November 2000 - Test - lists.nanog.org

RE: Exodus NOC phone number?
by rdobbins＠netmore.net 02 Nov '00

02 Nov '00

I have an international 800-number that works pretty well, as long as the locals in any given country know how to get to it via their own phone network conventions. In the UK, for example, it's a '0800' number. In less-developed countries, though, it often isn't possible to access the number. ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice -----Original Message----- From: Sean Donelan [mailto:sean@donelan.com] Sent: Thursday, November 02, 2000 11:43 AM To: nanog(a)merit.edu Subject: Re: Exodus NOC phone number? On Wed, 01 November 2000, "Dominic J. Eidson" wrote: > On Wed, 1 Nov 2000, Mathew Butler wrote: > > Does anyone have the Exodus NOC phone number? (Or who I'm supposed to talk > > to in this situation?): > > From http://www.exodus.net/contact_us.html > Response Center: > 1.877.393.7878 > (from outside the U.S. call 1.800.13937878) Does this phone number really work from outside the US? I know the ITU was working on an international "800" number, but I haven't kept up with it.

1 0

Re: Exodus NOC phone number?
by Sean Donelan 02 Nov '00

02 Nov '00

On Wed, 01 November 2000, "Dominic J. Eidson" wrote: > On Wed, 1 Nov 2000, Mathew Butler wrote: > > Does anyone have the Exodus NOC phone number? (Or who I'm supposed to talk > > to in this situation?): > > From http://www.exodus.net/contact_us.html > Response Center: > 1.877.393.7878 > (from outside the U.S. call 1.800.13937878) Does this phone number really work from outside the US? I know the ITU was working on an international "800" number, but I haven't kept up with it.

2 1

Re: DoS attacks, NSPs unresponsiveness
by Valdis.Kletnieks＠vt.edu 02 Nov '00

02 Nov '00

On Thu, 02 Nov 2000 12:28:19 PST, Alexei Roudnev said: > Just again - what's about an attempt to creta e ISP association which - > - promise to do ingress filtering It's already an IETF BCP, all clued ISP's should be doing it already - the problem is the *unclued* ISPs, which will neither do ingress/egress filtering, nor join any ISP association.. Hint: How many of those ISPs do we hear from on NANOG? ;) > - promise to do active filtering "active filtering" in what meaning? You have to be careful here, to avoid a DOS attack by triggering active filtering... > - promise to investigate any case Would "investigate" include the form letter I send out whenever I get a complaint that one of our NTP servers is trying to hack through somebody's firewall on ports 13, 37, and 123? Our CIRT is just basically 5-6 people who do security on top of everything else. We have to perform triage - in the last week, we got the disk drive of a compromised system into an evidence bag within 3 hours or so of our first notification there was a problem. On the other hand, we most certainly do *NOT* guarantee that level of response unless it's a very high profile incident. I'm sure the situation is similar at every other site out there.... -- Valdis Kletnieks Operating Systems Analyst Virginia Tech

1 0

InterNAP?
by Tom Schmidt 02 Nov '00

02 Nov '00

I need your opinion on InterNAP. I am currently have a DS3 to my current provider and want to add an additional DS3 for redundancy to the same location. We plan to run BGP4 on both connections. InterNap has some technology to avoid congested peering points. Does this technology actually work? Isn't it impossible to avoid these peering points? What are your experiences with InterNAP? _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

6 5

Re: RADWare Linkproof? (or better ways to multihome)
by Mike Johnson 02 Nov '00

02 Nov '00

Larry Rosenman [ler(a)lerctr.org] wrote: > For the record, I've got a customer taking 2 full BGP tables with a > 3640 with 128Meg of RAM. Can anything less than a 7200 handle three (preferably four) fast ethernet interfaces? That was my sole reason for going that route as it seems to be the smallest Cisco that will provide four fast-E connections (according to Cisco docs that I may have misread). > (not sure of cost...) Well, it's certainly cheaper than a 7206... Thanks, Mike -- Mike Johnson Network Engineer / iSun Networks, Inc. Morrisville, NC All opinions are mine, not those of my employer

