November 2000 - Test - lists.nanog.org

RE: Carnivore Update - Public Does Not Care
by Roeland Meyer 26 Nov '00

26 Nov '00

> From: Quark Physics [mailto:meuon@highertech.net] > Sent: Sunday, November 26, 2000 6:43 AM > > > extra trouble to install it. The proof is the market > penetration of PGP. > > Only the geeks tend to use it and SSH is only used by SA > geeks. The general > > market DOESN'T CARE! The following parallels what our marketing department found out (after launch, unfortunately <sigh>). > We see roughly several levels of clients: > > 70% - "Huh? We're secure, only I have the root password" > (actual quote) > > 10% - Encryption is hard, how about we ZIP the file we send via FTP? > (not bad, it helps...) These guys, 80% of the market, will not pay for it either. They will not buy software packages and they will not buy services either. They don't see a problem. Can we say "myopic"? > 10% - SSL encrypted XML posts. > > 5% - SCP (SSH) file transfer, known keys on each side + passwords. This last 15%, are mostly self-serve and actually know that there is a problem. But, they wont puchase, they don't need to, they're self-serve. This is where most of us, on this list, fall. > 5% - Hardware encryption, leased line, keys for hardware encryption > and passwords delivered in seperate parts by different people > after identity verification. No physical connections to gateway > systems. (Federal Reserve, Chase Manhatten Bank...) The unknown tier, many of them are banks where minimum security is a regulatory thing. It's a part of doing business. I'm not sure, that if left to their own devices, that they wouldn't join the majority in in their apathy. > Until real data encryption is built into the Operating Systems and all > software... --mike-- As long as we have Federal Export restrictions, on encryption products, this will continue to be an optional add-on (Win2K high-encryption pack ain't that bad. But, it is an add-on, one has to use the update service to install it).

3 2

Re: Sun Storm
by Spencer.Wood＠dot.state.oh.us 26 Nov '00

26 Nov '00

This might really sound crazy, but everytime there is a Solar Storm, we usually have at least on of our Cisco 2600's NVRAM become corrupt. I'm not saying that the solar storm causes the memory corruption, but I've seen stranger things happen... **************************************************** Spencer Wood, Network Administrator Ohio Department Of Transportation 1320 Arthur E. Adams Drive Columbus, Ohio 43221 E-Mail: Spencer.Wood(a)dot.state.oh.us Phone: 614.644.5422/Fax: 815.361.0714 **************************************************** Steve Sobol <sjsobol(a)NorthShoreTechnologies.net> Sent by: owner-nanog(a)merit.edu 11/26/2000 11:35 AM To: Dennis Dayman <ddayman(a)mail-abuse.org> cc: Nanog <nanog(a)merit.edu> Subject: Re: Sun Storm Dennis Dayman wrote: > The sun could be causing some more immediate problems overnight and into > next week. A major solar storm is bombarding the earth's atmosphere with > low-dose radiation that scientists say is no real danger to people on the > ground. Respected Internet professionals say that the solar storm may cause other irregularities - for example, on-topic posts to the NANOG mailing list such as the one I am replying to. -- Steve Sobol, BOFH, President 888.480.4NET 866.DSL.EXPRESS 216.619.2NET North Shore Technologies Corporation http://NorthShoreTechnologies.net JustTheNet/JustTheNet EXPRESS DSL (ISP Services) http://JustThe.net mailto:sjsobol@NorthShoreTechnologies.net Proud resident of Cleveland, Ohio

1 0

Looking Glass
by Ariel Biener 26 Nov '00

26 Nov '00

Hi guys/gals, I am looking for looking-glass software that is secure (i.e., that people wont be able to fiddle with the web server it's on). The security factor is critical. I have written such software myself, but as my boss points out, software that was already tested by alot of people, and that has been running for a while is better security wise than anything I can write and only visually test. There are quite a few LG on the web, some Perl based, some PHP based, and I even saw one in C (!!). I just want to know which is mostly used. My personal feeling is that alot of sites just wrote their own, am I mistaken ? thanks, --Ariel -- Ariel Biener e-mail: ariel(a)post.tau.ac.il PGP(6.5.8) public key http://www.tau.ac.il/~ariel/pgp.html

9 11

Sun Storm
by Dennis Dayman 26 Nov '00

26 Nov '00

FYI: The sun could be causing some more immediate problems overnight and into next week. A major solar storm is bombarding the earth's atmosphere with low-dose radiation that scientists say is no real danger to people on the ground. A major flare erupted off the sun's surface when many of us were sitting down to Thanksgiving dinner. Forecasters expect the shockwaves, moving at one to three million miles an hour, will hit the earth's atmosphere Saturday night and last through Sunday. Strong geomagnetic storms can do a number on our growing, global web of communications technologies from satellites, to pagers, to high-frequency radios. As most of you remember a smaller storm in 1998 knocked out one satellite that, in turn, shut down gas pumps and ATMs. --------------------------- Thanks Dennis Dayman Senior Consultant Consulting Services Group at MAPS http://www.mail-abuse.org ddayman(a)mail-abuse.org Voice/FAX 972-682-7556 ------------------------------------------------------------------------------ What goes up, must come down. Ask any system administrator. ------------------------------------------------------------------------------

