's friend forwarded this to me.. kinda funny.. Kinda lame.. > > >-----Original Message----- >Sent: Thursday, July 30, 1998 7:36 AM >Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT > > >---------- >From: Andrew Shoemaker[SMTP:wrath@jerky.net] >Sent: Thursday, July 30, 1998 6:43 AM >Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT > >Hello > >My name is Andrew Shoemaker and I am the head security consultant at JNS. We >recently were the target of a denial of service attack that saturated our >Internet connection. This attack, known as a 'smurf' attack, uses unknowing >relays to source the at >tack. By relaying the attack through your network the attack is made >anonymous and increases in strength. This type of attack causes degraded >performance on both the attacked and relay networks and is the result of an >improperly configured router at you >r site. I urge you to fix your routers. If you are unable to do so, or do >not know how I suggest you call a security consultant. JNS is willing to >fix your router permanently for a one time fee of $100 US. If you are >interested in this deal please co >ntact me and I will send you a copy of our security contract and an invoice. > >Netblock de.le.te.d was found to produce 11 replys for each packet sent. >This means if the attacker is sending at T1 speeds the amount of your >bandwidth used in relaying > the attack is equivalent to 11 T1s > >regards, >Andrew Shoemaker >JNS Security >wrath(a)jerky.net >617.442.5408 Did anyone take the time to look at this goober's web page? Here is a *nice* snippet. Jay Stewart Vice President OlyWa.Net - "Olympia's Premier Internet Service Provider" -=-=-=-=- from: http://www.jerky.net/smurf.html The Smurf Relay List This is a list of subnets that can be used for the "smurf" attack. If you find your subnet on this list FIX YOUR FUCKING ROUTERS! If you have subnets you wish to add to this list please email the wrath-mon. Once you fix your router email the above address to get your subnet removed. Until then....everyone feel free to completely FUCK these networks...and remember stupidity should never be tolerated. Updated: 07.29.98

1 0

FW: Network Abuse - Netblock x.x.x.x - IMPORTANT
by jamie＠dilbert.ais.net 30 Jul '98

30 Jul '98

A coworker's friend forwarded this to me.. kinda funny.. Kinda lame.. -----Original Message----- Sent: Thursday, July 30, 1998 7:36 AM Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT ---------- From: Andrew Shoemaker[SMTP:wrath@jerky.net] Sent: Thursday, July 30, 1998 6:43 AM Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT Hello My name is Andrew Shoemaker and I am the head security consultant at JNS. We recently were the target of a denial of service attack that saturated our Internet connection. This attack, known as a 'smurf' attack, uses unknowing relays to source the at tack. By relaying the attack through your network the attack is made anonymous and increases in strength. This type of attack causes degraded performance on both the attacked and relay networks and is the result of an improperly configured router at you r site. I urge you to fix your routers. If you are unable to do so, or do not know how I suggest you call a security consultant. JNS is willing to fix your router permanently for a one time fee of $100 US. If you are interested in this deal please co ntact me and I will send you a copy of our security contract and an invoice. Netblock de.le.te.d was found to produce 11 replys for each packet sent. This means if the attacker is sending at T1 speeds the amount of your bandwidth used in relaying the attack is equivalent to 11 T1s regards, Andrew Shoemaker JNS Security wrath(a)jerky.net 617.442.5408 -- jamie rishaw (dal/efnet:gavroche) American Information Systems, Inc. Tel:312.425.7140, FAX:312.425.7240 thirty thousand feet above the earth..youre a beautiful thing..

1 0