December 2000 - Test - lists.nanog.org

Re: FDDI to FE?
by Jimmy Kyriannis 19 Dec '00

19 Dec '00

At 07:10 PM 12/19/00, David C Prall wrote: >Unfortunately the 2820 FDDI module has been End of Lifed >http://www.cisco.com/warp/public/cc/pd/si/casi/ca1900/prodlit/1148_pp.htm > >David C Prall dcp(a)dcptech.com http://dcp.dcptech.com And the last ship date was less than a week ago, no less! Jimmy

1 0

Identifying network contacts (Re: Port scanning legal)
by Sean Donelan 19 Dec '00

19 Dec '00

On Tue, 19 December 2000, "L. Sassaman" wrote: > > Cool. Since you're obviously in the right, how about scanning some > > U.S. military networks and letting us all know what OS they are using? > > I have tcpwrappers set to trigger a portscan after certain actions... and > I have inadvertently scanned a section of the navy.mil network because of > this. (They're running raptor... what a surprise.) > > I was not approached by any men in black after this happened. I suspect > the US Military is well accustomed to having its networks scanned. They may be used to it now, but circa 1991 I had a programmer who failed to apply _htonl() in the appropriate connect() variable and spent several days trying to debug his program. The MIB at the TLA were not amused. This was back in the days when WHOIS contact information had real contacts. So it was simple for them to get a hold of me, and as soon as I did a WHOIS on the organization for me to figure out the inverse of network 1.2.3.4 was really 4.3.2.1.

1 0

RE: Port scanning legal
by Roeland Meyer 19 Dec '00

19 Dec '00

ping! > -----Original Message----- > From: Shawn McMahon [mailto:smcmahon@eiv.com] > Sent: Tuesday, December 19, 2000 10:58 AM > To: nanog(a)merit.edu > Subject: Re: Port scanning legal > > > On Tue, Dec 19, 2000 at 11:59:23AM -0500, John Fraizer wrote: > > > > Had he likened portscanning someones network to walking > into their back > > yard with a ladder, climbing up to the second floor and > checking for open > > windows, perhaps the court would have found differently. > > I'm sure they would, but it's a deeply flawed analogy. > > How many ports must be scanned before you deem it an attack? > Is one port > enough? Five? 50? > > If you pick a number here, is that arbitrary, or do you have a valid > logical (and legally-supportable) reason for the number? > > If one port is sufficient, then the act of typing an IP address into a > web browser to see if there's a web server listening is a crime. > >

5 4

RE: Port scanning legal
by Christian Kuhtz 19 Dec '00

19 Dec '00

> On Tue, 19 Dec 2000, Mathew Butler wrote: > > Great, so you're suggesting punishing good locksmiths or windowmen. > > Last I checked, locksmiths dont walk up and down streets checking > every lock and window on every house. Or to put it differently, when locksmiths or windowmen 'check' my property uninvited, YOU BET I will use whatever means neccessary to see them punished for invading my privacy, attempted breaking and entering or whatever. I (and many others) assume hostile intent. Don't port scan unless you have express permission. Typically locksmiths get paid, and windowmen, too. To equal port scanning with some sort of community service is a ludicrous argument. And if you want to offer free port scanning services, it can't hurt to ask before you do so if you really want to contribute something back to the net society. -- Christian Kuhtz <ck(a)arch.bellsouth.net> -wk, <ck(a)gnu.org> -hm Sr. Architect, Engineering & Architecture, BellSouth.net, Atlanta, GA, U.S. "I speak for myself only."

1 0

Anybody from Interliant in D.C. here?
by Kalus, Michael 19 Dec '00

19 Dec '00

Hi, could please somebody from Interliant (preferably from the center in D.C.) contact me? Thanks. Michael

1 0

Re: Port scanning legal
by Steven M. Bellovin 19 Dec '00

19 Dec '00

In message <Pine.LNX.4.30.0012190930530.27364-100000(a)labyrinth.local>, "Edward S. Marshall" writes: > >http://www.securityfocus.com/templates/article.html?id=126 > >A quick quote from the article: > > A tiff between two IT contractors that spiraled into federal court > ended last month with a U.S. district court ruling in Georgia that > port scanning a network does not damage it, under a section of the > anti-hacking laws that allows victims of cyber attack to sue an > attacker. > > Last week both sides agreed not to appeal the decision by judge Thomas > Thrash, who found that the value of time spent investigating a port > scan can not be considered damage. "The statute clearly states that > the damage must be an impairment to the integrity and availability of > the network," wrote the judge, who found that a port scan impaired > neither. > >This may have ramifications for both security professionals and abuse desk >personnel; this ruling would seem to make it clear that you cannot claim >time spent investigating abuse issues as damage. The complete finding is >here: > > http://pub.bna.com/eclr/00434.htm > >Any armchair lawyers on the list want to take a crack at this? As always, your mileage may vary. California law specifically states that costs incurred by the victim include any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by the access. So checking out a scan might qualify. As for "access", it's defined as "Access" means to gain entry to, instruct, or communicate with the logical, arithmetical, or memory function resources of a computer, computer system, or computer network Specific crimes include (6) Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section. (7) Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network. Does a port scan "communicate with" the specified part of a computer? FYI, these are from Section 502 of the California Penal Code, at http://www.leginfo.ca.gov/cgi-bin/displaycode?section=pen&group=00001-01000…

