January 2002 - Test - lists.nanog.org

ICANN dead?
by Curtis Maurand 18 Jan '02

18 Jan '02

I can't raise the website at icann. Asleep at the switch? Curtis

4 3

provider in Freeport, Bahamas
by Eve C. Koenning 18 Jan '02

18 Jan '02

All, If anyone has a network out in Freeport, Bahamas and can provide a t1, I would appreciate it if you could email me. Regards, Eve Koenning

1 0

Growing DoS attacks
by Paul Froutan 18 Jan '02

18 Jan '02

Hello all, Can some of you with larger networks let me know about the volume of the DoS attacks you have experienced lately? Our experience has been that the volume (not just occurrence) is going up significantly and I'm curious on the size of attacks that people are experiencing. For reference, while a year or two ago we used to get 50-100 meg attacks, now we're getting 500+ megs. Thanks _________________________________________ Paul Froutan, VP Engineering and Operations Rackspace Managed Hosting Email: pfroutan(a)rackspace.com ---------------------------------------------------------------------- --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.313 / Virus Database: 174 - Release Date: 1/2/2002

13 20

Re: Growing DoS attacks
by Vincent Gillet 17 Jan '02

17 Jan '02

nguilbaud(a)chello.com disait : > Vincent, > > The Cisco ISE aka Engine 3 cards for GSR allow you to combine those > features, you can even i/egress traffic police or even shape based on > access-list. You still have some constraints but nothing compared to the > E0/1/2. It looks getting better and better, but large GSR users have 95% LC E0/1/2 .... and i bet 100% customers are connected on E0/1/2 !! Even single POS oc48 LC are still E2 .... I am talking about problem we have today. E3 and above LC will be popular for access in 2003 i guess. Vincent.

2 1

uunet outage?
by Dan Hollis 17 Jan '02

17 Jan '02

Anyone seeing uunet outage in the last half hour or something? We are seeing huge routing problems. -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

3 2

Re: uunet outage?
by John Neiberger 17 Jan '02

17 Jan '02

I'm not sure about uunet, but Sprint is having some issues in Seattle and Tacoma. I just had to shut down our connection to them to stabilize things on our end. John ________________________________________________ Get your own "800" number Voicemail, fax, email, and a lot more http://www.ureach.com/reg/tag ---- On Thu, 17 Jan 2002, Dan Hollis (goemon(a)anime.net) wrote: > > Anyone seeing uunet outage in the last half hour or something? > We are seeing huge routing problems. > > -Dan > -- > [-] Omae no subete no kichi wa ore no mono da. [-] > > >

2 1

Re: Persistent BGP peer flapping - do you care?
by Dave Israel 17 Jan '02

17 Jan '02

On 1/17/2002 at 17:42:53 -0500, Vijay Gill said: > On Thu, 17 Jan 2002, Dave Israel wrote: > > > It's a question of robustness; if the new spec includes a way to be > > tolerant of how the spec is (or can be) commonly abused, then the > > followers of the spec will not be at the mercy of those who deviate. > > > > In this case, I think that having the option to keep a session that > > gives bad routes up, and just dropping the route, is a good answer. > > That would allow the user to determine which is preferable for a given > > peer: possible corruption or certain disconnection. > > If you have a "bad route" how do you know the rest of the update is good? You don't. That's why I suggested an option. If you're talking about somebody who lives in the core, then you probably never want to trust somebody who hands you a bad update. If, however, you're on the edge, you might decide to keep trying to talk to somebody who hands you a bad update, at least until the error rate reaches some threshold (or the other router goes down in flames), rather than turn off what may be your only remaining connectivity and sulk alone in your corner. -Dave

1 0

802.1x supplicant settings in XP
by Aaron Shively 17 Jan '02

17 Jan '02

Is anyone familiar with the 802.1x client in WinXP enough to know exaclty what username/password pair it is trying to pass to the server? I have been testing this out on an HP switch, with the switch itself set up as the authenticating server. I have been unsuccessful getting authentication, and have tried setting up the switch with a username/password for both accounts (administrator and myself) on my XP machine. If the supplicant is not using either of these, what is it using? The computer name? There is no password associated with that. Thanks.

1 0

Methods for managing large customer/internal mgmt ACLs?
by Roland Dobbins 17 Jan '02

17 Jan '02

I'd be grateful for insight into what tools/methods are being used out there for managing and deploying large numbers of large customer and/or internal management ACLs, specfically for Cisco devices. Is vi/RCS/tftp the most common toolset, or is anyone using the Cisco ACLM (I doubt the latter, but thought I'd ask, anyway) or other systems? Thanks in advance . . . -- ------------------------------------------------------------ Roland Dobbins <mordant(a)gothik.org> // 408.859.4137 voice

2 1

RE: Growing DoS attacks
by LeBlanc, Jason 16 Jan '02

16 Jan '02

Get in touch with these guys, ask about SLT Director: Radware, Inc. http://www.radware.com Jason Harrison, Regional Sales Manager - Northern California 721 Emerson Court San Jose, CA 95126 voice: 408.279.2310; fax: 408.279.2510 > -----Original Message----- > From: Pascal Gloor [mailto:pascal.gloor@spale.com] > Sent: Wednesday, January 16, 2002 3:13 PM > To: nanog(a)nanog.org > Subject: Re: Growing DoS attacks > > > > > Since years, IRC (users and/or servers) gets dDoS... We also > see a grow of > the dDoS attacks. For example on Undernet some servers get > attacked every > day with 100+Mbps for a few minutes, and sometimes for long > long hours... > Those attacks are usually comming from users - IRC Operators > conflicts, > those users think they may ask anything to an OPER with the > power of a dDoS. > We try to provide a free service, and all of us know how it > is hard to get a > host with good connectivity for free and on the other side we > see those > young 'script kiddies' playing around with hundreds of > compromised hosts > like a game and they have no idea how much it costs to all > the flooded > networks... Unlikely I have to say that most of these 'script > kiddies' are > from Romania. I dont know why it's so many times comming from them.... > > If you run an well dDoS'ed IRC Server on your network I have > a solution for > you... not the best one, but still technically working.. > > get a /24 (be carefull that there is no bigger network > announced which would > include it!!! i mean like if you get 10.10.10/24, 10/8 would > include it) > > Get a box, and run Zebra BGPD, which will announce that /24 > to your network. > Then do a script which monitors the traffic to the irc > server, and on a > certain threshold, kill BGPD. wait a certain time, like > 15minutes or so, and > restart BGPD. It would be nice to check the traffic every > minute and if 2 > consecutive checks are positive kill bgpd. That mean that you > may be able > to STOP dDoS to irc servers within 2-3 minutes... > > just my 0.00001 EUR > > Cheers.. > Pascal >

1 0