November 2000 - Test - lists.nanog.org

RE: Security on a home DSL Line
by David Lesher 03 Nov '00

03 Nov '00

Shameless plug from a beta tester: the ZyXEL P312... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: Security on a home DSL Line
by Brandon Hume 03 Nov '00

03 Nov '00

>Otherwise, your idea is perfect; Linux or OpenBSD, whichever you're >more comfortable with, will give you the most flexibility, and Solaris x86 >might work but will be dog-slow and unless you have a lot of RAM, >completely unusuable. For such a weakly defined measure of "a lot of RAM", this statement is inaccurate. Solaris 8 x86 will run comfortably, without X and superfluous processes (to say: a rational firewall/NAT box configuration) within 12M of RAM. A passing knowledge of Solaris would not let a person know this to be true, however, since Sun states its memory requirements on the assumption you'd be using X. That being said, OpenBSD is probably the best choice. It requires more skill to install, but less skill to secure, and would probably run better *by default* on a minimal machine. After that I'd suggest Solaris, since it installs less crap than most of the Linux distributions (note: most). Driver issues might force your hand to the Linuxes, of course. I also place OpenBSD and Solaris above Linux because they both give you the use of IPFilter, which I believe to be just flat-out superior to IPChains. -- Brandon Hume - hume -> BOFH.Halifax.NS.Ca, http://WWW.BOFH.Halifax.NS.Ca/ -> Solaris Snob and general NOCMonkey

2 1

RE: If the network is always down, how come I can post a message
by Roeland Meyer 03 Nov '00

03 Nov '00

For the telco, use www.dialpad.com ... it rocks! For the Internet, there are always portions that are not quite working. This will get worse, the larger it gets. I'm a CerfNet down-stream and ATT/Cerf digestion problems have been making me crazy for the past few months (routes going up, down, side-ways, you name it ...). In fact, it's getting to the point that I'm about to start recommending at least three different upstreams to clients (multi-home). The problem with that is that CIDR gets in the way. I plan to take it up, with ICANN/ASO in about a week. > -----Original Message----- > From: Alex Bligh [mailto:amb@gxn.net] > Sent: Friday, November 03, 2000 7:07 AM > To: Sean Donelan > Cc: nanog(a)merit.edu > Subject: Re: If the network is always down, how come I can post a > message > > > > Sean, > > This is because the phone system is considered down when the > subscriber > can dial no numbers. The internet is considered down when you can't > reach any particular web site (or collection thereof). If people > can't reach a given company by phone they say 'their phone line is > down'. I have given up counting the number of times I have spent > trying to dial the US from the UK and got fast busy (or worse). > > -- > Alex Bligh > VP Core Network, XO Communications - http://www.xo.com/ > (formerly Nextlink Inc, Concentric Network Corporation > GX Networks, Xara Networks) > > >

1 0

If the network is always down, how come I can post a message
by Sean Donelan 03 Nov '00

03 Nov '00

Discussing network reliability for the last week, I've been beating my head against the "phone system is 99.999% reliable, but the Internet crashes all the time." One anecdotal data point, I've been reporting about Internet problems for the last five years or so. Over the last 5 years no Internet network event has been so severe it prevented me from reporting about the problem on the net. In a strange way, my postings about the problems on the net are proof of the reliability of the same network. In the same time period, I've lost my telephone service several times. 1. The Ladue, MO central office was struck by lightning, and the generator failed 2. The Rochelle Park, NJ central office was flooded by a hurricane the week I started work in northern New Jersey 3. I moved to Pacific Bell country, enough said I've lost my pager service multiple times 1. Galaxy IV died 2. Pagenet network problems Even the Associated Press has gone down in the last five years. So I'm sick and tired about hearing the telephone network is 99.999% reliable and the Internet isn't.

3 2

Security on a home DSL Line
by J. Gilmore 03 Nov '00

03 Nov '00

I'm looking to beef up security on a home DSL line. Currently I am using ZoneAlarm (the freeware version). I'm thinking of taking an old Pentium 120, and setting that up as a firewall, but wanted to know if anyone else had a better idea. __________________________________________________ Do You Yahoo!? >From homework help to love advice, Yahoo! Experts has your answer. http://experts.yahoo.com/

10 9

Re: DoS attacks, NSPs unresponsiveness
by Sean Donelan 03 Nov '00

03 Nov '00

On Thu, 02 November 2000, Hank Nussbacher wrote: > We can write as many RFCs and BCPs as we want and discuss this item again > and again - the truth is - nothing we say or do will make a difference > until the government creates regulation on the matter. The same way every > phone company has to run a 911 number in event of emergencies, so too must > ISPs provide an abuse(a)xxxxx.net email address that not only gives an > auto-reply but actually has people behind it to handle the problem. People from at least three different US Government agencies have asked me if there is a need for government intervention in this precise area, either full-blown laws and regulations; or nudging such as including it in GSA and other government contracts (i.e. like the drug-free workplace requirements if you want to bid on a government contract). I'm old enough to remember the AUP NSF days (and I walked to school in the snow, up hill both ways). I'm afraid if we go down this path, the intervention won't be limited.

