October 2001 - Test - lists.nanog.org

Distance range?
by bhchoi＠smartnet.co.kr 26 Oct '01

26 Oct '01

Hi nanog. Does anyone know distance support range about gigabit ethernet in IEEE 802.3z and 802.3ab and SONET/SDH? Gigabit Ethernet SX Transceiver : ? km LX Transceiver : ? km Long Haul Transceiver : ? km SONET/SDH MM(Multimode) : ? SR(Short reach) : ? IR(Intermediate reach) : ? LR(Long reach) : ? thanks for any input or pointer. Brian

1 0

Re: Fwd: Re: Digital Island sponsors DoS attempt
by Christopher Wolff 26 Oct '01

26 Oct '01

Paul, Some very valid points here. I would be interested to see just what the legal definition of "network intrusion" is on a federal level with all of the recent computer-crime and anti-terrorism legislation sailing through the legislative branch. Regards, Christopher ---------- Original Message ---------------------------------- From: Paul A Vixie <vixie(a)vix.com> Date: Fri, 26 Oct 2001 00:07:05 -0700 > >> Until there are standards and technology available to push subscriber >> policy to the edge of the network and beyond, the subscriber has >> explicitly accepted the overall terms and conditions by which the service >> is to be provided. > >no. i do not agree to receive a smurf attack, no matter whether my contract >with a nexthop fails to require them to prevent it from reaching me. > >> I am assuming in this discussion that when you refer to "benefit", you are >> in fact refering to "financial benefit". > >no, there's no known financial benefit to smurfing me, but the entities who >direct such attacks have positive motivation of some kind for doing so -- >and i assure you that this benefit to them, whatever it is, is far greater >than the benefit to me (which would have to be expressed in negative terms.) > >> > another test for "welcome" is "if everybody did this, would the recipient >> > be injured?" >> >> An interesting hypothesis, but it is seldom the case that the sender of >> traffic knows the details of the recipients infrastructure. > >i think it's reasonable for a smurfer to know that my infrastructure cannot >tolerate multiplicitous input streams from tens of thousands of sources. just >as a spammer can indeed know, without doubt, that if millions of senders, >all at once, decided to send me unsolicited nonpersonal e-mail, that my inbox >would not hold up well. > >no specific knowledge is required in those cases. in those cases and in other >cases where specific knowledge of my infrastructure is not necessary to >determine that the traffic would be "not welcome", then it ought not be sent. > >> > smurf, ddos in general, and spam also classify well by this criteria. it >> >> Smurf and DDOS attacks are precisely that - attacks. They are >> intentionally initiated for the purpose of disrupting infrastructure or >> service. They are illegal. > >in some places, they are illegal. in all places, they are "unwelcome." since >a sender of this (or any) traffic may not know the laws in force at the place >where the recipient host resides, the broader standard of "unwelcome" is more >widely applicable than the narrow standard of "illegal." > >of course, illegal things ought also not be done. but that'd be a new thread. >

1 0

Re: How worried is too worried? Plus, a Global Crossing Story.
by Christopher Wolff 26 Oct '01

26 Oct '01

James, As someone recently said, cmd.exe and root.exe are my two top URL's haha Actually I have a NBAR list on my border routers that handle those extremely well. ---------- Original Message ---------------------------------- From: James Thomason <james(a)divide.org> Date: Thu, 25 Oct 2001 23:56:03 -0700 (PDT) > > >Perhaps you can speak with your friends at Global Crossing, and have >filters placed on your upstream routers to prevent stray "DDOS attacks >from Digital Island". > >Just curious, but aren't you a little more concerned about all of those >"GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../ >winnt/system32/cmd.exe?/c+dirHTTP/1.0" requests than a few ICMP datagrams >from Digital Island? > >Regards, >James > >On Thu, 25 Oct 2001, Christopher Wolff wrote: >> >> I truely enjoyed the wide range of reponses to my Digital Island post. Everything from DI is perfectly justified to 'tell DI to stick it' haha. >> >> I certainly do not run the largest ISP, nor the smallest, but my small company is managing customer connectivity on both coasts of the continental US. My customers know me as the one that cares about their network infrastructure and can answer most questions quickly. I enjoy offering personal service. >> >> I also take pride in managing my network well. I know, for the most part, what kinds of traffic are passing through my network. This helps me take a proactive stance to issues before they become my customers' business impediments. >> >> Therefore, I have to respectfully take exception to the opinion of "Welcome to the Internet, there's nothing you can do, just don't worry about 441 packets." >> >> I partner with companies that share my view of network management. Recently I had an issue with a customer that was claiming poor throughput. Global crossing did everything in their power to analyze their network, my network, and my customers server farm. Although this turned out to be a TCP/IP tuning issue on the particular host, Global Crossing did not charge me a premium for investigating this issue. >> >> Throughout this resolution, Global Crossing earned my respect and confidence that I am *partnered* with a vendor instead of just buying bandwidth from them. >> >> Just my $0.02, >> >> Christopher J. Wolff, VP, CTO >> Broadband Laboratories >> >> > >

