November 2002 - Test - lists.nanog.org

AT&T NYC
by Bryan Heitman 03 Sep '03

03 Sep '03

Anyone seeing any problems with ATT in new york? Best regards, Bryan Heitman Interland, Inc.

10 11

Re: Bin Laden Associate Warns of Cyberattack
by Michael.Dillon＠radianz.com 06 Dec '02

06 Dec '02

>It is a great example of how well Al-Quedah manipulates the media. >There are more ways to wreak havoc than script kiddies and DOS attacks. When was the last time you took a sample and tested for the presence of fertilizer *BEFORE* you let the truck driver put that diesel into your generator tanks? And did anyone else notice how the NY Times article gave some clear instructions on how to identify the building in Tribeca even though they didn't include the street address? The best defence against all of these potential terrorist attacks is to do what the military does, i.e. spread out. Never put more than a fraction of your eggs in one basket. Use the network to connect diverse and widespread assets so that they can function as a unit even though they are physically separated. This philosophy works whether your assets are combat soldiers or network PoPs. And again, there is a role for government here. How about tax reductions for companies who harden their networks by removing single points of failure that are vulnerable to terrorist attack? --Michael Dillon

13 18

MSRFCs versus RFCs?
by joej＠Rocknyou.com 03 Dec '02

03 Dec '02

Happy Thanksgiving all! While I don't think I'll get a response to this question over the holidays, I thought I'd at least present it for response post Thanksgiving. I have a site that (along with others) has decided to use MSExchange as their SMTP hub. One of the problems I am seeing with this is that the current configuration allows for any inbound domain traffic. In otherwords, the exchange server seems to allow emails destin for any domain, then sends a None Delivery Report to the "Mail From" party. My argument is that there lies an exploit with this senario. In otherwords (and those of you that probably know where I am going with this just skip ahead) If I send an email to JoeSmo(a)domain.com and spoof the Mail From as Victim(a)innocentdomain.com to an Exchange Server setup in this manor, the Exchange server will bounce an email to the Victim(a)innoccentdomain.com. While this is all fine and dandy, if a person(s) decides to use this as a mailbomb method and exploit this, its rather simple to do. So, in short I am aguing that 1> Mail destine for a domain not handled should be 550 Denied. 2> None Delivery Reports should only be sent for Domains Handled. 3> That a Firewall should not be doing Domain checking for SMTP What I am at a loss for is RFCs that explicitly state this, that is NDR for other domains, and accepting for other domains. Perhaps I missed something or one of them. Anyone have to deal with this situation? Any suggestions on how to argue this? Am I perhaps missing something? Does Bill Gates feel that "Monopoly is just a game, I want the world!" Just kidding. Thanks in advance, and again Happy Thanksgiving! -Joe

3 2

question concerning traceroute?
by Darrell Carley 01 Dec '02

01 Dec '02

I am trying to troubleshoot a latency issue for some of our networks, and was wondering about this.Knowing that routing isn't always symmetrical, is it possible for a traceroute to traverse a different reverse path, than the path that it took to get there? .or will it provide a trace of the path the packet took to reach the destination? According to definition, is should take the same path, but are there any other cases that I should be aware of? Darrell

24 34

Re: Risk of Internet collapse grows
by sgorman1＠gmu.edu 30 Nov '02

30 Nov '02

Sean makes a good point about the importance of the quality of data, but the question is how can good data be made available for research. We've covered this ground before, that firms are not going to make data available. There are better data sets that have become recently available from a few sources, and hopefully improved analysis will result. That said a few things should be kept in mind with academic work. The time from when work is done until it appears in publication is quite legthy, especially when peer reviewed (the Grubesic et al article was peer reviewed). I saw his paper presented in the Fall of 2001, which means he probably did the research in the spring of 2001, and the latest data available was Boardwatch 2000. so, you end with a lag in Internet time that seems horrendous. One of the problems with academia. I do think it is important to think about the best contributions from academia providing tools (algorithm's etc.) to analyze data and view issues from a different perspective. We will never have the quality of data the operations community has. That said I think it is vital to get good feedback from the operations communtiy on our assumptiopns and something this forum has been great with helping with from my experience. I was curious if we put some recent research online if folks would be interested in providing feedback. Happy holidays, sean ----- Original Message ----- From: Sean Donelan <sean(a)donelan.com> Date: Wednesday, November 27, 2002 3:49 pm Subject: Re: Risk of Internet collapse grows > > On Wed, 27 Nov 2002 sgorman1(a)gmu.edu wrote: > > The full paper is available at: > > > > http://whopper.sbs.ohio-state.edu/grads/tgrubesi/survive.pdf > > > > password: grubesic > > > > It was posted on the www.cybergeography.org website with the > password,> plus I'm sure Tony would like the feedback. > > Was this paper peer reviewed ? > > I'm interested in the problem, but this is not the paper. > > AT&T's network is the most vulnerable? While Onyx is among the least > vulnerable? Onyx is bankrupt, and their network is no longer in > operation. I guess you could argue Onyx not vulnerable any more. This > paper starts out with some bad assumptions, such as there is one > NAP in a > city, one path between cities or the marketing maps in Boardwatch are > meaningful. > > Until we figure out how to collect some meaningful starting data, we > can't draw these types of conclusions. > > > >

