October 2002 - Test - lists.nanog.org

WP: Attack On Internet Called Largest Ever
by Sean Donelan 23 Oct '02

23 Oct '02

http://www.washingtonpost.com/wp-dyn/articles/A828-2002Oct22.html The heart of the Internet sustained its largest and most sophisticated attack ever, starting late Monday, according to officials at key online backbone organizations.

21 24

RADIUS question
by Jonathan Disher 23 Oct '02

23 Oct '02

I'm trying to implement dialback with RADIUS on an Ascend MAX TNT... I've been looking for examples but can't find any. Anyone made this work and willing to share the necessary voodoo? Offlist replies welcome. Thanks in advance. -j

1 0

Sprint VS. Qwest
by Christopher K. Neitzert 23 Oct '02

23 Oct '02

List, Neither Sprint nor Qwest are serious about earning my business and are not providing me with their network peering details. I was hoping that the list might have the collective resources to help me determine who has better peering. thanks chirstopher -- Christopher K. Neitzert / 0xC10D222F / chris(a)neitzert.com

13 14

Way off Topic - 'shrooms
by Lucy E. Lynch 23 Oct '02

23 Oct '02

All - If you're coming to Eugene for the NANOG/ARIN meeting and looking for something Northwest-y to do on Sunday - check out the Mushroom Show at the Mt. Pisgah Arboretum: http://www.efn.org/~mtpisgah/upcoming.htm This is a really nice event, and close enough to town so you can drop in, see the wierd fungi, take a short hike, and still make the tutorials - directions: http://www.efn.org/~mtpisgah/location.htm I now return you to the regularly scheduled content. Lucy E. Lynch Academic User Services Computing Center University of Oregon llynch(a)darkwing.uoregon.edu (541) 346-1774/Cell: 912-7998

1 0

need opinions re: contact methods for a noc@ alias
by fingers 23 Oct '02

23 Oct '02

Hi there Over the years I've seen a few very odd methods for dealing with a noc@ email address. I've always had the mindset that: 1) individual users are subscribed to a list/alias for noc@ 2) it's _never_ a single/shared "account" 3) it _always_ accepts plaintext email, at the least, for reporting problems. recently I've been seing more of the "single account" that some poor sod on shift uses, and now I've seen it all - an isp who won't accept plaintext email to their noc@ list, but instead want the person sending the report to go to a webform and fill it in. I was wondering what others' thoughts on these and other methods of dealing with noc@ were. Regards --Rob

2 1

RE: AMS-IX problems
by neil＠DOMINO.ORG 23 Oct '02

23 Oct '02

Iljitcsh, > There seem to be large scale problems at the AMS-IX. BGP sessions with > peers keep oscillating. Since their own addresses keep jumping all > over the place, it is not possible to reach anyone over the AMS-IX > tech list. > > I have disabled all AMS-IX peerings for the networks I manage, and I > suggest everyone who is present there looks in to doing the same. > > Iljitsch van Beijnum > Did you try calling them?! Neil. -- Neil J. McRae - Alive and Kicking neil(a)DOMINO.ORG

2 3

RE: WP: Attack On Internet --more info?
by Brennan_Murphy＠NAI.com 23 Oct '02

23 Oct '02

It's ironic how these events make their way into the media but no one in the media seems inquisitive enough to truly follow up on an event. Was the attack widely distributed or were the streams large enough to traceback with netflow, etc? Was there any success in identifying compromised machines? Any forensic clues found? -----Original Message----- From: dies [mailto:dies@pulltheplug.com] Sent: Wednesday, October 23, 2002 1:06 AM To: Richard A Steenbergen Cc: Sean Donelan; nanog(a)merit.edu Subject: Re: WP: Attack On Internet Called Largest Ever Agreed...I worked these attacks on UUNET's backbone and quite honestly none of them was over 100mbit worth of traffic. We see this everyday, this was nothing out of the ordinary except the destination... Shrug...fear is an easy weapon to wield, eh? On Tue, 22 Oct 2002, Richard A Steenbergen wrote: > > On Tue, Oct 22, 2002 at 05:15:21PM -0400, Sean Donelan wrote: > > > > http://www.washingtonpost.com/wp-dyn/articles/A828-2002Oct22.html > > > > The heart of the Internet sustained its largest and most sophisticated > > attack ever, starting late Monday, according to officials at key online > > backbone organizations. > > Looked like a pretty piddly and unintelligent smurf/ping flood combo to > me. The state of the so-called "experts" saddens me more with each passing > day. > > -- > Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras > PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6) >

1 0

AMS-IX problems
by Iljitsch van Beijnum 23 Oct '02

23 Oct '02

There seem to be large scale problems at the AMS-IX. BGP sessions with peers keep oscillating. Since their own addresses keep jumping all over the place, it is not possible to reach anyone over the AMS-IX tech list. I have disabled all AMS-IX peerings for the networks I manage, and I suggest everyone who is present there looks in to doing the same. Iljitsch van Beijnum

