November 2002 - Test - lists.nanog.org

RE: Cisco hardware advice needed
by haesu＠towardex.com 22 Nov '02

22 Nov '02

Hello all, A lot of you have replied back to my original email with very good advice. I greatly appreciate everyone's assistance. Thank you --haesu ---------------------------------------------------------------- This mail sent through TowardEX Webmail http://mail.towardex.com

1 0

Re: Weird distributed spam attack
by Joe St Sauver 22 Nov '02

22 Nov '02

Hi, #Here is the kicker. I check where these are coming from, they #are from all over the place. I check for IP address spoofing... #not happening. No IP options or TCP options. # #This came from like about 300 different networks, and yes #I don't accept source routing (IP Options). In addition to thousands of open relays, which are bad enough in their own right, there are also thousands of open proxy servers which a growing number of spammers have been using to launch spam runs lately. I suspect that's what you're seeing. You can see some of the open proxy servers that we've seen traffic from at http://darkwing.uoregon.edu/~joe/open-proxies-used-to-send-spam.html If you aren't blocking traffic from open proxy servers via a dns blacklist, I predict that you will definitely see increasingly aggressive spam attacks coming in from diverse locations (although the more you look at the problem, the easier it becomes to identify the handful of carriers who are open proxy-tolerant). [I will also say that it would really be great if mail-abuse.org would add an open proxy listing project to complement their RSS, DUL, and other initiatives.] Regards, Joe

4 3

Weird distributed spam attack
by dru-nanog＠redwoodsoft.com 22 Nov '02

22 Nov '02

Unless, I missed the posts about this,.. I just (and still am experiencing) a distributed spam attack. I have a small machine at a colo. Today I check my inbox and there are 2000+ extra messages to a domain I have 'zbot.net'. The messages are doing 4 letter combinations for the recipient. (abde, abdf, etc.) The from's are all mybestplacetoshop(a)ainet.us I check my qmail queue -> its at 13405 messages. I shut down mail and remove the email from the queue. Here is the kicker. I check where these are coming from, they are from all over the place. I check for IP address spoofing... not happening. No IP options or TCP options. This came from like about 300 different networks, and yes I don't accept source routing (IP Options). Anyways, it happened to my machine, I stopped accepting mail to that domain from qmail-smtpd, so I'm back to normal. If anyone want's a tcpdump of the connection attempts or the emails. Let me know. Dru Nelson San Carlos, California

6 5

The Cidr Report
by cidr-report＠potaroo.net 22 Nov '02

22 Nov '02

This report has been generated at Fri Nov 22 21:45:21 2002 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 15-11-02 115525 83541 16-11-02 115876 83482 17-11-02 115903 83487 18-11-02 115816 83543 19-11-02 115965 83826 20-11-02 115962 84457 21-11-02 116704 84654 22-11-02 116795 84742 AS Summary 14074 Number of ASes in routing system 5531 Number of ASes announcing only one prefix 2106 Largest number of prefixes announced by an AS AS3908 : SUPERNETASBLK SuperNet, Inc. 72949760 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 22Nov02 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 117134 84750 32384 27.6% All ASes AS3908 2106 1243 863 41.0% SUPERNETASBLK SuperNet, Inc. AS701 1715 1271 444 25.9% ALTERNET-AS UUNET Technologies, Inc. AS7843 665 297 368 55.3% ADELPHIA-AS Adelphia Corp. AS7018 1370 1006 364 26.6% ATT-INTERNET4 AT&T WorldNet Services AS18566 367 5 362 98.6% COVAD Covad Communications AS4323 524 184 340 64.9% TW-COMM Time Warner Communications, Inc. AS6197 457 122 335 73.3% BATI-ATL BellSouth Network Solutions, Inc AS1221 1183 858 325 27.5% ASN-TELSTRA Telstra Pty Ltd AS6347 360 80 280 77.8% DIAMOND SAVVIS Communications Corporation AS4355 403 136 267 66.3% ERMS-EARTHLNK EARTHLINK, INC AS7046 584 323 261 44.7% UUNET-CUSTOMER UUNET Technologies, Inc. AS22927 275 20 255 92.7% AR-TEAR2-LACNIC TELEFONICA DE ARGENTINA AS209 589 338 251 42.6% ASN-QWEST Qwest AS1239 910 660 250 27.5% SPRINTLINK Sprint AS6198 415 167 248 59.8% BATI-MIA BellSouth Network Solutions, Inc AS705 436 203 233 53.4% ASN-ALTERNET UUNET Technologies, Inc. AS4814 247 15 232 93.9% CHINANET-BEIJING-AP China Telecom (Group) AS4151 346 123 223 64.5% USDA-1 USDA AS1 657 441 216 32.9% GNTY-1 Genuity AS6140 267 66 201 75.3% IMPSAT-USA ImpSat AS852 666 467 199 29.9% ASN852 Telus Advanced Communications AS17676 229 30 199 86.9% GIGAINFRA XTAGE CORPORATION AS6595 247 56 191 77.3% DODDSEUR DoD Education Activity Network Assistance Center AS17557 307 122 185 60.3% PKTELECOM-AS-AP Pakistan Telecom AS4134 298 116 182 61.1% ERX-CHINALINK Data Communications Bureau AS690 507 331 176 34.7% MERIT-AS-27 Merit Network Inc. AS2048 264 88 176 66.7% LANET-1 State of Louisiana AS7132 223 67 156 70.0% SBIS-AS Southwestern Bell Internet Services AS2548 390 240 150 38.5% ALGX-ATCW-AS Allegiance Telecom Companies Worldwide AS6327 181 33 148 81.8% SHAWFIBER Shaw Fiberlink Limited Total 17188 9108 8080 47.0% Top 30 total Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)lists.apnic.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Cisco router hardware advice needed..
by haesu＠towardex.com 21 Nov '02

