December 2000 - Test - lists.nanog.org

Re: RFC1918 addresses to permit in for VPN?
by Sean Donelan 09 Jan '01

09 Jan '01

On Thu, 28 December 2000, "Miguel A.L. Paraz" wrote: > Our DSUA filter had to have a small hole punched in since a customer had a VPN > (I do not know yet as to what kind) which was receiving packets sourced at > 172.17.x.x. Is this a misconfiguration on the sender's end, or a "feature." > > I think there was earlier discussion on VPN's requiring ICMP (echo?) Its not a very private or virtual network if it leaks addresses into a data stream visible to your filters.

21 47

Dialup congestion and winter weather
by Sean Donelan 04 Jan '01

04 Jan '01

It seems like a lot of people are at home, dialing into the Internet today. There is a major ice storm in the middle of the country, and its pretty much a holiday week elsewhere. Traffic seems to be moving on the major backbones, but some folks in the midwest report some problems dialing in from home.

3 2

RE: RFC1918 addresses to permit in for VPN?
by Richard A. Steenbergen 31 Dec '00

31 Dec '00

On Sun, Dec 31, 2000 at 02:14:54PM -0800, Bill Woodcock wrote: > > > Don't use RFC1918 addresses on as a security measure. > > That's the clue people are trying to convey here, yes. RFC1918 just > names a block of IP addresses. IP addresses are just integers. No > magic differentiates one from the next. i.e. there's no inherent > difference, security or otherwise, between 9.255.255.255 and 10.0.0.0. > They're just adjacent integers in a continuous range. Lets not get carried away. The difference we care about is, one address is announced and routed from the global internet, and one address is only used locally. This could just as easily be your real IP space which you're not announcing (note: this may actually be more useful then rfc1918 space for some things, like numbering your router interconnects out of such a block to prevent DoS without breaking icmp messages generated from them). Using unrouted IPs can be a very key part of a security policy, and if you want those IPs can be 1918 space. HOWEVER, it must be noted with lots of red flags and buzzers that this is NOT a complete security policy. For example if there is any way for an attacker to get on your local network, globally unrouted IPs won't help you. Also, if you're using NAT hosts can still be subverted in their external connections (perhaps something on your network is using MS Outlook for example). The key thing about this discussion is that it should be common sense. There is nothing "evil" with using globally unrouted IPs as part of your security, just as there is nothing "smart" about relying on it and thinking you're secure. Lets not make the same grossly oversimplified and underclued statements against 1918 addresses as some people would use in favor of them. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6

1 0

public route servers
by Dan Hollis 31 Dec '00

31 Dec '00

route-server.cerf.net appears to have been shut down, so all I have left is route-views.oregon-ix.net... What are some others...? -Dan

10 9

Re: NPIC Warning
by Jason Slagle 31 Dec '00

31 Dec '00

Not likely. Many of the members of this list despise IRC as a waste of resources. Perhaps it is, I won't argue that. One thing one cannot argue is it's ability to guage discover new forms of attacks, which are often utilized against IRC networks first. There have been a number of groups on IRC bragging about, or showing off, large Denial of Service and Distributed Denial of Service networks that are planned for use around the holidays. Already this holiday season this has happened when 12/26 Lineone, a large provider in the UK was knocked offline for nearly 11 hours by Denial of Service attacks. As the operators of many of these networks are away on the holiday season, and NOC's are often left lesser staffed, the time to attack becomes the holiday season, because attacks get harder to trace. Jason Slagle --- Jason Slagle - CCNA - CCDA Network Administrator - Toledo Internet Access - Toledo Ohio - raistlin(a)tacorp.net - jslagle(a)toledolink.com - WHOIS JS10172 /"\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \ / ASCII Ribbon Campaign . If dreams are like movies then memories X - NO HTML/RTF in e-mail . are films about ghosts.. / \ - NO Word docs in e-mail . - Adam Duritz - Counting Crows On Sat, 30 Dec 2000, Marshall Eubanks wrote: > > List members might be interested in this zombie warning : > > http://www.nipc.gov/warnings/advisories/2000/00-063.htm > > as reported in > http://www.wired.com/news/technology/0,1282,40905,00.html?tw=wn20001230 > > Real threat, or someone seeking funding ? > > Happy New Year ! >

