May 2001 - Test - lists.nanog.org

Re: foreign upstarts dare to use their own languages [was: Re: black hat .cn networks]
by Sean Donelan 10 May '01

10 May '01

On Wed, May 09, 2001 at 11:29:23AM -0700, Scott Francis wrote: > On Thu, May 10, 2001 at 12:26:00AM +0800, Adrian Chadd exclaimed: > > The internet has a bunch of technical standards which we loosely > > agree to. There's no law stating "thou shalt speak English if connected > > via BGP4 to thy internet". > > And are _any_ of those technical standards written in a language other than > English? Think about the acronyms we use in network-speak every day - how many > of them stand for phrases in a language other than English? CCITT, and of course the favorite ISO, International Organization for Standardization.

5 4

RE: Abuse notification in Chinese (was:black hat .cn networks)
by Daryl G. Jurbala 09 May '01

09 May '01

GB2312 is working on my system (not on your quoted text, but on the original as it came back to me posted to the list). I know nearly nothing about encoding, so I check with the translator and she confirmed that it was done in that. If that's not working for everyone, somebody give me a better idea of how to post it. Daryl -----Original Message----- From: hardie(a)equinix.com [mailto:hardie@equinix.com] Sent: Wednesday, May 09, 2001 12:22 PM To: Daryl G. Jurbala Cc: nanog(a)merit.edu Subject: Re: Abuse notification in Chinese (was:black hat .cn networks) Daryl, I don't see these as valid hanzi when viewed as GB2312, BIG5, or EUC-TW, the three most common encodings I'm aware of (mainland, Hong Kong, and Taiwan, respectively). Can you indicate what encoding these are in? regards, Ted Hardie > > For what it's worth, here are two pretty generic messages that you can > send, translated into Chinese (In Chinese Simplified -HZ encoding). > > ----- > > Dear <Abusive Autonomous System>, > The following unsolicited email appears either to have originated on > and/or traversed your network, or to have come from a client of yours. > If you simply have an open mail relay, please fix it. > Please look into this. > Regards, > > > è¦ªæ„›çš„ä¸çŸ¥åçš„ç³»çµ±ï¹ > > ã€€ä»¥ä¸‹ä¸æ˜Žä¿¡ä»¶é¡¯ç¤ºå‡ºå®ƒä¾†è‡ªäºŽæˆ–ç™¼é€åˆ°è²´ç¶²çµ¡ï¹æˆ–æ > ˜¯ä¾†æºäºŽè²´ç¶²çµ¡çš„æŸä¸€å®¢å®¢'ç°Ÿï¼¨ç¼›è£Ÿé˜Œ? > open email relayï¹èª¢OEâ‘ºî›æ‹šîŠ? > > è¬è¬! > > > ------ > > Dear <Abusive Autonomous System>, > A system on my network was attacked or compromised by > a system appearing to originate from your network. Below you will > find relevant log entries and other information I have on this issue. > Your immediate attention in resolving this matter is necessary and > appreciated. Regards, > > > è¦ªæ„›çš„ä¸çŸ¥åçš„ç³»çµ±ï¹ > > æˆ‘è˜˜ç¶²çµ¡ç³»çµ±è¢«è²´ç¶²çµ¡ç³»çµ±ä¾µå…¥æˆ–æ˜¯å…¼å®¹ã€‚æˆ‘å·²OEâ‘¾åš > “Pçš„log > entries å’Œå…¶å®ƒä¿¡æ¯åˆ—æ”¾åœ¨ä¸‹é¢ã€‚è‹¥è²´ç¶²èƒ½ç›¡å¿«è§£>Qæ¤ä¸€?-é¡Œï¹æˆ ‘'fOEâ‘·fåˆ†æ„Ÿè¬ã€‚ > > ------ > > Daryl G. Jurbala > Infrastrucutre Manager > Silverchair Science + Commuications > 215.823.5077 > http://www.silverchair.com >

3 2

RE: foreign upstarts dare to use their own languages [was: Re:bla ck hat .cn networks]
by Roeland Meyer 09 May '01