6 5

Re: Federal Reserve Risks Collapse Re: Risk of Internet collapse grows
by sgorman1＠gmu.edu 30 Nov '02

30 Nov '02

Is this selective argumentation? I agree that the proper assumptions need to be made for research. This is the whole reason I started posting here in the first place, and the request I made at the end of the post - help making sure assumptions are correct. What you decided to attack on the post was the defense of another researchers options of data and how current that data was. He used what was available to him at the time, end of statement. If you could you use your expertise and creativity to help the research community produce better research instead of shooting everything down after the fact, something postitive might actually come from the effort. "But misunderstanding the risks and vulnerabilities is worse because it diverts resources away from the real ones." Perhaps giving contructive advice would be away to avoid such a pitfall. Nahhhhh - it is much more fun to flame. ----- Original Message ----- From: Sean Donelan <sean(a)donelan.com> Date: Thursday, November 28, 2002 6:10 pm Subject: Federal Reserve Risks Collapse Re: Risk of Internet collapse grows > > On Thu, 28 Nov 2002 sgorman1(a)gmu.edu wrote: > > That said a few things should be kept in mind with academic > work. The > > time from when work is done until it appears in publication is quite > > legthy, especially when peer reviewed (the Grubesic et al > article was > > peer reviewed). I saw his paper presented in the Fall of 2001, > which> means he probably did the research in the spring of 2001, > and the > > latest data available was Boardwatch 2000. so, you end with a > lag in > > Internet time that seems horrendous. One of the problems with > > The paper would have the same problems in 2000. It starts with bad > assumptions. Age doesn't improve bad assumptions. > > Suppose I wrote an academic paper about the design of the Federal > Reserve Banking System. After carefull analysis of the map at > http://www.federalreserve.gov/otherfrb.htm (street addresses available > at http://www.federalreserve.gov/fraddress.htm) I write a fully > footnotedpaper that the Federal Reserve system is vulnerable to > the destruction > of the board in Washington DC and twelve banks in Boston, New York, > Philadelphia, Cleveland, Richmond, Atlanta, Chicago, St. Louis, > Minneapolis, Kansas City, Dallas and San Francisco. The US banking > system would collapse, ATMs would stop, paychecks wouldn't get cashed, > checks couldn't be cleared, etc. I would miss Alan Greenspan, but > that'snot how the US banking system works. > > The Federal Reserve system does have vulnerabilities. So does the > Internet (and the post office, and the telephone network, and ...) > But misunderstanding the risks and vulnerabilities is worse because > it diverts resources away from the real ones. > > > >

2 1

Risk of Internet collapse grows
by Irwin Lazar 29 Nov '02

29 Nov '02

Thought this might be worth passing on: http://news.bbc.co.uk/2/hi/technology/2514651.stm <http://news.bbc.co.uk/2/hi/technology/2514651.stm> There is a recent book out called "Linked: The New Science of Networks" which details the potential for causing widespread Internet damage by targeting a few hubs instead of random or widespread attacks against large numbers of hosts. This simulation seems to backup the author's concerns. Irwin

10 9

Odd DDoS, anyone else seen this?
by Stephen J. Wilcox 29 Nov '02

29 Nov '02

Hi, we had a large DDoS over the weekend, I wondered if anyone else has seen this and knows what software is behind it. We saw many hundred thousand packets per second entering our network from various international peers, each packet was tcp destined to a single real end user IP address and sourced from a /16 network address eg 61.254.0.0, where the src was random and different on each packet but always x.x.0.0 I was unable to find out more about the data within the packet, the sheer volume made diagnosis impossible without killing the routers. Steve

8 9

Re: DNS 101
by Damian Gerow 29 Nov '02

29 Nov '02

On Fri, 2002-11-29 at 18:07, Phillip Vandry wrote: > > I'm looking for a bit of DNS help here... > > > > We've been doing a bit of work that involves looking up the real > > authoritative nameservers for domains that we believe we are > > authoritative for, and have run into a spot of trouble when it comes to > > looking up ca. sub-domains. > > Damian, > > I was running exactly that kind of script for a while when I wanted to > clean up a nameserver (couldn't customers notify nameserver operators > when they redelegate their zones somewhere else? No, that would be :) Maybe we should set a fine or something... > too much to ask for.). I also had trouble with the ca. domains. > Several of the nameservers pick up the NS records at the top of *my* > zonefile instead of reporting what's in the "ca." zonefile. None > of the GTLD servers do this. I guess they're configured for recusrion > and fetch-glue and shouldn't be. Just to let everyone know, this has all been clarified, and it was the swap in responses that had me all confused. BIND8 responded, in this case, with an answer, giving the /n/ name servers, thus setting ANCOUNT to /n/. BIND9 responds, again in this case, with the nameservers as glue data, thus keeping the ANCOUNT at 0 (no official answers, right?). Thanks to Kandra for shedding light on this, and Joe Abley for explaining some of the more detailed items. Much appreciated. - Damian

1 0

Spanning tree melt down ?
by Huff, Mark 29 Nov '02

29 Nov '02

Cisco wins... As a result of the crash, Beth Israel Deaconess plans to spend $3 million to replace its entire network - creating an entire parallel set of wires and switches, double the capacity the medical center thought it needed.

12 11