February 2001 - Test - lists.nanog.org

Re:Update for noc .nl problem..
by CARL P HIRSCH 23 Feb '01

23 Feb '01

I'm curious - how many ISPs hold to this kind of policy of being tight-lipped until subpoenaed? Personally, I'm kind of glad to see this response from @home. I know I would want to see an ISP I used do the same thing if confronted by The Law. Maybe that's just the Bill of Rights lover in me. Having said that, it sucks that they're forcing you to get the lawyers and the cops involved. I'd often prefer to see things handled on an informal basis of professional courtesy. Especially when real damage is done such as in your case. -carl hirsch network analyst sargent & lundy llc ____________________Reply Separator____________________ Subject: Update for noc .nl problem.. Author: owner-nanog-outgoing(a)merit.edu Date: 2/23/01 3:09 PM Spoke to someone from the home.com abuse department... Basic conversation was, We won't give you the information, Untill you subpeona us. Well time to get the lawyers involved. -- Scott Walker scott(a)unspeakable.org Cell 954.444.3408 http://www.unspeakable.org Network/Security Administrator There are two ways to write error-free programs. Only the third one works.

5 5

Update for noc .nl problem..
by Scott Walker 23 Feb '01

23 Feb '01

Spoke to someone from the home.com abuse department... Basic conversation was, We won't give you the information, Untill you subpeona us. Well time to get the lawyers involved. -- Scott Walker scott(a)unspeakable.org Cell 954.444.3408 http://www.unspeakable.org Network/Security Administrator There are two ways to write error-free programs. Only the third one works.

1 0

Re: home.nl NOC contact number.
by Scott Walker 23 Feb '01

23 Feb '01

I all ready tried.... response I got was "Ohh, home.nl, that's a different company completly. So it's not out problem" Me: "Well, can I get the phone number?" Them: "Uhhh, I don't have it... Sorry" Quoting Mr. M <mistrM(a)socal.rr.com>: > > Does anyone happen to have a contact number for home.nl's noc? I need to > > speak with someone there ASAP about a incident that just occured. > > The @home cable network. Why am I not surprised? > > Anyway, if you can find a number for the one in .nl call their US noc for > home.com I'm sure they can get somone that speaks English on the phone for > you. > > > M -- Scott Walker scott(a)unspeakable.org Cell 954.444.3408 http://www.unspeakable.org Network/Security Administrator Life would be so much easier if we could just look at the source code.

2 1

Re: rfc 1918?
by SMcGrath＠dhhs.state.nh.us 23 Feb '01

23 Feb '01

Agreed Valdis, Our upstream's use 1918 addresses internally so that 1918 addresses are constantly bouncing off our filters we have an aggressive egress filter which makes sure no 1918's leak and pollute the internet ;-} and filtering on core routers is a suboptimal solution RFC 1819 addresses (10 points to the person who knows the predecessor) NEED to be filtered at the border IMHO. Scott Valdis.Kletnieks@vt.edu@merit.edu on 02/22/2001 10:14:35 PM Sent by: owner-nanog(a)merit.edu To: Mark Radabaugh <mark(a)amplex.net> cc: North America Network Operators Group Mailing List <nanog(a)merit.edu> Subject: Re: rfc 1918? On Thu, 22 Feb 2001 19:12:14 EST, Mark Radabaugh <mark(a)amplex.net> said: > At our egress points the filters are fairly short -- they allow only traffic > with our IP source addresses to leave. This was my interpretation of the RFC's. Thank you. The rest of the network appreciates you doing your part. > Some in this discussion seem to be saying that we should also filter for RFC1918 > destinations. Am I reading this correctly? That's probably optional. But if you have the router resources to do it. every little bit helps. You probably should filter and log it, to find out why one of your hosts is trying to send to a 1918 address outside your site - if you're not using 1918 space, it shouldn't happen, and if you ARE using it, the packet should have ended up inside your net, not on your border router. In either case, if a packet is trying to leave your net bound for a 1918 destination, something is probably seriously wrong(*). (*) I'll leave ICMP replies from 1918-addressed P2P links out for the moment ;) > I can see that packets destined for RFC1918 addresses will leave our network > (due to default routes) but are promptly dropped at the first BGP speaking > router they encounter. Is it worth the extra router processing time to check > all outgoing packet destinations as well? I can't see where this extra > filtering is worth the trouble. There's 2 main classes of "next router": 1) You don't filter, but it goes to the OTHER end of the link and promptly gets stomped by a fascist filter that refuses to accept any source address that's outside the adddress block that's supposed to be at your end. 2) You don't filter, they don't filter either, because they actually USE 1918 space for their own stuff, so your packets wtih 1918 source addresses and real destination addresses manage to go a LONG way before hitting anything that will stop them (as the original poster showed, the packets could actually *arrive* at the destination, with no way to reply). Remember - this filtering often can't be done on core routers due to performance issues, so if it doesn't get done at the border routers it probably won't happen... Valdis Kletnieks Operating Systems Analyst Virginia Tech