09 May '01

> From: Eric A. Hall [mailto:ehall@ehsco.com] > Sent: Wednesday, May 09, 2001 3:51 PM > > > > Think about the acronyms we use in network-speak every day - how > > > many of them stand for phrases in a language other than English? > > > > CCITT, and of course the favorite ISO, International > Organization for > > Standardization. > > ISO is not an acronym > > http://www.iso.ch/infoe/intro.htm > > Many people will have noticed a seeming lack of > correspondence between the official title when used in full, > International Organization for Standardization, and the > short form, ISO. Shouldn't the acronym be "IOS"? Yes, if > it were an acronym - which it is not. > > In fact, "ISO" is a word, derived from the Greek isos, > meaning "equal", which is the root of the prefix "iso-" that > occurs in a host of terms, such as "isometric" (of equal > measure or dimensions) and "isonomy" (equality of laws, > or of people before the law). > > From "equal" to "standard", the line of thinking that led to > the choice of "ISO" as the name of the organization is easy > to follow. In addition, the name ISO is used around the > world to denote the organization, thus avoiding the > plethora of acronyms resulting from the translation of > "International Organization for Standardization" into the > different national languages of members, e.g. IOS in > English, OIN in French (from Organisation internationale > de normalisation). Whatever the country, the short form of > the Organization's name is always ISO. > > Sounds revisionist but I'll buy it. Revisionist? I'll say ... Mind you that this is from the tail-end of the haze-daze and the memory isn't quite clear. But, when I was writing ISO/OSI protocol stacks (a brain damn-aging activity in [and of] itself), ISO stood for "International Standards Organization". It was an acronym like GNU is an acronym, with multiple connotations and meaning. However, it was ALSO an acronym. This comes from around 83-84 when DOD decided to stop waiting and go with TCP/IP (a hack around layer 6 and 7 politics). > As for CCITT, well, what do you expect. They can't even get > phone numbers > in a common presentation form. :/ I thought the CCITT was folded into the ITU?

1 0

Re: 10 gige experience
by Richard A. Steenbergen 09 May '01

09 May '01

On Wed, May 09, 2001 at 02:03:49PM -0700, Mike Leber wrote: > > > Anybody out there have any experience with 10 gigabit ethernet? > > I'm looking for switches and routers that actually exist (heh, as > opposed to the kind found in marketing literature). I've heard > extreme is shipping 10 gige stuff. Any news when cisco or juniper > will have something? My understanding is that Extreme sent 10gige gear to 8 beta sites. The magic answer on 10gige seems to be saying June/July. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 2

Re: black hat .cn networks
by David Lesher 09 May '01

09 May '01

> China's use of the Internet is skyrocketing. People in China > understand that the common language of the Internet is English, and > they are learning it. The stat I recall? There are more people in China learning English than now speak it world-wide. "The STory of English" - PBS a while back. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

possibly operationally relevant tutorials at sigcomm (ATT research)
by k claffy 09 May '01