2 1

Re: NPIC Warning
by Sean Donelan 31 Dec '00

31 Dec '00

On Sat, 30 December 2000, Marshall Eubanks wrote: > List members might be interested in this zombie warning : > > http://www.nipc.gov/warnings/advisories/2000/00-063.htm > > as reported in > http://www.wired.com/news/technology/0,1282,40905,00.html?tw=wn20001230 > > Real threat, or someone seeking funding ? I like the holiday warnings because they often let me know about holidays I never knew existed. They sometimes read a bit like this day in revolutionary history. The problem is every day of the year is important to some group. However, a holiday DDOS attack is a bit of an oxymoron. If a tree falls in a forest.... If no one is using the service over the holiday weekend, is anyone denied? The "pearl harbor" sunday morning attack isn't the best model for DDOS. Rapid distribution of e-mail viruses implies lots of people reading e-mail. Fewer people read e-mail over the holiday weekend suggesting a slower spread of viruses. E-mail viruses spread the fastest during the workday. DDOS attacks are most devestating when network traffic is already near its peak. A truck jackknifed in the middle of rush hour affects a lot more people than an accident on sunday morning. DDOS isn't as effective when there is lots of spare capacity. Collecting zombie computers is mostly a matter of numbers. Since many of the probes are automated, they occur 24 hours a day 7 days a week without regard of holdays or weekends. Of course, that presumes there is some logic or reason for the attack.

1 0

RE: RFC1918 addresses to permit in for VPN? (fwd)
by John Fraizer 31 Dec '00

31 Dec '00

I've been getting flamed by several of you off-list for picking on a "big carrier." As result, I decided to pass this one on to the list. --- John Fraizer EnterZone, Inc ---------- Forwarded message ---------- Date: Sat, 30 Dec 2000 02:56:50 -0500 (EST) From: Wants to keep his job <spork(a)xxxx.com> To: John Fraizer <nanog(a)EnterZone.Net> Subject: RE: RFC1918 addresses to permit in for VPN? Yeah, this "network architect" responded to a post of mine on NANOG that using TAP to send pages was just dumb when I could simply email my pager "directly". Uh... Yeah, that will get my page about "the internet" being down right out to my pager right quick. Of course I didn't see his response for a few weeks, as it fell into my spam folder. Wonder why? xxxx@shell[~]$ telnet 205.152.173.2 25 Trying 205.152.173.2... Connected to ns1.arch.bellsouth.net. Escape character is '^]'. 220 ns1.arch.bellsouth.net ESMTP Sendmail 8.9.1a/8.9.1; Sat, 30 Dec 2000 02:53:06 -0500 (EST) mail from: spammer(a)theinternet.com 250 spammer(a)theinternet.com... Sender ok rcpt to: xxxx(a)xxxx.com 250 xxxx(a)xxxx.com... Recipient ok data 354 Enter mail, end with "." on a line by itself sigh... . 250 CAA02152 Message accepted for delivery quit 221 ns1.arch.bellsouth.net closing connection enough said. flame on... (name deleted) --- Bellsouth: Please patch your spam hole. We all know they'll be using that one now. BTW: Any reason why you have SMTP service on a nameserver available from the global internet Money that tight that you can't have dedicated boxes to do DNS and DNS only? (On the phone to brokers voicemail: "Bellsouth: SELL IT! SELL IT! SELL IT!") --- John Fraizer EnterZone, Inc

