July 2000 - Test - lists.nanog.org

Open Question About AS Number assignments...
by Aaron Moreau-Cook 10 Jul '00

10 Jul '00

I was noticing that larger backbone providers, who have merged with other large backbone providers, seem to keep both AS numbers. Let's take Verio as a example, though Verio is only one of many who have multiple AS numbers. Verio has 8 AS numbers, AS 93, 97, 114, 275, 280, 253, 1225 and 2914. I noticed that there are no IP routes associated with 6 of the 8 AS numbers and that only AS 97 & AS 2914 has any IP routes. My questions are: 1) Is there a easy mechnisim to give back AS numbers to the ARIN? 2) Would ARIN even reallocate those AS numbers to new requesters? 3) Could those AS numbers be transfered over to new organizations? 4) Is there a advantage for a organzation to have multiple AS numbers? 5) Is there a advantage to having a lower AS number? Thanks!

4 3

RE: RBL-type BGP service for known rogue networks?
by Hal Murray 09 Jul '00

09 Jul '00

From: "Roeland M.J. Meyer" <rmeyer(a)mhsc.com> > I agree. MHSC lost an entire market plan, hosting third-party secure > mail, becasue third-party mail services must allow relaying that > is at minimum semi-open. At the time SMTP AUTH didn't exist (Until > it's use becomes more wide-spread it still isn't real useful). The > anti-relay bunch are killing a valid business model. This brings up an interesting point that I haven't seen discussed much. What should happen when various business models for using the internet conflict? Who gets to decide? Or how do we collect and distribute the information so individual sites can decide for themselves? I think all the examples I know about involve network abuse, or at least activities that will be considered as network abuse by many sensible people. Maybe the common theme is cost-shifting. I'm including support costs as well as up-front traffic/server costs. The obvious example is an ISP who wants to take spammers as customers, or host web servers for spammers. The next example is an ISP with a good looking anti-spam section in their AUP but they take a long time to enforce it. How long should it take to disconnect a flagrant spammer? ... How about ISPs that tolerate crackers or smurfers? What about ISPs that are just slow or incompetent at backtracking abusive traffic with forged headers or setting up filters to drop forged headers from their customers? AllAdvantage is another good example to consider. I have no interest in what they offer and I generally like having new/different businesses connected to the internet. But their system encourages spam, so we all get to pay for AllAdvantage's business in increased spam-fighting costs. I'm sure they could stop the spam (or rather almost all of it), but that would increase their costs. Another example that was recently mentioned was ISPs that are teaming up with phone companies. The phone company does the billing and gives the ISP a cut so the ISP doesn't have to keep customer records and hence those ISPs will have troubles disconnecting crackers. Again, the ISPs could do a reasonable job of making sure their customers are good netizens, but it will raise their cost of doing business.

4 3

RE: RBL-type BGP service for known rogue networks?
by Richard A. Steenbergen 09 Jul '00