09 May '01

even if not, strongly recommend being in same room with folks below for a day mon 27/28 aug 01, all day, UC, San Diego campus k http://www.acm.org/sigs/sigcomm/sigcomm2001/conference_program.html#M2 M2 Traffic Measurement for IP Operations Monday, August 27, 2001 9:00-5:00 Matt Grossglausner and Jennifer Rexford AT&T Labs -- Research; Florham Park, NJ, USA Content: You manage a large IP network. You notice that your connectivity to several peers is degrading rapidly. Is it due to an underprovisioned peering links? Distributed denial-of-service attack? A new peer-to-peer network? A bad routing advertisement? A flash crowd? What are you are going to do about it? Traffic measurement is an essential tool to guide operators of large IP networks in key engineering decisions. This tutorial focuses on measurement techniques and traffic models that provide a comprehensive view of large IP networks, over which the operator has full administrative control. The first part of the tutorial describes the basic tasks involved in operating a large IP network and derives requirements for network measurement. We argue that the very properties responsible for the Internet's success also make it difficult to control and manage. We provide a variety of "real world" anecdotes that illustrate the role of measurements in network operations. In the second part, we give a comprehensive survey of measurement data currently available in IP networks. We present an overview of SNMP/RMON, flow-level measurement, packet monitoring, active measurement, and techniques for collecting routing, configuration, and topology data. We classify these measurements according to their temporal and spatial granularity, their means of collection, and their overhead, and present case studies of how to exploit the measurement data in important operational tasks. The third part of the tutorial discusses complex operational tasks that require combining multiple types of measurement data. First, we describe network tomography, a technique for inferring a traffic matrix from link utilization statistics. Second, we describe how to compute point-to-multipoint traffic demands by combining flow-level measurements with routing table data. Third, we describe a hash-based packet sampling technique for direct observation of the path matrix. We discuss the pros and cons of each technique in detail. Intended audience: Researchers, network architects, and protocol implementors from academia and industry looking for an applied introduction to IP traffic measurement from the viewpoint of a network operator. Speaker's biographies: Matt Grossglauser received his diploma from the Swiss Federal Institute of Technology (EPFL) and his M.Sc. degree from the Georgia Institute of Technology, both in 1994, and his Ph.D. from the University of Paris 6, in 1998. He did most of his thesis work at INRIA Sophia Antipolis, France. He is currently a member of the IP Network Management and Performance Department at AT&T Labs -- Research in Florham Park, New Jersey. His research interests are in network traffic modeling and measurement, resource allocation, network management, and mobile communications. Jennifer Rexford received her B.S.E. degree in electrical engineering at Princeton University in 1991 and her M.S.E. and PhD degrees in electrical engineering and computer science at the University of Michigan in 1993 and 1996, respectively. She is currently a member of technical staff in the IP Network Management and Performance Department at AT&T Labs -- Research in Florham Park, New Jersey. Her research focuses on routing protocols, traffic engineering, and network measurement. Jennifer is co-author (with Balachander Krishnamurthy) of the book "Web Protocols and Practice: HTTP/1.1, Network Protocols, Caching, and Traffic Measurement", published by Addison-Wesley in May 2001. T1 Interdomain Routing and BGP Tuesday, August 28, 2001 9:00-12:30 Timothy G. Griffin AT&T Labs-Research, Florham Park, NJ, USA Content How is IP connectivity maintained on the global Internet? How do Internet Service Providers (ISPs) exchange routing information? How well is the current routing system working? Can the routing infrastructure continue to scale as the Internet grows? The tutorial will survey the basics of interdomain routing. It will cover what an autonomous system is, how IP addresses are assigned and aggregated, and why metric-based routing protocols, such as RIP and OSPF, do not meet the demands of scale and policy flexibility required for interdomain routing. Today, interdomain routing is accomplished with the Border Gateway Protocol (BGP). The core of the tutorial will be an in-depth look at what BGP is, how it works, and how it is configured by ISPs. The tutorial will also survey some of the significant challenges currently arising in interdomain routing. These include rapid growth in BGP routing information, delay in BGP convergence times, and complexity of analyzing the interaction of autonomously defined routing policies. Intended audience: Anyone who wants to know how connectivity is maintained in the global Internet. Attendees are expected to have some familiarity with basic IP addressing and forwarding. Some understanding of routing with interior gateway protocols, such as RIP or OSPF, will be helpful but not required. Speaker's biography: Tim Griffin is a member of the IP Network Management and Performance Department at AT&T Labs in Florham Park, New Jersey. He received his undergraduate degree in mathematics from the University of Wisconsin, Madison, his MS and Ph.D. degrees in Computer Science from Cornell University. Before joining AT&T Labs he was a member of technical staff at Bell Laboratories. His current research interests iinterdomain routing and the analysis and modeling of BGP.

1 0

Re: Network Simulation and Measurement Software
by Richard A. Steenbergen 09 May '01

09 May '01

On Wed, May 09, 2001 at 05:18:20PM -0400, Nathan Stratton wrote: > > On 9 May 2001, Sean Donelan wrote: > > > I hate html mail. > > > > 18 months ago, I asked about network modeling software and everyone > > pointed me to WANDL. It is an interesting package. Everyone had > > their set of gripes with it, but it seemed to be the best available. > > I changed jobs shortly afterwards, and didn't get to do much with it. > > Just use pine, text is always safe. Unless that text is exploiting one of the dozens of ways to own pine. Next. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Re: Network Simulation and Measurement Software
by Sean Donelan 09 May '01

09 May '01

I hate html mail. 18 months ago, I asked about network modeling software and everyone pointed me to WANDL. It is an interesting package. Everyone had their set of gripes with it, but it seemed to be the best available. I changed jobs shortly afterwards, and didn't get to do much with it. On Wed, 09 May 2001, "Wojtek Zlobicki" wrote: I need to evaluate what is out there in regards to > network simulation and modeling software.  I am especially interested in > freeware that will run on Linux.  However, just about any application will > do.   I will compile a list of all the responses I get and will be > publishing a web page with this info (part of a larger research project I am > doing).  I need software that will allow me to see how different > applications react to different network/protocols conditions.  I would like > to create a system that would allow any application to be tested in a controlled > environment