1 0

Fire protection in ISPs and collocation facilities
by Sean Donelan 03 Nov '00

03 Nov '00

What has been the fire experience for ISPs and collocation facilities? Other than the infamous Ascend incidents, I don't recall any ISP or collocation fire incidents during the last five years. Why am I asking, because some code officials seem to feel the need to develop a special code to cover collocation facilities popping up all over the place. But I think most collocation facilities are generally constructed to exceed the current codes anyway, and are generally much lower risk than the "normal" occupancies around them. The US Air Force is revising its design guidance for fire protection of computer-electronic equipment installations this year. In the most recent draft, the USAF has ultra sensitive air sampling smoke detection, wet-pipe automatic sprinklers and smoke exhaust systems in its design guidance. Based on a five year study, the USAF found the most significant fire and smoke threats have originated outside the computer-electronic equipment room. Two-thirds of the fires originate outside the computer-electronic room. One-third of the fires originated within the vicinity of the computer- electronic equipment. Less than 25% of the fires originate within the computer-electronic equipment. The single largest threat of fire to computer-electronic equipment is the electrical distribution system. Two-thirds of the dollar losses (1/3 of the fires) are caused by fixed wiring, transformers, power switching gear, light fixtures and extension cords. In over 50% of the fires, the first material ignited is some type of plastic, including electrical insulation.

