January 2002 - Test - lists.nanog.org

black hat .cn networks
by Dan Hollis 08 Mar '02

08 Mar '02

http://wired.com/news/politics/0,1283,43437,00.html Time to drop AS4134. -Dan

16 17

Fwd: SlashDot: "Comcast Gunning for NAT Users"
by Martin J. Levy 04 Feb '02

04 Feb '02

I got this forwarded to me. I'm not impressed. Based upon the general desire for providers to have NAT'ed users and to reduce IP-space usage where appropriate, does this make sense? I can understand the providers desire to increase revenue, but I don't believe this is a good way to do it. Besides the technical difficulties of detecting a household that is running a NAT'ed router, why not win over the customer with a low-cost extra IP address vs: the customers one-time hardware cost for the router. There are people who would be willing to pay some amount monthly vs: (let's say) $100 for a NAT box. Does anyone know what percentage of home broadband users run NAT? Does anyone have stats for IP-addresses saved by using NAT? Martin ------ Forwarded Message From: Ward Clark <ward(a)joyofmacs.com> Date: Sat, 26 Jan 2002 15:00:32 -0500 To: "NetTalk" <nettalk(a)sustworks.com> Subject: SlashDot: "Comcast Gunning for NAT Users" Today's MacInTouch links to a report that appeared in SlashDot on Thursday: "A co-worker of mine resigned today. His new job at Comcast: Hunting down 'abusers' of the service. More specifically, anyone using NAT to connect more than one computer to their cable modem to get Internet access- whether or not you're running servers or violating any other Acceptable Use Policies. Comcast has an entire department dedicated to eradicating NAT users from their network. ... did anyone think they'd already be harassing people that are using nothing more than the bandwidth for which they are paying? ..." Earthlink and Comcast have both been advertising lately their single-household, multi-computer services (and additional fees) -- probably amusing to many thousands of broadband-router owners, at least until the cable companies really crack down. There's a huge number of responses (691 at the moment), which I quickly scanned out of curiosity. I'm not a Comcast or Earthlink user. You can start here: http://slashdot.org/articles/02/01/24/1957236.shtml -- ward -------------------- To unsubscribe <mailto:requests@sustworks.com> with message body "unsubscribe nettalk" ------ End of Forwarded Message

34 61

Re: distributed attack, high or not
by Steven M. Bellovin 03 Feb '02

03 Feb '02

In message <20020131025142.A12260(a)monet.titania.net>, "Joseph T. Klein" writes: > >I define it as random because the traffic rise could be seen >coming in from multiple providers and looked to be the same >percent from all sources (separate routers with separate >interfaces to separate ASNs in separate geographic locations). >The traffic was inbound and not backsplash from randomized >source addresses. > >It looks to me like a infection with someone turning a control >knob. Is this common or a precusor of a bad thing? > It's a classic DDoS attack, aimed at you. Someone has lots of zombie machines out there; at some point, they sent a command packet to all of them, saying "bombard such-and-such an IP address for 3600 seconds". Common? It happens frequently to someone. Precursor? Entirely possible, though there's no way to know for sure. But it can be very bad -- see http://news.zdnet.co.uk/story/0,,t269-s2103098,00.html for what happened to a British ISP. --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com

4 4

NANOG 24: NAP BoF
by Mike Hughes 02 Feb '02

02 Feb '02

Hi all, As you may have seen from the NANOG 24 agenda, I'm running two NAP sessions at the coming meeting. In the General Session, there is a NAP update, from a handful of NAPs. We've had to keep this session small, and tightly timed, to fit well into the agenda. On the Monday evening, we'll have a NAP BoF session, which will I'm planning on being fairly free-form, but will consist of: * an "open-mic" for operators who didn't participate in the general session to introduce themselves and their IX/NAP. * a chance to carry out further discussion of any "hot topics" from the general session - I've even asked for a whiteboard/flipchart. * a place where participants get the opportunity to meet and chat with the operators of the NAPs where they participate now, or may be participating in the future. * We'll probably head toward the bar at some point too... :-) Why have we chosen to split it up like this? Well, in Europe, at the RIPE meeting, there is an open European IXP working-group for which we get 3 hours of agenda time. Not all the IXPs show up, and still we are hard-pressed to fit things in the schedule! So, if there are any NAP/IX operators who would be interested in coming along to the evening BoF, drop me a mail, or you're free to just turn up on the night. Of course, we would also like plenty of NAP participants to show up too! It will also be a good chance to meet with potential new peers as well... See you in Miami! Mike