1 0

uunet/packbell problems in the bay area
by Barb Dijker 26 Oct '01

26 Oct '01

Does anyone know the real story about a major outage in the bay area? For example, 131.106/16 is off the map and has been since Wed. ETR? ...Barb

3 2

Internet Bigs Behind Website Rating System
by redhead＠freebsd.redbird.com 26 Oct '01

26 Oct '01

Greetings from 1010wins.com! Reid Fishler recommends you check out this story from 1010 WINS: Internet Bigs Behind Website Rating System http://1010wins.com/StoryFolder/story_567928876_html

1 0

MIT network measurement probes
by David G. Andersen 25 Oct '01

25 Oct '01

Given the current thread about unwanted network probe traffic, I figured it would be a good idea to pre-announce this and let people have a chance to put their netblocks on a deny list in advance, if they so desire. (Note: We'd really appreciate it if you'd let our probes go through! It's an important part of some of the research we're doing). We're running some traceroutes and pings to observe the end-to-end reachability of sites around the times of BGP route changes. This means that if you have a stable network, you probably won't see too many probes from us, but if you flap all the time, you'll see up to a few probes per hour. (One probe == one traceroute). The probes are extremely low-bandwidth and as non-invasive as we can make them, but if you'd like to be put on an exclusion list for this and any other probing experiments our research group runs, please send mail to: mon-request(a)nms.lcs.mit.edu Include all of the netblocks that you'd like excluded, preferably like: 18.31.0.0/24 Thanks, -Dave Andersen -- work: dga(a)lcs.mit.edu me: dga(a)pobox.com MIT Laboratory for Computer Science http://www.angio.net/

1 0

Re: Fwd: Re: Digital Island sponsors DoS attempt?
by JC Dill 25 Oct '01

25 Oct '01

On 08:10 PM 10/25/2001 -0500, Andy Walden wrote: >On Thu, 25 Oct 2001, JC Dill wrote: > >> >> <cue twilight zone music> >> >> This is the story of a network who didn't learn the lesson of above.net vs >> orbs. >> >> </music> > >I may not have the whole story, but I don't believe above.net had much to >do with the demise of ORBS. Some in country lawsuit did. Above.net's blocking of ORBS led to fewer and fewer networks using ORBS and IMHO it contributed to the weakness that allowed the lawsuit to happen and thrive. If ORBS had been a stronger service with more users, they might have done things differently before or during the lawsuit. What happens to Digital Island if networks (especially large networks) start blocking them because they won't stop repeatedly scanning when asked? Can it do them *any* good? jc

4 3

Four Arrested in Pedophile Sting
by redhead＠freebsd.redbird.com 25 Oct '01

25 Oct '01

Greetings from 1010wins.com! Reid Fishler recommends you check out this story from 1010 WINS: Four Arrested in Pedophile Sting http://1010wins.com/StoryFolder/story_280775307_html Message from Reid Fishler: If everyone sent out "feelers" we would all have more of these articles.

1 0

Re: Digital Island sponsors DoS attempt?
by Bandy Rush 25 Oct '01

25 Oct '01

Not everyone would have oc3's, since sometimes gear that terminates oc3's gets locked in NON-CONFORM. /br >From: Reid Fishler <redhead(a)freebsd.redbird.com> >Subject: Re: Digital Island sponsors DoS attempt? > >If everyone sent out "feelers" we would all have >OC3's just to accept the >feelers...forget customers. > >Reid Fishler >Lightning.net __________________________________________________ Do You Yahoo!? Make a great connection at Yahoo! Personals. http://personals.yahoo.com

1 0

Re: Fwd: Re: Digital Island sponsors DoS attempt?
by Jason Forester 25 Oct '01

25 Oct '01

(apologies for the slow reply, as I read nanog via the archives updated once/hour). Of course we will honor requests to stop. As Joe said, 400 packets in two hours is not very much traffic. The end result of the measurements is improved service to people who use the Footprint service, which includes anyone who downloads files from Microsoft or views their website (in other words, much of the internet, including people at bblabs.com) I encourage anyone who wishes the requests to stop (with the possible consequence of reduced performance for their clients) to contact abuse(a)digisle.net with your IP range. Apologies for any inconvenience that the packets may have caused. BBlabs /24 has been added to our exclude list. - jason -----Original Message----- From: Dave Stewart [mailto:dbs@ntrnet.net] Sent: Thursday, October 25, 2001 3:14 PM To: Wojtek Zlobicki; nanog(a)merit.edu Subject: Re: Fwd: Re: Digital Island sponsors DoS attempt? At 08:58 PM 10/25/2001, Wojtek Zlobicki wrote: >excessive. Why should I have to waste processor cycles to keep these guys >out. You shouldn't have to. But they don't seem to honor requests to stop. -- Jason Forester jasonf(a)digisle.net Network Performance Engineer Digital Island

1 0