3 2

RE: Instant chats and central servers
by Richard A. Steenbergen 09 May '01

09 May '01

On Wed, May 09, 2001 at 10:35:17AM -0700, David Schwartz wrote: > > I don't see how that can be. A P3-600 can RC4 encrypt over > 60MB/sec in 64 byte blocks. That figure drops to only 45MB/sec in 8 > byte blocks. This is a slight overstatement because cache > effectiveness is increased by repeatedly encrypting the same stream. What crack are you smoking? RC4 is a stream cipher, it does not get applied to block sizes of any kind. Perhaps this shows the performance of the surrounding components feeding data to be encrypted in someone's benchmark, but it does not relate to the algorithm itself. Stream ciphers are just stateful pseudo random number generator, with the results being XOR'd into the plaintext on a byte by byte basis. This makes them extremely fast and light weight, but as WEP has recently demonstrated for us very vulnerable to "attack of the poorly implemented crypto". Don't get me wrong I rather like RC4, I can write it off the top of my head in 30 seconds, encrypt data at very high speeds, and it provides a good level of security IF implemented correctly. The problem is I don't trust it in other people's implementations unless I've double-checked it myself, because it's real easy to mess up. > If a chat server with a P3-733 has a throughput of, say, 8MB/sec > out and 3MB/sec in, encryption on all that traffic would eat less than > 15% of the CPU. There would be some memory usage to store all the > encryption/decryption state information but memory is cheap. That's a lot of chat! But the issue isn't really encryption of the bulk data, even after you throw in good IV's, message authentication codes, etc. The real issue is key exchange. > If you used a dual processor machine and separated the actual > chat layer from the I/O layer, you could put the encryption in the I/O > layer. This is actually not that terribly hard to hack into Ircd. Terribly hard to hack, no. Terrible hack, yes. > PS: If you use public-key encryption to do the initial key > exchange, that can be significant if you have a high rate of > connection establishment. But if you assume that everybody has a > password already known to both them and the chat server, it's not a > problem. And so unbelievably easy to defeat you might as well not have bothered. Bad crypto is almost worse then no crypto because it gives you a false sense of security. First think about what you're actually wanting to protect with crypto. Is it the communication between the server and user, so that noone can intercept (OR inject!) data? It certainly isn't a good thing when someone can compromise a machine local to you and intercept/inject commands into your irc session, as many efnet opers seem to have found out. It also isn't a good thing when you can compromise a machine local to a server, and intercept/inject commands which can destroy the entire structure of the chat network. For example, it is easy enough to capture the SJOIN flood of a server synchronizing to the network (which itself is an archiac design, but irc is good at those), then hijack the tcp session and play back that list with slight modifications so that you blast the entire state database on all servers and do things like deop every channel on the network, etc. Obviously this is an area where real crypto provides many benefits. Is it for end-to-end users across the network, so people can talk privately without the fear of an unethical server admin (or admins) snooping on their conversations? Sure it's possible to establish a direct client to client tcp connection, but that doesn't scale very well for things like meetings, which IRC would be rather well suited for. If you do not have good key exchange mechanisms in place, none of this can be accomplished, and as we all know public-key type exchanges suck CPU left and right. It may work reasonably well for your company's internal server with 100 people, but it probably wouldn't scale to many thousands or hundreds of thousands of users on public chat networks very well. If you'd like a suggestion on how to give it a shot though, I'd say your best bet is Diffie-Hellman where you can pre-generate your primes on the server, re-use them, and shift the work of random number generation to the individual client. It's not a perfect mutual-exchange, but it puts the ball of security back in the court of the connecting client. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 2

Abuse notification in Chinese (was:black hat .cn networks)
by Daryl G. Jurbala 09 May '01

09 May '01

For what it's worth, here are two pretty generic messages that you can send, translated into Chinese (In Chinese Simplified -HZ encoding). ----- Dear <Abusive Autonomous System>, The following unsolicited email appears either to have originated on and/or traversed your network, or to have come from a client of yours. If you simply have an open mail relay, please fix it. Please look into this. Regards, 親愛的不知名的系統﹐ 　以下不明信件顯示出它來自于或發送到貴網絡﹐或是來源于貴網絡的某一客客'簟Ｈ缛裟阌? open email relay﹐誢OE⑺拚? 謝謝! ------ Dear <Abusive Autonomous System>, A system on my network was attacked or compromised by a system appearing to originate from your network. Below you will find relevant log entries and other information I have on this issue. Your immediate attention in resolving this matter is necessary and appreciated. Regards, 親愛的不知名的系統﹐ 我蘘網絡系統被貴網絡系統侵入或是兼容。我已OE⑾嚓P的log entries 和其它信息列放在下面。若貴網能盡快解>Q此一?-題﹐我'fOE⑷f分感謝。 ------ Daryl G. Jurbala Infrastrucutre Manager Silverchair Science + Commuications 215.823.5077 http://www.silverchair.com

3 2