6 7

Exodus NOC phone number?
by Mathew Butler 02 Nov '00

02 Nov '00

Does anyone have the Exodus NOC phone number? (Or who I'm supposed to talk to in this situation?): I got a spam mail on AOL, with a link to a decimal IP (the exact link in question is: http://3626046468//nv/zawixmecwhcxejb ). After figuring out the dotted-decimal notation for it (216.33.20.4), I did a whois on arin for that. Turns out it belongs to Exodus, and there's an additional field for rwhois info. I got the rwhois info, and it shows that it belongs to WhoWhere. So I get curious, and go to the URL in question (speaking raw HTTP, as I am wont to do when checking out spam links)... it redirects me to an angelfire.com address. (A transcript is below: $ telnet 216.33.20.4 80 Trying 216.33.20.4... Connected to 216.33.20.4. Escape character is '^]'. GET //nv/zawixmecwhcxejb HTTP/1.1 Host: 3626046468 User-Agent: SecurityBreachDetected/1.0b2 HTTP/1.1 301 Moved Permanently Date: Thu, 02 Nov 2000 05:19:15 GMT Server: Apache/1.3.9 (Unix) FrontPage/4.0.4.3 Set-Cookie: CookieStatus=COOKIE_OK; path=/; domain=angelfire.lycos.com; expires= Fri, 02-Nov-2001 05:19:15 GMT Location: http://www.angelfire.com//nv/zawixmecwhcxejb/ Connection: close Transfer-Encoding: chunked Content-Type: text/html f9 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>301 Moved Permanently</TITLE> </HEAD><BODY> <H1>Moved Permanently</H1> The document has moved <A HREF="http://www.angelfire.com//nv/zawixmecwhcxejb/">h ere</A>.<P> </BODY></HTML> 0 Connection closed by foreign host. $ ) So, I need to inform someone that they need to inform someone that their server's being used for something it's not supposed to be. Thanks for any help! -Mat Butler Systems Engineer Tonbu, Inc

3 2

Re:DoS attacks, NSPs unresponsiveness
by rkuhljr＠uol.com.br 02 Nov '00

02 Nov '00

> Irc tends to be a volatile medium, like interpersonal relationships in >real life. Thus, many times arguements turn into heated disputes, and >sometimes, some people pick up arms, and attack. The attacks usually take >out whole ISPs for hours, or days. Networks with no IRC server running are also targeted by DoS; personal experience on this one. > The problem is that when trying to get help from the upstream provider >(UUnet in this example), you either receive a negative answer, or you're just ignored completely. We've had the same (lack of) responses from UUnet... > Smurfing, icmp attacks, udp attacks, tcp synflooding (spoofed >sources) are just a number of these weapons. The problem with alot of >networking entities, be it ISPs, enterprises, and such, is that they allow >spoofed packets to leave their network (i.e. do not check if the packets >originate from within their netblocks before letting them leave their >routers). Backbones should enforce RFC 2827 filtering on all static-routes customers; I think most do, but many networks with large amounts of computer power and router capacity are multi-homed, preventing their upstreams of filtering them. > The question is, how can we defend ourselves, and why do the large NSPs >turn a blind eye, and act as if it's not their concern ? A combination of access-list/rate-limit/tcp-intercept on routers and proper TCP/IP stack configuration on servers may put you back online while they track the attack sources and shut them down. > Is there a chance that by helping one another, and by implementing >Internet RFCs corrctly (rfc 1918 for example), we can contribute to the >elimination of this kind of electronic terrorism ? Or change some RFC defaults. Changing directed broadcast default from on to off helped to decrease smurf attacks, making reverse-path-checking the default might be a good move. > Any chance a UUnet person might answer ? Unlikely... but it's curious that the most interesting ideia I've ever saw about DoS tracking was presented at NANOG by an UUnet person. It seems that plan didn't make into deployment, or it is used for premium-class customers that don't include my upstream (also a Worldcom company...). Rubens Kuhl Jr.

