October 2001 - Test - lists.nanog.org

ICANN's new role: It's about keeping people from being killed by terrorist plots hatched over the net says Mike Roberts
by Gordon Cook 27 Oct '01

27 Oct '01

http://atlargestudy.org/forum_archive/msg01113.shtml With apologies to the non-US members of this list, I'd like to make some comments that are inevitably US-centric. Today marked a watershed day in the history of the Internet. In some sense, the real date was September 11, when the leadership role of the United States in world peace, in economic development, and in technology innovation was challenged by a group of determined religious fanatics using our own technology on us to cause the death of thousands of innocent people. But the legal date between the "old" Internet and the "new Internet was today, October 26, 2001,when President George Bush signed the anti-terrorism bill that was passed by the upper house of Congress yesterday with one dissenting vote. This legislation brings the Internet and its developers, providers and users directly into the new war on terrorism. It extends extensive new power to law enforcement to find, capture, and punish those who use the network for terrorism or other criminal activity. It removes the previous barriers between foreign and domestic anti-terrorism investigations and establishes the principle that whoever you are, wherever you are, if you use the net for terrorism, you are in the sights of the FBI, the CIA, the NSA and their foreign counterparts. In the New York Times this morning, under the heading "We are All Alone," widely respected columnist Tom Friedman said, "Focus instead on the firemen who rushed into the trade center towers without asking, 'How much?' Focus on the thousands of U.S. reservists who have left their jobs and families to go fight in Afghanistan without asking, 'What's in it for me?' Unlike the free-riders in our coalition, these young Americans know that September 11 is our holy day - the first day in a just war to preserve our free, multi-religious, democratic society. And I don't really care if that war coincides with Ramadan, Christmas, Hanukkah, or the Buddha's birthday - the most respectful and spiritual thing we can do now is fight it until justice is done." After a week of tough fighting in Afghanistan where the battle is rapidly deteriorating to the same "take no prisoners" ethic that prevailed on September 11, the same week that professionally prepared anthrax kept showing up in new places everyday on the U.S. east coast and killed two postal workers, there is a determined and deadly resolve to follow the Friedman advice. A resolve that will affect many if not most institutions, among them ICANN. It's different now for ICANN. What started out as your typical ritual White House privatization effort; one that parroted the young Clintonites' "Agenda for Action" of 1993; the Al Gore "Information Superhighway" speech; that provided a last hurrah for Clinton advisor Magaziner at the end of the second term. A sly political move that solved, or maybe solved, the National Science Foundation's honest mistake in giving Network Solutions and SAIC a billion dollar monopoly. That is not the ICANN of post-Sept 11. It's different now. It's not world government because national governments are evil; it's not Internet governance because national laws are unjust; it's not a response to some abstract imagining of the global popular will; it's not solving poverty, famine, infanticide, drug abuse and political oppression in the DNS. It's serious. It's first things first. It's about keeping people from being killed by terrorist plots hatched over the net. All of a sudden it matters that you know what you are talking about. If you are an Internet engineer, what about nailing down the RFC's needed for secure new functionality in the DNS? If you are a root server host organization CEO, all of a sudden being a volunteer in Jon Postel's army takes on new meaning. If you're the manager of a top level domain name registry, it's not a pc in a closet time anymore. Important people are watching, people who have the ability to nationalize you overnight if you're not carrying your weight in making the Internet more secure. The Japanese government and the United States government are sending cabinet level officers to speak at the November ICANN meeting about how serious this really is. So what does this have to do with At Large? First, don't expect to get the attention of the study committee, your fellow stakeholders in ICANN, the dedicated members of the Board, or the governments whose sanction makes this privatization effort possible, with a continuation of the shallow rhetoric that has characterized the postings on this list. Second, think seriously about constructive improvements in the recommendations of the ALSC. Nobody cares that you don't like a particular recommendation, they want to know whether you have a better idea, an idea that is good enough to gather the support of a lot of other interested parties that may not share your individual political or social or economic background but are nevertheless interested in the future welfare of ICANN. Third, be prepared to compromise your goals in the interests of forging an At Large organization that contributes to an ICANN that is going to operate in a far different environment than its founders envisaged. The study committee has worked hard. It doesn't deserve the abuse it has received on this list. The several points of the action plan are reasonable, centrist, and provide a basis for moving forward. They deserve your support. - Mike Roberts -- ======================================================== The COOK Report on Internet, 431 Greenway Ave, Ewing, NJ 08618 USA (609) 882-2572 (phone & fax) cook(a)cookreport.com Go to http://cookreport.com for info on new features, updated mission statement, contents of Dec 2001 issue, subscription info and prices at http://cookreport.com/subscriptions.shtml -- summary of content for nearly 10 years at http://cookreport.com/past_issues.shtml

