September 2001 - Test - lists.nanog.org

RE: Where NAT disenfranchises the end-user ...
by woody weaver 11 Sep '01

11 Sep '01

On Monday, September 10, 2001 10:30 AM, Scott Gifford wrote: >I ask not to drag this discussion on, but because I use NAT for >address conservation and security on a couple networks that I operate, >and am curious if I'd be much better off with something different... What is meant by NAT and firewall? If NAT is limited to simply the act of remapping sockets, then it provides little or no security. A source route that takes the packet to the NAT box and then routes to the target host bypasses NAT security. What I think is generally meant by (outgoing) NAT is 1) A state table is kept that maps outgoing IP flows to masqueraded values 2) Responses to entries in the table are re-mapped to original values and routed inward 3) Responses not in the table are dropped. It is step 3 that provides that stateful filter that provides security. 1 and 2, which comprise NAT, provide no security [except possibly information concealment, which is generally trivial to penetrate]. The problem is that because a NAT box isn't a security device, per se, it does not have the same level of verification (hence trust) as a formal security device. Using a LinkSys NAT device for a home firewall is probably appropriate -- the confidence in the trusted computing base should match the value of the assets being protected. Using that same device for an enterprise is probably not appropriate. If it were "a couple networks that I operate", I'd go ahead and purchase a firewall product, perhaps a Netscreen or something inexpensive. They *are* reviewed as formal security devices, and I would have a much higher level of confidence that the system meets its specifications, as rfc2828 puts it. YMMV. IANAL, although I play a security professional on TV. -- Director, Professional Services pager: 8779583393(a)skytel.net Callisma voice: 510 450 9132 6400 Hollis St cell: 510 593 5849 Emeryville, CA 94608 email: woody.weaver(a)callisma.com

1 0

RE: World Trade Center attack
by Martin, Christian 11 Sep '01

11 Sep '01

7 World Trade Center just went down. This is obscene. -chris > -----Original Message----- > From: Marius Strom [mailto:marius@marius.org] > Sent: Tuesday, September 11, 2001 3:32 PM > To: Joe Shaw > Cc: Marshall Eubanks; Youse, Chuck; 'Nanog@Merit. Edu' > Subject: Re: World Trade Center attack > > > > I am currently able to make LD calls and International calls > (to Norway, > at least) via MCI. > > On Tue, Sep 11, 2001 at 01:16:49PM -0500, Joe Shaw wrote: > > > > > > On Tue, 11 Sep 2001, Marshall Eubanks wrote: > > > > > Both WTC towers are down. My guess is that every person in NYC > > > is calling / being called by their families. The government > > > has been moved to a secure location (probably Mount Thunder.) > > > I cannot get any US news site in my bookmarks. > > > I have heard that cell phone service in DC is down. > > > > Rumor has it (from a reliable source) that there are LD > switch problems > > all over the country with at least one major carrier, not > just NYC right > > now. Attempts to make LD calls to non-NYC areas have gotten me all > > circuits busy. Anyone else? > > > > Regards, > > -- > > Joseph W. Shaw II > > Network Security Specialist/CCNA > > Unemployed. Will hack for food. God Bless. > > Apparently I'm overqualified but undereducated to be employed. > > > > > > -- > Marius Strom <marius(a)marius.org> > Professional Geek/Unix System Administrator > URL: http://www.marius.org/ > http://www.marius.org/marius.pgp 0xF5D89089 *updated 2001-02-26* > > It is a natural law. Physics tells us that for every action, > there must be an > equal and opposite reaction. They hate us, we hate them, they > hate us back and > so, here we are, victims of mathematics. > -- Londo, "A Voice in the Wilderness I" >

1 0

Re: GPS SA enabled?
by rs＠seastrom.com 11 Sep '01

11 Sep '01

"Jason A. Mills" <phyxis(a)rottweiler.org> writes: > Has anyone seen if GPS SA was re-enabled? (aka the Selective Availablity > "blur" effect). I have seen no evidence of SA as of a couple of hours ago. I was looking for it, actually. ---Rob