12 19

DNS DOS increasing?
by Matt Martini 01 Feb '02

01 Feb '02

-----BEGIN PGP SIGNED MESSAGE----- I've been seeing some strange problems in DNS lately (named 8.2.4-REL) where the nameserver stops resolving certain sites. During investigation I noticed that my query rate is way up. Many more DNS requests than normal are hitting my servers. Is anyone else seeing anything like this? Matt __________________________ http://www.invision.net/ _______________________ Matthew E. Martini, PE InVision.com, Inc. (631) 543-1000 x104 Chief Technology Officer matt(a)invision.net (631) 864-8896 Fax _______________________________________________________________________pgp_ -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQEVAwUBPEnCFmtXn16/JS7ZAQHZnAf9HUy+AtG7xOhKoHvPvjtESVdLLtw8ZKto xRkvSvzLIFUep77vi7w/CXQ7RBpoOrHMp1y1WFRMdwaVp4WWGk5qdiqcrtQiAyWn vmzP+VbaW3TT0jdRAdz98O1bW98GCZwLa9WR/xdO0bSQOvtCFuqV0P3XqGmTO0Jl fI7TViUzF6LpOcGGrTKxxj+A7rlOVVjCRozilZsMDKG9QVGZwdSG7/u8K+3U9mIq keyZKGRla1tFbVp4VXEaC6P0zdxh2OHqMTZSdd9nETQEFf9vUjR/ZUfXQfK5l3A9 4GCyAQ3VjhCFdt+xWBww2zh0c0F531eMrFCrrrU4jue4E+0Wuih89g== =+eIJ -----END PGP SIGNATURE-----

4 3

Re: SlashDot: "Comcast Gunning for NAT Users"
by Matt Barrette 01 Feb '02

01 Feb '02

To add more fuel to the fire, how does one combat the issue of "stolen" IP addresses. Stolen IP's are worse to me than a user doing NAT. Slightly intuitive users could figure out that their IP is one of a /24 and just statically assign one to their other machine with out paying for it, and worse take somebodies IP and make that user non-functional. I know the cable modem service where I live will allow this type of activity. At 01:37 PM 1/31/2002 -0800, Keith Woodworth wrote: > > > >On Thu, 31 Jan 2002, Dan Hollis wrote: > >|+On Thu, 31 Jan 2002, Marc Pierrat wrote: >|+> It's not very enforceable, so I'd be very surprised to see much money >|+> spent on this witch hunt. >|+ >|+At least one provider has a fully staffed full time "anti-nat" divison >|+now. But will they burn more cash in the nat witch-hunt than they save? >|+ >|+I also wonder about false positives. Watch the lawsuits fly as they >|+mistakenly cutoff non-nat customers. > >From a technical standpoint how does one detect NAT users over the >network? > >Keith > > ____ Matt Barrette NetINS Network Technician Email: mattbar(a)netins.net www.netins.net www.netins.com PH: 888-NETINS1

2 1

NAT Router for other purposes
by Cutler, James R 01 Feb '02

01 Feb '02

I use a Linksys BEFSR41B to connect both my PC and my Linksys printer server together while I am using my Internet connection. This way I can use the Internet and any of the three printers supported transparently with nothing but selecting which printer I want to use. And, since I use a company laptop as my PC, the hardware changes often. The Linksys insulates these changes from my ISP connection. Oh, in addition, I never see DOS attacks against my PC or my printer server, since the Linksys does not respond to connection attempts. Does this mean that I am an evil person, trying to cheat the ISP? Should I be charged $5/month to use my printers which cannot be accessed from the ISP connection? I think not, and, not. - James R. Cutler, EDS 800 Tower Drive, Troy, MI 48098 248 265 7514 (8-3650