2 1

Re: home.nl NOC contact number.
by Scott Walker 23 Feb '01

23 Feb '01

Someone from the .nl domain got into our database server, and proceeded to delete everything.. I got his ip... So I'm hunting him down... We got backups, but still ... This was a pretty big deal.. Quoting Scott A. McIntyre <scott(a)xs4all.nl>: > Also sprach Scott Walker (scott(a)unspeakable.org) > > > > > Does anyone happen to have a contact number for home.nl's noc? I need to > > speak with someone there ASAP about a incident that just occured. > > > > Sadly, I would not expect much by reply from them. > > Technical Contact: > Andre van Leeuwen > Phone: +31 20 885 5733 > E-mail: andre(a)corp.nl.home.com > > > In theory, is what is in RIPE, however, as I report events to them all > the time, we hear almost nothing. What was the incident, out of > curiosity? > -- Scott Walker scott(a)unspeakable.org Cell 954.444.3408 http://www.unspeakable.org Network/Security Administrator QUOTE OF THE DAY: `

1 0

rfc 1918?
by Chris Davis 23 Feb '01

23 Feb '01

Hello, Does anyone know why I get inbound packets from 10.x.x.x coming from my ISP, UUNet? They're just headed for a webserver, so it's not likely that they're up to no good. This seems to violate rfc 1918. Am I crazy? Feb 22 15:29:48 computerjobs-gw 353094: Feb 22 20:30:10.439 UTC: %SEC-6-IPACCESSLOGP: list 135 denied tcp 10.10.5.18(62438) -> 63.67.217.184(80), 1 packet Feb 22 15:30:02 computerjobs-gw 353095: Feb 22 20:30:24.024 UTC: %SEC-6-IPACCESSLOGP: list 135 denied tcp 10.10.5.18(62440) -> 63.67.217.184(80), 1 packet Feb 22 15:30:06 computerjobs-gw 353096: Feb 22 20:30:28.168 UTC: %SEC-6-IPACCESSLOGP: list 135 denied tcp 10.10.5.18(62455) -> 63.67.217.184(80), 1 packet

11 24

RE: rfc 1918?
by Mark Borchers 23 Feb '01

23 Feb '01

> This is not an issue of paranoia (except for those who actually use > PRIVATE addresses internally and have properly configured > their gateways > to be paranoid about even seeing such packets, let alone > routing them). Unless I'm mistaken, a prime reason for the evolution of RFC 1918 addresses was that it was once common practice for people to help themselves to PUBLIC address space to use on PRIVATE networks. As the world got more connected, these addresses occasionally got leaked and caused address conflicts. Using RFC 1918 addresses prevents conflicts with public/registered space. Obviously the possibility of leakage still exists, but with RFC 1918 the havoc potential is diminished to a mere irritant level. Which is what the incident that started this thread appeared to be.

3 2

Re: rfc 1918?
by Ron Buchalski 23 Feb '01

23 Feb '01

One may argue that, if all your border peers ARE filtering RFC1918 addresses inbound and outbound, they'll take care of your misbehavior. -rb >From: woods(a)weird.com (Greg A. Woods) >Reply-To: woods(a)weird.com (Greg A. Woods) >To: nanog(a)merit.edu (North America Network Operators Group Mailing List) >Subject: Re: rfc 1918? >Date: Fri, 23 Feb 2001 02:55:56 -0500 (EST) <snip> >Can you please try to find at least one even minor technical argument >for not filtering RFC-1918 addresses before you try again to give this idea >any more credit? _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

Re: Choosing a Service/Hosting Provider
by Craig A. Haney 23 Feb '01

23 Feb '01

i sent in a request for beer and gear at 4am wed. morning. i'll call to confirm. -craig

1 0

RE: Choosing a Service/Hosting Provider
by Irwin Lazar 23 Feb '01

23 Feb '01

Our consulting practice spends a lot of time on this very issue. I'd rate the top three things that our customers are looking for from SP's are as follows: - Customer Service - a single point of contact, pro-active network management, and fast provisioning. Poor customer service, IMHO, is the single biggest complaint I hear from our customers about their current service providers - Cost - especially considering market slow-downs - Geographic Availability - being able to provide service where its needed and when its needed, via a single point of contact if partnership arrangements are required. I'd also add financial stability as another concern. Companies are very wary about putting their lifeblood onto a service provider's network when that service provider isn't financially stable. Irwin ----- Irwin Lazar - ilazar(a)tbg.com <mailto:ilazar@tbg.com> Senior Consultant, The Burton Group Office: 703-742-9659 Cell: 703-402-4119 http://www.tbg.com/ "The Ultimate Resource For Network Architects" -----Original Message----- From: Eric Gauthier [mailto:eric@roxanne.org] Sent: Friday, February 23, 2001 11:29 AM To: nanog(a)merit.edu Subject: Choosing a Service/Hosting Provider Hello, I'm pretty sure that this question has been picked to death on this list, but I couldn't find a good thread in the nanog archives. If there is one in there, can someone drop me a pointer off-list? Anyways, here is my question: What should people look for when choosing a service or hosting provider? Thanks. Eric

3 3