21 Nov '02

Hello, We currently run a small ISP network with two Linux based routers called ISis (www.imagestream.com) to aggregate all the customers into the backbone. There are two ISis routers and each ISis has two frame-relay T3's. All customers have a frame-relay T1 and we setup the PVC DLCI mappings over the frame cloud.. Now, the ISis routers are too much of a low quality and unacceptable for our ever-growing network. (Please don't reply back to me telling me how Linux for ISP routing is incorrect to begin with, etc, etc.. I understand and agree.. I never made the call the go with Linux based routers in the beginning..) Anyway.. with that being said. We are in process of removing these ISis routers and replacing them with Cisco routers. We are currently thinking of using Cisco 7206VXR's with at least an NPE300 per replacement of ISis. So that would be two Cisco 7206 routers, each with two frame-relay T3's. Each Cisco 7206 router will have about approximately 150 or so serial sub-interfaces for customer PVC mapping.. And each 7206 will have a 100Meg FastEthernet connection to the backbone core router (since two T3's saturating only goes up to about 90Mbps). Now the question is.. Can a Cisco 7200 handle the two frame-relay T3's with 150 or so subinterfaces? My impression of a 7200 is that it is more designed for deployment at the border, not much at the edge/aggregation.. What do you people think? If it cannot handle such pressure, what other models do you guys suggest for us? We are looking at both Cisco and Juniper products, but we would like to use Cisco whenever we can, so Cisco is our preference. Thanks in advance. --haesu ---------------------------------------------------------------- This mail sent through TowardEX Webmail http://mail.towardex.com ----- End forwarded message ----- ---------------------------------------------------------------- This mail sent through TowardEX Webmail http://mail.towardex.com

2 1

On the cyber-security FUD topic
by Richard Forno 21 Nov '02

21 Nov '02

Here's my contribution to the current cyber-security FUD thread. I've been mulling this piece over for a while now, and it can certainly apply to a few different companies in this particluar market. Seeing the current debate, I feel justified in posting this essay to NANOG. -rf Security Through Soundbyte: The 'Cybersecurity Intelligence' Game Richard Forno Essay #2002-12 (c) 2002 Richard Forno. Permission granted to reproduce and distribute in entirety with credit to author. Full article with in-line URLS is available at: http://www.infowarrior.org/articles/2002-12.html Some say that cyberspace is the new battlefield, with its own unique rules, challenges, and concerns for those charged with defending it. If one does consider cyberspace a modern battlefield, intelligence must naturally play a key role in developing appropriate, proactive defenses. Regarding battlefield intelligence, military strategist Sun Tzu wrote that "what is called foreknowledge cannot be elicited from spirits, nor from gods, nor by analog with past events, nor from calculations. It must be obtained from men who know the enemy situation." That's sound advice. During recent months, hardly a week goes by without some reference to some firm's findings or statistics on hackers, crackers, cyberterrorists, and the general state of internet security as they see it. Many times these reports are marketed as cybersecurity "intelligence." As a security professional - and someone 'on the front lines' of the cyberspace battlefield - I'm both curious and dubious about the whole 'cybersecurity intelligence' business concept, and wonder what it takes to both become a 'cybersecurity intelligence' expert and make money at it, too. < - snip - > Full article with in-line URLS is available at: http://www.infowarrior.org/articles/2002-12.html

3 2

Fire in Data Centre of Twente University, Netherlands
by Wouter van Hulten 21 Nov '02