09 Jul '00

On Sun, 9 Jul 2000, Hal Murray wrote: > I think all the examples I know about involve network abuse, or at > least activities that will be considered as network abuse by many > sensible people. Maybe the common theme is cost-shifting. I'm > including support costs as well as up-front traffic/server costs. > > The obvious example is an ISP who wants to take spammers as customers, > or host web servers for spammers. The next example is an ISP with a > good looking anti-spam section in their AUP but they take a long time > to enforce it. How long should it take to disconnect a flagrant > spammer? ... > > How about ISPs that tolerate crackers or smurfers? What about ISPs > that are just slow or incompetent at backtracking abusive traffic with > forged headers or setting up filters to drop forged headers from their > customers? I suspect there isn't anyone on this list who has told someone (or at least thought about telling someone) "you're too stupid to use the internet, go away". Stupid people generally don't like being told they are stupid, and as much as we may not like it, they continue to use the internet anyways. There is no IQ test given to those who get internet connections, no licensing, no qualification exam, so we'll pretty much have to accept that stupid people will find their way into our lives, then proceed to setup open mail relays, networks with open directed broadcasts, and RedHat Linux machines. These people may later go on to realize the errors of their ways, but as long as experienced people keep dieing and new people keep getting born, people will make mistakes. Auditing and security your servers and mail relays, having people trained in tracing spoofed packet streams or catching the crackers, having equipment capable of DOING it (if this is even possible), and having sufficient numbers of people necessary to handle the tasks (ever tried responding to the number of spam complaints a fair sized ISP gets, and seperating the false claims from the real ones? Its not fun), is NOT a cheap or easy proposition. So the question is, how do we want to get "other networks" to provide the things? Educate them? Motivate them? Threaten them? Sue them? Ignore them? What do we consider to be an acceptable level of time where we try to be nice, before we decide that they're not going to respond without being not-nice? Who makes this decision? The only way it will be sufficiently "under control" for some people's tastes will be government regulation forcing people to meet a certain level of standards in these things. Thats obviously not what we want. But let me ask this... how many of us who complain about other people's networks and lack of response when we need help, actually run perfect networks outselves? Can you honestly say you have every mail relay in your network accounted for and secured? Can you honestly say you have every one of your customers RFC2267 filtered so they can't attack others? Can you honestly say you have training and policies in place for the expiditious tracing of spoofed packets across your network? Can you honestly say you look into every spam and abuse complain you receive, correctly seperate the real incidents from the paranoia, and handle all issues in a timely fashion? I suspect if your network is of any real size, the answer is NO. So why don't we all take a little bit of time to go work on these things in our own networks now, then encourage our customers to do the same. Just a thought. :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Alright, ORBS sucks - next topic, please ;) [was RE: RBL-type BGP service for known rogue networks?]
by rdobbins＠netmore.net 09 Jul '00

09 Jul '00

I -do- have a postmaster account, and there's nothing broken on my mail server. I *don't run an open relay*. I provide SMTP service to my clients *in conformance with the relevant RFCs*, as well as reasonable and prudent security practices. I'm not a spam-house; I have internal mechanisms for detecting such activity before it becomes a problem for others, in most cases. When something slips through the cracks, I jump on it immediately. It's great that their 'service' helped you; however, some of us would prefer to rely upon our own skills and experience to ensure that our systems are properly set-up. I no more want the ORBS people forging mail via my server than I do the 'MAKE MONEY FAST' people, and their attitude belies a stunning arrogance coupled with extreme shortsightedness, which isn't something any of us should wish for in an organization whose stated aim is to improve the user experience. And that's enough of that. -----Original Message----- From: Eric A. Hall [mailto:ehall@ehsco.com] Sent: Saturday, July 08, 2000 12:08 PM To: rdobbins(a)netmore.net Cc: nanog(a)merit.edu Subject: Re: RBL-type BGP service for known rogue networks? > ORBS forge headers (thereby violating the RFC) to look as if they're > coming from domains you host, then if it goes through, they put you > in their little black book for being an 'open relay'. No notice, > nothing. The last part of that statement is simply untrue. I got ORBS'd once and they notified me via postmaster@domain. If you don't get notified then you don't have a postmaster account for the domain, and it is you who are in violation of the RFCs. As for the "forge headers in violation" part, they have to test the common variations. Who cares if they do that as a one-off probe. If they were doing it all the time it would be a problem, but once is nothing. Of course, the spammers who are using your server as an open relay are certainly violating that and much more, so if it really bothers you close your freaking relay. ;) I for one was happy for the free and comprehensive testing. It pointed out a whole I had missed in my config. Once patched, I was out of the ORBS database in less than 24 hourse, and was able to get out on my own just by filling out a form on their web site that kicked off an automated retesting. I think ORBS provides an excellent service, and I say that because my experience says that they rely entirely upon factual evidence before they block, and it is easy to get out of the database once you provide evidence that you have fixed your server. -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