1 0

Re: RADWare Linkproof? (or better ways to multihome)
by John Fraizer 01 Nov '00

01 Nov '00

On Wed, 1 Nov 2000, Dan Hollis wrote: > On Wed, 1 Nov 2000, John Fraizer wrote: > > Also realize that you can build a PC router with multiple OC3 and GE > > ports, loads of memory and faster processor(s) for less than 1/2 the cost > > of the 7206 chassis naked. > > Ours has been more stable that the Cisco gear (72xx and 75xx) it is > > connected to. > > Care to share your hardware configuration? Motherboard, CPU, sync serial > cards, gated/zebra? > > -Dan > I don't do sync serial on anything. As result, I don't know much about the sync serial devices that are available. Gigabyte MB (Don't remember the exact model) 256M PC100 memory PIII 450 (I believe. It might be a 500. Don't remember.) ForeRunner 200E OC3 cards Netgear GA620 GigaE cards DLINK DFE570TX 4-port FastE cards Redhat Linux ATM-0.78 http://icawww1.epfl.ch/linux-atm/dist.html Zebra 0.89 http://www.zebra.org I have built 6 linux routers either for use in our network or for customers who couldn't afford Cisco or Juniper gear. They're all BGP speakers with an average of 90K prefixes and 3 peers. Here is the output of sh ip bgp sum on one of these routers: Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd x.x.x.x 4 yyyy 304589 8790 0 0 0 6d01h26m 89361 x.x.x.x 4 yyyyy 9739 8861 0 0 0 6d01h23m 147 x.x.x.x 4 yyyyy 9716 8862 0 0 0 6d01h23m 147 x.x.x.x 4+ yyyy 472016 8750 0 0 0 5d21h16m 88387 x.x.x.x 4+ yyyyy 8792 8849 0 0 0 3d09h08m 2 x.x.x.x 4 yyyyy 8780 8840 0 0 0 6d01h25m 1 x.x.x.x 4 yyyyy 8780 8803 0 0 0 6d01h27m 9 --- John Fraizer EnterZone, Inc

1 0

Re: InterNAP?
by Sean Donelan 31 Oct '00

31 Oct '00

On Tue, 31 October 2000, Bradley Dunn wrote: > The ability to "guarantee" performance is orthogonal to how you write > your SLAs. > > Anyone with knowledge of risk management and actuarial science > understands this. SLA's are a bit like reverse insurance. You pay a lot of money, and if the network crashes you get a little back. But you never get back more than you paid. With insurance you pay a small premium, and if you die your family gets more money back. Although, if you live a long life, you may not recoup your premiums.

1 0

The FBI tripping over itself again
by Kai Schlichting 31 Oct '00

31 Oct '00

In case any participants of NANOG 20 had any confidence left in the FBI after their Carniwhore presentation and getting shit from an attendee for an apparent illegal wiretap without a warrant in a network owned by said attendee's company, check this out: FBI confiscates computers of "curious" RPI student in aftermath of the yankees.com hack: Sounds like Operation Sundevil all over again (that one having gone down under SS direction): http://www.kuro5hin.org/?op=displaystory;sid=2000/10/31/0481/1037 http://slashdot.org/articles/00/10/31/025228.shtml If this gets a message across to network providers and individuals alike: The FBI is wasting your time, their own time and should be ignored and avoided at all cost. Imminent fall-out: Networks under my control (and more so some I've been called in to assist) are currently under attack by SMTP dictionary-attackers, which seems to be reincarnations of the ghosts of GeolistPro. [ scumbags that are trying to deliver spam, and/or are trying to learn every possible email address in a given domain, to the tune of up to 550,000 per attack (there's obviously a lot of usernames@ scraped from existing spam-lists). Did you ever have 500,000 mails in your Lotus Notes mail spool, because the product (by default) is too dumb to discard undeliverables and keeps them nicely for the postmaster to review ? This even brings Quad-PIII/600Mhz machines with 2GB of RAM to its knees. Now think of the attackers reselling these 500,000 'confirmed' email addresses to other spammers...the future damages of this bogus "data collection" will quickly reach 10,000's of dollars) Does the LE community honestly believe that I will encourage the owners of these networks to contact the authorities instead of suing the shit out the attackers in civil court instead? I didn't think so... And as far as this concerns this fucked up incident at RPI: Dear Almighty, please shine some clue rays down on Albany and Troy (apart from RPI, that's one VERY fucked up and run-down town), two towns that are badly in need of such grace, along with the local FBI office, which seems staffed by people who need to do a few more runs thru the Reston FLETC for 'computer training' (that moved to Quantico?), because the first time obviously didn't improve their clue level a whole lot and just caused confusion. (Hey Kim C., after 7 years, you still have a lot of work left to do with 'dem bloody recruits)

3 2