21 Nov '02

for all incident watchers: [Update 20/11/2002 12:30] At this moment the ICT-heart of the university of Twente is burning. The so-called TWRC-building houses the central systems of the university, all servers and PCs will be lost and various affiliated institutes are without Internet connectivity. [...] Hosting and colo company Virtu, the neighbour of the university, has provided an IP adress for the University. Further announcements are made available on http://srv1ut.utwente.virtu.nl/, a abbreviated copy of the university website. [Update 12u30] Op dit moment brandt het ICT-hart van de Universiteit Twente uit. Het zogeheten TWRC-gebouw huisvest het centrale net van de universiteit, alle servers en pc's gaan verloren en diverse geaffilieerde instellingen zitten zonder internetverbinding. [...] Hosting- en colocatieprovider Virtu, de fysiek buurman van de universiteit, 'heeft een machine en een IP-adres ter beschikking gesteld met medeweten en op verzoek van de universiteit. Op deze wijze kan de UT toch mededeling wereldkundig maken via het web', aldus een zegsman van Virtu. De site is een gestripte kloon van www.Utwente.nl. pictures: http://webcam.traserv.com/thumbnails/index.html http://images.fok.nl/upload/utwentebranddichtbijgroot.jpg websites [in Dutch]: http://www.planet.nl/pmm/0,1674,101_1501_1277175,00.html newslog with pictures: http://frontpage.fok.nl/news.fok?id=23971

2 2

Trouble loading page
by Richard Irving 21 Nov '02

21 Nov '02

Hrmmm... Is anyone else having trouble loading this page ? The trace looks good, must be the content and my browser ? http://www.aclu.org/Privacy/Privacy.cfm?ID=11361&c=130 Thanks in Advance. .Richard. :cointelpro: "First they came for the democrats, I didn't care, as I wasn't one..." "Those who don't learn from History.......shoot, too late!" ;)

1 1

Testing router code before deployment
by Tom Holbrook 21 Nov '02

21 Nov '02

Just curious what testing protocol people use with router code (IOS or JunOS for example) when considering deployment of a new version. Obviously the deployment would be made incrementally, but I wonder if you do anything more than running it in a lab router for a couple of weeks before the initial deployment. Thanks -Tom __________________ Tom Holbrook Sr. Network Engineer Earthlink - Atlanta 'Safe?' said Mr. Beaver...'Who said anything about safe? 'Course he isn't safe. but he's good. He's the King, I tell you.' --The Lion, the Witch and the Wardrobe

3 3

Re: Network integrity and non-random removal of nodes
by sgorman1＠gmu.edu 21 Nov '02

21 Nov '02

Hmm - not sure on who owns the trees, but if anyone does know it would be very useful. Most of the work I've read say the connection distribution follows a power law, and is why I did not think it would follow a linear pattern, but just guess work on my part. There has been some work at BU that says all the power law stuff is just sampling bias inherent in traceroute type of data aquisition. In which case vulnerbility might not be as dire as some of the early reports. How to get an accurate topology is the real big problem, but no need to reopen the private sector vs government vs academia debate. ----- Original Message ----- From: William Waites <ww(a)styx.org> Date: Thursday, November 21, 2002 7:56 pm Subject: Re: Network integrity and non-random removal of nodes > >>> "Sean" == <sgorman1(a)gmu.edu> writes: > > >> The supposition would be that the remaining nodes are evenly > >> distributed around the core so the percentage of nodes outside > >> of the core without connectivity should be roughly the > same as > >> the percentage of nodes removed from the core. At least until > >> the core goes non-linear... > > Sean> Is that the supposition stated in the paper? > > No. > > Sean> The reason being it contradicts quite a bit of similar > Sean> research. Nodes inside and outside of the core do not > Sean> typically disconnect at the same rate. > > References? Note that I posited that the rate was proportional, not > the same. > > Sean> The nodes outside of the core on the other hand are much > Sean> more sparsely connected. 55% of them are trees meaning that > Sean> they only have one connection. There is no back up > link, so > Sean> if their big hub node goes down they are out of commission. > > That's more or less what I said. If the trees are evenly distributed > around the core, and you take away 2% of the core, you can > expect 2% > of the trees to disappear too. Of course 2% of the trees is a much > larger number of nodes than 2% of the core. > > Sean> Hence you could have large numbers of nodes outside the core > Sean> disconencted before you would see any effect inside the > Sean> core. By the time the core goes non-linear the > periphery is > Sean> gonna be long gone and disconnected. > > True iff the links to the periphery are not evenly distributed across > the core, which is my, perhaps faulty, underlying assumption. Does > UUNet still own most of the trees? > > -w > >

1 0