7 9

"top secret" security does require blocking SSH
by rdobbins＠netmore.net 09 Jul '00

09 Jul '00

You are correct, it cannot. I've spent a good portion of my career working on networks which are CLASSIFIED or higher. There are very strong restrictions on simultaneous interconnection between systems of varying classifications. In most cases, complete -physical- isolation is required, although waivers may be obtained on a case-by-case basis. The enforcement of these policies of course varies between agencies, bureaus, and departments. I remember just a year-and-a-half ago installing fibre switchboxes on some USAF nodes which at various times needed to have connectivity to networks of varying security levels. This is slowly changing at the lower levels due to the advances in proxying technology, etc., but when you reach TS/SCI or SAP/SAR it's a different story, and understandably so. As a side note, the reason the first version of Microsoft Exchange, 4.0, was so late was due in large part to the fact that Microsoft wanted to bid on the Defense Messaging System, or DMS contract. DMS supports all levels of classification and types from UNCLASSIFIED all the way through FLASH, CRITIC, etc. The powers that be understand that an application-level service like messaging has to be able to cross such boundaries, but only with strong rules which prevent the dissemination of information of higher sensitivity to those who aren't cleared for same. To the best of my knowledge, there are no networks in DoD, the armed forces, or various other arms of the U.S. government which are ranked as SECRET or above which have any form of Internet connectivity at anything less than two removes. One of the reasons that it's so hard for them to come up with a coherent and workable overall information security policy is because of the (very necessary, more so than the typical slashdotter tends to believe) compartmentalization of information - and hence, IT resources - within various organizations which deal with sensitive information and issues. "Greg A. Woods" wrote: > > [ On Sunday, July 9, 2000 at 08:22:46 (-0700), Roeland M.J. Meyer wrote: ] > > Subject: RE: RBL-type BGP service for known rogue networks? > > > > In many organizations, a system isn't considered secure unless > > port 22 is blocked, at the firewall. It is, after all, the secure > > port, that must mean that you have to block it to be secure, > > right? > > Yes, that's exactly right, but not for the reasons you imply. > > If the primary concern of a security policy is that covert channels must > be prevented then it is absolutely mandatory that port-22 be blocked > since it is by definition a covert channel. > > However having any kind of Internet connection, proxied or not, into a > site where sensitive information must not be allowed to be leaked is in > effect a violation of the policy. > > Unfortunately we're rapidly approaching (if we're not already there) a > state of affairs where it is impossible to technically prevent inbound > and outbound covert channels wherever people are required to interact in > a privileged way with security sensitive systems. A paper given at last > year's ACM New Security Paradigms Workshop by Dean Povey ("Optomistic > Security: A New Access Control Paradigm") suggests that it might be > better to adopt the view that security officers should "Make the users > ask forgivness not permission." Whether this paradigm can successfully > be delployed in top secret (or higher) environments or not is yet to be > discussed. I suspect it can but then I'm not an expert in traditional > forms of high security. > > -- > Greg A. Woods > > +1 416 218-0098 VE3TCP <gwoods(a)acm.org> <robohack!woods> > Planix, Inc. <woods(a)planix.com>; Secrets of the Weird <woods(a)weird.com> -- ----------------------------------------------------------- Roland Dobbins <mordant(a)gothik.org> // 818.535.5024 voice One of the surest signs of the philistine is his reverence for the superior tastes of those who put him down. -- Pauline Kael

1 0

Lurking lawyers
by Sean Donelan 09 Jul '00

09 Jul '00

On Thu, 06 July 2000, Steve Sobol wrote: > However, unless there's something I don't know about you guys, > there are no lawyers or judges amongst the readers of NANOG. Actually, there are several lawyers lurking on NANOG. The direct and indirect readership of NANOG is rather diverse, extending far beyond network operators. I don't know if either of the inventors of the Internet (Al Gore or Vint Cerf) get copies of any of the messages, but lots of reporters, researchers, spies, hackers, law enforcement officers, regulators, inspector generals, policy makers, lobbyists and wonks do.

