November 2001 - Test - lists.nanog.org

ACLs / Filter Lists - Best Practices
by John McBrayne 30 Nov '01

30 Nov '01

Is anyone aware of any current "best practices" related to the recommended set of filtering rules (Cisco ACL lists or Juniper filter sets) for reasons of Security, statistics collection, DoS attack analysis/prevention, etc.? I'm curious to see if there are any such recommendations for Tier 1/Tier 2 backbone routers, peering points, etc., as opposed to CPE terminations or Enterprise/LAN equipment recommendations. Actual config file examples would be great, if they exist. Thanks; ..john

11 11

Exodus assimilated by C&W
by Dan Hollis 30 Nov '01

30 Nov '01

After assimilating more than they could handle, exodus gets assimilated themselves... http://biz.yahoo.com/prnews/011130/sff021_1.html -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

1 0

Re: bgp geopolitical analysis (warning: zero operational content. or so.)
by Hank Nussbacher 29 Nov '01

29 Nov '01

On Thu, 29 Nov 2001, David Williamson wrote: > On Thu, Nov 29, 2001 at 09:33:05AM +0200, Hank Nussbacher wrote: > > ZA has the 3rd highest prefix count at 2700.Why does South Africa have > > such a high prefix count? > > I thought it might be interesting to look at the ratio of prefixes > to ASes.While some ASes may have a large number of ip allocations, > and hence a need for more prefixes to be announced, most have rather few > prefixes that need to be announced.On the other hand, as we all know, > many ASes announce far more prefixes than necessary.Here's the top few > in the list when sorted by ratio of prefixes to ASes: > > country prefixes/ASes > ZA 77.22857143 Something in ZA looks skewed. Can anyone shed light as to why ZA has so many small prefixes (even with lots of users)? Lack of CIDR? Poor allocation methods? Clueless ISPs? Thanks, Hank > PK 38.75 > IN 30.83333333 > AU 27.6713615 > CL 24.25 > FI 22.68181818 > CA 22.23012552 > PR 21.66666667 > EC 21.66666667 > NZ 21.16129032 > > I've removed countries with fewer than 100 prefixes, since they have > nearly meaningless ratios.The US is in the 11 range, and ?? comes in > down around 9. > > -David > Hank Nussbacher

1 0

OT: Secret email?!
by Joe Blanchard 29 Nov '01

29 Nov '01

Greetings all I know this might have been brought up before so please disregard if so. Thought it might be of interest to some. While looking for ways to indicate that nimda/codered ect was pushed to a client within my network, I tripped across something completely unrelated, but interesting. It seems these email clients that utilize html formating also send out information unknowingly. I know nothing new, but heres the senario. A spam email arrives, client opens/previews the email and its pretty gifs/jpgs ect, while at the bottom a link is retrieving what looks like a logo. Example: <a href="http://www.em5000.com"><img src="http://www.em5000.com/counter.php?client=newhorizons&email=myemail@addy .com&msgid=281101000" width="109" height="16" border="0" alt="em5000.com"></a> What it does in fact is send information to a host (from the firewall's view): > 12:54:01: %PIX-5-304001: 10.1.1.10 Accessed URL > 66.77.58.92:/counter.php?client=newhorizons&email=myemail@domain.com&msgid > =281101000 > (from the host's view): GET /counter.php?client=newhorizons&email=myemail(a)domain.com&msgid=281101000 HTTP/1.1 which in turn (I suppose) places my email address into a database thats used for spaming. i.e. verifying that my email address is valid. While watching for this behavior, I saw about 10 other nodes/users do this, none of which knew the information had been sent out. Kind of sneaky if you ask me. Cheers -Joe

2 1

Re: OT: Secret email?!
by Steven M. Bellovin 29 Nov '01

29 Nov '01

In message <E9BBE0941932D511934C0002A52CDB4E0127F6B2(a)sj-exchange.wyse.com>, Joe Blanchard writes: > >Greetings all > >I know this might have been brought up before so please disregard if > so. Thought it might be of interest to some. > > While looking for ways to indicate that nimda/codered ect was >pushed to a client within my network, I tripped across something >completely unrelated, but interesting. > >It seems these email clients that utilize html formating also >send out information unknowingly. I know nothing new, but heres >the senario. A spam email arrives, client opens/previews the email >and its pretty gifs/jpgs ect, while at the bottom a link is retrieving >what looks like a logo. Example: > ><a href="http://www.em5000.com"><img >src="http://www.em5000.com/counter.php?client=newhorizons&email=myemail@addy >.com&msgid=281101000" width="109" height="16" border="0" >alt="em5000.com"></a> > >What it does in fact is send information to a host >(from the firewall's view): >> 12:54:01: %PIX-5-304001: 10.1.1.10 Accessed URL >> 66.77.58.92:/counter.php?client=newhorizons&email=myemail@domain.com&msgid >> =281101000 >> >(from the host's view): >GET /counter.php?client=newhorizons&email=myemail(a)domain.com&msgid=281101000 >HTTP/1.1 > >which in turn (I suppose) places my email address into a database thats used > >for spaming. i.e. verifying that my email address is valid. While watching >for this behavior, I saw about 10 other nodes/users do this, none of which >knew the information had been sent out. Kind of sneaky if you ask me. Yup -- that's why I turn off images on those rare occasions that I bother to read html email. --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com