1 0

Re: DoS attacks, NSPs unresponsiveness
by Hank Nussbacher 03 Nov '00

03 Nov '00

At 04:32 03/11/00 +0200, Ariel Biener wrote: >On Thu, 2 Nov 2000, dies wrote: > > > > Actually, I was thinking of taking a slightly different path. > > >1). ISPs (downstreams) responsibilities: > >1a). Active and clueful NOC. >1b). Proper implementation of Internet RFCs (private networks and > spoofing). >1c). Proper BGP filtering towards upstream. >1d). Running routing software adequate to today's challenges (for example, > something that can deal properly with small fragments...). > >2). NSPs (upstreams, tier1/2) responsibilities: > >2a). Active and clueful abuse department. >2b). Monitoring tools that will allow tracking down a stream throghout > their own backbone, and cooperation with their peers to get to the > source. With a handful of cluefull people, and a set of autmatic > tools, this IMHO is something at hand. >2c). Proper BGP filtering of their customers, to not allow their customers > to fuck-up Internet routing (Sprintlink incidents...). > > >The main idea is that downstreams make sure they are not very susceptable >to abuse. Then, if attacked, the upstream provider should cooperate in >detecting the source, by monitoring their own network, and cooperating >with it's peers. If for any reason, it takes more than X hours, the >upstream provider should try to protect it's customers. Usually, it wont, >and the attacker will be indentified, and shut down at it's source. > >There is no requirement that tier1/2 NSPs tie up their equipment into an >ACL monster. What is needed is cooperation. With proper cooperation, >identifying a stream's source is much easier that you may think. My experience trying to get tier1 ISPs in the USA to act on specific IP addresses that are attacking, has been terrible. In general it always takes a few private emails to people one may know, who work or have worked in the tier1 ISP to get any response. I have had one incident take 2 weeks recently and am now at day 4 of waiting for a technical reply from another Tier1. This one did not even provide an auto-reply from all their listed abuse and noc email addresses and only private email helped getting some sort of response. Based on solely my personal experience inside many ISPs (tier1-4), I do not find things encouraging. Most ISPs lose money. When you are losing money you can't invest in a top notch team of Internet security pros to handle the kind of problems we are all seeing. That team does not create revenue. As a matter of fact, it creates negative-revenue since the conclusion by the ISP is usually to disconnect the attacker from their service. We can write as many RFCs and BCPs as we want and discuss this item again and again - the truth is - nothing we say or do will make a difference until the government creates regulation on the matter. The same way every phone company has to run a 911 number in event of emergencies, so too must ISPs provide an abuse(a)xxxxx.net email address that not only gives an auto-reply but actually has people behind it to handle the problem. -Hank >Do you find the above so hard to do ? All it requires is some >professional attitude, and a bit more cooperation and consideration from >NSPs and ISPs as one, what happens to someone you don't know today may >happen to you tomorrow ! > > >Thoughts ? > >--Ariel > > > Well since everyone else is stating their opinions, I'll join in > > as well.First off I think pulling the plug is a great idea ( =] ). > > Anyways the point comes down to this.Who should be doing the ingress > > filtering?Tier-2's, Tier-1's, the actual customer?I know this whole > > idea sounds very pretty and nice, however, when it comes down to it there > > are many real problems with this idea.One, the hardware on most ISP's > > backbones cannot realistically do ingress filtering.I'm sorry to say but > > a GSR is not able to do ingress filtering on 5 Channelized OC-12's that > > hold 400+ Customers a piece.It just does not work, I don't care what > > Cisco claims, it just does not work.What about other vendors? I have no > > experience with Bay or Lucent, however, Juniper (which I do have > > experience with) has the ability due to the hardware based filtering > > available but that brings up a whole set of other questions.How will > > ingress filtering from an ISP level effect downstream customers that do > > asymmetrical routing?How about the management overhead that comes into > > play when you are a Tier-1 or a large Tier-2 with tens of thousands of > > customers?What is comes down to is that customers need to be doing > > egress filtering, it's the only scalable solution, however this just is > > not happening.Don't blame the ISPs only, it's their customers that are > > really the problem.Lack of security/knowledge on the customer's end > > leads to hacked boxes, which in turn lead to DoS attacks.It really comes > > down to not the responsibility of the ISP, but in fact the responsibility > > of the customers!Maybe we all should thinkg about that before we point > > fingers. > > > > > > > > On Thu, 2 Nov 2000 Valdis.Kletnieks(a)vt.edu wrote: > > > > > On Thu, 02 Nov 2000 09:59:04 EST, MarkMentovai > <mark-list(a)mentovai.com>said: > > > > This can't go on forever.I'd like to spread the clue about ingress > > > > filtering, and am willing to commit time to the cause.Is anyone > with me? > > > > > > The problem is that for many ISPs, I fear the only way to get them to > > > implement 2827-style filtering is for their upstreams to implement a > > > policy of fascist-mode ingress filtering - "We see a bogon packet that > > > your site should have filtered, we pull the plug on your link till you > > > fix it". > > > > > > Time alone won't be enough.Bring a baseball bat. And a spare bat. > > > > > > -- > > > Valdis Kletnieks > > > Operating Systems Analyst > > > Virginia Tech > > > > > > > > > > > > > > >-- >Ariel Biener >e-mail: ariel(a)post.tau.ac.il Work phone: 03-6406086 >fingerprint = 07 D1 E5 3E EF 6D E5 82 0B E9 21 D4 3C 7D 8B BC

1 0

RE: Security on a home DSL Line
by Roeland Meyer 02 Nov '00

02 Nov '00

The common answer is to install Linux/Unix/FreeBSD and build a firewall. However, I have recently been surveying the market for DSL gateways. Guess what, ALL of them include some sort of firewall capability and the LinkSys product even includes a 5-way switch ... for under $300! Then there are always Ascend/Lucent Pipeline 130's which includes a router and can gateway ISDN, IDSL, Cable, and DSL. I have a friend that hangs an entire /24 behind one of them. Setting up a host may be a fun excersize, but something that runs with the reliability of a toaster is better, in my view. With the host, you always have the tinker-factor to contend with. -----Original Message----- From: J. Gilmore [mailto:reece0011@yahoo.com] Sent: Thursday, November 02, 2000 3:38 PM To: nanog(a)merit.edu Subject: Security on a home DSL Line I'm looking to beef up security on a home DSL line. Currently I am using ZoneAlarm (the freeware version). I'm thinking of taking an old Pentium 120, and setting that up as a firewall, but wanted to know if anyone else had a better idea. __________________________________________________ Do You Yahoo!? >From homework help to love advice, Yahoo! Experts has your answer. http://experts.yahoo.com/

2 1

Re: Exodus NOC phone number?
by Sean Donelan 02 Nov '00

02 Nov '00

On Wed, 01 November 2000, "Dominic J. Eidson" wrote: > On Wed, 1 Nov 2000, Mathew Butler wrote: > > Does anyone have the Exodus NOC phone number? (Or who I'm supposed to talk > > to in this situation?): > From http://www.exodus.net/contact_us.html > Response Center: > 1.877.393.7878 > (from outside the U.S. call 1.800.13937878) ^ A one at the beginning of the NXX I'll be more specific, does this number work outside the USA. Its not a typical US 1-800 number, because it has too many digits and a "1" as the beginning of the NXX. Is it a special ITU number?

2 1