1 0

EXAMPLE: ### xxx Canada detected a penetration attempt from 209.123.x.229. Incident# xxxx
by Alex Rubenstein 27 Oct '01

27 Oct '01

Pursuant to my previous post, I just rec'd this. Not exactly the same, but very similar. Kind of my point; SO WHAT THAT THIS PERSON WAS SCANNED? Is scanning actually an illegal activity? Was anything actually hacked, cracked, or 0wn3d? It's an absurd waste of resources to be emailed by automagic systems every time someone sends a stray packet. -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net -- ---------- Forwarded message ---------- Date: Fri, 26 Oct 2001 04:50:27 -0600 (MDT) From: Super-User <root(a)xx.xx.net> To: "dnsadmin(a)NAC.NET" <dnsadmin(a)NAC.NET> Subject: ### xxx Canada detected a penetration attempt from 209.123.x.229. Incident# xxxx ### This email was generated by so-and-so Canada's network intrusion detection system. Please forward to your Internet security personnel if you are not the appropriate person to receive this notice. so-and-so Canada, located in Calgary, Alberta Canada, wishes to inform you that we experienced a probe or scan from your IP space. LOGGED INFORMATION: -------------------------- Source: 209.123.x.229 Destination: Host-x.x.19.254 Date: 26Oct2001 Time: 4:50:23 (Local Calgary Time GMT-7) Service/Protocol: http -------------------------- This notification has been sent to: alex(a)NAC.NET dnsadmin(a)NAC.NET abuse(a)NAC.NET Because we view this activity as possible intent to breach security, we ask you to review your logs and take appropriate action against the offending party responsible for this suspicious activity. Please respond to xx(a)xx.net for any issues concerning this. You may also visit our Intrusion Detection Information website at: http://x.x.19.11/intrusion_detection Thank you. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Jim bleh Senior Unix Network Analyst xxx Canada Calgary, AB Canada (403) xxx-yyyy

9 9

RE: 12000 ACL issue
by Rubens Kuhl Jr. 27 Oct '01

27 Oct '01

Why do you think 6500/7600 doesn't have the required performance ? 30 Mpps Sup 2 with fabric-enabled line-cards can perform incredibly well... Having FlexWAN and other non-fabric line-cards will slow down to 15 Mpps, which is usually enough. VLAN L3 interfaces are required only on CatOS (which is today required by POS modules, unfortunately), but not on Supervisor IOS. Rubens Kuhl Jr. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Pete Kruckenberg Sent: Friday, October 19, 2001 2:20 PM To: Mikael Abrahamsson Cc: nanog(a)merit.edu Subject: Re: 12000 ACL issue On Fri, 19 Oct 2001, Mikael Abrahamsson wrote: > I guess I cannot use the GSR as a serious GigE platform, > and now seeing the NTE prices on 10GE for the GSR and > the timeframe it's going to be available, the GSR is not > a viable 10GE platform either. I've been trying to figure out the same thing, while there are several other vendors very strong in L3 GigE, Cisco's strategy (if there is one) appears to be twine and bailing wire. 6500/7600 doesn't have the performance, and VLAN L3 interfaces are just too non-intuitive for me. GSR price/performance and availability is so dismal compared to other vendors, I am willing to bet on someone else and deal with any platform immaturity. Can't say my experience with GSR is so great, either, as far as stability, reliability, etc goes. Reminds me of the GFR, the number of times I have to reboot/reload... Pete.

