February 2002 - Test - lists.nanog.org

Re: it's here
by Eric Brandwine 14 Feb '02

14 Feb '02

>>>>> "sd" == Sean Donelan <sean(a)donelan.com> writes: sd> On Tue, 12 Feb 2002, Alex Rubenstein wrote: >> http://www.cert.org/advisories/CA-2002-03.html sd> ASN.1 is pretty cool, but I've been wondering are there that sd> many ISPs which allow external SNMP access to their equipment? sd> SNMP is a UDP management protocol, and even under the best of sd> conditions, accepting packets from out of the blue isn't a good sd> idea. Spoofed packets? It's not feasible to filter antispoof at OC-12 or OC-48 line rate on all customer facing interfaces. ericb -- Eric Brandwine | To assert that the earth revolves around the sun is as UUNetwork Security | erroneous as to claim that Jesus was not born of a ericb(a)uu.net | virgin. +1 703 886 6038 | - Cardinal Bellarmine (during the Key fingerprint = 3A39 2C2F D5A0 FC7C 5F60 4118 A84A BD5D 59D7 4E3E

7 7

RE: it's here
by Jon Stanley 14 Feb '02

14 Feb '02

Hmm - who said they had to be physically separate? Being a layer 2 centric network has allowed us to extend device management functionality to not only the core, but also straight out to the edge CPE equipment - every piece of (non-legacy) CPE that we have has a 1918 address on it that the customer cannot see. The only incremental cost is the management of the management network - almost minimal, as the IP tracking scheme that we have extends nicely into the /32 range. There is also the required bandwidth, and the need for additional PVC's to the customer prem (these are 64k UBR PVC's) - again, minimal when you own the layer 2 network. Just my 2 cents. PS - these views are my own and do not necessarily represent those of my employer. -----Original Message----- From: jlewis(a)lewis.org [mailto:jlewis@lewis.org] Sent: Wednesday, February 13, 2002 10:56 AM To: jerry scharf Cc: nanog(a)merit.edu Subject: Re: it's here sites) spanning multiple states or countries. Not everyone can afford to build both a backbone and a separate management WAN. Putting management in 1918 space is ok at one location, but gets tricky on a large network. Do we then also buy/maintain VPN hardware to connect all the various 1918 management networks to the NOC?

1 0

Summary: Nothing to report
by Sean Donelan 13 Feb '02

13 Feb '02

I came home to a deluge of e-mail. Whatever happened, I missed it at 30,000 feet. Here is what I found. AT&T Worldnet: E-mail and certificate problems (just ignore the warning) C&W: Green across the board Earthlink/Mindspring: Dialup authentication problems (San Jose and other locations) Genuity: Normal Sprint: A couple of router hardware problems (Tacoma and Washington DC) UUNET: No outages

1 0

NANOG Help Desk???
by Bill Thompson 13 Feb '02

13 Feb '02

I just gotta rant about this. When the Hell did the NANOG list become a help desk? Why are we encouraging theses questions about configuring a Linux box to be a router and how to get Cisco IOS to make coffee? I thought that this list was for OPERATIONAL content and not to answer HOW TO questions about home networks. There are other lists for that. I have configuration questions too, but that's what Google is for, not NANOG. I would like to propose that people DO NOT reply to these posts, or if they want to help take it off list. -- BillT(a)Mahagonny.com - PGP KeyID#: 0xFB966670 "Crappy old OSes have value in the basically negative sense that changing to new ones makes us wish we'd never been born." -Neal Stephenson 1999

3 2

Fibre cut in the DC area
by Thomas Kernen 13 Feb '02

13 Feb '02

Don't have much details to provide (yet) but I understand that there is a major fibre cut in the DC area that is affecting multiple carriers. Thomas

1 1

Re: it's here
by Eric Brandwine 13 Feb '02

13 Feb '02

>>>>> "js" == Jesper Skriver <jesper(a)skriver.dk> writes: js> On Wed, Feb 13, 2002 at 03:55:25PM +0000, Eric Brandwine wrote: >> Without control plane seperation (and it's not possible with Cisco, >> Juniper, or most other routers out there), management services are >> listening on the public network, and that makes this very scary, >> regardless of filtering policies, etc. js> interfaces { ... js> } js> firewall { ... js> } OK, but that's filtering. The telnet/ssh/snmp daemon is still listening on all interfaces. You can't get there, as long as your filter stands, but those are some hard filters to write. They're simple when they're simple, but they're very complex when they're not. You're relying on your filters, rather than on proper configuration of the daemon. On a UNIX system, you can bind a service to all interfaces (e.g. *.161) or just to a specific interface (10.1.2.3:161). This should be possible in general, on all routers. We HAVE an OOB management network. This is where all our console servers, switches (there is no Ethernet in the backbone, don't shove VLANs at me), etc all live. This address space is not routed to you. We like this. There's no cost issues, we've already paid for it, and need it for our layer 1/2 network anyway. But then you plug an IP port on the router (vs. a console port) into the mgmt net, and you've bridged the public net and the mgmt net. Virtual routers are capable of maintaining multiple routing tables, but last I checked, Juniper was not. So how do you route this? I send an SNMP query to the device. It comes in over the mgmt net (because for me, in my datacenter, the loopback for that device (or it's mgmt IP) is routed across the mgmt net). The device recieves, digests, and decides to respond to this query. Where does it send it? My datacenter is routed on the internet, so does it send it out the public interface? Or do I route my datacenter over the mgmt net? You can start filtering, but then those filters are suddenly very important, crucial to the proper operation of the network. Better not fat finger anything. Ever. Or do I move all my backbone facing datacenters into a network that is not routed on the Internet, but only on the mgmt net? That has it's own host of problems. And you still have to convince the router not to propagate routes that it learns from the mgmt net into the public network. This can be done with filters, but when you have a global mgmt network spread over many netblocks, regions, etc, it's ugly. The router needs to act as a router to the public network. But it needs to act as a host (with only 1 interface) to the mgmt net. This is not how current routers work. Been there, done that, it's not that simple. ericb -- Eric Brandwine | Put your hand on a hot stove for a minute and it seems UUNetwork Security | like an hour, sit next to a pretty woman for and hour ericb(a)uu.net | and it seems like a minute. That's relativity. +1 703 886 6038 | - Albert Einstein Key fingerprint = 3A39 2C2F D5A0 FC7C 5F60 4118 A84A BD5D 59D7 4E3E