5 4

Re: RFC1918 addresses to permit in for VPN?
by Richard A. Steenbergen 30 Dec '00

30 Dec '00

On Sat, 30 Dec 2000, Bill Fumerola wrote: > On Fri, Dec 29, 2000 at 04:19:23PM -0500, Deron J. Ringen wrote: > > > That makes perfect sense to me...there is not a better way to protect a box > > from a DOS/hack than to only give it a private address. Why expose a box > > to the outside world if there is not a need??? > > For exactly this reason, people start to use the reserved address > space as a security feature and think "welp, its safe now!". That should be more correctly stated as "what more simplistic but guarantee of nothing method".., Just remember it only takes one public exploited linux or solaris box on your network, and suddenly all that 1918 space is fair game again. If you have put all your eggs in this one basket and havn't bothered to take care of the rest of your responsabilities, you could quickly find yourself getting bit hard. Straight layer 2 switches provide little protection from someone worming their way through your network, since arp toys like http://www.monkey.org/~dugsong/dsniff/ and dozens of others are now publicly available to script kiddies. I place this in the same category as those who blindly put their faith in the security of ssh, without stopping to think how possible is it that these ssh bins have been backdoored and are logging my passwords and/or connections. This is particularly funny in the terminal room of certain conferences, and the number of people I saw blindly ssh'ing from boxes with no root password at nanog 19 still never ceases to amaze me. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

OT
by John Fraizer 30 Dec '00

30 Dec '00

OK. I'm sorry for flaming the Bellsouths out there. I'll try not to do it any more. --- John Fraizer EnterZone, Inc

1 0

RE: RFC1918 addresses to permit in for VPN?
by John Fraizer 30 Dec '00

30 Dec '00

Oh, come on. You must not monitor NANOG that much. Otherwise, you would know that if I was flaming, anyone with a bell*.* address would be in a burn ward. I was just making a simple observation. Can I help it if every contact I've had, save one, with bell*.* has been a clueless, old-fart, union-so-you-can't-replace-him-her-with-someone-with-clue, wouldn't know a clue if it came up and bit them in the a$%@^$@%^ piece of %^&#%&^#?!??? who is sucking up oxygen from the script kiddies (who while I hate, may actually grow up some day and do something productive)??!!!??? Don't want to be associated with that stereotype? Get rid of 99% of your organization or go to work for someone else. BTW: I know from first hand experience. I had to leave a job at a bell*.* company because as a 19 y/o. I made the 20/30/40/50/60 y/o's nervous as far as their jobs were concerned. 'Nuff said. --- John Fraizer EnterZone, Inc On Fri, 29 Dec 2000, Christian Kuhtz wrote: > > John, > > I disagree with Deron, albeit for different reasons. But I don't think the > flame was neccessary. > > Cheers, > Chris > > -- > Christian Kuhtz <ck(a)arch.bellsouth.net> -wk, <ck(a)gnu.org> -hm > Sr. Architect, Engineering & Architecture, BellSouth.net, Atlanta, GA, U.S. > "I speak for myself only." > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > > John Fraizer > > Sent: Friday, December 29, 2000 7:01 PM > > To: Deron J. Ringen > > Cc: Simon Lyall; nanog(a)merit.edu > > Subject: RE: RFC1918 addresses to permit in for VPN? > > > > > > > > On Fri, 29 Dec 2000, Deron J. Ringen wrote: > > > > > > > > > -----Original Message----- > > > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > > > > Simon Lyall > > > > Sent: Friday, December 29, 2000 3:03 PM > > > > To: nanog(a)merit.edu > > > > Subject: Re: RFC1918 addresses to permit in for VPN? > > > . > > > . > > > > One of the companies we work with has 192.168 address for some of the > > > > radius servers we have to talk to, we are directly connected to them so > > > > it's not a big pain but it's just so ugly. > > > . > > > . > > > That makes perfect sense to me...there is not a better way to > > protect a box > > > from a DOS/hack than to only give it a private address. Why expose a box > > > to the outside world if there is not a need??? > > > > Deron, > > > > Ever heard of an access list? Didn't think so. > > > > > Deron J. Ringen > > > Sr. Network Architect > > > BellSouth Internet Services > > > > Typical. > > > > --- > > John Fraizer > > EnterZone, Inc > > > > > > > > > > >

3 2