October 2002 - Test - lists.nanog.org

DNS issues various
by Simon Waters 25 Oct '02

25 Oct '02

> From: "Greg Pendergrass" <greg(a)band-x.com> > Subject: RE: WP: Attack On Internet Called Largest Ever > > Future attacks will be stronger and more > organized. So how do we protect the root servers from future attack? As has been discussed here previously (see archive) it is unclear that the root DNS servers are particularly vulnerable, so further effort specifically defending them may be misplaced, compared to efforts to address DDoS in general, or efforts to fortify other parts of the Internet infrastructure. > From: "Joe Patterson" <jpatterson(a)asgardgroup.com> > > would it cause problems, and more importantly would it solve potential > problems, to put some/most/all of the root servers (and maybe gtld-servers > too) into an AS112-like config? Last time it was discussed I thought that the provisions already in the DNS RFC's to allow zone transfer for "." to recursive servers is a neat solution for the root zone. It can be implemented with existing technology, no new servers/routers needed. Bypasses the 13 root server limit. Reduces load on the current root servers. Increases performance when unknown domains are queried. Even if all addresses where the zone was available were public, a persistent DDoS would merely deny the addition of new TLD's, or readdressing of all DNS servers for a TLD, both occur rarely. The gtld-servers, and servers for other key zones, maybe more painful to do without, harder to replace, or less well configured and/or protected than the root servers. > From: "Stephen J. Wilcox" <steve(a)telecomplete.co.uk> > Subject: Re: Testing root server down code > > Microsoft DNS has a poor response and can spin out of control with all root > servers available.. Unfair, Microsoft DNS has a good response and peak throughput when it isn't spining out of control ;-) > From: "Martin J. Levy" <mahtin(a)mahtin.com> > Subject: Re: Testing root server down code > >2. Encourage greater software diversity for DNS sever systems. Currently most DNS servers are based on the BIND Berkeley Internet Name Domain code base. There is also a Microsoft Windows version of DNS that very few groups currently run. > >3. ... > > Hence... At least in the US (and I can't say for the rest of the world), the government have been recommended to consider Microsoft's version of DNS. Others might interpret that as not to run BIND, or Microsoft DNS ;-) Surely that should be "code bases", plural, as BIND 9 is a new code base? So that is BIND 4, BIND 8, BIND 9, MS DNS, UltraDNS and DJBDNS in fairly widespread use (and the one the root servers use if they don't use BIND), or supporting critical domains, but we still need more diversity?! I think promoting correct configuration, and in-balliwick delegation, would be more useful. Now how do I set follow-ups to comp.protocols.tcp-ip.domains ?

2 1

Re: DNS issues various
by Daniel Senie 25 Oct '02

25 Oct '02

At 02:59 PM 10/24/2002, Kelly J. Cooper wrote: >On Thu, 24 Oct 2002 Valdis.Kletnieks(a)vt.edu wrote: > > > On Thu, 24 Oct 2002 18:01:44 -0000, "Kelly J. Cooper" > <kcooper(a)genuity.net> said: > > > > > So, seven years of hardening hosts against SYN attacks. Five years of > > > trying to get people to turn off the forwarding of broadcast packets. > > > Three years of botnets generating meg upon meg of crap-bandwidth. > > > > > > Where are the suuuuuper-geniuses? > > > > You know, most bars have bouncers at the door that check IDs. Sure, > they're > > not perfect, but the bartender can usually be pretty sure the guy > ordering a > > beer is over 21. The average bar isn't run by a soooper-genius. But > it's still > > considered fashionable to let packets roam your network without an ID > check at > > the door. > >Yeah and how's that working so far? The Bouncer/Bartender who serve an underage person are subject to prosecution, and are liable if someone gets drunk and goes driving and gets into trouble. We've had BCPs in place for some time on directed broadcast and ingress issues. I expect it will take lawsuits to get many people to get serious about implementing these. While it's up to lawyers and judges to decide if ignoring an industry Best Current Practice opens a company to negligence, I won't be surprised if I'm asked to testify for a prosecution in such a case.