3 2

Re: it's here
by Eric Brandwine 13 Feb '02

13 Feb '02

>>>>> "rds" == Ron da Silva <ron(a)aol.net> writes: >> >> http://www.cert.org/advisories/CA-2002-03.html >> sd> ASN.1 is pretty cool, but I've been wondering are there that sd> many ISPs which allow external SNMP access to their equipment? sd> SNMP is a UDP management protocol, and even under the best of sd> conditions, accepting packets from out of the blue isn't a good sd> idea. >> Spoofed packets? >> It's not feasible to filter antispoof at OC-12 or OC-48 line rate on >> all customer facing interfaces. rds> But it should be not only feasible, but standard practice. It's impossible using most high bandwidth gear that's out there. At these speeds, you can either route the bits, or look at them, but not both. Juniper is the one vendor that's given us packet inspection abilities that scale with bandwidth. We have non-Juniper routers. Please, tell your vendors you want line-rate filtering up to layer 4. We're tired of being told "But you're the only ones that ask for this". Without control plane seperation (and it's not possible with Cisco, Juniper, or most other routers out there), management services are listening on the public network, and that makes this very scary, regardless of filtering policies, etc. ericb -- Eric Brandwine | "Intel Inside" is a Government Warning requied by Law. UUNetwork Security | ericb(a)uu.net | +1 703 886 6038 | - Usenet Key fingerprint = 3A39 2C2F D5A0 FC7C 5F60 4118 A84A BD5D 59D7 4E3E

9 8

Clueful help from someone Genuity needed
by Arman 13 Feb '02

13 Feb '02

Genuity has "Assigned" a block to my client (an ISP) instead of "Allocating" it. I am having problem getting through to someone at Genuity to fix this issue. If you are from Genuity and understand how SWIPs/ARIN work please email off-line. ak

1 0

Re: it's here
by Eric Brandwine 13 Feb '02

13 Feb '02

>>>>> "th" == Tony Hain <alh-ietf(a)tndh.net> writes: th> Eric Brandwine wrote: >> Please, tell your vendors you want line-rate filtering up to layer 4. th> And when you do so, be prepared to pay what it will cost to deliver th> that. Absolutely! And it'll be well worth it too. The up-front cost is higher, but economy of scale will bring it down. Having routers that can protect themselves, protect devices behind them, track attacks, and provide vastly improved visibility into your network will pay for itself quickly. Imagine, a router that cannot be knocked over! I have this argument with Chris any my management all the time. Up through layer 4, headers are well defined, bit fields, 16/32 bit ints, etc. Filtering at this point is just making a decision to do so, and designing it into hardware. Juniper did it from the beginning (mostly), and does it well. More recent Cisco GSR line cards (Engine 4, etc) come close. It's just another ASIC. Filtering past layer 5 is open to argument, that's a much harder job, but up till 4, it's almost free. When we installed CF chips in all our M40s, the amount of extra information that we gained about our network was amazing. We regularly see multi-gigabit attack flows in the network, and are now able to mitigate/filter/track them. It's a good thing, and with general purpose filtering capabilities, you're always finding new uses for them. ericb -- Eric Brandwine | Doing what little one can to increase the general stock UUNetwork Security | of knowledge is as respectable an object of life, as one ericb(a)uu.net | can in any likelihood pursue. +1 703 886 6038 | - Charles Darwin Key fingerprint = 3A39 2C2F D5A0 FC7C 5F60 4118 A84A BD5D 59D7 4E3E

1 0

RE: port 139 scans?
by Steve Smith 13 Feb '02

13 Feb '02

There is a new trojan called ANTZ that scans this port. We have seen a ton of these. -----Original Message----- From: Jasper Wallace [mailto:jasper@ivision.co.uk] Sent: Wednesday, February 13, 2002 5:38 AM To: nanog(a)merit.edu Subject: port 139 scans? Is anyone else seing lots of packets being thrown at port 139? We're getting 5 or 6 packets a sec, mostly from 80.0.0.0/8 (and all tcp syn's). -- Internet Vision Internet Consultancy Tel: 020 7589 4500 60 Albert Court & Web development Fax: 020 7589 4522 Prince Consort Road vision(a)ivision.co.uk London SW7 2BE http://www.ivision.co.uk/

1 0