2 2

RE: Carnivore Update - Washington Post 11/21/00
by Roeland Meyer 26 Nov '00

26 Nov '00

The only answer is the same one for CALEA, absolute mil-grade encryption on every single packet! Given that, it won't matter if they capture packets, they wont be readable. However, as MHSC has found out the hard way, folks don't want to pay for it. Even when it is freeware, they wont go through the extra trouble to install it. The proof is the market penetration of PGP. Only the geeks tend to use it and SSH is only used by SA geeks. The general market DOESN'T CARE! At one time, MHSC offered VPN software and an SSL-based web mail product, for a very nominal $10/month. We had lottsa queries, but few buyers. Folks would rather use a free, unsecured, hotmail/juno/etc than a non-free SSL-based one. BTW, you can't have banner ads on an SSL page. I figure that this market has at least three years to go before it is real. > -----Original Message----- > From: Frater M.A.Ch.H. 999 [mailto:azoth@occult.net] > Sent: Wednesday, November 22, 2000 6:03 PM > To: nanog(a)merit.edu > Subject: Re: Carnivore Update - Washington Post 11/21/00 > > > > nanog: > > Do what thou wilt shall be the whole of the law. > > I still have to say that the Carnivore program is potentially the most > disgusting domestic surveillance program ever proposed. > > To Hell with the 4th Ammendment, eh, FBI? > > I don't know what the FBI's oaths of service are, but my > oaths upon entering > the US Armed Forces were to protect the Constitution of the > United States > from all enemies, foreign and domestic. > > Furthermore, our motto in Special Forces is 'De Oppresso > Liber' --- Liberate > from Oppression. > > Perhaps they just want to ruffle some feathers and get some domestic > resistance popping up by all of this... or on the flip-side see if the > citizens actually would resist an attempt to eradicate the > 4th Ammendment. > > I've noticed that national ammunition sales are soaring over > the past few > weeks. > > Amen! And so they should be. > > Carnivore needs to find a resting point before someone takes too much > offense to it. > > And personally, I always like to use the good ole 'Meta-x spook' lisp > built-in command in emacs as often as possible for just this sort of > occasion. > > e.g.: > -------------------------------------------------------------- > -------------- > NSA kibo Waco, Texas counter-intelligence smuggle DES Mossad terrorist > class struggle security CIA explosion Noriega Marxist Kennedy > > DES genetic strategic NSA smuggle FBI World Trade Center FSF Panama > SDI Honduras Ft. Meade Treasury counter-intelligence class struggle > -------------------------------------------------------------- > -------------- > > For everyone who didn't know that command existed in the distribution, > enjoy! ;) > > Love is the law, love under will. > > Frater M.A.Ch.H. 999 > > ~~~^^O^^~~~ > > MTH/HE/SX/TA/EN S++(*) W N+++(++) PEG++(XX) Dr+ A>++ a++ C G+ QH+++ > 666++ Y++(+++) Z+ > > > >

5 7

Limits of reliability or is 99.999999999% realistic
by Sean Donelan 26 Nov '00

26 Nov '00

On Fri, 24 November 2000, Roeland Meyer wrote: > After all the discussion that we had on the Datacenter list, I am surprised > at this. You'd think that they'd have redundant PS's with redundant UPS's. There are interesting electrical faults which will kill redundant UPSes and redundant power supplies. However, I don't know if Sprint uses redudant power supplies, or had a failure affecting multiple power supplies on the STP. They use Compaq/Tandem NonStop hardware for their SCPs. After previous power problems at Sprint COs (i.e. Kansas City) which affected my service, I've asked my Sprint sales person what happened. He was never able to get anyone to call me back with an answer. > For the internet, I see an amazing number of systems with no redundancy > whatsoever. Of course, the first hardware failure usually corrects the > problem, at the cost of substantial down-time. But many second-tier ISPs and > dot-coms are still operating on brand-new equipment that hasn't started > hitting its MTBF specs yet and they don't even have a clue on their MTTR > ratings. In the next few years, I expect to see a lot more failures, as the > equipment starts to age. I'm not sure that is true. Brand new electronic equipment tends to have a period of infant mortality. If it survives, it tends to be reliable for a fairly long period of time. I had customers still using Proteon routers 10 years after Proteon discontinued the model. However scaling requires most dot-coms to replace/upgrade their equipment every few months, so they are always dealing with infant mortality. But back to my question. What is the real requirement? Amazon.COM had system problems on Friday, and their site was unusuable for 30 minutes, definitely not 99.999%. But what did that really mean? The FAA loses its radar for several hours in various parts of the country. What did that really mean? Essentially every system given as an example of "high- availability, high-reliability" I've looked at, doesn't hold up under close examination. Is 99.999% just F.U.D. created by consultants? Instead of pretending we can build systems which will never fail, should we work on a realistic understanding of what can be delivered?