5 5

PacBell: San Jose equipment problems
by Sean Donelan 09 Jul '00

09 Jul '00

Pacific Bell has equipment problems affecting PBI Internet access for subscribers in the San Jose area. As far as I can tell, it is only affecting PBI customers. Subscribers using other ISPs as their uplink seem ok. PBI's service level promise is a bit weak. Quoting from PBI's terms and conditions for DSL service: "You understand and agree that temporary interruptions of the Service may occur as normal events in the provision of the Service." Its a sad day when service interruptions are viewed as normal events. In other news, the San Bruno Fire Department issued a preliminary report saying an accident by workers using cutting torches above the cable manhole led to the cable fire June 26. Pacific Bell is expected to be the first one with a claim for damages.

1 0

RE: LoadBalancing products: Foundry ServerIron
by Karyn Ulriksen 08 Jul '00

08 Jul '00

A friend of mine was using LD's on his service. They do about 180mbps over 3 locations and were running performance problems. (They ended up moving to F5's). One of Exodus's Senior Network Engineers has seen that consistenly become problematic at about the magic 80mbps you mentioned. I spoke with a few different neteng buddies when we started looking at LB's over a year ago and they all told me to stay away from the LD's. But like all of us, they get better as they stay around longer... Probably, it's the same with all LB products ... you have to match the right products with your needs. Me, I have to go for the big scale. So I'll sacrifice features for ability to consistently handle the traffic and scalability. I eliminated quite a few simply because they couldn't handle the volume, but that doesn't mean that they would work well for a site located in one of the big data centers. -Karyn -----Original Message----- From: Bennett Todd [mailto:bet@rahul.net] Sent: Thursday, July 06, 2000 9:25 AM To: Karyn Ulriksen Cc: 'nanog(a)merit.edu' Subject: Re: LoadBalancing products: Foundry ServerIron 2000-07-06-11:56:34 Karyn Ulriksen: > > How about Local Director? > > Everyone I've spoke to about LD is very unhappy with it's > performance. That can only be because you didn't speak to me:-). Seriously, I've used them a fair bit, and like 'em a lot. Their H-A failover is superb, they load balance really gracefully, their hold-time feature (making assignments sticky) works well with simple website designs for session tracking; and I really love the way they passively monitor the performance of all servers in the farm and consistently route traffic to the currently fastest server. I've heard that they max out around 80Mbps. That was a year or so ago, I've no idea if that's still the case. I've never hit their limits. But I can believe that a faster-but-dumber load balancer would have a higher ceiling. -Bennett