2 2

Re: Fwd: Re: Digital Island sponsors DoS attempt?
by Paul Vixie 27 Oct '01

27 Oct '01

> 'course, a nice ACL at the borders reminds 'em who your network actually > belongs to well, be careful with your acl's, because if you accidently disrupt nonabusive traffic as a side effect of protecting your network from abuse, you'll shortly be hearing complaints from EFF about how you've disenfranchised said nonabusers.

2 1

FORGED EMAIL POSTED TO NANOG
by Reid B. Fishler 27 Oct '01

27 Oct '01

Hi all- Someone is having fun tonight, getting 1010WINS, a local radio stations web site to send mail as me to nanog: Received: from mail.cbsig.net (mail32.nyc01.cbsig.net [63.240.57.32]) by segue.merit.edu (Postfix) with SMTP id 441835DD8F for <nanog(a)merit.edu>; Thu, 25 Oct 2001 23:16:14 -0400 (EDT) Received: (qmail 7985 invoked from network); 26 Oct 2001 03:16:13 -0000 Received: from web145.nyc01.cbsig.net (63.240.56.145) by mail02.cbsig.net with SMTP; 26 Oct 2001 03:16:13 -0000 1010WINS is a CBS owned station, and as you can see this email came from cbsig.net, which is NOT me. Can the mailing list program be fooled by sending mail from a web program like this? Perhaps this should be looked at. Anyhow, I just wanted to mention I did NOT send this email. Reid Fishler Lightning.net

2 1

Re: Pinging Yahoo! (WAS: Getting hacked by Digital Isle?)
by Patrick W. Gilmore 27 Oct '01

27 Oct '01

At 10:09 PM 10/26/2001 -0400, mike harrison wrote: >Now, here's a real issue, many of us probably have similiar systems >that ping upstream connections and page/alert/log when there are >problems. My 'watcher' could also grab a web page (checking port 80) >or do other tests, but I have always assumed that the ping was the least >amount of traffic easily and reliably sent to check connectivity. > >Whats the best way to monitor upstream connectivity for this purpose? Personally, I do not see anything wrong with pinging your upstream. You PAY them, they will take any and all traffic you send them (unless otherwise stated in something like an AUP). Ping away. Of course, that leaves the question as to whether your upstream can get to the rest of the world.... -- TTFN, patrick

1 0

Physical diversity in a meshed Frame Relay network
by JC Dill 27 Oct '01

27 Oct '01

I'm in the process of spec'ing out a meshed Frame Relay network and would like to have as much physical diversity in the mesh as possible. The plan is to have 2 or more FR lines into each location, running in separate bundles, preferably in separate conduits and thru separate paths back to the CO, and then have each FR line terminated on a different switch. I'd love suggestions on how to actually achieve this. Are there any special terms to use to specify this? Is there any way to determine if we are actually *getting* it, if it's so specified? Thanks! jc (please don't wander off into discussions of "why FR?" as this has already been decided)

2 1

Does 'the good of the net' still exist? Yes? Maybe you can help it out...
by Ben Ryan 27 Oct '01

27 Oct '01

I think this is within the broad spectrum of NANOG's charter. Central resources like this are a dying breed, hopefully there's someone from the tech community who is in a position to help/host/etc... maybe someone's out there who doesn't have a bean-counter watching over their shoulder and can recognize value beyond current share price... http://www.faqs.org/ http://www.faqs.org/save_faqs-org.html thanks for your time, i have no personal interest in this beyond supporting the efforts of people trying to maintain the 'spirit' that brought this whole thing together. Pity much of the corp's who survive via global IP forget where the net came from and to whom they owe gratitude for putting in the effort to make it what it is today... cheers ben ________.-~-.________ Ben Ryan, MCP Network Engineer Lansys Technologies Bendigo, Victoria Australia Phone +61-[0]417 502061 email: ben(a)bssc.edu.au URL: http://thrasher.impulse.net.au/index.htm