1 0

RE: Followup British Telecom outage reason
by Youse, Chuck 29 Nov '01

29 Nov '01

You'll forgive me for being cynical here, but I seriously doubt that any Linux-derived operating systems could truly qualify as 'real-time'. To meet the requirements for an RTOS, Linux would have to be so heavily mutated that it would no longer be Linux. Cheers Chuck -----Original Message----- From: Patrick Greenwell To: Christian Kuhtz Cc: Alex Bligh; Paul Vixie; nanog(a)merit.edu Sent: 29/11/01 07:49 Subject: RE: Followup British Telecom outage reason On Wed, 28 Nov 2001, Christian Kuhtz wrote: > > > I guess some time someone will realize routers are both > > hardware, and software, and shock horror both, if done > > well, can actually add value. [hint & example: compare the > > scheduler on, say, Linux/FreeBSD, Windows 95 (sic), > > and your favourite router OS (*); pay particular attention > > to suitability for running realtime, or near realtime tasks, > > where such tasks may occasionally crash or overrun their > > expected timeslice; note how the best OS amongst the > > bunch for this aint exactly great]. > > > > (*) results may vary according to personal choice here. > > Don't use a non-realtime OS for something that you expect realtime or > near-realtime OS functionality. There are specific systems to address these > kinds of needs with rather complicated scheduling mechanism to accomodate > such requirements in a sensible manner. > > Is IOS a realtime operating system? No. Are any of the other listed OS > realtime operating systems? No. Actually there are multiple Linux-based RTOSes.

3 2

RE: bgp geopolitical analysis (warning: zero operational content. or so.)
by Pickett, Mclean 29 Nov '01

29 Nov '01

How about mapping BGP info to Per Capita Income. I imagine you might see a better correlation there. McLean -----Original Message----- From: k claffy [mailto:kc@ipn.caida.org] Sent: Tuesday, November 27, 2001 9:46 PM To: nanog(a)nanog.org Cc: elfcore(a)caida.org Subject: bgp geopolitical analysis (warning: zero operational content. or so.) one of caida's elves (brad) did a cool visualization of demographic measures of Internet resources, stratified by continent with substratification by country (with help of CIA factbook, RouteViews, and NetGeo). http://www.caida.org/analysis/geopolitical/bgp2country/ measures: geographic area, human population, GDP, phones-in-use, ASes, ISPs, prefixes, addresses.... nothing overwhelmingly surprising here but compelling nonetheless (yes, it turns out data can be both) k // things are not what they seem to be, nor are they otherwise. -lankavatara sutra //

4 4

bgp geopolitical analysis (warning: zero operational content. or so.)
by k claffy 29 Nov '01

29 Nov '01

one of caida's elves (brad) did a cool visualization of demographic measures of Internet resources, stratified by continent with substratification by country (with help of CIA factbook, RouteViews, and NetGeo). http://www.caida.org/analysis/geopolitical/bgp2country/ measures: geographic area, human population, GDP, phones-in-use, ASes, ISPs, prefixes, addresses.... nothing overwhelmingly surprising here but compelling nonetheless (yes, it turns out data can be both) k // things are not what they seem to be, nor are they otherwise. -lankavatara sutra //

2 2

Re: Looking for a ping plotting tool for *nix
by Steven M. Bellovin 29 Nov '01

29 Nov '01

In message <009e01c177bc$0df91830$9865fea9@49uzz>, "Mike Moglin" writes: > >http://www.pingplotter.com/download.html > As best I can tell, that's for Windows only. I wish there were a Unix version. >----- Original Message ----- >From: "mike harrison" <meuon(a)highertech.net> >To: "Troy Corbin" <troyc(a)titan.communitech.net> >Cc: <dani-post(a)roisman.com>; <nanog(a)merit.edu> >Sent: Tuesday, November 27, 2001 10:06 PM >Subject: Re: Looking for a ping plotting tool for *nix > > >> >> > Sample: >> > http://people.ee.ethz.ch/~oetiker/smokeping/smokeping.cgi >> >> Thanks.. I needed that also. WOW! --Mike- >> >> > > > --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com

3 2

[barney@databus.com: NYTimes.com Article: Engineers Suspect Diesel Fuel in Collapse of 7 World Trade Center]
by Barney Wolff 29 Nov '01

29 Nov '01

I'm sure there will be lessons from this, but not what they will be. Date: Thu, 29 Nov 2001 10:22:20 -0500 (EST) This article from NYTimes.com has been sent to you by barney(a)databus.com. Engineers Suspect Diesel Fuel in Collapse of 7 World Trade Center November 29, 2001 By JAMES GLANZ Engineers and scientists are trying to determine what role diesel fuel, ignited into an uncontrollable fire, had in the collapse of 7 World Trade Center. http://www.nytimes.com/2001/11/29/nyregion/29TOWE.html?ex=1008047340&ei=1&e… -- Barney Wolff "Nonetheless, ease and peace had left this people still curiously tough. They were, if it came to it, difficult to daunt or to kill; and they were, perhaps, so unwearyingly fond of good things not least because they could, when put to it, do without them, and could survive rough handling by grief, foe, or weather in a way that astonished those who did not know them well and looked no further than their bellies and their well-fed faces." J.R.R.T.

1 0