January 1999 - Test - lists.nanog.org

RE: Lawsuit threat against RBL users
by Chris Mauritz 27 Mar '99

27 Mar '99

-----Original Message----- From: Karl Denninger [mailto:karl@Denninger.Net] Sent: Thursday, November 19, 1998 10:26 AM To: Chris Mauritz; 'Sheryl Chapin'; nanog(a)merit.edu Subject: Re: Lawsuit threat against RBL users >The problem with this is that someone, sooner or later, is going to >take a run at people trying to set up what amounts to a set of contractual >requirements that exceed legal requirements - and then enforce them network >wide. > >The collusive aspect of this is downright scary, especially when coupled >with threats of depeering, active denial of service attacks, etc. *shrug* If I am an ISP, I'm free to have whatever AUP I want. IF clients don't like the AUP, they are free to shop elsewhere. I don't have the ability to force other ISPs to use my AUP or even a close facsimile...nor is there is a method to enforce your 1984 vision anyway. The net is a loose connection of public and private links. If I own a private link and I decide that I'm going to route you into /dev/null...that's what I'll do. There isn't a thing you can do about it. [snip] >There are a lot of "questionable" things that this industry does, but IMHO >this one is near or at the top of the list of things I'd talk to my counsel >about.... Knock yourself out. Be sure to let us know what your legal eagle has to say on the matter. Chris

11 10

Re: 'nic whois warning
by Dean Anderson 04 Mar '99

04 Mar '99

At 10:04 PM 1/4/1999 -0800, bmanning(a)vacation.karoshi.com wrote: > >24.in-addr.arpa has never been delegated. What do you mean? Address space has been assigned by ARIN: > whois -h whois.arin.net 24.128 Continental Cablevision - North East (NETBLK-CVSN-CCNE) CVSN-CCNE 24.128.0.0 - 24.128.255.255 There appear to be registered nameservers for some blocks. And just now: > set type=soa > 24.in-addr.arpa. Server: starship.av8.com Address: 198.3.136.10 IN-ADDR.ARPA origin = A.ROOT-SERVERS.NET mail addr = hostmaster.INTERNIC.NET serial = 1999010400 --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

7 6

SMURF Detector Software
by prue＠ISI.EDU 10 Feb '99

10 Feb '99

Hi, I, as many of you have had to deal with various types of denial of service attacks or other attacks. A good number of these attacks can be characterized by one host sending to many destinations, many hosts on one subnet sending to one destination, one host sending to very similar or the same IP address (host/port scans) etc. Confronted with detecting this to warn my customers if they are victims, or admonish my customers if they are the culprits, I wrote a tool to give me some indication when this kind of thing is going on, while it is still happening using netflow data. I modified Ciscos' fdget program they make available on one of their ftp sites to look for self similar source or destination addresses in netflow data blocks. Thanks go to Cisco for leting me distribute this to the group. You can give it a try if you want. It is avaliable via anonymous ftp on venera.isi.edu in subdirectory mon. The file names you will need to know to retrieve by name are: smurfind.c C program README.smurfind documentation flowdata.h C program definitions (written by cisco folks) smurfind.rc sample data file You can't do an ls on the directory. I used version 5 netflow data to debug the code. I haven't tested it against version 1 or other versions. B.T.W. The program dumps legitimate data as suspect. If however the rate at which the program shows suspect data changes, that is when you need to look more closely. The output from the program is very valuable to confront the guilty party to demonstrate that something inapropriate is going on. Let me know what you think. Walt Prue Los Nettos

2 1

SNMP Hub management tools
by Matt Braun 09 Feb '99

09 Feb '99

Since the System monitoring query had such good results, I am going to try a variation. I am looking for SNMP management tools (windows or Unix) that can use multiple MIBS for an environment with hubs from several different vendors. The tools need not be GUI, and I am espically interested in 'free' tools. The functionality I am looking for includes (but is not limitted to): gathering port / board pps and bps information port link status the ability to determine what port an IP addresses / MAC addreses is connected to enable / disable ports reset hub / hub management Don't bother reporting on Openview and Optivity...I know about those :-) Please send responses to me personally (with URLS or other appropriate pointers) and I will digest / sumarize them and send them to the list. Matt