1 0

Re: FBI is at it again
by herb＠tomobiki.urusei.net 27 Oct '01

27 Oct '01

Forwardee message: > > Per the following article: = > http://www.foxnews.com/story/0,2933,37203,00.html it appears as if the = > FBI now wants to route ALL Internet traffic through it's central = > servers!!!! > > What gall!! What nerve!!!! > > Now, for all of you who said, "Hey, I'm not doing anything wrong, let = > the FBI monitor what it wants to." can go shove hot spikes up your nose. > > I don't think the FBI really wants to control the Internet, they want to = > destabilize it. As tyranny approaches the only thing more dangerous = > than an armed populace is an informed one. If they can monitor all the = > traffic, they can certainly control it. > > The ISP's (whatever those are) need to collectively tell the FBI to go = > jump off a bridge. Information campaigns need to be sent to the = > customers to alert them of the potential loss of civil liberties. > > I'm gonna stop before I say something that will get me arrested. > > Regards, > > Larry Diffey Here's an idea: Shove it at them! If they want to have a running log of everything that goes on in the 'Net, let them try to keep up. I hope they have a lot of solid state disks... /herb

1 0

The Cidr Report
by CIDR Report 27 Oct '01

27 Oct '01

This is an auto-generated mail on Fri Oct 26 23:00:00 PDT 2001 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. NEW: Check http://www.employees.org/~tbates/cidr-report-region.html for the regional version of this report. NEW: Check http://www.employees.org/~tbates/autnums.html for a complete list of autonomous system number to name mappings as used by the CIDR-Report. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to GX Networks for giving me access to their routing tables once a day. Please send any comments about this report directly to CIDR Report <cidr-report(a)cisco.com>. ------------------------------------------------------------------------------ CIDR REPORT for 26Oct01 0) General Status Table History ------------- Date Prefixes 191001 104997 201001 104988 211001 104985 221001 105173 231001 105209 241001 104135 251001 103926 261001 104244 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 8804 Number of ASes announcing only one prefix: 3995 (3995 cidr, 0 classful) Largest number of cidr routes: 846 announced by AS701 Largest number of classful routes: 0 announced by 1) Gains by aggregating at the origin AS level --- 26Oct01 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS1221 1223 940 283 23.1% Telstra Pty Ltd AS4151 298 164 134 45.0% USDA AS13999 136 9 127 93.4% Mega Cable S.A. de C.V. AS16473 196 75 121 61.7% Bell South AS4293 364 257 107 29.4% Cable & Wireless USA AS2048 215 116 99 46.0% State of Louisiana AS271 158 71 87 55.1% University of British Columbia AS4755 215 133 82 38.1% Videsh Sanchar Nigam Ltd. Autonom AS1239 476 400 76 16.0% Sprint AS12302 106 35 71 67.0% MobiFon S.A. AS17557 138 71 67 48.6% Pakistan Telecom AS4200 131 66 65 49.6% Apex Global Information Services, AS3464 161 96 65 40.4% Alabama SuperComputer Network AS19632 72 7 65 90.3% Metropolis Intercom S.A. AS16758 63 6 57 90.5% IKON Office Solutions AS209 304 249 55 18.1% Qwest AS226 144 91 53 36.8% Los Nettos AS4323 273 221 52 19.0% Time Warner Communications, Inc. AS3908 298 247 51 17.1% Supernet, Inc. AS17561 111 60 51 45.9% Internet service provision to Wes AS376 121 73 48 39.7% Reseau Interordinateurs Scientiqu AS10620 69 21 48 69.6% TVCABLE BOGOTA AS1 517 469 48 9.3% BBN Planet AS16814 65 18 47 72.3% NSS, S.A. AS15288 71 24 47 66.2% Alcanet International NA AS15290 247 201 46 18.6% AT&T Canada IES AS2652 129 85 44 34.1% Government Telecommunications and AS10292 70 27 43 61.4% TELECOMMUNICATIONS OF JAMAICA AS5416 51 9 42 82.4% BATELCO-BH AS5103 76 34 42 55.3% Ameritech Advanced Data Services, For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0