1 0

Specific Portscans
by blitz 24 Oct '02

24 Oct '02

Is there any consensus of what's scanning all the 1020-1040 ports? (as in what program etc.) Lately, I've seen the scan jump from the 1000 range to 2000, meaning 2035 etc. Is this something that?s been documented? It's annoying at best. Thanks Marc Blitz macronet.net

1 0

charter cable
by Scott Granados 24 Oct '02

24 Oct '02

Could an engineer from Charter Cable contact me off list? Thanks Scott

1 0

Re: More federal management of key components of the Internet needed
by sgorman1＠gmu.edu 24 Oct '02

24 Oct '02

Any volunteers to inform Congress? They are hiring: (surely they are some out work networking engineers available...) The Congressional Research Service is now accepting applications for the following two positions in its Resources, Science and Industry Division. Interested applicants must either apply online at www.loc.gov/crsinfo (preferred) or call (202) 707-5627 to request an applicant job kit. Please reference the appropriate vacancy number on all correspondence. Applications must be received by October 29, 2002. Specialist in Information and Telecommunication Engineering and Public Policy GS-15 ($92,060 - $119,682) - Vacancy #020233 This position will provide senior leadership and public policy expertise on issues related to telecommunications, networking, and government information policy, including information resources management, convergence, and broadband technologies. The specialist will assess the regulatory, legislative, economic and technical aspects of information and telecommunications technologies in a broad public policy context. Individuals with a policy/research background in telecommunications, engineering, economics, or law are strongly encouraged to apply. This is not an IT or technical position. ----- Original Message ----- From: Richard Forno <rforno(a)infowarrior.org> Date: Thursday, October 24, 2002 5:12 am Subject: Re: More federal management of key components of the Internet needed > > > > Why isn't it against the law to (s)Yell "FUD" at Congress ? > > Wouldn't do any good, they don't know any better. Few if any > Congresscritters are techno-literate -- I spent 3 years on the > Hill, saw it > first hand....and it's not gotten much better. > > The only language most Congresscritters understand is $$$$ and how it > relates to their staying elected by keeping their constituients > somewhathappy and impressed with their performance. > > >> I don't understand how giving the US federal government > management control > >> of key components of the Internet will make it more secure. > > <Sean's Rant about FBI info request removed> > > Remember this is the same 'cybercrime agency' that when I-Love-Y0U was > released, simply posted a NIPC warning saying "A New Virus Has > Been Detected > in the Philippenes." -- I was about to make sure my immunization > recordswere up to date. Even after I called them from my NOC, and > told them that > the security community had already dissected the worm and there > were sigs > and coutnermeasures available, they didn't update the warning on > NIPC.GOVfor like 5 hours. > > A screenshot of that particular example of NIPC's expertise is > immortalizedhere: http://www.infowarrior.or > > Commentary I did about NIPC's warning capability is here, if you're > interested. http://www.infowarrior.or > > > And these are the people that are going to -=improve=- security ? > > Hardly. They have a hard enough time passing information from one > squad to > another within the FBI, they're never going to be able to survive and > interoperate in the Information Age against high-tech threats that > move at > packet speed. And don�t get me started about Infragard.....ugh... > > > I think they should be focusing on terrorist activity, if you ask > > me. > > Good idea, since they still haven't got that task down yet, either. > Remember, the FBI - before and after its 2002 reorg - is, thanks > to its > internal culture, UNABLE to work well with outsiders, be they > cops, the CIA, > or ISP security teams. This has the unfortunate effect of > severely torking > those folks in the FBI that are intelligent and want to make a > difference,but thanks to the system, their initiative is > constrained by the 'status > quo'. I feel sorry for some of these folks, they really do try, > but the > system there prevents them from being effective, thus partially > explainingthe mess the FBI and NIPC is in at the moment in > responding to terrorism or > hacker threats. > > re: The "DNS Attack" -- I'm hearing all this talk about DNS-on-CD > that was > some sort of research project that would be used during a loss of > the roots. > Anyone have any add'l info on what this is/was? > > Cheers from DC, > > Rick > Infowarrior.org > > >