5 4

FW: LoadBalancing products: Cisco LocalDirector
by Roeland M.J. Meyer 08 Jul '00

08 Jul '00

> -----Original Message----- > From: ejm(a)onmedia.com [mailto:ejm@onmedia.com] > Sent: Saturday, July 08, 2000 10:19 AM > To: Roeland M.J. Meyer; 'Stephen Sprunk'; 'Karyn Ulriksen' > Cc: 'North American Noise and Off-topic Gripes' > Subject: RE: LoadBalancing products: Cisco LocalDirector > > > Actually, the MSM module has been phased-out in favor of what Cisco > calls the "MSFC/PFC" modules for the supervisor engine. It performs > silicon based L3/L4 services, rather than MSM CPU/CEF based > forwarding. > > It is true that there is IOS based LB, which can be enabled on the > MSFC. However, the functionality is a subset of the LD. > You'll have to > visit Cisco to get the full scoop on the 6xxx futures for LB. > > You might forward this to the NANOG list, since I'm a "listen only" > member. > > As a disclaimer, I work for Cisco. > > Thanks! > > ... Erik > --- > Erik Murrey > > > "Roeland M.J. Meyer" <rmeyer(a)mhsc.com> wrote on Saturday July 8, 2000 > at 7:35am: > > > >I heard rumor that Cisco was considering including LD capability > >in the 6509 MSN router module? > > > >> Stephen Sprunk: Friday, July 07, 2000 5:46 PM > >> > >> If you are using a LocalDirector with a Cat6k switch, you can > >> enable the > >> Accelerated Server Load Balancing feature. This allows the > >Cat6k to > >> forward the bulk of the flow (at wire speed), and lets the LD > >focus > >> exclusively on the connection setup/teardown functions. > >> > >> For more information: > >> http://www.cisco.com/univercd/cc/td/doc/product/iaabu/localdir > >> /ld33rns/l > >> dicgd/ld3_ch04.htm#xtocid1675521 > >> > >> S > >> > >> | | Stephen Sprunk, K5SSS, CCIE #3723 > >> :|: :|: Network Design Consultant, HCOE > >> :|||: :|||: 14875 Landmark Blvd #400; Dallas, TX > >> .:|||||||:..:|||||||:. Email: ssprunk(a)cisco.com > >> > >> > >> ----- Original Message ----- > >> From: "Karyn Ulriksen" <kulriksen(a)publichost.com> > >> To: "'Bennett Todd'" <bet(a)rahul.net>; "Karyn Ulriksen" > >> <kulriksen(a)publichost.com> > >> Cc: <nanog(a)merit.edu> > >> Sent: Thursday, July 06, 2000 11:40 > >> Subject: RE: LoadBalancing products: Foundry ServerIron > >> > >> > >> > > >> > A friend of mine was using LD's on his service. They do > >> about 180mbps > >> over > >> > 3 locations and were running performance problems. (They > >ended up > >> moving to > >> > F5's). One of Exodus's Senior Network Engineers has seen > >that > >> consistenly > >> > become problematic at about the magic 80mbps you mentioned. > >I spoke > >> with a > >> > few different neteng buddies when we started looking at LB's > >over a > >> year ago > >> > and they all told me to stay away from the LD's. But like > >> all of us, > >> they > >> > get better as they stay around longer... > >> > > >> > Probably, it's the same with all LB products ... you have > >> to match the > >> right > >> > products with your needs. Me, I have to go for the big > >> scale. So I'll > >> > sacrifice features for ability to consistently handle the > >> traffic and > >> > scalability. I eliminated quite a few simply because they > >couldn't > >> handle > >> > the volume, but that doesn't mean that they would work well > >> for a site > >> > located in one of the big data centers. > >> > > >> > -Karyn > >> > >> > >> > > > ....

1 0

RE: RBL-type BGP service for known rogue networks?
by rdobbins＠netmore.net 07 Jul '00

07 Jul '00

Sure; I see your point. Thing is, though you don't -have- to make the ACL thing automatic - you can have someone sitting and watching the thing, and triggering it manually after positive identification. -----Original Message----- From: John Kristoff [mailto:jtk@depaul.edu] Sent: Friday, July 07, 2000 5:01 PM To: nanog(a)merit.edu Subject: Re: RBL-type BGP service for known rogue networks? rdobbins(a)netmore.net wrote: > I certainly don't think that intrusion-detection makes sense for the > backbones and NAPs and so forth, but when you get closer to the > traffic-orginator/requestor boundaries of the network, it becomes more > feasible, does it not? Perhaps. It might be less detrimental to the entire Internet community if only a edge customer's dynamic IDS/filtering system went haywire. It then boils down to an organization's design and support philosophy. Personally, I don't like the idea of messing with packets/streams in transit unless it's route them, drop them (congestion) or mark them (IP ToS bits/DiffServ). There of course may be a few instances where you block an entire netblock (e.g. RFC 1918) or specific ports (e.g. snmp) that are widely know to be insecure or invalid. It seems easier in the long run (harder intially) to secure the end systems. Maybe I'm just getting used to vendors automatically configuring my network with the routing protocols and I'm not quite ready for automatic ACL definitions based on traffic patterns. :-) John

1 0