2 1

The Cidr Report
by Tony Bates 24 Nov '00

24 Nov '00

This is an auto-generated mail on Fri Nov 24 12:00:00 PST 2000 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 24Nov00 0) General Status Table History ------------- Date Prefixes 051100 90552 061100 90504 071100 90705 081100 91061 091100 91153 221100 92414 231100 92419 241100 92527 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 91.16.23.0/24 from AS11770 *** Bogus 219.219.219.0 from AS2563 AS Summary ---------- Number of ASes in routing system: 9183 Number of ASes announcing only one prefix: 5305 (2973 cidr, 2332 classful) Largest number of cidr routes: 953 announced by AS701 Largest number of classful routes: 1360 announced by AS701 1) Gains by aggregating at the origin AS level --- 24Nov00 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS2563 430 135 295 68.6% KoRean Education Network AS1221 624 455 169 27.1% TELSTRA-AS AS9269 163 51 112 68.7% Hong Kong CTI AS701 1360 1248 112 8.2% Alternet AS2609 126 17 109 86.5% EUnet-TN AS7545 162 54 108 66.7% TPG Internet Pty Ltd AS8013 459 355 104 22.7% PSINET-CA AS271 209 112 97 46.4% BCnet Backbone AS6595 156 62 94 60.3% DODDSEUR AS4755 206 112 94 45.6% Videsh Sanchar Nigam Ltd. India AS13999 94 6 88 93.6% UNKNOWN AS7657 277 193 84 30.3% The Internet Group Limited AS705 334 253 81 24.3% ALTERNET-AS AS4293 343 262 81 23.6% Internal ASN for C&W AS174 527 446 81 15.4% Performance Systems International AS7496 102 25 77 75.5% Power Up AS4151 286 209 77 26.9% USDA Internet Access Network AS7046 323 248 75 23.2% UUNET-CUSTOMER AS724 238 165 73 30.7% DLA-ASNBLOCK-AS AS577 243 173 70 28.8% Bell Backbone AS3908 239 169 70 29.3% Supernet, Inc. AS7018 589 524 65 11.0% AT&T WorldNet Service Backbone AS5106 101 37 64 63.4% AADS-COLUMBUS AS3749 121 59 62 51.2% TECNET AS226 168 106 62 36.9% USC/Information Sciences Institut AS816 382 322 60 15.7% UUNET Canada (ASN-UUNETCA-AS4) AS376 141 81 60 42.6% RISQ AS3602 307 249 58 18.9% Sprint Canada Inc. AS16758 63 6 57 90.5% UNKNOWN AS11252 90 37 53 58.9% Idaho State University For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

I think I jinxed Sprint
by Sean Donelan 24 Nov '00

24 Nov '00

Last week I gave Sprint some complements on their success avoiding customer service affecting fiber cuts. Unfortunately, Murphy took it as a challange. First, Sprint lost an STP power supply which blocked SS7 service in Sprint's southeastern network for 2 hours and 52 minutes. Then on Tuesday, Murphy killed a disk drive on Sprint's SCP, blocking Sprint's nationwide network for 4 minutes until it could be taken out of service. Maintaining 99.999% network availability is hard for any network, telephone or the Internet. But sometimes I wonder what the real requirement is. The Australian stock exchange went down for a few hours, it wasn't the end of the world. Sprint had some more blocked calls than normal, most people didn't notice. Are we setting artificial performance requirements, which don't reflect reality? Either in what can be achieved, or is necessary.