2 1

Re: Port scanning legal
by Marius Strom 19 Dec '00

19 Dec '00

*frantically rewrites AUP's to read as follows:* 5.17 While we provide network connectivity, you must verify the host you are connecting to by using whois(1) to make sure it's not a military or government site. Use information from the whois(1) records to contact by phone the sites in question. Make sure to contact ARIN/RIPE/APNIC before querying their whois servers. Contact us before querying our DNS servers for ARIN/RIPE/APNIC hostname information. Not to step in the middle of a firefight without a waterhouse, but come on guys, this is getting absurd. On Tue, Dec 19, 2000 at 12:26:16PM -0800, Dan Hollis wrote: > > On Tue, 19 Dec 2000, Roeland Meyer wrote: > > I've pinged IP addrs that I later found out were MIL addrs. Nothing > > happened. Duh! > > Cool. Care to portscan a couple .mil /16's and get back to me? > > > There are a LOT of IP addrs that aren't in the DNS. How is one to know? > > Hmm. whois perhaps? > > connecting to whois.arin.net [192.149.252.21:43] ... > HQ 7th Signal Command (NETBLK-ARMY-C) NETBLK-ARMY-C198.49.183.0 - 198.49.192.0 > INFORMATION SYSTEMS COMMAND (NET-NSMCNET) NSMCNET198.49.185.0 - 198.49.185.255 > > Naah, that makes too much sense. Can't have that now can we. > > > I don't know about you, but I flunked telepathy in High School and did > > worse in clarvoyance. > > One might argue its not the only thing you flunked. > > > Could it be, that is why ping and traceroute were invented? > > ping and traceroute are a far cry from nmap. I dont recall ping and > traceroute having a 'decoy host' option, or 'stealth' option for example, > nor any option to scan entire nets and ranges of ports. > > > The argument against port-scanning applies equally well to just about every > > diagnostic tool we use. > > Only by the most convoluted thinking. > > -Dan > -- Marius Strom <marius(a)marius.org> Professional Geek/Unix System Administrator URL: http://www.marius.org http://www.marius.org/marius.pgp 0x55DE53E4 "Never underestimate the bandwidth of a mini-van full of DLT tapes traveling down the highway at 65 miles per hour..." -Andrew Tanenbaum, "Computer Networks"

1 0

RE: Port scanning legal
by Roeland Meyer 19 Dec '00

19 Dec '00

> From: Steven M. Bellovin [mailto:smb@research.att.com] > Sent: Tuesday, December 19, 2000 2:23 PM Thanks for re-quoting this ... > In message > <Pine.LNX.4.30.0012190930530.27364-100000(a)labyrinth.local>, "Edward > S. Marshall" writes: > > > >http://www.securityfocus.com/templates/article.html?id=126 > >This may have ramifications for both security professionals > and abuse desk > >personnel; this ruling would seem to make it clear that you > cannot claim > >time spent investigating abuse issues as damage. The > complete finding is > >here: > > > > http://pub.bna.com/eclr/00434.htm > > > >Any armchair lawyers on the list want to take a crack at this? After reading the specifics I could find. It would seem that you could bill for the investigation only AFTER there has been a break-in. Bad analogies aside, a port scan isn't a break-in, by any stretch of the imagination. Therefore, on its own, it's not billable. However, if a break-in has been proven, time spent on the investigation, before-hand, becomes billable. -- IANAL - I Am Not A Lawyer. Before taking action on anything I say, you are encouraged to seek legal advice.

1 0

RE: RFC Outlines
by Sami Juvonen 19 Dec '00

19 Dec '00

> Can anyone refer me to an RFC or similar documentation that outlines > how an RFC should be written? http://www.rfc-editor.org/

1 0

RE: Port scanning legal
by Mathew Butler 19 Dec '00

19 Dec '00

If someone leaves their network open to the scan in the first place, it's their own lack of due diligence. However, someone going through a hole that's been detected is bad juju. -Mat Butler -----Original Message----- From: Dan Hollis [mailto:goemon@sasami.anime.net] Sent: Tuesday, December 19, 2000 11:46 AM To: Shawn McMahon Cc: 'nanog(a)merit.edu' Subject: Re: Port scanning legal On Tue, 19 Dec 2000, Shawn McMahon wrote: > Better lock me up; I can't count the number of times I've nmap-ed > somebody just to find out what OS they were using, either for personal > curiosity, or as part of an argument. Cool. Since you're obviously in the right, how about scanning some U.S. military networks and letting us all know what OS they are using? If you like, I'll start an argument with you so you have the justification you need to portscan. -Dan

1 0