5 6

Fwd: IETF Call for Nominations
by RJ Atkinson 22 Oct '02

22 Oct '02

Operators who are involved in IETF should consider providing input (good/bad/other) to the IETF Nomcom -- since that is the best way to affect the future makeup of the IESG and IAB. Details below. Cheers, Ran Begin forwarded message: > From: Phil Roberts <PRoberts(a)MEGISTO.com> > Date: Mon Oct 21, 2002 16:54:44 America/Montreal > To: all-ietf(a)ietf.org > Subject: Call for Nominations > Message-Id: <200210212054.QAA15190(a)ietf.org> > > The 2002-2003 Nominations Committee is now > soliciting nominations for the open > slots on the IESG and IAB. > > Please take the time, even if it is > only a few moments, to send us your > thoughts. > > Members of the community are encouraged to > nominate candidates for any of the positions > which are up for re-filling: > > IESG Terms ending in March, 2003: > Harald Alvestrand IETF Chair > Scott Bradner Transport > Randy Bush Operations & Management > Patrik Faltstrom Applications > Thomas Narten Internet > Bill Fenner Routing > Jeff Schiller Security > > IAB Terms ending in March, 2003: > Ran Atkinson > Rob Austein > Fred Baker > Steve Deering > Sally Floyd > Geoff Huston > > Members of the community are encouraged to contact the nomcom > confidentially > 1) to nominate someone for any of these positions (please provide the > email > address of any nominee), > 2) to provide input relating to potential candidates, or > 3) to provide comments regarding the past performance of incumbents. > All of this information will be considered during the deliberations of > the nominating committee and will be held in confidence by the > nominating > committee. > > We emphasize that comments sent to the nominations committee will be > kept > in confidence. As noted in RFC 2727 "all deliberations and supporting > information that relates to specific nominees, candidates, and > confirmed > candidates are confidential." > > Self-nominations are accepted. The deadline for nominations is midnight > Friday, November 22, 2002. Early input is desirable so that candidates > may be interviewed during the Atlanta IETF meeting. > > The members of the NomCom can be contacted individually at the > addresses > below or collectively at nomcom(a)ietf.org <mailto:nomcom@ietf.org>. > Additionally, the members of > the NomCom will be identified at the IETF by a small orange dot > on their name tags. People are encouraged to take advantage of the > opportunity to talk to the members of the NomCom about nominations > and other issues related to the IAB and IESG membership. > > The 2002-2003 Nominations Committee > Edward Lewis <edlewis(a)arin.net <mailto:edlewis@arin.net>> > Alec Brusilovsky <abrusilovsky(a)lucent.com > <mailto:abrusilovsky@lucent.com>> > Michael Richardson <mcr(a)sandelman.ca <mailto:mcr@sandelman.ca>> > Eva Jonsson <eva.jonsson(a)utfors.se <mailto:eva.jonsson@utfors.se>> > Stephen Trowbridge <sjtrowbridge(a)lucent.com > <mailto:sjtrowbridge@lucent.com>> > Frank Alfano <falfano(a)lucent.com <mailto:falfano@lucent.com>> > Thomas Kurien <kurien(a)lucent.com <mailto:kurien@lucent.com>> > Dennis Beard <beardd(a)nortelnetworks.com > <mailto:beardd@nortelnetworks.com>> > Richard Draves <richdr(a)microsoft.com <mailto:richdr@microsoft.com>> > Eva Gustafsson <eva.gustafsson(a)ericsson.com > <mailto:eva.gustafsson@ericsson.com>> > > Non-voting members: > Phil Roberts <proberts(a)megito.com <mailto:proberts@megito.com>> (chair) > Allison Mankin <mankin(a)psg.com <mailto:mankin@psg.com>> (IESG liaison) > Eric Rescorla <ekr(a)rtfm.com <mailto:ekr@rtfm.com>> (IAB liaison) > Theodore Ts'o <tytso(a)mit.edu <mailto:tytso@mit.edu>> (previous nomcom > chair) > > The role of non-voting members (from RFC 2727): > > "The nominations committee comprises at least a non-voting Chair, > 10 voting volunteers, and 3 non-voting liaisons. The sitting IAB > and IESG members each appoint a non-voting liaison to the nominating > committee from their current membership who are not sitting in an > open position. The Chair of the prior year's nominating committee > also serves as a non-voting liaison.

2 1

attacking DDOS using BGP communities?
by Saku Ytti 22 Oct '02

22 Oct '02

How feasible would these ideas be? 1) Signaling unwanted traffic. You would set community which would just inform that you are receiving unwanted traffic. This way responsible AS# with statistical netflow could easily automaticly search for these networks and report to NOC if both there is increased traffic to them and community is on. -would it be affective at all? Could your netflow parser use it easily? +wouldn't need big changes 2) 'TTL' community. You would have ~10 communities representing how many AS hops until route should not be advertised anymore. If you would experience DOS you'd start from TTL 1 and increase until DOS flow starts again, with any luck you would end up having very limited amount of AS# to communicate with in hopes of fixing their anti-spoofing filters and to catch malicious party. -just think about the amount of route-maps :> -you would need to flap the network possible 10 times == damped +some idea who to contact w/o co-operation of NOCs (can be hard) +wins you time, often DOS is over before you've reached 3rd AS number to ask where the traffic is originating. 3) 'null route' community. This would only be useful if it would mean that you are also accepting more spesific annoucement, preferally even /32. Most people are propably crying about the idea already, but if you plan it wisely with prefix-limit setting it might not be suicide. Just remember that all downstream prefix-limit+your prefices must be smaller than what your upstream has set for prefix-limit, if this is not done then your downstreams can effectively trigger your upstream prefix-limit killing your connectivity. How AS handles the 'null route' community could vary, others set next-hop to null0 other might set it to analyzer tool. Just that it shouldn't reach the other end anymore. -the obvious: explosion of global bgp routing table (no, not nececcarily) +effective, you'd instantly free your link from any DOS traffic to given destination. -- ++ytti

3 2