2 1

RE: SlashDot: "Comcast Gunning for NAT Users"
by Rowland, Alan D 01 Feb '02

01 Feb '02

I've seen a lot of good responses since this post but none that points out the obvious, most broadband providers offer 'residential' and 'business' products. The former at ~$50/month for a 'single connection,' the latter for ~$120/month including most of the services at issue in this thread. You get what you pay for. Some day case law will catch up to this new media enough that when a 'residential' service customer seeks remedy for $X,000 in 'lost business' the defense will be that if they want a 'business' connection, then that is what they should have signed up for/been paying for. When 1% of your users are sucking down %50+ of your bandwidth you may need to discuss AUPs with that 1%. Don't expect your shareholders to cut you any slack on this issue. -Al Just my 2¢, feel free to use your delete key. -----Original Message----- From: Martin J. Levy [mailto:mahtin@mahtin.com] Sent: Thursday, January 31, 2002 7:58 AM To: nanog(a)merit.edu Subject: Fwd: SlashDot: "Comcast Gunning for NAT Users" I got this forwarded to me. I'm not impressed. Based upon the general desire for providers to have NAT'ed users and to reduce IP-space usage where appropriate, does this make sense? I can understand the providers desire to increase revenue, but I don't believe this is a good way to do it. Besides the technical difficulties of detecting a household that is running a NAT'ed router, why not win over the customer with a low-cost extra IP address vs: the customers one-time hardware cost for the router. There are people who would be willing to pay some amount monthly vs: (let's say) $100 for a NAT box. Does anyone know what percentage of home broadband users run NAT? Does anyone have stats for IP-addresses saved by using NAT? Martin ------ Forwarded Message From: Ward Clark <ward(a)joyofmacs.com> Date: Sat, 26 Jan 2002 15:00:32 -0500 To: "NetTalk" <nettalk(a)sustworks.com> Subject: SlashDot: "Comcast Gunning for NAT Users" Today's MacInTouch links to a report that appeared in SlashDot on Thursday: "A co-worker of mine resigned today. His new job at Comcast: Hunting down 'abusers' of the service. More specifically, anyone using NAT to connect more than one computer to their cable modem to get Internet access- whether or not you're running servers or violating any other Acceptable Use Policies. Comcast has an entire department dedicated to eradicating NAT users from their network. ... did anyone think they'd already be harassing people that are using nothing more than the bandwidth for which they are paying? ..." Earthlink and Comcast have both been advertising lately their single-household, multi-computer services (and additional fees) -- probably amusing to many thousands of broadband-router owners, at least until the cable companies really crack down. There's a huge number of responses (691 at the moment), which I quickly scanned out of curiosity. I'm not a Comcast or Earthlink user. You can start here: http://slashdot.org/articles/02/01/24/1957236.shtml -- ward -------------------- To unsubscribe <mailto:requests@sustworks.com> with message body "unsubscribe nettalk" ------ End of Forwarded Message

17 19

Re: Fwd: SlashDot: "Comcast Gunning for NAT Users" (fwd)
by Ukyo Kuonji 31 Jan '02

31 Jan '02

>The question I have is, by the letter of the terms, is running ssh >a 'VPN'? Or if I use a VPN client to connect to my datacenters from home? >Or is >it you 'hosting' a VPN? What about running a VPN over a SSH connection? Would that be considered a VPN? Or maybe we will see cable companies limit you to only surfing. No ports other than 80. _________________________________________________________________ Chat with friends online, try MSN Messenger: http://messenger.msn.com

3 2

RE: NAT Router for other purposes
by Joe Blanchard 31 Jan '02

31 Jan '02

I Totally agree. No reason for an ISP to charge for such things. Reminds me of the days when the phone company used to charge per phone before they were broken up. I have a feeling that in the future, perhaps, it will be a per packet cost. At one place I worked each Dept was charged xxx per Gigabyte of data transfered to and from their respective segments. Maybe this will slide into the home market someday don't know. Cheers -Joe Blanchard > ---------- > From: Cutler, James R[SMTP:james.cutler@eds.com] > Sent: Thursday, January 31, 2002 2:40 PM > To: nanog(a)merit.edu > Cc: Cutler, James R > Subject: NAT Router for other purposes > > > > > I use a Linksys BEFSR41B to connect both my PC and my Linksys printer > server > together while I am using my Internet connection. This way I can use the > Internet and any of the three printers supported transparently with > nothing > but selecting which printer I want to use. > > And, since I use a company laptop as my PC, the hardware changes often. > The > Linksys insulates these changes from my ISP connection. > > Oh, in addition, I never see DOS attacks against my PC or my printer > server, > since the Linksys does not respond to connection attempts. > > Does this mean that I am an evil person, trying to cheat the ISP? Should > I > be charged $5/month to use my printers which cannot be accessed from the > ISP > connection? > > I think not, and, not. > > - > James R. Cutler, EDS > 800 Tower Drive, Troy, MI 48098 > 248 265 7514 (8-3650 >

1 0