1 0

GPS SA enabled?
by Jason A. Mills 11 Sep '01

11 Sep '01

Has anyone seen if GPS SA was re-enabled? (aka the Selective Availablity "blur" effect). -J obNANOG: Exo peering still looks stable. Oif. Jason A. Mills phyxis(a)rottweiler.org ---------------------------------------------- "La morale est la faiblesse de la cervelle." Arthur Rimbaud --- Une Saison en Enfer

3 2

[matthew@leftcoast.com: FW: Donate blood to help attack victims. USA/Canada]
by Jason Legate 11 Sep '01

11 Sep '01

Forwarded for another. -- Jason Legate Sr. Net/Sys Admin, eVine, Inc. work- jlegate(a)evine.com | home- jlegate(a)alienchick.com Key Fingerprint: 4FB4 2228 DE63 3BBA 7B72 40DD 13D5 2547 821D 2909

1 0

news sites recovering
by Martin Hepworth 11 Sep '01

11 Sep '01

8.20pm London - 3.20pm Eastern US.. Looks like the news are getting their thing together. CNN's gone for very small content BBC seem to be running normal service now, with an interesting on how they and other sites didn't cope. ananova.com always up - guess either they ain't popular or they the same ISP as me.....?? /. seem to ridden the wave pretty well too. some reported troubles, but all was fine for me.. Also stuff one 'the reg' on all this but they've been having troubles anyhow Will be interesting how they all plan for this sort of thing from now on. -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

2 1

Re: Horrible world trade center crash, traffic effect
by Scott Bradner 11 Sep '01

11 Sep '01

> Slashdot is reporting a rumor that Akamai's founder was onboard a plane > into NYC at about the time of the crash. Can someone from Akamai confirm > or deny? http://www.Akamai.com/

1 0

Re: World Trade Center attack
by Sean Donelan 11 Sep '01

11 Sep '01

On Tue, 11 September 2001, Bill Woodcock wrote: > FWIW, I'm getting the voice-telco equivalent of an ICMP > administratively-prohibited when trying to place voice calls from San > Francisco to Moscow on AT&T LD. I'm curious whether this is a generalized > policy or whether I'm just encountering a specific failure with a > mis-matched error message. Network Management Controls (i.e. call gapping) seem to be in effect for most international destinations. I don't think all calls are blocked, just 1 in N are getting a blocked recording on the first switch instead of going through the entire network. Sometimes if you use a different carrier (10-10-xxx) you'll get around the NMC.

1 0

RE: Horrible world trade center crash, traffic effect
by Martin, Christian 11 Sep '01

11 Sep '01

The 140 west and 111 8th avenue CO's are apparently operating normally, albeit with a great deal of congestion. -chris > -----Original Message----- > From: Jason A. Mills [mailto:phyxis@rottweiler.org] > Sent: Tuesday, September 11, 2001 12:46 PM > To: Rachel Luxemburg > Cc: deeann mikula; Charles Sprickman; nanog(a)merit.edu; Avi Freedman > Subject: RE: Horrible world trade center crash, traffic effect > > > > From what I know, Exodus 9th Ave and 11th Ave buildings were > evacuated, > but intact. I don't speak for Exo officially, just work here. > > > On Tue, 11 Sep 2001, Rachel Luxemburg wrote: > > > If anyone happens to know whether any of the buildings immediately > > surrounding the WTC have been affected I would really appreciate > > knowing which ones; my sister is in 140 Broadway. Thank > you. Sorry for > > the non-operational content. > > > Jason A. Mills phyxis(a)rottweiler.org > ---------------------------------------------- > "La morale est la faiblesse de la cervelle." > Arthur Rimbaud --- Une Saison en Enfer >

2 1

live coverage from local NYC television (WABC Ch 7) up & running
by Jeff.Hodges＠kingsmountain.com 11 Sep '01

11 Sep '01

Just announced: all bridges open going outbound from Manhattan calls for blood donations. JeffH

2 1