2 1

RE: I think I jinxed Sprint
by Roeland Meyer 24 Nov '00

24 Nov '00

> From: Sean Donelan [mailto:sean@donelan.com] > Sent: Friday, November 24, 2000 2:44 AM > > Last week I gave Sprint some complements on their success avoiding > customer service affecting fiber cuts. > > Unfortunately, Murphy took it as a challange. First, Sprint lost an > STP power supply which blocked SS7 service in Sprint's southeastern > network for 2 hours and 52 minutes. After all the discussion that we had on the Datacenter list, I am surprised at this. You'd think that they'd have redundant PS's with redundant UPS's. > Then on Tuesday, Murphy killed > a disk drive on Sprint's SCP, blocking Sprint's nationwide network > for 4 minutes until it could be taken out of service. With the radical reduction in the cost of any form of RAID these days, I am surprised that a single disk-drive failure was able to do this. I'm even putting IDE RAID1 on critical workstations these days (Promis FastTrak66 and 2x10GB IDE drives. 3ware makes one with Linux drivers, IBM has linux drivers for their high-end RAID controllers as well [works on 3090's]). Of course, if they really insist on paying $money$ then they could spec EMC ... > Maintaining 99.999% network availability is hard for any network, > telephone or the Internet. But sometimes I wonder what the real > requirement is. The Australian stock exchange went down for a few > hours, it wasn't the end of the world. Sprint had some more blocked > calls than normal, most people didn't notice. Telephony and internet are substantially different, as are uptime and availability. For the telcos, they have no choice. Local public utilities commissions set the requirement for them and they negotiate how to measure it. Telcos are good at this sort of negotiation (what the meaning of "is" is, in this case, what the meaning of "99.999%" is, there is an amazing amount of varience <g>). For the internet, I see an amazing number of systems with no redundancy whatsoever. Of course, the first hardware failure usually corrects the problem, at the cost of substantial down-time. But many second-tier ISPs and dot-coms are still operating on brand-new equipment that hasn't started hitting its MTBF specs yet and they don't even have a clue on their MTTR ratings. In the next few years, I expect to see a lot more failures, as the equipment starts to age. > Are we setting artificial performance requirements, which > don't reflect > reality? Either in what can be achieved, or is necessary. The internet is a lot less forgiving wrt outages then the telco. The telco can have a circut outage, re-route to another circuit, and the customer never sees an availability gap. Also, a total outage, during reduced traffic times, and no customer ever misses a dial-tone because they aren't trying to get one, is not an outage in telco terms. The internet, on the other hand, may have similar issues, unless we start talking streaming video, streaming audio, and voice over IP. In those cases, packet losses can make a serious mess of things. Also, congestion is treated differently between the two systems. Telcos will actually return a fast-busy when a switch becomes congested. The internet simply starts dropping packets. You can actually hear the latter when using www.dialpad.com or MS-Netmeeting (both of which, I use extensively).

2 1

ICANN, TLDs, and directory services.
by rdobbins＠netmore.net 24 Nov '00

24 Nov '00

I'm no big fan of Brock Meeks - he strikes me as being rather immature and naive much of the time. Still, his piece on the ICANN TLD meeting (see http://www.msnbc.com/news/493721.asp?0nm=-11P ) is certainly enough to make those of us who've been around for a while want to weep and gnash our teeth. The first taste of this sort of nonsense was, in my opinion, the CLNP fiasco of a few years ago. Fortunately, wiser heads prevailed, but the blatant power-play that certain parties made at the Tokyo (it -was- Tokyo, wasn't it?) IETF meeting seems in hindsight to've been a foreshadowing of the bureaucratic diktat under which we now seem to be operating. ARIN's ill-informed (hadn't anyone there heard of SSL?) policy announcement regarding virtual hosting IPs was yet another - hopefully, this will go the way of the dodo after the public thrashing they've been subject to in this and other forums as a result of said stupidity. Still, the root problem (pardon the pun) of the namespace and how it should be managed is a pressing issue, and one which hasn't been resolved to anyone's satisfaction, not even ICANN's. IPv6 will, I think, begin to seep into mainstream usage as a matter of necessity. It's taking longer than it should, but security concerns alone (i.e., the fact that, as far as I can tell, spoofing addresses under IPv6 seems to be a pretty difficult, if not impossible task) will probably help give it some momentum. I wonder how long it will be until the 'research only' caveat will be eliminated by the registrars? The namespace is the big enchilada, though. There's been talk since at least 1993 of either a) switching to a directory service as the naming system for the Internet, or b) converting DNS itself into a true directory service by simply adding more and more directory-like features. X.500 was what most people saw as being the logical choice; its cumbersome design and the fact that it took so long to get the standard itself up to snuff made that choice stillborn during the 1990s. Now that we're starting to see, in very blatant terms, what technical/policy/regulatory issues arise with the current naming structure, I wonder if taking a serious look at directories as an ultimate DNS replacement might be more than just a quixotic thought-exercise? Structured properly, probably along national lines, the TLD/top-OU issue would go away, leaving people free to structure their namespaces as they choose. Object types and properties would certainly be a more elegant way of identifying various content-types rather than merely relying upon URL prefixes plus file extensions and their (assumed) proper mapping to MIME-types on the millions of client machines around the world. There are standards issues which must certainly be addressed before such a change could be contemplated; even so, I'm beginning to wonder whether or not it might be time to revisit the naming issue, with a specific focus on directory services? ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice

1 0