1 0

Re: More federal management of key components of the Internet needed
by Michael.Dillon＠radianz.com 24 Oct '02

24 Oct '02

> Hardly. They have a hard enough time passing information from one squad to > another within the FBI, they're never going to be able to survive and > interoperate in the Information Age against high-tech threats that move at > packet speed. And don¹t get me started about Infragard.....ugh... What government fails to realize is that this is war. In a combat situation, you have to rely on the skill and the initiative of front-line troops to win the battle, not generals and certainly not politicians. It is true that generals and politicians can win wars, but they do this by making the battles irrelevant, i.e. negotiating the surrender of the enemy. However, the war we are involved in is against a disorganized enemy who has no politicians of his own and who probably doesn't even have any generals. Since there are no hacker politicians to negotiate with, political action has little chance of being effective. And since there are no hacker generals making sweeping strategic decisions, there is not much for an organization like the FBI or NIPC to do. The best strategic action that government and crimefighting groups can take is to encourage and support the front-line troops to go out there and fight the enemey. Battles are won by persistence, rapidly adapting to the fluid situation and quick decision making on or near the front-lines. That's why the existing communications channels and information sharing tools used by network operators are superior to Infragard or anything that the FBI or NIPC could think up. They are used to the slow plodding post-mortem analysis of crimes that have been committed. Their goal is only to catch the perp. However, on the net, we are more concerned with mitigating the damage of an attack while it occurs and removing newly discovered vulnerabilities as soon as possible. I think a lot of the debate about infrastructure protection would evaporate if we would be clearer about the goals of the different parties and we would recognize that different goals require different means. The FBI can manage their own program to catch perps who attack the infrastructure while we can manage our program to quickly react to an attack in real time, i.e. fight the front-line battles. Perhaps we need to better document the times when the net community was successful in dealing with an attack and analyze what was good and should be kept versus what was bad and could be improved. One incident that I recall was the wave of SYN flood attacks that led to various OS kernels being hardened against such an attack. At the time I was on both the NANOG list and the firewalls mailing list. I crossposted several messages between the two lists so that both communities would see the full picture and so that both groups could work together to win that one battle over a period of two or three days. The end result was not to eliminate SYN floods but we did mitigate the attacks so that nowadays you cannot knock out a server with a low-bandwidth stream of SYN packets. --Michael Dillon

1 0

Surviving the Fiber-Optic Fire Sale
by Hank Nussbacher 24 Oct '02

24 Oct '02

An interesting read: http://www.wired.com/wired/archive/10.11/fiber_optic.html -Hank

1 0

ISP responses to DOS/DDOS attacks for customers
by Wayne Bogan 24 Oct '02

24 Oct '02

Is there a standard/general level of response that ISPs should provide when responding to DOS/DDOS attacks for customer networks. We try to respond and help any customer with identifying and resolving the problem since most of our customers don't have the staff to respond appropriately. How far should we go? If this issue has already been addressed, please respond off-list with the correct direction to search. Regards, Wayne

3 2

Sugestions for a colocation equipment check-list
by Dan Lockwood 23 Oct '02

23 Oct '02

Does anyone have a list of criteria that is collected when a customer brings equipment into a colocation facility? Things may include make and model, number of power supplies, serial number, etc. Any comments on this type of operation are greatly appreciated. TIA Dan Lockwood Microsoft Certified Professional CompTIA Network+ Certified Cisco Certified Network Associate

2 1

Yahoogroups probs?
by blitz 23 Oct '02

23 Oct '02

Anyone hearing of yahoogroups probs these past few days? >I sent an email to a group im subscribed to there and it bounced, saying >the bounce was from: Reporting-MTA: dns; mail.gallyas.cl Figure the esteemed group here might know if theres been a domain hijacking or other problem. Thanks Marc macronet.net

1 0