2 2

SF Bay Area LEC discussion list?
by Jim Browne 03 Feb '99

03 Feb '99

I'm trying to gauge interest among San Francisco Bay Area operators (ISPs and knowledgeable corporate customers) with respect to starting a mailing list or forum dedicated to the notification of LEC operational issues specific to the Bay Area. I'm willing to run a list with a strict AUP. Such a list would allow customers of PacBell, ICG, TCG, Brooks, MFS, etc. to communicate outages such as the current DS0 shredding between Brooks and PacBell at SJ SpacePark. I'm interested in an emphasis on the tandems and PRI (dialup) related problems, but I'm sure there would be ample room for notifications regarding fiber cuts, DACS failures, and similar issues. If you are interested drop me a line. If sufficient interest arises, I'll make it a full-blown list. Jim Browne jbrowne(a)jbrowne.com "I wish journalism would return to its glory days, when principled incorruptible men like William Randolph Hearst and Joseph Pulitzer were in charge."- Vanessa Jackson, Piano Teacher, www.theonion.com

4 7

Re: Busy Connect
by William Allen Simpson 01 Feb '99

01 Feb '99

> From: "William Allen Simpson" <wsimpson(a)greendragon.com> > > From: "Steven J. Sobol" <sjsobol(a)nacs.net> > > Ameritech offers the same service, and I've only been charged for the times > > I've actually used the feature. If I hang up, I don't get charged. I have to > > believe BellSouth works the same way, although I could be wrong. > > > Ameritech doesn't offer it here in Michigan, so I don't know what > problems there are. > Well, I'll be damned! It's here today. Only 2 days ago, I got a normal busy signal here in Ann Arbor. Just now, I got a voiceover that said "Let repeat dialing call you back when this line is free. To activate, for 75 cents, press 3. No additional charge to repeat dialing customers. If you are calling from a rotary dial phone, please hang up and dial 1166." I could barely hear the busy signal in the background, but the modem didn't catch it. Good thing there isn't a 3 or a 1166 in my dialing sequence. WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

4 3

recent update from ARIN
by bmanning＠vacation.karoshi.com 01 Feb '99

01 Feb '99

Subject: Lowering of minimum allocation from /19 to /20 .... more should be on the ARIN web site soon... --bill

4 3

Busy Connect
by William Allen Simpson 30 Jan '99

30 Jan '99

I don't know how many other small/dialup ISPs are seeing this problem. BellSouth just turned it on in our area. Sent our support calls through the ceiling during busy evening hours. >Date: Mon, 25 Jan 1999 14:39:31 -0600 >Subject: Please Help Us >From: "Howard Shere" <hshere(a)watervalley.net> > >BellSouth recently added a feature to your phone service called "Busy >Connect". This service plays a recording whenever you dial and get a busy >signal offering to keep trying the number for 75 cents. This service will >interfere with your modems ability to detect a busy signal and your computer >will report that "the computer you are dialing is not answering" or some >similar message. > >2 weeks ago BellSouth told us that this service was on our lines and we >asked that it be removed. They told us that this would solve the "no answer" >problems that our customers were reporting. We have continued to get >complaints from customers about "no answer" problems and when we talked to >BellSouth today, we were told that this service was on our customers lines >and not on ours. We are not sure why we were given the wrong information >when we first reported this trouble. > >We are asking that all of our customers call BellSouth and ask to have this >service removed. They have refused to help us directly and have said that >the only way to have this service removed is for our customers to call them >directly. > >BellSouth can be reached at 557-6500 (for home telephone customers) or >557-6000 (for small business customers). Tell them you want the "Busy >Connect" service removed from your line. There is no charge from BellSouth >for removing this service. >

7 7

Hello, Denver
by alex＠nac.net 30 Jan '99

30 Jan '99

I am here, and if anyone wants to hang tonight, hollar! -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP; we have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

1 0

roamabout in denver
by Eric Kozowski 30 Jan '99

30 Jan '99

doens anyone know the roamabout network id that'll be used for in denver for the 915mhz roamabouts? also what ip addresses?

2 1